@vellumai/assistant 0.5.11 → 0.5.12

package/src/__tests__/host-file-proxy.test.ts

@@ -184,6 +184,32 @@ describe("HostFileProxy", () => {
       expect(proxy.hasPendingRequest(requestId)).toBe(false);
     });
 
+    test("sends host_file_cancel to client on abort", async () => {
+      setup();
+
+      const controller = new AbortController();
+      const resultPromise = proxy.request(
+        {
+          operation: "read",
+          path: "/tmp/test.txt",
+        },
+        "session-1",
+        controller.signal,
+      );
+
+      const sent = sentMessages[0] as Record<string, unknown>;
+      const requestId = sent.requestId as string;
+
+      controller.abort();
+      await resultPromise;
+
+      // Second message should be the cancel
+      expect(sentMessages).toHaveLength(2);
+      const cancelMsg = sentMessages[1] as Record<string, unknown>;
+      expect(cancelMsg.type).toBe("host_file_cancel");
+      expect(cancelMsg.requestId).toBe(requestId);
+    });
+
     test("returns immediately if signal already aborted", async () => {
       setup();
 
@@ -247,6 +273,69 @@ describe("HostFileProxy", () => {
       expect(proxy.hasPendingRequest(requestId)).toBe(false);
       expect(resultPromise).rejects.toThrow("Host file proxy disposed");
     });
+
+    test("sends host_file_cancel for each pending request on dispose", () => {
+      setup();
+
+      const p1 = proxy.request(
+        { operation: "read", path: "/tmp/a.txt" },
+        "session-1",
+      );
+      const p2 = proxy.request(
+        { operation: "read", path: "/tmp/b.txt" },
+        "session-1",
+      );
+      p1.catch(() => {}); // Expected rejection on dispose
+      p2.catch(() => {}); // Expected rejection on dispose
+
+      const requestIds = (sentMessages as Array<Record<string, unknown>>).map(
+        (m) => m.requestId as string,
+      );
+      expect(requestIds).toHaveLength(2);
+
+      proxy.dispose();
+
+      // After the 2 request messages, dispose should have sent 2 cancel messages
+      const cancelMessages = sentMessages
+        .slice(2)
+        .filter(
+          (m) => (m as Record<string, unknown>).type === "host_file_cancel",
+        ) as Array<Record<string, unknown>>;
+      expect(cancelMessages).toHaveLength(2);
+      expect(cancelMessages.map((m) => m.requestId)).toContain(requestIds[0]);
+      expect(cancelMessages.map((m) => m.requestId)).toContain(requestIds[1]);
+    });
+  });
+
+  describe("late resolve after abort", () => {
+    test("resolve is a no-op after abort (entry already deleted)", async () => {
+      setup();
+
+      const controller = new AbortController();
+      const resultPromise = proxy.request(
+        {
+          operation: "read",
+          path: "/tmp/test.txt",
+        },
+        "session-1",
+        controller.signal,
+      );
+
+      const sent = sentMessages[0] as Record<string, unknown>;
+      const requestId = sent.requestId as string;
+
+      controller.abort();
+      const result = await resultPromise;
+      expect(result.content).toBe("Aborted");
+
+      // Late resolve should be silently ignored (no throw, no double-resolve)
+      proxy.resolve(requestId, {
+        content: "late response",
+        isError: false,
+      });
+
+      expect(proxy.hasPendingRequest(requestId)).toBe(false);
+    });
   });
 
   describe("updateSender", () => {

package/src/__tests__/integration-status.test.ts

@@ -56,8 +56,8 @@ describe("integration-status", () => {
     });
 
     test("returns all connected when all keys are set", async () => {
-      setOAuthConnected("integration:google");
-      setOAuthConnected("integration:slack");
+      setOAuthConnected("google");
+      setOAuthConnected("slack");
       mockTwilioAccountSid = "sid";
       secureKeyValues.set(credentialKey("twilio", "auth_token"), "auth");
       setOAuthConnected("telegram");
@@ -129,8 +129,8 @@ describe("integration-status", () => {
     });
 
     test("all connected", async () => {
-      setOAuthConnected("integration:google");
-      setOAuthConnected("integration:slack");
+      setOAuthConnected("google");
+      setOAuthConnected("slack");
       mockTwilioAccountSid = "sid";
       secureKeyValues.set(credentialKey("twilio", "auth_token"), "auth");
       setOAuthConnected("telegram");
@@ -163,7 +163,7 @@ describe("integration-status", () => {
     });
 
     test("email category checks Gmail", async () => {
-      setOAuthConnected("integration:google");
+      setOAuthConnected("google");
       expect(await hasCapability("email")).toBe(true);
     });
   });

package/src/__tests__/list-messages-attachments.test.ts

@@ -286,3 +286,174 @@ describe("handleListMessages no_response filtering", () => {
     expect(body.messages[0].content).toBe("What does <no_response/> do?");
   });
 });
+
+// ---------------------------------------------------------------------------
+// Pagination
+// ---------------------------------------------------------------------------
+
+interface PaginatedResponse {
+  messages: { id: string; content: string; timestamp: string }[];
+  hasMore?: boolean;
+  oldestTimestamp?: number;
+  oldestMessageId?: string;
+}
+
+function createPaginatedUrl(
+  conversationId: string,
+  params?: { limit?: string; beforeTimestamp?: string },
+): URL {
+  const url = new URL(
+    `http://localhost/v1/messages?conversationId=${conversationId}`,
+  );
+  if (params?.limit !== undefined) url.searchParams.set("limit", params.limit);
+  if (params?.beforeTimestamp !== undefined)
+    url.searchParams.set("beforeTimestamp", params.beforeTimestamp);
+  return url;
+}
+
+/** Helper: insert N messages with distinct, increasing timestamps and return them in insertion order. */
+async function insertMessages(
+  conversationId: string,
+  count: number,
+): Promise<{ id: string; createdAt: number }[]> {
+  const msgs: { id: string; createdAt: number }[] = [];
+  for (let i = 0; i < count; i++) {
+    const msg = await addMessage(
+      conversationId,
+      i % 2 === 0 ? "user" : "assistant",
+      JSON.stringify([{ type: "text", text: `msg-${i}` }]),
+    );
+    msgs.push({ id: msg.id, createdAt: msg.createdAt });
+  }
+  return msgs;
+}
+
+describe("handleListMessages pagination", () => {
+  beforeEach(resetTables);
+
+  test("no params → all messages, no hasMore field", async () => {
+    const conv = createConversation();
+    await insertMessages(conv.id, 5);
+
+    const response = handleListMessages(createTestUrl(conv.id), null);
+    const body = (await response.json()) as PaginatedResponse;
+
+    expect(body.messages).toHaveLength(5);
+    expect(body.hasMore).toBeUndefined();
+    expect(body.oldestTimestamp).toBeUndefined();
+    expect(body.oldestMessageId).toBeUndefined();
+  });
+
+  test("limit only (no beforeTimestamp) → all messages, no hasMore", async () => {
+    const conv = createConversation();
+    await insertMessages(conv.id, 5);
+
+    const url = createPaginatedUrl(conv.id, { limit: "3" });
+    const response = handleListMessages(url, null);
+    const body = (await response.json()) as PaginatedResponse;
+
+    // Option A: without beforeTimestamp, all messages are returned regardless of limit
+    expect(body.messages).toHaveLength(5);
+    expect(body.hasMore).toBeUndefined();
+  });
+
+  test("beforeTimestamp + limit → correct page with hasMore: true", async () => {
+    const conv = createConversation();
+    const msgs = await insertMessages(conv.id, 10);
+
+    // Cursor is message[7]'s timestamp; limit=3 → should return messages [4,5,6]
+    const url = createPaginatedUrl(conv.id, {
+      beforeTimestamp: String(msgs[7].createdAt),
+      limit: "3",
+    });
+    const response = handleListMessages(url, null);
+    const body = (await response.json()) as PaginatedResponse;
+
+    expect(body.messages).toHaveLength(3);
+    expect(body.messages.map((m) => m.id)).toEqual([
+      msgs[4].id,
+      msgs[5].id,
+      msgs[6].id,
+    ]);
+    expect(body.hasMore).toBe(true);
+  });
+
+  test("beforeTimestamp is strictly exclusive", async () => {
+    const conv = createConversation();
+    const msgs = await insertMessages(conv.id, 3);
+
+    // Use message[1]'s exact timestamp as cursor — message[1] should NOT appear
+    const url = createPaginatedUrl(conv.id, {
+      beforeTimestamp: String(msgs[1].createdAt),
+      limit: "10",
+    });
+    const response = handleListMessages(url, null);
+    const body = (await response.json()) as PaginatedResponse;
+
+    const ids = body.messages.map((m) => m.id);
+    expect(ids).toContain(msgs[0].id);
+    expect(ids).not.toContain(msgs[1].id);
+    expect(ids).not.toContain(msgs[2].id);
+  });
+
+  test("hasMore: false when all older messages fit", async () => {
+    const conv = createConversation();
+    const msgs = await insertMessages(conv.id, 5);
+
+    // beforeTimestamp beyond the last message, limit larger than total count
+    const url = createPaginatedUrl(conv.id, {
+      beforeTimestamp: String(msgs[4].createdAt + 1),
+      limit: "10",
+    });
+    const response = handleListMessages(url, null);
+    const body = (await response.json()) as PaginatedResponse;
+
+    expect(body.messages).toHaveLength(5);
+    expect(body.hasMore).toBe(false);
+  });
+
+  test("oldestTimestamp and oldestMessageId match oldest returned message", async () => {
+    const conv = createConversation();
+    const msgs = await insertMessages(conv.id, 5);
+
+    // Fetch last 3 messages before a cursor past the end
+    const url = createPaginatedUrl(conv.id, {
+      beforeTimestamp: String(msgs[4].createdAt + 1),
+      limit: "3",
+    });
+    const response = handleListMessages(url, null);
+    const body = (await response.json()) as PaginatedResponse;
+
+    expect(body.messages).toHaveLength(3);
+    // Oldest returned message is msgs[2] (messages [2,3,4])
+    expect(body.oldestTimestamp).toBe(msgs[2].createdAt);
+    expect(body.oldestMessageId).toBe(msgs[2].id);
+  });
+
+  test("empty / nonexistent conversation → empty messages, no pagination metadata", async () => {
+    const url = createPaginatedUrl("nonexistent-conv-id");
+    const response = handleListMessages(url, null);
+    const body = (await response.json()) as PaginatedResponse;
+
+    expect(body.messages).toEqual([]);
+    expect(body.hasMore).toBeUndefined();
+    expect(body.oldestTimestamp).toBeUndefined();
+    expect(body.oldestMessageId).toBeUndefined();
+  });
+
+  test("invalid limit (NaN) → 400", async () => {
+    const conv = createConversation();
+    const url = createPaginatedUrl(conv.id, { limit: "abc" });
+    const response = handleListMessages(url, null);
+
+    expect(response.status).toBe(400);
+  });
+
+  test("invalid beforeTimestamp (NaN) → 400", async () => {
+    const conv = createConversation();
+    const url = createPaginatedUrl(conv.id, { beforeTimestamp: "abc" });
+    const response = handleListMessages(url, null);
+
+    expect(response.status).toBe(400);
+  });
+});

package/src/__tests__/mcp-abort-signal.test.ts

@@ -0,0 +1,205 @@
+import { describe, expect, jest, mock, test } from "bun:test";
+
+// Mock secure-keys so McpOAuthProvider doesn't try to access the credential store
+mock.module("../security/secure-keys.js", () => ({
+  getSecureKeyAsync: jest.fn().mockResolvedValue(null),
+  setSecureKeyAsync: jest.fn().mockResolvedValue(true),
+  deleteSecureKeyAsync: jest.fn().mockResolvedValue("deleted"),
+}));
+
+const { McpClient } = await import("../mcp/client.js");
+const { McpServerManager } = await import("../mcp/manager.js");
+const { createMcpTool } = await import("../tools/mcp/mcp-tool-factory.js");
+
+describe("MCP AbortSignal threading", () => {
+  describe("McpClient.callTool", () => {
+    test("forwards signal to the SDK client.callTool options", async () => {
+      const client = new McpClient("test-server");
+
+      const callToolSpy = jest.fn().mockResolvedValue({
+        content: [{ type: "text", text: "ok" }],
+        isError: false,
+      });
+
+      // Monkey-patch to mark as connected and capture callTool args
+      (client as any).connected = true;
+      (client as any).client = { callTool: callToolSpy };
+
+      const ac = new AbortController();
+      await client.callTool("my-tool", { foo: "bar" }, ac.signal);
+
+      expect(callToolSpy).toHaveBeenCalledTimes(1);
+      const [params, resultSchema, options] = callToolSpy.mock.calls[0];
+      expect(params).toEqual({ name: "my-tool", arguments: { foo: "bar" } });
+      expect(resultSchema).toBeUndefined();
+      expect(options).toEqual({ signal: ac.signal });
+    });
+
+    test("passes undefined signal cleanly (no regression)", async () => {
+      const client = new McpClient("test-server");
+
+      const callToolSpy = jest.fn().mockResolvedValue({
+        content: [{ type: "text", text: "ok" }],
+        isError: false,
+      });
+
+      (client as any).connected = true;
+      (client as any).client = { callTool: callToolSpy };
+
+      await client.callTool("my-tool", { foo: "bar" });
+
+      expect(callToolSpy).toHaveBeenCalledTimes(1);
+      const [_params, _resultSchema, options] = callToolSpy.mock.calls[0];
+      expect(options).toBeUndefined();
+    });
+
+    test("already-aborted signal causes the SDK call to reject", async () => {
+      const client = new McpClient("test-server");
+
+      const callToolSpy = jest
+        .fn()
+        .mockImplementation((_p: any, _r: any, opts: any) => {
+          if (opts?.signal?.aborted) {
+            return Promise.reject(
+              new DOMException("The operation was aborted.", "AbortError"),
+            );
+          }
+          return Promise.resolve({
+            content: [{ type: "text", text: "ok" }],
+            isError: false,
+          });
+        });
+
+      (client as any).connected = true;
+      (client as any).client = { callTool: callToolSpy };
+
+      const ac = new AbortController();
+      ac.abort();
+
+      await expect(client.callTool("my-tool", {}, ac.signal)).rejects.toThrow(
+        "The operation was aborted.",
+      );
+    });
+  });
+
+  describe("McpServerManager.callTool", () => {
+    test("forwards signal to the underlying McpClient.callTool", async () => {
+      const manager = new McpServerManager();
+
+      const callToolSpy = jest.fn().mockResolvedValue({
+        content: "result",
+        isError: false,
+      });
+
+      const fakeClient = { callTool: callToolSpy, serverId: "test-server" };
+      (manager as any).clients.set("test-server", fakeClient);
+
+      const ac = new AbortController();
+      await manager.callTool("test-server", "my-tool", { x: 1 }, ac.signal);
+
+      expect(callToolSpy).toHaveBeenCalledWith("my-tool", { x: 1 }, ac.signal);
+    });
+
+    test("passes undefined signal when not provided", async () => {
+      const manager = new McpServerManager();
+
+      const callToolSpy = jest.fn().mockResolvedValue({
+        content: "result",
+        isError: false,
+      });
+
+      const fakeClient = { callTool: callToolSpy, serverId: "test-server" };
+      (manager as any).clients.set("test-server", fakeClient);
+
+      await manager.callTool("test-server", "my-tool", { x: 1 });
+
+      expect(callToolSpy).toHaveBeenCalledWith("my-tool", { x: 1 }, undefined);
+    });
+  });
+
+  describe("createMcpTool execute", () => {
+    test("threads context.signal through manager.callTool", async () => {
+      const callToolSpy = jest.fn().mockResolvedValue({
+        content: "tool result",
+        isError: false,
+      });
+
+      const fakeManager = { callTool: callToolSpy } as any;
+
+      const tool = createMcpTool(
+        {
+          name: "my-tool",
+          description: "A test tool",
+          inputSchema: { type: "object", properties: {} },
+        },
+        "test-server",
+        {
+          transport: { type: "stdio", command: "echo", args: [] },
+          enabled: true,
+          defaultRiskLevel: "high",
+          maxTools: 100,
+        },
+        fakeManager,
+      );
+
+      const ac = new AbortController();
+      await tool.execute(
+        { someArg: "value" },
+        {
+          workingDir: "/tmp",
+          conversationId: "conv-1",
+          signal: ac.signal,
+          trustClass: "guardian",
+        },
+      );
+
+      expect(callToolSpy).toHaveBeenCalledWith(
+        "test-server",
+        "my-tool",
+        { someArg: "value" },
+        ac.signal,
+      );
+    });
+
+    test("passes undefined signal when context has no signal", async () => {
+      const callToolSpy = jest.fn().mockResolvedValue({
+        content: "tool result",
+        isError: false,
+      });
+
+      const fakeManager = { callTool: callToolSpy } as any;
+
+      const tool = createMcpTool(
+        {
+          name: "my-tool",
+          description: "A test tool",
+          inputSchema: { type: "object", properties: {} },
+        },
+        "test-server",
+        {
+          transport: { type: "stdio", command: "echo", args: [] },
+          enabled: true,
+          defaultRiskLevel: "high",
+          maxTools: 100,
+        },
+        fakeManager,
+      );
+
+      await tool.execute(
+        { someArg: "value" },
+        {
+          workingDir: "/tmp",
+          conversationId: "conv-1",
+          trustClass: "guardian",
+        },
+      );
+
+      expect(callToolSpy).toHaveBeenCalledWith(
+        "test-server",
+        "my-tool",
+        { someArg: "value" },
+        undefined,
+      );
+    });
+  });
+});

package/src/__tests__/messaging-send-tool.test.ts

@@ -24,16 +24,16 @@ const provider: MessagingProvider = {
   getHistory: async () => [],
   search: async () => ({ total: 0, messages: [], hasMore: false }),
   sendMessage: (
-    connectionOrToken: OAuthConnection | string,
+    connection: OAuthConnection | undefined,
     conversationId: string,
     text: string,
     options?: SendOptions,
-  ) => sendMessageMock(connectionOrToken, conversationId, text, options),
+  ) => sendMessageMock(connection, conversationId, text, options),
 };
 
 mock.module("../config/bundled-skills/messaging/tools/shared.js", () => ({
   resolveProvider: () => provider,
-  getProviderConnection: () => "provider-token",
+  getProviderConnection: () => undefined,
   ok: (content: string) => ({ content, isError: false }),
   err: (content: string) => ({ content, isError: true }),
   extractHeader: () => "",
@@ -65,7 +65,7 @@ describe("messaging-send tool", () => {
 
     expect(result.isError).toBe(false);
     expect(sendMessageMock).toHaveBeenCalledWith(
-      "provider-token",
+      undefined,
       "+15550004444",
       "test message",
       {
@@ -95,7 +95,7 @@ describe("messaging-send tool", () => {
 
     expect(result.isError).toBe(false);
     expect(sendMessageMock).toHaveBeenCalledWith(
-      "provider-token",
+      undefined,
       "conv-1",
       "reply text",
       {

package/src/__tests__/notification-telegram-adapter.test.ts

@@ -6,6 +6,9 @@ const deliveryCalls: Array<{
   bearerToken?: string;
 }> = [];
 
+/** When true, deliverChannelReply throws if the payload contains an approval field. */
+let rejectRichDelivery = false;
+
 mock.module("../config/env.js", () => ({
   isHttpAuthDisabled: () => true,
   getGatewayInternalBaseUrl: () => "http://gateway.internal",
@@ -17,6 +20,9 @@ mock.module("../runtime/gateway-client.js", () => ({
     payload: Record<string, unknown>,
     bearerToken?: string,
   ) => {
+    if (rejectRichDelivery && payload.approval) {
+      throw new Error("Telegram API error: buttons not supported");
+    }
     deliveryCalls.push({ url, payload, bearerToken });
   },
 }));
@@ -60,6 +66,7 @@ function makeDestination(
 describe("TelegramAdapter", () => {
   beforeEach(() => {
     deliveryCalls.length = 0;
+    rejectRichDelivery = false;
   });
 
   test("prefers deliveryText and does not append deterministic label", async () => {
@@ -156,4 +163,122 @@ describe("TelegramAdapter", () => {
     );
     expect(deliveryCalls[2]?.payload.text).toBe("watcher escalation");
   });
+
+  // ── Access request inline keyboard tests ──────────────────────────────
+
+  test("includes approval payload with inline buttons for access requests", async () => {
+    const adapter = new TelegramAdapter();
+    const payload = makePayload({
+      sourceEventName: "ingress.access_request",
+      copy: {
+        title: "Access Request",
+        body: "Someone is requesting access.",
+        deliveryText: "Someone is requesting access to the assistant.",
+      },
+      contextPayload: {
+        requestId: "req-abc-123",
+        requestCode: "XYZW",
+        senderIdentifier: "Marina",
+        sourceChannel: "telegram",
+      },
+    });
+
+    const result = await adapter.send(payload, makeDestination());
+
+    expect(result.success).toBe(true);
+    expect(deliveryCalls).toHaveLength(1);
+
+    const call = deliveryCalls[0]!;
+    expect(call.payload.text).toBe(
+      "Someone is requesting access to the assistant.",
+    );
+
+    const approval = call.payload.approval as {
+      requestId: string;
+      actions: Array<{ id: string; label: string }>;
+      plainTextFallback: string;
+    };
+    expect(approval).toBeDefined();
+    expect(approval.requestId).toBe("req-abc-123");
+    expect(approval.actions).toHaveLength(2);
+    expect(approval.actions[0]).toEqual({
+      id: "approve_once",
+      label: "Approve once",
+    });
+    expect(approval.actions[1]).toEqual({ id: "reject", label: "Reject" });
+    expect(approval.plainTextFallback).toContain("XYZW");
+  });
+
+  test("sends plain text without approval when contextPayload is missing", async () => {
+    const adapter = new TelegramAdapter();
+    const payload = makePayload({
+      sourceEventName: "ingress.access_request",
+      copy: {
+        title: "Access Request",
+        body: "Someone is requesting access.",
+      },
+    });
+
+    const result = await adapter.send(payload, makeDestination());
+
+    expect(result.success).toBe(true);
+    expect(deliveryCalls).toHaveLength(1);
+    expect(deliveryCalls[0]?.payload.approval).toBeUndefined();
+  });
+
+  test("sends plain text without approval when requestId is missing from contextPayload", async () => {
+    const adapter = new TelegramAdapter();
+    const payload = makePayload({
+      sourceEventName: "ingress.access_request",
+      copy: {
+        title: "Access Request",
+        body: "Someone is requesting access.",
+      },
+      contextPayload: {
+        senderIdentifier: "Marina",
+        sourceChannel: "telegram",
+        // no requestId
+      },
+    });
+
+    const result = await adapter.send(payload, makeDestination());
+
+    expect(result.success).toBe(true);
+    expect(deliveryCalls).toHaveLength(1);
+    expect(deliveryCalls[0]?.payload.approval).toBeUndefined();
+  });
+
+  test("falls back to plain text with instructions when rich delivery fails", async () => {
+    rejectRichDelivery = true;
+
+    const adapter = new TelegramAdapter();
+    const payload = makePayload({
+      sourceEventName: "ingress.access_request",
+      copy: {
+        title: "Access Request",
+        body: "Someone is requesting access.",
+        deliveryText: "Someone is requesting access to the assistant.",
+      },
+      contextPayload: {
+        requestId: "req-abc-123",
+        requestCode: "XYZW",
+        senderIdentifier: "Marina",
+        sourceChannel: "telegram",
+      },
+    });
+
+    const result = await adapter.send(payload, makeDestination());
+
+    expect(result.success).toBe(true);
+    // Rich delivery threw, so only the plain-text fallback should be recorded.
+    expect(deliveryCalls).toHaveLength(1);
+    const call = deliveryCalls[0]!;
+    // No approval payload in the fallback delivery.
+    expect(call.payload.approval).toBeUndefined();
+    // The fallback text should include the original message AND the
+    // typed-command instructions from plainTextFallback.
+    const text = call.payload.text as string;
+    expect(text).toContain("Someone is requesting access to the assistant.");
+    expect(text).toContain("XYZW");
+  });
 });