@vellumai/assistant 0.5.11 → 0.5.13

package/src/__tests__/credential-security-invariants.test.ts

@@ -483,13 +483,9 @@ describe("Invariant 6: oauth2ClientSecret not in metadata, only in secure store"
   });
 
   test("upsertCredentialMetadata does not accept oauth2ClientSecret or other OAuth fields", () => {
-    const record = upsertCredentialMetadata(
-      "integration:google",
-      "access_token",
-      {
-        allowedTools: ["api_request"],
-      },
-    );
+    const record = upsertCredentialMetadata("google", "access_token", {
+      allowedTools: ["api_request"],
+    });
     expect("oauth2ClientSecret" in record).toBe(false);
     expect("oauth2TokenUrl" in record).toBe(false);
     expect("oauth2ClientId" in record).toBe(false);
@@ -497,14 +493,14 @@ describe("Invariant 6: oauth2ClientSecret not in metadata, only in secure store"
 
   test("client secret is read from secure store, not metadata", async () => {
     await setSecureKeyAsync(
-      credentialKey("integration:google", "client_secret"),
+      credentialKey("google", "client_secret"),
       "my-secret",
     );
-    upsertCredentialMetadata("integration:google", "access_token", {
+    upsertCredentialMetadata("google", "access_token", {
       allowedTools: ["api_request"],
     });
 
-    const meta = getCredentialMetadata("integration:google", "access_token");
+    const meta = getCredentialMetadata("google", "access_token");
     expect(meta).toBeDefined();
     expect("oauth2ClientSecret" in meta!).toBe(false);
     // OAuth-specific fields are no longer in metadata (v5)
@@ -513,9 +509,7 @@ describe("Invariant 6: oauth2ClientSecret not in metadata, only in secure store"
 
     // Secret is in secure store
     expect(
-      await getSecureKeyAsync(
-        credentialKey("integration:google", "client_secret"),
-      ),
+      await getSecureKeyAsync(credentialKey("google", "client_secret")),
     ).toBe("my-secret");
   });
 
@@ -525,7 +519,7 @@ describe("Invariant 6: oauth2ClientSecret not in metadata, only in secure store"
       credentials: [
         {
           credentialId: "cred-v2-secret",
-          service: "integration:google",
+          service: "google",
           field: "access_token",
           allowedTools: [],
           allowedDomains: [],
@@ -543,7 +537,7 @@ describe("Invariant 6: oauth2ClientSecret not in metadata, only in secure store"
       "utf-8",
     );
 
-    const meta = getCredentialMetadata("integration:google", "access_token");
+    const meta = getCredentialMetadata("google", "access_token");
     expect(meta).toBeDefined();
     expect("oauth2ClientSecret" in meta!).toBe(false);
 

package/src/__tests__/credential-vault-unit.test.ts

@@ -755,8 +755,8 @@ describe("credential_store tool — prompt action", () => {
 describe("credential_store tool — oauth2_connect error paths", () => {
   /** Well-known provider rows returned by the mocked getProvider */
   const wellKnownProviders: Record<string, object> = {
-    "integration:google": {
-      key: "integration:google",
+    google: {
+      key: "google",
       authUrl: "https://accounts.google.com/o/oauth2/v2/auth",
       tokenUrl: "https://oauth2.googleapis.com/token",
       defaultScopes: JSON.stringify(["https://mail.google.com/"]),
@@ -764,8 +764,8 @@ describe("credential_store tool — oauth2_connect error paths", () => {
       callbackTransport: "loopback",
       loopbackPort: 8756,
     },
-    "integration:slack": {
-      key: "integration:slack",
+    slack: {
+      key: "slack",
       authUrl: "https://slack.com/oauth/v2/authorize",
       tokenUrl: "https://slack.com/api/oauth.v2.access",
       defaultScopes: JSON.stringify(["channels:read"]),
@@ -779,7 +779,7 @@ describe("credential_store tool — oauth2_connect error paths", () => {
     _setStorePath(STORE_PATH);
     _resetBackend();
     _setMetadataPath(join(TEST_DIR, "metadata.json"));
-    // Return well-known provider rows so vault.ts knows gmail/slack are
+    // Return well-known provider rows so vault.ts knows google/slack are
     // registered, and custom providers return undefined.
     mockGetProvider.mockImplementation(
       (key: string) => wellKnownProviders[key] ?? undefined,
@@ -880,22 +880,21 @@ describe("credential_store tool — oauth2_connect error paths", () => {
     expect(result.content).toContain("mock-auth-url.example.com");
   });
 
-  test("resolves gmail alias to integration:google", async () => {
-    // Even with alias resolution, missing client_id should still fail
+  test("rejects missing client_id for google", async () => {
+    // Missing client_id should fail
     const result = await credentialStoreTool.execute(
       {
         action: "oauth2_connect",
-        service: "gmail",
+        service: "google",
       },
       _ctx,
     );
     expect(result.isError).toBe(true);
-    // Should NOT require auth_url/token_url/scopes — those are well-known for gmail
     // Should fail on client_id since none is stored
     expect(result.content).toContain("client_id is required");
   });
 
-  test("resolves slack alias to integration:slack", async () => {
+  test("resolves slack to its canonical name", async () => {
     const result = await credentialStoreTool.execute(
       {
         action: "oauth2_connect",
@@ -912,13 +911,13 @@ describe("credential_store tool — oauth2_connect error paths", () => {
     // and store client_secret in the secure store.
     mockGetMostRecentAppByProvider.mockImplementation(() => ({
       id: "test-app-id",
-      providerKey: "integration:google",
+      providerKey: "google",
       clientId: "stored-client-id-123",
       clientSecretCredentialPath: "oauth_app/test-app-id/client_secret",
       createdAt: Date.now(),
     }));
     mockGetProvider.mockImplementation(() => ({
-      key: "integration:google",
+      key: "google",
       authUrl: "https://accounts.google.com/o/oauth2/v2/auth",
       tokenUrl: "https://oauth2.googleapis.com/token",
       defaultScopes: JSON.stringify(["https://mail.google.com/"]),
@@ -934,16 +933,16 @@ describe("credential_store tool — oauth2_connect error paths", () => {
     const result = await credentialStoreTool.execute(
       {
         action: "oauth2_connect",
-        service: "gmail",
+        service: "google",
       },
       { ..._ctx, isInteractive: false },
     );
 
     // Should pass client_id and client_secret checks — the flow proceeds
-    // through the channel path (gmail uses loopback transport so no
+    // through the channel path (google uses loopback transport so no
     // public ingress URL is needed) and returns the authorization URL.
     expect(result.isError).toBe(false);
-    expect(result.content).toContain("To connect gmail, open this link");
+    expect(result.content).toContain("To connect google, open this link");
     expect(result.content).not.toContain("client_id is required");
     expect(result.content).not.toContain("client_secret is required");
 
@@ -958,13 +957,10 @@ describe("credential_store tool — oauth2_connect error paths", () => {
     // most-recent-app heuristic) so the secret comes from the correct app.
     mockGetAppByProviderAndClientId.mockImplementation(
       (providerKey: string, cId: string) => {
-        if (
-          providerKey === "integration:google" &&
-          cId === "caller-supplied-client-id"
-        ) {
+        if (providerKey === "google" && cId === "caller-supplied-client-id") {
           return {
             id: "matched-app-id",
-            providerKey: "integration:google",
+            providerKey: "google",
             clientId: "caller-supplied-client-id",
             clientSecretCredentialPath:
               "oauth_app/matched-app-id/client_secret",
@@ -975,7 +971,7 @@ describe("credential_store tool — oauth2_connect error paths", () => {
       },
     );
     mockGetProvider.mockImplementation(() => ({
-      key: "integration:google",
+      key: "google",
       authUrl: "https://accounts.google.com/o/oauth2/v2/auth",
       tokenUrl: "https://oauth2.googleapis.com/token",
       defaultScopes: JSON.stringify(["https://mail.google.com/"]),
@@ -991,7 +987,7 @@ describe("credential_store tool — oauth2_connect error paths", () => {
     const result = await credentialStoreTool.execute(
       {
         action: "oauth2_connect",
-        service: "gmail",
+        service: "google",
         client_id: "caller-supplied-client-id",
       },
       { ..._ctx, isInteractive: false },
@@ -999,7 +995,7 @@ describe("credential_store tool — oauth2_connect error paths", () => {
 
     // Should succeed — client_secret resolved from the matched app
     expect(result.isError).toBe(false);
-    expect(result.content).toContain("To connect gmail, open this link");
+    expect(result.content).toContain("To connect google, open this link");
     // getMostRecentAppByProvider should NOT have been called since client_id was known
     expect(mockGetMostRecentAppByProvider).not.toHaveBeenCalled();
 
@@ -1013,13 +1009,13 @@ describe("credential_store tool — oauth2_connect error paths", () => {
     // use getMostRecentAppByProvider (the fallback heuristic).
     mockGetMostRecentAppByProvider.mockImplementation(() => ({
       id: "recent-app-id",
-      providerKey: "integration:google",
+      providerKey: "google",
       clientId: "recent-client-id",
       clientSecretCredentialPath: "oauth_app/recent-app-id/client_secret",
       createdAt: Date.now(),
     }));
     mockGetProvider.mockImplementation(() => ({
-      key: "integration:google",
+      key: "google",
       authUrl: "https://accounts.google.com/o/oauth2/v2/auth",
       tokenUrl: "https://oauth2.googleapis.com/token",
       defaultScopes: JSON.stringify(["https://mail.google.com/"]),
@@ -1035,13 +1031,13 @@ describe("credential_store tool — oauth2_connect error paths", () => {
     const result = await credentialStoreTool.execute(
       {
         action: "oauth2_connect",
-        service: "gmail",
+        service: "google",
       },
       { ..._ctx, isInteractive: false },
     );
 
     expect(result.isError).toBe(false);
-    expect(result.content).toContain("To connect gmail, open this link");
+    expect(result.content).toContain("To connect google, open this link");
     // getAppByProviderAndClientId should NOT have been called since client_id was unknown
     expect(mockGetAppByProviderAndClientId).not.toHaveBeenCalled();
 
@@ -1056,23 +1052,24 @@ describe("credential_store tool — oauth2_connect error paths", () => {
     // report the missing secret error.
     mockGetAppByProviderAndClientId.mockImplementation(() => undefined);
     mockGetProvider.mockImplementation(() => ({
-      key: "integration:google",
+      key: "google",
       authUrl: "https://accounts.google.com/o/oauth2/v2/auth",
       tokenUrl: "https://oauth2.googleapis.com/token",
       defaultScopes: JSON.stringify(["https://mail.google.com/"]),
+      requiresClientSecret: 1,
     }));
 
     const result = await credentialStoreTool.execute(
       {
         action: "oauth2_connect",
-        service: "gmail",
+        service: "google",
         client_id: "unknown-client-id",
       },
       _ctx,
     );
 
     expect(result.isError).toBe(true);
-    expect(result.content).toContain("client_secret is required for gmail");
+    expect(result.content).toContain("client_secret is required for google");
     // getMostRecentAppByProvider should NOT have been called
     expect(mockGetMostRecentAppByProvider).not.toHaveBeenCalled();
 
@@ -1087,27 +1084,28 @@ describe("credential_store tool — oauth2_connect error paths", () => {
     // guardrail.
     mockGetMostRecentAppByProvider.mockImplementation(() => ({
       id: "test-app-id-no-secret",
-      providerKey: "integration:google",
+      providerKey: "google",
       clientId: "stored-client-id-456",
       createdAt: Date.now(),
     }));
     mockGetProvider.mockImplementation(() => ({
-      key: "integration:google",
+      key: "google",
       authUrl: "https://accounts.google.com/o/oauth2/v2/auth",
       tokenUrl: "https://oauth2.googleapis.com/token",
       defaultScopes: JSON.stringify(["https://mail.google.com/"]),
+      requiresClientSecret: 1,
     }));
 
     const result = await credentialStoreTool.execute(
       {
         action: "oauth2_connect",
-        service: "gmail",
+        service: "google",
       },
       _ctx,
     );
 
     expect(result.isError).toBe(true);
-    expect(result.content).toContain("client_secret is required for gmail");
+    expect(result.content).toContain("client_secret is required for google");
 
     // Reset mocks
     mockGetMostRecentAppByProvider.mockImplementation(() => undefined);

package/src/__tests__/credential-vault.test.ts

@@ -736,7 +736,7 @@ describe("credential_store tool", () => {
       await credentialStoreTool.execute(
         {
           action: "store",
-          service: "integration:google",
+          service: "google",
           field: "api_key",
           value: "test-value",
         },
@@ -744,9 +744,9 @@ describe("credential_store tool", () => {
       );
 
       // Simulate an active OAuth connection for this service
-      mockConnections.set("integration:google", {
+      mockConnections.set("google", {
         id: "conn-gmail",
-        providerKey: "integration:google",
+        providerKey: "google",
         oauthAppId: "app-gmail",
         expiresAt: Date.now() + 3600_000,
       });
@@ -754,7 +754,7 @@ describe("credential_store tool", () => {
       const result = await credentialStoreTool.execute(
         {
           action: "delete",
-          service: "integration:google",
+          service: "google",
           field: "api_key",
         },
         _ctx,
@@ -764,9 +764,7 @@ describe("credential_store tool", () => {
       expect(result.content).toContain("Deleted credential");
       // Verify disconnectOAuthProvider was called with the service name
       expect(mockDisconnectOAuthProvider).toHaveBeenCalledTimes(1);
-      expect(mockDisconnectOAuthProvider).toHaveBeenCalledWith(
-        "integration:google",
-      );
+      expect(mockDisconnectOAuthProvider).toHaveBeenCalledWith("google");
     });
   });
 
@@ -1354,7 +1352,7 @@ describe("withValidToken refresh deduplication", () => {
   }
 
   test("3 concurrent 401 refreshes for the same service call doRefresh exactly once", async () => {
-    await setupService("integration:google");
+    await setupService("google");
 
     let resolveRefresh!: (value: {
       accessToken: string;
@@ -1378,9 +1376,9 @@ describe("withValidToken refresh deduplication", () => {
 
     // Launch 3 concurrent withValidToken calls — all will get a non-expired
     // token first, call the callback, get a 401, and then try to refresh.
-    const p1 = withValidToken("integration:google", callback);
-    const p2 = withValidToken("integration:google", callback);
-    const p3 = withValidToken("integration:google", callback);
+    const p1 = withValidToken("google", callback);
+    const p2 = withValidToken("google", callback);
+    const p3 = withValidToken("google", callback);
 
     // Let the event loop tick so all 3 calls enter the 401 retry path
     await new Promise((r) => setTimeout(r, 10));
@@ -1402,8 +1400,8 @@ describe("withValidToken refresh deduplication", () => {
   });
 
   test("concurrent refreshes for different services proceed independently", async () => {
-    await setupService("integration:google");
-    await setupService("integration:slack");
+    await setupService("google");
+    await setupService("slack");
 
     let resolveGmail!: (value: {
       accessToken: string;
@@ -1447,8 +1445,8 @@ describe("withValidToken refresh deduplication", () => {
       return `slack-${token}`;
     };
 
-    const p1 = withValidToken("integration:google", gmailCallback);
-    const p2 = withValidToken("integration:slack", slackCallback);
+    const p1 = withValidToken("google", gmailCallback);
+    const p2 = withValidToken("slack", slackCallback);
 
     await new Promise((r) => setTimeout(r, 10));
 
@@ -1466,7 +1464,7 @@ describe("withValidToken refresh deduplication", () => {
   });
 
   test("deduplication cleans up after refresh completes, allowing subsequent refreshes", async () => {
-    await setupService("integration:google");
+    await setupService("google");
 
     let refreshCount = 0;
     mockRefreshOAuth2Token.mockImplementation(() => {
@@ -1480,25 +1478,19 @@ describe("withValidToken refresh deduplication", () => {
     const err401 = Object.assign(new Error("Unauthorized"), { status: 401 });
 
     // First call triggers a refresh (old token → 401 → refresh → token-1)
-    const r1 = await withValidToken(
-      "integration:google",
-      async (token: string) => {
-        if (token !== "token-1") throw err401;
-        return token;
-      },
-    );
+    const r1 = await withValidToken("google", async (token: string) => {
+      if (token !== "token-1") throw err401;
+      return token;
+    });
     expect(r1).toBe("token-1");
     expect(refreshCount).toBe(1);
 
     // Second call also triggers a 401 to verify dedup state was cleaned up
     // and a new refresh is allowed (not deduplicated with the first).
-    const r2 = await withValidToken(
-      "integration:google",
-      async (token: string) => {
-        if (token !== "token-2") throw err401;
-        return token;
-      },
-    );
+    const r2 = await withValidToken("google", async (token: string) => {
+      if (token !== "token-2") throw err401;
+      return token;
+    });
     expect(r2).toBe("token-2");
     // Second refresh should have happened (not deduplicated with the first,
     // since the first already completed)
@@ -1506,7 +1498,7 @@ describe("withValidToken refresh deduplication", () => {
   });
 
   test("deduplication propagates refresh errors to all waiting callers", async () => {
-    await setupService("integration:google");
+    await setupService("google");
 
     mockRefreshOAuth2Token.mockImplementation(() =>
       Promise.reject(
@@ -1524,8 +1516,8 @@ describe("withValidToken refresh deduplication", () => {
     };
 
     // Launch 2 concurrent calls — both should fail with the same error
-    const p1 = withValidToken("integration:google", callback);
-    const p2 = withValidToken("integration:google", callback);
+    const p1 = withValidToken("google", callback);
+    const p2 = withValidToken("google", callback);
 
     const results = await Promise.allSettled([p1, p2]);
 

package/src/__tests__/credentials-cli.test.ts

@@ -1059,7 +1059,7 @@ describe("assistant credentials CLI", () => {
       const setResult = await runCli([
         "set",
         "--service",
-        "integration:google",
+        "google",
         "--field",
         "client_secret",
         "secret123",
@@ -1068,13 +1068,13 @@ describe("assistant credentials CLI", () => {
       expect(setResult.exitCode).toBe(0);
       const setParsed = JSON.parse(setResult.stdout);
       expect(setParsed.ok).toBe(true);
-      expect(setParsed.service).toBe("integration:google");
+      expect(setParsed.service).toBe("google");
       expect(setParsed.field).toBe("client_secret");
 
       const revealResult = await runCli([
         "reveal",
         "--service",
-        "integration:google",
+        "google",
         "--field",
         "client_secret",
         "--json",

package/src/__tests__/daemon-credential-client.test.ts

@@ -110,13 +110,13 @@ describe("daemon credential read requests", () => {
 
   test("preserves compound credential service names on metadata reads", async () => {
     const result = await getSecureKeyResultViaDaemon(
-      credentialKey("integration:google", "client_secret"),
+      credentialKey("google", "client_secret"),
     );
 
     expect(result).toEqual({ value: "secret-value", unreachable: false });
     expect(getRequestBody()).toEqual({
       type: "credential",
-      name: "integration:google:client_secret",
+      name: "google:client_secret",
       reveal: true,
     });
   });

package/src/__tests__/first-greeting.test.ts

@@ -50,6 +50,13 @@ describe("first-greeting", () => {
       expect(isWakeUpGreeting("Wake Up, My Friend.", 0)).toBe(true);
     });
 
+    it("returns true for punctuation variations", () => {
+      writeFileSync(join(tempDir, "BOOTSTRAP.md"), "bootstrap content");
+      expect(isWakeUpGreeting("Wake up, my friend!", 0)).toBe(true);
+      expect(isWakeUpGreeting("Wake up, my friend?", 0)).toBe(true);
+      expect(isWakeUpGreeting("Wake up, my friend", 0)).toBe(true);
+    });
+
     it("returns false when content doesn't match wake-up greeting", () => {
       writeFileSync(join(tempDir, "BOOTSTRAP.md"), "bootstrap content");
       expect(isWakeUpGreeting("Hello", 0)).toBe(false);

package/src/__tests__/host-bash-proxy.test.ts

@@ -215,6 +215,29 @@ describe("HostBashProxy", () => {
       expect(proxy.hasPendingRequest(requestId)).toBe(false);
     });
 
+    test("sends host_bash_cancel to client on abort", async () => {
+      setup();
+
+      const controller = new AbortController();
+      const resultPromise = proxy.request(
+        { command: "echo hello" },
+        "session-1",
+        controller.signal,
+      );
+
+      const sent = sentMessages[0] as Record<string, unknown>;
+      const requestId = sent.requestId as string;
+
+      controller.abort();
+      await resultPromise;
+
+      // Second message should be the cancel
+      expect(sentMessages).toHaveLength(2);
+      const cancelMsg = sentMessages[1] as Record<string, unknown>;
+      expect(cancelMsg.type).toBe("host_bash_cancel");
+      expect(cancelMsg.requestId).toBe(requestId);
+    });
+
     test("returns immediately if signal already aborted", async () => {
       setup();
 
@@ -272,6 +295,62 @@ describe("HostBashProxy", () => {
       // The promise should reject since dispose rejects pending
       expect(resultPromise).rejects.toThrow("Host bash proxy disposed");
     });
+
+    test("sends host_bash_cancel for each pending request on dispose", () => {
+      setup();
+
+      const p1 = proxy.request({ command: "echo a" }, "session-1");
+      const p2 = proxy.request({ command: "echo b" }, "session-1");
+      p1.catch(() => {}); // Expected rejection on dispose
+      p2.catch(() => {}); // Expected rejection on dispose
+
+      const requestIds = (sentMessages as Array<Record<string, unknown>>).map(
+        (m) => m.requestId as string,
+      );
+      expect(requestIds).toHaveLength(2);
+
+      proxy.dispose();
+
+      // After the 2 request messages, dispose should have sent 2 cancel messages
+      const cancelMessages = sentMessages
+        .slice(2)
+        .filter(
+          (m) => (m as Record<string, unknown>).type === "host_bash_cancel",
+        ) as Array<Record<string, unknown>>;
+      expect(cancelMessages).toHaveLength(2);
+      expect(cancelMessages.map((m) => m.requestId)).toContain(requestIds[0]);
+      expect(cancelMessages.map((m) => m.requestId)).toContain(requestIds[1]);
+    });
+  });
+
+  describe("late resolve after abort", () => {
+    test("resolve is a no-op after abort (entry already deleted)", async () => {
+      setup();
+
+      const controller = new AbortController();
+      const resultPromise = proxy.request(
+        { command: "echo hello" },
+        "session-1",
+        controller.signal,
+      );
+
+      const sent = sentMessages[0] as Record<string, unknown>;
+      const requestId = sent.requestId as string;
+
+      controller.abort();
+      const result = await resultPromise;
+      expect(result.content).toContain("Aborted");
+
+      // Late resolve should be silently ignored (no throw, no double-resolve)
+      proxy.resolve(requestId, {
+        stdout: "late",
+        stderr: "",
+        exitCode: 0,
+        timedOut: false,
+      });
+
+      expect(proxy.hasPendingRequest(requestId)).toBe(false);
+    });
   });
 
   describe("updateSender", () => {