@vellumai/assistant 0.5.13 → 0.5.14

package/src/__tests__/guardian-decision-primitive-canonical.test.ts

@@ -1,21 +1,5 @@
-import { mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
 import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
 
-const testDir = mkdtempSync(join(tmpdir(), "canonical-decision-test-"));
-
-mock.module("../util/platform.js", () => ({
-  getDataDir: () => testDir,
-  isMacOS: () => process.platform === "darwin",
-  isLinux: () => process.platform === "linux",
-  isWindows: () => process.platform === "win32",
-  getPidPath: () => join(testDir, "test.pid"),
-  getDbPath: () => join(testDir, "test.db"),
-  getLogPath: () => join(testDir, "test.log"),
-  ensureDataDir: () => {},
-}));
-
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
     new Proxy({} as Record<string, unknown>, {
@@ -26,6 +10,8 @@ mock.module("../util/logger.js", () => ({
 
 import {
   applyCanonicalGuardianDecision,
+  GRANT_TTL_10M_MS,
+  GRANT_TTL_MS,
   mintCanonicalRequestGrant,
 } from "../approvals/guardian-decision-primitive.js";
 import type { ActorContext } from "../approvals/guardian-request-resolvers.js";
@@ -51,11 +37,6 @@ function resetTables(): void {
 
 afterAll(() => {
   resetDb();
-  try {
-    rmSync(testDir, { recursive: true });
-  } catch {
-    // best-effort cleanup
-  }
 });
 
 // ---------------------------------------------------------------------------
@@ -376,7 +357,7 @@ describe("applyCanonicalGuardianDecision", () => {
     expect(unchanged!.status).toBe("pending");
   });
 
-  // ── approve_always downgrade ───────────────────────────────────────
+  // ── approve_always downgrade / temporal mode preservation ──────────
 
   test("downgrades approve_always to approve_once", async () => {
     const req = createCanonicalGuardianRequest({
@@ -412,6 +393,89 @@ describe("applyCanonicalGuardianDecision", () => {
     expect(result.resolverFailed).toBe(true);
   });
 
+  test("preserves approve_10m (not downgraded) and mints grant with 10m TTL", async () => {
+    const before = Date.now();
+    const req = createCanonicalGuardianRequest({
+      kind: "unknown_kind",
+      sourceType: "voice",
+      sourceChannel: "phone",
+      conversationId: "conv-10m-1",
+      callSessionId: "call-10m-1",
+      toolName: "host_bash",
+      inputDigest: "sha256:10m-digest",
+      guardianPrincipalId: TEST_PRINCIPAL_ID,
+      expiresAt: Date.now() + 60_000,
+    });
+
+    const result = await applyCanonicalGuardianDecision({
+      requestId: req.id,
+      action: "approve_10m",
+      actorContext: guardianActor(),
+    });
+
+    expect(result.applied).toBe(true);
+    if (!result.applied) return;
+
+    // approve_10m is preserved — the request is approved (not downgraded)
+    const resolved = getCanonicalGuardianRequest(req.id);
+    expect(resolved!.status).toBe("approved");
+
+    // Grant is minted because approve_10m is not downgraded and the request
+    // has tool metadata (unknown_kind has no resolver, so resolver doesn't fail)
+    expect(result.grantMinted).toBe(true);
+
+    const db = getDb();
+    const grants = db.select().from(scopedApprovalGrants).all();
+    expect(grants.length).toBe(1);
+    expect(grants[0].toolName).toBe("host_bash");
+    expect(grants[0].conversationId).toBe("conv-10m-1");
+
+    // Grant TTL should be ~10 minutes, not the default 5 minutes
+    const grantExpiresAt = grants[0].expiresAt;
+    expect(grantExpiresAt).toBeGreaterThanOrEqual(before + GRANT_TTL_10M_MS);
+    expect(grantExpiresAt).toBeLessThanOrEqual(Date.now() + GRANT_TTL_10M_MS);
+  });
+
+  test("preserves approve_conversation (not downgraded) and mints grant with no wall-clock expiry", async () => {
+    const req = createCanonicalGuardianRequest({
+      kind: "unknown_kind",
+      sourceType: "voice",
+      sourceChannel: "phone",
+      conversationId: "conv-session-1",
+      callSessionId: "call-session-1",
+      toolName: "file_write",
+      inputDigest: "sha256:session-digest",
+      guardianPrincipalId: TEST_PRINCIPAL_ID,
+      expiresAt: Date.now() + 60_000,
+    });
+
+    const result = await applyCanonicalGuardianDecision({
+      requestId: req.id,
+      action: "approve_conversation",
+      actorContext: guardianActor(),
+    });
+
+    expect(result.applied).toBe(true);
+    if (!result.applied) return;
+
+    // approve_conversation is preserved — the request is approved (not downgraded)
+    const resolved = getCanonicalGuardianRequest(req.id);
+    expect(resolved!.status).toBe("approved");
+
+    // Grant is minted because approve_conversation is not downgraded and the
+    // request has tool metadata (unknown_kind has no resolver, so no failure)
+    expect(result.grantMinted).toBe(true);
+
+    const db = getDb();
+    const grants = db.select().from(scopedApprovalGrants).all();
+    expect(grants.length).toBe(1);
+    expect(grants[0].toolName).toBe("file_write");
+    expect(grants[0].conversationId).toBe("conv-session-1");
+
+    // Conversation-scoped grants have no wall-clock expiry (far-future sentinel)
+    expect(grants[0].expiresAt).toBe(Number.MAX_SAFE_INTEGER);
+  });
+
   // ── Expired request ────────────────────────────────────────────────
 
   test("rejects decision on expired request", async () => {
@@ -580,6 +644,7 @@ describe("mintCanonicalRequestGrant", () => {
       request: req,
       actorChannel: "telegram",
       guardianExternalUserId: "guardian-1",
+      effectiveAction: "approve_once",
     });
 
     expect(result.minted).toBe(true);
@@ -599,6 +664,7 @@ describe("mintCanonicalRequestGrant", () => {
     const result = mintCanonicalRequestGrant({
       request: req,
       actorChannel: "vellum",
+      effectiveAction: "approve_once",
     });
 
     expect(result.minted).toBe(true);
@@ -621,6 +687,7 @@ describe("mintCanonicalRequestGrant", () => {
       request: req,
       actorChannel: "telegram",
       guardianExternalUserId: "guardian-1",
+      effectiveAction: "approve_once",
     });
 
     expect(result.minted).toBe(false);
@@ -639,8 +706,91 @@ describe("mintCanonicalRequestGrant", () => {
       request: req,
       actorChannel: "telegram",
       guardianExternalUserId: "guardian-1",
+      effectiveAction: "approve_once",
     });
 
     expect(result.minted).toBe(false);
   });
+
+  test("mints grant with 10m TTL for approve_10m action", () => {
+    const before = Date.now();
+    const req = createCanonicalGuardianRequest({
+      kind: "tool_approval",
+      sourceType: "channel",
+      sourceChannel: "telegram",
+      conversationId: "conv-ttl-10m",
+      guardianPrincipalId: TEST_PRINCIPAL_ID,
+      toolName: "shell",
+      inputDigest: "sha256:ttl-10m",
+    });
+
+    const result = mintCanonicalRequestGrant({
+      request: req,
+      actorChannel: "telegram",
+      guardianExternalUserId: "guardian-1",
+      effectiveAction: "approve_10m",
+    });
+
+    expect(result.minted).toBe(true);
+
+    const db = getDb();
+    const grants = db.select().from(scopedApprovalGrants).all();
+    expect(grants.length).toBe(1);
+    expect(grants[0].expiresAt).toBeGreaterThanOrEqual(before + GRANT_TTL_10M_MS);
+    expect(grants[0].expiresAt).toBeLessThanOrEqual(Date.now() + GRANT_TTL_10M_MS);
+  });
+
+  test("mints grant with no wall-clock expiry for approve_conversation", () => {
+    const req = createCanonicalGuardianRequest({
+      kind: "tool_approval",
+      sourceType: "channel",
+      sourceChannel: "telegram",
+      conversationId: "conv-ttl-conv",
+      guardianPrincipalId: TEST_PRINCIPAL_ID,
+      toolName: "shell",
+      inputDigest: "sha256:ttl-conv",
+    });
+
+    const result = mintCanonicalRequestGrant({
+      request: req,
+      actorChannel: "telegram",
+      guardianExternalUserId: "guardian-1",
+      effectiveAction: "approve_conversation",
+    });
+
+    expect(result.minted).toBe(true);
+
+    const db = getDb();
+    const grants = db.select().from(scopedApprovalGrants).all();
+    expect(grants.length).toBe(1);
+    expect(grants[0].expiresAt).toBe(Number.MAX_SAFE_INTEGER);
+  });
+
+  test("mints grant with default 5m TTL for approve_once", () => {
+    const before = Date.now();
+    const req = createCanonicalGuardianRequest({
+      kind: "tool_approval",
+      sourceType: "channel",
+      sourceChannel: "telegram",
+      conversationId: "conv-ttl-once",
+      guardianPrincipalId: TEST_PRINCIPAL_ID,
+      toolName: "shell",
+      inputDigest: "sha256:ttl-once",
+    });
+
+    const result = mintCanonicalRequestGrant({
+      request: req,
+      actorChannel: "telegram",
+      guardianExternalUserId: "guardian-1",
+      effectiveAction: "approve_once",
+    });
+
+    expect(result.minted).toBe(true);
+
+    const db = getDb();
+    const grants = db.select().from(scopedApprovalGrants).all();
+    expect(grants.length).toBe(1);
+    expect(grants[0].expiresAt).toBeGreaterThanOrEqual(before + GRANT_TTL_MS);
+    expect(grants[0].expiresAt).toBeLessThanOrEqual(Date.now() + GRANT_TTL_MS);
+  });
 });

package/src/__tests__/guardian-dispatch.test.ts

@@ -1,24 +1,8 @@
-import { mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
 import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
 
 import type { ConversationCreatedInfo } from "../notifications/broadcaster.js";
 import type { NotificationDeliveryResult } from "../notifications/types.js";
 
-const testDir = mkdtempSync(join(tmpdir(), "guardian-dispatch-test-"));
-
-mock.module("../util/platform.js", () => ({
-  getDataDir: () => testDir,
-  isMacOS: () => process.platform === "darwin",
-  isLinux: () => process.platform === "linux",
-  isWindows: () => process.platform === "win32",
-  getPidPath: () => join(testDir, "test.pid"),
-  getDbPath: () => join(testDir, "test.db"),
-  getLogPath: () => join(testDir, "test.log"),
-  ensureDataDir: () => {},
-}));
-
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
     new Proxy({} as Record<string, unknown>, {
@@ -143,11 +127,6 @@ describe("guardian-dispatch", () => {
 
   afterAll(() => {
     resetDb();
-    try {
-      rmSync(testDir, { recursive: true });
-    } catch {
-      /* best effort */
-    }
   });
 
   test("creates a guardian action request and vellum delivery from pipeline results", async () => {

package/src/__tests__/guardian-grant-minting.test.ts

@@ -6,9 +6,6 @@
  * Non-tool-approval requests and rejections must NOT mint grants.
  */
 
-import { mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
 import {
   afterAll,
   beforeEach,
@@ -23,20 +20,6 @@ import {
 // Test isolation: in-memory SQLite via temp directory
 // ---------------------------------------------------------------------------
 
-const testDir = mkdtempSync(join(tmpdir(), "guardian-grant-minting-test-"));
-
-mock.module("../util/platform.js", () => ({
-  getRootDir: () => testDir,
-  getDataDir: () => testDir,
-  isMacOS: () => process.platform === "darwin",
-  isLinux: () => process.platform === "linux",
-  isWindows: () => process.platform === "win32",
-  getPidPath: () => join(testDir, "test.pid"),
-  getDbPath: () => join(testDir, "test.db"),
-  getLogPath: () => join(testDir, "test.log"),
-  ensureDataDir: () => {},
-}));
-
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
     new Proxy({} as Record<string, unknown>, {
@@ -65,11 +48,6 @@ initializeDb();
 
 afterAll(() => {
   resetDb();
-  try {
-    rmSync(testDir, { recursive: true });
-  } catch {
-    /* best effort */
-  }
 });
 
 // ---------------------------------------------------------------------------

package/src/__tests__/guardian-outbound-http.test.ts

@@ -12,29 +12,12 @@
  *   no_active_session error paths all produce the expected error codes.
  */
 
-import { mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
 import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
 
 // ---------------------------------------------------------------------------
 // Test isolation: in-memory SQLite via temp directory
 // ---------------------------------------------------------------------------
 
-const testDir = mkdtempSync(join(tmpdir(), "guardian-outbound-http-test-"));
-
-mock.module("../util/platform.js", () => ({
-  getRootDir: () => testDir,
-  getDataDir: () => testDir,
-  isMacOS: () => process.platform === "darwin",
-  isLinux: () => process.platform === "linux",
-  isWindows: () => process.platform === "win32",
-  getPidPath: () => join(testDir, "test.pid"),
-  getDbPath: () => join(testDir, "test.db"),
-  getLogPath: () => join(testDir, "test.log"),
-  ensureDataDir: () => {},
-}));
-
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
     new Proxy({} as Record<string, unknown>, {
@@ -124,11 +107,6 @@ initializeDb();
 afterAll(() => {
   globalThis.fetch = originalFetch;
   resetDb();
-  try {
-    rmSync(testDir, { recursive: true });
-  } catch {
-    /* best effort */
-  }
 });
 
 function resetTables(): void {

package/src/__tests__/guardian-principal-id-roundtrip.test.ts

@@ -1,23 +1,5 @@
-import { mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
 import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
 
-const testDir = mkdtempSync(
-  join(tmpdir(), "guardian-principal-id-roundtrip-test-"),
-);
-
-mock.module("../util/platform.js", () => ({
-  getDataDir: () => testDir,
-  isMacOS: () => process.platform === "darwin",
-  isLinux: () => process.platform === "linux",
-  isWindows: () => process.platform === "win32",
-  getPidPath: () => join(testDir, "test.pid"),
-  getDbPath: () => join(testDir, "test.db"),
-  getLogPath: () => join(testDir, "test.log"),
-  ensureDataDir: () => {},
-}));
-
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
     new Proxy({} as Record<string, unknown>, {
@@ -48,11 +30,6 @@ describe("guardianPrincipalId roundtrip", () => {
 
   afterAll(() => {
     resetDb();
-    try {
-      rmSync(testDir, { recursive: true });
-    } catch {
-      // best-effort cleanup
-    }
   });
 
   // ── canonical_guardian_requests ──────────────────────────────────────

package/src/__tests__/guardian-routing-invariants.test.ts

@@ -15,28 +15,11 @@
  */
 
 import { readFileSync } from "node:fs";
-import { mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
 
 mock.module("../config/env.js", () => ({ isHttpAuthDisabled: () => true }));
 
-const testDir = mkdtempSync(
-  join(tmpdir(), "guardian-routing-invariants-test-"),
-);
-
-mock.module("../util/platform.js", () => ({
-  getDataDir: () => testDir,
-  isMacOS: () => process.platform === "darwin",
-  isLinux: () => process.platform === "linux",
-  isWindows: () => process.platform === "win32",
-  getPidPath: () => join(testDir, "test.pid"),
-  getDbPath: () => join(testDir, "test.db"),
-  getLogPath: () => join(testDir, "test.log"),
-  ensureDataDir: () => {},
-}));
-
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
     new Proxy({} as Record<string, unknown>, {
@@ -74,11 +57,6 @@ function resetTables(): void {
 
 afterAll(() => {
   resetDb();
-  try {
-    rmSync(testDir, { recursive: true });
-  } catch {
-    // best-effort cleanup
-  }
 });
 
 // ---------------------------------------------------------------------------

package/src/__tests__/guardian-routing-state.test.ts

@@ -1,6 +1,3 @@
-import { mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
 import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
 
 mock.module("../config/env.js", () => ({ isHttpAuthDisabled: () => true }));
@@ -10,20 +7,6 @@ import { eq } from "drizzle-orm";
 // Test isolation: in-memory SQLite via temp directory
 // ---------------------------------------------------------------------------
 
-const testDir = mkdtempSync(join(tmpdir(), "guardian-routing-state-test-"));
-
-mock.module("../util/platform.js", () => ({
-  getRootDir: () => testDir,
-  getDataDir: () => testDir,
-  isMacOS: () => process.platform === "darwin",
-  isLinux: () => process.platform === "linux",
-  isWindows: () => process.platform === "win32",
-  getPidPath: () => join(testDir, "test.pid"),
-  getDbPath: () => join(testDir, "test.db"),
-  getLogPath: () => join(testDir, "test.log"),
-  ensureDataDir: () => {},
-}));
-
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
     new Proxy({} as Record<string, unknown>, {
@@ -48,11 +31,6 @@ initializeDb();
 
 afterAll(() => {
   resetDb();
-  try {
-    rmSync(testDir, { recursive: true });
-  } catch {
-    /* best effort */
-  }
 });
 
 function resetTables(): void {

package/src/__tests__/guardian-verification-voice-binding.test.ts

@@ -2,27 +2,8 @@
  * Regression test: guardian verification calls must create a voice channel
  * binding so the conversation never appears as an unbound desktop conversation.
  */
-import { mkdtempSync, realpathSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
 import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
 
-const testDir = realpathSync(
-  mkdtempSync(join(tmpdir(), "guardian-verify-binding-test-")),
-);
-
-mock.module("../util/platform.js", () => ({
-  getRootDir: () => testDir,
-  getDataDir: () => testDir,
-  isMacOS: () => process.platform === "darwin",
-  isLinux: () => process.platform === "linux",
-  isWindows: () => process.platform === "win32",
-  getPidPath: () => join(testDir, "test.pid"),
-  getDbPath: () => join(testDir, "test.db"),
-  getLogPath: () => join(testDir, "test.log"),
-  ensureDataDir: () => {},
-}));
-
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
     new Proxy({} as Record<string, unknown>, {
@@ -116,11 +97,6 @@ initializeDb();
 
 afterAll(() => {
   resetDb();
-  try {
-    rmSync(testDir, { recursive: true });
-  } catch {
-    /* best effort */
-  }
 });
 
 describe("startVerificationCall — voice binding", () => {

package/src/__tests__/headless-browser-interactions.test.ts

@@ -9,10 +9,6 @@ mock.module("../util/logger.js", () => ({
     }),
 }));
 
-mock.module("../util/platform.js", () => ({
-  getDataDir: () => "/tmp/headless-browser-interactions-test",
-}));
-
 let mockPage: {
   click: ReturnType<typeof mock>;
   fill: ReturnType<typeof mock>;

package/src/__tests__/headless-browser-navigate.test.ts

@@ -9,10 +9,6 @@ mock.module("../util/logger.js", () => ({
     }),
 }));
 
-mock.module("../util/platform.js", () => ({
-  getDataDir: () => "/tmp/headless-browser-test",
-}));
-
 // Track calls to browserManager and url-safety helpers
 let mockPage: {
   goto: ReturnType<typeof mock>;

package/src/__tests__/headless-browser-read-tools.test.ts

@@ -9,10 +9,6 @@ mock.module("../util/logger.js", () => ({
     }),
 }));
 
-mock.module("../util/platform.js", () => ({
-  getDataDir: () => "/tmp/headless-browser-read-tools-test",
-}));
-
 let mockPage: {
   click: ReturnType<typeof mock>;
   fill: ReturnType<typeof mock>;

package/src/__tests__/headless-browser-snapshot.test.ts

@@ -9,10 +9,6 @@ mock.module("../util/logger.js", () => ({
     }),
 }));
 
-mock.module("../util/platform.js", () => ({
-  getDataDir: () => "/tmp/headless-browser-snapshot-test",
-}));
-
 let mockPage: {
   evaluate: ReturnType<typeof mock>;
   title: ReturnType<typeof mock>;