@vellumai/assistant 0.5.15 → 0.6.0

package/src/__tests__/scoped-approval-grants.test.ts

@@ -1,4 +1,4 @@
-import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
+import { beforeEach, describe, expect, mock, test } from "bun:test";
 
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
@@ -8,7 +8,7 @@ mock.module("../util/logger.js", () => ({
   truncateForLog: (value: string) => value,
 }));
 
-import { getDb, initializeDb, resetDb } from "../memory/db.js";
+import { getDb, initializeDb } from "../memory/db.js";
 import { scopedApprovalGrants } from "../memory/schema.js";
 import {
   _internal,
@@ -34,10 +34,6 @@ function clearTables(): void {
   db.delete(scopedApprovalGrants).run();
 }
 
-afterAll(() => {
-  resetDb();
-});
-
 // ---------------------------------------------------------------------------
 // Helper to build grant params with sensible defaults
 // ---------------------------------------------------------------------------

package/src/__tests__/scoped-grant-security-matrix.test.ts

@@ -23,7 +23,7 @@
  *  11. Guardian identity mismatch cannot mint grant — guardian-grant-minting.test.ts
  */
 
-import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
+import { beforeEach, describe, expect, mock, test } from "bun:test";
 
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
@@ -33,7 +33,7 @@ mock.module("../util/logger.js", () => ({
   truncateForLog: (value: string) => value,
 }));
 
-import { getDb, initializeDb, resetDb } from "../memory/db.js";
+import { getDb, initializeDb } from "../memory/db.js";
 import { scopedApprovalGrants } from "../memory/schema.js";
 import {
   _internal,
@@ -51,10 +51,6 @@ function clearTables(): void {
   db.delete(scopedApprovalGrants).run();
 }
 
-afterAll(() => {
-  resetDb();
-});
-
 // ---------------------------------------------------------------------------
 // Helper to build grant params with sensible defaults
 // ---------------------------------------------------------------------------

package/src/__tests__/search-skills-unified.test.ts

@@ -0,0 +1,421 @@
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+// ---------------------------------------------------------------------------
+// Mock state
+// ---------------------------------------------------------------------------
+
+const mockCatalogSkills = mock(
+  (): Array<{
+    id: string;
+    displayName: string;
+    description: string;
+    source: string;
+  }> => [],
+);
+const mockClawhubSearch = mock(
+  async (
+    _query: string,
+  ): Promise<{
+    skills: Array<{
+      name: string;
+      slug: string;
+      description: string;
+      author: string;
+      stars: number;
+      installs: number;
+      version: string;
+      createdAt: number;
+      source: string;
+    }>;
+  }> => ({ skills: [] }),
+);
+const mockSkillsshSearch = mock(
+  async (
+    _query: string,
+    _limit?: number,
+  ): Promise<
+    Array<{
+      id: string;
+      skillId: string;
+      name: string;
+      installs: number;
+      source: string;
+    }>
+  > => [],
+);
+
+// ---------------------------------------------------------------------------
+// Mock modules — before importing module under test
+// ---------------------------------------------------------------------------
+
+mock.module("../config/skills.js", () => ({
+  loadSkillCatalog: mockCatalogSkills,
+}));
+
+mock.module("../skills/catalog-search.js", () => ({
+  filterByQuery: (
+    items: Array<{ id: string; displayName: string; description: string }>,
+    query: string,
+    _fields: unknown[],
+  ) => {
+    const lower = query.toLowerCase();
+    return items.filter(
+      (s) =>
+        s.id.toLowerCase().includes(lower) ||
+        s.displayName.toLowerCase().includes(lower) ||
+        s.description.toLowerCase().includes(lower),
+    );
+  },
+}));
+
+mock.module("../skills/clawhub.js", () => ({
+  clawhubSearch: mockClawhubSearch,
+  // Stubs for other exports that may be referenced at import time
+  clawhubCheckUpdates: mock(async () => []),
+  clawhubInspect: mock(async () => ({})),
+  clawhubInstall: mock(async () => ({ success: true })),
+  clawhubUpdate: mock(async () => ({ success: true })),
+}));
+
+mock.module("../skills/skillssh-registry.js", () => ({
+  searchSkillsRegistry: mockSkillsshSearch,
+}));
+
+// Stub install-meta (needed by the new origin derivation logic)
+mock.module("../skills/install-meta.js", () => ({
+  readInstallMeta: () => null,
+}));
+
+// Stub remaining imports pulled in by skills.ts
+mock.module("../config/assistant-feature-flags.js", () => ({
+  isAssistantFeatureFlagEnabled: () => true,
+}));
+mock.module("../config/loader.js", () => ({
+  getConfig: () => ({}),
+  invalidateConfigCache: () => {},
+  loadRawConfig: () => ({}),
+  saveRawConfig: () => {},
+}));
+mock.module("../config/skill-state.js", () => ({
+  resolveSkillStates: () => [],
+  skillFlagKey: () => null,
+}));
+mock.module("../providers/provider-send-message.js", () => ({
+  createTimeout: () => ({
+    signal: AbortSignal.timeout(1000),
+    cleanup: () => {},
+  }),
+  extractText: () => "",
+  getConfiguredProvider: async () => null,
+  userMessage: () => ({}),
+}));
+mock.module("../runtime/routes/workspace-utils.js", () => ({
+  isTextMimeType: () => true,
+}));
+mock.module("../skills/catalog-cache.js", () => ({
+  getCatalog: async () => [],
+}));
+mock.module("../skills/catalog-install.js", () => ({
+  installSkillLocally: async () => {},
+}));
+mock.module("../skills/managed-store.js", () => ({
+  createManagedSkill: () => ({ created: true }),
+  deleteManagedSkill: () => ({ deleted: true }),
+  removeSkillsIndexEntry: () => {},
+  validateManagedSkillId: () => null,
+}));
+mock.module("../skills/skill-memory.js", () => ({
+  deleteSkillCapabilityMemory: () => {},
+  seedCatalogSkillMemories: () => {},
+}));
+mock.module("../util/platform.js", () => ({
+  getWorkspaceSkillsDir: () => "/tmp/test-skills",
+}));
+mock.module("../daemon/handlers/shared.js", () => ({
+  CONFIG_RELOAD_DEBOUNCE_MS: 100,
+  ensureSkillEntry: () => ({}),
+  log: {
+    info: () => {},
+    warn: () => {},
+    error: () => {},
+    debug: () => {},
+  },
+}));
+
+// Import after mocking
+import { searchSkills } from "../daemon/handlers/skills.js";
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+const dummyCtx = {
+  debounceTimers: { schedule: () => {} },
+  setSuppressConfigReload: () => {},
+  updateConfigFingerprint: () => {},
+  broadcast: () => {},
+} as unknown as Parameters<typeof searchSkills>[1];
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("searchSkills (unified)", () => {
+  beforeEach(() => {
+    mockCatalogSkills.mockReset();
+    mockClawhubSearch.mockReset();
+    mockSkillsshSearch.mockReset();
+
+    // Defaults: empty results
+    mockCatalogSkills.mockReturnValue([]);
+    mockClawhubSearch.mockResolvedValue({ skills: [] });
+    mockSkillsshSearch.mockResolvedValue([]);
+  });
+
+  test("returns results from all three registries", async () => {
+    mockCatalogSkills.mockReturnValue([
+      {
+        id: "weather",
+        displayName: "Weather",
+        description: "Weather lookup",
+        source: "bundled",
+      },
+    ]);
+    mockClawhubSearch.mockResolvedValue({
+      skills: [
+        {
+          name: "Deploy",
+          slug: "deploy",
+          description: "Deploy helper",
+          author: "alice",
+          stars: 10,
+          installs: 100,
+          version: "1.0.0",
+          createdAt: 1000,
+          source: "clawhub",
+        },
+      ],
+    });
+    mockSkillsshSearch.mockResolvedValue([
+      {
+        id: "vercel-labs/skills/react-best",
+        skillId: "react-best",
+        name: "React Best Practices",
+        installs: 500,
+        source: "vercel-labs/skills",
+      },
+    ]);
+
+    const result = await searchSkills("e", dummyCtx);
+    expect(result.success).toBe(true);
+    if (!result.success) throw new Error("Expected success");
+
+    expect(result.skills).toHaveLength(3);
+
+    // Verify ordering: catalog first, then clawhub, then skills.sh
+    expect(result.skills[0]!.id).toBe("weather");
+    expect(result.skills[0]!.origin).toBe("vellum");
+    expect(result.skills[0]!.kind).toBe("catalog");
+    expect(result.skills[0]!.status).toBe("available");
+    expect(result.skills[1]!.id).toBe("deploy");
+    expect(result.skills[1]!.origin).toBe("clawhub");
+    expect(result.skills[1]!.kind).toBe("catalog");
+    expect(result.skills[2]!.id).toBe("vercel-labs/skills/react-best");
+    expect(result.skills[2]!.origin).toBe("skillssh");
+    expect(result.skills[2]!.kind).toBe("catalog");
+  });
+
+  test("deduplicates: catalog takes precedence over clawhub and skills.sh", async () => {
+    mockCatalogSkills.mockReturnValue([
+      {
+        id: "shared-skill",
+        displayName: "Shared Skill",
+        description: "From catalog",
+        source: "bundled",
+      },
+    ]);
+    mockClawhubSearch.mockResolvedValue({
+      skills: [
+        {
+          name: "Shared Skill",
+          slug: "shared-skill",
+          description: "From clawhub",
+          author: "",
+          stars: 5,
+          installs: 50,
+          version: "2.0.0",
+          createdAt: 2000,
+          source: "clawhub",
+        },
+      ],
+    });
+    // skills.sh uses full id as slug, so it won't collide with catalog/clawhub
+    // short slugs. Dedup only removes the clawhub duplicate here.
+    mockSkillsshSearch.mockResolvedValue([
+      {
+        id: "org/repo/shared-skill",
+        skillId: "shared-skill",
+        name: "Shared Skill",
+        installs: 300,
+        source: "org/repo",
+      },
+    ]);
+
+    const result = await searchSkills("shared", dummyCtx);
+    expect(result.success).toBe(true);
+    if (!result.success) throw new Error("Expected success");
+
+    // Catalog deduplicates clawhub (same slug "shared-skill"), but skills.sh
+    // now uses the full id "org/repo/shared-skill" so it's a distinct entry.
+    expect(result.skills).toHaveLength(2);
+    expect(result.skills[0]!.id).toBe("shared-skill");
+    expect(result.skills[0]!.origin).toBe("vellum");
+    expect(result.skills[1]!.id).toBe("org/repo/shared-skill");
+    expect(result.skills[1]!.origin).toBe("skillssh");
+  });
+
+  test("deduplicates: clawhub takes precedence over skills.sh with same slug", async () => {
+    mockCatalogSkills.mockReturnValue([]);
+    mockClawhubSearch.mockResolvedValue({
+      skills: [
+        {
+          name: "Overlap",
+          slug: "overlap-skill",
+          description: "From clawhub",
+          author: "bob",
+          stars: 20,
+          installs: 200,
+          version: "1.0.0",
+          createdAt: 3000,
+          source: "clawhub",
+        },
+      ],
+    });
+    // skills.sh now uses full id as slug, so it won't collide with clawhub
+    // short slugs — both entries survive dedup.
+    mockSkillsshSearch.mockResolvedValue([
+      {
+        id: "org/repo/overlap-skill",
+        skillId: "overlap-skill",
+        name: "Overlap",
+        installs: 100,
+        source: "org/repo",
+      },
+    ]);
+
+    const result = await searchSkills("overlap", dummyCtx);
+    expect(result.success).toBe(true);
+    if (!result.success) throw new Error("Expected success");
+
+    // Full id slug means no collision — both entries survive
+    expect(result.skills).toHaveLength(2);
+    expect(result.skills[0]!.id).toBe("overlap-skill");
+    expect(result.skills[0]!.origin).toBe("clawhub");
+    expect(result.skills[1]!.id).toBe("org/repo/overlap-skill");
+    expect(result.skills[1]!.origin).toBe("skillssh");
+  });
+
+  test("returns clawhub results when skills.sh fails", async () => {
+    mockCatalogSkills.mockReturnValue([]);
+    mockClawhubSearch.mockResolvedValue({
+      skills: [
+        {
+          name: "ClawhubSkill",
+          slug: "clawhub-only",
+          description: "",
+          author: "",
+          stars: 0,
+          installs: 0,
+          version: "",
+          createdAt: 0,
+          source: "clawhub",
+        },
+      ],
+    });
+    mockSkillsshSearch.mockRejectedValue(new Error("skills.sh is down"));
+
+    const result = await searchSkills("clawhub", dummyCtx);
+    expect(result.success).toBe(true);
+    if (!result.success) throw new Error("Expected success");
+
+    expect(result.skills).toHaveLength(1);
+    expect(result.skills[0]!.id).toBe("clawhub-only");
+    expect(result.skills[0]!.origin).toBe("clawhub");
+  });
+
+  test("returns skills.sh results when clawhub fails", async () => {
+    mockCatalogSkills.mockReturnValue([]);
+    mockClawhubSearch.mockRejectedValue(new Error("clawhub is down"));
+    mockSkillsshSearch.mockResolvedValue([
+      {
+        id: "org/repo/skillssh-only",
+        skillId: "skillssh-only",
+        name: "SkillsShOnly",
+        installs: 42,
+        source: "org/repo",
+      },
+    ]);
+
+    const result = await searchSkills("skillssh", dummyCtx);
+    expect(result.success).toBe(true);
+    if (!result.success) throw new Error("Expected success");
+
+    expect(result.skills).toHaveLength(1);
+    expect(result.skills[0]!.id).toBe("org/repo/skillssh-only");
+    expect(result.skills[0]!.origin).toBe("skillssh");
+  });
+
+  test("returns catalog-only results when both community registries fail", async () => {
+    mockCatalogSkills.mockReturnValue([
+      {
+        id: "my-skill",
+        displayName: "My Skill",
+        description: "A bundled skill",
+        source: "bundled",
+      },
+    ]);
+    mockClawhubSearch.mockRejectedValue(new Error("clawhub down"));
+    mockSkillsshSearch.mockRejectedValue(new Error("skillssh down"));
+
+    const result = await searchSkills("my", dummyCtx);
+    expect(result.success).toBe(true);
+    if (!result.success) throw new Error("Expected success");
+
+    expect(result.skills).toHaveLength(1);
+    expect(result.skills[0]!.id).toBe("my-skill");
+    expect(result.skills[0]!.origin).toBe("vellum");
+  });
+
+  test("skills.sh results have correct normalized fields", async () => {
+    mockCatalogSkills.mockReturnValue([]);
+    mockClawhubSearch.mockResolvedValue({ skills: [] });
+    mockSkillsshSearch.mockResolvedValue([
+      {
+        id: "org/repo/test-skill",
+        skillId: "test-skill",
+        name: "Test Skill",
+        installs: 99,
+        source: "org/repo",
+      },
+    ]);
+
+    const result = await searchSkills("test", dummyCtx);
+    expect(result.success).toBe(true);
+    if (!result.success) throw new Error("Expected success");
+
+    expect(result.skills).toHaveLength(1);
+
+    const skill = result.skills[0]!;
+    expect(skill.id).toBe("org/repo/test-skill");
+    expect(skill.name).toBe("Test Skill");
+    expect(skill.description).toBe("");
+    expect(skill.kind).toBe("catalog");
+    expect(skill.origin).toBe("skillssh");
+    expect(skill.status).toBe("available");
+    if (skill.origin === "skillssh") {
+      expect(skill.slug).toBe("org/repo/test-skill");
+      expect(skill.sourceRepo).toBe("org/repo");
+      expect(skill.installs).toBe(99);
+    }
+  });
+});

package/src/__tests__/secret-allowlist.test.ts

@@ -1,10 +1,8 @@
-import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
+import { mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 
-// Mock the data dir to a temp directory so tests don't touch ~/.vellum/
-let testDir: string;
+const testDir = process.env.VELLUM_WORKSPACE_DIR!;
 
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
@@ -13,11 +11,6 @@ mock.module("../util/logger.js", () => ({
     }),
 }));
 
-mock.module("../util/platform.js", () => ({
-  getProtectedDir: () => join(testDir, "protected"),
-  getDataDir: () => testDir,
-}));
-
 import {
   isAllowlisted,
   loadAllowlist,
@@ -27,21 +20,13 @@ import { scanText } from "../security/secret-scanner.js";
 
 describe("secret-allowlist", () => {
   beforeEach(() => {
-    testDir = join(
-      tmpdir(),
-      `vellum-allowlist-test-${Date.now()}-${Math.random()
-        .toString(36)
-        .slice(2)}`,
-    );
-    mkdirSync(join(testDir, "protected"), { recursive: true });
+    mkdirSync(join(testDir, "data"), { recursive: true });
     resetAllowlist();
   });
 
   afterEach(() => {
     resetAllowlist();
-    if (existsSync(testDir)) {
-      rmSync(testDir, { recursive: true, force: true });
-    }
+    rmSync(join(testDir, "data"), { recursive: true, force: true });
   });
 
   // -----------------------------------------------------------------------
@@ -56,7 +41,7 @@ describe("secret-allowlist", () => {
   // -----------------------------------------------------------------------
   test("[experimental] suppresses exact values", () => {
     writeFileSync(
-      join(testDir, "protected", "secret-allowlist.json"),
+      join(testDir, "data", "secret-allowlist.json"),
       JSON.stringify({ values: ["my-test-api-key-12345"] }),
     );
     expect(isAllowlisted("my-test-api-key-12345")).toBe(true);
@@ -65,7 +50,7 @@ describe("secret-allowlist", () => {
 
   test("[experimental] exact values are case-sensitive", () => {
     writeFileSync(
-      join(testDir, "protected", "secret-allowlist.json"),
+      join(testDir, "data", "secret-allowlist.json"),
       JSON.stringify({ values: ["MyTestKey"] }),
     );
     expect(isAllowlisted("MyTestKey")).toBe(true);
@@ -77,7 +62,7 @@ describe("secret-allowlist", () => {
   // -----------------------------------------------------------------------
   test("[experimental] suppresses values matching a prefix", () => {
     writeFileSync(
-      join(testDir, "protected", "secret-allowlist.json"),
+      join(testDir, "data", "secret-allowlist.json"),
       JSON.stringify({ prefixes: ["my-internal-"] }),
     );
     expect(isAllowlisted("my-internal-key-abc123")).toBe(true);
@@ -89,7 +74,7 @@ describe("secret-allowlist", () => {
   // -----------------------------------------------------------------------
   test("[experimental] suppresses values matching a regex pattern", () => {
     writeFileSync(
-      join(testDir, "protected", "secret-allowlist.json"),
+      join(testDir, "data", "secret-allowlist.json"),
       JSON.stringify({ patterns: ["^ci-test-[a-z0-9]+$"] }),
     );
     expect(isAllowlisted("ci-test-abc123")).toBe(true);
@@ -98,7 +83,7 @@ describe("secret-allowlist", () => {
 
   test("[experimental] invalid regex is skipped without crashing", () => {
     writeFileSync(
-      join(testDir, "protected", "secret-allowlist.json"),
+      join(testDir, "data", "secret-allowlist.json"),
       JSON.stringify({ patterns: ["[invalid", "^valid$"] }),
     );
     loadAllowlist();
@@ -113,7 +98,7 @@ describe("secret-allowlist", () => {
   // -----------------------------------------------------------------------
   test("[experimental] combines values, prefixes, and patterns", () => {
     writeFileSync(
-      join(testDir, "protected", "secret-allowlist.json"),
+      join(testDir, "data", "secret-allowlist.json"),
       JSON.stringify({
         values: ["exact-match-value"],
         prefixes: ["test-prefix-"],
@@ -131,7 +116,7 @@ describe("secret-allowlist", () => {
   // -----------------------------------------------------------------------
   test("handles malformed JSON gracefully", () => {
     writeFileSync(
-      join(testDir, "protected", "secret-allowlist.json"),
+      join(testDir, "data", "secret-allowlist.json"),
       "not json{{{",
     );
     loadAllowlist();
@@ -141,7 +126,7 @@ describe("secret-allowlist", () => {
 
   test("handles non-array fields gracefully", () => {
     writeFileSync(
-      join(testDir, "protected", "secret-allowlist.json"),
+      join(testDir, "data", "secret-allowlist.json"),
       JSON.stringify({ values: "not-an-array", prefixes: 42 }),
     );
     loadAllowlist();
@@ -154,7 +139,7 @@ describe("secret-allowlist", () => {
   test("[experimental] allowlisted values are suppressed by scanText", () => {
     const awsKey = "AKIAIOSFODNN7REALKEY";
     writeFileSync(
-      join(testDir, "protected", "secret-allowlist.json"),
+      join(testDir, "data", "secret-allowlist.json"),
       JSON.stringify({ values: [awsKey] }),
     );
     resetAllowlist();
@@ -166,7 +151,7 @@ describe("secret-allowlist", () => {
 
   test("non-allowlisted values are still detected by scanText", () => {
     writeFileSync(
-      join(testDir, "protected", "secret-allowlist.json"),
+      join(testDir, "data", "secret-allowlist.json"),
       JSON.stringify({ values: ["AKIAIOSFODNN7OTHERKE"] }),
     );
     resetAllowlist();
@@ -178,7 +163,7 @@ describe("secret-allowlist", () => {
 
   test("[experimental] prefix allowlist suppresses pattern matches", () => {
     writeFileSync(
-      join(testDir, "protected", "secret-allowlist.json"),
+      join(testDir, "data", "secret-allowlist.json"),
       JSON.stringify({ prefixes: ["ghp_AAAA"] }),
     );
     resetAllowlist();
@@ -198,7 +183,7 @@ describe("secret-allowlist", () => {
 
     // Create the file — but fileChecked is cached, so it won't be seen
     writeFileSync(
-      join(testDir, "protected", "secret-allowlist.json"),
+      join(testDir, "data", "secret-allowlist.json"),
       JSON.stringify({ values: ["test-key"] }),
     );
     expect(isAllowlisted("test-key")).toBe(false);
@@ -211,7 +196,7 @@ describe("secret-allowlist", () => {
   test("[experimental] retries loading when file was malformed on first call", () => {
     // First call with malformed JSON
     writeFileSync(
-      join(testDir, "protected", "secret-allowlist.json"),
+      join(testDir, "data", "secret-allowlist.json"),
       "not json{{{",
     );
     loadAllowlist();
@@ -219,7 +204,7 @@ describe("secret-allowlist", () => {
 
     // Fix the file
     writeFileSync(
-      join(testDir, "protected", "secret-allowlist.json"),
+      join(testDir, "data", "secret-allowlist.json"),
       JSON.stringify({ values: ["test-key"] }),
     );
 
@@ -232,7 +217,7 @@ describe("secret-allowlist", () => {
   // -----------------------------------------------------------------------
   test("[experimental] resetAllowlist clears cached state", () => {
     writeFileSync(
-      join(testDir, "protected", "secret-allowlist.json"),
+      join(testDir, "data", "secret-allowlist.json"),
       JSON.stringify({ values: ["test-value"] }),
     );
     loadAllowlist();
@@ -240,7 +225,7 @@ describe("secret-allowlist", () => {
 
     // Reset and remove file — should no longer be allowlisted
     resetAllowlist();
-    rmSync(join(testDir, "protected", "secret-allowlist.json"));
+    rmSync(join(testDir, "data", "secret-allowlist.json"));
     expect(isAllowlisted("test-value")).toBe(false);
   });
 });

package/src/__tests__/secret-onetime-send.test.ts

@@ -67,6 +67,8 @@ mock.module("../security/secure-keys.js", () => {
       syncSet(key, value),
     deleteSecureKeyAsync: async (key: string) => syncDelete(key),
     listSecureKeysAsync: async () => ({ accounts: [], unreachable: false }),
+    getProviderKeyAsync: async () => undefined,
+    getMaskedProviderKey: async () => null,
   };
 });