@vellumai/assistant 0.5.15 → 0.6.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.5.15",
+  "version": "0.6.0",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/actor-token-service.test.ts

@@ -75,6 +75,9 @@ const loopbackServer = mockServer("127.0.0.1");
 /** Mock non-loopback server -- returns a public IP for all requests. */
 const nonLoopbackServer = mockServer("203.0.113.50");
 
+/** Mock LAN peer -- returns a private RFC 1918 IP (not loopback). */
+const lanPeerServer = mockServer("192.168.1.100");
+
 initializeDb();
 
 beforeEach(() => {
@@ -649,6 +652,25 @@ describe("pairing credential flow", () => {
 // ---------------------------------------------------------------------------
 
 describe("bootstrap private-network guard", () => {
+  test("rejects bootstrap request with private X-Forwarded-For", async () => {
+    const { handleGuardianBootstrap } =
+      await import("../runtime/routes/guardian-bootstrap-routes.js");
+
+    const req = new Request("http://localhost/v1/guardian/init", {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "X-Forwarded-For": "192.168.1.10",
+      },
+      body: JSON.stringify({ platform: "macos", deviceId: "test-device" }),
+    });
+
+    const res = await handleGuardianBootstrap(req, loopbackServer);
+    expect(res.status).toBe(403);
+    const body = (await res.json()) as { error: { message: string } };
+    expect(body.error.message).toContain("local-only");
+  });
+
   test("rejects bootstrap request with public X-Forwarded-For", async () => {
     const { handleGuardianBootstrap } =
       await import("../runtime/routes/guardian-bootstrap-routes.js");
@@ -697,4 +719,50 @@ describe("bootstrap private-network guard", () => {
     const res = await handleGuardianBootstrap(req, loopbackServer);
     expect(res.status).toBe(200);
   });
+
+  test("rejects LAN peer in non-containerized mode", async () => {
+    // Default IS_CONTAINERIZED is unset (non-containerized).
+    delete process.env.IS_CONTAINERIZED;
+
+    const { handleGuardianBootstrap } =
+      await import("../runtime/routes/guardian-bootstrap-routes.js");
+
+    const req = new Request("http://localhost/v1/guardian/init", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ platform: "macos", deviceId: "test-device-lan" }),
+    });
+
+    const res = await handleGuardianBootstrap(req, lanPeerServer);
+    expect(res.status).toBe(403);
+    const body = (await res.json()) as { error: { message: string } };
+    expect(body.error.message).toContain("local-only");
+  });
+
+  test("accepts LAN peer in containerized mode", async () => {
+    const prev = process.env.IS_CONTAINERIZED;
+    process.env.IS_CONTAINERIZED = "true";
+    try {
+      const { handleGuardianBootstrap } =
+        await import("../runtime/routes/guardian-bootstrap-routes.js");
+
+      const req = new Request("http://localhost/v1/guardian/init", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          platform: "macos",
+          deviceId: "test-device-docker",
+        }),
+      });
+
+      const res = await handleGuardianBootstrap(req, lanPeerServer);
+      expect(res.status).toBe(200);
+    } finally {
+      if (prev === undefined) {
+        delete process.env.IS_CONTAINERIZED;
+      } else {
+        process.env.IS_CONTAINERIZED = prev;
+      }
+    }
+  });
 });

package/src/__tests__/agent-loop.test.ts

@@ -468,38 +468,6 @@ describe("AgentLoop", () => {
     ).toBe(false);
   });
 
-  // 8. Progress reminder injection every 5 tool-use turns
-  test("injects progress reminder after every 5 tool-use turns", async () => {
-    // Create 6 tool responses followed by a text response
-    const responses: ProviderResponse[] = [];
-    for (let i = 0; i < 6; i++) {
-      responses.push(
-        toolUseResponse(`t${i}`, "read_file", { path: `/file${i}.txt` }),
-      );
-    }
-    responses.push(textResponse("Finally done"));
-
-    const { provider, calls } = createMockProvider(responses);
-    const toolExecutor = async () => ({ content: "data", isError: false });
-    const loop = new AgentLoop(
-      provider,
-      "system",
-      {},
-      dummyTools,
-      toolExecutor,
-    );
-
-    await loop.run([userMessage], () => {});
-
-    // After the 5th tool-use turn, the user message should contain a progress reminder
-    // calls[5] is the 6th provider call; its messages[-1] should have the reminder
-    const fifthTurnResultMsg = calls[5].messages[calls[5].messages.length - 1];
-    const reminderBlock = fifthTurnResultMsg.content.find(
-      (b): b is Extract<ContentBlock, { type: "text" }> =>
-        b.type === "text" && b.text.includes("making meaningful progress"),
-    );
-    expect(reminderBlock).toBeDefined();
-  });
 
   // 9. Tool executor error results are forwarded correctly
   test("forwards tool error results to provider", async () => {

package/src/__tests__/always-loaded-tools-guard.test.ts

@@ -56,8 +56,8 @@ describe("always-loaded tool count", () => {
       "file_edit",
       "file_read",
       "file_write",
-      "memory_manage",
-      "memory_recall",
+      "recall",
+      "remember",
       "skill_execute",
       "skill_load",
       "web_fetch",

package/src/__tests__/anthropic-provider.test.ts

@@ -931,7 +931,7 @@ describe("AnthropicProvider — Cache-Control Characterization", () => {
 
     // Assistant message should have tool_use in paired portion, server_tool_use in carryover
     // ensureToolPairing splits: paired = [tool_use(tu_a)], carryover = [server_tool_use(srvtoolu_b)]
-    // Result: assistant(tool_use) → user(tool_result) → assistant(server_tool_use) → user(continue)
+    // Result: assistant(tool_use) → user(tool_result) → assistant(server_tool_use) → user(synthetic_continuation)
     const assistantMsg = sent[1];
     expect(assistantMsg.role).toBe("assistant");
     expect(assistantMsg.content[0].type).toBe("tool_use");
@@ -1258,7 +1258,7 @@ describe("AnthropicProvider — Cache-Control Characterization", () => {
     // 2. assistant(tool_use)
     // 3. user(tool_result)
     // 4. assistant(Checking the file now.)
-    // 5. user((continue))  <-- synthetic user message to maintain alternation
+    // 5. user(<synthetic_continuation __injected />)  <-- synthetic user message to maintain alternation
     // 6. assistant(Next response)
     expect(sent).toHaveLength(6);
     expect(sent[0].role).toBe("user");
@@ -1271,11 +1271,65 @@ describe("AnthropicProvider — Cache-Control Characterization", () => {
     expect(sent[3].content[0].text).toBe("Checking the file now.");
     expect(sent[4].role).toBe("user");
     expect(sent[4].content[0].type).toBe("text");
-    expect(sent[4].content[0].text).toBe("(continue)");
+    expect(sent[4].content[0].text).toBe(
+      "<synthetic_continuation __injected />",
+    );
     expect(sent[5].role).toBe("assistant");
     expect(sent[5].content[0].text).toBe("Next response");
   });
 
+  test("carryover with tool_result-only user turn skips synthetic when next message is user", async () => {
+    // When the user turn after the consumed pair is already a user message,
+    // the synthetic continuation is unnecessary — the next user message
+    // naturally maintains alternation after the carryover assistant message.
+    const messages: Message[] = [
+      userMsg("Read file"),
+      {
+        role: "assistant",
+        content: [
+          { type: "tool_use", id: "tu_1", name: "file_read", input: {} },
+          { type: "text", text: "Checking the file now." }, // carryover content
+        ],
+      },
+      {
+        role: "user",
+        content: [
+          // ONLY tool_result, no other content
+          {
+            type: "tool_result",
+            tool_use_id: "tu_1",
+            content: "file contents",
+            is_error: false,
+          },
+        ],
+      },
+      userMsg("Follow-up question"), // next message is user — no synthetic needed
+    ];
+    await provider.sendMessage(messages);
+
+    const sent = lastStreamParams!.messages as Array<{
+      role: string;
+      content: Array<{ type: string; text?: string; tool_use_id?: string }>;
+    }>;
+
+    // Expected structure:
+    // 1. user(Read file)
+    // 2. assistant(tool_use)
+    // 3. user(tool_result)
+    // 4. assistant(Checking the file now.)
+    // 5. user(Follow-up question)  <-- real user message, NO synthetic continuation
+    expect(sent).toHaveLength(5);
+    expect(sent[0].role).toBe("user");
+    expect(sent[1].role).toBe("assistant");
+    expect(sent[1].content[0].type).toBe("tool_use");
+    expect(sent[2].role).toBe("user");
+    expect(sent[2].content[0].type).toBe("tool_result");
+    expect(sent[3].role).toBe("assistant");
+    expect(sent[3].content[0].text).toBe("Checking the file now.");
+    expect(sent[4].role).toBe("user");
+    expect(sent[4].content[0].text).toBe("Follow-up question");
+  });
+
   test("multi-turn with workspace injection: cache on second-to-last user turn only", async () => {
     const messages: Message[] = [
       // Turn 1: workspace + user text (no cache - 3rd-to-last)

package/src/__tests__/app-compiler.test.ts

@@ -214,6 +214,126 @@ console.log("styled");`,
     expect(js.length).toBeGreaterThan(100);
   }, 30_000);
 
+  test("rejects relative import that escapes app directory", async () => {
+    const appDir = await scaffold("escape-relative", {
+      "main.tsx": `import data from "../../../../etc/passwd";\nconsole.log(data);`,
+      "index.html": MINIMAL_HTML,
+    });
+
+    const result = await compileApp(appDir);
+
+    expect(result.ok).toBe(false);
+    expect(result.errors.length).toBeGreaterThan(0);
+    expect(result.errors[0].text).toContain(
+      "resolves outside the app directory",
+    );
+  });
+
+  test("rejects absolute path import", async () => {
+    const appDir = await scaffold("escape-absolute", {
+      "main.tsx": `import data from "/etc/passwd";\nconsole.log(data);`,
+      "index.html": MINIMAL_HTML,
+    });
+
+    const result = await compileApp(appDir);
+
+    expect(result.ok).toBe(false);
+    expect(result.errors.length).toBeGreaterThan(0);
+    expect(result.errors[0].text).toContain(
+      "resolves outside the app directory",
+    );
+  });
+
+  test("allows relative imports within app directory", async () => {
+    const appDir = await scaffold("local-relative", {
+      "main.tsx": `import { helper } from "./utils";\nconsole.log(helper);`,
+      "utils.ts": `export const helper = "ok";`,
+      "index.html": MINIMAL_HTML,
+    });
+
+    const result = await compileApp(appDir);
+
+    expect(result.ok).toBe(true);
+    expect(result.errors).toHaveLength(0);
+  });
+
+  test("rejects hex-escaped import that decodes to path traversal", async () => {
+    const appDir = await scaffold("escape-hex", {
+      // \x2e = '.', so this decodes to ../../../../etc/passwd
+      "main.tsx": `import data from "\\x2e\\x2e/\\x2e\\x2e/\\x2e\\x2e/\\x2e\\x2e/etc/passwd";\nconsole.log(data);`,
+      "index.html": MINIMAL_HTML,
+    });
+
+    const result = await compileApp(appDir);
+
+    expect(result.ok).toBe(false);
+    expect(result.errors.length).toBeGreaterThan(0);
+    expect(result.errors[0].text).toContain(
+      "resolves outside the app directory",
+    );
+  });
+
+  test("rejects unicode-escaped import that decodes to path traversal", async () => {
+    const appDir = await scaffold("escape-unicode", {
+      // \u002e = '.', \u002f = '/'
+      "main.tsx": `import data from "\\u002e\\u002e\\u002f\\u002e\\u002e/etc/passwd";\nconsole.log(data);`,
+      "index.html": MINIMAL_HTML,
+    });
+
+    const result = await compileApp(appDir);
+
+    expect(result.ok).toBe(false);
+    expect(result.errors.length).toBeGreaterThan(0);
+    expect(result.errors[0].text).toContain(
+      "resolves outside the app directory",
+    );
+  });
+
+  test("rejects import hidden behind block comment", async () => {
+    const appDir = await scaffold("escape-block-comment", {
+      "main.tsx": `import data from /* bypass */ "../../../../etc/passwd";\nconsole.log(data);`,
+      "index.html": MINIMAL_HTML,
+    });
+
+    const result = await compileApp(appDir);
+
+    expect(result.ok).toBe(false);
+    expect(result.errors.length).toBeGreaterThan(0);
+    expect(result.errors[0].text).toContain(
+      "resolves outside the app directory",
+    );
+  });
+
+  test("rejects import hidden behind line comment", async () => {
+    const appDir = await scaffold("escape-line-comment", {
+      "main.tsx": `import data from // bypass\n"../../../../etc/passwd";\nconsole.log(data);`,
+      "index.html": MINIMAL_HTML,
+    });
+
+    const result = await compileApp(appDir);
+
+    expect(result.ok).toBe(false);
+    expect(result.errors.length).toBeGreaterThan(0);
+    expect(result.errors[0].text).toContain(
+      "resolves outside the app directory",
+    );
+  });
+
+  test("rejects dynamic import escaping app directory", async () => {
+    const appDir = await scaffold("escape-dynamic", {
+      "main.tsx": `const data = await import("../../../../etc/hosts");\nconsole.log(data);`,
+      "index.html": MINIMAL_HTML,
+    });
+
+    const result = await compileApp(appDir);
+
+    expect(result.ok).toBe(false);
+    expect(result.errors.length).toBeGreaterThan(0);
+    expect(result.errors[0].text).toContain(
+      "resolves outside the app directory",
+    );
+  });
+
   test("allowed package uses shared cache on second build", async () => {
     // First build installs the package
     const appDir1 = await scaffold("cache-test-1", {