@vellumai/assistant 0.5.15 → 0.6.0

package/src/__tests__/config-set-platform-guard.test.ts

@@ -0,0 +1,302 @@
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+import { Command } from "commander";
+
+// ---------------------------------------------------------------------------
+// Mock state
+// ---------------------------------------------------------------------------
+
+let mockPlatformClientCreate: () => Promise<Record<
+  string,
+  unknown
+> | null> = async () => null;
+
+let mockLoadRawConfig: () => Record<string, unknown> = () => ({});
+const mockSaveRawConfigCalls: Array<Record<string, unknown>> = [];
+const mockSetNestedValueCalls: Array<{
+  obj: Record<string, unknown>;
+  key: string;
+  value: unknown;
+}> = [];
+let mockGetNestedValue: (
+  obj: Record<string, unknown>,
+  key: string,
+) => unknown = () => undefined;
+
+// ---------------------------------------------------------------------------
+// Mocks — platform/client (controls requirePlatformConnection)
+// ---------------------------------------------------------------------------
+
+mock.module("../platform/client.js", () => ({
+  VellumPlatformClient: {
+    create: () => mockPlatformClientCreate(),
+  },
+}));
+
+// ---------------------------------------------------------------------------
+// Mocks — config/loader
+// ---------------------------------------------------------------------------
+
+mock.module("../config/loader.js", () => ({
+  getConfig: () => ({ services: {} }),
+  loadConfig: () => ({ services: {} }),
+  saveConfig: () => {},
+  invalidateConfigCache: () => {},
+  loadRawConfig: () => mockLoadRawConfig(),
+  saveRawConfig: (raw: Record<string, unknown>) => {
+    mockSaveRawConfigCalls.push(raw);
+  },
+  applyNestedDefaults: (c: unknown) => c,
+  deepMergeMissing: (a: unknown) => a,
+  deepMergeOverwrite: (a: unknown) => a,
+  mergeDefaultWorkspaceConfig: () => {},
+  getNestedValue: (obj: Record<string, unknown>, key: string) =>
+    mockGetNestedValue(obj, key),
+  setNestedValue: (obj: Record<string, unknown>, key: string, value: unknown) =>
+    mockSetNestedValueCalls.push({ obj, key, value }),
+  API_KEY_PROVIDERS: [
+    "anthropic",
+    "openai",
+    "gemini",
+    "ollama",
+    "fireworks",
+    "openrouter",
+    "brave",
+    "perplexity",
+  ],
+}));
+
+// ---------------------------------------------------------------------------
+// Mocks — util/logger (suppress log output)
+// ---------------------------------------------------------------------------
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () => ({
+    info: () => {},
+    warn: () => {},
+    error: () => {},
+    debug: () => {},
+  }),
+  getCliLogger: () => ({
+    info: () => {},
+    warn: () => {},
+    error: () => {},
+    debug: () => {},
+  }),
+}));
+
+// ---------------------------------------------------------------------------
+// Mocks — oauth/oauth-store (transitive dep of oauth/shared.ts)
+// ---------------------------------------------------------------------------
+
+mock.module("../oauth/oauth-store.js", () => ({
+  disconnectOAuthProvider: async () => "not-found" as const,
+  getConnection: () => undefined,
+  getConnectionByProvider: () => undefined,
+  listConnections: () => [],
+  deleteConnection: () => false,
+  upsertApp: async () => ({}),
+  getApp: () => undefined,
+  getAppByProviderAndClientId: () => undefined,
+  getMostRecentAppByProvider: () => undefined,
+  listApps: () => [],
+  deleteApp: async () => false,
+  getProvider: () => undefined,
+  listProviders: () => [],
+  registerProvider: () => ({}),
+  updateProvider: () => undefined,
+  deleteProvider: () => false,
+  seedProviders: () => {},
+  getActiveConnection: () => undefined,
+  listActiveConnectionsByProvider: () => [],
+  createConnection: () => ({}),
+  isProviderConnected: () => false,
+  updateConnection: () => ({}),
+}));
+
+// ---------------------------------------------------------------------------
+// Import the module under test (after mocks are registered)
+// ---------------------------------------------------------------------------
+
+const { registerConfigCommand } = await import("../cli/commands/config.js");
+
+// ---------------------------------------------------------------------------
+// Test helper
+// ---------------------------------------------------------------------------
+
+async function runCli(
+  args: string[],
+): Promise<{ exitCode: number; stdout: string }> {
+  const originalStdoutWrite = process.stdout.write.bind(process.stdout);
+  const originalStderrWrite = process.stderr.write.bind(process.stderr);
+  const stdoutChunks: string[] = [];
+
+  process.stdout.write = ((chunk: unknown) => {
+    stdoutChunks.push(typeof chunk === "string" ? chunk : String(chunk));
+    return true;
+  }) as typeof process.stdout.write;
+
+  process.stderr.write = (() => true) as typeof process.stderr.write;
+
+  process.exitCode = 0;
+
+  try {
+    const program = new Command();
+    program.option("--json", "JSON output");
+    program.exitOverride();
+    program.configureOutput({
+      writeErr: () => {},
+      writeOut: (str: string) => stdoutChunks.push(str),
+    });
+    registerConfigCommand(program);
+    await program.parseAsync(args);
+  } catch {
+    if (process.exitCode === 0) process.exitCode = 1;
+  } finally {
+    process.stdout.write = originalStdoutWrite;
+    process.stderr.write = originalStderrWrite;
+  }
+
+  const exitCode = process.exitCode ?? 0;
+  process.exitCode = 0;
+
+  return {
+    exitCode,
+    stdout: stdoutChunks.join(""),
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("config set — platform connection guard for service mode paths", () => {
+  beforeEach(() => {
+    // Default: not connected to platform
+    mockPlatformClientCreate = async () => null;
+    mockLoadRawConfig = () => ({});
+    mockSaveRawConfigCalls.length = 0;
+    mockSetNestedValueCalls.length = 0;
+    mockGetNestedValue = () => undefined;
+  });
+
+  test("config set services.inference.mode managed — fails when not connected", async () => {
+    const { exitCode, stdout } = await runCli([
+      "node",
+      "assistant",
+      "--json",
+      "config",
+      "set",
+      "services.inference.mode",
+      "managed",
+    ]);
+
+    expect(exitCode).toBe(1);
+    const parsed = JSON.parse(stdout);
+    expect(parsed.ok).toBe(false);
+    expect(parsed.error).toContain("vellum platform connect");
+    expect(parsed.error).toContain("Not connected");
+    // Config should NOT have been written
+    expect(mockSaveRawConfigCalls).toHaveLength(0);
+    expect(mockSetNestedValueCalls).toHaveLength(0);
+  });
+
+  test("config set services.image-generation.mode your-own — succeeds without platform connection", async () => {
+    const { exitCode } = await runCli([
+      "node",
+      "assistant",
+      "--json",
+      "config",
+      "set",
+      "services.image-generation.mode",
+      "your-own",
+    ]);
+
+    expect(exitCode).toBe(0);
+    // Config should have been written — setting to "your-own" doesn't need platform
+    expect(mockSetNestedValueCalls).toHaveLength(1);
+    expect(mockSetNestedValueCalls[0]!.key).toBe(
+      "services.image-generation.mode",
+    );
+    expect(mockSetNestedValueCalls[0]!.value).toBe("your-own");
+    expect(mockSaveRawConfigCalls).toHaveLength(1);
+  });
+
+  test("config set calls.enabled true — succeeds without platform connection", async () => {
+    const { exitCode } = await runCli([
+      "node",
+      "assistant",
+      "config",
+      "set",
+      "calls.enabled",
+      "true",
+    ]);
+
+    expect(exitCode).toBe(0);
+    // Config should have been written
+    expect(mockSetNestedValueCalls).toHaveLength(1);
+    expect(mockSetNestedValueCalls[0]!.key).toBe("calls.enabled");
+    expect(mockSetNestedValueCalls[0]!.value).toBe(true);
+    expect(mockSaveRawConfigCalls).toHaveLength(1);
+  });
+
+  test("config get services.inference.mode — works without platform connection", async () => {
+    mockGetNestedValue = (_obj, key) => {
+      if (key === "services.inference.mode") return "your-own";
+      return undefined;
+    };
+
+    const { exitCode } = await runCli([
+      "node",
+      "assistant",
+      "config",
+      "get",
+      "services.inference.mode",
+    ]);
+
+    expect(exitCode).toBe(0);
+    // No writes should have occurred
+    expect(mockSaveRawConfigCalls).toHaveLength(0);
+    expect(mockSetNestedValueCalls).toHaveLength(0);
+  });
+
+  test("config set services.web-search.mode managed — fails when not connected", async () => {
+    const { exitCode, stdout } = await runCli([
+      "node",
+      "assistant",
+      "--json",
+      "config",
+      "set",
+      "services.web-search.mode",
+      "managed",
+    ]);
+
+    expect(exitCode).toBe(1);
+    const parsed = JSON.parse(stdout);
+    expect(parsed.ok).toBe(false);
+    expect(parsed.error).toContain("vellum platform connect");
+    expect(mockSaveRawConfigCalls).toHaveLength(0);
+  });
+
+  test("config set services.inference.mode managed — succeeds when connected", async () => {
+    mockPlatformClientCreate = async () => ({
+      platformAssistantId: "asst-123",
+      fetch: async () => new Response(),
+    });
+
+    const { exitCode } = await runCli([
+      "node",
+      "assistant",
+      "config",
+      "set",
+      "services.inference.mode",
+      "managed",
+    ]);
+
+    expect(exitCode).toBe(0);
+    expect(mockSetNestedValueCalls).toHaveLength(1);
+    expect(mockSetNestedValueCalls[0]!.key).toBe("services.inference.mode");
+    expect(mockSetNestedValueCalls[0]!.value).toBe("managed");
+    expect(mockSaveRawConfigCalls).toHaveLength(1);
+  });
+});

package/src/__tests__/config-watcher-feature-flags.test.ts

@@ -0,0 +1,211 @@
+import { mkdirSync } from "node:fs";
+import { join } from "node:path";
+import {
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  mock,
+  test,
+} from "bun:test";
+
+// ---------------------------------------------------------------------------
+// Temp directory scaffold
+// ---------------------------------------------------------------------------
+
+const WORKSPACE_DIR = process.env.VELLUM_WORKSPACE_DIR!;
+
+// Use a subdirectory of the test workspace as the mock protected directory
+const PROTECTED_DIR = join(WORKSPACE_DIR, "protected");
+
+// ---------------------------------------------------------------------------
+// Mock platform paths
+// ---------------------------------------------------------------------------
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+  truncateForLog: (v: string) => v,
+}));
+
+// ---------------------------------------------------------------------------
+// Track clearFeatureFlagOverridesCache calls
+// ---------------------------------------------------------------------------
+
+let clearCacheCallCount = 0;
+
+mock.module("../config/assistant-feature-flags.js", () => ({
+  clearFeatureFlagOverridesCache: () => {
+    clearCacheCallCount++;
+  },
+}));
+
+// ---------------------------------------------------------------------------
+// Capture fs.watch calls so we can simulate file system events deterministically
+// ---------------------------------------------------------------------------
+
+type WatchCallback = (eventType: string, filename: string | null) => void;
+
+interface CapturedWatcher {
+  dir: string;
+  callback: WatchCallback;
+  options?: { recursive?: boolean };
+}
+
+const capturedWatchers: CapturedWatcher[] = [];
+
+const fakeWatcher = {
+  close: () => {},
+};
+
+mock.module("node:fs", () => {
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+  const actual = require("node:fs");
+  return {
+    ...actual,
+    watch: (dir: string, ...args: unknown[]) => {
+      let callback: WatchCallback;
+      let options: { recursive?: boolean } | undefined;
+
+      if (typeof args[0] === "function") {
+        callback = args[0] as WatchCallback;
+      } else {
+        options = args[0] as { recursive?: boolean };
+        callback = args[1] as WatchCallback;
+      }
+
+      capturedWatchers.push({ dir, callback, options });
+      return fakeWatcher;
+    },
+  };
+});
+
+// Mock config/loader and other dependencies that ConfigWatcher imports
+mock.module("../config/loader.js", () => ({
+  getConfig: () => ({
+    ui: {},
+  }),
+  invalidateConfigCache: () => {},
+}));
+
+mock.module("../memory/embedding-backend.js", () => ({
+  clearEmbeddingBackendCache: () => {},
+}));
+
+mock.module("../permissions/trust-store.js", () => ({
+  clearCache: () => {},
+}));
+
+mock.module("../providers/registry.js", () => ({
+  initializeProviders: () => {},
+}));
+
+mock.module("../signals/mcp-reload.js", () => ({
+  handleMcpReloadSignal: () => {},
+}));
+
+mock.module("../signals/conversation-undo.js", () => ({
+  handleConversationUndoSignal: () => {},
+}));
+
+// Import after mocks are set up
+const { ConfigWatcher } = await import("../daemon/config-watcher.js");
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+/** Find the watcher for a given directory path. */
+function findWatcher(dir: string): CapturedWatcher | undefined {
+  return capturedWatchers.find((w) => w.dir === dir);
+}
+
+/** Simulate a file change event in a watched directory. */
+function simulateFileChange(dir: string, filename: string): void {
+  const watcher = findWatcher(dir);
+  if (!watcher) throw new Error(`No watcher found for ${dir}`);
+  watcher.callback("change", filename);
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+beforeAll(() => {
+  mkdirSync(WORKSPACE_DIR, { recursive: true });
+  mkdirSync(PROTECTED_DIR, { recursive: true });
+
+  // Point the watcher to our test protected directory
+  process.env.GATEWAY_SECURITY_DIR = PROTECTED_DIR;
+});
+
+let watcher: InstanceType<typeof ConfigWatcher>;
+const onConversationEvict = () => {};
+
+beforeEach(() => {
+  capturedWatchers.length = 0;
+  clearCacheCallCount = 0;
+  watcher = new ConfigWatcher();
+});
+
+afterEach(() => {
+  watcher.stop();
+});
+
+describe("ConfigWatcher feature flags file watcher", () => {
+  test("feature-flags.json change triggers clearFeatureFlagOverridesCache", async () => {
+    watcher.start(onConversationEvict);
+    simulateFileChange(PROTECTED_DIR, "feature-flags.json");
+
+    // Wait for the debounce timer to fire (500ms debounce)
+    await new Promise((r) => setTimeout(r, 700));
+    expect(clearCacheCallCount).toBe(1);
+  });
+
+  test("feature-flags-remote.json change triggers clearFeatureFlagOverridesCache", async () => {
+    watcher.start(onConversationEvict);
+    simulateFileChange(PROTECTED_DIR, "feature-flags-remote.json");
+
+    // Wait for the debounce timer to fire (500ms debounce)
+    await new Promise((r) => setTimeout(r, 700));
+    expect(clearCacheCallCount).toBe(1);
+  });
+
+  test("unrelated file change in protected directory does NOT trigger clearFeatureFlagOverridesCache", async () => {
+    watcher.start(onConversationEvict);
+    simulateFileChange(PROTECTED_DIR, "trust.json");
+
+    // Wait for the debounce timer to fire
+    await new Promise((r) => setTimeout(r, 700));
+    expect(clearCacheCallCount).toBe(0);
+  });
+
+  test("unrelated credential key file does NOT trigger clearFeatureFlagOverridesCache", async () => {
+    watcher.start(onConversationEvict);
+    simulateFileChange(PROTECTED_DIR, "actor-token-signing-key");
+
+    await new Promise((r) => setTimeout(r, 700));
+    expect(clearCacheCallCount).toBe(0);
+  });
+
+  test("both flag files changing are debounced to a single invalidation", async () => {
+    watcher.start(onConversationEvict);
+
+    // Rapid fire changes to both flag files
+    simulateFileChange(PROTECTED_DIR, "feature-flags.json");
+    simulateFileChange(PROTECTED_DIR, "feature-flags-remote.json");
+
+    // Both use the same debounce key "file:feature-flags", so only one call
+    await new Promise((r) => setTimeout(r, 700));
+    expect(clearCacheCallCount).toBe(1);
+  });
+
+  test("protected directory watcher is registered", () => {
+    watcher.start(onConversationEvict);
+    const protectedWatcher = findWatcher(PROTECTED_DIR);
+    expect(protectedWatcher).toBeDefined();
+  });
+});

package/src/__tests__/confirmation-request-guardian-bridge.test.ts

@@ -8,7 +8,7 @@
  * 4. Missing guardian binding causes a skip
  */
 
-import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
+import { beforeEach, describe, expect, mock, test } from "bun:test";
 
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
@@ -76,7 +76,7 @@ import {
   generateCanonicalRequestCode,
   listCanonicalGuardianDeliveries,
 } from "../memory/canonical-guardian-store.js";
-import { getDb, initializeDb, resetDb } from "../memory/db.js";
+import { getDb, initializeDb } from "../memory/db.js";
 import { bridgeConfirmationRequestToGuardian } from "../runtime/confirmation-request-guardian-bridge.js";
 
 initializeDb();
@@ -87,10 +87,6 @@ function resetTables(): void {
   db.run("DELETE FROM canonical_guardian_requests");
 }
 
-afterAll(() => {
-  resetDb();
-});
-
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------

package/src/__tests__/contacts-tools.test.ts

@@ -137,6 +137,37 @@ describe("contact_upsert tool", () => {
     expect(result.content).toContain("slack: @bob");
   });
 
+  test("ignores external identity bindings supplied through tool input", async () => {
+    const result = await executeContactUpsert(
+      {
+        display_name: "Eve",
+        channels: [
+          {
+            type: "slack",
+            address: "@eve",
+            external_user_id: "UATTACKER",
+            external_chat_id: "DATTACKER",
+          },
+        ],
+      },
+      ctx,
+    );
+
+    expect(result.isError).toBe(false);
+
+    const row = getRawDb()
+      .query(
+        "SELECT external_user_id, external_chat_id FROM contact_channels WHERE type = 'slack' AND address = '@eve'",
+      )
+      .get() as {
+      external_user_id: string | null;
+      external_chat_id: string | null;
+    };
+
+    expect(row.external_user_id).toBeNull();
+    expect(row.external_chat_id).toBeNull();
+  });
+
   test("updates an existing contact by ID", async () => {
     const createResult = await executeContactUpsert(
       { display_name: "Charlie" },

package/src/__tests__/context-overflow-reducer.test.ts

@@ -467,6 +467,92 @@ describe("context-overflow-reducer", () => {
     });
   });
 
+  describe("budget-aware media stubbing", () => {
+    test("media stubbing tier retains images within budget", async () => {
+      // Create messages with multiple image-only user messages (5 images in the
+      // latest user message). With budget-aware retention, the reducer should
+      // keep more than the old hardcoded limit of 3 when targetTokens is high.
+      const makeImageBlock = () => ({
+        type: "image" as const,
+        source: {
+          type: "base64" as const,
+          media_type: "image/png" as const,
+          // Small base64 payload so each image doesn't cost many tokens
+          data: "A".repeat(1_000),
+        },
+      });
+
+      const messages: Message[] = [
+        msg("user", "Here are some old images"),
+        {
+          role: "user",
+          content: [makeImageBlock(), makeImageBlock()],
+        },
+        msg("assistant", "I see the old images."),
+        msg("user", "And some more old images"),
+        {
+          role: "user",
+          content: [makeImageBlock()],
+        },
+        msg("assistant", "Got those too."),
+        // Latest user message with 5 images — should retain more than 3
+        {
+          role: "user",
+          content: [
+            makeImageBlock(),
+            makeImageBlock(),
+            makeImageBlock(),
+            makeImageBlock(),
+            makeImageBlock(),
+          ],
+        },
+      ];
+
+      // Set targetTokens very high so all images in the latest message fit
+      const config = makeConfig({
+        targetTokens: 500_000,
+      });
+      const compactFn = makeNoOpCompactFn();
+
+      // Run through forced_compaction and tool_result_truncation first
+      const step1 = await reduceContextOverflow(
+        messages,
+        config,
+        undefined,
+        compactFn,
+      );
+      expect(step1.tier).toBe("forced_compaction");
+
+      const step2 = await reduceContextOverflow(
+        step1.messages,
+        config,
+        step1.state,
+        compactFn,
+      );
+      expect(step2.tier).toBe("tool_result_truncation");
+
+      // Now apply media stubbing
+      const step3 = await reduceContextOverflow(
+        step2.messages,
+        config,
+        step2.state,
+        compactFn,
+      );
+      expect(step3.tier).toBe("media_stubbing");
+
+      // Count remaining image blocks in the latest user message
+      const latestUserMsg = step3.messages[step3.messages.length - 1];
+      expect(latestUserMsg.role).toBe("user");
+      const remainingImages = latestUserMsg.content.filter(
+        (b) => b.type === "image",
+      );
+
+      // With budget-aware retention and a high target, all 5 images should be
+      // retained — more than the old hardcoded limit of 3.
+      expect(remainingImages.length).toBeGreaterThan(3);
+    });
+  });
+
   describe("createInitialReducerState", () => {
     test("returns a clean state with no applied tiers", () => {
       const state = createInitialReducerState();