@vellumai/assistant 0.5.16 → 0.6.1

package/src/__tests__/app-compiler.test.ts

@@ -214,6 +214,126 @@ console.log("styled");`,
     expect(js.length).toBeGreaterThan(100);
   }, 30_000);
 
+  test("rejects relative import that escapes app directory", async () => {
+    const appDir = await scaffold("escape-relative", {
+      "main.tsx": `import data from "../../../../etc/passwd";\nconsole.log(data);`,
+      "index.html": MINIMAL_HTML,
+    });
+
+    const result = await compileApp(appDir);
+
+    expect(result.ok).toBe(false);
+    expect(result.errors.length).toBeGreaterThan(0);
+    expect(result.errors[0].text).toContain(
+      "resolves outside the app directory",
+    );
+  });
+
+  test("rejects absolute path import", async () => {
+    const appDir = await scaffold("escape-absolute", {
+      "main.tsx": `import data from "/etc/passwd";\nconsole.log(data);`,
+      "index.html": MINIMAL_HTML,
+    });
+
+    const result = await compileApp(appDir);
+
+    expect(result.ok).toBe(false);
+    expect(result.errors.length).toBeGreaterThan(0);
+    expect(result.errors[0].text).toContain(
+      "resolves outside the app directory",
+    );
+  });
+
+  test("allows relative imports within app directory", async () => {
+    const appDir = await scaffold("local-relative", {
+      "main.tsx": `import { helper } from "./utils";\nconsole.log(helper);`,
+      "utils.ts": `export const helper = "ok";`,
+      "index.html": MINIMAL_HTML,
+    });
+
+    const result = await compileApp(appDir);
+
+    expect(result.ok).toBe(true);
+    expect(result.errors).toHaveLength(0);
+  });
+
+  test("rejects hex-escaped import that decodes to path traversal", async () => {
+    const appDir = await scaffold("escape-hex", {
+      // \x2e = '.', so this decodes to ../../../../etc/passwd
+      "main.tsx": `import data from "\\x2e\\x2e/\\x2e\\x2e/\\x2e\\x2e/\\x2e\\x2e/etc/passwd";\nconsole.log(data);`,
+      "index.html": MINIMAL_HTML,
+    });
+
+    const result = await compileApp(appDir);
+
+    expect(result.ok).toBe(false);
+    expect(result.errors.length).toBeGreaterThan(0);
+    expect(result.errors[0].text).toContain(
+      "resolves outside the app directory",
+    );
+  });
+
+  test("rejects unicode-escaped import that decodes to path traversal", async () => {
+    const appDir = await scaffold("escape-unicode", {
+      // \u002e = '.', \u002f = '/'
+      "main.tsx": `import data from "\\u002e\\u002e\\u002f\\u002e\\u002e/etc/passwd";\nconsole.log(data);`,
+      "index.html": MINIMAL_HTML,
+    });
+
+    const result = await compileApp(appDir);
+
+    expect(result.ok).toBe(false);
+    expect(result.errors.length).toBeGreaterThan(0);
+    expect(result.errors[0].text).toContain(
+      "resolves outside the app directory",
+    );
+  });
+
+  test("rejects import hidden behind block comment", async () => {
+    const appDir = await scaffold("escape-block-comment", {
+      "main.tsx": `import data from /* bypass */ "../../../../etc/passwd";\nconsole.log(data);`,
+      "index.html": MINIMAL_HTML,
+    });
+
+    const result = await compileApp(appDir);
+
+    expect(result.ok).toBe(false);
+    expect(result.errors.length).toBeGreaterThan(0);
+    expect(result.errors[0].text).toContain(
+      "resolves outside the app directory",
+    );
+  });
+
+  test("rejects import hidden behind line comment", async () => {
+    const appDir = await scaffold("escape-line-comment", {
+      "main.tsx": `import data from // bypass\n"../../../../etc/passwd";\nconsole.log(data);`,
+      "index.html": MINIMAL_HTML,
+    });
+
+    const result = await compileApp(appDir);
+
+    expect(result.ok).toBe(false);
+    expect(result.errors.length).toBeGreaterThan(0);
+    expect(result.errors[0].text).toContain(
+      "resolves outside the app directory",
+    );
+  });
+
+  test("rejects dynamic import escaping app directory", async () => {
+    const appDir = await scaffold("escape-dynamic", {
+      "main.tsx": `const data = await import("../../../../etc/hosts");\nconsole.log(data);`,
+      "index.html": MINIMAL_HTML,
+    });
+
+    const result = await compileApp(appDir);
+
+    expect(result.ok).toBe(false);
+    expect(result.errors.length).toBeGreaterThan(0);
+    expect(result.errors[0].text).toContain(
+      "resolves outside the app directory",
+    );
+  });
+
   test("allowed package uses shared cache on second build", async () => {
     // First build installs the package
     const appDir1 = await scaffold("cache-test-1", {

package/src/__tests__/app-dir-path-guard.test.ts

@@ -18,6 +18,7 @@ import { describe, expect, test } from "bun:test";
 const ALLOWLIST = new Set([
   "assistant/src/memory/app-store.ts", // defines getAppsDir
   "assistant/src/memory/app-git-service.ts", // uses getAppsDir for git repo root, not per-app paths
+  "assistant/src/daemon/app-source-watcher.ts", // uses getAppsDir for recursive fs.watch root, not per-app paths
 ]);
 
 function isTestFile(filePath: string): boolean {

package/src/__tests__/app-executors.test.ts

@@ -11,7 +11,10 @@ mock.module("../bundler/app-compiler.js", () => ({
 
 import type { AppDefinition } from "../memory/app-store.js";
 import type { AppStore } from "../tools/apps/executors.js";
-import { executeAppCreate } from "../tools/apps/executors.js";
+import {
+  executeAppCreate,
+  executeAppRefresh,
+} from "../tools/apps/executors.js";
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -158,3 +161,46 @@ describe("executeAppCreate", () => {
     expect(files["src/main.tsx"]).toBeDefined();
   });
 });
+
+// ---------------------------------------------------------------------------
+// executeAppRefresh
+// ---------------------------------------------------------------------------
+
+describe("executeAppRefresh", () => {
+  test("legacy app: bumps updatedAt without compiling", async () => {
+    const app = makeLegacyApp();
+    const store = mockStore(app);
+    const result = await executeAppRefresh({ app_id: app.id }, store);
+
+    expect(result.isError).toBe(false);
+    const parsed = JSON.parse(result.content);
+    expect(parsed.refreshed).toBe(true);
+    expect(parsed.appId).toBe(app.id);
+    // Legacy apps should not have compile-related fields
+    expect(parsed.compiled).toBeUndefined();
+    expect(parsed.compile_errors).toBeUndefined();
+  });
+
+  test("multifile app: compiles src/ and returns result", async () => {
+    const app = makeMultifileApp();
+    const store = mockStore(app);
+    const result = await executeAppRefresh({ app_id: app.id }, store);
+
+    expect(result.isError).toBe(false);
+    const parsed = JSON.parse(result.content);
+    expect(parsed.refreshed).toBe(true);
+    expect(parsed.appId).toBe(app.id);
+    expect(parsed.compiled).toBe(true);
+    expect(parsed.compile_duration_ms).toBeDefined();
+  });
+
+  test("returns error for unknown app", async () => {
+    const app = makeLegacyApp();
+    const store = mockStore(app);
+    const result = await executeAppRefresh({ app_id: "nonexistent" }, store);
+
+    expect(result.isError).toBe(true);
+    const parsed = JSON.parse(result.content);
+    expect(parsed.error).toContain("not found");
+  });
+});

package/src/__tests__/app-source-watcher.test.ts

@@ -0,0 +1,159 @@
+/**
+ * Tests for AppSourceWatcher — filesystem watcher that detects app source
+ * file changes and triggers debounced recompile + surface refresh.
+ */
+
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  mock,
+  test,
+} from "bun:test";
+
+// ---------------------------------------------------------------------------
+// Mocks — must be set up before importing the module under test
+// ---------------------------------------------------------------------------
+
+const TEST_APPS_DIR = "/tmp/test-apps";
+const testDirNameMap = new Map<string, string>([["my-app", "app-id-1"]]);
+
+let capturedWatchCallback: ((eventType: string, filename: string | null) => void) | null = null;
+const mockWatcher = { close: mock(() => {}) };
+
+mock.module("node:fs", () => {
+  // eslint-disable-next-line @typescript-eslint/no-require-imports
+  const actualFs = require("node:fs");
+  return {
+    ...actualFs,
+    existsSync: mock((p: string) => p === TEST_APPS_DIR),
+    watch: mock(
+      (
+        _path: string,
+        _opts: Record<string, unknown>,
+        callback: (eventType: string, filename: string | null) => void,
+      ) => {
+        capturedWatchCallback = callback;
+        return mockWatcher;
+      },
+    ),
+  };
+});
+
+mock.module("../memory/app-store.js", () => ({
+  getAppsDir: mock(() => TEST_APPS_DIR),
+  resolveAppIdByDirName: mock(
+    (dirName: string) => testDirNameMap.get(dirName) ?? null,
+  ),
+}));
+
+// ---------------------------------------------------------------------------
+// Import after mocks
+// ---------------------------------------------------------------------------
+
+import { AppSourceWatcher } from "../daemon/app-source-watcher.js";
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("AppSourceWatcher", () => {
+  let watcher: AppSourceWatcher;
+  let onChangeSpy: ReturnType<typeof mock>;
+
+  beforeEach(() => {
+    watcher = new AppSourceWatcher();
+    onChangeSpy = mock(() => {});
+    capturedWatchCallback = null;
+    mockWatcher.close.mockClear();
+  });
+
+  afterEach(() => {
+    watcher.stop();
+  });
+
+  test("start() creates a recursive watcher on the apps directory", () => {
+    watcher.start(onChangeSpy);
+    expect(capturedWatchCallback).not.toBeNull();
+  });
+
+  test("source file change triggers callback with resolved appId", async () => {
+    watcher.start(onChangeSpy);
+    capturedWatchCallback!("change", "my-app/src/main.tsx");
+
+    // Wait for debounce (500ms + margin)
+    await new Promise((r) => setTimeout(r, 600));
+    expect(onChangeSpy).toHaveBeenCalledTimes(1);
+    expect(onChangeSpy).toHaveBeenCalledWith("app-id-1");
+  });
+
+  test("root-level app file triggers callback", async () => {
+    watcher.start(onChangeSpy);
+    capturedWatchCallback!("change", "my-app/index.html");
+
+    await new Promise((r) => setTimeout(r, 600));
+    expect(onChangeSpy).toHaveBeenCalledTimes(1);
+    expect(onChangeSpy).toHaveBeenCalledWith("app-id-1");
+  });
+
+  test("dist/ files are filtered out", async () => {
+    watcher.start(onChangeSpy);
+    capturedWatchCallback!("change", "my-app/dist/index.html");
+
+    await new Promise((r) => setTimeout(r, 600));
+    expect(onChangeSpy).not.toHaveBeenCalled();
+  });
+
+  test("records/ files are filtered out", async () => {
+    watcher.start(onChangeSpy);
+    capturedWatchCallback!("change", "my-app/records/rec-1.json");
+
+    await new Promise((r) => setTimeout(r, 600));
+    expect(onChangeSpy).not.toHaveBeenCalled();
+  });
+
+  test("files directly in apps/ (no subdirectory) are filtered out", async () => {
+    watcher.start(onChangeSpy);
+    capturedWatchCallback!("change", "my-app.json");
+
+    await new Promise((r) => setTimeout(r, 600));
+    expect(onChangeSpy).not.toHaveBeenCalled();
+  });
+
+  test("unknown app directory is filtered out", async () => {
+    watcher.start(onChangeSpy);
+    capturedWatchCallback!("change", "unknown-app/src/main.tsx");
+
+    await new Promise((r) => setTimeout(r, 600));
+    expect(onChangeSpy).not.toHaveBeenCalled();
+  });
+
+  test("null filename is ignored", async () => {
+    watcher.start(onChangeSpy);
+    capturedWatchCallback!("change", null);
+
+    await new Promise((r) => setTimeout(r, 600));
+    expect(onChangeSpy).not.toHaveBeenCalled();
+  });
+
+  test("rapid changes to same app are debounced into single callback", async () => {
+    watcher.start(onChangeSpy);
+
+    capturedWatchCallback!("change", "my-app/src/main.tsx");
+    capturedWatchCallback!("change", "my-app/src/styles.css");
+    capturedWatchCallback!("change", "my-app/src/utils.ts");
+
+    await new Promise((r) => setTimeout(r, 600));
+    expect(onChangeSpy).toHaveBeenCalledTimes(1);
+  });
+
+  test("stop() closes watcher and cancels pending timers", () => {
+    watcher.start(onChangeSpy);
+    capturedWatchCallback!("change", "my-app/src/main.tsx");
+
+    watcher.stop();
+
+    expect(mockWatcher.close).toHaveBeenCalledTimes(1);
+  });
+});

package/src/__tests__/assistant-feature-flags-integration.test.ts

@@ -12,7 +12,7 @@ import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 // Test-scoped config state
 // ---------------------------------------------------------------------------
 
-const DECLARED_FLAG_ID = "contacts";
+const DECLARED_FLAG_ID = "sounds";
 const DECLARED_FLAG_KEY = DECLARED_FLAG_ID;
 
 const { isAssistantFeatureFlagEnabled, _setOverridesForTesting } =
@@ -54,7 +54,7 @@ describe("isAssistantFeatureFlagEnabled", () => {
 
   test("missing persisted value falls back to defaults registry defaultEnabled", () => {
     // No explicit config at all — should fall back to defaults registry
-    // which has defaultEnabled: true for contacts
+    // which has defaultEnabled: true for sounds
     const config = {} as any;
 
     expect(isAssistantFeatureFlagEnabled(DECLARED_FLAG_KEY, config)).toBe(true);

package/src/__tests__/call-conversation-messages.test.ts

@@ -1,4 +1,4 @@
-import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
+import { beforeEach, describe, expect, mock, test } from "bun:test";
 
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
@@ -17,7 +17,7 @@ import {
   updateCallSession,
 } from "../calls/call-store.js";
 import { getMessages } from "../memory/conversation-crud.js";
-import { getDb, initializeDb, resetDb } from "../memory/db.js";
+import { getDb, initializeDb } from "../memory/db.js";
 import { conversations } from "../memory/schema.js";
 
 initializeDb();
@@ -65,10 +65,6 @@ describe("call-conversation-messages", () => {
     resetTables();
   });
 
-  afterAll(() => {
-    resetDb();
-  });
-
   test("buildCallCompletionMessage labels failed calls correctly", () => {
     const conversationId = "conv-call-msg-failed";
     ensureConversation(conversationId);

package/src/__tests__/call-domain.test.ts

@@ -7,7 +7,7 @@
  * - Voice-ingress preflight blocks doomed outbound calls before Twilio dialing.
  * - Pointer messages are written on successful call start and on failure.
  */
-import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
+import { beforeEach, describe, expect, mock, test } from "bun:test";
 
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
@@ -120,7 +120,7 @@ import {
 } from "../calls/call-domain.js";
 import type { AssistantConfig } from "../config/types.js";
 import { getMessages } from "../memory/conversation-crud.js";
-import { getDb, initializeDb, resetDb } from "../memory/db.js";
+import { getDb, initializeDb } from "../memory/db.js";
 import { conversations } from "../memory/schema.js";
 
 initializeDb();
@@ -185,10 +185,6 @@ function getLatestAssistantText(conversationId: string): string | null {
   return latest.content;
 }
 
-afterAll(() => {
-  resetDb();
-});
-
 function makeConfig(
   overrides: {
     allowPerCallOverride?: boolean;

package/src/__tests__/call-pointer-messages.test.ts

@@ -1,12 +1,4 @@
-import {
-  afterAll,
-  afterEach,
-  beforeEach,
-  describe,
-  expect,
-  mock,
-  test,
-} from "bun:test";
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
@@ -22,7 +14,7 @@ import {
   setPointerMessageProcessor,
 } from "../calls/call-pointer-messages.js";
 import { addMessage, getMessages } from "../memory/conversation-crud.js";
-import { getDb, initializeDb, resetDb } from "../memory/db.js";
+import { getDb, initializeDb } from "../memory/db.js";
 import { conversations } from "../memory/schema.js";
 
 initializeDb();
@@ -110,10 +102,6 @@ describe("addPointerMessage", () => {
     resetPointerMessageProcessor();
   });
 
-  afterAll(() => {
-    resetDb();
-  });
-
   test("adds a started pointer message", () => {
     const convId = "conv-ptr-started";
     ensureConversation(convId);

package/src/__tests__/call-recovery.test.ts

@@ -1,4 +1,4 @@
-import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
+import { beforeEach, describe, expect, mock, test } from "bun:test";
 
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
@@ -26,15 +26,11 @@ import {
   updateCallSession,
 } from "../calls/call-store.js";
 import type { VoiceProvider } from "../calls/voice-provider.js";
-import { getDb, initializeDb, resetDb } from "../memory/db.js";
+import { getDb, initializeDb } from "../memory/db.js";
 import { conversations } from "../memory/schema.js";
 
 initializeDb();
 
-afterAll(() => {
-  resetDb();
-});
-
 /** Ensure a conversation row exists for the given ID so FK constraints pass. */
 let ensuredConvIds = new Set<string>();
 function ensureConversation(id: string): void {

package/src/__tests__/call-routes-http.test.ts

@@ -5,7 +5,7 @@
  * POST /v1/calls/:id/cancel, and POST /v1/calls/:id/answer
  * through RuntimeHttpServer.
  */
-import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
+import { beforeEach, describe, expect, mock, test } from "bun:test";
 
 mock.module("../config/env.js", () => ({ isHttpAuthDisabled: () => true }));
 
@@ -105,7 +105,7 @@ import {
   createPendingQuestion,
   updateCallSession,
 } from "../calls/call-store.js";
-import { getDb, initializeDb, resetDb } from "../memory/db.js";
+import { getDb, initializeDb } from "../memory/db.js";
 import { conversations } from "../memory/schema.js";
 import { RuntimeHttpServer } from "../runtime/http-server.js";
 
@@ -162,10 +162,6 @@ describe("runtime call routes — HTTP layer", () => {
     resetTables();
   });
 
-  afterAll(() => {
-    resetDb();
-  });
-
   async function startServer(): Promise<void> {
     server = new RuntimeHttpServer({ port: 0, bearerToken: TEST_TOKEN });
     await server.start();

package/src/__tests__/call-store.test.ts

@@ -1,4 +1,4 @@
-import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
+import { beforeEach, describe, expect, mock, test } from "bun:test";
 
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
@@ -23,15 +23,11 @@ import {
   releaseCallbackClaim,
   updateCallSession,
 } from "../calls/call-store.js";
-import { getDb, initializeDb, resetDb } from "../memory/db.js";
+import { getDb, initializeDb } from "../memory/db.js";
 import { conversations } from "../memory/schema.js";
 
 initializeDb();
 
-afterAll(() => {
-  resetDb();
-});
-
 /** Ensure a conversation row exists for the given ID so FK constraints pass. */
 let ensuredConvIds = new Set<string>();
 function ensureConversation(id: string): void {

package/src/__tests__/cancel-resolves-conversation-key.test.ts

@@ -6,7 +6,7 @@
  * from the daemon's internal ID), fails to find the conversation, and
  * silently ignores the cancel — leaving the stream running.
  */
-import { afterAll, describe, expect, mock, test } from "bun:test";
+import { describe, expect, mock, test } from "bun:test";
 
 mock.module("../config/env.js", () => ({ isHttpAuthDisabled: () => true }));
 
@@ -43,15 +43,11 @@ mock.module("../config/loader.js", () => ({
 }));
 
 import { getOrCreateConversation } from "../memory/conversation-key-store.js";
-import { initializeDb, resetDb } from "../memory/db.js";
+import { initializeDb } from "../memory/db.js";
 import { conversationManagementRouteDefinitions } from "../runtime/routes/conversation-management-routes.js";
 
 initializeDb();
 
-afterAll(() => {
-  resetDb();
-});
-
 describe("POST /v1/conversations/:id/cancel", () => {
   test("resolves conversation key to internal ID before cancelling", () => {
     // Create a conversation via key — this assigns an internal ID that

package/src/__tests__/canonical-guardian-store.test.ts

@@ -1,4 +1,4 @@
-import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
+import { beforeEach, describe, expect, mock, test } from "bun:test";
 
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
@@ -21,7 +21,7 @@ import {
   updateCanonicalGuardianDelivery,
   updateCanonicalGuardianRequest,
 } from "../memory/canonical-guardian-store.js";
-import { getDb, initializeDb, resetDb } from "../memory/db.js";
+import { getDb, initializeDb } from "../memory/db.js";
 
 initializeDb();
 
@@ -40,10 +40,6 @@ describe("canonical-guardian-store", () => {
     resetTables();
   });
 
-  afterAll(() => {
-    resetDb();
-  });
-
   // ── createCanonicalGuardianRequest ────────────────────────────────
 
   test("creates a request with all fields populated", () => {

package/src/__tests__/channel-delivery-store.test.ts

@@ -1,4 +1,4 @@
-import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
+import { beforeEach, describe, expect, mock, test } from "bun:test";
 
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
@@ -13,7 +13,7 @@ import {
   getConversationByKey,
   setConversationKey,
 } from "../memory/conversation-key-store.js";
-import { getDb, initializeDb, resetDb } from "../memory/db.js";
+import { getDb, initializeDb } from "../memory/db.js";
 import {
   clearPayload,
   findMessageBySourceId,
@@ -40,10 +40,6 @@ import { handleDeleteConversation } from "../runtime/routes/channel-routes.js";
 
 initializeDb();
 
-afterAll(() => {
-  resetDb();
-});
-
 function resetTables() {
   const db = getDb();
   db.run("DELETE FROM channel_inbound_events");

package/src/__tests__/channel-retry-sweep.test.ts

@@ -1,4 +1,4 @@
-import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
+import { beforeEach, describe, expect, mock, test } from "bun:test";
 
 import { eq } from "drizzle-orm";
 
@@ -9,17 +9,13 @@ mock.module("../util/logger.js", () => ({
     }),
 }));
 
-import { getDb, initializeDb, resetDb } from "../memory/db.js";
+import { getDb, initializeDb } from "../memory/db.js";
 import * as deliveryCrud from "../memory/delivery-crud.js";
 import { channelInboundEvents, messages } from "../memory/schema.js";
 import { sweepFailedEvents } from "../runtime/channel-retry-sweep.js";
 
 initializeDb();
 
-afterAll(() => {
-  resetDb();
-});
-
 function resetTables(): void {
   const db = getDb();
   db.run("DELETE FROM channel_inbound_events");