@vellumai/assistant 0.5.5 → 0.5.7

package/src/__tests__/assistant-feature-flags-integration.test.ts

@@ -5,7 +5,7 @@
  * Covers:
  *   - Flag OFF blocks all exposure paths
  *   - Missing persisted value falls back to code default
- *   - New assistantFeatureFlagValues is the sole override mechanism
+ *   - Protected feature-flags.json is the sole override mechanism
  *   - Undeclared keys default to enabled
  */
 import {
@@ -101,7 +101,6 @@ mock.module("../config/loader.js", () => ({
   invalidateConfigCache: () => {},
   getNestedValue: () => undefined,
   setNestedValue: () => {},
-  syncConfigToLockfile: () => {},
 }));
 
 // eslint-disable-next-line @typescript-eslint/no-require-imports
@@ -120,7 +119,7 @@ mock.module("../tools/credentials/metadata-store.js", () => ({
 }));
 
 const { buildSystemPrompt } = await import("../prompts/system-prompt.js");
-const { isAssistantFeatureFlagEnabled } =
+const { isAssistantFeatureFlagEnabled, _setOverridesForTesting } =
   await import("../config/assistant-feature-flags.js");
 const { skillFlagKey } = await import("../config/skill-state.js");
 
@@ -130,6 +129,7 @@ const { skillFlagKey } = await import("../config/skill-state.js");
 
 beforeEach(() => {
   mkdirSync(TEST_DIR, { recursive: true });
+  _setOverridesForTesting({});
   currentConfig = {
     services: {
       inference: {
@@ -148,6 +148,7 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  _setOverridesForTesting({});
   if (existsSync(TEST_DIR)) {
     rmSync(TEST_DIR, { recursive: true, force: true });
   }
@@ -198,11 +199,12 @@ describe("buildSystemPrompt assistant feature flag filtering", () => {
       "browser",
     );
 
+    _setOverridesForTesting({
+      [DECLARED_FLAG_KEY]: false,
+      "feature_flags.browser.enabled": true,
+    });
+
     currentConfig = {
-      assistantFeatureFlagValues: {
-        [DECLARED_FLAG_KEY]: false,
-        "feature_flags.browser.enabled": true,
-      },
       services: {
         inference: {
           mode: "your-own",
@@ -282,11 +284,12 @@ describe("buildSystemPrompt assistant feature flag filtering", () => {
       "email-channel",
     );
 
+    _setOverridesForTesting({
+      [DECLARED_FLAG_KEY]: false,
+      "feature_flags.email-channel.enabled": false,
+    });
+
     currentConfig = {
-      assistantFeatureFlagValues: {
-        [DECLARED_FLAG_KEY]: false,
-        "feature_flags.email-channel.enabled": false,
-      },
       services: {
         inference: {
           mode: "your-own",
@@ -311,7 +314,7 @@ describe("buildSystemPrompt assistant feature flag filtering", () => {
     expect(result).not.toContain("**email-channel**");
   });
 
-  test("assistantFeatureFlagValues overrides control visibility", () => {
+  test("file-based overrides control visibility", () => {
     createSkillOnDisk(
       DECLARED_SKILL_ID,
       "Contacts",
@@ -319,8 +322,9 @@ describe("buildSystemPrompt assistant feature flag filtering", () => {
       DECLARED_FLAG_ID,
     );
 
+    _setOverridesForTesting({ [DECLARED_FLAG_KEY]: true });
+
     currentConfig = {
-      assistantFeatureFlagValues: { [DECLARED_FLAG_KEY]: true },
       services: {
         inference: {
           mode: "your-own",
@@ -352,8 +356,9 @@ describe("buildSystemPrompt assistant feature flag filtering", () => {
       "browser",
     );
 
+    _setOverridesForTesting({ "feature_flags.browser.enabled": false });
+
     currentConfig = {
-      assistantFeatureFlagValues: { "feature_flags.browser.enabled": false },
       services: {
         inference: {
           mode: "your-own",
@@ -446,18 +451,16 @@ describe("buildSystemPrompt assistant feature flag filtering", () => {
 // ---------------------------------------------------------------------------
 
 describe("isAssistantFeatureFlagEnabled", () => {
-  test("reads from assistantFeatureFlagValues", () => {
-    const config = {
-      assistantFeatureFlagValues: { [DECLARED_FLAG_KEY]: true },
-    } as any;
+  test("reads from file-based overrides", () => {
+    _setOverridesForTesting({ [DECLARED_FLAG_KEY]: true });
+    const config = {} as any;
 
     expect(isAssistantFeatureFlagEnabled(DECLARED_FLAG_KEY, config)).toBe(true);
   });
 
-  test("explicit false override in assistantFeatureFlagValues", () => {
-    const config = {
-      assistantFeatureFlagValues: { [DECLARED_FLAG_KEY]: false },
-    } as any;
+  test("explicit false override in file-based overrides", () => {
+    _setOverridesForTesting({ [DECLARED_FLAG_KEY]: false });
+    const config = {} as any;
 
     expect(isAssistantFeatureFlagEnabled(DECLARED_FLAG_KEY, config)).toBe(
       false,
@@ -483,10 +486,9 @@ describe("isAssistantFeatureFlagEnabled", () => {
     ).toBe(true);
   });
 
-  test("undeclared flag respects persisted canonical override", () => {
-    const config = {
-      assistantFeatureFlagValues: { "feature_flags.browser.enabled": false },
-    } as any;
+  test("undeclared flag respects persisted override", () => {
+    _setOverridesForTesting({ "feature_flags.browser.enabled": false });
+    const config = {} as any;
 
     expect(
       isAssistantFeatureFlagEnabled("feature_flags.browser.enabled", config),
@@ -496,9 +498,8 @@ describe("isAssistantFeatureFlagEnabled", () => {
 
 describe("isAssistantFeatureFlagEnabled with skillFlagKey", () => {
   test("resolves skill flag via canonical path", () => {
-    const config = {
-      assistantFeatureFlagValues: { [DECLARED_FLAG_KEY]: false },
-    } as any;
+    _setOverridesForTesting({ [DECLARED_FLAG_KEY]: false });
+    const config = {} as any;
 
     expect(
       isAssistantFeatureFlagEnabled(

package/src/__tests__/browser-skill-endstate.test.ts

@@ -7,13 +7,10 @@
 import { afterAll, beforeAll, describe, expect, mock, test } from "bun:test";
 
 mock.module("../config/loader.js", () => ({
-  getConfig: () => ({
-    assistantFeatureFlagValues: {
-      "feature_flags.browser.enabled": true,
-    },
-  }),
+  getConfig: () => ({}),
 }));
 
+import { _setOverridesForTesting } from "../config/assistant-feature-flags.js";
 import {
   projectSkillTools,
   resetSkillToolProjection,
@@ -35,11 +32,15 @@ import {
 
 afterAll(() => {
   __resetRegistryForTesting();
+  _setOverridesForTesting({});
 });
 
 describe("browser skill migration end-state", () => {
   beforeAll(async () => {
     __resetRegistryForTesting();
+    _setOverridesForTesting({
+      "feature_flags.browser.enabled": true,
+    });
     await initializeTools();
   });
 

package/src/__tests__/btw-routes.test.ts

@@ -54,17 +54,6 @@ mock.module("../daemon/conversation-tool-setup.js", () => ({
   buildToolDefinitions: () => MOCK_TOOLS,
 }));
 
-const mockCheckIngressForSecrets = mock((content: string) => ({
-  blocked: false,
-  userNotice: "",
-  detectedTypes: [] as string[],
-  normalizedContent: content,
-}));
-
-mock.module("../security/secret-ingress.js", () => ({
-  checkIngressForSecrets: mockCheckIngressForSecrets,
-}));
-
 const MOCK_SYSTEM_PROMPT = "You are a helpful assistant.";
 const mockBuildSystemPrompt = mock(() => MOCK_SYSTEM_PROMPT);
 
@@ -236,34 +225,6 @@ describe("POST /v1/btw", () => {
     expect(body.error.message).toContain("content");
   });
 
-  test("returns 422 when content includes a blocked secret", async () => {
-    mockCheckIngressForSecrets.mockReturnValueOnce({
-      blocked: true,
-      userNotice: "Secret detected",
-      detectedTypes: ["api_key"],
-      normalizedContent: "sk-test-123",
-    });
-
-    const provider = makeMockProvider();
-    const session = makeMockSession(provider);
-    const res = await callHandler(
-      { conversationKey: "key", content: "sk-test-123" },
-      { sendMessageDeps: makeSendMessageDeps(session) },
-    );
-
-    expect(res.status).toBe(422);
-    const body = (await res.json()) as {
-      accepted: boolean;
-      error: string;
-      message: string;
-      detectedTypes: string[];
-    };
-    expect(body.accepted).toBe(false);
-    expect(body.error).toBe("secret_blocked");
-    expect(body.detectedTypes).toEqual(["api_key"]);
-    expect(provider.sendMessage).not.toHaveBeenCalled();
-  });
-
   // -- Service unavailability (503) --
 
   test("returns 503 when sendMessageDeps is unavailable", async () => {

package/src/__tests__/call-domain.test.ts

@@ -40,46 +40,6 @@ let twilioInitiateCallArgs: Array<Record<string, unknown>> = [];
 let mockIngressEnabled = true;
 let mockIngressPublicBaseUrl = "https://test.example.com";
 
-interface MockGatewayHealthResult {
-  target: string;
-  healthy: boolean;
-  localDeployment: boolean;
-  error?: string;
-}
-
-interface MockEnsureLocalGatewayReadyResult extends MockGatewayHealthResult {
-  recovered: boolean;
-  recoveryAttempted: boolean;
-  recoverySkipped: boolean;
-}
-
-let probeLocalGatewayHealthResults: MockGatewayHealthResult[] = [];
-let probeLocalGatewayHealthCallCount = 0;
-let ensureLocalGatewayReadyResult: MockEnsureLocalGatewayReadyResult;
-let ensureLocalGatewayReadyCallCount = 0;
-
-function makeGatewayHealthResult(
-  overrides: Partial<MockGatewayHealthResult> = {},
-): MockGatewayHealthResult {
-  return {
-    target: "http://127.0.0.1:7830",
-    healthy: true,
-    localDeployment: true,
-    ...overrides,
-  };
-}
-
-function makeRecoveryResult(
-  overrides: Partial<MockEnsureLocalGatewayReadyResult> = {},
-): MockEnsureLocalGatewayReadyResult {
-  return {
-    ...makeGatewayHealthResult(),
-    recovered: false,
-    recoveryAttempted: false,
-    recoverySkipped: false,
-    ...overrides,
-  };
-}
 
 mock.module("../calls/twilio-config.js", () => ({
   getTwilioConfig: (assistantId?: string) => ({
@@ -160,18 +120,6 @@ mock.module("../memory/conversation-title-service.js", () => ({
   queueGenerateConversationTitle: () => {},
 }));
 
-mock.module("../runtime/local-gateway-health.js", () => ({
-  probeLocalGatewayHealth: async () => {
-    probeLocalGatewayHealthCallCount++;
-    const next =
-      probeLocalGatewayHealthResults.shift() ?? makeGatewayHealthResult();
-    return next;
-  },
-  ensureLocalGatewayReady: async () => {
-    ensureLocalGatewayReadyCallCount++;
-    return ensureLocalGatewayReadyResult;
-  },
-}));
 
 mock.module("../daemon/handlers/config-ingress.js", () => ({
   computeGatewayTarget: () => "http://127.0.0.1:7830",
@@ -204,13 +152,6 @@ beforeEach(() => {
   twilioInitiateCallArgs = [];
   mockIngressEnabled = true;
   mockIngressPublicBaseUrl = "https://test.example.com";
-  probeLocalGatewayHealthResults = [
-    makeGatewayHealthResult(),
-    makeGatewayHealthResult(),
-  ];
-  probeLocalGatewayHealthCallCount = 0;
-  ensureLocalGatewayReadyResult = makeRecoveryResult();
-  ensureLocalGatewayReadyCallCount = 0;
 });
 
 let ensuredConvIds = new Set<string>();
@@ -446,9 +387,6 @@ describe("startCall — pointer message regression", () => {
       expect(result.status).toBe(503);
       expect(result.error).toContain("Public ingress");
     }
-    expect(probeLocalGatewayHealthCallCount).toBe(0);
-    expect(ensureLocalGatewayReadyCallCount).toBe(0);
-    // No reconcile calls expected (reconcile triggers removed).
     expect(twilioInitiateCallCount).toBe(0);
 
     await new Promise((r) => setTimeout(r, 50));
@@ -459,72 +397,6 @@ describe("startCall — pointer message regression", () => {
     expect(text!).toContain("failed");
   });
 
-  test("never dials Twilio when the local callback gateway stays unhealthy", async () => {
-    const convId = "conv-domain-preflight-unhealthy";
-    ensureConversation(convId);
-    probeLocalGatewayHealthResults = [
-      makeGatewayHealthResult({
-        healthy: false,
-        error: "Gateway health check returned HTTP 503",
-      }),
-      makeGatewayHealthResult({
-        healthy: false,
-        error: "Gateway health check returned HTTP 503",
-      }),
-    ];
-    ensureLocalGatewayReadyResult = makeRecoveryResult({
-      healthy: false,
-      error: "Gateway health check returned HTTP 503",
-      recovered: false,
-      recoveryAttempted: true,
-    });
-
-    const result = await startCall({
-      phoneNumber: "+15559876543",
-      task: "Test call",
-      conversationId: convId,
-    });
-
-    expect(result.ok).toBe(false);
-    if (!result.ok) {
-      expect(result.status).toBe(503);
-      expect(result.error).toContain("still unhealthy");
-    }
-    expect(probeLocalGatewayHealthCallCount).toBe(2);
-    expect(ensureLocalGatewayReadyCallCount).toBe(1);
-    // No reconcile calls expected (reconcile triggers removed).
-    expect(twilioInitiateCallCount).toBe(0);
-  });
-
-  test("can recover a local gateway and then place exactly one outbound Twilio call", async () => {
-    const convId = "conv-domain-preflight-recovery";
-    ensureConversation(convId);
-    probeLocalGatewayHealthResults = [
-      makeGatewayHealthResult({
-        healthy: false,
-        error: "Gateway health check returned HTTP 503",
-      }),
-      makeGatewayHealthResult(),
-    ];
-    ensureLocalGatewayReadyResult = makeRecoveryResult({
-      healthy: true,
-      recovered: true,
-      recoveryAttempted: true,
-    });
-
-    const result = await startCall({
-      phoneNumber: "+15559876543",
-      task: "Test call",
-      conversationId: convId,
-    });
-
-    expect(result.ok).toBe(true);
-    expect(probeLocalGatewayHealthCallCount).toBe(2);
-    expect(ensureLocalGatewayReadyCallCount).toBe(1);
-    // Gateway reconcile triggers have been removed; the gateway reads
-    // credentials and config via TTL caches.
-    expect(twilioInitiateCallCount).toBe(1);
-  });
 
   test("failed call writes a failed pointer to the initiating conversation", async () => {
     const convId = "conv-domain-ptr-fail";

package/src/__tests__/ces-rpc-credential-backend.test.ts

@@ -0,0 +1,199 @@
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+import { CesRpcMethod } from "@vellumai/ces-contracts";
+
+// ---------------------------------------------------------------------------
+// Mock state
+// ---------------------------------------------------------------------------
+
+const callFn = mock(
+  async (_method: string, _request: unknown): Promise<unknown> => ({}),
+);
+
+const isReadyFn = mock((): boolean => true);
+
+// ---------------------------------------------------------------------------
+// Mock modules — before importing module under test
+// ---------------------------------------------------------------------------
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+// Import after mocking
+import type { CesClient } from "../credential-execution/client.js";
+import { CesRpcCredentialBackend } from "../security/ces-rpc-credential-backend.js";
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function createMockClient(): CesClient {
+  return {
+    handshake: mock(async () => ({ accepted: true })),
+    call: callFn as CesClient["call"],
+    updateAssistantApiKey: mock(async () => ({ updated: true })),
+    isReady: isReadyFn,
+    close: mock(() => {}),
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("CesRpcCredentialBackend", () => {
+  let client: CesClient;
+  let backend: CesRpcCredentialBackend;
+
+  beforeEach(() => {
+    callFn.mockClear();
+    isReadyFn.mockClear();
+
+    isReadyFn.mockReturnValue(true);
+
+    client = createMockClient();
+    backend = new CesRpcCredentialBackend(client);
+  });
+
+  test("has name 'ces-rpc'", () => {
+    expect(backend.name).toBe("ces-rpc");
+  });
+
+  // -------------------------------------------------------------------------
+  // isAvailable
+  // -------------------------------------------------------------------------
+
+  describe("isAvailable", () => {
+    test("returns true when client is ready", () => {
+      isReadyFn.mockReturnValue(true);
+      expect(backend.isAvailable()).toBe(true);
+    });
+
+    test("returns false when client is not ready", () => {
+      isReadyFn.mockReturnValue(false);
+      expect(backend.isAvailable()).toBe(false);
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // get
+  // -------------------------------------------------------------------------
+
+  describe("get", () => {
+    test("delegates to CesRpcMethod.GetCredential and returns value when found", async () => {
+      callFn.mockResolvedValue({ found: true, value: "my-secret" });
+
+      const result = await backend.get("test-account");
+
+      expect(callFn).toHaveBeenCalledWith(CesRpcMethod.GetCredential, {
+        account: "test-account",
+      });
+      expect(result).toEqual({ value: "my-secret", unreachable: false });
+    });
+
+    test("returns undefined value when credential not found", async () => {
+      callFn.mockResolvedValue({ found: false });
+
+      const result = await backend.get("missing-account");
+
+      expect(callFn).toHaveBeenCalledWith(CesRpcMethod.GetCredential, {
+        account: "missing-account",
+      });
+      expect(result).toEqual({ value: undefined, unreachable: false });
+    });
+
+    test("returns unreachable when RPC call throws", async () => {
+      callFn.mockRejectedValue(new Error("transport error"));
+
+      const result = await backend.get("broken-account");
+
+      expect(result).toEqual({ value: undefined, unreachable: true });
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // set
+  // -------------------------------------------------------------------------
+
+  describe("set", () => {
+    test("delegates to CesRpcMethod.SetCredential and returns true on success", async () => {
+      callFn.mockResolvedValue({ ok: true });
+
+      const result = await backend.set("test-account", "new-secret");
+
+      expect(callFn).toHaveBeenCalledWith(CesRpcMethod.SetCredential, {
+        account: "test-account",
+        value: "new-secret",
+      });
+      expect(result).toBe(true);
+    });
+
+    test("returns false when RPC call throws", async () => {
+      callFn.mockRejectedValue(new Error("transport error"));
+
+      const result = await backend.set("test-account", "new-secret");
+
+      expect(result).toBe(false);
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // delete
+  // -------------------------------------------------------------------------
+
+  describe("delete", () => {
+    test("delegates to CesRpcMethod.DeleteCredential and returns the result", async () => {
+      callFn.mockResolvedValue({ result: "deleted" });
+
+      const result = await backend.delete("test-account");
+
+      expect(callFn).toHaveBeenCalledWith(CesRpcMethod.DeleteCredential, {
+        account: "test-account",
+      });
+      expect(result).toBe("deleted");
+    });
+
+    test("returns not-found result from CES", async () => {
+      callFn.mockResolvedValue({ result: "not-found" });
+
+      const result = await backend.delete("nonexistent-account");
+
+      expect(result).toBe("not-found");
+    });
+
+    test("returns 'error' when RPC call throws", async () => {
+      callFn.mockRejectedValue(new Error("transport error"));
+
+      const result = await backend.delete("test-account");
+
+      expect(result).toBe("error");
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // list
+  // -------------------------------------------------------------------------
+
+  describe("list", () => {
+    test("delegates to CesRpcMethod.ListCredentials and returns accounts", async () => {
+      callFn.mockResolvedValue({ accounts: ["account-a", "account-b"] });
+
+      const result = await backend.list();
+
+      expect(callFn).toHaveBeenCalledWith(CesRpcMethod.ListCredentials, {});
+      expect(result).toEqual(["account-a", "account-b"]);
+    });
+
+    test("returns empty array when RPC call throws", async () => {
+      callFn.mockRejectedValue(new Error("transport error"));
+
+      const result = await backend.list();
+
+      expect(result).toEqual([]);
+    });
+  });
+});

package/src/__tests__/channel-approval-routes.test.ts

@@ -38,11 +38,6 @@ mock.module("../util/logger.js", () => ({
     }),
 }));
 
-// Mock security check to always pass
-mock.module("../security/secret-ingress.js", () => ({
-  checkIngressForSecrets: () => ({ blocked: false }),
-}));
-
 // Mock render to return the raw content as text
 mock.module("../daemon/handlers/shared.js", () => ({
   renderHistoryContent: (content: unknown) => ({