@vellumai/assistant 0.5.6 → 0.5.7

package/src/__tests__/actor-token-service.test.ts

@@ -18,8 +18,6 @@ mock.module("../util/platform.js", () => ({
   getDataDir: () => testDir,
   getDbPath: () => join(testDir, "test.db"),
   normalizeAssistantId: (id: string) => (id === "self" ? "self" : id),
-  readLockfile: () => null,
-  writeLockfile: () => {},
   isMacOS: () => process.platform === "darwin",
   isLinux: () => process.platform === "linux",
   isWindows: () => process.platform === "win32",
@@ -57,8 +55,6 @@ import {
 } from "../runtime/actor-token-store.js";
 import { resetExternalAssistantIdCache } from "../runtime/auth/external-assistant-id.js";
 import {
-  BootstrapAlreadyCompleted,
-  fetchSigningKeyFromGateway,
   hashToken,
   initAuthSigningKey,
 } from "../runtime/auth/token-service.js";
@@ -732,113 +728,3 @@ describe("bootstrap private-network guard", () => {
   });
 });
 
-// ---------------------------------------------------------------------------
-// fetchSigningKeyFromGateway
-// ---------------------------------------------------------------------------
-
-describe("fetchSigningKeyFromGateway", () => {
-  const VALID_HEX_KEY = "a".repeat(64); // 64 hex chars = 32 bytes
-  const originalEnv = process.env.GATEWAY_INTERNAL_URL;
-  const originalFetch = globalThis.fetch;
-
-  beforeEach(() => {
-    process.env.GATEWAY_INTERNAL_URL = "http://gateway:7822";
-  });
-
-  afterAll(() => {
-    if (originalEnv !== undefined) {
-      process.env.GATEWAY_INTERNAL_URL = originalEnv;
-    } else {
-      delete process.env.GATEWAY_INTERNAL_URL;
-    }
-    globalThis.fetch = originalFetch;
-  });
-
-  test("returns 32-byte buffer on successful 200 response", async () => {
-    globalThis.fetch = (async () =>
-      new Response(JSON.stringify({ key: VALID_HEX_KEY }), {
-        status: 200,
-        headers: { "Content-Type": "application/json" },
-      })) as unknown as typeof fetch;
-
-    const key = await fetchSigningKeyFromGateway();
-    expect(key).toBeInstanceOf(Buffer);
-    expect(key.length).toBe(32);
-    expect(key.toString("hex")).toBe(VALID_HEX_KEY);
-  });
-
-  test("throws BootstrapAlreadyCompleted on 403 response", async () => {
-    globalThis.fetch = (async () =>
-      new Response("Forbidden", { status: 403 })) as unknown as typeof fetch;
-
-    await expect(fetchSigningKeyFromGateway()).rejects.toBeInstanceOf(
-      BootstrapAlreadyCompleted,
-    );
-  });
-
-  test("throws timeout error after max retry attempts on persistent failure", async () => {
-    // Mock Bun.sleep to avoid waiting 30s in tests
-    const origSleep = Bun.sleep;
-    Bun.sleep = (() => Promise.resolve()) as typeof Bun.sleep;
-
-    let callCount = 0;
-    globalThis.fetch = (async () => {
-      callCount++;
-      throw new Error("ECONNREFUSED");
-    }) as unknown as typeof fetch;
-
-    try {
-      await expect(fetchSigningKeyFromGateway()).rejects.toThrow(
-        "timed out waiting for gateway",
-      );
-      expect(callCount).toBe(30);
-    } finally {
-      Bun.sleep = origSleep;
-    }
-  });
-
-  test("throws when GATEWAY_INTERNAL_URL is not set", async () => {
-    delete process.env.GATEWAY_INTERNAL_URL;
-
-    await expect(fetchSigningKeyFromGateway()).rejects.toThrow(
-      "GATEWAY_INTERNAL_URL not set",
-    );
-  });
-
-  test("rejects invalid key length", async () => {
-    globalThis.fetch = (async () =>
-      new Response(JSON.stringify({ key: "aabb" }), {
-        status: 200,
-        headers: { "Content-Type": "application/json" },
-      })) as unknown as typeof fetch;
-
-    await expect(fetchSigningKeyFromGateway()).rejects.toThrow(
-      "Invalid signing key length",
-    );
-  });
-
-  test("retries on non-200/non-403 status and eventually succeeds", async () => {
-    const origSleep = Bun.sleep;
-    Bun.sleep = (() => Promise.resolve()) as typeof Bun.sleep;
-
-    let callCount = 0;
-    globalThis.fetch = (async () => {
-      callCount++;
-      if (callCount < 3) {
-        return new Response("Service Unavailable", { status: 503 });
-      }
-      return new Response(JSON.stringify({ key: VALID_HEX_KEY }), {
-        status: 200,
-        headers: { "Content-Type": "application/json" },
-      });
-    }) as unknown as typeof fetch;
-
-    try {
-      const key = await fetchSigningKeyFromGateway();
-      expect(key.length).toBe(32);
-      expect(callCount).toBe(3);
-    } finally {
-      Bun.sleep = origSleep;
-    }
-  });
-});

package/src/__tests__/assistant-feature-flags-integration.test.ts

@@ -5,7 +5,7 @@
  * Covers:
  *   - Flag OFF blocks all exposure paths
  *   - Missing persisted value falls back to code default
- *   - New assistantFeatureFlagValues is the sole override mechanism
+ *   - Protected feature-flags.json is the sole override mechanism
  *   - Undeclared keys default to enabled
  */
 import {
@@ -101,7 +101,6 @@ mock.module("../config/loader.js", () => ({
   invalidateConfigCache: () => {},
   getNestedValue: () => undefined,
   setNestedValue: () => {},
-  syncConfigToLockfile: () => {},
 }));
 
 // eslint-disable-next-line @typescript-eslint/no-require-imports
@@ -120,7 +119,7 @@ mock.module("../tools/credentials/metadata-store.js", () => ({
 }));
 
 const { buildSystemPrompt } = await import("../prompts/system-prompt.js");
-const { isAssistantFeatureFlagEnabled } =
+const { isAssistantFeatureFlagEnabled, _setOverridesForTesting } =
   await import("../config/assistant-feature-flags.js");
 const { skillFlagKey } = await import("../config/skill-state.js");
 
@@ -130,6 +129,7 @@ const { skillFlagKey } = await import("../config/skill-state.js");
 
 beforeEach(() => {
   mkdirSync(TEST_DIR, { recursive: true });
+  _setOverridesForTesting({});
   currentConfig = {
     services: {
       inference: {
@@ -148,6 +148,7 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  _setOverridesForTesting({});
   if (existsSync(TEST_DIR)) {
     rmSync(TEST_DIR, { recursive: true, force: true });
   }
@@ -198,11 +199,12 @@ describe("buildSystemPrompt assistant feature flag filtering", () => {
       "browser",
     );
 
+    _setOverridesForTesting({
+      [DECLARED_FLAG_KEY]: false,
+      "feature_flags.browser.enabled": true,
+    });
+
     currentConfig = {
-      assistantFeatureFlagValues: {
-        [DECLARED_FLAG_KEY]: false,
-        "feature_flags.browser.enabled": true,
-      },
       services: {
         inference: {
           mode: "your-own",
@@ -282,11 +284,12 @@ describe("buildSystemPrompt assistant feature flag filtering", () => {
       "email-channel",
     );
 
+    _setOverridesForTesting({
+      [DECLARED_FLAG_KEY]: false,
+      "feature_flags.email-channel.enabled": false,
+    });
+
     currentConfig = {
-      assistantFeatureFlagValues: {
-        [DECLARED_FLAG_KEY]: false,
-        "feature_flags.email-channel.enabled": false,
-      },
       services: {
         inference: {
           mode: "your-own",
@@ -311,7 +314,7 @@ describe("buildSystemPrompt assistant feature flag filtering", () => {
     expect(result).not.toContain("**email-channel**");
   });
 
-  test("assistantFeatureFlagValues overrides control visibility", () => {
+  test("file-based overrides control visibility", () => {
     createSkillOnDisk(
       DECLARED_SKILL_ID,
       "Contacts",
@@ -319,8 +322,9 @@ describe("buildSystemPrompt assistant feature flag filtering", () => {
       DECLARED_FLAG_ID,
     );
 
+    _setOverridesForTesting({ [DECLARED_FLAG_KEY]: true });
+
     currentConfig = {
-      assistantFeatureFlagValues: { [DECLARED_FLAG_KEY]: true },
       services: {
         inference: {
           mode: "your-own",
@@ -352,8 +356,9 @@ describe("buildSystemPrompt assistant feature flag filtering", () => {
       "browser",
     );
 
+    _setOverridesForTesting({ "feature_flags.browser.enabled": false });
+
     currentConfig = {
-      assistantFeatureFlagValues: { "feature_flags.browser.enabled": false },
       services: {
         inference: {
           mode: "your-own",
@@ -446,18 +451,16 @@ describe("buildSystemPrompt assistant feature flag filtering", () => {
 // ---------------------------------------------------------------------------
 
 describe("isAssistantFeatureFlagEnabled", () => {
-  test("reads from assistantFeatureFlagValues", () => {
-    const config = {
-      assistantFeatureFlagValues: { [DECLARED_FLAG_KEY]: true },
-    } as any;
+  test("reads from file-based overrides", () => {
+    _setOverridesForTesting({ [DECLARED_FLAG_KEY]: true });
+    const config = {} as any;
 
     expect(isAssistantFeatureFlagEnabled(DECLARED_FLAG_KEY, config)).toBe(true);
   });
 
-  test("explicit false override in assistantFeatureFlagValues", () => {
-    const config = {
-      assistantFeatureFlagValues: { [DECLARED_FLAG_KEY]: false },
-    } as any;
+  test("explicit false override in file-based overrides", () => {
+    _setOverridesForTesting({ [DECLARED_FLAG_KEY]: false });
+    const config = {} as any;
 
     expect(isAssistantFeatureFlagEnabled(DECLARED_FLAG_KEY, config)).toBe(
       false,
@@ -483,10 +486,9 @@ describe("isAssistantFeatureFlagEnabled", () => {
     ).toBe(true);
   });
 
-  test("undeclared flag respects persisted canonical override", () => {
-    const config = {
-      assistantFeatureFlagValues: { "feature_flags.browser.enabled": false },
-    } as any;
+  test("undeclared flag respects persisted override", () => {
+    _setOverridesForTesting({ "feature_flags.browser.enabled": false });
+    const config = {} as any;
 
     expect(
       isAssistantFeatureFlagEnabled("feature_flags.browser.enabled", config),
@@ -496,9 +498,8 @@ describe("isAssistantFeatureFlagEnabled", () => {
 
 describe("isAssistantFeatureFlagEnabled with skillFlagKey", () => {
   test("resolves skill flag via canonical path", () => {
-    const config = {
-      assistantFeatureFlagValues: { [DECLARED_FLAG_KEY]: false },
-    } as any;
+    _setOverridesForTesting({ [DECLARED_FLAG_KEY]: false });
+    const config = {} as any;
 
     expect(
       isAssistantFeatureFlagEnabled(

package/src/__tests__/browser-skill-endstate.test.ts

@@ -7,13 +7,10 @@
 import { afterAll, beforeAll, describe, expect, mock, test } from "bun:test";
 
 mock.module("../config/loader.js", () => ({
-  getConfig: () => ({
-    assistantFeatureFlagValues: {
-      "feature_flags.browser.enabled": true,
-    },
-  }),
+  getConfig: () => ({}),
 }));
 
+import { _setOverridesForTesting } from "../config/assistant-feature-flags.js";
 import {
   projectSkillTools,
   resetSkillToolProjection,
@@ -35,11 +32,15 @@ import {
 
 afterAll(() => {
   __resetRegistryForTesting();
+  _setOverridesForTesting({});
 });
 
 describe("browser skill migration end-state", () => {
   beforeAll(async () => {
     __resetRegistryForTesting();
+    _setOverridesForTesting({
+      "feature_flags.browser.enabled": true,
+    });
     await initializeTools();
   });
 

package/src/__tests__/btw-routes.test.ts

@@ -54,17 +54,6 @@ mock.module("../daemon/conversation-tool-setup.js", () => ({
   buildToolDefinitions: () => MOCK_TOOLS,
 }));
 
-const mockCheckIngressForSecrets = mock((content: string) => ({
-  blocked: false,
-  userNotice: "",
-  detectedTypes: [] as string[],
-  normalizedContent: content,
-}));
-
-mock.module("../security/secret-ingress.js", () => ({
-  checkIngressForSecrets: mockCheckIngressForSecrets,
-}));
-
 const MOCK_SYSTEM_PROMPT = "You are a helpful assistant.";
 const mockBuildSystemPrompt = mock(() => MOCK_SYSTEM_PROMPT);
 
@@ -236,34 +225,6 @@ describe("POST /v1/btw", () => {
     expect(body.error.message).toContain("content");
   });
 
-  test("returns 422 when content includes a blocked secret", async () => {
-    mockCheckIngressForSecrets.mockReturnValueOnce({
-      blocked: true,
-      userNotice: "Secret detected",
-      detectedTypes: ["api_key"],
-      normalizedContent: "sk-test-123",
-    });
-
-    const provider = makeMockProvider();
-    const session = makeMockSession(provider);
-    const res = await callHandler(
-      { conversationKey: "key", content: "sk-test-123" },
-      { sendMessageDeps: makeSendMessageDeps(session) },
-    );
-
-    expect(res.status).toBe(422);
-    const body = (await res.json()) as {
-      accepted: boolean;
-      error: string;
-      message: string;
-      detectedTypes: string[];
-    };
-    expect(body.accepted).toBe(false);
-    expect(body.error).toBe("secret_blocked");
-    expect(body.detectedTypes).toEqual(["api_key"]);
-    expect(provider.sendMessage).not.toHaveBeenCalled();
-  });
-
   // -- Service unavailability (503) --
 
   test("returns 503 when sendMessageDeps is unavailable", async () => {

package/src/__tests__/call-domain.test.ts

@@ -40,46 +40,6 @@ let twilioInitiateCallArgs: Array<Record<string, unknown>> = [];
 let mockIngressEnabled = true;
 let mockIngressPublicBaseUrl = "https://test.example.com";
 
-interface MockGatewayHealthResult {
-  target: string;
-  healthy: boolean;
-  localDeployment: boolean;
-  error?: string;
-}
-
-interface MockEnsureLocalGatewayReadyResult extends MockGatewayHealthResult {
-  recovered: boolean;
-  recoveryAttempted: boolean;
-  recoverySkipped: boolean;
-}
-
-let probeLocalGatewayHealthResults: MockGatewayHealthResult[] = [];
-let probeLocalGatewayHealthCallCount = 0;
-let ensureLocalGatewayReadyResult: MockEnsureLocalGatewayReadyResult;
-let ensureLocalGatewayReadyCallCount = 0;
-
-function makeGatewayHealthResult(
-  overrides: Partial<MockGatewayHealthResult> = {},
-): MockGatewayHealthResult {
-  return {
-    target: "http://127.0.0.1:7830",
-    healthy: true,
-    localDeployment: true,
-    ...overrides,
-  };
-}
-
-function makeRecoveryResult(
-  overrides: Partial<MockEnsureLocalGatewayReadyResult> = {},
-): MockEnsureLocalGatewayReadyResult {
-  return {
-    ...makeGatewayHealthResult(),
-    recovered: false,
-    recoveryAttempted: false,
-    recoverySkipped: false,
-    ...overrides,
-  };
-}
 
 mock.module("../calls/twilio-config.js", () => ({
   getTwilioConfig: (assistantId?: string) => ({
@@ -160,18 +120,6 @@ mock.module("../memory/conversation-title-service.js", () => ({
   queueGenerateConversationTitle: () => {},
 }));
 
-mock.module("../runtime/local-gateway-health.js", () => ({
-  probeLocalGatewayHealth: async () => {
-    probeLocalGatewayHealthCallCount++;
-    const next =
-      probeLocalGatewayHealthResults.shift() ?? makeGatewayHealthResult();
-    return next;
-  },
-  ensureLocalGatewayReady: async () => {
-    ensureLocalGatewayReadyCallCount++;
-    return ensureLocalGatewayReadyResult;
-  },
-}));
 
 mock.module("../daemon/handlers/config-ingress.js", () => ({
   computeGatewayTarget: () => "http://127.0.0.1:7830",
@@ -204,13 +152,6 @@ beforeEach(() => {
   twilioInitiateCallArgs = [];
   mockIngressEnabled = true;
   mockIngressPublicBaseUrl = "https://test.example.com";
-  probeLocalGatewayHealthResults = [
-    makeGatewayHealthResult(),
-    makeGatewayHealthResult(),
-  ];
-  probeLocalGatewayHealthCallCount = 0;
-  ensureLocalGatewayReadyResult = makeRecoveryResult();
-  ensureLocalGatewayReadyCallCount = 0;
 });
 
 let ensuredConvIds = new Set<string>();
@@ -446,9 +387,6 @@ describe("startCall — pointer message regression", () => {
       expect(result.status).toBe(503);
       expect(result.error).toContain("Public ingress");
     }
-    expect(probeLocalGatewayHealthCallCount).toBe(0);
-    expect(ensureLocalGatewayReadyCallCount).toBe(0);
-    // No reconcile calls expected (reconcile triggers removed).
     expect(twilioInitiateCallCount).toBe(0);
 
     await new Promise((r) => setTimeout(r, 50));
@@ -459,72 +397,6 @@ describe("startCall — pointer message regression", () => {
     expect(text!).toContain("failed");
   });
 
-  test("never dials Twilio when the local callback gateway stays unhealthy", async () => {
-    const convId = "conv-domain-preflight-unhealthy";
-    ensureConversation(convId);
-    probeLocalGatewayHealthResults = [
-      makeGatewayHealthResult({
-        healthy: false,
-        error: "Gateway health check returned HTTP 503",
-      }),
-      makeGatewayHealthResult({
-        healthy: false,
-        error: "Gateway health check returned HTTP 503",
-      }),
-    ];
-    ensureLocalGatewayReadyResult = makeRecoveryResult({
-      healthy: false,
-      error: "Gateway health check returned HTTP 503",
-      recovered: false,
-      recoveryAttempted: true,
-    });
-
-    const result = await startCall({
-      phoneNumber: "+15559876543",
-      task: "Test call",
-      conversationId: convId,
-    });
-
-    expect(result.ok).toBe(false);
-    if (!result.ok) {
-      expect(result.status).toBe(503);
-      expect(result.error).toContain("still unhealthy");
-    }
-    expect(probeLocalGatewayHealthCallCount).toBe(2);
-    expect(ensureLocalGatewayReadyCallCount).toBe(1);
-    // No reconcile calls expected (reconcile triggers removed).
-    expect(twilioInitiateCallCount).toBe(0);
-  });
-
-  test("can recover a local gateway and then place exactly one outbound Twilio call", async () => {
-    const convId = "conv-domain-preflight-recovery";
-    ensureConversation(convId);
-    probeLocalGatewayHealthResults = [
-      makeGatewayHealthResult({
-        healthy: false,
-        error: "Gateway health check returned HTTP 503",
-      }),
-      makeGatewayHealthResult(),
-    ];
-    ensureLocalGatewayReadyResult = makeRecoveryResult({
-      healthy: true,
-      recovered: true,
-      recoveryAttempted: true,
-    });
-
-    const result = await startCall({
-      phoneNumber: "+15559876543",
-      task: "Test call",
-      conversationId: convId,
-    });
-
-    expect(result.ok).toBe(true);
-    expect(probeLocalGatewayHealthCallCount).toBe(2);
-    expect(ensureLocalGatewayReadyCallCount).toBe(1);
-    // Gateway reconcile triggers have been removed; the gateway reads
-    // credentials and config via TTL caches.
-    expect(twilioInitiateCallCount).toBe(1);
-  });
 
   test("failed call writes a failed pointer to the initiating conversation", async () => {
     const convId = "conv-domain-ptr-fail";