@vellumai/assistant 0.5.6 → 0.5.7

package/src/__tests__/jobs-store-qdrant-breaker.test.ts

@@ -0,0 +1,178 @@
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  afterAll,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  mock,
+  test,
+} from "bun:test";
+
+const testDir = mkdtempSync(join(tmpdir(), "jobs-store-qdrant-breaker-"));
+
+mock.module("../util/platform.js", () => ({
+  getDataDir: () => testDir,
+  isMacOS: () => process.platform === "darwin",
+  isLinux: () => process.platform === "linux",
+  isWindows: () => process.platform === "win32",
+  getPidPath: () => join(testDir, "test.pid"),
+  getDbPath: () => join(testDir, "test.db"),
+  getLogPath: () => join(testDir, "test.log"),
+  ensureDataDir: () => {},
+}));
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+mock.module("../config/loader.js", () => ({
+  loadConfig: () => ({}),
+  getConfig: () => ({}),
+  invalidateConfigCache: () => {},
+}));
+
+import { getDb, initializeDb, resetDb } from "../memory/db.js";
+import {
+  claimMemoryJobs,
+  enqueueMemoryJob,
+  type MemoryJobType,
+} from "../memory/jobs-store.js";
+import {
+  _resetQdrantBreaker,
+  withQdrantBreaker,
+} from "../memory/qdrant-circuit-breaker.js";
+
+describe("claimMemoryJobs with Qdrant circuit breaker", () => {
+  beforeAll(() => {
+    initializeDb();
+  });
+
+  beforeEach(() => {
+    const db = getDb();
+    db.run("DELETE FROM memory_jobs");
+    _resetQdrantBreaker();
+  });
+
+  afterAll(() => {
+    resetDb();
+    rmSync(testDir, { recursive: true, force: true });
+  });
+
+  test("claims embed jobs when circuit breaker is closed (healthy)", () => {
+    enqueueMemoryJob("embed_segment", { segmentId: "seg-1" });
+    enqueueMemoryJob("embed_item", { itemId: "item-1" });
+    enqueueMemoryJob("extract_items", { conversationId: "conv-1" });
+
+    const claimed = claimMemoryJobs(10);
+    const types = claimed.map((j) => j.type);
+
+    expect(types).toContain("embed_segment");
+    expect(types).toContain("embed_item");
+    expect(types).toContain("extract_items");
+    expect(claimed).toHaveLength(3);
+  });
+
+  test("skips embed jobs when circuit breaker is open", async () => {
+    // Trip the circuit breaker by recording 5 consecutive failures
+    for (let i = 0; i < 5; i++) {
+      try {
+        await withQdrantBreaker(async () => {
+          throw new Error("simulated qdrant failure");
+        });
+      } catch {
+        // expected
+      }
+    }
+
+    enqueueMemoryJob("embed_segment", { segmentId: "seg-1" });
+    enqueueMemoryJob("embed_item", { itemId: "item-1" });
+    enqueueMemoryJob("embed_summary", { summaryId: "sum-1" });
+    enqueueMemoryJob("extract_items", { conversationId: "conv-1" });
+    enqueueMemoryJob("build_conversation_summary", {
+      conversationId: "conv-1",
+    });
+
+    const claimed = claimMemoryJobs(10);
+    const types = claimed.map((j) => j.type);
+
+    // Only non-embed jobs should be claimed
+    expect(types).toContain("extract_items");
+    expect(types).toContain("build_conversation_summary");
+    expect(types).not.toContain("embed_segment");
+    expect(types).not.toContain("embed_item");
+    expect(types).not.toContain("embed_summary");
+    expect(claimed).toHaveLength(2);
+  });
+
+  test("resumes claiming embed jobs after circuit breaker closes", async () => {
+    // Trip the circuit breaker
+    for (let i = 0; i < 5; i++) {
+      try {
+        await withQdrantBreaker(async () => {
+          throw new Error("simulated qdrant failure");
+        });
+      } catch {
+        // expected
+      }
+    }
+
+    // Verify embed jobs are skipped while open
+    enqueueMemoryJob("embed_segment", { segmentId: "seg-1" });
+    enqueueMemoryJob("extract_items", { conversationId: "conv-1" });
+
+    const claimedWhileOpen = claimMemoryJobs(10);
+    expect(claimedWhileOpen.map((j) => j.type)).not.toContain("embed_segment");
+
+    // Reset breaker (simulates successful probe closing the circuit)
+    _resetQdrantBreaker();
+
+    // Re-enqueue an embed job (the previous one is now "running")
+    enqueueMemoryJob("embed_item", { itemId: "item-2" });
+
+    const claimedAfterClose = claimMemoryJobs(10);
+    const types = claimedAfterClose.map((j) => j.type);
+
+    expect(types).toContain("embed_item");
+  });
+
+  test("all embed job types are skipped when breaker is open", async () => {
+    const embedTypes: MemoryJobType[] = [
+      "embed_segment",
+      "embed_item",
+      "embed_summary",
+      "embed_media",
+      "embed_attachment",
+    ];
+
+    // Trip the circuit breaker
+    for (let i = 0; i < 5; i++) {
+      try {
+        await withQdrantBreaker(async () => {
+          throw new Error("simulated qdrant failure");
+        });
+      } catch {
+        // expected
+      }
+    }
+
+    // Enqueue one of each embed type
+    for (const type of embedTypes) {
+      enqueueMemoryJob(type, { id: `test-${type}` });
+    }
+    // Also enqueue a non-embed job
+    enqueueMemoryJob("extract_entities", { conversationId: "conv-1" });
+
+    const claimed = claimMemoryJobs(20);
+    const types = claimed.map((j) => j.type);
+
+    // Only the non-embed job should be claimed
+    expect(claimed).toHaveLength(1);
+    expect(types).toEqual(["extract_entities"]);
+  });
+});

package/src/__tests__/keychain-broker-client.test.ts

@@ -537,8 +537,8 @@ describe("keychain-broker-client", () => {
       writeFileSync(SOCKET_PATH, "");
       expect(client.isAvailable()).toBe(false);
 
-      // Advance time past the first cooldown (30s)
-      fakeNow += 30_001;
+      // Advance time past the first cooldown (5s)
+      fakeNow += 5_001;
       expect(client.isAvailable()).toBe(true);
 
       // Now start a real broker and verify the client reconnects
@@ -558,8 +558,8 @@ describe("keychain-broker-client", () => {
       const client = createBrokerClient();
       await client.ping();
 
-      // Advance past first cooldown (30s)
-      fakeNow += 30_001;
+      // Advance past first cooldown (5s)
+      fakeNow += 5_001;
 
       // Start broker — reconnection should succeed and reset counters
       const broker = createMockBroker();
@@ -578,15 +578,15 @@ describe("keychain-broker-client", () => {
       rmSync(SOCKET_PATH, { force: true });
 
       // This new failure should start from the beginning of the cooldown
-      // schedule (30s), not escalated.
+      // schedule (5s), not escalated.
       await client.ping();
 
-      // Verify cooldown is back to 30s (not 60s)
+      // Verify cooldown is back to 5s (not 15s)
       writeFileSync(SOCKET_PATH, "");
       expect(client.isAvailable()).toBe(false);
 
-      // 30s should be enough to clear cooldown
-      fakeNow += 30_001;
+      // 5s should be enough to clear cooldown
+      fakeNow += 5_001;
       expect(client.isAvailable()).toBe(true);
     }, 15_000);
 
@@ -594,60 +594,73 @@ describe("keychain-broker-client", () => {
       const client = createBrokerClient();
 
       // First failure round: two attempts (first + immediate retry) ->
-      // consecutiveFailures=2, cooldown index = max(2-2,0) = 0 -> 30s.
+      // consecutiveFailures=2, cooldown index = max(2-2,0) = 0 -> 5s.
       await client.ping();
 
       writeFileSync(SOCKET_PATH, "");
       expect(client.isAvailable()).toBe(false);
 
-      // 30s should clear the first cooldown
-      fakeNow += 30_001;
+      // 5s should clear the first cooldown
+      fakeNow += 5_001;
       expect(client.isAvailable()).toBe(true);
 
       // Remove socket to trigger another failure. After cooldown elapses,
       // ensureConnected clears unavailableSince and tries connect().
       // This failure increments consecutiveFailures to 3 (no immediate retry
       // since consecutiveFailures > 1 after increment).
-      // Cooldown index = max(3-2,0) = 1 -> 60s.
+      // Cooldown index = max(3-2,0) = 1 -> 15s.
       rmSync(SOCKET_PATH, { force: true });
       await client.ping();
 
       writeFileSync(SOCKET_PATH, "");
       expect(client.isAvailable()).toBe(false);
 
-      fakeNow += 30_001;
-      expect(client.isAvailable()).toBe(false); // 30s not enough
+      fakeNow += 5_001;
+      expect(client.isAvailable()).toBe(false); // 5s not enough
 
-      fakeNow += 30_000; // total 60_001ms since this cooldown started
+      fakeNow += 10_000; // total 15_001ms since this cooldown started
       expect(client.isAvailable()).toBe(true);
 
-      // Another failure -> consecutiveFailures=4, index = max(4-2,0) = 2 -> 120s (2min)
+      // Another failure -> consecutiveFailures=4, index = max(4-2,0) = 2 -> 30s
       rmSync(SOCKET_PATH, { force: true });
       await client.ping();
 
       writeFileSync(SOCKET_PATH, "");
       expect(client.isAvailable()).toBe(false);
 
-      fakeNow += 60_001;
+      fakeNow += 15_001;
+      expect(client.isAvailable()).toBe(false);
+
+      fakeNow += 15_000; // total 30_001ms
+      expect(client.isAvailable()).toBe(true);
+
+      // Another failure -> consecutiveFailures=5, index = max(5-2,0) = 3 -> 60s
+      rmSync(SOCKET_PATH, { force: true });
+      await client.ping();
+
+      writeFileSync(SOCKET_PATH, "");
+      expect(client.isAvailable()).toBe(false);
+
+      fakeNow += 30_001;
       expect(client.isAvailable()).toBe(false);
 
-      fakeNow += 60_000; // total 120_001ms
+      fakeNow += 30_000; // total 60_001ms
       expect(client.isAvailable()).toBe(true);
 
-      // Another failure -> consecutiveFailures=5, index = max(5-2,0) = 3 -> 300s (5min)
+      // Another failure -> consecutiveFailures=6, index = min(max(6-2,0), 4) = 4 -> 300s (5min)
       rmSync(SOCKET_PATH, { force: true });
       await client.ping();
 
       writeFileSync(SOCKET_PATH, "");
       expect(client.isAvailable()).toBe(false);
 
-      fakeNow += 120_001;
+      fakeNow += 60_001;
       expect(client.isAvailable()).toBe(false);
 
-      fakeNow += 180_000; // total 300_001ms
+      fakeNow += 240_000; // total 300_001ms
       expect(client.isAvailable()).toBe(true);
 
-      // Another failure -> consecutiveFailures=6, index = min(max(6-2,0), 3) = 3 -> 300s (capped)
+      // Another failure -> consecutiveFailures=7, index = min(max(7-2,0), 4) = 4 -> 300s (capped)
       rmSync(SOCKET_PATH, { force: true });
       await client.ping();
 
@@ -658,4 +671,130 @@ describe("keychain-broker-client", () => {
       expect(client.isAvailable()).toBe(true);
     });
   });
+
+  // -----------------------------------------------------------------------
+  // Connect timeout
+  // -----------------------------------------------------------------------
+  describe("connect timeout", () => {
+    let stopFn: (() => Promise<void>) | null = null;
+
+    beforeEach(() => {
+      writeFileSync(TOKEN_PATH, TEST_TOKEN);
+    });
+
+    afterEach(async () => {
+      if (stopFn) {
+        await stopFn();
+        stopFn = null;
+      }
+    });
+
+    test("rejects connect within 3 seconds when broker is unresponsive", async () => {
+      // Create a server that accepts connections but never responds
+      // (simulates an unresponsive broker process).
+      const activeConns = new Set<import("node:net").Socket>();
+      const server = createServer((conn) => {
+        activeConns.add(conn);
+        conn.on("close", () => activeConns.delete(conn));
+        // Accept connection but do nothing — no data, no close
+      });
+      await new Promise<void>((resolve) => {
+        server.listen(SOCKET_PATH, () => resolve());
+      });
+      stopFn = () =>
+        new Promise<void>((resolve) => {
+          for (const conn of activeConns) conn.destroy();
+          activeConns.clear();
+          server.close(() => resolve());
+        });
+
+      const client = createBrokerClient();
+      const start = Date.now();
+      const result = await client.ping();
+      const elapsed = Date.now() - start;
+
+      // Should return null (graceful fallback) and not hang indefinitely.
+      // The connect timeout is 3s; allow some slack but it should be well
+      // under 10s (the old behavior would hang for REQUEST_TIMEOUT_MS * retries).
+      expect(result).toBeNull();
+      expect(elapsed).toBeLessThan(10_000);
+    }, 15_000);
+
+    test("successful connect clears the connect timer", async () => {
+      // Normal broker that responds to pings — verifies the timer is cleared
+      // and doesn't fire after a successful connection.
+      const broker = createMockBroker();
+      broker.setHandler(() => ({ ok: true, result: { pong: true } }));
+      await broker.start();
+      stopFn = () => broker.stop();
+
+      const client = createBrokerClient();
+      const result = await client.ping();
+      expect(result).toEqual({ pong: true });
+
+      // Wait a bit past the connect timeout to ensure no stale timer fires
+      await new Promise((r) => setTimeout(r, 100));
+
+      // Client should still work fine
+      const result2 = await client.ping();
+      expect(result2).toEqual({ pong: true });
+    });
+  });
+
+  // -----------------------------------------------------------------------
+  // Reduced initial cooldown
+  // -----------------------------------------------------------------------
+  describe("reduced initial cooldown", () => {
+    const originalDateNow = Date.now;
+    let fakeNow: number;
+
+    beforeEach(() => {
+      fakeNow = originalDateNow.call(Date);
+      Date.now = () => fakeNow;
+      writeFileSync(TOKEN_PATH, TEST_TOKEN);
+    });
+
+    afterEach(() => {
+      Date.now = originalDateNow;
+    });
+
+    test("first cooldown is 5 seconds, not 30 seconds", async () => {
+      const client = createBrokerClient();
+
+      // Trigger two connection failures (first + immediate retry)
+      await client.ping();
+
+      writeFileSync(SOCKET_PATH, "");
+
+      // Should still be in cooldown at 4 seconds
+      fakeNow += 4_000;
+      expect(client.isAvailable()).toBe(false);
+
+      // Should be available after 5 seconds
+      fakeNow += 1_001;
+      expect(client.isAvailable()).toBe(true);
+    });
+
+    test("second cooldown is 15 seconds", async () => {
+      const client = createBrokerClient();
+
+      // First failure round -> cooldown 5s
+      await client.ping();
+
+      // Clear first cooldown
+      fakeNow += 5_001;
+
+      // Second failure -> cooldown 15s
+      await client.ping();
+
+      writeFileSync(SOCKET_PATH, "");
+      expect(client.isAvailable()).toBe(false);
+
+      fakeNow += 14_000;
+      expect(client.isAvailable()).toBe(false);
+
+      fakeNow += 1_001;
+      expect(client.isAvailable()).toBe(true);
+    });
+  });
 });

package/src/__tests__/memory-jobs-worker-backoff.test.ts

@@ -0,0 +1,150 @@
+/**
+ * Tests for adaptive poll interval backoff in the memory jobs worker.
+ *
+ * Verifies that when no jobs are claimable, the poll interval doubles each
+ * tick (1.5s -> 3s -> 6s -> ... -> 30s cap), and resets to 1.5s when work
+ * is found.
+ */
+import { describe, expect, mock, test } from "bun:test";
+
+// ── Mocks (must precede imports of tested module) ──────────────────
+
+mock.module("../util/platform.js", () => ({
+  getDataDir: () => "/tmp/test-backoff",
+  isMacOS: () => false,
+  isLinux: () => true,
+  isWindows: () => false,
+  getPidPath: () => "/tmp/test-backoff/test.pid",
+  getDbPath: () => "/tmp/test-backoff/test.db",
+  getLogPath: () => "/tmp/test-backoff/test.log",
+  ensureDataDir: () => {},
+}));
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+// Mock config — memory disabled so runMemoryJobsOnce returns 0 immediately
+mock.module("../config/loader.js", () => ({
+  getConfig: () => ({
+    memory: { enabled: false },
+  }),
+  loadConfig: () => ({
+    memory: { enabled: false },
+  }),
+}));
+
+// Mock jobs-store (accesses DB)
+mock.module("../memory/jobs-store.js", () => ({
+  resetRunningJobsToPending: () => 0,
+  claimMemoryJobs: () => [],
+  completeMemoryJob: () => {},
+  deferMemoryJob: () => "deferred",
+  failMemoryJob: () => {},
+  failStalledJobs: () => 0,
+  enqueueCleanupStaleSupersededItemsJob: () => null,
+  enqueuePruneOldConversationsJob: () => null,
+}));
+
+// Mock db.js (rawRun used in sweepStaleItems)
+mock.module("../memory/db.js", () => ({
+  rawRun: () => 0,
+}));
+
+import {
+  POLL_INTERVAL_MAX_MS,
+  POLL_INTERVAL_MIN_MS,
+  startMemoryJobsWorker,
+} from "../memory/jobs-worker.js";
+
+describe("memory jobs worker adaptive poll interval", () => {
+  test("exports expected poll interval constants", () => {
+    expect(POLL_INTERVAL_MIN_MS).toBe(1_500);
+    expect(POLL_INTERVAL_MAX_MS).toBe(30_000);
+  });
+
+  test("backoff sequence doubles from min to max then caps", () => {
+    // Verify the math: starting at 1500, doubling each step, capped at 30000
+    const intervals: number[] = [];
+    let current = POLL_INTERVAL_MIN_MS;
+    for (let i = 0; i < 10; i++) {
+      intervals.push(current);
+      current = Math.min(current * 2, POLL_INTERVAL_MAX_MS);
+    }
+    expect(intervals).toEqual([
+      1_500, // tick 1
+      3_000, // tick 2
+      6_000, // tick 3
+      12_000, // tick 4
+      24_000, // tick 5
+      30_000, // tick 6 (capped)
+      30_000, // stays capped
+      30_000,
+      30_000,
+      30_000,
+    ]);
+  });
+
+  test("worker schedules setTimeout with increasing intervals when idle", async () => {
+    const timeoutDelays: number[] = [];
+    const originalSetTimeout = globalThis.setTimeout;
+    const originalClearTimeout = globalThis.clearTimeout;
+
+    // Collect pending timer callbacks so we can fire them manually
+    const pendingCallbacks: Array<() => void> = [];
+
+    globalThis.setTimeout = ((fn: () => void, delay?: number) => {
+      if (delay !== undefined && delay >= POLL_INTERVAL_MIN_MS) {
+        timeoutDelays.push(delay);
+        pendingCallbacks.push(fn);
+      }
+      return 999 as unknown as ReturnType<typeof setTimeout>;
+    }) as typeof setTimeout;
+    globalThis.clearTimeout = (() => {}) as typeof clearTimeout;
+
+    try {
+      const worker = startMemoryJobsWorker();
+
+      // Wait for the initial tick() promise to settle
+      await new Promise((resolve) => originalSetTimeout(resolve, 20));
+
+      // Fire pending timer callbacks to advance through the backoff sequence.
+      // Each callback triggers tick() which is async, so we await a microtask
+      // after each to let the promise chain settle and schedule the next timer.
+      for (let i = 0; i < 6; i++) {
+        const cb = pendingCallbacks.shift();
+        if (cb) {
+          cb();
+          await new Promise((resolve) => originalSetTimeout(resolve, 20));
+        }
+      }
+
+      worker.stop();
+
+      // We should have captured several setTimeout calls with increasing delays
+      expect(timeoutDelays.length).toBeGreaterThanOrEqual(4);
+
+      // Intervals should be non-decreasing (backoff)
+      for (let i = 1; i < timeoutDelays.length; i++) {
+        expect(timeoutDelays[i]).toBeGreaterThanOrEqual(timeoutDelays[i - 1]!);
+      }
+
+      // All intervals within bounds
+      for (const delay of timeoutDelays) {
+        expect(delay).toBeGreaterThanOrEqual(POLL_INTERVAL_MIN_MS);
+        expect(delay).toBeLessThanOrEqual(POLL_INTERVAL_MAX_MS);
+      }
+
+      // Should eventually reach the cap
+      expect(timeoutDelays[timeoutDelays.length - 1]).toBe(
+        POLL_INTERVAL_MAX_MS,
+      );
+    } finally {
+      globalThis.setTimeout = originalSetTimeout;
+      globalThis.clearTimeout = originalClearTimeout;
+    }
+  });
+});

package/src/__tests__/migration-export-http.test.ts

@@ -527,9 +527,9 @@ describe("integration: existing routes unaffected", () => {
   });
 
   test("GET /v1/health still works (not intercepted by migration routes)", async () => {
-    const { handleHealth } =
+    const { handleDetailedHealth } =
       await import("../runtime/routes/identity-routes.js");
-    const res = handleHealth();
+    const res = handleDetailedHealth();
     const body = (await res.json()) as Record<string, unknown>;
 
     expect(res.status).toBe(200);

package/src/__tests__/migration-import-commit-http.test.ts

@@ -939,9 +939,9 @@ describe("route policy registration", () => {
 
 describe("integration: existing routes unaffected", () => {
   test("GET /v1/health still works", async () => {
-    const { handleHealth } =
+    const { handleDetailedHealth } =
       await import("../runtime/routes/identity-routes.js");
-    const res = handleHealth();
+    const res = handleDetailedHealth();
     const body = (await res.json()) as Record<string, unknown>;
 
     expect(res.status).toBe(200);

package/src/__tests__/migration-import-preflight-http.test.ts

@@ -792,9 +792,9 @@ describe("route policy registration", () => {
 
 describe("integration: existing routes unaffected", () => {
   test("GET /v1/health still works", async () => {
-    const { handleHealth } =
+    const { handleDetailedHealth } =
       await import("../runtime/routes/identity-routes.js");
-    const res = handleHealth();
+    const res = handleDetailedHealth();
     const body = (await res.json()) as Record<string, unknown>;
 
     expect(res.status).toBe(200);

package/src/__tests__/migration-validate-http.test.ts

@@ -684,9 +684,9 @@ describe("route policy registration", () => {
 
 describe("integration: existing routes unaffected", () => {
   test("GET /v1/health still works (not intercepted by migration routes)", async () => {
-    const { handleHealth } =
+    const { handleDetailedHealth } =
       await import("../runtime/routes/identity-routes.js");
-    const res = handleHealth();
+    const res = handleDetailedHealth();
     const body = (await res.json()) as Record<string, unknown>;
 
     expect(res.status).toBe(200);

package/src/__tests__/non-member-access-request.test.ts

@@ -37,11 +37,6 @@ mock.module("../util/logger.js", () => ({
     }),
 }));
 
-// Mock security check to always pass
-mock.module("../security/secret-ingress.js", () => ({
-  checkIngressForSecrets: () => ({ blocked: false }),
-}));
-
 mock.module("../config/env.js", () => ({
   isHttpAuthDisabled: () => true,
   getGatewayInternalBaseUrl: () => "http://127.0.0.1:7830",

package/src/__tests__/notification-decision-fallback.test.ts

@@ -34,6 +34,10 @@ mock.module("../notifications/conversation-candidates.js", () => ({
   serializeCandidatesForPrompt: () => undefined,
 }));
 
+mock.module("../prompts/persona-resolver.js", () => ({
+  resolveGuardianPersona: () => null,
+}));
+
 let configuredProvider: { sendMessage: () => Promise<unknown> } | null = null;
 let extractedToolUse: unknown = null;
 

package/src/__tests__/notification-decision-identity.test.ts

@@ -36,6 +36,10 @@ mock.module("../notifications/conversation-candidates.js", () => ({
   serializeCandidatesForPrompt: () => undefined,
 }));
 
+mock.module("../prompts/persona-resolver.js", () => ({
+  resolveGuardianPersona: () => null,
+}));
+
 // ── Identity context mock ─────────────────────────────────────────────
 
 let mockIdentityContext: string | null = null;

package/src/__tests__/permission-types.test.ts

@@ -15,6 +15,7 @@ describe("isAllowDecision", () => {
     "always_allow",
     "always_allow_high_risk",
     "temporary_override",
+    "dangerously_skip_permissions",
   ];
 
   for (const decision of allowDecisions) {