@vellumai/assistant 0.5.6 → 0.5.8

package/src/__tests__/conversation-skill-tools.test.ts

@@ -209,11 +209,9 @@ mock.module("../util/logger.js", () => ({
 mock.module("../config/loader.js", () => ({
   getConfig: () => ({
     skills: { entries: {}, allowBundled: null },
-    assistantFeatureFlagValues: {},
   }),
   loadConfig: () => ({
     skills: { entries: {}, allowBundled: null },
-    assistantFeatureFlagValues: {},
   }),
   invalidateConfigCache: () => {},
 }));
@@ -1721,58 +1719,6 @@ describe("bundled skill: gmail", () => {
   });
 });
 
-describe("bundled skill: claude-code", () => {
-  let sessionState: Map<string, string>;
-
-  beforeEach(() => {
-    mockCatalog = [];
-    mockManifests = {};
-    mockRegisteredTools = new Map();
-    mockUnregisteredSkillIds = [];
-    mockSkillRefCount = new Map();
-    mockSkillRefCount = new Map();
-    mockVersionHashes = {};
-    mockVersionHashErrors = new Set();
-    sessionState = new Map<string, string>();
-  });
-
-  test("claude-code skill activation registers claude_code in allowedToolNames", () => {
-    mockCatalog = [
-      makeSkill("claude-code", "/path/to/bundled-skills/claude-code"),
-    ];
-    mockManifests = { "claude-code": makeManifest(["claude_code"]) };
-
-    const history: Message[] = [
-      ...skillLoadMessages('<loaded_skill id="claude-code" />'),
-    ];
-
-    const result = projectSkillTools(history, {
-      previouslyActiveSkillIds: sessionState,
-    });
-
-    expect(result.toolDefinitions).toEqual([]);
-    expect(result.allowedToolNames).toEqual(new Set(["claude_code"]));
-  });
-
-  test("claude_code tool is absent when claude-code skill is not active", () => {
-    mockCatalog = [
-      makeSkill("claude-code", "/path/to/bundled-skills/claude-code"),
-    ];
-    mockManifests = { "claude-code": makeManifest(["claude_code"]) };
-
-    const history: Message[] = [
-      { role: "user", content: [{ type: "text", text: "Hello" }] },
-    ];
-
-    const result = projectSkillTools(history, {
-      previouslyActiveSkillIds: sessionState,
-    });
-
-    expect(result.toolDefinitions).toHaveLength(0);
-    expect(result.allowedToolNames.has("claude_code")).toBe(false);
-  });
-});
-
 // ---------------------------------------------------------------------------
 // Bundled skill: app-builder
 // ---------------------------------------------------------------------------

package/src/__tests__/conversation-slash-queue.test.ts

@@ -130,7 +130,6 @@ mock.module("../memory/retriever.js", () => ({
     injectedText: "",
 
     semanticHits: 0,
-    recencyHits: 0,
     injectedTokens: 0,
     latencyMs: 0,
   }),

package/src/__tests__/conversation-slash-unknown.test.ts

@@ -137,7 +137,6 @@ mock.module("../memory/retriever.js", () => ({
     injectedText: "",
 
     semanticHits: 0,
-    recencyHits: 0,
     injectedTokens: 0,
     latencyMs: 0,
   }),

package/src/__tests__/conversation-title-service.test.ts

@@ -107,6 +107,93 @@ describe("conversation-title-service", () => {
     );
   });
 
+  test("regeneration extracts text from JSON content blocks", async () => {
+    mockGetMessages.mockReturnValueOnce([
+      {
+        role: "user",
+        content: JSON.stringify([
+          { type: "text", text: "Help me plan the kickoff" },
+        ]),
+      },
+      {
+        role: "assistant",
+        content: JSON.stringify([
+          { type: "text", text: "Sure, here's a plan" },
+          { type: "tool_use", id: "toolu_1", name: "web_search", input: {} },
+        ]),
+      },
+      {
+        role: "user",
+        content: JSON.stringify([{ type: "text", text: "Looks good" }]),
+      },
+    ]);
+
+    const provider = {
+      name: "test-provider",
+      sendMessage: mock(async () => {
+        throw new Error("should not call directly");
+      }),
+    };
+
+    await regenerateConversationTitle({ conversationId: "conv-1", provider });
+
+    // The prompt sent to the sidechain should contain plain text, not raw JSON
+    const prompt = (mockRunBtwSidechain.mock.calls[0] as any)?.[0]
+      ?.content as string;
+    expect(prompt).not.toContain('"type":"text"');
+    expect(prompt).not.toContain('"type":"tool_use"');
+    // Tool metadata should NOT appear in the title prompt
+    expect(prompt).not.toContain("Tool use");
+    expect(prompt).not.toContain("web_search");
+    expect(prompt).toContain("Help me plan the kickoff");
+    expect(prompt).toContain("Sure, here's a plan");
+    expect(prompt).toContain("Looks good");
+  });
+
+  test("regeneration extracts text from tool_result content blocks", async () => {
+    mockGetMessages.mockReturnValueOnce([
+      {
+        role: "user",
+        content: JSON.stringify([
+          { type: "text", text: "Search for restaurants" },
+        ]),
+      },
+      {
+        role: "assistant",
+        content: JSON.stringify([
+          { type: "tool_use", id: "toolu_1", name: "web_search", input: {} },
+        ]),
+      },
+      {
+        role: "user",
+        content: JSON.stringify([
+          {
+            type: "tool_result",
+            tool_use_id: "toolu_1",
+            content: "Found 3 restaurants nearby",
+          },
+        ]),
+      },
+    ]);
+
+    const provider = {
+      name: "test-provider",
+      sendMessage: mock(async () => {
+        throw new Error("should not call directly");
+      }),
+    };
+
+    await regenerateConversationTitle({ conversationId: "conv-1", provider });
+
+    const prompt = (mockRunBtwSidechain.mock.calls[0] as any)?.[0]
+      ?.content as string;
+    expect(prompt).not.toContain('"type":"tool_result"');
+    // Tool-only assistant message should be skipped entirely
+    expect(prompt).not.toContain("Tool use");
+    expect(prompt).toContain("Search for restaurants");
+    expect(prompt).toContain("Found 3 restaurants nearby");
+  });
+
   test("uses the BTW side-chain helper for title regeneration", async () => {
     const provider = {
       name: "test-provider",

package/src/__tests__/conversation-workspace-injection.test.ts

@@ -149,7 +149,6 @@ mock.module("../memory/retriever.js", () => ({
     model: "mock",
     injectedText: "",
     semanticHits: 0,
-    recencyHits: 0,
     mergedCount: 0,
     selectedCount: 0,
     injectedTokens: 0,

package/src/__tests__/conversation-workspace-tool-tracking.test.ts

@@ -145,7 +145,6 @@ mock.module("../memory/retriever.js", () => ({
     model: "mock",
     injectedText: "",
     semanticHits: 0,
-    recencyHits: 0,
     mergedCount: 0,
     selectedCount: 0,
     injectedTokens: 0,

package/src/__tests__/credential-execution-client.test.ts

@@ -84,6 +84,9 @@ describe("local CES discovery", () => {
     if (result.mode === "unavailable") {
       expect(result.reason).toContain("CES executable not found");
       expect(result.mode).toBe("unavailable");
+    } else if (result.mode === "local-source") {
+      // Source entry point exists in the monorepo — verify the success shape.
+      expect(result.sourcePath).toBeTruthy();
     } else {
       // Binary exists in this environment — verify the success shape.
       expect(result.mode).toBe("local");
@@ -95,9 +98,9 @@ describe("local CES discovery", () => {
 
   test("never returns a fallback or in-process mode", () => {
     const result = discoverLocalCes();
-    // The result must be either "local" (with a valid path) or "unavailable".
+    // The result must be "local", "local-source", or "unavailable".
     // There must never be a fallback mode like "in-process" or "degraded".
-    expect(["local", "unavailable"]).toContain(result.mode);
+    expect(["local", "local-source", "unavailable"]).toContain(result.mode);
   });
 });
 

package/src/__tests__/credential-execution-feature-gates.test.ts

@@ -2,15 +2,18 @@
  * Tests for CES (Credential Execution Service) feature gates.
  *
  * Verifies:
- * - All CES flags default to disabled (safe dark-launch).
- * - Each flag can be enabled independently via config overrides.
+ * - Each CES flag defaults to its registry-declared value.
+ * - Each flag can be toggled independently via config overrides.
  * - Enabling CES flags does not implicitly change unrelated approval
  *   behavior or existing feature flags.
  */
 
-import { describe, expect, test } from "bun:test";
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 
-import { isAssistantFeatureFlagEnabled } from "../config/assistant-feature-flags.js";
+import {
+  _setOverridesForTesting,
+  isAssistantFeatureFlagEnabled,
+} from "../config/assistant-feature-flags.js";
 import type { AssistantConfig } from "../config/schema.js";
 import {
   CES_GRANT_AUDIT_FLAG_KEY,
@@ -25,15 +28,21 @@ import {
   isCesToolsEnabled,
 } from "../credential-execution/feature-gates.js";
 
+beforeEach(() => {
+  _setOverridesForTesting({});
+});
+
+afterEach(() => {
+  _setOverridesForTesting({});
+});
+
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
 
-/** Create a minimal AssistantConfig with optional feature flag values. */
-function makeConfig(flagOverrides?: Record<string, boolean>): AssistantConfig {
-  return {
-    ...(flagOverrides ? { assistantFeatureFlagValues: flagOverrides } : {}),
-  } as AssistantConfig;
+/** Create a minimal AssistantConfig (flag overrides are now set via _setOverridesForTesting). */
+function makeConfig(): AssistantConfig {
+  return {} as AssistantConfig;
 }
 
 /** All CES flag keys for iteration. */
@@ -45,28 +54,37 @@ const ALL_CES_FLAG_KEYS = [
   CES_MANAGED_SIDECAR_FLAG_KEY,
 ] as const;
 
-/** All CES predicate functions paired with their flag keys. */
+/** All CES predicate functions paired with their flag keys and expected defaults. */
 const ALL_CES_PREDICATES = [
-  { name: "isCesToolsEnabled", fn: isCesToolsEnabled, key: CES_TOOLS_FLAG_KEY },
+  {
+    name: "isCesToolsEnabled",
+    fn: isCesToolsEnabled,
+    key: CES_TOOLS_FLAG_KEY,
+    defaultEnabled: false,
+  },
   {
     name: "isCesShellLockdownEnabled",
     fn: isCesShellLockdownEnabled,
     key: CES_SHELL_LOCKDOWN_FLAG_KEY,
+    defaultEnabled: false,
   },
   {
     name: "isCesSecureInstallEnabled",
     fn: isCesSecureInstallEnabled,
     key: CES_SECURE_INSTALL_FLAG_KEY,
+    defaultEnabled: false,
   },
   {
     name: "isCesGrantAuditEnabled",
     fn: isCesGrantAuditEnabled,
     key: CES_GRANT_AUDIT_FLAG_KEY,
+    defaultEnabled: false,
   },
   {
     name: "isCesManagedSidecarEnabled",
     fn: isCesManagedSidecarEnabled,
     key: CES_MANAGED_SIDECAR_FLAG_KEY,
+    defaultEnabled: true,
   },
 ] as const;
 
@@ -83,21 +101,23 @@ describe("CES flag key format", () => {
 });
 
 // ---------------------------------------------------------------------------
-// Default-safe: all CES flags disabled by default
+// Defaults: each CES flag matches its registry-declared default
 // ---------------------------------------------------------------------------
 
-describe("CES flags default safely (all disabled)", () => {
-  const config = makeConfig();
-
-  for (const { name, fn } of ALL_CES_PREDICATES) {
-    test(`${name} returns false with no config overrides`, () => {
-      expect(fn(config)).toBe(false);
+describe("CES flags match registry defaults", () => {
+  for (const { name, fn, defaultEnabled } of ALL_CES_PREDICATES) {
+    test(`${name} returns ${defaultEnabled} with no config overrides`, () => {
+      const config = makeConfig();
+      expect(fn(config)).toBe(defaultEnabled);
     });
   }
 
-  for (const key of ALL_CES_FLAG_KEYS) {
-    test(`isAssistantFeatureFlagEnabled('${key}') returns false with no overrides`, () => {
-      expect(isAssistantFeatureFlagEnabled(key, config)).toBe(false);
+  for (const pred of ALL_CES_PREDICATES) {
+    test(`isAssistantFeatureFlagEnabled('${pred.key}') returns ${pred.defaultEnabled} with no overrides`, () => {
+      const config = makeConfig();
+      expect(isAssistantFeatureFlagEnabled(pred.key, config)).toBe(
+        pred.defaultEnabled,
+      );
     });
   }
 });
@@ -106,18 +126,24 @@ describe("CES flags default safely (all disabled)", () => {
 // Independent enablement: each flag can be enabled without affecting others
 // ---------------------------------------------------------------------------
 
-describe("CES flags can be enabled independently", () => {
+describe("CES flags can be toggled independently", () => {
   for (const { name, fn, key } of ALL_CES_PREDICATES) {
     test(`enabling ${key} makes ${name} return true`, () => {
-      const config = makeConfig({ [key]: true });
+      _setOverridesForTesting({ [key]: true });
+      const config = makeConfig();
       expect(fn(config)).toBe(true);
     });
 
-    test(`enabling ${key} does not enable other CES flags`, () => {
-      const config = makeConfig({ [key]: true });
-      for (const { fn: otherFn, key: otherKey } of ALL_CES_PREDICATES) {
+    test(`enabling ${key} does not change other CES flags from their defaults`, () => {
+      _setOverridesForTesting({ [key]: true });
+      const config = makeConfig();
+      for (const {
+        fn: otherFn,
+        key: otherKey,
+        defaultEnabled,
+      } of ALL_CES_PREDICATES) {
         if (otherKey === key) continue;
-        expect(otherFn(config)).toBe(false);
+        expect(otherFn(config)).toBe(defaultEnabled);
       }
     });
   }
@@ -130,7 +156,8 @@ describe("CES flags can be enabled independently", () => {
 describe("CES flags respect explicit false overrides", () => {
   for (const { name, fn, key } of ALL_CES_PREDICATES) {
     test(`${name} returns false when explicitly set to false`, () => {
-      const config = makeConfig({ [key]: false });
+      _setOverridesForTesting({ [key]: false });
+      const config = makeConfig();
       expect(fn(config)).toBe(false);
     });
   }
@@ -146,7 +173,8 @@ describe("CES flags do not affect unrelated flags", () => {
     for (const key of ALL_CES_FLAG_KEYS) {
       overrides[key] = true;
     }
-    const config = makeConfig(overrides);
+    _setOverridesForTesting(overrides);
+    const config = makeConfig();
 
     // browser defaults to true in the registry and should stay true
     expect(
@@ -159,7 +187,8 @@ describe("CES flags do not affect unrelated flags", () => {
     for (const key of ALL_CES_FLAG_KEYS) {
       overrides[key] = true;
     }
-    const config = makeConfig(overrides);
+    _setOverridesForTesting(overrides);
+    const config = makeConfig();
 
     // contacts defaults to true in the registry and should stay true
     expect(

package/src/__tests__/credential-execution-managed-contract.test.ts

@@ -26,7 +26,17 @@
  * contracts — no real CES process or socket dependencies are needed.
  */
 
-import { describe, expect, test } from "bun:test";
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+
+import { _setOverridesForTesting } from "../config/assistant-feature-flags.js";
+
+beforeEach(() => {
+  _setOverridesForTesting({});
+});
+
+afterEach(() => {
+  _setOverridesForTesting({});
+});
 
 import {
   CES_PROTOCOL_VERSION,
@@ -58,11 +68,9 @@ import {
 // Helpers
 // ---------------------------------------------------------------------------
 
-/** Create a minimal AssistantConfig with optional feature flag values. */
-function makeConfig(flagOverrides?: Record<string, boolean>): AssistantConfig {
-  return {
-    ...(flagOverrides ? { assistantFeatureFlagValues: flagOverrides } : {}),
-  } as AssistantConfig;
+/** Create a minimal AssistantConfig (flag overrides are now set via _setOverridesForTesting). */
+function makeConfig(): AssistantConfig {
+  return {} as AssistantConfig;
 }
 
 // ---------------------------------------------------------------------------
@@ -438,38 +446,42 @@ describe("managed OAuth materialization through CES sidecar", () => {
 // ---------------------------------------------------------------------------
 
 describe("feature-flag rollback safety", () => {
-  test("managed sidecar flag defaults to false (safe dark-launch)", () => {
+  test("managed sidecar flag defaults to true (enabled by default)", () => {
     const config = makeConfig();
-    expect(isCesManagedSidecarEnabled(config)).toBe(false);
+    expect(isCesManagedSidecarEnabled(config)).toBe(true);
   });
 
   test("managed sidecar flag can be explicitly enabled", () => {
-    const config = makeConfig({
+    _setOverridesForTesting({
       "feature_flags.ces-managed-sidecar.enabled": true,
     });
+    const config = makeConfig();
     expect(isCesManagedSidecarEnabled(config)).toBe(true);
   });
 
   test("managed sidecar flag can be explicitly disabled", () => {
-    const config = makeConfig({
+    _setOverridesForTesting({
       "feature_flags.ces-managed-sidecar.enabled": false,
     });
+    const config = makeConfig();
     expect(isCesManagedSidecarEnabled(config)).toBe(false);
   });
 
   test("enabling managed sidecar does not enable CES tools", () => {
-    const config = makeConfig({
+    _setOverridesForTesting({
       "feature_flags.ces-managed-sidecar.enabled": true,
     });
+    const config = makeConfig();
     // CES tools flag should remain independently controlled
     expect(isCesToolsEnabled(config)).toBe(false);
   });
 
   test("disabling managed sidecar does not affect other CES flags", () => {
-    const config = makeConfig({
+    _setOverridesForTesting({
       "feature_flags.ces-managed-sidecar.enabled": false,
       "feature_flags.ces-tools.enabled": true,
     });
+    const config = makeConfig();
     expect(isCesToolsEnabled(config)).toBe(true);
   });
 });
@@ -480,10 +492,11 @@ describe("feature-flag rollback safety", () => {
 
 describe("process manager config wiring", () => {
   test("CesProcessManagerConfig accepts assistantConfig for flag gating", () => {
+    _setOverridesForTesting({
+      "feature_flags.ces-managed-sidecar.enabled": true,
+    });
     const config: CesProcessManagerConfig = {
-      assistantConfig: makeConfig({
-        "feature_flags.ces-managed-sidecar.enabled": true,
-      }),
+      assistantConfig: makeConfig(),
     };
     expect(config.assistantConfig).toBeDefined();
     expect(isCesManagedSidecarEnabled(config.assistantConfig!)).toBe(true);
@@ -491,16 +504,17 @@ describe("process manager config wiring", () => {
 
   test("CesProcessManagerConfig requires assistantConfig for feature-flag gate", () => {
     const config: CesProcessManagerConfig = {
-      assistantConfig: makeConfig({}),
+      assistantConfig: makeConfig(),
     };
     expect(config.assistantConfig).toBeDefined();
   });
 
   test("when flag is off, managed discovery is skipped", () => {
+    _setOverridesForTesting({
+      "feature_flags.ces-managed-sidecar.enabled": false,
+    });
     const config: CesProcessManagerConfig = {
-      assistantConfig: makeConfig({
-        "feature_flags.ces-managed-sidecar.enabled": false,
-      }),
+      assistantConfig: makeConfig(),
     };
     // The managed path should be gated
     expect(isCesManagedSidecarEnabled(config.assistantConfig!)).toBe(false);
@@ -513,9 +527,10 @@ describe("process manager config wiring", () => {
 
 describe("non-CES internal consumers intact when flag is off", () => {
   test("existing non-agent flows are unaffected by managed sidecar flag", () => {
-    const config = makeConfig({
+    _setOverridesForTesting({
       "feature_flags.ces-managed-sidecar.enabled": false,
     });
+    const config = makeConfig();
     expect(isCesManagedSidecarEnabled(config)).toBe(false);
   });
 

package/src/__tests__/credential-security-e2e.test.ts

@@ -10,7 +10,6 @@ const mockConfig = {
     action: "block" as "redact" | "warn" | "block",
     entropyThreshold: 4.0,
     allowOneTimeSend: false,
-    blockIngress: true,
   },
   timeouts: { permissionTimeoutSec: 300 },
 };
@@ -67,7 +66,7 @@ mock.module("../security/secure-keys.js", () => {
     setSecureKeyAsync: async (key: string, value: string) =>
       syncSet(key, value),
     deleteSecureKeyAsync: async (key: string) => syncDelete(key),
-    listSecureKeysAsync: async () => [...storedKeys.keys()],
+    listSecureKeysAsync: async () => ({ accounts: [...storedKeys.keys()], unreachable: false }),
   };
 });
 
@@ -118,8 +117,6 @@ mock.module("../tools/credentials/policy-validate.js", () => ({
 
 // Import modules under test
 const { credentialStoreTool } = await import("../tools/credentials/vault.js");
-const { checkIngressForSecrets } =
-  await import("../security/secret-ingress.js");
 const { isToolAllowed } = await import("../tools/credentials/tool-policy.js");
 const { isDomainAllowed } =
   await import("../tools/credentials/domain-policy.js");
@@ -203,61 +200,6 @@ describe("E2E: secure store and list lifecycle", () => {
   });
 });
 
-// ---------------------------------------------------------------------------
-// E2E Scenario 2 — Secret-in-chat blocked and redirected
-// ---------------------------------------------------------------------------
-
-describe("E2E: secret ingress blocking", () => {
-  beforeEach(() => {
-    mockConfig.secretDetection.enabled = true;
-    mockConfig.secretDetection.action = "block";
-  });
-
-  test("blocks message containing AWS access key", () => {
-    const awsKey = ["AKIA", "IOSFODNN7", "REALKEY"].join("");
-    const check = checkIngressForSecrets(`Here is my key: ${awsKey}`);
-    expect(check.blocked).toBe(true);
-    expect(check.detectedTypes.length).toBeGreaterThan(0);
-    // Notice must never contain the actual secret
-    expect(check.userNotice).toBeDefined();
-    expect(check.userNotice).not.toContain(awsKey);
-  });
-
-  test("blocks message containing GitHub token", () => {
-    const ghToken = ["ghp_", "ABCDEFghijklMN01234567", "89abcdef"].join("");
-    const check = checkIngressForSecrets(`Use this token: ${ghToken}`);
-    expect(check.blocked).toBe(true);
-  });
-
-  test("allows normal text through", () => {
-    const check = checkIngressForSecrets("Please help me configure my project");
-    expect(check.blocked).toBe(false);
-    expect(check.detectedTypes).toEqual([]);
-  });
-
-  test("bypasses when detection is disabled", () => {
-    mockConfig.secretDetection.enabled = false;
-    const awsKey = ["AKIA", "IOSFODNN7", "REALKEY"].join("");
-    const check = checkIngressForSecrets(awsKey);
-    expect(check.blocked).toBe(false);
-  });
-
-  test("bypasses when blockIngress is false", () => {
-    mockConfig.secretDetection.blockIngress = false;
-    const awsKey = ["AKIA", "IOSFODNN7", "REALKEY"].join("");
-    const check = checkIngressForSecrets(awsKey);
-    expect(check.blocked).toBe(false);
-  });
-
-  test("still blocks when action is warn but blockIngress is true", () => {
-    mockConfig.secretDetection.action = "warn";
-    mockConfig.secretDetection.blockIngress = true;
-    const awsKey = ["AKIA", "IOSFODNN7", "REALKEY"].join("");
-    const check = checkIngressForSecrets(awsKey);
-    expect(check.blocked).toBe(true);
-  });
-});
-
 // ---------------------------------------------------------------------------
 // E2E Scenario 3 — One-time send override path
 // ---------------------------------------------------------------------------
@@ -411,12 +353,4 @@ describe("E2E: cross-cutting secret leak prevention", () => {
     );
     expect(result.content).not.toContain(secret);
   });
-
-  test("ingress notice never contains the detected secret", () => {
-    const awsKey = ["AKIA", "IOSFODNN7", "REALKEY"].join("");
-    const check = checkIngressForSecrets(awsKey);
-    expect(check.blocked).toBe(true);
-    expect(check.userNotice).toBeDefined();
-    expect(check.userNotice).not.toContain(awsKey);
-  });
 });