@vellumai/assistant 0.6.2 → 0.6.4

package/src/__tests__/channel-approvals.test.ts

@@ -9,6 +9,7 @@ mock.module("../util/logger.js", () => ({
     }),
 }));
 
+import { _setOverridesForTesting } from "../config/assistant-feature-flags.js";
 import type { Conversation } from "../daemon/conversation.js";
 import * as trustStore from "../permissions/trust-store.js";
 import type {
@@ -81,6 +82,7 @@ function registerPendingConfirmation(
 
 describe("getChannelApprovalPrompt", () => {
   beforeEach(() => {
+    _setOverridesForTesting({});
     pendingInteractions.clear();
   });
 
@@ -169,6 +171,20 @@ describe("getChannelApprovalPrompt", () => {
     const result = getChannelApprovalPrompt("conv-2");
     expect(result).toBeNull();
   });
+
+  test("returns approve_once + reject only under v2", () => {
+    _setOverridesForTesting({ "permission-controls-v2": true });
+    registerPendingConfirmation("req-v2", "conv-1", "shell");
+
+    const result = getChannelApprovalPrompt("conv-1");
+    expect(result).not.toBeNull();
+    expect(result!.actions.map((a) => a.id)).toEqual([
+      "approve_once",
+      "reject",
+    ]);
+    expect(result!.plainTextFallback).not.toContain("10 minutes");
+    expect(result!.plainTextFallback).not.toContain("always");
+  });
 });
 
 // ═══════════════════════════════════════════════════════════════════════════
@@ -241,6 +257,7 @@ describe("buildApprovalUIMetadata", () => {
 
 describe("handleChannelDecision", () => {
   beforeEach(() => {
+    _setOverridesForTesting({});
     pendingInteractions.clear();
   });
 
@@ -414,6 +431,24 @@ describe("handleChannelDecision", () => {
 
     addRuleSpy.mockRestore();
   });
+
+  test("v2 collapses legacy approval actions to one-time allow without persisting rules", () => {
+    _setOverridesForTesting({ "permission-controls-v2": true });
+    registerPendingConfirmation("req-v2", "conv-1", "shell");
+
+    const addRuleSpy = spyOn(trustStore, "addRule");
+    const result = handleChannelDecision("conv-1", {
+      action: "approve_always",
+      requestId: "req-v2",
+      source: "plain_text",
+    });
+
+    expect(result).toEqual({
+      applied: true,
+      requestId: "req-v2",
+    });
+    expect(addRuleSpy).not.toHaveBeenCalled();
+  });
 });
 
 // ═══════════════════════════════════════════════════════════════════════════
@@ -421,6 +456,10 @@ describe("handleChannelDecision", () => {
 // ═══════════════════════════════════════════════════════════════════════════
 
 describe("buildGuardianApprovalPrompt", () => {
+  beforeEach(() => {
+    _setOverridesForTesting({});
+  });
+
   test("prompt includes requester identifier and tool name", () => {
     const approvalInfo: PendingApprovalInfo = {
       requestId: "req-g1",
@@ -457,6 +496,20 @@ describe("buildGuardianApprovalPrompt", () => {
     expect(prompt.plainTextFallback).toContain("yes");
     expect(prompt.plainTextFallback).toContain("no");
   });
+
+  test("uses approve_once + reject only under v2", () => {
+    _setOverridesForTesting({ "permission-controls-v2": true });
+    const approvalInfo: PendingApprovalInfo = {
+      requestId: "req-g4",
+      toolName: "shell",
+      input: {},
+      riskLevel: "medium",
+      persistentDecisionsAllowed: true,
+    };
+
+    const prompt = buildGuardianApprovalPrompt(approvalInfo, "dana");
+    expect(prompt.actions.map((a) => a.id)).toEqual(["approve_once", "reject"]);
+  });
 });
 
 // ═══════════════════════════════════════════════════════════════════════════

package/src/__tests__/channel-invite-transport.test.ts

@@ -54,11 +54,11 @@ describe("resolveAdapterHandle", () => {
   test("returns async handle when only resolveChannelHandleAsync is defined", async () => {
     const adapter: ChannelInviteAdapter = {
       channel: "email",
-      resolveChannelHandleAsync: async () => "hello@assistant.agentmail.to",
+      resolveChannelHandleAsync: async () => "hello@vellum.me",
     };
 
     const handle = await resolveAdapterHandle(adapter);
-    expect(handle).toBe("hello@assistant.agentmail.to");
+    expect(handle).toBe("hello@vellum.me");
   });
 
   test("prefers async over sync when both are defined", async () => {

package/src/__tests__/channel-readiness-routes.test.ts

@@ -14,7 +14,6 @@ import { beforeEach, describe, expect, mock, test } from "bun:test";
 let mockRawConfig: Record<string, unknown> | undefined;
 let mockSecureKeys: Record<string, string>;
 let mockHasTwilioCredentials: boolean;
-let mockPrimaryInboxAddress: string | undefined;
 
 mock.module("../calls/twilio-rest.js", () => ({
   hasTwilioCredentials: () => mockHasTwilioCredentials,
@@ -24,7 +23,7 @@ mock.module("../calls/twilio-rest.js", () => ({
 mock.module("../config/env.js", () => ({}));
 
 mock.module("../config/loader.js", () => ({
-  loadRawConfig: () => mockRawConfig,
+  loadRawConfig: () => mockRawConfig ?? {},
   loadConfig: () => {
     const raw = mockRawConfig ?? {};
     const wa = (raw.whatsapp ?? {}) as Record<string, unknown>;
@@ -43,6 +42,15 @@ mock.module("../config/loader.js", () => ({
       whatsapp: { phoneNumber: (wa.phoneNumber as string) ?? "" },
     };
   },
+  getNestedValue: (obj: Record<string, unknown>, path: string) => {
+    const keys = path.split(".");
+    let current: unknown = obj;
+    for (const key of keys) {
+      if (current == null || typeof current !== "object") return undefined;
+      current = (current as Record<string, unknown>)[key];
+    }
+    return current;
+  },
   invalidateConfigCache: () => {},
 }));
 
@@ -50,12 +58,6 @@ mock.module("../security/secure-keys.js", () => ({
   getSecureKeyAsync: async (key: string) => mockSecureKeys[key] ?? null,
 }));
 
-mock.module("../email/service.js", () => ({
-  getEmailService: () => ({
-    getPrimaryInboxAddress: async () => mockPrimaryInboxAddress,
-  }),
-}));
-
 mock.module("../email/feature-gate.js", () => ({
   isEmailEnabled: () => true,
 }));
@@ -76,7 +78,6 @@ describe("channel readiness routes — email and WhatsApp probes", () => {
     mockRawConfig = undefined;
     mockSecureKeys = {};
     mockHasTwilioCredentials = false;
-    mockPrimaryInboxAddress = undefined;
   });
 
   // -------------------------------------------------------------------------
@@ -96,19 +97,19 @@ describe("channel readiness routes — email and WhatsApp probes", () => {
       ).toBe(false);
     });
 
-    test("reports not ready when AgentMail API key is missing", async () => {
+    test("reports platform email check as passing", async () => {
       mockRawConfig = {};
       const service = createReadinessService();
       const [snapshot] = await service.getReadiness("email");
 
-      expect(snapshot.ready).toBe(false);
-      expect(snapshot.reasons.some((r) => r.code === "agentmail_api_key")).toBe(
-        true,
+      const platformCheck = snapshot.localChecks.find(
+        (c) => c.name === "platform_email",
       );
+      expect(platformCheck).toBeDefined();
+      expect(platformCheck!.passed).toBe(true);
     });
 
     test("checks invite policy", async () => {
-      mockSecureKeys = { agentmail: "test-key" };
       mockRawConfig = {
         ingress: { publicBaseUrl: "https://example.com", enabled: true },
       };
@@ -124,7 +125,6 @@ describe("channel readiness routes — email and WhatsApp probes", () => {
     });
 
     test("checks ingress configuration", async () => {
-      mockSecureKeys = { agentmail: "test-key" };
       mockRawConfig = {};
       const service = createReadinessService();
       const [snapshot] = await service.getReadiness("email");
@@ -137,11 +137,10 @@ describe("channel readiness routes — email and WhatsApp probes", () => {
     });
 
     test("ready when all prerequisites are met (including inbox)", async () => {
-      mockSecureKeys = { agentmail: "test-key" };
       mockRawConfig = {
         ingress: { publicBaseUrl: "https://example.com", enabled: true },
+        email: { address: "hello@vellum.me" },
       };
-      mockPrimaryInboxAddress = "hello@example.agentmail.to";
       const service = createReadinessService();
       const [snapshot] = await service.getReadiness("email", true);
 
@@ -150,11 +149,9 @@ describe("channel readiness routes — email and WhatsApp probes", () => {
     });
 
     test("not ready when inbox is missing (remote check)", async () => {
-      mockSecureKeys = { agentmail: "test-key" };
       mockRawConfig = {
         ingress: { publicBaseUrl: "https://example.com", enabled: true },
       };
-      mockPrimaryInboxAddress = undefined;
       const service = createReadinessService();
       const [snapshot] = await service.getReadiness("email", true);
 
@@ -165,7 +162,6 @@ describe("channel readiness routes — email and WhatsApp probes", () => {
     });
 
     test("local-only readiness still passes without inbox check", async () => {
-      mockSecureKeys = { agentmail: "test-key" };
       mockRawConfig = {
         ingress: { publicBaseUrl: "https://example.com", enabled: true },
       };

package/src/__tests__/channel-readiness-service.test.ts

@@ -26,7 +26,7 @@ mock.module("../channels/config.js", () => ({
 mock.module("../config/env.js", () => ({}));
 
 mock.module("../config/loader.js", () => ({
-  loadRawConfig: () => mockRawConfig,
+  loadRawConfig: () => mockRawConfig ?? {},
   loadConfig: () => ({
     twilio: { phoneNumber: mockTwilioPhoneNumber ?? "" },
     whatsapp: { phoneNumber: "" },
@@ -35,12 +35,17 @@ mock.module("../config/loader.js", () => ({
     twilio: { phoneNumber: mockTwilioPhoneNumber ?? "" },
     whatsapp: { phoneNumber: "" },
   }),
-}));
-
-mock.module("../email/service.js", () => ({
-  getEmailService: () => ({
-    getPrimaryInboxAddress: async () => undefined,
-  }),
+  getNestedValue: (obj: Record<string, unknown>, path: string) => {
+    const keys = path.split(".");
+    let current: unknown = obj;
+    for (const key of keys) {
+      if (current == null || typeof current !== "object") return undefined;
+      current = (current as Record<string, unknown>)[key];
+    }
+    return current;
+  },
+  saveRawConfig: () => {},
+  setNestedValue: () => {},
 }));
 
 mock.module("../inbound/platform-callback-registration.js", () => ({

package/src/__tests__/checker.test.ts

@@ -12,12 +12,14 @@ import {
 import { homedir, tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import {
+  afterAll,
   afterEach,
   beforeAll,
   beforeEach,
   describe,
   expect,
   mock,
+  spyOn,
   test,
 } from "bun:test";
 
@@ -67,6 +69,25 @@ mock.module("../config/loader.js", () => ({
   setNestedValue: () => {},
 }));
 
+// Mutable guardian persona path so tests can toggle whether
+// getDefaultRuleTemplates emits the dynamic guardian-persona allow rules.
+// Defaults to null so existing tests see no extra rules, matching the
+// behaviour on a fresh install without a resolved guardian.
+let mockGuardianPersonaPath: string | null = null;
+
+// Spy on the namespace import rather than using `mock.module`. Bun's
+// `mock.module` is a persistent process-wide override that would clobber
+// every other export (e.g. `ensureGuardianPersonaFile`,
+// `isGuardianPersonaCustomized`) and break unrelated test files
+// (persona-resolver.test.ts) when run in the same bun test invocation.
+// `spyOn` with `mockRestore()` in afterAll restores the original
+// implementation so other test files see the real exports.
+import * as personaResolver from "../prompts/persona-resolver.js";
+const guardianPathSpy = spyOn(
+  personaResolver,
+  "resolveGuardianPersonaPath",
+).mockImplementation(() => mockGuardianPersonaPath);
+
 import {
   check,
   classifyRisk,
@@ -140,6 +161,13 @@ function writeSkill(
   );
 }
 
+// Restore the guardian persona spy at the end of this file's run so
+// subsequent test files (e.g. persona-resolver.test.ts) see the real
+// implementation when they import from the module namespace.
+afterAll(() => {
+  guardianPathSpy.mockRestore();
+});
+
 describe("Permission Checker", () => {
   beforeAll(async () => {
     // Warm up the shell parser (loads WASM)
@@ -152,6 +180,8 @@ describe("Permission Checker", () => {
     // Reset permissions mode to workspace (default) so existing tests are not affected
     testConfig.permissions = { mode: "workspace" };
     testConfig.skills = { load: { extraDirs: [] } };
+    // Reset guardian persona mock so each test opts in explicitly
+    mockGuardianPersonaPath = null;
     loggerWarnCalls.length = 0;
     try {
       rmSync(join(checkerTestDir, "protected", "trust.json"));
@@ -201,6 +231,25 @@ describe("Permission Checker", () => {
         });
         expect(risk).toBe(RiskLevel.High);
       });
+
+      test("file_read of legacy signing key is high risk even when BASE_DATA_DIR relocates getProtectedDir()", async () => {
+        const savedBaseDataDir = process.env.BASE_DATA_DIR;
+        process.env.BASE_DATA_DIR = "/tmp/fake-instance-signing-key-test";
+        try {
+          const risk = await classifyRisk("file_read", {
+            path: join(
+              homedir(),
+              ".vellum",
+              "protected",
+              "actor-token-signing-key",
+            ),
+          });
+          expect(risk).toBe(RiskLevel.High);
+        } finally {
+          if (savedBaseDataDir === undefined) delete process.env.BASE_DATA_DIR;
+          else process.env.BASE_DATA_DIR = savedBaseDataDir;
+        }
+      });
     });
 
     // file_write is always low (sandboxed)
@@ -1473,14 +1522,6 @@ describe("Permission Checker", () => {
       expect(result.matchedRule!.id).toBe("default:allow-file_edit-identity");
     });
 
-    test("file_read of workspace USER.md is auto-allowed", async () => {
-      const userPath = join(checkerTestDir, "USER.md");
-      const result = await check("file_read", { path: userPath }, "/tmp");
-      expect(result.decision).toBe("allow");
-      expect(result.matchedRule).toBeDefined();
-      expect(result.matchedRule!.id).toBe("default:allow-file_read-user");
-    });
-
     test("file_write of workspace SOUL.md is auto-allowed", async () => {
       const soulPath = join(checkerTestDir, "SOUL.md");
       const result = await check("file_write", { path: soulPath }, "/tmp");
@@ -1528,6 +1569,106 @@ describe("Permission Checker", () => {
       // Low risk → auto-allowed even outside workspace
       expect(result.decision).toBe("allow");
     });
+
+    // ── guardian persona file (users/<slug>.md) ──────────────────
+    // The per-user persona file lives at `users/<guardian-slug>.md`.
+    // Dynamic guardian-persona default rules auto-allow reads and
+    // edits of this file.
+
+    test("file_edit of guardian users/<slug>.md is auto-allowed", async () => {
+      const guardianPath = join(checkerTestDir, "users", "alice.md");
+      mockGuardianPersonaPath = guardianPath;
+      const result = await check("file_edit", { path: guardianPath }, "/tmp");
+      expect(result.decision).toBe("allow");
+      expect(result.matchedRule).toBeDefined();
+      expect(result.matchedRule!.id).toBe(
+        "default:allow-file_edit-guardian-persona",
+      );
+    });
+
+    test("file_read of guardian users/<slug>.md is auto-allowed", async () => {
+      const guardianPath = join(checkerTestDir, "users", "alice.md");
+      mockGuardianPersonaPath = guardianPath;
+      const result = await check("file_read", { path: guardianPath }, "/tmp");
+      expect(result.decision).toBe("allow");
+      expect(result.matchedRule).toBeDefined();
+      expect(result.matchedRule!.id).toBe(
+        "default:allow-file_read-guardian-persona",
+      );
+    });
+
+    test("file_write of guardian users/<slug>.md is auto-allowed", async () => {
+      const guardianPath = join(checkerTestDir, "users", "alice.md");
+      mockGuardianPersonaPath = guardianPath;
+      const result = await check("file_write", { path: guardianPath }, "/tmp");
+      expect(result.decision).toBe("allow");
+      expect(result.matchedRule).toBeDefined();
+      expect(result.matchedRule!.id).toBe(
+        "default:allow-file_write-guardian-persona",
+      );
+    });
+
+    test("getDefaultRuleTemplates emits guardian persona rules when guardian is resolved", () => {
+      const guardianPath = join(checkerTestDir, "users", "alice.md");
+      mockGuardianPersonaPath = guardianPath;
+      const templates = getDefaultRuleTemplates();
+      const guardianRules = templates.filter((t) =>
+        t.id.endsWith("-guardian-persona"),
+      );
+      // One rule each for file_read, file_write, file_edit.
+      expect(guardianRules).toHaveLength(3);
+      for (const rule of guardianRules) {
+        expect(rule.decision).toBe("allow");
+        expect(rule.priority).toBe(100);
+        expect(rule.scope).toBe("everywhere");
+        expect(rule.pattern).toBe(`${rule.tool}:${guardianPath}`);
+      }
+    });
+
+    test("getDefaultRuleTemplates emits no guardian persona rules when unresolved", () => {
+      mockGuardianPersonaPath = null;
+      const templates = getDefaultRuleTemplates();
+      const guardianRules = templates.filter((t) =>
+        t.id.endsWith("-guardian-persona"),
+      );
+      expect(guardianRules).toHaveLength(0);
+    });
+
+    test("glob metacharacters in guardian path are escaped and match only the literal file", async () => {
+      // A legacy/imported contact whose userFile contains glob metacharacters
+      // must not broaden the auto-allow rule into a wildcard match.
+      const weirdDir = join(checkerTestDir, "users");
+      const guardianPath = join(weirdDir, "weird[slug]*.md");
+      const siblingPath = join(weirdDir, "weirdX.md");
+      mockGuardianPersonaPath = guardianPath;
+
+      const templates = getDefaultRuleTemplates();
+      const guardianRules = templates.filter((t) =>
+        t.id.endsWith("-guardian-persona"),
+      );
+      expect(guardianRules).toHaveLength(3);
+      for (const rule of guardianRules) {
+        // Pattern must contain escaped metacharacters, not bare wildcards.
+        expect(rule.pattern).not.toBe(`${rule.tool}:${guardianPath}`);
+        expect(rule.pattern).toContain("\\[");
+        expect(rule.pattern).toContain("\\]");
+        expect(rule.pattern).toContain("\\*");
+      }
+
+      // Literal guardian path is auto-allowed.
+      const literal = await check("file_edit", { path: guardianPath }, "/tmp");
+      expect(literal.decision).toBe("allow");
+      expect(literal.matchedRule?.id).toBe(
+        "default:allow-file_edit-guardian-persona",
+      );
+
+      // A sibling file that would match if `*` / `[...]` were treated as
+      // wildcards must NOT match the dynamic guardian-persona rule.
+      const sibling = await check("file_edit", { path: siblingPath }, "/tmp");
+      expect(sibling.matchedRule?.id).not.toBe(
+        "default:allow-file_edit-guardian-persona",
+      );
+    });
   });
 
   // ── generateAllowlistOptions ───────────────────────────────────
@@ -4252,8 +4393,8 @@ describe("Permission Checker", () => {
   });
 
   // ── browser tool permission baselines ─────────────────────────────
-  // All 10 browser tools are core-registered and RiskLevel.Low by default.
-  // These tests lock that baseline so the migration can verify it's preserved.
+  // Representative browser tools are RiskLevel.Low and auto-allowed by
+  // default rules in strict mode.
 
   describe("browser tool permission baselines", () => {
     const browserToolNames = [
@@ -4261,12 +4402,15 @@ describe("Permission Checker", () => {
       "browser_snapshot",
       "browser_screenshot",
       "browser_close",
+      "browser_attach",
+      "browser_detach",
       "browser_click",
       "browser_type",
       "browser_press_key",
       "browser_wait_for",
       "browser_extract",
       "browser_fill_credential",
+      "browser_status",
     ] as const;
 
     // Register mock browser tools with the correct metadata so classifyRisk
@@ -4357,12 +4501,15 @@ describe("Permission Checker", () => {
         "browser_snapshot",
         "browser_screenshot",
         "browser_close",
+        "browser_attach",
+        "browser_detach",
         "browser_click",
         "browser_type",
         "browser_press_key",
         "browser_wait_for",
         "browser_extract",
         "browser_fill_credential",
+        "browser_status",
       ];
 
       for (const tool of browserTools) {