@vellumai/assistant 0.6.2 → 0.6.4

package/src/__tests__/tool-executor.test.ts

@@ -129,8 +129,12 @@ mock.module("../permissions/checker.js", () => ({
     scopeOptionsOverride ?? [{ label: "/tmp", scope: "/tmp" }],
 }));
 
+// Mock every export so downstream test files that dynamically import modules
+// with a static `from "../memory/tool-usage-store.js"` still see all symbols.
 mock.module("../memory/tool-usage-store.js", () => ({
   recordToolInvocation: () => {},
+  getRecentInvocations: () => [],
+  rotateToolInvocations: () => 0,
 }));
 
 mock.module("../tools/registry.js", () => ({
@@ -1148,6 +1152,8 @@ describe("isSideEffectTool", () => {
       "browser_type",
       "browser_press_key",
       "browser_close",
+      "browser_attach",
+      "browser_detach",
       "browser_fill_credential",
       "document_create",
       "document_update",
@@ -1220,12 +1226,13 @@ describe("isSideEffectTool", () => {
   });
 });
 
-// Baseline: allow rules can auto-allow file_edit for USER.md today (no forced prompting).
-// The mock check() delegates to findHighestPriorityRule (via spy) so a regression
-// in trust-rule matching would cause this test to fail instead of being masked by
-// a blanket mock-allow.
-describe("ToolExecutor baseline: allow rule auto-allows file_edit USER.md", () => {
-  const userMdPath = "/Users/sidd/.vellum/workspace/USER.md";
+// Baseline: allow rules can auto-allow file_edit for the guardian persona
+// today (no forced prompting). The mock check() delegates to
+// findHighestPriorityRule (via spy) so a regression in trust-rule matching
+// would cause this test to fail instead of being masked by a blanket
+// mock-allow.
+describe("ToolExecutor baseline: allow rule auto-allows file_edit guardian persona", () => {
+  const guardianPersonaPath = "/Users/sidd/.vellum/workspace/users/sidd.md";
   let ruleSpy: ReturnType<typeof spyOn> | undefined;
 
   beforeEach(() => {
@@ -1239,18 +1246,19 @@ describe("ToolExecutor baseline: allow rule auto-allows file_edit USER.md", () =
       addRuleSpy = undefined;
     }
 
-    // Simulate a trust rule that allows file_edit on USER.md by stubbing
-    // findHighestPriorityRule. This mirrors the default allow rules that
-    // the trust-store creates for workspace prompt files.
+    // Simulate a trust rule that allows file_edit on the guardian's per-user
+    // persona file by stubbing findHighestPriorityRule. This mirrors the
+    // default allow rules that the trust-store creates for the guardian
+    // persona file (see permissions/defaults.ts).
     ruleSpy = spyOn(trustStore, "findHighestPriorityRule").mockImplementation(
       (tool: string, commands: string[], _scope: string) => {
         if (tool !== "file_edit") return null;
         for (const cmd of commands) {
-          if (cmd === `file_edit:${userMdPath}`) {
+          if (cmd === `file_edit:${guardianPersonaPath}`) {
             return {
-              id: "default:allow-file_edit-user",
+              id: "default:allow-file_edit-guardian-persona",
               tool: "file_edit",
-              pattern: `file_edit:${userMdPath}`,
+              pattern: `file_edit:${guardianPersonaPath}`,
               scope: "everywhere",
               decision: "allow" as const,
               priority: 100,
@@ -1294,11 +1302,11 @@ describe("ToolExecutor baseline: allow rule auto-allows file_edit USER.md", () =
     }
   });
 
-  test("file_edit to USER.md is auto-allowed via trust rule", async () => {
+  test("file_edit to guardian persona is auto-allowed via trust rule", async () => {
     const executor = new ToolExecutor(makePrompter());
     const result = await executor.execute(
       "file_edit",
-      { path: userMdPath, content: "hello" },
+      { path: guardianPersonaPath, content: "hello" },
       makeContext(),
     );
     expect(result.isError).toBe(false);
@@ -1310,7 +1318,7 @@ describe("ToolExecutor baseline: allow rule auto-allows file_edit USER.md", () =
     expect(ruleSpy).toHaveBeenCalled();
   });
 
-  test("file_edit to a non-USER.md path is NOT auto-allowed without a matching rule", async () => {
+  test("file_edit to a non-guardian-persona path is NOT auto-allowed without a matching rule", async () => {
     let promptCalled = false;
     const trackingPrompter = {
       prompt: async () => {
@@ -1530,22 +1538,23 @@ describe("ToolExecutor forcePromptSideEffects enforcement", () => {
     expect(promptCount).toBe(1);
   });
 
-  // ── USER.md security invariant (PR 31) ──────────
+  // ── Guardian persona security invariant (PR 31) ──────────
 
-  test("file_edit to USER.md forces prompt in private conversation even with matching trust rule", async () => {
-    // This is a key security invariant: USER.md contains the user's persistent
-    // memory. In a private conversation (forcePromptSideEffects=true), edits to it
-    // must always require explicit approval, even when a trust rule matches.
+  test("file_edit to guardian persona forces prompt in private conversation even with matching trust rule", async () => {
+    // This is a key security invariant: the guardian persona file contains
+    // the user's persistent memory. In a private conversation
+    // (forcePromptSideEffects=true), edits to it must always require explicit
+    // approval, even when a trust rule matches.
     checkResultOverride = {
       decision: "allow",
-      reason: "Matched trust rule: file_edit:*/USER.md",
+      reason: "Matched trust rule: file_edit:*/users/*.md",
     };
 
     const executor = new ToolExecutor(makeTrackingPrompter());
     const result = await executor.execute(
       "file_edit",
       {
-        path: "/Users/sidd/.vellum/workspace/USER.md",
+        path: "/Users/sidd/.vellum/workspace/users/sidd.md",
         old_string: "old pref",
         new_string: "new pref",
       },
@@ -1557,14 +1566,14 @@ describe("ToolExecutor forcePromptSideEffects enforcement", () => {
     expect(promptCalled).toBe(true);
   });
 
-  test("host_file_edit to USER.md forces prompt in private conversation", async () => {
+  test("host_file_edit to guardian persona forces prompt in private conversation", async () => {
     checkResultOverride = { decision: "allow", reason: "Matched trust rule" };
 
     const executor = new ToolExecutor(makeTrackingPrompter());
     const result = await executor.execute(
       "host_file_edit",
       {
-        path: "/Users/sidd/.vellum/workspace/USER.md",
+        path: "/Users/sidd/.vellum/workspace/users/sidd.md",
         old_string: "x",
         new_string: "y",
       },

package/src/__tests__/tool-result-truncation.test.ts

@@ -11,6 +11,20 @@ import {
 } from "../context/tool-result-truncation.js";
 import type { ContentBlock, ToolResultContent } from "../providers/types.js";
 
+function hasOrphanedSurrogate(str: string): boolean {
+  for (let i = 0; i < str.length; i++) {
+    const code = str.charCodeAt(i);
+    if (code >= 0xd800 && code <= 0xdbff) {
+      const next = i + 1 < str.length ? str.charCodeAt(i + 1) : 0;
+      if (next < 0xdc00 || next > 0xdfff) return true;
+      i++;
+    } else if (code >= 0xdc00 && code <= 0xdfff) {
+      return true;
+    }
+  }
+  return false;
+}
+
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
@@ -100,6 +114,28 @@ describe("truncateToolResultText", () => {
     expect(result).toBe(text);
     expect(result).not.toContain(TRUNCATION_SUFFIX);
   });
+
+  test("does not orphan a UTF-16 surrogate pair at the cut boundary", () => {
+    // Regression for the "no low surrogate in string" Anthropic 400 error.
+    // Build a string where the cut point lands inside a surrogate pair:
+    // 4999 padding chars, then an emoji (2 code units), then enough filler
+    // to push the cut inside the pair.
+    const EMOJI = "\uD83C\uDF89";
+    // maxChars = 5_000, so cutPoint = 5_000 - TRUNCATION_SUFFIX.length.
+    // Put the emoji so its high surrogate lands exactly at cutPoint - 1.
+    const maxChars = 5_000;
+    const cutPoint = maxChars - TRUNCATION_SUFFIX.length;
+    // Fill up to cutPoint - 1 with "a"s, then place the emoji so the high
+    // surrogate is the character at cutPoint - 1 and the low is at cutPoint.
+    const prefix = "a".repeat(cutPoint - 1);
+    const text = prefix + EMOJI + "b".repeat(100);
+    // Use a long filler with no newlines so lastIndexOf("\n", cutPoint) === -1
+    // and the function falls back to cutPoint itself.
+    const result = truncateToolResultText(text, maxChars);
+    expect(hasOrphanedSurrogate(result)).toBe(false);
+    // JSON.stringify must not throw on the result.
+    expect(() => JSON.stringify(result)).not.toThrow();
+  });
 });
 
 // ---------------------------------------------------------------------------

package/src/__tests__/tool-side-effects-slack-dm.test.ts

@@ -30,8 +30,30 @@ mock.module("../media/app-icon-generator.js", () => ({
 mock.module("../memory/app-store.js", () => ({
   getApp: mock(() => null),
   getAppDirPath: mock(() => ""),
+  getAppsDir: mock(() => ""),
   isMultifileApp: mock(() => false),
   resolveAppIdFromPath: mock(() => null),
+  resolveAppIdByDirName: mock(() => null),
+  resolveAppDir: mock(() => ({ dirName: "", dirPath: "" })),
+  slugify: mock((s: string) => s),
+  validateDirName: mock(() => {}),
+  generateAppDirName: mock(() => ""),
+  listApps: mock(() => []),
+  createApp: mock(() => ({})),
+  updateApp: mock(() => {}),
+  deleteApp: mock(() => {}),
+  getAppPreview: mock(() => null),
+  createAppRecord: mock(() => ({})),
+  getAppRecord: mock(() => null),
+  queryAppRecords: mock(() => []),
+  updateAppRecord: mock(() => {}),
+  deleteAppRecord: mock(() => {}),
+  listAppFiles: mock(() => []),
+  appFileExists: mock(() => false),
+  readAppFile: mock(() => ""),
+  writeAppFile: mock(() => {}),
+  editAppFile: mock(() => ({})),
+  inlineDistAssets: mock((_, html: string) => html),
 }));
 mock.module("../services/published-app-updater.js", () => ({
   updatePublishedAppDeployment: mock(() => Promise.resolve()),

package/src/__tests__/top-level-renderer.test.ts

@@ -1,10 +1,11 @@
+import { homedir, userInfo } from "node:os";
 import { describe, expect, test } from "bun:test";
 
 import { renderWorkspaceTopLevelContext } from "../workspace/top-level-renderer.js";
 import type { TopLevelSnapshot } from "../workspace/top-level-scanner.js";
 
 describe("renderWorkspaceTopLevelContext", () => {
-  test("renders basic snapshot with directories and files", () => {
+  test("renders basic snapshot with directories, files, and host env", () => {
     const snapshot: TopLevelSnapshot = {
       rootPath: "/sandbox",
       directories: ["lib", "src", "tests"],
@@ -19,6 +20,8 @@ describe("renderWorkspaceTopLevelContext", () => {
         "Root: /sandbox",
         "Directories: lib, src, tests",
         "Files: README.md, package.json",
+        `Host home directory: ${homedir()}`,
+        `Host username: ${userInfo().username}`,
         "</workspace>",
       ].join("\n"),
     );
@@ -65,6 +68,8 @@ describe("renderWorkspaceTopLevelContext", () => {
         "Root: /empty",
         "Directories: ",
         "Files: ",
+        `Host home directory: ${homedir()}`,
+        `Host username: ${userInfo().username}`,
         "</workspace>",
       ].join("\n"),
     );
@@ -142,4 +147,71 @@ describe("renderWorkspaceTopLevelContext", () => {
     );
     expect(result).not.toContain("Current conversation folder");
   });
+
+  test("prefers client-reported host env over daemon os.homedir()", () => {
+    const snapshot: TopLevelSnapshot = {
+      rootPath: "/sandbox",
+      directories: ["src"],
+      files: ["package.json"],
+      truncated: false,
+    };
+
+    const result = renderWorkspaceTopLevelContext(snapshot, {
+      hostHomeDir: "/Users/alice",
+      hostUsername: "alice",
+    });
+
+    expect(result).toContain("Host home directory: /Users/alice");
+    expect(result).toContain("Host username: alice");
+    // Fallback values must NOT appear when client values are provided.
+    expect(result).not.toContain(`Host home directory: ${homedir()}`);
+    expect(result).not.toContain(`Host username: ${userInfo().username}`);
+  });
+
+  test("falls back to daemon os info when host env options omitted", () => {
+    const snapshot: TopLevelSnapshot = {
+      rootPath: "/sandbox",
+      directories: ["src"],
+      files: ["package.json"],
+      truncated: false,
+    };
+
+    const result = renderWorkspaceTopLevelContext(snapshot, {});
+
+    expect(result).toContain(`Host home directory: ${homedir()}`);
+    expect(result).toContain(`Host username: ${userInfo().username}`);
+  });
+
+  test("falls back to daemon os info when host env options are undefined", () => {
+    const snapshot: TopLevelSnapshot = {
+      rootPath: "/sandbox",
+      directories: ["src"],
+      files: ["package.json"],
+      truncated: false,
+    };
+
+    const result = renderWorkspaceTopLevelContext(snapshot, {
+      hostHomeDir: undefined,
+      hostUsername: undefined,
+    });
+
+    expect(result).toContain(`Host home directory: ${homedir()}`);
+    expect(result).toContain(`Host username: ${userInfo().username}`);
+  });
+
+  test("uses client home dir but falls back to os username when only home is provided", () => {
+    const snapshot: TopLevelSnapshot = {
+      rootPath: "/sandbox",
+      directories: ["src"],
+      files: ["package.json"],
+      truncated: false,
+    };
+
+    const result = renderWorkspaceTopLevelContext(snapshot, {
+      hostHomeDir: "/Users/alice",
+    });
+
+    expect(result).toContain("Host home directory: /Users/alice");
+    expect(result).toContain(`Host username: ${userInfo().username}`);
+  });
 });

package/src/__tests__/transport-hints-queue.test.ts

@@ -1,8 +1,8 @@
 import { describe, expect, test } from "bun:test";
 
 import type {
-  MacosTransportMetadata,
-  NonMacosTransportMetadata,
+  HostProxyTransportMetadata,
+  NonHostProxyTransportMetadata,
 } from "../daemon/message-types/conversations.js";
 import { buildTransportHints } from "../daemon/transport-hints.js";
 
@@ -11,8 +11,8 @@ import { buildTransportHints } from "../daemon/transport-hints.js";
 // ---------------------------------------------------------------------------
 
 describe("buildTransportHints", () => {
-  test("produces correct hints for macOS transport", () => {
-    const transport: MacosTransportMetadata = {
+  test("returns empty array for host-proxy transport without client hints", () => {
+    const transport: HostProxyTransportMetadata = {
       channelId: "vellum",
       interfaceId: "macos",
       hostHomeDir: "/Users/alice",
@@ -21,29 +21,22 @@ describe("buildTransportHints", () => {
 
     const hints = buildTransportHints(transport);
 
-    expect(hints).toContain("User is messaging from interface: macos");
-    expect(hints).toContain("Host home directory: /Users/alice");
-    expect(hints).toContain("Host username: alice");
-    expect(hints).toHaveLength(3);
+    expect(hints).toHaveLength(0);
   });
 
-  test("produces correct hints for non-macOS transport", () => {
-    const transport: NonMacosTransportMetadata = {
+  test("returns empty array for non-host-proxy transport without client hints", () => {
+    const transport: NonHostProxyTransportMetadata = {
       channelId: "vellum",
       interfaceId: "ios",
     };
 
     const hints = buildTransportHints(transport);
 
-    expect(hints).toContain("User is messaging from interface: ios");
-    expect(hints).toHaveLength(1);
-    // Should not include host environment hints
-    expect(hints.some((h) => h.includes("Host home directory"))).toBe(false);
-    expect(hints.some((h) => h.includes("Host username"))).toBe(false);
+    expect(hints).toHaveLength(0);
   });
 
-  test("includes client-provided hints", () => {
-    const transport: MacosTransportMetadata = {
+  test("forwards client-provided hints", () => {
+    const transport: HostProxyTransportMetadata = {
       channelId: "vellum",
       interfaceId: "macos",
       hostHomeDir: "/Users/bob",
@@ -53,25 +46,17 @@ describe("buildTransportHints", () => {
 
     const hints = buildTransportHints(transport);
 
-    expect(hints).toContain("User is messaging from interface: macos");
-    expect(hints).toContain("Host home directory: /Users/bob");
-    expect(hints).toContain("Host username: bob");
-    expect(hints).toContain("custom hint");
-    expect(hints).toHaveLength(4);
+    expect(hints).toEqual(["custom hint"]);
   });
 
-  test("handles missing optional fields on macOS transport", () => {
-    const transport: MacosTransportMetadata = {
+  test("returns empty array when no hints field present", () => {
+    const transport: HostProxyTransportMetadata = {
       channelId: "vellum",
       interfaceId: "macos",
     };
 
     const hints = buildTransportHints(transport);
 
-    expect(hints).toContain("User is messaging from interface: macos");
-    // Without hostHomeDir and hostUsername, only the interface hint is present
-    expect(hints).toHaveLength(1);
-    expect(hints.some((h) => h.includes("Host home directory"))).toBe(false);
-    expect(hints.some((h) => h.includes("Host username"))).toBe(false);
+    expect(hints).toHaveLength(0);
   });
 });

package/src/__tests__/trust-store.test.ts

@@ -740,8 +740,10 @@ describe("Trust Store", () => {
       ].sort();
       expect(defaultTools).toEqual([
         "bash",
+        "browser_attach",
         "browser_click",
         "browser_close",
+        "browser_detach",
         "browser_extract",
         "browser_fill_credential",
         "browser_hover",
@@ -751,6 +753,7 @@ describe("Trust Store", () => {
         "browser_scroll",
         "browser_select_option",
         "browser_snapshot",
+        "browser_status",
         "browser_type",
         "browser_wait_for",
         "browser_wait_for_download",
@@ -1078,13 +1081,15 @@ describe("Trust Store", () => {
 
     // ── default allow: browser tools ────────────────────────────
 
-    test("all 14 browser tools have default allow rules", () => {
+    test("all browser tools have default allow rules", () => {
       const templates = getDefaultRuleTemplates();
       const browserTools = [
         "browser_navigate",
         "browser_snapshot",
         "browser_screenshot",
         "browser_close",
+        "browser_attach",
+        "browser_detach",
         "browser_click",
         "browser_type",
         "browser_press_key",
@@ -1095,6 +1100,7 @@ describe("Trust Store", () => {
         "browser_extract",
         "browser_wait_for_download",
         "browser_fill_credential",
+        "browser_status",
       ];
 
       for (const tool of browserTools) {

package/src/__tests__/trusted-contact-approval-notifier.test.ts

@@ -117,7 +117,7 @@ mock.module("../prompts/user-reference.js", () => ({
   ...realUserReference,
   resolveUserReference: () => "my human",
   resolveGuardianName: (guardianDisplayName?: string | null): string => {
-    // Mirror the real implementation: USER.md name > guardianDisplayName > default
+    // Mirror the real implementation: guardian persona name (from users/<slug>.md) > guardianDisplayName > default
     const userRef = "my human"; // In tests, resolveUserReference() returns this
     if (userRef !== "my human") return userRef;
     if (guardianDisplayName && guardianDisplayName.trim().length > 0) {

package/src/__tests__/trusted-contact-inline-approval-integration.test.ts

@@ -162,6 +162,7 @@ mock.module("../config/env.js", () => ({
 import { applyCanonicalGuardianDecision } from "../approvals/guardian-decision-primitive.js";
 import type { ActorContext } from "../approvals/guardian-request-resolvers.js";
 import { getResolver } from "../approvals/guardian-request-resolvers.js";
+import { _setOverridesForTesting } from "../config/assistant-feature-flags.js";
 import type { TrustContext } from "../daemon/conversation-runtime-assembly.js";
 import {
   createCanonicalGuardianRequest,
@@ -169,6 +170,10 @@ import {
   listCanonicalGuardianRequests,
   updateCanonicalGuardianRequest,
 } from "../memory/canonical-guardian-store.js";
+import {
+  createConversation,
+  updateConversationHostAccess,
+} from "../memory/conversation-crud.js";
 import { getDb, initializeDb } from "../memory/db.js";
 import { scopedApprovalGrants } from "../memory/schema.js";
 import { bridgeConfirmationRequestToGuardian } from "../runtime/confirmation-request-guardian-bridge.js";
@@ -184,6 +189,8 @@ initializeDb();
 function resetTables(): void {
   const db = getDb();
   db.delete(scopedApprovalGrants).run();
+  db.run("DELETE FROM messages");
+  db.run("DELETE FROM conversations");
   db.run("DELETE FROM canonical_guardian_deliveries");
   db.run("DELETE FROM canonical_guardian_requests");
 }
@@ -246,6 +253,7 @@ describe("(a) target flow: trusted-contact inline guardian approval end-to-end",
     events.length = 0;
     emittedSignals.length = 0;
     deliveredReplies.length = 0;
+    _setOverridesForTesting({});
     mockGuardianBinding = {
       id: "binding-1",
       assistantId: "self",
@@ -1160,3 +1168,104 @@ describe("cross-milestone integration checks", () => {
     expect(freshReq?.followupState).toBeNull();
   });
 });
+
+describe("(g) v2 trusted-contact flow: model-mediated guardian consent", () => {
+  const handler = new ToolApprovalHandler({
+    inlineGrantWait: { maxWaitMs: 100, intervalMs: 20 },
+  });
+
+  beforeEach(() => {
+    resetTables();
+    events.length = 0;
+    emittedSignals.length = 0;
+    deliveredReplies.length = 0;
+    _setOverridesForTesting({ "permission-controls-v2": true });
+    mockGuardianBinding = {
+      id: "binding-1",
+      assistantId: "self",
+      channel: "telegram",
+      guardianExternalUserId: "guardian-1",
+      guardianDeliveryChatId: "guardian-chat-1",
+      guardianPrincipalId: "test-principal-id",
+      status: "active",
+    };
+  });
+
+  test("trusted-contact host tools do not create tool_grant_request rows under v2", async () => {
+    const conv = createConversation("trusted contact v2 host gate");
+    const result = await handler.checkPreExecutionGates(
+      "bash",
+      { command: "ls" },
+      makeToolContext({
+        trustClass: "trusted_contact",
+        conversationId: conv.id,
+      }),
+      "host",
+      "high",
+      Date.now(),
+      emitLifecycleEvent,
+    );
+
+    expect(result.allowed).toBe(false);
+    if (result.allowed) return;
+    expect(result.result.content).toContain(
+      "computer access is not enabled for this conversation",
+    );
+
+    const requests = listCanonicalGuardianRequests({
+      kind: "tool_grant_request",
+      status: "pending",
+    });
+    expect(requests).toHaveLength(0);
+    expect(emittedSignals).toHaveLength(0);
+  });
+
+  test("trusted-contact host tools run inline once the guardian has already enabled computer access for the conversation", async () => {
+    const conv = createConversation("trusted contact v2 host access enabled");
+    updateConversationHostAccess(conv.id, true);
+
+    const result = await handler.checkPreExecutionGates(
+      "bash",
+      { command: "ls" },
+      makeToolContext({
+        trustClass: "trusted_contact",
+        conversationId: conv.id,
+      }),
+      "host",
+      "high",
+      Date.now(),
+      emitLifecycleEvent,
+    );
+
+    expect(result.allowed).toBe(true);
+  });
+
+  test("confirmation_request guardian bridge is disabled for trusted contacts under v2", () => {
+    const canonicalRequest = createCanonicalGuardianRequest({
+      id: `req-v2-skip-${Date.now()}`,
+      kind: "tool_approval",
+      sourceType: "channel",
+      sourceChannel: "telegram",
+      conversationId: "conv-v2-skip",
+      requesterExternalUserId: "requester-1",
+      guardianExternalUserId: "guardian-1",
+      guardianPrincipalId: "test-principal-id",
+      toolName: "bash",
+      status: "pending",
+      expiresAt: Date.now() + 5 * 60_000,
+    });
+
+    const result = bridgeConfirmationRequestToGuardian({
+      canonicalRequest,
+      trustContext: makeTrustedContactTrustContext(),
+      conversationId: "conv-v2-skip",
+      toolName: "bash",
+    });
+
+    expect("skipped" in result && result.skipped).toBe(true);
+    if ("skipped" in result) {
+      expect(result.reason).toBe("v2_model_mediated");
+    }
+    expect(emittedSignals).toHaveLength(0);
+  });
+});