@vellumai/assistant 0.6.3 → 0.6.4

package/src/__tests__/cross-provider-web-search.test.ts

@@ -89,7 +89,8 @@ function webSearchResultOnlyMessage(): Message[] {
 // Mock OpenAI SDK
 // ---------------------------------------------------------------------------
 
-let lastOpenAIParams: Record<string, unknown> | null = null;
+let lastOpenAIResponsesParams: Record<string, unknown> | null = null;
+let lastOpenAIChatParams: Record<string, unknown> | null = null;
 
 mock.module("openai", () => {
   class FakeAPIError extends Error {
@@ -110,7 +111,7 @@ mock.module("openai", () => {
       chat = {
         completions: {
           create: (params: Record<string, unknown>) => {
-            lastOpenAIParams = JSON.parse(JSON.stringify(params));
+            lastOpenAIChatParams = JSON.parse(JSON.stringify(params));
             return (async function* () {
               yield {
                 choices: [
@@ -126,6 +127,28 @@ mock.module("openai", () => {
           },
         },
       };
+      responses = {
+        stream: (params: Record<string, unknown>) => {
+          lastOpenAIResponsesParams = JSON.parse(JSON.stringify(params));
+          return (async function* () {
+            yield {
+              type: "response.output_text.delta",
+              delta: "OK",
+            };
+            yield {
+              type: "response.completed",
+              response: {
+                model: "gpt-4o",
+                status: "completed",
+                usage: {
+                  input_tokens: 10,
+                  output_tokens: 5,
+                },
+              },
+            };
+          })();
+        },
+      };
     },
   };
 });
@@ -172,60 +195,137 @@ mock.module("@google/genai", () => {
 
 // Import providers after mocking
 import { GeminiProvider } from "../providers/gemini/client.js";
-import { OpenAIProvider } from "../providers/openai/client.js";
+import {
+  OpenAIChatCompletionsProvider,
+  OpenAIResponsesProvider,
+} from "../providers/openai/client.js";
 
 // ---------------------------------------------------------------------------
-// OpenAI provider tests
+// OpenAI Responses API provider tests
 // ---------------------------------------------------------------------------
 
-describe("Cross-Provider Web Search — OpenAI", () => {
+describe("Cross-Provider Web Search — OpenAI (Responses API)", () => {
   beforeEach(() => {
-    lastOpenAIParams = null;
+    lastOpenAIResponsesParams = null;
   });
 
-  test("degrades server_tool_use in assistant message to text placeholder", async () => {
-    const provider = new OpenAIProvider("sk-test", "gpt-4o");
+  test("degrades server_tool_use in assistant message to text placeholder in Responses input", async () => {
+    const provider = new OpenAIResponsesProvider("sk-test", "gpt-4o");
     await provider.sendMessage(webSearchConversation());
 
-    const messages = lastOpenAIParams!.messages as Array<{
-      role: string;
-      content: unknown;
+    const input = lastOpenAIResponsesParams!.input as Array<{
+      type: string;
+      role?: string;
+      content?: Array<{ type: string; text?: string }>;
     }>;
 
-    const assistantMsg = messages.find((m) => m.role === "assistant");
-    expect(assistantMsg).toBeDefined();
-    expect(assistantMsg!.content).toContain("[Web search: web_search]");
-    expect(assistantMsg!.content).toContain("Here are the results.");
+    const assistantItems = input.filter(
+      (item) => item.type === "message" && item.role === "assistant",
+    );
+    const hasWebSearchPlaceholder = assistantItems.some((item) =>
+      item.content?.some(
+        (part) =>
+          part.type === "output_text" &&
+          part.text?.includes("[Web search: web_search]"),
+      ),
+    );
+    expect(hasWebSearchPlaceholder).toBe(true);
+
+    const hasResultsText = assistantItems.some((item) =>
+      item.content?.some(
+        (part) =>
+          part.type === "output_text" &&
+          part.text?.includes("Here are the results."),
+      ),
+    );
+    expect(hasResultsText).toBe(true);
   });
 
-  test("degrades web_search_tool_result in user message to text placeholder", async () => {
-    const provider = new OpenAIProvider("sk-test", "gpt-4o");
+  test("degrades web_search_tool_result in user message to text placeholder in Responses input", async () => {
+    const provider = new OpenAIResponsesProvider("sk-test", "gpt-4o");
     await provider.sendMessage(webSearchConversation());
 
-    const messages = lastOpenAIParams!.messages as Array<{
-      role: string;
-      content: unknown;
+    const input = lastOpenAIResponsesParams!.input as Array<{
+      type: string;
+      role?: string;
+      content?: Array<{ type: string; text?: string }>;
     }>;
 
-    const userMsgs = messages.filter((m) => m.role === "user");
-    const hasWebSearchResult = userMsgs.some((m) => {
-      if (typeof m.content === "string") return false;
-      if (Array.isArray(m.content)) {
-        return (m.content as Array<{ type: string; text?: string }>).some(
-          (part) =>
-            part.type === "text" && part.text === "[Web search results]",
-        );
-      }
-      return false;
-    });
+    const userItems = input.filter(
+      (item) => item.type === "message" && item.role === "user",
+    );
+    const hasWebSearchResult = userItems.some((item) =>
+      item.content?.some(
+        (part) =>
+          part.type === "input_text" && part.text === "[Web search results]",
+      ),
+    );
     expect(hasWebSearchResult).toBe(true);
   });
 
   test("handles message containing only web_search_tool_result", async () => {
-    const provider = new OpenAIProvider("sk-test", "gpt-4o");
+    const provider = new OpenAIResponsesProvider("sk-test", "gpt-4o");
     await provider.sendMessage(webSearchResultOnlyMessage());
 
-    const messages = lastOpenAIParams!.messages as Array<{
+    const input = lastOpenAIResponsesParams!.input as Array<{
+      type: string;
+      role?: string;
+      content?: Array<{ type: string; text?: string }>;
+    }>;
+
+    const assistantItems = input.filter(
+      (item) => item.type === "message" && item.role === "assistant",
+    );
+    const hasWebSearchPlaceholder = assistantItems.some((item) =>
+      item.content?.some(
+        (part) =>
+          part.type === "output_text" &&
+          part.text?.includes("[Web search: web_search]"),
+      ),
+    );
+    expect(hasWebSearchPlaceholder).toBe(true);
+
+    const userItems = input.filter(
+      (item) => item.type === "message" && item.role === "user",
+    );
+    const hasWebSearchResult = userItems.some((item) =>
+      item.content?.some(
+        (part) =>
+          part.type === "input_text" && part.text === "[Web search results]",
+      ),
+    );
+    expect(hasWebSearchResult).toBe(true);
+  });
+
+  test("does not produce function_call items for server_tool_use blocks", async () => {
+    const provider = new OpenAIResponsesProvider("sk-test", "gpt-4o");
+    await provider.sendMessage(webSearchConversation());
+
+    const input = lastOpenAIResponsesParams!.input as Array<{
+      type: string;
+    }>;
+
+    const functionCallItems = input.filter(
+      (item) => item.type === "function_call",
+    );
+    expect(functionCallItems).toHaveLength(0);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// OpenAI Chat Completions compatibility provider tests
+// ---------------------------------------------------------------------------
+
+describe("Cross-Provider Web Search — OpenAI Chat Completions (compatibility)", () => {
+  beforeEach(() => {
+    lastOpenAIChatParams = null;
+  });
+
+  test("degrades server_tool_use in assistant message to text placeholder", async () => {
+    const provider = new OpenAIChatCompletionsProvider("sk-test", "gpt-4o");
+    await provider.sendMessage(webSearchConversation());
+
+    const messages = lastOpenAIChatParams!.messages as Array<{
       role: string;
       content: unknown;
     }>;
@@ -233,6 +333,17 @@ describe("Cross-Provider Web Search — OpenAI", () => {
     const assistantMsg = messages.find((m) => m.role === "assistant");
     expect(assistantMsg).toBeDefined();
     expect(assistantMsg!.content).toContain("[Web search: web_search]");
+    expect(assistantMsg!.content).toContain("Here are the results.");
+  });
+
+  test("degrades web_search_tool_result in user message to text placeholder", async () => {
+    const provider = new OpenAIChatCompletionsProvider("sk-test", "gpt-4o");
+    await provider.sendMessage(webSearchConversation());
+
+    const messages = lastOpenAIChatParams!.messages as Array<{
+      role: string;
+      content: unknown;
+    }>;
 
     const userMsgs = messages.filter((m) => m.role === "user");
     const hasWebSearchResult = userMsgs.some((m) => {
@@ -249,10 +360,10 @@ describe("Cross-Provider Web Search — OpenAI", () => {
   });
 
   test("does not produce tool_calls for server_tool_use blocks", async () => {
-    const provider = new OpenAIProvider("sk-test", "gpt-4o");
+    const provider = new OpenAIChatCompletionsProvider("sk-test", "gpt-4o");
     await provider.sendMessage(webSearchConversation());
 
-    const messages = lastOpenAIParams!.messages as Array<{
+    const messages = lastOpenAIChatParams!.messages as Array<{
       role: string;
       tool_calls?: unknown[];
     }>;

package/src/__tests__/deterministic-verification-control-plane.test.ts

@@ -31,6 +31,7 @@ mock.module("../config/env.js", () => ({
 // Imports (after mocks)
 // ---------------------------------------------------------------------------
 
+import type { TwilioRelaySpeechConfig } from "../calls/twilio-routes.js";
 import { generateTwiML } from "../calls/twilio-routes.js";
 import { initializeDb } from "../memory/db-init.js";
 import {
@@ -100,9 +101,14 @@ describe("Channel verification reply templates", () => {
 describe("TwiML parameter propagation", () => {
   const defaultProfile = {
     language: "en-US",
-    transcriptionProvider: "deepgram",
     ttsProvider: "google",
     voice: "en-US-Standard-A",
+  };
+
+  const defaultSpeechConfig: TwilioRelaySpeechConfig = {
+    transcriptionProvider: "deepgram",
+    speechModel: undefined,
+    hints: undefined,
     interruptSensitivity: "low",
   };
 
@@ -112,6 +118,7 @@ describe("TwiML parameter propagation", () => {
       "wss://example.com/v1/calls/relay",
       null,
       defaultProfile,
+      defaultSpeechConfig,
       undefined,
       { verificationSessionId: "gv-session-456" },
     );
@@ -126,6 +133,7 @@ describe("TwiML parameter propagation", () => {
       "wss://example.com/v1/calls/relay",
       null,
       defaultProfile,
+      defaultSpeechConfig,
     );
     expect(twiml).not.toContain("<Parameter");
   });
@@ -136,6 +144,7 @@ describe("TwiML parameter propagation", () => {
       "wss://example.com/v1/calls/relay",
       null,
       defaultProfile,
+      defaultSpeechConfig,
       "token123",
       undefined,
     );

package/src/__tests__/device-id.test.ts

@@ -0,0 +1,112 @@
+import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+
+// Suppress logger output before importing the module under test.
+mock.module("../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+import { getDeviceId, resetDeviceIdCache } from "../util/device-id.js";
+
+const originalVellumEnvironment = process.env.VELLUM_ENVIRONMENT;
+const originalXdgConfigHome = process.env.XDG_CONFIG_HOME;
+const originalIsContainerized = process.env.IS_CONTAINERIZED;
+
+let tempDir: string;
+
+beforeEach(() => {
+  tempDir = mkdtempSync(join(tmpdir(), "vellum-device-id-test-"));
+  resetDeviceIdCache();
+});
+
+afterEach(() => {
+  resetDeviceIdCache();
+
+  if (originalVellumEnvironment == null) {
+    delete process.env.VELLUM_ENVIRONMENT;
+  } else {
+    process.env.VELLUM_ENVIRONMENT = originalVellumEnvironment;
+  }
+  if (originalXdgConfigHome == null) {
+    delete process.env.XDG_CONFIG_HOME;
+  } else {
+    process.env.XDG_CONFIG_HOME = originalXdgConfigHome;
+  }
+  if (originalIsContainerized == null) {
+    delete process.env.IS_CONTAINERIZED;
+  } else {
+    process.env.IS_CONTAINERIZED = originalIsContainerized;
+  }
+
+  try {
+    rmSync(tempDir, { recursive: true, force: true });
+  } catch {
+    /* best-effort */
+  }
+});
+
+describe("getDeviceId env-awareness", () => {
+  test("non-prod (dev) writes device.json under $XDG_CONFIG_HOME/vellum-dev", () => {
+    // Guarantee we're not containerized — the test-preload deletes this,
+    // but be defensive.
+    delete process.env.IS_CONTAINERIZED;
+    process.env.VELLUM_ENVIRONMENT = "dev";
+    process.env.XDG_CONFIG_HOME = tempDir;
+
+    const id = getDeviceId();
+    expect(typeof id).toBe("string");
+    expect(id.length).toBeGreaterThan(0);
+
+    const expectedPath = join(tempDir, "vellum-dev", "device.json");
+    expect(existsSync(expectedPath)).toBe(true);
+
+    const parsed = JSON.parse(readFileSync(expectedPath, "utf-8"));
+    expect(parsed.deviceId).toBe(id);
+  });
+
+  test("staging environment writes under $XDG_CONFIG_HOME/vellum-staging", () => {
+    delete process.env.IS_CONTAINERIZED;
+    process.env.VELLUM_ENVIRONMENT = "staging";
+    process.env.XDG_CONFIG_HOME = tempDir;
+
+    getDeviceId();
+
+    const expectedPath = join(tempDir, "vellum-staging", "device.json");
+    expect(existsSync(expectedPath)).toBe(true);
+  });
+
+  test("unknown environment does NOT write under $XDG_CONFIG_HOME/vellum-<unknown>", () => {
+    // Unknown env names fall back to the legacy production behavior.
+    // We can't assert the exact legacy path without mocking homedir(),
+    // but we can assert that the XDG env-scoped dir is NOT created.
+    delete process.env.IS_CONTAINERIZED;
+    process.env.VELLUM_ENVIRONMENT = "no-such-env";
+    process.env.XDG_CONFIG_HOME = tempDir;
+
+    getDeviceId();
+
+    // No `vellum-no-such-env` directory created under our XDG tempdir.
+    const envScopedPath = join(tempDir, "vellum-no-such-env", "device.json");
+    expect(existsSync(envScopedPath)).toBe(false);
+    // Legacy fallback would write under `${homedir()}/.vellum` — not touched.
+    const productionXdgPath = join(tempDir, "vellum", "device.json");
+    expect(existsSync(productionXdgPath)).toBe(false);
+  });
+
+  test("production does NOT write under $XDG_CONFIG_HOME/vellum", () => {
+    // Production path is ~/.vellum/device.json, never XDG_CONFIG_HOME.
+    delete process.env.IS_CONTAINERIZED;
+    delete process.env.VELLUM_ENVIRONMENT;
+    process.env.XDG_CONFIG_HOME = tempDir;
+
+    getDeviceId();
+
+    const xdgPath = join(tempDir, "vellum", "device.json");
+    expect(existsSync(xdgPath)).toBe(false);
+  });
+});

package/src/__tests__/docker-signing-key-bootstrap.test.ts

@@ -1,9 +1,17 @@
 /**
- * Tests for resolveSigningKey() covering env var injection (Docker)
- * and file-based load/create (local mode).
+ * Tests for resolveSigningKey() covering env var injection (Docker),
+ * file-based load/create (local mode), and env-to-disk sync for CLI
+ * signing-key convergence.
  */
 
-import { existsSync, rmSync } from "node:fs";
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { dirname, join } from "node:path";
 import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 
 mock.module("../util/logger.js", () => ({
@@ -13,7 +21,15 @@ mock.module("../util/logger.js", () => ({
     }),
 }));
 
-const { resolveSigningKey } = await import("../runtime/auth/token-service.js");
+const {
+  resolveSigningKey,
+  initAuthSigningKey,
+  loadSigningKey,
+  mintToken,
+  verifyToken,
+  _resetSigningKeyForTesting,
+} = await import("../runtime/auth/token-service.js");
+const { CURRENT_POLICY_EPOCH } = await import("../runtime/auth/policy.js");
 const { getDeprecatedDir } = await import("../util/platform.js");
 
 const VALID_HEX_KEY = "ab".repeat(32); // 64 hex chars = 32 bytes
@@ -22,6 +38,7 @@ const savedEnv: Record<string, string | undefined> = {};
 
 beforeEach(() => {
   savedEnv.ACTOR_TOKEN_SIGNING_KEY = process.env.ACTOR_TOKEN_SIGNING_KEY;
+  savedEnv.IS_CONTAINERIZED = process.env.IS_CONTAINERIZED;
   // Clean up key files from previous tests so they don't leak between cases.
   const deprecatedDir = getDeprecatedDir();
   if (existsSync(deprecatedDir))
@@ -34,6 +51,13 @@ afterEach(() => {
   } else {
     process.env.ACTOR_TOKEN_SIGNING_KEY = savedEnv.ACTOR_TOKEN_SIGNING_KEY;
   }
+  if (savedEnv.IS_CONTAINERIZED === undefined) {
+    delete process.env.IS_CONTAINERIZED;
+  } else {
+    process.env.IS_CONTAINERIZED = savedEnv.IS_CONTAINERIZED;
+  }
+  // Reset signing key so interop tests don't leak state
+  _resetSigningKeyForTesting();
 });
 
 describe("resolveSigningKey", () => {
@@ -76,3 +100,142 @@ describe("resolveSigningKey", () => {
     expect(key2.toString("hex")).not.toBe(key1.toString("hex"));
   });
 });
+
+// ---------------------------------------------------------------------------
+// Env-to-disk signing key sync
+// ---------------------------------------------------------------------------
+
+describe("env-to-disk signing key sync", () => {
+  test("env key syncs to canonical disk path in non-containerized mode", () => {
+    delete process.env.IS_CONTAINERIZED;
+    process.env.ACTOR_TOKEN_SIGNING_KEY = VALID_HEX_KEY;
+
+    const key = resolveSigningKey();
+
+    expect(key.toString("hex")).toBe(VALID_HEX_KEY);
+
+    const keyPath = join(getDeprecatedDir(), "actor-token-signing-key");
+    expect(existsSync(keyPath)).toBe(true);
+    const diskKey = readFileSync(keyPath);
+    expect(diskKey.length).toBe(32);
+    expect(diskKey.toString("hex")).toBe(VALID_HEX_KEY);
+  });
+
+  test("env key does NOT sync to disk in containerized mode", () => {
+    process.env.IS_CONTAINERIZED = "true";
+    process.env.ACTOR_TOKEN_SIGNING_KEY = VALID_HEX_KEY;
+
+    const key = resolveSigningKey();
+
+    expect(key.toString("hex")).toBe(VALID_HEX_KEY);
+
+    const keyPath = join(getDeprecatedDir(), "actor-token-signing-key");
+    expect(existsSync(keyPath)).toBe(false);
+  });
+
+  test("mismatched disk key is updated to env key in non-containerized mode", () => {
+    delete process.env.IS_CONTAINERIZED;
+
+    // Write a mismatched key to disk first
+    const keyPath = join(getDeprecatedDir(), "actor-token-signing-key");
+    const dir = dirname(keyPath);
+    if (!existsSync(dir)) {
+      mkdirSync(dir, { recursive: true });
+    }
+    const mismatchedKey = Buffer.from("ff".repeat(32), "hex");
+    writeFileSync(keyPath, mismatchedKey, { mode: 0o600 });
+
+    // Set a different env key
+    process.env.ACTOR_TOKEN_SIGNING_KEY = VALID_HEX_KEY;
+
+    const key = resolveSigningKey();
+    expect(key.toString("hex")).toBe(VALID_HEX_KEY);
+
+    // Disk key should now match env key
+    const diskKey = readFileSync(keyPath);
+    expect(diskKey.toString("hex")).toBe(VALID_HEX_KEY);
+  });
+
+  test("matching disk key is not rewritten (no-op)", () => {
+    delete process.env.IS_CONTAINERIZED;
+    process.env.ACTOR_TOKEN_SIGNING_KEY = VALID_HEX_KEY;
+
+    // First call writes the key
+    resolveSigningKey();
+    const keyPath = join(getDeprecatedDir(), "actor-token-signing-key");
+    expect(existsSync(keyPath)).toBe(true);
+
+    // Second call with same key should not throw or fail
+    const key2 = resolveSigningKey();
+    expect(key2.toString("hex")).toBe(VALID_HEX_KEY);
+
+    const diskKey = readFileSync(keyPath);
+    expect(diskKey.toString("hex")).toBe(VALID_HEX_KEY);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Signature interoperability between daemon (env key) and CLI (disk key)
+// ---------------------------------------------------------------------------
+
+describe("daemon/CLI signing key interoperability", () => {
+  test("token minted via CLI disk-load path verifies with daemon env key after sync", () => {
+    delete process.env.IS_CONTAINERIZED;
+
+    // Pre-seed a mismatched "legacy" disk key to simulate the pre-fix state
+    const keyPath = join(getDeprecatedDir(), "actor-token-signing-key");
+    const dir = dirname(keyPath);
+    if (!existsSync(dir)) {
+      mkdirSync(dir, { recursive: true });
+    }
+    const legacyKey = Buffer.from("ee".repeat(32), "hex");
+    writeFileSync(keyPath, legacyKey, { mode: 0o600 });
+
+    // --- Daemon startup path ---
+    // Set the env key and call resolveSigningKey (daemon behavior).
+    // This syncs the env key to disk.
+    process.env.ACTOR_TOKEN_SIGNING_KEY = VALID_HEX_KEY;
+    const daemonKey = resolveSigningKey();
+    initAuthSigningKey(daemonKey);
+
+    // Mint a token using the daemon's key
+    const daemonToken = mintToken({
+      aud: "vellum-daemon",
+      sub: "svc:daemon:self",
+      scope_profile: "gateway_service_v1",
+      policy_epoch: CURRENT_POLICY_EPOCH,
+      ttlSeconds: 60,
+    });
+
+    // --- CLI subprocess path ---
+    // Reset signing key to simulate a fresh CLI subprocess context
+    _resetSigningKeyForTesting();
+
+    // CLI loads key from disk (post-sync, disk now matches env key)
+    const cliDiskKey = loadSigningKey();
+    expect(cliDiskKey).toBeDefined();
+    initAuthSigningKey(cliDiskKey!);
+
+    // Mint a token using the CLI's disk-loaded key
+    const cliToken = mintToken({
+      aud: "vellum-daemon",
+      sub: "svc:daemon:self",
+      scope_profile: "gateway_service_v1",
+      policy_epoch: CURRENT_POLICY_EPOCH,
+      ttlSeconds: 60,
+    });
+
+    // --- Cross-verification ---
+    // CLI-minted token must verify with daemon key
+    _resetSigningKeyForTesting();
+    initAuthSigningKey(daemonKey);
+    const cliResult = verifyToken(cliToken, "vellum-daemon");
+    expect(cliResult.ok).toBe(true);
+
+    // Daemon-minted token must verify with CLI disk key
+    _resetSigningKeyForTesting();
+    initAuthSigningKey(cliDiskKey!);
+    const daemonResult = verifyToken(daemonToken, "vellum-daemon");
+    expect(daemonResult.ok).toBe(true);
+  });
+});

package/src/__tests__/dynamic-skill-workflow-prompt.test.ts

@@ -83,15 +83,13 @@ describe("Dynamic Skill Authoring Workflow moved to tool descriptions", () => {
     expect(result).not.toContain("**test-skill**");
   });
 
-  test("prompt is additive with IDENTITY/SOUL/USER files", () => {
+  test("prompt is additive with IDENTITY/SOUL files", () => {
     writeFileSync(join(TEST_DIR, "IDENTITY.md"), "Identity here");
     writeFileSync(join(TEST_DIR, "SOUL.md"), "Soul here");
-    writeFileSync(join(TEST_DIR, "USER.md"), "User here");
 
     const result = buildSystemPrompt();
     expect(result).toContain("Identity here");
     expect(result).toContain("Soul here");
-    expect(result).toContain("User here");
   });
 
   test("browser skill activation hints no longer appear in system prompt", () => {