@vellumai/assistant 0.6.4 → 0.6.6

package/src/__tests__/update-bulletin-job.test.ts

@@ -0,0 +1,389 @@
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  mock,
+  test,
+} from "bun:test";
+
+import { getWorkspacePromptPath } from "../util/platform.js";
+
+// ── fs.readFileSync override (for gap 3 test) ────────────────────────
+// We mock node:fs so we can inject a readFileSync that throws for the
+// workspace path. All other call sites fall through to the real fs.
+const realReadFileSync = readFileSync;
+const realExistsSync = existsSync;
+
+let readFileSyncOverride:
+  | ((path: Parameters<typeof readFileSync>[0]) => string | undefined)
+  | null = null;
+
+mock.module("node:fs", () => ({
+  existsSync: realExistsSync,
+  readFileSync: ((
+    path: Parameters<typeof readFileSync>[0],
+    opts?: Parameters<typeof readFileSync>[1],
+  ) => {
+    if (readFileSyncOverride) {
+      const override = readFileSyncOverride(path);
+      if (override !== undefined) return override;
+    }
+    return realReadFileSync(path, opts);
+  }) as typeof readFileSync,
+}));
+
+// ── In-memory checkpoint store ───────────────────────────────────────
+const store = new Map<string, string>();
+let setCheckpointCallCount = 0;
+
+mock.module("../memory/checkpoints.js", () => ({
+  getMemoryCheckpoint: (key: string) => store.get(key) ?? null,
+  setMemoryCheckpoint: (key: string, value: string) => {
+    setCheckpointCallCount += 1;
+    store.set(key, value);
+  },
+}));
+
+// ── Mutable config stub ──────────────────────────────────────────────
+const updatesConfig = { enabled: true };
+
+mock.module("../config/loader.js", () => ({
+  getConfig: () => ({ updates: updatesConfig }),
+}));
+
+// ── bootstrapConversation + wakeAgentForOpportunity mocks ────────────
+let bootstrapCalls = 0;
+let bootstrapLastArgs: Record<string, unknown> | null = null;
+let wakeCalls = 0;
+let wakeLastArgs: Record<string, unknown> | null = null;
+let wakeShouldThrow = false;
+let wakeInvoked = true;
+let wakeProducedToolCalls = false;
+// A side-effect function invoked during wake. Lets tests simulate the
+// agent deleting UPDATES.md while the wake is in flight.
+let wakeSideEffect: (() => void) | null = null;
+
+mock.module("../memory/conversation-bootstrap.js", () => ({
+  bootstrapConversation: (opts: Record<string, unknown>) => {
+    bootstrapCalls += 1;
+    bootstrapLastArgs = opts;
+    return { id: `conv-${bootstrapCalls}` };
+  },
+}));
+
+// ── deleteConversation mock (orphan cleanup path) ────────────────────
+let deleteCalls = 0;
+const deletedIds: string[] = [];
+let deleteShouldThrow = false;
+
+mock.module("../memory/conversation-crud.js", () => ({
+  deleteConversation: (id: string) => {
+    deleteCalls += 1;
+    deletedIds.push(id);
+    if (deleteShouldThrow) {
+      throw new Error("simulated delete failure");
+    }
+    return { segmentIds: [], deletedSummaryIds: [] };
+  },
+}));
+
+mock.module("../runtime/agent-wake.js", () => ({
+  wakeAgentForOpportunity: async (opts: Record<string, unknown>) => {
+    wakeCalls += 1;
+    wakeLastArgs = opts;
+    if (wakeSideEffect) {
+      wakeSideEffect();
+    }
+    if (wakeShouldThrow) {
+      throw new Error("simulated wake failure");
+    }
+    return {
+      invoked: wakeInvoked,
+      producedToolCalls: wakeProducedToolCalls,
+    };
+  },
+}));
+
+const { runUpdateBulletinJobIfNeeded } = await import(
+  "../prompts/update-bulletin-job.js"
+);
+
+const HASH_CHECKPOINT_KEY = "updates:last_processed_hash";
+const EMPTY_HASH = "empty";
+
+function sha256(input: string): string {
+  return createHash("sha256").update(input).digest("hex");
+}
+
+const workspacePath = getWorkspacePromptPath("UPDATES.md");
+
+describe("runUpdateBulletinJobIfNeeded", () => {
+  beforeEach(() => {
+    store.clear();
+    setCheckpointCallCount = 0;
+    bootstrapCalls = 0;
+    bootstrapLastArgs = null;
+    wakeCalls = 0;
+    wakeLastArgs = null;
+    wakeShouldThrow = false;
+    wakeInvoked = true;
+    wakeProducedToolCalls = false;
+    wakeSideEffect = null;
+    readFileSyncOverride = null;
+    updatesConfig.enabled = true;
+    deleteCalls = 0;
+    deletedIds.length = 0;
+    deleteShouldThrow = false;
+    if (existsSync(workspacePath)) {
+      rmSync(workspacePath);
+    }
+  });
+
+  afterEach(() => {
+    if (existsSync(workspacePath)) {
+      rmSync(workspacePath);
+    }
+  });
+
+  test("config disabled — no bootstrap, no wake, no checkpoint change", async () => {
+    updatesConfig.enabled = false;
+    writeFileSync(workspacePath, "## Real content", "utf-8");
+
+    await runUpdateBulletinJobIfNeeded();
+
+    expect(bootstrapCalls).toBe(0);
+    expect(wakeCalls).toBe(0);
+    expect(setCheckpointCallCount).toBe(0);
+    expect(store.has(HASH_CHECKPOINT_KEY)).toBe(false);
+  });
+
+  test("file missing, stored hash absent — no wake; stored becomes 'empty'", async () => {
+    expect(existsSync(workspacePath)).toBe(false);
+    expect(store.has(HASH_CHECKPOINT_KEY)).toBe(false);
+
+    await runUpdateBulletinJobIfNeeded();
+
+    expect(bootstrapCalls).toBe(0);
+    expect(wakeCalls).toBe(0);
+    expect(store.get(HASH_CHECKPOINT_KEY)).toBe(EMPTY_HASH);
+  });
+
+  test("file missing, stored hash already 'empty' — no wake; no checkpoint write", async () => {
+    store.set(HASH_CHECKPOINT_KEY, EMPTY_HASH);
+    // Reset the counter to ignore the priming write above.
+    setCheckpointCallCount = 0;
+
+    await runUpdateBulletinJobIfNeeded();
+
+    expect(bootstrapCalls).toBe(0);
+    expect(wakeCalls).toBe(0);
+    expect(setCheckpointCallCount).toBe(0);
+    expect(store.get(HASH_CHECKPOINT_KEY)).toBe(EMPTY_HASH);
+  });
+
+  test("file present but whitespace-only — treated as empty; stored hash 'empty'", async () => {
+    writeFileSync(workspacePath, "   \n\n\t\n", "utf-8");
+
+    await runUpdateBulletinJobIfNeeded();
+
+    expect(bootstrapCalls).toBe(0);
+    expect(wakeCalls).toBe(0);
+    expect(store.get(HASH_CHECKPOINT_KEY)).toBe(EMPTY_HASH);
+  });
+
+  test("file present with content, wake produced tool calls — bootstrap + wake; stored hash is sha256(trimmed); source/origin are snake_case", async () => {
+    const content = "## Release 1.2.3\n\nNew thing.\n";
+    writeFileSync(workspacePath, content, "utf-8");
+    wakeProducedToolCalls = true;
+
+    await runUpdateBulletinJobIfNeeded();
+
+    expect(bootstrapCalls).toBe(1);
+    expect(wakeCalls).toBe(1);
+    expect(store.get(HASH_CHECKPOINT_KEY)).toBe(sha256(content.trim()));
+    // Gap 4: confirm snake_case reached the downstream mocks.
+    expect(bootstrapLastArgs?.source).toBe("updates_bulletin");
+    expect(bootstrapLastArgs?.origin).toBe("updates_bulletin");
+    expect(wakeLastArgs?.source).toBe("updates_bulletin");
+  });
+
+  test("file present, stored hash matches current — no wake", async () => {
+    const content = "## Release 1.2.3\n\nSame content.\n";
+    writeFileSync(workspacePath, content, "utf-8");
+    store.set(HASH_CHECKPOINT_KEY, sha256(content.trim()));
+    setCheckpointCallCount = 0;
+
+    await runUpdateBulletinJobIfNeeded();
+
+    expect(bootstrapCalls).toBe(0);
+    expect(wakeCalls).toBe(0);
+    expect(setCheckpointCallCount).toBe(0);
+  });
+
+  test("wake returns invoked:false — checkpoint UNCHANGED + orphan conversation is cleaned up", async () => {
+    const content = "## Release Q\n\nResolver-missing scenario.\n";
+    writeFileSync(workspacePath, content, "utf-8");
+    wakeInvoked = false;
+    wakeProducedToolCalls = false;
+
+    await runUpdateBulletinJobIfNeeded();
+
+    expect(bootstrapCalls).toBe(1);
+    expect(wakeCalls).toBe(1);
+    // Critical: do NOT poison the checkpoint (round-1 behavior preserved).
+    expect(store.has(HASH_CHECKPOINT_KEY)).toBe(false);
+    expect(setCheckpointCallCount).toBe(0);
+    // Belt-and-suspenders: the orphan background conversation bootstrapped
+    // before the wake must be deleted so we don't leak DB rows on every
+    // silent no-op.
+    expect(deleteCalls).toBe(1);
+    expect(deletedIds).toEqual(["conv-1"]);
+  });
+
+  test("wake returns invoked:false AND deleteConversation throws — function still returns (cleanup error is swallowed)", async () => {
+    const content = "## Release Q2\n\nDelete-throws scenario.\n";
+    writeFileSync(workspacePath, content, "utf-8");
+    wakeInvoked = false;
+    wakeProducedToolCalls = false;
+    deleteShouldThrow = true;
+
+    await expect(runUpdateBulletinJobIfNeeded()).resolves.toBeUndefined();
+
+    expect(bootstrapCalls).toBe(1);
+    expect(wakeCalls).toBe(1);
+    expect(deleteCalls).toBe(1);
+    // Checkpoint still untouched.
+    expect(store.has(HASH_CHECKPOINT_KEY)).toBe(false);
+    expect(setCheckpointCallCount).toBe(0);
+  });
+
+  test("wake invoked normally — deleteConversation is NOT called (happy path)", async () => {
+    const content = "## Release Q3\n\nNormal happy-path scenario.\n";
+    writeFileSync(workspacePath, content, "utf-8");
+    wakeInvoked = true;
+    wakeProducedToolCalls = true;
+
+    await runUpdateBulletinJobIfNeeded();
+
+    expect(bootstrapCalls).toBe(1);
+    expect(wakeCalls).toBe(1);
+    expect(deleteCalls).toBe(0);
+    expect(deletedIds).toEqual([]);
+  });
+
+  test("wake invoked but no tool calls AND file unchanged — checkpoint UNCHANGED (retry next startup)", async () => {
+    const content = "## Release R\n\nSilent no-op scenario.\n";
+    writeFileSync(workspacePath, content, "utf-8");
+    wakeInvoked = true;
+    wakeProducedToolCalls = false;
+
+    await runUpdateBulletinJobIfNeeded();
+
+    expect(bootstrapCalls).toBe(1);
+    expect(wakeCalls).toBe(1);
+    expect(store.has(HASH_CHECKPOINT_KEY)).toBe(false);
+    expect(setCheckpointCallCount).toBe(0);
+  });
+
+  test("wake invoked, no tool calls, but file deleted mid-wake — checkpoint becomes 'empty'", async () => {
+    const content = "## Release S\n\nAgent deleted file.\n";
+    writeFileSync(workspacePath, content, "utf-8");
+    wakeInvoked = true;
+    wakeProducedToolCalls = false;
+    wakeSideEffect = () => {
+      rmSync(workspacePath);
+    };
+
+    await runUpdateBulletinJobIfNeeded();
+
+    expect(bootstrapCalls).toBe(1);
+    expect(wakeCalls).toBe(1);
+    expect(existsSync(workspacePath)).toBe(false);
+    expect(store.get(HASH_CHECKPOINT_KEY)).toBe(EMPTY_HASH);
+  });
+
+  test("wake invoked + produced tool calls + file unchanged — checkpoint = hash of content (agent decided this is the right state)", async () => {
+    const content = "## Release T\n\nAgent processed, chose to leave file.\n";
+    writeFileSync(workspacePath, content, "utf-8");
+    wakeInvoked = true;
+    wakeProducedToolCalls = true;
+
+    await runUpdateBulletinJobIfNeeded();
+
+    expect(bootstrapCalls).toBe(1);
+    expect(wakeCalls).toBe(1);
+    expect(store.get(HASH_CHECKPOINT_KEY)).toBe(sha256(content.trim()));
+  });
+
+  test("file present, stored hash differs — wake invoked; stored hash updates", async () => {
+    const oldContent = "## Old";
+    const newContent = "## New content v2";
+    writeFileSync(workspacePath, newContent, "utf-8");
+    store.set(HASH_CHECKPOINT_KEY, sha256(oldContent));
+    wakeProducedToolCalls = true;
+
+    await runUpdateBulletinJobIfNeeded();
+
+    expect(bootstrapCalls).toBe(1);
+    expect(wakeCalls).toBe(1);
+    expect(store.get(HASH_CHECKPOINT_KEY)).toBe(sha256(newContent.trim()));
+    expect(store.get(HASH_CHECKPOINT_KEY)).not.toBe(sha256(oldContent));
+  });
+
+  test("agent deletes file mid-wake (producedToolCalls=true) — stored hash becomes 'empty'", async () => {
+    const content = "## Release X\n\nStuff to process.\n";
+    writeFileSync(workspacePath, content, "utf-8");
+    wakeProducedToolCalls = true;
+    wakeSideEffect = () => {
+      rmSync(workspacePath);
+    };
+
+    await runUpdateBulletinJobIfNeeded();
+
+    expect(bootstrapCalls).toBe(1);
+    expect(wakeCalls).toBe(1);
+    expect(existsSync(workspacePath)).toBe(false);
+    expect(store.get(HASH_CHECKPOINT_KEY)).toBe(EMPTY_HASH);
+  });
+
+  test("file present but readFileSync throws — checkpoint UNCHANGED; warn logged (gap 3)", async () => {
+    const content = "## Release U\n\nSimulated read failure.\n";
+    writeFileSync(workspacePath, content, "utf-8");
+
+    readFileSyncOverride = (path) => {
+      if (typeof path === "string" && path === workspacePath) {
+        throw new Error("EACCES simulated");
+      }
+      return undefined;
+    };
+
+    try {
+      await runUpdateBulletinJobIfNeeded();
+    } finally {
+      readFileSyncOverride = null;
+    }
+
+    expect(bootstrapCalls).toBe(0);
+    expect(wakeCalls).toBe(0);
+    expect(store.has(HASH_CHECKPOINT_KEY)).toBe(false);
+    expect(setCheckpointCallCount).toBe(0);
+  });
+
+  test("wake throws — function does not reject; warning logged", async () => {
+    const content = "## Release Z";
+    writeFileSync(workspacePath, content, "utf-8");
+    wakeShouldThrow = true;
+
+    // Must not throw.
+    await expect(runUpdateBulletinJobIfNeeded()).resolves.toBeUndefined();
+
+    expect(bootstrapCalls).toBe(1);
+    expect(wakeCalls).toBe(1);
+    // Hash was never updated because the try/catch returned before the
+    // self-healing step.
+    expect(store.has(HASH_CHECKPOINT_KEY)).toBe(false);
+  });
+});

package/src/__tests__/usage-cache-backfill-migration.test.ts

@@ -16,7 +16,9 @@ mock.module("../util/logger.js", () => ({
 
 mock.module("../config/loader.js", () => ({
   getConfig: () => ({
-    pricingOverrides: mockPricingOverrides,
+    llm: {
+      pricingOverrides: mockPricingOverrides,
+    },
   }),
 }));
 

package/src/__tests__/user-plugin-loader.test.ts

@@ -0,0 +1,191 @@
+/**
+ * Tests for the user plugin loader (PR 29).
+ *
+ * Redirects `vellumRoot()` into a per-test temp directory via `BASE_DATA_DIR`
+ * (the canonical multi-instance override read by `util/platform.ts`) so
+ * `loadUserPlugins()` walks an isolated tree that we populate on demand.
+ *
+ * Covers:
+ * - A plugin whose `register.ts` calls `registerPlugin()` at import time
+ *   ends up in the registry after `loadUserPlugins()` resolves.
+ * - A plugin whose `register.ts` throws during import is logged + skipped;
+ *   other plugins in the same directory still load.
+ * - A missing `vellumRoot()/plugins/` directory is a no-op (zero installed
+ *   user plugins is the default shape of a fresh daemon).
+ */
+import { mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { beforeEach, describe, expect, test } from "bun:test";
+
+import {
+  getRegisteredPlugins,
+  resetPluginRegistryForTests,
+} from "../plugins/registry.js";
+import { loadUserPlugins } from "../plugins/user-loader.js";
+
+// Isolate every run under its own tempdir so parallel test files (and
+// repeated runs of this file) cannot collide on `~/.vellum/plugins/`.
+// Each describe-scope gets a fresh subdirectory.
+const TEST_INSTANCE_DIR = join(
+  tmpdir(),
+  `vellum-user-plugin-loader-test-${process.pid}-${Date.now()}`,
+);
+process.env.BASE_DATA_DIR = TEST_INSTANCE_DIR;
+
+/** The plugins directory the loader will walk. */
+const PLUGINS_DIR = join(TEST_INSTANCE_DIR, ".vellum", "plugins");
+
+/**
+ * Write a plugin directory with a `register.ts` (TypeScript source, so bun
+ * can import it at test time without a build step) that executes the given
+ * body. The body has access to `registerPlugin` via a relative import back
+ * into the repo's registry module.
+ *
+ * `relativeRegistryImport` points from the synthetic plugin file at
+ * `<TEST_INSTANCE_DIR>/.vellum/plugins/<name>/register.ts` to the real
+ * registry source at `<repo>/assistant/src/plugins/registry.ts`. Using a
+ * relative path (rather than a project-root alias) keeps the test hermetic
+ * and matches how an on-disk user plugin would actually import the
+ * registry's public API in a real install.
+ */
+function writePlugin(name: string, body: string): void {
+  const pluginDir = join(PLUGINS_DIR, name);
+  mkdirSync(pluginDir, { recursive: true });
+  // Resolve the absolute path to the registry module so the synthetic
+  // register.ts can import it. bun happily resolves `.ts` files at runtime
+  // when the test suite itself is running in source mode.
+  const registryPath = join(import.meta.dir, "..", "plugins", "registry.ts");
+  const registerSource = `
+import { registerPlugin } from ${JSON.stringify(registryPath)};
+${body}
+`;
+  writeFileSync(join(pluginDir, "register.ts"), registerSource);
+}
+
+function clearPluginsDir(): void {
+  rmSync(TEST_INSTANCE_DIR, { recursive: true, force: true });
+}
+
+describe("user plugin loader", () => {
+  beforeEach(() => {
+    resetPluginRegistryForTests();
+    clearPluginsDir();
+  });
+
+  test("loads a valid plugin whose register.ts calls registerPlugin()", async () => {
+    writePlugin(
+      "my-plugin",
+      `
+registerPlugin({
+  manifest: {
+    name: "my-plugin",
+    version: "0.0.1",
+    requires: { pluginRuntime: "v1" },
+  },
+});
+`,
+    );
+
+    await loadUserPlugins();
+
+    const registered = getRegisteredPlugins();
+    expect(registered).toHaveLength(1);
+    expect(registered[0]?.manifest.name).toBe("my-plugin");
+  });
+
+  test("per-plugin failure is isolated: other plugins still load", async () => {
+    // Plugin A throws at import time. The loader must log and move on so
+    // Plugin B still ends up registered — one bad user plugin cannot brick
+    // the entire user-plugin surface or crash the daemon.
+    writePlugin(
+      "broken-plugin",
+      `
+throw new Error("boom at import time");
+`,
+    );
+    writePlugin(
+      "good-plugin",
+      `
+registerPlugin({
+  manifest: {
+    name: "good-plugin",
+    version: "0.0.1",
+    requires: { pluginRuntime: "v1" },
+  },
+});
+`,
+    );
+
+    await loadUserPlugins();
+
+    const registered = getRegisteredPlugins();
+    const names = registered.map((p) => p.manifest.name);
+    // Order is not guaranteed (filesystem-dependent) — assert membership.
+    expect(names).toContain("good-plugin");
+    expect(names).not.toContain("broken-plugin");
+  });
+
+  test("missing plugins/ directory is a no-op", async () => {
+    // clearPluginsDir() in beforeEach has already removed TEST_INSTANCE_DIR
+    // entirely, so vellumRoot()/plugins/ does not exist. The loader must
+    // complete without throwing and without registering anything.
+    await loadUserPlugins();
+    expect(getRegisteredPlugins()).toHaveLength(0);
+  });
+
+  test("plugin with hanging top-level await is timed out and skipped", async () => {
+    // A plugin whose module evaluation never resolves (hanging top-level
+    // await) would otherwise block daemon startup indefinitely. The loader
+    // must bound the import with a timeout so the hang is isolated the same
+    // way a thrown error would be. A neighboring well-behaved plugin must
+    // still load.
+    writePlugin(
+      "hanging-plugin",
+      `
+await new Promise(() => {
+  // Intentionally never resolves — simulates a plugin whose top-level
+  // await blocks forever.
+});
+registerPlugin({
+  manifest: {
+    name: "hanging-plugin",
+    version: "0.0.1",
+    requires: { pluginRuntime: "v1" },
+  },
+});
+`,
+    );
+    writePlugin(
+      "healthy-plugin",
+      `
+registerPlugin({
+  manifest: {
+    name: "healthy-plugin",
+    version: "0.0.1",
+    requires: { pluginRuntime: "v1" },
+  },
+});
+`,
+    );
+
+    // Use a short test-only timeout so the suite does not wait the full
+    // production 10s for the hung-plugin path.
+    await loadUserPlugins({ importTimeoutMs: 250 });
+
+    const names = getRegisteredPlugins().map((p) => p.manifest.name);
+    expect(names).toContain("healthy-plugin");
+    expect(names).not.toContain("hanging-plugin");
+  });
+
+  test("subdirectory without register.{ts,js} is silently skipped", async () => {
+    // Populate a directory that looks like a plugin but lacks a register
+    // file. The loader must skip it without throwing.
+    const stubDir = join(PLUGINS_DIR, "not-a-plugin");
+    mkdirSync(stubDir, { recursive: true });
+    writeFileSync(join(stubDir, "README.md"), "# not actually a plugin\n");
+
+    await loadUserPlugins();
+    expect(getRegisteredPlugins()).toHaveLength(0);
+  });
+});

package/src/__tests__/verification-control-plane-policy.test.ts

@@ -67,7 +67,7 @@ mock.module("../util/logger.js", () => ({
 }));
 
 mock.module("../permissions/checker.js", () => ({
-  classifyRisk: async () => "low",
+  classifyRisk: async () => ({ level: "low" }),
   check: async () => ({ decision: "allow", reason: "allowed" }),
   generateAllowlistOptions: () => [],
   generateScopeOptions: () => [],
@@ -273,16 +273,6 @@ describe("isVerificationControlPlaneInvocation", () => {
     });
   });
 
-  describe("browser_navigate tool with verification endpoint in url", () => {
-    test("detects verification endpoint", () => {
-      expect(
-        isVerificationControlPlaneInvocation("browser_navigate", {
-          url: "http://localhost:3000/v1/channel-verification-sessions/status",
-        }),
-      ).toBe(true);
-    });
-  });
-
   describe("unrelated tools are not flagged", () => {
     test("file_read is never a verification invocation", () => {
       expect(
@@ -677,17 +667,6 @@ describe("ToolExecutor verification control-plane policy gate", () => {
     expect(result.content).toContain("restricted to guardian users");
   });
 
-  test("non-guardian blocked from browser_navigate to verification endpoint", async () => {
-    const executor = new ToolExecutor(makePrompter());
-    const result = await executor.execute(
-      "browser_navigate",
-      { url: "http://localhost:3000/v1/channel-verification-sessions/status" },
-      makeContext({ trustClass: "trusted_contact" }),
-    );
-    expect(result.isError).toBe(true);
-    expect(result.content).toContain("restricted to guardian users");
-  });
-
   test("non-guardian blocked from host_bash with verification endpoint", async () => {
     const executor = new ToolExecutor(makePrompter());
     const result = await executor.execute(

package/src/__tests__/voice-session-bridge.test.ts

@@ -221,6 +221,45 @@ describe("voice-session-bridge", () => {
     expect(abortCalled).toBe(true);
   });
 
+  test("startVoiceTurn passes callSite: 'callAgent' to runAgentLoop", async () => {
+    const conversation = createConversation("voice bridge callSite test");
+    const events: ServerMessage[] = [
+      { type: "message_complete", conversationId: conversation.id },
+    ];
+
+    let capturedOptions: Record<string, unknown> | undefined;
+    const session = {
+      ...makeStreamingSession(events),
+      runAgentLoop: async (
+        _content: string,
+        _messageId: string,
+        onEvent: (msg: ServerMessage) => void,
+        options?: Record<string, unknown>,
+      ) => {
+        capturedOptions = options;
+        for (const event of events) {
+          onEvent(event);
+        }
+      },
+    } as unknown as Conversation;
+
+    injectDeps(() => session);
+
+    await startVoiceTurn({
+      conversationId: conversation.id,
+      content: "Hello",
+      isInbound: true,
+      onTextDelta: () => {},
+      onComplete: () => {},
+      onError: () => {},
+    });
+
+    await new Promise((r) => setTimeout(r, 50));
+
+    expect(capturedOptions).toBeDefined();
+    expect(capturedOptions?.callSite).toBe("callAgent");
+  });
+
   test("external AbortSignal triggers turn abort", async () => {
     const conversation = createConversation("voice bridge signal test");
     let abortCalled = false;

package/src/__tests__/volume-security-guard.test.ts

@@ -33,13 +33,14 @@ const ALLOWED_FILES = new Set([
   "assistant/src/security/ces-credential-client.ts",
   // Token service owns the signing key lifecycle
   "assistant/src/runtime/auth/token-service.ts",
-  // CLI commands that run outside Docker (doctor diagnostics, trust management)
-  "assistant/src/cli/commands/doctor.ts",
+  // CLI commands that run outside Docker (trust management)
   "assistant/src/cli/commands/trust.ts",
   // Auth middleware documentation comment (not a file access)
   "assistant/src/runtime/auth/middleware.ts",
   // Permission checker: classifies file_read of signing key as High risk
   "assistant/src/permissions/checker.ts",
+  // File risk classifier: replicates signing key path check for file_read
+  "assistant/src/permissions/file-risk-classifier.ts",
 ]);
 
 // ---------------------------------------------------------------------------