@vellumai/assistant 0.6.5 → 0.6.6

package/src/__tests__/plugin-types.test.ts

@@ -0,0 +1,320 @@
+/**
+ * Shape-only tests for the plugin core types (PR 11).
+ *
+ * These tests don't exercise any runtime behavior — they only assert, via
+ * the `satisfies` operator, that a fully-populated `Plugin` literal lines
+ * up with the public interface. If a later PR changes a field name or
+ * signature in a breaking way, this file fails to type-check and the
+ * regression is caught at `tsc --noEmit` / `bun test` time.
+ */
+
+import { describe, expect, test } from "bun:test";
+
+import type { TrustContext } from "../daemon/conversation-runtime-assembly.js";
+import { RiskLevel } from "../permissions/types.js";
+import {
+  type CircuitBreakerArgs,
+  type CircuitBreakerResult,
+  type CompactionArgs,
+  type CompactionResult,
+  type EmptyResponseArgs,
+  type EmptyResponseResult,
+  type EstimateArgs,
+  type EstimateResult,
+  type Injector,
+  type LLMCallArgs,
+  type LLMCallResult,
+  type MemoryArgs,
+  type MemoryResult,
+  type Middleware,
+  type OverflowReduceArgs,
+  type OverflowReduceResult,
+  type PersistArgs,
+  type PersistResult,
+  type Plugin,
+  PluginExecutionError,
+  type PluginInitContext,
+  type PluginManifest,
+  PluginTimeoutError,
+  type TitleArgs,
+  type TitleResult,
+  type ToolErrorArgs,
+  type ToolErrorDecision,
+  type ToolExecuteArgs,
+  type ToolExecuteResult,
+  type ToolResultTruncateArgs,
+  type ToolResultTruncateResult,
+  type TurnContext,
+} from "../plugins/types.js";
+import type { Tool } from "../tools/types.js";
+
+const sampleTrust: TrustContext = {
+  sourceChannel: "vellum",
+  trustClass: "guardian",
+};
+
+const sampleTurnContext: TurnContext = {
+  requestId: "req-abc",
+  conversationId: "conv-xyz",
+  turnIndex: 0,
+  pluginName: "sample-plugin",
+  trust: sampleTrust,
+};
+
+describe("plugin core types", () => {
+  test("a fully-populated Plugin literal satisfies the interface", () => {
+    const manifest: PluginManifest = {
+      name: "sample-plugin",
+      version: "0.1.0",
+      provides: { sampleApi: "v1" },
+      requires: { pluginRuntime: "v1" },
+      requiresCredential: ["SAMPLE_API_KEY"],
+      requiresFlag: ["sample-feature"],
+      config: { parse: (input: unknown) => input },
+    };
+
+    // Generic passthrough — typed per slot below because per-pipeline
+    // arg/result types have diverged from the early `{input: unknown}` /
+    // `{output: unknown}` placeholders as individual pipeline wrap-up PRs
+    // land.
+    function passthroughFor<A, R>(): Middleware<A, R> {
+      return async (args, next, _ctx) => next(args);
+    }
+    const passthrough: Middleware<
+      { input: unknown },
+      { output: unknown }
+    > = async (args, next, _ctx) => next(args);
+    const passthroughHistoryRepair = passthroughFor<
+      import("../plugins/types.js").HistoryRepairArgs,
+      import("../plugins/types.js").HistoryRepairResult
+    >();
+
+    // `llmCall` has concrete arg/result types (upgraded in PR 15).
+    const llmCallPassthrough: Middleware<LLMCallArgs, LLMCallResult> = async (
+      args,
+      next,
+      _ctx,
+    ) => next(args);
+
+    // `toolExecute` has concrete arg/result types (refined in PR 16).
+    const toolExecutePassthrough: Middleware<
+      ToolExecuteArgs,
+      ToolExecuteResult
+    > = async (args, next, _ctx) => next(args);
+
+    // `toolResultTruncate` has a concrete args/result shape (PR 17) so we
+    // need a dedicated passthrough for that slot.
+    const truncatePassthrough: Middleware<
+      ToolResultTruncateArgs,
+      ToolResultTruncateResult
+    > = async (args, _next, _ctx) => ({
+      content: args.content,
+      truncated: false,
+    });
+
+    // The `emptyResponse` slot has concrete args/result types; use a
+    // dedicated passthrough so the `satisfies Plugin` check stays honest.
+    const emptyResponsePassthrough: Middleware<
+      EmptyResponseArgs,
+      EmptyResponseResult
+    > = async (args, next, _ctx) => next(args);
+
+    // The `toolError` slot has concrete args/result types (PR 19); use a
+    // dedicated passthrough so the shape-only test keeps compiling as types
+    // get tightened.
+    const toolErrorPassthrough: Middleware<
+      ToolErrorArgs,
+      ToolErrorDecision
+    > = async (args, next, _ctx) => next(args);
+
+    // `memoryRetrieval` has a concrete typed signature (MemoryArgs →
+    // MemoryResult) introduced in PR 20, so it can't use the generic
+    // `{ input }` passthrough above.
+    const memoryPassthrough: Middleware<MemoryArgs, MemoryResult> = async (
+      args,
+      next,
+      _ctx,
+    ) => next(args);
+
+    // `tokenEstimate` has a concrete arg/result shape (refined in the
+    // tokenEstimate-pipeline PR), so its middleware can't share the generic
+    // `{ input, output }` passthrough. A slot-specific passthrough keeps the
+    // shape-only assertion honest across type-refinement PRs.
+    const tokenEstimatePassthrough: Middleware<
+      EstimateArgs,
+      EstimateResult
+    > = async (args, next, _ctx) => next(args);
+
+    // `overflowReduce` has a concrete arg/result shape (PR 23). Uses a
+    // dedicated passthrough that returns a structurally-correct result so
+    // `satisfies Plugin` keeps verifying the signature.
+    const overflowReducePassthrough: Middleware<
+      OverflowReduceArgs,
+      OverflowReduceResult
+    > = async (args, _next, _ctx) => ({
+      messages: args.messages,
+      runMessages: args.runMessages,
+      injectionMode: "full",
+      reducerState: {
+        appliedTiers: [],
+        injectionMode: "full",
+        exhausted: true,
+      },
+      reducerCompacted: false,
+      attempts: 0,
+    });
+
+    // Slot-specific passthrough for the `compaction` pipeline — PR 25
+    // narrowed its args/result away from the generic `{ input: unknown }`
+    // placeholder, so the generic `passthrough` no longer satisfies its
+    // middleware signature. This dedicated middleware keeps the shape-only
+    // assertion for the slot without forcing every other slot to narrow.
+    const compactionPassthrough: Middleware<
+      CompactionArgs,
+      CompactionResult
+    > = async (args, next, _ctx) => next(args);
+
+    // `circuitBreaker` carries a concrete arg shape (pipeline wrapping
+    // landed ahead of the other slots) so it needs its own passthrough
+    // rather than reusing the generic placeholder.
+    const circuitPassthrough: Middleware<
+      CircuitBreakerArgs,
+      CircuitBreakerResult
+    > = async (args, next, _ctx) => next(args);
+
+    // `persistence` has concrete discriminated-union arg/result types
+    // (upgraded from the initial `{ input }/{ output }` placeholder in PR 27)
+    // so it gets its own passthrough rather than sharing the generic one
+    // above.
+    const persistPassthrough: Middleware<PersistArgs, PersistResult> = async (
+      args,
+      next,
+      _ctx,
+    ) => next(args);
+
+    // The `titleGenerate` slot now has concrete arg/result types (PR 28)
+    // rather than the placeholder `{ input/output: unknown }` shape, so it
+    // needs its own passthrough implementation.
+    const titlePassthrough: Middleware<TitleArgs, TitleResult> = async (
+      args,
+      next,
+      _ctx,
+    ) => next(args);
+
+    const injector: Injector = {
+      name: "sample-injector",
+      order: 10,
+      async produce(_ctx) {
+        return { id: "sample-block", text: "hello", meta: { kind: "demo" } };
+      },
+    };
+
+    const sampleTool: Tool = {
+      name: "sample-tool",
+      description: "Sample plugin tool",
+      category: "plugins",
+      defaultRiskLevel: RiskLevel.Low,
+      getDefinition() {
+        return {
+          name: "sample-tool",
+          description: "Sample plugin tool",
+          input_schema: { type: "object", properties: {}, required: [] },
+        };
+      },
+      async execute() {
+        return { content: "ok", isError: false };
+      },
+    };
+
+    const plugin = {
+      manifest,
+      async init(ctx: PluginInitContext) {
+        // Touch every field so refactors that rename any of them break here.
+        void ctx.config;
+        void ctx.credentials;
+        void ctx.logger;
+        void ctx.pluginStorageDir;
+        void ctx.assistantVersion;
+        void ctx.apiVersions;
+      },
+      async onShutdown() {
+        // no-op
+      },
+      tools: [sampleTool],
+      routes: [
+        {
+          pattern: /^\/sample$/,
+          methods: ["GET"],
+          handler: async () => new Response("ok", { status: 200 }),
+        },
+      ],
+      skills: [
+        {
+          id: "sample-skill",
+          name: "Sample Skill",
+          description: "Demo plugin-contributed skill",
+          body: "## Sample\n\nPlugin-provided skill body.",
+        },
+      ],
+      injectors: [injector],
+      middleware: {
+        turn: passthrough,
+        llmCall: llmCallPassthrough,
+        toolExecute: toolExecutePassthrough,
+        memoryRetrieval: memoryPassthrough,
+        historyRepair: passthroughHistoryRepair,
+        tokenEstimate: tokenEstimatePassthrough,
+        compaction: compactionPassthrough,
+        overflowReduce: overflowReducePassthrough,
+        persistence: persistPassthrough,
+        titleGenerate: titlePassthrough,
+        toolResultTruncate: truncatePassthrough,
+        emptyResponse: emptyResponsePassthrough,
+        toolError: toolErrorPassthrough,
+        circuitBreaker: circuitPassthrough,
+      },
+    } satisfies Plugin;
+
+    // Minimal runtime check so the test body is non-empty.
+    expect(plugin.manifest.name).toBe("sample-plugin");
+    expect(plugin.middleware.turn).toBe(passthrough);
+    expect(plugin.middleware.historyRepair).toBe(passthroughHistoryRepair);
+  });
+
+  test("PluginTimeoutError carries pipeline, plugin, and elapsed fields", () => {
+    const err = new PluginTimeoutError("compaction", "sample-plugin", 30000);
+    expect(err).toBeInstanceOf(Error);
+    expect(err.name).toBe("PluginTimeoutError");
+    expect(err.pipeline).toBe("compaction");
+    expect(err.pluginName).toBe("sample-plugin");
+    expect(err.elapsedMs).toBe(30000);
+    expect(err.message).toContain("compaction");
+    expect(err.message).toContain("30000");
+    expect(err.message).toContain("sample-plugin");
+  });
+
+  test("PluginTimeoutError omits plugin suffix when unknown", () => {
+    const err = new PluginTimeoutError("llmCall", undefined, 1234);
+    expect(err.pluginName).toBeUndefined();
+    expect(err.message).not.toContain("offending plugin");
+  });
+
+  test("PluginExecutionError carries the plugin name and message", () => {
+    const err = new PluginExecutionError(
+      "plugin 'x' requires memoryApi@v2, assistant exposes v1",
+      "x",
+    );
+    expect(err).toBeInstanceOf(Error);
+    expect(err.name).toBe("PluginExecutionError");
+    expect(err.pluginName).toBe("x");
+    expect(err.message).toContain("memoryApi@v2");
+  });
+
+  test("TurnContext references the canonical TrustContext", () => {
+    // Assignment is the real assertion — if `TurnContext.trust` drifts from
+    // `TrustContext` this fails to compile.
+    const ctx: TurnContext = sampleTurnContext;
+    expect(ctx.trust.trustClass).toBe("guardian");
+    expect(ctx.trust.sourceChannel).toBe("vellum");
+  });
+});

package/src/__tests__/pricing.test.ts

@@ -30,7 +30,7 @@ describe("resolvePricing", () => {
         1_000_000,
       );
       expect(result.pricingStatus).toBe("priced");
-      expect(result.estimatedCostUsd).toBe(15 + 75);
+      expect(result.estimatedCostUsd).toBe(5 + 25);
     });
 
     test("returns priced for claude-sonnet-4", () => {
@@ -52,7 +52,7 @@ describe("resolvePricing", () => {
         1_000_000,
       );
       expect(result.pricingStatus).toBe("priced");
-      expect(result.estimatedCostUsd).toBe(0.8 + 4);
+      expect(result.estimatedCostUsd).toBe(1 + 5);
     });
   });
 
@@ -202,7 +202,7 @@ describe("resolvePricing", () => {
         1_000_000,
       );
       expect(result.pricingStatus).toBe("priced");
-      expect(result.estimatedCostUsd).toBe(15 + 75);
+      expect(result.estimatedCostUsd).toBe(5 + 25);
     });
 
     test("matches gpt-4o-mini-2024-07-18 via gpt-4o-mini prefix", () => {
@@ -269,6 +269,7 @@ describe("resolvePricingForUsage", () => {
     );
 
     expect(result.pricingStatus).toBe("priced");
+    // 5 (input) + 50 (output) + 0.15 (cache-read) + 1.25 (5m write) + 1.0 (1h write) = 57.4
     expect(result.estimatedCostUsd).toBeCloseTo(57.4, 10);
   });
 
@@ -306,7 +307,11 @@ describe("fast mode pricing", () => {
       speed: "fast",
     };
 
-    const result = resolvePricingForUsage("anthropic", "claude-opus-4-6", usage);
+    const result = resolvePricingForUsage(
+      "anthropic",
+      "claude-opus-4-6",
+      usage,
+    );
 
     // Base: $5 input + $25 output = $30; fast: $30 * 6 = $180
     expect(result.pricingStatus).toBe("priced");
@@ -323,7 +328,11 @@ describe("fast mode pricing", () => {
       speed: "standard",
     };
 
-    const result = resolvePricingForUsage("anthropic", "claude-opus-4-6", usage);
+    const result = resolvePricingForUsage(
+      "anthropic",
+      "claude-opus-4-6",
+      usage,
+    );
 
     expect(result.pricingStatus).toBe("priced");
     expect(result.estimatedCostUsd).toBe(5 + 25);
@@ -339,7 +348,11 @@ describe("fast mode pricing", () => {
       speed: null,
     };
 
-    const result = resolvePricingForUsage("anthropic", "claude-opus-4-6", usage);
+    const result = resolvePricingForUsage(
+      "anthropic",
+      "claude-opus-4-6",
+      usage,
+    );
 
     expect(result.pricingStatus).toBe("priced");
     expect(result.estimatedCostUsd).toBe(5 + 25);
@@ -374,7 +387,9 @@ describe("fast mode pricing", () => {
     expect(fastResult.pricingStatus).toBe("priced");
     expect(standardResult.pricingStatus).toBe("priced");
     // Fast mode applies 6x to base rates; cache multipliers stack on top
-    expect(fastResult.estimatedCostUsd).toBe(standardResult.estimatedCostUsd! * 6);
+    expect(fastResult.estimatedCostUsd).toBe(
+      standardResult.estimatedCostUsd! * 6,
+    );
   });
 
   test("does not apply fast mode multiplier for non-Anthropic providers", () => {
@@ -459,7 +474,7 @@ describe("Anthropic models on OpenRouter", () => {
       1_000_000,
     );
     expect(result.pricingStatus).toBe("priced");
-    expect(result.estimatedCostUsd).toBe(0.8 + 4);
+    expect(result.estimatedCostUsd).toBe(1 + 5);
   });
 
   test("prices bare claude-opus-4-6 slug returned unprefixed", () => {
@@ -528,7 +543,7 @@ describe("Anthropic models on OpenRouter", () => {
       1_000_000,
     );
     expect(result.pricingStatus).toBe("priced");
-    expect(result.estimatedCostUsd).toBe(0.8 + 4);
+    expect(result.estimatedCostUsd).toBe(1 + 5);
   });
 
   test("returns unpriced for unknown anthropic model on OpenRouter", () => {
@@ -542,13 +557,24 @@ describe("Anthropic models on OpenRouter", () => {
     expect(result.estimatedCostUsd).toBeNull();
   });
 
-  test("returns unpriced for non-Anthropic OpenRouter model", () => {
+  test("prices non-Anthropic OpenRouter model from catalog", () => {
     const result = resolvePricing(
       "openrouter",
       "x-ai/grok-4.20-beta",
       1_000_000,
       1_000_000,
     );
+    expect(result.pricingStatus).toBe("priced");
+    expect(result.estimatedCostUsd).toBe(3 + 15);
+  });
+
+  test("returns unpriced for unknown non-Anthropic OpenRouter model", () => {
+    const result = resolvePricing(
+      "openrouter",
+      "unknown-provider/some-model",
+      1_000_000,
+      1_000_000,
+    );
     expect(result.pricingStatus).toBe("unpriced");
     expect(result.estimatedCostUsd).toBeNull();
   });
@@ -566,7 +592,11 @@ describe("Anthropic models on OpenRouter", () => {
       "anthropic/claude-opus-4.6",
       usage,
     );
-    const direct = resolvePricingForUsage("anthropic", "claude-opus-4-6", usage);
+    const direct = resolvePricingForUsage(
+      "anthropic",
+      "claude-opus-4-6",
+      usage,
+    );
 
     // Cache-read tokens are charged at 10% of input rate for Anthropic models.
     expect(openRouter.pricingStatus).toBe("priced");
@@ -623,7 +653,9 @@ describe("Anthropic models on OpenRouter", () => {
 
 describe("usesAnthropicPricingRules", () => {
   test("returns true for direct Anthropic", () => {
-    expect(usesAnthropicPricingRules("anthropic", "claude-opus-4-6")).toBe(true);
+    expect(usesAnthropicPricingRules("anthropic", "claude-opus-4-6")).toBe(
+      true,
+    );
   });
 
   test("returns true for anthropic/* on OpenRouter", () => {

package/src/__tests__/proxy-approval-callback.test.ts

@@ -133,13 +133,6 @@ describe("createProxyApprovalCallback", () => {
   test("returns true when user allows an ask_missing_credential request", async () => {
     const ctx = makeContext();
 
-    const _resolvePrompt:
-      | ((v: {
-          decision: string;
-          selectedPattern?: string;
-          selectedScope?: string;
-        }) => void)
-      | null = null;
     const prompterSendToClient = mock(() => {});
     const prompter = new PermissionPrompter(prompterSendToClient);
 
@@ -381,7 +374,14 @@ describe("createProxyApprovalCallback", () => {
       // Verify the confirmation request uses the network_request tool name
       expect(msg.toolName).toBe("network_request");
       expect(msg.input).toHaveProperty("url", "https://api.fal.ai:443/v1/run");
-      expect(msg.input).toHaveProperty("matching_patterns", ["*.fal.ai"]);
+      expect(msg.input).toHaveProperty("scheme", "https");
+      expect(msg.input).toHaveProperty("known_credential_patterns", [
+        "*.fal.ai",
+      ]);
+      expect(msg.input.reason).toMatch(
+        /A known credential template matches this host.*caller-supplied auth headers will still be sent/,
+      );
+      expect(msg.input).not.toHaveProperty("proxy_session_id");
       prompter.resolveConfirmation(msg.requestId, "allow");
       return p;
     };
@@ -390,6 +390,67 @@ describe("createProxyApprovalCallback", () => {
     await callback(makeAskMissingCredentialRequest());
   });
 
+  test("surfaces method and curated headers when the proxy has HTTP-level context", async () => {
+    const ctx = makeContext();
+    const prompterSendToClient = mock(() => {});
+    const prompter = new PermissionPrompter(prompterSendToClient);
+
+    const originalPrompt = prompter.prompt.bind(prompter);
+    prompter.prompt = async (...args) => {
+      const p = originalPrompt(...args);
+      await new Promise((r) => setTimeout(r, 10));
+      const call = (prompterSendToClient.mock.calls as unknown[][])[0];
+      const msg = call[0] as {
+        requestId: string;
+        input: Record<string, unknown>;
+      };
+      expect(msg.input).toHaveProperty("method", "POST");
+      expect(msg.input).toHaveProperty("request_headers", {
+        "content-type": "application/json",
+        "user-agent": "curl/8.5.0",
+      });
+      expect(msg.input).not.toHaveProperty("connection_detail_available");
+      prompter.resolveConfirmation(msg.requestId, "allow");
+      return p;
+    };
+
+    const callback = createProxyApprovalCallback(prompter, ctx);
+    await callback(
+      makeAskUnauthenticatedRequest({
+        method: "POST",
+        requestHeaders: {
+          "content-type": "application/json",
+          "user-agent": "curl/8.5.0",
+        },
+      }),
+    );
+  });
+
+  test("marks connection_detail_available=no for HTTPS CONNECT approvals", async () => {
+    const ctx = makeContext();
+    const prompterSendToClient = mock(() => {});
+    const prompter = new PermissionPrompter(prompterSendToClient);
+
+    const originalPrompt = prompter.prompt.bind(prompter);
+    prompter.prompt = async (...args) => {
+      const p = originalPrompt(...args);
+      await new Promise((r) => setTimeout(r, 10));
+      const call = (prompterSendToClient.mock.calls as unknown[][])[0];
+      const msg = call[0] as {
+        requestId: string;
+        input: Record<string, unknown>;
+      };
+      expect(msg.input).toHaveProperty("connection_detail_available", "no");
+      expect(msg.input).not.toHaveProperty("method");
+      expect(msg.input).not.toHaveProperty("request_headers");
+      prompter.resolveConfirmation(msg.requestId, "allow");
+      return p;
+    };
+
+    const callback = createProxyApprovalCallback(prompter, ctx);
+    await callback(makeAskUnauthenticatedRequest());
+  });
+
   test("sends correct tool name for ask_unauthenticated decisions", async () => {
     const ctx = makeContext();
     const prompterSendToClient = mock(() => {});

package/src/__tests__/reaction-persistence.test.ts

@@ -80,6 +80,7 @@ function resetState(): void {
   db.run("DELETE FROM conversations");
   db.run("DELETE FROM contact_channels");
   db.run("DELETE FROM contacts");
+  _clearApprovalPromptTsTrackerForTesting();
 }
 
 function seedActiveMember(): void {

package/src/__tests__/regenerate-fire-and-forget-trace.test.ts

@@ -54,6 +54,7 @@ mock.module("../memory/qdrant-client.js", () => ({
   getQdrantClient: () => {
     throw new Error("Qdrant not initialized");
   },
+  resolveQdrantUrl: () => "http://127.0.0.1:6333",
 }));
 
 import {

package/src/__tests__/registry.test.ts

@@ -117,8 +117,6 @@ describe("tool manifest", () => {
     expect(names).toContain("recall");
     expect(names).toContain("remember");
     expect(names).toContain("credential_store");
-    // start_screen_watch moved to the screen-watch bundled skill
-    expect(names).not.toContain("start_screen_watch");
   });
 
   test("registered tool count is at least eager + host", async () => {