@vellumai/assistant 0.6.6 → 0.7.0

package/src/__tests__/http-conversation-lineage.test.ts

@@ -35,7 +35,9 @@ import {
   createConversation,
   updateConversationTitle,
 } from "../memory/conversation-crud.js";
-import { getDb, initializeDb, rawRun, resetDb } from "../memory/db.js";
+import { getDb, resetDb } from "../memory/db-connection.js";
+import { initializeDb } from "../memory/db-init.js";
+import { rawRun } from "../memory/raw-query.js";
 import { RuntimeHttpServer } from "../runtime/http-server.js";
 
 initializeDb();
@@ -212,7 +214,6 @@ describe("conversation lineage in HTTP reads", () => {
   async function startServer(): Promise<void> {
     server = new RuntimeHttpServer({
       port: 0,
-      bearerToken: "test-bearer-token",
     });
     await server.start();
   }

package/src/__tests__/http-user-message-parity.test.ts

@@ -176,8 +176,9 @@ mock.module("../config/loader.js", () => ({
 
 import type { AuthContext } from "../runtime/auth/types.js";
 import { handleSendMessage } from "../runtime/routes/conversation-routes.js";
+import { callHandler } from "./helpers/call-route-handler.js";
 
-const testAuthContext: AuthContext = {
+const _testAuthContext: AuthContext = {
   subject: "actor:self:test-actor",
   principalType: "actor",
   assistantId: "self",
@@ -208,6 +209,8 @@ function makeConversation(overrides: Record<string, unknown> = {}) {
     setHostBashProxy: () => {},
     setHostBrowserProxy: () => {},
     setHostFileProxy: () => {},
+    setHostTransferProxy: () => {},
+    getHostTransferProxy: () => undefined,
     setHostCuProxy: () => {},
     addPreactivatedSkillId: () => {},
     emitConfirmationStateChanged: () => {},
@@ -234,7 +237,11 @@ function makeConversation(overrides: Record<string, unknown> = {}) {
 function makeRequest(content: string, extra: Record<string, unknown> = {}) {
   return new Request("http://localhost/v1/messages", {
     method: "POST",
-    headers: { "Content-Type": "application/json" },
+    headers: {
+      "Content-Type": "application/json",
+      "x-vellum-actor-principal-id": "test-user",
+      "x-vellum-principal-type": "actor",
+    },
     body: JSON.stringify({
       conversationKey: "parity-test-key",
       content,
@@ -251,16 +258,18 @@ async function sendMessage(
   conversationObj: import("../daemon/conversation.js").Conversation,
   extra: Record<string, unknown> = {},
 ) {
-  return handleSendMessage(
+  return callHandler(
+    (args) =>
+      handleSendMessage(args, {
+        sendMessageDeps: {
+          getOrCreateConversation: async () => conversationObj,
+          assistantEventHub: { publish: async () => {} } as any,
+          resolveAttachments: () => [],
+        },
+      }),
     makeRequest(content, extra),
-    {
-      sendMessageDeps: {
-        getOrCreateConversation: async () => conversationObj,
-        assistantEventHub: { publish: async () => {} } as any,
-        resolveAttachments: () => [],
-      },
-    },
-    testAuthContext,
+    undefined,
+    202,
   );
 }
 

package/src/__tests__/inbound-invite-redemption.test.ts

@@ -69,9 +69,10 @@ import {
   upsertContact,
 } from "../contacts/contact-store.js";
 import { upsertContactChannel } from "../contacts/contacts-write.js";
-import { getDb, initializeDb } from "../memory/db.js";
+import { getDb } from "../memory/db-connection.js";
+import { initializeDb } from "../memory/db-init.js";
 import { createInvite, revokeInvite } from "../memory/invite-store.js";
-import { handleChannelInbound } from "../runtime/routes/channel-routes.js";
+import { handleChannelInbound } from "./helpers/channel-test-adapter.js";
 
 initializeDb();
 

package/src/__tests__/injector-chain.test.ts

@@ -141,9 +141,8 @@ describe("injector chain", () => {
   });
 
   test("composeInjectorChain returns empty string when every injector opts out", async () => {
-    // The default chain is the golden-path: all seven defaults return `null`
-    // in this PR, so the composed block is an empty string, matching the
-    // pre-PR behavior where no chain existed at all.
+    // The default chain is the golden-path: all eight defaults return `null`
+    // on an empty turn context, so the composed block is an empty string.
     registerPlugin(defaultInjectorsPlugin);
 
     const composed = await composeInjectorChain(makeTurnContext());
@@ -286,13 +285,13 @@ describe("injector chain", () => {
     expect(result.blocks.injectorChainBlock).toBe("THIRD_PARTY_BLOCK");
   });
 
-  // ── G2.1 migration integration tests ────────────────────────────────
+  // ── Integration tests ───────────────────────────────────────────────
   //
   // These assertions exercise the real per-turn injection pipeline with
-  // the default chain active, verifying that each ported injector emits
-  // byte-identical content to the pre-migration output and that a
-  // third-party injector registered at a fractional `order` slots into
-  // the correct position in the final user-tail content.
+  // the default chain active, verifying that each default injector emits
+  // the expected content and that a third-party injector registered at a
+  // fractional `order` slots into the correct position in the final
+  // user-tail content.
 
   test("golden-path: default chain injects workspace + unified-turn + PKB + NOW + subagent in the correct positions", async () => {
     // Canonical golden-path conversation state: full mode, non-Slack
@@ -366,22 +365,22 @@ describe("injector chain", () => {
     );
   });
 
-  test("third-party injector at order 25 lands between unified-turn-context (20) and pkb-context (30) in the final message", async () => {
+  test("third-party prepend injector at order 15 lands between workspace (10) and unified-turn-context (20) in the final message", async () => {
     // Proves the extensibility contract end-to-end: a plugin-registered
-    // injector at `order: 25` with `placement: "prepend-user-tail"` slots
-    // between the unified-turn prepend (order 20, executes just before
-    // workspace) and the PKB after-memory splice (order 30). Because it
-    // uses prepend-user-tail placement it becomes a third prepend,
-    // landing between workspace (topmost) and unified-turn.
+    // injector at `order: 15` with `placement: "prepend-user-tail"` slots
+    // between the workspace prepend (order 10) and the unified-turn
+    // prepend (order 20). Because descending-order application for
+    // prepends puts the lowest-`order` injector topmost, workspace ends
+    // up on top, then plugin@15, then unified-turn.
     registerPlugin(defaultInjectorsPlugin);
     registerPlugin(
-      wrapInPlugin("third-party-25-prepend", [
+      wrapInPlugin("third-party-15-prepend", [
         {
-          name: "plugin-25",
+          name: "plugin-15",
           order: 15, // between workspace (10) and unified-turn (20)
           async produce(): Promise<InjectionBlock> {
             return {
-              id: "plugin-25",
+              id: "plugin-15",
               text: "<plugin_block_15/>",
               placement: "prepend-user-tail",
             };

package/src/__tests__/inline-skill-load-permissions.test.ts

@@ -34,14 +34,12 @@ mock.module("../util/logger.js", () => ({
 }));
 
 interface TestConfig {
-  permissions: { mode: "strict" | "workspace" };
   skills: { load: { extraDirs: string[] } };
   sandbox: { enabled: boolean };
   [key: string]: unknown;
 }
 
 const testConfig: TestConfig = {
-  permissions: { mode: "workspace" },
   skills: { load: { extraDirs: [] } },
   sandbox: { enabled: true },
 };
@@ -57,11 +55,27 @@ mock.module("../config/loader.js", () => ({
   setNestedValue: () => {},
 }));
 
+import {
+  installIpcMock,
+  mockIpcResponse,
+} from "./helpers/gateway-classify-mock.js";
+installIpcMock();
+mockIpcResponse("classify_risk", {
+  risk: "low",
+  reason: "skill_load",
+  matchType: "unknown",
+});
+mockIpcResponse("get_global_thresholds", {
+  interactive: "low",
+  background: "medium",
+  headless: "none",
+});
+
 // ── Imports (after mocks) ─────────────────────────────────────────────────
 
 import { check, generateAllowlistOptions } from "../permissions/checker.js";
-import { addRule, clearCache } from "../permissions/trust-store.js";
-import { computeSkillVersionHash } from "../skills/version-hash.js";
+import { clearRiskCache } from "../permissions/checker.js";
+import { _clearGlobalCacheForTesting } from "../permissions/gateway-threshold-reader.js";
 
 // ── Helpers ───────────────────────────────────────────────────────────────
 
@@ -102,8 +116,13 @@ function writeDynamicSkill(
 
 describe("inline-command skill_load permissions", () => {
   beforeEach(() => {
-    clearCache();
-    testConfig.permissions = { mode: "workspace" };
+    clearRiskCache();
+    _clearGlobalCacheForTesting();
+    mockIpcResponse("get_global_thresholds", {
+      interactive: "low",
+      background: "medium",
+      headless: "none",
+    });
     testConfig.skills = { load: { extraDirs: [] } };
     _setOverridesForTesting({
       "inline-skill-commands": true,
@@ -120,10 +139,10 @@ describe("inline-command skill_load permissions", () => {
     }
   });
 
-  // ── Default prompt behavior ──────────────────────────────────────────
+  // ── Default behavior ─────────────────────────────────────────────────
 
-  describe("default prompt behavior", () => {
-    test("dynamic skill prompts by default (matches skill_load_dynamic:* ask rule)", async () => {
+  describe("default behavior", () => {
+    test("dynamic skill auto-allows in workspace mode (low risk threshold)", async () => {
       ensureSkillsDir();
       writeDynamicSkill("dynamic-prompt", "Dynamic Prompt Skill");
 
@@ -132,16 +151,18 @@ describe("inline-command skill_load permissions", () => {
         { skill: "dynamic-prompt" },
         "/tmp",
       );
-      expect(result.decision).toBe("prompt");
-      expect(result.matchedRule).toBeDefined();
-      expect(result.matchedRule!.pattern).toBe("skill_load_dynamic:*");
-      expect(result.matchedRule!.decision).toBe("ask");
+      expect(result.decision).toBe("allow");
     });
 
-    test("dynamic skill prompts in strict mode too", async () => {
+    test("dynamic skill prompts in strict mode (no matching rule)", async () => {
       ensureSkillsDir();
       writeDynamicSkill("dynamic-strict", "Dynamic Strict Skill");
-      testConfig.permissions.mode = "strict";
+      mockIpcResponse("get_global_thresholds", {
+        interactive: "none",
+        background: "none",
+        headless: "none",
+      });
+      _clearGlobalCacheForTesting();
 
       const result = await check(
         "skill_load",
@@ -149,147 +170,14 @@ describe("inline-command skill_load permissions", () => {
         "/tmp",
       );
       expect(result.decision).toBe("prompt");
-      expect(result.matchedRule).toBeDefined();
-      expect(result.matchedRule!.pattern).toBe("skill_load_dynamic:*");
-    });
-  });
-
-  // ── Exact-hash allow rules ───────────────────────────────────────────
-
-  describe("exact-hash allow rules", () => {
-    test("exact skill_load_dynamic:<id>@<hash> rule auto-allows", async () => {
-      ensureSkillsDir();
-      writeDynamicSkill("dynamic-pinned", "Dynamic Pinned Skill");
-
-      // Compute the transitive hash to create a version-pinned rule.
-      const { computeTransitiveSkillVersionHash } =
-        await import("../skills/transitive-version-hash.js");
-      const { indexCatalogById } = await import("../skills/include-graph.js");
-      const { loadSkillCatalog } = await import("../config/skills.js");
-
-      const catalog = loadSkillCatalog();
-      const index = indexCatalogById(catalog);
-      const transitiveHash = computeTransitiveSkillVersionHash(
-        "dynamic-pinned",
-        index,
-      );
-
-      // Add an exact hash rule
-      addRule(
-        "skill_load",
-        `skill_load_dynamic:dynamic-pinned@${transitiveHash}`,
-        "everywhere",
-        "allow",
-        2000,
-      );
-
-      const result = await check(
-        "skill_load",
-        { skill: "dynamic-pinned" },
-        "/tmp",
-      );
-      expect(result.decision).toBe("allow");
-      expect(result.matchedRule).toBeDefined();
-      expect(result.matchedRule!.pattern).toBe(
-        `skill_load_dynamic:dynamic-pinned@${transitiveHash}`,
-      );
-    });
-  });
-
-  // ── Any-version allow rules ──────────────────────────────────────────
-
-  describe("any-version allow rules", () => {
-    test("skill_load_dynamic:<id> rule auto-allows any version", async () => {
-      ensureSkillsDir();
-      writeDynamicSkill("dynamic-anyver", "Dynamic Any Version Skill");
-
-      addRule(
-        "skill_load",
-        "skill_load_dynamic:dynamic-anyver",
-        "everywhere",
-        "allow",
-        2000,
-      );
-
-      const result = await check(
-        "skill_load",
-        { skill: "dynamic-anyver" },
-        "/tmp",
-      );
-      expect(result.decision).toBe("allow");
-      expect(result.matchedRule).toBeDefined();
-      expect(result.matchedRule!.pattern).toBe(
-        "skill_load_dynamic:dynamic-anyver",
-      );
+      expect(result.reason).toContain("above auto-approve threshold");
     });
   });
 
-  // ── Changed transitive hash re-prompting ─────────────────────────────
+  // ── Non-dynamic skills ───────────────────────────────────────────────
 
-  describe("changed transitive hash re-prompting", () => {
-    test("editing a dynamic skill changes the hash, causing version-pinned rule to stop matching", async () => {
-      ensureSkillsDir();
-      writeDynamicSkill("dynamic-reprompt", "Dynamic Reprompt", "echo v1");
-
-      const { computeTransitiveSkillVersionHash } =
-        await import("../skills/transitive-version-hash.js");
-      const { indexCatalogById } = await import("../skills/include-graph.js");
-      const { loadSkillCatalog } = await import("../config/skills.js");
-
-      const catalog1 = loadSkillCatalog();
-      const index1 = indexCatalogById(catalog1);
-      const hashV1 = computeTransitiveSkillVersionHash(
-        "dynamic-reprompt",
-        index1,
-      );
-
-      // Add a version-specific rule for v1
-      addRule(
-        "skill_load",
-        `skill_load_dynamic:dynamic-reprompt@${hashV1}`,
-        "everywhere",
-        "allow",
-        2000,
-      );
-
-      // v1: should auto-allow
-      const resultV1 = await check(
-        "skill_load",
-        { skill: "dynamic-reprompt" },
-        "/tmp",
-      );
-      expect(resultV1.decision).toBe("allow");
-      expect(resultV1.matchedRule!.pattern).toBe(
-        `skill_load_dynamic:dynamic-reprompt@${hashV1}`,
-      );
-
-      // Edit the skill (change the command)
-      writeDynamicSkill("dynamic-reprompt", "Dynamic Reprompt", "echo v2");
-
-      const catalog2 = loadSkillCatalog();
-      const index2 = indexCatalogById(catalog2);
-      const hashV2 = computeTransitiveSkillVersionHash(
-        "dynamic-reprompt",
-        index2,
-      );
-      expect(hashV2).not.toBe(hashV1);
-
-      // v2: the version-specific rule no longer matches; falls through
-      // to the default skill_load_dynamic:* ask rule
-      const resultV2 = await check(
-        "skill_load",
-        { skill: "dynamic-reprompt" },
-        "/tmp",
-      );
-      expect(resultV2.decision).toBe("prompt");
-      expect(resultV2.matchedRule!.pattern).toBe("skill_load_dynamic:*");
-    });
-  });
-
-  // ── Non-dynamic skills continue matching skill_load:* ────────────────
-
-  describe("non-dynamic skills continue to use skill_load:* flow", () => {
-    test("plain skill (no inline expansions) matches skill_load:* allow rule", async () => {
+  describe("non-dynamic skills continue to use skill_load flow", () => {
+    test("plain skill auto-allows in workspace mode (low risk threshold)", async () => {
       ensureSkillsDir();
       writePlainSkill("plain-skill", "Plain Skill");
 
@@ -299,42 +187,14 @@ describe("inline-command skill_load permissions", () => {
         "/tmp",
       );
       expect(result.decision).toBe("allow");
-      expect(result.matchedRule).toBeDefined();
-      expect(result.matchedRule!.pattern).toBe("skill_load:*");
     });
 
-    test("plain skill with version-specific rule still uses skill_load: namespace", async () => {
-      ensureSkillsDir();
-      writePlainSkill("plain-pinned", "Plain Pinned Skill");
-      testConfig.permissions.mode = "strict";
-
-      const skillDir = join(testDir, "skills", "plain-pinned");
-      const diskHash = computeSkillVersionHash(skillDir);
-
-      addRule(
-        "skill_load",
-        `skill_load:plain-pinned@${diskHash}`,
-        "everywhere",
-        "allow",
-        2000,
-      );
-
-      const result = await check(
-        "skill_load",
-        { skill: "plain-pinned" },
-        "/tmp",
-      );
-      expect(result.decision).toBe("allow");
-      expect(result.matchedRule!.pattern).toBe(
-        `skill_load:plain-pinned@${diskHash}`,
-      );
-    });
   });
 
   // ── Feature flag disabled ────────────────────────────────────────────
 
   describe("feature flag disabled", () => {
-    test("dynamic skill falls through to skill_load:* when flag is off", async () => {
+    test("dynamic skill auto-allows when flag is off (low risk threshold)", async () => {
       ensureSkillsDir();
       writeDynamicSkill("dynamic-flag-off", "Dynamic Flag Off Skill");
 
@@ -348,9 +208,7 @@ describe("inline-command skill_load permissions", () => {
         { skill: "dynamic-flag-off" },
         "/tmp",
       );
-      // With the flag off, the skill is treated as a normal skill_load
       expect(result.decision).toBe("allow");
-      expect(result.matchedRule!.pattern).toBe("skill_load:*");
     });
   });
 
@@ -396,27 +254,4 @@ describe("inline-command skill_load permissions", () => {
     });
   });
 
-  // ── Default rule priority ────────────────────────────────────────────
-
-  describe("default rule priority", () => {
-    test("skill_load_dynamic:* ask rule has higher priority than skill_load:* allow rule", async () => {
-      const { getDefaultRuleTemplates } =
-        await import("../permissions/defaults.js");
-      const rules = getDefaultRuleTemplates();
-
-      const dynamicRule = rules.find(
-        (r) => r.id === "default:ask-skill_load_dynamic-global",
-      );
-      const loadRule = rules.find(
-        (r) => r.id === "default:allow-skill_load-global",
-      );
-
-      expect(dynamicRule).toBeDefined();
-      expect(loadRule).toBeDefined();
-      expect(dynamicRule!.priority).toBeGreaterThan(loadRule!.priority);
-      expect(dynamicRule!.decision).toBe("ask");
-      expect(dynamicRule!.pattern).toBe("skill_load_dynamic:*");
-      expect(dynamicRule!.tool).toBe("skill_load");
-    });
-  });
 });

package/src/__tests__/install-skill-routing.test.ts

@@ -78,7 +78,7 @@ mock.module("../config/assistant-feature-flags.js", () => ({
   isAssistantFeatureFlagEnabled: () => true,
 }));
 mock.module("../config/loader.js", () => ({
-  getConfig: () => ({}),
+  getConfig: () => ({ memory: { v2: { enabled: false } } }),
   invalidateConfigCache: () => {},
   loadRawConfig: () => ({}),
   saveRawConfig: () => {},

package/src/__tests__/invite-redemption-service.test.ts

@@ -13,7 +13,8 @@ import {
   upsertContact,
 } from "../contacts/contact-store.js";
 import { upsertContactChannel } from "../contacts/contacts-write.js";
-import { getSqlite, initializeDb } from "../memory/db.js";
+import { getSqlite } from "../memory/db-connection.js";
+import { initializeDb } from "../memory/db-init.js";
 import {
   createInvite,
   revokeInvite as revokeStoreFn,

package/src/__tests__/invite-routes-http.test.ts

@@ -19,14 +19,10 @@ mock.module("../security/secure-keys.js", () => ({
 // control the return value directly via a mutable variable.
 let mockTelegramBotUsername: string | undefined;
 mock.module("../telegram/bot-username.js", () => ({
+  getTelegramBotId: () => undefined,
   getTelegramBotUsername: () => mockTelegramBotUsername,
 }));
 
-// Mock invite instruction generator — skip LLM calls in tests.
-mock.module("../runtime/invite-instruction-generator.js", () => ({
-  generateInviteInstruction: async () => "Mock invite instruction for testing.",
-}));
-
 // Mock startInviteCall from call-domain — test env lacks Twilio credentials.
 let mockStartInviteCallResult:
   | { ok: true; callSid: string }
@@ -39,14 +35,86 @@ mock.module("../calls/call-domain.js", () => ({
 }));
 
 import { upsertContact } from "../contacts/contact-store.js";
-import { getSqlite, initializeDb } from "../memory/db.js";
+import { getSqlite } from "../memory/db-connection.js";
+import { initializeDb } from "../memory/db-init.js";
 import {
-  handleCreateInvite,
-  handleListInvites,
-  handleRedeemInvite,
-  handleRevokeInvite,
-  handleTriggerInviteCall,
-} from "../runtime/routes/invite-routes.js";
+  handleCreateInvite as _handleCreateInvite,
+  handleListInvites as _handleListInvites,
+  handleRedeemInvite as _handleRedeemInvite,
+  handleRevokeInvite as _handleRevokeInvite,
+  handleTriggerInviteCall as _handleTriggerInviteCall,
+} from "../runtime/routes/contact-routes.js";
+import { RouteError } from "../runtime/routes/errors.js";
+
+/**
+ * Compatibility wrappers: translate old handler call signatures into the new
+ * RouteHandlerArgs pattern and wrap the result in a Response-like object so
+ * existing test assertions (res.status / res.json()) keep working.
+ */
+function fakeResponse(body: unknown, status = 200) {
+  return { status, json: async () => body };
+}
+
+async function handleCreateInvite(req: Request) {
+  const body = (await req.json()) as Record<string, unknown>;
+  try {
+    const result = await _handleCreateInvite({ body });
+    return fakeResponse(result, 201);
+  } catch (err) {
+    if (err instanceof RouteError)
+      return fakeResponse({ ok: false, error: err.message }, err.statusCode);
+    throw err;
+  }
+}
+
+function handleListInvites(url: URL) {
+  const queryParams: Record<string, string> = {};
+  for (const [k, v] of url.searchParams.entries()) queryParams[k] = v;
+  try {
+    const result = _handleListInvites({ queryParams });
+    return fakeResponse(result);
+  } catch (err) {
+    if (err instanceof RouteError)
+      return fakeResponse({ ok: false, error: err.message }, err.statusCode);
+    throw err;
+  }
+}
+
+function handleRevokeInvite(inviteId: string) {
+  try {
+    const result = _handleRevokeInvite({ pathParams: { id: inviteId } });
+    return fakeResponse(result);
+  } catch (err) {
+    if (err instanceof RouteError)
+      return fakeResponse({ ok: false, error: err.message }, err.statusCode);
+    throw err;
+  }
+}
+
+async function handleRedeemInvite(req: Request) {
+  const body = (await req.json()) as Record<string, unknown>;
+  try {
+    const result = await _handleRedeemInvite({ body });
+    return fakeResponse(result);
+  } catch (err) {
+    if (err instanceof RouteError)
+      return fakeResponse({ ok: false, error: err.message }, err.statusCode);
+    throw err;
+  }
+}
+
+async function handleTriggerInviteCall(inviteId: string) {
+  try {
+    const result = await _handleTriggerInviteCall({
+      pathParams: { id: inviteId },
+    });
+    return fakeResponse(result);
+  } catch (err) {
+    if (err instanceof RouteError)
+      return fakeResponse({ ok: false, error: err.message }, err.statusCode);
+    throw err;
+  }
+}
 
 initializeDb();
 

package/src/__tests__/jobs-store-qdrant-breaker.test.ts

@@ -13,7 +13,8 @@ mock.module("../config/loader.js", () => ({
   invalidateConfigCache: () => {},
 }));
 
-import { getDb, initializeDb } from "../memory/db.js";
+import { getDb } from "../memory/db-connection.js";
+import { initializeDb } from "../memory/db-init.js";
 import {
   claimMemoryJobs,
   enqueueMemoryJob,

package/src/__tests__/jobs-store-upsert-debounced.test.ts

@@ -15,7 +15,8 @@ mock.module("../config/loader.js", () => ({
 
 import { eq } from "drizzle-orm";
 
-import { getDb, initializeDb } from "../memory/db.js";
+import { getDb } from "../memory/db-connection.js";
+import { initializeDb } from "../memory/db-init.js";
 import {
   enqueueMemoryJob,
   upsertDebouncedJob,