@vellumai/assistant 0.6.6 → 0.7.1

package/src/__tests__/relay-server.test.ts

@@ -215,10 +215,7 @@ import {
 } from "../calls/relay-server.js";
 import { setVoiceBridgeDeps } from "../calls/voice-session-bridge.js";
 import { upsertContact } from "../contacts/contact-store.js";
-import {
-  createGuardianBinding,
-  upsertContactChannel,
-} from "../contacts/contacts-write.js";
+import { upsertContactChannel } from "../contacts/contacts-write.js";
 import {
   listCanonicalGuardianRequests,
   resolveCanonicalGuardianRequest,
@@ -228,14 +225,17 @@ import {
   createVerificationSession,
 } from "../memory/channel-verification-sessions.js";
 import { addMessage, getMessages } from "../memory/conversation-crud.js";
-import { getDb, initializeDb, resetDb, resetTestTables } from "../memory/db.js";
+import { getDb, resetDb } from "../memory/db-connection.js";
+import { initializeDb } from "../memory/db-init.js";
 import { createInvite } from "../memory/invite-store.js";
+import { resetTestTables } from "../memory/raw-query.js";
 import { conversations } from "../memory/schema.js";
 import {
   createOutboundSession,
   getGuardianBinding,
 } from "../runtime/channel-verification-service.js";
 import { generateVoiceCode, hashVoiceCode } from "../util/voice-code.js";
+import { createGuardianBinding } from "./helpers/create-guardian-binding.js";
 
 initializeDb();
 
@@ -379,6 +379,14 @@ function getLatestAssistantText(conversationId: string): string | null {
 describe("relay-server", () => {
   beforeEach(() => {
     resetTables();
+    // Seed the vellum guardian binding (gateway does this at startup in production)
+    createGuardianBinding({
+      channel: "vellum",
+      guardianExternalUserId: "test-principal-id",
+      guardianDeliveryChatId: "local",
+      guardianPrincipalId: "test-principal-id",
+      verifiedVia: "bootstrap",
+    });
     activeRelayConnections.clear();
     mockUserReference = "my human";
     mockAssistantName = "Vellum";
@@ -400,7 +408,6 @@ describe("relay-server", () => {
           memoryPolicy: {
             scopeId: "default",
             includeDefaultFallback: false,
-            strictSideEffects: false,
           },
           isProcessing: () => false,
           persistUserMessage: async (
@@ -482,7 +489,6 @@ describe("relay-server", () => {
         return session as unknown as import("../daemon/conversation.js").Conversation;
       },
       resolveAttachments: () => [],
-      deriveDefaultStrictSideEffects: () => false,
     });
   });
 
@@ -1411,9 +1417,11 @@ describe("relay-server", () => {
     expect(relay.isVerificationSessionActive()).toBe(false);
     expect(relay.getConnectionState()).toBe("connected");
 
-    // Guardian binding should have been created
+    // Guardian binding is NOT created by the assistant — the gateway owns
+    // binding creation for inbound voice verification. The assistant only
+    // transitions to connected state and starts the normal call flow.
     const binding = getGuardianBinding("self", "phone");
-    expect(binding).not.toBeNull();
+    expect(binding).toBeNull();
 
     // Orchestrator greeting should have fired
     const textMessages = ws.sentMessages
@@ -1482,9 +1490,9 @@ describe("relay-server", () => {
     expect(relay.isVerificationSessionActive()).toBe(false);
     expect(relay.getConnectionState()).toBe("connected");
 
-    // Binding created
+    // Binding is NOT created by the assistant — gateway owns this.
     const binding = getGuardianBinding("self", "phone");
-    expect(binding).not.toBeNull();
+    expect(binding).toBeNull();
 
     // Greeting should have started
     const textMessages = ws.sentMessages
@@ -1738,18 +1746,23 @@ describe("relay-server", () => {
 
     await new Promise((resolve) => setTimeout(resolve, 10));
 
+    // The gateway creates the guardian binding before the ConversationRelay
+    // WebSocket is established, so resolveActorTrust() would find it in
+    // production. Without a gateway in this test, trust reflects the
+    // resolved state without a binding.
     const postVerify = (
       relay.getController() as unknown as {
         trustContext?: {
           sourceChannel?: string;
           trustClass?: string;
-          guardianExternalUserId?: string;
         };
       }
     )?.trustContext;
     expect(postVerify?.sourceChannel).toBe("phone");
-    expect(postVerify?.trustClass).toBe("guardian");
-    expect(postVerify?.guardianExternalUserId).toBe(session.fromNumber);
+    // Trust class is 'unknown' because the gateway creates the binding
+    // before the relay is established. Without a gateway in this test,
+    // resolveActorTrust finds no guardian binding.
+    expect(postVerify?.trustClass).toBe("unknown");
 
     relay.destroy();
   });
@@ -2282,6 +2295,10 @@ describe("relay-server", () => {
   test("inbound voice: unknown caller name capture uses fallback when assistant name is unavailable", async () => {
     const prevName = mockAssistantName;
     mockAssistantName = null;
+    // Clear guardian binding so resolveGuardianLabel falls back to DEFAULT_USER_REFERENCE
+    const db = getDb();
+    db.run("DELETE FROM contact_channels");
+    db.run("DELETE FROM contacts");
     try {
       ensureConversation("conv-invite-no-name");
       const session = createCallSession({
@@ -4022,9 +4039,9 @@ describe("relay-server", () => {
     expect(relay.isVerificationSessionActive()).toBe(false);
     expect(relay.getConnectionState()).toBe("connected");
 
-    // Guardian binding should have been created
+    // Guardian binding is NOT created by the assistant — gateway owns this.
     const binding = getGuardianBinding("self", "phone");
-    expect(binding).not.toBeNull();
+    expect(binding).toBeNull();
 
     // Normal greeting should fire (from mockSendMessage), not the handoff copy
     const textMessages = ws.sentMessages
@@ -4256,7 +4273,10 @@ describe("relay-server", () => {
   test("guardian label: DEFAULT_USER_REFERENCE used when both guardian persona name and Contact.displayName are empty", async () => {
     mockUserReference = "my human";
 
-    // No guardian binding — no Contact.displayName available
+    // Clear guardian binding so resolveGuardianLabel falls back to DEFAULT_USER_REFERENCE
+    const db = getDb();
+    db.run("DELETE FROM contact_channels");
+    db.run("DELETE FROM contacts");
 
     ensureConversation("conv-label-default");
     const session = createCallSession({

package/src/__tests__/require-fresh-approval.test.ts

@@ -2,12 +2,11 @@
  * Tests for the requireFreshApproval context flag.
  *
  * Verifies that manage_secure_command_tool cannot bypass the interactive
- * approval prompt through any of the four shortcut paths:
+ * approval prompt through any of the following shortcut paths:
  *
- * 1. Temporary override (allow_10m / allow_conversation) auto-approve
- * 2. Persistent decisions ("Always Allow" rule creation)
- * 3. Grant-consumed short-circuit (pre-existing scoped grant)
- * 4. Non-interactive guardian auto-approve
+ * 1. Persistent decisions ("Always Allow" rule creation)
+ * 2. Grant-consumed short-circuit (pre-existing scoped grant)
+ * 3. Non-interactive guardian auto-approve
  */
 
 import {
@@ -55,11 +54,6 @@ const mockConfig = {
   rateLimit: { maxRequestsPerMinute: 0 },
   secretDetection: {
     enabled: false,
-    action: "warn" as const,
-    entropyThreshold: 4.0,
-  },
-  permissions: {
-    mode: "workspace" as const,
   },
 };
 
@@ -104,6 +98,7 @@ mock.module("../permissions/checker.js", () => ({
   ],
   generateScopeOptions: () =>
     scopeOptionsOverride ?? [{ label: "/tmp", scope: "/tmp" }],
+  getCachedAssessment: () => undefined,
 }));
 
 mock.module("../memory/tool-usage-store.js", () => ({
@@ -129,21 +124,17 @@ mock.module("../tools/registry.js", () => ({
   getAllTools: () => [],
 }));
 
+mock.module("../permissions/gateway-threshold-reader.js", () => ({
+  getAutoApproveThreshold: async () => "medium",
+  _clearGlobalCacheForTesting: () => {},
+}));
+
 mock.module("../tools/shared/filesystem/path-policy.js", () => ({
   sandboxPolicy: () => ({ ok: false }),
   hostPolicy: () => ({ ok: false }),
 }));
 
-mock.module("../tools/terminal/sandbox.js", () => ({
-  wrapCommand: () => ({ command: "", sandboxed: false }),
-}));
-
 import { PermissionPrompter } from "../permissions/prompter.js";
-import {
-  clearAll as clearAllOverrides,
-  setConversationMode,
-  setTimedMode,
-} from "../runtime/conversation-approval-overrides.js";
 import { ToolExecutor } from "../tools/executor.js";
 import type { ToolContext as TC } from "../tools/types.js";
 
@@ -180,12 +171,9 @@ describe("requireFreshApproval: non-interactive guardian denial", () => {
     checkResultOverride = undefined;
     scopeOptionsOverride = undefined;
     riskOverride = "high";
-    clearAllOverrides();
   });
 
-  afterEach(() => {
-    clearAllOverrides();
-  });
+  afterEach(() => {});
 
   test("manage_secure_command_tool is denied in non-interactive guardian sessions", async () => {
     // check() returns "prompt" (which normally triggers guardian auto-approve
@@ -237,7 +225,11 @@ describe("requireFreshApproval: non-interactive guardian denial", () => {
     const result = await executor.execute(
       "bash",
       { command: "echo hello" },
-      makeContext({ isInteractive: false, trustClass: "guardian" }),
+      makeContext({
+        isInteractive: false,
+        trustClass: "guardian",
+        requireFreshApproval: true,
+      }),
     );
 
     expect(result.isError).toBe(true);
@@ -289,7 +281,11 @@ describe("requireFreshApproval: non-interactive guardian denial", () => {
     const result = await executor.execute(
       "gmail_send_draft",
       { draft_id: "draft-123", confidence: 0.99 },
-      makeContext({ isInteractive: false, trustClass: "guardian" }),
+      makeContext({
+        isInteractive: false,
+        trustClass: "guardian",
+        requireFreshApproval: true,
+      }),
     );
 
     expect(result.isError).toBe(true);
@@ -314,116 +310,6 @@ describe("requireFreshApproval: non-interactive guardian denial", () => {
   });
 });
 
-// ---------------------------------------------------------------------------
-// Bypass 1: Temporary override auto-approve
-// ---------------------------------------------------------------------------
-
-describe("requireFreshApproval: temporary override bypass", () => {
-  beforeEach(() => {
-    fakeToolResult = { content: "ok", isError: false };
-    checkResultOverride = undefined;
-    scopeOptionsOverride = undefined;
-    riskOverride = "high";
-    clearAllOverrides();
-  });
-
-  afterEach(() => {
-    clearAllOverrides();
-  });
-
-  test("manage_secure_command_tool is not auto-approved by conversation-scoped override", async () => {
-    // Activate a conversation-scoped temporary override
-    setConversationMode("conversation-1");
-
-    // check() returns allow, which forcePromptSideEffects promotes to prompt.
-    // The temporary override would normally auto-approve, but
-    // requireFreshApproval should block that.
-    checkResultOverride = { decision: "allow", reason: "Matched trust rule" };
-
-    let promptCalled = false;
-    const trackingPrompter = {
-      prompt: async () => {
-        promptCalled = true;
-        return { decision: "allow" as const };
-      },
-      resolveConfirmation: () => {},
-      updateSender: () => {},
-      dispose: () => {},
-    } as unknown as PermissionPrompter;
-
-    const executor = new ToolExecutor(trackingPrompter);
-    const result = await executor.execute(
-      "manage_secure_command_tool",
-      { action: "register", toolName: "test-tool" },
-      makeContext({ trustClass: "guardian" }),
-    );
-
-    // The tool must have been prompted (not auto-approved via override)
-    expect(promptCalled).toBe(true);
-    expect(result.isError).toBe(false);
-  });
-
-  test("manage_secure_command_tool is not auto-approved by timed (10m) override", async () => {
-    // Activate a 10-minute temporary override
-    setTimedMode("conversation-1");
-
-    checkResultOverride = { decision: "allow", reason: "Matched trust rule" };
-
-    let promptCalled = false;
-    const trackingPrompter = {
-      prompt: async () => {
-        promptCalled = true;
-        return { decision: "allow" as const };
-      },
-      resolveConfirmation: () => {},
-      updateSender: () => {},
-      dispose: () => {},
-    } as unknown as PermissionPrompter;
-
-    const executor = new ToolExecutor(trackingPrompter);
-    const result = await executor.execute(
-      "manage_secure_command_tool",
-      { action: "register", toolName: "test-tool" },
-      makeContext({ trustClass: "guardian" }),
-    );
-
-    // Must prompt — temporary override must not bypass requireFreshApproval
-    expect(promptCalled).toBe(true);
-    expect(result.isError).toBe(false);
-  });
-
-  test("regular tools ARE auto-approved by temporary override", async () => {
-    // Verify normal tools still get the auto-approve shortcut
-    setConversationMode("conversation-1");
-    checkResultOverride = {
-      decision: "prompt",
-      reason: "Needs approval",
-    };
-
-    let promptCalled = false;
-    const trackingPrompter = {
-      prompt: async () => {
-        promptCalled = true;
-        return { decision: "allow" as const };
-      },
-      resolveConfirmation: () => {},
-      updateSender: () => {},
-      dispose: () => {},
-    } as unknown as PermissionPrompter;
-
-    const executor = new ToolExecutor(trackingPrompter);
-    const result = await executor.execute(
-      "bash",
-      { command: "echo hello" },
-      makeContext({ trustClass: "guardian" }),
-    );
-
-    // Regular tool should be auto-approved without prompting
-    expect(promptCalled).toBe(false);
-    expect(result.isError).toBe(false);
-  });
-});
-
 // ---------------------------------------------------------------------------
 // Bypass 2: Persistent decisions (Always Allow)
 // ---------------------------------------------------------------------------
@@ -434,12 +320,9 @@ describe("requireFreshApproval: persistent decisions disabled", () => {
     checkResultOverride = undefined;
     scopeOptionsOverride = undefined;
     riskOverride = "high";
-    clearAllOverrides();
   });
 
-  afterEach(() => {
-    clearAllOverrides();
-  });
+  afterEach(() => {});
 
   test("manage_secure_command_tool prompt does not offer persistent decisions", async () => {
     checkResultOverride = { decision: "allow", reason: "Matched trust rule" };
@@ -488,41 +371,6 @@ describe("requireFreshApproval: persistent decisions disabled", () => {
     expect(promptEvent).toBeDefined();
     expect(promptEvent!.persistentDecisionsAllowed).toBe(false);
   });
-
-  test("regular tools still offer persistent decisions", async () => {
-    checkResultOverride = {
-      decision: "prompt",
-      reason: "Needs approval",
-    };
-
-    let persistentDecisionsPassedToPrompter: boolean | undefined;
-
-    const inspectingPrompter = {
-      prompt: async (
-        _toolName: string,
-        _input: Record<string, unknown>,
-        _riskLevel: string,
-        _allowlistOptions: unknown[],
-        _scopeOptions: unknown[],
-        _previewDiff: unknown,
-        _conversationId: string,
-        _executionTarget: string,
-        persistentDecisionsAllowed: boolean,
-      ) => {
-        persistentDecisionsPassedToPrompter = persistentDecisionsAllowed;
-        return { decision: "allow" as const };
-      },
-      resolveConfirmation: () => {},
-      updateSender: () => {},
-      dispose: () => {},
-    } as unknown as PermissionPrompter;
-
-    const executor = new ToolExecutor(inspectingPrompter);
-    await executor.execute("bash", { command: "echo hello" }, makeContext());
-
-    // Regular tools should have persistentDecisions allowed
-    expect(persistentDecisionsPassedToPrompter).toBe(true);
-  });
 });
 
 // ---------------------------------------------------------------------------
@@ -535,12 +383,9 @@ describe("requireFreshApproval: grant-consumed does not skip permission check",
     checkResultOverride = undefined;
     scopeOptionsOverride = undefined;
     riskOverride = "high";
-    clearAllOverrides();
   });
 
-  afterEach(() => {
-    clearAllOverrides();
-  });
+  afterEach(() => {});
 
   test("manage_secure_command_tool is prompted even when executor sets requireFreshApproval and grantConsumed would normally short-circuit", async () => {
     // This test verifies the code path in executor.ts where the
@@ -590,12 +435,9 @@ describe("requireFreshApproval: context flag propagation", () => {
     checkResultOverride = undefined;
     scopeOptionsOverride = undefined;
     riskOverride = "high";
-    clearAllOverrides();
   });
 
-  afterEach(() => {
-    clearAllOverrides();
-  });
+  afterEach(() => {});
 
   test("manage_secure_command_tool sets both forcePromptSideEffects and requireFreshApproval", async () => {
     checkResultOverride = { decision: "allow", reason: "Matched trust rule" };

package/src/__tests__/resolve-trust-class.test.ts

@@ -1,6 +1,6 @@
 import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
 
-import type { TrustContext } from "../daemon/conversation-runtime-assembly.js";
+
 
 // ── Module mocks ─────────────────────────────────────────────────────
 
@@ -14,6 +14,7 @@ mock.module("../config/env.js", () => ({
 // ── Real imports (after mocks) ───────────────────────────────────────
 
 import { resolveTrustClass } from "../daemon/conversation-tool-setup.js";
+import type { TrustContext } from "../daemon/trust-context.js";
 
 afterAll(() => {
   mock.restore();

package/src/__tests__/retry-thinking-tool-choice.test.ts

@@ -161,13 +161,25 @@ describe("retry normalization: thinking + forced tool_choice", () => {
         tool_choice: { type: "tool", name: "select_memories" },
       },
     });
-    // thinking: { type: "disabled" } should be stripped because the strip
-    // logic doesn't distinguish disabled from adaptive — the Anthropic API
-    // actually accepts disabled + forced tool_choice, but since thinking is
-    // explicitly set by the caller, the callSite resolution path doesn't
-    // overwrite it. The strip is harmless: Anthropic treats absent thinking
-    // the same as disabled.
-    expect(lastConfig()?.thinking).toBeUndefined();
+    expect(lastConfig()?.thinking).toEqual({ type: "disabled" });
+  });
+
+  test("preserves resolved thinking: disabled with forced tool_choice", async () => {
+    setLlmConfig({
+      default: {
+        provider: "anthropic",
+        model: "claude-opus-4-7",
+        thinking: { enabled: false },
+      },
+    });
+    const { provider, lastConfig } = makePipeline("anthropic");
+    await provider.sendMessage([userMessage], undefined, undefined, {
+      config: {
+        callSite: "memoryExtraction",
+        tool_choice: { type: "tool", name: "extract_graph_diff" },
+      },
+    });
+    expect(lastConfig()?.thinking).toEqual({ type: "disabled" });
   });
 
   test("strips thinking for openrouter with anthropic model and forced tool_choice", async () => {

package/src/__tests__/retry-verbosity-normalization.test.ts

@@ -0,0 +1,139 @@
+/**
+ * Verifies that `RetryProvider.normalizeSendMessageOptions` plumbs
+ * `verbosity` only to providers that consume it (OpenAI) and strips it for
+ * every other provider — so strict-schema clients (Anthropic, …) never see
+ * the unknown field on the wire.
+ */
+
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, { get: () => () => {} }),
+}));
+
+let mockLlmConfig: Record<string, unknown> = {};
+
+mock.module("../config/loader.js", () => ({
+  getConfig: () => ({ llm: mockLlmConfig }),
+}));
+
+import { LLMSchema } from "../config/schemas/llm.js";
+import { RetryProvider } from "../providers/retry.js";
+import type {
+  Message,
+  Provider,
+  ProviderResponse,
+  SendMessageOptions,
+  ToolDefinition,
+} from "../providers/types.js";
+
+function setLlmConfig(raw: unknown): void {
+  mockLlmConfig = LLMSchema.parse(raw) as Record<string, unknown>;
+}
+
+beforeEach(() => {
+  mockLlmConfig = LLMSchema.parse({}) as Record<string, unknown>;
+});
+
+function makePipeline(providerName: string): {
+  provider: Provider;
+  lastConfig: () => Record<string, unknown> | undefined;
+} {
+  let captured: Record<string, unknown> | undefined;
+  const inner: Provider = {
+    name: providerName,
+    async sendMessage(
+      _messages: Message[],
+      _tools?: ToolDefinition[],
+      _systemPrompt?: string,
+      options?: SendMessageOptions,
+    ): Promise<ProviderResponse> {
+      captured = options?.config as Record<string, unknown> | undefined;
+      return {
+        content: [],
+        model: "test",
+        usage: { inputTokens: 0, outputTokens: 0 },
+        stopReason: "stop",
+      };
+    },
+  };
+  return {
+    provider: new RetryProvider(inner),
+    lastConfig: () => captured,
+  };
+}
+
+const userMessage: Message = {
+  role: "user",
+  content: [{ type: "text", text: "hi" }],
+};
+
+describe("retry normalization for verbosity", () => {
+  test("forwards verbosity on the outbound config for openai", async () => {
+    setLlmConfig({
+      default: {
+        provider: "openai",
+        model: "gpt-5.5",
+        verbosity: "high",
+      },
+    });
+    const { provider, lastConfig } = makePipeline("openai");
+    await provider.sendMessage([userMessage], undefined, undefined, {
+      config: { callSite: "mainAgent" },
+    });
+    expect(lastConfig()?.verbosity).toBe("high");
+  });
+
+  test("strips verbosity from config for anthropic provider", async () => {
+    const { provider, lastConfig } = makePipeline("anthropic");
+    await provider.sendMessage([userMessage], undefined, undefined, {
+      config: { verbosity: "low" },
+    });
+    expect(lastConfig()?.verbosity).toBe(undefined);
+  });
+
+  test("strips verbosity from config for openrouter provider", async () => {
+    const { provider, lastConfig } = makePipeline("openrouter");
+    await provider.sendMessage([userMessage], undefined, undefined, {
+      config: { verbosity: "low" },
+    });
+    expect(lastConfig()?.verbosity).toBe(undefined);
+  });
+
+  test("call-site override replaces default verbosity", async () => {
+    setLlmConfig({
+      default: {
+        provider: "openai",
+        model: "gpt-5.5",
+        verbosity: "low",
+      },
+      callSites: {
+        mainAgent: { verbosity: "high" },
+      },
+    });
+    const { provider, lastConfig } = makePipeline("openai");
+    await provider.sendMessage([userMessage], undefined, undefined, {
+      config: { callSite: "mainAgent" },
+    });
+    expect(lastConfig()?.verbosity).toBe("high");
+  });
+
+  test("per-call explicit verbosity overrides resolved call-site value", async () => {
+    setLlmConfig({
+      default: {
+        provider: "openai",
+        model: "gpt-5.5",
+        verbosity: "low",
+      },
+      callSites: {
+        mainAgent: { verbosity: "medium" },
+      },
+    });
+    const { provider, lastConfig } = makePipeline("openai");
+    await provider.sendMessage([userMessage], undefined, undefined, {
+      config: { callSite: "mainAgent", verbosity: "high" },
+    });
+    expect(lastConfig()?.verbosity).toBe("high");
+  });
+});