@vellumai/assistant 0.7.0 → 0.7.1

package/src/__tests__/managed-profile-guard.test.ts

@@ -0,0 +1,225 @@
+/**
+ * Tests that managed inference profiles ("quality-optimized", "balanced",
+ * "cost-optimized") cannot be edited via the PUT profile route or deleted
+ * via the PATCH config route.
+ */
+
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+import { makeMockLogger } from "./helpers/mock-logger.js";
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () => makeMockLogger(),
+}));
+
+let savedRaw: Record<string, unknown> | null = null;
+let rawConfig: Record<string, unknown>;
+
+function makeDefaultRawConfig(): Record<string, unknown> {
+  return {
+    llm: {
+      profiles: {
+        "quality-optimized": {
+          provider: "anthropic",
+          model: "claude-sonnet",
+        },
+        balanced: { provider: "anthropic", model: "claude-sonnet" },
+        "cost-optimized": { provider: "anthropic", model: "claude-haiku" },
+        "my-custom": { provider: "openai", model: "gpt-4o" },
+      },
+    },
+  };
+}
+
+function deepMergeForTest(
+  target: Record<string, unknown>,
+  overrides: Record<string, unknown>,
+): void {
+  for (const [key, value] of Object.entries(overrides)) {
+    if (
+      value !== null &&
+      typeof value === "object" &&
+      !Array.isArray(value) &&
+      target[key] !== null &&
+      typeof target[key] === "object" &&
+      !Array.isArray(target[key])
+    ) {
+      deepMergeForTest(
+        target[key] as Record<string, unknown>,
+        value as Record<string, unknown>,
+      );
+      continue;
+    }
+    target[key] = value;
+  }
+}
+
+mock.module("../config/loader.js", () => ({
+  loadRawConfig: () => structuredClone(rawConfig),
+  saveRawConfig: (raw: Record<string, unknown>) => {
+    savedRaw = raw;
+  },
+  deepMergeOverwrite: (
+    target: Record<string, unknown>,
+    overrides: Record<string, unknown>,
+  ) => {
+    deepMergeForTest(target, overrides);
+  },
+  getConfig: () => rawConfig,
+  invalidateConfigCache: () => {},
+}));
+
+mock.module("../providers/registry.js", () => ({
+  initializeProviders: async () => {},
+}));
+
+mock.module("../memory/embedding-backend.js", () => ({
+  clearEmbeddingBackendCache: () => {},
+}));
+
+import { ROUTES } from "../runtime/routes/conversation-query-routes.js";
+import { BadRequestError } from "../runtime/routes/errors.js";
+
+const replaceRoute = ROUTES.find(
+  (r) => r.operationId === "config_llm_profiles_replace",
+)!;
+
+const patchRoute = ROUTES.find((r) => r.operationId === "config_patch")!;
+
+beforeEach(() => {
+  rawConfig = makeDefaultRawConfig();
+  savedRaw = null;
+});
+
+// ---------------------------------------------------------------------------
+// PUT /v1/config/llm/profiles/:name — replace inference profile
+// ---------------------------------------------------------------------------
+
+describe("PUT /v1/config/llm/profiles/:name — managed profile guard", () => {
+  test("rejects edits to quality-optimized with descriptive message", () => {
+    expect(() =>
+      replaceRoute.handler({
+        pathParams: { name: "quality-optimized" },
+        body: { provider: "openai", model: "gpt-4o" },
+      }),
+    ).toThrow(
+      'Cannot edit managed profile "quality-optimized". Duplicate it to create a custom profile.',
+    );
+  });
+
+  test("rejects edits to balanced", () => {
+    expect(() =>
+      replaceRoute.handler({
+        pathParams: { name: "balanced" },
+        body: { provider: "openai", model: "gpt-4o" },
+      }),
+    ).toThrow(BadRequestError);
+  });
+
+  test("rejects edits to cost-optimized", () => {
+    expect(() =>
+      replaceRoute.handler({
+        pathParams: { name: "cost-optimized" },
+        body: { provider: "openai", model: "gpt-4o" },
+      }),
+    ).toThrow(BadRequestError);
+  });
+
+  test("allows edits to a user-defined profile", () => {
+    savedRaw = null;
+    const result = replaceRoute.handler({
+      pathParams: { name: "my-custom" },
+      body: { provider: "openai", model: "gpt-4o" },
+    });
+    expect(result).toEqual({ ok: true });
+    expect(savedRaw).not.toBeNull();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// PATCH /v1/config — managed profile deletion guard
+// ---------------------------------------------------------------------------
+
+describe("PATCH /v1/config — managed profile deletion guard", () => {
+  test("rejects deletion of quality-optimized via null with descriptive message", async () => {
+    await expect(
+      patchRoute.handler({
+        body: { llm: { profiles: { "quality-optimized": null } } },
+      }),
+    ).rejects.toThrow('Cannot delete managed profile "quality-optimized".');
+  });
+
+  test("rejects deletion of balanced via null", async () => {
+    await expect(
+      patchRoute.handler({
+        body: { llm: { profiles: { balanced: null } } },
+      }),
+    ).rejects.toThrow(BadRequestError);
+  });
+
+  test("rejects deletion of cost-optimized via null", async () => {
+    await expect(
+      patchRoute.handler({
+        body: { llm: { profiles: { "cost-optimized": null } } },
+      }),
+    ).rejects.toThrow(BadRequestError);
+  });
+
+  test("allows deletion of a user-defined profile via null", async () => {
+    savedRaw = null;
+    const result = await patchRoute.handler({
+      body: { llm: { profiles: { "my-custom": null } } },
+    });
+    expect(result).toEqual({ ok: true });
+  });
+
+  test("allows non-profile config patches", async () => {
+    const result = await patchRoute.handler({
+      body: { someOtherKey: "value" },
+    });
+    expect(result).toEqual({ ok: true });
+  });
+
+  test("clears stale Velay ownership when manually patching public base URL", async () => {
+    rawConfig = {
+      ingress: {
+        publicBaseUrl: "https://stale-velay.example.test",
+        publicBaseUrlManagedBy: "velay",
+      },
+    };
+
+    const result = await patchRoute.handler({
+      body: {
+        ingress: { publicBaseUrl: "https://manual.example.test" },
+      },
+    });
+
+    expect(result).toEqual({ ok: true });
+    expect(savedRaw).toEqual({
+      ingress: {
+        publicBaseUrl: "https://manual.example.test",
+        publicBaseUrlManagedBy: "velay",
+      },
+    });
+  });
+
+  test("allows patches that modify a managed profile (non-null)", async () => {
+    savedRaw = null;
+    const result = await patchRoute.handler({
+      body: {
+        llm: {
+          profiles: { "quality-optimized": { provider: "anthropic" } },
+        },
+      },
+    });
+    expect(result).toEqual({ ok: true });
+  });
+
+  test("rejects nulling the entire profiles map", async () => {
+    await expect(
+      patchRoute.handler({
+        body: { llm: { profiles: null } },
+      }),
+    ).rejects.toThrow("Cannot null llm.profiles");
+  });
+});

package/src/__tests__/managed-skill-lifecycle.test.ts

@@ -17,8 +17,6 @@ const mockConfig = {
   rateLimit: { maxRequestsPerMinute: 0 },
   secretDetection: {
     enabled: true,
-    action: "warn" as const,
-    entropyThreshold: 4.0,
   },
   auditLog: { retentionDays: 0 },
   services: {
@@ -54,14 +52,6 @@ mock.module("../config/loader.js", () => ({
   setNestedValue: () => {},
 }));
 
-mock.module("../tools/terminal/sandbox.js", () => ({
-  wrapCommand: (command: string, _workingDir: string, _config: unknown) => ({
-    command: "bash",
-    args: ["-c", "--", command],
-    sandboxed: false,
-  }),
-}));
-
 import { loadSkillCatalog } from "../config/skills.js";
 import { executeDeleteManagedSkill } from "../tools/skills/delete-managed.js";
 import { SkillLoadTool } from "../tools/skills/load.js";

package/src/__tests__/manual-token-reconciliation.test.ts

@@ -0,0 +1,334 @@
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+import type { SecureKeyResult } from "../security/secure-keys.js";
+
+// ---------------------------------------------------------------------------
+// Mock state
+// ---------------------------------------------------------------------------
+
+let secureKeyResults: Record<string, SecureKeyResult> = {};
+let connectionStore: Record<
+  string,
+  { id: string; provider: string; accountInfo?: string | null }
+> = {};
+let deletedConnectionIds: string[] = [];
+let createdConnections: Array<{ provider: string; accountInfo?: string }> = [];
+const warnings: string[] = [];
+
+// ---------------------------------------------------------------------------
+// Module mocks — must be registered before importing the module under test
+// ---------------------------------------------------------------------------
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () => ({
+    warn: (msg: string) => warnings.push(msg),
+    info: () => {},
+    error: () => {},
+    debug: () => {},
+  }),
+}));
+
+mock.module("../security/secure-keys.js", () => ({
+  getSecureKeyResultAsync: async (account: string): Promise<SecureKeyResult> =>
+    secureKeyResults[account] ?? { value: undefined, unreachable: false },
+  // Keep getSecureKeyAsync available for any transitive imports
+  getSecureKeyAsync: async (account: string): Promise<string | undefined> => {
+    const result = secureKeyResults[account] ?? {
+      value: undefined,
+      unreachable: false,
+    };
+    return result.value;
+  },
+}));
+
+mock.module("../oauth/oauth-store.js", () => ({
+  getConnectionByProvider: (provider: string) =>
+    connectionStore[provider] ?? undefined,
+  deleteConnection: (id: string) => {
+    deletedConnectionIds.push(id);
+    // Remove from store
+    for (const [key, val] of Object.entries(connectionStore)) {
+      if (val.id === id) {
+        delete connectionStore[key];
+        break;
+      }
+    }
+  },
+  createConnection: (params: {
+    oauthAppId: string;
+    provider: string;
+    accountInfo?: string;
+    grantedScopes: string[];
+    hasRefreshToken: boolean;
+  }) => {
+    createdConnections.push({
+      provider: params.provider,
+      accountInfo: params.accountInfo,
+    });
+    connectionStore[params.provider] = {
+      id: `conn-${params.provider}`,
+      provider: params.provider,
+      accountInfo: params.accountInfo ?? null,
+    };
+    return { id: `conn-${params.provider}` };
+  },
+  updateConnection: () => {},
+  upsertApp: async (_provider: string, _clientId: string) => ({
+    id: "app-1",
+  }),
+}));
+
+// ---------------------------------------------------------------------------
+// Import module under test (after mocks are registered)
+// ---------------------------------------------------------------------------
+
+const { backfillManualTokenConnections, syncManualTokenConnection } =
+  await import("../oauth/manual-token-connection.js");
+import { credentialKey } from "../security/credential-key.js";
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function setCredentialResult(
+  service: string,
+  field: string,
+  result: SecureKeyResult,
+): void {
+  secureKeyResults[credentialKey(service, field)] = result;
+}
+
+function seedConnection(
+  provider: string,
+  opts?: { accountInfo?: string },
+): void {
+  connectionStore[provider] = {
+    id: `conn-${provider}`,
+    provider,
+    accountInfo: opts?.accountInfo ?? null,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("syncManualTokenConnection", () => {
+  beforeEach(() => {
+    secureKeyResults = {};
+    connectionStore = {};
+    deletedConnectionIds = [];
+    createdConnections = [];
+    warnings.length = 0;
+  });
+
+  // ---- Slack: reachable backend, missing tokens -> removes row ----
+
+  test("removes slack_channel connection when bot token is missing and backend is reachable", async () => {
+    seedConnection("slack_channel");
+    setCredentialResult("slack_channel", "bot_token", {
+      value: undefined,
+      unreachable: false,
+    });
+    setCredentialResult("slack_channel", "app_token", {
+      value: "xapp-valid",
+      unreachable: false,
+    });
+
+    await syncManualTokenConnection("slack_channel");
+
+    expect(deletedConnectionIds).toContain("conn-slack_channel");
+    expect(connectionStore["slack_channel"]).toBeUndefined();
+  });
+
+  test("removes slack_channel connection when app token is missing and backend is reachable", async () => {
+    seedConnection("slack_channel");
+    setCredentialResult("slack_channel", "bot_token", {
+      value: "xoxb-valid",
+      unreachable: false,
+    });
+    setCredentialResult("slack_channel", "app_token", {
+      value: undefined,
+      unreachable: false,
+    });
+
+    await syncManualTokenConnection("slack_channel");
+
+    expect(deletedConnectionIds).toContain("conn-slack_channel");
+    expect(connectionStore["slack_channel"]).toBeUndefined();
+  });
+
+  // ---- Telegram: reachable backend, missing tokens -> removes row ----
+
+  test("removes telegram connection when bot token is missing and backend is reachable", async () => {
+    seedConnection("telegram");
+    setCredentialResult("telegram", "bot_token", {
+      value: undefined,
+      unreachable: false,
+    });
+    setCredentialResult("telegram", "webhook_secret", {
+      value: "secret-valid",
+      unreachable: false,
+    });
+
+    await syncManualTokenConnection("telegram");
+
+    expect(deletedConnectionIds).toContain("conn-telegram");
+    expect(connectionStore["telegram"]).toBeUndefined();
+  });
+
+  test("removes telegram connection when webhook secret is missing and backend is reachable", async () => {
+    seedConnection("telegram");
+    setCredentialResult("telegram", "bot_token", {
+      value: "bot-token-valid",
+      unreachable: false,
+    });
+    setCredentialResult("telegram", "webhook_secret", {
+      value: undefined,
+      unreachable: false,
+    });
+
+    await syncManualTokenConnection("telegram");
+
+    expect(deletedConnectionIds).toContain("conn-telegram");
+    expect(connectionStore["telegram"]).toBeUndefined();
+  });
+
+  // ---- Unreachable backend -> leaves rows untouched ----
+
+  test("leaves slack_channel connection untouched when backend is unreachable", async () => {
+    seedConnection("slack_channel");
+    setCredentialResult("slack_channel", "bot_token", {
+      value: undefined,
+      unreachable: true,
+    });
+    setCredentialResult("slack_channel", "app_token", {
+      value: undefined,
+      unreachable: true,
+    });
+
+    await syncManualTokenConnection("slack_channel");
+
+    expect(deletedConnectionIds).toEqual([]);
+    expect(createdConnections).toEqual([]);
+    expect(connectionStore["slack_channel"]).toBeDefined();
+    expect(warnings.length).toBeGreaterThan(0);
+    expect(warnings[0]).toContain("slack_channel");
+    expect(warnings[0]).toContain("unreachable");
+  });
+
+  test("leaves telegram connection untouched when backend is unreachable", async () => {
+    seedConnection("telegram");
+    setCredentialResult("telegram", "bot_token", {
+      value: undefined,
+      unreachable: true,
+    });
+    setCredentialResult("telegram", "webhook_secret", {
+      value: undefined,
+      unreachable: true,
+    });
+
+    await syncManualTokenConnection("telegram");
+
+    expect(deletedConnectionIds).toEqual([]);
+    expect(createdConnections).toEqual([]);
+    expect(connectionStore["telegram"]).toBeDefined();
+    expect(warnings.length).toBeGreaterThan(0);
+    expect(warnings[0]).toContain("telegram");
+    expect(warnings[0]).toContain("unreachable");
+  });
+
+  test("leaves slack_channel connection untouched when only one credential read is unreachable", async () => {
+    seedConnection("slack_channel");
+    // bot_token is readable but app_token backend is unreachable
+    setCredentialResult("slack_channel", "bot_token", {
+      value: "xoxb-valid",
+      unreachable: false,
+    });
+    setCredentialResult("slack_channel", "app_token", {
+      value: undefined,
+      unreachable: true,
+    });
+
+    await syncManualTokenConnection("slack_channel");
+
+    expect(deletedConnectionIds).toEqual([]);
+    expect(connectionStore["slack_channel"]).toBeDefined();
+  });
+
+  // ---- Reachable backend, all tokens present -> ensures connection ----
+
+  test("creates slack_channel connection when all tokens are present", async () => {
+    setCredentialResult("slack_channel", "bot_token", {
+      value: "xoxb-valid",
+      unreachable: false,
+    });
+    setCredentialResult("slack_channel", "app_token", {
+      value: "xapp-valid",
+      unreachable: false,
+    });
+
+    await syncManualTokenConnection("slack_channel");
+
+    expect(createdConnections).toEqual([
+      { provider: "slack_channel", accountInfo: undefined },
+    ]);
+  });
+
+  test("creates telegram connection when all tokens are present", async () => {
+    setCredentialResult("telegram", "bot_token", {
+      value: "bot-token",
+      unreachable: false,
+    });
+    setCredentialResult("telegram", "webhook_secret", {
+      value: "webhook-secret",
+      unreachable: false,
+    });
+
+    await syncManualTokenConnection("telegram");
+
+    expect(createdConnections).toEqual([
+      { provider: "telegram", accountInfo: undefined },
+    ]);
+  });
+});
+
+describe("backfillManualTokenConnections", () => {
+  beforeEach(() => {
+    secureKeyResults = {};
+    connectionStore = {};
+    deletedConnectionIds = [];
+    createdConnections = [];
+    warnings.length = 0;
+  });
+
+  test("propagates non-destructive behavior — unreachable backend leaves all rows untouched", async () => {
+    seedConnection("telegram");
+    seedConnection("slack_channel");
+
+    // All credential reads return unreachable
+    setCredentialResult("telegram", "bot_token", {
+      value: undefined,
+      unreachable: true,
+    });
+    setCredentialResult("telegram", "webhook_secret", {
+      value: undefined,
+      unreachable: true,
+    });
+    setCredentialResult("slack_channel", "bot_token", {
+      value: undefined,
+      unreachable: true,
+    });
+    setCredentialResult("slack_channel", "app_token", {
+      value: undefined,
+      unreachable: true,
+    });
+
+    await backfillManualTokenConnections();
+
+    expect(deletedConnectionIds).toEqual([]);
+    expect(connectionStore["telegram"]).toBeDefined();
+    expect(connectionStore["slack_channel"]).toBeDefined();
+    expect(warnings.length).toBe(2);
+  });
+});

package/src/__tests__/memory-v2-static-injector.test.ts

@@ -0,0 +1,95 @@
+/**
+ * Tests for the `memory-v2-static` runtime injector.
+ *
+ * Covers:
+ *   - Returns null when `memoryV2Static` is missing/empty.
+ *   - Returns null when `mode === "minimal"`.
+ *   - Wraps content in `<memory>...</memory>` and uses
+ *     `after-memory-prefix` placement.
+ *   - Escapes any `</memory>` substring inside the authored content so the
+ *     wrapper cannot be broken out of.
+ *
+ * Hermetic: drives the injector's `produce()` directly with a synthesized
+ * `TurnContext` — no daemon, no filesystem.
+ */
+
+import { describe, expect, test } from "bun:test";
+
+import { defaultInjectorsPlugin } from "../plugins/defaults/injectors.js";
+import type { Injector, TurnContext } from "../plugins/types.js";
+
+function findInjector(name: string): Injector {
+  const injector = defaultInjectorsPlugin.injectors?.find(
+    (i) => i.name === name,
+  );
+  if (!injector) {
+    throw new Error(`injector '${name}' not registered`);
+  }
+  return injector;
+}
+
+function makeContext(overrides: Partial<TurnContext> = {}): TurnContext {
+  return {
+    requestId: "req-test",
+    conversationId: "conv-test",
+    turnIndex: 0,
+    trust: { sourceChannel: "vellum", trustClass: "guardian" },
+    ...overrides,
+  };
+}
+
+const memoryV2StaticInjector = findInjector("memory-v2-static");
+
+describe("memory-v2-static injector", () => {
+  test("returns null when memoryV2Static is undefined", async () => {
+    const ctx = makeContext({ injectionInputs: {} });
+    expect(await memoryV2StaticInjector.produce(ctx)).toBeNull();
+  });
+
+  test("returns null when memoryV2Static is null", async () => {
+    const ctx = makeContext({ injectionInputs: { memoryV2Static: null } });
+    expect(await memoryV2StaticInjector.produce(ctx)).toBeNull();
+  });
+
+  test("returns null when memoryV2Static is an empty string", async () => {
+    const ctx = makeContext({ injectionInputs: { memoryV2Static: "" } });
+    expect(await memoryV2StaticInjector.produce(ctx)).toBeNull();
+  });
+
+  test("returns null in minimal mode even with content", async () => {
+    const ctx = makeContext({
+      injectionInputs: {
+        mode: "minimal",
+        memoryV2Static: "## Essentials\n\nAlice prefers VS Code.",
+      },
+    });
+    expect(await memoryV2StaticInjector.produce(ctx)).toBeNull();
+  });
+
+  test("wraps content in <memory>...</memory> with after-memory-prefix placement", async () => {
+    const content =
+      "## Essentials\n\nAlice prefers VS Code.\n\n## Threads\n\nOpen: ship PR.";
+    const ctx = makeContext({
+      injectionInputs: { memoryV2Static: content },
+    });
+
+    const block = await memoryV2StaticInjector.produce(ctx);
+    expect(block).not.toBeNull();
+    expect(block!.id).toBe("memory-v2-static");
+    expect(block!.placement).toBe("after-memory-prefix");
+    expect(block!.text).toBe(`<memory>\n${content}\n</memory>`);
+  });
+
+  test("escapes inner </memory> closing tags so the wrapper cannot be broken out of", async () => {
+    const content = "## Essentials\n\nText with </memory> embedded.";
+    const ctx = makeContext({
+      injectionInputs: { memoryV2Static: content },
+    });
+
+    const block = await memoryV2StaticInjector.produce(ctx);
+    expect(block).not.toBeNull();
+    expect(block!.text).toBe(
+      "<memory>\n## Essentials\n\nText with &lt;/memory&gt; embedded.\n</memory>",
+    );
+  });
+});