@vellumai/assistant 0.7.0 → 0.7.1

package/src/__tests__/trusted-contact-lifecycle-notifications.test.ts

@@ -65,16 +65,12 @@ mock.module("../runtime/approval-message-composer.js", () => ({
 }));
 
 import { getResolver } from "../approvals/guardian-request-resolvers.js";
-import { findContactChannel } from "../contacts/contact-store.js";
-import {
-  createGuardianBinding,
-  upsertContactChannel,
-} from "../contacts/contacts-write.js";
+import { upsertContactChannel } from "../contacts/contacts-write.js";
 import { getDb } from "../memory/db-connection.js";
 import { initializeDb } from "../memory/db-init.js";
 import { createApprovalRequest } from "../memory/guardian-approvals.js";
-import { createOutboundSession } from "../runtime/channel-verification-service.js";
 import { handleChannelInbound } from "./helpers/channel-test-adapter.js";
+import { createGuardianBinding } from "./helpers/create-guardian-binding.js";
 
 initializeDb();
 
@@ -466,107 +462,6 @@ describe("trusted contact activated notification signal", () => {
     resetState();
   });
 
-  test("successful trusted contact verification emits activated signal", async () => {
-    // Set up a guardian binding so the verification path allows bypass
-    createGuardianBinding({
-      channel: "telegram",
-      guardianExternalUserId: "guardian-user-789",
-      guardianDeliveryChatId: "guardian-chat-789",
-      guardianPrincipalId: "guardian-user-789",
-      verifiedVia: "test",
-    });
-
-    // Create an identity-bound outbound session (simulates M3 approval flow)
-    const session = createOutboundSession({
-      channel: "telegram",
-      expectedExternalUserId: "requester-user-456",
-      expectedChatId: "chat-123",
-      identityBindingStatus: "bound",
-      destinationAddress: "chat-123",
-      verificationPurpose: "trusted_contact",
-    });
-
-    // Requester enters the verification code
-    const verifyReq = buildInboundRequest({
-      content: session.secret,
-      conversationExternalId: "chat-123",
-      actorExternalId: "requester-user-456",
-    });
-
-    await handleChannelInbound(verifyReq, undefined, TEST_BEARER_TOKEN);
-
-    // Should emit the activated signal
-    const activatedSignals = emitSignalCalls.filter(
-      (c) => c.sourceEventName === "ingress.trusted_contact.activated",
-    );
-
-    expect(activatedSignals.length).toBe(1);
-
-    // Verify payload
-    const payload = activatedSignals[0].contextPayload as Record<
-      string,
-      unknown
-    >;
-    expect(payload.sourceChannel).toBe("telegram");
-    expect(payload.actorExternalId).toBe("requester-user-456");
-    expect(payload.conversationExternalId).toBe("chat-123");
-
-    // Verify deduplication key includes the user identity
-    const dedupeKey = activatedSignals[0].dedupeKey as string;
-    expect(dedupeKey).toContain("trusted-contact:activated:");
-    expect(dedupeKey).toContain("requester-user-456");
-
-    // Verify attention hints indicate informational (no action required)
-    const hints = activatedSignals[0].attentionHints as Record<string, unknown>;
-    expect(hints.requiresAction).toBe(false);
-    expect(hints.urgency).toBe("low");
-  });
-
-  test("re-verification preserves an existing guardian-managed member display name", async () => {
-    createGuardianBinding({
-      channel: "telegram",
-      guardianExternalUserId: "guardian-user-789",
-      guardianDeliveryChatId: "guardian-chat-789",
-      guardianPrincipalId: "guardian-user-789",
-      verifiedVia: "test",
-    });
-
-    upsertContactChannel({
-      sourceChannel: "telegram",
-      externalUserId: "requester-user-456",
-      externalChatId: "chat-123",
-      status: "revoked",
-      policy: "allow",
-      displayName: "Jeff",
-    });
-
-    const session = createOutboundSession({
-      channel: "telegram",
-      expectedExternalUserId: "requester-user-456",
-      expectedChatId: "chat-123",
-      identityBindingStatus: "bound",
-      destinationAddress: "chat-123",
-      verificationPurpose: "trusted_contact",
-    });
-
-    const verifyReq = buildInboundRequest({
-      content: session.secret,
-      conversationExternalId: "chat-123",
-      actorExternalId: "requester-user-456",
-      actorDisplayName: "Noa Flaherty",
-    });
-
-    await handleChannelInbound(verifyReq, undefined, TEST_BEARER_TOKEN);
-
-    const result = findContactChannel({
-      channelType: "telegram",
-      externalUserId: "requester-user-456",
-    });
-    expect(result).not.toBeNull();
-    expect(result!.channel.status).toBe("active");
-    expect(result!.contact.displayName).toBe("Jeff");
-  });
-
   test("guardian verification does NOT emit activated signal", async () => {
     // Create an inbound challenge (guardian flow, not trusted contact)
     const { createInboundVerificationSession } =
@@ -599,46 +494,4 @@ describe("trusted contact activated notification signal", () => {
     expect(resolver!.kind).toBe("access_request");
   });
 
-  test("member is persisted BEFORE activated signal is emitted", async () => {
-    // Set up a guardian binding
-    createGuardianBinding({
-      channel: "telegram",
-      guardianExternalUserId: "guardian-user-789",
-      guardianDeliveryChatId: "guardian-chat-789",
-      guardianPrincipalId: "guardian-user-789",
-      verifiedVia: "test",
-    });
-
-    const session = createOutboundSession({
-      channel: "telegram",
-      expectedExternalUserId: "requester-user-456",
-      expectedChatId: "chat-123",
-      identityBindingStatus: "bound",
-      destinationAddress: "chat-123",
-      verificationPurpose: "trusted_contact",
-    });
-
-    const verifyReq = buildInboundRequest({
-      content: session.secret,
-      conversationExternalId: "chat-123",
-      actorExternalId: "requester-user-456",
-    });
-
-    await handleChannelInbound(verifyReq, undefined, TEST_BEARER_TOKEN);
-
-    // The activated signal was emitted
-    const activatedSignals = emitSignalCalls.filter(
-      (c) => c.sourceEventName === "ingress.trusted_contact.activated",
-    );
-    expect(activatedSignals.length).toBe(1);
-
-    // Verify the member was already persisted (the signal fires after upsertContactChannel)
-    const result = findContactChannel({
-      channelType: "telegram",
-      externalUserId: "requester-user-456",
-    });
-    expect(result).not.toBeNull();
-    expect(result!.channel.status).toBe("active");
-    expect(result!.channel.policy).toBe("allow");
-  });
 });

package/src/__tests__/trusted-contact-multichannel.test.ts

@@ -74,10 +74,7 @@ mock.module("../runtime/approval-message-composer.js", () => ({
 }));
 
 import { findContactChannel } from "../contacts/contact-store.js";
-import {
-  createGuardianBinding,
-  upsertContactChannel,
-} from "../contacts/contacts-write.js";
+import { upsertContactChannel } from "../contacts/contacts-write.js";
 import { getDb } from "../memory/db-connection.js";
 import { initializeDb } from "../memory/db-init.js";
 import {
@@ -85,6 +82,7 @@ import {
   validateAndConsumeVerification,
 } from "../runtime/channel-verification-service.js";
 import { handleChannelInbound } from "./helpers/channel-test-adapter.js";
+import { createGuardianBinding } from "./helpers/create-guardian-binding.js";
 
 initializeDb();
 

package/src/__tests__/trusted-contact-verification.test.ts

@@ -27,7 +27,6 @@ import {
   findGuardianForChannel,
 } from "../contacts/contact-store.js";
 import {
-  createGuardianBinding,
   revokeMember,
   upsertContactChannel,
 } from "../contacts/contacts-write.js";
@@ -38,6 +37,7 @@ import {
   createOutboundSession,
   validateAndConsumeVerification,
 } from "../runtime/channel-verification-service.js";
+import { createGuardianBinding } from "./helpers/create-guardian-binding.js";
 
 initializeDb();
 

package/src/__tests__/tts-catalog-parity.test.ts

@@ -67,22 +67,33 @@ function loadClientCatalog(): ClientCatalog {
  * catalog entry's secret requirements.
  *
  * Convention:
- * - If the first secretRequirement.credentialStoreKey starts with "credential/",
- *   the client uses credentialMode "credential" and credentialNamespace is the
- *   second path segment.
+ * - If the first secretRequirement.credentialStoreKey starts with "credential/"
+ *   AND the setCommand uses "assistant keys set" (api-key flow), the client uses
+ *   credentialMode "api-key" with apiKeyProviderName as the second path segment.
+ * - If the first secretRequirement.credentialStoreKey starts with "credential/"
+ *   and the setCommand uses the credentials flow, the client uses credentialMode
+ *   "credential" and credentialNamespace is the second path segment.
  * - Otherwise, the client uses credentialMode "api-key" and apiKeyProviderName
  *   is the bare key.
  */
 function deriveCredentialMetadata(daemonEntry: {
-  secretRequirements: readonly { readonly credentialStoreKey: string }[];
+  secretRequirements: readonly {
+    readonly credentialStoreKey: string;
+    readonly setCommand?: string;
+  }[];
 }): {
   credentialMode: "api-key" | "credential";
   apiKeyProviderName?: string;
   credentialNamespace?: string;
 } {
-  const key = daemonEntry.secretRequirements[0]?.credentialStoreKey ?? "";
+  const req = daemonEntry.secretRequirements[0];
+  const key = req?.credentialStoreKey ?? "";
+  const cmd = req?.setCommand ?? "";
   if (key.startsWith("credential/")) {
     const parts = key.split("/");
+    if (cmd.startsWith("assistant keys set ")) {
+      return { credentialMode: "api-key", apiKeyProviderName: parts[1] };
+    }
     return { credentialMode: "credential", credentialNamespace: parts[1] };
   }
   return { credentialMode: "api-key", apiKeyProviderName: key };

package/src/__tests__/usage-attribution.test.ts

@@ -0,0 +1,247 @@
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+let mockLlmConfig: Record<string, unknown> = {};
+
+mock.module("../config/loader.js", () => ({
+  getConfig: () => ({ llm: mockLlmConfig }),
+}));
+
+import { resolveCallSiteConfig } from "../config/llm-resolver.js";
+import {
+  type LLMCallSite,
+  type LLMConfig,
+  LLMSchema,
+} from "../config/schemas/llm.js";
+import {
+  resolveUsageAttribution,
+  sanitizeUsageMetadataValue,
+} from "../usage/attribution.js";
+
+function setLlmConfig(raw: unknown): void {
+  mockLlmConfig = LLMSchema.parse(raw) as Record<string, unknown>;
+}
+
+function expectResolvedProviderModelMatchesResolver(
+  callSite: LLMCallSite,
+  overrideProfile?: string,
+): void {
+  const snapshot = resolveUsageAttribution({
+    callSite,
+    ...(overrideProfile != null ? { overrideProfile } : {}),
+  });
+  const resolved = resolveCallSiteConfig(callSite, mockLlmConfig as LLMConfig, {
+    ...(overrideProfile != null ? { overrideProfile } : {}),
+  });
+
+  expect(snapshot.resolvedProvider).toBe(resolved.provider);
+  expect(snapshot.resolvedModel).toBe(resolved.model);
+}
+
+beforeEach(() => {
+  mockLlmConfig = LLMSchema.parse({}) as Record<string, unknown>;
+});
+
+describe("resolveUsageAttribution", () => {
+  test("resolves default-only attribution", () => {
+    setLlmConfig({
+      default: { provider: "anthropic", model: "claude-opus-4-7" },
+    });
+
+    const snapshot = resolveUsageAttribution({ callSite: "mainAgent" });
+
+    expect(snapshot).toMatchObject({
+      callSite: "mainAgent",
+      activeProfile: null,
+      overrideProfile: null,
+      callSiteProfile: null,
+      appliedProfile: null,
+      profileSource: "default",
+      resolvedProvider: "anthropic",
+      resolvedModel: "claude-opus-4-7",
+    });
+    expectResolvedProviderModelMatchesResolver("mainAgent");
+  });
+
+  test("resolves workspace active profile attribution", () => {
+    setLlmConfig({
+      default: { provider: "anthropic", model: "claude-opus-4-7" },
+      profiles: {
+        balanced: { provider: "openai", model: "gpt-5.4" },
+      },
+      activeProfile: "balanced",
+    });
+
+    const snapshot = resolveUsageAttribution({ callSite: "mainAgent" });
+
+    expect(snapshot).toMatchObject({
+      activeProfile: "balanced",
+      overrideProfile: null,
+      callSiteProfile: null,
+      appliedProfile: "balanced",
+      profileSource: "active",
+      resolvedProvider: "openai",
+      resolvedModel: "gpt-5.4",
+    });
+    expectResolvedProviderModelMatchesResolver("mainAgent");
+  });
+
+  test("resolves per-conversation override profile attribution", () => {
+    setLlmConfig({
+      default: { provider: "anthropic", model: "claude-opus-4-7" },
+      profiles: {
+        active: { provider: "openai", model: "gpt-5.4" },
+        pinned: { provider: "gemini", model: "gemini-3-pro" },
+      },
+      activeProfile: "active",
+    });
+
+    const snapshot = resolveUsageAttribution({
+      callSite: "mainAgent",
+      overrideProfile: "pinned",
+    });
+
+    expect(snapshot).toMatchObject({
+      activeProfile: "active",
+      overrideProfile: "pinned",
+      callSiteProfile: null,
+      appliedProfile: "pinned",
+      profileSource: "conversation",
+      resolvedProvider: "gemini",
+      resolvedModel: "gemini-3-pro",
+    });
+    expectResolvedProviderModelMatchesResolver("mainAgent", "pinned");
+  });
+
+  test("resolves call-site profile attribution over conversation override", () => {
+    setLlmConfig({
+      default: { provider: "anthropic", model: "claude-opus-4-7" },
+      profiles: {
+        active: { provider: "openai", model: "gpt-5.4" },
+        pinned: { provider: "gemini", model: "gemini-3-pro" },
+        site: {
+          provider: "fireworks",
+          model: "accounts/fireworks/models/kimi-k2",
+        },
+      },
+      activeProfile: "active",
+      callSites: {
+        memoryRetrieval: { profile: "site" },
+      },
+    });
+
+    const snapshot = resolveUsageAttribution({
+      callSite: "memoryRetrieval",
+      overrideProfile: "pinned",
+    });
+
+    expect(snapshot).toMatchObject({
+      activeProfile: "active",
+      overrideProfile: "pinned",
+      callSiteProfile: "site",
+      appliedProfile: "site",
+      profileSource: "call_site",
+      resolvedProvider: "fireworks",
+      resolvedModel: "accounts/fireworks/models/kimi-k2",
+    });
+    expectResolvedProviderModelMatchesResolver("memoryRetrieval", "pinned");
+  });
+
+  test("attributes mainAgent to conversation profile over call-site profile", () => {
+    setLlmConfig({
+      default: { provider: "anthropic", model: "claude-opus-4-7" },
+      profiles: {
+        active: { provider: "openai", model: "gpt-5.4" },
+        pinned: { provider: "gemini", model: "gemini-2.5-pro" },
+        site: {
+          provider: "fireworks",
+          model: "accounts/fireworks/models/kimi-k2p5",
+        },
+      },
+      activeProfile: "active",
+      callSites: {
+        mainAgent: { profile: "site" },
+      },
+    });
+
+    const snapshot = resolveUsageAttribution({
+      callSite: "mainAgent",
+      overrideProfile: "pinned",
+    });
+
+    expect(snapshot).toMatchObject({
+      activeProfile: "active",
+      overrideProfile: "pinned",
+      callSiteProfile: "site",
+      appliedProfile: "pinned",
+      profileSource: "conversation",
+      resolvedProvider: "gemini",
+      resolvedModel: "gemini-2.5-pro",
+    });
+    expectResolvedProviderModelMatchesResolver("mainAgent", "pinned");
+  });
+
+  test("uses explicit call-site provider and model overrides in resolved metadata", () => {
+    setLlmConfig({
+      default: { provider: "anthropic", model: "claude-opus-4-7" },
+      profiles: {
+        active: { provider: "openai", model: "gpt-5.4" },
+      },
+      activeProfile: "active",
+      callSites: {
+        memoryRetrieval: {
+          provider: "ollama",
+          model: "llama3.2",
+        },
+      },
+    });
+
+    const snapshot = resolveUsageAttribution({
+      callSite: "memoryRetrieval",
+    });
+
+    expect(snapshot).toMatchObject({
+      activeProfile: "active",
+      callSiteProfile: null,
+      appliedProfile: "active",
+      profileSource: "active",
+      resolvedProvider: "ollama",
+      resolvedModel: "llama3.2",
+    });
+    expectResolvedProviderModelMatchesResolver("memoryRetrieval");
+  });
+
+  test("falls back when a runtime override profile is missing", () => {
+    setLlmConfig({
+      default: { provider: "anthropic", model: "claude-opus-4-7" },
+      profiles: {
+        active: { provider: "openai", model: "gpt-5.4" },
+      },
+      activeProfile: "active",
+    });
+
+    const snapshot = resolveUsageAttribution({
+      callSite: "mainAgent",
+      overrideProfile: "deleted",
+    });
+
+    expect(snapshot).toMatchObject({
+      activeProfile: "active",
+      overrideProfile: "deleted",
+      appliedProfile: "active",
+      profileSource: "active",
+      resolvedProvider: "openai",
+      resolvedModel: "gpt-5.4",
+    });
+    expectResolvedProviderModelMatchesResolver("mainAgent", "deleted");
+  });
+});
+
+describe("sanitizeUsageMetadataValue", () => {
+  test("trims, drops empty values, caps long values, and rejects controls", () => {
+    expect(sanitizeUsageMetadataValue("  profile-1  ")).toBe("profile-1");
+    expect(sanitizeUsageMetadataValue("   ")).toBeNull();
+    expect(sanitizeUsageMetadataValue(`profile\n1`)).toBeNull();
+    expect(sanitizeUsageMetadataValue("profile\u00851")).toBeNull();
+    expect(sanitizeUsageMetadataValue("x".repeat(200))).toHaveLength(128);
+  });
+});

package/src/__tests__/usage-cli.test.ts

@@ -0,0 +1,143 @@
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+import { Command } from "commander";
+
+const logLines: string[] = [];
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () => ({
+    info: () => {},
+    warn: () => {},
+    error: () => {},
+    debug: () => {},
+  }),
+  getCliLogger: () => ({
+    info: (message: string) => logLines.push(message),
+    warn: (message: string) => logLines.push(message),
+    error: (message: string) => logLines.push(message),
+    debug: () => {},
+  }),
+}));
+
+const { initializeDb } = await import("../memory/db-init.js");
+const { getDb } = await import("../memory/db-connection.js");
+const { recordUsageEvent } = await import("../memory/llm-usage-store.js");
+const { registerUsageCommand } = await import("../cli/commands/usage.js");
+
+initializeDb();
+
+async function runCommand(args: string[]): Promise<{
+  exitCode: number;
+  output: string;
+}> {
+  process.exitCode = 0;
+  logLines.length = 0;
+  const originalExit = process.exit;
+  process.exit = ((code?: number) => {
+    process.exitCode = code ?? 0;
+    throw new Error(`process.exit(${code ?? 0})`);
+  }) as typeof process.exit;
+
+  try {
+    const program = new Command();
+    program.exitOverride();
+    registerUsageCommand(program);
+    await program.parseAsync(["node", "assistant", ...args]);
+  } catch {
+    if (process.exitCode === 0) process.exitCode = 1;
+  } finally {
+    process.exit = originalExit;
+  }
+
+  const exitCode = process.exitCode ?? 0;
+  process.exitCode = 0;
+  return { exitCode, output: logLines.join("\n") };
+}
+
+function insertUsage(
+  overrides: Partial<Parameters<typeof recordUsageEvent>[0]>,
+  estimatedCostUsd = 0.01,
+): void {
+  recordUsageEvent(
+    {
+      conversationId: null,
+      runId: null,
+      requestId: null,
+      actor: "main_agent",
+      provider: "anthropic",
+      model: "claude-sonnet-4-20250514",
+      inputTokens: 100,
+      outputTokens: 50,
+      cacheCreationInputTokens: 0,
+      cacheReadInputTokens: 0,
+      ...overrides,
+    },
+    { estimatedCostUsd, pricingStatus: "priced" },
+  );
+}
+
+describe("assistant usage CLI", () => {
+  beforeEach(() => {
+    logLines.length = 0;
+    getDb().run("DELETE FROM llm_usage_events");
+  });
+
+  test("breakdown JSON includes call-site display labels and groupKey", async () => {
+    insertUsage({ callSite: "mainAgent" });
+    insertUsage({ callSite: null, inputTokens: 200 }, 0.005);
+
+    const result = await runCommand([
+      "usage",
+      "breakdown",
+      "--range",
+      "all",
+      "--group-by",
+      "call_site",
+      "--json",
+    ]);
+
+    expect(result.exitCode).toBe(0);
+    const parsed = JSON.parse(result.output) as {
+      breakdown: Array<{ group: string; groupKey: string | null }>;
+    };
+    expect(parsed.breakdown.map((row) => row.group)).toEqual([
+      "Main Agent",
+      "Unknown Task",
+    ]);
+    expect(parsed.breakdown.map((row) => row.groupKey)).toEqual([
+      "mainAgent",
+      null,
+    ]);
+  });
+
+  test("breakdown table prints friendly profile fallback labels", async () => {
+    insertUsage({ inferenceProfile: null });
+
+    const result = await runCommand([
+      "usage",
+      "breakdown",
+      "--range",
+      "all",
+      "--group-by",
+      "inference_profile",
+    ]);
+
+    expect(result.exitCode).toBe(0);
+    expect(result.output).toContain("PROFILE");
+    expect(result.output).toContain("Default / Unset");
+  });
+
+  test("rejects invalid breakdown dimensions", async () => {
+    const result = await runCommand([
+      "usage",
+      "breakdown",
+      "--group-by",
+      "invalid",
+    ]);
+
+    expect(result.exitCode).toBe(1);
+    expect(result.output).toContain("Invalid --group-by value");
+    expect(result.output).toContain("call_site");
+    expect(result.output).toContain("inference_profile");
+  });
+});