@vellumai/assistant 0.7.0 → 0.7.2

package/src/__tests__/init-feature-flag-overrides.test.ts

@@ -41,8 +41,11 @@ describe("initFeatureFlagOverrides", () => {
   it("falls back gracefully when gateway socket is unavailable", async () => {
     mockGatewayIpc(null, { error: true });
 
-    // Should not throw
-    await initFeatureFlagOverrides();
+    // Disable retries — production retries the IPC fetch on failure to
+    // dodge the daemon-vs-gateway startup race, but here we're explicitly
+    // testing the no-gateway fallback and don't want the test to wait
+    // through the backoff schedule.
+    await initFeatureFlagOverrides({ retryBackoffsMs: [] });
 
     // Without gateway data or file, undeclared flags default to true
     const config = {} as any;
@@ -64,7 +67,10 @@ describe("initFeatureFlagOverrides", () => {
   it("does not cache empty gateway response", async () => {
     mockGatewayIpc({});
 
-    await initFeatureFlagOverrides();
+    // Disable retries — this test explicitly simulates a sustained empty
+    // response (gateway up but reporting zero flags) and should not wait
+    // through the production backoff schedule.
+    await initFeatureFlagOverrides({ retryBackoffsMs: [] });
 
     // Undeclared flags without overrides default to true (not false from
     // a cached empty map)
@@ -72,6 +78,23 @@ describe("initFeatureFlagOverrides", () => {
     expect(isAssistantFeatureFlagEnabled("foo-enabled", config)).toBe(true);
   });
 
+  it("retries empty gateway responses and picks up flags once they become available", async () => {
+    // Simulate the daemon-vs-gateway startup race: the first IPC call
+    // returns empty (gateway not yet ready), but a later attempt sees
+    // the populated flag map. The retry loop in init should bridge this
+    // gap without losing the flag.
+    mockGatewayIpc({});
+    setTimeout(() => {
+      resetMockGatewayIpc();
+      mockGatewayIpc({ "retry-test-flag": true });
+    }, 50);
+
+    await initFeatureFlagOverrides({ retryBackoffsMs: [200] });
+
+    const config = {} as any;
+    expect(isAssistantFeatureFlagEnabled("retry-test-flag", config)).toBe(true);
+  });
+
   it("does not re-fetch when cache is already populated", async () => {
     mockGatewayIpc({ "first-call": true });
 

package/src/__tests__/injector-chain.test.ts

@@ -4,10 +4,10 @@
  *
  * Covers:
  *
- * 1. The eight default injectors registered by `defaultInjectorsPlugin` come
+ * 1. The nine default injectors registered by `defaultInjectorsPlugin` come
  *    back from `getInjectors()` in the documented order (workspace-context →
- *    unified-turn-context → pkb-context → pkb-reminder → now-md →
- *    subagent-status → slack-messages → thread-focus).
+ *    unified-turn-context → pkb-context → pkb-reminder → memory-v2-static →
+ *    now-md → subagent-status → slack-messages → thread-focus).
  * 2. A third-party-registered injector at `order: 25` slots between
  *    `unified-turn-context` (order 20) and `pkb` (order 30), proving the
  *    extensibility contract.
@@ -76,7 +76,7 @@ describe("injector chain", () => {
     resetPluginRegistryForTests();
   });
 
-  test("defaultInjectorsPlugin registers the eight defaults in the documented order", () => {
+  test("defaultInjectorsPlugin registers the nine defaults in the documented order", () => {
     registerPlugin(defaultInjectorsPlugin);
 
     const names = getInjectors().map((i) => i.name);
@@ -85,6 +85,7 @@ describe("injector chain", () => {
       "unified-turn-context",
       "pkb-context",
       "pkb-reminder",
+      "memory-v2-static",
       "now-md",
       "subagent-status",
       "slack-messages",
@@ -104,6 +105,9 @@ describe("injector chain", () => {
     );
     expect(byName.get("pkb-context")).toBe(DEFAULT_INJECTOR_ORDER.pkbContext);
     expect(byName.get("pkb-reminder")).toBe(DEFAULT_INJECTOR_ORDER.pkbReminder);
+    expect(byName.get("memory-v2-static")).toBe(
+      DEFAULT_INJECTOR_ORDER.memoryV2Static,
+    );
     expect(byName.get("now-md")).toBe(DEFAULT_INJECTOR_ORDER.nowMd);
     expect(byName.get("subagent-status")).toBe(
       DEFAULT_INJECTOR_ORDER.subagentStatus,
@@ -133,6 +137,7 @@ describe("injector chain", () => {
       "plugin-25", // 25 — slots in
       "pkb-context", // 30
       "pkb-reminder", // 35
+      "memory-v2-static", // 38
       "now-md", // 40
       "subagent-status", // 50
       "slack-messages", // 60
@@ -141,7 +146,7 @@ describe("injector chain", () => {
   });
 
   test("composeInjectorChain returns empty string when every injector opts out", async () => {
-    // The default chain is the golden-path: all eight defaults return `null`
+    // The default chain is the golden-path: all nine defaults return `null`
     // on an empty turn context, so the composed block is an empty string.
     registerPlugin(defaultInjectorsPlugin);
 

package/src/__tests__/injector-pkb-v2-silenced.test.ts

@@ -0,0 +1,124 @@
+/**
+ * v2 read-side cutover behavior for the PKB-derived default injectors.
+ *
+ * When `isMemoryV2ReadActive(getConfig())` is true:
+ *   - `pkb-context` silences itself (concept pages own retrieval).
+ *   - `pkb-reminder` still fires (its body is generic recall/remember
+ *     guidance) but skips the PKB-search hints — those name PKB paths.
+ *   - `now-md` fires unchanged (workspace state, independent of PKB).
+ *
+ * Mocks `isMemoryV2ReadActive` at the module level so each test can flip the
+ * effective gate state without standing up a full feature-flag + config
+ * stack. Mocks the PKB hybrid search so the reminder-with-hints branch can
+ * resolve deterministically when called.
+ */
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+let v2Active = false;
+
+mock.module("../memory/context-search/sources/memory-v2.js", () => ({
+  isMemoryV2ReadActive: () => v2Active,
+}));
+
+mock.module("../memory/pkb/pkb-search.js", () => ({
+  searchPkbFiles: async () => [],
+}));
+
+const { applyRuntimeInjections } =
+  await import("../daemon/conversation-runtime-assembly.js");
+const { defaultInjectorsPlugin } =
+  await import("../plugins/defaults/injectors.js");
+const { registerPlugin, resetPluginRegistryForTests } =
+  await import("../plugins/registry.js");
+import type { TurnContext } from "../plugins/types.js";
+import type { Message } from "../providers/types.js";
+
+function makeTurnContext(): TurnContext {
+  return {
+    requestId: "req-test-1",
+    conversationId: "conv-test-1",
+    turnIndex: 0,
+    trust: {
+      sourceChannel: "vellum",
+      trustClass: "guardian",
+    },
+  };
+}
+
+function tailTexts(messages: Message[]): string[] {
+  const tail = messages[messages.length - 1];
+  return tail.content
+    .filter((b): b is { type: "text"; text: string } => b.type === "text")
+    .map((b) => b.text);
+}
+
+const PKB_CONTEXT = "essentials of the project";
+const NOW_CONTENT = "Current focus: shipping G2.1";
+const RUN_MESSAGES: Message[] = [
+  { role: "user", content: [{ type: "text", text: "What next?" }] },
+];
+
+describe("PKB injector v2 cutover behavior", () => {
+  beforeEach(() => {
+    resetPluginRegistryForTests();
+    registerPlugin(defaultInjectorsPlugin);
+    v2Active = false;
+  });
+
+  test("v2 inactive → pkb-context, pkb-reminder, and now-md all produce blocks", async () => {
+    const result = await applyRuntimeInjections(RUN_MESSAGES, {
+      turnContext: makeTurnContext(),
+      pkbContext: PKB_CONTEXT,
+      pkbActive: true,
+      pkbScopeId: "scope-default",
+      pkbRoot: "/tmp/pkb",
+      pkbConversation: { messages: [] },
+      nowScratchpad: NOW_CONTENT,
+    });
+
+    const texts = tailTexts(result.messages);
+    expect(texts.some((t) => t.includes("<knowledge_base>"))).toBe(true);
+    expect(texts.some((t) => t.includes("<system_reminder>"))).toBe(true);
+    expect(texts.some((t) => t.includes("<NOW.md"))).toBe(true);
+  });
+
+  test("v2 active → pkb-context silenced; pkb-reminder + now-md still fire", async () => {
+    v2Active = true;
+    const result = await applyRuntimeInjections(RUN_MESSAGES, {
+      turnContext: makeTurnContext(),
+      pkbContext: PKB_CONTEXT,
+      pkbActive: true,
+      pkbScopeId: "scope-default",
+      pkbRoot: "/tmp/pkb",
+      pkbConversation: { messages: [] },
+      nowScratchpad: NOW_CONTENT,
+    });
+
+    const texts = tailTexts(result.messages);
+    expect(texts.some((t) => t.includes("<knowledge_base>"))).toBe(false);
+    expect(texts.some((t) => t.includes("<system_reminder>"))).toBe(true);
+    expect(texts.some((t) => t.includes("<NOW.md"))).toBe(true);
+    expect(texts).toContain("What next?");
+  });
+
+  test("v2 active → pkb-reminder body fires without the hybrid-search hints", async () => {
+    v2Active = true;
+    const result = await applyRuntimeInjections(RUN_MESSAGES, {
+      turnContext: makeTurnContext(),
+      pkbActive: true,
+      pkbScopeId: "scope-default",
+      pkbRoot: "/tmp/pkb",
+      pkbConversation: { messages: [] },
+      // Provide a query vector so the v1 path WOULD have called searchPkbFiles
+      // and rendered hints. Under v2, the call is skipped and the reminder
+      // is rendered with empty hints — i.e. no "files look especially
+      // relevant" line.
+      pkbQueryVector: [0.1, 0.2, 0.3],
+    });
+
+    const texts = tailTexts(result.messages);
+    const reminder = texts.find((t) => t.includes("<system_reminder>"));
+    expect(reminder).toBeDefined();
+    expect(reminder).not.toContain("files look especially relevant");
+  });
+});

package/src/__tests__/inline-command-runner.test.ts

@@ -19,8 +19,6 @@ const mockConfig = {
   rateLimit: { maxRequestsPerMinute: 0 },
   secretDetection: {
     enabled: true,
-    action: "warn" as const,
-    entropyThreshold: 4.0,
   },
   auditLog: { retentionDays: 0 },
 };
@@ -29,7 +27,6 @@ mock.module("../config/loader.js", () => ({
   getConfig: () => mockConfig,
   loadConfig: () => mockConfig,
   invalidateConfigCache: () => {},
-  saveConfig: () => {},
   loadRawConfig: () => ({}),
   saveRawConfig: () => {},
   getNestedValue: () => undefined,
@@ -43,30 +40,6 @@ mock.module("../util/logger.js", () => ({
     }),
 }));
 
-// Track wrapCommand calls to verify sandbox-only execution
-let lastWrapCall: {
-  command: string;
-  workingDir: string;
-  config: { enabled: boolean };
-  options?: { networkMode?: string };
-} | null = null;
-
-mock.module("../tools/terminal/sandbox.js", () => ({
-  wrapCommand: (
-    command: string,
-    workingDir: string,
-    config: { enabled: boolean },
-    options?: { networkMode?: string },
-  ) => {
-    lastWrapCall = { command, workingDir, config, options };
-    return {
-      command: "bash",
-      args: ["-c", "--", command],
-      sandboxed: false,
-    };
-  },
-}));
-
 mock.module("../tools/terminal/safe-env.js", () => ({
   buildSanitizedEnv: () => ({
     PATH: process.env.PATH ?? "/usr/bin:/bin",
@@ -100,46 +73,6 @@ function expectFailure(
 // ---------------------------------------------------------------------------
 
 describe("runInlineCommand", () => {
-  // ── Sandbox enforcement ──────────────────────────────────────────────────
-
-  describe("sandbox enforcement", () => {
-    test("always passes sandbox config with enabled=false", async () => {
-      lastWrapCall = null;
-      await runInlineCommand("echo sandbox-check", CWD);
-
-      expect(lastWrapCall).not.toBeNull();
-      expect(lastWrapCall!.config.enabled).toBe(false);
-    });
-
-    test("does not pass networkMode when sandbox is disabled", async () => {
-      lastWrapCall = null;
-      await runInlineCommand("echo network-check", CWD);
-
-      expect(lastWrapCall).not.toBeNull();
-      // networkMode is a no-op when sandbox is disabled (wrapCommand returns
-      // a plain bash invocation), so it is not passed. Network isolation is
-      // provided by the Docker/platform-managed container.
-      expect(lastWrapCall!.options).toBeUndefined();
-    });
-
-    test("uses the provided workingDir as cwd", async () => {
-      lastWrapCall = null;
-      const customDir = "/tmp/my-project";
-      await runInlineCommand("echo cwd-check", customDir);
-
-      expect(lastWrapCall).not.toBeNull();
-      expect(lastWrapCall!.workingDir).toBe(customDir);
-    });
-
-    test("passes the literal command string to the sandbox", async () => {
-      lastWrapCall = null;
-      await runInlineCommand("git log --oneline -n 5", CWD);
-
-      expect(lastWrapCall).not.toBeNull();
-      expect(lastWrapCall!.command).toBe("git log --oneline -n 5");
-    });
-  });
-
   // ── Successful execution ─────────────────────────────────────────────────
 
   describe("successful execution", () => {

package/src/__tests__/inline-skill-load-permissions.test.ts

@@ -1,8 +1,7 @@
 /**
  * Tests for inline-command skill load permission handling.
  *
- * When a skill contains inline command expansions (!\`...\`) and the
- * inline-skill-commands flag is on, the permission
+ * When a skill contains inline command expansions (!\`...\`), the permission
  * system must:
  *
  * 1. Emit skill_load_dynamic:<id>@<hash> / skill_load_dynamic:<id> candidates
@@ -17,8 +16,6 @@ import { mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
-import { _setOverridesForTesting } from "../config/assistant-feature-flags.js";
-
 // ── Mock setup (must be before any imports from the project) ──────────────
 
 const testDir = process.env.VELLUM_WORKSPACE_DIR!;
@@ -48,7 +45,6 @@ mock.module("../config/loader.js", () => ({
   getConfig: () => testConfig,
   loadConfig: () => testConfig,
   invalidateConfigCache: () => {},
-  saveConfig: () => {},
   loadRawConfig: () => ({}),
   saveRawConfig: () => {},
   getNestedValue: () => undefined,
@@ -67,12 +63,13 @@ mockIpcResponse("classify_risk", {
 });
 mockIpcResponse("get_global_thresholds", {
   interactive: "low",
-  background: "medium",
+  autonomous: "medium",
   headless: "none",
 });
 
 // ── Imports (after mocks) ─────────────────────────────────────────────────
 
+import { _setOverridesForTesting } from "../config/assistant-feature-flags.js";
 import { check, generateAllowlistOptions } from "../permissions/checker.js";
 import { clearRiskCache } from "../permissions/checker.js";
 import { _clearGlobalCacheForTesting } from "../permissions/gateway-threshold-reader.js";
@@ -120,13 +117,10 @@ describe("inline-command skill_load permissions", () => {
     _clearGlobalCacheForTesting();
     mockIpcResponse("get_global_thresholds", {
       interactive: "low",
-      background: "medium",
+      autonomous: "medium",
       headless: "none",
     });
     testConfig.skills = { load: { extraDirs: [] } };
-    _setOverridesForTesting({
-      "inline-skill-commands": true,
-    });
     try {
       rmSync(join(testDir, "protected", "trust.json"));
     } catch {
@@ -159,7 +153,7 @@ describe("inline-command skill_load permissions", () => {
       writeDynamicSkill("dynamic-strict", "Dynamic Strict Skill");
       mockIpcResponse("get_global_thresholds", {
         interactive: "none",
-        background: "none",
+        autonomous: "none",
         headless: "none",
       });
       _clearGlobalCacheForTesting();
@@ -188,7 +182,6 @@ describe("inline-command skill_load permissions", () => {
       );
       expect(result.decision).toBe("allow");
     });
-
   });
 
   // ── Feature flag disabled ────────────────────────────────────────────
@@ -253,5 +246,4 @@ describe("inline-command skill_load permissions", () => {
       }
     });
   });
-
 });

package/src/__tests__/install-skill-routing.test.ts

@@ -141,12 +141,6 @@ import { installSkill } from "../daemon/handlers/skills.js";
 // Helpers
 // ---------------------------------------------------------------------------
 
-const dummyCtx = {
-  debounceTimers: { schedule: () => {} },
-  setSuppressConfigReload: () => {},
-  updateConfigFingerprint: () => {},
-  broadcast: () => {},
-} as unknown as Parameters<typeof installSkill>[1];
 
 // ---------------------------------------------------------------------------
 // Tests
@@ -178,7 +172,6 @@ describe("installSkill routing", () => {
         slug: "vercel-labs/agent-skills/react-best-practices",
         origin: "skillssh",
       },
-      dummyCtx,
     );
 
     expect(result.success).toBe(true);
@@ -196,7 +189,7 @@ describe("installSkill routing", () => {
   });
 
   test("install without origin falls through to clawhub for simple slugs", async () => {
-    const result = await installSkill({ slug: "some-clawhub-skill" }, dummyCtx);
+    const result = await installSkill({ slug: "some-clawhub-skill" });
 
     expect(result.success).toBe(true);
     expect(mockClawhubInstall).toHaveBeenCalledTimes(1);
@@ -210,7 +203,6 @@ describe("installSkill routing", () => {
   test("install with origin: 'clawhub' routes directly to clawhub without trying skills.sh", async () => {
     const result = await installSkill(
       { slug: "my-skill", origin: "clawhub" },
-      dummyCtx,
     );
 
     expect(result.success).toBe(true);
@@ -221,7 +213,6 @@ describe("installSkill routing", () => {
   test("multi-segment slug without explicit origin auto-routes to skills.sh", async () => {
     const result = await installSkill(
       { slug: "owner/repo/my-skill" },
-      dummyCtx,
     );
 
     expect(result.success).toBe(true);
@@ -242,7 +233,6 @@ describe("installSkill routing", () => {
     // should override the auto-detection and go to clawhub
     const result = await installSkill(
       { slug: "owner/repo/my-skill", origin: "clawhub" },
-      dummyCtx,
     );
 
     expect(result.success).toBe(true);
@@ -263,7 +253,6 @@ describe("installSkill routing", () => {
 
     const result = await installSkill(
       { slug: "bundled-skill", origin: "skillssh" },
-      dummyCtx,
     );
 
     expect(result.success).toBe(true);
@@ -282,7 +271,6 @@ describe("installSkill routing", () => {
         slug: "owner/repo/nonexistent-skill",
         origin: "skillssh",
       },
-      dummyCtx,
     );
 
     expect(result.success).toBe(false);

package/src/__tests__/integration-status.test.ts

@@ -5,8 +5,9 @@ import { credentialKey } from "../security/credential-key.js";
 const secureKeyValues = new Map<string, string>();
 let mockTwilioAccountSid: string | undefined;
 
-/** Set of providers that should report as connected via isProviderConnected(). */
 const connectedProviders = new Set<string>();
+const managedProviders = new Set<string>();
+const platformConnectedProviders = new Set<string>();
 
 mock.module("../security/secure-keys.js", () => ({
   getSecureKeyAsync: async (account: string) => secureKeyValues.get(account),
@@ -18,21 +19,60 @@ mock.module("../config/loader.js", () => ({
       ? { accountSid: mockTwilioAccountSid }
       : undefined,
   }),
+  getConfig: () => ({ services: {} }),
+}));
+
+mock.module("../config/schemas/services.js", () => ({
+  getServiceMode: (_services: unknown, key: string) =>
+    managedProviders.has(key) ? "managed" : "your-own",
+  ServicesSchema: { shape: { google: true, slack: true } },
 }));
 
 mock.module("../oauth/oauth-store.js", () => ({
-  isProviderConnected: (provider: string) => connectedProviders.has(provider),
+  isProviderConnected: (provider: string) =>
+    Promise.resolve(connectedProviders.has(provider)),
   getConnectionByProvider: (provider: string) =>
     connectedProviders.has(provider)
       ? { id: `conn-${provider}`, status: "active" }
       : undefined,
+  getProvider: (provider: string) => {
+    const managedKeys: Record<string, string> = {
+      google: "google",
+      slack: "slack",
+    };
+    return managedKeys[provider]
+      ? { managedServiceConfigKey: managedKeys[provider] }
+      : undefined;
+  },
+}));
+
+mock.module("../platform/client.js", () => ({
+  VellumPlatformClient: {
+    create: async () => ({
+      platformAssistantId: "test-assistant",
+      fetch: async (path: string) => {
+        const url = new URL(`http://localhost${path}`);
+        const provider = url.searchParams.get("provider");
+        const hasConnections =
+          provider && platformConnectedProviders.has(provider);
+        return {
+          ok: true,
+          json: async () => (hasConnections ? [{ id: "conn-1" }] : []),
+        };
+      },
+    }),
+  },
 }));
 
-/** Mark a provider as fully connected (active row + access token). */
 function setOAuthConnected(provider: string): void {
   connectedProviders.add(provider);
 }
 
+function setPlatformConnected(provider: string, configKey: string): void {
+  managedProviders.add(configKey);
+  platformConnectedProviders.add(provider);
+}
+
 const { getIntegrationSummary, formatIntegrationSummary, hasCapability } =
   await import("../schedule/integration-status.js");
 
@@ -40,6 +80,8 @@ describe("integration-status", () => {
   beforeEach(() => {
     secureKeyValues.clear();
     connectedProviders.clear();
+    managedProviders.clear();
+    platformConnectedProviders.clear();
     mockTwilioAccountSid = undefined;
   });
 
@@ -99,7 +141,6 @@ describe("integration-status", () => {
     });
 
     test("Telegram disconnected when no connection record exists", async () => {
-      // No oauth_connection record for telegram — should be disconnected
       const summary = await getIntegrationSummary();
       const telegram = summary.find(
         (s: { name: string }) => s.name === "Telegram",
@@ -153,7 +194,6 @@ describe("integration-status", () => {
     });
 
     test("returns false when no connection record exists for category integrations", async () => {
-      // No oauth_connection record for telegram — should not count as connected
       expect(await hasCapability("messaging")).toBe(false);
     });
 
@@ -166,4 +206,44 @@ describe("integration-status", () => {
       expect(await hasCapability("email")).toBe(true);
     });
   });
+
+  describe("managed mode", () => {
+    test("Gmail shows connected when platform has active connection", async () => {
+      setPlatformConnected("google", "google");
+
+      const summary = await getIntegrationSummary();
+      const gmail = summary.find((s: { name: string }) => s.name === "Gmail");
+      expect(gmail?.connected).toBe(true);
+    });
+
+    test("Gmail shows disconnected when managed but no platform connection", async () => {
+      managedProviders.add("google");
+
+      const summary = await getIntegrationSummary();
+      const gmail = summary.find((s: { name: string }) => s.name === "Gmail");
+      expect(gmail?.connected).toBe(false);
+    });
+
+    test("Slack shows connected when platform has active connection", async () => {
+      setPlatformConnected("slack", "slack");
+
+      const summary = await getIntegrationSummary();
+      const slack = summary.find((s: { name: string }) => s.name === "Slack");
+      expect(slack?.connected).toBe(true);
+    });
+
+    test("formatIntegrationSummary reflects managed connections", async () => {
+      setPlatformConnected("google", "google");
+      setPlatformConnected("slack", "slack");
+
+      const result = await formatIntegrationSummary();
+      expect(result).toContain("Gmail \u2713");
+      expect(result).toContain("Slack \u2713");
+    });
+
+    test("hasCapability returns true for managed email connection", async () => {
+      setPlatformConnected("google", "google");
+      expect(await hasCapability("email")).toBe(true);
+    });
+  });
 });

package/src/__tests__/intent-routing.test.ts

@@ -36,7 +36,6 @@ mock.module("../config/loader.js", () => ({
   }),
   loadConfig: () => ({}),
   loadRawConfig: () => ({}),
-  saveConfig: () => {},
   saveRawConfig: () => {},
   invalidateConfigCache: () => {},
   getNestedValue: () => undefined,