@vellumai/assistant 0.7.0 → 0.7.2

package/src/__tests__/provider-managed-proxy-integration.test.ts

@@ -8,6 +8,8 @@ import { credentialKey } from "../security/credential-key.js";
 // assertions. Must be before importing the registry.
 // ---------------------------------------------------------------------------
 let lastGeminiConstructorOpts: Record<string, unknown> | null = null;
+let lastGeminiGenerateContentStreamParams: Record<string, unknown> | null =
+  null;
 
 mock.module("@google/genai", () => ({
   GoogleGenAI: class MockGoogleGenAI {
@@ -15,11 +17,14 @@ mock.module("@google/genai", () => ({
       lastGeminiConstructorOpts = opts;
     }
     models = {
-      generateContentStream: async () => ({
-        [Symbol.asyncIterator]: async function* () {
-          /* no chunks */
-        },
-      }),
+      generateContentStream: async (params: Record<string, unknown>) => {
+        lastGeminiGenerateContentStreamParams = params;
+        return {
+          [Symbol.asyncIterator]: async function* () {
+            /* no chunks */
+          },
+        };
+      },
     };
   },
   ApiError: class FakeApiError extends Error {
@@ -40,6 +45,7 @@ mock.module("@google/genai", () => ({
 let mockPlatformBaseUrl = "";
 let mockAssistantApiKey: string | null = null;
 let mockProviderKeys: Record<string, string> = {};
+let mockLlmConfig: Record<string, unknown> = {};
 
 mock.module("../config/env.js", () => ({
   getPlatformBaseUrl: () => mockPlatformBaseUrl,
@@ -54,6 +60,14 @@ mock.module("../security/secure-keys.js", () => ({
   },
 }));
 
+mock.module("../config/loader.js", () => ({
+  getConfig: () => ({
+    llm: mockLlmConfig,
+    services: { inference: { mode: "your-own" } },
+  }),
+}));
+
+import { LLMSchema } from "../config/schemas/llm.js";
 import type { ProvidersConfig } from "../providers/registry.js";
 import {
   getProvider,
@@ -103,13 +117,25 @@ function disableManagedProxy() {
   mockAssistantApiKey = null;
 }
 
+type ProviderWithClientBaseUrl = Record<string, unknown> & {
+  client: { baseURL: string };
+};
+
+function unwrapInnermostProvider(provider: unknown): ProviderWithClientBaseUrl {
+  let current = provider as Record<string, unknown>;
+  while (current.inner) {
+    current = current.inner as Record<string, unknown>;
+  }
+  return current as ProviderWithClientBaseUrl;
+}
+
 /**
  * Set mock secure keys with a user key for every provider in `names`.
  */
 function setUserKeysFor(...names: string[]): void {
   mockProviderKeys = {};
   for (const n of names) {
-    mockProviderKeys[n] = `user-key-${n}`;
+    mockProviderKeys[credentialKey(n, "api_key")] = `user-key-${n}`;
   }
 }
 
@@ -121,6 +147,8 @@ beforeEach(() => {
   disableManagedProxy();
   mockProviderKeys = {};
   lastGeminiConstructorOpts = null;
+  lastGeminiGenerateContentStreamParams = null;
+  mockLlmConfig = LLMSchema.parse({}) as Record<string, unknown>;
 });
 
 describe("managed proxy integration — credential precedence", () => {
@@ -198,12 +226,7 @@ describe("managed proxy integration — credential precedence", () => {
 
       const provider = getProvider("anthropic");
 
-      // Unwrap RetryProvider → AnthropicProvider to inspect the Anthropic
-      // SDK client's baseURL. RetryProvider stores the inner provider as
-      // private `inner` and AnthropicProvider stores the SDK client as
-      // private `client`.
-      const retryInner = (provider as any).inner;
-      const anthropicClient = (retryInner as any).client;
+      const anthropicClient = unwrapInnermostProvider(provider).client;
 
       expect(anthropicClient).toBeDefined();
       const baseURL: string = anthropicClient.baseURL;
@@ -217,10 +240,7 @@ describe("managed proxy integration — credential precedence", () => {
 
       const provider = getProvider("openai");
 
-      // Unwrap RetryProvider → OpenAIResponsesProvider to inspect the OpenAI
-      // SDK client's baseURL.
-      const retryInner = (provider as any).inner;
-      const openaiClient = (retryInner as any).client;
+      const openaiClient = unwrapInnermostProvider(provider).client;
 
       expect(openaiClient).toBeDefined();
       const baseURL: string = openaiClient.baseURL;
@@ -239,6 +259,90 @@ describe("managed proxy integration — credential precedence", () => {
       expect(httpOptions).toBeDefined();
       expect(httpOptions!.baseUrl).toContain("/v1/runtime-proxy/gemini");
     });
+
+    test("managed gemini receives attribution headers outside request JSON", async () => {
+      enableManagedProxy();
+      mockProviderKeys = {};
+      mockLlmConfig = LLMSchema.parse({
+        default: { provider: "gemini", model: "gemini-3.1-pro" },
+        profiles: {
+          "conversation-profile": {
+            model: "gemini-3.1-flash",
+            source: "user",
+          },
+        },
+        callSites: {
+          mainAgent: {},
+        },
+      }) as Record<string, unknown>;
+      await initializeProviders(
+        makeProvidersConfig("gemini", "gemini-3.1-pro"),
+      );
+
+      const provider = getProvider("gemini");
+      const response = await provider.sendMessage(
+        [{ role: "user", content: [{ type: "text", text: "hello" }] }],
+        undefined,
+        undefined,
+        {
+          config: {
+            callSite: "mainAgent",
+            overrideProfile: "conversation-profile",
+          },
+        },
+      );
+
+      const constructorHttpOptions = lastGeminiConstructorOpts!.httpOptions as
+        | { baseUrl?: string }
+        | undefined;
+      expect(constructorHttpOptions?.baseUrl).toContain(
+        "/v1/runtime-proxy/gemini",
+      );
+      const sentConfig = lastGeminiGenerateContentStreamParams!.config as {
+        httpOptions?: { headers?: Record<string, string> };
+        usageAttributionHeaders?: Record<string, string>;
+      };
+      expect(sentConfig.httpOptions?.headers).toEqual({
+        "X-Vellum-LLM-Call-Site": "mainAgent",
+        "X-Vellum-Inference-Profile": "conversation-profile",
+        "X-Vellum-Inference-Profile-Source": "conversation",
+        "X-Vellum-Resolved-Provider": "gemini",
+        "X-Vellum-Resolved-Model": "gemini-3.1-flash",
+      });
+      expect(sentConfig.usageAttributionHeaders).toBeUndefined();
+
+      const rawRequest = response.rawRequest as {
+        config?: Record<string, unknown>;
+      };
+      expect(rawRequest.config?.usageAttributionHeaders).toBeUndefined();
+      expect(rawRequest.config?.httpOptions).toBeUndefined();
+    });
+
+    test("managed gemini omits attribution headers without callSite", async () => {
+      enableManagedProxy();
+      mockProviderKeys = {};
+      mockLlmConfig = LLMSchema.parse({
+        default: { provider: "gemini", model: "gemini-3.1-pro" },
+      }) as Record<string, unknown>;
+      await initializeProviders(
+        makeProvidersConfig("gemini", "gemini-3.1-pro"),
+      );
+
+      const provider = getProvider("gemini");
+      await provider.sendMessage(
+        [{ role: "user", content: [{ type: "text", text: "hello" }] }],
+        undefined,
+        undefined,
+        { config: { model: "gemini-3.1-pro" } },
+      );
+
+      const sentConfig = lastGeminiGenerateContentStreamParams!.config as {
+        httpOptions?: { headers?: Record<string, string> };
+        usageAttributionHeaders?: Record<string, string>;
+      };
+      expect(sentConfig.httpOptions?.headers).toBeUndefined();
+      expect(sentConfig.usageAttributionHeaders).toBeUndefined();
+    });
   });
 
   describe("neither user keys nor managed context → providers not initialized", () => {
@@ -318,7 +422,7 @@ describe("managed proxy integration — ollama exclusion", () => {
 
   test("ollama registers with explicit API key", async () => {
     enableManagedProxy();
-    mockProviderKeys = { ollama: "ollama-key" };
+    mockProviderKeys = { [credentialKey("ollama", "api_key")]: "ollama-key" };
     await initializeProviders(makeProvidersConfig("anthropic", "test-model"));
     expect(listProviders()).toContain("ollama");
   });
@@ -331,6 +435,38 @@ describe("managed proxy integration — ollama exclusion", () => {
   });
 });
 
+describe("config mode flip → provider reinit", () => {
+  test("re-running initializeProviders after managed→your-own flip switches gemini from managed-proxy to user-key", async () => {
+    // Phase 1: managed mode without user key → gemini registered as managed-proxy.
+    // This is the pre-patch state before PATCH /v1/config is called.
+    enableManagedProxy();
+    mockProviderKeys = {};
+    await initializeProviders(makeProvidersConfig("gemini", "gemini-2.5-pro"));
+    expect(getProviderRoutingSource("gemini")).toBe("managed-proxy");
+
+    // Phase 2: user has now saved a key (POST /v1/secrets), then PATCHed config
+    // to mode=your-own. handlePatchConfig calls initializeProviders(getConfig())
+    // after saving, which should re-register gemini using the user key.
+    setUserKeysFor("gemini");
+    await initializeProviders(makeProvidersConfig("gemini", "gemini-2.5-pro"));
+    expect(getProviderRoutingSource("gemini")).toBe("user-key");
+  });
+
+  test("without reinit after config patch, gemini source remains stale managed-proxy", async () => {
+    // Demonstrates the bug: if initializeProviders is NOT called after saving
+    // config, the routing source stays managed-proxy even after mode flip.
+    enableManagedProxy();
+    mockProviderKeys = {};
+    await initializeProviders(makeProvidersConfig("gemini", "gemini-2.5-pro"));
+    expect(getProviderRoutingSource("gemini")).toBe("managed-proxy");
+
+    // Flip mode but do NOT re-initialize providers (simulates skipping reinit).
+    setUserKeysFor("gemini");
+    // Source stays managed-proxy because initializeProviders was not called.
+    expect(getProviderRoutingSource("gemini")).toBe("managed-proxy");
+  });
+});
+
 describe("managed proxy integration — constants integrity", () => {
   test("anthropic, openai, and gemini have metadata with managed=true and a proxyPath", () => {
     for (const provider of ["anthropic", "openai", "gemini"]) {

package/src/__tests__/provider-send-message-override-profile.test.ts

@@ -28,6 +28,7 @@ mock.module("../config/loader.js", () => ({
 
 import { LLMSchema } from "../config/schemas/llm.js";
 import { CallSiteRoutingProvider } from "../providers/call-site-routing.js";
+import { CallSiteConfiguredProvider } from "../providers/provider-send-message.js";
 import { RetryProvider } from "../providers/retry.js";
 import type {
   Message,
@@ -59,6 +60,55 @@ beforeEach(() => {
 });
 
 describe("SendMessageOptions.config.overrideProfile", () => {
+  test("CallSiteConfiguredProvider injects the resolving call site when callers omit it", async () => {
+    let captured: SendMessageOptions | undefined;
+    const inner: Provider = {
+      name: "anthropic",
+      async sendMessage(
+        _messages: Message[],
+        _tools?: ToolDefinition[],
+        _systemPrompt?: string,
+        options?: SendMessageOptions,
+      ): Promise<ProviderResponse> {
+        captured = options;
+        return makeResponse("anthropic");
+      },
+    };
+
+    const provider = new CallSiteConfiguredProvider(inner, "mainAgent");
+    await provider.sendMessage(DUMMY_MESSAGES, undefined, undefined, {
+      config: { model: "claude-opus-4-7" },
+    });
+
+    expect(captured?.config).toMatchObject({
+      callSite: "mainAgent",
+      model: "claude-opus-4-7",
+    });
+  });
+
+  test("CallSiteConfiguredProvider preserves explicit per-call call sites", async () => {
+    let captured: SendMessageOptions | undefined;
+    const inner: Provider = {
+      name: "anthropic",
+      async sendMessage(
+        _messages: Message[],
+        _tools?: ToolDefinition[],
+        _systemPrompt?: string,
+        options?: SendMessageOptions,
+      ): Promise<ProviderResponse> {
+        captured = options;
+        return makeResponse("anthropic");
+      },
+    };
+
+    const provider = new CallSiteConfiguredProvider(inner, "mainAgent");
+    await provider.sendMessage(DUMMY_MESSAGES, undefined, undefined, {
+      config: { callSite: "conversationTitle" },
+    });
+
+    expect(captured?.config?.callSite).toBe("conversationTitle");
+  });
+
   test("RetryProvider resolves model from named profile when overrideProfile is set", async () => {
     setLlmConfig({
       default: { provider: "anthropic", model: "claude-opus-4-7" },

package/src/__tests__/provider-usage-tracking.test.ts

@@ -0,0 +1,208 @@
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+import { makeMockLogger } from "./helpers/mock-logger.js";
+
+let mockLlmConfig: Record<string, unknown> = {};
+
+mock.module("../config/loader.js", () => ({
+  getConfig: () => ({
+    llm: mockLlmConfig,
+  }),
+}));
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () => makeMockLogger(),
+}));
+
+import { LLMSchema } from "../config/schemas/llm.js";
+import { getDb } from "../memory/db-connection.js";
+import { initializeDb } from "../memory/db-init.js";
+import { listUsageEvents } from "../memory/llm-usage-store.js";
+import { CallSiteConfiguredProvider } from "../providers/provider-send-message.js";
+import type { Provider, ProviderResponse } from "../providers/types.js";
+import { UsageTrackingProvider } from "../providers/usage-tracking.js";
+
+initializeDb();
+
+function setLlmConfig(raw: unknown): void {
+  mockLlmConfig = LLMSchema.parse(raw) as Record<string, unknown>;
+}
+
+function makeProvider(response: ProviderResponse): Provider {
+  return {
+    name: "openai",
+    async sendMessage() {
+      return response;
+    },
+  };
+}
+
+describe("UsageTrackingProvider", () => {
+  beforeEach(() => {
+    const db = getDb();
+    db.run(`DELETE FROM llm_usage_events`);
+    setLlmConfig({
+      default: {
+        provider: "anthropic",
+        model: "claude-opus-4-7",
+      },
+      profiles: {
+        balanced: {
+          provider: "openai",
+          model: "gpt-5.4-mini",
+        },
+      },
+      activeProfile: "balanced",
+      pricingOverrides: [],
+    });
+  });
+
+  test("auto-records attributed non-conversation provider usage", async () => {
+    const provider = new UsageTrackingProvider(
+      makeProvider({
+        content: [{ type: "text", text: "Title" }],
+        model: "gpt-5.4-mini",
+        usage: {
+          inputTokens: 1_000,
+          outputTokens: 2_000,
+        },
+        stopReason: "end_turn",
+      }),
+    );
+
+    await provider.sendMessage(
+      [{ role: "user", content: [{ type: "text", text: "Summarize" }] }],
+      undefined,
+      undefined,
+      {
+        config: {
+          callSite: "conversationTitle",
+        },
+      },
+    );
+
+    const events = listUsageEvents();
+    expect(events).toHaveLength(1);
+    expect(events[0]).toMatchObject({
+      actor: "llm_call_site",
+      conversationId: null,
+      runId: null,
+      requestId: null,
+      provider: "openai",
+      model: "gpt-5.4-mini",
+      inputTokens: 1_000,
+      outputTokens: 2_000,
+      cacheCreationInputTokens: 0,
+      cacheReadInputTokens: 0,
+      callSite: "conversationTitle",
+      inferenceProfile: "balanced",
+      inferenceProfileSource: "active",
+      pricingStatus: "priced",
+    });
+    expect(events[0].estimatedCostUsd ?? 0).toBeCloseTo(0.00975, 10);
+  });
+
+  test("uses the transport provider when resolved attribution points elsewhere", async () => {
+    setLlmConfig({
+      default: {
+        provider: "openai",
+        model: "gpt-5.4-mini",
+      },
+      callSites: {
+        conversationTitle: {
+          provider: "fireworks",
+          model: "accounts/fireworks/models/deepseek-v3",
+        },
+      },
+      pricingOverrides: [],
+    });
+
+    const provider = new UsageTrackingProvider(
+      makeProvider({
+        content: [{ type: "text", text: "Title" }],
+        model: "gpt-5.4-mini",
+        usage: {
+          inputTokens: 1_000,
+          outputTokens: 2_000,
+        },
+        stopReason: "end_turn",
+      }),
+    );
+
+    await provider.sendMessage(
+      [{ role: "user", content: [{ type: "text", text: "Summarize" }] }],
+      undefined,
+      undefined,
+      {
+        config: {
+          callSite: "conversationTitle",
+        },
+      },
+    );
+
+    const events = listUsageEvents();
+    expect(events).toHaveLength(1);
+    expect(events[0]).toMatchObject({
+      provider: "openai",
+      model: "gpt-5.4-mini",
+      callSite: "conversationTitle",
+      pricingStatus: "priced",
+    });
+  });
+
+  test("does not record calls without a call site", async () => {
+    const provider = new UsageTrackingProvider(
+      makeProvider({
+        content: [{ type: "text", text: "ok" }],
+        model: "gpt-5.4-mini",
+        usage: {
+          inputTokens: 1,
+          outputTokens: 1,
+        },
+        stopReason: "end_turn",
+      }),
+    );
+
+    await provider.sendMessage([
+      { role: "user", content: [{ type: "text", text: "Hello" }] },
+    ]);
+
+    expect(listUsageEvents()).toHaveLength(0);
+  });
+
+  test("records calls from providers resolved for a call site even when send options omit it", async () => {
+    const provider = new CallSiteConfiguredProvider(
+      new UsageTrackingProvider(
+        makeProvider({
+          content: [{ type: "text", text: "ok" }],
+          model: "gpt-5.4-mini",
+          usage: {
+            inputTokens: 100,
+            outputTokens: 50,
+          },
+          stopReason: "end_turn",
+        }),
+      ),
+      "mainAgent",
+    );
+
+    await provider.sendMessage(
+      [{ role: "user", content: [{ type: "text", text: "Hello" }] }],
+      undefined,
+      undefined,
+      {
+        config: {
+          model: "gpt-5.4-mini",
+        },
+      },
+    );
+
+    const events = listUsageEvents();
+    expect(events).toHaveLength(1);
+    expect(events[0]).toMatchObject({
+      callSite: "mainAgent",
+      provider: "openai",
+      model: "gpt-5.4-mini",
+    });
+  });
+});

package/src/__tests__/public-ingress-urls.test.ts

@@ -26,16 +26,49 @@ mock.module("../util/logger.js", () => ({
 }));
 
 import { setIngressPublicBaseUrl } from "../config/env.js";
+import { IngressConfigSchema } from "../config/schemas/ingress.js";
 import {
   getOAuthCallbackUrl,
   getPublicBaseUrl,
   getTelegramWebhookUrl,
   getTwilioConnectActionUrl,
+  getTwilioMediaStreamUrl,
   getTwilioRelayUrl,
   getTwilioStatusCallbackUrl,
   getTwilioVoiceWebhookUrl,
 } from "../inbound/public-ingress-urls.js";
 
+// ---------------------------------------------------------------------------
+// IngressConfigSchema
+// ---------------------------------------------------------------------------
+
+describe("IngressConfigSchema", () => {
+  test("accepts an absolute HTTP(S) public base URL", () => {
+    const result = IngressConfigSchema.parse({
+      publicBaseUrl: "https://example.com",
+    });
+
+    expect(result.publicBaseUrl).toBe("https://example.com");
+  });
+
+  test("accepts an empty public base URL", () => {
+    const result = IngressConfigSchema.parse({
+      publicBaseUrl: "",
+    });
+
+    expect(result.publicBaseUrl).toBe("");
+  });
+
+  test("rejects a relative public base URL", () => {
+    expect(() =>
+      IngressConfigSchema.parse({
+        publicBaseUrl: "/webhooks/twilio",
+      }),
+    ).toThrow(/ingress\.publicBaseUrl must be an absolute URL/);
+  });
+
+});
+
 // ---------------------------------------------------------------------------
 // getPublicBaseUrl — fallback chain
 // ---------------------------------------------------------------------------
@@ -155,6 +188,70 @@ describe("getPublicBaseUrl", () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// Twilio-specific public base URL selection
+// ---------------------------------------------------------------------------
+
+describe("Twilio URL builders use publicBaseUrl", () => {
+  beforeEach(() => {
+    setIngressPublicBaseUrl(undefined);
+  });
+
+  afterEach(() => {
+    setIngressPublicBaseUrl(undefined);
+  });
+
+  test("Twilio URL builders use ingress.publicBaseUrl", () => {
+    const config = {
+      ingress: {
+        publicBaseUrl: "  https://example.com///  ",
+      },
+    };
+
+    expect(getTwilioVoiceWebhookUrl(config, "session-123")).toBe(
+      "https://example.com/webhooks/twilio/voice?callSessionId=session-123",
+    );
+    expect(getTwilioStatusCallbackUrl(config)).toBe(
+      "https://example.com/webhooks/twilio/status",
+    );
+    expect(getTwilioConnectActionUrl(config)).toBe(
+      "https://example.com/webhooks/twilio/connect-action",
+    );
+    expect(getTwilioRelayUrl(config)).toBe(
+      "wss://example.com/webhooks/twilio/relay",
+    );
+    expect(getTwilioMediaStreamUrl(config)).toBe(
+      "wss://example.com/webhooks/twilio/media-stream",
+    );
+  });
+
+  test("Twilio URL builders fall back to module-level ingress state", () => {
+    setIngressPublicBaseUrl("https://ingress-env.example.com");
+
+    expect(
+      getTwilioStatusCallbackUrl({
+        ingress: { publicBaseUrl: "" },
+      }),
+    ).toBe("https://ingress-env.example.com/webhooks/twilio/status");
+  });
+
+  test("all URL builders share the same publicBaseUrl", () => {
+    const config = {
+      ingress: {
+        publicBaseUrl: "https://example.com",
+      },
+    };
+
+    expect(getPublicBaseUrl(config)).toBe("https://example.com");
+    expect(getOAuthCallbackUrl(config)).toBe(
+      "https://example.com/webhooks/oauth/callback",
+    );
+    expect(getTelegramWebhookUrl(config)).toBe(
+      "https://example.com/webhooks/telegram",
+    );
+  });
+});
+
 // ---------------------------------------------------------------------------
 // getTwilioVoiceWebhookUrl
 // ---------------------------------------------------------------------------

package/src/__tests__/reaction-persistence.test.ts

@@ -26,6 +26,11 @@ mock.module("../config/env.js", () => ({
   getGatewayInternalBaseUrl: () => "http://127.0.0.1:7830",
 }));
 
+const _conversationMocks = new Map<string, unknown>();
+mock.module("../daemon/conversation-store.js", () => ({
+  findConversation: (id: string) => _conversationMocks.get(id),
+}));
+
 mock.module("../tools/credentials/metadata-store.js", () => ({
   getCredentialMetadata: () => undefined,
   upsertCredentialMetadata: () => {},
@@ -39,10 +44,7 @@ mock.module("../runtime/gateway-client.js", () => ({
 
 import { eq } from "drizzle-orm";
 
-import {
-  createGuardianBinding,
-  upsertContactChannel,
-} from "../contacts/contacts-write.js";
+import { upsertContactChannel } from "../contacts/contacts-write.js";
 import type { Conversation } from "../daemon/conversation.js";
 import { getDb } from "../memory/db-connection.js";
 import { initializeDb } from "../memory/db-init.js";
@@ -62,6 +64,7 @@ import {
   parseSlackReactionCallbackData,
 } from "../runtime/routes/inbound-message-handler.js";
 import { handleChannelInbound } from "./helpers/channel-test-adapter.js";
+import { createGuardianBinding } from "./helpers/create-guardian-binding.js";
 
 initializeDb();
 
@@ -435,12 +438,12 @@ function seedPendingGuardianApprovalForReaction(
   // Register a pending interaction so applyGuardianDecision finds the
   // requester-side hook to drive `allow`.
   const handleConfirmationResponse = mock(() => {});
-  const mockSession = {
+  const _mockSession = {
     handleConfirmationResponse,
     ensureActorScopedHistory: async () => {},
   } as unknown as Conversation;
+  _conversationMocks.set(conversationId, _mockSession);
   pendingInteractions.register(requestId, {
-    conversation: mockSession,
     conversationId,
     kind: "confirmation",
     confirmationDetails: {