@vellumai/assistant 0.7.0 → 0.7.2

package/src/__tests__/skill-script-runner-sandbox.test.ts

@@ -20,8 +20,6 @@ const mockConfig = {
   rateLimit: { maxRequestsPerMinute: 0 },
   secretDetection: {
     enabled: true,
-    action: "warn" as const,
-    entropyThreshold: 4.0,
   },
   auditLog: { retentionDays: 0 },
 };
@@ -30,7 +28,6 @@ mock.module("../config/loader.js", () => ({
   getConfig: () => mockConfig,
   loadConfig: () => mockConfig,
   invalidateConfigCache: () => {},
-  saveConfig: () => {},
   loadRawConfig: () => ({}),
   saveRawConfig: () => {},
   getNestedValue: () => undefined,
@@ -44,15 +41,6 @@ mock.module("../util/logger.js", () => ({
     }),
 }));
 
-// Pass through without actual sandboxing so tests can run bun directly
-mock.module("../tools/terminal/sandbox.js", () => ({
-  wrapCommand: (command: string, _workingDir: string, _config: unknown) => ({
-    command: "bash",
-    args: ["-c", "--", command],
-    sandboxed: false,
-  }),
-}));
-
 import { runSkillToolScript } from "../tools/skills/skill-script-runner.js";
 import type { ToolContext } from "../tools/types.js";
 

package/src/__tests__/skill-tool-factory.test.ts

@@ -269,6 +269,103 @@ describe("createSkillToolsFromManifest", () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// createSkillTool — unknown parameter validation
+// ---------------------------------------------------------------------------
+
+describe("createSkillTool — unknown parameter validation", () => {
+  test("rejects input with unknown parameters", async () => {
+    const hash = computeSkillVersionHash(tempDir);
+    const tool = createSkillTool(
+      makeEntry({ executor: "echo.ts" }),
+      "my-skill",
+      tempDir,
+      hash,
+    );
+
+    const result = await tool.execute(
+      { query: "hello", unsubscribe: true },
+      makeContext(),
+    );
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain('Unknown parameter "unsubscribe"');
+    expect(result.content).toContain("Supported parameters");
+    expect(result.content).toContain('"query"');
+  });
+
+  test("rejects multiple unknown parameters", async () => {
+    const hash = computeSkillVersionHash(tempDir);
+    const tool = createSkillTool(
+      makeEntry({ executor: "echo.ts" }),
+      "my-skill",
+      tempDir,
+      hash,
+    );
+
+    const result = await tool.execute(
+      { query: "hello", foo: 1, bar: 2 },
+      makeContext(),
+    );
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("Unknown parameters");
+    expect(result.content).toContain('"foo"');
+    expect(result.content).toContain('"bar"');
+  });
+
+  test("allows input with only known parameters", async () => {
+    const hash = computeSkillVersionHash(tempDir);
+    const tool = createSkillTool(
+      makeEntry({ executor: "echo.ts" }),
+      "my-skill",
+      tempDir,
+      hash,
+    );
+
+    const result = await tool.execute({ query: "hello" }, makeContext());
+
+    expect(result.isError).toBe(false);
+  });
+
+  test("allows empty input when schema has no required fields", async () => {
+    const hash = computeSkillVersionHash(tempDir);
+    const tool = createSkillTool(
+      makeEntry({
+        executor: "echo.ts",
+        input_schema: {
+          type: "object",
+          properties: { query: { type: "string" } },
+        },
+      }),
+      "my-skill",
+      tempDir,
+      hash,
+    );
+
+    const result = await tool.execute({}, makeContext());
+
+    expect(result.isError).toBe(false);
+  });
+
+  test("skips validation when schema has no properties", async () => {
+    const hash = computeSkillVersionHash(tempDir);
+    const tool = createSkillTool(
+      makeEntry({
+        executor: "echo.ts",
+        input_schema: { type: "object" },
+      }),
+      "my-skill",
+      tempDir,
+      hash,
+    );
+
+    const result = await tool.execute({ anything: "goes" }, makeContext());
+
+    expect(result.isError).toBe(false);
+  });
+});
+
 // ---------------------------------------------------------------------------
 // createSkillTool — expectedSkillVersionHash plumbing
 // ---------------------------------------------------------------------------

package/src/__tests__/skills-file-content-endpoint.test.ts

@@ -278,23 +278,11 @@ mock.module("../daemon/handlers/shared.js", () => ({
 // Imports (after mocks)
 // ---------------------------------------------------------------------------
 
-import type { SkillOperationContext } from "../daemon/handlers/skills.js";
 import {
   _resetFileProvidersForTest,
   getSkillFileContent,
 } from "../daemon/handlers/skills.js";
 
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-
-const dummyCtx = {
-  debounceTimers: { schedule: () => {} },
-  setSuppressConfigReload: () => {},
-  updateConfigFingerprint: () => {},
-  broadcast: () => {},
-} as unknown as SkillOperationContext;
-
 type FetchFn = typeof globalThis.fetch;
 
 let originalFetch: FetchFn;
@@ -375,7 +363,7 @@ describe("getSkillFileContent — installed skill", () => {
     mockResolvedSkills = [installedSkill("my-skill", skillDir)];
     installFetchForbidden();
 
-    const result = await getSkillFileContent("my-skill", "SKILL.md", dummyCtx);
+    const result = await getSkillFileContent("my-skill", "SKILL.md");
     expect("error" in result).toBe(false);
     if ("error" in result) return;
     expect(result.path).toBe("SKILL.md");
@@ -395,7 +383,7 @@ describe("getSkillFileContent — installed skill", () => {
     mockResolvedSkills = [installedSkill("my-skill", skillDir)];
     installFetchForbidden();
 
-    const result = await getSkillFileContent("my-skill", "img.png", dummyCtx);
+    const result = await getSkillFileContent("my-skill", "img.png");
     expect("error" in result).toBe(false);
     if ("error" in result) return;
     expect(result.isBinary).toBe(true);
@@ -410,7 +398,7 @@ describe("getSkillFileContent — installed skill", () => {
     installFetchForbidden();
 
     for (const bad of ["../secrets", "..", "/etc/passwd", "./../escape"]) {
-      const result = await getSkillFileContent("my-skill", bad, dummyCtx);
+      const result = await getSkillFileContent("my-skill", bad);
       expect("error" in result).toBe(true);
       if (!("error" in result)) continue;
       expect(result.status).toBe(400);
@@ -427,7 +415,6 @@ describe("getSkillFileContent — installed skill", () => {
     const result = await getSkillFileContent(
       "my-skill",
       "SKILL.md\0.png",
-      dummyCtx,
     );
     expect("error" in result).toBe(true);
     if (!("error" in result)) return;
@@ -440,7 +427,7 @@ describe("getSkillFileContent — installed skill", () => {
     mockResolvedSkills = [installedSkill("my-skill", skillDir)];
     installFetchForbidden();
 
-    const result = await getSkillFileContent("my-skill", "ghost.txt", dummyCtx);
+    const result = await getSkillFileContent("my-skill", "ghost.txt");
     expect("error" in result).toBe(true);
     if (!("error" in result)) return;
     expect(result.status).toBe(404);
@@ -474,7 +461,6 @@ describe("getSkillFileContent — uninstalled skill (provider chain)", () => {
     const result = await getSkillFileContent(
       "remote-skill",
       "SKILL.md",
-      dummyCtx,
     );
     expect("error" in result).toBe(false);
     if ("error" in result) return;
@@ -495,7 +481,6 @@ describe("getSkillFileContent — uninstalled skill (provider chain)", () => {
     const result = await getSkillFileContent(
       "ghost-skill",
       "SKILL.md",
-      dummyCtx,
     );
     expect("error" in result).toBe(true);
     if (!("error" in result)) return;
@@ -528,7 +513,6 @@ describe("getSkillFileContent — uninstalled skill (provider chain)", () => {
     const result = await getSkillFileContent(
       "owner/repo/my-skill",
       "SKILL.md",
-      dummyCtx,
     );
     expect("error" in result).toBe(false);
     if ("error" in result) return;
@@ -559,7 +543,7 @@ describe("getSkillFileContent — uninstalled skill (provider chain)", () => {
       toSlimSkill: async () => null,
     };
 
-    const result = await getSkillFileContent("cool-tool", "SKILL.md", dummyCtx);
+    const result = await getSkillFileContent("cool-tool", "SKILL.md");
     expect("error" in result).toBe(false);
     if ("error" in result) return;
     expect(result.content).toBe("# clawhub content yo\n");
@@ -581,7 +565,6 @@ describe("getSkillFileContent — uninstalled skill (provider chain)", () => {
     const result = await getSkillFileContent(
       "known-skill",
       "nonexistent.txt",
-      dummyCtx,
     );
     expect("error" in result).toBe(true);
     if (!("error" in result)) return;
@@ -624,7 +607,6 @@ describe("getSkillFileContent — uninstalled skill (provider chain)", () => {
     const result = await getSkillFileContent(
       "simple-slug",
       "SKILL.md",
-      dummyCtx,
     );
     // Should be "File not found" (vellum handled but returned null)
     expect("error" in result).toBe(true);
@@ -647,7 +629,6 @@ describe("getSkillFileContent — skill not found", () => {
     const result = await getSkillFileContent(
       "ghost-skill",
       "SKILL.md",
-      dummyCtx,
     );
     expect("error" in result).toBe(true);
     if (!("error" in result)) return;
@@ -688,7 +669,6 @@ describe("getSkillFileContent — installed skill with missing directory", () =>
     const result = await getSkillFileContent(
       "ghost-installed",
       "SKILL.md",
-      dummyCtx,
     );
 
     expect("error" in result).toBe(true);
@@ -713,7 +693,7 @@ describe("getSkillFileContent — hidden / SKIP_DIRS rejection", () => {
     mockResolvedSkills = [installedSkill("leaky-skill", skillDir)];
     installFetchForbidden();
 
-    const result = await getSkillFileContent("leaky-skill", ".env", dummyCtx);
+    const result = await getSkillFileContent("leaky-skill", ".env");
     expect("error" in result).toBe(true);
     if (!("error" in result)) return;
     expect(result.status).toBe(400);
@@ -737,7 +717,7 @@ describe("getSkillFileContent — hidden / SKIP_DIRS rejection", () => {
       toSlimSkill: async () => null,
     };
 
-    const result = await getSkillFileContent("catalog-leaky", ".env", dummyCtx);
+    const result = await getSkillFileContent("catalog-leaky", ".env");
     expect("error" in result).toBe(true);
     if (!("error" in result)) return;
     expect(result.status).toBe(400);
@@ -753,7 +733,7 @@ describe("getSkillFileContent — hidden / SKIP_DIRS rejection", () => {
     installFetchForbidden();
 
     for (const bad of [".git/config", "docs/.hidden/file.md"]) {
-      const result = await getSkillFileContent("my-skill", bad, dummyCtx);
+      const result = await getSkillFileContent("my-skill", bad);
       expect("error" in result).toBe(true);
       if (!("error" in result)) continue;
       expect(result.status).toBe(400);
@@ -772,7 +752,7 @@ describe("getSkillFileContent — hidden / SKIP_DIRS rejection", () => {
       "__pycache__/cached.pyc",
       "nested/node_modules/mod/index.js",
     ]) {
-      const result = await getSkillFileContent("my-skill", bad, dummyCtx);
+      const result = await getSkillFileContent("my-skill", bad);
       expect("error" in result).toBe(true);
       if (!("error" in result)) continue;
       expect(result.status).toBe(400);
@@ -789,7 +769,6 @@ describe("getSkillFileContent — hidden / SKIP_DIRS rejection", () => {
     const result = await getSkillFileContent(
       "healthy-skill",
       "SKILL.md",
-      dummyCtx,
     );
     expect("error" in result).toBe(false);
     if ("error" in result) return;

package/src/__tests__/skills-files-catalog-fallback.test.ts

@@ -238,12 +238,6 @@ import {
 // Helpers
 // ---------------------------------------------------------------------------
 
-const dummyCtx = {
-  debounceTimers: { schedule: () => {} },
-  setSuppressConfigReload: () => {},
-  updateConfigFingerprint: () => {},
-  broadcast: () => {},
-} as unknown as Parameters<typeof getSkillFiles>[1];
 
 function makeSummary(overrides: Partial<SkillSummary>): SkillSummary {
   return {
@@ -318,7 +312,7 @@ describe("getSkillFiles — provider chain fallback", () => {
       }),
     };
 
-    const result = await getSkillFiles("acme-seo", dummyCtx);
+    const result = await getSkillFiles("acme-seo");
 
     expect("error" in result).toBe(false);
     if ("error" in result) return;
@@ -348,7 +342,7 @@ describe("getSkillFiles — provider chain fallback", () => {
   test("returns 404 when skill is neither installed nor handled by any provider", async () => {
     mockResolvedStates = [];
 
-    const result = await getSkillFiles("ghost-skill", dummyCtx);
+    const result = await getSkillFiles("ghost-skill");
 
     expect("error" in result).toBe(true);
     if (!("error" in result)) return;
@@ -364,7 +358,7 @@ describe("getSkillFiles — provider chain fallback", () => {
       toSlimSkill: async () => null,
     };
 
-    const result = await getSkillFiles("broken-skill", dummyCtx);
+    const result = await getSkillFiles("broken-skill");
 
     expect("error" in result).toBe(true);
     if (!("error" in result)) return;
@@ -404,7 +398,7 @@ describe("getSkillFiles — provider chain fallback", () => {
         },
       ];
 
-      const result = await getSkillFiles("installed-skill", dummyCtx);
+      const result = await getSkillFiles("installed-skill");
 
       expect("error" in result).toBe(false);
       if ("error" in result) return;
@@ -467,7 +461,7 @@ describe("getSkillFiles — provider chain fallback", () => {
       }),
     };
 
-    const result = await getSkillFiles("ghost-installed", dummyCtx);
+    const result = await getSkillFiles("ghost-installed");
 
     expect("error" in result).toBe(true);
     if (!("error" in result)) return;
@@ -491,7 +485,7 @@ describe("getSkillFiles — provider chain fallback", () => {
       }),
     };
 
-    const result = await getSkillFiles("plain-skill", dummyCtx);
+    const result = await getSkillFiles("plain-skill");
 
     expect("error" in result).toBe(false);
     if ("error" in result) return;
@@ -516,7 +510,7 @@ describe("getSkillFiles — provider chain fallback", () => {
       }),
     };
 
-    const result = await getSkillFiles("fancy-skill", dummyCtx);
+    const result = await getSkillFiles("fancy-skill");
 
     expect("error" in result).toBe(false);
     if ("error" in result) return;
@@ -559,7 +553,7 @@ describe("getSkillFiles — provider chain fallback", () => {
       }),
     };
 
-    const result = await getSkillFiles("owner/repo/my-skill", dummyCtx);
+    const result = await getSkillFiles("owner/repo/my-skill");
 
     expect("error" in result).toBe(false);
     if ("error" in result) return;
@@ -621,7 +615,7 @@ describe("getSkillFiles — provider chain fallback", () => {
       }),
     };
 
-    const result = await getSkillFiles("cool-tool", dummyCtx);
+    const result = await getSkillFiles("cool-tool");
 
     expect("error" in result).toBe(false);
     if ("error" in result) return;
@@ -635,7 +629,7 @@ describe("getSkillFiles — provider chain fallback", () => {
     mockSkillsshProvider = makeNoopProvider("skillssh");
     mockClawhubProvider = makeNoopProvider("clawhub");
 
-    const result = await getSkillFiles("unknown-origin-skill", dummyCtx);
+    const result = await getSkillFiles("unknown-origin-skill");
 
     expect("error" in result).toBe(true);
     if (!("error" in result)) return;
@@ -715,7 +709,7 @@ describe("getSkillFiles — provider chain fallback", () => {
       }),
     };
 
-    const result = await getSkillFiles("contested-skill", dummyCtx);
+    const result = await getSkillFiles("contested-skill");
 
     expect("error" in result).toBe(false);
     if ("error" in result) return;

package/src/__tests__/slack-channel-config.test.ts

@@ -61,7 +61,6 @@ mock.module("../config/loader.js", () => ({
   saveRawConfig: (raw: Record<string, unknown>) => {
     configStore = structuredClone(raw);
   },
-  saveConfig: () => {},
   invalidateConfigCache: () => {},
   setNestedValue,
 }));
@@ -438,11 +437,7 @@ describe("Slack channel config handler", () => {
   });
 
   test("POST rejects user token with invalid prefix", async () => {
-    const result = await setSlackChannelConfig(
-      undefined,
-      undefined,
-      "abc-123",
-    );
+    const result = await setSlackChannelConfig(undefined, undefined, "abc-123");
     expect(result.success).toBe(false);
     expect(result.error).toContain("xoxp-");
     // Nothing was stored.
@@ -660,9 +655,7 @@ describe("Slack channel config handler", () => {
     expect(
       await getSecureKeyAsync(credentialKey("slack_channel", "user_token")),
     ).toBe("xoxp-still-valid");
-    expect(
-      getCredentialMetadata("slack_channel", "user_token"),
-    ).toBeDefined();
+    expect(getCredentialMetadata("slack_channel", "user_token")).toBeDefined();
 
     // No warning about user_token removal — nothing was removed.
     expect(result.warning ?? "").not.toContain("User token");
@@ -697,10 +690,10 @@ describe("Slack channel config handler", () => {
       }
       if (auth === "Bearer xoxp-workspace-a") {
         // Workspace mismatch — handler will try to clear the user_token.
-        return new Response(
-          JSON.stringify({ ok: true, team_id: "T_A" }),
-          { status: 200, headers: { "content-type": "application/json" } },
-        );
+        return new Response(JSON.stringify({ ok: true, team_id: "T_A" }), {
+          status: 200,
+          headers: { "content-type": "application/json" },
+        });
       }
       throw new Error(`Unexpected auth header: ${auth}`);
     }) as unknown as typeof globalThis.fetch;
@@ -808,7 +801,9 @@ describe("Slack channel config handler", () => {
     expect(
       await getSecureKeyAsync(credentialKey("slack_channel", "user_token")),
     ).toBeUndefined();
-    expect(getCredentialMetadata("slack_channel", "user_token")).toBeUndefined();
+    expect(
+      getCredentialMetadata("slack_channel", "user_token"),
+    ).toBeUndefined();
   });
 
   test("clearSlackUserToken leaves bot+app tokens and oauth_connection intact", async () => {

package/src/__tests__/slack-inbound-verification.test.ts

@@ -55,11 +55,11 @@ mock.module("../runtime/gateway-client.js", () => ({
   },
 }));
 
-import { createGuardianBinding } from "../contacts/contacts-write.js";
 import { getDb } from "../memory/db-connection.js";
 import { initializeDb } from "../memory/db-init.js";
 import { findActiveSession } from "../runtime/channel-verification-service.js";
 import { handleChannelInbound } from "./helpers/channel-test-adapter.js";
+import { createGuardianBinding } from "./helpers/create-guardian-binding.js";
 
 initializeDb();
 
@@ -257,65 +257,4 @@ describe("Slack inbound trusted contact verification", () => {
     // No Slack DM was sent
   });
 
-  test("user can verify by replying with the code in the DM", async () => {
-    // Step 1: Unknown user sends a message, gets verification challenge
-    const req = buildSlackInboundRequest();
-    await handleChannelInbound(req, undefined, TEST_BEARER_TOKEN);
-
-    const session = findActiveSession("slack");
-    expect(session).not.toBeNull();
-
-    // The challenge hash is stored in the session — extract the secret
-    // from the DM text sent to the user. The code is embedded in the
-    // template text. Since we're using a 6-digit code for identity-bound
-    // sessions, extract it from the session's challengeHash by consuming
-    // the challenge directly.
-    // The session was created with createOutboundSession which generates
-    // a 6-digit code. We can validate by calling validateAndConsumeVerification
-    // with the correct secret. Since the mock captures the DM text, we
-    // can extract the code indirectly. But for testing, we just verify
-    // the session properties and that validateAndConsumeVerification works
-    // with the correct identity.
-
-    // The actual secret was sent in the DM. For this test, let's use the
-    // session directly via the channel-verification-service to verify the
-    // consume path works.
-    // The DM text contains the verification code implicitly (it's in the
-    // template message). Since we need to test the full round-trip, let's
-    // verify via the inbound handler by sending the code as a message.
-
-    // Extract the session's challenge hash and verify that submitting the
-    // correct code works. We create a fresh session with a known secret for
-    // this part of the test.
-    resetState();
-
-    // Create a verification session manually to test the consume path
-    const { createOutboundSession } =
-      await import("../runtime/channel-verification-service.js");
-
-    const outboundSession = createOutboundSession({
-      channel: "slack",
-      expectedExternalUserId: "U0123UNKNOWN",
-      expectedChatId: "U0123UNKNOWN",
-      identityBindingStatus: "bound",
-      destinationAddress: "U0123UNKNOWN",
-      verificationPurpose: "trusted_contact",
-    });
-
-    // User replies with the code in the DM
-    const verifyReq = buildSlackInboundRequest({
-      conversationExternalId: "U0123UNKNOWN",
-      content: outboundSession.secret,
-      externalMessageId: `msg-verify-${Date.now()}`,
-    });
-    const verifyResp = await handleChannelInbound(
-      verifyReq,
-      undefined,
-      TEST_BEARER_TOKEN,
-    );
-    const verifyJson = (await verifyResp.json()) as Record<string, unknown>;
-
-    expect(verifyJson.accepted).toBe(true);
-    expect(verifyJson.verificationOutcome).toBe("verified");
-  });
 });