@vellumai/assistant 0.7.1 → 0.7.2

package/src/__tests__/tool-execute-pipeline.test.ts

@@ -55,7 +55,6 @@ mock.module("../config/loader.js", () => ({
   getConfig: () => mockConfig,
   loadConfig: () => mockConfig,
   invalidateConfigCache: () => {},
-  saveConfig: () => {},
   loadRawConfig: () => ({}),
   saveRawConfig: () => {},
   getNestedValue: () => undefined,

package/src/__tests__/tool-execution-abort-cleanup.test.ts

@@ -39,7 +39,6 @@ mock.module("../config/loader.js", () => ({
   }),
   loadConfig: () => ({}),
   invalidateConfigCache: () => {},
-  saveConfig: () => {},
   loadRawConfig: () => ({}),
   saveRawConfig: () => {},
 }));

package/src/__tests__/tool-executor-lifecycle-events.test.ts

@@ -46,7 +46,6 @@ mock.module("../config/loader.js", () => ({
   getConfig: () => mockConfig,
   loadConfig: () => mockConfig,
   invalidateConfigCache: () => {},
-  saveConfig: () => {},
   loadRawConfig: () => ({}),
   saveRawConfig: () => {},
   getNestedValue: () => undefined,

package/src/__tests__/tool-executor.test.ts

@@ -82,7 +82,6 @@ mock.module("../config/loader.js", () => ({
   getConfig: () => mockConfig,
   loadConfig: () => mockConfig,
   invalidateConfigCache: () => {},
-  saveConfig: () => {},
   loadRawConfig: () => ({}),
   saveRawConfig: () => {},
   getNestedValue: () => undefined,

package/src/__tests__/twilio-config.test.ts

@@ -20,11 +20,6 @@ mock.module("../config/loader.js", () => ({
   loadConfig: () => mockLoadConfigResult,
 }));
 
-mock.module("../inbound/public-ingress-urls.js", () => ({
-  getPublicBaseUrl: () => "https://test.example.com",
-  getTwilioRelayUrl: () => "wss://test.example.com/twilio/relay",
-}));
-
 import { getTwilioConfig } from "../calls/twilio-config.js";
 import { credentialKey } from "../security/credential-key.js";
 
@@ -36,7 +31,7 @@ describe("twilio-config", () => {
     mockLoadConfigResult = {
       twilio: {
         accountSid: "AC_test_sid",
-        phoneNumber: "+15551234567",
+        phoneNumber: "+15550123",
       },
     };
   });
@@ -45,14 +40,12 @@ describe("twilio-config", () => {
     const config = await getTwilioConfig();
     expect(config.accountSid).toBe("AC_test_sid");
     expect(config.authToken).toBe("test_auth_token");
-    expect(config.phoneNumber).toBe("+15551234567");
-    expect(config.webhookBaseUrl).toBe("https://test.example.com");
-    expect(config.wssBaseUrl).toBe("wss://test.example.com/twilio/relay");
+    expect(config.phoneNumber).toBe("+15550123");
   });
 
   test("throws ConfigError when account SID is missing", async () => {
     mockLoadConfigResult = {
-      twilio: { accountSid: "", phoneNumber: "+15551234567" },
+      twilio: { accountSid: "", phoneNumber: "+15550123" },
     };
     expect(getTwilioConfig()).rejects.toThrow(
       /Twilio credentials not configured/,
@@ -61,12 +54,6 @@ describe("twilio-config", () => {
 
   test("throws ConfigError when auth token is missing", async () => {
     mockSecureKeys = {};
-    mockLoadConfigResult = {
-      twilio: {
-        accountSid: "AC_test_sid",
-        phoneNumber: "+15551234567",
-      },
-    };
     expect(getTwilioConfig()).rejects.toThrow(
       /Twilio credentials not configured/,
     );

package/src/__tests__/twilio-routes.test.ts

@@ -209,8 +209,6 @@ mock.module("../calls/twilio-config.js", () => ({
     accountSid: "AC_test",
     authToken: "test-auth-token-for-webhooks",
     phoneNumber: "+15550001111",
-    webhookBaseUrl: "https://test.example.com",
-    wssBaseUrl: "wss://test.example.com",
   }),
   resolveTwilioPhoneNumber: () => readMockTwilioPhoneNumber(),
 }));
@@ -813,7 +811,7 @@ describe("twilio webhook routes", () => {
   // Call handleVoiceWebhook directly since direct routes are blocked.
 
   describe("voice webhook TwiML relay URL", () => {
-    test("TwiML relay URL is sourced from getTwilioRelayUrl", async () => {
+    test("TwiML relay URL uses placeholder for gateway resolution", async () => {
       const session = createTestSession("conv-twiml-1", "CA_twiml_1");
       const req = makeVoiceRequest(session.id, { CallSid: "CA_twiml_1" });
 
@@ -822,7 +820,7 @@ describe("twilio webhook routes", () => {
       expect(res.status).toBe(200);
       const twiml = await res.text();
       expect(twiml).toContain(
-        "wss://ingress.example.com/webhooks/twilio/relay",
+        "wss://__VELLUM_PUBLIC_BASE_URL__/webhooks/twilio/relay",
       );
     });
 
@@ -1138,7 +1136,7 @@ describe("twilio webhook routes", () => {
       expect(twiml).not.toContain("transcriptionProvider=");
       // callSessionId is in the URL path, not as a query param
       expect(twiml).toContain(
-        `wss://ingress.example.com/webhooks/twilio/media-stream/${session.id}`,
+        `wss://__VELLUM_PUBLIC_BASE_URL__/webhooks/twilio/media-stream/${session.id}`,
       );
       expect(twiml).not.toContain("?callSessionId=");
     });

package/src/__tests__/twilio-validation.test.ts

@@ -0,0 +1,93 @@
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+let mockConfig: Record<string, unknown>;
+let mockVerifyCalls: Array<{
+  url: string;
+  params: Record<string, string>;
+  signature: string;
+  authToken: string;
+}> = [];
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+mock.module("../config/loader.js", () => ({
+  loadConfig: () => mockConfig,
+}));
+
+mock.module("../calls/twilio-provider.js", () => ({
+  TwilioConversationRelayProvider: class {
+    static getAuthToken() {
+      return "test-auth-token";
+    }
+
+    static verifyWebhookSignature(
+      url: string,
+      params: Record<string, string>,
+      signature: string,
+      authToken: string,
+    ) {
+      mockVerifyCalls.push({ url, params, signature, authToken });
+      return signature === "valid";
+    }
+  },
+}));
+
+import { validateTwilioWebhook } from "../runtime/middleware/twilio-validation.js";
+
+describe("Twilio validation middleware", () => {
+  beforeEach(() => {
+    mockVerifyCalls = [];
+    mockConfig = {
+      ingress: {
+        publicBaseUrl: "https://generic.example.com",
+      },
+    };
+  });
+
+  test("validates signatures against Twilio-specific public ingress first", async () => {
+    mockConfig = {
+      ingress: {
+        publicBaseUrl: "  https://twilio.example.com///  ",
+      },
+    };
+    const req = new Request(
+      "http://127.0.0.1:7821/v1/calls/twilio/voice-webhook?callSessionId=session-123",
+      {
+        method: "POST",
+        headers: { "x-twilio-signature": "valid" },
+        body: new URLSearchParams({ CallSid: "CA123" }),
+      },
+    );
+
+    const result = await validateTwilioWebhook(req);
+
+    expect(result).toEqual({ body: "CallSid=CA123" });
+    expect(mockVerifyCalls).toEqual([
+      {
+        url: "https://twilio.example.com/v1/calls/twilio/voice-webhook?callSessionId=session-123",
+        params: { CallSid: "CA123" },
+        signature: "valid",
+        authToken: "test-auth-token",
+      },
+    ]);
+  });
+
+  test("falls back to generic public ingress when Twilio-specific ingress is empty", async () => {
+    const req = new Request("http://127.0.0.1:7821/v1/calls/twilio/status", {
+      method: "POST",
+      headers: { "x-twilio-signature": "valid" },
+      body: new URLSearchParams({ CallSid: "CA123" }),
+    });
+
+    await validateTwilioWebhook(req);
+
+    expect(mockVerifyCalls[0]?.url).toBe(
+      "https://generic.example.com/v1/calls/twilio/status",
+    );
+  });
+});

package/src/__tests__/vellum-self-knowledge-inline-command.test.ts

@@ -56,7 +56,6 @@ mock.module("../config/loader.js", () => ({
   getConfig: () => testConfig,
   loadConfig: () => testConfig,
   invalidateConfigCache: () => {},
-  saveConfig: () => {},
   loadRawConfig: () => ({}),
   saveRawConfig: () => {},
   getNestedValue: () => undefined,
@@ -153,9 +152,7 @@ describe("vellum-self-knowledge skill", () => {
 
   test("references the GitHub repo for deep implementation questions", async () => {
     const result = await executeSkillLoad({ skill: "vellum-self-knowledge" });
-    expect(result.content).toContain(
-      "github.com/vellum-ai/vellum-assistant",
-    );
+    expect(result.content).toContain("github.com/vellum-ai/vellum-assistant");
     expect(result.content).toContain("ARCHITECTURE.md");
   });
 

package/src/__tests__/verification-control-plane-policy.test.ts

@@ -49,7 +49,6 @@ mock.module("../config/loader.js", () => ({
   getConfig: () => mockConfig,
   loadConfig: () => mockConfig,
   invalidateConfigCache: () => {},
-  saveConfig: () => {},
   loadRawConfig: () => ({}),
   saveRawConfig: () => {},
   getNestedValue: () => undefined,
@@ -700,15 +699,14 @@ describe("ToolExecutor verification control-plane policy gate", () => {
     expect(result.content).toBe("ok");
   });
 
-  test("non-guardian invocation of unrelated bash command is allowed (sandbox bash is auto-approved)", async () => {
+  test("non-guardian invocation of unrelated bash command requires guardian grant", async () => {
     const executor = new ToolExecutor(makePrompter());
     const result = await executor.execute(
       "bash",
       { command: "curl http://localhost:3000/v1/messages" },
       makeContext({ trustClass: "trusted_contact" }),
     );
-    expect(result.isError).toBe(false);
-    expect(result.content).toBe("ok");
+    expect(result.isError).toBe(true);
   });
 
   test("non-guardian invocation of unrelated tool is unaffected", async () => {

package/src/__tests__/voice-ingress-preflight.test.ts

@@ -33,4 +33,23 @@ describe("voice ingress preflight", () => {
       expect(result.ingressConfig.ingress?.enabled).toBe(false);
     }
   });
+
+  test("accepts public base URL for Twilio when configured", async () => {
+    mockLoadConfig = () => ({
+      ingress: {
+        enabled: true,
+        publicBaseUrl: "https://twilio.example.com/",
+      },
+    });
+
+    const result = await preflightVoiceIngress();
+
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.publicBaseUrl).toBe("https://twilio.example.com");
+      expect(result.ingressConfig.ingress?.publicBaseUrl).toBe(
+        "https://twilio.example.com",
+      );
+    }
+  });
 });

package/src/__tests__/workspace-migration-006-services-config.test.ts

@@ -183,8 +183,9 @@ describe("006-services-config migration", () => {
   });
 
   test("merges with existing backfilled services object", async () => {
-    // Simulates the scenario where backfillConfigDefaults wrote a default
-    // services object before migrations run, and legacy fields coexist.
+    // Simulates a legacy-daemon scenario where an older loader wrote a
+    // schema-default services object to disk before migrations run, and
+    // legacy top-level fields coexist with it.
     writeConfig({
       provider: "openai",
       model: "gpt-4o",

package/src/__tests__/workspace-migration-backfill-installation-id.test.ts

@@ -84,7 +84,6 @@ describe("011-backfill-installation-id migration", () => {
     getExternalAssistantIdFn.mockReturnValue("my-assistant");
     getMemoryCheckpointFn.mockReturnValue(null);
     randomUUIDFn.mockReturnValue("generated-uuid-1234");
-    delete process.env.BASE_DATA_DIR;
   });
 
   test("no-op when no lockfile exists", () => {
@@ -284,12 +283,9 @@ describe("011-backfill-installation-id migration", () => {
     expect(parsed.assistants[0].installationId).toBe("sqlite-id");
   });
 
-  test("ignores BASE_DATA_DIR and always reads lockfile from homedir", () => {
-    process.env.BASE_DATA_DIR = "/custom-base";
+  test("always reads lockfile from homedir (per-user, not per-instance)", () => {
     getMemoryCheckpointFn.mockReturnValue("sqlite-id");
 
-    // Lockfile under BASE_DATA_DIR should be ignored — the migration
-    // always reads from homedir() (per-user, not per-instance).
     setupFs({
       [LOCK_PATH]: makeLockfile([{ assistantId: "my-assistant" }]),
     });

package/src/__tests__/workspace-migration-down-functions.test.ts

@@ -32,7 +32,7 @@ mock.module("../security/credential-key.js", () => ({
   credentialKey: (...args: string[]) => args.join(":"),
 }));
 
-// Mock getRootDir for 016-extract-feature-flags-to-protected
+// Mutable root dir used by 016-extract-feature-flags-to-protected tests
 let mockRootDir: string = "/tmp/mock-root";
 // ---------------------------------------------------------------------------
 // Imports — after mocking
@@ -763,21 +763,21 @@ describe("014-migrate-to-workspace-volume down()", () => {
 // ---------------------------------------------------------------------------
 
 describe("016-extract-feature-flags-to-protected down()", () => {
-  let savedBaseDataDir: string | undefined;
+  let savedWorkspaceDir: string | undefined;
 
   beforeEach(() => {
-    // The migration has an inlined platform helpers that reads BASE_DATA_DIR,
-    // so we set that env var so the inlined function resolves to mockRootDir.
+    // getVellumRoot() resolves via dirname(VELLUM_WORKSPACE_DIR), so we set
+    // VELLUM_WORKSPACE_DIR to <mockRootDir>/workspace so dirname gives mockRootDir.
     const baseDir = freshWorkspace();
     mockRootDir = join(baseDir, ".vellum");
     mkdirSync(mockRootDir, { recursive: true });
-    savedBaseDataDir = process.env.BASE_DATA_DIR;
-    process.env.BASE_DATA_DIR = baseDir;
+    savedWorkspaceDir = process.env.VELLUM_WORKSPACE_DIR;
+    process.env.VELLUM_WORKSPACE_DIR = join(mockRootDir, "workspace");
   });
 
   afterEach(() => {
-    if (savedBaseDataDir === undefined) delete process.env.BASE_DATA_DIR;
-    else process.env.BASE_DATA_DIR = savedBaseDataDir;
+    if (savedWorkspaceDir === undefined) delete process.env.VELLUM_WORKSPACE_DIR;
+    else process.env.VELLUM_WORKSPACE_DIR = savedWorkspaceDir;
   });
 
   test("moves feature flags from protected dir back to config.json", () => {

package/src/__tests__/workspace-migration-unify-llm-callsite-configs.test.ts

@@ -119,15 +119,17 @@ describe("038-unify-llm-callsite-configs migration", () => {
   // ─── Schema-default-injection regression (the original bug) ────────────
 
   test("legacy services.inference.{provider,model} win over schema-default-injected llm.default", () => {
-    // Reproduces the production bug: between PR #26095 (added
-    // `LLMSchema.default(LLMSchema.parse({}))` to AssistantConfigSchema)
-    // and PR #26101 (this migration), any daemon boot caused the loader's
-    // `backfillConfigDefaults()` to write a schema-default `llm.default`
+    // Reproduces a production bug from a legacy-daemon era: between PR
+    // #26095 (added `LLMSchema.default(LLMSchema.parse({}))` to
+    // AssistantConfigSchema) and PR #26101 (this migration), any daemon
+    // boot caused the loader to write a schema-default `llm.default`
     // block to disk. Migration 038's old idempotency check (`return early
     // if llm.default exists`) then silently skipped, and migration 039
     // stripped `services.inference.{provider,model}` — losing the user's
     // actual configuration. The fix prefers legacy source keys over the
-    // injected schema defaults whenever both are present.
+    // injected schema defaults whenever both are present. (The loader
+    // no longer writes defaults to disk, but workspaces still on disk
+    // from that era can carry the bad state forward.)
     writeConfig({
       services: {
         inference: {
@@ -806,7 +808,9 @@ describe("038-unify-llm-callsite-configs migration", () => {
     // documented no-op — it leaves the config exactly as it found it,
     // whether the `llm` block is present or absent.
     const original = {
-      services: { inference: { mode: "your-own", provider: "openai", model: "gpt-5.4" } },
+      services: {
+        inference: { mode: "your-own", provider: "openai", model: "gpt-5.4" },
+      },
       maxTokens: 32000,
       llm: {
         default: {

package/src/backup/__tests__/paths.test.ts

@@ -5,7 +5,6 @@ import { afterEach, describe, expect, test } from "bun:test";
 import {
   deriveSafeAncestor,
   formatBackupFilename,
-  getBackupKeyPath,
   getBackupRootDir,
   getDefaultOffsiteBackupsDir,
   getICloudDriveRoot,
@@ -162,27 +161,6 @@ describe("resolveOffsiteDestinations", () => {
   });
 });
 
-describe("getBackupKeyPath", () => {
-  const ORIGINAL_KEY_PATH = process.env.VELLUM_BACKUP_KEY_PATH;
-
-  afterEach(() => {
-    if (ORIGINAL_KEY_PATH === undefined) {
-      delete process.env.VELLUM_BACKUP_KEY_PATH;
-    } else {
-      process.env.VELLUM_BACKUP_KEY_PATH = ORIGINAL_KEY_PATH;
-    }
-  });
-
-  test("ends with /.backup.key when env var is unset", () => {
-    delete process.env.VELLUM_BACKUP_KEY_PATH;
-    expect(getBackupKeyPath().endsWith("/.backup.key")).toBe(true);
-  });
-
-  test("returns the env var override when VELLUM_BACKUP_KEY_PATH is set", () => {
-    process.env.VELLUM_BACKUP_KEY_PATH = "/workspace/.backup.key";
-    expect(getBackupKeyPath()).toBe("/workspace/.backup.key");
-  });
-});
 
 describe("formatBackupFilename", () => {
   const fixture = new Date("2026-04-11T15:30:45.000Z");