@vellumai/assistant 0.7.1 → 0.7.3

package/src/__tests__/inline-skill-load-permissions.test.ts

@@ -1,8 +1,7 @@
 /**
  * Tests for inline-command skill load permission handling.
  *
- * When a skill contains inline command expansions (!\`...\`) and the
- * inline-skill-commands flag is on, the permission
+ * When a skill contains inline command expansions (!\`...\`), the permission
  * system must:
  *
  * 1. Emit skill_load_dynamic:<id>@<hash> / skill_load_dynamic:<id> candidates
@@ -17,8 +16,6 @@ import { mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
-import { _setOverridesForTesting } from "../config/assistant-feature-flags.js";
-
 // ── Mock setup (must be before any imports from the project) ──────────────
 
 const testDir = process.env.VELLUM_WORKSPACE_DIR!;
@@ -48,7 +45,6 @@ mock.module("../config/loader.js", () => ({
   getConfig: () => testConfig,
   loadConfig: () => testConfig,
   invalidateConfigCache: () => {},
-  saveConfig: () => {},
   loadRawConfig: () => ({}),
   saveRawConfig: () => {},
   getNestedValue: () => undefined,
@@ -67,12 +63,13 @@ mockIpcResponse("classify_risk", {
 });
 mockIpcResponse("get_global_thresholds", {
   interactive: "low",
-  background: "medium",
+  autonomous: "medium",
   headless: "none",
 });
 
 // ── Imports (after mocks) ─────────────────────────────────────────────────
 
+import { _setOverridesForTesting } from "../config/assistant-feature-flags.js";
 import { check, generateAllowlistOptions } from "../permissions/checker.js";
 import { clearRiskCache } from "../permissions/checker.js";
 import { _clearGlobalCacheForTesting } from "../permissions/gateway-threshold-reader.js";
@@ -120,13 +117,10 @@ describe("inline-command skill_load permissions", () => {
     _clearGlobalCacheForTesting();
     mockIpcResponse("get_global_thresholds", {
       interactive: "low",
-      background: "medium",
+      autonomous: "medium",
       headless: "none",
     });
     testConfig.skills = { load: { extraDirs: [] } };
-    _setOverridesForTesting({
-      "inline-skill-commands": true,
-    });
     try {
       rmSync(join(testDir, "protected", "trust.json"));
     } catch {
@@ -159,7 +153,7 @@ describe("inline-command skill_load permissions", () => {
       writeDynamicSkill("dynamic-strict", "Dynamic Strict Skill");
       mockIpcResponse("get_global_thresholds", {
         interactive: "none",
-        background: "none",
+        autonomous: "none",
         headless: "none",
       });
       _clearGlobalCacheForTesting();

package/src/__tests__/integration-status.test.ts

@@ -5,8 +5,9 @@ import { credentialKey } from "../security/credential-key.js";
 const secureKeyValues = new Map<string, string>();
 let mockTwilioAccountSid: string | undefined;
 
-/** Set of providers that should report as connected via isProviderConnected(). */
 const connectedProviders = new Set<string>();
+const managedProviders = new Set<string>();
+const platformConnectedProviders = new Set<string>();
 
 mock.module("../security/secure-keys.js", () => ({
   getSecureKeyAsync: async (account: string) => secureKeyValues.get(account),
@@ -18,21 +19,60 @@ mock.module("../config/loader.js", () => ({
       ? { accountSid: mockTwilioAccountSid }
       : undefined,
   }),
+  getConfig: () => ({ services: {} }),
+}));
+
+mock.module("../config/schemas/services.js", () => ({
+  getServiceMode: (_services: unknown, key: string) =>
+    managedProviders.has(key) ? "managed" : "your-own",
+  ServicesSchema: { shape: { google: true, slack: true } },
 }));
 
 mock.module("../oauth/oauth-store.js", () => ({
-  isProviderConnected: (provider: string) => connectedProviders.has(provider),
+  isProviderConnected: (provider: string) =>
+    Promise.resolve(connectedProviders.has(provider)),
   getConnectionByProvider: (provider: string) =>
     connectedProviders.has(provider)
       ? { id: `conn-${provider}`, status: "active" }
       : undefined,
+  getProvider: (provider: string) => {
+    const managedKeys: Record<string, string> = {
+      google: "google",
+      slack: "slack",
+    };
+    return managedKeys[provider]
+      ? { managedServiceConfigKey: managedKeys[provider] }
+      : undefined;
+  },
+}));
+
+mock.module("../platform/client.js", () => ({
+  VellumPlatformClient: {
+    create: async () => ({
+      platformAssistantId: "test-assistant",
+      fetch: async (path: string) => {
+        const url = new URL(`http://localhost${path}`);
+        const provider = url.searchParams.get("provider");
+        const hasConnections =
+          provider && platformConnectedProviders.has(provider);
+        return {
+          ok: true,
+          json: async () => (hasConnections ? [{ id: "conn-1" }] : []),
+        };
+      },
+    }),
+  },
 }));
 
-/** Mark a provider as fully connected (active row + access token). */
 function setOAuthConnected(provider: string): void {
   connectedProviders.add(provider);
 }
 
+function setPlatformConnected(provider: string, configKey: string): void {
+  managedProviders.add(configKey);
+  platformConnectedProviders.add(provider);
+}
+
 const { getIntegrationSummary, formatIntegrationSummary, hasCapability } =
   await import("../schedule/integration-status.js");
 
@@ -40,6 +80,8 @@ describe("integration-status", () => {
   beforeEach(() => {
     secureKeyValues.clear();
     connectedProviders.clear();
+    managedProviders.clear();
+    platformConnectedProviders.clear();
     mockTwilioAccountSid = undefined;
   });
 
@@ -99,7 +141,6 @@ describe("integration-status", () => {
     });
 
     test("Telegram disconnected when no connection record exists", async () => {
-      // No oauth_connection record for telegram — should be disconnected
       const summary = await getIntegrationSummary();
       const telegram = summary.find(
         (s: { name: string }) => s.name === "Telegram",
@@ -153,7 +194,6 @@ describe("integration-status", () => {
     });
 
     test("returns false when no connection record exists for category integrations", async () => {
-      // No oauth_connection record for telegram — should not count as connected
       expect(await hasCapability("messaging")).toBe(false);
     });
 
@@ -166,4 +206,44 @@ describe("integration-status", () => {
       expect(await hasCapability("email")).toBe(true);
     });
   });
+
+  describe("managed mode", () => {
+    test("Gmail shows connected when platform has active connection", async () => {
+      setPlatformConnected("google", "google");
+
+      const summary = await getIntegrationSummary();
+      const gmail = summary.find((s: { name: string }) => s.name === "Gmail");
+      expect(gmail?.connected).toBe(true);
+    });
+
+    test("Gmail shows disconnected when managed but no platform connection", async () => {
+      managedProviders.add("google");
+
+      const summary = await getIntegrationSummary();
+      const gmail = summary.find((s: { name: string }) => s.name === "Gmail");
+      expect(gmail?.connected).toBe(false);
+    });
+
+    test("Slack shows connected when platform has active connection", async () => {
+      setPlatformConnected("slack", "slack");
+
+      const summary = await getIntegrationSummary();
+      const slack = summary.find((s: { name: string }) => s.name === "Slack");
+      expect(slack?.connected).toBe(true);
+    });
+
+    test("formatIntegrationSummary reflects managed connections", async () => {
+      setPlatformConnected("google", "google");
+      setPlatformConnected("slack", "slack");
+
+      const result = await formatIntegrationSummary();
+      expect(result).toContain("Gmail \u2713");
+      expect(result).toContain("Slack \u2713");
+    });
+
+    test("hasCapability returns true for managed email connection", async () => {
+      setPlatformConnected("google", "google");
+      expect(await hasCapability("email")).toBe(true);
+    });
+  });
 });

package/src/__tests__/intent-routing.test.ts

@@ -36,7 +36,6 @@ mock.module("../config/loader.js", () => ({
   }),
   loadConfig: () => ({}),
   loadRawConfig: () => ({}),
-  saveConfig: () => {},
   saveRawConfig: () => {},
   invalidateConfigCache: () => {},
   getNestedValue: () => undefined,

package/src/__tests__/jobs-store-qdrant-breaker.test.ts

@@ -13,6 +13,8 @@ mock.module("../config/loader.js", () => ({
   invalidateConfigCache: () => {},
 }));
 
+import { eq } from "drizzle-orm";
+
 import { getDb } from "../memory/db-connection.js";
 import { initializeDb } from "../memory/db-init.js";
 import {
@@ -24,6 +26,7 @@ import {
   _resetQdrantBreaker,
   withQdrantBreaker,
 } from "../memory/qdrant-circuit-breaker.js";
+import { memoryJobs } from "../memory/schema.js";
 
 describe("claimMemoryJobs with Qdrant circuit breaker", () => {
   beforeAll(() => {
@@ -41,7 +44,7 @@ describe("claimMemoryJobs with Qdrant circuit breaker", () => {
     enqueueMemoryJob("embed_graph_node", { nodeId: "node-1" });
     enqueueMemoryJob("graph_extract", { conversationId: "conv-1" });
 
-    const claimed = claimMemoryJobs(10);
+    const claimed = claimMemoryJobs({ slowLlm: 10, fast: 10, embed: 10 });
     const types = claimed.map((j) => j.type);
 
     expect(types).toContain("embed_segment");
@@ -70,7 +73,7 @@ describe("claimMemoryJobs with Qdrant circuit breaker", () => {
       conversationId: "conv-1",
     });
 
-    const claimed = claimMemoryJobs(10);
+    const claimed = claimMemoryJobs({ slowLlm: 10, fast: 10, embed: 10 });
     const types = claimed.map((j) => j.type);
 
     // Only non-embed jobs should be claimed
@@ -98,7 +101,11 @@ describe("claimMemoryJobs with Qdrant circuit breaker", () => {
     enqueueMemoryJob("embed_segment", { segmentId: "seg-1" });
     enqueueMemoryJob("graph_extract", { conversationId: "conv-1" });
 
-    const claimedWhileOpen = claimMemoryJobs(10);
+    const claimedWhileOpen = claimMemoryJobs({
+      slowLlm: 10,
+      fast: 10,
+      embed: 10,
+    });
     expect(claimedWhileOpen.map((j) => j.type)).not.toContain("embed_segment");
 
     // Reset breaker (simulates successful probe closing the circuit)
@@ -107,12 +114,95 @@ describe("claimMemoryJobs with Qdrant circuit breaker", () => {
     // Re-enqueue an embed job (the previous one is now "running")
     enqueueMemoryJob("embed_graph_node", { nodeId: "node-2" });
 
-    const claimedAfterClose = claimMemoryJobs(10);
+    const claimedAfterClose = claimMemoryJobs({
+      slowLlm: 10,
+      fast: 10,
+      embed: 10,
+    });
     const types = claimedAfterClose.map((j) => j.type);
 
     expect(types).toContain("embed_graph_node");
   });
 
+  test("lane budgets are honored when called with explicit budgets", () => {
+    // 5 slow-lane jobs
+    for (let i = 0; i < 5; i++) {
+      enqueueMemoryJob("graph_extract", { conversationId: `slow-${i}` });
+    }
+    // 5 fast-lane jobs (rebuild_index is neither slow-LLM nor embed)
+    for (let i = 0; i < 5; i++) {
+      enqueueMemoryJob("rebuild_index", { id: `fast-${i}` });
+    }
+    // 5 embed-lane jobs
+    for (let i = 0; i < 5; i++) {
+      enqueueMemoryJob("embed_segment", { segmentId: `embed-${i}` });
+    }
+
+    const claimed = claimMemoryJobs({ slowLlm: 1, fast: 2, embed: 2 });
+    const slowClaimed = claimed.filter((j) => j.type === "graph_extract");
+    const fastClaimed = claimed.filter((j) => j.type === "rebuild_index");
+    const embedClaimed = claimed.filter((j) => j.type === "embed_segment");
+
+    expect(claimed).toHaveLength(5);
+    expect(slowClaimed).toHaveLength(1);
+    expect(fastClaimed).toHaveLength(2);
+    expect(embedClaimed).toHaveLength(2);
+
+    // Remaining 10 jobs should still be pending.
+    const db = getDb();
+    const pendingRows = db
+      .select()
+      .from(memoryJobs)
+      .where(eq(memoryJobs.status, "pending"))
+      .all();
+    expect(pendingRows).toHaveLength(10);
+  });
+
+  test("Qdrant breaker gates only the embed lane in lane-aware mode", async () => {
+    // 5 slow + 5 fast + 5 embed pending jobs
+    for (let i = 0; i < 5; i++) {
+      enqueueMemoryJob("graph_extract", { conversationId: `slow-${i}` });
+    }
+    for (let i = 0; i < 5; i++) {
+      enqueueMemoryJob("rebuild_index", { id: `fast-${i}` });
+    }
+    for (let i = 0; i < 5; i++) {
+      enqueueMemoryJob("embed_segment", { segmentId: `embed-${i}` });
+    }
+
+    // Trip the breaker
+    for (let i = 0; i < 5; i++) {
+      try {
+        await withQdrantBreaker(async () => {
+          throw new Error("simulated qdrant failure");
+        });
+      } catch {
+        // expected
+      }
+    }
+
+    const claimed = claimMemoryJobs({ slowLlm: 1, fast: 2, embed: 2 });
+    const slowClaimed = claimed.filter((j) => j.type === "graph_extract");
+    const fastClaimed = claimed.filter((j) => j.type === "rebuild_index");
+    const embedClaimed = claimed.filter((j) => j.type === "embed_segment");
+
+    expect(slowClaimed).toHaveLength(1);
+    expect(fastClaimed).toHaveLength(2);
+    // Breaker is open and probe window has not elapsed → no embed jobs claimed.
+    expect(embedClaimed).toHaveLength(0);
+  });
+
+  test("FIFO order within a lane is preserved by runAfter ascending", () => {
+    const t0 = Date.now() - 30_000;
+    enqueueMemoryJob("graph_extract", { conversationId: "third" }, t0 + 200);
+    enqueueMemoryJob("graph_extract", { conversationId: "first" }, t0);
+    enqueueMemoryJob("graph_extract", { conversationId: "second" }, t0 + 100);
+
+    const claimed = claimMemoryJobs({ slowLlm: 3, fast: 0, embed: 0 });
+    const order = claimed.map((j) => j.payload.conversationId);
+    expect(order).toEqual(["first", "second", "third"]);
+  });
+
   test("all embed job types are skipped when breaker is open", async () => {
     const embedTypes: MemoryJobType[] = [
       "embed_segment",
@@ -141,7 +231,7 @@ describe("claimMemoryJobs with Qdrant circuit breaker", () => {
     // Also enqueue a non-embed job
     enqueueMemoryJob("graph_consolidate", { conversationId: "conv-1" });
 
-    const claimed = claimMemoryJobs(20);
+    const claimed = claimMemoryJobs({ slowLlm: 20, fast: 20, embed: 20 });
     const types = claimed.map((j) => j.type);
 
     // Only the non-embed job should be claimed

package/src/__tests__/lifecycle-memory-v2-seed.test.ts

@@ -139,6 +139,23 @@ describe("maybeSeedMemoryV2Skills (daemon startup gate)", () => {
     expect(state.warnCalls).toHaveLength(0);
   });
 
+  test("re-invocation seeds after flag flips on (deferred-init race recovery)", async () => {
+    // Models the lifecycle-startup race: the synchronous seed call evaluates
+    // the flag while the gateway IPC override fetch is still in flight, falls
+    // through to the registry default (`false`), and skips. Once
+    // `initFeatureFlagOverrides()` resolves, the chained `.then` re-invokes
+    // the seed with the now-populated cache and the flag flips to `true`.
+    state.flagOverrides = { "memory-v2-enabled": false };
+    maybeSeedMemoryV2Skills(makeConfig(true));
+    await flushMicrotasks();
+    expect(state.seedCallCount).toBe(0);
+
+    state.flagOverrides = { "memory-v2-enabled": true };
+    maybeSeedMemoryV2Skills(makeConfig(true));
+    await flushMicrotasks();
+    expect(state.seedCallCount).toBe(1);
+  });
+
   test("swallows seedV2SkillEntries rejections and logs a warning", async () => {
     state.flagOverrides = { "memory-v2-enabled": true };
     state.seedShouldReject = new Error("seed failed");

package/src/__tests__/managed-profile-guard.test.ts

@@ -125,6 +125,16 @@ describe("PUT /v1/config/llm/profiles/:name — managed profile guard", () => {
     ).toThrow(BadRequestError);
   });
 
+  test("allows edits to custom-balanced (user-owned)", () => {
+    savedRaw = null;
+    const result = replaceRoute.handler({
+      pathParams: { name: "custom-balanced" },
+      body: { provider: "openai", model: "gpt-4o" },
+    });
+    expect(result).toEqual({ ok: true });
+    expect(savedRaw).not.toBeNull();
+  });
+
   test("allows edits to a user-defined profile", () => {
     savedRaw = null;
     const result = replaceRoute.handler({
@@ -165,6 +175,14 @@ describe("PATCH /v1/config — managed profile deletion guard", () => {
     ).rejects.toThrow(BadRequestError);
   });
 
+  test("allows deletion of custom-balanced via null (user-owned)", async () => {
+    savedRaw = null;
+    const result = await patchRoute.handler({
+      body: { llm: { profiles: { "custom-balanced": null } } },
+    });
+    expect(result).toEqual({ ok: true });
+  });
+
   test("allows deletion of a user-defined profile via null", async () => {
     savedRaw = null;
     const result = await patchRoute.handler({

package/src/__tests__/managed-skill-lifecycle.test.ts

@@ -45,7 +45,6 @@ mock.module("../config/loader.js", () => ({
   getConfig: () => mockConfig,
   loadConfig: () => mockConfig,
   invalidateConfigCache: () => {},
-  saveConfig: () => {},
   loadRawConfig: () => ({}),
   saveRawConfig: () => {},
   getNestedValue: () => undefined,

package/src/__tests__/mcp-abort-signal.test.ts

@@ -122,6 +122,136 @@ describe("MCP AbortSignal threading", () => {
   });
 
   describe("createMcpTool execute", () => {
+    test("keeps safe MCP tool names unchanged", () => {
+      const fakeManager = { callTool: jest.fn() } as any;
+
+      const tool = createMcpTool(
+        {
+          name: "my-tool",
+          description: "A test tool",
+          inputSchema: { type: "object", properties: {} },
+        },
+        "test-server",
+        {
+          transport: { type: "stdio", command: "echo", args: [] },
+          enabled: true,
+          defaultRiskLevel: "high",
+          maxTools: 100,
+        },
+        fakeManager,
+      );
+
+      expect(tool.name).toBe("mcp__test-server__my-tool");
+      expect(tool.getDefinition().name).toBe("mcp__test-server__my-tool");
+    });
+
+    test("keeps MCP tool names with trailing whitespace distinct", () => {
+      const fakeManager = { callTool: jest.fn() } as any;
+
+      const plain = createMcpTool(
+        {
+          name: "deploy",
+          description: "Deploy",
+          inputSchema: { type: "object", properties: {} },
+        },
+        "test-server",
+        {
+          transport: { type: "stdio", command: "echo", args: [] },
+          enabled: true,
+          defaultRiskLevel: "high",
+          maxTools: 100,
+        },
+        fakeManager,
+      );
+      const padded = createMcpTool(
+        {
+          name: "deploy ",
+          description: "Deploy padded",
+          inputSchema: { type: "object", properties: {} },
+        },
+        "test-server",
+        {
+          transport: { type: "stdio", command: "echo", args: [] },
+          enabled: true,
+          defaultRiskLevel: "high",
+          maxTools: 100,
+        },
+        fakeManager,
+      );
+
+      expect(plain.name).toBe("mcp__test-server__deploy");
+      expect(padded.name).toMatch(/^mcp__test-server__deploy__[a-f0-9]{12}$/);
+      expect(padded.name).not.toBe(plain.name);
+    });
+
+    test("exposes provider-safe MCP names while preserving raw execution names", async () => {
+      const callToolSpy = jest.fn().mockResolvedValue({
+        content: "tool result",
+        isError: false,
+      });
+      const fakeManager = { callTool: callToolSpy } as any;
+
+      const tool = createMcpTool(
+        {
+          name: "create link",
+          description: "Create a Stripe Link CLI resource",
+          inputSchema: { type: "object", properties: {} },
+        },
+        "stripe.link-cli",
+        {
+          transport: { type: "stdio", command: "echo", args: [] },
+          enabled: true,
+          defaultRiskLevel: "high",
+          maxTools: 100,
+        },
+        fakeManager,
+      );
+
+      expect(tool.name).toMatch(/^[a-zA-Z0-9_-]{1,64}$/);
+      expect(tool.name.startsWith("mcp__stripe_link-cli__create_link__")).toBe(
+        true,
+      );
+      expect(tool.getDefinition().name).toBe(tool.name);
+
+      await tool.execute(
+        { someArg: "value" },
+        {
+          workingDir: "/tmp",
+          conversationId: "conv-1",
+          trustClass: "guardian",
+        },
+      );
+
+      expect(callToolSpy).toHaveBeenCalledWith(
+        "stripe.link-cli",
+        "create link",
+        { someArg: "value" },
+        undefined,
+      );
+    });
+
+    test("caps long MCP names at the provider limit", () => {
+      const fakeManager = { callTool: jest.fn() } as any;
+      const tool = createMcpTool(
+        {
+          name: "x".repeat(180),
+          description: "A test tool",
+          inputSchema: { type: "object", properties: {} },
+        },
+        "server",
+        {
+          transport: { type: "stdio", command: "echo", args: [] },
+          enabled: true,
+          defaultRiskLevel: "high",
+          maxTools: 100,
+        },
+        fakeManager,
+      );
+
+      expect(tool.name).toHaveLength(64);
+      expect(tool.name).toMatch(/^[a-zA-Z0-9_-]{1,64}$/);
+    });
+
     test("threads context.signal through manager.callTool", async () => {
       const callToolSpy = jest.fn().mockResolvedValue({
         content: "tool result",