@vellumai/assistant 0.7.2 → 0.8.0

package/src/__tests__/disk-usage.test.ts

@@ -0,0 +1,150 @@
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+const MIB = 1024 * 1024;
+const GIB = 1024 * MIB;
+
+let existingPaths = new Set<string>();
+const workspaceDir = "/workspace";
+let minikubeStorageSize: string | undefined;
+let statfsResult = {
+  bsize: 4096,
+  blocks: 0,
+  bavail: 0,
+};
+let spawnResult: {
+  status: number | null;
+  stdout: string;
+} = {
+  status: 0,
+  stdout: "",
+};
+let spawnCalls: Array<{ command: string; args: string[] }> = [];
+
+mock.module("node:fs", () => ({
+  existsSync: (path: string) => existingPaths.has(path),
+  statfsSync: () => statfsResult,
+}));
+
+mock.module("node:child_process", () => ({
+  spawnSync: (command: string, args: string[]) => {
+    spawnCalls.push({ command, args });
+    return spawnResult;
+  },
+}));
+
+mock.module("../config/env-registry.js", () => ({
+  getMinikubeStorageSize: () => minikubeStorageSize,
+}));
+
+mock.module("../util/platform.js", () => ({
+  getWorkspaceDir: () => workspaceDir,
+}));
+
+const { __resetDiskUsageCacheForTests, getDiskUsageInfo, parseK8sMemoryBytes } =
+  await import("../util/disk-usage.js");
+
+function statfsFor(totalBytes: number, freeBytes: number) {
+  return {
+    bsize: MIB,
+    blocks: totalBytes / MIB,
+    bavail: freeBytes / MIB,
+  };
+}
+
+describe("disk usage sampler", () => {
+  beforeEach(() => {
+    existingPaths = new Set([workspaceDir]);
+    minikubeStorageSize = undefined;
+    statfsResult = statfsFor(100 * MIB, 25 * MIB);
+    spawnResult = { status: 0, stdout: "" };
+    spawnCalls = [];
+    __resetDiskUsageCacheForTests();
+  });
+
+  test("reports regular statfs usage", () => {
+    const usage = getDiskUsageInfo();
+
+    expect(usage).toEqual({
+      path: "/workspace",
+      totalMb: 100,
+      usedMb: 75,
+      freeMb: 25,
+    });
+    expect(spawnCalls).toHaveLength(0);
+  });
+
+  test("falls back to root when the workspace path does not exist", () => {
+    existingPaths = new Set();
+
+    const usage = getDiskUsageInfo();
+
+    expect(usage?.path).toBe("/");
+  });
+
+  test("uses PVC capacity and du usage when host filesystem is larger", () => {
+    minikubeStorageSize = "1Gi";
+    statfsResult = statfsFor(10 * GIB, 8 * GIB);
+    spawnResult = {
+      status: 0,
+      stdout: `${100 * MIB}\t/workspace\n`,
+    };
+
+    const usage = getDiskUsageInfo();
+
+    expect(usage).toEqual({
+      path: "/workspace",
+      totalMb: 1024,
+      usedMb: 100,
+      freeMb: 924,
+    });
+    expect(spawnCalls).toEqual([
+      { command: "du", args: ["-sb", "/workspace"] },
+    ]);
+  });
+
+  test("includes /data in PVC du usage when it exists separately", () => {
+    existingPaths = new Set([workspaceDir, "/data"]);
+    minikubeStorageSize = "1Gi";
+    statfsResult = statfsFor(10 * GIB, 8 * GIB);
+    spawnResult = {
+      status: 0,
+      stdout: `${100 * MIB}\t/workspace\n${20 * MIB}\t/data\n`,
+    };
+
+    const usage = getDiskUsageInfo();
+
+    expect(usage?.usedMb).toBe(120);
+    expect(spawnCalls).toEqual([
+      { command: "du", args: ["-sb", "/workspace", "/data"] },
+    ]);
+  });
+
+  test("returns null for malformed Kubernetes memory strings", () => {
+    expect(parseK8sMemoryBytes("")).toBeNull();
+    expect(parseK8sMemoryBytes("abc")).toBeNull();
+    expect(parseK8sMemoryBytes("12Zi")).toBeNull();
+    expect(parseK8sMemoryBytes("-1Gi")).toBeNull();
+    expect(parseK8sMemoryBytes("0Gi")).toBeNull();
+  });
+
+  test("falls back to statfs when du fails in PVC mode", () => {
+    minikubeStorageSize = "1Gi";
+    statfsResult = statfsFor(10 * GIB, 8 * GIB);
+    spawnResult = {
+      status: 1,
+      stdout: "",
+    };
+
+    const usage = getDiskUsageInfo();
+
+    expect(usage).toEqual({
+      path: "/workspace",
+      totalMb: 10240,
+      usedMb: 2048,
+      freeMb: 8192,
+    });
+    expect(spawnCalls).toEqual([
+      { command: "du", args: ["-sb", "/workspace"] },
+    ]);
+  });
+});

package/src/__tests__/events-client-registration.test.ts

@@ -395,6 +395,58 @@ describe("events client registration", () => {
     ac2.abort();
   });
 
+  // ── actorPrincipalId capture ──────────────────────────────────────────────
+
+  test("captures actorPrincipalId from x-vellum-actor-principal-id header", () => {
+    const ac = new AbortController();
+    const hub = new AssistantEventHub();
+
+    handleSubscribeAssistantEvents(
+      {
+        headers: {
+          "x-vellum-client-id": "principal-client-001",
+          "x-vellum-interface-id": "macos",
+          "x-vellum-actor-principal-id": "user-A",
+        },
+        abortSignal: ac.signal,
+      },
+      { hub },
+    );
+
+    const entry = hub.getClientById("principal-client-001");
+    expect(entry?.actorPrincipalId).toBe("user-A");
+    expect(hub.getActorPrincipalIdForClient("principal-client-001")).toBe(
+      "user-A",
+    );
+
+    ac.abort();
+  });
+
+  test("registers client with undefined actorPrincipalId when header is absent", () => {
+    const ac = new AbortController();
+    const hub = new AssistantEventHub();
+
+    handleSubscribeAssistantEvents(
+      {
+        headers: {
+          "x-vellum-client-id": "principal-client-002",
+          "x-vellum-interface-id": "macos",
+        },
+        abortSignal: ac.signal,
+      },
+      { hub },
+    );
+
+    const entry = hub.getClientById("principal-client-002");
+    expect(entry).toBeDefined();
+    expect(entry?.actorPrincipalId).toBeUndefined();
+    expect(
+      hub.getActorPrincipalIdForClient("principal-client-002"),
+    ).toBeUndefined();
+
+    ac.abort();
+  });
+
   // ── disposeClient (force disconnect) ──────────────────────────────────────
 
   test("disposeClient removes all subscribers for the clientId", () => {

package/src/__tests__/events-dev-bypass-actor.test.ts

@@ -0,0 +1,162 @@
+/**
+ * Regression tests for the SSE registration dev-bypass actor principal
+ * translation.
+ *
+ * In `DISABLE_HTTP_AUTH=true` (platform-managed) deployments the synthetic
+ * dev-bypass `AuthContext` injects `actorPrincipalId="dev-bypass"` for every
+ * request. Tool-side trust resolution still resolves to the real local
+ * guardian's principalId via `resolveLocalTrustContext`. Without translation,
+ * `ClientEntry.actorPrincipalId === "dev-bypass"` and
+ * `ToolContext.sourceActorPrincipalId === "<real-guardian>"` mismatch, so the
+ * same-user check in HostBashProxy / HostFileProxy / HostCuProxy /
+ * conversation-surfaces rejects every targeted host proxy invocation and the
+ * auto-resolve path silently falls through to untargeted broadcast.
+ *
+ * The events-routes handler translates `"dev-bypass"` to the real guardian's
+ * principalId at registration time so both sides agree. This keeps targeted
+ * host proxy execution working on Docker / platform-managed deployments.
+ */
+import { afterAll, describe, expect, mock, test } from "bun:test";
+
+// ── Module mocks (must be set up before importing the route) ──────────────
+
+let fakeHttpAuthDisabled = false;
+let fakeGuardianPrincipalId: string | undefined = undefined;
+
+mock.module("../config/env.js", () => ({
+  isHttpAuthDisabled: () => fakeHttpAuthDisabled,
+  hasUngatedHttpAuthDisabled: () => false,
+}));
+
+mock.module("../runtime/local-actor-identity.js", () => ({
+  findLocalGuardianPrincipalId: () => fakeGuardianPrincipalId,
+}));
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+// ── Real imports (after mocks) ────────────────────────────────────────────
+
+import { AssistantEventHub } from "../runtime/assistant-event-hub.js";
+import { handleSubscribeAssistantEvents } from "../runtime/routes/events-routes.js";
+
+afterAll(() => {
+  mock.restore();
+});
+
+describe("events SSE registration — dev-bypass actor translation", () => {
+  test("translates 'dev-bypass' to the real guardian principalId when auth is disabled", () => {
+    fakeHttpAuthDisabled = true;
+    fakeGuardianPrincipalId = "guardian-real-id";
+
+    const ac = new AbortController();
+    const hub = new AssistantEventHub();
+
+    handleSubscribeAssistantEvents(
+      {
+        headers: {
+          "x-vellum-client-id": "devbypass-client-001",
+          "x-vellum-interface-id": "macos",
+          "x-vellum-actor-principal-id": "dev-bypass",
+        },
+        abortSignal: ac.signal,
+      },
+      { hub },
+    );
+
+    const entry = hub.getClientById("devbypass-client-001");
+    expect(entry?.actorPrincipalId).toBe("guardian-real-id");
+    expect(hub.getActorPrincipalIdForClient("devbypass-client-001")).toBe(
+      "guardian-real-id",
+    );
+
+    ac.abort();
+  });
+
+  test("registers without principalId when dev-bypass is set but no guardian is bound", () => {
+    fakeHttpAuthDisabled = true;
+    fakeGuardianPrincipalId = undefined;
+
+    const ac = new AbortController();
+    const hub = new AssistantEventHub();
+
+    handleSubscribeAssistantEvents(
+      {
+        headers: {
+          "x-vellum-client-id": "devbypass-client-002",
+          "x-vellum-interface-id": "macos",
+          "x-vellum-actor-principal-id": "dev-bypass",
+        },
+        abortSignal: ac.signal,
+      },
+      { hub },
+    );
+
+    const entry = hub.getClientById("devbypass-client-002");
+    expect(entry).toBeDefined();
+    expect(entry?.actorPrincipalId).toBeUndefined();
+
+    ac.abort();
+  });
+
+  test("does NOT translate when auth is enabled (production mode)", () => {
+    // Defense in depth: make sure we never silently rewrite a real
+    // principalId that legitimately happens to be the literal "dev-bypass"
+    // string in a non-dev-bypass deployment. The translation is gated on
+    // isHttpAuthDisabled() === true.
+    fakeHttpAuthDisabled = false;
+    fakeGuardianPrincipalId = "guardian-real-id";
+
+    const ac = new AbortController();
+    const hub = new AssistantEventHub();
+
+    handleSubscribeAssistantEvents(
+      {
+        headers: {
+          "x-vellum-client-id": "prod-client-003",
+          "x-vellum-interface-id": "macos",
+          "x-vellum-actor-principal-id": "dev-bypass",
+        },
+        abortSignal: ac.signal,
+      },
+      { hub },
+    );
+
+    const entry = hub.getClientById("prod-client-003");
+    expect(entry?.actorPrincipalId).toBe("dev-bypass");
+
+    ac.abort();
+  });
+
+  test("passes through non-dev-bypass principalId verbatim in dev-bypass mode", () => {
+    // Edge case: a service-token connection that happens to be made while
+    // the daemon runs in DISABLE_HTTP_AUTH=true mode should still register
+    // with its own principalId, not the guardian's.
+    fakeHttpAuthDisabled = true;
+    fakeGuardianPrincipalId = "guardian-real-id";
+
+    const ac = new AbortController();
+    const hub = new AssistantEventHub();
+
+    handleSubscribeAssistantEvents(
+      {
+        headers: {
+          "x-vellum-client-id": "service-client-004",
+          "x-vellum-interface-id": "macos",
+          "x-vellum-actor-principal-id": "service-account-A",
+        },
+        abortSignal: ac.signal,
+      },
+      { hub },
+    );
+
+    const entry = hub.getClientById("service-client-004");
+    expect(entry?.actorPrincipalId).toBe("service-account-A");
+
+    ac.abort();
+  });
+});

package/src/__tests__/file-write-tool.test.ts

@@ -197,26 +197,20 @@ describe("file_write tool PKB re-index hook", () => {
     });
   });
 
-  test("always uses PKB_WORKSPACE_SCOPE regardless of context.memoryScopeId", async () => {
+  test("always uses PKB_WORKSPACE_SCOPE", async () => {
     const workingDir = makeTempDir();
     setWorkspaceDir(workingDir);
     mkdirSync(join(workingDir, "pkb"), { recursive: true });
 
-    const ctx: ToolContext = {
-      ...makeContext(workingDir),
-      memoryScopeId: "subagent:abc123",
-    };
-
     const result = await fileWriteTool.execute(
       { path: "pkb/private.md", content: "secret\n" },
-      ctx,
+      makeContext(workingDir),
     );
 
     expect(result.isError).toBe(false);
     expect(enqueueCalls).toHaveLength(1);
-    // PKB files are workspace-level — the per-conversation scopeId is NOT
-    // threaded through so different conversations can't overwrite each
-    // other's Qdrant points via target_id upsert deduplication.
+    // PKB files are workspace-level — points are keyed by PKB_WORKSPACE_SCOPE
+    // so all conversations share one PKB index.
     expect(enqueueCalls[0]?.memoryScopeId).toBe(PKB_WORKSPACE_SCOPE);
   });
 

package/src/__tests__/filing-service.test.ts

@@ -34,9 +34,6 @@ mock.module("../config/loader.js", () => ({
   invalidateConfigCache: () => {},
 }));
 
-const { _setOverridesForTesting } =
-  await import("../config/assistant-feature-flags.js");
-
 // Mock conversation store
 const createdConversations: Array<{ title: string; conversationType: string }> =
   [];
@@ -128,7 +125,6 @@ describe("FilingService", () => {
     } catch {
       // best-effort
     }
-    _setOverridesForTesting({});
   });
 
   beforeEach(() => {
@@ -331,8 +327,7 @@ describe("FilingService", () => {
   });
 
   describe("memory v2 gate", () => {
-    test("start() does not schedule timers when v2 flag and config are both on", () => {
-      _setOverridesForTesting({ "memory-v2-enabled": true });
+    test("start() does not schedule timers when memory.v2.enabled is true", () => {
       mockConfig.memory.v2.enabled = true;
 
       const service = createService();
@@ -342,8 +337,7 @@ describe("FilingService", () => {
       expect(service.nextCompactionAt).toBeNull();
     });
 
-    test("start() schedules timers when only the flag is on", () => {
-      _setOverridesForTesting({ "memory-v2-enabled": true });
+    test("start() schedules timers when memory.v2.enabled is false (v1 filing runs)", () => {
       mockConfig.memory.v2.enabled = false;
 
       const service = createService();
@@ -353,18 +347,6 @@ describe("FilingService", () => {
       expect(service.nextCompactionAt).not.toBeNull();
       service.stop();
     });
-
-    test("start() schedules timers when only the config is on", () => {
-      _setOverridesForTesting({ "memory-v2-enabled": false });
-      mockConfig.memory.v2.enabled = true;
-
-      const service = createService();
-      service.start();
-
-      expect(service.nextRunAt).not.toBeNull();
-      expect(service.nextCompactionAt).not.toBeNull();
-      service.stop();
-    });
   });
 
   describe("llm.callSites.filingAgent resolution", () => {

package/src/__tests__/handlers-skills-memory-v2-reseed.test.ts

@@ -5,17 +5,16 @@
  * One representative call site (the `installSkill` bundled branch) is
  * exercised — all 5 sites share the same delegation to
  * `maybeSeedMemoryV2Skills`, so a single suite covers behavior. Validates:
- *   - flag + config both on → helper invoked after seedSkillGraphNodes
- *     and the seed observed (callOrder picks up "v2")
- *   - flag off → helper still invoked, but the seed short-circuits
- *   - config.memory.v2.enabled off → helper still invoked, seed short-circuits
+ *   - config on → helper invoked after seedSkillGraphNodes and the seed
+ *     observed (callOrder picks up "v2")
+ *   - config off → helper still invoked, but the seed short-circuits
  *
  * The handler delegates to `maybeSeedMemoryV2Skills` from
  * `daemon/memory-v2-startup.ts`. We mock that module directly so the test
  * does not have to drain the dynamic-import microtask chain. The helper's
- * gate semantics (flag + config + rejection swallowing) are covered by
- * `lifecycle-memory-v2-seed.test.ts`; here we only verify that the
- * handler invokes the helper synchronously with the live config.
+ * gate semantics are covered by `lifecycle-memory-v2-seed.test.ts`; here
+ * we only verify that the handler invokes the helper synchronously with
+ * the live config.
  */
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
@@ -23,7 +22,7 @@ import { beforeEach, describe, expect, mock, test } from "bun:test";
 // Programmable test state
 // ---------------------------------------------------------------------------
 
-const flagsState = { flagEnabled: true, configV2Enabled: true };
+const flagsState = { configV2Enabled: true };
 
 const callOrder: string[] = [];
 
@@ -55,10 +54,7 @@ mock.module("../config/skills.js", () => ({
 }));
 
 mock.module("../config/assistant-feature-flags.js", () => ({
-  isAssistantFeatureFlagEnabled: (key: string) => {
-    if (key === "memory-v2-enabled") return flagsState.flagEnabled;
-    return true;
-  },
+  isAssistantFeatureFlagEnabled: () => true,
 }));
 
 // Stub both `getConfig` and `loadConfig`. `loadConfig` is reached by code
@@ -220,18 +216,17 @@ const { installSkill } = await import("../daemon/handlers/skills.js");
 
 describe("v2 skill re-seed gating in skill handlers", () => {
   beforeEach(() => {
-    flagsState.flagEnabled = true;
     flagsState.configV2Enabled = true;
     callOrder.length = 0;
     mockSeedSkillGraphNodes.mockClear();
     mockMaybeSeedMemoryV2Skills.mockClear();
     mockMaybeSeedMemoryV2Skills.mockImplementation((config) => {
-      if (!flagsState.flagEnabled || !config.memory.v2.enabled) return;
+      if (!config.memory.v2.enabled) return;
       callOrder.push("v2");
     });
   });
 
-  test("flag + config both on → maybeSeedMemoryV2Skills invoked after seedSkillGraphNodes", async () => {
+  test("config on → maybeSeedMemoryV2Skills invoked after seedSkillGraphNodes", async () => {
     const result = await installSkill({ slug: "bundled-skill" });
 
     expect(result.success).toBe(true);
@@ -240,17 +235,6 @@ describe("v2 skill re-seed gating in skill handlers", () => {
     expect(callOrder).toEqual(["v1", "v2"]);
   });
 
-  test("flag off → seed mock observes the disabled flag and skips", async () => {
-    flagsState.flagEnabled = false;
-
-    const result = await installSkill({ slug: "bundled-skill" });
-
-    expect(result.success).toBe(true);
-    expect(mockSeedSkillGraphNodes).toHaveBeenCalledTimes(1);
-    expect(mockMaybeSeedMemoryV2Skills).toHaveBeenCalledTimes(1);
-    expect(callOrder).toEqual(["v1"]);
-  });
-
   test("config.memory.v2.enabled off → seed mock observes config and skips", async () => {
     flagsState.configV2Enabled = false;