@vellumai/assistant 0.7.3 → 0.8.1

package/src/__tests__/config-loader-corrupt.test.ts

@@ -146,6 +146,42 @@ describe("loadConfig corrupt-file recovery", () => {
       /^config\.json\.corrupt-\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}\.\d{3}Z\.json$/,
     );
   });
+
+  // ---------------------------------------------------------------------------
+  // Shape-mismatch quarantine — same JSON.parse caveat as `loadRawConfig`.
+  // Without an `isPlainObject` check, downstream code (e.g. the managed-Gemini
+  // `setNestedValue` block in `loadConfig`) would TypeError on `null` or
+  // primitive `fileConfig`, and only the broad try/catch around the migration
+  // saved startup. Treating the wrong-shape case as a parse error here moves
+  // the boundary check to the loader so callers don't have to defend.
+  // ---------------------------------------------------------------------------
+
+  test.each([
+    ["null at the top level", "null"],
+    ["a JSON number", "42"],
+    ["a JSON string", '"hello"'],
+    ["a JSON boolean", "true"],
+    ["a JSON array", '["provider", "anthropic"]'],
+  ])(
+    "quarantines when config.json contains %s and returns defaults",
+    (_label, jsonText) => {
+      writeFileSync(CONFIG_PATH, jsonText);
+
+      // Must not throw — daemon startup contract.
+      const config = loadConfig();
+
+      // Defaults loaded — config is populated through the Zod schema.
+      expect(config).toBeDefined();
+      expect(config.memory).toBeDefined();
+
+      const quarantined = listQuarantinedFiles();
+      expect(quarantined).toHaveLength(1);
+      // Original wrong-shape content preserved for debugging.
+      expect(readFileSync(join(WORKSPACE_DIR, quarantined[0]), "utf-8")).toBe(
+        jsonText,
+      );
+    },
+  );
 });
 
 describe("loadRawConfig corrupt-file recovery", () => {
@@ -180,4 +216,36 @@ describe("loadRawConfig corrupt-file recovery", () => {
     expect(raw).toEqual({ foo: "bar", nested: { k: 1 } });
     expect(listQuarantinedFiles()).toHaveLength(0);
   });
+
+  // ---------------------------------------------------------------------------
+  // Shape-mismatch quarantine — JSON.parse can succeed on `null`, primitives,
+  // and arrays, all of which violate the function's `Record<string, unknown>`
+  // return-type contract. These cases must be quarantined the same way as a
+  // syntax error so callers (e.g. /v1/config handlers) can iterate the result
+  // safely without runtime shape checks.
+  // ---------------------------------------------------------------------------
+
+  test.each([
+    ["null at the top level", "null"],
+    ["a JSON number", "42"],
+    ["a JSON string", '"hello"'],
+    ["a JSON boolean", "true"],
+    ["a JSON array", '["provider", "anthropic"]'],
+  ])(
+    "quarantines when config.json contains %s and returns {}",
+    (_label, jsonText) => {
+      writeFileSync(CONFIG_PATH, jsonText);
+
+      // Must not throw — same contract as the syntax-error path.
+      const raw = loadRawConfig();
+
+      expect(raw).toEqual({});
+      const quarantined = listQuarantinedFiles();
+      expect(quarantined).toHaveLength(1);
+      // Original wrong-shape content is preserved for debugging.
+      expect(readFileSync(join(WORKSPACE_DIR, quarantined[0]), "utf-8")).toBe(
+        jsonText,
+      );
+    },
+  );
 });

package/src/__tests__/config-loader-platform-defaults.test.ts

@@ -58,6 +58,7 @@ afterAll(() => {
 });
 
 import { invalidateConfigCache, loadConfig } from "../config/loader.js";
+import { applyContextDefaultsToRawConfig } from "../runtime/routes/conversation-query-routes.js";
 import { _setStorePath } from "../security/encrypted-store.js";
 
 // ---------------------------------------------------------------------------
@@ -91,7 +92,6 @@ function readConfig(): Record<string, unknown> {
 }
 
 const MANAGED_SERVICES = [
-  "inference",
   "image-generation",
   "web-search",
   "google-oauth",
@@ -125,7 +125,7 @@ describe("platform-managed config defaults", () => {
     }
   });
 
-  test("IS_PLATFORM=true, no config file → all 8 service modes written as 'managed'", () => {
+  test("IS_PLATFORM=true, no config file → all 7 managed service modes written as 'managed'", () => {
     process.env.IS_PLATFORM = "true";
 
     loadConfig();
@@ -139,7 +139,7 @@ describe("platform-managed config defaults", () => {
     }
   });
 
-  test("IS_PLATFORM=false, no config file → service modes default to 'your-own'", () => {
+  test("IS_PLATFORM=false, no config file → managed service modes default to 'your-own'", () => {
     process.env.IS_PLATFORM = "false";
 
     loadConfig();
@@ -153,7 +153,7 @@ describe("platform-managed config defaults", () => {
     }
   });
 
-  test("IS_PLATFORM unset, no config file → service modes default to 'your-own'", () => {
+  test("IS_PLATFORM unset, no config file → managed service modes default to 'your-own'", () => {
     delete process.env.IS_PLATFORM;
 
     loadConfig();
@@ -170,13 +170,13 @@ describe("platform-managed config defaults", () => {
   test("IS_PLATFORM=true, config file already exists → existing service mode values are preserved", () => {
     process.env.IS_PLATFORM = "true";
 
-    // Write an existing config with inference mode explicitly set to "your-own"
+    // Write an existing config with image-generation mode explicitly set to "your-own"
     writeFileSync(
       CONFIG_PATH,
       JSON.stringify(
         {
           services: {
-            inference: { mode: "your-own" },
+            "image-generation": { mode: "your-own" },
           },
         },
         null,
@@ -184,13 +184,350 @@ describe("platform-managed config defaults", () => {
       ) + "\n",
     );
 
-    loadConfig();
+    const config = loadConfig();
 
     const written = readConfig() as { services?: Record<string, unknown> };
     expect(written.services).toBeDefined();
     // The existing value must be preserved — backfill path, not fresh-write path
     expect(
-      (written.services!["inference"] as { mode?: string })?.mode,
+      (written.services!["image-generation"] as { mode?: string })?.mode,
     ).toBe("your-own");
+    // ...and the in-memory config must mirror the explicit user choice (the
+    // fill-defaults pass must not override an explicit "your-own").
+    expect(config.services["image-generation"].mode).toBe("your-own");
+  });
+
+  test("IS_PLATFORM=true, config file exists without a services key → in-memory config has all managed modes", () => {
+    // Regression guard for the platform-managed boot order: by the time
+    // `loadConfig()` runs, lifecycle steps such as `seedInferenceProfiles`
+    // have already written `config.json` (with `llm.profiles` etc.), so
+    // `configFileExisted` is true even on a brand-new platform-managed
+    // assistant. Deployment-context defaults must still be applied to the
+    // in-memory config for any leaf keys that are absent from disk.
+    process.env.IS_PLATFORM = "true";
+
+    writeFileSync(
+      CONFIG_PATH,
+      JSON.stringify(
+        {
+          llm: {
+            profiles: {
+              balanced: { provider: "anthropic", model: "claude-sonnet-4.5" },
+            },
+            activeProfile: "balanced",
+          },
+        },
+        null,
+        2,
+      ) + "\n",
+    );
+
+    const config = loadConfig();
+
+    // In-memory config has the deployment-context defaults applied for the
+    // missing service-mode fields.
+    for (const svc of MANAGED_SERVICES) {
+      expect(
+        (
+          config.services as unknown as Record<
+            string,
+            { mode: string }
+          >
+        )[svc]!.mode,
+      ).toBe("managed");
+    }
+
+    // The on-disk file is NOT modified by the fill pass — disk reflects only
+    // what was already there. Existing-file branch never re-writes config.json.
+    const onDisk = readConfig() as Record<string, unknown>;
+    expect(onDisk["services"]).toBeUndefined();
+  });
+
+  test("IS_PLATFORM=true, config file exists with a partial service subtree → preserves user fields, fills missing mode", () => {
+    process.env.IS_PLATFORM = "true";
+
+    // User has an image-generation provider configured but never explicitly
+    // chose a mode for that service. The fill pass must apply
+    // `mode: "managed"` without clobbering the user-supplied provider.
+    // (The inference schema dropped per-service model/provider in
+    // migration 039 — image-generation still carries them, so it's the
+    // right schema to exercise the partial-subtree case.)
+    writeFileSync(
+      CONFIG_PATH,
+      JSON.stringify(
+        {
+          services: {
+            "image-generation": { provider: "openai" },
+          },
+        },
+        null,
+        2,
+      ) + "\n",
+    );
+
+    const config = loadConfig();
+
+    const imageGen = (
+      config.services as unknown as Record<
+        string,
+        { mode: string; provider?: string }
+      >
+    )["image-generation"]!;
+    expect(imageGen.mode).toBe("managed");
+    expect(imageGen.provider).toBe("openai");
+  });
+
+  test("IS_PLATFORM=false, config file exists without services key → in-memory config keeps schema your-own defaults", () => {
+    // Sanity guard: deployment-context defaults are a no-op when IS_PLATFORM
+    // is not enabled, regardless of whether config.json existed.
+    process.env.IS_PLATFORM = "false";
+
+    writeFileSync(
+      CONFIG_PATH,
+      JSON.stringify(
+        {
+          llm: {
+            profiles: {
+              balanced: { provider: "anthropic", model: "claude-sonnet-4.5" },
+            },
+            activeProfile: "balanced",
+          },
+        },
+        null,
+        2,
+      ) + "\n",
+    );
+
+    const config = loadConfig();
+
+    for (const svc of MANAGED_SERVICES) {
+      expect(
+        (
+          config.services as unknown as Record<
+            string,
+            { mode: string }
+          >
+        )[svc]!.mode,
+      ).toBe("your-own");
+    }
+  });
+});
+
+/**
+ * Regression guard for the `handleGetConfig` route handler in
+ * `assistant/src/runtime/routes/conversation-query-routes.ts`. That handler
+ * returns the raw on-disk JSON to clients (macOS, web, CLI) via
+ * `GET /v1/config`, but first layers deployment-context defaults on top
+ * via the `applyContextDefaultsToRawConfig` helper.
+ *
+ * macOS's `loadServiceModes(config:)` only updates `inferenceMode` when
+ * `services.inference.mode` is present in the response — without the fill
+ * pass, freshly-hatched platform-managed assistants would have no `services`
+ * key on disk (only `llm.profiles` from `seedInferenceProfiles`) and macOS
+ * would fall back to its `@Published` default of "your-own". The helper is
+ * also responsible for guarding against `loadRawConfig()` returning a
+ * non-object payload from a malformed-but-parseable `config.json`.
+ */
+describe("GET /v1/config handler — context-default fill on raw response", () => {
+  const originalIsPlatform = process.env.IS_PLATFORM;
+
+  afterEach(() => {
+    if (originalIsPlatform === undefined) {
+      delete process.env.IS_PLATFORM;
+    } else {
+      process.env.IS_PLATFORM = originalIsPlatform;
+    }
+  });
+
+  test("IS_PLATFORM=true, raw config has no services key → response includes managed defaults", () => {
+    process.env.IS_PLATFORM = "true";
+
+    // Mirrors the real-world fresh-hatch state: lifecycle wrote
+    // `llm.profiles` to disk, but never persisted any service modes.
+    const raw: Record<string, unknown> = {
+      llm: {
+        profiles: {
+          balanced: { provider: "anthropic", model: "claude-sonnet-4.5" },
+        },
+        activeProfile: "balanced",
+      },
+    };
+
+    const result = applyContextDefaultsToRawConfig(raw) as Record<
+      string,
+      unknown
+    >;
+    const services = result["services"] as Record<string, { mode: string }>;
+    expect(services).toBeDefined();
+    for (const svc of MANAGED_SERVICES) {
+      expect(services[svc]!.mode).toBe("managed");
+    }
+  });
+
+  test("IS_PLATFORM=true, raw config has explicit services.image-generation.mode='your-own' → preserved", () => {
+    process.env.IS_PLATFORM = "true";
+
+    // User has explicitly chosen "your-own" for image-generation via the macOS
+    // Save flow. The patch handler persisted that to disk; the fill pass must
+    // not override an explicit user choice.
+    const raw: Record<string, unknown> = {
+      services: {
+        "image-generation": { mode: "your-own" },
+      },
+    };
+
+    const result = applyContextDefaultsToRawConfig(raw) as Record<
+      string,
+      unknown
+    >;
+    const services = result["services"] as Record<string, { mode: string }>;
+    expect(services["image-generation"]!.mode).toBe("your-own");
+    // web-search was missing → fill.
+    expect(services["web-search"]!.mode).toBe("managed");
+    // inference.mode is a legacy backwards-compat wire field — synthesized
+    // here for old macOS clients (SettingsStore.swift) that still read it.
+    expect(services["inference"]!.mode).toBe("managed");
+  });
+
+  test("IS_PLATFORM=false, raw config has no services key → response is unchanged", () => {
+    process.env.IS_PLATFORM = "false";
+
+    const raw: Record<string, unknown> = {
+      llm: {
+        profiles: {
+          balanced: { provider: "anthropic", model: "claude-sonnet-4.5" },
+        },
+      },
+    };
+
+    const result = applyContextDefaultsToRawConfig(raw) as Record<
+      string,
+      unknown
+    >;
+    expect(result["services"]).toBeUndefined();
+  });
+
+  test("IS_PLATFORM=true, raw config has partial services subtree → preserves user fields, fills missing mode", () => {
+    process.env.IS_PLATFORM = "true";
+
+    // User set image-generation.provider but never chose a mode.
+    // The fill pass adds the missing mode without clobbering the user-supplied
+    // provider.
+    const raw: Record<string, unknown> = {
+      services: {
+        "image-generation": { provider: "openai" },
+      },
+    };
+
+    const result = applyContextDefaultsToRawConfig(raw) as Record<
+      string,
+      unknown
+    >;
+    const services = result["services"] as Record<
+      string,
+      { mode: string; provider?: string }
+    >;
+    expect(services["image-generation"]!.mode).toBe("managed");
+    expect(services["image-generation"]!.provider).toBe("openai");
+    // services.inference.mode is synthesized as a legacy wire-only field for
+    // older macOS clients during the rollout window (Phase 1.2 schema removal
+    // landed before the macOS Providers UI ships).
+    expect(services["inference"]!.mode).toBe("managed");
+  });
+
+  test("IS_PLATFORM=true, raw config has no inference subtree → synthesizes legacy mode='managed'", () => {
+    process.env.IS_PLATFORM = "true";
+
+    const raw: Record<string, unknown> = {
+      llm: {
+        profiles: {
+          balanced: { provider: "anthropic", model: "claude-sonnet-4.5" },
+        },
+      },
+    };
+
+    const result = applyContextDefaultsToRawConfig(raw) as Record<
+      string,
+      unknown
+    >;
+    const services = result["services"] as Record<string, { mode: string }>;
+    expect(services["inference"]!.mode).toBe("managed");
+  });
+
+  test("IS_PLATFORM=true, raw config has explicit services.inference.mode='your-own' → preserved (legacy override)", () => {
+    process.env.IS_PLATFORM = "true";
+
+    // Pre-migration upgrade: workspace config still carries the legacy
+    // mode value. The synthesis only fills when absent, so an explicit
+    // disk value wins until migration 076 strips it.
+    const raw: Record<string, unknown> = {
+      services: {
+        inference: { mode: "your-own" },
+      },
+    };
+
+    const result = applyContextDefaultsToRawConfig(raw) as Record<
+      string,
+      unknown
+    >;
+    const services = result["services"] as Record<string, { mode: string }>;
+    expect(services["inference"]!.mode).toBe("your-own");
+  });
+
+  test("IS_PLATFORM=false, raw config has no inference subtree → no synthesis", () => {
+    process.env.IS_PLATFORM = "false";
+
+    const raw: Record<string, unknown> = {
+      llm: {},
+    };
+
+    const result = applyContextDefaultsToRawConfig(raw) as Record<
+      string,
+      unknown
+    >;
+    expect(result["services"]).toBeUndefined();
+  });
+
+  // -------------------------------------------------------------------------
+  // Malformed-but-parseable config.json — must not 500 the GET endpoint.
+  //
+  // `loadRawConfig()` is typed `Record<string, unknown>` but `JSON.parse`
+  // will happily return `null`, primitives, or arrays for a syntactically
+  // valid file like `null` / `42` / `[]`. The helper must return those
+  // payloads unchanged rather than throwing inside
+  // `fillContextDefaultsForMissingKeys`.
+  // -------------------------------------------------------------------------
+
+  test("IS_PLATFORM=true, raw config is null → returned unchanged (no throw)", () => {
+    process.env.IS_PLATFORM = "true";
+    expect(applyContextDefaultsToRawConfig(null)).toBe(null);
+  });
+
+  test("IS_PLATFORM=true, raw config is a primitive number → returned unchanged (no throw)", () => {
+    process.env.IS_PLATFORM = "true";
+    expect(applyContextDefaultsToRawConfig(42)).toBe(42);
+  });
+
+  test("IS_PLATFORM=true, raw config is an array → returned unchanged (no throw)", () => {
+    process.env.IS_PLATFORM = "true";
+    const raw: unknown[] = [{ foo: "bar" }];
+    const result = applyContextDefaultsToRawConfig(raw);
+    expect(result).toBe(raw);
+    // No `services` key was synthesized onto the array.
+    expect((result as { services?: unknown }).services).toBeUndefined();
+  });
+
+  test("IS_PLATFORM=true, raw config is a string → returned unchanged (no throw)", () => {
+    process.env.IS_PLATFORM = "true";
+    expect(applyContextDefaultsToRawConfig("not-an-object")).toBe(
+      "not-an-object",
+    );
+  });
+
+  test("IS_PLATFORM=false, raw config is null → returned unchanged (no throw)", () => {
+    // Sanity check: when there are no context defaults to apply, the helper
+    // also short-circuits cleanly on non-object payloads.
+    process.env.IS_PLATFORM = "false";
+    expect(applyContextDefaultsToRawConfig(null)).toBe(null);
   });
 });

package/src/__tests__/config-schema-cmd.test.ts

@@ -3,7 +3,7 @@ import { join } from "node:path";
 import { describe, expect, mock, test } from "bun:test";
 
 // ---------------------------------------------------------------------------
-// Mocks — declared before imports that depend on platform/logger
+// Mocks - declared before imports that depend on platform/logger/ipc
 // ---------------------------------------------------------------------------
 
 const WORKSPACE_DIR = process.env.VELLUM_WORKSPACE_DIR!;
@@ -45,28 +45,38 @@ mock.module("../util/logger.js", () => ({
   getCliLogger: () => makeLoggerStub(),
 }));
 
-mock.module("../config/loader.js", () => ({
-  getConfig: () => ({
-    services: {
-      inference: {
-        mode: "your-own",
-        provider: "anthropic",
-        model: "claude-opus-4-6",
-      },
-      "image-generation": {
-        mode: "your-own",
-        provider: "gemini",
-        model: "gemini-3.1-flash-image-preview",
-      },
-      "web-search": { mode: "your-own", provider: "inference-provider-native" },
-    },
-  }),
-  loadConfig: () => ({}),
-  loadRawConfig: () => ({}),
-  saveRawConfig: () => {},
-  invalidateConfigCache: () => {},
-  getNestedValue: () => undefined,
-  setNestedValue: () => {},
+// ---------------------------------------------------------------------------
+// Mocks - ipc/cli-client
+//
+// The `config` CLI is IPC-tagged, so all schema lookups go through the
+// daemon. Mock cliIpcCall so we can drive the response in each test and
+// assert on exit behavior without spinning up a daemon socket.
+// ---------------------------------------------------------------------------
+
+let mockIpcResult: {
+  ok: boolean;
+  result?: unknown;
+  error?: string;
+  statusCode?: number;
+} = { ok: true, result: { schema: {} } };
+
+mock.module("../ipc/cli-client.js", () => ({
+  cliIpcCall: async () => mockIpcResult,
+  exitFromIpcResult: (r: {
+    error?: string;
+    statusCode?: number;
+  }) => {
+    process.stderr.write((r.error ?? "Unknown error") + "\n");
+    if (r.statusCode === undefined) {
+      process.exit(10);
+    } else if (r.statusCode >= 500) {
+      process.exit(3);
+    } else if (r.statusCode >= 400) {
+      process.exit(2);
+    } else {
+      process.exit(1);
+    }
+  },
 }));
 
 import { Command } from "commander";
@@ -259,30 +269,54 @@ describe("z.toJSONSchema integration", () => {
 
 // ---------------------------------------------------------------------------
 // Tests: CLI schema command error path
+//
+// The CLI now routes `config schema <path>` through the daemon. When the
+// daemon throws a BadRequestError for an unknown path, the IPC layer
+// returns statusCode=400, and exitFromIpcResult maps that to process exit
+// code 2 (per the matrix in cli-client.ts:exitFromIpcResult).
 // ---------------------------------------------------------------------------
 
 describe("CLI schema command", () => {
-  test("nonexistent path prints error and exits with code 1", () => {
+  test("daemon error for nonexistent path surfaces via exitFromIpcResult", async () => {
+    // Drive the IPC mock to return a BadRequest as the daemon would
+    mockIpcResult = {
+      ok: false,
+      error: "No schema found at path: nonexistent",
+      statusCode: 400,
+    };
+
     const program = new Command();
-    program.exitOverride(); // throw instead of calling process.exit
+    program.exitOverride();
     registerConfigCommand(program);
 
     const origExit = process.exit;
-    // Replace process.exit to capture the exit code without killing the test
+    const origStderrWrite = process.stderr.write.bind(process.stderr);
     let exitCode: number | undefined;
     process.exit = ((code?: number) => {
       exitCode = code;
       throw new Error(`process.exit(${code})`);
     }) as never;
+    process.stderr.write = (() => true) as typeof process.stderr.write;
 
     try {
-      program.parse(["node", "test", "config", "schema", "nonexistent"]);
+      await program.parseAsync([
+        "node",
+        "test",
+        "config",
+        "schema",
+        "nonexistent",
+      ]);
     } catch {
-      // Expected: either Commander's exitOverride or our process.exit stub throws
+      // Expected: process.exit stub throws
     } finally {
       process.exit = origExit;
+      process.stderr.write = origStderrWrite;
     }
 
-    expect(exitCode).toBe(1);
+    // 400 → exit 2 (per exitFromIpcResult matrix)
+    expect(exitCode).toBe(2);
+
+    // Restore default
+    mockIpcResult = { ok: true, result: { schema: {} } };
   });
 });

package/src/__tests__/config-schema.test.ts

@@ -83,9 +83,9 @@ function writeConfig(obj: unknown): void {
 describe("AssistantConfigSchema", () => {
   test("parses empty object with full defaults", () => {
     const result = AssistantConfigSchema.parse({});
-    // services.inference now carries only `mode`; provider/model live under
-    // llm.default.{provider,model} (see PR 19 of unify-llm-callsites).
-    expect(result.services.inference.mode).toBe("your-own");
+    // services.inference is now an empty object; provider/model live under
+    // llm.default.{provider,model}, auth routing via provider_connections.
+    expect(result.services.inference).toEqual({});
     expect(result.llm.default.provider).toBe("anthropic");
     expect(result.llm.default.model).toBe("claude-opus-4-7");
     expect(result.services["image-generation"].provider).toBe("gemini");
@@ -134,6 +134,17 @@ describe("AssistantConfigSchema", () => {
     expect(result.auditLog).toEqual({ retentionDays: 0 });
   });
 
+  test("accepts Tavily as a web search provider", () => {
+    const result = AssistantConfigSchema.parse({
+      services: {
+        "web-search": { mode: "your-own", provider: "tavily" },
+      },
+    });
+
+    expect(result.services["web-search"].provider).toBe("tavily");
+    expect(result.services["web-search"].mode).toBe("your-own");
+  });
+
   test("accepts valid complete config", () => {
     const input = {
       llm: {