@vellumai/assistant 0.7.3 → 0.8.1

package/src/__tests__/server-history-render.test.ts

@@ -154,6 +154,88 @@ describe("renderHistoryContent", () => {
     ]);
   });
 
+  // ── Persisted risk-option ladders (Phase B of conflation track) ─────────────
+
+  test("hydrates persisted _risk*Options annotations onto tool calls", () => {
+    // Mirrors what `annotatePersistedAssistantMessage` writes to the DB so the
+    // rule editor's chip ladder survives chat-history reload. Without these,
+    // hydrated chips fall back to the synthesized `*` allowlist (see web's
+    // `synthesizeFallbackOption` in RuleEditorModal.tsx).
+    const scopeOptions = [
+      { pattern: "exact", label: "exact: rm -rf /tmp" },
+      { pattern: "by-program", label: "All rm" },
+    ];
+    const allowlistOptions = [
+      { label: "exact", description: "exact match", pattern: "rm -rf /tmp" },
+      { label: "All rm", description: "All rm commands", pattern: "rm *" },
+    ];
+    const directoryScopeOptions = [
+      { scope: "/Users/me/code", label: "in code/" },
+      { scope: "everywhere", label: "Everywhere" },
+    ];
+
+    const output = renderHistoryContent([
+      {
+        type: "tool_use",
+        id: "tu_1",
+        name: "bash",
+        input: { command: "rm -rf /tmp" },
+        _riskLevel: "high",
+        _matchedTrustRuleId: "rule_42",
+        _riskScopeOptions: scopeOptions,
+        _riskAllowlistOptions: allowlistOptions,
+        _riskDirectoryScopeOptions: directoryScopeOptions,
+      },
+    ]);
+
+    const [entry] = output.toolCalls;
+    expect(entry.riskLevel).toBe("high");
+    expect(entry.matchedTrustRuleId).toBe("rule_42");
+    expect(entry.riskScopeOptions).toEqual(scopeOptions);
+    expect(entry.riskAllowlistOptions).toEqual(allowlistOptions);
+    expect(entry.riskDirectoryScopeOptions).toEqual(directoryScopeOptions);
+  });
+
+  test("ignores non-array _risk*Options annotations", () => {
+    // Defensive: a malformed persisted block should not throw or coerce.
+    const output = renderHistoryContent([
+      {
+        type: "tool_use",
+        id: "tu_1",
+        name: "bash",
+        input: { command: "ls" },
+        _riskLevel: "low",
+        _riskScopeOptions: "not an array",
+        _riskAllowlistOptions: { not: "an array" },
+        _riskDirectoryScopeOptions: 42,
+      },
+    ]);
+
+    const [entry] = output.toolCalls;
+    expect(entry.riskLevel).toBe("low");
+    expect(entry.riskScopeOptions).toBeUndefined();
+    expect(entry.riskAllowlistOptions).toBeUndefined();
+    expect(entry.riskDirectoryScopeOptions).toBeUndefined();
+  });
+
+  test("omits absent _risk*Options annotations", () => {
+    const output = renderHistoryContent([
+      {
+        type: "tool_use",
+        id: "tu_1",
+        name: "bash",
+        input: { command: "ls" },
+        _riskLevel: "low",
+      },
+    ]);
+
+    const [entry] = output.toolCalls;
+    expect(entry.riskLevel).toBe("low");
+    expect(entry.riskScopeOptions).toBeUndefined();
+    expect(entry.riskAllowlistOptions).toBeUndefined();
+    expect(entry.riskDirectoryScopeOptions).toBeUndefined();
+  });
+
   test("handles mixed text and tool blocks", () => {
     const output = renderHistoryContent([
       { type: "text", text: "Let me look that up." },

package/src/__tests__/shell-credential-ref.test.ts

@@ -93,6 +93,7 @@ afterAll(() => {
 describe("shell tool credential ref resolution", () => {
   test("service/field ref resolves to UUID and reaches session creation", async () => {
     const meta = upsertCredentialMetadata("fal", "api_key", {
+      allowedTools: ["bash"],
       injectionTemplates: [
         {
           hostPattern: "*.fal.ai",
@@ -120,7 +121,9 @@ describe("shell tool credential ref resolution", () => {
   });
 
   test("UUID ref remains supported", async () => {
-    const meta = upsertCredentialMetadata("github", "token");
+    const meta = upsertCredentialMetadata("github", "token", {
+      allowedTools: ["bash"],
+    });
 
     await shellTool.execute(
       {
@@ -156,7 +159,9 @@ describe("shell tool credential ref resolution", () => {
   });
 
   test("mixed known+unknown refs fails fast (no partial execution)", async () => {
-    upsertCredentialMetadata("fal", "api_key");
+    upsertCredentialMetadata("fal", "api_key", {
+      allowedTools: ["bash"],
+    });
 
     const result = await shellTool.execute(
       {
@@ -175,7 +180,9 @@ describe("shell tool credential ref resolution", () => {
   });
 
   test("duplicate refs are deduped", async () => {
-    const meta = upsertCredentialMetadata("fal", "api_key");
+    const meta = upsertCredentialMetadata("fal", "api_key", {
+      allowedTools: ["bash"],
+    });
 
     await shellTool.execute(
       {
@@ -209,4 +216,89 @@ describe("shell tool credential ref resolution", () => {
     expect(result.isError).toBeFalsy();
     expect(mockGetOrStartSession).not.toHaveBeenCalled();
   });
+
+  test("credential with allowedTools excluding bash is denied for proxied shell", async () => {
+    upsertCredentialMetadata("vercel", "api_token", {
+      allowedTools: ["publish_page"],
+      injectionTemplates: [
+        {
+          hostPattern: "api.vercel.com",
+          injectionType: "header",
+          headerName: "Authorization",
+          valuePrefix: "Bearer ",
+        },
+      ],
+    });
+
+    const result = await shellTool.execute(
+      {
+        command: "curl https://api.vercel.com/v1/projects",
+        activity: "test",
+        network_mode: "proxied",
+        credential_ids: ["vercel/api_token"],
+      },
+      ctx,
+    );
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("credential tool policy denied");
+    expect(result.content).toContain("not bash");
+    // Must not call getOrStartSession — policy denial happens before session creation
+    expect(mockGetOrStartSession).not.toHaveBeenCalled();
+  });
+
+  test("credential with allowedTools including bash starts proxied session", async () => {
+    const meta = upsertCredentialMetadata("deploy_svc", "api_key", {
+      allowedTools: ["bash"],
+      injectionTemplates: [
+        {
+          hostPattern: "*.deploy-svc.io",
+          injectionType: "header",
+          headerName: "Authorization",
+          valuePrefix: "Bearer ",
+        },
+      ],
+    });
+
+    await shellTool.execute(
+      {
+        command: "echo deploy",
+        activity: "test",
+        network_mode: "proxied",
+        credential_ids: ["deploy_svc/api_key"],
+      },
+      ctx,
+    );
+
+    // Session should be created with the resolved credential ID
+    expect(mockGetOrStartSession).toHaveBeenCalledTimes(1);
+    const callArgs = mockGetOrStartSession.mock.calls[0];
+    expect(callArgs[1]).toEqual([meta.credentialId]);
+  });
+
+  test("mixed allowed and denied credentials fail the whole command before session creation", async () => {
+    upsertCredentialMetadata("allowed_svc", "token", {
+      allowedTools: ["bash"],
+    });
+    upsertCredentialMetadata("denied_svc", "token", {
+      allowedTools: ["publish_page"],
+    });
+
+    const result = await shellTool.execute(
+      {
+        command: "echo mixed",
+        activity: "test",
+        network_mode: "proxied",
+        credential_ids: ["allowed_svc/token", "denied_svc/token"],
+      },
+      ctx,
+    );
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("credential tool policy denied");
+    expect(result.content).toContain("denied_svc/token");
+    expect(result.content).toContain("not bash");
+    // Must not call getOrStartSession — even one denied credential blocks the whole command
+    expect(mockGetOrStartSession).not.toHaveBeenCalled();
+  });
 });

package/src/__tests__/shell-tool-proxy-mode.test.ts

@@ -136,6 +136,20 @@ mock.module("../tools/credentials/resolve.js", () => ({
   resolveCredentialRef: (ref: string) => ({ credentialId: ref }),
 }));
 
+mock.module("../tools/credentials/metadata-store.js", () => ({
+  getCredentialMetadataById: (id: string) => ({
+    service: "test",
+    field: id,
+    allowedTools: ["bash"],
+    allowedDomains: [],
+  }),
+}));
+
+mock.module("../tools/credentials/tool-policy.js", () => ({
+  isToolAllowed: (toolName: string, allowedTools: string[]) =>
+    Array.isArray(allowedTools) && allowedTools.includes(toolName),
+}));
+
 mock.module("../tools/network/script-proxy/logging.js", () => ({
   buildCredentialRefTrace: (
     rawRefs: string[],

package/src/__tests__/skill-include-graph.test.ts

@@ -6,6 +6,7 @@ import {
   getImmediateChildren,
   indexCatalogById,
   traverseIncludes,
+  validateIncludeCycles,
   validateIncludes,
 } from "../skills/include-graph.js";
 
@@ -299,6 +300,36 @@ describe("validateIncludes — cycle detection", () => {
   });
 });
 
+describe("validateIncludeCycles", () => {
+  test("skips missing children while still detecting available cycles", () => {
+    const catalog = [
+      makeSkill("root", ["missing", "a"]),
+      makeSkill("a", ["b"]),
+      makeSkill("b", ["a"]),
+    ];
+    const index = indexCatalogById(catalog);
+
+    const result = validateIncludeCycles("root", index);
+
+    expect(result.ok).toBe(false);
+    if (!result.ok && result.error === "cycle") {
+      expect(result.cyclePath).toEqual(["a", "b", "a"]);
+    }
+  });
+
+  test("returns success when the only invalid edges are missing children", () => {
+    const catalog = [makeSkill("root", ["missing"])];
+    const index = indexCatalogById(catalog);
+
+    const result = validateIncludeCycles("root", index);
+
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.visited).toEqual(["root"]);
+    }
+  });
+});
+
 describe("collectAllMissing", () => {
   test("returns empty set when skill has no includes", () => {
     const catalog = [makeSkill("root")];

package/src/__tests__/skill-load-feature-flag.test.ts

@@ -50,6 +50,7 @@ mock.module("../config/loader.js", () => ({
     "openrouter",
     "brave",
     "perplexity",
+    "tavily",
   ],
 }));
 

package/src/__tests__/skill-load-tool.test.ts

@@ -266,17 +266,19 @@ describe("skill_load tool", () => {
     expect(markers.length).toBe(1);
   });
 
-  test("returns error when skill has missing include", async () => {
+  test("continues when skill has missing include", async () => {
     writeSkillWithIncludes("parent", "Parent", "Has missing child", "Body", [
       "missing-child",
     ]);
     writeFileSync(join(TEST_DIR, "skills", "SKILLS.md"), "- parent\n");
 
     const result = await executeSkillLoad({ skill: "parent" });
-    expect(result.isError).toBe(true);
+    expect(result.isError).toBe(false);
+    expect(result.content).toContain("Skill: Parent");
+    expect(result.content).toContain("Suggested Included Skills (not loaded):");
     expect(result.content).toContain("missing-child");
-    expect(result.content).toContain("not found");
-    expect(result.content).not.toContain("<loaded_skill");
+    expect(result.content).toContain('<loaded_skill id="parent"');
+    expect(result.content).not.toContain('<loaded_skill id="missing-child"');
   });
 
   test("returns error when skill has circular include", async () => {
@@ -317,7 +319,7 @@ describe("skill_load tool", () => {
     expect(result.content).toContain("<loaded_skill");
   });
 
-  test("failed include validation (missing) emits no loaded_skill marker", async () => {
+  test("missing include emits only the parent loaded_skill marker", async () => {
     const skillDir = join(TEST_DIR, "skills", "marker-missing");
     mkdirSync(skillDir, { recursive: true });
     writeFileSync(
@@ -327,9 +329,13 @@ describe("skill_load tool", () => {
     writeFileSync(join(TEST_DIR, "skills", "SKILLS.md"), "- marker-missing\n");
 
     const result = await executeSkillLoad({ skill: "marker-missing" });
-    expect(result.isError).toBe(true);
-    expect(result.content).not.toContain("<loaded_skill");
-    expect(result.content).not.toMatch(/<loaded_skill\s/);
+    expect(result.isError).toBe(false);
+    expect(result.content).toContain("Suggested Included Skills (not loaded):");
+    expect(result.content).toContain("nonexistent");
+    const markers = result.content.match(/<loaded_skill/g) || [];
+    expect(markers.length).toBe(1);
+    expect(result.content).toContain('<loaded_skill id="marker-missing"');
+    expect(result.content).not.toContain('<loaded_skill id="nonexistent"');
   });
 
   test("failed include validation (cycle) emits no loaded_skill marker", async () => {
@@ -365,6 +371,26 @@ describe("skill_load tool", () => {
     expect(result.content).toContain("Skill: No Includes");
   });
 
+  test("bundled app-builder loads without includes", async () => {
+    const result = await executeSkillLoad({ skill: "app-builder" });
+
+    expect(result.isError).toBe(false);
+    expect(result.content).toContain("Skill: App Builder");
+    expect(result.content).toContain("Included Skills (immediate): none");
+    expect(result.content).toContain('<loaded_skill id="app-builder"');
+  });
+
+  test("bundled phone-calls loads when setup includes are unavailable", async () => {
+    const result = await executeSkillLoad({ skill: "phone-calls" });
+
+    expect(result.isError).toBe(false);
+    expect(result.content).toContain("Skill: Phone Calls");
+    expect(result.content).toContain("Suggested Included Skills (not loaded):");
+    expect(result.content).toContain("twilio-setup");
+    expect(result.content).toContain('<loaded_skill id="phone-calls"');
+    expect(result.content).not.toContain('<loaded_skill id="twilio-setup"');
+  });
+
   test("skill_load output includes immediate child metadata", async () => {
     writeSkill("child-skill", "Child Skill", "A child skill", "Child body");
     const parentDir = join(TEST_DIR, "skills", "parent-with-children");
@@ -883,7 +909,7 @@ describe("skill_load tool", () => {
     expect(mockAutoInstall).toHaveBeenCalledWith("trans-c");
   });
 
-  test("returns error when auto-install of missing include fails", async () => {
+  test("continues when auto-install of missing include fails", async () => {
     writeSkillWithIncludes(
       "fail-parent",
       "Fail Parent",
@@ -902,10 +928,12 @@ describe("skill_load tool", () => {
     });
 
     const result = await executeSkillLoad({ skill: "fail-parent" });
-    expect(result.isError).toBe(true);
+    expect(result.isError).toBe(false);
+    expect(result.content).toContain("Skill: Fail Parent");
+    expect(result.content).toContain("Suggested Included Skills (not loaded):");
     expect(result.content).toContain("dep-x");
-    expect(result.content).toContain("not found");
-    expect(result.content).not.toContain("<loaded_skill");
+    expect(result.content).toContain('<loaded_skill id="fail-parent"');
+    expect(result.content).not.toContain('<loaded_skill id="dep-x"');
   });
 
   test("stops after MAX_INSTALL_ROUNDS", async () => {
@@ -941,10 +969,8 @@ describe("skill_load tool", () => {
     });
 
     const result = await executeSkillLoad({ skill: "loop-root" });
-    // Should terminate with an error (the final dep is still missing)
-    expect(result.isError).toBe(true);
-    expect(result.content).toContain("not found");
-    // Should have terminated — installCount should be bounded by MAX_INSTALL_ROUNDS (5)
+    expect(result.isError).toBe(false);
+    expect(result.content).toContain("Suggested Included Skills (not loaded):");
     expect(installCount).toBeLessThanOrEqual(5);
   });
 });

package/src/__tests__/skills.test.ts

@@ -1,6 +1,7 @@
 import {
   existsSync,
   mkdirSync,
+  readdirSync,
   readFileSync,
   rmSync,
   symlinkSync,
@@ -678,3 +679,41 @@ describe("bundled computer-use skill", () => {
     ]);
   });
 });
+
+describe("skill source ownership", () => {
+  const BUNDLED_SKILLS_DIR = join(
+    import.meta.dir,
+    "..",
+    "config",
+    "bundled-skills",
+  );
+  const FIRST_PARTY_SKILLS_DIR = join(
+    import.meta.dir,
+    "..",
+    "..",
+    "..",
+    "skills",
+  );
+
+  function collectSourceSkillIds(rootDir: string): string[] {
+    return readdirSync(rootDir, { withFileTypes: true })
+      .filter(
+        (entry) =>
+          entry.isDirectory() &&
+          existsSync(join(rootDir, entry.name, "SKILL.md")),
+      )
+      .map((entry) => entry.name)
+      .sort((a, b) => a.localeCompare(b));
+  }
+
+  test("bundled skills are not duplicated in the first-party source catalog", () => {
+    const firstPartyIds = new Set(
+      collectSourceSkillIds(FIRST_PARTY_SKILLS_DIR),
+    );
+    const duplicates = collectSourceSkillIds(BUNDLED_SKILLS_DIR).filter((id) =>
+      firstPartyIds.has(id),
+    );
+
+    expect(duplicates).toEqual([]);
+  });
+});

package/src/__tests__/subagent-call-site-routing.test.ts

@@ -110,16 +110,39 @@ mock.module("../prompts/system-prompt.js", () => ({
   buildSubagentSystemPrompt: () => "subagent system",
 }));
 
-// Provider registry — return distinct stubs so we can verify the selection.
+// Provider registry + connection resolver — routing goes through
+// `provider_connection` exclusively. `getProvider` is kept here purely
+// because the registry module still exports it; the production code under
+// test does not call it.
 const anthropicStub = { name: "anthropic" };
 const openaiStub = { name: "openai" };
 
 mock.module("../providers/registry.js", () => ({
   getProvider: (name: string) => {
-    if (name === "anthropic") return anthropicStub;
-    if (name === "openai") return openaiStub;
-    throw new Error(`unknown provider: ${name}`);
+    throw new Error(`legacy getProvider should not be called: ${name}`);
   },
+  resolveProviderFromConnection: async (connection: { name: string }) => {
+    if (connection.name === "anthropic-conn") return anthropicStub;
+    if (connection.name === "openai-conn") return openaiStub;
+    return null;
+  },
+  clearConnectionProviderCache: () => {},
+}));
+
+// Connection lookup — feeds `resolveProviderFromConnection` above. The DB
+// is stubbed; tests don't touch SQLite.
+mock.module("../providers/inference/connections.js", () => ({
+  getConnection: (_db: unknown, name: string) => {
+    if (name === "anthropic-conn")
+      return { name: "anthropic-conn", provider: "anthropic", auth: { type: "platform" } };
+    if (name === "openai-conn")
+      return { name: "openai-conn", provider: "openai", auth: { type: "platform" } };
+    return null;
+  },
+}));
+
+mock.module("../memory/db-connection.js", () => ({
+  getDb: () => ({}),
 }));
 
 // Mutable LLM config — tests rewrite this per-case.
@@ -154,7 +177,11 @@ function setLlmConfig(raw: unknown): void {
 describe("SubagentManager — provider call-site routing", () => {
   test("wraps the default provider in CallSiteRoutingProvider", async () => {
     setLlmConfig({
-      default: { provider: "anthropic", model: "claude-opus-4-7" },
+      default: {
+        provider: "anthropic",
+        provider_connection: "anthropic-conn",
+        model: "claude-opus-4-7",
+      },
     });
 
     capturedProvider = undefined;
@@ -172,10 +199,27 @@ describe("SubagentManager — provider call-site routing", () => {
   });
 
   test("the wrapped provider exposes the default provider's name (stable identity for outer wrappers)", async () => {
+    // Note: `provider_connection` lives on `ProfileEntry` and `LLMConfigBase`,
+    // NOT on `LLMCallSiteConfig` (which is `LLMConfigFragment.extend({
+    // profile })`). Setting `provider_connection` directly on a `callSites.*`
+    // entry would be silently stripped by Zod. The correct shape for an
+    // alternate-provider call-site override is a profile reference, defined
+    // here as `altOpenai`.
     setLlmConfig({
-      default: { provider: "anthropic", model: "claude-opus-4-7" },
+      default: {
+        provider: "anthropic",
+        provider_connection: "anthropic-conn",
+        model: "claude-opus-4-7",
+      },
+      profiles: {
+        altOpenai: {
+          provider: "openai",
+          provider_connection: "openai-conn",
+          model: "gpt-5.4",
+        },
+      },
       callSites: {
-        subagentSpawn: { provider: "openai", model: "gpt-5.4" },
+        subagentSpawn: { profile: "altOpenai" },
       },
     });
 
@@ -202,7 +246,11 @@ describe("SubagentManager — provider call-site routing", () => {
 
   test("falls back to default provider when subagentSpawn callSite is absent", async () => {
     setLlmConfig({
-      default: { provider: "anthropic", model: "claude-opus-4-7" },
+      default: {
+        provider: "anthropic",
+        provider_connection: "anthropic-conn",
+        model: "claude-opus-4-7",
+      },
       // No subagentSpawn override.
     });
 
@@ -224,7 +272,11 @@ describe("SubagentManager — provider call-site routing", () => {
 
   test("copies parent guardian and auth context into spawned conversation", async () => {
     setLlmConfig({
-      default: { provider: "anthropic", model: "claude-opus-4-7" },
+      default: {
+        provider: "anthropic",
+        provider_connection: "anthropic-conn",
+        model: "claude-opus-4-7",
+      },
     });
 
     const parentTrustContext = {
@@ -273,11 +325,18 @@ describe("SubagentManager — provider call-site routing", () => {
 // ── Direct unit test for CallSiteRoutingProvider's selection logic ─────────
 
 describe("CallSiteRoutingProvider — selectProvider behavior", () => {
-  test("routes to the resolved provider when callSite.provider differs from default", async () => {
+  test("routes to the resolved provider when callSite resolves to a profile with provider_connection", async () => {
     setLlmConfig({
       default: { provider: "anthropic", model: "claude-opus-4-7" },
+      profiles: {
+        altOpenai: {
+          provider: "openai",
+          provider_connection: "openai-conn",
+          model: "gpt-5.4",
+        },
+      },
       callSites: {
-        subagentSpawn: { provider: "openai", model: "gpt-5.4" },
+        subagentSpawn: { profile: "altOpenai" },
       },
     });
 
@@ -309,10 +368,13 @@ describe("CallSiteRoutingProvider — selectProvider behavior", () => {
       },
     };
 
-    const wrapper = new CallSiteRoutingProvider(defaultProvider, (name) => {
-      if (name === "openai") return altProvider;
-      return undefined;
-    });
+    const wrapper = new CallSiteRoutingProvider(
+      defaultProvider,
+      async (connectionName) => {
+        if (connectionName === "openai-conn") return altProvider;
+        return null;
+      },
+    );
 
     await wrapper.sendMessage([], undefined, undefined, {
       config: { callSite: "subagentSpawn" },
@@ -347,7 +409,7 @@ describe("CallSiteRoutingProvider — selectProvider behavior", () => {
 
     const wrapper = new CallSiteRoutingProvider(
       defaultProvider,
-      () => undefined,
+      async () => null,
     );
 
     await wrapper.sendMessage([], undefined, undefined, {

package/src/__tests__/suggestion-routes.test.ts

@@ -532,7 +532,7 @@ describe("GET /v1/suggestion", () => {
     );
   });
 
-  test("uses conversationStarters call site", async () => {
+  test("uses replySuggestion call site", async () => {
     const provider = makeMockProvider("Quick reply");
     mockGetConfiguredProvider.mockImplementation(async () => provider);
     mockGetConversationByKey.mockImplementation(() => ({
@@ -558,7 +558,7 @@ describe("GET /v1/suggestion", () => {
     const options = callArgs[3] as
       | { config?: { callSite?: string } }
       | undefined;
-    expect(options?.config?.callSite).toBe("conversationStarters");
+    expect(options?.config?.callSite).toBe("replySuggestion");
   });
 
   test("disables thinking and zeros effort to avoid Anthropic temp/thinking 400", async () => {
@@ -612,7 +612,7 @@ describe("GET /v1/suggestion", () => {
     // whenever the request triggers extended thinking (e.g. Opus 4.x at
     // `effort: "xhigh"`). The suggestion generator must only send a
     // single user-role message so it stays compatible with every
-    // possible `conversationStarters` call-site config.
+    // possible `replySuggestion` call-site config.
     const provider = makeMockProvider("<reply>Sure, works for me</reply>");
     mockGetConfiguredProvider.mockImplementation(async () => provider);
     mockGetConversationByKey.mockImplementation(() => ({