@vellumai/assistant 0.7.3 → 0.8.1

package/src/__tests__/vercel-config.test.ts

@@ -0,0 +1,168 @@
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+import { credentialKey } from "../security/credential-key.js";
+
+let secureKeyStore: Record<string, string> = {};
+
+// Track metadata upsert calls to verify policy
+let lastUpsertCall: {
+  service: string;
+  field: string;
+  policy: Record<string, unknown> | undefined;
+} | null = null;
+let metadataDeleted: { service: string; field: string } | null = null;
+
+mock.module("../security/secure-keys.js", () => ({
+  getSecureKeyAsync: async (account: string) =>
+    secureKeyStore[account] ?? undefined,
+  setSecureKeyAsync: async (account: string, value: string) => {
+    secureKeyStore[account] = value;
+    return true;
+  },
+  deleteSecureKeyAsync: async (account: string) => {
+    if (account in secureKeyStore) {
+      delete secureKeyStore[account];
+      return "deleted" as const;
+    }
+    return "not-found" as const;
+  },
+}));
+
+mock.module("../tools/credentials/metadata-store.js", () => ({
+  deleteCredentialMetadata: (service: string, field: string) => {
+    metadataDeleted = { service, field };
+    return true;
+  },
+  upsertCredentialMetadata: (
+    service: string,
+    field: string,
+    policy?: Record<string, unknown>,
+  ) => {
+    lastUpsertCall = { service, field, policy };
+    return {};
+  },
+}));
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+import {
+  deleteVercelConfig,
+  getVercelConfig,
+  setVercelConfig,
+} from "../daemon/handlers/config-vercel.js";
+
+describe("Vercel config handler", () => {
+  beforeEach(() => {
+    secureKeyStore = {};
+    lastUpsertCall = null;
+    metadataDeleted = null;
+  });
+
+  // -- setVercelConfig --
+
+  describe("setVercelConfig", () => {
+    test("stores token and returns success", async () => {
+      const result = await setVercelConfig("vl_test_token_123");
+
+      expect(result.success).toBe(true);
+      expect(result.hasToken).toBe(true);
+      expect(secureKeyStore[credentialKey("vercel", "api_token")]).toBe(
+        "vl_test_token_123",
+      );
+    });
+
+    test("metadata does not include bash in allowedTools", async () => {
+      await setVercelConfig("vl_test_token_123");
+
+      expect(lastUpsertCall).not.toBeNull();
+      const tools = lastUpsertCall!.policy?.allowedTools as string[];
+      expect(tools).not.toContain("bash");
+    });
+
+    test("metadata does not include deploy in allowedTools", async () => {
+      await setVercelConfig("vl_test_token_123");
+
+      expect(lastUpsertCall).not.toBeNull();
+      const tools = lastUpsertCall!.policy?.allowedTools as string[];
+      expect(tools).not.toContain("deploy");
+    });
+
+    test("metadata explicitly clears injection templates", async () => {
+      await setVercelConfig("vl_test_token_123");
+
+      expect(lastUpsertCall).not.toBeNull();
+      expect(lastUpsertCall!.policy?.injectionTemplates).toBeNull();
+    });
+
+    test("publish_page and unpublish_page remain in allowedTools", async () => {
+      await setVercelConfig("vl_test_token_123");
+
+      expect(lastUpsertCall).not.toBeNull();
+      const tools = lastUpsertCall!.policy?.allowedTools as string[];
+      expect(tools).toContain("publish_page");
+      expect(tools).toContain("unpublish_page");
+    });
+
+    test("allowedTools contains only publish_page and unpublish_page", async () => {
+      await setVercelConfig("vl_test_token_123");
+
+      expect(lastUpsertCall).not.toBeNull();
+      const tools = lastUpsertCall!.policy?.allowedTools as string[];
+      expect(tools).toEqual(["publish_page", "unpublish_page"]);
+    });
+
+    test("returns error when apiToken is not provided", async () => {
+      const result = await setVercelConfig(undefined);
+
+      expect(result.success).toBe(false);
+      expect(result.hasToken).toBe(false);
+      expect(result.error).toBeDefined();
+    });
+  });
+
+  // -- getVercelConfig --
+
+  describe("getVercelConfig", () => {
+    test("returns hasToken true when token exists", async () => {
+      secureKeyStore[credentialKey("vercel", "api_token")] = "some-token";
+      const result = await getVercelConfig();
+
+      expect(result.hasToken).toBe(true);
+      expect(result.success).toBe(true);
+    });
+
+    test("returns hasToken false when no token exists", async () => {
+      const result = await getVercelConfig();
+
+      expect(result.hasToken).toBe(false);
+      expect(result.success).toBe(true);
+    });
+  });
+
+  // -- deleteVercelConfig --
+
+  describe("deleteVercelConfig", () => {
+    test("removes both secure key and metadata", async () => {
+      secureKeyStore[credentialKey("vercel", "api_token")] = "token-to-delete";
+
+      const result = await deleteVercelConfig();
+
+      expect(result.success).toBe(true);
+      expect(result.hasToken).toBe(false);
+      // Secure key should be removed
+      expect(
+        secureKeyStore[credentialKey("vercel", "api_token")],
+      ).toBeUndefined();
+      // Metadata should be deleted
+      expect(metadataDeleted).toEqual({
+        service: "vercel",
+        field: "api_token",
+      });
+    });
+  });
+});

package/src/__tests__/voice-session-bridge.test.ts

@@ -652,6 +652,9 @@ describe("voice-session-bridge", () => {
     expect(prompt).toContain(
       "If your assistant name is not known, skip the name and just identify yourself as the guardian's assistant.",
     );
+    expect(prompt).toContain(
+      "Never use a UUID-shaped internal assistant ID as your spoken name.",
+    );
     expect(prompt).toContain(
       'Do NOT say "I\'m calling" or "I\'m calling on behalf of".',
     );

package/src/__tests__/web-search-catalog-parity.test.ts

@@ -0,0 +1,86 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { describe, expect, test } from "bun:test";
+
+import {
+  SEARCH_PROVIDER_CATALOG,
+  type SearchProviderCatalogEntry,
+} from "../providers/search-provider-catalog.js";
+
+/**
+ * Parity guard: daemon TS catalog vs `meta/web-search-provider-catalog.json`.
+ *
+ * The daemon maintains its canonical search-provider catalog in
+ * `assistant/src/providers/search-provider-catalog.ts`.
+ * `meta/web-search-provider-catalog.json` is generated by
+ * `assistant/scripts/sync-web-search-catalog.ts` and is the cross-package
+ * artifact consumed by CLI tests + (eventually) the web-side vendored
+ * catalog in `vellum-assistant-platform`.
+ *
+ * This test enforces structural equality between the two so CI fails when
+ * someone edits the TS catalog without regenerating the JSON. Mirrors the
+ * pattern from `llm-catalog-parity.test.ts`.
+ */
+
+interface JsonCatalogEntry {
+  id: string;
+  displayName: string;
+  displayNameLong?: string;
+  kind: "managed" | "byok";
+  apiKeyPrefix?: string;
+  envVar?: string;
+  secretKey?: string;
+  fallbackOrder?: number;
+  privacyPolicyUrl?: string;
+}
+
+interface JsonCatalog {
+  version: number;
+  providers: JsonCatalogEntry[];
+}
+
+function loadJsonCatalog(): JsonCatalog {
+  const path = join(process.cwd(), "..", "meta/web-search-provider-catalog.json");
+  return JSON.parse(readFileSync(path, "utf-8"));
+}
+
+function entryToPlain(
+  entry: SearchProviderCatalogEntry,
+): Record<string, unknown> {
+  // Project the TS entry into the same shape the JSON serializer emits:
+  // field order matches `sync-web-search-catalog.ts`, optional fields are
+  // omitted (not serialized as undefined).
+  const out: Record<string, unknown> = {
+    id: entry.id,
+    displayName: entry.displayName,
+  };
+  if (entry.displayNameLong !== undefined) {
+    out.displayNameLong = entry.displayNameLong;
+  }
+  out.kind = entry.kind;
+  if (entry.apiKeyPrefix !== undefined) out.apiKeyPrefix = entry.apiKeyPrefix;
+  if (entry.envVar !== undefined) out.envVar = entry.envVar;
+  if (entry.secretKey !== undefined) out.secretKey = entry.secretKey;
+  if (entry.fallbackOrder !== undefined) out.fallbackOrder = entry.fallbackOrder;
+  if (entry.privacyPolicyUrl !== undefined) {
+    out.privacyPolicyUrl = entry.privacyPolicyUrl;
+  }
+  return out;
+}
+
+describe("web-search catalog parity (TS canonical vs meta/ JSON)", () => {
+  test("provider list and metadata match exactly", () => {
+    const json = loadJsonCatalog();
+    const expected = SEARCH_PROVIDER_CATALOG.map(
+      entryToPlain,
+    ) as unknown as JsonCatalogEntry[];
+    expect(json.providers).toEqual(expected);
+  });
+
+  test("provider order matches declaration order", () => {
+    const json = loadJsonCatalog();
+    expect(json.providers.map((p) => p.id)).toEqual(
+      SEARCH_PROVIDER_CATALOG.map((p) => p.id),
+    );
+  });
+});

package/src/__tests__/web-search.test.ts

@@ -43,6 +43,17 @@ describe("WebSearchTool", () => {
       expect(result.isError).toBe(true);
       expect(result.content).toContain("No web search API key configured");
     });
+
+    test("returns error when no API key is configured (tavily)", async () => {
+      delete process.env.TAVILY_API_KEY;
+      const result = await executeWebSearch(
+        { query: "test" },
+        undefined,
+        "tavily",
+      );
+      expect(result.isError).toBe(true);
+      expect(result.content).toContain("No web search API key configured");
+    });
   });
 
   describe("input validation", () => {
@@ -508,6 +519,159 @@ describe("WebSearchTool", () => {
       expect(result.content).toContain("Network unreachable");
     });
   });
+
+  describe("Tavily API responses", () => {
+    test("formats results", async () => {
+      const mockResponse = {
+        results: [
+          {
+            title: "Tavily Result",
+            url: "https://example.com/tavily",
+            content: "A Tavily search snippet.",
+            score: 0.9234,
+          },
+        ],
+      };
+
+      globalThis.fetch = (async () =>
+        new Response(JSON.stringify(mockResponse), {
+          status: 200,
+          headers: { "Content-Type": "application/json" },
+        })) as unknown as typeof fetch;
+
+      const result = await executeWebSearch(
+        { query: "test" },
+        "tvly-key",
+        "tavily",
+      );
+      expect(result.isError).toBe(false);
+      expect(result.content).toContain("Tavily Result");
+      expect(result.content).toContain("https://example.com/tavily");
+      expect(result.content).toContain("A Tavily search snippet");
+      expect(result.content).toContain("Score: 0.923");
+    });
+
+    test("handles empty response", async () => {
+      globalThis.fetch = (async () =>
+        new Response(JSON.stringify({ results: [] }), {
+          status: 200,
+          headers: { "Content-Type": "application/json" },
+        })) as unknown as typeof fetch;
+
+      const result = await executeWebSearch(
+        { query: "noresults" },
+        "tvly-key",
+        "tavily",
+      );
+      expect(result.isError).toBe(false);
+      expect(result.content).toContain("No results found");
+    });
+
+    test("maps count and freshness into Tavily request body", async () => {
+      let capturedHeaders: Record<string, string> = {};
+      let capturedBody: Record<string, unknown> = {};
+      globalThis.fetch = (async (_url: string, init: RequestInit) => {
+        capturedHeaders = Object.fromEntries(
+          Object.entries(init.headers as Record<string, string>),
+        );
+        capturedBody = JSON.parse(init.body as string);
+        return new Response(JSON.stringify({ results: [] }), {
+          status: 200,
+          headers: { "Content-Type": "application/json" },
+        });
+      }) as unknown as typeof fetch;
+
+      await executeWebSearch(
+        { query: "test query", count: 50, freshness: "pw" },
+        "tvly-my-key",
+        "tavily",
+      );
+      expect(capturedHeaders.Authorization).toBe("Bearer tvly-my-key");
+      expect(capturedHeaders["Content-Type"]).toBe("application/json");
+      expect(capturedBody.query).toBe("test query");
+      expect(capturedBody.search_depth).toBe("advanced");
+      expect(capturedBody.max_results).toBe(20);
+      expect(capturedBody.time_range).toBe("week");
+    });
+
+    test("omits invalid freshness values", async () => {
+      let capturedBody: Record<string, unknown> = {};
+      globalThis.fetch = (async (_url: string, init: RequestInit) => {
+        capturedBody = JSON.parse(init.body as string);
+        return new Response(JSON.stringify({ results: [] }), {
+          status: 200,
+          headers: { "Content-Type": "application/json" },
+        });
+      }) as unknown as typeof fetch;
+
+      await executeWebSearch(
+        { query: "test query", freshness: "invalid" },
+        "tvly-my-key",
+        "tavily",
+      );
+      expect(capturedBody.time_range).toBeUndefined();
+    });
+
+    test("handles 401 unauthorized", async () => {
+      globalThis.fetch = (async () =>
+        new Response("Unauthorized", {
+          status: 401,
+        })) as unknown as typeof fetch;
+
+      const result = await executeWebSearch(
+        { query: "test" },
+        "bad-key",
+        "tavily",
+      );
+      expect(result.isError).toBe(true);
+      expect(result.content).toContain("Invalid or expired");
+    });
+
+    test("retries on 429 and succeeds", async () => {
+      let callCount = 0;
+      globalThis.fetch = (async () => {
+        callCount++;
+        if (callCount <= 2) {
+          return new Response("Too Many Requests", { status: 429 });
+        }
+        return new Response(
+          JSON.stringify({
+            results: [
+              {
+                title: "Found it",
+                url: "https://example.com/found",
+                content: "Found it with Tavily",
+              },
+            ],
+          }),
+          { status: 200, headers: { "Content-Type": "application/json" } },
+        );
+      }) as unknown as typeof fetch;
+
+      const result = await executeWebSearch(
+        { query: "test" },
+        "tvly-key",
+        "tavily",
+      );
+      expect(result.isError).toBe(false);
+      expect(result.content).toContain("Found it with Tavily");
+      expect(callCount).toBe(3);
+    });
+
+    test("handles network errors", async () => {
+      globalThis.fetch = (async () => {
+        throw new Error("Network unreachable");
+      }) as unknown as typeof fetch;
+
+      const result = await executeWebSearch(
+        { query: "test" },
+        "tvly-key",
+        "tavily",
+      );
+      expect(result.isError).toBe(true);
+      expect(result.content).toContain("Network unreachable");
+    });
+  });
 });
 
 interface BraveSearchResult {
@@ -527,6 +691,17 @@ interface PerplexityResponse {
   citations?: string[];
 }
 
+interface TavilySearchResult {
+  title?: string;
+  url?: string;
+  content?: string;
+  score?: number;
+}
+
+interface TavilySearchResponse {
+  results?: TavilySearchResult[];
+}
+
 /**
  * Helper that exercises the web search logic directly, bypassing module
  * registration concerns. This replicates the core execute path from
@@ -535,7 +710,7 @@ interface PerplexityResponse {
 async function executeWebSearch(
   input: Record<string, unknown>,
   apiKey?: string,
-  provider: "brave" | "perplexity" = "brave",
+  provider: "brave" | "perplexity" | "tavily" = "brave",
 ): Promise<{ content: string; isError: boolean }> {
   const query = input.query;
   if (!query || typeof query !== "string") {
@@ -548,7 +723,7 @@ async function executeWebSearch(
   if (!apiKey) {
     return {
       content:
-        "Error: No web search API key configured. Set it via `keys set perplexity <key>` or `keys set brave <key>`, or configure it from the Settings page under API Keys.",
+        "Error: No web search API key configured. Set it via `keys set perplexity <key>`, `keys set brave <key>`, or `keys set tavily <key>`, or configure it from the Settings page under API Keys.",
       isError: true,
     };
   }
@@ -557,6 +732,10 @@ async function executeWebSearch(
     return executePerplexitySearchHelper(query as string, apiKey);
   }
 
+  if (provider === "tavily") {
+    return executeTavilySearchHelper(input, query as string, apiKey);
+  }
+
   return executeBraveSearchHelper(input, query as string, apiKey);
 }
 
@@ -764,3 +943,125 @@ async function executePerplexitySearchHelper(
     return { content: `Error: Web search failed: ${msg}`, isError: true };
   }
 }
+
+function tavilyTimeRangeForFreshness(
+  freshness: string | undefined,
+): "day" | "week" | "month" | "year" | undefined {
+  switch (freshness) {
+    case "pd":
+      return "day";
+    case "pw":
+      return "week";
+    case "pm":
+      return "month";
+    case "py":
+      return "year";
+    default:
+      return undefined;
+  }
+}
+
+async function executeTavilySearchHelper(
+  input: Record<string, unknown>,
+  query: string,
+  apiKey: string,
+): Promise<{ content: string; isError: boolean }> {
+  const count =
+    typeof input.count === "number"
+      ? Math.min(20, Math.max(1, Math.round(input.count)))
+      : 10;
+  const timeRange = tavilyTimeRangeForFreshness(
+    typeof input.freshness === "string" ? input.freshness : undefined,
+  );
+  const body: Record<string, unknown> = {
+    query,
+    search_depth: "advanced",
+    max_results: count,
+  };
+  if (timeRange) body.time_range = timeRange;
+
+  const MAX_RETRIES = 3;
+  const BASE_DELAY_MS = 1;
+
+  try {
+    for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
+      const response = await fetch("https://api.tavily.com/search", {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${apiKey}`,
+          "X-Client-Source": "vellum-assistant",
+        },
+        body: JSON.stringify(body),
+      });
+
+      if (response.ok) {
+        const data = (await response.json()) as TavilySearchResponse;
+        const results = data.results ?? [];
+
+        if (results.length === 0) {
+          return {
+            content: `No results found for "${query}".`,
+            isError: false,
+          };
+        }
+
+        const lines: string[] = [`Web search results for "${query}":\n`];
+
+        for (let i = 0; i < results.length; i++) {
+          const r = results[i];
+          const title = r.title?.trim() || r.url?.trim() || "Untitled result";
+          lines.push(`${i + 1}. ${title}`);
+          if (r.url) lines.push(`   URL: ${r.url}`);
+          if (r.content) lines.push(`   ${r.content}`);
+          if (typeof r.score === "number") {
+            lines.push(`   Score: ${r.score.toFixed(3)}`);
+          }
+          lines.push("");
+        }
+
+        return { content: lines.join("\n"), isError: false };
+      }
+
+      await response.text();
+
+      if (response.status === 401 || response.status === 403) {
+        return {
+          content: "Error: Invalid or expired Tavily API key",
+          isError: true,
+        };
+      }
+
+      if (response.status === 429 && attempt < MAX_RETRIES) {
+        const retryAfter = response.headers.get("retry-after");
+        const delayMs =
+          retryAfter && !isNaN(Number(retryAfter))
+            ? Number(retryAfter) * 1000
+            : BASE_DELAY_MS * Math.pow(2, attempt);
+        await new Promise((resolve) => setTimeout(resolve, delayMs));
+        continue;
+      }
+
+      if (response.status === 429) {
+        return {
+          content:
+            "Error: Tavily Search rate limit exceeded after retries. Try again shortly.",
+          isError: true,
+        };
+      }
+      return {
+        content: `Error: Tavily Search API returned status ${response.status}`,
+        isError: true,
+      };
+    }
+
+    return {
+      content:
+        "Error: Tavily Search rate limit exceeded after retries. Try again shortly.",
+      isError: true,
+    };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return { content: `Error: Web search failed: ${msg}`, isError: true };
+  }
+}

package/src/__tests__/workspace-migration-039-drop-legacy-llm-keys.test.ts

@@ -176,11 +176,10 @@ describe("039-drop-legacy-llm-keys migration", () => {
     expect(config.contextWindow).toBeUndefined();
     expect(config.pricingOverrides).toBeUndefined();
 
-    // services.inference: provider/model stripped, mode preserved
+    // services.inference: provider/model stripped
     const services = config.services as { inference: Record<string, unknown> };
     expect(services.inference.provider).toBeUndefined();
     expect(services.inference.model).toBeUndefined();
-    expect(services.inference.mode).toBe("your-own");
 
     // heartbeat / filing
     const heartbeat = config.heartbeat as Record<string, unknown>;
@@ -248,31 +247,12 @@ describe("039-drop-legacy-llm-keys migration", () => {
     expect(config.speed).toBeUndefined();
     const services = config.services as { inference: Record<string, unknown> };
     expect(services.inference.provider).toBeUndefined();
-    expect(services.inference.mode).toBe("managed");
     expect(
       (config.notifications as Record<string, unknown>).decisionModelIntent,
     ).toBeUndefined();
     expect(config.maxStepsPerSession).toBe(50);
   });
 
-  // ─── services.inference.mode preservation ──────────────────────────────
-
-  test("preserves services.inference.mode while stripping provider/model", () => {
-    writeConfig({
-      services: {
-        inference: { mode: "your-own", provider: "openai", model: "gpt-5.4" },
-      },
-    });
-
-    dropLegacyLlmKeysMigration.run(workspaceDir);
-
-    const config = readConfig();
-    const services = config.services as { inference: Record<string, unknown> };
-    expect(services.inference.mode).toBe("your-own");
-    expect(services.inference.provider).toBeUndefined();
-    expect(services.inference.model).toBeUndefined();
-  });
-
   // ─── Idempotency ───────────────────────────────────────────────────────
 
   test("idempotency: re-running the migration yields no further mutation", () => {