@vellumai/assistant 0.7.3 → 0.8.1

package/src/__tests__/annotate-risk-options.test.ts

@@ -0,0 +1,291 @@
+/**
+ * Tests for `annotatePersistedAssistantMessage` persisting the 3 risk-option
+ * arrays alongside the existing `_risk*` scalars.
+ *
+ * Phase B of the conflation track. Without these annotations, the Rule Editor
+ * Modal's chip ladder loses its scope/allowlist/directory options on chat-
+ * history reload and falls back to the synthesized `*` allowlist.
+ *
+ * The test exercises the full populate → annotate → persist round-trip:
+ *   handleToolResult(event with 3 arrays)
+ *     → state.toolRiskOutcomes captures them
+ *     → annotatePersistedAssistantMessage writes _risk*Options onto the row
+ *     → updateMessageContent receives the JSON-serialized output
+ *
+ * Read-side coverage (renderHistoryContent in handlers/shared.ts) lives in
+ * server-history-render.test.ts.
+ */
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+// ── Mock platform (must precede imports that read it) ─────────────────────────
+mock.module("../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+mock.module("../config/loader.js", () => ({
+  getConfig: () => ({
+    skills: {
+      entries: {},
+      load: { extraDirs: [], watch: false, watchDebounceMs: 0 },
+      install: { nodeManager: "npm" },
+      allowBundled: null,
+      remoteProviders: {
+        skillssh: { enabled: true },
+        clawhub: { enabled: true },
+      },
+      remotePolicy: {
+        blockSuspicious: true,
+        blockMalware: true,
+        maxSkillsShRisk: "medium",
+      },
+    },
+  }),
+  loadConfig: () => ({}),
+}));
+
+let mockedRowContent = "";
+const updates: Array<{ id: string; content: string }> = [];
+
+mock.module("../memory/conversation-crud.js", () => ({
+  addMessage: () => ({ id: "mock-msg-id" }),
+  getMessageById: (id: string) =>
+    mockedRowContent ? { id, content: mockedRowContent } : null,
+  updateMessageContent: (id: string, content: string) => {
+    updates.push({ id, content });
+  },
+  provenanceFromTrustContext: () => ({}),
+}));
+
+mock.module("../memory/llm-request-log-store.js", () => ({
+  recordRequestLog: () => {},
+  backfillMessageIdOnLogs: () => {},
+}));
+
+// ── Imports (after mocks) ─────────────────────────────────────────────────────
+import type {
+  EventHandlerDeps,
+  EventHandlerState,
+} from "../daemon/conversation-agent-loop-handlers.js";
+import {
+  createEventHandlerState,
+  handleToolResult,
+} from "../daemon/conversation-agent-loop-handlers.js";
+
+// ── Helpers ───────────────────────────────────────────────────────────────────
+
+function makeDeps(): EventHandlerDeps {
+  return {
+    ctx: {
+      conversationId: "test-conv",
+      provider: { name: "anthropic" },
+      traceEmitter: { emit: () => {} },
+      streamThinking: false,
+      emitActivityState: () => {},
+      markWorkspaceTopLevelDirty: () => {},
+      currentTurnSurfaces: [],
+    } as unknown as EventHandlerDeps["ctx"],
+    onEvent: () => {},
+    reqId: "test-req",
+    isFirstMessage: false,
+    shouldGenerateTitle: false,
+    rlog: new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }) as unknown as EventHandlerDeps["rlog"],
+    turnChannelContext: {
+      userMessageChannel: "vellum",
+      assistantMessageChannel: "vellum",
+    } as unknown as EventHandlerDeps["turnChannelContext"],
+    turnInterfaceContext: {
+      userMessageInterface: "web",
+      assistantMessageInterface: "web",
+    } as unknown as EventHandlerDeps["turnInterfaceContext"],
+  };
+}
+
+function setupState(toolUseId: string): EventHandlerState {
+  const state = createEventHandlerState();
+  state.lastAssistantMessageId = "msg-1";
+  state.toolUseIdToName.set(toolUseId, "bash");
+  state.toolCallTimestamps.set(toolUseId, { startedAt: Date.now() });
+  state.currentTurnToolUseIds.push(toolUseId);
+  return state;
+}
+
+function findPersistedToolUse(
+  rawContent: string,
+  toolUseId: string,
+): Record<string, unknown> {
+  const parsed = JSON.parse(rawContent) as Array<Record<string, unknown>>;
+  const block = parsed.find(
+    (b) => b.type === "tool_use" && b.id === toolUseId,
+  );
+  if (!block) throw new Error(`tool_use block ${toolUseId} not found`);
+  return block;
+}
+
+// ── Tests ─────────────────────────────────────────────────────────────────────
+
+describe("annotatePersistedAssistantMessage — risk-option arrays (Phase B)", () => {
+  beforeEach(() => {
+    updates.length = 0;
+    mockedRowContent = "";
+  });
+
+  test("persists all 3 risk-option arrays from the live tool_result event", () => {
+    const toolUseId = "tu_persist_full";
+    const state = setupState(toolUseId);
+
+    mockedRowContent = JSON.stringify([
+      {
+        type: "tool_use",
+        id: toolUseId,
+        name: "bash",
+        input: { command: "rm -rf /tmp" },
+      },
+    ]);
+
+    const scopeOptions = [
+      { pattern: "exact", label: "exact: rm -rf /tmp" },
+      { pattern: "by-program", label: "All rm" },
+    ];
+    const allowlistOptions = [
+      { label: "exact", description: "exact match", pattern: "rm -rf /tmp" },
+      { label: "All rm", description: "All rm commands", pattern: "rm *" },
+    ];
+    const directoryScopeOptions = [
+      { scope: "/Users/me/code", label: "in code/" },
+      { scope: "everywhere", label: "Everywhere" },
+    ];
+
+    handleToolResult(state, makeDeps(), {
+      type: "tool_result",
+      toolUseId,
+      content: "ok",
+      isError: false,
+      riskLevel: "high",
+      riskReason: "Modifies state",
+      matchedTrustRuleId: "rule_42",
+      riskScopeOptions: scopeOptions,
+      riskAllowlistOptions: allowlistOptions,
+      riskDirectoryScopeOptions: directoryScopeOptions,
+      approvalMode: "prompted",
+      approvalReason: "user_approved",
+      riskThreshold: "relaxed",
+    });
+
+    expect(updates).toHaveLength(1);
+    const block = findPersistedToolUse(updates[0].content, toolUseId);
+    // Existing scalars still flow through.
+    expect(block._riskLevel).toBe("high");
+    expect(block._riskReason).toBe("Modifies state");
+    expect(block._matchedTrustRuleId).toBe("rule_42");
+    expect(block._approvalMode).toBe("prompted");
+    expect(block._approvalReason).toBe("user_approved");
+    expect(block._riskThreshold).toBe("relaxed");
+    // New: 3 risk-option arrays persisted verbatim.
+    expect(block._riskScopeOptions).toEqual(scopeOptions);
+    expect(block._riskAllowlistOptions).toEqual(allowlistOptions);
+    expect(block._riskDirectoryScopeOptions).toEqual(directoryScopeOptions);
+  });
+
+  test("omits empty arrays from the persisted block (saves DB space)", () => {
+    const toolUseId = "tu_persist_empty";
+    const state = setupState(toolUseId);
+
+    mockedRowContent = JSON.stringify([
+      {
+        type: "tool_use",
+        id: toolUseId,
+        name: "bash",
+        input: { command: "ls" },
+      },
+    ]);
+
+    handleToolResult(state, makeDeps(), {
+      type: "tool_result",
+      toolUseId,
+      content: "ok",
+      isError: false,
+      riskLevel: "low",
+      riskScopeOptions: [],
+      riskAllowlistOptions: [],
+      riskDirectoryScopeOptions: [],
+    });
+
+    expect(updates).toHaveLength(1);
+    const block = findPersistedToolUse(updates[0].content, toolUseId);
+    expect(block._riskLevel).toBe("low");
+    expect(block._riskScopeOptions).toBeUndefined();
+    expect(block._riskAllowlistOptions).toBeUndefined();
+    expect(block._riskDirectoryScopeOptions).toBeUndefined();
+  });
+
+  test("omits absent (undefined) arrays from the persisted block", () => {
+    // Mirrors classic bash/file tools that don't always emit all 3 arrays —
+    // e.g. recall, file_read with riskLevel=low and no allowlist coverage.
+    const toolUseId = "tu_persist_absent";
+    const state = setupState(toolUseId);
+
+    mockedRowContent = JSON.stringify([
+      {
+        type: "tool_use",
+        id: toolUseId,
+        name: "recall",
+        input: { query: "anything" },
+      },
+    ]);
+
+    handleToolResult(state, makeDeps(), {
+      type: "tool_result",
+      toolUseId,
+      content: "ok",
+      isError: false,
+      riskLevel: "low",
+      // No risk-option arrays passed at all.
+    });
+
+    expect(updates).toHaveLength(1);
+    const block = findPersistedToolUse(updates[0].content, toolUseId);
+    expect(block._riskLevel).toBe("low");
+    expect(block._riskScopeOptions).toBeUndefined();
+    expect(block._riskAllowlistOptions).toBeUndefined();
+    expect(block._riskDirectoryScopeOptions).toBeUndefined();
+  });
+
+  test("partial coverage — only allowlist options present (e.g. tools with classifier but no scope ladder)", () => {
+    const toolUseId = "tu_partial";
+    const state = setupState(toolUseId);
+
+    mockedRowContent = JSON.stringify([
+      {
+        type: "tool_use",
+        id: toolUseId,
+        name: "file_write",
+        input: { path: "/tmp/foo.txt" },
+      },
+    ]);
+
+    const allowlistOptions = [
+      { label: "exact", description: "exact match", pattern: "/tmp/foo.txt" },
+    ];
+
+    handleToolResult(state, makeDeps(), {
+      type: "tool_result",
+      toolUseId,
+      content: "ok",
+      isError: false,
+      riskLevel: "medium",
+      riskAllowlistOptions: allowlistOptions,
+    });
+
+    expect(updates).toHaveLength(1);
+    const block = findPersistedToolUse(updates[0].content, toolUseId);
+    expect(block._riskLevel).toBe("medium");
+    expect(block._riskAllowlistOptions).toEqual(allowlistOptions);
+    expect(block._riskScopeOptions).toBeUndefined();
+    expect(block._riskDirectoryScopeOptions).toBeUndefined();
+  });
+});

package/src/__tests__/anthropic-provider.test.ts

@@ -807,7 +807,7 @@ describe("AnthropicProvider — Cache-Control Characterization", () => {
 
   test("orphaned server_tool_use gets synthetic web_search_tool_result injected", async () => {
     // When stream is interrupted, server_tool_use may be stored without its
-    // paired web_search_tool_result. repairOrphanedServerToolUse should inject
+    // paired web_search_tool_result. repairOrphanedServerToolBlocks should inject
     // a synthetic error web_search_tool_result after the orphan so the model
     // knows the search failed (rather than silently returning zero results).
     const messages: Message[] = [
@@ -1133,7 +1133,7 @@ describe("AnthropicProvider — Cache-Control Characterization", () => {
 
   test("paired server_tool_use is not modified by repair", async () => {
     // When server_tool_use has its matching web_search_tool_result,
-    // repairOrphanedServerToolUse should not inject anything.
+    // repairOrphanedServerToolBlocks should not inject anything.
     const messages: Message[] = [
       userMsg("search"),
       {
@@ -1178,6 +1178,96 @@ describe("AnthropicProvider — Cache-Control Characterization", () => {
     expect(wsResults[0].tool_use_id).toBe("srvtoolu_paired");
   });
 
+  test("orphaned web_search_tool_result with no preceding server_tool_use gets downgraded to text", async () => {
+    // The inverse of the orphan server_tool_use case. A
+    // web_search_tool_result whose tool_use_id has no matching server_tool_use
+    // in the same assistant message would trip Anthropic's
+    // "messages.N.content.M: unexpected tool_use_id" error. Downgrading the
+    // orphan to a text block preserves the titles/URLs for the model and
+    // keeps the request valid.
+    const messages: Message[] = [
+      userMsg("Tell me more"),
+      {
+        role: "assistant",
+        content: [
+          { type: "text", text: "Let me check." },
+          {
+            type: "web_search_tool_result",
+            tool_use_id: "srvtoolu_orphaned",
+            content: [
+              {
+                type: "web_search_result",
+                url: "https://example.com",
+                title: "Example",
+                encrypted_content: "enc_abc",
+              },
+            ],
+          },
+        ],
+      },
+      userMsg("Thanks"),
+    ];
+    await provider.sendMessage(messages);
+
+    const sent = lastStreamParams!.messages as Array<{
+      role: string;
+      content: Array<{ type: string; text?: string; tool_use_id?: string }>;
+    }>;
+
+    // No web_search_tool_result block survives anywhere in the dispatched
+    // request — the orphan must be downgraded so Anthropic doesn't 400.
+    const allBlocks = sent.flatMap((m) => m.content);
+    expect(allBlocks.every((b) => b.type !== "web_search_tool_result")).toBe(
+      true,
+    );
+
+    // The downgrade text references the orphan id and the result's URL so
+    // the model retains context.
+    const assistantMsg = sent[1];
+    expect(assistantMsg.role).toBe("assistant");
+    const downgraded = assistantMsg.content.find(
+      (b) => b.type === "text" && b.text?.includes("srvtoolu_orphaned"),
+    );
+    expect(downgraded).toBeDefined();
+    expect(downgraded!.text).toContain("https://example.com");
+  });
+
+  test("orphaned web_search_tool_result with no content array still downgrades cleanly", async () => {
+    const messages: Message[] = [
+      userMsg("status?"),
+      {
+        role: "assistant",
+        content: [
+          {
+            type: "web_search_tool_result",
+            tool_use_id: "srvtoolu_empty",
+            content: {
+              type: "web_search_tool_result_error",
+              error_code: "unavailable",
+            },
+          },
+        ],
+      },
+      userMsg("ok"),
+    ];
+    await provider.sendMessage(messages);
+
+    const sent = lastStreamParams!.messages as Array<{
+      role: string;
+      content: Array<{ type: string; text?: string }>;
+    }>;
+
+    const allBlocks = sent.flatMap((m) => m.content);
+    expect(allBlocks.every((b) => b.type !== "web_search_tool_result")).toBe(
+      true,
+    );
+    const downgraded = sent[1].content.find(
+      (b) => b.type === "text" && b.text?.includes("srvtoolu_empty"),
+    );
+    expect(downgraded).toBeDefined();
+    expect(downgraded!.text).toContain("results unavailable");
+  });
+
   test("assistant message with only unknown blocks gets placeholder text", async () => {
     const messages: Message[] = [
       userMsg("Start"),

package/src/__tests__/app-control-flow.test.ts

@@ -65,6 +65,13 @@ mock.module("../runtime/assistant-event-hub.js", () => ({
       cap === "host_app_control" && mockHasClient
         ? { id: "mock-client" }
         : null,
+    // Stubbed for the surfaceProxyResolver's target_client_id resolution
+    // path. The flow tests do not exercise multiple-client scenarios; they
+    // only need the resolver to fall through to proxy.request without
+    // throwing on undefined methods.
+    listClientsByCapability: () => [],
+    getClientById: () => undefined,
+    getActorPrincipalIdForClient: () => undefined,
   },
 }));
 

package/src/__tests__/approval-cascade.test.ts

@@ -291,21 +291,13 @@ function seedPendingConfirmation(
   conversation: Conversation,
   requestId: string,
 ): void {
+  // Access private ownedIds so denyAllPending/dispose can find this request.
+  // promptResolve/promptReject callbacks are stored in pendingInteractions via
+  // registerPendingInteraction, which is called separately in each test.
   const prompter = conversation["prompter"] as unknown as {
-    pending: Map<
-      string,
-      {
-        resolve: (...args: unknown[]) => void;
-        reject: (...args: unknown[]) => void;
-        timer: ReturnType<typeof setTimeout>;
-      }
-    >;
+    ownedIds: Set<string>;
   };
-  prompter.pending.set(requestId, {
-    resolve: () => {},
-    reject: () => {},
-    timer: setTimeout(() => {}, 60_000),
-  });
+  prompter.ownedIds.add(requestId);
 }
 
 /**
@@ -439,12 +431,12 @@ describe("approval cascading", () => {
       makeConfirmationDetails(["bash:echo stale"]),
     );
 
-    // Remove req-stale from the prompter's pending map (simulating it was
+    // Remove req-stale from the prompter's ownedIds (simulating it was
     // already resolved by another path before cascade reaches it)
     const prompter = conversationObj["prompter"] as unknown as {
-      pending: Map<string, unknown>;
+      ownedIds: Set<string>;
     };
-    prompter.pending.delete("req-stale");
+    prompter.ownedIds.delete("req-stale");
 
     // This should not throw — cascade should skip req-stale gracefully
     expect(() => {

package/src/__tests__/approval-routes-http.test.ts

@@ -192,6 +192,8 @@ function makeIdleSession(opts?: {
       processing = false;
     },
     handleConfirmationResponse: (requestId: string, decision: string) => {
+      // Simulate PermissionPrompter.resolveConfirmation(): prompter owns deregistration.
+      pendingInteractions.resolve(requestId);
       opts?.onConfirmation?.(requestId, decision);
     },
     handleSecretResponse: (
@@ -199,6 +201,8 @@ function makeIdleSession(opts?: {
       value?: string,
       delivery?: string,
     ) => {
+      // Simulate SecretPrompter.resolveSecret(): prompter owns deregistration.
+      pendingInteractions.resolve(requestId);
       opts?.onSecret?.(requestId, value, delivery);
     },
   } as unknown as Conversation;
@@ -285,6 +289,8 @@ function makeConfirmationEmittingSession(opts?: {
       await new Promise<void>(() => {});
     },
     handleConfirmationResponse: (requestId: string, decision: string) => {
+      // Simulate PermissionPrompter.resolveConfirmation(): prompter owns deregistration.
+      pendingInteractions.resolve(requestId);
       opts?.onConfirmation?.(requestId, decision);
     },
     handleSecretResponse: () => {},