@vellumai/assistant 0.7.3 → 0.8.1

package/src/__tests__/call-site-routing-provider.test.ts

@@ -8,6 +8,11 @@
  * without this wrapper a memoryRetrieval call configured to run on OpenAI
  * but originating from an Anthropic-default conversation would still hit
  * the Anthropic transport.
+ *
+ * Alternate-provider routing requires a `provider_connection`, and the
+ * wrapper takes a single async hook
+ * `(connectionName, expectedProvider) => Promise<Provider | null>`.
+ * Call-site profiles without a connection throw `ConnectionResolutionError`.
  */
 
 import { beforeEach, describe, expect, mock, test } from "bun:test";
@@ -26,6 +31,7 @@ mock.module("../config/loader.js", () => ({
 
 import { LLMSchema } from "../config/schemas/llm.js";
 import { CallSiteRoutingProvider } from "../providers/call-site-routing.js";
+import { ConnectionResolutionError } from "../providers/connection-resolution.js";
 import type {
   Message,
   Provider,
@@ -63,6 +69,21 @@ function setLlmConfig(raw: unknown): void {
   mockLlmConfig = LLMSchema.parse(raw) as Record<string, unknown>;
 }
 
+/**
+ * Build a connection-resolution hook keyed by connection name. Returns the
+ * matching Provider (or null if not registered). Async to satisfy the new
+ * `resolveByConnection` signature.
+ */
+function makeConnectionHook(
+  byConnection: Record<string, Provider>,
+): (
+  connectionName: string,
+  expectedProvider: string,
+) => Promise<Provider | null> {
+  return async (connectionName, _expectedProvider) =>
+    byConnection[connectionName] ?? null;
+}
+
 beforeEach(() => {
   mockLlmConfig = LLMSchema.parse({}) as Record<string, unknown>;
 });
@@ -71,8 +92,15 @@ describe("CallSiteRoutingProvider", () => {
   test("routes to default provider when callSite is absent", async () => {
     setLlmConfig({
       default: { provider: "anthropic", model: "claude-opus-4-7" },
+      profiles: {
+        altOpenai: {
+          provider: "openai",
+          provider_connection: "openai-conn",
+          model: "gpt-5.4",
+        },
+      },
       callSites: {
-        memoryRetrieval: { provider: "openai", model: "gpt-5.4" },
+        memoryRetrieval: { profile: "altOpenai" },
       },
     });
 
@@ -84,8 +112,9 @@ describe("CallSiteRoutingProvider", () => {
       calls.alt++;
     });
 
-    const wrapped = new CallSiteRoutingProvider(defaultProvider, (name) =>
-      name === "openai" ? altProvider : undefined,
+    const wrapped = new CallSiteRoutingProvider(
+      defaultProvider,
+      makeConnectionHook({ "openai-conn": altProvider }),
     );
 
     const response = await wrapped.sendMessage(
@@ -102,11 +131,12 @@ describe("CallSiteRoutingProvider", () => {
     expect(response.model).toBe("anthropic");
   });
 
-  test("routes to default provider when callSite resolves to same provider name", async () => {
+  test("routes to default provider when callSite resolves to same provider name (no connection)", async () => {
     setLlmConfig({
       default: { provider: "anthropic", model: "claude-opus-4-7" },
       callSites: {
-        // Same provider as default — no transport swap needed.
+        // Same provider as default, no connection — should reuse default
+        // without doing any connection resolution work.
         memoryRetrieval: { model: "claude-haiku-4-5-20251001" },
       },
     });
@@ -119,8 +149,9 @@ describe("CallSiteRoutingProvider", () => {
       calls.alt++;
     });
 
-    const wrapped = new CallSiteRoutingProvider(defaultProvider, (name) =>
-      name === "openai" ? altProvider : undefined,
+    const wrapped = new CallSiteRoutingProvider(
+      defaultProvider,
+      makeConnectionHook({ "openai-conn": altProvider }),
     );
 
     await wrapped.sendMessage(DUMMY_MESSAGES, undefined, undefined, {
@@ -131,11 +162,18 @@ describe("CallSiteRoutingProvider", () => {
     expect(calls.alt).toBe(0);
   });
 
-  test("routes to alternative provider when callSite resolves to a different provider name", async () => {
+  test("routes to alternative provider when callSite resolves to a profile with provider_connection", async () => {
     setLlmConfig({
       default: { provider: "anthropic", model: "claude-opus-4-7" },
+      profiles: {
+        altOpenai: {
+          provider: "openai",
+          provider_connection: "openai-conn",
+          model: "gpt-5.4",
+        },
+      },
       callSites: {
-        memoryRetrieval: { provider: "openai", model: "gpt-5.4" },
+        memoryRetrieval: { profile: "altOpenai" },
       },
     });
 
@@ -147,8 +185,9 @@ describe("CallSiteRoutingProvider", () => {
       calls.alt++;
     });
 
-    const wrapped = new CallSiteRoutingProvider(defaultProvider, (name) =>
-      name === "openai" ? altProvider : undefined,
+    const wrapped = new CallSiteRoutingProvider(
+      defaultProvider,
+      makeConnectionHook({ "openai-conn": altProvider }),
     );
 
     const response = await wrapped.sendMessage(
@@ -163,11 +202,18 @@ describe("CallSiteRoutingProvider", () => {
     expect(response.model).toBe("openai");
   });
 
-  test("falls back to default when alternative provider is not registered", async () => {
+  test("falls back to default when connection resolves to null (soft credential failure)", async () => {
     setLlmConfig({
       default: { provider: "anthropic", model: "claude-opus-4-7" },
+      profiles: {
+        altOpenai: {
+          provider: "openai",
+          provider_connection: "openai-conn",
+          model: "gpt-5.4",
+        },
+      },
       callSites: {
-        memoryRetrieval: { provider: "openai", model: "gpt-5.4" },
+        memoryRetrieval: { profile: "altOpenai" },
       },
     });
 
@@ -176,11 +222,11 @@ describe("CallSiteRoutingProvider", () => {
       calls.default++;
     });
 
-    // Lookup always returns undefined — simulating a missing/uninitialized
-    // provider in the registry.
+    // Hook always returns null — simulates a credential miss / transient
+    // auth failure inside the resolver.
     const wrapped = new CallSiteRoutingProvider(
       defaultProvider,
-      () => undefined,
+      async () => null,
     );
 
     const response = await wrapped.sendMessage(
@@ -194,19 +240,65 @@ describe("CallSiteRoutingProvider", () => {
     expect(response.model).toBe("anthropic");
   });
 
+  test("alternate-provider profile WITHOUT a connection throws ConnectionResolutionError", async () => {
+    setLlmConfig({
+      default: { provider: "anthropic", model: "claude-opus-4-7" },
+      profiles: {
+        legacyOpenai: {
+          provider: "openai",
+          // No provider_connection — alternate-provider routing requires
+          // one, so this profile is expected to throw
+          // `ConnectionResolutionError(missing_connection)` below.
+        },
+      },
+      callSites: {
+        memoryRetrieval: { profile: "legacyOpenai" },
+      },
+    });
+
+    const defaultProvider = makeProvider("anthropic", () => {});
+
+    const wrapped = new CallSiteRoutingProvider(
+      defaultProvider,
+      makeConnectionHook({}),
+    );
+
+    let caught: unknown;
+    try {
+      await wrapped.sendMessage(DUMMY_MESSAGES, undefined, undefined, {
+        config: { callSite: "memoryRetrieval" },
+      });
+    } catch (err) {
+      caught = err;
+    }
+
+    expect(caught).toBeInstanceOf(ConnectionResolutionError);
+    expect((caught as ConnectionResolutionError).reason).toBe(
+      "missing_connection",
+    );
+  });
+
   test("stamps actualProvider when routing to an alternative provider", async () => {
     setLlmConfig({
       default: { provider: "anthropic", model: "claude-opus-4-7" },
+      profiles: {
+        altOpenai: {
+          provider: "openai",
+          provider_connection: "openai-conn",
+          model: "gpt-5.5",
+        },
+      },
       callSites: {
-        memoryRetrieval: { provider: "openai", model: "gpt-5.5" },
+        memoryRetrieval: { profile: "altOpenai" },
       },
     });
 
     const defaultProvider = makeProvider("anthropic", () => {});
     const altProvider = makeProvider("openai", () => {});
 
-    const wrapped = new CallSiteRoutingProvider(defaultProvider, (name) =>
-      name === "openai" ? altProvider : undefined,
+    const wrapped = new CallSiteRoutingProvider(
+      defaultProvider,
+      makeConnectionHook({ "openai-conn": altProvider }),
     );
 
     const response = await wrapped.sendMessage(
@@ -225,8 +317,15 @@ describe("CallSiteRoutingProvider", () => {
   test("does not overwrite actualProvider already set by the alternative provider", async () => {
     setLlmConfig({
       default: { provider: "anthropic", model: "claude-opus-4-7" },
+      profiles: {
+        altOpenai: {
+          provider: "openai",
+          provider_connection: "openai-conn",
+          model: "gpt-5.5",
+        },
+      },
       callSites: {
-        memoryRetrieval: { provider: "openai", model: "gpt-5.5" },
+        memoryRetrieval: { profile: "altOpenai" },
       },
     });
 
@@ -242,8 +341,9 @@ describe("CallSiteRoutingProvider", () => {
       },
     };
 
-    const wrapped = new CallSiteRoutingProvider(defaultProvider, (name) =>
-      name === "openai" ? altProvider : undefined,
+    const wrapped = new CallSiteRoutingProvider(
+      defaultProvider,
+      makeConnectionHook({ "openai-conn": altProvider }),
     );
 
     const response = await wrapped.sendMessage(
@@ -265,7 +365,7 @@ describe("CallSiteRoutingProvider", () => {
 
     const wrapped = new CallSiteRoutingProvider(
       defaultProvider,
-      () => undefined,
+      makeConnectionHook({}),
     );
 
     const response = await wrapped.sendMessage(
@@ -290,7 +390,7 @@ describe("CallSiteRoutingProvider", () => {
 
     const wrapped = new CallSiteRoutingProvider(
       defaultProvider,
-      () => undefined,
+      makeConnectionHook({}),
     );
 
     expect(wrapped.name).toBe("anthropic");
@@ -304,8 +404,15 @@ describe("CallSiteRoutingProvider", () => {
     // event says "LLM call to anthropic" even when the call went to openai.
     setLlmConfig({
       default: { provider: "anthropic", model: "claude-opus-4-7" },
+      profiles: {
+        altOpenai: {
+          provider: "openai",
+          provider_connection: "openai-conn",
+          model: "gpt-5.5",
+        },
+      },
       callSites: {
-        memoryRetrieval: { provider: "openai", model: "gpt-5.5" },
+        memoryRetrieval: { profile: "altOpenai" },
       },
     });
 
@@ -321,8 +428,9 @@ describe("CallSiteRoutingProvider", () => {
       },
     };
 
-    const wrapped = new CallSiteRoutingProvider(defaultProvider, (name) =>
-      name === "openai" ? altProvider : undefined,
+    const wrapped = new CallSiteRoutingProvider(
+      defaultProvider,
+      makeConnectionHook({ "openai-conn": altProvider }),
     );
 
     expect(wrapped.name).toBe("anthropic"); // idle → default
@@ -339,9 +447,21 @@ describe("CallSiteRoutingProvider", () => {
     // other. AsyncLocalStorage gives each call its own async-context slot.
     setLlmConfig({
       default: { provider: "anthropic", model: "claude-opus-4-7" },
+      profiles: {
+        altOpenai: {
+          provider: "openai",
+          provider_connection: "openai-conn",
+          model: "gpt-5.5",
+        },
+        altFireworks: {
+          provider: "fireworks",
+          provider_connection: "fireworks-conn",
+          model: "qwen3-235b",
+        },
+      },
       callSites: {
-        memoryRetrieval: { provider: "openai", model: "gpt-5.5" },
-        conversationTitle: { provider: "fireworks", model: "qwen3-235b" },
+        memoryRetrieval: { profile: "altOpenai" },
+        conversationTitle: { profile: "altFireworks" },
       },
     });
 
@@ -349,18 +469,25 @@ describe("CallSiteRoutingProvider", () => {
     const nameSeenByOpenAI: string[] = [];
     const nameSeenByFireworks: string[] = [];
 
-    // Shared resolve handles so we can interleave the two calls:
-    // openAI starts → fireworks starts → openAI resolves → fireworks resolves
+    // Shared resolve handles, pre-bound via Deferred-style promises so they
+    // exist before either provider's sendMessage executes. The connection-
+    // aware dispatch path awaits an extra tick to resolve the connection
+    // before invoking sendMessage, so any late-binding via
+    // `new Promise((r) => { resolveOpenAI = r })` would race with the
+    // microtask queue — these handles must be assigned synchronously.
     let resolveOpenAI!: () => void;
     let resolveFireworks!: () => void;
+    const openAIBlocked = new Promise<void>((r) => {
+      resolveOpenAI = r;
+    });
+    const fireworksBlocked = new Promise<void>((r) => {
+      resolveFireworks = r;
+    });
 
     const openAIProvider: Provider = {
       name: "openai",
       async sendMessage() {
-        // Yield so fireworks call can start before we complete.
-        await new Promise<void>((r) => {
-          resolveOpenAI = r;
-        });
+        await openAIBlocked;
         nameSeenByOpenAI.push(wrapped.name);
         return makeResponse("openai");
       },
@@ -369,19 +496,19 @@ describe("CallSiteRoutingProvider", () => {
     const fireworksProvider: Provider = {
       name: "fireworks",
       async sendMessage() {
-        await new Promise<void>((r) => {
-          resolveFireworks = r;
-        });
+        await fireworksBlocked;
         nameSeenByFireworks.push(wrapped.name);
         return makeResponse("fireworks");
       },
     };
 
-    const wrapped = new CallSiteRoutingProvider(defaultProvider, (name) => {
-      if (name === "openai") return openAIProvider;
-      if (name === "fireworks") return fireworksProvider;
-      return undefined;
-    });
+    const wrapped = new CallSiteRoutingProvider(
+      defaultProvider,
+      makeConnectionHook({
+        "openai-conn": openAIProvider,
+        "fireworks-conn": fireworksProvider,
+      }),
+    );
 
     // Start both calls concurrently (do not await yet).
     const callA = wrapped.sendMessage(DUMMY_MESSAGES, undefined, undefined, {
@@ -391,8 +518,8 @@ describe("CallSiteRoutingProvider", () => {
       config: { callSite: "conversationTitle" }, // → fireworks
     });
 
-    // Let both reach their suspension point, then resolve in order.
-    await Promise.resolve(); // flush microtasks so both calls are in-flight
+    // Resolve both — the awaits above guarantee these handles fire even if
+    // the providers' sendMessage hasn't executed yet.
     resolveOpenAI();
     resolveFireworks();
 

package/src/__tests__/cancel-resolves-conversation-key.test.ts

@@ -57,6 +57,7 @@ mock.module("../daemon/handlers/conversations.js", () => ({
 import { getOrCreateConversation } from "../memory/conversation-key-store.js";
 import { initializeDb } from "../memory/db-init.js";
 import { ROUTES } from "../runtime/routes/conversation-management-routes.js";
+import { routeDefinitionsToHTTPRoutes } from "../runtime/routes/http-adapter.js";
 
 initializeDb();
 
@@ -73,27 +74,67 @@ describe("POST /v1/conversations/:id/cancel", () => {
 
     expect(internalId).not.toBe(conversationKey);
 
-    cancelRoute.handler({
+    const result = cancelRoute.handler({
       pathParams: { id: conversationKey },
       body: {},
       headers: {},
-
     });
 
     expect(cancelledId!).toBe(internalId);
+    expect(result).toEqual({
+      ok: true,
+      cancelled: true,
+      conversationId: internalId,
+    });
   });
 
   test("falls back to raw ID when key is not in the mapping", () => {
     cancelledId = undefined;
     const directId = "direct-conversation-id";
 
-    cancelRoute.handler({
+    const result = cancelRoute.handler({
       pathParams: { id: directId },
       body: {},
       headers: {},
+    });
 
+    expect(cancelledId!).toBe(directId);
+    expect(result).toEqual({
+      ok: true,
+      cancelled: true,
+      conversationId: directId,
     });
+  });
 
+  test("HTTP adapter returns a serializable 202 response", async () => {
+    cancelledId = undefined;
+    const directId = "direct-http-conversation-id";
+    const [httpRoute] = routeDefinitionsToHTTPRoutes([cancelRoute]);
+    const url = new URL(`http://localhost/v1/conversations/${directId}/cancel`);
+
+    const response = await httpRoute.handler({
+      req: new Request(url, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: "{}",
+      }),
+      url,
+      params: { id: directId },
+      authContext: {} as never,
+      server: {} as never,
+    });
+
+    expect(response.status).toBe(202);
+    expect(await response.json()).toEqual({
+      ok: true,
+      cancelled: true,
+      conversationId: directId,
+    });
     expect(cancelledId!).toBe(directId);
   });
+
+  test("route definition advertises the cancellation response body", () => {
+    expect(cancelRoute.responseStatus).toBe("202");
+    expect(cancelRoute.responseBody).toBeDefined();
+  });
 });

package/src/__tests__/channel-policy.test.ts

@@ -71,6 +71,7 @@ describe("channel policy registry", () => {
       "start_new_conversation",
       "continue_existing_conversation",
       "not_deliverable",
+      "push_only",
     ]);
 
     for (const channelId of CHANNEL_IDS) {
@@ -101,6 +102,7 @@ describe("channel policy registry", () => {
       ["telegram", "continue_existing_conversation"],
       ["slack", "continue_existing_conversation"],
       ["phone", "not_deliverable"],
+      ["platform", "push_only"],
     ];
 
     for (const [channelId, expected] of expectedStrategies) {
@@ -113,6 +115,7 @@ describe("channel policy registry", () => {
       "start_new_conversation",
       "continue_existing_conversation",
       "not_deliverable",
+      "push_only",
     ]);
 
     for (const channelId of CHANNEL_IDS) {
@@ -148,4 +151,13 @@ describe("channel policy registry", () => {
       }
     }
   });
+
+  test("channels with push_only strategy have deliveryEnabled: true", () => {
+    for (const channelId of CHANNEL_IDS) {
+      const policy = getChannelPolicy(channelId);
+      if (policy.notification.conversationStrategy === "push_only") {
+        expect(policy.notification.deliveryEnabled).toBe(true);
+      }
+    }
+  });
 });

package/src/__tests__/checker.test.ts

@@ -1597,6 +1597,95 @@ describe("bash network_mode=proxied — risk capped at medium", () => {
   });
 });
 
+describe("credentialed proxied bash — high risk escalation", () => {
+  beforeEach(() => {
+    mockRisk("low");
+    mockIpcResponse("get_global_thresholds", DEFAULT_GATEWAY_THRESHOLDS);
+    _clearGlobalCacheForTesting();
+    clearRiskCache();
+    testConfig.skills = { load: { extraDirs: [] } };
+  });
+
+  test("proxied bash with credential_ids sends credentialRefCount in IPC params", async () => {
+    mockRisk("high", {
+      reason:
+        "Proxied credential session — shell has access to injected credentials",
+    });
+    const result = await check(
+      "bash",
+      {
+        command: "curl https://api.example.com",
+        network_mode: "proxied",
+        credential_ids: ["cred-abc-123"],
+      },
+      "/tmp",
+    );
+    expect(result.decision).toBe("prompt");
+    expect(result.reason).toContain("credential");
+  });
+
+  test("proxied bash with multiple credential_ids prompts with high risk", async () => {
+    mockRisk("high", {
+      reason:
+        "Proxied credential session — shell has access to injected credentials",
+    });
+    const result = await check(
+      "bash",
+      {
+        command: "ls",
+        network_mode: "proxied",
+        credential_ids: ["cred-1", "cred-2"],
+      },
+      "/tmp",
+    );
+    expect(result.decision).toBe("prompt");
+  });
+
+  test("proxied bash with empty credential_ids array does not escalate risk", async () => {
+    mockRisk("low");
+    const result = await check(
+      "bash",
+      {
+        command: "ls",
+        network_mode: "proxied",
+        credential_ids: [],
+      },
+      "/tmp",
+    );
+    // Empty array means no credential refs — follows normal proxied behavior
+    expect(result.decision).toBe("allow");
+  });
+
+  test("proxied bash with credential_ids containing empty strings does not escalate", async () => {
+    mockRisk("low");
+    const result = await check(
+      "bash",
+      {
+        command: "ls",
+        network_mode: "proxied",
+        credential_ids: ["", ""],
+      },
+      "/tmp",
+    );
+    // Empty strings are filtered out, so no credential refs
+    expect(result.decision).toBe("allow");
+  });
+
+  test("non-proxied bash with credential_ids follows normal flow", async () => {
+    mockRisk("low");
+    const result = await check(
+      "bash",
+      {
+        command: "ls",
+        credential_ids: ["cred-abc-123"],
+      },
+      "/tmp",
+    );
+    // Without proxied mode, credential refs don't affect IPC classification
+    expect(result.decision).toBe("allow");
+  });
+});
+
 describe("workspace mode — auto-allow workspace-scoped operations", () => {
   const workspaceDir = "/home/user/my-project";