@vellumai/assistant 0.8.0 → 0.8.1

package/src/__tests__/scheduler-reuse-conversation.test.ts

@@ -16,6 +16,63 @@ mock.module("../util/logger.js", () => ({
   truncateForLog: (value: string) => value,
 }));
 
+// Mock the shared `runBackgroundJob` runner so the scheduler's fresh-bootstrap
+// talk-mode path stays observable in unit tests. Each invocation creates a new
+// conversation row (so `getLastScheduleConversationId` lookups reflect reality)
+// and pushes onto a shared log mirrored by the per-test `processMessage`
+// callback used for the reuse path — that way assertions don't have to know
+// which path a given run took.
+const processedMessages: { conversationId: string; message: string }[] = [];
+const runBackgroundJobOptions: Array<{
+  conversationType?: string;
+  scheduleJobId?: string;
+  groupId?: string;
+  suppressFailureNotifications?: boolean;
+  onConversationCreated?: (id: string) => void;
+}> = [];
+let runBackgroundJobShouldFail = false;
+mock.module("../runtime/background-job-runner.js", () => ({
+  runBackgroundJob: async (opts: {
+    prompt: string;
+    groupId?: string;
+    conversationType?: "background" | "scheduled";
+    scheduleJobId?: string;
+    suppressFailureNotifications?: boolean;
+    onConversationCreated?: (id: string) => void;
+  }) => {
+    const { createConversation } =
+      await import("../memory/conversation-crud.js");
+    const conv = createConversation({
+      title: "(test stub)",
+      conversationType: opts.conversationType ?? "background",
+      source: "schedule",
+      ...(opts.groupId ? { groupId: opts.groupId } : {}),
+      ...(opts.scheduleJobId ? { scheduleJobId: opts.scheduleJobId } : {}),
+    });
+    runBackgroundJobOptions.push({
+      conversationType: opts.conversationType,
+      scheduleJobId: opts.scheduleJobId,
+      groupId: opts.groupId,
+      suppressFailureNotifications: opts.suppressFailureNotifications,
+      onConversationCreated: opts.onConversationCreated,
+    });
+    // Mirror the real runner's contract: fire the SSE callback synchronously
+    // BEFORE the job's processMessage finishes, with the bootstrap-returned
+    // conversation id.
+    opts.onConversationCreated?.(conv.id);
+    processedMessages.push({ conversationId: conv.id, message: opts.prompt });
+    if (runBackgroundJobShouldFail) {
+      return {
+        conversationId: conv.id,
+        ok: false,
+        error: new Error("Simulated failure"),
+        errorKind: "exception" as const,
+      };
+    }
+    return { conversationId: conv.id, ok: true };
+  },
+}));
+
 import { deleteConversation } from "../memory/conversation-crud.js";
 import { getDb } from "../memory/db-connection.js";
 import { initializeDb } from "../memory/db-init.js";
@@ -77,6 +134,9 @@ describe("scheduler conversation reuse", () => {
     db.run("DELETE FROM tasks");
     db.run("DELETE FROM messages");
     db.run("DELETE FROM conversations");
+    processedMessages.length = 0;
+    runBackgroundJobOptions.length = 0;
+    runBackgroundJobShouldFail = false;
   });
 
   test("recurring schedule with reuseConversation=true reuses conversation across runs", async () => {
@@ -99,7 +159,6 @@ describe("scheduler conversation reuse", () => {
     // WHEN the schedule fires for the first time
     forceScheduleDue(schedule.id);
 
-    const processedMessages: { conversationId: string; message: string }[] = [];
     const processMessage = async (conversationId: string, message: string) => {
       processedMessages.push({ conversationId, message });
     };
@@ -156,7 +215,6 @@ describe("scheduler conversation reuse", () => {
     // WHEN the schedule fires for the first time
     forceScheduleDue(schedule.id);
 
-    const processedMessages: { conversationId: string; message: string }[] = [];
     const processMessage = async (conversationId: string, message: string) => {
       processedMessages.push({ conversationId, message });
     };
@@ -200,7 +258,6 @@ describe("scheduler conversation reuse", () => {
 
     forceScheduleDue(schedule.id);
 
-    const processedMessages: { conversationId: string; message: string }[] = [];
     const processMessage = async (conversationId: string, message: string) => {
       processedMessages.push({ conversationId, message });
     };
@@ -245,7 +302,6 @@ describe("scheduler conversation reuse", () => {
     });
 
     // WHEN the schedule fires
-    const processedMessages: { conversationId: string; message: string }[] = [];
     const processMessage = async (conversationId: string, message: string) => {
       processedMessages.push({ conversationId, message });
     };
@@ -285,7 +341,6 @@ describe("scheduler conversation reuse", () => {
     forceScheduleDue(schedule.id);
 
     let shouldFail = false;
-    const processedMessages: { conversationId: string; message: string }[] = [];
     const processMessage = async (conversationId: string, message: string) => {
       processedMessages.push({ conversationId, message });
       if (shouldFail) throw new Error("Simulated failure");
@@ -327,3 +382,104 @@ describe("scheduler conversation reuse", () => {
     expect(processedMessages[0].conversationId).toBe(successConversationId);
   });
 });
+
+describe("scheduler talk-mode runner option propagation", () => {
+  beforeEach(() => {
+    const db = getDb();
+    db.run("DELETE FROM cron_runs");
+    db.run("DELETE FROM cron_jobs");
+    db.run("DELETE FROM messages");
+    db.run("DELETE FROM conversations");
+    processedMessages.length = 0;
+    runBackgroundJobOptions.length = 0;
+    runBackgroundJobShouldFail = false;
+  });
+
+  test("talk-mode propagates conversationType=scheduled, scheduleJobId, and quiet=>suppressFailureNotifications", async () => {
+    const rruleExpr = buildEveryMinuteRrule();
+    const schedule = createSchedule({
+      name: "Quiet Talk Mode",
+      cronExpression: rruleExpr,
+      message: "Background work",
+      syntax: "rrule",
+      expression: rruleExpr,
+      quiet: true,
+    });
+    forceScheduleDue(schedule.id);
+
+    const processMessage = async () => {};
+    const scheduler = startScheduler(processMessage, () => {});
+    await new Promise((resolve) => setTimeout(resolve, 500));
+    scheduler.stop();
+
+    expect(runBackgroundJobOptions).toHaveLength(1);
+    const opts = runBackgroundJobOptions[0]!;
+    expect(opts.conversationType).toBe("scheduled");
+    expect(opts.scheduleJobId).toBe(schedule.id);
+    expect(opts.groupId).toBe("system:scheduled");
+    expect(opts.suppressFailureNotifications).toBe(true);
+  });
+
+  test("talk-mode without quiet leaves suppressFailureNotifications=false", async () => {
+    const rruleExpr = buildEveryMinuteRrule();
+    const schedule = createSchedule({
+      name: "Loud Talk Mode",
+      cronExpression: rruleExpr,
+      message: "Background work",
+      syntax: "rrule",
+      expression: rruleExpr,
+      // quiet defaults to false
+    });
+    forceScheduleDue(schedule.id);
+
+    const processMessage = async () => {};
+    const scheduler = startScheduler(processMessage, () => {});
+    await new Promise((resolve) => setTimeout(resolve, 500));
+    scheduler.stop();
+
+    expect(runBackgroundJobOptions).toHaveLength(1);
+    expect(runBackgroundJobOptions[0]!.suppressFailureNotifications).toBe(
+      false,
+    );
+  });
+
+  test("talk-mode fires onScheduleConversationCreated synchronously via runner callback (BEFORE the runner returns)", async () => {
+    const rruleExpr = buildEveryMinuteRrule();
+    const schedule = createSchedule({
+      name: "SSE timing",
+      cronExpression: rruleExpr,
+      message: "x",
+      syntax: "rrule",
+      expression: rruleExpr,
+    });
+    forceScheduleDue(schedule.id);
+
+    const sseCalls: Array<{
+      conversationId: string;
+      scheduleJobId: string;
+      title: string;
+    }> = [];
+    const processMessage = async () => {};
+    const scheduler = startScheduler(
+      processMessage,
+      () => {},
+      undefined,
+      (info) => sseCalls.push(info),
+    );
+    await new Promise((resolve) => setTimeout(resolve, 500));
+    scheduler.stop();
+
+    expect(sseCalls).toHaveLength(1);
+    expect(sseCalls[0]).toMatchObject({
+      scheduleJobId: schedule.id,
+      title: "SSE timing",
+    });
+    // The mock runner fires the callback synchronously after creating the
+    // conversation row, so the conversationId must be the same id the runner
+    // ultimately reports.
+    expect(processedMessages).toHaveLength(1);
+    expect(sseCalls[0].conversationId).toBe(
+      processedMessages[0].conversationId,
+    );
+  });
+});

package/src/__tests__/scheduler-wake.test.ts

@@ -27,11 +27,6 @@ mock.module("../runtime/agent-wake.js", () => ({
   wakeAgentForOpportunity: mockWakeAgentForOpportunity,
 }));
 
-const mockEmitFeedEvent = mock(() => Promise.resolve());
-mock.module("../home/emit-feed-event.js", () => ({
-  emitFeedEvent: mockEmitFeedEvent,
-}));
-
 import { getDb } from "../memory/db-connection.js";
 import { initializeDb } from "../memory/db-init.js";
 import { createSchedule } from "../schedule/schedule-store.js";
@@ -82,7 +77,6 @@ describe("scheduler wake mode", () => {
     db.run("DELETE FROM messages");
     db.run("DELETE FROM conversations");
     mockWakeAgentForOpportunity.mockClear();
-    mockEmitFeedEvent.mockClear();
   });
 
   test("wake schedule calls wakeAgentForOpportunity with correct args", async () => {
@@ -208,63 +202,6 @@ describe("scheduler wake mode", () => {
     expect(row?.status).toBe("active");
   });
 
-  test("quiet: true suppresses feed event", async () => {
-    // GIVEN a one-shot wake schedule with quiet: true
-    const schedule = createSchedule({
-      name: "Wake Quiet",
-      message: "Quiet wake",
-      mode: "wake",
-      wakeConversationId: "conv-quiet",
-      quiet: true,
-      nextRunAt: Date.now() - 1000,
-    });
-    forceScheduleDue(schedule.id);
-
-    // WHEN the scheduler fires
-    const scheduler = startScheduler(
-      mock(() => Promise.resolve()),
-      () => {},
-    );
-    await new Promise((resolve) => setTimeout(resolve, 500));
-    scheduler.stop();
-
-    // THEN wakeAgentForOpportunity is called
-    expect(mockWakeAgentForOpportunity).toHaveBeenCalledTimes(1);
-
-    // AND no feed event is emitted
-    expect(mockEmitFeedEvent).not.toHaveBeenCalled();
-  });
-
-  test("quiet: false emits feed event on success", async () => {
-    // GIVEN a one-shot wake schedule with quiet: false (default)
-    const schedule = createSchedule({
-      name: "Wake Loud",
-      message: "Loud wake",
-      mode: "wake",
-      wakeConversationId: "conv-loud",
-      nextRunAt: Date.now() - 1000,
-    });
-    forceScheduleDue(schedule.id);
-
-    // WHEN the scheduler fires
-    const scheduler = startScheduler(
-      mock(() => Promise.resolve()),
-      () => {},
-    );
-    await new Promise((resolve) => setTimeout(resolve, 500));
-    scheduler.stop();
-
-    // THEN a feed event IS emitted
-    expect(mockEmitFeedEvent).toHaveBeenCalledTimes(1);
-    expect(mockEmitFeedEvent).toHaveBeenCalledWith(
-      expect.objectContaining({
-        source: "assistant",
-        title: "Wake Loud",
-        summary: "Deferred wake fired.",
-      }),
-    );
-  });
-
   test("retries wake when wakeAgentForOpportunity returns timeout", async () => {
     // GIVEN wakeAgentForOpportunity returns timeout on first call, then succeeds
     mockWakeAgentForOpportunity

package/src/__tests__/secret-allowlist.test.ts

@@ -135,6 +135,7 @@ describe("secret-allowlist", () => {
 
   // -----------------------------------------------------------------------
   // Integration with scanText
+  // AKIAIOSFODNN7* keys below are fake — based on the AWS docs example prefix, not real credentials.
   // -----------------------------------------------------------------------
   test("[experimental] allowlisted values are suppressed by scanText", () => {
     const awsKey = "AKIAIOSFODNN7REALKEY";

package/src/__tests__/secret-routes-managed-proxy.test.ts

@@ -1,5 +1,6 @@
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
+import { LLMSchema } from "../config/schemas/llm.js";
 import { credentialKey } from "../security/credential-key.js";
 
 let lastGeminiConstructorOpts: Record<string, unknown> | null = null;
@@ -15,11 +16,11 @@ const MANAGED_PROVIDERS = ["anthropic", "openai", "gemini"] as const;
 
 let platformBaseUrlOverride: string | undefined;
 
+const baseLlm = LLMSchema.parse({});
+
 const mockConfig = {
   services: {
-    inference: {
-      mode: "your-own" as const,
-    },
+    inference: {},
     "image-generation": {
       mode: "your-own" as const,
       provider: "gemini",
@@ -30,7 +31,14 @@ const mockConfig = {
       provider: "inference-provider-native",
     },
   },
-  llm: { default: { provider: "anthropic", model: "test-model" } },
+  llm: {
+    ...baseLlm,
+    default: {
+      ...baseLlm.default,
+      provider: "anthropic" as const,
+      model: "test-model",
+    },
+  },
 };
 
 mock.module("@google/genai", () => ({

package/src/__tests__/shell-credential-ref.test.ts

@@ -93,6 +93,7 @@ afterAll(() => {
 describe("shell tool credential ref resolution", () => {
   test("service/field ref resolves to UUID and reaches session creation", async () => {
     const meta = upsertCredentialMetadata("fal", "api_key", {
+      allowedTools: ["bash"],
       injectionTemplates: [
         {
           hostPattern: "*.fal.ai",
@@ -120,7 +121,9 @@ describe("shell tool credential ref resolution", () => {
   });
 
   test("UUID ref remains supported", async () => {
-    const meta = upsertCredentialMetadata("github", "token");
+    const meta = upsertCredentialMetadata("github", "token", {
+      allowedTools: ["bash"],
+    });
 
     await shellTool.execute(
       {
@@ -156,7 +159,9 @@ describe("shell tool credential ref resolution", () => {
   });
 
   test("mixed known+unknown refs fails fast (no partial execution)", async () => {
-    upsertCredentialMetadata("fal", "api_key");
+    upsertCredentialMetadata("fal", "api_key", {
+      allowedTools: ["bash"],
+    });
 
     const result = await shellTool.execute(
       {
@@ -175,7 +180,9 @@ describe("shell tool credential ref resolution", () => {
   });
 
   test("duplicate refs are deduped", async () => {
-    const meta = upsertCredentialMetadata("fal", "api_key");
+    const meta = upsertCredentialMetadata("fal", "api_key", {
+      allowedTools: ["bash"],
+    });
 
     await shellTool.execute(
       {
@@ -209,4 +216,89 @@ describe("shell tool credential ref resolution", () => {
     expect(result.isError).toBeFalsy();
     expect(mockGetOrStartSession).not.toHaveBeenCalled();
   });
+
+  test("credential with allowedTools excluding bash is denied for proxied shell", async () => {
+    upsertCredentialMetadata("vercel", "api_token", {
+      allowedTools: ["publish_page"],
+      injectionTemplates: [
+        {
+          hostPattern: "api.vercel.com",
+          injectionType: "header",
+          headerName: "Authorization",
+          valuePrefix: "Bearer ",
+        },
+      ],
+    });
+
+    const result = await shellTool.execute(
+      {
+        command: "curl https://api.vercel.com/v1/projects",
+        activity: "test",
+        network_mode: "proxied",
+        credential_ids: ["vercel/api_token"],
+      },
+      ctx,
+    );
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("credential tool policy denied");
+    expect(result.content).toContain("not bash");
+    // Must not call getOrStartSession — policy denial happens before session creation
+    expect(mockGetOrStartSession).not.toHaveBeenCalled();
+  });
+
+  test("credential with allowedTools including bash starts proxied session", async () => {
+    const meta = upsertCredentialMetadata("deploy_svc", "api_key", {
+      allowedTools: ["bash"],
+      injectionTemplates: [
+        {
+          hostPattern: "*.deploy-svc.io",
+          injectionType: "header",
+          headerName: "Authorization",
+          valuePrefix: "Bearer ",
+        },
+      ],
+    });
+
+    await shellTool.execute(
+      {
+        command: "echo deploy",
+        activity: "test",
+        network_mode: "proxied",
+        credential_ids: ["deploy_svc/api_key"],
+      },
+      ctx,
+    );
+
+    // Session should be created with the resolved credential ID
+    expect(mockGetOrStartSession).toHaveBeenCalledTimes(1);
+    const callArgs = mockGetOrStartSession.mock.calls[0];
+    expect(callArgs[1]).toEqual([meta.credentialId]);
+  });
+
+  test("mixed allowed and denied credentials fail the whole command before session creation", async () => {
+    upsertCredentialMetadata("allowed_svc", "token", {
+      allowedTools: ["bash"],
+    });
+    upsertCredentialMetadata("denied_svc", "token", {
+      allowedTools: ["publish_page"],
+    });
+
+    const result = await shellTool.execute(
+      {
+        command: "echo mixed",
+        activity: "test",
+        network_mode: "proxied",
+        credential_ids: ["allowed_svc/token", "denied_svc/token"],
+      },
+      ctx,
+    );
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("credential tool policy denied");
+    expect(result.content).toContain("denied_svc/token");
+    expect(result.content).toContain("not bash");
+    // Must not call getOrStartSession — even one denied credential blocks the whole command
+    expect(mockGetOrStartSession).not.toHaveBeenCalled();
+  });
 });

package/src/__tests__/shell-tool-proxy-mode.test.ts

@@ -136,6 +136,20 @@ mock.module("../tools/credentials/resolve.js", () => ({
   resolveCredentialRef: (ref: string) => ({ credentialId: ref }),
 }));
 
+mock.module("../tools/credentials/metadata-store.js", () => ({
+  getCredentialMetadataById: (id: string) => ({
+    service: "test",
+    field: id,
+    allowedTools: ["bash"],
+    allowedDomains: [],
+  }),
+}));
+
+mock.module("../tools/credentials/tool-policy.js", () => ({
+  isToolAllowed: (toolName: string, allowedTools: string[]) =>
+    Array.isArray(allowedTools) && allowedTools.includes(toolName),
+}));
+
 mock.module("../tools/network/script-proxy/logging.js", () => ({
   buildCredentialRefTrace: (
     rawRefs: string[],

package/src/__tests__/skill-load-feature-flag.test.ts

@@ -50,6 +50,7 @@ mock.module("../config/loader.js", () => ({
     "openrouter",
     "brave",
     "perplexity",
+    "tavily",
   ],
 }));
 

package/src/__tests__/skill-load-tool.test.ts

@@ -371,15 +371,13 @@ describe("skill_load tool", () => {
     expect(result.content).toContain("Skill: No Includes");
   });
 
-  test("bundled app-builder loads when frontend-design is unavailable", async () => {
+  test("bundled app-builder loads without includes", async () => {
     const result = await executeSkillLoad({ skill: "app-builder" });
 
     expect(result.isError).toBe(false);
     expect(result.content).toContain("Skill: App Builder");
-    expect(result.content).toContain("Suggested Included Skills (not loaded):");
-    expect(result.content).toContain("frontend-design");
+    expect(result.content).toContain("Included Skills (immediate): none");
     expect(result.content).toContain('<loaded_skill id="app-builder"');
-    expect(result.content).not.toContain('<loaded_skill id="frontend-design"');
   });
 
   test("bundled phone-calls loads when setup includes are unavailable", async () => {

package/src/__tests__/subagent-call-site-routing.test.ts

@@ -110,16 +110,39 @@ mock.module("../prompts/system-prompt.js", () => ({
   buildSubagentSystemPrompt: () => "subagent system",
 }));
 
-// Provider registry — return distinct stubs so we can verify the selection.
+// Provider registry + connection resolver — routing goes through
+// `provider_connection` exclusively. `getProvider` is kept here purely
+// because the registry module still exports it; the production code under
+// test does not call it.
 const anthropicStub = { name: "anthropic" };
 const openaiStub = { name: "openai" };
 
 mock.module("../providers/registry.js", () => ({
   getProvider: (name: string) => {
-    if (name === "anthropic") return anthropicStub;
-    if (name === "openai") return openaiStub;
-    throw new Error(`unknown provider: ${name}`);
+    throw new Error(`legacy getProvider should not be called: ${name}`);
   },
+  resolveProviderFromConnection: async (connection: { name: string }) => {
+    if (connection.name === "anthropic-conn") return anthropicStub;
+    if (connection.name === "openai-conn") return openaiStub;
+    return null;
+  },
+  clearConnectionProviderCache: () => {},
+}));
+
+// Connection lookup — feeds `resolveProviderFromConnection` above. The DB
+// is stubbed; tests don't touch SQLite.
+mock.module("../providers/inference/connections.js", () => ({
+  getConnection: (_db: unknown, name: string) => {
+    if (name === "anthropic-conn")
+      return { name: "anthropic-conn", provider: "anthropic", auth: { type: "platform" } };
+    if (name === "openai-conn")
+      return { name: "openai-conn", provider: "openai", auth: { type: "platform" } };
+    return null;
+  },
+}));
+
+mock.module("../memory/db-connection.js", () => ({
+  getDb: () => ({}),
 }));
 
 // Mutable LLM config — tests rewrite this per-case.
@@ -154,7 +177,11 @@ function setLlmConfig(raw: unknown): void {
 describe("SubagentManager — provider call-site routing", () => {
   test("wraps the default provider in CallSiteRoutingProvider", async () => {
     setLlmConfig({
-      default: { provider: "anthropic", model: "claude-opus-4-7" },
+      default: {
+        provider: "anthropic",
+        provider_connection: "anthropic-conn",
+        model: "claude-opus-4-7",
+      },
     });
 
     capturedProvider = undefined;
@@ -172,10 +199,27 @@ describe("SubagentManager — provider call-site routing", () => {
   });
 
   test("the wrapped provider exposes the default provider's name (stable identity for outer wrappers)", async () => {
+    // Note: `provider_connection` lives on `ProfileEntry` and `LLMConfigBase`,
+    // NOT on `LLMCallSiteConfig` (which is `LLMConfigFragment.extend({
+    // profile })`). Setting `provider_connection` directly on a `callSites.*`
+    // entry would be silently stripped by Zod. The correct shape for an
+    // alternate-provider call-site override is a profile reference, defined
+    // here as `altOpenai`.
     setLlmConfig({
-      default: { provider: "anthropic", model: "claude-opus-4-7" },
+      default: {
+        provider: "anthropic",
+        provider_connection: "anthropic-conn",
+        model: "claude-opus-4-7",
+      },
+      profiles: {
+        altOpenai: {
+          provider: "openai",
+          provider_connection: "openai-conn",
+          model: "gpt-5.4",
+        },
+      },
       callSites: {
-        subagentSpawn: { provider: "openai", model: "gpt-5.4" },
+        subagentSpawn: { profile: "altOpenai" },
       },
     });
 
@@ -202,7 +246,11 @@ describe("SubagentManager — provider call-site routing", () => {
 
   test("falls back to default provider when subagentSpawn callSite is absent", async () => {
     setLlmConfig({
-      default: { provider: "anthropic", model: "claude-opus-4-7" },
+      default: {
+        provider: "anthropic",
+        provider_connection: "anthropic-conn",
+        model: "claude-opus-4-7",
+      },
       // No subagentSpawn override.
     });
 
@@ -224,7 +272,11 @@ describe("SubagentManager — provider call-site routing", () => {
 
   test("copies parent guardian and auth context into spawned conversation", async () => {
     setLlmConfig({
-      default: { provider: "anthropic", model: "claude-opus-4-7" },
+      default: {
+        provider: "anthropic",
+        provider_connection: "anthropic-conn",
+        model: "claude-opus-4-7",
+      },
     });
 
     const parentTrustContext = {
@@ -273,11 +325,18 @@ describe("SubagentManager — provider call-site routing", () => {
 // ── Direct unit test for CallSiteRoutingProvider's selection logic ─────────
 
 describe("CallSiteRoutingProvider — selectProvider behavior", () => {
-  test("routes to the resolved provider when callSite.provider differs from default", async () => {
+  test("routes to the resolved provider when callSite resolves to a profile with provider_connection", async () => {
     setLlmConfig({
       default: { provider: "anthropic", model: "claude-opus-4-7" },
+      profiles: {
+        altOpenai: {
+          provider: "openai",
+          provider_connection: "openai-conn",
+          model: "gpt-5.4",
+        },
+      },
       callSites: {
-        subagentSpawn: { provider: "openai", model: "gpt-5.4" },
+        subagentSpawn: { profile: "altOpenai" },
       },
     });
 
@@ -309,10 +368,13 @@ describe("CallSiteRoutingProvider — selectProvider behavior", () => {
       },
     };
 
-    const wrapper = new CallSiteRoutingProvider(defaultProvider, (name) => {
-      if (name === "openai") return altProvider;
-      return undefined;
-    });
+    const wrapper = new CallSiteRoutingProvider(
+      defaultProvider,
+      async (connectionName) => {
+        if (connectionName === "openai-conn") return altProvider;
+        return null;
+      },
+    );
 
     await wrapper.sendMessage([], undefined, undefined, {
       config: { callSite: "subagentSpawn" },
@@ -347,7 +409,7 @@ describe("CallSiteRoutingProvider — selectProvider behavior", () => {
 
     const wrapper = new CallSiteRoutingProvider(
       defaultProvider,
-      () => undefined,
+      async () => null,
     );
 
     await wrapper.sendMessage([], undefined, undefined, {