@vellumai/assistant 0.8.0 → 0.8.1

package/src/__tests__/config-loader-corrupt.test.ts

@@ -146,6 +146,42 @@ describe("loadConfig corrupt-file recovery", () => {
       /^config\.json\.corrupt-\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}\.\d{3}Z\.json$/,
     );
   });
+
+  // ---------------------------------------------------------------------------
+  // Shape-mismatch quarantine — same JSON.parse caveat as `loadRawConfig`.
+  // Without an `isPlainObject` check, downstream code (e.g. the managed-Gemini
+  // `setNestedValue` block in `loadConfig`) would TypeError on `null` or
+  // primitive `fileConfig`, and only the broad try/catch around the migration
+  // saved startup. Treating the wrong-shape case as a parse error here moves
+  // the boundary check to the loader so callers don't have to defend.
+  // ---------------------------------------------------------------------------
+
+  test.each([
+    ["null at the top level", "null"],
+    ["a JSON number", "42"],
+    ["a JSON string", '"hello"'],
+    ["a JSON boolean", "true"],
+    ["a JSON array", '["provider", "anthropic"]'],
+  ])(
+    "quarantines when config.json contains %s and returns defaults",
+    (_label, jsonText) => {
+      writeFileSync(CONFIG_PATH, jsonText);
+
+      // Must not throw — daemon startup contract.
+      const config = loadConfig();
+
+      // Defaults loaded — config is populated through the Zod schema.
+      expect(config).toBeDefined();
+      expect(config.memory).toBeDefined();
+
+      const quarantined = listQuarantinedFiles();
+      expect(quarantined).toHaveLength(1);
+      // Original wrong-shape content preserved for debugging.
+      expect(readFileSync(join(WORKSPACE_DIR, quarantined[0]), "utf-8")).toBe(
+        jsonText,
+      );
+    },
+  );
 });
 
 describe("loadRawConfig corrupt-file recovery", () => {
@@ -180,4 +216,36 @@ describe("loadRawConfig corrupt-file recovery", () => {
     expect(raw).toEqual({ foo: "bar", nested: { k: 1 } });
     expect(listQuarantinedFiles()).toHaveLength(0);
   });
+
+  // ---------------------------------------------------------------------------
+  // Shape-mismatch quarantine — JSON.parse can succeed on `null`, primitives,
+  // and arrays, all of which violate the function's `Record<string, unknown>`
+  // return-type contract. These cases must be quarantined the same way as a
+  // syntax error so callers (e.g. /v1/config handlers) can iterate the result
+  // safely without runtime shape checks.
+  // ---------------------------------------------------------------------------
+
+  test.each([
+    ["null at the top level", "null"],
+    ["a JSON number", "42"],
+    ["a JSON string", '"hello"'],
+    ["a JSON boolean", "true"],
+    ["a JSON array", '["provider", "anthropic"]'],
+  ])(
+    "quarantines when config.json contains %s and returns {}",
+    (_label, jsonText) => {
+      writeFileSync(CONFIG_PATH, jsonText);
+
+      // Must not throw — same contract as the syntax-error path.
+      const raw = loadRawConfig();
+
+      expect(raw).toEqual({});
+      const quarantined = listQuarantinedFiles();
+      expect(quarantined).toHaveLength(1);
+      // Original wrong-shape content is preserved for debugging.
+      expect(readFileSync(join(WORKSPACE_DIR, quarantined[0]), "utf-8")).toBe(
+        jsonText,
+      );
+    },
+  );
 });

package/src/__tests__/config-loader-platform-defaults.test.ts

@@ -92,7 +92,6 @@ function readConfig(): Record<string, unknown> {
 }
 
 const MANAGED_SERVICES = [
-  "inference",
   "image-generation",
   "web-search",
   "google-oauth",
@@ -126,7 +125,7 @@ describe("platform-managed config defaults", () => {
     }
   });
 
-  test("IS_PLATFORM=true, no config file → all 8 service modes written as 'managed'", () => {
+  test("IS_PLATFORM=true, no config file → all 7 managed service modes written as 'managed'", () => {
     process.env.IS_PLATFORM = "true";
 
     loadConfig();
@@ -140,7 +139,7 @@ describe("platform-managed config defaults", () => {
     }
   });
 
-  test("IS_PLATFORM=false, no config file → service modes default to 'your-own'", () => {
+  test("IS_PLATFORM=false, no config file → managed service modes default to 'your-own'", () => {
     process.env.IS_PLATFORM = "false";
 
     loadConfig();
@@ -154,7 +153,7 @@ describe("platform-managed config defaults", () => {
     }
   });
 
-  test("IS_PLATFORM unset, no config file → service modes default to 'your-own'", () => {
+  test("IS_PLATFORM unset, no config file → managed service modes default to 'your-own'", () => {
     delete process.env.IS_PLATFORM;
 
     loadConfig();
@@ -171,13 +170,13 @@ describe("platform-managed config defaults", () => {
   test("IS_PLATFORM=true, config file already exists → existing service mode values are preserved", () => {
     process.env.IS_PLATFORM = "true";
 
-    // Write an existing config with inference mode explicitly set to "your-own"
+    // Write an existing config with image-generation mode explicitly set to "your-own"
     writeFileSync(
       CONFIG_PATH,
       JSON.stringify(
         {
           services: {
-            inference: { mode: "your-own" },
+            "image-generation": { mode: "your-own" },
           },
         },
         null,
@@ -191,13 +190,11 @@ describe("platform-managed config defaults", () => {
     expect(written.services).toBeDefined();
     // The existing value must be preserved — backfill path, not fresh-write path
     expect(
-      (written.services!["inference"] as { mode?: string })?.mode,
+      (written.services!["image-generation"] as { mode?: string })?.mode,
     ).toBe("your-own");
     // ...and the in-memory config must mirror the explicit user choice (the
     // fill-defaults pass must not override an explicit "your-own").
-    expect(
-      (config.services.inference as { mode: string }).mode,
-    ).toBe("your-own");
+    expect(config.services["image-generation"].mode).toBe("your-own");
   });
 
   test("IS_PLATFORM=true, config file exists without a services key → in-memory config has all managed modes", () => {
@@ -367,15 +364,15 @@ describe("GET /v1/config handler — context-default fill on raw response", () =
     }
   });
 
-  test("IS_PLATFORM=true, raw config has explicit services.inference.mode='your-own' → preserved", () => {
+  test("IS_PLATFORM=true, raw config has explicit services.image-generation.mode='your-own' → preserved", () => {
     process.env.IS_PLATFORM = "true";
 
-    // User has explicitly chosen "your-own" via the macOS Save flow.
-    // The patch handler persisted that to disk; the fill pass must not
-    // override an explicit user choice.
+    // User has explicitly chosen "your-own" for image-generation via the macOS
+    // Save flow. The patch handler persisted that to disk; the fill pass must
+    // not override an explicit user choice.
     const raw: Record<string, unknown> = {
       services: {
-        inference: { mode: "your-own" },
+        "image-generation": { mode: "your-own" },
       },
     };
 
@@ -384,10 +381,12 @@ describe("GET /v1/config handler — context-default fill on raw response", () =
       unknown
     >;
     const services = result["services"] as Record<string, { mode: string }>;
-    expect(services["inference"]!.mode).toBe("your-own");
-    // Other services were missing entirely → context defaults fill them in.
-    expect(services["image-generation"]!.mode).toBe("managed");
+    expect(services["image-generation"]!.mode).toBe("your-own");
+    // web-search was missing → fill.
     expect(services["web-search"]!.mode).toBe("managed");
+    // inference.mode is a legacy backwards-compat wire field — synthesized
+    // here for old macOS clients (SettingsStore.swift) that still read it.
+    expect(services["inference"]!.mode).toBe("managed");
   });
 
   test("IS_PLATFORM=false, raw config has no services key → response is unchanged", () => {
@@ -408,12 +407,12 @@ describe("GET /v1/config handler — context-default fill on raw response", () =
     expect(result["services"]).toBeUndefined();
   });
 
-  test("IS_PLATFORM=true, raw config has partial services.inference subtree → preserves user fields, fills missing mode", () => {
+  test("IS_PLATFORM=true, raw config has partial services subtree → preserves user fields, fills missing mode", () => {
     process.env.IS_PLATFORM = "true";
 
-    // User set image-generation.provider but never chose a mode for any
-    // service. The fill pass adds the missing modes without clobbering
-    // the user-supplied provider.
+    // User set image-generation.provider but never chose a mode.
+    // The fill pass adds the missing mode without clobbering the user-supplied
+    // provider.
     const raw: Record<string, unknown> = {
       services: {
         "image-generation": { provider: "openai" },
@@ -430,10 +429,65 @@ describe("GET /v1/config handler — context-default fill on raw response", () =
     >;
     expect(services["image-generation"]!.mode).toBe("managed");
     expect(services["image-generation"]!.provider).toBe("openai");
-    // Inference, which was missing entirely, picks up the context default.
+    // services.inference.mode is synthesized as a legacy wire-only field for
+    // older macOS clients during the rollout window (Phase 1.2 schema removal
+    // landed before the macOS Providers UI ships).
+    expect(services["inference"]!.mode).toBe("managed");
+  });
+
+  test("IS_PLATFORM=true, raw config has no inference subtree → synthesizes legacy mode='managed'", () => {
+    process.env.IS_PLATFORM = "true";
+
+    const raw: Record<string, unknown> = {
+      llm: {
+        profiles: {
+          balanced: { provider: "anthropic", model: "claude-sonnet-4.5" },
+        },
+      },
+    };
+
+    const result = applyContextDefaultsToRawConfig(raw) as Record<
+      string,
+      unknown
+    >;
+    const services = result["services"] as Record<string, { mode: string }>;
     expect(services["inference"]!.mode).toBe("managed");
   });
 
+  test("IS_PLATFORM=true, raw config has explicit services.inference.mode='your-own' → preserved (legacy override)", () => {
+    process.env.IS_PLATFORM = "true";
+
+    // Pre-migration upgrade: workspace config still carries the legacy
+    // mode value. The synthesis only fills when absent, so an explicit
+    // disk value wins until migration 076 strips it.
+    const raw: Record<string, unknown> = {
+      services: {
+        inference: { mode: "your-own" },
+      },
+    };
+
+    const result = applyContextDefaultsToRawConfig(raw) as Record<
+      string,
+      unknown
+    >;
+    const services = result["services"] as Record<string, { mode: string }>;
+    expect(services["inference"]!.mode).toBe("your-own");
+  });
+
+  test("IS_PLATFORM=false, raw config has no inference subtree → no synthesis", () => {
+    process.env.IS_PLATFORM = "false";
+
+    const raw: Record<string, unknown> = {
+      llm: {},
+    };
+
+    const result = applyContextDefaultsToRawConfig(raw) as Record<
+      string,
+      unknown
+    >;
+    expect(result["services"]).toBeUndefined();
+  });
+
   // -------------------------------------------------------------------------
   // Malformed-but-parseable config.json — must not 500 the GET endpoint.
   //

package/src/__tests__/config-schema-cmd.test.ts

@@ -3,7 +3,7 @@ import { join } from "node:path";
 import { describe, expect, mock, test } from "bun:test";
 
 // ---------------------------------------------------------------------------
-// Mocks — declared before imports that depend on platform/logger
+// Mocks - declared before imports that depend on platform/logger/ipc
 // ---------------------------------------------------------------------------
 
 const WORKSPACE_DIR = process.env.VELLUM_WORKSPACE_DIR!;
@@ -45,28 +45,38 @@ mock.module("../util/logger.js", () => ({
   getCliLogger: () => makeLoggerStub(),
 }));
 
-mock.module("../config/loader.js", () => ({
-  getConfig: () => ({
-    services: {
-      inference: {
-        mode: "your-own",
-        provider: "anthropic",
-        model: "claude-opus-4-6",
-      },
-      "image-generation": {
-        mode: "your-own",
-        provider: "gemini",
-        model: "gemini-3.1-flash-image-preview",
-      },
-      "web-search": { mode: "your-own", provider: "inference-provider-native" },
-    },
-  }),
-  loadConfig: () => ({}),
-  loadRawConfig: () => ({}),
-  saveRawConfig: () => {},
-  invalidateConfigCache: () => {},
-  getNestedValue: () => undefined,
-  setNestedValue: () => {},
+// ---------------------------------------------------------------------------
+// Mocks - ipc/cli-client
+//
+// The `config` CLI is IPC-tagged, so all schema lookups go through the
+// daemon. Mock cliIpcCall so we can drive the response in each test and
+// assert on exit behavior without spinning up a daemon socket.
+// ---------------------------------------------------------------------------
+
+let mockIpcResult: {
+  ok: boolean;
+  result?: unknown;
+  error?: string;
+  statusCode?: number;
+} = { ok: true, result: { schema: {} } };
+
+mock.module("../ipc/cli-client.js", () => ({
+  cliIpcCall: async () => mockIpcResult,
+  exitFromIpcResult: (r: {
+    error?: string;
+    statusCode?: number;
+  }) => {
+    process.stderr.write((r.error ?? "Unknown error") + "\n");
+    if (r.statusCode === undefined) {
+      process.exit(10);
+    } else if (r.statusCode >= 500) {
+      process.exit(3);
+    } else if (r.statusCode >= 400) {
+      process.exit(2);
+    } else {
+      process.exit(1);
+    }
+  },
 }));
 
 import { Command } from "commander";
@@ -259,30 +269,54 @@ describe("z.toJSONSchema integration", () => {
 
 // ---------------------------------------------------------------------------
 // Tests: CLI schema command error path
+//
+// The CLI now routes `config schema <path>` through the daemon. When the
+// daemon throws a BadRequestError for an unknown path, the IPC layer
+// returns statusCode=400, and exitFromIpcResult maps that to process exit
+// code 2 (per the matrix in cli-client.ts:exitFromIpcResult).
 // ---------------------------------------------------------------------------
 
 describe("CLI schema command", () => {
-  test("nonexistent path prints error and exits with code 1", () => {
+  test("daemon error for nonexistent path surfaces via exitFromIpcResult", async () => {
+    // Drive the IPC mock to return a BadRequest as the daemon would
+    mockIpcResult = {
+      ok: false,
+      error: "No schema found at path: nonexistent",
+      statusCode: 400,
+    };
+
     const program = new Command();
-    program.exitOverride(); // throw instead of calling process.exit
+    program.exitOverride();
     registerConfigCommand(program);
 
     const origExit = process.exit;
-    // Replace process.exit to capture the exit code without killing the test
+    const origStderrWrite = process.stderr.write.bind(process.stderr);
     let exitCode: number | undefined;
     process.exit = ((code?: number) => {
       exitCode = code;
       throw new Error(`process.exit(${code})`);
     }) as never;
+    process.stderr.write = (() => true) as typeof process.stderr.write;
 
     try {
-      program.parse(["node", "test", "config", "schema", "nonexistent"]);
+      await program.parseAsync([
+        "node",
+        "test",
+        "config",
+        "schema",
+        "nonexistent",
+      ]);
     } catch {
-      // Expected: either Commander's exitOverride or our process.exit stub throws
+      // Expected: process.exit stub throws
     } finally {
       process.exit = origExit;
+      process.stderr.write = origStderrWrite;
     }
 
-    expect(exitCode).toBe(1);
+    // 400 → exit 2 (per exitFromIpcResult matrix)
+    expect(exitCode).toBe(2);
+
+    // Restore default
+    mockIpcResult = { ok: true, result: { schema: {} } };
   });
 });

package/src/__tests__/config-schema.test.ts

@@ -83,9 +83,9 @@ function writeConfig(obj: unknown): void {
 describe("AssistantConfigSchema", () => {
   test("parses empty object with full defaults", () => {
     const result = AssistantConfigSchema.parse({});
-    // services.inference now carries only `mode`; provider/model live under
-    // llm.default.{provider,model} (see PR 19 of unify-llm-callsites).
-    expect(result.services.inference.mode).toBe("your-own");
+    // services.inference is now an empty object; provider/model live under
+    // llm.default.{provider,model}, auth routing via provider_connections.
+    expect(result.services.inference).toEqual({});
     expect(result.llm.default.provider).toBe("anthropic");
     expect(result.llm.default.model).toBe("claude-opus-4-7");
     expect(result.services["image-generation"].provider).toBe("gemini");
@@ -134,6 +134,17 @@ describe("AssistantConfigSchema", () => {
     expect(result.auditLog).toEqual({ retentionDays: 0 });
   });
 
+  test("accepts Tavily as a web search provider", () => {
+    const result = AssistantConfigSchema.parse({
+      services: {
+        "web-search": { mode: "your-own", provider: "tavily" },
+      },
+    });
+
+    expect(result.services["web-search"].provider).toBe("tavily");
+    expect(result.services["web-search"].mode).toBe("your-own");
+  });
+
   test("accepts valid complete config", () => {
     const input = {
       llm: {