@vellumai/assistant 0.8.1 → 0.8.3

package/src/__tests__/oauth-commands-routes.test.ts

@@ -22,6 +22,8 @@ import { beforeEach, describe, expect, mock, test } from "bun:test";
 interface MockProviderRow {
   provider: string;
   managedServiceConfigKey: string | null;
+  baseUrl: string | null;
+  injectionTemplates: string | null;
   pingUrl: string | null;
   pingMethod: string | null;
   pingHeaders: string | null;
@@ -31,6 +33,8 @@ interface MockProviderRow {
 const baseProvider: MockProviderRow = {
   provider: "google",
   managedServiceConfigKey: "google-oauth",
+  baseUrl: "https://api.google.com",
+  injectionTemplates: null,
   pingUrl: null,
   pingMethod: null,
   pingHeaders: null,
@@ -45,7 +49,10 @@ let mockApps: Record<string, unknown> = {};
 let mockTokenValue = "tok-fake";
 let platformAvailable = true;
 let platformAssistantId: string | null = "assistant-1";
-let mockFetchImpl: (path: string, init?: RequestInit) => Promise<{
+let mockFetchImpl: (
+  path: string,
+  init?: RequestInit,
+) => Promise<{
   ok: boolean;
   status: number;
   json: () => Promise<unknown>;
@@ -61,6 +68,7 @@ let mockResolveResponse: {
   headers: Record<string, string>;
   body: unknown;
 } = { status: 200, headers: {}, body: { ok: true } };
+let mockResolveRequests: unknown[] = [];
 
 const mockDisconnectOAuthProvider = mock(() => Promise.resolve());
 const mockSaveRawConfig = mock(() => undefined);
@@ -102,7 +110,10 @@ mock.module("../oauth/oauth-store.js", () => ({
 
 mock.module("../oauth/connection-resolver.js", () => ({
   resolveOAuthConnection: async (_provider: string) => ({
-    request: async () => mockResolveResponse,
+    request: async (req: unknown) => {
+      mockResolveRequests.push(req);
+      return mockResolveResponse;
+    },
   }),
 }));
 
@@ -119,17 +130,19 @@ mock.module("../platform/client.js", () => ({
 }));
 
 mock.module("../security/token-manager.js", () => ({
-  withValidToken: async <T,>(
-    _provider: string,
-    fn: (t: string) => Promise<T>,
-  ) => fn(mockTokenValue),
+  withValidToken: async <T>(_provider: string, fn: (t: string) => Promise<T>) =>
+    fn(mockTokenValue),
 }));
 
 mock.module("../config/loader.js", () => ({
   getConfig: () => ({ services: {} }),
   loadRawConfig: () => ({ services: {} }),
   saveRawConfig: mockSaveRawConfig,
-  setNestedValue: (obj: Record<string, unknown>, path: string, value: unknown) => {
+  setNestedValue: (
+    obj: Record<string, unknown>,
+    path: string,
+    value: unknown,
+  ) => {
     const parts = path.split(".");
     let cur: Record<string, unknown> = obj;
     for (let i = 0; i < parts.length - 1; i++) {
@@ -152,7 +165,11 @@ mock.module("../config/schemas/services.js", () => ({
   },
 }));
 
-import { BadRequestError, InternalError, NotFoundError } from "../runtime/routes/errors.js";
+import {
+  BadRequestError,
+  InternalError,
+  NotFoundError,
+} from "../runtime/routes/errors.js";
 import { ROUTES } from "../runtime/routes/oauth-commands-routes.js";
 import type { RouteHandlerArgs } from "../runtime/routes/types.js";
 
@@ -194,6 +211,7 @@ beforeEach(() => {
     text: async () => "",
   });
   mockResolveResponse = { status: 200, headers: {}, body: { ok: true } };
+  mockResolveRequests = [];
   mockDisconnectOAuthProvider.mockClear();
   mockSaveRawConfig.mockClear();
 });
@@ -430,7 +448,10 @@ describe("GET oauth/status", () => {
     ];
     const result = (await getRoute("GET", "oauth/status").handler(
       makeArgs({ queryParams: { provider: "google" } }),
-    )) as { mode: string; connections: Array<{ id: string; grantedScopes: string[] }> };
+    )) as {
+      mode: string;
+      connections: Array<{ id: string; grantedScopes: string[] }>;
+    };
     expect(result.mode).toBe("byo");
     expect(result.connections).toHaveLength(1);
     expect(result.connections[0]!.id).toBe("conn-1");
@@ -507,7 +528,11 @@ describe("POST oauth/ping", () => {
       ...baseProvider,
       pingUrl: "https://api.google.com/v1/me",
     };
-    mockResolveResponse = { status: 401, headers: {}, body: { error: "unauthorized" } };
+    mockResolveResponse = {
+      status: 401,
+      headers: {},
+      body: { error: "unauthorized" },
+    };
     const result = (await getRoute("POST", "oauth/ping").handler(
       makeArgs({ body: { provider: "google" } }),
     )) as { ok: boolean; status: number; hint?: string };
@@ -543,7 +568,9 @@ describe("POST oauth/token", () => {
     // No active connections registered for google
     await expect(
       getRoute("POST", "oauth/token").handler(
-        makeArgs({ body: { provider: "google", account: "missing@example.com" } }),
+        makeArgs({
+          body: { provider: "google", account: "missing@example.com" },
+        }),
       ),
     ).rejects.toBeInstanceOf(NotFoundError);
   });
@@ -578,6 +605,130 @@ describe("POST oauth/request", () => {
     expect(result.body).toEqual({ hello: "world" });
   });
 
+  test("rejects absolute URL host outside provider base host when no injection templates exist", async () => {
+    await expect(
+      getRoute("POST", "oauth/request").handler(
+        makeArgs({
+          body: { provider: "google", url: "https://attacker.example/v1/me" },
+        }),
+      ),
+    ).rejects.toBeInstanceOf(BadRequestError);
+    expect(mockResolveRequests).toHaveLength(0);
+  });
+
+  test("rejects protocol downgrade for absolute OAuth request URLs", async () => {
+    await expect(
+      getRoute("POST", "oauth/request").handler(
+        makeArgs({
+          body: { provider: "google", url: "http://api.google.com/v1/me" },
+        }),
+      ),
+    ).rejects.toBeInstanceOf(BadRequestError);
+    expect(mockResolveRequests).toHaveLength(0);
+  });
+
+  test("rejects absolute URL host outside provider injection templates", async () => {
+    mockProviders.slack_channel = {
+      ...baseProvider,
+      provider: "slack_channel",
+      managedServiceConfigKey: null,
+      baseUrl: "https://slack.com/api",
+      injectionTemplates: JSON.stringify([
+        {
+          hostPattern: "slack.com",
+          injectionType: "header",
+          headerName: "Authorization",
+          valuePrefix: "Bearer ",
+        },
+      ]),
+    };
+
+    await expect(
+      getRoute("POST", "oauth/request").handler(
+        makeArgs({
+          body: {
+            provider: "slack_channel",
+            url: "https://attacker.example/api/auth.test",
+          },
+        }),
+      ),
+    ).rejects.toBeInstanceOf(BadRequestError);
+    expect(mockResolveRequests).toHaveLength(0);
+  });
+
+  test("allows absolute URL host matching provider injection templates", async () => {
+    mockProviders.slack_channel = {
+      ...baseProvider,
+      provider: "slack_channel",
+      managedServiceConfigKey: null,
+      baseUrl: "https://slack.com/api",
+      injectionTemplates: JSON.stringify([
+        {
+          hostPattern: "slack.com",
+          injectionType: "header",
+          headerName: "Authorization",
+          valuePrefix: "Bearer ",
+        },
+      ]),
+    };
+
+    await getRoute("POST", "oauth/request").handler(
+      makeArgs({
+        body: {
+          provider: "slack_channel",
+          url: "https://slack.com/api/auth.test?team=T123",
+        },
+      }),
+    );
+
+    expect(mockResolveRequests).toEqual([
+      {
+        method: "GET",
+        path: "/api/auth.test",
+        query: { team: "T123" },
+        baseUrl: "https://slack.com",
+      },
+    ]);
+  });
+
+  test("allows cross-host absolute URLs declared by provider injection templates", async () => {
+    mockProviders.google = {
+      ...baseProvider,
+      baseUrl: "https://gmail.googleapis.com/gmail/v1/users/me",
+      injectionTemplates: JSON.stringify([
+        {
+          hostPattern: "gmail.googleapis.com",
+          injectionType: "header",
+          headerName: "Authorization",
+          valuePrefix: "Bearer ",
+        },
+        {
+          hostPattern: "www.googleapis.com",
+          injectionType: "header",
+          headerName: "Authorization",
+          valuePrefix: "Bearer ",
+        },
+      ]),
+    };
+
+    await getRoute("POST", "oauth/request").handler(
+      makeArgs({
+        body: {
+          provider: "google",
+          url: "https://www.googleapis.com/calendar/v3/calendars",
+        },
+      }),
+    );
+
+    expect(mockResolveRequests).toEqual([
+      {
+        method: "GET",
+        path: "/calendar/v3/calendars",
+        baseUrl: "https://www.googleapis.com",
+      },
+    ]);
+  });
+
   test("attaches reconnect hint on 401 response", async () => {
     mockResolveResponse = { status: 401, headers: {}, body: { error: "no" } };
     const result = (await getRoute("POST", "oauth/request").handler(
@@ -681,10 +832,7 @@ describe("GET oauth/managed-connect/poll", () => {
       ],
       text: async () => "",
     });
-    const result = (await getRoute(
-      "GET",
-      "oauth/managed-connect/poll",
-    ).handler(
+    const result = (await getRoute("GET", "oauth/managed-connect/poll").handler(
       makeArgs({ queryParams: { provider: "google" } }),
     )) as {
       ok: boolean;
@@ -696,7 +844,11 @@ describe("GET oauth/managed-connect/poll", () => {
     };
     expect(result.ok).toBe(true);
     expect(result.connections).toEqual([
-      { id: "conn-1", account_label: "alice@example.com", scopes_granted: ["email"] },
+      {
+        id: "conn-1",
+        account_label: "alice@example.com",
+        scopes_granted: ["email"],
+      },
     ]);
   });
 

package/src/__tests__/oauth-provider-profiles.test.ts

@@ -21,6 +21,15 @@ initializeDb();
 seedOAuthProviders();
 
 describe("oauth provider profiles (DB-seeded)", () => {
+  test("google provider row includes Drive in default scopes", () => {
+    const provider = getProvider("google");
+
+    expect(provider).toBeDefined();
+    expect(JSON.parse(provider!.defaultScopes)).toContain(
+      "https://www.googleapis.com/auth/drive",
+    );
+  });
+
   test("google provider row contains bearer injection templates for 3 Google API hosts", () => {
     const provider = getProvider("google");
 

package/src/__tests__/openai-provider.test.ts

@@ -21,6 +21,13 @@ interface FakeChunk {
   choices: Array<{
     delta: {
       content?: string | null;
+      reasoning_content?: string | null;
+      reasoning?: string | null;
+      reasoning_details?: Array<{
+        type?: string;
+        summary?: string | null;
+        text?: string | null;
+      }> | null;
       tool_calls?: Array<{
         index: number;
         id?: string;
@@ -209,6 +216,44 @@ function cachedUsageChunk(
   };
 }
 
+function reasoningChunk(
+  reasoning: string,
+  finish: string | null = null,
+): FakeChunk {
+  return {
+    choices: [
+      { delta: { reasoning_content: reasoning }, finish_reason: finish },
+    ],
+    usage: null,
+    model: "gpt-5.2",
+  };
+}
+
+// OpenRouter spec uses `delta.reasoning` rather than `delta.reasoning_content`.
+function openRouterReasoningChunk(
+  reasoning: string,
+  finish: string | null = null,
+): FakeChunk {
+  return {
+    choices: [{ delta: { reasoning }, finish_reason: finish }],
+    usage: null,
+    model: "gpt-5.2",
+  };
+}
+
+// OpenRouter's documented reasoning-summary shape: a `reasoning_details` array
+// with entries tagged `reasoning.summary` / `reasoning.text` / `reasoning.encrypted`.
+function reasoningDetailsChunk(
+  details: Array<{ type?: string; summary?: string; text?: string }>,
+  finish: string | null = null,
+): FakeChunk {
+  return {
+    choices: [{ delta: { reasoning_details: details }, finish_reason: finish }],
+    usage: null,
+    model: "gpt-5.2",
+  };
+}
+
 // ---------------------------------------------------------------------------
 // Class extraction sanity checks
 // ---------------------------------------------------------------------------
@@ -339,6 +384,153 @@ describe("OpenAIProvider", () => {
     expect(events[1]).toEqual({ type: "text_delta", text: ", world!" });
   });
 
+  // -----------------------------------------------------------------------
+  // Reasoning content (MiniMax / DeepSeek extension)
+  // -----------------------------------------------------------------------
+  test("parses reasoning_content into thinking block", async () => {
+    fakeChunks = [
+      reasoningChunk("Let me think..."),
+      textChunk("The answer is 42."),
+      usageChunk(10, 20),
+    ];
+
+    const result = await provider.sendMessage([userMsg("Hi")]);
+
+    expect(result.content).toHaveLength(2);
+    expect(result.content[0]).toEqual({
+      type: "thinking",
+      thinking: "Let me think...",
+      signature: "",
+    });
+    expect(result.content[1]).toEqual({
+      type: "text",
+      text: "The answer is 42.",
+    });
+    expect(result.usage).toEqual({ inputTokens: 10, outputTokens: 20 });
+  });
+
+  test("fires thinking_delta events during streaming", async () => {
+    fakeChunks = [
+      reasoningChunk("Let me think..."),
+      textChunk("The answer is 42."),
+      usageChunk(10, 20),
+    ];
+
+    const events: ProviderEvent[] = [];
+    await provider.sendMessage([userMsg("Hi")], undefined, undefined, {
+      onEvent: (e) => events.push(e),
+    });
+
+    expect(events).toHaveLength(2);
+    expect(events[0]).toEqual({
+      type: "thinking_delta",
+      thinking: "Let me think...",
+    });
+    expect(events[1]).toEqual({
+      type: "text_delta",
+      text: "The answer is 42.",
+    });
+  });
+
+  test("reasoning + tool calls orders correctly (thinking → tool_use)", async () => {
+    fakeChunks = [
+      reasoningChunk("Planning..."),
+      ...toolCallChunks([
+        { id: "call_1", name: "file_read", args: '{"path":"/a"}' },
+      ]),
+      usageChunk(10, 30),
+    ];
+
+    const result = await provider.sendMessage([userMsg("Read /a")]);
+
+    expect(result.content).toHaveLength(2);
+    expect(result.content[0].type).toBe("thinking");
+    expect(result.content[1].type).toBe("tool_use");
+  });
+
+  test("no thinking block when reasoning_content is absent", async () => {
+    fakeChunks = [textChunk("Just text"), usageChunk(10, 5)];
+
+    const result = await provider.sendMessage([userMsg("Hi")]);
+
+    expect(result.content).toHaveLength(1);
+    expect(result.content[0].type).toBe("text");
+  });
+
+  test("parses OpenRouter's `delta.reasoning` field into thinking block", async () => {
+    fakeChunks = [
+      openRouterReasoningChunk("Hmm, let me think..."),
+      textChunk("Final answer."),
+      usageChunk(10, 8),
+    ];
+
+    const events: ProviderEvent[] = [];
+    const result = await provider.sendMessage(
+      [userMsg("Hi")],
+      undefined,
+      undefined,
+      {
+        onEvent: (e) => events.push(e),
+      },
+    );
+
+    expect(result.content).toHaveLength(2);
+    expect(result.content[0]).toEqual({
+      type: "thinking",
+      thinking: "Hmm, let me think...",
+      signature: "",
+    });
+    expect(result.content[1]).toEqual({ type: "text", text: "Final answer." });
+    expect(events).toContainEqual({
+      type: "thinking_delta",
+      thinking: "Hmm, let me think...",
+    });
+  });
+
+  test("parses OpenRouter `delta.reasoning_details` summary/text entries and skips encrypted", async () => {
+    fakeChunks = [
+      reasoningDetailsChunk([
+        { type: "reasoning.summary", summary: "Plan step one. " },
+        { type: "reasoning.encrypted", text: "ENCRYPTED_BLOB" },
+        { type: "reasoning.text", text: "Detailed thought." },
+      ]),
+      textChunk("Done."),
+      usageChunk(10, 8),
+    ];
+
+    const events: ProviderEvent[] = [];
+    const result = await provider.sendMessage(
+      [userMsg("Hi")],
+      undefined,
+      undefined,
+      {
+        onEvent: (e) => events.push(e),
+      },
+    );
+
+    expect(result.content).toHaveLength(2);
+    expect(result.content[0]).toEqual({
+      type: "thinking",
+      thinking: "Plan step one. Detailed thought.",
+      signature: "",
+    });
+    expect(result.content[1]).toEqual({ type: "text", text: "Done." });
+    expect(events).toContainEqual({
+      type: "thinking_delta",
+      thinking: "Plan step one. ",
+    });
+    expect(events).toContainEqual({
+      type: "thinking_delta",
+      thinking: "Detailed thought.",
+    });
+    // Encrypted blob must never surface as visible thinking.
+    for (const e of events) {
+      if (e.type === "thinking_delta") {
+        expect(e.thinking).not.toContain("ENCRYPTED_BLOB");
+      }
+    }
+  });
+
   // -----------------------------------------------------------------------
   // System prompt
   // -----------------------------------------------------------------------
@@ -1306,14 +1498,17 @@ describe("OpenRouterProvider reasoning", () => {
     shouldThrow = null;
   });
 
-  test("sends reasoning.enabled=true when thinking config is present", async () => {
+  test("sends reasoning.enabled=true with default detailed summary when thinking config is present", async () => {
     const provider = new OpenRouterProvider("or-key", "x-ai/grok-4");
     await provider.sendMessage([userMsg("hi")], undefined, undefined, {
       config: { thinking: { type: "adaptive" } },
     });
 
     expect(lastCreateParams).toBeTruthy();
-    expect(lastCreateParams!.reasoning).toEqual({ enabled: true });
+    expect(lastCreateParams!.reasoning).toEqual({
+      enabled: true,
+      summary: "detailed",
+    });
   });
 
   test("sends reasoning.enabled=false when thinking is explicitly disabled", async () => {
@@ -1344,6 +1539,30 @@ describe("OpenRouterProvider reasoning", () => {
     expect(lastCreateParams!.reasoning).toEqual({ enabled: false });
   });
 
+  test("sends OpenRouter app-attribution headers on OpenAI-compatible requests", async () => {
+    const provider = new OpenRouterProvider("or-key", "x-ai/grok-4");
+    await provider.sendMessage([userMsg("hi")], undefined, undefined, {
+      config: {
+        usageAttributionHeaders: {
+          "Vellum-Organization-Id": "org-123",
+        },
+      },
+    });
+
+    expect(lastCreateOptions?.headers).toEqual(
+      expect.objectContaining({
+        "HTTP-Referer": "https://www.vellum.ai",
+        "X-OpenRouter-Title": "Vellum Assistant",
+        "X-OpenRouter-Categories": "personal-agent,cli-agent",
+        "Vellum-Organization-Id": "org-123",
+      }),
+    );
+    expect(lastCreateParams).not.toHaveProperty("HTTP-Referer");
+    expect(lastCreateParams).not.toHaveProperty("X-OpenRouter-Title");
+    expect(lastCreateParams).not.toHaveProperty("X-OpenRouter-Categories");
+    expect(lastCreateParams).not.toHaveProperty("usageAttributionHeaders");
+  });
+
   test("RetryProvider + OpenRouterProvider enables thinking end-to-end", async () => {
     const provider = new OpenRouterProvider("or-key", "x-ai/grok-4");
     const retry = new RetryProvider(provider);
@@ -1352,7 +1571,10 @@ describe("OpenRouterProvider reasoning", () => {
     await retry.sendMessage([userMsg("hi")], undefined, undefined, {
       config: { thinking: { type: "adaptive" } },
     });
-    expect(lastCreateParams!.reasoning).toEqual({ enabled: true });
+    expect(lastCreateParams!.reasoning).toEqual({
+      enabled: true,
+      summary: "detailed",
+    });
   });
 
   test("RetryProvider + OpenRouterProvider disables thinking end-to-end", async () => {
@@ -1365,6 +1587,23 @@ describe("OpenRouterProvider reasoning", () => {
     });
     expect(lastCreateParams!.reasoning).toEqual({ enabled: false });
   });
+
+  test("nests effort under reasoning and omits top-level reasoning_effort", async () => {
+    const provider = new OpenRouterProvider("or-key", "moonshotai/kimi-k2.6");
+    await provider.sendMessage([userMsg("hi")], undefined, undefined, {
+      config: { thinking: { enabled: true }, effort: "max" },
+    });
+
+    expect(lastCreateParams).toBeTruthy();
+    expect(lastCreateParams!.reasoning).toEqual({
+      enabled: true,
+      effort: "xhigh",
+      summary: "detailed",
+    });
+    // Critical: must NOT also send the OpenAI-native flat field — OpenRouter
+    // rejects requests that carry both forms for reasoning models.
+    expect(lastCreateParams).not.toHaveProperty("reasoning_effort");
+  });
 });
 
 describe("OpenRouterProvider Anthropic-compatible errors", () => {

package/src/__tests__/openai-responses-cutover-guard.test.ts

@@ -91,18 +91,26 @@ describe("OpenAI Responses API cutover guard", () => {
     ).toBe(true);
 
     // The factory must NOT instantiate OpenAIChatCompletionsProvider or
-    // OpenAIProvider (the backward-compatible alias) for the "openai" key.
-    // Chat-completions classes may appear in imports but should not be
-    // instantiated in the openai factory entry.
-    const chatCompletionsInstantiations = [
-      ...source.matchAll(/new\s+OpenAIChatCompletionsProvider\s*\(/g),
-      ...source.matchAll(/new\s+OpenAIProvider\s*\(/g),
+    // OpenAIProvider (the backward-compatible alias) inside the `openai:`
+    // factory entry. Other entries (e.g. `openai-compatible:`) may legitimately
+    // use OpenAIChatCompletionsProvider since that's the OpenAI Chat Completions
+    // transport for third-party endpoints.
+    const openaiEntryRegion =
+      /(?:^|\s)openai\s*:\s*\([^)]*\)\s*=>\s*[\s\S]{0,400}?(?=\}\s*,\s*[a-z-]+\s*:|\}\s*;)/m.exec(
+        source,
+      )?.[0] ?? "";
+    const chatCompletionsInstantiationsInOpenAi = [
+      ...openaiEntryRegion.matchAll(
+        /new\s+OpenAIChatCompletionsProvider\s*\(/g,
+      ),
+      ...openaiEntryRegion.matchAll(/new\s+OpenAIProvider\s*\(/g),
     ];
     expect(
-      chatCompletionsInstantiations.length,
+      chatCompletionsInstantiationsInOpenAi.length,
       [
-        "adapter-factory.ts must NOT instantiate OpenAIChatCompletionsProvider or",
-        "OpenAIProvider (legacy alias). Use OpenAIResponsesProvider for openai.",
+        "ADAPTER_FACTORIES['openai'] must NOT instantiate",
+        "OpenAIChatCompletionsProvider or OpenAIProvider (legacy alias).",
+        "Use OpenAIResponsesProvider for openai.",
       ].join("\n"),
     ).toBe(0);