@vellumai/assistant 0.8.10 → 0.8.11-staging.1

package/src/__tests__/credential-execution-tools.test.ts

@@ -1,6 +1,8 @@
-import { describe, expect, test } from "bun:test";
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
 
+import type { CesClient } from "../credential-execution/client.js";
 import { RiskLevel } from "../permissions/types.js";
+import { setCesClient } from "../security/secure-keys.js";
 import { makeAuthenticatedRequestTool } from "../tools/credential-execution/make-authenticated-request.js";
 import { manageSecureCommandTool } from "../tools/credential-execution/manage-secure-command-tool.js";
 import { runAuthenticatedCommandTool } from "../tools/credential-execution/run-authenticated-command.js";
@@ -168,6 +170,11 @@ describe("CES tool execution without client", () => {
     trustClass: "guardian" as const,
   };
 
+  // The CES tools resolve the client via the module-level getCesClient()
+  // resolver, so ensure none is injected for the "absent client" cases.
+  beforeEach(() => setCesClient(undefined));
+  afterEach(() => setCesClient(undefined));
+
   test("make_authenticated_request fails gracefully when CES client is absent", async () => {
     const result = await makeAuthenticatedRequestTool.execute(
       {
@@ -218,19 +225,24 @@ describe("CES tool execution without client", () => {
 // ---------------------------------------------------------------------------
 
 describe("manage_secure_command_tool input validation", () => {
-  const contextWithMockCes = {
+  const minimalContext = {
     workingDir: "/tmp",
     conversationId: "test-conversation",
     trustClass: "guardian" as const,
-    cesClient: {
-      isReady: () => true,
-      handshake: async () => ({ accepted: true }),
-      call: async () => ({ success: true }),
-      updateAssistantApiKey: async () => ({ updated: true }),
-      close: () => {},
-    },
   };
 
+  // Input validation runs only after the client readiness check passes, so
+  // inject a ready mock client via the resolver for these cases.
+  const mockCesClient = {
+    isReady: () => true,
+    handshake: async () => ({ accepted: true }),
+    call: async () => ({ success: true }),
+    updateAssistantApiKey: async () => ({ updated: true }),
+    close: () => {},
+  } as unknown as CesClient;
+  beforeEach(() => setCesClient(mockCesClient));
+  afterEach(() => setCesClient(undefined));
+
   test("rejects register without required bundle metadata", async () => {
     const result = await manageSecureCommandTool.execute(
       {
@@ -238,7 +250,7 @@ describe("manage_secure_command_tool input validation", () => {
         toolName: "test-tool",
         // Missing bundleId, version, sourceUrl, sha256, credentialHandle
       },
-      contextWithMockCes,
+      minimalContext,
     );
     expect(result.isError).toBe(true);
     expect(result.content).toContain("bundleId");
@@ -270,7 +282,7 @@ describe("manage_secure_command_tool input validation", () => {
           egressMode: "no_network",
         },
       },
-      contextWithMockCes,
+      minimalContext,
     );
     expect(result.isError).toBe(true);
     expect(result.content).toContain("HTTPS");

package/src/__tests__/credential-security-invariants.test.ts

@@ -216,6 +216,7 @@ describe("Invariant 2: no generic plaintext secret read API", () => {
       "media/image-credentials.ts", // shared image-gen credential resolver (provider API key lookup)
       "memory/embedding-backend.ts", // embedding backend API key lookup
       "memory/llm-request-log-source-clickhouse.ts", // ClickHouse read source — lazy lookup of clickhouse:url + clickhouse:password + vellum:platform_assistant_id for self-scoped mirror reads
+      "memory/compaction-log-writer-clickhouse.ts", // ClickHouse compaction log writer — lazy lookup of clickhouse:url + clickhouse:password + vellum:platform_assistant_id for self-scoped event writes
       "daemon/providers-setup.ts", // provider initialization API key lookup
       "workspace/migrations/006-services-config.ts", // services config migration reads provider API keys
       "workspace/migrations/018-rekey-compound-credential-keys.ts", // re-key compound credential storage keys
@@ -230,7 +231,7 @@ describe("Invariant 2: no generic plaintext secret read API", () => {
       "runtime/routes/platform-routes.ts", // CLI platform connect/disconnect/status routes (CLI-migrated to IPC)
       "ipc/skill-routes/providers.ts", // host.providers.secureKeys.getProviderKey IPC route (out-of-process SkillHost companion)
       "daemon/external-plugins-bootstrap.ts", // reads credentials at plugin init (manifest.requiresCredential) via the CES-mediated getSecureKeyAsync path
-      "plugins/external-api.ts", // globalThis runtime bridge that exposes getSecureKeyAsync to dynamically-imported workspace plugins (compiled-binary plugin loading)
+      "plugin-api/index.ts", // public @vellumai/plugin-api surface re-exports getSecureKeyAsync to dynamically-imported workspace plugins via the boot-time shim (compiled-binary plugin loading)
       "inbound/platform-callback-registration.ts", // managed credential lookup for platform base URL, assistant ID, and API key
       "tts/providers/elevenlabs-provider.ts", // ElevenLabs TTS API key lookup
       "tts/providers/deepgram-provider.ts", // Deepgram TTS API key lookup
@@ -242,6 +243,10 @@ describe("Invariant 2: no generic plaintext secret read API", () => {
       "cli/commands/oauth/connect.ts", // CLI OAuth connect stored-secret verification
       "runtime/routes/chatgpt-subscription-auth-routes.ts", // ChatGPT subscription OAuth token storage
       "runtime/routes/identity-routes.ts", // health/readyz endpoint checks CES connectivity via getCesClient
+      "tools/credential-execution/run-authenticated-command.ts", // resolves the CES RPC client via getCesClient
+      "tools/credential-execution/make-authenticated-request.ts", // resolves the CES RPC client via getCesClient
+      "tools/credential-execution/manage-secure-command-tool.ts", // resolves the CES RPC client via getCesClient
+      "tools/executor.ts", // CES approval bridge resolves the CES RPC client via getCesClient
     ]);
 
     const thisDir = dirname(fileURLToPath(import.meta.url));

package/src/__tests__/db-schedule-syntax-migration.test.ts

@@ -4,6 +4,7 @@ import { describe, expect, test } from "bun:test";
 import { eq } from "drizzle-orm";
 import { drizzle } from "drizzle-orm/bun-sqlite";
 
+import { migrateScheduleDescription } from "../memory/migrations/270-schedule-description.js";
 import { migrateScheduleSourceConversation } from "../memory/migrations/270-schedule-source-conversation.js";
 import * as schema from "../memory/schema.js";
 import { scheduleJobs } from "../memory/schema.js";
@@ -50,6 +51,7 @@ describe("schedule_syntax column migration", () => {
         script TEXT,
         wake_conversation_id TEXT,
         timeout_ms INTEGER,
+        description TEXT NOT NULL DEFAULT '',
         created_at INTEGER NOT NULL,
         updated_at INTEGER NOT NULL
       )
@@ -137,6 +139,7 @@ describe("schedule_syntax column migration", () => {
       /* already exists */
     }
     migrateScheduleSourceConversation(db);
+    migrateScheduleDescription(db);
 
     const row = db
       .select()
@@ -202,6 +205,8 @@ describe("schedule_syntax column migration", () => {
     }
     migrateScheduleSourceConversation(db);
     migrateScheduleSourceConversation(db);
+    migrateScheduleDescription(db);
+    migrateScheduleDescription(db);
 
     const now = Date.now();
     raw.exec(
@@ -214,4 +219,79 @@ describe("schedule_syntax column migration", () => {
       .get();
     expect(row!.scheduleSyntax).toBe("cron");
   });
+
+  test("schedule description migration backfills non-defer rows once", () => {
+    const db = createTestDb();
+    const raw = getRawSqlite(db);
+
+    raw.exec(/*sql*/ `
+      CREATE TABLE IF NOT EXISTS cron_jobs (
+        id TEXT PRIMARY KEY,
+        name TEXT NOT NULL,
+        enabled INTEGER NOT NULL DEFAULT 1,
+        cron_expression TEXT,
+        schedule_syntax TEXT NOT NULL DEFAULT 'cron',
+        timezone TEXT,
+        message TEXT NOT NULL,
+        next_run_at INTEGER NOT NULL,
+        retry_count INTEGER NOT NULL DEFAULT 0,
+        created_by TEXT NOT NULL,
+        created_at INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL
+      )
+    `);
+
+    const now = Date.now();
+    raw
+      .query(
+        `INSERT INTO cron_jobs (id, name, cron_expression, message, next_run_at, created_by, created_at, updated_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+      )
+      .run(
+        "legacy-schedule",
+        "Legacy report",
+        "0 9 * * *",
+        "compile report",
+        now + 60_000,
+        "agent",
+        now,
+        now,
+      );
+    raw
+      .query(
+        `INSERT INTO cron_jobs (id, name, cron_expression, message, next_run_at, created_by, created_at, updated_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+      )
+      .run(
+        "legacy-defer",
+        "Deferred wake",
+        null,
+        "resume later",
+        now + 60_000,
+        "defer",
+        now,
+        now,
+      );
+
+    migrateScheduleDescription(db);
+
+    const rows = raw
+      .query("SELECT id, description FROM cron_jobs ORDER BY id")
+      .all() as Array<{ id: string; description: string }>;
+    expect(rows).toEqual([
+      { id: "legacy-defer", description: "" },
+      { id: "legacy-schedule", description: "Legacy report" },
+    ]);
+
+    raw
+      .query("UPDATE cron_jobs SET description = ? WHERE id = ?")
+      .run("", "legacy-schedule");
+
+    migrateScheduleDescription(db);
+
+    const description = raw
+      .query("SELECT description FROM cron_jobs WHERE id = ?")
+      .get("legacy-schedule") as { description: string };
+    expect(description.description).toBe("");
+  });
 });

package/src/__tests__/device-id.test.ts

@@ -1,4 +1,12 @@
-import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
@@ -16,11 +24,13 @@ import { getDeviceId, resetDeviceIdCache } from "../util/device-id.js";
 const originalVellumEnvironment = process.env.VELLUM_ENVIRONMENT;
 const originalXdgConfigHome = process.env.XDG_CONFIG_HOME;
 const originalIsContainerized = process.env.IS_CONTAINERIZED;
+const originalVellumDeviceId = process.env.VELLUM_DEVICE_ID;
 
 let tempDir: string;
 
 beforeEach(() => {
   tempDir = mkdtempSync(join(tmpdir(), "vellum-device-id-test-"));
+  delete process.env.VELLUM_DEVICE_ID;
   resetDeviceIdCache();
 });
 
@@ -42,6 +52,11 @@ afterEach(() => {
   } else {
     process.env.IS_CONTAINERIZED = originalIsContainerized;
   }
+  if (originalVellumDeviceId == null) {
+    delete process.env.VELLUM_DEVICE_ID;
+  } else {
+    process.env.VELLUM_DEVICE_ID = originalVellumDeviceId;
+  }
 
   try {
     rmSync(tempDir, { recursive: true, force: true });
@@ -110,3 +125,57 @@ describe("getDeviceId env-awareness", () => {
     expect(existsSync(xdgPath)).toBe(false);
   });
 });
+
+describe("getDeviceId VELLUM_DEVICE_ID precedence", () => {
+  beforeEach(() => {
+    delete process.env.IS_CONTAINERIZED;
+    process.env.VELLUM_ENVIRONMENT = "dev";
+    process.env.XDG_CONFIG_HOME = tempDir;
+  });
+
+  test("env var set returns that value without writing device.json", () => {
+    process.env.VELLUM_DEVICE_ID = "abc-123";
+
+    expect(getDeviceId()).toBe("abc-123");
+    // Nothing written anywhere under the XDG tempdir.
+    expect(readdirSync(tempDir)).toEqual([]);
+  });
+
+  test("env var with surrounding whitespace returns the trimmed value", () => {
+    process.env.VELLUM_DEVICE_ID = "  abc-123  ";
+
+    expect(getDeviceId()).toBe("abc-123");
+  });
+
+  test("empty/whitespace-only env var falls through to file resolution", () => {
+    process.env.VELLUM_DEVICE_ID = "   ";
+
+    const id = getDeviceId();
+    expect(id.length).toBeGreaterThan(0);
+    expect(existsSync(join(tempDir, "vellum-dev", "device.json"))).toBe(true);
+  });
+
+  test("env var wins over an existing device.json without overwriting it", () => {
+    const dir = join(tempDir, "vellum-dev");
+    mkdirSync(dir, { recursive: true });
+    const filePath = join(dir, "device.json");
+    writeFileSync(filePath, JSON.stringify({ deviceId: "file-id" }));
+    process.env.VELLUM_DEVICE_ID = "env-id";
+
+    expect(getDeviceId()).toBe("env-id");
+    expect(JSON.parse(readFileSync(filePath, "utf-8")).deviceId).toBe(
+      "file-id",
+    );
+  });
+
+  test("env-resolved value stays cached until resetDeviceIdCache", () => {
+    process.env.VELLUM_DEVICE_ID = "env-id";
+    expect(getDeviceId()).toBe("env-id");
+
+    delete process.env.VELLUM_DEVICE_ID;
+    expect(getDeviceId()).toBe("env-id");
+
+    resetDeviceIdCache();
+    expect(getDeviceId()).not.toBe("env-id");
+  });
+});

package/src/__tests__/embedding-managed-proxy-selection.test.ts

@@ -2,8 +2,7 @@
  * Tests for managed proxy Gemini embedding backend selection.
  *
  * Verifies that selectEmbeddingBackend correctly routes through the
- * managed proxy when the feature flag is enabled and managed proxy
- * prerequisites are satisfied.
+ * managed proxy when managed proxy prerequisites are satisfied.
  */
 
 import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
@@ -42,13 +41,9 @@ mock.module("../security/secure-keys.js", () => ({
   },
 }));
 
-// Feature flag mock
-const mockFeatureFlags: Record<string, boolean> = {};
-
+// Feature flag mock — always returns true (flag is GA'ed)
 mock.module("../config/assistant-feature-flags.js", () => ({
-  isAssistantFeatureFlagEnabled: (key: string, _config: unknown) => {
-    return mockFeatureFlags[key] ?? false;
-  },
+  isAssistantFeatureFlagEnabled: () => true,
 }));
 
 import type { AssistantConfig } from "../config/types.js";
@@ -75,14 +70,6 @@ function disableManagedProxy() {
   mockAssistantApiKey = null;
 }
 
-function enableFlag() {
-  mockFeatureFlags["managed-gemini-embeddings-enabled"] = true;
-}
-
-function disableFlag() {
-  mockFeatureFlags["managed-gemini-embeddings-enabled"] = false;
-}
-
 function makeConfig(
   overrides: {
     provider?: string;
@@ -116,7 +103,6 @@ function makeConfig(
 
 beforeEach(() => {
   disableManagedProxy();
-  disableFlag();
   mockProviderKeys = {};
   clearEmbeddingBackendCache();
 });
@@ -126,9 +112,8 @@ afterEach(() => {
 });
 
 describe("managed proxy Gemini embedding selection", () => {
-  test("selects managed proxy Gemini when flag enabled and proxy context available", async () => {
+  test("selects managed proxy Gemini when proxy context available", async () => {
     enableManagedProxy();
-    enableFlag();
     const config = makeConfig();
 
     const { backend, reason } = await selectEmbeddingBackend(config);
@@ -141,7 +126,6 @@ describe("managed proxy Gemini embedding selection", () => {
 
   test("managed proxy backend uses default 3072 dimensions when geminiDimensions not set", async () => {
     enableManagedProxy();
-    enableFlag();
     const config = makeConfig();
 
     const { backend } = await selectEmbeddingBackend(config);
@@ -155,7 +139,6 @@ describe("managed proxy Gemini embedding selection", () => {
 
   test("managed proxy backend uses explicit geminiDimensions when set", async () => {
     enableManagedProxy();
-    enableFlag();
     const config = makeConfig({ geminiDimensions: 768 });
 
     const { backend } = await selectEmbeddingBackend(config);
@@ -168,7 +151,6 @@ describe("managed proxy Gemini embedding selection", () => {
 
   test("managed proxy backend uses managedBaseUrl (not direct Google API)", async () => {
     enableManagedProxy();
-    enableFlag();
     const config = makeConfig();
 
     const { backend } = await selectEmbeddingBackend(config);
@@ -179,32 +161,19 @@ describe("managed proxy Gemini embedding selection", () => {
     expect(managedBaseUrl).toBe(`${PLATFORM_BASE}/v1/runtime-proxy/gemini`);
   });
 
-  test("falls back to local when flag is disabled (no managed proxy)", async () => {
-    enableManagedProxy();
-    disableFlag();
-    const config = makeConfig();
-
-    const { backend } = await selectEmbeddingBackend(config);
-
-    // With auto and no provider keys, falls through to local
-    expect(backend).not.toBeNull();
-    expect(backend!.provider).toBe("local");
-  });
-
   test("falls back to local when managed proxy context unavailable", async () => {
     disableManagedProxy();
-    enableFlag();
     const config = makeConfig();
 
     const { backend } = await selectEmbeddingBackend(config);
 
+    // With auto and no provider keys or proxy, falls through to local
     expect(backend).not.toBeNull();
     expect(backend!.provider).toBe("local");
   });
 
   test("selects managed proxy when provider is explicitly gemini", async () => {
     enableManagedProxy();
-    enableFlag();
     const config = makeConfig({ provider: "gemini" });
 
     const { backend } = await selectEmbeddingBackend(config);
@@ -217,7 +186,6 @@ describe("managed proxy Gemini embedding selection", () => {
 
   test("does not use managed proxy when provider is explicitly local", async () => {
     enableManagedProxy();
-    enableFlag();
     const config = makeConfig({ provider: "local" });
 
     const { backend } = await selectEmbeddingBackend(config);
@@ -228,7 +196,6 @@ describe("managed proxy Gemini embedding selection", () => {
 
   test("does not use managed proxy when provider is explicitly openai", async () => {
     enableManagedProxy();
-    enableFlag();
     mockProviderKeys[credentialKey("openai", "api_key")] = "user-openai-key";
     const config = makeConfig({ provider: "openai" });
 
@@ -238,9 +205,8 @@ describe("managed proxy Gemini embedding selection", () => {
     expect(backend!.provider).toBe("openai");
   });
 
-  test("direct Gemini key still works when flag is off", async () => {
+  test("direct Gemini key still works without managed proxy", async () => {
     disableManagedProxy();
-    disableFlag();
     mockProviderKeys[credentialKey("gemini", "api_key")] = "user-gemini-key";
     const config = makeConfig({ provider: "gemini" });