@vellumai/assistant 0.8.11 → 0.8.12-staging.2

package/src/__tests__/config-loader-quarantine-notice.test.ts

@@ -0,0 +1,167 @@
+/**
+ * When loadConfig()/loadRawConfig() quarantines a corrupt config.json, it
+ * writes a small JSON sentinel to <workspace>/data/config-quarantine-notice.json
+ * recording the event. The per-turn `config-quarantine-notice` injector reads
+ * that sentinel and surfaces the reset to the agent — it's agent-visible
+ * context, not a push notification.
+ *
+ * The sentinel is overwritten on each quarantine (idempotent per event) and
+ * resolves from a workspace-derived path so it is safe to write during the
+ * very early config load, before the SQLite DB or getConfig().dataDir exist.
+ */
+
+import {
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+
+import {
+  _writeQuarantineNotice,
+  invalidateConfigCache,
+  loadConfig,
+} from "../config/loader.js";
+import { getConfigQuarantineNoticePath } from "../util/platform.js";
+import { setStorePathForTesting } from "./encrypted-store-test-helpers.js";
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+const WORKSPACE_DIR = process.env.VELLUM_WORKSPACE_DIR!;
+const CONFIG_PATH = join(WORKSPACE_DIR, "config.json");
+const NOTICE_PATH = getConfigQuarantineNoticePath();
+
+function ensureTestDir(): void {
+  const dirs = [
+    WORKSPACE_DIR,
+    join(WORKSPACE_DIR, "data"),
+    join(WORKSPACE_DIR, "data", "memory"),
+    join(WORKSPACE_DIR, "data", "memory", "knowledge"),
+    join(WORKSPACE_DIR, "data", "logs"),
+  ];
+  for (const dir of dirs) {
+    if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  }
+}
+
+function resetWorkspace(): void {
+  for (const name of readdirSync(WORKSPACE_DIR)) {
+    rmSync(join(WORKSPACE_DIR, name), { recursive: true, force: true });
+  }
+  ensureTestDir();
+}
+
+function listQuarantinedFiles(): string[] {
+  return readdirSync(WORKSPACE_DIR).filter((name) =>
+    /^config\.json\.corrupt-.+\.json$/.test(name),
+  );
+}
+
+function readNotice(): {
+  quarantinedAt: string;
+  quarantinePath: string;
+  originalPath: string;
+} {
+  return JSON.parse(readFileSync(NOTICE_PATH, "utf-8"));
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("config-quarantine notice sentinel", () => {
+  beforeEach(() => {
+    resetWorkspace();
+    setStorePathForTesting(join(WORKSPACE_DIR, "keys.enc"));
+    invalidateConfigCache();
+  });
+
+  afterEach(() => {
+    setStorePathForTesting(null);
+    invalidateConfigCache();
+  });
+
+  test("writes a sentinel recording the quarantine when config.json is corrupt", () => {
+    writeFileSync(CONFIG_PATH, '{"provider": "anthropic", "mo');
+
+    loadConfig();
+
+    const [quarantinedName] = listQuarantinedFiles();
+    expect(quarantinedName).toBeDefined();
+    const quarantinedPath = join(WORKSPACE_DIR, quarantinedName);
+
+    expect(existsSync(NOTICE_PATH)).toBe(true);
+    const notice = readNotice();
+    expect(notice.quarantinePath).toBe(quarantinedPath);
+    expect(notice.originalPath).toBe(CONFIG_PATH);
+    // quarantinedAt is a parseable ISO timestamp.
+    expect(Number.isNaN(Date.parse(notice.quarantinedAt))).toBe(false);
+  });
+
+  test("a second quarantine overwrites the sentinel with the latest event", () => {
+    // First corruption round.
+    writeFileSync(CONFIG_PATH, '{"partial": ');
+    loadConfig();
+    invalidateConfigCache();
+
+    const firstNotice = readNotice();
+    expect(listQuarantinedFiles()).toHaveLength(1);
+
+    // Loader wrote a fresh default config.json after quarantine; corrupt it
+    // again. Spin briefly so the second quarantine gets a distinct
+    // millisecond-precision filename (and a later timestamp).
+    const untilDifferentMs = Date.now() + 5;
+    while (Date.now() < untilDifferentMs) {
+      /* spin */
+    }
+    writeFileSync(CONFIG_PATH, "still not json");
+    loadConfig();
+
+    const quarantined = listQuarantinedFiles().sort();
+    expect(quarantined).toHaveLength(2);
+
+    // Single sentinel, pointing at the most recent quarantine.
+    const secondNotice = readNotice();
+    expect(secondNotice.quarantinePath).not.toBe(firstNotice.quarantinePath);
+    expect(secondNotice.quarantinePath).toBe(
+      join(WORKSPACE_DIR, quarantined[quarantined.length - 1]),
+    );
+  });
+
+  test("valid config.json does not create a sentinel (regression guard)", () => {
+    writeFileSync(
+      CONFIG_PATH,
+      JSON.stringify({ provider: "anthropic", model: "claude-opus-4-7" }),
+    );
+
+    loadConfig();
+
+    expect(listQuarantinedFiles()).toHaveLength(0);
+    expect(existsSync(NOTICE_PATH)).toBe(false);
+  });
+
+  test("sentinel write failure is swallowed (startup never blocks)", () => {
+    // Make the notice directory unwritable by replacing it with a file so the
+    // write/mkdir path throws. The helper must not propagate the error.
+    const noticeDir = join(WORKSPACE_DIR, "data");
+    rmSync(noticeDir, { recursive: true, force: true });
+    // A regular file where the `data` directory is expected makes mkdir/write
+    // fail with ENOTDIR/EEXIST.
+    writeFileSync(noticeDir, "not a directory", "utf-8");
+
+    const quarantinePath = join(
+      WORKSPACE_DIR,
+      "config.json.corrupt-2026-04-20T12-00-00.000Z.json",
+    );
+
+    expect(() =>
+      _writeQuarantineNotice(CONFIG_PATH, quarantinePath),
+    ).not.toThrow();
+  });
+});

package/src/__tests__/config-watcher.test.ts

@@ -266,12 +266,12 @@ describe("ConfigWatcher workspace file handlers", () => {
     expect(identityCallCount).toBe(1);
   });
 
-  test("UPDATES.md is not subscribed (only the registered handler set is)", () => {
+  test("unregistered workspace files are not subscribed (only the registered handler set is)", () => {
     watcher.start(onConversationEvict);
     // Per-file watching only registers config.json, SOUL.md, IDENTITY.md.
     // The whole workspace dir must not be watched either — that was the
     // ENXIO-on-Unix-sockets bug.
-    expect(findFileWatch(join(WORKSPACE_DIR, "UPDATES.md"))).toBeUndefined();
+    expect(findFileWatch(join(WORKSPACE_DIR, "OTHER.md"))).toBeUndefined();
     expect(findWatcher(WORKSPACE_DIR)).toBeUndefined();
   });
 

package/src/__tests__/conversation-agent-loop-inference-profile.test.ts

@@ -3,7 +3,7 @@
  * `inferenceProfile` column at turn start and threads it through to
  * `AgentLoop.run()` as the per-turn `overrideProfile`. Background
  * conversations intentionally skip the column so background fan-out
- * (subagents, scheduled tasks, update bulletins) runs on the workspace
+ * (subagents, scheduled tasks) runs on the workspace
  * defaults rather than inheriting an interactive override.
  *
  * This is the "conversation-agent-loop integration" half of the

package/src/__tests__/conversation-error.test.ts

@@ -461,7 +461,7 @@ describe("classifyConversationError", () => {
       const result = classifyConversationError(err, baseCtx);
       expect(result.code).toBe("PROVIDER_NOT_CONFIGURED");
       expect(result.userMessage).toBe(
-        "No API key configured for inference. Add one in Settings to start chatting.",
+        "No API key configured for inference. Add one in Settings → Models & Services to start chatting.",
       );
       expect(result.retryable).toBe(true);
       expect(result.errorCategory).toBe("provider_not_configured");
@@ -636,11 +636,7 @@ describe("classifyConversationError", () => {
     });
 
     it("classifies ProviderError 403 with 'invalid api key' message as PROVIDER_INVALID_KEY", () => {
-      const err = new ProviderError(
-        "OpenAI: Invalid API key",
-        "openai",
-        403,
-      );
+      const err = new ProviderError("OpenAI: Invalid API key", "openai", 403);
       const result = classifyConversationError(err, baseCtx);
       expect(result.code).toBe("PROVIDER_INVALID_KEY");
       expect(result.errorCategory).toBe("provider_invalid_key");

package/src/__tests__/conversation-history-web-search.test.ts

@@ -755,6 +755,7 @@ describe("web_search_tool_result structural guard", () => {
     // (array of web_search_result objects) and is not truncated this way.
     "context/tool-result-truncation.ts",
     "context/post-turn-tool-result-truncation.ts",
+    "context/tool-result-spool.ts",
 
     // Anthropic provider type guards define API-specific discriminants.
     // It has a separate isWebSearchToolResultBlock for the other type.
@@ -788,6 +789,13 @@ describe("web_search_tool_result structural guard", () => {
     // tool_result is relevant. Same reasoning as agent/loop.ts above.
     "plugins/defaults/tool-error/hooks/post-tool-use.ts",
 
+    // Counts unbroken runs of locally-executed exploration tools (bash,
+    // file_read, file_list) to detect inline drift. Server-side web search
+    // results (web_search_tool_result) are not produced by the tool executor;
+    // any non-exploration block simply bounds the trailing run, which is the
+    // conservative direction (fewer nudges). Same reasoning as agent/loop.ts.
+    "plugins/defaults/exploration-drift/hooks/post-tool-use.ts",
+
     // Reconciles synthesized cancellation tool_results for locally-executed
     // tools only. Same reasoning as agent/loop.ts above.
     "daemon/conversation-agent-loop.ts",

package/src/__tests__/conversation-title-service.test.ts

@@ -59,6 +59,7 @@ mock.module("../runtime/sync/resource-sync-events.js", () => ({
 }));
 
 import {
+  AUTO_TITLE_DETERMINISTIC,
   generateAndPersistConversationTitle,
   queueGenerateConversationTitle,
   regenerateConversationTitle,
@@ -260,7 +261,7 @@ describe("conversation-title-service", () => {
     expect(mockUpdateConversationTitle).toHaveBeenCalledWith(
       "conv-1",
       "Untitled Conversation",
-      1,
+      AUTO_TITLE_DETERMINISTIC,
     );
   });
 

package/src/__tests__/credential-security-invariants.test.ts

@@ -216,7 +216,7 @@ describe("Invariant 2: no generic plaintext secret read API", () => {
       "media/image-credentials.ts", // shared image-gen credential resolver (provider API key lookup)
       "memory/embedding-backend.ts", // embedding backend API key lookup
       "memory/llm-request-log-source-clickhouse.ts", // ClickHouse read source — lazy lookup of clickhouse:url + clickhouse:password + vellum:platform_assistant_id for self-scoped mirror reads
-      "memory/compaction-log-writer-clickhouse.ts", // ClickHouse compaction log writer — lazy lookup of clickhouse:url + clickhouse:password + vellum:platform_assistant_id for self-scoped event writes
+      "memory/compaction-log-store-clickhouse.ts", // ClickHouse compaction log writer — lazy lookup of clickhouse:url + clickhouse:password + vellum:platform_assistant_id for self-scoped event writes
       "daemon/providers-setup.ts", // provider initialization API key lookup
       "workspace/migrations/006-services-config.ts", // services config migration reads provider API keys
       "workspace/migrations/018-rekey-compound-credential-keys.ts", // re-key compound credential storage keys

package/src/__tests__/disk-pressure-tools.test.ts

@@ -41,7 +41,7 @@ mock.module("../config/loader.js", () => ({
   setNestedValue: () => undefined,
   mergeDefaultWorkspaceConfig: (config: unknown) => config,
   API_KEY_PROVIDERS: [] as const,
-  _appendQuarantineBulletin: () => undefined,
+  _writeQuarantineNotice: () => undefined,
 }));
 
 mock.module("../daemon/conversation-skill-tools.js", () => ({