@vellumai/assistant 0.8.11 → 0.8.12-staging.2

package/src/__tests__/recurrence-engine.test.ts

@@ -2,6 +2,8 @@ import { describe, expect, test } from "bun:test";
 
 import {
   computeNextRunAt,
+  describeRRuleExpression,
+  isSingleFireRRule,
   isValidScheduleExpression,
 } from "../schedule/recurrence-engine.js";
 
@@ -117,3 +119,46 @@ describe("recurrence engine — rrule", () => {
     expect(next).toBe(jan2);
   });
 });
+
+describe("recurrence engine — rrule display helpers", () => {
+  const SINGLE_FIRE = "DTSTART:20990612T080000\nRRULE:FREQ=DAILY;COUNT=1";
+  const WEEKLY = "DTSTART:20990612T080000\nRRULE:FREQ=WEEKLY;BYDAY=MO,WE";
+
+  test("isSingleFireRRule detects COUNT=1 rules", () => {
+    expect(isSingleFireRRule(SINGLE_FIRE)).toBe(true);
+    expect(isSingleFireRRule(WEEKLY)).toBe(false);
+    expect(
+      isSingleFireRRule("DTSTART:20990612T080000\nRRULE:FREQ=DAILY;COUNT=2"),
+    ).toBe(false);
+    expect(isSingleFireRRule("not an rrule")).toBe(false);
+  });
+
+  test("isSingleFireRRule is false for set constructs", () => {
+    expect(
+      isSingleFireRRule(
+        "DTSTART:20990612T080000\nRRULE:FREQ=DAILY;COUNT=1\nRDATE:20990613T080000",
+      ),
+    ).toBe(false);
+  });
+
+  test("describeRRuleExpression humanizes rules", () => {
+    expect(describeRRuleExpression(SINGLE_FIRE)).toBe("One-time");
+    expect(describeRRuleExpression(WEEKLY)).toBe(
+      "Every week on Monday, Wednesday",
+    );
+    expect(
+      describeRRuleExpression(
+        "DTSTART:20990612T080000\nRRULE:FREQ=DAILY;COUNT=3",
+      ),
+    ).toBe("Every day for 3 times");
+  });
+
+  test("describeRRuleExpression falls back instead of leaking raw text", () => {
+    expect(
+      describeRRuleExpression(
+        "DTSTART:20990612T080000\nRRULE:FREQ=DAILY\nEXDATE:20990613T080000",
+      ),
+    ).toBe("Custom recurrence");
+    expect(describeRRuleExpression("garbage")).toBe("Custom recurrence");
+  });
+});

package/src/__tests__/schedule-routes.test.ts

@@ -492,6 +492,40 @@ describe("GET /schedules — default defer exclusion", () => {
     });
   });
 
+  test("humanizes rrule cadences and flags single-fire rrules as one-shot", () => {
+    createSchedule({
+      name: "RRule single fire",
+      cronExpression: "DTSTART:20990612T080000\nRRULE:FREQ=DAILY;COUNT=1",
+      syntax: "rrule",
+      message: "brush teeth",
+    });
+    createSchedule({
+      name: "RRule weekly",
+      cronExpression: "DTSTART:20990612T080000\nRRULE:FREQ=WEEKLY;BYDAY=MO,WE",
+      syntax: "rrule",
+      message: "standup",
+    });
+
+    const route = findRoute("schedules", "GET");
+    const result = route.handler({}) as {
+      schedules: Array<{
+        name: string;
+        cadenceDescription: string;
+        isOneShot: boolean;
+      }>;
+    };
+    const byName = new Map(result.schedules.map((s) => [s.name, s]));
+
+    expect(byName.get("RRule single fire")).toMatchObject({
+      cadenceDescription: "One-time",
+      isOneShot: true,
+    });
+    expect(byName.get("RRule weekly")).toMatchObject({
+      cadenceDescription: "Every week on Monday, Wednesday",
+      isOneShot: false,
+    });
+  });
+
   test("mutation responses also exclude deferred wakes", () => {
     createSchedule({
       name: "Agent schedule",

package/src/__tests__/scheduler-disk-pressure.test.ts

@@ -28,7 +28,7 @@ mock.module("../config/loader.js", () => ({
   getNestedValue: () => undefined,
   setNestedValue: () => {},
   API_KEY_PROVIDERS: [],
-  _appendQuarantineBulletin: () => {},
+  _writeQuarantineNotice: () => {},
   invalidateConfigCache: () => {},
 }));
 

package/src/__tests__/script-proxy-conversation-manager.test.ts

@@ -247,13 +247,18 @@ describe("session-manager", () => {
       await startSession(session.id);
       expect(getActiveSession(CONV_ID)).toBeDefined();
 
-      // Wait for the idle timeout to fire
-      await new Promise((r) => setTimeout(r, 200));
+      // Wait for the idle timeout to fire and the async stop to finish.
+      // The session passes through "stopping" while the server closes, so
+      // poll for the terminal state rather than sleeping a fixed interval.
+      const deadline = Date.now() + 5000;
+      const findSession = () =>
+        getSessionsForConversation(CONV_ID).find((x) => x.id === session.id);
+      while (findSession()?.status !== "stopped" && Date.now() < deadline) {
+        await new Promise((r) => setTimeout(r, 20));
+      }
 
       expect(getActiveSession(CONV_ID)).toBeUndefined();
-      const all = getSessionsForConversation(CONV_ID);
-      const s = all.find((x) => x.id === session.id);
-      expect(s?.status).toBe("stopped");
+      expect(findSession()?.status).toBe("stopped");
     });
   });
 

package/src/__tests__/secret-fixtures.ts

@@ -0,0 +1,20 @@
+/**
+ * Shared synthetic-secret fixtures for redaction tests.
+ *
+ * Constants only — per the test machinery isolation rule, shared helpers in
+ * `src/__tests__/` must not import from `src/`.
+ */
+
+/**
+ * A synthetic OpenAI project key that matches the scanner's
+ * `sk-proj-[A-Za-z0-9\-_]{40,}` pattern while deliberately dodging its
+ * placeholder filtering: no "test"/"example"/"xxxx"-style segments, not a
+ * repeated character, and it ends with an alphanumeric so the trailing `\b`
+ * boundary holds.
+ */
+export const SYNTHETIC_OPENAI_PROJECT_KEY =
+  "sk-proj-Ab1Cd2Ef3Gh4Ij5Kl6Mn7Op8Qr9St0Uv1Wx2Yz3Ab4Cd5Ef6Gh";
+
+/** The marker `redactSecrets()` substitutes for the key above. */
+export const OPENAI_PROJECT_KEY_REDACTION_MARKER =
+  '<redacted type="OpenAI Project Key" />';

package/src/__tests__/skill-tool-factory.test.ts

@@ -347,6 +347,55 @@ describe("createSkillTool — required/type/enum validation", () => {
     expect(result.content).toContain('mode must be one of "a", "b"');
   });
 
+  test("coerces string booleans before validation and passes the coerced value to the executor", async () => {
+    const hash = computeSkillVersionHash(tempDir);
+    const tool = createSkillTool(
+      makeEntry({
+        executor: "echo.ts",
+        input_schema: {
+          type: "object",
+          properties: {
+            auto_open: { type: "boolean" },
+            name: { type: "string" },
+          },
+        },
+      }),
+      tempDir,
+      hash,
+    );
+
+    const result = await tool.execute(
+      { auto_open: "false", name: "x" },
+      makeContext(),
+    );
+
+    expect(result.isError).toBe(false);
+    const parsed = JSON.parse(result.content);
+    expect(parsed.input).toEqual({ auto_open: false, name: "x" });
+  });
+
+  test("rejects non-coercible boolean strings with a self-correcting message", async () => {
+    const hash = computeSkillVersionHash(tempDir);
+    const tool = createSkillTool(
+      makeEntry({
+        executor: "echo.ts",
+        input_schema: {
+          type: "object",
+          properties: { auto_open: { type: "boolean" } },
+        },
+      }),
+      tempDir,
+      hash,
+    );
+
+    const result = await tool.execute({ auto_open: "yes" }, makeContext());
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain(
+      "auto_open must be a boolean — pass true or false as a JSON boolean, not a string",
+    );
+  });
+
   test("passes valid input through to the executor unchanged", async () => {
     const hash = computeSkillVersionHash(tempDir);
     const tool = createSkillTool(

package/src/__tests__/subagent-role-registry.test.ts

@@ -7,7 +7,13 @@ import {
 } from "../subagent/index.js";
 
 /** All roles defined in the SubagentRole union. */
-const ALL_ROLES: SubagentRole[] = ["general", "researcher", "coder", "planner"];
+const ALL_ROLES: SubagentRole[] = [
+  "general",
+  "researcher",
+  "coder",
+  "planner",
+  "investigator",
+];
 
 describe("SUBAGENT_ROLE_REGISTRY", () => {
   test("covers all values in the SubagentRole union", () => {
@@ -64,6 +70,23 @@ describe("SUBAGENT_ROLE_REGISTRY", () => {
     expect(SUBAGENT_ROLE_REGISTRY.planner.allowedTools!).toContain("recall");
   });
 
+  test('investigator includes "bash" for grep/find-based code and log investigation', () => {
+    expect(SUBAGENT_ROLE_REGISTRY.investigator.allowedTools!).toContain("bash");
+  });
+
+  test("investigator excludes file write tools (read-only investigation)", () => {
+    const tools = SUBAGENT_ROLE_REGISTRY.investigator.allowedTools!;
+    expect(tools).not.toContain("file_write");
+    expect(tools).not.toContain("file_edit");
+  });
+
+  test("investigator preamble defines the root-cause report contract", () => {
+    const preamble = SUBAGENT_ROLE_REGISTRY.investigator.systemPromptPreamble;
+    expect(preamble).toContain("Root cause");
+    expect(preamble).toContain("Evidence");
+    expect(preamble).toContain("notify_parent");
+  });
+
   test("no role references the old memory_recall tool name", () => {
     for (const [_role, config] of Object.entries(SUBAGENT_ROLE_REGISTRY)) {
       if (config.allowedTools !== undefined) {

package/src/__tests__/subagent-tools.test.ts

@@ -1325,6 +1325,7 @@ describe("Subagent role-based spawn", () => {
       "researcher",
       "coder",
       "planner",
+      "investigator",
     ]);
     // role is not required
     expect(def.input_schema.required).not.toContain("role");

package/src/__tests__/system-prompt.test.ts

@@ -110,6 +110,8 @@ mock.module("../credential-execution/managed-catalog.js", () => ({
 // Import after mock
 const { buildSystemPrompt, ensurePromptFiles, stripCommentLines } =
   await import("../prompts/system-prompt.js");
+const { SYSTEM_PROMPT_CACHE_BOUNDARY } =
+  await import("../prompts/cache-boundary.js");
 
 describe("buildSystemPrompt", () => {
   beforeEach(() => {
@@ -128,7 +130,6 @@ describe("buildSystemPrompt", () => {
       "SOUL.md",
       "USER.md",
       "BOOTSTRAP.md",
-      "UPDATES.md",
       "VOICE.md",
       "skills",
       "users",
@@ -603,16 +604,6 @@ describe("buildSystemPrompt", () => {
     });
   });
 
-  test("never includes UPDATES.md content in system prompt", () => {
-    const updatesBody = "# v1.2\n\nNew feature added. UNIQUE_UPDATES_MARKER.";
-    writeFileSync(join(TEST_DIR, "UPDATES.md"), updatesBody);
-    const result = buildSystemPrompt();
-    expect(result).not.toContain("## Recent Updates");
-    expect(result).not.toContain(updatesBody);
-    expect(result).not.toContain("UNIQUE_UPDATES_MARKER");
-    expect(result).not.toContain("Update Handling");
-  });
-
   test("strips comment lines starting with _ from prompt files", () => {
     writeFileSync(
       join(TEST_DIR, "IDENTITY.md"),
@@ -879,6 +870,113 @@ describe("buildSystemPrompt", () => {
       expect(orgIdx).toBeGreaterThan(parallelIdx);
     });
 
+    describe("cache breakpoints", () => {
+      test("default breakpoint splits the prompt after 11-channel-persona", () => {
+        /**
+         * Tests that the bundled `cacheBreakpoint` on 11-channel-persona
+         * places the boundary marker between the stable sections and the
+         * volatile 12-voice section.
+         */
+        // GIVEN a workspace where a volatile section (12-voice) renders
+        writeFileSync(join(TEST_DIR, "VOICE.md"), "- Prefers lowercase.");
+
+        // WHEN the system prompt is built
+        const result = buildSystemPrompt();
+
+        // THEN the boundary marker sits before the voice content and
+        // after the stable instruction sections
+        const boundaryIdx = result.indexOf(SYSTEM_PROMPT_CACHE_BOUNDARY);
+        expect(boundaryIdx).toBeGreaterThan(-1);
+        expect(result.indexOf("## Communication")).toBeLessThan(boundaryIdx);
+        expect(result.indexOf("# Voice Profile")).toBeGreaterThan(boundaryIdx);
+      });
+
+      test("breakpoint splits even when the declaring section gates off", () => {
+        /**
+         * Tests that the split is resolved against the section ordering,
+         * not the rendered output — an absent channel persona must not
+         * merge the blocks around it.
+         */
+        // GIVEN no channel persona file exists but a volatile section renders
+        writeFileSync(join(TEST_DIR, "VOICE.md"), "- Prefers lowercase.");
+
+        // WHEN the system prompt is built
+        const result = buildSystemPrompt();
+
+        // THEN the boundary marker is still present
+        expect(result).toContain(SYSTEM_PROMPT_CACHE_BOUNDARY);
+      });
+
+      test("no boundary marker when nothing renders after the breakpoint", () => {
+        /**
+         * Tests that empty trailing blocks are dropped so the marker
+         * never dangles at the end of the prompt.
+         */
+        // GIVEN a fresh workspace with no volatile sections (no VOICE.md,
+        // no BOOTSTRAP.md, no connections)
+        // WHEN the system prompt is built
+        const result = buildSystemPrompt();
+
+        // THEN no boundary marker appears
+        expect(result).not.toContain(SYSTEM_PROMPT_CACHE_BOUNDARY);
+      });
+
+      test("workspace override of 11-channel-persona without cache_breakpoint clears the default", () => {
+        /**
+         * Tests that a workspace override takes full control of the
+         * section, including its breakpoint declaration.
+         */
+        // GIVEN a workspace override of 11-channel-persona with no
+        // cache_breakpoint frontmatter, and a volatile section that renders
+        mkdirSync(SYSTEM_PROMPTS_DIR, { recursive: true });
+        writeFileSync(
+          join(SYSTEM_PROMPTS_DIR, "11-channel-persona.md"),
+          "Override channel persona.\n",
+        );
+        writeFileSync(join(TEST_DIR, "VOICE.md"), "- Prefers lowercase.");
+
+        // WHEN the system prompt is built
+        const result = buildSystemPrompt();
+
+        // THEN the override body renders but no boundary marker appears
+        expect(result).toContain("Override channel persona.");
+        expect(result).not.toContain(SYSTEM_PROMPT_CACHE_BOUNDARY);
+      });
+
+      test("frontmatter cache_breakpoint on a workspace section places the boundary there", () => {
+        /**
+         * Tests that users can declare the breakpoint position via
+         * `cache_breakpoint: true` frontmatter, and that only the first
+         * declaration (in id-sort order) is honored.
+         */
+        // GIVEN a custom workspace section declaring a cache breakpoint
+        // ahead of the bundled default on 11-channel-persona
+        mkdirSync(SYSTEM_PROMPTS_DIR, { recursive: true });
+        writeFileSync(
+          join(SYSTEM_PROMPTS_DIR, "00-aaa-custom.md"),
+          "---\ncache_breakpoint: true\n---\nCustom head section.\n",
+        );
+        writeFileSync(join(TEST_DIR, "VOICE.md"), "- Prefers lowercase.");
+
+        // WHEN the system prompt is built
+        const result = buildSystemPrompt();
+
+        // THEN exactly one boundary appears, right after the custom section
+        const boundaryIdx = result.indexOf(SYSTEM_PROMPT_CACHE_BOUNDARY);
+        expect(boundaryIdx).toBeGreaterThan(-1);
+        expect(result.indexOf("Custom head section.")).toBeLessThan(
+          boundaryIdx,
+        );
+        expect(result.indexOf("## Communication")).toBeGreaterThan(boundaryIdx);
+
+        // AND the bundled default declaration on 11-channel-persona is
+        // ignored — no second marker
+        expect(
+          result.indexOf(SYSTEM_PROMPT_CACHE_BOUNDARY, boundaryIdx + 1),
+        ).toBe(-1);
+      });
+    });
+
     describe("containerized section (slot 02)", () => {
       const CONTAINERIZED_FILE = join(
         SYSTEM_PROMPTS_DIR,

package/src/__tests__/tool-approval-handler.test.ts

@@ -532,6 +532,91 @@ describe("ToolApprovalHandler / pre-exec gate grant check", () => {
   });
 });
 
+describe("ToolApprovalHandler / unparseable tool args gate", () => {
+  const handler = new ToolApprovalHandler();
+  const events: ToolLifecycleEvent[] = [];
+  const emitLifecycleEvent = (event: ToolLifecycleEvent) => {
+    events.push(event);
+  };
+
+  beforeEach(() => {
+    clearTables();
+    events.length = 0;
+  });
+
+  test("input wrapped as { _raw } is rejected without executing", async () => {
+    const result = await handler.checkPreExecutionGates(
+      "bash",
+      { _raw: '{"command": "ls -' },
+      makeContext({ trustClass: "guardian" }),
+      "sandbox",
+      "low",
+      Date.now(),
+      emitLifecycleEvent,
+    );
+
+    expect(result.allowed).toBe(false);
+    if (result.allowed) return;
+    expect(result.result.isError).toBe(true);
+    expect(result.result.content).toContain("were not valid JSON");
+    expect(result.result.content).toContain('{"command": "ls -');
+    expect(result.result.content).toContain("Retry");
+
+    const errorEvents = events.filter((e) => e.type === "error");
+    expect(errorEvents).toHaveLength(1);
+    if (errorEvents[0].type === "error") {
+      expect(errorEvents[0].isExpected).toBe(true);
+      expect(errorEvents[0].errorCategory).toBe("tool_failure");
+    }
+  });
+
+  test("long raw args are truncated in the error message", async () => {
+    const raw = `{"data": "${"x".repeat(500)}`;
+    const result = await handler.checkPreExecutionGates(
+      "bash",
+      { _raw: raw },
+      makeContext({ trustClass: "guardian" }),
+      "sandbox",
+      "low",
+      Date.now(),
+      emitLifecycleEvent,
+    );
+
+    expect(result.allowed).toBe(false);
+    if (result.allowed) return;
+    expect(result.result.content).not.toContain(raw);
+    expect(result.result.content).toContain("…");
+  });
+
+  test("legitimate input containing a _raw field among others is not rejected", async () => {
+    const result = await handler.checkPreExecutionGates(
+      "bash",
+      { _raw: "something", command: "ls" },
+      makeContext({ trustClass: "guardian" }),
+      "sandbox",
+      "low",
+      Date.now(),
+      emitLifecycleEvent,
+    );
+
+    expect(result.allowed).toBe(true);
+  });
+
+  test("non-string _raw value is not treated as the marker", async () => {
+    const result = await handler.checkPreExecutionGates(
+      "bash",
+      { _raw: 42 },
+      makeContext({ trustClass: "guardian" }),
+      "sandbox",
+      "low",
+      Date.now(),
+      emitLifecycleEvent,
+    );
+
+    expect(result.allowed).toBe(true);
+  });
+});
+
 afterAll(() => {
   mock.restore();
 });

package/src/__tests__/tool-audit-listener.test.ts

@@ -10,6 +10,10 @@ mock.module("../config/loader.js", () => ({
 
 import { createToolAuditListener } from "../events/tool-audit-listener.js";
 import type { ToolInvocationRecord } from "../memory/tool-usage-store.js";
+import {
+  OPENAI_PROJECT_KEY_REDACTION_MARKER,
+  SYNTHETIC_OPENAI_PROJECT_KEY,
+} from "./secret-fixtures.js";
 
 describe("tool audit listener", () => {
   beforeEach(() => {
@@ -101,6 +105,88 @@ describe("tool audit listener", () => {
     expect(records[0].result).toContain("<redacted");
   });
 
+  test("redacts known-pattern secrets in tool inputs before recording", () => {
+    const records: ToolInvocationRecord[] = [];
+    const listener = createToolAuditListener((record) => records.push(record));
+
+    const input = {
+      command: `export OPENAI_API_KEY="${SYNTHETIC_OPENAI_PROJECT_KEY}"`,
+    };
+
+    listener({
+      type: "executed",
+      toolName: "bash",
+      input,
+      workingDir: "/tmp",
+      conversationId: "conv-input-redact",
+      riskLevel: "low",
+      decision: "allow",
+      durationMs: 5,
+      result: { content: "ok", isError: false },
+    });
+    listener({
+      type: "error",
+      toolName: "bash",
+      input,
+      workingDir: "/tmp",
+      conversationId: "conv-input-redact",
+      riskLevel: "low",
+      decision: "error",
+      durationMs: 5,
+      errorMessage: "boom",
+      isExpected: false,
+      errorCategory: "tool_failure",
+    });
+    listener({
+      type: "permission_denied",
+      toolName: "bash",
+      input,
+      workingDir: "/tmp",
+      conversationId: "conv-input-redact",
+      riskLevel: "high",
+      decision: "deny",
+      reason: "Permission denied by user",
+      durationMs: 5,
+    });
+
+    expect(records).toHaveLength(3);
+    for (const record of records) {
+      expect(record.input).not.toContain(SYNTHETIC_OPENAI_PROJECT_KEY);
+      // The stored input must remain parseable JSON: string leaves are
+      // redacted before stringification, so the marker lands inside a JSON
+      // string value (its quotes escaped) instead of corrupting the
+      // serialized form.
+      const parsed = JSON.parse(record.input) as { command: string };
+      expect(parsed.command).toContain(OPENAI_PROJECT_KEY_REDACTION_MARKER);
+    }
+  });
+
+  test("benign inputs round-trip byte-identical (no false-positive mangling)", () => {
+    const records: ToolInvocationRecord[] = [];
+    const listener = createToolAuditListener((record) => records.push(record));
+
+    const input = {
+      command: "git log --oneline -5 && echo done",
+      cwd: "/tmp/project",
+      env: { LANG: "en_US.UTF-8" },
+    };
+
+    listener({
+      type: "executed",
+      toolName: "bash",
+      input,
+      workingDir: "/tmp",
+      conversationId: "conv-benign-input",
+      riskLevel: "low",
+      decision: "allow",
+      durationMs: 2,
+      result: { content: "ok", isError: false },
+    });
+
+    expect(records).toHaveLength(1);
+    expect(records[0].input).toBe(JSON.stringify(input));
+  });
+
   test("does not redact non-secret content like UUIDs or hashes", () => {
     const records: ToolInvocationRecord[] = [];
     const listener = createToolAuditListener((record) => records.push(record));

package/src/__tests__/tool-error-hook.test.ts

@@ -79,6 +79,7 @@ function makeCtx(
     toolResponse,
     messages,
     additionalContext: null,
+    model: "claude-test-model",
     maxInputTokens: 10_000,
     logger: noopLogger,
   };