@vellumai/assistant 0.8.12 → 0.9.0-staging.2

package/src/__tests__/require-fresh-approval.test.ts

@@ -68,6 +68,13 @@ let riskOverride: string = "high";
 /** Scope options override — controls whether persistent decisions are offered. */
 let scopeOptionsOverride: ScopeOption[] | undefined;
 
+/**
+ * Auto-approve threshold returned to the permission checker. "high" is the
+ * full-access posture under which the requireFreshApproval promotion is
+ * skipped; every lower value still promotes allow → prompt.
+ */
+let thresholdOverride: "none" | "low" | "medium" | "high" = "medium";
+
 mock.module("../config/loader.js", () => ({
   getConfig: () => mockConfig,
   loadConfig: () => mockConfig,
@@ -124,13 +131,26 @@ mock.module("../tools/registry.js", () => ({
 }));
 
 mock.module("../permissions/gateway-threshold-reader.js", () => ({
-  getAutoApproveThreshold: async () => "medium",
+  getAutoApproveThreshold: async () => thresholdOverride,
   // Refresh failure ("null") keeps the original decision — these tests
   // exercise the cached-threshold paths only.
   refreshAutoApproveThreshold: async () => null,
   _clearGlobalCacheForTesting: () => {},
 }));
 
+// Stub the workflow run manager so the `manage_workflows` resume gate can read a
+// target run's STORED capabilities without a real journal/DB. Tests set
+// `fakeWorkflowRun` to control the stored manifest (or null for "not found").
+let fakeWorkflowRun: {
+  capabilities: unknown;
+  conversationId: string | null;
+} | null = null;
+mock.module("../workflows/run-manager.js", () => ({
+  getWorkflowRunManager: () => ({
+    status: (_runId: string) => fakeWorkflowRun,
+  }),
+}));
+
 mock.module("../tools/shared/filesystem/path-policy.js", () => ({
   sandboxPolicy: () => ({ ok: false }),
   hostPolicy: () => ({ ok: false }),
@@ -173,6 +193,7 @@ describe("requireFreshApproval: non-interactive guardian denial", () => {
     checkResultOverride = undefined;
     scopeOptionsOverride = undefined;
     riskOverride = "high";
+    thresholdOverride = "medium";
   });
 
   afterEach(() => {});
@@ -322,6 +343,7 @@ describe("requireFreshApproval: persistent decisions disabled", () => {
     checkResultOverride = undefined;
     scopeOptionsOverride = undefined;
     riskOverride = "high";
+    thresholdOverride = "medium";
   });
 
   afterEach(() => {});
@@ -385,6 +407,7 @@ describe("requireFreshApproval: grant-consumed does not skip permission check",
     checkResultOverride = undefined;
     scopeOptionsOverride = undefined;
     riskOverride = "high";
+    thresholdOverride = "medium";
   });
 
   afterEach(() => {});
@@ -437,6 +460,7 @@ describe("requireFreshApproval: context flag propagation", () => {
     checkResultOverride = undefined;
     scopeOptionsOverride = undefined;
     riskOverride = "high";
+    thresholdOverride = "medium";
   });
 
   afterEach(() => {});
@@ -476,3 +500,403 @@ describe("requireFreshApproval: context flag propagation", () => {
     expect(ctx.requireFreshApproval).toBeUndefined();
   });
 });
+
+// ---------------------------------------------------------------------------
+// Workflow launch consent: a run_workflow whose capability manifest grants
+// side-effecting tools/host functions must prompt at LAUNCH (the manifest is
+// model-declared and leaves execute granted tools directly, with no per-call
+// check). A read-only run launches silently.
+// ---------------------------------------------------------------------------
+
+describe("requireFreshApproval: workflow capability grants", () => {
+  beforeEach(() => {
+    fakeToolResult = { content: "ok", isError: false };
+    checkResultOverride = undefined;
+    scopeOptionsOverride = undefined;
+    riskOverride = "low";
+    thresholdOverride = "medium";
+    fakeWorkflowRun = null;
+  });
+
+  afterEach(() => {});
+
+  function trackingPrompter(state: { prompted: boolean }): PermissionPrompter {
+    return {
+      prompt: async () => {
+        state.prompted = true;
+        return { decision: "allow" as const };
+      },
+      resolveConfirmation: () => {},
+      updateSender: () => {},
+      dispose: () => {},
+    } as unknown as PermissionPrompter;
+  }
+
+  test("run_workflow granting side-effecting tools prompts at launch", async () => {
+    // A grant of `bash` would normally auto-allow (mocked check() returns
+    // allow); requireFreshApproval promotes it to an interactive prompt.
+    checkResultOverride = { decision: "allow", reason: "allowed" };
+    const state = { prompted: false };
+    const executor = new ToolExecutor(trackingPrompter(state));
+    const ctx = makeContext();
+
+    const result = await executor.execute(
+      "run_workflow",
+      { script: "export const meta={};", capabilities: { tools: ["bash"] } },
+      ctx,
+    );
+
+    expect(ctx.requireFreshApproval).toBe(true);
+    expect(state.prompted).toBe(true);
+    expect(result.isError).toBe(false);
+  });
+
+  test.each(["none", "low", "medium"] as const)(
+    "run_workflow side-effecting launch prompts at the %s threshold (non-full-access posture)",
+    async (threshold) => {
+      checkResultOverride = { decision: "allow", reason: "allowed" };
+      thresholdOverride = threshold;
+      const state = { prompted: false };
+      const executor = new ToolExecutor(trackingPrompter(state));
+      const ctx = makeContext();
+
+      const result = await executor.execute(
+        "run_workflow",
+        { script: "export const meta={};", capabilities: { tools: ["bash"] } },
+        ctx,
+      );
+
+      expect(ctx.requireFreshApproval).toBe(true);
+      expect(state.prompted).toBe(true);
+      expect(result.isError).toBe(false);
+    },
+  );
+
+  test("run_workflow side-effecting launch does NOT prompt at full access (high)", async () => {
+    // Full-access posture auto-approves even high-risk tools, so the
+    // requireFreshApproval promotion is skipped — the grant auto-allows.
+    checkResultOverride = { decision: "allow", reason: "allowed" };
+    thresholdOverride = "high";
+    const state = { prompted: false };
+    const executor = new ToolExecutor(trackingPrompter(state));
+    const ctx = makeContext();
+
+    const result = await executor.execute(
+      "run_workflow",
+      { script: "export const meta={};", capabilities: { tools: ["bash"] } },
+      ctx,
+    );
+
+    // requireFreshApproval is still SET on the context (launch is
+    // side-effecting); only the allow → prompt promotion is suppressed.
+    expect(ctx.requireFreshApproval).toBe(true);
+    expect(state.prompted).toBe(false);
+    expect(result.isError).toBe(false);
+  });
+
+  test("a deny rule still blocks a side-effecting launch at full access (high)", async () => {
+    // Full access skips the fresh-approval promotion but never overrides an
+    // explicit deny — deny rules win regardless of posture.
+    checkResultOverride = { decision: "deny", reason: "blocked by rule" };
+    thresholdOverride = "high";
+    const state = { prompted: false };
+    const executor = new ToolExecutor(trackingPrompter(state));
+    const ctx = makeContext();
+
+    const result = await executor.execute(
+      "run_workflow",
+      { script: "export const meta={};", capabilities: { tools: ["bash"] } },
+      ctx,
+    );
+
+    expect(state.prompted).toBe(false);
+    expect(result.isError).toBe(true);
+  });
+
+  test("a deny rule still blocks a side-effecting launch at a normal threshold", async () => {
+    checkResultOverride = { decision: "deny", reason: "blocked by rule" };
+    thresholdOverride = "medium";
+    const state = { prompted: false };
+    const executor = new ToolExecutor(trackingPrompter(state));
+    const ctx = makeContext();
+
+    const result = await executor.execute(
+      "run_workflow",
+      { script: "export const meta={};", capabilities: { tools: ["bash"] } },
+      ctx,
+    );
+
+    expect(state.prompted).toBe(false);
+    expect(result.isError).toBe(true);
+  });
+
+  test("a read-only launch (no requireFreshApproval) is unaffected by a normal threshold", async () => {
+    // No requireFreshApproval means the allow stands untouched at any posture.
+    checkResultOverride = { decision: "allow", reason: "allowed" };
+    thresholdOverride = "medium";
+    const state = { prompted: false };
+    const executor = new ToolExecutor(trackingPrompter(state));
+    const ctx = makeContext();
+
+    const result = await executor.execute(
+      "run_workflow",
+      { script: "export const meta={};", capabilities: {} },
+      ctx,
+    );
+
+    expect(ctx.requireFreshApproval).toBeUndefined();
+    expect(state.prompted).toBe(false);
+    expect(result.isError).toBe(false);
+  });
+
+  test("run_workflow granting host functions prompts at launch", async () => {
+    checkResultOverride = { decision: "allow", reason: "allowed" };
+    const state = { prompted: false };
+    const executor = new ToolExecutor(trackingPrompter(state));
+    const ctx = makeContext();
+
+    await executor.execute(
+      "run_workflow",
+      {
+        script: "export const meta={};",
+        capabilities: { hostFunctions: ["notify"] },
+      },
+      ctx,
+    );
+
+    expect(ctx.requireFreshApproval).toBe(true);
+    expect(state.prompted).toBe(true);
+  });
+
+  test("read-only run_workflow launches silently (no fresh approval, no prompt)", async () => {
+    checkResultOverride = { decision: "allow", reason: "allowed" };
+    const state = { prompted: false };
+    const executor = new ToolExecutor(trackingPrompter(state));
+    const ctx = makeContext();
+
+    const result = await executor.execute(
+      "run_workflow",
+      { script: "export const meta={};", capabilities: {} },
+      ctx,
+    );
+
+    expect(ctx.requireFreshApproval).toBeUndefined();
+    expect(state.prompted).toBe(false);
+    expect(result.isError).toBe(false);
+  });
+
+  test("workflow-mode schedule_create granting side-effecting tools prompts at creation", async () => {
+    checkResultOverride = { decision: "allow", reason: "allowed" };
+    const state = { prompted: false };
+    const executor = new ToolExecutor(trackingPrompter(state));
+    const ctx = makeContext();
+
+    const result = await executor.execute(
+      "schedule_create",
+      {
+        name: "Nightly writeback",
+        mode: "workflow",
+        workflow_name: "nightly-report",
+        capabilities: { tools: ["bash"] },
+      },
+      ctx,
+    );
+
+    expect(ctx.requireFreshApproval).toBe(true);
+    expect(state.prompted).toBe(true);
+    expect(result.isError).toBe(false);
+  });
+
+  test("workflow-mode schedule_create granting host functions prompts at creation", async () => {
+    checkResultOverride = { decision: "allow", reason: "allowed" };
+    const state = { prompted: false };
+    const executor = new ToolExecutor(trackingPrompter(state));
+    const ctx = makeContext();
+
+    await executor.execute(
+      "schedule_create",
+      {
+        name: "Nightly notify",
+        mode: "workflow",
+        workflow_name: "nightly-report",
+        capabilities: { hostFunctions: ["notify"] },
+      },
+      ctx,
+    );
+
+    expect(ctx.requireFreshApproval).toBe(true);
+    expect(state.prompted).toBe(true);
+  });
+
+  test("workflow-mode schedule_create with a read-only manifest stays silent", async () => {
+    checkResultOverride = { decision: "allow", reason: "allowed" };
+    const state = { prompted: false };
+    const executor = new ToolExecutor(trackingPrompter(state));
+    const ctx = makeContext();
+
+    const result = await executor.execute(
+      "schedule_create",
+      {
+        name: "Read-only schedule",
+        mode: "workflow",
+        workflow_name: "nightly-report",
+        capabilities: {},
+      },
+      ctx,
+    );
+
+    expect(ctx.requireFreshApproval).toBeUndefined();
+    expect(state.prompted).toBe(false);
+    expect(result.isError).toBe(false);
+  });
+
+  test("non-workflow schedule_create never gates even with a side-effecting capabilities blob", async () => {
+    // The capabilities field is workflow-mode only; an execute-mode schedule
+    // must not be promoted to a fresh approval by a stray capabilities object.
+    checkResultOverride = { decision: "allow", reason: "allowed" };
+    const state = { prompted: false };
+    const executor = new ToolExecutor(trackingPrompter(state));
+    const ctx = makeContext();
+
+    await executor.execute(
+      "schedule_create",
+      {
+        name: "Execute schedule",
+        mode: "execute",
+        message: "do the thing",
+        capabilities: { tools: ["bash"] },
+      },
+      ctx,
+    );
+
+    expect(ctx.requireFreshApproval).toBeUndefined();
+    expect(state.prompted).toBe(false);
+  });
+
+  test("manage_workflows resume of a side-effecting run requires fresh approval", async () => {
+    // The target run's STORED manifest granted tools, so resuming it (which
+    // restarts unfinished side-effecting leaves) must re-prompt.
+    fakeWorkflowRun = {
+      capabilities: { tools: ["bash"] },
+      conversationId: "conversation-1",
+    };
+    checkResultOverride = { decision: "allow", reason: "allowed" };
+    const state = { prompted: false };
+    const executor = new ToolExecutor(trackingPrompter(state));
+    const ctx = makeContext();
+
+    await executor.execute(
+      "manage_workflows",
+      { action: "resume", run_id: "wf-run-1" },
+      ctx,
+    );
+
+    expect(ctx.requireFreshApproval).toBe(true);
+    expect(state.prompted).toBe(true);
+  });
+
+  test("manage_workflows resume of a read-only run stays silent", async () => {
+    fakeWorkflowRun = { capabilities: {}, conversationId: "conversation-1" };
+    checkResultOverride = { decision: "allow", reason: "allowed" };
+    const state = { prompted: false };
+    const executor = new ToolExecutor(trackingPrompter(state));
+    const ctx = makeContext();
+
+    await executor.execute(
+      "manage_workflows",
+      { action: "resume", run_id: "wf-run-1" },
+      ctx,
+    );
+
+    expect(ctx.requireFreshApproval).toBeUndefined();
+    expect(state.prompted).toBe(false);
+  });
+
+  test("manage_workflows non-resume actions never gate (status of a side-effecting run)", async () => {
+    // Even though the run granted tools, status/abort/list_runs are pure
+    // control/reads and must stay low-risk and silent.
+    fakeWorkflowRun = {
+      capabilities: { tools: ["bash"] },
+      conversationId: "conversation-1",
+    };
+    checkResultOverride = { decision: "allow", reason: "allowed" };
+    const state = { prompted: false };
+    const executor = new ToolExecutor(trackingPrompter(state));
+    const ctx = makeContext();
+
+    await executor.execute(
+      "manage_workflows",
+      { action: "status", run_id: "wf-run-1" },
+      ctx,
+    );
+
+    expect(ctx.requireFreshApproval).toBeUndefined();
+    expect(state.prompted).toBe(false);
+  });
+
+  test("manage_workflows resume of an unknown run does not gate (run not found)", async () => {
+    fakeWorkflowRun = null;
+    checkResultOverride = { decision: "allow", reason: "allowed" };
+    const state = { prompted: false };
+    const executor = new ToolExecutor(trackingPrompter(state));
+    const ctx = makeContext();
+
+    await executor.execute(
+      "manage_workflows",
+      { action: "resume", run_id: "missing" },
+      ctx,
+    );
+
+    expect(ctx.requireFreshApproval).toBeUndefined();
+    expect(state.prompted).toBe(false);
+  });
+
+  test("a non-owner resuming another conversation's side-effecting run does NOT gate (no prompt, no existence leak)", async () => {
+    // The run is side-effecting but belongs to a different conversation. The
+    // tool will hide it as not-found, so the gate must not prompt — otherwise it
+    // leaks that the run exists and nags the guardian for a no-op resume.
+    fakeWorkflowRun = {
+      capabilities: { tools: ["bash"] },
+      conversationId: "other-conversation",
+    };
+    checkResultOverride = { decision: "allow", reason: "allowed" };
+    const state = { prompted: false };
+    const executor = new ToolExecutor(trackingPrompter(state));
+    const ctx = makeContext({
+      trustClass: "trusted_contact",
+      conversationId: "conversation-1",
+    });
+
+    await executor.execute(
+      "manage_workflows",
+      { action: "resume", run_id: "wf-run-1" },
+      ctx,
+    );
+
+    expect(ctx.requireFreshApproval).toBeUndefined();
+    expect(state.prompted).toBe(false);
+  });
+
+  test("a non-owner resuming its OWN side-effecting run still gates", async () => {
+    fakeWorkflowRun = {
+      capabilities: { tools: ["bash"] },
+      conversationId: "conversation-1",
+    };
+    checkResultOverride = { decision: "allow", reason: "allowed" };
+    const state = { prompted: false };
+    const executor = new ToolExecutor(trackingPrompter(state));
+    const ctx = makeContext({
+      trustClass: "trusted_contact",
+      conversationId: "conversation-1",
+    });
+
+    await executor.execute(
+      "manage_workflows",
+      { action: "resume", run_id: "wf-run-1" },
+      ctx,
+    );
+
+    expect(ctx.requireFreshApproval).toBe(true);
+    expect(state.prompted).toBe(true);
+  });
+});

package/src/__tests__/resolve-app-id.test.ts

@@ -0,0 +1,56 @@
+import { describe, expect, mock, test } from "bun:test";
+
+import type { AppDefinition } from "../memory/app-store.js";
+
+let appsByConversation: AppDefinition[] = [];
+
+const realStore = await import("../memory/app-store.js");
+mock.module("../memory/app-store.js", () => ({
+  ...realStore,
+  listAppsByConversation: (_conversationId: string) => appsByConversation,
+}));
+
+const { resolveAppId, missingAppIdError } =
+  await import("../tools/apps/resolve-app-id.js");
+
+function makeApp(id: string, updatedAt: number): AppDefinition {
+  return {
+    id,
+    name: id,
+    schemaJson: "{}",
+    htmlDefinition: "",
+    createdAt: updatedAt,
+    updatedAt,
+  };
+}
+
+describe("resolveAppId", () => {
+  test("returns an explicit non-empty app_id unchanged", () => {
+    appsByConversation = [makeApp("other", 1)];
+    expect(resolveAppId({ app_id: "explicit" }, "conv-1")).toBe("explicit");
+  });
+
+  test("falls back to the most-recently-updated conversation app when missing", () => {
+    // listAppsByConversation inherits listApps' updatedAt-descending order.
+    appsByConversation = [makeApp("newest", 30), makeApp("older", 10)];
+    expect(resolveAppId({}, "conv-1")).toBe("newest");
+  });
+
+  test("treats a blank app_id as missing", () => {
+    appsByConversation = [makeApp("active", 5)];
+    expect(resolveAppId({ app_id: "   " }, "conv-1")).toBe("active");
+  });
+
+  test("returns null when no app_id is given and the conversation has no app", () => {
+    appsByConversation = [];
+    expect(resolveAppId({}, "conv-1")).toBeNull();
+  });
+});
+
+describe("missingAppIdError", () => {
+  test("is an actionable error result", () => {
+    const result = missingAppIdError();
+    expect(result.isError).toBe(true);
+    expect(JSON.parse(result.content).error).toContain("app_create");
+  });
+});

package/src/__tests__/runtime-events-sse-parity.test.ts

@@ -138,6 +138,7 @@ describe("SSE HTTP parity — streaming/delta message types", () => {
       type: "assistant_thinking_delta" as const,
       thinking: "Let me reason through this...",
       conversationId: "conv-thinking-test",
+      timestampMs: 1_700_000_000_000,
     };
     const event = await publishAndReadFrame("parity-thinking-delta", msg);
 
@@ -145,6 +146,7 @@ describe("SSE HTTP parity — streaming/delta message types", () => {
     const m = event.message as typeof msg;
     expect(m.thinking).toBe("Let me reason through this...");
     expect(m.conversationId).toBe("conv-thinking-test");
+    expect(m.timestampMs).toBe(1_700_000_000_000);
   });
 
   // ── tool_input_delta ─────────────────────────────────────────────────────