@vellumai/assistant 0.8.12 → 0.9.0-staging.2

package/src/__tests__/skill-execute-input.test.ts

@@ -0,0 +1,85 @@
+import { describe, expect, test } from "bun:test";
+
+import { resolveSkillExecuteInput } from "../tools/skills/execute.js";
+
+describe("resolveSkillExecuteInput", () => {
+  test("returns a correctly nested object unchanged", () => {
+    const input = { prompt: "a sunset", variants: 2 };
+    const result = resolveSkillExecuteInput({
+      tool: "media_generate_image",
+      input,
+      activity: "Generating image",
+    });
+    expect(result).toEqual(input);
+  });
+
+  test("rescues parameters spread as top-level siblings", () => {
+    // Weak model put `prompt` next to `tool`/`activity` instead of under `input`.
+    const result = resolveSkillExecuteInput({
+      tool: "media_generate_image",
+      activity: "Generating image",
+      prompt: "a sunset over the ocean",
+      variants: 2,
+    });
+    expect(result).toEqual({ prompt: "a sunset over the ocean", variants: 2 });
+  });
+
+  test("rescues siblings when input is an empty object", () => {
+    // The exact shape from the room-redesign failure: `input: {}` plus the
+    // real parameter placed at the top level.
+    const result = resolveSkillExecuteInput({
+      tool: "media_generate_image",
+      input: {},
+      activity: "Generating room concept image",
+      prompt: "a cozy living room",
+    });
+    expect(result).toEqual({ prompt: "a cozy living room" });
+  });
+
+  test("parses input passed as a JSON string", () => {
+    const result = resolveSkillExecuteInput({
+      tool: "media_generate_image",
+      input: '{"prompt":"a sunset","variants":3}',
+      activity: "Generating image",
+    });
+    expect(result).toEqual({ prompt: "a sunset", variants: 3 });
+  });
+
+  test("non-empty nested object wins over stray siblings", () => {
+    const result = resolveSkillExecuteInput({
+      tool: "media_generate_image",
+      input: { prompt: "the real prompt" },
+      activity: "Generating image",
+      prompt: "a stray sibling",
+    });
+    expect(result).toEqual({ prompt: "the real prompt" });
+  });
+
+  test("returns empty object when no parameters are present anywhere", () => {
+    const result = resolveSkillExecuteInput({
+      tool: "media_generate_image",
+      input: {},
+      activity: "Generating image",
+    });
+    expect(result).toEqual({});
+  });
+
+  test("does not treat a JSON array string as input", () => {
+    // An array isn't a valid parameter map; fall through to (absent) siblings.
+    const result = resolveSkillExecuteInput({
+      tool: "some_tool",
+      input: "[1,2,3]",
+      activity: "Doing work",
+    });
+    expect(result).toEqual({});
+  });
+
+  test("ignores envelope keys when rescuing siblings", () => {
+    const result = resolveSkillExecuteInput({
+      tool: "some_tool",
+      activity: "Doing work",
+      foo: "bar",
+    });
+    expect(result).toEqual({ foo: "bar" });
+  });
+});

package/src/__tests__/skill-secret-handling-guard.test.ts

@@ -5,7 +5,7 @@ import { describe, expect, test } from "bun:test";
  * Guard test: SKILL.md files must never instruct the assistant to accept
  * secrets (passwords, API keys, tokens, etc.) pasted directly in chat.
  *
- * Secrets must always be collected via `credential_store prompt`, which
+ * Secrets must always be collected via `assistant credentials prompt`, which
  * presents a secure native UI that keeps the value out of conversation
  * history and LLM context.
  *
@@ -28,7 +28,7 @@ const SECRET_WORDS =
 
 /**
  * Patterns that indicate the assistant is being told to accept a secret
- * value directly in chat, rather than via credential_store prompt.
+ * value directly in chat, rather than via `assistant credentials prompt`.
  */
 const VIOLATION_PATTERNS: RegExp[] = [
   // "accept <secret> in/via/from chat/plaintext/the conversation"
@@ -72,12 +72,13 @@ const NEGATION_PATTERNS =
   /\b(?:never|do\s+not|don['']t|must\s+not|should\s+not|shouldn['']t)\b|\bNOT\b/;
 
 /**
- * Lines that are YAML-style field values within a credential_store prompt
- * block (label, description, placeholder). These contain secret-related
- * words but are secure UI text, not chat instructions.
+ * Lines that carry the secure prompt's field text within an `assistant
+ * credentials prompt` block — either CLI flags (`--label`, `--description`,
+ * `--placeholder`, ...) or legacy YAML-style fields. These contain
+ * secret-related words but are secure UI text, not chat instructions.
  */
-const CREDENTIAL_STORE_UI_FIELD =
-  /^\s*(?:[-*]\s+)?(?:label|description|placeholder)\s*[:=]\s*/i;
+const CREDENTIAL_PROMPT_UI_FIELD =
+  /^\s*(?:[-*]\s+)?(?:label|description|placeholder)\s*[:=]\s*|^\s*--(?:service|field|label|description|placeholder|allowed-domains|allowed-tools|injection-templates|usage-description)\b/i;
 
 interface Violation {
   file: string;
@@ -127,31 +128,31 @@ function findViolations(): Violation[] {
 
     const lines = content.split("\n");
 
-    // Track whether we're inside a credential_store prompt block
-    // (indented YAML-like content after a credential_store mention)
-    let inCredentialStoreBlock = false;
+    // Track whether we're inside an `assistant credentials prompt` block
+    // (the command plus its indented flag continuation lines)
+    let inCredentialPromptBlock = false;
     let blockIndent = 0;
 
     for (let i = 0; i < lines.length; i++) {
       const line = lines[i];
       const lineNumber = i + 1;
 
-      // Track credential_store prompt blocks
-      if (/credential_store\s+prompt/i.test(line)) {
-        inCredentialStoreBlock = true;
+      // Track `assistant credentials prompt` blocks
+      if (/assistant\s+credentials\s+prompt/i.test(line)) {
+        inCredentialPromptBlock = true;
         blockIndent = line.search(/\S/);
         continue;
       }
 
-      // Exit credential_store block when indentation returns to same or lesser level
-      if (inCredentialStoreBlock) {
+      // Exit the prompt block when indentation returns to same or lesser level
+      if (inCredentialPromptBlock) {
         const currentIndent = line.search(/\S/);
         if (
           currentIndent !== -1 &&
           currentIndent <= blockIndent &&
           line.trim().length > 0
         ) {
-          inCredentialStoreBlock = false;
+          inCredentialPromptBlock = false;
         }
       }
 
@@ -161,8 +162,8 @@ function findViolations(): Violation[] {
       // Skip negation lines — these instruct NOT to do something
       if (NEGATION_PATTERNS.test(line)) continue;
 
-      // Skip credential_store UI field lines (label:, description:, placeholder:)
-      if (inCredentialStoreBlock && CREDENTIAL_STORE_UI_FIELD.test(line))
+      // Skip secure-prompt UI field lines (--label/--description/--placeholder, etc.)
+      if (inCredentialPromptBlock && CREDENTIAL_PROMPT_UI_FIELD.test(line))
         continue;
 
       // Strip markdown backticks before pattern matching so that
@@ -193,13 +194,13 @@ describe("SKILL.md secret handling guard", () => {
     if (violations.length > 0) {
       const message = [
         "Found SKILL.md files that instruct accepting secrets directly in chat.",
-        "Secrets must always be collected via `credential_store prompt`, which",
+        "Secrets must always be collected via `assistant credentials prompt`, which",
         "presents a secure native UI that keeps values out of conversation history.",
         "",
         "Violations:",
         ...violations.map((v) => `  - ${v.file}:${v.line}: ${v.text}`),
         "",
-        "To fix: replace chat-based secret collection with a `credential_store prompt` call.",
+        "To fix: replace chat-based secret collection with an `assistant credentials prompt` call.",
         "See any *-setup skill (e.g. skills/slack-app-setup/SKILL.md) for the correct pattern.",
         "",
         "If this is a genuine exception, add the file path to the ALLOWLIST in",

package/src/__tests__/skills.test.ts

@@ -103,7 +103,7 @@ describe("skills catalog loading", () => {
     expect(skill!.bundled).toBeUndefined();
   });
 
-  test("discovers symlinked skill directories that point inside ~/.vellum/workspace/skills", () => {
+  test("discovers symlinked skill directories that point inside $VELLUM_WORKSPACE_DIR/skills", () => {
     const internalSkillDir = join(
       TEST_DIR,
       "skills",
@@ -124,7 +124,7 @@ describe("skills catalog loading", () => {
     expect(catalog[0].name).toBe("Internal Linked Skill");
   });
 
-  test("does not discover symlinked skill directories that point outside ~/.vellum/workspace/skills", () => {
+  test("does not discover symlinked skill directories that point outside $VELLUM_WORKSPACE_DIR/skills", () => {
     const externalSkillDir = join(TEST_DIR, "outside", "external-skill");
     mkdirSync(externalSkillDir, { recursive: true });
     writeFileSync(
@@ -138,7 +138,7 @@ describe("skills catalog loading", () => {
     expect(catalog).toHaveLength(0);
   });
 
-  test("rejects symlinked SKILL.md files that point outside ~/.vellum/workspace/skills", () => {
+  test("rejects symlinked SKILL.md files that point outside $VELLUM_WORKSPACE_DIR/skills", () => {
     const linkedSkillDir = join(TEST_DIR, "skills", "linked-file-skill");
     mkdirSync(linkedSkillDir, { recursive: true });
 

package/src/__tests__/slack-app-setup-skill-regression.test.ts

@@ -10,7 +10,7 @@ const skillContent = readFileSync(SKILL_PATH, "utf-8");
 describe("slack-app-setup skill regression", () => {
   test("keeps Slack token collection on the secure credential prompt path", () => {
     expect(skillContent).toContain(
-      '`credential_store` with `action: "prompt"`',
+      "assistant credentials prompt --service slack_channel",
     );
     expect(skillContent).toContain(
       "same Slack settings handler used by Settings",

package/src/__tests__/subagent-tool-filtering.test.ts

@@ -87,6 +87,56 @@ describe("subagent-only tool filtering", () => {
     expect(isToolActiveForContext(TEST_TOOL_NAME, ctx)).toBe(false);
   });
 
+  test("execution gate mode keeps non-allowlisted tools visible (allowlist enforced at execution time)", () => {
+    // `subagentToolGateMode: "execution"` keeps the full tool surface on the
+    // wire for provider prompt-cache parity; the executor callback rejects
+    // non-allowlisted calls instead.
+    const ctx: SkillProjectionContext = {
+      skillProjectionState: new Map(),
+      skillProjectionCache: {},
+      coreToolNames: new Set(),
+      toolsDisabledDepth: 0,
+      hasNoClient: false,
+      subagentAllowedTools: new Set(["remember"]),
+      subagentToolGateMode: "execution",
+    };
+
+    expect(isToolActiveForContext("remember", ctx)).toBe(true);
+    expect(isToolActiveForContext("bash", ctx)).toBe(true);
+  });
+
+  test("explicit wire gate mode filters exactly like the absent default", () => {
+    const ctx: SkillProjectionContext = {
+      skillProjectionState: new Map(),
+      skillProjectionCache: {},
+      coreToolNames: new Set(),
+      toolsDisabledDepth: 0,
+      hasNoClient: false,
+      subagentAllowedTools: new Set(["remember"]),
+      subagentToolGateMode: "wire",
+    };
+
+    expect(isToolActiveForContext("remember", ctx)).toBe(true);
+    expect(isToolActiveForContext("bash", ctx)).toBe(false);
+  });
+
+  test("execution gate mode still applies non-allowlist filters (toolsDisabledDepth)", () => {
+    // The execution gate only bypasses the subagent allowlist's wire filter;
+    // every other visibility rule still applies.
+    const ctx: SkillProjectionContext = {
+      skillProjectionState: new Map(),
+      skillProjectionCache: {},
+      coreToolNames: new Set(),
+      toolsDisabledDepth: 1,
+      hasNoClient: false,
+      subagentAllowedTools: new Set(["remember"]),
+      subagentToolGateMode: "execution",
+    };
+
+    expect(isToolActiveForContext("remember", ctx)).toBe(false);
+    expect(isToolActiveForContext("bash", ctx)).toBe(false);
+  });
+
   test("returns false for every tool when toolsDisabledDepth > 0", () => {
     // `createResolveToolsCallback` returns an empty tool list when tools are
     // disabled; mirror it here so this helper reports the same final tool set.