@vellumai/assistant 0.8.12 → 0.9.0-staging.2

package/src/__tests__/agent-wake-disk-pressure-callsite.test.ts

@@ -89,6 +89,8 @@ function makeTarget(): Conversation {
     getTurnChannelContext: () => null,
     getTurnInterfaceContext: () => null,
     drainQueue: async () => {},
+    // Pre-run auto-compaction gate — no-op for these tests.
+    maybeCompact: async () => null,
   };
   return target as unknown as Conversation;
 }

package/src/__tests__/agent-wake-override-profile.test.ts

@@ -101,6 +101,8 @@ function makeTarget(): {
     getTurnChannelContext: () => null,
     getTurnInterfaceContext: () => null,
     drainQueue: async () => {},
+    // Pre-run auto-compaction gate — no-op for these tests.
+    maybeCompact: async () => null,
   };
   return { target: target as unknown as Conversation, runArgs };
 }
@@ -159,6 +161,81 @@ describe("wakeAgentForOpportunity — overrideProfile forwarding", () => {
     expect(runArgs[0]!.options?.requestId).toBe("wake:scheduler");
   });
 
+  test("forceOverrideProfile replaces the pinned-profile lookup and forwards the force flag to agentLoop.run", async () => {
+    // The conversation's own pinned profile must be ignored — the caller's
+    // forced profile (e.g. a fork-based retrospective matching the source
+    // conversation) takes its place AND floats above the call-site layers
+    // via the resolver's `forceOverrideProfile` escape hatch.
+    mockOverrideProfile = "pinned-ignored";
+    mockLlmConfig = LLMSchema.parse({
+      default: {
+        provider: "anthropic",
+        model: "claude-sonnet-4-6",
+        maxTokens: 64000,
+        contextWindow: { maxInputTokens: 200000 },
+      },
+      profiles: {
+        forced: {
+          contextWindow: { maxInputTokens: 120000 },
+        },
+      },
+      callSites: {
+        memoryRetrospective: { contextWindow: { maxInputTokens: 180000 } },
+      },
+    }) as Record<string, unknown>;
+    const { target, runArgs } = makeTarget();
+
+    const result = await wakeAgentForOpportunity(
+      {
+        conversationId: target.conversationId,
+        hint: "test hint",
+        source: "memory-retrospective",
+        callSite: "memoryRetrospective",
+        forceOverrideProfile: "forced",
+      },
+      { resolveTarget: async () => target },
+    );
+
+    expect(result.invoked).toBe(true);
+    expect(runArgs).toHaveLength(1);
+    expect(runArgs[0]!.options?.overrideProfile).toBe("forced");
+    expect(runArgs[0]!.options?.forceOverrideProfile).toBe(true);
+    expect(runArgs[0]!.options?.callSite).toBe("memoryRetrospective");
+    // The effective context window resolves under the FORCED profile, above
+    // the explicit call-site override (120k beats the call site's 180k).
+    expect(runArgs[0]!.options?.resolveContextWindow?.().maxInputTokens).toBe(
+      120000,
+    );
+  });
+
+  test("without forceOverrideProfile the wake never sets the force flag", async () => {
+    mockOverrideProfile = "frontier";
+    mockLlmConfig = LLMSchema.parse({
+      default: {
+        provider: "anthropic",
+        model: "claude-sonnet-4-6",
+        maxTokens: 64000,
+        contextWindow: { maxInputTokens: 200000 },
+      },
+      profiles: { frontier: {} },
+      callSites: { mainAgent: {} },
+    }) as Record<string, unknown>;
+    const { target, runArgs } = makeTarget();
+
+    await wakeAgentForOpportunity(
+      {
+        conversationId: target.conversationId,
+        hint: "test hint",
+        source: "scheduler",
+      },
+      { resolveTarget: async () => target },
+    );
+
+    expect(runArgs).toHaveLength(1);
+    expect(runArgs[0]!.options?.overrideProfile).toBe("frontier");
+    expect(runArgs[0]!.options?.forceOverrideProfile).toBe(false);
+  });
+
   test("passes undefined overrideProfile when the conversation has no pinned profile, but still forwards mainAgent callSite", async () => {
     mockOverrideProfile = undefined;
     const { target, runArgs } = makeTarget();

package/src/__tests__/app-compiler.test.ts

@@ -450,6 +450,12 @@ describe("package-resolver", () => {
     expect(ALLOWED_PACKAGES).toContain("lodash-es");
     expect(ALLOWED_PACKAGES).toContain("zod");
     expect(ALLOWED_PACKAGES).toContain("clsx");
-    expect(ALLOWED_PACKAGES).toContain("lucide");
+  });
+
+  // `lucide` (the vanilla package) unpacks to ~29 MB, far above the resolver's
+  // size cap, so it is installed then deleted and never resolves. It also
+  // exports icon data arrays, not Preact components. Apps use inline SVG.
+  test("ALLOWED_PACKAGES excludes lucide", () => {
+    expect(ALLOWED_PACKAGES).not.toContain("lucide");
   });
 });

package/src/__tests__/app-dir-path-guard.test.ts

@@ -20,6 +20,7 @@ const ALLOWLIST = new Set([
   "assistant/src/memory/app-git-service.ts", // uses getAppsDir for git repo root, not per-app paths
   "assistant/src/daemon/app-source-watcher.ts", // uses getAppsDir for recursive fs.watch root, not per-app paths
   "assistant/src/tools/filesystem/write.ts", // uses getAppsDir as an exemption root for the artifact-HTML guard, not per-app paths
+  "assistant/src/memory/preloaded-apps.ts", // seeds fixed-slug apps (id === dirName by construction) and writes the definition JSON, which app-store has no fixed-id helper for
 ]);
 
 function isTestFile(filePath: string): boolean {
@@ -37,12 +38,15 @@ function isMigrationFile(filePath: string): boolean {
 
 describe("app directory path construction guard", () => {
   test("no non-allowlisted production files import getAppsDir", () => {
-    // Search for files that import getAppsDir (not just mention it in comments)
+    // Match files that import getAppsDir or call it, but not files that only
+    // mention it in a comment (a doc comment referencing the helper by name is
+    // not a usage). `-n` yields `file:line:content` so comment-only lines can
+    // be filtered out before collapsing to the set of matching files.
     const pattern = "import.*getAppsDir.*from|getAppsDir\\(\\)";
 
     let grepOutput = "";
     try {
-      grepOutput = execSync(`git grep -lE '${pattern}' -- '*.ts'`, {
+      grepOutput = execSync(`git grep -nE '${pattern}' -- '*.ts'`, {
         encoding: "utf-8",
         cwd: process.cwd() + "/..",
       }).trim();
@@ -54,7 +58,27 @@ describe("app directory path construction guard", () => {
       throw err;
     }
 
-    const files = grepOutput.split("\n").filter((f) => f.length > 0);
+    const isCommentLine = (line: string): boolean => {
+      const trimmed = line.trim();
+      return (
+        trimmed.startsWith("//") ||
+        trimmed.startsWith("*") ||
+        trimmed.startsWith("/*")
+      );
+    };
+    const files = Array.from(
+      new Set(
+        grepOutput
+          .split("\n")
+          .filter((line) => line.length > 0)
+          .map((line) => {
+            const [file, , ...rest] = line.split(":");
+            return { file, content: rest.join(":") };
+          })
+          .filter(({ content }) => !isCommentLine(content))
+          .map(({ file }) => file),
+      ),
+    );
     const violations = files.filter((f) => {
       if (isTestFile(f)) return false;
       if (isMigrationFile(f)) return false;

package/src/__tests__/app-executors.test.ts

@@ -168,6 +168,49 @@ describe("executeAppCreate", () => {
     expect(parsed.next_steps).toContain("app_refresh");
   });
 
+  test("associates the new app with its conversation when a conversationId is given", async () => {
+    const app = makeMultifileApp({ id: "app-xyz", name: "Assoc App" });
+    const associated: Array<{ appId: string; conversationId: string }> = [];
+    const store: AppStore = {
+      ...mockStore(app, {}),
+      addAppConversationId: (appId, conversationId) => {
+        associated.push({ appId, conversationId });
+        return true;
+      },
+    };
+
+    const result = await executeAppCreate(
+      { name: "Assoc App" },
+      store,
+      undefined,
+      "conv-assoc-1",
+    );
+
+    expect(result.isError).toBe(false);
+    expect(associated).toEqual([
+      { appId: "app-xyz", conversationId: "conv-assoc-1" },
+    ]);
+  });
+
+  test("a failed conversation association does not fail the create", async () => {
+    const app = makeMultifileApp({ id: "app-throw", name: "Throw App" });
+    const store: AppStore = {
+      ...mockStore(app, {}),
+      addAppConversationId: () => {
+        throw new Error("disk gone");
+      },
+    };
+
+    const result = await executeAppCreate(
+      { name: "Throw App" },
+      store,
+      undefined,
+      "conv-assoc-2",
+    );
+
+    expect(result.isError).toBe(false);
+  });
+
   test("skips auto_open on scaffold even when proxy resolver is available", async () => {
     const files: Record<string, string> = {};
     const app = makeMultifileApp({ name: "New App" });

package/src/__tests__/approval-cascade.test.ts

@@ -40,11 +40,6 @@ mock.module("../util/logger.js", () => ({
   getLogger: () => makeLoggerStub(),
 }));
 
-mock.module("../memory/guardian-action-store.js", () => ({
-  getGuardianActionRequest: () => null,
-  resolveGuardianActionRequest: () => {},
-}));
-
 mock.module("../providers/registry.js", () => ({
   getProvider: () => ({ name: "mock-provider" }),
   initializeProviders: async () => {},

package/src/__tests__/approval-routes-http.test.ts

@@ -8,6 +8,7 @@ import { beforeEach, describe, expect, mock, test } from "bun:test";
 
 import type { Conversation } from "../daemon/conversation.js";
 import type { ServerMessage } from "../daemon/message-protocol.js";
+import type { SecretPromptResult } from "../permissions/secret-prompter.js";
 
 mock.module("../util/logger.js", () => ({
   getLogger: () =>
@@ -196,6 +197,7 @@ function makeIdleSession(opts?: {
       pendingInteractions.resolve(requestId);
       opts?.onConfirmation?.(requestId, decision);
     },
+    hasPendingSecret: () => true,
     handleSecretResponse: (
       requestId: string,
       value?: string,
@@ -593,6 +595,54 @@ describe("standalone approval endpoints — HTTP layer", () => {
       await stopServer();
     });
 
+    test("resolves a conversation-less secret request via its resolver", async () => {
+      /**
+       * The CLI `credentials prompt` command registers a conversation-less
+       * secret interaction whose resolver lives in pendingInteractions. POST
+       * /v1/secret must drive that resolver directly — with no owning
+       * conversation — so the standalone prompt completes instead of only
+       * timing out.
+       */
+      // GIVEN a running server
+      await startServer(() => makeIdleSession());
+
+      // AND a conversation-less secret interaction whose resolver is captured
+      let resolved: SecretPromptResult | undefined;
+      pendingInteractions.register("standalone-secret-1", {
+        kind: "secret",
+        rpcResolve: (value: unknown) => {
+          resolved = value as SecretPromptResult;
+        },
+      });
+
+      // WHEN the secret is submitted for that requestId
+      const res = await fetch(url("secret"), {
+        method: "POST",
+        headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
+        body: JSON.stringify({
+          requestId: "standalone-secret-1",
+          value: "cli-secret-value",
+          delivery: "store",
+        }),
+      });
+      const body = (await res.json()) as { accepted: boolean };
+
+      // THEN the request is accepted
+      expect(res.status).toBe(200);
+      expect(body.accepted).toBe(true);
+
+      // AND the standalone resolver receives the value and delivery
+      expect(resolved).toEqual({
+        value: "cli-secret-value",
+        delivery: "store",
+      });
+
+      // AND the interaction is removed after resolution
+      expect(pendingInteractions.get("standalone-secret-1")).toBeUndefined();
+
+      await stopServer();
+    });
+
     test("returns 404 for unknown requestId", async () => {
       await startServer(() => makeIdleSession());
 
@@ -638,6 +688,47 @@ describe("standalone approval endpoints — HTTP layer", () => {
 
       await stopServer();
     });
+
+    test("rejects a non-secret requestId without consuming it", async () => {
+      /**
+       * /v1/secret only settles secret prompts. A confirmation (or any other
+       * interaction kind) posted here from stale client state must be rejected
+       * so its real approval endpoint still finds an intact pending interaction
+       * rather than one consumed and resolved with a SecretPromptResult.
+       */
+      // GIVEN a running server
+      await startServer(() => makeIdleSession());
+
+      // AND a pending confirmation interaction whose resolver would be corrupted
+      let resolverCalled = false;
+      pendingInteractions.register("confirm-not-secret", {
+        conversationId: "conv-1",
+        kind: "confirmation",
+        rpcResolve: () => {
+          resolverCalled = true;
+        },
+      });
+
+      // WHEN that confirmation's requestId is posted to /v1/secret
+      const res = await fetch(url("secret"), {
+        method: "POST",
+        headers: { "Content-Type": "application/json", ...AUTH_HEADERS },
+        body: JSON.stringify({
+          requestId: "confirm-not-secret",
+          value: "leaked",
+          delivery: "store",
+        }),
+      });
+
+      // THEN the request is rejected
+      expect(res.status).toBe(404);
+
+      // AND the confirmation interaction is left intact and unresolved
+      expect(pendingInteractions.get("confirm-not-secret")).toBeDefined();
+      expect(resolverCalled).toBe(false);
+
+      await stopServer();
+    });
   });
 
   // ── POST /v1/trust-rules ─────────────────────────────────────────────

package/src/__tests__/assistant-stream-state.test.ts

@@ -1,3 +1,5 @@
+import { mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
 import { beforeEach, describe, expect, test } from "bun:test";
 
 import type { AssistantEvent } from "../runtime/assistant-event.js";
@@ -8,6 +10,7 @@ import type {
 import {
   _peekStreamForTesting,
   _resetStreamStateForTesting,
+  _simulateRestartForTesting,
   getCurrentSeq,
   getPersistedSeq,
   getReplayWindow,
@@ -642,4 +645,108 @@ describe("assistant-stream-state", () => {
       expect(getPersistedSeq("conv_1")).toBeNull();
     });
   });
+
+  describe("seq persistence across restarts", () => {
+    test("counter resumes above the persisted reservation after a restart", () => {
+      // GIVEN a process that stamped events (reserving a seq block on disk)
+      const a = mkEvent();
+      stampAndBuffer(a);
+      expect(a.seq).toBe(1);
+
+      // WHEN the daemon restarts
+      _simulateRestartForTesting();
+
+      // THEN the next stamp resumes above the reserved block instead of 1,
+      // so clients never observe the counter moving backwards.
+      const b = mkEvent();
+      stampAndBuffer(b);
+      expect(b.seq).toBe(1025);
+    });
+
+    test("repeated restarts keep advancing monotonically", () => {
+      stampAndBuffer(mkEvent());
+      _simulateRestartForTesting();
+      const a = mkEvent();
+      stampAndBuffer(a);
+      _simulateRestartForTesting();
+      const b = mkEvent();
+      stampAndBuffer(b);
+      expect(a.seq).toBe(1025);
+      expect(b.seq).toBe(2049);
+    });
+
+    test("stamping within a reserved block does not advance the persisted ceiling", () => {
+      // GIVEN many stamps within one block
+      for (let i = 0; i < 100; i++) stampAndBuffer(mkEvent());
+
+      // WHEN the daemon restarts
+      _simulateRestartForTesting();
+
+      // THEN the resume point is the block ceiling, not per-event state.
+      const a = mkEvent();
+      stampAndBuffer(a);
+      expect(a.seq).toBe(1025);
+    });
+
+    test("a corrupt reservation file degrades to a cold start", () => {
+      const path = join(
+        process.env.VELLUM_WORKSPACE_DIR!,
+        "data",
+        "stream-seq.json",
+      );
+      mkdirSync(dirname(path), { recursive: true });
+      writeFileSync(path, "not json");
+
+      _simulateRestartForTesting();
+      const a = mkEvent();
+      stampAndBuffer(a);
+      expect(a.seq).toBe(1);
+    });
+
+    test("a pre-restart cursor replays the post-restart events (reservation gap is not an eviction)", () => {
+      // GIVEN a client that saw seq 1 before the daemon restarted
+      stampAndBuffer(mkEvent());
+      _simulateRestartForTesting();
+
+      // AND the restarted daemon has buffered new events
+      const a = mkEvent();
+      const b = mkEvent();
+      stampAndBuffer(a);
+      stampAndBuffer(b);
+      expect(a.seq).toBe(1025);
+
+      // WHEN the client reconnects with its pre-restart cursor
+      const window = getReplayWindow(1);
+
+      // THEN the post-restart events are replayed rather than treated as
+      // an out-of-window gap (no events below the reservation ever existed
+      // in this process, so nothing replayable is missing).
+      expect(window).not.toBeNull();
+      expect(window?.map((e) => e.seq)).toEqual([1025, 1026]);
+    });
+
+    test("a pre-restart cursor still gets the snapshot fallback once post-restart events evict", () => {
+      stampAndBuffer(mkEvent());
+      _simulateRestartForTesting();
+
+      // Stamp past the 200-event ring cap so the restarted process's
+      // earliest events are genuinely evicted.
+      for (let i = 0; i < 205; i++) stampAndBuffer(mkEvent());
+
+      // The gap now includes evicted post-restart events, so replay must
+      // signal the snapshot fallback.
+      expect(getReplayWindow(1)).toBeNull();
+    });
+
+    test("a missing reservation file is a cold start at 1", () => {
+      rmSync(
+        join(process.env.VELLUM_WORKSPACE_DIR!, "data", "stream-seq.json"),
+        { force: true },
+      );
+      _simulateRestartForTesting();
+      const a = mkEvent();
+      stampAndBuffer(a);
+      expect(a.seq).toBe(1);
+    });
+  });
 });

package/src/__tests__/browser-fill-credential.test.ts

@@ -319,7 +319,7 @@ describe("executeBrowserFillCredential", () => {
     );
     expect(result.isError).toBe(true);
     expect(result.content).toContain("No credential stored for slack/api_key");
-    expect(result.content).toContain("credential_store");
+    expect(result.content).toContain("assistant credentials set");
     // The broker short-circuits before DOM.focus is dispatched.
     const methods = sendCalls.map((c) => c.method);
     expect(methods).not.toContain("DOM.focus");
@@ -335,7 +335,7 @@ describe("executeBrowserFillCredential", () => {
     );
     expect(result.isError).toBe(true);
     expect(result.content).toContain("No credential stored for slack/api_key");
-    expect(result.content).toContain("credential_store");
+    expect(result.content).toContain("assistant credentials set");
     const methods = sendCalls.map((c) => c.method);
     expect(methods).not.toContain("Input.insertText");
   });
@@ -465,7 +465,7 @@ describe("executeBrowserFillCredential", () => {
       expect(result.isError).toBe(true);
       expect(result.content).toContain("Policy denied");
       expect(result.content).toContain("not allowed to use credential");
-      expect(result.content).toContain("credential_store");
+      expect(result.content).toContain("assistant credentials set");
       // The broker short-circuits before Input.insertText fires.
       const methods = sendCalls.map((c) => c.method);
       expect(methods).not.toContain("Input.insertText");

package/src/__tests__/bundled-skill-retrieval-guard.test.ts

@@ -179,7 +179,7 @@ describe("bundled skill retrieval guard", () => {
     if (violations.length > 0) {
       const message = [
         "Direct credential lookup instructions were found in skills.",
-        "Use credential_store and CLI/proxied flows instead.",
+        "Use the `assistant credentials` CLI and proxied flows instead.",
         "",
         "Violations:",
         ...violations.map((v) => `  - ${v}`),

package/src/__tests__/compaction-events.test.ts

@@ -41,11 +41,6 @@ mock.module("../util/logger.js", () => ({
   getLogger: () => makeLoggerStub(),
 }));
 
-mock.module("../memory/guardian-action-store.js", () => ({
-  getGuardianActionRequest: () => null,
-  resolveGuardianActionRequest: () => {},
-}));
-
 mock.module("../providers/registry.js", () => ({
   getProvider: () => ({ name: "mock-provider" }),
   initializeProviders: async () => {},
@@ -79,7 +74,14 @@ mock.module("../config/loader.js", () => ({
         },
       },
       profiles: {},
-      callSites: {},
+      callSites: {
+        // Resolves a SMALLER window than mainAgent (which inherits
+        // llm.default's 100000) — exercised by the maybeCompact gate-sizing
+        // tests below.
+        memoryRetrospective: {
+          contextWindow: { maxInputTokens: 50000 },
+        },
+      },
       pricingOverrides: [],
     },
     rateLimit: { maxRequestsPerMinute: 0 },
@@ -187,11 +189,18 @@ let mockCompactResult: ContextWindowResult = {
   summaryText: "",
 };
 
+// Config payloads handed to the manager's updateConfig — runCompaction calls
+// it with the (possibly sizing-threaded) resolved context-window config
+// before delegating to the manager.
+const updateConfigCalls: Array<{ maxInputTokens?: number }> = [];
+
 mock.module("../plugins/defaults/compaction/window-manager.js", () => ({
   ContextWindowManager: class {
     nonPersistedPrefixCount = 0;
     constructor() {}
-    updateConfig() {}
+    updateConfig(cfg: { maxInputTokens?: number }) {
+      updateConfigCalls.push(cfg);
+    }
     shouldCompact() {
       return { needed: false, estimatedTokens: 0 };
     }
@@ -433,6 +442,53 @@ describe("forceCompact event emission", () => {
   });
 });
 
+describe("maybeCompact gate sizing", () => {
+  test("default sizing resolves mainAgent's window; wake sizing resolves the wake's call-site window", async () => {
+    // The auto-threshold gate derives its trip point from the
+    // context-window config pushed via updateConfig. Sized against
+    // mainAgent (100k here), a wake whose call site resolves a smaller
+    // window (memoryRetrospective → 50k) would pass the gate un-compacted
+    // and then overflow at the provider — threading the sizing makes the
+    // gate see the 50k window instead.
+    mockCompactResult = {
+      messages: [],
+      compacted: false,
+      previousEstimatedInputTokens: 0,
+      estimatedInputTokens: 0,
+      maxInputTokens: 0,
+      thresholdTokens: 0,
+      compactedMessages: 0,
+      compactedPersistedMessages: 0,
+      summaryCalls: 0,
+      summaryInputTokens: 0,
+      summaryOutputTokens: 0,
+      summaryModel: "",
+      summaryText: "",
+    };
+    const conversation = makeConversation([], "conv-compact-sizing");
+
+    updateConfigCalls.length = 0;
+    await conversation.maybeCompact();
+    await conversation.maybeCompact({ callSite: "memoryRetrospective" });
+
+    expect(updateConfigCalls.map((cfg) => cfg.maxInputTokens)).toEqual([
+      100000, 50000,
+    ]);
+  });
+
+  test("forceCompact keeps mainAgent sizing", async () => {
+    mockCompactResult = { ...mockCompactResult, compacted: false };
+    const conversation = makeConversation([], "conv-compact-force-sizing");
+
+    updateConfigCalls.length = 0;
+    await conversation.forceCompact();
+
+    expect(updateConfigCalls.map((cfg) => cfg.maxInputTokens)).toEqual([
+      100000,
+    ]);
+  });
+});
+
 // ---------------------------------------------------------------------------
 // computeSummaryQualitySignals — imported lazily after mocks are installed so
 // the logger stub and other module replacements take effect first.