@vellumai/assistant 0.8.3 → 0.8.5

package/src/__tests__/credential-execution-feature-gates.test.ts

@@ -159,7 +159,7 @@ describe("CES flags respect explicit false overrides", () => {
 // ---------------------------------------------------------------------------
 
 describe("CES flags do not affect unrelated flags", () => {
-  test("enabling all CES flags does not change browser flag (defaultEnabled: true)", () => {
+  test("enabling all CES flags does not change declared default-enabled flags", () => {
     const overrides: Record<string, boolean> = {};
     for (const key of ALL_CES_FLAG_KEYS) {
       overrides[key] = true;
@@ -167,11 +167,13 @@ describe("CES flags do not affect unrelated flags", () => {
     _setOverridesForTesting(overrides);
     const config = makeConfig();
 
-    // browser defaults to true in the registry and should stay true
-    expect(isAssistantFeatureFlagEnabled("browser", config)).toBe(true);
+    // account-deletion defaults to true in the registry and should stay true.
+    expect(isAssistantFeatureFlagEnabled("account-deletion", config)).toBe(
+      true,
+    );
   });
 
-  test("enabling all CES flags does not change unrelated default-open flags", () => {
+  test("enabling all CES flags does not change unrelated fail-closed flags", () => {
     const overrides: Record<string, boolean> = {};
     for (const key of ALL_CES_FLAG_KEYS) {
       overrides[key] = true;
@@ -179,9 +181,9 @@ describe("CES flags do not affect unrelated flags", () => {
     _setOverridesForTesting(overrides);
     const config = makeConfig();
 
-    // Unknown flags default open unless explicitly overridden.
+    // Unknown flags fail closed unless explicitly overridden.
     expect(
-      isAssistantFeatureFlagEnabled("unrelated-default-open", config),
-    ).toBe(true);
+      isAssistantFeatureFlagEnabled("unrelated-default-closed", config),
+    ).toBe(false);
   });
 });

package/src/__tests__/credential-execution-tools.test.ts

@@ -13,7 +13,7 @@ import type { Tool } from "../tools/types.js";
 
 describe("CES tool schema shapes", () => {
   test("make_authenticated_request has correct name and required fields", () => {
-    const def = makeAuthenticatedRequestTool.getDefinition();
+    const def = makeAuthenticatedRequestTool;
     expect(def.name).toBe("make_authenticated_request");
     const schema = def.input_schema as {
       required: string[];
@@ -28,7 +28,7 @@ describe("CES tool schema shapes", () => {
   });
 
   test("run_authenticated_command has correct name and required fields", () => {
-    const def = runAuthenticatedCommandTool.getDefinition();
+    const def = runAuthenticatedCommandTool;
     expect(def.name).toBe("run_authenticated_command");
     const schema = def.input_schema as {
       required: string[];
@@ -43,7 +43,7 @@ describe("CES tool schema shapes", () => {
   });
 
   test("manage_secure_command_tool has correct name and required fields", () => {
-    const def = manageSecureCommandTool.getDefinition();
+    const def = manageSecureCommandTool;
     expect(def.name).toBe("manage_secure_command_tool");
     const schema = def.input_schema as {
       required: string[];
@@ -95,7 +95,7 @@ describe("CES tool manifest registration", () => {
 
   test("no CES tool exposes raw secret values in its schema", () => {
     for (const tool of cesTools) {
-      const def = tool.getDefinition();
+      const def = tool;
       const schema = def.input_schema as {
         properties: Record<string, { type?: string; description?: string }>;
       };
@@ -114,7 +114,7 @@ describe("CES tool manifest registration", () => {
 
 describe("secure tool installation is separate from credential grants", () => {
   test("manage_secure_command_tool accepts only bundle metadata, not raw bytes", () => {
-    const def = manageSecureCommandTool.getDefinition();
+    const def = manageSecureCommandTool;
     const schema = def.input_schema as {
       properties: Record<string, unknown>;
     };
@@ -144,7 +144,7 @@ describe("secure tool installation is separate from credential grants", () => {
   });
 
   test("manage_secure_command_tool action enum does not include grant actions", () => {
-    const def = manageSecureCommandTool.getDefinition();
+    const def = manageSecureCommandTool;
     const schema = def.input_schema as {
       properties: {
         action: { enum?: string[] };

package/src/__tests__/credential-security-invariants.test.ts

@@ -171,6 +171,7 @@ describe("Invariant 2: no generic plaintext secret read API", () => {
       "daemon/handlers/config-telegram.ts", // Telegram bot token management
       "daemon/handlers/config-vercel.ts", // Vercel API token management
       "runtime/routes/integrations/twilio.ts", // Twilio credential management (HTTP control-plane)
+      "acp/prepare-agent-env.ts", // shared helper injects CLAUDE_CODE_OAUTH_TOKEN into claude-agent-acp subprocess env (called by route + skill tool spawn paths)
       "security/token-manager.ts", // OAuth token refresh flow
       "tools/network/script-proxy/session-manager.ts", // proxy credential injection at runtime
       "calls/call-domain.ts", // caller identity resolution (user phone number lookup)
@@ -209,6 +210,9 @@ describe("Invariant 2: no generic plaintext secret read API", () => {
       "config/bundled-skills/media-processing/tools/analyze-keyframes.ts", // keyframe analysis tool API key lookup
       "providers/registry.ts", // provider registry API key lookup for initialization
       "providers/inference/resolve-auth.ts", // provider_connection auth resolver (api_key path reads vault, mirrors registry.ts)
+      "providers/inference/codex-token-refresh.ts", // Codex OAuth token refresh (reads/writes access_token, refresh_token, expires_at)
+      "cli/commands/inference-providers.ts", // ChatGPT subscription OAuth token storage
+      "runtime/routes/chatgpt-subscription-auth-routes.ts", // ChatGPT subscription daemon OAuth flow (stores tokens in CES)
       "providers/provider-availability.ts", // provider availability API key check
       "media/image-credentials.ts", // shared image-gen credential resolver (provider API key lookup)
       "memory/embedding-backend.ts", // embedding backend API key lookup
@@ -223,6 +227,7 @@ describe("Invariant 2: no generic plaintext secret read API", () => {
       "daemon/daemon-skill-host.ts", // SkillHost secureKeys facet adapter (delegates to getProviderKeyAsync)
       "runtime/routes/credential-prompt-routes.ts", // Route for secure credential prompt (stores secret via setSecureKeyAsync)
       "runtime/routes/credential-routes.ts", // CLI credential management routes (CLI-migrated to IPC)
+      "runtime/routes/sanity-routes.ts", // Sanity connect/discover routes (reads stored api_token from credential store)
       "runtime/routes/platform-routes.ts", // CLI platform connect/disconnect/status routes (CLI-migrated to IPC)
       "ipc/skill-routes/providers.ts", // host.providers.secureKeys.getProviderKey IPC route (out-of-process SkillHost companion)
       "daemon/external-plugins-bootstrap.ts", // reads credentials at plugin init (manifest.requiresCredential) via the CES-mediated getSecureKeyAsync path
@@ -236,6 +241,8 @@ describe("Invariant 2: no generic plaintext secret read API", () => {
       "runtime/routes/avatar-routes.ts", // avatar generate route reads platform_base_url from credential store
       "cli/commands/keys.ts", // CLI provider key management
       "cli/commands/oauth/connect.ts", // CLI OAuth connect stored-secret verification
+      "runtime/routes/chatgpt-subscription-auth-routes.ts", // ChatGPT subscription OAuth token storage
+      "runtime/routes/identity-routes.ts", // health/readyz endpoint checks CES connectivity via getCesClient
     ]);
 
     const thisDir = dirname(fileURLToPath(import.meta.url));

package/src/__tests__/credential-vault-unit.test.ts

@@ -1267,7 +1267,7 @@ describe("credential_store tool — tool definition", () => {
   });
 
   test("getDefinition returns valid schema with required action", () => {
-    const def = credentialStoreTool.getDefinition();
+    const def = credentialStoreTool;
     expect(def.name).toBe("credential_store");
     const schema = def.input_schema as Record<string, unknown>;
     expect(schema.type).toBe("object");
@@ -1277,7 +1277,7 @@ describe("credential_store tool — tool definition", () => {
   });
 
   test("getDefinition includes injection_templates schema", () => {
-    const def = credentialStoreTool.getDefinition();
+    const def = credentialStoreTool;
     const schemaProps = (def.input_schema as Record<string, unknown>)
       .properties as Record<string, Record<string, unknown>>;
     const templates = schemaProps.injection_templates as Record<

package/src/__tests__/cu-unified-flow.test.ts

@@ -26,7 +26,16 @@ let mockCuClients: Array<{
 ];
 
 mock.module("../runtime/assistant-event-hub.js", () => ({
-  broadcastMessage: (msg: unknown) => sentMessages.push(msg),
+  broadcastMessage: (msg: unknown) => {
+    // `interaction_resolved` envelopes are emitted by the
+    // pending-interactions tracker for every resolution. They are
+    // orthogonal to the surface-proxy wire messages these tests assert
+    // on, so swallow them here.
+    if ((msg as { type?: string } | null)?.type === "interaction_resolved") {
+      return;
+    }
+    sentMessages.push(msg);
+  },
   assistantEventHub: {
     getMostRecentClientByCapability: (cap: string) =>
       cap === "host_cu" && mockHasClient ? { id: "mock-client" } : null,

package/src/__tests__/dm-backfill.test.ts

@@ -40,6 +40,20 @@ mock.module("../runtime/gateway-client.js", () => ({
   deliverChannelReply: async () => {},
 }));
 
+mock.module("../messaging/providers/slack/adapter.js", () => ({
+  withSlackBotToken: async (
+    _account: string | undefined,
+    fn: (token: string) => Promise<unknown>,
+  ) => fn("test-slack-token"),
+  resolveSlackBotUserId: async (
+    _account: string | undefined,
+    botId: string,
+  ) => {
+    if (botId === "B_ASSISTANT") return "U_BOT";
+    return null;
+  },
+}));
+
 import type { Message } from "../messaging/provider-types.js";
 
 // `backfillDm` is the only piece of the slack provider surface this test
@@ -59,6 +73,11 @@ mock.module("../messaging/providers/slack/backfill.js", () => ({
   backfillThread: () => backfillThreadMock(),
 }));
 
+import {
+  loadRawConfig,
+  saveRawConfig,
+  setNestedValue,
+} from "../config/loader.js";
 import { upsertContactChannel } from "../contacts/contacts-write.js";
 import { getDb } from "../memory/db-connection.js";
 import { initializeDb } from "../memory/db-init.js";
@@ -88,6 +107,13 @@ function resetState(): void {
   db.run("DELETE FROM contact_channels");
   db.run("DELETE FROM contacts");
   db.run("DELETE FROM external_conversation_bindings");
+  setConfiguredSlackBotUserId("U_BOT");
+}
+
+function setConfiguredSlackBotUserId(botUserId: string): void {
+  const raw = loadRawConfig();
+  setNestedValue(raw, "slack.botUserId", botUserId);
+  saveRawConfig(raw);
 }
 
 function seedActiveMember(): void {
@@ -494,6 +520,44 @@ describe("PR 23 — Slack DM cold-start backfill", () => {
     expect(botRow?.provenanceRequesterIdentifier).toBe("B_BOT");
   });
 
+  test("skips Slack assistant new-thread placeholder during DM backfill", async () => {
+    backfillDmMock.mockImplementation(async () => [
+      makeBackfilledMessage({
+        id: "1700000000.000001",
+        text: "New Assistant Thread",
+        sender: { id: "B_ASSISTANT", name: "Ada" },
+        metadata: { isBot: true, slackBotId: "B_ASSISTANT" },
+      }),
+      makeBackfilledMessage({
+        id: "1700000000.000002",
+        text: "real bot context",
+        sender: { id: "B_ASSISTANT", name: "Ada" },
+        metadata: { isBot: true, slackBotId: "B_ASSISTANT" },
+      }),
+      makeBackfilledMessage({
+        id: "1700000000.000003",
+        text: "New Assistant Thread",
+        sender: { id: "B_OTHER", name: "Build Bot" },
+        metadata: { isBot: true, slackBotId: "B_OTHER" },
+      }),
+    ]);
+
+    await handleChannelInbound(
+      buildDmRequest("live new DM"),
+      noopProcessMessage,
+      TEST_BEARER_TOKEN,
+    );
+
+    const rows = readPersistedSlackRows();
+    expect(rows.map((row) => row.rawContent).sort()).toEqual([
+      "New Assistant Thread",
+      "real bot context",
+    ]);
+    expect(
+      rows.some((row) => row.slackMeta?.actorExternalUserId === "B_OTHER"),
+    ).toBe(true);
+  });
+
   test("backfill skips channelTs values already stored", async () => {
     // First DM: backfill returns three rows.
     backfillDmMock.mockImplementation(async () => [

package/src/__tests__/dm-persistence.test.ts

@@ -179,6 +179,39 @@ describe("PR 16 — Slack DM persistence parity", () => {
     expect(slackMeta!.displayName).toBeUndefined();
   });
 
+  test("DM inbound persists Slack actor timezone metadata", async () => {
+    const ctx = createSlackTurnContext();
+    await persistQueuedMessageBody(
+      ctx,
+      "hello across timezones",
+      [],
+      "req-dm-timezone",
+      {
+        slackInbound: {
+          channelId: "D0123DM",
+          channelTs: "1700000000.777777",
+          displayName: "Alice",
+          actorTimezone: "America/New_York",
+          actorTimezoneLabel: "ET",
+          actorTimezoneOffsetSeconds: -18000,
+          timestampTimezone: "America/New_York",
+          timestampTimezoneLabel: "ET",
+          speakerTimezoneLabel: "ET",
+        },
+      },
+      undefined,
+    );
+
+    const slackMeta = lastPersistedSlackMeta();
+    expect(slackMeta).not.toBeNull();
+    expect(slackMeta!.actorTimezone).toBe("America/New_York");
+    expect(slackMeta!.actorTimezoneLabel).toBe("ET");
+    expect(slackMeta!.actorTimezoneOffsetSeconds).toBe(-18000);
+    expect(slackMeta!.timestampTimezone).toBe("America/New_York");
+    expect(slackMeta!.timestampTimezoneLabel).toBe("ET");
+    expect(slackMeta!.speakerTimezoneLabel).toBe("ET");
+  });
+
   test("DM and channel-message envelopes differ only by threadTs", async () => {
     // Capture the channel-thread case first.
     const ctx = createSlackTurnContext();