@vellumai/assistant 0.8.4 → 0.8.6

package/src/__tests__/manual-token-reconciliation.test.ts

@@ -13,6 +13,8 @@ let connectionStore: Record<
 > = {};
 let deletedConnectionIds: string[] = [];
 let createdConnections: Array<{ provider: string; accountInfo?: string }> = [];
+let updatedConnections: Array<{ id: string; accountInfo?: string | null }> = [];
+let telegramBotUsername: string | undefined;
 const warnings: string[] = [];
 
 // ---------------------------------------------------------------------------
@@ -41,6 +43,10 @@ mock.module("../security/secure-keys.js", () => ({
   },
 }));
 
+mock.module("../telegram/bot-username.js", () => ({
+  getTelegramBotUsername: () => telegramBotUsername,
+}));
+
 mock.module("../oauth/oauth-store.js", () => ({
   getConnectionByProvider: (provider: string) =>
     connectionStore[provider] ?? undefined,
@@ -72,7 +78,16 @@ mock.module("../oauth/oauth-store.js", () => ({
     };
     return { id: `conn-${params.provider}` };
   },
-  updateConnection: () => {},
+  updateConnection: (id: string, updates: { accountInfo?: string | null }) => {
+    updatedConnections.push({ id, accountInfo: updates.accountInfo });
+    for (const conn of Object.values(connectionStore)) {
+      if (conn.id === id) {
+        conn.accountInfo = updates.accountInfo;
+        return true;
+      }
+    }
+    return false;
+  },
   upsertApp: async (_provider: string, _clientId: string) => ({
     id: "app-1",
   }),
@@ -119,6 +134,8 @@ describe("syncManualTokenConnection", () => {
     connectionStore = {};
     deletedConnectionIds = [];
     createdConnections = [];
+    updatedConnections = [];
+    telegramBotUsername = undefined;
     warnings.length = 0;
   });
 
@@ -291,6 +308,62 @@ describe("syncManualTokenConnection", () => {
       { provider: "telegram", accountInfo: undefined },
     ]);
   });
+
+  test("creates telegram connection with configured bot username when account is omitted", async () => {
+    telegramBotUsername = "example_bot";
+    setCredentialResult("telegram", "bot_token", {
+      value: "bot-token",
+      unreachable: false,
+    });
+    setCredentialResult("telegram", "webhook_secret", {
+      value: "webhook-secret",
+      unreachable: false,
+    });
+
+    await syncManualTokenConnection("telegram");
+
+    expect(createdConnections).toEqual([
+      { provider: "telegram", accountInfo: "@example_bot" },
+    ]);
+  });
+
+  test("updates existing telegram connection with configured bot username when account is omitted", async () => {
+    telegramBotUsername = "@example_bot";
+    seedConnection("telegram");
+    setCredentialResult("telegram", "bot_token", {
+      value: "bot-token",
+      unreachable: false,
+    });
+    setCredentialResult("telegram", "webhook_secret", {
+      value: "webhook-secret",
+      unreachable: false,
+    });
+
+    await syncManualTokenConnection("telegram");
+
+    expect(updatedConnections).toEqual([
+      { id: "conn-telegram", accountInfo: "@example_bot" },
+    ]);
+    expect(connectionStore["telegram"]?.accountInfo).toBe("@example_bot");
+  });
+
+  test("preserves existing telegram account label when deriving bot username lazily", async () => {
+    telegramBotUsername = "@example_bot";
+    seedConnection("telegram", { accountInfo: "@existing_bot" });
+    setCredentialResult("telegram", "bot_token", {
+      value: "bot-token",
+      unreachable: false,
+    });
+    setCredentialResult("telegram", "webhook_secret", {
+      value: "webhook-secret",
+      unreachable: false,
+    });
+
+    await syncManualTokenConnection("telegram");
+
+    expect(updatedConnections).toEqual([]);
+    expect(connectionStore["telegram"]?.accountInfo).toBe("@existing_bot");
+  });
 });
 
 describe("backfillManualTokenConnections", () => {
@@ -299,6 +372,8 @@ describe("backfillManualTokenConnections", () => {
     connectionStore = {};
     deletedConnectionIds = [];
     createdConnections = [];
+    updatedConnections = [];
+    telegramBotUsername = undefined;
     warnings.length = 0;
   });
 

package/src/__tests__/mcp-abort-signal.test.ts

@@ -8,7 +8,21 @@ mock.module("../security/secure-keys.js", () => ({
 }));
 
 mock.module("../config/env-registry.js", () => ({
+  getDebugStdoutLogs: () => false,
+  getIsContainerized: () => false,
   getIsPlatform: () => false,
+  isPlatformRemote: () => false,
+  getWorkspaceDirOverride: () => undefined,
+  getBackupDirOverride: () => undefined,
+  getBackupKeyPathOverride: () => undefined,
+  getCpuLimit: () => undefined,
+  getMinikubeStorageSize: () => undefined,
+  getProfilerRunId: () => undefined,
+  getProfilerMode: () => undefined,
+  getProfilerMaxBytes: () => undefined,
+  getProfilerMaxRuns: () => undefined,
+  getProfilerMinFreeMb: () => undefined,
+  checkUnrecognizedEnvVars: () => [],
 }));
 
 const { McpClient } = await import("../mcp/client.js");
@@ -142,7 +156,7 @@ describe("MCP AbortSignal threading", () => {
       );
 
       expect(tool.name).toBe("mcp__test-server__my-tool");
-      expect(tool.getDefinition().name).toBe("mcp__test-server__my-tool");
+      expect(tool.name).toBe("mcp__test-server__my-tool");
     });
 
     test("keeps MCP tool names with trailing whitespace distinct", () => {
@@ -211,7 +225,7 @@ describe("MCP AbortSignal threading", () => {
       expect(tool.name.startsWith("mcp__stripe_link-cli__create_link__")).toBe(
         true,
       );
-      expect(tool.getDefinition().name).toBe(tool.name);
+      expect(tool.name).toBe(tool.name);
 
       await tool.execute(
         { someArg: "value" },

package/src/__tests__/mcp-client-auth.test.ts

@@ -8,7 +8,21 @@ mock.module("../security/secure-keys.js", () => ({
 }));
 
 mock.module("../config/env-registry.js", () => ({
+  getDebugStdoutLogs: () => false,
+  getIsContainerized: () => false,
   getIsPlatform: () => false,
+  isPlatformRemote: () => false,
+  getWorkspaceDirOverride: () => undefined,
+  getBackupDirOverride: () => undefined,
+  getBackupKeyPathOverride: () => undefined,
+  getCpuLimit: () => undefined,
+  getMinikubeStorageSize: () => undefined,
+  getProfilerRunId: () => undefined,
+  getProfilerMode: () => undefined,
+  getProfilerMaxBytes: () => undefined,
+  getProfilerMaxRuns: () => undefined,
+  getProfilerMinFreeMb: () => undefined,
+  checkUnrecognizedEnvVars: () => [],
 }));
 
 const { McpClient } = await import("../mcp/client.js");

package/src/__tests__/media-generate-image.test.ts

@@ -321,6 +321,9 @@ describe("image-studio skill script wrapper", () => {
 
     expect(result.isError).toBe(true);
     expect(result.content).toContain("Mock Gemini error: API failure");
+    expect(result.content).toContain(
+      "Do not change service configuration (mode, provider, or model) to try to fix it",
+    );
   });
 
   test("openai generation error uses OpenAI-specific mapping", async () => {
@@ -331,6 +334,34 @@ describe("image-studio skill script wrapper", () => {
 
     expect(result.isError).toBe(true);
     expect(result.content).toContain("Mock OpenAI error: openai failure");
+    expect(result.content).toContain(
+      "Do not change service configuration (mode, provider, or model) to try to fix it",
+    );
+  });
+
+  test("missing credentials error includes guidance not to change service config", async () => {
+    mockGeminiKey = undefined;
+
+    const result = await run({ prompt: "a cat" }, fakeContext);
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("No Gemini API key");
+    expect(result.content).toContain(
+      "Do not change service configuration (mode, provider, or model) to try to fix it",
+    );
+  });
+
+  test("managed mode credential error includes guidance not to change service config", async () => {
+    mockImageGenMode = "managed";
+    mockManagedBaseUrl = undefined;
+
+    const result = await run({ prompt: "a cat" }, fakeContext);
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("Managed proxy is not available");
+    expect(result.content).toContain(
+      "Do not change service configuration (mode, provider, or model) to try to fix it",
+    );
   });
 
   test("reads source images from file paths on disk", async () => {

package/src/__tests__/memory-v2-static-injector.test.ts

@@ -4,9 +4,9 @@
  * Covers:
  *   - Returns null when `memoryV2Static` is missing/empty.
  *   - Returns null when `mode === "minimal"`.
- *   - Wraps content in `<memory>...</memory>` and uses
+ *   - Wraps content in `<info>...</info>` and uses
  *     `after-memory-prefix` placement.
- *   - Escapes any `</memory>` substring inside the authored content so the
+ *   - Escapes any `</info>` substring inside the authored content so the
  *     wrapper cannot be broken out of.
  *
  * Hermetic: drives the injector's `produce()` directly with a synthesized
@@ -66,7 +66,7 @@ describe("memory-v2-static injector", () => {
     expect(await memoryV2StaticInjector.produce(ctx)).toBeNull();
   });
 
-  test("wraps content in <memory>...</memory> with after-memory-prefix placement", async () => {
+  test("wraps content in <info>...</info> with after-memory-prefix placement", async () => {
     const content =
       "## Essentials\n\nAlice prefers VS Code.\n\n## Threads\n\nOpen: ship PR.";
     const ctx = makeContext({
@@ -77,11 +77,11 @@ describe("memory-v2-static injector", () => {
     expect(block).not.toBeNull();
     expect(block!.id).toBe("memory-v2-static");
     expect(block!.placement).toBe("after-memory-prefix");
-    expect(block!.text).toBe(`<memory>\n${content}\n</memory>`);
+    expect(block!.text).toBe(`<info>\n${content}\n</info>`);
   });
 
-  test("escapes inner </memory> closing tags so the wrapper cannot be broken out of", async () => {
-    const content = "## Essentials\n\nText with </memory> embedded.";
+  test("escapes inner </info> closing tags so the wrapper cannot be broken out of", async () => {
+    const content = "## Essentials\n\nText with </info> embedded.";
     const ctx = makeContext({
       injectionInputs: { memoryV2Static: content },
     });
@@ -89,7 +89,7 @@ describe("memory-v2-static injector", () => {
     const block = await memoryV2StaticInjector.produce(ctx);
     expect(block).not.toBeNull();
     expect(block!.text).toBe(
-      "<memory>\n## Essentials\n\nText with &lt;/memory&gt; embedded.\n</memory>",
+      "<info>\n## Essentials\n\nText with &lt;/info&gt; embedded.\n</info>",
     );
   });
 });

package/src/__tests__/messaging-send-tool.test.ts

@@ -79,6 +79,7 @@ const getBindingByChannelChatMock = mock(
 mock.module("../memory/conversation-crud.js", () => ({
   addMessage: addMessageMock,
   getConversation: getConversationMock,
+  reserveMessage: mock(async () => ({ id: "msg-reserve" })),
 }));
 
 mock.module("../memory/conversation-disk-view.js", () => ({

package/src/__tests__/migration-import-from-url.test.ts

@@ -118,13 +118,13 @@ mock.module("../config/env.js", () => ({
 // Imports (after mocks so module-level code picks up the stubs)
 // ---------------------------------------------------------------------------
 
-import { resetDb } from "../memory/db-connection.js";
 import { defaultV1Options } from "../runtime/migrations/__tests__/v1-test-helpers.js";
 import { buildVBundle } from "../runtime/migrations/vbundle-builder.js";
 import {
   _setUrlImportValidatorOptionsForTests,
   handleMigrationImport,
 } from "../runtime/routes/migration-routes.js";
+import { resetDbForTesting } from "./db-test-helpers.js";
 import { callHandler } from "./helpers/call-route-handler.js";
 // ---------------------------------------------------------------------------
 // Local http fixture server
@@ -448,7 +448,7 @@ describe("handleMigrationImport — no-swap path omits newer-migration warning",
 
     // Drop any cached Drizzle singleton so getDb() re-opens from the
     // seeded path above when the handler calls it post-import.
-    resetDb();
+    resetDbForTesting();
 
     // All-`vellum:*` credentials bundle: the streaming importer returns
     // ok=true with zero files_created/overwritten (no-swap success),
@@ -505,7 +505,7 @@ describe("handleMigrationImport — no-swap path omits newer-migration warning",
       await fixture.close();
       // Close the cached DB handle before the workspace dir gets rm'd
       // in afterEach so we don't leak WAL/SHM files across tests.
-      resetDb();
+      resetDbForTesting();
     }
   });
 });

package/src/__tests__/mock-gateway-ipc.ts

@@ -56,7 +56,9 @@ class FakePersistentIpcClient extends EventEmitter {
     if (simulateError) {
       throw new Error("Mock IPC socket error");
     }
-    return method in ipcResults ? ipcResults[method] : undefined;
+    if (method in ipcResults) return ipcResults[method];
+    if (method === "get_feature_flags") return GET_FEATURE_FLAGS_DEFAULT;
+    return undefined;
   }
 
   destroy(): void {
@@ -68,6 +70,18 @@ class FakePersistentIpcClient extends EventEmitter {
 // Register the mock (called once from test-preload.ts)
 // ---------------------------------------------------------------------------
 
+/**
+ * Sentinel returned by the mock for `get_feature_flags` when a test has not
+ * explicitly configured a result. Keeps the response non-empty so
+ * `initFeatureFlagOverrides()` does not enter its 7.75 s empty-result retry
+ * loop during tests that build the CLI program or otherwise trigger flag
+ * initialization. The sentinel key starts with a double underscore so it
+ * cannot collide with any real registry-declared flag.
+ */
+const GET_FEATURE_FLAGS_DEFAULT: Record<string, boolean> = {
+  __test_default__: false,
+};
+
 export function installGatewayIpcMock(): void {
   mock.module("@vellumai/gateway-client/ipc-client", () => ({
     ipcCall: async (
@@ -79,7 +93,9 @@ export function installGatewayIpcMock(): void {
         // Real ipcCall returns undefined on failure — mirror that behavior.
         return undefined;
       }
-      return method in ipcResults ? ipcResults[method] : undefined;
+      if (method in ipcResults) return ipcResults[method];
+      if (method === "get_feature_flags") return GET_FEATURE_FLAGS_DEFAULT;
+      return undefined;
     },
     PersistentIpcClient: FakePersistentIpcClient,
   }));

package/src/__tests__/model-intents.test.ts

@@ -20,7 +20,7 @@ describe("model intents", () => {
       "claude-haiku-4-5-20251001",
     );
     expect(resolveModelIntent("anthropic", "quality-optimized")).toBe(
-      "claude-opus-4-7",
+      "claude-opus-4-8",
     );
     expect(resolveModelIntent("anthropic", "vision-optimized")).toBe(
       "claude-opus-4-6",
@@ -29,7 +29,7 @@ describe("model intents", () => {
       "gpt-5.4-nano",
     );
     expect(resolveModelIntent("gemini", "latency-optimized")).toBe(
-      "gemini-3.1-flash-lite-preview",
+      "gemini-3.1-flash-lite",
     );
     expect(resolveModelIntent("gemini", "quality-optimized")).toBe(
       "gemini-3.1-pro-preview",
@@ -44,11 +44,9 @@ describe("model intents", () => {
   });
 
   test("falls back to provider default for unknown providers", () => {
-    expect(getProviderDefaultModel("unknown-provider")).toBe(
-      "claude-opus-4-7",
-    );
+    expect(getProviderDefaultModel("unknown-provider")).toBe("claude-opus-4-8");
     expect(resolveModelIntent("unknown-provider", "quality-optimized")).toBe(
-      "claude-opus-4-7",
+      "claude-opus-4-8",
     );
   });
 });

package/src/__tests__/native-web-search.test.ts

@@ -51,8 +51,7 @@ mock.module("@anthropic-ai/sdk", () => ({
           _options?: Record<string, unknown>,
         ) => {
           lastStreamParams = JSON.parse(JSON.stringify(params));
-          const handlers: Record<string, ((...args: unknown[]) => void)[]> =
-            {};
+          const handlers: Record<string, ((...args: unknown[]) => void)[]> = {};
           return {
             on(event: string, cb: (...args: unknown[]) => void) {
               (handlers[event] ??= []).push(cb);
@@ -74,6 +73,7 @@ mock.module("@anthropic-ai/sdk", () => ({
 
 // Import after mocking
 import { AnthropicProvider } from "../providers/anthropic/client.js";
+import { isNativeWebSearchCapableProvider } from "../providers/registry.js";
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -99,6 +99,34 @@ const sampleTools: ToolDefinition[] = [
   },
 ];
 
+describe("Native Web Search — Selection Semantics", () => {
+  test("only native-capable inference providers/models request provider-native web search", () => {
+    expect(
+      isNativeWebSearchCapableProvider("anthropic", "claude-opus-4-7"),
+    ).toBe(true);
+    expect(isNativeWebSearchCapableProvider("openai", "gpt-5")).toBe(true);
+    expect(
+      isNativeWebSearchCapableProvider(
+        "openrouter",
+        "anthropic/claude-opus-4-7",
+      ),
+    ).toBe(true);
+
+    expect(
+      isNativeWebSearchCapableProvider(
+        "fireworks",
+        "accounts/fireworks/models/kimi-k2p6",
+      ),
+    ).toBe(false);
+    expect(isNativeWebSearchCapableProvider("gemini", "gemini-3.1-pro")).toBe(
+      false,
+    );
+    expect(isNativeWebSearchCapableProvider("openrouter", "openai/gpt-5")).toBe(
+      false,
+    );
+  });
+});
+
 // ---------------------------------------------------------------------------
 // Tests — Round-trip: fromAnthropicBlock
 // ---------------------------------------------------------------------------

package/src/__tests__/notification-deep-link.test.ts

@@ -38,6 +38,13 @@ mock.module("../notifications/deliveries-store.js", () => ({
   findDeliveryByDecisionAndChannel: () => undefined,
 }));
 
+// Mock conversation-crud so the broadcaster's source-context fallback lookup
+// can be driven from tests without DB access.
+let mockExistingConversations: Record<string, { id: string }> = {};
+mock.module("../memory/conversation-crud.js", () => ({
+  getConversation: (id: string) => mockExistingConversations[id] ?? null,
+}));
+
 // Configurable mock for conversation-pairing
 let nextPairingResult:
   | import("../notifications/conversation-pairing.js").PairingResult
@@ -141,6 +148,7 @@ class MockAdapter implements ChannelAdapter {
 describe("notification deep-link metadata", () => {
   beforeEach(() => {
     nextPairingResult = null;
+    mockExistingConversations = {};
   });
 
   describe("VellumAdapter", () => {
@@ -600,5 +608,59 @@ describe("notification deep-link metadata", () => {
       expect(deepLink1!.messageId).toBe("msg-delivery-1");
       expect(deepLink2!.messageId).toBe("msg-delivery-2");
     });
+
+    // ── Source-context fallback when pairing yields no conversation ──
+
+    test("falls back to signal.sourceContextId for deep link when pairing returns no conversation and sourceContextId resolves", async () => {
+      const vellumAdapter = new MockAdapter("vellum");
+      const broadcaster = new NotificationBroadcaster([vellumAdapter]);
+
+      // Passive vellum signal: pairing skips creation, returns null.
+      nextPairingResult = {
+        conversationId: null,
+        messageId: null,
+        strategy: "start_new_conversation" as const,
+        createdNewConversation: false,
+        conversationFallbackUsed: false,
+      };
+
+      const originConvId = "conv-origin-of-event";
+      mockExistingConversations[originConvId] = { id: originConvId };
+
+      const signal = makeSignal({ sourceContextId: originConvId });
+      const decision = makeDecision();
+
+      await broadcaster.broadcastDecision(signal, decision);
+
+      expect(vellumAdapter.sent).toHaveLength(1);
+      const deepLink = vellumAdapter.sent[0].deepLinkTarget;
+      expect(deepLink).toBeDefined();
+      expect(deepLink!.conversationId).toBe(originConvId);
+    });
+
+    test("omits conversationId from deep link when pairing returns no conversation and sourceContextId is a sentinel", async () => {
+      const vellumAdapter = new MockAdapter("vellum");
+      const broadcaster = new NotificationBroadcaster([vellumAdapter]);
+
+      nextPairingResult = {
+        conversationId: null,
+        messageId: null,
+        strategy: "start_new_conversation" as const,
+        createdNewConversation: false,
+        conversationFallbackUsed: false,
+      };
+
+      // Sentinel sourceContextId (job ID, access-req-*, etc.) — getConversation returns null.
+      const signal = makeSignal({ sourceContextId: "access-req-sentinel-xyz" });
+      const decision = makeDecision();
+
+      await broadcaster.broadcastDecision(signal, decision);
+
+      expect(vellumAdapter.sent).toHaveLength(1);
+      const deepLink = vellumAdapter.sent[0].deepLinkTarget;
+      // Decision did not carry a deepLinkTarget either — the resulting
+      // deep link should be undefined or have no conversationId.
+      expect(deepLink?.conversationId).toBeUndefined();
+    });
   });
 });

package/src/__tests__/notification-guardian-path.test.ts

@@ -66,7 +66,6 @@ mock.module("../notifications/emit-signal.js", () => ({
     }
     return mockEmitResult;
   },
-  registerBroadcastFn: () => {},
 }));
 
 import {

package/src/__tests__/oauth-commands-routes.test.ts

@@ -21,6 +21,7 @@ import { beforeEach, describe, expect, mock, test } from "bun:test";
 
 interface MockProviderRow {
   provider: string;
+  authorizeUrl: string;
   managedServiceConfigKey: string | null;
   baseUrl: string | null;
   injectionTemplates: string | null;
@@ -32,6 +33,7 @@ interface MockProviderRow {
 
 const baseProvider: MockProviderRow = {
   provider: "google",
+  authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
   managedServiceConfigKey: "google-oauth",
   baseUrl: "https://api.google.com",
   injectionTemplates: null,
@@ -69,6 +71,7 @@ let mockResolveResponse: {
   body: unknown;
 } = { status: 200, headers: {}, body: { ok: true } };
 let mockResolveRequests: unknown[] = [];
+let mockSyncManualTokenCalls: string[] = [];
 
 const mockDisconnectOAuthProvider = mock(() => Promise.resolve());
 const mockSaveRawConfig = mock(() => undefined);
@@ -117,6 +120,12 @@ mock.module("../oauth/connection-resolver.js", () => ({
   }),
 }));
 
+mock.module("../oauth/manual-token-connection.js", () => ({
+  syncManualTokenConnection: async (provider: string) => {
+    mockSyncManualTokenCalls.push(provider);
+  },
+}));
+
 mock.module("../platform/client.js", () => ({
   VellumPlatformClient: {
     create: async () => {
@@ -212,6 +221,7 @@ beforeEach(() => {
   });
   mockResolveResponse = { status: 200, headers: {}, body: { ok: true } };
   mockResolveRequests = [];
+  mockSyncManualTokenCalls = [];
   mockDisconnectOAuthProvider.mockClear();
   mockSaveRawConfig.mockClear();
 });
@@ -475,6 +485,33 @@ describe("GET oauth/status", () => {
     expect(result.connections[0]!.grantedScopes).toEqual([]);
   });
 
+  test("BYO mode reconciles manual-token providers before listing status", async () => {
+    mockProviders.telegram = {
+      ...baseProvider,
+      provider: "telegram",
+      authorizeUrl: "urn:manual-token",
+      managedServiceConfigKey: null,
+      baseUrl: "https://api.telegram.org",
+    };
+    mockAllConnections.telegram = [
+      {
+        id: "conn-telegram",
+        accountInfo: "@example_bot",
+        grantedScopes: "[]",
+        status: "active",
+        hasRefreshToken: 0,
+        expiresAt: null,
+      },
+    ];
+
+    const result = (await getRoute("GET", "oauth/status").handler(
+      makeArgs({ queryParams: { provider: "telegram" } }),
+    )) as { connections: Array<{ account: string | null }> };
+
+    expect(mockSyncManualTokenCalls).toEqual(["telegram"]);
+    expect(result.connections[0]!.account).toBe("@example_bot");
+  });
+
   test("managed mode surfaces platform connections", async () => {
     mockServiceModes["google-oauth"] = "managed";
     mockFetchImpl = async () => ({

package/src/__tests__/oauth-provider-visibility.test.ts

@@ -21,13 +21,13 @@ mock.module("../security/secure-keys.js", () => ({
   getSecureKeyAsync: () => Promise.resolve(undefined),
 }));
 
-import { _setOverridesForTesting } from "../config/assistant-feature-flags.js";
 import type { AssistantConfig } from "../config/schema.js";
-import { resetDb } from "../memory/db-connection.js";
 import { initializeDb } from "../memory/db-init.js";
 import { resetTestTables } from "../memory/raw-query.js";
 import { listProviders, seedProviders } from "../oauth/oauth-store.js";
 import { isProviderVisible } from "../oauth/provider-visibility.js";
+import { resetDbForTesting } from "./db-test-helpers.js";
+import { setOverridesForTesting } from "./feature-flag-test-helpers.js";
 
 initializeDb();
 
@@ -38,15 +38,15 @@ function makeConfig(): AssistantConfig {
 
 beforeEach(() => {
   resetTestTables("oauth_connections", "oauth_apps", "oauth_providers");
-  _setOverridesForTesting({});
+  setOverridesForTesting({});
 });
 
 afterEach(() => {
-  _setOverridesForTesting({});
+  setOverridesForTesting({});
 });
 
 afterAll(() => {
-  resetDb();
+  resetDbForTesting();
 });
 
 describe("isProviderVisible", () => {
@@ -70,7 +70,7 @@ describe("isProviderVisible", () => {
   });
 
   test("returns true when featureFlag is set and the flag is enabled", () => {
-    _setOverridesForTesting({ "test-gate": true });
+    setOverridesForTesting({ "test-gate": true });
 
     seedProviders([
       {
@@ -93,7 +93,7 @@ describe("isProviderVisible", () => {
   });
 
   test("returns false when featureFlag is set and the flag is disabled", () => {
-    _setOverridesForTesting({ "test-gate": false });
+    setOverridesForTesting({ "test-gate": false });
 
     seedProviders([
       {
@@ -115,7 +115,7 @@ describe("isProviderVisible", () => {
   });
 
   test("listProviders returns all providers but isProviderVisible filters gated ones when flag is disabled", () => {
-    _setOverridesForTesting({ "test-gate": false });
+    setOverridesForTesting({ "test-gate": false });
 
     seedProviders([
       {