@vellumai/assistant 0.8.5 → 0.8.7-dev.202606052118.34cd356

package/src/__tests__/compactor-image-manifest-trust.test.ts

@@ -0,0 +1,112 @@
+/**
+ * Compaction must not surface guardian-only images to untrusted actors.
+ *
+ * `loadFromDb` hides guardian-provenance messages (and their images) from
+ * untrusted actors. The compaction image manifest reads the DB directly, so
+ * without the same provenance filter an untrusted actor's compaction turn
+ * could list a guardian image, retain it, and re-attach its bytes — leaking
+ * content the actor was never allowed to see. `collectImageManifest` applies
+ * the identical trust filter so this cannot happen.
+ */
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+mock.module("../config/loader.js", () => ({
+  getConfig: () => ({
+    ui: {},
+    model: "test",
+    provider: "test",
+    memory: { enabled: false },
+  }),
+}));
+
+import { collectImageManifest } from "../context/compactor.js";
+import { attachInlineAttachmentToMessage } from "../memory/attachments-store.js";
+import { addMessage, createConversation } from "../memory/conversation-crud.js";
+import { getDb } from "../memory/db-connection.js";
+import { initializeDb } from "../memory/db-init.js";
+
+initializeDb();
+
+// 1x1 transparent PNG.
+const PNG_1X1_BASE64 =
+  "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNkYPhfDwAChwGA60e6kgAAAABJRU5ErkJggg==";
+
+function resetTables(): void {
+  const db = getDb();
+  db.run("DELETE FROM message_attachments");
+  db.run("DELETE FROM attachments");
+  db.run("DELETE FROM messages");
+  db.run("DELETE FROM conversations");
+}
+
+async function addImageMessage(
+  conversationId: string,
+  provenanceTrustClass: "guardian" | "trusted_contact" | "unknown",
+  filename: string,
+): Promise<void> {
+  const inserted = await addMessage(
+    conversationId,
+    "user",
+    JSON.stringify([{ type: "text", text: filename }]),
+    {
+      metadata: { provenanceTrustClass },
+      skipIndexing: true,
+    },
+  );
+  attachInlineAttachmentToMessage(
+    inserted.id,
+    0,
+    filename,
+    "image/png",
+    PNG_1X1_BASE64,
+  );
+}
+
+describe("collectImageManifest trust filtering", () => {
+  beforeEach(resetTables);
+
+  test("untrusted actor manifest excludes guardian images", async () => {
+    // GIVEN a conversation with a guardian image and an unknown-actor image
+    const conv = createConversation();
+    await addImageMessage(conv.id, "guardian", "guardian-secret.png");
+    await addImageMessage(conv.id, "unknown", "visitor.png");
+
+    // WHEN the manifest is built for an untrusted ("unknown") actor
+    const manifest = collectImageManifest(conv.id, "unknown");
+
+    // THEN only the untrusted actor's own image is listed
+    const filenames = manifest.map((e) => e.filename);
+    expect(filenames).toContain("visitor.png");
+    expect(filenames).not.toContain("guardian-secret.png");
+  });
+
+  test("guardian actor manifest includes all images", async () => {
+    // GIVEN a conversation with a guardian image and an unknown-actor image
+    const conv = createConversation();
+    await addImageMessage(conv.id, "guardian", "guardian-secret.png");
+    await addImageMessage(conv.id, "unknown", "visitor.png");
+
+    // WHEN the manifest is built for the guardian
+    const manifest = collectImageManifest(conv.id, "guardian");
+
+    // THEN every image is listed
+    const filenames = manifest.map((e) => e.filename);
+    expect(filenames).toContain("guardian-secret.png");
+    expect(filenames).toContain("visitor.png");
+  });
+
+  test("omitted trust class defaults to the untrusted filter", async () => {
+    // GIVEN a conversation containing a guardian image
+    const conv = createConversation();
+    await addImageMessage(conv.id, "guardian", "guardian-secret.png");
+    await addImageMessage(conv.id, "trusted_contact", "contact.png");
+
+    // WHEN the manifest is built without an explicit trust class
+    const manifest = collectImageManifest(conv.id);
+
+    // THEN the guardian image is excluded (fail-closed, mirroring loadFromDb)
+    const filenames = manifest.map((e) => e.filename);
+    expect(filenames).toContain("contact.png");
+    expect(filenames).not.toContain("guardian-secret.png");
+  });
+});

package/src/__tests__/compactor-preserved-tail-count.test.ts

@@ -23,6 +23,7 @@ mock.module("../util/logger.js", () => ({
 
 mock.module("../memory/conversation-crud.js", () => ({
   getMessages: () => [],
+  reserveMessage: mock(async () => ({ id: "msg-reserve" })),
 }));
 
 mock.module("../memory/attachments-store.js", () => ({

package/src/__tests__/computer-use-skill-manifest-regression.test.ts

@@ -113,8 +113,9 @@ describe("computer-use skill manifest regression", () => {
     await initializeTools();
 
     // Simulate what projectSkillTools() does when the computer-use skill is
-    // activated: create skill-origin Tool objects matching the manifest names
-    // and register them. This must not throw.
+    // activated: create Tool objects matching the manifest names and register
+    // them through `registerSkillTools(skillId, tools)`, which records
+    // ownership in the registry's `ownersByName` map. This must not throw.
     const skillTools: Tool[] = manifest.tools.map(
       (entry: { name: string; description: string }) => ({
         name: entry.name,
@@ -122,13 +123,14 @@ describe("computer-use skill manifest regression", () => {
         input_schema: { type: "object" as const, properties: {} },
         category: "computer-use",
         defaultRiskLevel: RiskLevel.Low,
-        origin: "skill" as const,
-        ownerSkillId: "computer-use",
         execute: async () => ({ content: "stub", isError: false }),
       }),
     );
 
-    expect(() => registerSkillTools(skillTools)).not.toThrow();
+    // Owner flows in through `registerSkillTools(skillId, tools)` and lands
+    // in the registry's `ownersByName` map — the tools themselves carry no
+    // per-tool owner field.
+    expect(() => registerSkillTools("computer-use", skillTools)).not.toThrow();
 
     // Clean up
     unregisterSkillTools("computer-use");

package/src/__tests__/computer-use-tools.test.ts

@@ -23,7 +23,7 @@ interface JsonSchema {
 }
 
 /** Cast a tool definition's input_schema to a usable JSON Schema shape. */
-function schema(tool: { input_schema: object }): JsonSchema {
+function schema(tool: { input_schema?: object }): JsonSchema {
   return tool.input_schema as JsonSchema;
 }
 
@@ -40,12 +40,6 @@ describe("computer-use tool definitions", () => {
     expect(allComputerUseTools.length).toBe(11);
   });
 
-  test("all tools have proxy execution mode", () => {
-    for (const tool of allComputerUseTools) {
-      expect(tool.executionMode).toBe("proxy");
-    }
-  });
-
   test("all tools belong to computer-use category", () => {
     for (const tool of allComputerUseTools) {
       expect(tool.category).toBe("computer-use");
@@ -59,7 +53,7 @@ describe("computer-use tool definitions", () => {
 
   test("all tools have descriptions", () => {
     for (const tool of allComputerUseTools) {
-      expect(tool.description.length).toBeGreaterThan(0);
+      expect(tool.description!.length).toBeGreaterThan(0);
     }
   });
 });
@@ -94,8 +88,10 @@ describe("computer_use_click (unified)", () => {
     expect(props.y.type).toBe("integer");
   });
 
-  test("execute throws proxy error", () => {
-    expect(() => computerUseClickTool.execute({}, ctx)).toThrow("Proxy tool");
+  test("execute returns isError when no proxy resolver is configured", async () => {
+    const result = await computerUseClickTool.execute({}, ctx);
+    expect(result.isError).toBe(true);
+    expect(result.content).toMatch(/No proxy resolver/);
   });
 });
 
@@ -107,10 +103,10 @@ describe("computer_use_type_text", () => {
     expect(schema(computerUseTypeTextTool).required).toContain("reasoning");
   });
 
-  test("execute throws proxy error", () => {
-    expect(() => computerUseTypeTextTool.execute({}, ctx)).toThrow(
-      "Proxy tool",
-    );
+  test("execute returns isError when no proxy resolver is configured", async () => {
+    const result = await computerUseTypeTextTool.execute({}, ctx);
+    expect(result.isError).toBe(true);
+    expect(result.content).toMatch(/No proxy resolver/);
   });
 });
 
@@ -122,8 +118,10 @@ describe("computer_use_key", () => {
     expect(schema(computerUseKeyTool).required).toContain("reasoning");
   });
 
-  test("execute throws proxy error", () => {
-    expect(() => computerUseKeyTool.execute({}, ctx)).toThrow("Proxy tool");
+  test("execute returns isError when no proxy resolver is configured", async () => {
+    const result = await computerUseKeyTool.execute({}, ctx);
+    expect(result.isError).toBe(true);
+    expect(result.content).toMatch(/No proxy resolver/);
   });
 });
 

package/src/__tests__/config-loader-backfill.test.ts

@@ -82,7 +82,7 @@ import { migrateProviderConnectionStatusLabel } from "../memory/migrations/244-p
 import { migrateProviderConnectionBaseUrlAndModels } from "../memory/migrations/250-provider-connection-base-url-and-models.js";
 import * as schema from "../memory/schema.js";
 import { getConnection } from "../providers/inference/connections.js";
-import { _setStorePath } from "../security/encrypted-store.js";
+import { setStorePathForTesting } from "./encrypted-store-test-helpers.js";
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -328,14 +328,14 @@ describe("loadConfig startup behavior", () => {
     const updatesPath = join(WORKSPACE_DIR, "UPDATES.md");
     if (existsSync(updatesPath)) rmSync(updatesPath, { force: true });
     ensureTestDir();
-    _setStorePath(join(WORKSPACE_DIR, "keys.enc"));
+    setStorePathForTesting(join(WORKSPACE_DIR, "keys.enc"));
     delete process.env.VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH;
     delete process.env.IS_PLATFORM;
     invalidateConfigCache();
   });
 
   afterEach(() => {
-    _setStorePath(null);
+    setStorePathForTesting(null);
     delete process.env.VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH;
     delete process.env.IS_PLATFORM;
     invalidateConfigCache();
@@ -943,14 +943,14 @@ describe("seedInferenceProfiles BYOK-mode managed profile labels", () => {
       }
     }
     ensureTestDir();
-    _setStorePath(join(WORKSPACE_DIR, "keys.enc"));
+    setStorePathForTesting(join(WORKSPACE_DIR, "keys.enc"));
     delete process.env.VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH;
     delete process.env.IS_PLATFORM;
     invalidateConfigCache();
   });
 
   afterEach(() => {
-    _setStorePath(null);
+    setStorePathForTesting(null);
     delete process.env.VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH;
     delete process.env.IS_PLATFORM;
     invalidateConfigCache();
@@ -1037,9 +1037,10 @@ describe("seedInferenceProfiles BYOK-mode managed profile labels", () => {
       "anthropic-managed",
     );
     expect("status" in raw.llm.profiles.balanced).toBe(false);
-    expect(getConnection(db, "anthropic-managed")?.status).toBe("active");
-    expect(getConnection(db, "openai-managed")?.status).toBe("disabled");
-    expect(getConnection(db, "gemini-managed")?.status).toBe("disabled");
+    // Connections exist (status is no longer a connection-level concept).
+    expect(getConnection(db, "anthropic-managed")).not.toBeNull();
+    expect(getConnection(db, "openai-managed")).not.toBeNull();
+    expect(getConnection(db, "gemini-managed")).not.toBeNull();
   });
 
   test("off-platform managed-inference hatch respects explicit non-managed active connection", () => {
@@ -1075,26 +1076,10 @@ describe("seedInferenceProfiles BYOK-mode managed profile labels", () => {
     expect(raw.llm.profiles.balanced.provider_connection).toBe(
       "anthropic-personal",
     );
-    expect(getConnection(db, "anthropic-managed")?.status).toBe("disabled");
-    expect(getConnection(db, "openai-managed")?.status).toBe("disabled");
-    expect(getConnection(db, "gemini-managed")?.status).toBe("disabled");
-  });
-
-  test("off-platform BYOK hatch still disables managed connections", () => {
-    const overlayPath = join(WORKSPACE_DIR, "hatch-overlay.json");
-    writeFileSync(
-      overlayPath,
-      JSON.stringify({ llm: { default: { provider: "anthropic" } } }, null, 2) +
-        "\n",
-    );
-    process.env.VELLUM_DEFAULT_WORKSPACE_CONFIG_PATH = overlayPath;
-    const db = createProviderConnectionsDb();
-
-    mergeDefaultConfigAndSeedInferenceProfiles(db);
-
-    expect(getConnection(db, "anthropic-managed")?.status).toBe("disabled");
-    expect(getConnection(db, "openai-managed")?.status).toBe("disabled");
-    expect(getConnection(db, "gemini-managed")?.status).toBe("disabled");
+    // Connections exist (status is no longer a connection-level concept).
+    expect(getConnection(db, "anthropic-managed")).not.toBeNull();
+    expect(getConnection(db, "openai-managed")).not.toBeNull();
+    expect(getConnection(db, "gemini-managed")).not.toBeNull();
   });
 
   test("non-hatch off-platform boot does NOT auto-disable freshly-materialized managed profiles", () => {

package/src/__tests__/config-loader-corrupt.test.ts

@@ -23,7 +23,7 @@ import {
   loadConfig,
   loadRawConfig,
 } from "../config/loader.js";
-import { _setStorePath } from "../security/encrypted-store.js";
+import { setStorePathForTesting } from "./encrypted-store-test-helpers.js";
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -65,12 +65,12 @@ function listQuarantinedFiles(): string[] {
 describe("loadConfig corrupt-file recovery", () => {
   beforeEach(() => {
     resetWorkspace();
-    _setStorePath(join(WORKSPACE_DIR, "keys.enc"));
+    setStorePathForTesting(join(WORKSPACE_DIR, "keys.enc"));
     invalidateConfigCache();
   });
 
   afterEach(() => {
-    _setStorePath(null);
+    setStorePathForTesting(null);
     invalidateConfigCache();
   });
 
@@ -187,12 +187,12 @@ describe("loadConfig corrupt-file recovery", () => {
 describe("loadRawConfig corrupt-file recovery", () => {
   beforeEach(() => {
     resetWorkspace();
-    _setStorePath(join(WORKSPACE_DIR, "keys.enc"));
+    setStorePathForTesting(join(WORKSPACE_DIR, "keys.enc"));
     invalidateConfigCache();
   });
 
   afterEach(() => {
-    _setStorePath(null);
+    setStorePathForTesting(null);
     invalidateConfigCache();
   });
 

package/src/__tests__/config-loader-platform-defaults.test.ts

@@ -1,9 +1,11 @@
 /**
  * When IS_PLATFORM=true and no config.json exists yet, loadConfig() must
- * write all eight managed-capable service modes as "managed" instead of the
- * schema default "your-own". When IS_PLATFORM is absent/false, or when
- * config.json already exists, the schema defaults and existing values are
- * preserved unchanged.
+ * write all managed-capable service modes as "managed" instead of the
+ * per-service schema default. When IS_PLATFORM is absent/false, or when
+ * config.json already exists, the Zod schema defaults and existing values
+ * are preserved unchanged — note that `google-oauth` and `notion-oauth`
+ * default to "managed" at the schema level (per JARVIS-966), while every
+ * other managed-capable service defaults to "your-own".
  */
 
 import {
@@ -59,7 +61,7 @@ afterAll(() => {
 
 import { invalidateConfigCache, loadConfig } from "../config/loader.js";
 import { applyContextDefaultsToRawConfig } from "../runtime/routes/conversation-query-routes.js";
-import { _setStorePath } from "../security/encrypted-store.js";
+import { setStorePathForTesting } from "./encrypted-store-test-helpers.js";
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -91,6 +93,9 @@ function readConfig(): Record<string, unknown> {
   return JSON.parse(readFileSync(CONFIG_PATH, "utf-8"));
 }
 
+// When IS_PLATFORM=true, every managed-capable service defaults to "managed".
+// Without IS_PLATFORM, services split by Zod schema default: google/notion-oauth
+// resolve to "managed" (per JARVIS-966), the rest resolve to "your-own".
 const MANAGED_SERVICES = [
   "image-generation",
   "web-search",
@@ -101,6 +106,28 @@ const MANAGED_SERVICES = [
   "notion-oauth",
 ] as const;
 
+/**
+ * Services whose Zod schema default is `"managed"` rather than `"your-own"`.
+ * For these, the fresh-write and in-memory paths produce `"managed"` even
+ * when IS_PLATFORM is false/unset — the schema default applies regardless of
+ * deployment context. See `assistant/src/config/schemas/services.ts` and
+ * JARVIS-966: managed mode is the optimization target for new users on
+ * managed-capable infra, since the BYO flow requires a Google Cloud /
+ * Notion integration setup that most users never complete.
+ */
+const SCHEMA_MANAGED_DEFAULT_SERVICES = [
+  "google-oauth",
+  "notion-oauth",
+] as const;
+
+const SCHEMA_YOUR_OWN_DEFAULT_SERVICES = [
+  "image-generation",
+  "web-search",
+  "outlook-oauth",
+  "linear-oauth",
+  "github-oauth",
+] as const;
+
 // ---------------------------------------------------------------------------
 // Tests
 // ---------------------------------------------------------------------------
@@ -110,12 +137,12 @@ describe("platform-managed config defaults", () => {
 
   beforeEach(() => {
     resetWorkspace();
-    _setStorePath(join(WORKSPACE_DIR, "keys.enc"));
+    setStorePathForTesting(join(WORKSPACE_DIR, "keys.enc"));
     invalidateConfigCache();
   });
 
   afterEach(() => {
-    _setStorePath(null);
+    setStorePathForTesting(null);
     invalidateConfigCache();
     // Restore env to its original value
     if (originalIsPlatform === undefined) {
@@ -137,9 +164,12 @@ describe("platform-managed config defaults", () => {
     for (const svc of MANAGED_SERVICES) {
       expect((services[svc] as { mode?: string })?.mode).toBe("managed");
     }
+    expect((services["web-search"] as { provider?: string })?.provider).toBe(
+      "inference-provider-native",
+    );
   });
 
-  test("IS_PLATFORM=false, no config file → managed service modes default to 'your-own'", () => {
+  test("IS_PLATFORM=false, no config file → service modes follow schema defaults (your-own except google/notion-oauth which are managed)", () => {
     process.env.IS_PLATFORM = "false";
 
     loadConfig();
@@ -148,12 +178,15 @@ describe("platform-managed config defaults", () => {
     const written = readConfig() as { services?: Record<string, unknown> };
     expect(written.services).toBeDefined();
     const services = written.services!;
-    for (const svc of MANAGED_SERVICES) {
+    for (const svc of SCHEMA_YOUR_OWN_DEFAULT_SERVICES) {
       expect((services[svc] as { mode?: string })?.mode).toBe("your-own");
     }
+    for (const svc of SCHEMA_MANAGED_DEFAULT_SERVICES) {
+      expect((services[svc] as { mode?: string })?.mode).toBe("managed");
+    }
   });
 
-  test("IS_PLATFORM unset, no config file → managed service modes default to 'your-own'", () => {
+  test("IS_PLATFORM unset, no config file → service modes follow schema defaults (your-own except google/notion-oauth which are managed)", () => {
     delete process.env.IS_PLATFORM;
 
     loadConfig();
@@ -162,9 +195,12 @@ describe("platform-managed config defaults", () => {
     const written = readConfig() as { services?: Record<string, unknown> };
     expect(written.services).toBeDefined();
     const services = written.services!;
-    for (const svc of MANAGED_SERVICES) {
+    for (const svc of SCHEMA_YOUR_OWN_DEFAULT_SERVICES) {
       expect((services[svc] as { mode?: string })?.mode).toBe("your-own");
     }
+    for (const svc of SCHEMA_MANAGED_DEFAULT_SERVICES) {
+      expect((services[svc] as { mode?: string })?.mode).toBe("managed");
+    }
   });
 
   test("IS_PLATFORM=true, config file already exists → existing service mode values are preserved", () => {
@@ -197,6 +233,37 @@ describe("platform-managed config defaults", () => {
     expect(config.services["image-generation"].mode).toBe("your-own");
   });
 
+  test("IS_PLATFORM=true, config file with explicit notion-oauth mode='your-own' → preserved (schema default is 'managed')", () => {
+    process.env.IS_PLATFORM = "true";
+
+    // notion-oauth's schema default is "managed" (per JARVIS-966), but an
+    // explicit user choice of "your-own" must win — the fill-defaults pass
+    // must never override an explicit value, even one that contradicts the
+    // schema default. Mirror of the image-generation "your-own preserved"
+    // test above, but for a service whose schema default is "managed".
+    writeFileSync(
+      CONFIG_PATH,
+      JSON.stringify(
+        {
+          services: {
+            "notion-oauth": { mode: "your-own" },
+          },
+        },
+        null,
+        2,
+      ) + "\n",
+    );
+
+    const config = loadConfig();
+
+    const written = readConfig() as { services?: Record<string, unknown> };
+    expect(written.services).toBeDefined();
+    expect((written.services!["notion-oauth"] as { mode?: string })?.mode).toBe(
+      "your-own",
+    );
+    expect(config.services["notion-oauth"].mode).toBe("your-own");
+  });
+
   test("IS_PLATFORM=true, config file exists without a services key → in-memory config has all managed modes", () => {
     // Regression guard for the platform-managed boot order: by the time
     // `loadConfig()` runs, lifecycle steps such as `seedInferenceProfiles`
@@ -228,12 +295,8 @@ describe("platform-managed config defaults", () => {
     // missing service-mode fields.
     for (const svc of MANAGED_SERVICES) {
       expect(
-        (
-          config.services as unknown as Record<
-            string,
-            { mode: string }
-          >
-        )[svc]!.mode,
+        (config.services as unknown as Record<string, { mode: string }>)[svc]!
+          .mode,
       ).toBe("managed");
     }
 
@@ -277,9 +340,11 @@ describe("platform-managed config defaults", () => {
     expect(imageGen.provider).toBe("openai");
   });
 
-  test("IS_PLATFORM=false, config file exists without services key → in-memory config keeps schema your-own defaults", () => {
+  test("IS_PLATFORM=false, config file exists without services key → in-memory config keeps schema defaults (your-own except google/notion-oauth which are managed)", () => {
     // Sanity guard: deployment-context defaults are a no-op when IS_PLATFORM
-    // is not enabled, regardless of whether config.json existed.
+    // is not enabled, regardless of whether config.json existed. The Zod
+    // schema defaults still apply, so google-oauth and notion-oauth resolve
+    // to "managed" while the remaining services resolve to "your-own".
     process.env.IS_PLATFORM = "false";
 
     writeFileSync(
@@ -300,16 +365,18 @@ describe("platform-managed config defaults", () => {
 
     const config = loadConfig();
 
-    for (const svc of MANAGED_SERVICES) {
+    for (const svc of SCHEMA_YOUR_OWN_DEFAULT_SERVICES) {
       expect(
-        (
-          config.services as unknown as Record<
-            string,
-            { mode: string }
-          >
-        )[svc]!.mode,
+        (config.services as unknown as Record<string, { mode: string }>)[svc]!
+          .mode,
       ).toBe("your-own");
     }
+    for (const svc of SCHEMA_MANAGED_DEFAULT_SERVICES) {
+      expect(
+        (config.services as unknown as Record<string, { mode: string }>)[svc]!
+          .mode,
+      ).toBe("managed");
+    }
   });
 });
 

package/src/__tests__/config-loader-quarantine-bulletin.test.ts

@@ -28,7 +28,7 @@ import {
   invalidateConfigCache,
   loadConfig,
 } from "../config/loader.js";
-import { _setStorePath } from "../security/encrypted-store.js";
+import { setStorePathForTesting } from "./encrypted-store-test-helpers.js";
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -71,12 +71,12 @@ function listQuarantinedFiles(): string[] {
 describe("config-quarantine UPDATES.md bulletin", () => {
   beforeEach(() => {
     resetWorkspace();
-    _setStorePath(join(WORKSPACE_DIR, "keys.enc"));
+    setStorePathForTesting(join(WORKSPACE_DIR, "keys.enc"));
     invalidateConfigCache();
   });
 
   afterEach(() => {
-    _setStorePath(null);
+    setStorePathForTesting(null);
     invalidateConfigCache();
   });
 

package/src/__tests__/config-managed-gemini-defaults.test.ts

@@ -68,7 +68,6 @@ mock.module("../config/assistant-feature-flags.js", () => ({
     if (key === "managed-gemini-embeddings-enabled") return featureFlagEnabled;
     return true;
   },
-  _setOverridesForTesting: () => {},
   clearFeatureFlagOverridesCache: () => {},
   initFeatureFlagOverrides: async () => {},
   getAssistantFeatureFlagDefaults: () => ({}),
@@ -81,7 +80,7 @@ afterAll(() => {
 });
 
 import { invalidateConfigCache, loadConfig } from "../config/loader.js";
-import { _setStorePath } from "../security/encrypted-store.js";
+import { setStorePathForTesting } from "./encrypted-store-test-helpers.js";
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -117,7 +116,7 @@ describe("managed Gemini embedding defaults (via loadConfig)", () => {
       }
     }
     ensureTestDir();
-    _setStorePath(join(WORKSPACE_DIR, "keys.enc"));
+    setStorePathForTesting(join(WORKSPACE_DIR, "keys.enc"));
     invalidateConfigCache();
 
     // Reset mock state
@@ -127,7 +126,7 @@ describe("managed Gemini embedding defaults (via loadConfig)", () => {
   });
 
   afterEach(() => {
-    _setStorePath(null);
+    setStorePathForTesting(null);
     invalidateConfigCache();
 
     // Restore IS_PLATFORM