@vellumai/assistant 0.8.5 → 0.8.7

package/src/__tests__/credential-health-service.test.ts

@@ -12,6 +12,7 @@ let mockProviders: Array<{
   pingMethod: string | null;
   pingHeaders: string | null;
   pingBody: string | null;
+  managedServiceConfigKey?: string;
 }> = [];
 
 let mockConnections: Map<
@@ -33,6 +34,24 @@ let mockFetchResponse: { ok: boolean; status: number } = {
 };
 let mockFetchThrows = false;
 
+// Per-test refresh outcome — drives the withValidToken mock.
+//   "ok"          → refresh succeeds (or wasn't needed); callback runs with token
+//   "refresh_failed" → refresh throws TokenExpiredError (revoked refresh token)
+type RefreshOutcome = "ok" | "refresh_failed";
+let mockRefreshOutcome: RefreshOutcome = "ok";
+
+// Managed-path mock state.
+const managedProviders = new Set<string>();
+let managedListResponse: {
+  ok: boolean;
+  status: number;
+  body?: unknown;
+} = { ok: true, status: 200, body: { results: [] } };
+let managedPingOutcome:
+  | { kind: "status"; status: number }
+  | { kind: "credential_required" }
+  | { kind: "throw"; message: string } = { kind: "status", status: 200 };
+
 // ── Module mocks ─────────────────────────────────────────────────────
 
 mock.module("../security/secure-keys.js", () => ({
@@ -81,6 +100,88 @@ mock.module("../util/logger.js", () => ({
   }),
 }));
 
+class MockTokenExpiredError extends Error {
+  constructor(service: string, message?: string) {
+    super(message ?? `Token expired for "${service}"`);
+    this.name = "TokenExpiredError";
+  }
+}
+
+mock.module("../security/token-manager.js", () => ({
+  TokenExpiredError: MockTokenExpiredError,
+  withValidToken: async (
+    service: string,
+    callback: (token: string) => Promise<unknown>,
+    opts: { connectionId: string },
+  ) => {
+    if (mockRefreshOutcome === "refresh_failed") {
+      throw new MockTokenExpiredError(service);
+    }
+    const token =
+      secureKeyValues.get(
+        `oauth_connection/${opts.connectionId}/access_token`,
+      ) ?? "refreshed-token";
+    return callback(token);
+  },
+}));
+
+// Managed-path mocks: services schema, config loader, platform client,
+// PlatformOAuthConnection. The managed code path uses dynamic imports for
+// these so they only matter when a managed test scenario is exercised.
+mock.module("../config/schemas/services.js", () => ({
+  ServicesSchema: {
+    shape: {
+      "google-oauth": {},
+      "notion-oauth": {},
+    },
+  },
+  getServiceMode: (_services: unknown, key: string) =>
+    managedProviders.has(key) ? "managed" : "your-own",
+}));
+
+mock.module("../config/loader.js", () => ({
+  getConfig: () => ({ services: {} }),
+}));
+
+mock.module("../platform/client.js", () => ({
+  VellumPlatformClient: {
+    create: async () => ({
+      platformAssistantId: "test-assistant",
+      fetch: async (_path: string) => ({
+        ok: managedListResponse.ok,
+        status: managedListResponse.status,
+        json: async () => managedListResponse.body ?? { results: [] },
+      }),
+    }),
+  },
+}));
+
+class MockCredentialRequiredError extends Error {
+  constructor() {
+    super("credential required");
+    this.name = "CredentialRequiredError";
+  }
+}
+
+mock.module("../oauth/platform-connection.js", () => ({
+  PlatformOAuthConnection: class {
+    constructor(_opts: unknown) {}
+    async request(_req: unknown) {
+      if (managedPingOutcome.kind === "credential_required") {
+        throw new MockCredentialRequiredError();
+      }
+      if (managedPingOutcome.kind === "throw") {
+        throw new Error(managedPingOutcome.message);
+      }
+      return {
+        status: managedPingOutcome.status,
+        headers: {},
+        body: {},
+      };
+    }
+  },
+}));
+
 // ── Import under test ────────────────────────────────────────────────
 
 const { checkAllCredentials, checkCredentialForProvider, _setFetchFn } =
@@ -106,6 +207,7 @@ function addProvider(
     defaultScopes?: string[];
     pingUrl?: string | null;
     pingMethod?: string | null;
+    managedServiceConfigKey?: string;
   },
 ) {
   mockProviders.push({
@@ -115,6 +217,10 @@ function addProvider(
     pingMethod: opts?.pingMethod ?? null,
     pingHeaders: null,
     pingBody: null,
+    // checkManagedProvider reads this field via OAuthProviderRow; the
+    // health-check code branches to the managed path only when set AND
+    // when managedProviders includes the corresponding config key.
+    managedServiceConfigKey: opts?.managedServiceConfigKey,
   });
 }
 
@@ -159,6 +265,10 @@ describe("credential-health-service", () => {
     mockConnections = new Map();
     mockFetchResponse = { ok: true, status: 200 };
     mockFetchThrows = false;
+    mockRefreshOutcome = "ok";
+    managedProviders.clear();
+    managedListResponse = { ok: true, status: 200, body: { results: [] } };
+    managedPingOutcome = { kind: "status", status: 200 };
   });
 
   test("returns empty report when no providers exist", async () => {
@@ -238,8 +348,12 @@ describe("credential-health-service", () => {
     expect(report.results[0]!.canAutoRecover).toBe(false);
   });
 
-  test("returns expiring when token is past expiresAt with refresh token", async () => {
-    addProvider("google");
+  test("returns healthy when expired token has a refresh token, no ping URL, and refresh succeeds via the ping path", async () => {
+    // Without a pingUrl there's no opportunity to exercise the refresh —
+    // the connection is reported as healthy on the trust that the next
+    // real API call will refresh transparently. This matches the contract
+    // for connections that have a refresh token but no liveness endpoint.
+    addProvider("google"); // no pingUrl
     addConnection("google", "conn-1", {
       expiresAt: Date.now() - 60_000, // 1 minute ago
       hasRefreshToken: true,
@@ -247,10 +361,61 @@ describe("credential-health-service", () => {
     setToken("conn-1");
 
     const report = await checkAllCredentials();
-    expect(report.results[0]!.status).toBe("expiring");
+    expect(report.results[0]!.status).toBe("healthy");
     expect(report.results[0]!.canAutoRecover).toBe(true);
   });
 
+  test("expired BYO token + successful refresh + 200 ping → healthy", async () => {
+    // The withValidToken mock returns "refreshed" by default; pingProvider
+    // sees a fresh token and the upstream returns 200.
+    mockFetchResponse = { ok: true, status: 200 };
+    addProvider("google", {
+      pingUrl: "https://www.googleapis.com/oauth2/v2/userinfo",
+    });
+    addConnection("google", "conn-1", {
+      expiresAt: Date.now() - 60_000,
+      hasRefreshToken: true,
+    });
+    setToken("conn-1");
+
+    const report = await checkAllCredentials();
+    expect(report.results[0]!.status).toBe("healthy");
+  });
+
+  test("expired BYO token + refresh fails (revoked refresh token) → revoked", async () => {
+    mockRefreshOutcome = "refresh_failed";
+    addProvider("google", {
+      pingUrl: "https://www.googleapis.com/oauth2/v2/userinfo",
+    });
+    addConnection("google", "conn-1", {
+      expiresAt: Date.now() - 60_000,
+      hasRefreshToken: true,
+    });
+    setToken("conn-1");
+
+    const report = await checkAllCredentials();
+    expect(report.results[0]!.status).toBe("revoked");
+    expect(report.results[0]!.canAutoRecover).toBe(false);
+  });
+
+  test("BYO ping that still returns 401 after a refresh attempt → revoked", async () => {
+    // Refresh succeeds (mockRefreshOutcome stays "ok") but the upstream
+    // still returns 401 — the token was genuinely revoked by the provider.
+    mockFetchResponse = { ok: false, status: 401 };
+    addProvider("google", {
+      pingUrl: "https://www.googleapis.com/oauth2/v2/userinfo",
+    });
+    addConnection("google", "conn-1", {
+      expiresAt: Date.now() + 30 * 24 * 60 * 60 * 1000,
+      hasRefreshToken: true,
+    });
+    setToken("conn-1");
+
+    const report = await checkAllCredentials();
+    expect(report.results[0]!.status).toBe("revoked");
+    expect(report.results[0]!.details).toContain("after a refresh attempt");
+  });
+
   test("returns expiring when token expires within 7 days without refresh token", async () => {
     addProvider("google");
     addConnection("google", "conn-1", {
@@ -459,6 +624,90 @@ describe("credential-health-service", () => {
     });
   });
 
+  describe("managed-provider path", () => {
+    // Distinguishing managed-path failure modes: a 424 from the platform
+    // proxy (CredentialRequiredError) means the platform tried and gave up
+    // on refresh — actionable, fire reconnect alert. A bare 401/403 from
+    // the upstream provider could be a transient platform-side miss (proxy
+    // didn't refresh-before-forward) and should NOT fire reconnect alerts
+    // without further evidence — demote to ping_failed.
+
+    function setupManagedGoogle(opts?: { hasActiveConnection?: boolean }) {
+      addProvider("google", {
+        pingUrl: "https://www.googleapis.com/oauth2/v2/userinfo",
+        managedServiceConfigKey: "google-oauth",
+      });
+      managedProviders.add("google-oauth");
+      if (opts?.hasActiveConnection !== false) {
+        managedListResponse = {
+          ok: true,
+          status: 200,
+          body: {
+            results: [
+              {
+                id: "platform-conn-1",
+                account_label: "user@example.com",
+                status: "ACTIVE",
+              },
+            ],
+          },
+        };
+      }
+    }
+
+    test("managed 2xx ping → healthy", async () => {
+      setupManagedGoogle();
+      managedPingOutcome = { kind: "status", status: 200 };
+
+      const report = await checkAllCredentials();
+      const google = report.results.find((r) => r.provider === "google");
+      expect(google!.status).toBe("healthy");
+    });
+
+    test("managed 424 (CredentialRequiredError) → revoked", async () => {
+      setupManagedGoogle();
+      managedPingOutcome = { kind: "credential_required" };
+
+      const report = await checkAllCredentials();
+      const google = report.results.find((r) => r.provider === "google");
+      expect(google!.status).toBe("revoked");
+      expect(google!.canAutoRecover).toBe(false);
+      expect(google!.details).toContain("cannot be refreshed");
+    });
+
+    test("managed 401 from upstream → ping_failed, not revoked", async () => {
+      // This is the key change: previously this would fire a user-facing
+      // reconnect alert (because "revoked" is in hardFailureStatuses). Now
+      // we treat upstream 401 as potentially transient — only a 424 from
+      // the platform proxy is trusted enough to trigger the alert.
+      setupManagedGoogle();
+      managedPingOutcome = { kind: "status", status: 401 };
+
+      const report = await checkAllCredentials();
+      const google = report.results.find((r) => r.provider === "google");
+      expect(google!.status).toBe("ping_failed");
+      expect(google!.status).not.toBe("revoked");
+    });
+
+    test("managed 403 from upstream → ping_failed, not revoked", async () => {
+      setupManagedGoogle();
+      managedPingOutcome = { kind: "status", status: 403 };
+
+      const report = await checkAllCredentials();
+      const google = report.results.find((r) => r.provider === "google");
+      expect(google!.status).toBe("ping_failed");
+    });
+
+    test("managed 500 from upstream → ping_failed", async () => {
+      setupManagedGoogle();
+      managedPingOutcome = { kind: "status", status: 500 };
+
+      const report = await checkAllCredentials();
+      const google = report.results.find((r) => r.provider === "google");
+      expect(google!.status).toBe("ping_failed");
+    });
+  });
+
   describe("checkCredentialForProvider", () => {
     test("returns null when no connections exist", async () => {
       const result = await checkCredentialForProvider("google");

package/src/__tests__/credential-security-invariants.test.ts

@@ -41,8 +41,8 @@ afterAll(() => {
   mock.restore();
 });
 
-import { _setStorePath } from "../security/encrypted-store.js";
 import { _resetBackend } from "../security/secure-keys.js";
+import { setStorePathForTesting } from "./encrypted-store-test-helpers.js";
 
 const TEST_DIR = join(
   tmpdir(),
@@ -171,7 +171,6 @@ describe("Invariant 2: no generic plaintext secret read API", () => {
       "daemon/handlers/config-telegram.ts", // Telegram bot token management
       "daemon/handlers/config-vercel.ts", // Vercel API token management
       "runtime/routes/integrations/twilio.ts", // Twilio credential management (HTTP control-plane)
-      "acp/prepare-agent-env.ts", // shared helper injects CLAUDE_CODE_OAUTH_TOKEN into claude-agent-acp subprocess env (called by route + skill tool spawn paths)
       "security/token-manager.ts", // OAuth token refresh flow
       "tools/network/script-proxy/session-manager.ts", // proxy credential injection at runtime
       "calls/call-domain.ts", // caller identity resolution (user phone number lookup)
@@ -409,7 +408,7 @@ describe("Invariant 4: credentials only used for allowed purpose", () => {
 
   beforeEach(() => {
     mkdirSync(TEST_DIR, { recursive: true });
-    _setStorePath(STORE_PATH);
+    setStorePathForTesting(STORE_PATH);
     _resetBackend();
     _setMetadataPath(join(TEST_DIR, "metadata.json"));
     broker = new CredentialBroker();
@@ -417,7 +416,7 @@ describe("Invariant 4: credentials only used for allowed purpose", () => {
 
   afterEach(() => {
     _setMetadataPath(null);
-    _setStorePath(null);
+    setStorePathForTesting(null);
     _resetBackend();
     rmSync(TEST_DIR, { recursive: true, force: true });
   });
@@ -497,14 +496,14 @@ describe("Invariant 4: credentials only used for allowed purpose", () => {
 describe("Invariant 6: oauth2ClientSecret not in metadata, only in secure store", () => {
   beforeEach(() => {
     mkdirSync(TEST_DIR, { recursive: true });
-    _setStorePath(STORE_PATH);
+    setStorePathForTesting(STORE_PATH);
     _resetBackend();
     _setMetadataPath(join(TEST_DIR, "metadata.json"));
   });
 
   afterEach(() => {
     _setMetadataPath(null);
-    _setStorePath(null);
+    setStorePathForTesting(null);
     _resetBackend();
     rmSync(TEST_DIR, { recursive: true, force: true });
   });

package/src/__tests__/credential-vault-unit.test.ts

@@ -27,8 +27,8 @@ mock.module("../util/logger.js", () => ({
 // Use encrypted backend with a temp store path
 // ---------------------------------------------------------------------------
 
-import { _setStorePath } from "../security/encrypted-store.js";
 import { _resetBackend } from "../security/secure-keys.js";
+import { setStorePathForTesting } from "./encrypted-store-test-helpers.js";
 
 const TEST_DIR = join(
   tmpdir(),
@@ -280,7 +280,7 @@ describe("CredentialBroker transient credentials", () => {
   beforeEach(() => {
     if (existsSync(TEST_DIR)) rmSync(TEST_DIR, { recursive: true });
     mkdirSync(TEST_DIR, { recursive: true });
-    _setStorePath(STORE_PATH);
+    setStorePathForTesting(STORE_PATH);
     _resetBackend();
     _setMetadataPath(join(TEST_DIR, "metadata.json"));
     broker = new CredentialBroker();
@@ -288,7 +288,7 @@ describe("CredentialBroker transient credentials", () => {
 
   afterEach(() => {
     _setMetadataPath(null);
-    _setStorePath(null);
+    setStorePathForTesting(null);
     _resetBackend();
   });
 
@@ -504,14 +504,14 @@ describe("credential_store tool — unknown action", () => {
   beforeEach(() => {
     if (existsSync(TEST_DIR)) rmSync(TEST_DIR, { recursive: true });
     mkdirSync(TEST_DIR, { recursive: true });
-    _setStorePath(STORE_PATH);
+    setStorePathForTesting(STORE_PATH);
     _resetBackend();
     _setMetadataPath(join(TEST_DIR, "metadata.json"));
   });
 
   afterEach(() => {
     _setMetadataPath(null);
-    _setStorePath(null);
+    setStorePathForTesting(null);
     _resetBackend();
   });
 
@@ -534,14 +534,14 @@ describe("credential_store tool — prompt action", () => {
   beforeEach(() => {
     if (existsSync(TEST_DIR)) rmSync(TEST_DIR, { recursive: true });
     mkdirSync(TEST_DIR, { recursive: true });
-    _setStorePath(STORE_PATH);
+    setStorePathForTesting(STORE_PATH);
     _resetBackend();
     _setMetadataPath(join(TEST_DIR, "metadata.json"));
   });
 
   afterEach(() => {
     _setMetadataPath(null);
-    _setStorePath(null);
+    setStorePathForTesting(null);
     _resetBackend();
   });
 
@@ -845,14 +845,14 @@ describe("credential_store tool — slack_channel store routing", () => {
   beforeEach(() => {
     if (existsSync(TEST_DIR)) rmSync(TEST_DIR, { recursive: true });
     mkdirSync(TEST_DIR, { recursive: true });
-    _setStorePath(STORE_PATH);
+    setStorePathForTesting(STORE_PATH);
     _resetBackend();
     _setMetadataPath(join(TEST_DIR, "metadata.json"));
   });
 
   afterEach(() => {
     _setMetadataPath(null);
-    _setStorePath(null);
+    setStorePathForTesting(null);
     _resetBackend();
   });
 
@@ -956,14 +956,14 @@ describe("credential_store tool — store validation edge cases", () => {
   beforeEach(() => {
     if (existsSync(TEST_DIR)) rmSync(TEST_DIR, { recursive: true });
     mkdirSync(TEST_DIR, { recursive: true });
-    _setStorePath(STORE_PATH);
+    setStorePathForTesting(STORE_PATH);
     _resetBackend();
     _setMetadataPath(join(TEST_DIR, "metadata.json"));
   });
 
   afterEach(() => {
     _setMetadataPath(null);
-    _setStorePath(null);
+    setStorePathForTesting(null);
     _resetBackend();
   });
 
@@ -1124,14 +1124,14 @@ describe("credential_store tool — slack_channel delete routing", () => {
   beforeEach(() => {
     if (existsSync(TEST_DIR)) rmSync(TEST_DIR, { recursive: true });
     mkdirSync(TEST_DIR, { recursive: true });
-    _setStorePath(STORE_PATH);
+    setStorePathForTesting(STORE_PATH);
     _resetBackend();
     _setMetadataPath(join(TEST_DIR, "metadata.json"));
   });
 
   afterEach(() => {
     _setMetadataPath(null);
-    _setStorePath(null);
+    setStorePathForTesting(null);
     _resetBackend();
   });
 
@@ -1304,7 +1304,7 @@ describe("CredentialBroker — serverUseById edge cases", () => {
   beforeEach(() => {
     if (existsSync(TEST_DIR)) rmSync(TEST_DIR, { recursive: true });
     mkdirSync(TEST_DIR, { recursive: true });
-    _setStorePath(STORE_PATH);
+    setStorePathForTesting(STORE_PATH);
     _resetBackend();
     _setMetadataPath(join(TEST_DIR, "metadata.json"));
     broker = new CredentialBroker();
@@ -1312,7 +1312,7 @@ describe("CredentialBroker — serverUseById edge cases", () => {
 
   afterEach(() => {
     _setMetadataPath(null);
-    _setStorePath(null);
+    setStorePathForTesting(null);
     _resetBackend();
   });
 
@@ -1376,7 +1376,7 @@ describe("CredentialBroker — revokeAll", () => {
   beforeEach(() => {
     if (existsSync(TEST_DIR)) rmSync(TEST_DIR, { recursive: true });
     mkdirSync(TEST_DIR, { recursive: true });
-    _setStorePath(STORE_PATH);
+    setStorePathForTesting(STORE_PATH);
     _resetBackend();
     _setMetadataPath(join(TEST_DIR, "metadata.json"));
     broker = new CredentialBroker();
@@ -1384,7 +1384,7 @@ describe("CredentialBroker — revokeAll", () => {
 
   afterEach(() => {
     _setMetadataPath(null);
-    _setStorePath(null);
+    setStorePathForTesting(null);
     _resetBackend();
   });
 
@@ -1432,7 +1432,7 @@ describe("CredentialBroker — canonical capability key", () => {
   beforeEach(() => {
     if (existsSync(TEST_DIR)) rmSync(TEST_DIR, { recursive: true });
     mkdirSync(TEST_DIR, { recursive: true });
-    _setStorePath(STORE_PATH);
+    setStorePathForTesting(STORE_PATH);
     _resetBackend();
     _setMetadataPath(join(TEST_DIR, "metadata.json"));
     broker = new CredentialBroker();
@@ -1440,7 +1440,7 @@ describe("CredentialBroker — canonical capability key", () => {
 
   afterEach(() => {
     _setMetadataPath(null);
-    _setStorePath(null);
+    setStorePathForTesting(null);
     _resetBackend();
   });
 

package/src/__tests__/credential-vault.test.ts

@@ -28,8 +28,8 @@ mock.module("../util/logger.js", () => ({
 // Use encrypted backend with a temp store path
 // ---------------------------------------------------------------------------
 
-import { _setStorePath } from "../security/encrypted-store.js";
 import { _resetBackend } from "../security/secure-keys.js";
+import { setStorePathForTesting } from "./encrypted-store-test-helpers.js";
 
 const TEST_DIR = join(
   tmpdir(),
@@ -282,7 +282,7 @@ describe("credential_store tool", () => {
     for (const entry of readdirSync(TEST_DIR)) {
       rmSync(join(TEST_DIR, entry), { recursive: true, force: true });
     }
-    _setStorePath(STORE_PATH);
+    setStorePathForTesting(STORE_PATH);
     _setMetadataPath(join(TEST_DIR, "metadata.json"));
     mockDisconnectOAuthProvider.mockClear();
     mockConnections.clear();
@@ -290,7 +290,7 @@ describe("credential_store tool", () => {
 
   afterEach(() => {
     _setMetadataPath(null);
-    _setStorePath(null);
+    setStorePathForTesting(null);
     _resetBackend();
     mockConnections.clear();
   });
@@ -1282,7 +1282,7 @@ describe("withValidToken refresh deduplication", () => {
     for (const entry of readdirSync(TEST_DIR)) {
       rmSync(join(TEST_DIR, entry), { recursive: true, force: true });
     }
-    _setStorePath(STORE_PATH);
+    setStorePathForTesting(STORE_PATH);
     _setMetadataPath(join(TEST_DIR, "metadata.json"));
     _resetRefreshBreakers();
     _resetInflightRefreshes();
@@ -1295,7 +1295,7 @@ describe("withValidToken refresh deduplication", () => {
 
   afterEach(() => {
     _setMetadataPath(null);
-    _setStorePath(null);
+    setStorePathForTesting(null);
     _resetBackend();
     _resetRefreshBreakers();
     _resetInflightRefreshes();

package/src/__tests__/cross-provider-web-search.test.ts

@@ -1,6 +1,10 @@
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
-import type { ContentBlock, Message } from "../providers/types.js";
+import type {
+  ContentBlock,
+  Message,
+  ToolDefinition,
+} from "../providers/types.js";
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -85,6 +89,22 @@ function webSearchResultOnlyMessage(): Message[] {
   ];
 }
 
+const sampleTools: ToolDefinition[] = [
+  {
+    name: "file_read",
+    description: "Read a file",
+    input_schema: { type: "object", properties: { path: { type: "string" } } },
+  },
+  {
+    name: "web_search",
+    description: "Search the web",
+    input_schema: {
+      type: "object",
+      properties: { query: { type: "string" } },
+    },
+  },
+];
+
 // ---------------------------------------------------------------------------
 // Mock OpenAI SDK
 // ---------------------------------------------------------------------------
@@ -128,7 +148,7 @@ mock.module("openai", () => {
         },
       };
       responses = {
-        stream: (params: Record<string, unknown>) => {
+        create: async (params: Record<string, unknown>) => {
           lastOpenAIResponsesParams = JSON.parse(JSON.stringify(params));
           return (async function* () {
             yield {
@@ -194,6 +214,7 @@ mock.module("@google/genai", () => {
 });
 
 // Import providers after mocking
+import { FireworksProvider } from "../providers/fireworks/client.js";
 import { GeminiProvider } from "../providers/gemini/client.js";
 import {
   OpenAIChatCompletionsProvider,
@@ -345,7 +366,9 @@ describe("Cross-Provider Web Search — OpenAI (Responses API, native mode)", ()
       },
     ];
 
-    await provider.sendMessage([userMsg("Search for something")], tools);
+    await provider.sendMessage([userMsg("Search for something")], {
+      tools,
+    });
 
     const sentTools = lastOpenAIResponsesParams!.tools as Array<
       Record<string, unknown>
@@ -458,6 +481,41 @@ describe("Cross-Provider Web Search — OpenAI Chat Completions (compatibility)"
   });
 });
 
+// ---------------------------------------------------------------------------
+// Fireworks provider tests
+// ---------------------------------------------------------------------------
+
+describe("Cross-Provider Web Search — Fireworks", () => {
+  beforeEach(() => {
+    lastOpenAIChatParams = null;
+  });
+
+  test("keeps web_search as an app-executed function tool for managed Brave fallback", async () => {
+    const provider = new FireworksProvider(
+      "fw-test",
+      "accounts/fireworks/models/kimi-k2p6",
+    );
+
+    await provider.sendMessage([userMsg("Search for something")], {
+      tools: sampleTools,
+    });
+
+    const tools = lastOpenAIChatParams!.tools as Array<{
+      type: string;
+      function: { name: string; description?: string };
+    }>;
+
+    expect(tools).toHaveLength(2);
+    expect(tools[1]).toMatchObject({
+      type: "function",
+      function: {
+        name: "web_search",
+        description: "Search the web",
+      },
+    });
+  });
+});
+
 // ---------------------------------------------------------------------------
 // Gemini provider tests
 // ---------------------------------------------------------------------------