@vellumai/assistant 0.8.5 → 0.8.7

package/src/__tests__/validate-input.test.ts

@@ -0,0 +1,381 @@
+import { describe, expect, test } from "bun:test";
+
+import { validateInputAgainstSchema } from "../skills/validate-input.js";
+
+// ---------------------------------------------------------------------------
+// required
+// ---------------------------------------------------------------------------
+
+describe("validateInputAgainstSchema — required", () => {
+  const schema = {
+    type: "object",
+    properties: {
+      surface_id: { type: "string" },
+      content: { type: "string" },
+      mode: { type: "string" },
+    },
+    required: ["surface_id", "content"],
+  };
+
+  test("succeeds when all required fields are present", () => {
+    const result = validateInputAgainstSchema(
+      "document_update",
+      { surface_id: "doc-1", content: "hi" },
+      schema,
+    );
+    expect(result).toEqual({ ok: true });
+  });
+
+  test("lists each missing required field individually", () => {
+    const result = validateInputAgainstSchema("document_update", {}, schema);
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.errors).toContain("surface_id is required");
+    expect(result.errors).toContain("content is required");
+  });
+
+  test("treats present-but-undefined keys as present (JSON Schema spec)", () => {
+    // JSON Schema `required` is presence-only — `{ surface_id: undefined }`
+    // still has `"surface_id" in input` === true. The type/null skip in step
+    // 2 covers the actual value handling.
+    const result = validateInputAgainstSchema(
+      "document_update",
+      { surface_id: undefined, content: undefined },
+      schema,
+    );
+    // No "required" errors since the keys are present.
+    if (!result.ok) {
+      expect(result.errors).not.toContain("surface_id is required");
+      expect(result.errors).not.toContain("content is required");
+    }
+  });
+
+  test("accepts explicit null for a required field (presence-only)", () => {
+    // JSON Schema `required` does NOT forbid null — that's a type concern.
+    // A custom/plugin schema with `type: ["string","null"]` would be valid;
+    // the type check (step 2) is what gates null values, not required (step 1).
+    const result = validateInputAgainstSchema(
+      "document_update",
+      { surface_id: "doc-1", content: null },
+      // Use a schema where `content` allows null via union, so type-check skips it.
+      {
+        type: "object",
+        properties: {
+          surface_id: { type: "string" },
+          content: { type: ["string", "null"] },
+          mode: { type: "string" },
+        },
+        required: ["surface_id", "content"],
+      },
+    );
+    expect(result).toEqual({ ok: true });
+  });
+
+  test("flags only truly absent keys, not explicit-undefined ones", () => {
+    const result = validateInputAgainstSchema("document_update", {}, schema);
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.errors).toContain("surface_id is required");
+    expect(result.errors).toContain("content is required");
+  });
+
+  test("empty input is allowed when nothing is required", () => {
+    const schemaNoRequired = {
+      type: "object",
+      properties: { query: { type: "string" } },
+    };
+    const result = validateInputAgainstSchema("noop", {}, schemaNoRequired);
+    expect(result).toEqual({ ok: true });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// type checks
+// ---------------------------------------------------------------------------
+
+describe("validateInputAgainstSchema — type checks", () => {
+  test.each([
+    ["string", "hello", true],
+    ["string", 5, false],
+    ["number", 3.14, true],
+    ["number", "3.14", false],
+    ["integer", 7, true],
+    ["integer", 7.5, false],
+    ["integer", "7", false],
+    ["boolean", true, true],
+    ["boolean", "true", false],
+    ["array", [1, 2], true],
+    ["array", { 0: 1 }, false],
+    ["object", { a: 1 }, true],
+    ["object", [1, 2], false],
+    ["object", null, false], // null is a present value and fails single-type check
+    ["string", null, false],
+    ["number", null, false],
+    ["integer", null, false],
+    ["boolean", null, false],
+    ["array", null, false],
+  ] as const)("type=%s, value=%p, valid=%p", (type, value, valid) => {
+    const result = validateInputAgainstSchema(
+      "t",
+      { field: value },
+      { type: "object", properties: { field: { type } } },
+    );
+    expect(result.ok).toBe(valid);
+    if (!valid) {
+      expect((result as { ok: false; errors: string[] }).errors[0]).toContain(
+        `field must be `,
+      );
+      expect((result as { ok: false; errors: string[] }).errors[0]).toContain(
+        type,
+      );
+    }
+  });
+});
+
+// ---------------------------------------------------------------------------
+// nullable / union-type handling (preserve plugin skills with nullable schemas)
+// ---------------------------------------------------------------------------
+
+describe("validateInputAgainstSchema — nullable / union types", () => {
+  test("skips type check when `type` is an array union (e.g. ['string','null'])", () => {
+    // Plugin / custom skills may declare `required: ["note"]` with
+    // `type: ["string", "null"]`. Per the spec, `null` is a valid value.
+    // We don't model union types, so we skip — never reject.
+    const schema = {
+      type: "object",
+      properties: {
+        note: { type: ["string", "null"] },
+      },
+      required: ["note"],
+    };
+    const nullResult = validateInputAgainstSchema("t", { note: null }, schema);
+    expect(nullResult).toEqual({ ok: true });
+
+    const stringResult = validateInputAgainstSchema(
+      "t",
+      { note: "hello" },
+      schema,
+    );
+    expect(stringResult).toEqual({ ok: true });
+  });
+
+  test("rejects null for single non-null type but presence-check still passes", () => {
+    // `type: "string"` does NOT allow null — the type check fires. Only
+    // union types (`["string","null"]`) bypass the single-type check. The
+    // `required` check is presence-only, so it does NOT fire for null.
+    const schema = {
+      type: "object",
+      properties: {
+        note: { type: "string" },
+      },
+      required: ["note"],
+    };
+    const result = validateInputAgainstSchema("t", { note: null }, schema);
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.errors).toContain("note must be a string");
+    expect(result.errors).not.toContain("note is required");
+  });
+
+  test("document_update({ content: null }) is rejected at the factory layer", () => {
+    // Codex's example: a tool call supplying `null` for a non-nullable string
+    // field should be rejected by the central validator, not passed through
+    // to the downstream tool/proxy.
+    const schema = {
+      type: "object",
+      properties: {
+        surface_id: { type: "string" },
+        content: { type: "string" },
+        mode: { type: "string" },
+      },
+      required: ["surface_id", "content"],
+    };
+    const result = validateInputAgainstSchema(
+      "document_update",
+      { surface_id: "x", content: null },
+      schema,
+    );
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.errors).toContain("content must be a string");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// enum
+// ---------------------------------------------------------------------------
+
+describe("validateInputAgainstSchema — enum", () => {
+  const schema = {
+    type: "object",
+    properties: {
+      mode: { type: "string", enum: ["replace", "append"] },
+    },
+  };
+
+  test("succeeds for a valid enum value", () => {
+    const result = validateInputAgainstSchema("t", { mode: "replace" }, schema);
+    expect(result).toEqual({ ok: true });
+  });
+
+  test("fails with the list of allowed values", () => {
+    const result = validateInputAgainstSchema("t", { mode: "bogus" }, schema);
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.errors).toContain('mode must be one of "replace", "append"');
+  });
+});
+
+// ---------------------------------------------------------------------------
+// array items
+// ---------------------------------------------------------------------------
+
+describe("validateInputAgainstSchema — array items", () => {
+  const schema = {
+    type: "object",
+    properties: {
+      tags: { type: "array", items: { type: "string" } },
+    },
+  };
+
+  test("succeeds when every element matches", () => {
+    const result = validateInputAgainstSchema(
+      "t",
+      { tags: ["a", "b"] },
+      schema,
+    );
+    expect(result).toEqual({ ok: true });
+  });
+
+  test("flags each element that violates the item type", () => {
+    const result = validateInputAgainstSchema(
+      "t",
+      { tags: ["a", 2, "c", false] },
+      schema,
+    );
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.errors).toContain("tags[1] must be a string");
+    expect(result.errors).toContain("tags[3] must be a string");
+    expect(result.errors).not.toContain("tags[0] must be a string");
+    expect(result.errors).not.toContain("tags[2] must be a string");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// unknown keys
+// ---------------------------------------------------------------------------
+
+describe("validateInputAgainstSchema — unknown keys", () => {
+  const schema = {
+    type: "object",
+    properties: {
+      surface_id: { type: "string" },
+      content: { type: "string" },
+      mode: { type: "string" },
+    },
+  };
+
+  test("flags a single unknown key with the supported list", () => {
+    const result = validateInputAgainstSchema(
+      "t",
+      { surface_id: "doc", content: "x", foo: 1 },
+      schema,
+    );
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    expect(result.errors).toContain(
+      'Unknown parameter "foo". Supported: "surface_id", "content", "mode"',
+    );
+  });
+
+  test("flags multiple unknown keys individually", () => {
+    const result = validateInputAgainstSchema("t", { foo: 1, bar: 2 }, schema);
+    expect(result.ok).toBe(false);
+    if (result.ok) return;
+    const unknownErrors = result.errors.filter((e) =>
+      e.startsWith("Unknown parameter"),
+    );
+    expect(unknownErrors).toHaveLength(2);
+    expect(unknownErrors.some((e) => e.includes('"foo"'))).toBe(true);
+    expect(unknownErrors.some((e) => e.includes('"bar"'))).toBe(true);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// permissive paths
+// ---------------------------------------------------------------------------
+
+describe("validateInputAgainstSchema — permissive paths", () => {
+  test("permits anything when schema is undefined", () => {
+    const result = validateInputAgainstSchema(
+      "t",
+      { whatever: "goes" },
+      undefined,
+    );
+    expect(result).toEqual({ ok: true });
+  });
+
+  test("permits anything when schema has no properties", () => {
+    const result = validateInputAgainstSchema(
+      "t",
+      { anything: 1 },
+      { type: "object" },
+    );
+    expect(result).toEqual({ ok: true });
+  });
+
+  test("does not throw when schema contains oneOf / $ref keywords", () => {
+    const schema = {
+      type: "object",
+      properties: {
+        field: {
+          $ref: "#/definitions/Thing",
+          oneOf: [{ type: "string" }, { type: "number" }],
+        },
+      },
+    };
+    let result: ReturnType<typeof validateInputAgainstSchema>;
+    expect(() => {
+      result = validateInputAgainstSchema("t", { field: "x" }, schema);
+    }).not.toThrow();
+    expect(result!.ok).toBe(true);
+  });
+
+  test("does not throw when top-level schema contains anyOf / allOf", () => {
+    const schema = {
+      type: "object",
+      properties: { field: { type: "string" } },
+      anyOf: [{ required: ["field"] }],
+      allOf: [{ type: "object" }],
+    };
+    expect(() =>
+      validateInputAgainstSchema("t", { field: "x" }, schema),
+    ).not.toThrow();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// purity
+// ---------------------------------------------------------------------------
+
+describe("validateInputAgainstSchema — purity", () => {
+  test("does not mutate the input or the schema", () => {
+    const input = { surface_id: "doc", content: "hi", extra: 1 };
+    const schema = {
+      type: "object",
+      properties: {
+        surface_id: { type: "string" },
+        content: { type: "string" },
+      },
+      required: ["surface_id"],
+    };
+    const inputSnapshot = JSON.parse(JSON.stringify(input));
+    const schemaSnapshot = JSON.parse(JSON.stringify(schema));
+
+    validateInputAgainstSchema("t", input, schema);
+
+    expect(input).toEqual(inputSnapshot);
+    expect(schema).toEqual(schemaSnapshot);
+  });
+});

package/src/__tests__/verification-control-plane-policy.test.ts

@@ -73,6 +73,7 @@ mock.module("../permissions/checker.js", () => ({
 
 mock.module("../memory/conversation-crud.js", () => ({
   createConversation: (title: string) => ({ id: "conversation-1", title }),
+  reserveMessage: mock(async () => ({ id: "msg-reserve" })),
 }));
 
 // Mock every export so downstream test files that dynamically import modules

package/src/__tests__/voice-scoped-grant-consumer.test.ts

@@ -56,6 +56,7 @@ mock.module("../runtime/assistant-event-hub.js", () => ({
   assistantEventHub: {
     publish: async () => {},
   },
+  broadcastMessage: async () => {},
 }));
 
 mock.module("../runtime/assistant-event.js", () => ({
@@ -137,24 +138,26 @@ function createMockSession(opts?: {
     setVoiceCallControlPrompt: () => {},
     currentRequestId: requestId,
     abort: () => {},
-    persistUserMessage: async () => "msg-1",
+    persistUserMessage: async () => ({ id: "msg-1", deduplicated: false }),
     updateClient: (cb: (msg: ServerMessage) => void, _reset?: boolean) => {
       clientCallback = cb;
     },
     handleConfirmationResponse: (
       reqId: string,
       decision: string,
-      _pattern?: string,
-      _scope?: string,
-      reason?: string,
+      options?: { decisionContext?: string },
     ) => {
-      confirmationDecision = { requestId: reqId, decision, reason };
+      confirmationDecision = {
+        requestId: reqId,
+        decision,
+        reason: options?.decisionContext,
+      };
     },
     handleSecretResponse: () => {},
     runAgentLoop: async (
       _content: string,
       _messageId: string,
-      broadcastFn: (msg: ServerMessage) => void,
+      options?: { onEvent?: (msg: ServerMessage) => void },
     ) => {
       // Emit a confirmation_request through the client callback
       if (clientCallback) {
@@ -169,7 +172,7 @@ function createMockSession(opts?: {
         } as ServerMessage);
       }
       // Then complete the turn
-      broadcastFn({ type: "message_complete" } as ServerMessage);
+      options?.onEvent?.({ type: "message_complete" } as ServerMessage);
     },
   };
 

package/src/__tests__/voice-session-bridge.test.ts

@@ -56,7 +56,10 @@ initializeDb();
 function makeStreamingSession(events: ServerMessage[]): Conversation {
   return {
     isProcessing: () => false,
-    persistUserMessage: () => undefined as unknown as string,
+    persistUserMessage: async () => ({
+      id: "test-msg-id",
+      deduplicated: false,
+    }),
     memoryPolicy: {
       scopeId: "default",
       includeDefaultFallback: false,
@@ -73,8 +76,9 @@ function makeStreamingSession(events: ServerMessage[]): Conversation {
     runAgentLoop: async (
       _content: string,
       _messageId: string,
-      onEvent: (msg: ServerMessage) => void,
+      options?: { onEvent?: (msg: ServerMessage) => void },
     ) => {
+      const onEvent = options?.onEvent ?? (() => {});
       for (const event of events) {
         onEvent(event);
       }
@@ -128,8 +132,9 @@ function makePersistingStreamingSession(
     runAgentLoop: async (
       _content: string,
       _messageId: string,
-      onEvent: (msg: ServerMessage) => void,
+      options?: { onEvent?: (msg: ServerMessage) => void },
     ) => {
+      const onEvent = options?.onEvent ?? (() => {});
       for (const event of events) {
         onEvent(event);
       }
@@ -262,13 +267,9 @@ describe("voice-session-bridge", () => {
     const session = {
       isProcessing: () => false,
       currentRequestId: undefined as string | undefined,
-      persistUserMessage: (
-        _content: string,
-        _attachments: unknown[],
-        requestId?: string,
-      ) => {
-        session.currentRequestId = requestId;
-        return undefined as unknown as string;
+      persistUserMessage: (options: { requestId?: string }) => {
+        session.currentRequestId = options.requestId;
+        return { id: "test-msg-id", deduplicated: false };
       },
       memoryPolicy: {
         scopeId: "default",
@@ -319,10 +320,12 @@ describe("voice-session-bridge", () => {
       runAgentLoop: async (
         _content: string,
         _messageId: string,
-        onEvent: (msg: ServerMessage) => void,
         options?: Record<string, unknown>,
       ) => {
         capturedOptions = options;
+        const onEvent =
+          (options as { onEvent?: (msg: ServerMessage) => void })?.onEvent ??
+          (() => {});
         for (const event of events) {
           onEvent(event);
         }
@@ -353,13 +356,9 @@ describe("voice-session-bridge", () => {
     const session = {
       isProcessing: () => false,
       currentRequestId: undefined as string | undefined,
-      persistUserMessage: (
-        _content: string,
-        _attachments: unknown[],
-        requestId?: string,
-      ) => {
-        session.currentRequestId = requestId;
-        return undefined as unknown as string;
+      persistUserMessage: (options: { requestId?: string }) => {
+        session.currentRequestId = options.requestId;
+        return { id: "test-msg-id", deduplicated: false };
       },
       memoryPolicy: {
         scopeId: "default",
@@ -732,7 +731,10 @@ describe("voice-session-bridge", () => {
 
     const session = {
       isProcessing: () => false,
-      persistUserMessage: () => undefined as unknown as string,
+      persistUserMessage: async () => ({
+        id: "test-msg-id",
+        deduplicated: false,
+      }),
       memoryPolicy: {
         scopeId: "default",
         includeDefaultFallback: false,
@@ -767,11 +769,13 @@ describe("voice-session-bridge", () => {
       handleConfirmationResponse: (
         requestId: string,
         decision: string,
-        _selectedPattern?: string,
-        _selectedScope?: string,
-        decisionContext?: string,
+        options?: { decisionContext?: string },
       ) => {
-        handleConfirmationCalls.push({ requestId, decision, decisionContext });
+        handleConfirmationCalls.push({
+          requestId,
+          decision,
+          decisionContext: options?.decisionContext,
+        });
       },
       abort: () => {},
     } as unknown as Conversation;
@@ -817,7 +821,10 @@ describe("voice-session-bridge", () => {
 
     const session = {
       isProcessing: () => false,
-      persistUserMessage: () => undefined as unknown as string,
+      persistUserMessage: async () => ({
+        id: "test-msg-id",
+        deduplicated: false,
+      }),
       memoryPolicy: {
         scopeId: "default",
         includeDefaultFallback: false,
@@ -885,7 +892,10 @@ describe("voice-session-bridge", () => {
 
     const session = {
       isProcessing: () => false,
-      persistUserMessage: () => undefined as unknown as string,
+      persistUserMessage: async () => ({
+        id: "test-msg-id",
+        deduplicated: false,
+      }),
       memoryPolicy: {
         scopeId: "default",
         includeDefaultFallback: false,
@@ -959,7 +969,10 @@ describe("voice-session-bridge", () => {
 
     const session = {
       isProcessing: () => false,
-      persistUserMessage: () => undefined as unknown as string,
+      persistUserMessage: async () => ({
+        id: "test-msg-id",
+        deduplicated: false,
+      }),
       memoryPolicy: {
         scopeId: "default",
         includeDefaultFallback: false,
@@ -1049,7 +1062,10 @@ describe("voice-session-bridge", () => {
 
     const session = {
       isProcessing: () => false,
-      persistUserMessage: () => undefined as unknown as string,
+      persistUserMessage: async () => ({
+        id: "test-msg-id",
+        deduplicated: false,
+      }),
       memoryPolicy: {
         scopeId: "default",
         includeDefaultFallback: false,
@@ -1122,7 +1138,10 @@ describe("voice-session-bridge", () => {
 
     const session = {
       isProcessing: () => false,
-      persistUserMessage: () => undefined as unknown as string,
+      persistUserMessage: async () => ({
+        id: "test-msg-id",
+        deduplicated: false,
+      }),
       memoryPolicy: {
         scopeId: "default",
         includeDefaultFallback: false,
@@ -1388,13 +1407,9 @@ describe("voice-session-bridge", () => {
     const session = {
       isProcessing: () => false,
       currentRequestId: undefined as string | undefined,
-      persistUserMessage: (
-        _content: string,
-        _attachments: unknown[],
-        requestId?: string,
-      ) => {
-        session.currentRequestId = requestId;
-        return undefined as unknown as string;
+      persistUserMessage: (options: { requestId?: string }) => {
+        session.currentRequestId = options.requestId;
+        return { id: "test-msg-id", deduplicated: false };
       },
       memoryPolicy: {
         scopeId: "default",