@vellumai/assistant 0.8.6 → 0.8.7

package/src/__tests__/conversation-tool-setup-app-refresh.test.ts

@@ -14,6 +14,7 @@ import { beforeEach, describe, expect, mock, test } from "bun:test";
 
 import type { ToolSetupContext } from "../daemon/conversation-tool-setup.js";
 import type { SurfaceData, SurfaceType } from "../daemon/message-protocol.js";
+import { SYNC_TAGS } from "../daemon/message-types/sync.js";
 import type { PermissionPrompter } from "../permissions/prompter.js";
 import type { SecretPrompter } from "../permissions/secret-prompter.js";
 import type { ToolExecutor } from "../tools/executor.js";
@@ -71,6 +72,19 @@ import { createToolExecutor } from "../daemon/conversation-tool-setup.js";
 // Helpers
 // ---------------------------------------------------------------------------
 
+function broadcastPayloads(): unknown[] {
+  return (broadcastSpy.mock.calls as unknown[][]).map(([payload]) => payload);
+}
+
+function expectAppChangeBroadcast(appId: string): void {
+  expect(broadcastPayloads()).toEqual(
+    expect.arrayContaining([
+      { type: "app_files_changed", appId },
+      { type: "sync_changed", tags: [SYNC_TAGS.appsList] },
+    ]) as never,
+  );
+}
+
 /** Build a minimal ToolSetupContext stub. */
 function makeCtx(overrides: Partial<ToolSetupContext> = {}): ToolSetupContext {
   return {
@@ -167,11 +181,8 @@ describe("session-tool-setup app refresh side effects", () => {
 
       await toolFn("app_refresh", { app_id: "app-42" });
 
-      expect(broadcastSpy).toHaveBeenCalledTimes(1);
-      expect((broadcastSpy.mock.calls as unknown[][])[0][0]).toEqual({
-        type: "app_files_changed",
-        appId: "app-42",
-      });
+      expect(broadcastSpy).toHaveBeenCalledTimes(2);
+      expectAppChangeBroadcast("app-42");
     });
 
     test("calls updatePublishedAppDeployment", async () => {
@@ -262,6 +273,7 @@ describe("session-tool-setup app refresh side effects", () => {
         type: "app_files_changed",
         appId: "new-app-1",
       });
+      expectAppChangeBroadcast("new-app-1");
     });
 
     test("canonicalizes create_app skill_execute alias before hooks run", async () => {
@@ -293,6 +305,7 @@ describe("session-tool-setup app refresh side effects", () => {
         type: "app_files_changed",
         appId: "alias-app-1",
       });
+      expectAppChangeBroadcast("alias-app-1");
     });
 
     test("canonicalizes legacy computer_use_press_key skill_execute alias before dispatch", async () => {
@@ -403,6 +416,7 @@ describe("session-tool-setup app refresh side effects", () => {
         type: "app_files_changed",
         appId: "new-app-err",
       });
+      expectAppChangeBroadcast("new-app-err");
       expect(updatePublishedSpy).toHaveBeenCalledTimes(1);
     });
   });
@@ -424,11 +438,8 @@ describe("session-tool-setup app refresh side effects", () => {
 
       await toolFn("app_delete", { app_id: "del-app-1" });
 
-      expect(broadcastSpy).toHaveBeenCalledTimes(1);
-      expect((broadcastSpy.mock.calls as unknown[][])[0][0]).toEqual({
-        type: "app_files_changed",
-        appId: "del-app-1",
-      });
+      expect(broadcastSpy).toHaveBeenCalledTimes(2);
+      expectAppChangeBroadcast("del-app-1");
     });
 
     test("skips side effects when app_delete result is an error", async () => {
@@ -480,7 +491,8 @@ describe("session-tool-setup app refresh side effects", () => {
         });
 
         expect(refreshSpy).toHaveBeenCalledTimes(1);
-        expect(broadcastSpy).toHaveBeenCalledTimes(1);
+        expect(broadcastSpy).toHaveBeenCalledTimes(2);
+        expectAppChangeBroadcast("skill-app");
         expect(updatePublishedSpy).toHaveBeenCalledTimes(1);
       }
     });

package/src/__tests__/conversation-unread-route.test.ts

@@ -31,7 +31,19 @@ mock.module("../memory/conversation-key-store.js", () => ({
   resolveConversationId: (id: string) => id,
 }));
 
-import { getPolicy } from "../runtime/auth/route-policy.js";
+import { ROUTES } from "../runtime/routes/index.js";
+
+/**
+ * Look up the policy on a route by endpoint+method. Returns null when
+ * the route isn't found or has no policy declared — both surface as
+ * test failures via the explicit assertion below.
+ */
+function routePolicy(endpoint: string, method?: string) {
+  const route = ROUTES.find(
+    (r) => r.endpoint === endpoint && (!method || r.method === method),
+  );
+  return route?.policy ?? null;
+}
 import { RuntimeHttpServer } from "../runtime/http-server.js";
 import { UserError } from "../util/errors.js";
 
@@ -62,7 +74,7 @@ describe("POST /v1/conversations/unread", () => {
   }
 
   test("registers the unread route with chat.write policy", () => {
-    expect(getPolicy("conversations/unread")).toEqual({
+    expect(routePolicy("conversations/unread")).toEqual({
       requiredScopes: ["chat.write"],
       allowedPrincipalTypes: ["actor", "svc_gateway", "svc_daemon", "local"],
     });

package/src/__tests__/conversation-usage.test.ts

@@ -284,8 +284,6 @@ describe("recordUsage", () => {
 
     await wrapped.sendMessage(
       [{ role: "user", content: [{ type: "text", text: "Hello" }] }],
-      undefined,
-      undefined,
       {
         config: {
           callSite: "mainAgent",

package/src/__tests__/conversation-wipe.test.ts

@@ -94,7 +94,7 @@ describe("wipeConversation", () => {
 
   test("cancels pending memory jobs", async () => {
     const conv = createConversation("test");
-    await addMessage(conv.id, "user", "hello", undefined, {
+    await addMessage(conv.id, "user", "hello", {
       skipIndexing: true,
     });
 

package/src/__tests__/conversation-workspace-cache-state.test.ts

@@ -3,6 +3,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
+import { CompactionCircuit } from "../agent/compaction-circuit.js";
 import type { AgentEvent } from "../agent/loop.js";
 import { getConversationDirName } from "../memory/conversation-disk-view.js";
 import type { Message, ProviderResponse } from "../providers/types.js";
@@ -164,6 +165,7 @@ mock.module("../memory/app-store.js", () => ({
 
 mock.module("../agent/loop.js", () => ({
   AgentLoop: class {
+    compactionCircuit = new CompactionCircuit("test-conv");
     constructor() {}
     getToolTokenBudget() {
       return 0;
@@ -217,9 +219,9 @@ function makeConversation(workingDir = "/tmp"): Conversation {
     "conv-1",
     provider,
     "system prompt",
-    4096,
     () => {},
     workingDir,
+    { maxTokens: 4096 },
   );
 }
 

package/src/__tests__/conversation-workspace-injection.test.ts

@@ -1,6 +1,7 @@
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
-import type { AgentEvent } from "../agent/loop.js";
+import { CompactionCircuit } from "../agent/compaction-circuit.js";
+import type { AgentEvent, AgentLoopRunResult } from "../agent/loop.js";
 import type { Message, ProviderResponse } from "../providers/types.js";
 
 // ---------------------------------------------------------------------------
@@ -232,6 +233,7 @@ mock.module("../workspace/turn-commit.js", () => ({
 
 mock.module("../agent/loop.js", () => ({
   AgentLoop: class {
+    compactionCircuit = new CompactionCircuit("test-conv");
     constructor() {}
     getToolTokenBudget() {
       return 0;
@@ -245,7 +247,7 @@ mock.module("../agent/loop.js", () => ({
     async run(
       messages: Message[],
       onEvent: (event: AgentEvent) => void,
-    ): Promise<Message[]> {
+    ): Promise<AgentLoopRunResult> {
       // Prime the assistant row anchor — production code emits this from
       // `AgentLoop.run` just before `provider.sendMessage`.
       await onEvent({ type: "llm_call_started" });
@@ -263,7 +265,7 @@ mock.module("../agent/loop.js", () => ({
         content: [{ type: "text", text: "ok" }],
       };
       onEvent({ type: "message_complete", message: assistantMessage });
-      return [...messages, assistantMessage];
+      return { history: [...messages, assistantMessage], exitReason: null };
     }
   },
 }));
@@ -288,6 +290,7 @@ mock.module("../memory/canonical-guardian-store.js", () => ({
 }));
 
 import { Conversation } from "../daemon/conversation.js";
+import { resetPluginRegistryAndRegisterDefaults } from "../plugins/defaults/index.js";
 
 function makeConversation(): Conversation {
   const provider = {
@@ -305,9 +308,9 @@ function makeConversation(): Conversation {
     "conv-1",
     provider,
     "system prompt",
-    4096,
     () => {},
     "/tmp",
+    { maxTokens: 4096 },
   );
 }
 
@@ -327,13 +330,14 @@ describe("Conversation workspace injection", () => {
     runCalls = [];
     agentLoopScript = () => {};
     scanCallCount = 0;
+    resetPluginRegistryAndRegisterDefaults();
   });
 
   test("runtime messages include workspace top-level context", async () => {
     const conversation = makeConversation();
     await conversation.loadFromDb();
 
-    await conversation.processMessage("Hello", [], () => {});
+    await conversation.processMessage({ content: "Hello", attachments: [] });
 
     expect(runCalls).toHaveLength(1);
     const runtimeUser = runCalls[0][runCalls[0].length - 1];
@@ -347,7 +351,7 @@ describe("Conversation workspace injection", () => {
     const conversation = makeConversation();
     await conversation.loadFromDb();
 
-    await conversation.processMessage("Hello", [], () => {});
+    await conversation.processMessage({ content: "Hello", attachments: [] });
 
     expect(runCalls).toHaveLength(1);
     const runtimeUser = runCalls[0][runCalls[0].length - 1];
@@ -361,7 +365,7 @@ describe("Conversation workspace injection", () => {
     const conversation = makeConversation();
     await conversation.loadFromDb();
 
-    await conversation.processMessage("Hello", [], () => {});
+    await conversation.processMessage({ content: "Hello", attachments: [] });
 
     expect(runCalls).toHaveLength(1);
     const runtimeUser = runCalls[0][runCalls[0].length - 1];
@@ -375,7 +379,7 @@ describe("Conversation workspace injection", () => {
     const conversation = makeConversation();
     await conversation.loadFromDb();
 
-    await conversation.processMessage("Hello", [], () => {});
+    await conversation.processMessage({ content: "Hello", attachments: [] });
 
     // Workspace blocks use <workspace> tag which is intentionally NOT stripped.
     const persistedMessages = conversation.getMessages();
@@ -390,14 +394,17 @@ describe("Conversation workspace injection", () => {
     await conversation.loadFromDb();
 
     // First message — workspace is injected
-    await conversation.processMessage("Hello", [], () => {});
+    await conversation.processMessage({ content: "Hello", attachments: [] });
     expect(runCalls).toHaveLength(1);
     const firstCallUser = runCalls[0][runCalls[0].length - 1];
     const firstText = messageText(firstCallUser);
     expect(firstText).toContain("<workspace>");
 
     // Second message — workspace is NOT injected (not first message, no compaction)
-    await conversation.processMessage("Follow up", [], () => {});
+    await conversation.processMessage({
+      content: "Follow up",
+      attachments: [],
+    });
     expect(runCalls).toHaveLength(2);
     const secondCallUser = runCalls[1][runCalls[1].length - 1];
     const secondText = messageText(secondCallUser);
@@ -410,13 +417,14 @@ describe("Conversation workspace dirty-refresh E2E", () => {
     runCalls = [];
     agentLoopScript = () => {};
     scanCallCount = 0;
+    resetPluginRegistryAndRegisterDefaults();
   });
 
   test("first turn computes snapshot", async () => {
     const conversation = makeConversation();
     await conversation.loadFromDb();
 
-    await conversation.processMessage("Hello", [], () => {});
+    await conversation.processMessage({ content: "Hello", attachments: [] });
 
     expect(scanCallCount).toBe(1);
     const text = messageText(runCalls[0][runCalls[0].length - 1]);
@@ -427,10 +435,10 @@ describe("Conversation workspace dirty-refresh E2E", () => {
     const conversation = makeConversation();
     await conversation.loadFromDb();
 
-    await conversation.processMessage("Hello", [], () => {});
+    await conversation.processMessage({ content: "Hello", attachments: [] });
     const afterFirst = scanCallCount;
 
-    await conversation.processMessage("Again", [], () => {});
+    await conversation.processMessage({ content: "Again", attachments: [] });
 
     // Scanner should NOT have been called again
     expect(scanCallCount).toBe(afterFirst);
@@ -440,7 +448,7 @@ describe("Conversation workspace dirty-refresh E2E", () => {
     const conversation = makeConversation();
     await conversation.loadFromDb();
 
-    await conversation.processMessage("Hello", [], () => {});
+    await conversation.processMessage({ content: "Hello", attachments: [] });
     const afterFirst = scanCallCount;
 
     // Simulate a turn where the agent uses file_edit
@@ -453,7 +461,10 @@ describe("Conversation workspace dirty-refresh E2E", () => {
         isError: false,
       });
     };
-    await conversation.processMessage("Edit a file", [], () => {});
+    await conversation.processMessage({
+      content: "Edit a file",
+      attachments: [],
+    });
 
     // No rescan should happen during the mutation turn itself
     const afterMutation = scanCallCount;
@@ -461,7 +472,10 @@ describe("Conversation workspace dirty-refresh E2E", () => {
 
     // Next turn should trigger exactly one fresh scan
     agentLoopScript = () => {};
-    await conversation.processMessage("What happened?", [], () => {});
+    await conversation.processMessage({
+      content: "What happened?",
+      attachments: [],
+    });
 
     expect(scanCallCount).toBe(afterMutation + 1);
   });
@@ -470,7 +484,7 @@ describe("Conversation workspace dirty-refresh E2E", () => {
     const conversation = makeConversation();
     await conversation.loadFromDb();
 
-    await conversation.processMessage("Hello", [], () => {});
+    await conversation.processMessage({ content: "Hello", attachments: [] });
     const afterFirst = scanCallCount;
 
     agentLoopScript = (onEvent) => {
@@ -482,7 +496,10 @@ describe("Conversation workspace dirty-refresh E2E", () => {
         isError: false,
       });
     };
-    await conversation.processMessage("Run a command", [], () => {});
+    await conversation.processMessage({
+      content: "Run a command",
+      attachments: [],
+    });
 
     // No rescan should happen during the mutation turn itself
     const afterMutation = scanCallCount;
@@ -490,7 +507,10 @@ describe("Conversation workspace dirty-refresh E2E", () => {
 
     // Next turn should trigger exactly one fresh scan
     agentLoopScript = () => {};
-    await conversation.processMessage("What now?", [], () => {});
+    await conversation.processMessage({
+      content: "What now?",
+      attachments: [],
+    });
 
     expect(scanCallCount).toBe(afterMutation + 1);
   });
@@ -499,7 +519,7 @@ describe("Conversation workspace dirty-refresh E2E", () => {
     const conversation = makeConversation();
     await conversation.loadFromDb();
 
-    await conversation.processMessage("Hello", [], () => {});
+    await conversation.processMessage({ content: "Hello", attachments: [] });
     const afterFirst = scanCallCount;
 
     agentLoopScript = (onEvent) => {
@@ -511,10 +531,16 @@ describe("Conversation workspace dirty-refresh E2E", () => {
         isError: true,
       });
     };
-    await conversation.processMessage("Try editing", [], () => {});
+    await conversation.processMessage({
+      content: "Try editing",
+      attachments: [],
+    });
 
     agentLoopScript = () => {};
-    await conversation.processMessage("What happened?", [], () => {});
+    await conversation.processMessage({
+      content: "What happened?",
+      attachments: [],
+    });
 
     // Scanner should NOT have been re-called since the tool failed
     expect(scanCallCount).toBe(afterFirst);

package/src/__tests__/conversation-workspace-tool-tracking.test.ts

@@ -1,5 +1,6 @@
 import { beforeEach, describe, expect, mock, test } from "bun:test";
 
+import { CompactionCircuit } from "../agent/compaction-circuit.js";
 import type { AgentEvent } from "../agent/loop.js";
 import type { Message, ProviderResponse } from "../providers/types.js";
 
@@ -216,6 +217,7 @@ mock.module("../workspace/turn-commit.js", () => ({
 
 mock.module("../agent/loop.js", () => ({
   AgentLoop: class {
+    compactionCircuit = new CompactionCircuit("test-conv");
     constructor() {}
     getToolTokenBudget() {
       return 0;
@@ -288,9 +290,9 @@ function makeConversation(): Conversation {
     "conv-1",
     provider,
     "system prompt",
-    4096,
     () => {},
     "/tmp",
+    { maxTokens: 4096 },
   );
 }
 
@@ -326,7 +328,10 @@ describe("Conversation workspace dirty on file mutations", () => {
       });
     };
 
-    await conversation.processMessage("Write a file", [], () => {});
+    await conversation.processMessage({
+      content: "Write a file",
+      attachments: [],
+    });
     expect(conversation.isWorkspaceTopLevelDirty()).toBe(true);
   });
 
@@ -352,7 +357,10 @@ describe("Conversation workspace dirty on file mutations", () => {
       });
     };
 
-    await conversation.processMessage("Edit a file", [], () => {});
+    await conversation.processMessage({
+      content: "Edit a file",
+      attachments: [],
+    });
     expect(conversation.isWorkspaceTopLevelDirty()).toBe(true);
   });
 
@@ -380,7 +388,10 @@ describe("Conversation workspace dirty on file mutations", () => {
       });
     };
 
-    await conversation.processMessage("Write a file", [], () => {});
+    await conversation.processMessage({
+      content: "Write a file",
+      attachments: [],
+    });
     expect(conversation.isWorkspaceTopLevelDirty()).toBe(true);
   });
 
@@ -406,7 +417,10 @@ describe("Conversation workspace dirty on file mutations", () => {
       });
     };
 
-    await conversation.processMessage("Run a command", [], () => {});
+    await conversation.processMessage({
+      content: "Run a command",
+      attachments: [],
+    });
     expect(conversation.isWorkspaceTopLevelDirty()).toBe(true);
   });
 
@@ -432,7 +446,10 @@ describe("Conversation workspace dirty on file mutations", () => {
       });
     };
 
-    await conversation.processMessage("Run a command", [], () => {});
+    await conversation.processMessage({
+      content: "Run a command",
+      attachments: [],
+    });
     expect(conversation.isWorkspaceTopLevelDirty()).toBe(true);
   });
 
@@ -458,7 +475,10 @@ describe("Conversation workspace dirty on file mutations", () => {
       });
     };
 
-    await conversation.processMessage("Read a file", [], () => {});
+    await conversation.processMessage({
+      content: "Read a file",
+      attachments: [],
+    });
     expect(conversation.isWorkspaceTopLevelDirty()).toBe(false);
   });
 });

package/src/__tests__/credential-execution-tools.test.ts

@@ -5,7 +5,6 @@ import { makeAuthenticatedRequestTool } from "../tools/credential-execution/make
 import { manageSecureCommandTool } from "../tools/credential-execution/manage-secure-command-tool.js";
 import { runAuthenticatedCommandTool } from "../tools/credential-execution/run-authenticated-command.js";
 import { cesTools, getCesToolsIfEnabled } from "../tools/tool-manifest.js";
-import type { Tool } from "../tools/types.js";
 
 // ---------------------------------------------------------------------------
 // Schema shape tests
@@ -79,7 +78,7 @@ describe("CES tool schema shapes", () => {
 describe("CES tool manifest registration", () => {
   test("cesTools contains exactly three CES tools", () => {
     expect(cesTools).toHaveLength(3);
-    const names = cesTools.map((t: Tool) => t.name);
+    const names = cesTools.map((t) => t.name);
     expect(names).toContain("make_authenticated_request");
     expect(names).toContain("run_authenticated_command");
     expect(names).toContain("manage_secure_command_tool");

package/src/__tests__/credential-security-invariants.test.ts

@@ -171,7 +171,6 @@ describe("Invariant 2: no generic plaintext secret read API", () => {
       "daemon/handlers/config-telegram.ts", // Telegram bot token management
       "daemon/handlers/config-vercel.ts", // Vercel API token management
       "runtime/routes/integrations/twilio.ts", // Twilio credential management (HTTP control-plane)
-      "acp/prepare-agent-env.ts", // shared helper injects CLAUDE_CODE_OAUTH_TOKEN into claude-agent-acp subprocess env (called by route + skill tool spawn paths)
       "security/token-manager.ts", // OAuth token refresh flow
       "tools/network/script-proxy/session-manager.ts", // proxy credential injection at runtime
       "calls/call-domain.ts", // caller identity resolution (user phone number lookup)

package/src/__tests__/cross-provider-web-search.test.ts

@@ -366,7 +366,9 @@ describe("Cross-Provider Web Search — OpenAI (Responses API, native mode)", ()
       },
     ];
 
-    await provider.sendMessage([userMsg("Search for something")], tools);
+    await provider.sendMessage([userMsg("Search for something")], {
+      tools,
+    });
 
     const sentTools = lastOpenAIResponsesParams!.tools as Array<
       Record<string, unknown>
@@ -494,7 +496,9 @@ describe("Cross-Provider Web Search — Fireworks", () => {
       "accounts/fireworks/models/kimi-k2p6",
     );
 
-    await provider.sendMessage([userMsg("Search for something")], sampleTools);
+    await provider.sendMessage([userMsg("Search for something")], {
+      tools: sampleTools,
+    });
 
     const tools = lastOpenAIChatParams!.tools as Array<{
       type: string;

package/src/__tests__/cu-unified-flow.test.ts

@@ -438,7 +438,7 @@ describe("surfaceProxyResolver — CU tool routing", () => {
       });
 
       expect(result.isError).toBe(true);
-      expect(result.content).toContain("multiple clients support host_cu");
+      expect(result.content).toContain("Multiple host_cu clients");
       expect(result.content).toContain("target_client_id");
       // No message should have been dispatched
       expect(sentMessages).toHaveLength(0);
@@ -705,6 +705,31 @@ describe("surfaceProxyResolver — CU tool routing", () => {
       });
       await resultPromise;
     });
+
+    test("rejects untargeted CU dispatch when only another actor has a capable client", async () => {
+      sentMessages.length = 0;
+      mockHasClient = true;
+      mockCuClients = [
+        {
+          clientId: "cu-other",
+          capabilities: ["host_cu"],
+          actorPrincipalId: "user-other",
+        },
+      ];
+      proxy = new HostCuProxy();
+      const ctx = buildMockContext(proxy, DEFAULT_PRINCIPAL);
+
+      const result = await surfaceProxyResolver(ctx, "computer_use_click", {
+        element_id: 1,
+        reasoning: "click",
+      });
+
+      expect(result.isError).toBe(true);
+      expect(result.content).toContain("current actor");
+      // No step burned, no dispatch.
+      expect(proxy.stepCount).toBe(0);
+      expect(sentMessages).toHaveLength(0);
+    });
   });
 
   describe("step limit enforcement through resolver", () => {

package/src/__tests__/db-schedule-syntax-migration.test.ts

@@ -47,6 +47,7 @@ describe("schedule_syntax column migration", () => {
         reuse_conversation INTEGER NOT NULL DEFAULT 0,
         script TEXT,
         wake_conversation_id TEXT,
+        timeout_ms INTEGER,
         created_at INTEGER NOT NULL,
         updated_at INTEGER NOT NULL
       )
@@ -128,6 +129,11 @@ describe("schedule_syntax column migration", () => {
     } catch {
       /* already exists */
     }
+    try {
+      raw.exec(`ALTER TABLE cron_jobs ADD COLUMN timeout_ms INTEGER`);
+    } catch {
+      /* already exists */
+    }
 
     const row = db
       .select()
@@ -186,6 +192,11 @@ describe("schedule_syntax column migration", () => {
     } catch {
       /* ok */
     }
+    try {
+      raw.exec(`ALTER TABLE cron_jobs ADD COLUMN timeout_ms INTEGER`);
+    } catch {
+      /* ok */
+    }
 
     const now = Date.now();
     raw.exec(