@vellumai/assistant 0.8.7 → 0.8.8-dev.202606052332.17fc8ea

package/src/__tests__/cross-provider-web-search.test.ts

@@ -1,4 +1,4 @@
-import { beforeEach, describe, expect, mock, test } from "bun:test";
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 
 import type {
   ContentBlock,
@@ -221,6 +221,64 @@ import {
   OpenAIResponsesProvider,
 } from "../providers/openai/client.js";
 
+// ---------------------------------------------------------------------------
+// App-side web_search provider adapters (Brave/Perplexity/Tavily)
+//
+// Exercise the real `web-search.ts` execute path with a mocked config, provider
+// key, and global fetch. The logger is mocked to capture structured warnings so
+// we can assert the `web_search_backend_failure` telemetry (ATL-727).
+// ---------------------------------------------------------------------------
+
+let mockWebSearchProvider: string = "brave";
+let mockProviderKey: string | undefined = "test-key";
+const capturedWarnLogs: Record<string, unknown>[] = [];
+
+const realConfigLoader = await import("../config/loader.js");
+mock.module("../config/loader.js", () => ({
+  ...realConfigLoader,
+  getConfig: () => ({
+    services: { "web-search": { provider: mockWebSearchProvider } },
+  }),
+}));
+
+const realSecureKeys = await import("../security/secure-keys.js");
+mock.module("../security/secure-keys.js", () => ({
+  ...realSecureKeys,
+  getProviderKeyAsync: async () => mockProviderKey,
+}));
+
+const realLogger = await import("../util/logger.js");
+mock.module("../util/logger.js", () => ({
+  ...realLogger,
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: (_target, prop) => {
+        if (prop === "warn") {
+          return (obj: Record<string, unknown>) => {
+            capturedWarnLogs.push(obj);
+          };
+        }
+        return () => {};
+      },
+    }),
+}));
+
+const { webSearchTool } = await import("../tools/network/web-search.js");
+const { WEB_SEARCH_BACKEND_FAILURE_MESSAGE } = await import(
+  "../tools/network/web-search-error.js"
+);
+
+function executeWebSearch(input: Record<string, unknown>) {
+  return webSearchTool.execute(input, {} as never);
+}
+
+function executeWebSearchWithSignal(
+  input: Record<string, unknown>,
+  signal: AbortSignal,
+) {
+  return webSearchTool.execute(input, { signal } as never);
+}
+
 // ---------------------------------------------------------------------------
 // OpenAI Responses API provider tests
 // ---------------------------------------------------------------------------
@@ -604,3 +662,158 @@ describe("Cross-Provider Web Search — Gemini", () => {
     expect(functionCallParts).toHaveLength(0);
   });
 });
+
+// ---------------------------------------------------------------------------
+// App-side provider backend-failure normalization (ATL-727)
+// ---------------------------------------------------------------------------
+
+describe("Cross-Provider Web Search — app-side backend failure normalization", () => {
+  let originalFetch: typeof globalThis.fetch;
+
+  beforeEach(() => {
+    originalFetch = globalThis.fetch;
+    mockWebSearchProvider = "brave";
+    mockProviderKey = "test-key";
+    capturedWarnLogs.length = 0;
+  });
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch;
+  });
+
+  function backendFailureLog() {
+    return capturedWarnLogs.find(
+      (entry) => entry.event === "web_search_backend_failure",
+    );
+  }
+
+  test("503 from provider yields friendly recoverable copy in content + errorMessage, logs raw 503, no body leak", async () => {
+    const rawBody = '{"error":"upstream exploded","trace":"do-not-leak"}';
+    globalThis.fetch = (async () =>
+      new Response(rawBody, { status: 503 })) as unknown as typeof fetch;
+
+    const result = await executeWebSearch({ query: "needle in a haystack" });
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toBe(WEB_SEARCH_BACKEND_FAILURE_MESSAGE);
+    const meta = result.activityMetadata?.webSearch;
+    expect(meta?.errorMessage).toBe(WEB_SEARCH_BACKEND_FAILURE_MESSAGE);
+    expect(meta?.results).toEqual([]);
+    expect(meta?.resultCount).toBe(0);
+
+    const logEntry = backendFailureLog();
+    expect(logEntry).toBeDefined();
+    expect(logEntry!.provider).toBe("brave");
+    expect(logEntry!.errorCategory).toBe("backend_unavailable");
+    expect(logEntry!.fallbackShown).toBe(true);
+    expect(logEntry!.queryLength).toBe("needle in a haystack".length);
+    expect(String(logEntry!.rawDetail)).toContain("503");
+    // Provider diagnostic body is preserved in internal telemetry rawDetail.
+    expect(String(logEntry!.rawDetail)).toContain("upstream exploded");
+    expect(String(logEntry!.rawDetail)).toContain("do-not-leak");
+
+    // Raw provider body must never reach user-facing fields.
+    expect(result.content).not.toContain("upstream exploded");
+    expect(result.content).not.toContain("do-not-leak");
+    expect(meta?.errorMessage).not.toContain("upstream exploded");
+    expect(meta?.errorMessage).not.toContain("do-not-leak");
+  });
+
+  test("thrown network error yields the same friendly backend result", async () => {
+    globalThis.fetch = (async () => {
+      throw new TypeError("fetch failed");
+    }) as unknown as typeof fetch;
+
+    const result = await executeWebSearch({ query: "offline" });
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toBe(WEB_SEARCH_BACKEND_FAILURE_MESSAGE);
+    expect(result.activityMetadata?.webSearch?.errorMessage).toBe(
+      WEB_SEARCH_BACKEND_FAILURE_MESSAGE,
+    );
+    const logEntry = backendFailureLog();
+    expect(logEntry).toBeDefined();
+    expect(logEntry!.errorCategory).toBe("backend_unavailable");
+    expect(result.content).not.toContain("fetch failed");
+  });
+
+  test("401 invalid-key preserves the specific message, not the backend copy", async () => {
+    globalThis.fetch = (async () =>
+      new Response("Unauthorized", { status: 401 })) as unknown as typeof fetch;
+
+    const result = await executeWebSearch({ query: "bad key" });
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("Invalid or expired Brave Search API key");
+    expect(result.content).not.toBe(WEB_SEARCH_BACKEND_FAILURE_MESSAGE);
+    expect(result.activityMetadata?.webSearch?.errorMessage).not.toBe(
+      WEB_SEARCH_BACKEND_FAILURE_MESSAGE,
+    );
+    expect(backendFailureLog()).toBeUndefined();
+  });
+
+  test("HTTP 200 with zero results stays a success (unchanged)", async () => {
+    globalThis.fetch = (async () =>
+      new Response(JSON.stringify({ web: { results: [] } }), {
+        status: 200,
+        headers: { "content-type": "application/json" },
+      })) as unknown as typeof fetch;
+
+    const result = await executeWebSearch({ query: "no hits" });
+
+    expect(result.isError).toBe(false);
+    expect(result.activityMetadata?.webSearch?.errorMessage).toBeUndefined();
+    expect(result.content).toContain("No results found");
+    expect(backendFailureLog()).toBeUndefined();
+  });
+
+  test("post-retry 429 yields the friendly recoverable copy and preserves body in rawDetail", async () => {
+    const rawBody = '{"error":"quota burned","retryHint":"do-not-leak-429"}';
+    globalThis.fetch = (async () =>
+      new Response(rawBody, {
+        status: 429,
+        headers: { "retry-after": "0" },
+      })) as unknown as typeof fetch;
+
+    const result = await executeWebSearch({ query: "rate limited" });
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toBe(WEB_SEARCH_BACKEND_FAILURE_MESSAGE);
+    const meta = result.activityMetadata?.webSearch;
+    expect(meta?.errorMessage).toBe(WEB_SEARCH_BACKEND_FAILURE_MESSAGE);
+    const logEntry = backendFailureLog();
+    expect(logEntry).toBeDefined();
+    expect(logEntry!.errorCategory).toBe("rate_limited");
+    expect(String(logEntry!.rawDetail)).toContain("429");
+    // Provider diagnostic body is preserved in internal telemetry rawDetail.
+    expect(String(logEntry!.rawDetail)).toContain("quota burned");
+    expect(String(logEntry!.rawDetail)).toContain("do-not-leak-429");
+
+    // Raw provider body must never reach user-facing fields.
+    expect(result.content).not.toContain("quota burned");
+    expect(result.content).not.toContain("do-not-leak-429");
+    expect(meta?.errorMessage).not.toContain("quota burned");
+    expect(meta?.errorMessage).not.toContain("do-not-leak-429");
+  });
+
+  test("caller abort re-throws instead of producing a backend failure (no telemetry)", async () => {
+    const controller = new AbortController();
+    controller.abort();
+
+    // A caller-aborted request surfaces an AbortError from fetch.
+    globalThis.fetch = (async () => {
+      const abortError = new Error("The operation was aborted");
+      abortError.name = "AbortError";
+      throw abortError;
+    }) as unknown as typeof fetch;
+
+    // The cancellation must re-throw so the executor's abort handling takes
+    // over — NOT resolve to the friendly backend-failure result.
+    await expect(
+      executeWebSearchWithSignal({ query: "cancel me" }, controller.signal),
+    ).rejects.toThrow();
+
+    // No spurious backend-failure telemetry for a user/external cancellation.
+    expect(backendFailureLog()).toBeUndefined();
+  });
+});

package/src/__tests__/db-acp-history.test.ts

@@ -5,6 +5,7 @@ import { drizzle } from "drizzle-orm/bun-sqlite";
 
 import { getSqliteFrom } from "../memory/db-connection.js";
 import { migrate230AcpSessionHistory } from "../memory/migrations/230-acp-session-history.js";
+import { migrateAcpSessionHistoryCwd } from "../memory/migrations/272-acp-session-history-cwd.js";
 import * as schema from "../memory/schema.js";
 
 function createTestDb() {
@@ -282,3 +283,103 @@ describe("acp_session_history migration", () => {
     expect(row?.id).toBe("history-rerun");
   });
 });
+
+describe("acp_session_history cwd migration (272)", () => {
+  function readColumns(raw: Database): Map<string, ColumnRow> {
+    const columns = raw
+      .query(`PRAGMA table_info(acp_session_history)`)
+      .all() as ColumnRow[];
+    return new Map(columns.map((c) => [c.name, c]));
+  }
+
+  test("adds a nullable cwd TEXT column to an upgraded table", () => {
+    const db = createTestDb();
+    const raw = getSqliteFrom(db);
+    bootstrapCheckpointsTable(raw);
+
+    migrate230AcpSessionHistory(db);
+    expect(readColumns(raw).has("cwd")).toBe(false);
+
+    migrateAcpSessionHistoryCwd(db);
+
+    const cwd = readColumns(raw).get("cwd");
+    expect(cwd).toBeDefined();
+    expect(cwd?.type).toBe("TEXT");
+    expect(cwd?.notnull).toBe(0);
+  });
+
+  test("re-running is a no-op, including with a cleared checkpoint", () => {
+    const db = createTestDb();
+    const raw = getSqliteFrom(db);
+    bootstrapCheckpointsTable(raw);
+
+    migrate230AcpSessionHistory(db);
+    migrateAcpSessionHistoryCwd(db);
+
+    // Second run short-circuits on the completed checkpoint.
+    expect(() => migrateAcpSessionHistoryCwd(db)).not.toThrow();
+
+    // Even with the checkpoint cleared (simulating crash recovery), the
+    // column-existence guard makes the ALTER a no-op.
+    raw
+      .query(`DELETE FROM memory_checkpoints WHERE key = ?`)
+      .run("migration_acp_session_history_cwd_v1");
+    expect(() => migrateAcpSessionHistoryCwd(db)).not.toThrow();
+
+    const columns = raw
+      .query(`PRAGMA table_info(acp_session_history)`)
+      .all() as ColumnRow[];
+    expect(columns.filter((c) => c.name === "cwd")).toHaveLength(1);
+  });
+
+  test("legacy rows read back with cwd null; new rows round-trip cwd", () => {
+    const db = createTestDb();
+    const raw = getSqliteFrom(db);
+    bootstrapCheckpointsTable(raw);
+
+    migrate230AcpSessionHistory(db);
+
+    // Legacy row inserted before the cwd column existed.
+    raw
+      .query(
+        /*sql*/ `
+        INSERT INTO acp_session_history (
+          id, agent_id, acp_session_id, parent_conversation_id,
+          started_at, status
+        ) VALUES (?, ?, ?, ?, ?, ?)
+      `,
+      )
+      .run("legacy-1", "agent-old", "acp-old", "conv-old", 100, "completed");
+
+    migrateAcpSessionHistoryCwd(db);
+
+    const legacy = raw
+      .query(`SELECT cwd FROM acp_session_history WHERE id = 'legacy-1'`)
+      .get() as { cwd: string | null } | null;
+    expect(legacy?.cwd).toBeNull();
+
+    raw
+      .query(
+        /*sql*/ `
+        INSERT INTO acp_session_history (
+          id, agent_id, acp_session_id, parent_conversation_id,
+          started_at, status, cwd
+        ) VALUES (?, ?, ?, ?, ?, ?, ?)
+      `,
+      )
+      .run(
+        "new-1",
+        "agent-new",
+        "acp-new",
+        "conv-new",
+        200,
+        "completed",
+        "/Users/me/project",
+      );
+
+    const fresh = raw
+      .query(`SELECT cwd FROM acp_session_history WHERE id = 'new-1'`)
+      .get() as { cwd: string | null } | null;
+    expect(fresh?.cwd).toBe("/Users/me/project");
+  });
+});

package/src/__tests__/db-schedule-syntax-migration.test.ts

@@ -4,6 +4,7 @@ import { describe, expect, test } from "bun:test";
 import { eq } from "drizzle-orm";
 import { drizzle } from "drizzle-orm/bun-sqlite";
 
+import { migrateScheduleSourceConversation } from "../memory/migrations/270-schedule-source-conversation.js";
 import * as schema from "../memory/schema.js";
 import { scheduleJobs } from "../memory/schema.js";
 
@@ -38,6 +39,7 @@ describe("schedule_syntax column migration", () => {
         retry_count INTEGER NOT NULL DEFAULT 0,
         max_retries INTEGER NOT NULL DEFAULT 3,
         retry_backoff_ms INTEGER NOT NULL DEFAULT 60000,
+        created_from_conversation_id TEXT,
         created_by TEXT NOT NULL,
         mode TEXT NOT NULL DEFAULT 'execute',
         routing_intent TEXT NOT NULL DEFAULT 'all_channels',
@@ -134,6 +136,7 @@ describe("schedule_syntax column migration", () => {
     } catch {
       /* already exists */
     }
+    migrateScheduleSourceConversation(db);
 
     const row = db
       .select()
@@ -197,6 +200,8 @@ describe("schedule_syntax column migration", () => {
     } catch {
       /* ok */
     }
+    migrateScheduleSourceConversation(db);
+    migrateScheduleSourceConversation(db);
 
     const now = Date.now();
     raw.exec(

package/src/__tests__/dm-persistence.test.ts

@@ -94,10 +94,14 @@ function createSlackTurnContext(): MessagingConversationContext {
     drain: () => [],
     size: () => 0,
   } as unknown as MessageQueue;
+  let processing = false;
   return {
     conversationId: "conv-dm-test",
     messages: [],
-    processing: false,
+    isProcessing: () => processing,
+    setProcessing: (value: boolean) => {
+      processing = value;
+    },
     abortController: null,
     queue: queueStub,
     getTurnChannelContext: () => channel,

package/src/__tests__/dynamic-page-surface.test.ts

@@ -94,6 +94,37 @@ describe("ui_show dynamic_page app substitute guard", () => {
     expect(proxied).toBe(false);
   });
 
+  test("rejects dynamic_page with a clean title but substantial interactive html", async () => {
+    let proxied = false;
+
+    const result = await uiShowTool.execute(
+      {
+        surface_type: "dynamic_page",
+        title: "Labor Market Stats",
+        data: {
+          html:
+            "<div id='root'></div><script>" +
+            "const data=[/*...*/];".padEnd(2100, "/") +
+            "new Chart(document.getElementById('root'), {});</script>",
+          preview: { title: "Labor Market Stats" },
+        },
+      },
+      {
+        conversationId: "conversation-123",
+        workingDir: "/tmp",
+        trustClass: "guardian",
+        proxyToolResolver: async () => {
+          proxied = true;
+          return { content: "proxied", isError: false };
+        },
+      },
+    );
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain('skill: "app-builder"');
+    expect(proxied).toBe(false);
+  });
+
   test("allows transient non-app dynamic_page surfaces", async () => {
     let proxied = false;