@vellumai/assistant 0.9.0 → 0.10.0-dev.202606192226.8ed8a6a

package/src/__tests__/schedule-tools.test.ts

@@ -421,7 +421,7 @@ describe("schedule tools — workflow mode", () => {
   beforeEach(() => {
     getRawDb().run("DELETE FROM cron_runs");
     getRawDb().run("DELETE FROM cron_jobs");
-    setOverridesForTesting({ workflows: true });
+    setOverridesForTesting({});
   });
   afterAll(() => {
     setOverridesForTesting({});
@@ -466,22 +466,6 @@ describe("schedule tools — workflow mode", () => {
     expect(result.content).toContain("workflow_name is required");
   });
 
-  test("rejects workflow mode when the workflows flag is off", async () => {
-    setOverridesForTesting({}); // flag off
-    const result = await executeScheduleCreate(
-      {
-        name: "Flag off",
-        expression: "0 8 * * *",
-        mode: "workflow",
-        workflow_name: "inbox-triage",
-      },
-      ctx,
-    );
-
-    expect(result.isError).toBe(true);
-    expect(result.content).toContain("workflows are not enabled");
-  });
-
   test("update to workflow mode requires a workflow_name", async () => {
     await executeScheduleCreate(
       { name: "To workflow", expression: "0 9 * * *", message: "test" },
@@ -544,7 +528,7 @@ describe("schedule_create — workflow capability manifest", () => {
   beforeEach(() => {
     getRawDb().run("DELETE FROM cron_runs");
     getRawDb().run("DELETE FROM cron_jobs");
-    setOverridesForTesting({ workflows: true });
+    setOverridesForTesting({});
     // Deterministic registry so a declared side-effecting tool resolves.
     __clearRegistryForTesting();
     registerTool(makeFakeTool("file_write"));

package/src/__tests__/scheduler-reuse-conversation.test.ts

@@ -210,10 +210,13 @@ describe("scheduler conversation reuse", () => {
     expect(runs2[0].conversationId).toBe(firstConversationId);
   });
 
-  test("recurring schedule defaults to reuseConversation=true", async () => {
+  test("recurring schedule defaults to reuseConversation=false", async () => {
     /**
      * When no explicit reuseConversation is provided, recurring schedules
-     * default to true — subsequent runs reuse the same conversation.
+     * default to false — each run gets a fresh conversation. This keeps a
+     * weak model's per-run context bounded instead of accumulating a long,
+     * self-similar transcript that primes it to repeat or drift; durable
+     * cross-run state belongs in workspace files and memory, not history.
      */
 
     // GIVEN a recurring schedule with no explicit reuseConversation
@@ -224,7 +227,7 @@ describe("scheduler conversation reuse", () => {
       message: "Default reuse message",
       syntax: "rrule",
       expression: rruleExpr,
-      // no explicit reuseConversation — should default to true for recurring
+      // no explicit reuseConversation — should default to false
     });
 
     // WHEN the schedule fires for the first time
@@ -250,9 +253,9 @@ describe("scheduler conversation reuse", () => {
     await new Promise((resolve) => setTimeout(resolve, 500));
     scheduler2.stop();
 
-    // THEN the same conversation is reused
+    // THEN a fresh conversation is created instead of reusing the first
     expect(processedMessages).toHaveLength(1);
-    expect(processedMessages[0].conversationId).toBe(firstConversationId);
+    expect(processedMessages[0].conversationId).not.toBe(firstConversationId);
   });
 
   test("recurring schedule with reuseConversation=false creates new conversation each run", async () => {

package/src/__tests__/secret-response-routing.test.ts

@@ -106,6 +106,41 @@ describe("secret response routing", () => {
     await promise;
   });
 
+  test("prompt registers public secretDetails without the value", async () => {
+    const promise = prompter.prompt(
+      "github",
+      "token",
+      "GitHub Token",
+      "desc",
+      "placeholder",
+      "session-1",
+      "Push commits",
+      ["git_push"],
+      ["github.com"],
+    );
+    const msg = broadcastedMessages[0] as SecretRequestEvent;
+    const entry = _piStore.get(msg.requestId) as {
+      kind: string;
+      secretDetails?: Record<string, unknown>;
+    };
+    expect(entry.kind).toBe("secret");
+    expect(entry.secretDetails).toMatchObject({
+      service: "github",
+      field: "token",
+      label: "GitHub Token",
+      description: "desc",
+      placeholder: "placeholder",
+      purpose: "Push commits",
+      allowedTools: ["git_push"],
+      allowedDomains: ["github.com"],
+    });
+    // SECURITY: the secret value is never part of the registered metadata.
+    expect(JSON.stringify(entry.secretDetails)).not.toContain("test-value");
+    // Clean up
+    prompter.resolveSecret(msg.requestId, undefined);
+    await promise;
+  });
+
   test("resolveSecret for unknown requestId is a no-op", () => {
     // Should not throw
     prompter.resolveSecret("unknown-id", "value", "store");

package/src/__tests__/secret-routes-platform-proxy.test.ts

@@ -12,7 +12,12 @@ let providerRefreshCalls = 0;
 const PLATFORM_BASE_URL = "https://platform.example.com";
 const ASSISTANT_API_KEY_PATH = credentialKey("vellum", "assistant_api_key");
 const PLATFORM_BASE_URL_PATH = credentialKey("vellum", "platform_base_url");
-const MANAGED_PROVIDERS = ["anthropic", "openai", "gemini", "fireworks"] as const;
+const MANAGED_PROVIDERS = [
+  "anthropic",
+  "openai",
+  "gemini",
+  "fireworks",
+] as const;
 
 let platformBaseUrlOverride: string | undefined;
 
@@ -116,6 +121,13 @@ mock.module("../util/logger.js", () => ({
     }),
 }));
 
+// `handleAddSecret` fires this detached when a managed-proxy credential lands —
+// a v2-memory side effect outside this suite's provider-registry scope. Stub it
+// to a no-op; its behavior is covered by memory-v2-startup.test.ts.
+mock.module("../daemon/memory-v2-startup.js", () => ({
+  maybeReseedCapabilitiesAfterManagedCredential: async () => {},
+}));
+
 import {
   getProviderRoutingSource,
   initializeProviders,
@@ -199,7 +211,9 @@ describe("secret routes managed proxy registry sync", () => {
   test("provider API key writes notify live-conversation refresh listeners", async () => {
     await addApiKey("fireworks", "fw-key");
 
-    expect(secureKeyStore[credentialKey("fireworks", "api_key")]).toBe("fw-key");
+    expect(secureKeyStore[credentialKey("fireworks", "api_key")]).toBe(
+      "fw-key",
+    );
     expect(providerRefreshCalls).toBe(1);
 
     await deleteApiKey("fireworks");

package/src/__tests__/skill-execute-input.test.ts

@@ -1,6 +1,20 @@
 import { describe, expect, test } from "bun:test";
 
-import { resolveSkillExecuteInput } from "../tools/skills/execute.js";
+import {
+  augmentSkillExecuteError,
+  recoverSkillExecuteEnvelope,
+  resolveSkillExecuteInput,
+} from "../tools/skills/execute.js";
+
+/** Schema with exactly one required string field (e.g. document_update). */
+const SINGLE_REQUIRED_STRING_SCHEMA = {
+  type: "object",
+  properties: {
+    content: { type: "string" },
+    mode: { type: "string", enum: ["replace", "append"] },
+  },
+  required: ["content"],
+};
 
 describe("resolveSkillExecuteInput", () => {
   test("returns a correctly nested object unchanged", () => {
@@ -82,4 +96,166 @@ describe("resolveSkillExecuteInput", () => {
     });
     expect(result).toEqual({ foo: "bar" });
   });
+
+  test("maps a bare (non-JSON) input string to the sole required string field", () => {
+    // The exact shape from the doc-writer incident: the full Markdown body
+    // passed as `input` instead of `{ "content": "..." }`.
+    const body = "# AI in 2026\n\nWe're halfway through the year.";
+    const result = resolveSkillExecuteInput(
+      { tool: "document_update", input: body, activity: "Streaming article" },
+      SINGLE_REQUIRED_STRING_SCHEMA,
+    );
+    expect(result).toEqual({ content: body });
+  });
+
+  test("does not map a bare string without the inner schema", () => {
+    const result = resolveSkillExecuteInput({
+      tool: "document_update",
+      input: "# AI in 2026",
+      activity: "Streaming article",
+    });
+    expect(result).toEqual({});
+  });
+
+  test("does not map a bare string when the schema has multiple required fields", () => {
+    const schema = {
+      type: "object",
+      properties: { a: { type: "string" }, b: { type: "string" } },
+      required: ["a", "b"],
+    };
+    const result = resolveSkillExecuteInput(
+      { tool: "t", input: "some text", activity: "x" },
+      schema,
+    );
+    expect(result).toEqual({});
+  });
+
+  test("does not map a bare string when the sole required field is not a string", () => {
+    const schema = {
+      type: "object",
+      properties: { count: { type: "number" } },
+      required: ["count"],
+    };
+    const result = resolveSkillExecuteInput(
+      { tool: "t", input: "42", activity: "x" },
+      schema,
+    );
+    // "42" parses as JSON but isn't an object, and the lone required field is
+    // not a string — no rescue applies.
+    expect(result).toEqual({});
+  });
+
+  test("a valid JSON-object string still wins over the bare-string rescue", () => {
+    const result = resolveSkillExecuteInput(
+      {
+        tool: "document_update",
+        input: '{"content":"hello","mode":"append"}',
+        activity: "x",
+      },
+      SINGLE_REQUIRED_STRING_SCHEMA,
+    );
+    expect(result).toEqual({ content: "hello", mode: "append" });
+  });
+
+  test("an empty input string is not rescued (nothing to map)", () => {
+    const result = resolveSkillExecuteInput(
+      { tool: "document_update", input: "", activity: "x" },
+      SINGLE_REQUIRED_STRING_SCHEMA,
+    );
+    expect(result).toEqual({});
+  });
+});
+
+describe("recoverSkillExecuteEnvelope", () => {
+  test("recovers a valid envelope wrapped under the _raw marker", () => {
+    // MiniMax coercion marks a bare-string `input` call unparseable even though
+    // the outer arguments are valid JSON.
+    const raw = JSON.stringify({
+      tool: "document_update",
+      input: "# AI in 2026\n\nbody",
+      activity: "Streaming",
+    });
+    const recovered = recoverSkillExecuteEnvelope({ _raw: raw });
+    expect(recovered).toEqual({
+      tool: "document_update",
+      input: "# AI in 2026\n\nbody",
+      activity: "Streaming",
+    });
+  });
+
+  test("leaves a genuinely unparseable (truncated) call wrapped", () => {
+    const wrapped = { _raw: '{"tool":"document_update","input":"# AI' };
+    expect(recoverSkillExecuteEnvelope(wrapped)).toBe(wrapped);
+  });
+
+  test("passes a normal envelope through untouched", () => {
+    const envelope = {
+      tool: "document_update",
+      input: { content: "hi" },
+      activity: "x",
+    };
+    expect(recoverSkillExecuteEnvelope(envelope)).toBe(envelope);
+  });
+
+  test("end-to-end: recovered bare-string envelope resolves to content", () => {
+    const body = "# Title\n\nThe full article body.";
+    const raw = JSON.stringify({
+      tool: "document_update",
+      input: body,
+      activity: "Streaming",
+    });
+    const envelope = recoverSkillExecuteEnvelope({ _raw: raw });
+    const resolved = resolveSkillExecuteInput(
+      envelope,
+      SINGLE_REQUIRED_STRING_SCHEMA,
+    );
+    expect(resolved).toEqual({ content: body });
+  });
+});
+
+describe("augmentSkillExecuteError", () => {
+  test("appends envelope guidance when an empty-input call errors", () => {
+    // The subagent_spawn failure: empty input, tool rejects with a field-level
+    // message that says nothing about the skill_execute envelope.
+    const result = augmentSkillExecuteError(
+      "subagent_spawn",
+      {},
+      { content: 'Both "label" and "objective" are required.', isError: true },
+    );
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain(
+      'Both "label" and "objective" are required.',
+    );
+    expect(result.content).toContain("carried no parameters");
+    expect(result.content).toContain('"tool": "subagent_spawn"');
+    expect(result.content).toContain("inside `input`");
+    // The guidance must not condemn the JSON-encoded-string form: the resolver
+    // accepts it (resolveSkillExecuteInput parses string input), and it is a
+    // shape weak models successfully use. Telling them it is wrong steers them
+    // toward dropping the payload entirely.
+    expect(result.content).not.toContain("JSON-encoded string");
+  });
+
+  test("leaves errors untouched when parameters were resolved", () => {
+    // A non-empty resolved input means the model structured the call; any error
+    // is a real tool-level failure, not an envelope-shape mistake.
+    const original = {
+      content: "Subagent quota exceeded.",
+      isError: true,
+    };
+    const result = augmentSkillExecuteError(
+      "subagent_spawn",
+      { label: "x", objective: "y" },
+      original,
+    );
+    expect(result).toBe(original);
+  });
+
+  test("leaves successful empty-input calls untouched", () => {
+    // Tools that legitimately accept no parameters (e.g. subagent_status) must
+    // not have guidance appended to their successful results.
+    const original = { content: "No subagents running.", isError: false };
+    const result = augmentSkillExecuteError("subagent_status", {}, original);
+    expect(result).toBe(original);
+  });
 });

package/src/__tests__/skill-load-tool.test.ts

@@ -100,6 +100,21 @@ async function executeSkillLoad(
   return { content: result.content, isError: result.isError };
 }
 
+async function executeSkillLoadCleanup(
+  input: Record<string, unknown>,
+): Promise<{ content: string; isError: boolean }> {
+  const tool = getTool("skill_load");
+  if (!tool) throw new Error("skill_load tool was not registered");
+
+  const result = await tool.execute(input, {
+    workingDir: "/tmp",
+    conversationId: "conversation-1",
+    trustClass: "guardian",
+    diskPressureCleanupModeActive: true,
+  });
+  return { content: result.content, isError: result.isError };
+}
+
 describe("skill_load tool", () => {
   beforeEach(() => {
     mkdirSync(join(TEST_DIR, "skills"), { recursive: true });
@@ -911,4 +926,61 @@ describe("skill_load tool", () => {
     expect(result.content).toContain("Suggested Included Skills (not loaded):");
     expect(installCount).toBeLessThanOrEqual(5);
   });
+
+  // During disk-pressure cleanup mode, skill_load is allowed but must not
+  // produce side effects: no catalog auto-install (workspace writes / bun
+  // install) and no inline command execution. Instructions are still returned.
+  test("does not auto-install a missing catalog skill during cleanup mode", async () => {
+    mockAutoInstall.mockImplementation((skillId: string) => {
+      writeSkill(skillId, "Should Not Install", "nope", "body");
+      return Promise.resolve(true);
+    });
+
+    const result = await executeSkillLoadCleanup({ skill: "absent-skill" });
+
+    expect(mockAutoInstall).not.toHaveBeenCalled();
+    expect(result.isError).toBe(true);
+  });
+
+  test("does not auto-install missing includes during cleanup mode", async () => {
+    writeSkillWithIncludes(
+      "cleanup-parent",
+      "Cleanup Parent",
+      "Has a missing include",
+      "Parent body",
+      ["cleanup-dep"],
+    );
+    mockAutoInstall.mockImplementation((skillId: string) => {
+      writeSkill(skillId, "Cleanup Dep", "should not install", "Dep body");
+      return Promise.resolve(true);
+    });
+
+    const result = await executeSkillLoadCleanup({ skill: "cleanup-parent" });
+
+    expect(mockAutoInstall).not.toHaveBeenCalled();
+    expect(result.isError).toBe(false);
+    expect(result.content).toContain("Skill: Cleanup Parent");
+    expect(result.content).toContain("Suggested Included Skills (not loaded):");
+    expect(result.content).toContain("cleanup-dep");
+  });
+
+  test("strips inline command tokens instead of executing them during cleanup mode", async () => {
+    writeSkill(
+      "cleanup-inline",
+      "Cleanup Inline",
+      "Has an inline command",
+      "Before !`echo SENTINEL_OUTPUT` after",
+    );
+
+    const result = await executeSkillLoadCleanup({ skill: "cleanup-inline" });
+
+    expect(result.isError).toBe(false);
+    expect(result.content).toContain(
+      "[inline command skipped: storage cleanup mode]",
+    );
+    expect(result.content).not.toContain("SENTINEL_OUTPUT");
+    expect(result.content).not.toContain("!`echo SENTINEL_OUTPUT`");
+    expect(result.content).toContain("Before");
+    expect(result.content).toContain("after");
+  });
 });

package/src/__tests__/skill-runtime-path.test.ts

@@ -9,9 +9,8 @@
  * branches (macOS `.app` Resources, next-to-binary) key off
  * `import.meta.dir.startsWith("/$bunfs/")`, so at test time only the
  * source-mode early-return is exercised here; the compiled branch is
- * covered structurally via the signing + packaging step in
- * `clients/macos/build.sh` and will be exercised end-to-end by the
- * supervisor integration test added in PR 27.
+ * covered structurally via the Electron signing + packaging step in
+ * `clients/macos/scripts/pack.sh`.
  */
 
 import { mkdirSync, rmSync, writeFileSync } from "node:fs";

package/src/__tests__/skills.test.ts

@@ -691,6 +691,57 @@ describe("category frontmatter parsing", () => {
   });
 });
 
+describe("always-candidate frontmatter parsing", () => {
+  beforeEach(() => {
+    mkdirSync(join(TEST_DIR, "skills"), { recursive: true });
+  });
+
+  afterEach(() => {
+    const skillsDir = join(TEST_DIR, "skills");
+    if (existsSync(skillsDir))
+      rmSync(skillsDir, { recursive: true, force: true });
+  });
+
+  function writeSkillWithAlwaysCandidate(skillId: string, value: string): void {
+    const skillDir = join(TEST_DIR, "skills", skillId);
+    mkdirSync(skillDir, { recursive: true });
+    const metadata = `{"vellum":{"always-candidate":${value}}}`;
+    writeFileSync(
+      join(skillDir, "SKILL.md"),
+      `---\nname: "${skillId}"\ndescription: "test"\nmetadata: ${metadata}\n---\n\nBody.\n`,
+    );
+  }
+
+  test("parses always-candidate: true from metadata.vellum", () => {
+    writeSkillWithAlwaysCandidate("pinned", "true");
+    const skill = loadUserSkillCatalog().find((s) => s.id === "pinned");
+    expect(skill!.alwaysCandidate).toBe(true);
+  });
+
+  test("parses always-candidate: false", () => {
+    writeSkillWithAlwaysCandidate("unpinned", "false");
+    const skill = loadUserSkillCatalog().find((s) => s.id === "unpinned");
+    expect(skill!.alwaysCandidate).toBe(false);
+  });
+
+  test("returns undefined for a non-boolean always-candidate", () => {
+    writeSkillWithAlwaysCandidate("bad", '"yes"');
+    const skill = loadUserSkillCatalog().find((s) => s.id === "bad");
+    expect(skill!.alwaysCandidate).toBeUndefined();
+  });
+
+  test("skill without always-candidate has undefined", () => {
+    writeSkill("plain", "Plain", "Test");
+    const skill = loadUserSkillCatalog().find((s) => s.id === "plain");
+    expect(skill!.alwaysCandidate).toBeUndefined();
+  });
+
+  test("the bundled workflows skill is flagged always-candidate", () => {
+    const wf = loadSkillCatalog().find((s) => s.id === "workflows");
+    expect(wf?.alwaysCandidate).toBe(true);
+  });
+});
+
 describe("bundled skill categories", () => {
   test("every bundled skill declares a valid category slug", () => {
     const yamlPath = join(

package/src/__tests__/slack-notification-approval-card.test.ts

@@ -0,0 +1,176 @@
+import { describe, expect, test } from "bun:test";
+
+import { parseAccessRequestPayload } from "../notifications/access-request-copy.js";
+import { buildApprovalNotificationBlocks } from "../notifications/adapters/slack.js";
+import type { ChannelDeliveryPayload } from "../notifications/types.js";
+import type { ApprovalUIMetadata } from "../runtime/channel-approval-types.js";
+
+/**
+ * Pins the Slack approval-card block contract: the title, identity subtitle,
+ * quoted-preview body, action callback ids, source/permalink and requester-id
+ * context blocks, the security-warning context block, and guardian
+ * verification note that `buildApprovalNotificationBlocks` emits for an
+ * access request.
+ */
+
+const APPROVAL: ApprovalUIMetadata = {
+  requestId: "req-123",
+  actions: [
+    { id: "approve_once", label: "Approve once" },
+    { id: "reject", label: "Reject" },
+  ],
+  plainTextFallback: 'Reply "ABC123 approve" or "ABC123 reject"',
+};
+
+function buildPayload(
+  raw: Record<string, unknown>,
+  approval: ApprovalUIMetadata = APPROVAL,
+): ChannelDeliveryPayload {
+  return {
+    sourceEventName: "ingress.access_request",
+    copy: { title: "Access Request", body: "Someone is requesting access" },
+    urgency: "high",
+    approvalContext: approval,
+    accessRequestContext: parseAccessRequestPayload(raw),
+  };
+}
+
+type Block = Record<string, unknown>;
+
+function card(blocks: unknown[]): Block {
+  const c = (blocks as Block[]).find((b) => b.type === "card");
+  if (!c) throw new Error("no card block");
+  return c;
+}
+
+function contextTexts(blocks: unknown[]): string[] {
+  return (blocks as Block[])
+    .filter((b) => b.type === "context")
+    .map((b) => {
+      const elements = b.elements as Array<{ text: string }>;
+      return elements.map((e) => e.text).join("");
+    });
+}
+
+function text(node: unknown): string {
+  return (node as { text: string }).text;
+}
+
+const BASE: Record<string, unknown> = {
+  requestId: "req-123",
+  requestCode: "ABC123",
+  sourceChannel: "slack",
+  conversationExternalId: "C01ABC",
+  actorExternalId: "U999",
+  actorDisplayName: "Alice",
+  actorUsername: "alice",
+  senderIdentifier: "U999",
+  messagePreview: "Hello, I need help with something",
+  messageTs: "1700000000.000100",
+};
+
+describe("Slack access-request card blocks", () => {
+  test("card carries title, identity subtitle, and quoted preview body", () => {
+    const c = card(buildApprovalNotificationBlocks(buildPayload(BASE), "msg"));
+    expect(text(c.title)).toBe("Access Request");
+    expect(text(c.subtitle)).toBe("Alice (@alice) via slack");
+    expect(text(c.body)).toBe('> _"Hello, I need help with something"_');
+  });
+
+  test("card actions encode the apr:<requestId>:<action> callback ids", () => {
+    const c = card(buildApprovalNotificationBlocks(buildPayload(BASE), "msg"));
+    const actions = c.actions as Array<Record<string, unknown>>;
+    expect(actions).toHaveLength(2);
+    expect(actions[0].action_id).toBe("apr:req-123:approve_once");
+    expect(actions[0].style).toBe("primary");
+    expect(actions[1].action_id).toBe("apr:req-123:reject");
+    expect(actions[1].style).toBe("danger");
+  });
+
+  test("source context renders a channel mention with permalink", () => {
+    const texts = contextTexts(
+      buildApprovalNotificationBlocks(buildPayload(BASE), "msg"),
+    );
+    expect(texts).toContain(
+      "Source: Slack — <#C01ABC> · <https://slack.com/archives/C01ABC/p1700000000000100|View message>",
+    );
+  });
+
+  test("DM source renders as Direct message", () => {
+    const blocks = buildApprovalNotificationBlocks(
+      buildPayload({ ...BASE, conversationExternalId: "D01XYZ" }),
+      "msg",
+    );
+    expect(contextTexts(blocks)).toContain(
+      "Source: Slack — Direct message · <https://slack.com/archives/D01XYZ/p1700000000000100|View message>",
+    );
+  });
+
+  test("requester id block appears when external id adds info", () => {
+    const texts = contextTexts(
+      buildApprovalNotificationBlocks(buildPayload(BASE), "msg"),
+    );
+    expect(texts).toContain("ID: U999");
+  });
+
+  test("invite directive context block is always present", () => {
+    const texts = contextTexts(
+      buildApprovalNotificationBlocks(buildPayload(BASE), "msg"),
+    );
+    expect(texts).toContain(
+      'Reply "open invite flow" to start Trusted Contacts invite flow.',
+    );
+  });
+
+  test("warnings render in a context block under the card", () => {
+    const blocks = buildApprovalNotificationBlocks(
+      buildPayload({
+        ...BASE,
+        isStranger: true,
+        isRestricted: true,
+        previousMemberStatus: "revoked",
+      }),
+      "msg",
+    );
+    // `subtext` is not a Slack card field; warnings must live in a real block
+    // or Slack drops them and the guardian never sees them.
+    expect(card(blocks).subtext).toBeUndefined();
+    const warning = contextTexts(blocks).find((t) => t.includes(":warning:"));
+    expect(warning).toBeDefined();
+    expect(warning).toContain(":warning: This user was previously revoked.");
+    expect(warning).toContain(
+      ":warning: External Slack user (not in this workspace).",
+    );
+    expect(warning).toContain(":warning: Guest / restricted account.");
+  });
+
+  test("no warning context block when there are no warnings", () => {
+    const blocks = buildApprovalNotificationBlocks(buildPayload(BASE), "msg");
+    expect(card(blocks).subtext).toBeUndefined();
+    expect(contextTexts(blocks).some((t) => t.includes(":warning:"))).toBe(
+      false,
+    );
+  });
+
+  test("body falls back to a default label when no preview", () => {
+    const c = card(
+      buildApprovalNotificationBlocks(
+        buildPayload({ ...BASE, messagePreview: undefined }),
+        "msg",
+      ),
+    );
+    expect(text(c.body)).toBe("Requesting access to the assistant");
+  });
+
+  test("guardian verification note appears for fallback guardian resolution", () => {
+    const texts = contextTexts(
+      buildApprovalNotificationBlocks(
+        buildPayload({ ...BASE, guardianResolutionSource: "vellum-anchor" }),
+        "msg",
+      ),
+    );
+    expect(
+      texts.some((t) => t.includes("haven't verified your identity on slack")),
+    ).toBe(true);
+  });
+});