@vellumai/assistant 0.9.0 → 0.10.0-dev.202606192226.8ed8a6a

package/src/__tests__/trusted-contact-inline-approval-integration.test.ts

@@ -92,7 +92,7 @@ mock.module("../runtime/channel-verification-service.js", () => ({
     return null;
   },
   createOutboundSession: () => ({
-    conversationId: "test-session",
+    sessionId: "test-session",
     secret: "123456",
   }),
   bindSessionIdentity: () => {},
@@ -108,16 +108,23 @@ mock.module("../runtime/channel-verification-service.js", () => ({
   }),
 }));
 
-// Mock gateway client — capture delivery calls
+// Mock gateway client — capture delivery calls. `failDeliveryWhen` lets a test
+// simulate a delivery failure for a specific payload (e.g. a DM that can't be
+// opened) so fallback paths can be exercised.
 const deliveredReplies: Array<{
   url: string;
   payload: Record<string, unknown>;
 }> = [];
+let failDeliveryWhen: ((payload: Record<string, unknown>) => boolean) | null =
+  null;
 mock.module("../runtime/gateway-client.js", () => ({
   deliverChannelReply: async (
     url: string,
     payload: Record<string, unknown>,
   ) => {
+    if (failDeliveryWhen?.(payload)) {
+      throw new Error("simulated delivery failure");
+    }
     deliveredReplies.push({ url, payload });
     return { ok: true };
   },
@@ -150,6 +157,7 @@ mock.module("../config/env.js", () => ({
 import { applyCanonicalGuardianDecision } from "../approvals/guardian-decision-primitive.js";
 import type { ActorContext } from "../approvals/guardian-request-resolvers.js";
 import { getResolver } from "../approvals/guardian-request-resolvers.js";
+import { upsertContactChannel } from "../contacts/contacts-write.js";
 import type { TrustContext } from "../daemon/trust-context.js";
 import {
   createCanonicalGuardianRequest,
@@ -564,7 +572,7 @@ describe("(d) unknown actor flow: fail-closed with no interactive approval", ()
 
     expect("skipped" in result && result.skipped).toBe(true);
     if ("skipped" in result) {
-      expect(result.reason).toBe("not_trusted_contact");
+      expect(result.reason).toBe("not_bridgeable_trust_class");
     }
   });
 });
@@ -1088,3 +1096,212 @@ describe("cross-milestone integration checks", () => {
   });
 });
 
+// ===========================================================================
+// (g) access_request resolver: requester verification-code delivery
+//
+// On approval the requester must receive the 6-digit code so the guardian
+// never has to relay it by hand. On Slack the code is DM'd straight to the
+// requester (a private path is guaranteed via their user ID); other channels
+// keep the courier message because a private path to the requester is not
+// guaranteed there (e.g. a group chat would leak the secret).
+// ===========================================================================
+
+describe("(g) access_request resolver: requester code delivery", () => {
+  const REQUESTER_UID = "U_REQUESTER";
+  const GUARDIAN_UID = "U_GUARDIAN";
+
+  function createAccessRequest(overrides: Record<string, unknown> = {}) {
+    return createCanonicalGuardianRequest({
+      id: `access-req-${Date.now()}-${Math.random().toString(36).slice(2)}`,
+      kind: "access_request",
+      sourceType: "channel",
+      sourceChannel: "slack",
+      conversationId: "conv-access-slack",
+      requesterExternalUserId: REQUESTER_UID,
+      requesterChatId: "C_SHARED_CHANNEL",
+      guardianExternalUserId: GUARDIAN_UID,
+      guardianPrincipalId: "test-principal-id",
+      toolName: "ingress_access_request",
+      expiresAt: Date.now() + 60_000,
+      ...overrides,
+    });
+  }
+
+  beforeEach(() => {
+    resetTables();
+    deliveredReplies.length = 0;
+    emittedSignals.length = 0;
+    failDeliveryWhen = null;
+  });
+
+  test("on-channel Slack approval DMs the verification code to the requester", async () => {
+    const req = createAccessRequest();
+
+    const result = await applyCanonicalGuardianDecision({
+      requestId: req.id,
+      action: "approve_once",
+      actorContext: guardianActor({
+        channel: "slack",
+        actorExternalUserId: GUARDIAN_UID,
+      }),
+      channelDeliveryContext: {
+        replyCallbackUrl:
+          "http://localhost:3000/deliver/slack?threadTs=111.222",
+        guardianChatId: "C_SHARED_CHANNEL",
+        assistantId: "self",
+      },
+    });
+
+    expect(result.applied).toBe(true);
+
+    // The requester receives the actual code in their DM (chatId = user ID),
+    // not a "ask the guardian" courier message.
+    const requesterCodeReply = deliveredReplies.find(
+      (r) =>
+        r.payload.chatId === REQUESTER_UID &&
+        typeof r.payload.text === "string" &&
+        (r.payload.text as string).includes("123456"),
+    );
+    expect(requesterCodeReply).toBeDefined();
+    expect(requesterCodeReply!.payload.text).toContain(
+      "your access request was approved",
+    );
+    // The code DM is durable, never ephemeral.
+    expect(requesterCodeReply!.payload.ephemeral).toBeUndefined();
+    // threadTs (the guardian's channel thread) is stripped for the DM.
+    expect(requesterCodeReply!.url).not.toContain("threadTs");
+
+    // No courier "receive from the guardian" message goes to the requester.
+    const courier = deliveredReplies.find(
+      (r) =>
+        typeof r.payload.text === "string" &&
+        (r.payload.text as string).includes("receive from the guardian"),
+    );
+    expect(courier).toBeUndefined();
+  });
+
+  test("desktop-decided approval DMs the code to the Slack requester via the deliver path", async () => {
+    const req = createAccessRequest();
+
+    const result = await applyCanonicalGuardianDecision({
+      requestId: req.id,
+      action: "approve_once",
+      // Desktop decision: no channelDeliveryContext, actor on the vellum channel.
+      actorContext: guardianActor({
+        channel: "vellum",
+        actorExternalUserId: undefined,
+      }),
+    });
+
+    expect(result.applied).toBe(true);
+
+    const requesterCodeReply = deliveredReplies.find(
+      (r) =>
+        r.payload.chatId === REQUESTER_UID &&
+        typeof r.payload.text === "string" &&
+        (r.payload.text as string).includes("123456"),
+    );
+    expect(requesterCodeReply).toBeDefined();
+    expect(requesterCodeReply!.url).toContain("/deliver/slack");
+    expect(requesterCodeReply!.payload.text).toContain(
+      "your access request was approved",
+    );
+  });
+
+  test("non-Slack channel keeps the courier message and never delivers the code to the requester chat", async () => {
+    const req = createAccessRequest({
+      sourceChannel: "telegram",
+      requesterChatId: "requester-chat-1",
+      conversationId: "conv-access-telegram",
+    });
+
+    const result = await applyCanonicalGuardianDecision({
+      requestId: req.id,
+      action: "approve_once",
+      actorContext: guardianActor({
+        channel: "telegram",
+        actorExternalUserId: GUARDIAN_UID,
+      }),
+      channelDeliveryContext: {
+        replyCallbackUrl: "http://localhost:3000/deliver/telegram",
+        guardianChatId: "guardian-chat-1",
+        assistantId: "self",
+      },
+    });
+
+    expect(result.applied).toBe(true);
+
+    // The requester is told to expect the code from the guardian; the secret is
+    // never delivered to the requester's (possibly group) chat.
+    const requesterReply = deliveredReplies.find(
+      (r) => r.payload.chatId === "requester-chat-1",
+    );
+    expect(requesterReply).toBeDefined();
+    expect(requesterReply!.payload.text).toContain("receive from the guardian");
+    expect(requesterReply!.payload.text).not.toContain("123456");
+  });
+
+  test("Slack shared-channel fallback posts an ephemeral notice to the channel when the DM fails", async () => {
+    const req = createAccessRequest();
+
+    // Make the direct DM (to the U... user ID) fail so the courier fallback runs.
+    failDeliveryWhen = (payload) => payload.chatId === REQUESTER_UID;
+
+    const result = await applyCanonicalGuardianDecision({
+      requestId: req.id,
+      action: "approve_once",
+      actorContext: guardianActor({
+        channel: "slack",
+        actorExternalUserId: GUARDIAN_UID,
+      }),
+      channelDeliveryContext: {
+        replyCallbackUrl:
+          "http://localhost:3000/deliver/slack?threadTs=111.222",
+        guardianChatId: "C_SHARED_CHANNEL",
+        assistantId: "self",
+      },
+    });
+
+    expect(result.applied).toBe(true);
+
+    // The courier notice falls back to an ephemeral message targeting the
+    // originating channel (C...), since chat.postEphemeral needs a channel ID —
+    // not the requester's user ID.
+    const courier = deliveredReplies.find(
+      (r) =>
+        typeof r.payload.text === "string" &&
+        (r.payload.text as string).includes("receive from the guardian"),
+    );
+    expect(courier).toBeDefined();
+    expect(courier!.payload.chatId).toBe("C_SHARED_CHANNEL");
+    expect(courier!.payload.ephemeral).toBe(true);
+    expect(courier!.payload.user).toBe(REQUESTER_UID);
+  });
+
+  test("guardian-facing reply uses the requester's display name, not the raw ID", async () => {
+    // Seed a contact so the resolver can resolve a display name.
+    upsertContactChannel({
+      sourceChannel: "slack",
+      externalUserId: REQUESTER_UID,
+      displayName: "Alice",
+      status: "unverified",
+    });
+
+    const req = createAccessRequest();
+
+    const result = await applyCanonicalGuardianDecision({
+      requestId: req.id,
+      action: "approve_once",
+      // Desktop decision → resolver returns guardianReplyText for assertion.
+      actorContext: guardianActor({
+        channel: "vellum",
+        actorExternalUserId: undefined,
+      }),
+    });
+
+    expect(result.applied).toBe(true);
+    const replyText = result.applied ? result.resolverReplyText : undefined;
+    expect(replyText).toContain("Alice");
+    expect(replyText).not.toContain(REQUESTER_UID);
+  });
+});

package/src/__tests__/trusted-contact-multichannel.test.ts

@@ -266,7 +266,7 @@ for (const config of CHANNEL_CONFIGS) {
 
       const contactResult = findContactChannel({
         channelType: config.channel,
-        externalUserId: config.senderExternalUserId,
+        address: config.senderExternalUserId,
       });
 
       expect(contactResult).not.toBeNull();
@@ -288,7 +288,7 @@ for (const config of CHANNEL_CONFIGS) {
       // Should be found on this channel
       const sameChanResult = findContactChannel({
         channelType: config.channel,
-        externalUserId: config.senderExternalUserId,
+        address: config.senderExternalUserId,
       });
       expect(sameChanResult).not.toBeNull();
 
@@ -296,7 +296,7 @@ for (const config of CHANNEL_CONFIGS) {
       const otherChannel = config.channel === "telegram" ? "slack" : "telegram";
       const crossChanResult = findContactChannel({
         channelType: otherChannel,
-        externalUserId: config.senderExternalUserId,
+        address: config.senderExternalUserId,
       });
       expect(crossChanResult).toBeNull();
     });

package/src/__tests__/trusted-contact-verification.test.ts

@@ -102,13 +102,13 @@ describe("trusted contact verification → member activation", () => {
     // Verify: active member record exists
     const contactResult = findContactChannel({
       channelType: "telegram",
-      externalUserId: "requester-user-123",
+      address: "requester-user-123",
     });
 
     expect(contactResult).not.toBeNull();
     expect(contactResult!.channel.status).toBe("active");
     expect(contactResult!.channel.policy).toBe("allow");
-    expect(contactResult!.channel.externalUserId).toBe("requester-user-123");
+    expect(contactResult!.channel.address).toBe("requester-user-123");
     expect(contactResult!.channel.externalChatId).toBe("requester-chat-123");
     expect(contactResult!.contact.displayName).toBe("Requester Name");
     expect(contactResult!.channel.type).toBe("telegram");
@@ -236,7 +236,7 @@ describe("trusted contact verification → member activation", () => {
     // Simulate the ACL check that inbound-message-handler performs
     const contactResult = findContactChannel({
       channelType: "telegram",
-      externalUserId: "requester-user-456",
+      address: "requester-user-456",
     });
 
     expect(contactResult).not.toBeNull();
@@ -274,7 +274,7 @@ describe("trusted contact verification → member activation", () => {
     // Member should be found via contacts
     const contactResult = findContactChannel({
       channelType: "telegram",
-      externalUserId: "user-cross-test",
+      address: "user-cross-test",
     });
     expect(contactResult).not.toBeNull();
     expect(contactResult!.channel.status).toBe("active");
@@ -282,7 +282,7 @@ describe("trusted contact verification → member activation", () => {
     // Member should NOT be found for a different channel type
     const otherChannel = findContactChannel({
       channelType: "slack",
-      externalUserId: "user-cross-test",
+      address: "user-cross-test",
     });
     expect(otherChannel).toBeNull();
   });
@@ -306,7 +306,7 @@ describe("trusted contact verification → member activation", () => {
     // Verify the member is indeed revoked (ACL would reject)
     const revokedResult = findContactChannel({
       channelType: "telegram",
-      externalUserId: "user-revoked",
+      address: "user-revoked",
     });
     expect(revokedResult).not.toBeNull();
     expect(revokedResult!.channel.status).toBe("revoked");
@@ -345,7 +345,7 @@ describe("trusted contact verification → member activation", () => {
     // Verify: member is now active again
     const reactivatedResult = findContactChannel({
       channelType: "telegram",
-      externalUserId: "user-revoked",
+      address: "user-revoked",
     });
     expect(reactivatedResult).not.toBeNull();
     expect(reactivatedResult!.channel.status).toBe("active");
@@ -390,9 +390,7 @@ describe("trusted contact verification → member activation", () => {
     // The original guardian binding should remain intact
     const guardianResult = findGuardianForChannel("telegram");
     expect(guardianResult).not.toBeNull();
-    expect(guardianResult!.channel.externalUserId).toBe(
-      "guardian-user-original",
-    );
+    expect(guardianResult!.channel.address).toBe("guardian-user-original");
   });
 
   test("guardian inbound verification succeeds but does not create binding", async () => {

package/src/__tests__/twilio-routes.test.ts

@@ -92,8 +92,21 @@ let mockRouteSetupResult: {
   },
 };
 
+// Captures the last context passed to routeSetup so preflight tests can
+// assert the resolved phone admission policy was threaded through.
+let lastRouteSetupCtx: Record<string, unknown> | null = null;
 mock.module("../calls/relay-setup-router.js", () => ({
-  routeSetup: () => mockRouteSetupResult,
+  routeSetup: (ctx: Record<string, unknown>) => {
+    lastRouteSetupCtx = ctx;
+    return mockRouteSetupResult;
+  },
+}));
+
+// Mock the phone channel admission reader used by the media-stream preflight.
+// Tests override mockAdmissionPolicy to exercise floor classification.
+let mockAdmissionPolicy: unknown = null;
+mock.module("../calls/channel-admission-reader.js", () => ({
+  getChannelAdmissionPolicy: async () => mockAdmissionPolicy,
 }));
 
 mock.module("../config/env.js", () => ({
@@ -454,6 +467,9 @@ describe("twilio webhook routes", () => {
     mockTwilioApiValidationBody = JSON.stringify({ sid: "AC_validated" });
     // Reset STT config to defaults between tests
     mockConfigObj.services.stt.provider = "deepgram" as any;
+    // Reset admission policy + captured routeSetup context between tests
+    mockAdmissionPolicy = null;
+    lastRouteSetupCtx = null;
     // Reset routeSetup mock to default normal_call
     mockRouteSetupResult = {
       outcome: { action: "normal_call", isInbound: true },
@@ -1228,6 +1244,70 @@ describe("twilio webhook routes", () => {
       expect(twiml).not.toContain("<ConversationRelay");
     });
 
+    test("media-stream: resolves the phone admission floor and threads it into the preflight routeSetup", async () => {
+      mockConfigObj.services.stt.provider = "openai-whisper" as any;
+      mockAdmissionPolicy = "guardian_only";
+      mockRouteSetupResult = {
+        outcome: { action: "normal_call", isInbound: true },
+        resolved: {
+          assistantId: "self",
+          isInbound: true,
+          otherPartyNumber: "+15559998888",
+          actorTrust: { trustClass: "guardian", memberRecord: null },
+        },
+      };
+
+      const session = createTestSession("conv-ms-floor-1", "CA_ms_floor_1");
+      const req = makeVoiceRequest(session.id, { CallSid: "CA_ms_floor_1" });
+
+      const res = await handleVoiceWebhook(req);
+      expect(res.status).toBe(200);
+
+      // The resolved floor was passed into the preflight routeSetup so its
+      // classification matches the real stream-start enforcement.
+      expect(lastRouteSetupCtx).not.toBeNull();
+      expect(lastRouteSetupCtx?.admissionPolicy).toBe("guardian_only");
+    });
+
+    test("media-stream: floor-denied caller classified deny still produces Stream TwiML (deny handled at stream level)", async () => {
+      mockConfigObj.services.stt.provider = "openai-whisper" as any;
+      mockAdmissionPolicy = "guardian_only";
+      // With the floor wired, the real router returns `deny` for a
+      // below-floor trusted_contact caller; the mock reflects that.
+      mockRouteSetupResult = {
+        outcome: {
+          action: "deny",
+          message:
+            "This number is not authorized to reach the assistant right now.",
+          logReason: "Inbound voice admission floor: guardian_only",
+        },
+        resolved: {
+          assistantId: "self",
+          isInbound: true,
+          otherPartyNumber: "+14155550000",
+          actorTrust: { trustClass: "trusted_contact", memberRecord: null },
+        },
+      };
+
+      const session = createTestSession(
+        "conv-ms-floor-deny-1",
+        "CA_ms_floor_deny_1",
+      );
+      const req = makeVoiceRequest(session.id, {
+        CallSid: "CA_ms_floor_deny_1",
+      });
+
+      const res = await handleVoiceWebhook(req);
+      expect(res.status).toBe(200);
+
+      // Policy was threaded; deny is supported on media-stream, so Stream
+      // TwiML is still produced (denial spoken + torn down at stream start).
+      expect(lastRouteSetupCtx?.admissionPolicy).toBe("guardian_only");
+      const twiml = await res.text();
+      expect(twiml).toContain("<Stream");
+      expect(twiml).not.toContain("<ConversationRelay");
+    });
+
     test("media-stream: deny setup proceeds with Stream TwiML (deny is handled at stream level)", async () => {
       mockConfigObj.services.stt.provider = "openai-whisper" as any;
       mockRouteSetupResult = {

package/src/__tests__/voice-invite-redemption.test.ts

@@ -180,7 +180,7 @@ describe("redeemVoiceInviteCode", () => {
 
     const channelResult = findContactChannel({
       channelType: "phone",
-      externalUserId: phone,
+      address: phone,
     });
 
     expect(channelResult).not.toBeNull();
@@ -368,7 +368,6 @@ describe("redeemVoiceInviteCode", () => {
         {
           type: "phone",
           address: phone,
-          externalUserId: phone,
           status: "revoked",
         },
       ],
@@ -399,7 +398,7 @@ describe("redeemVoiceInviteCode", () => {
     // Verify the redeemer's phone is now bound to Mom's contact
     const contactResult = findContactChannel({
       channelType: "phone",
-      externalUserId: phone,
+      address: phone,
     });
     expect(contactResult).not.toBeNull();
     expect(contactResult!.contact.id).toBe(momContact.id);

package/src/__tests__/weak-open-model.test.ts

@@ -0,0 +1,30 @@
+import { describe, expect, test } from "bun:test";
+
+import { isWeakOpenModel } from "../providers/weak-open-model.js";
+
+describe("isWeakOpenModel", () => {
+  test("matches weak open models across provider naming conventions", () => {
+    for (const model of [
+      "accounts/fireworks/models/minimax-m3",
+      "minimax/minimax-m3",
+      "moonshotai/kimi-k2.6",
+      "accounts/fireworks/models/kimi-k2p6",
+      "deepseek/deepseek-chat",
+      "accounts/fireworks/models/glm-5p2",
+    ]) {
+      expect(isWeakOpenModel(model)).toBe(true);
+    }
+  });
+
+  test("does not match capable models", () => {
+    for (const model of ["claude-opus-4-8", "claude-sonnet-4-6", "gpt-5.5"]) {
+      expect(isWeakOpenModel(model)).toBe(false);
+    }
+  });
+
+  test("is false for null/undefined/empty", () => {
+    expect(isWeakOpenModel(null)).toBe(false);
+    expect(isWeakOpenModel(undefined)).toBe(false);
+    expect(isWeakOpenModel("")).toBe(false);
+  });
+});

package/src/__tests__/web-search-catalog-parity.test.ts

@@ -8,20 +8,15 @@ import {
 } from "../providers/search-provider-catalog.js";
 
 /**
- * Parity guard: daemon TS catalog vs the two generated JSON copies.
+ * Parity guard: daemon TS catalog vs the generated JSON copy.
  *
  * The daemon maintains its canonical search-provider catalog in
  * `assistant/src/providers/search-provider-catalog.ts`.
- * `assistant/scripts/sync-web-search-catalog.ts` writes two byte-identical
- * artifacts:
- *   - `meta/web-search-provider-catalog.json` — primary cross-package artifact.
- *   - `clients/shared/Resources/web-search-provider-catalog.json` — SwiftPM
- *     resource bundled into `VellumAssistantShared` (Swift cannot reach
- *     files outside a target's source directory).
+ * `assistant/scripts/sync-web-search-catalog.ts` writes
+ * `meta/web-search-provider-catalog.json` — the primary cross-package artifact.
  *
  * These tests enforce structural equality between the TS catalog and the
- * meta/ copy, plus byte equality between the meta/ copy and the SwiftPM
- * mirror. CI fails when any of the three drift.
+ * meta/ copy. CI fails when they drift.
  */
 
 interface JsonCatalogEntry {
@@ -46,11 +41,6 @@ const META_JSON_PATH = join(
   "..",
   "meta/web-search-provider-catalog.json",
 );
-const SWIFTPM_MIRROR_PATH = join(
-  process.cwd(),
-  "..",
-  "clients/shared/Resources/web-search-provider-catalog.json",
-);
 
 function loadJsonCatalog(): JsonCatalog {
   return JSON.parse(readFileSync(META_JSON_PATH, "utf-8"));
@@ -73,7 +63,8 @@ function entryToPlain(
   if (entry.apiKeyPrefix !== undefined) out.apiKeyPrefix = entry.apiKeyPrefix;
   if (entry.envVar !== undefined) out.envVar = entry.envVar;
   if (entry.secretKey !== undefined) out.secretKey = entry.secretKey;
-  if (entry.fallbackOrder !== undefined) out.fallbackOrder = entry.fallbackOrder;
+  if (entry.fallbackOrder !== undefined)
+    out.fallbackOrder = entry.fallbackOrder;
   if (entry.privacyPolicyUrl !== undefined) {
     out.privacyPolicyUrl = entry.privacyPolicyUrl;
   }
@@ -95,14 +86,4 @@ describe("web-search catalog parity (TS canonical vs meta/ JSON)", () => {
       SEARCH_PROVIDER_CATALOG.map((p) => p.id),
     );
   });
-
-  test("SwiftPM mirror is byte-identical to meta/ copy", () => {
-    // The generator writes both files from the same serializer; this guard
-    // catches any case where one copy is regenerated without the other.
-    // Byte equality is required because SwiftPM bundles the resource verbatim
-    // and the meta/ JSON is consumed as a cross-package artifact.
-    const metaBytes = readFileSync(META_JSON_PATH);
-    const swiftPmBytes = readFileSync(SWIFTPM_MIRROR_PATH);
-    expect(swiftPmBytes.equals(metaBytes)).toBe(true);
-  });
 });