@vellumai/assistant 0.9.1-staging.1 → 0.10.0-staging.2

package/src/__tests__/post-compaction-reinjection-idempotency.test.ts

@@ -0,0 +1,214 @@
+/**
+ * Post-compaction re-injection idempotency.
+ *
+ * The agent loop hands the post-compaction hook the full injected continuation
+ * history (it does not pre-strip it), so the hook must clear the tail's stale
+ * per-turn injection blocks before re-applying them. Without that strip,
+ * `applyRuntimeInjections` double-stacks every non-presence-gated block —
+ * `<turn_context>`, `<config_reset_notice>`, `<active_documents>`,
+ * `<document_comments>` — because it appends to the tail without removing an
+ * existing copy. These tests cover the strip primitive directly and the
+ * end-to-end re-injection it protects.
+ */
+import { afterEach, describe, expect, test } from "bun:test";
+
+import {
+  clearConversations,
+  setConversation,
+} from "../daemon/conversation-registry.js";
+import { applyRuntimeInjections } from "../daemon/conversation-runtime-assembly.js";
+import { stripTailInjectionsForReinjection } from "../plugins/defaults/memory-retrieval/tail-reinjection-strip.js";
+import type { Message } from "../providers/types.js";
+
+const WORKSPACE_BLOCK = "<workspace>\nRoot: /sandbox\n</workspace>";
+const INFO_BLOCK = "<info>\nRemembered fact about project-x\n</info>";
+const TURN_CONTEXT_BLOCK =
+  "<turn_context>\ncurrent_time: noon\n</turn_context>";
+const CONFIG_RESET_BLOCK =
+  "<config_reset_notice>\nSettings were reset.\n</config_reset_notice>";
+const ACTIVE_DOCUMENTS_BLOCK =
+  "<active_documents>\nThe following documents are open: notes.md\n</active_documents>";
+const DOCUMENT_COMMENTS_BLOCK =
+  "<document_comments>\nOpen comments on notes.md\n</document_comments>";
+const TURN_BODY = "Please continue the task.";
+
+function userMsg(...texts: string[]): Message {
+  return {
+    role: "user",
+    content: texts.map((text) => ({ type: "text" as const, text })),
+  };
+}
+
+function assistantMsg(text: string): Message {
+  return { role: "assistant", content: [{ type: "text", text }] };
+}
+
+function tailContentTexts(messages: Message[]): string[] {
+  const last = messages[messages.length - 1];
+  return last.content.map((block) => (block.type === "text" ? block.text : ""));
+}
+
+function countTailBlocksWithPrefix(
+  messages: Message[],
+  prefix: string,
+): number {
+  return tailContentTexts(messages).filter((text) => text.startsWith(prefix))
+    .length;
+}
+
+describe("stripTailInjectionsForReinjection", () => {
+  test("clears every per-turn injection block from the tail user message", () => {
+    // GIVEN a tail user message carrying the real turn body plus the full
+    // per-turn injection set, including the four blocks compaction keeps in
+    // durable history
+    const messages: Message[] = [
+      userMsg(
+        TURN_BODY,
+        WORKSPACE_BLOCK,
+        INFO_BLOCK,
+        TURN_CONTEXT_BLOCK,
+        CONFIG_RESET_BLOCK,
+        ACTIVE_DOCUMENTS_BLOCK,
+        DOCUMENT_COMMENTS_BLOCK,
+      ),
+    ];
+
+    // WHEN the tail injections are stripped for re-injection
+    const result = stripTailInjectionsForReinjection(messages);
+
+    // THEN only the real turn body survives on the tail
+    expect(tailContentTexts(result)).toEqual([TURN_BODY]);
+  });
+
+  test("leaves injection blocks on earlier messages untouched", () => {
+    // GIVEN an earlier user message and the tail both carrying a turn-context
+    // block
+    const messages: Message[] = [
+      userMsg("Earlier turn", TURN_CONTEXT_BLOCK),
+      assistantMsg("Working on it."),
+      userMsg(TURN_BODY, TURN_CONTEXT_BLOCK),
+    ];
+
+    // WHEN the tail injections are stripped
+    const result = stripTailInjectionsForReinjection(messages);
+
+    // THEN the earlier message keeps its historical turn-context grounding
+    expect(result[0].content).toHaveLength(2);
+    expect((result[0].content[1] as { text: string }).text).toBe(
+      TURN_CONTEXT_BLOCK,
+    );
+    // AND only the tail is cleared
+    expect(tailContentTexts(result)).toEqual([TURN_BODY]);
+  });
+
+  test("returns the messages unchanged when the tail carries no injections", () => {
+    // GIVEN a tail with only real user content
+    const messages: Message[] = [userMsg(TURN_BODY)];
+
+    // WHEN the tail injections are stripped
+    const result = stripTailInjectionsForReinjection(messages);
+
+    // THEN the array is returned unchanged
+    expect(result).toBe(messages);
+  });
+
+  test("preserves the tail user message even when every block is stripped", () => {
+    // GIVEN a tail composed entirely of injection blocks
+    const messages: Message[] = [
+      assistantMsg("Earlier reply."),
+      userMsg(WORKSPACE_BLOCK, TURN_CONTEXT_BLOCK),
+    ];
+
+    // WHEN the tail injections are stripped
+    const result = stripTailInjectionsForReinjection(messages);
+
+    // THEN the tail user message remains so the re-injection tail invariant
+    // holds, just with empty content
+    expect(result).toHaveLength(2);
+    expect(result[1].role).toBe("user");
+    expect(result[1].content).toHaveLength(0);
+  });
+
+  test("is idempotent — stripping an already-stripped tail is a no-op", () => {
+    // GIVEN a tail that has already been stripped once
+    const messages: Message[] = [userMsg(TURN_BODY, TURN_CONTEXT_BLOCK)];
+    const once = stripTailInjectionsForReinjection(messages);
+
+    // WHEN it is stripped again
+    const twice = stripTailInjectionsForReinjection(once);
+
+    // THEN the second strip changes nothing
+    expect(twice).toBe(once);
+    expect(tailContentTexts(twice)).toEqual([TURN_BODY]);
+  });
+});
+
+describe("applyRuntimeInjections re-injection idempotency", () => {
+  // `applyRuntimeInjections` synthesizes this conversation id when no
+  // turnContext is supplied, so the injectors resolve their blocks from the
+  // registry under this key.
+  const FALLBACK_CONVERSATION_ID = "runtime-assembly-fallback";
+
+  // Seed the fallback conversation with a workspace block (presence-gated) and
+  // a frozen temporal snapshot so the non-presence-gated `<turn_context>` block
+  // is produced every assembly.
+  function seedConversation(): void {
+    setConversation(FALLBACK_CONVERSATION_ID, {
+      conversationId: FALLBACK_CONVERSATION_ID,
+      workingDir: "/sandbox",
+      workspaceTopLevelContext: WORKSPACE_BLOCK,
+      workspaceTopLevelDirty: false,
+      currentTurnTemporalSnapshot: { clientTimezone: null },
+    } as never);
+  }
+
+  afterEach(() => {
+    clearConversations();
+  });
+
+  test("re-injecting an already-injected base without the strip double-stacks the non-presence-gated block", async () => {
+    // GIVEN a fresh turn assembled once, so its tail carries one workspace and
+    // one turn-context block
+    seedConversation();
+    const { messages: injectedOnce } = await applyRuntimeInjections(
+      [userMsg(TURN_BODY)],
+      { conversationId: FALLBACK_CONVERSATION_ID },
+    );
+    expect(countTailBlocksWithPrefix(injectedOnce, "<turn_context>")).toBe(1);
+
+    // WHEN injections are applied again to that already-injected base
+    const { messages: injectedTwice } = await applyRuntimeInjections(
+      injectedOnce,
+      { conversationId: FALLBACK_CONVERSATION_ID },
+    );
+
+    // THEN the non-presence-gated turn-context block double-stacks
+    expect(countTailBlocksWithPrefix(injectedTwice, "<turn_context>")).toBe(2);
+    // AND the presence-gated workspace block stays single
+    expect(countTailBlocksWithPrefix(injectedTwice, "<workspace>")).toBe(1);
+  });
+
+  test("stripping the tail before re-injecting keeps every block single", async () => {
+    // GIVEN a fresh turn assembled once
+    seedConversation();
+    const { messages: injectedOnce } = await applyRuntimeInjections(
+      [userMsg(TURN_BODY)],
+      { conversationId: FALLBACK_CONVERSATION_ID },
+    );
+
+    // WHEN the tail is stripped before re-injection, exactly as the
+    // post-compaction hook does
+    const { messages: reinjected } = await applyRuntimeInjections(
+      stripTailInjectionsForReinjection(injectedOnce),
+      { conversationId: FALLBACK_CONVERSATION_ID },
+    );
+
+    // THEN both the non-presence-gated and presence-gated blocks stay single
+    expect(countTailBlocksWithPrefix(reinjected, "<turn_context>")).toBe(1);
+    expect(countTailBlocksWithPrefix(reinjected, "<workspace>")).toBe(1);
+    // AND the real turn body survives
+    expect(
+      tailContentTexts(reinjected).some((text) => text === TURN_BODY),
+    ).toBe(true);
+  });
+});

package/src/__tests__/provider-send-message-override-profile.test.ts

@@ -261,3 +261,79 @@ describe("SendMessageOptions.config.overrideProfile", () => {
     expect(captured?.overrideProfile).toBeUndefined();
   });
 });
+
+describe("SendMessageOptions.config.forceOverrideProfile", () => {
+  test("CallSiteConfiguredProvider forwards forceOverrideProfile into the send config", async () => {
+    let captured: SendMessageOptions | undefined;
+    const inner: Provider = {
+      name: "anthropic",
+      async sendMessage(
+        _messages: Message[],
+        options?: SendMessageOptions,
+      ): Promise<ProviderResponse> {
+        captured = options;
+        return makeResponse("anthropic");
+      },
+    };
+
+    const provider = new CallSiteConfiguredProvider(
+      inner,
+      "inference",
+      "strong",
+      true,
+    );
+    await provider.sendMessage(DUMMY_MESSAGES, {});
+
+    expect(captured?.config).toMatchObject({
+      callSite: "inference",
+      overrideProfile: "strong",
+      forceOverrideProfile: true,
+    });
+  });
+
+  test("forceOverrideProfile floats the override above a call-site profile pin", async () => {
+    // The advisor scenario in miniature: the `inference` call site is pinned to
+    // a cheap profile, but a caller forces a stronger profile for its own send.
+    setLlmConfig({
+      default: { provider: "anthropic", model: "claude-opus-4-7" },
+      profiles: {
+        cheap: { provider: "anthropic", model: "claude-haiku-4-5-20251001" },
+        strong: { provider: "anthropic", model: "claude-opus-4-8" },
+      },
+      callSites: { inference: { profile: "cheap" } },
+    });
+
+    const send = async (force: boolean) => {
+      let captured: Record<string, unknown> | undefined;
+      const inner: Provider = {
+        name: "anthropic",
+        async sendMessage(
+          _messages: Message[],
+          options?: SendMessageOptions,
+        ): Promise<ProviderResponse> {
+          captured = options?.config as Record<string, unknown> | undefined;
+          return makeResponse("anthropic");
+        },
+      };
+      const provider = new RetryProvider(inner);
+      await provider.sendMessage(DUMMY_MESSAGES, {
+        config: {
+          callSite: "inference",
+          overrideProfile: "strong",
+          ...(force ? { forceOverrideProfile: true } : {}),
+        },
+      });
+      return captured;
+    };
+
+    // Without the flag, the call-site pin (`cheap`) outranks `overrideProfile`.
+    expect((await send(false))?.model).toBe("claude-haiku-4-5-20251001");
+
+    // With the flag, the forced `strong` profile wins over the call-site pin.
+    const forced = await send(true);
+    expect(forced?.model).toBe("claude-opus-4-8");
+    // The routing keys are stripped before the provider wire request.
+    expect(forced?.overrideProfile).toBeUndefined();
+    expect(forced?.forceOverrideProfile).toBeUndefined();
+  });
+});

package/src/__tests__/reaction-persistence.test.ts

@@ -46,23 +46,20 @@ import { eq } from "drizzle-orm";
 
 import { upsertContactChannel } from "../contacts/contacts-write.js";
 import type { Conversation } from "../daemon/conversation.js";
+import {
+  createCanonicalGuardianDelivery,
+  createCanonicalGuardianRequest,
+  getCanonicalGuardianRequest,
+} from "../memory/canonical-guardian-store.js";
 import { getDb } from "../memory/db-connection.js";
 import { initializeDb } from "../memory/db-init.js";
-import {
-  createApprovalRequest,
-  getPendingApprovalForRequest,
-} from "../memory/guardian-approvals.js";
 import { messages } from "../memory/schema/conversations.js";
 import { readSlackMetadata } from "../messaging/providers/slack/message-metadata.js";
 import * as pendingInteractions from "../runtime/pending-interactions.js";
-import {
-  _clearApprovalPromptTsTrackerForTesting,
-  trackApprovalPromptTs,
-} from "../runtime/routes/approval-prompt-ts-tracker.js";
 import {
   isSlackReactionEvent,
   parseSlackReactionCallbackData,
-} from "../runtime/routes/inbound-message-handler.js";
+} from "../runtime/routes/inbound-stages/reaction-intercept.js";
 import { handleChannelInbound } from "./helpers/channel-test-adapter.js";
 import { createGuardianBinding } from "./helpers/create-guardian-binding.js";
 
@@ -84,7 +81,6 @@ function resetState(): void {
   db.run("DELETE FROM conversations");
   db.run("DELETE FROM contact_channels");
   db.run("DELETE FROM contacts");
-  _clearApprovalPromptTsTrackerForTesting();
 }
 
 function seedActiveMember(): void {
@@ -421,21 +417,35 @@ function seedGuardianForChannel(): void {
 function seedPendingGuardianApprovalForReaction(
   requestId: string,
   conversationId: string,
+  reactedTs: string,
 ): void {
-  createApprovalRequest({
-    runId: `run-${requestId}`,
-    requestId,
+  // Canonical tool_approval request keyed by the confirmation requestId — the
+  // same record assistant-event-hub creates for every confirmation.
+  createCanonicalGuardianRequest({
+    id: requestId,
+    kind: "tool_approval",
+    sourceType: "channel",
+    sourceChannel: "slack",
     conversationId,
-    channel: "slack",
     requesterExternalUserId: "requester-user-1",
     requesterChatId: SLACK_CHANNEL_ID,
     guardianExternalUserId: GUARDIAN_USER_ID,
-    guardianChatId: SLACK_CHANNEL_ID,
+    guardianPrincipalId: GUARDIAN_USER_ID,
     toolName: GUARDIAN_REACTION_TOOL,
+    status: "pending",
     expiresAt: Date.now() + 300_000,
   });
 
-  // Register a pending interaction so applyGuardianDecision finds the
+  // The delivered approval card → request mapping the reaction resolves
+  // against (destination_message_id = the reacted Slack ts).
+  createCanonicalGuardianDelivery({
+    requestId,
+    destinationChannel: "slack",
+    destinationChatId: SLACK_CHANNEL_ID,
+    destinationMessageId: reactedTs,
+  });
+
+  // Register a pending interaction so the tool_approval resolver finds the
   // requester-side hook to drive `allow`.
   const handleConfirmationResponse = mock(() => {});
   const _mockSession = {
@@ -466,18 +476,17 @@ describe("guardian approval-by-reaction integration via handleChannelInbound", (
     db.run("DELETE FROM conversations");
     db.run("DELETE FROM contact_channels");
     db.run("DELETE FROM contacts");
-    db.run("DELETE FROM channel_guardian_approval_requests");
+    db.run("DELETE FROM canonical_guardian_requests");
+    db.run("DELETE FROM canonical_guardian_deliveries");
     pendingInteractions.clear();
-    _clearApprovalPromptTsTrackerForTesting();
     msgCounter = 0;
   });
 
   test("guardian reaction on pending approval applies decision and persists no transcript row", async () => {
     seedGuardianForChannel();
     const requestId = "req-guardian-react-1";
-    // Conversation must exist so the approval row's conversation_id FK
-    // resolves; reuse an inbound seed by sending a no-op message that the
-    // ACL allows. Easier: insert directly via the DB layer.
+    // Back the canonical request and its pending interaction with a real
+    // conversation row, inserted directly via the DB layer.
     const db = getDb();
     const conversationId = "conv-react-test-1";
     const now = Date.now();
@@ -491,12 +500,15 @@ describe("guardian approval-by-reaction integration via handleChannelInbound", (
       )
       .run(conversationId, now, now);
 
-    seedPendingGuardianApprovalForReaction(requestId, conversationId);
-
     const reactedTs = "1700000099.000001";
-    // Simulate the approval prompt having been delivered on this ts so the
-    // guardian reaction is scoped to a tracked prompt message.
-    trackApprovalPromptTs("slack", SLACK_CHANNEL_ID, reactedTs);
+    // The approval card was delivered on this ts; its canonical delivery row
+    // is how the guardian reaction is scoped to a known approval message.
+    seedPendingGuardianApprovalForReaction(
+      requestId,
+      conversationId,
+      reactedTs,
+    );
+
     const body = {
       sourceChannel: "slack",
       interface: "slack",
@@ -541,11 +553,11 @@ describe("guardian approval-by-reaction integration via handleChannelInbound", (
 
     expect(resp.status).toBe(200);
     expect(json.accepted).toBe(true);
-    expect(json.approval).toBe("guardian_decision_applied");
+    expect(json.canonicalRouter).toBe("canonical_decision_applied");
     expect(approvalConversationGenerator).not.toHaveBeenCalled();
 
-    // The pending approval row is resolved (no longer pending).
-    expect(getPendingApprovalForRequest(requestId)).toBeNull();
+    // The canonical request is resolved (no longer pending).
+    expect(getCanonicalGuardianRequest(requestId)?.status).toBe("approved");
 
     // No transcript row was written for the reaction itself — resolved
     // guardian approval reactions have no transcript representation.
@@ -563,3 +575,112 @@ describe("guardian approval-by-reaction integration via handleChannelInbound", (
     expect(reactionRows.length).toBe(0);
   });
 });
+
+// ---------------------------------------------------------------------------
+// Reaction access-control regression (LUM-2489)
+// ---------------------------------------------------------------------------
+//
+// A reaction is a passive signal, not an access attempt. Because reactions are
+// dispatched before the ingress pipeline, an unknown user's 👍 must never run
+// ACL (no trusted-contact verification handshake), create a conversation, or
+// write a binding — it is dropped as channel noise. A known contact's reaction
+// is recorded; neither triggers a verification challenge.
+
+describe("reaction access control (no verification handshake)", () => {
+  const STRANGER_USER_ID = "U_REACTION_STRANGER";
+  const CONTACT_USER_ID = "U_REACTION_CONTACT";
+  // Guardian's approval channel is a DM, distinct from the public channel the
+  // reaction lands in (mirroring production). Reusing the public channel id
+  // would let a reactor match the guardian's channel via findContactChannel's
+  // externalChatId fallback and mask the bug.
+  const GUARDIAN_DM_CHAT = "D_GUARDIAN_DM";
+
+  function tableCount(table: string): number {
+    return (
+      getDb().$client.prepare(`SELECT COUNT(*) AS n FROM ${table}`).get() as {
+        n: number;
+      }
+    ).n;
+  }
+
+  beforeEach(() => {
+    resetState();
+    getDb().run("DELETE FROM channel_verification_sessions");
+    // The assistant has a guardian (as in production); the reactors below are
+    // different users.
+    createGuardianBinding({
+      channel: "slack",
+      guardianExternalUserId: GUARDIAN_USER_ID,
+      guardianDeliveryChatId: GUARDIAN_DM_CHAT,
+      guardianPrincipalId: GUARDIAN_USER_ID,
+    });
+    msgCounter = 0;
+  });
+
+  test("stranger's reaction is dropped — no challenge, session, conversation, or row", async () => {
+    let agentDispatched = false;
+    const processMessage = async (): Promise<{ messageId: string }> => {
+      agentDispatched = true;
+      return { messageId: "should-not-be-called" };
+    };
+
+    const req = buildReactionRequest("reaction:thumbsup", {
+      actorExternalId: STRANGER_USER_ID,
+      actorDisplayName: "Outside Reactor",
+      actorUsername: "outsider",
+    });
+    const resp = await handleChannelInbound(
+      req,
+      processMessage,
+      TEST_BEARER_TOKEN,
+    );
+    const json = (await resp.json()) as Record<string, unknown>;
+
+    // Accepted as a passive signal — never denied or turned into a challenge.
+    expect(json.accepted).toBe(true);
+    expect(json.denied).not.toBe(true);
+    expect(json.reason).not.toBe("verification_challenge_sent");
+    expect(json.verificationSessionId).toBeUndefined();
+    expect(agentDispatched).toBe(false);
+
+    // No verification handshake, and no side effects: a dropped reaction leaves
+    // no transcript row, no conversation, and no binding.
+    expect(tableCount("channel_verification_sessions")).toBe(0);
+    expect(readPersistedMessages().length).toBe(0);
+    expect(tableCount("conversations")).toBe(0);
+    expect(tableCount("external_conversation_bindings")).toBe(0);
+  });
+
+  test("known contact's reaction is recorded — no challenge", async () => {
+    // A pending contact classifies as `unverified_contact` — a known tier, so
+    // its reactions are recorded. On a real message it would be re-challenged,
+    // but a reaction must not trigger that.
+    upsertContactChannel({
+      sourceChannel: "slack",
+      externalUserId: CONTACT_USER_ID,
+      externalChatId: SLACK_CHANNEL_ID,
+      status: "pending",
+      policy: "allow",
+      displayName: "Pending Contact",
+    });
+
+    const req = buildReactionRequest("reaction:tada", {
+      actorExternalId: CONTACT_USER_ID,
+      actorDisplayName: "Pending Contact",
+      actorUsername: "pending_contact",
+    });
+    const resp = await handleChannelInbound(req, undefined, TEST_BEARER_TOKEN);
+    const json = (await resp.json()) as Record<string, unknown>;
+
+    expect(json.denied).not.toBe(true);
+    expect(json.reason).not.toBe("verification_challenge_sent");
+    expect(tableCount("channel_verification_sessions")).toBe(0);
+
+    const rows = readPersistedMessages();
+    expect(rows.length).toBe(1);
+    const envelope = JSON.parse(rows[0].metadata!) as Record<string, unknown>;
+    const slackMeta = readSlackMetadata(envelope.slackMeta as string);
+    expect(slackMeta?.eventKind).toBe("reaction");
+    expect(slackMeta?.reaction?.emoji).toBe("tada");
+  });
+});