@vellumai/assistant 0.9.1-staging.1 → 0.10.0-staging.2

package/src/__tests__/trusted-contact-inline-approval-integration.test.ts

@@ -92,7 +92,7 @@ mock.module("../runtime/channel-verification-service.js", () => ({
     return null;
   },
   createOutboundSession: () => ({
-    conversationId: "test-session",
+    sessionId: "test-session",
     secret: "123456",
   }),
   bindSessionIdentity: () => {},
@@ -108,16 +108,23 @@ mock.module("../runtime/channel-verification-service.js", () => ({
   }),
 }));
 
-// Mock gateway client — capture delivery calls
+// Mock gateway client — capture delivery calls. `failDeliveryWhen` lets a test
+// simulate a delivery failure for a specific payload (e.g. a DM that can't be
+// opened) so fallback paths can be exercised.
 const deliveredReplies: Array<{
   url: string;
   payload: Record<string, unknown>;
 }> = [];
+let failDeliveryWhen: ((payload: Record<string, unknown>) => boolean) | null =
+  null;
 mock.module("../runtime/gateway-client.js", () => ({
   deliverChannelReply: async (
     url: string,
     payload: Record<string, unknown>,
   ) => {
+    if (failDeliveryWhen?.(payload)) {
+      throw new Error("simulated delivery failure");
+    }
     deliveredReplies.push({ url, payload });
     return { ok: true };
   },
@@ -150,6 +157,7 @@ mock.module("../config/env.js", () => ({
 import { applyCanonicalGuardianDecision } from "../approvals/guardian-decision-primitive.js";
 import type { ActorContext } from "../approvals/guardian-request-resolvers.js";
 import { getResolver } from "../approvals/guardian-request-resolvers.js";
+import { upsertContactChannel } from "../contacts/contacts-write.js";
 import type { TrustContext } from "../daemon/trust-context.js";
 import {
   createCanonicalGuardianRequest,
@@ -564,7 +572,7 @@ describe("(d) unknown actor flow: fail-closed with no interactive approval", ()
 
     expect("skipped" in result && result.skipped).toBe(true);
     if ("skipped" in result) {
-      expect(result.reason).toBe("not_trusted_contact");
+      expect(result.reason).toBe("not_bridgeable_trust_class");
     }
   });
 });
@@ -1088,3 +1096,212 @@ describe("cross-milestone integration checks", () => {
   });
 });
 
+// ===========================================================================
+// (g) access_request resolver: requester verification-code delivery
+//
+// On approval the requester must receive the 6-digit code so the guardian
+// never has to relay it by hand. On Slack the code is DM'd straight to the
+// requester (a private path is guaranteed via their user ID); other channels
+// keep the courier message because a private path to the requester is not
+// guaranteed there (e.g. a group chat would leak the secret).
+// ===========================================================================
+
+describe("(g) access_request resolver: requester code delivery", () => {
+  const REQUESTER_UID = "U_REQUESTER";
+  const GUARDIAN_UID = "U_GUARDIAN";
+
+  function createAccessRequest(overrides: Record<string, unknown> = {}) {
+    return createCanonicalGuardianRequest({
+      id: `access-req-${Date.now()}-${Math.random().toString(36).slice(2)}`,
+      kind: "access_request",
+      sourceType: "channel",
+      sourceChannel: "slack",
+      conversationId: "conv-access-slack",
+      requesterExternalUserId: REQUESTER_UID,
+      requesterChatId: "C_SHARED_CHANNEL",
+      guardianExternalUserId: GUARDIAN_UID,
+      guardianPrincipalId: "test-principal-id",
+      toolName: "ingress_access_request",
+      expiresAt: Date.now() + 60_000,
+      ...overrides,
+    });
+  }
+
+  beforeEach(() => {
+    resetTables();
+    deliveredReplies.length = 0;
+    emittedSignals.length = 0;
+    failDeliveryWhen = null;
+  });
+
+  test("on-channel Slack approval DMs the verification code to the requester", async () => {
+    const req = createAccessRequest();
+
+    const result = await applyCanonicalGuardianDecision({
+      requestId: req.id,
+      action: "approve_once",
+      actorContext: guardianActor({
+        channel: "slack",
+        actorExternalUserId: GUARDIAN_UID,
+      }),
+      channelDeliveryContext: {
+        replyCallbackUrl:
+          "http://localhost:3000/deliver/slack?threadTs=111.222",
+        guardianChatId: "C_SHARED_CHANNEL",
+        assistantId: "self",
+      },
+    });
+
+    expect(result.applied).toBe(true);
+
+    // The requester receives the actual code in their DM (chatId = user ID),
+    // not a "ask the guardian" courier message.
+    const requesterCodeReply = deliveredReplies.find(
+      (r) =>
+        r.payload.chatId === REQUESTER_UID &&
+        typeof r.payload.text === "string" &&
+        (r.payload.text as string).includes("123456"),
+    );
+    expect(requesterCodeReply).toBeDefined();
+    expect(requesterCodeReply!.payload.text).toContain(
+      "your access request was approved",
+    );
+    // The code DM is durable, never ephemeral.
+    expect(requesterCodeReply!.payload.ephemeral).toBeUndefined();
+    // threadTs (the guardian's channel thread) is stripped for the DM.
+    expect(requesterCodeReply!.url).not.toContain("threadTs");
+
+    // No courier "receive from the guardian" message goes to the requester.
+    const courier = deliveredReplies.find(
+      (r) =>
+        typeof r.payload.text === "string" &&
+        (r.payload.text as string).includes("receive from the guardian"),
+    );
+    expect(courier).toBeUndefined();
+  });
+
+  test("desktop-decided approval DMs the code to the Slack requester via the deliver path", async () => {
+    const req = createAccessRequest();
+
+    const result = await applyCanonicalGuardianDecision({
+      requestId: req.id,
+      action: "approve_once",
+      // Desktop decision: no channelDeliveryContext, actor on the vellum channel.
+      actorContext: guardianActor({
+        channel: "vellum",
+        actorExternalUserId: undefined,
+      }),
+    });
+
+    expect(result.applied).toBe(true);
+
+    const requesterCodeReply = deliveredReplies.find(
+      (r) =>
+        r.payload.chatId === REQUESTER_UID &&
+        typeof r.payload.text === "string" &&
+        (r.payload.text as string).includes("123456"),
+    );
+    expect(requesterCodeReply).toBeDefined();
+    expect(requesterCodeReply!.url).toContain("/deliver/slack");
+    expect(requesterCodeReply!.payload.text).toContain(
+      "your access request was approved",
+    );
+  });
+
+  test("non-Slack channel keeps the courier message and never delivers the code to the requester chat", async () => {
+    const req = createAccessRequest({
+      sourceChannel: "telegram",
+      requesterChatId: "requester-chat-1",
+      conversationId: "conv-access-telegram",
+    });
+
+    const result = await applyCanonicalGuardianDecision({
+      requestId: req.id,
+      action: "approve_once",
+      actorContext: guardianActor({
+        channel: "telegram",
+        actorExternalUserId: GUARDIAN_UID,
+      }),
+      channelDeliveryContext: {
+        replyCallbackUrl: "http://localhost:3000/deliver/telegram",
+        guardianChatId: "guardian-chat-1",
+        assistantId: "self",
+      },
+    });
+
+    expect(result.applied).toBe(true);
+
+    // The requester is told to expect the code from the guardian; the secret is
+    // never delivered to the requester's (possibly group) chat.
+    const requesterReply = deliveredReplies.find(
+      (r) => r.payload.chatId === "requester-chat-1",
+    );
+    expect(requesterReply).toBeDefined();
+    expect(requesterReply!.payload.text).toContain("receive from the guardian");
+    expect(requesterReply!.payload.text).not.toContain("123456");
+  });
+
+  test("Slack shared-channel fallback posts an ephemeral notice to the channel when the DM fails", async () => {
+    const req = createAccessRequest();
+
+    // Make the direct DM (to the U... user ID) fail so the courier fallback runs.
+    failDeliveryWhen = (payload) => payload.chatId === REQUESTER_UID;
+
+    const result = await applyCanonicalGuardianDecision({
+      requestId: req.id,
+      action: "approve_once",
+      actorContext: guardianActor({
+        channel: "slack",
+        actorExternalUserId: GUARDIAN_UID,
+      }),
+      channelDeliveryContext: {
+        replyCallbackUrl:
+          "http://localhost:3000/deliver/slack?threadTs=111.222",
+        guardianChatId: "C_SHARED_CHANNEL",
+        assistantId: "self",
+      },
+    });
+
+    expect(result.applied).toBe(true);
+
+    // The courier notice falls back to an ephemeral message targeting the
+    // originating channel (C...), since chat.postEphemeral needs a channel ID —
+    // not the requester's user ID.
+    const courier = deliveredReplies.find(
+      (r) =>
+        typeof r.payload.text === "string" &&
+        (r.payload.text as string).includes("receive from the guardian"),
+    );
+    expect(courier).toBeDefined();
+    expect(courier!.payload.chatId).toBe("C_SHARED_CHANNEL");
+    expect(courier!.payload.ephemeral).toBe(true);
+    expect(courier!.payload.user).toBe(REQUESTER_UID);
+  });
+
+  test("guardian-facing reply uses the requester's display name, not the raw ID", async () => {
+    // Seed a contact so the resolver can resolve a display name.
+    upsertContactChannel({
+      sourceChannel: "slack",
+      externalUserId: REQUESTER_UID,
+      displayName: "Alice",
+      status: "unverified",
+    });
+
+    const req = createAccessRequest();
+
+    const result = await applyCanonicalGuardianDecision({
+      requestId: req.id,
+      action: "approve_once",
+      // Desktop decision → resolver returns guardianReplyText for assertion.
+      actorContext: guardianActor({
+        channel: "vellum",
+        actorExternalUserId: undefined,
+      }),
+    });
+
+    expect(result.applied).toBe(true);
+    const replyText = result.applied ? result.resolverReplyText : undefined;
+    expect(replyText).toContain("Alice");
+    expect(replyText).not.toContain(REQUESTER_UID);
+  });
+});

package/src/__tests__/trusted-contact-verification.test.ts

@@ -108,7 +108,7 @@ describe("trusted contact verification → member activation", () => {
     expect(contactResult).not.toBeNull();
     expect(contactResult!.channel.status).toBe("active");
     expect(contactResult!.channel.policy).toBe("allow");
-    expect(contactResult!.channel.externalUserId).toBe("requester-user-123");
+    expect(contactResult!.channel.address).toBe("requester-user-123");
     expect(contactResult!.channel.externalChatId).toBe("requester-chat-123");
     expect(contactResult!.contact.displayName).toBe("Requester Name");
     expect(contactResult!.channel.type).toBe("telegram");
@@ -390,9 +390,7 @@ describe("trusted contact verification → member activation", () => {
     // The original guardian binding should remain intact
     const guardianResult = findGuardianForChannel("telegram");
     expect(guardianResult).not.toBeNull();
-    expect(guardianResult!.channel.externalUserId).toBe(
-      "guardian-user-original",
-    );
+    expect(guardianResult!.channel.address).toBe("guardian-user-original");
   });
 
   test("guardian inbound verification succeeds but does not create binding", async () => {

package/src/__tests__/twilio-routes.test.ts

@@ -92,8 +92,21 @@ let mockRouteSetupResult: {
   },
 };
 
+// Captures the last context passed to routeSetup so preflight tests can
+// assert the resolved phone admission policy was threaded through.
+let lastRouteSetupCtx: Record<string, unknown> | null = null;
 mock.module("../calls/relay-setup-router.js", () => ({
-  routeSetup: () => mockRouteSetupResult,
+  routeSetup: (ctx: Record<string, unknown>) => {
+    lastRouteSetupCtx = ctx;
+    return mockRouteSetupResult;
+  },
+}));
+
+// Mock the phone channel admission reader used by the media-stream preflight.
+// Tests override mockAdmissionPolicy to exercise floor classification.
+let mockAdmissionPolicy: unknown = null;
+mock.module("../calls/channel-admission-reader.js", () => ({
+  getChannelAdmissionPolicy: async () => mockAdmissionPolicy,
 }));
 
 mock.module("../config/env.js", () => ({
@@ -454,6 +467,9 @@ describe("twilio webhook routes", () => {
     mockTwilioApiValidationBody = JSON.stringify({ sid: "AC_validated" });
     // Reset STT config to defaults between tests
     mockConfigObj.services.stt.provider = "deepgram" as any;
+    // Reset admission policy + captured routeSetup context between tests
+    mockAdmissionPolicy = null;
+    lastRouteSetupCtx = null;
     // Reset routeSetup mock to default normal_call
     mockRouteSetupResult = {
       outcome: { action: "normal_call", isInbound: true },
@@ -1228,6 +1244,70 @@ describe("twilio webhook routes", () => {
       expect(twiml).not.toContain("<ConversationRelay");
     });
 
+    test("media-stream: resolves the phone admission floor and threads it into the preflight routeSetup", async () => {
+      mockConfigObj.services.stt.provider = "openai-whisper" as any;
+      mockAdmissionPolicy = "guardian_only";
+      mockRouteSetupResult = {
+        outcome: { action: "normal_call", isInbound: true },
+        resolved: {
+          assistantId: "self",
+          isInbound: true,
+          otherPartyNumber: "+15559998888",
+          actorTrust: { trustClass: "guardian", memberRecord: null },
+        },
+      };
+
+      const session = createTestSession("conv-ms-floor-1", "CA_ms_floor_1");
+      const req = makeVoiceRequest(session.id, { CallSid: "CA_ms_floor_1" });
+
+      const res = await handleVoiceWebhook(req);
+      expect(res.status).toBe(200);
+
+      // The resolved floor was passed into the preflight routeSetup so its
+      // classification matches the real stream-start enforcement.
+      expect(lastRouteSetupCtx).not.toBeNull();
+      expect(lastRouteSetupCtx?.admissionPolicy).toBe("guardian_only");
+    });
+
+    test("media-stream: floor-denied caller classified deny still produces Stream TwiML (deny handled at stream level)", async () => {
+      mockConfigObj.services.stt.provider = "openai-whisper" as any;
+      mockAdmissionPolicy = "guardian_only";
+      // With the floor wired, the real router returns `deny` for a
+      // below-floor trusted_contact caller; the mock reflects that.
+      mockRouteSetupResult = {
+        outcome: {
+          action: "deny",
+          message:
+            "This number is not authorized to reach the assistant right now.",
+          logReason: "Inbound voice admission floor: guardian_only",
+        },
+        resolved: {
+          assistantId: "self",
+          isInbound: true,
+          otherPartyNumber: "+14155550000",
+          actorTrust: { trustClass: "trusted_contact", memberRecord: null },
+        },
+      };
+
+      const session = createTestSession(
+        "conv-ms-floor-deny-1",
+        "CA_ms_floor_deny_1",
+      );
+      const req = makeVoiceRequest(session.id, {
+        CallSid: "CA_ms_floor_deny_1",
+      });
+
+      const res = await handleVoiceWebhook(req);
+      expect(res.status).toBe(200);
+
+      // Policy was threaded; deny is supported on media-stream, so Stream
+      // TwiML is still produced (denial spoken + torn down at stream start).
+      expect(lastRouteSetupCtx?.admissionPolicy).toBe("guardian_only");
+      const twiml = await res.text();
+      expect(twiml).toContain("<Stream");
+      expect(twiml).not.toContain("<ConversationRelay");
+    });
+
     test("media-stream: deny setup proceeds with Stream TwiML (deny is handled at stream level)", async () => {
       mockConfigObj.services.stt.provider = "openai-whisper" as any;
       mockRouteSetupResult = {

package/src/__tests__/voice-invite-redemption.test.ts

@@ -368,7 +368,6 @@ describe("redeemVoiceInviteCode", () => {
         {
           type: "phone",
           address: phone,
-          externalUserId: phone,
           status: "revoked",
         },
       ],

package/src/__tests__/weak-open-model.test.ts

@@ -0,0 +1,30 @@
+import { describe, expect, test } from "bun:test";
+
+import { isWeakOpenModel } from "../providers/weak-open-model.js";
+
+describe("isWeakOpenModel", () => {
+  test("matches weak open models across provider naming conventions", () => {
+    for (const model of [
+      "accounts/fireworks/models/minimax-m3",
+      "minimax/minimax-m3",
+      "moonshotai/kimi-k2.6",
+      "accounts/fireworks/models/kimi-k2p6",
+      "deepseek/deepseek-chat",
+      "accounts/fireworks/models/glm-5p2",
+    ]) {
+      expect(isWeakOpenModel(model)).toBe(true);
+    }
+  });
+
+  test("does not match capable models", () => {
+    for (const model of ["claude-opus-4-8", "claude-sonnet-4-6", "gpt-5.5"]) {
+      expect(isWeakOpenModel(model)).toBe(false);
+    }
+  });
+
+  test("is false for null/undefined/empty", () => {
+    expect(isWeakOpenModel(null)).toBe(false);
+    expect(isWeakOpenModel(undefined)).toBe(false);
+    expect(isWeakOpenModel("")).toBe(false);
+  });
+});

package/src/__tests__/workspace-migration-105-enable-memory-v3-live-for-new-workspaces.test.ts

@@ -0,0 +1,149 @@
+/**
+ * Tests for workspace migration `105-enable-memory-v3-live-for-new-workspaces`.
+ *
+ * The schema default for `memory.v3.live` is false so existing assistants stay
+ * on v2. The migration persists `memory.v3.live = true` for FRESH workspaces
+ * only (switching new assistants onto memory-v3 at creation), creating
+ * `config.json` when it does not exist, leaving existing workspaces and
+ * explicit values untouched, and being idempotent.
+ */
+
+import {
+  existsSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+
+import { MemoryV3ConfigSchema } from "../config/schemas/memory-v3.js";
+import { enableMemoryV3LiveForNewWorkspacesMigration } from "../workspace/migrations/105-enable-memory-v3-live-for-new-workspaces.js";
+import type { MigrationRunContext } from "../workspace/migrations/types.js";
+
+const NEW_WORKSPACE_CTX: MigrationRunContext = { isNewWorkspace: true };
+const UPGRADE_CTX: MigrationRunContext = { isNewWorkspace: false };
+
+let workspaceDir: string;
+let configPath: string;
+
+beforeEach(() => {
+  workspaceDir = mkdtempSync(join(tmpdir(), "vellum-migration-105-test-"));
+  configPath = join(workspaceDir, "config.json");
+});
+
+afterEach(() => {
+  if (existsSync(workspaceDir)) {
+    rmSync(workspaceDir, { recursive: true, force: true });
+  }
+});
+
+function readConfig(): Record<string, unknown> {
+  return JSON.parse(readFileSync(configPath, "utf-8"));
+}
+
+describe("105-enable-memory-v3-live-for-new-workspaces migration", () => {
+  test("has correct id and description", () => {
+    expect(enableMemoryV3LiveForNewWorkspacesMigration.id).toBe(
+      "105-enable-memory-v3-live-for-new-workspaces",
+    );
+    expect(enableMemoryV3LiveForNewWorkspacesMigration.description).toContain(
+      "memory.v3.live",
+    );
+  });
+
+  test("schema default is off so existing assistants stay on v2", () => {
+    expect(MemoryV3ConfigSchema.parse({}).live).toBe(false);
+  });
+
+  test("creates config.json with memory.v3.live=true for a fresh workspace", () => {
+    enableMemoryV3LiveForNewWorkspacesMigration.run(
+      workspaceDir,
+      NEW_WORKSPACE_CTX,
+    );
+
+    expect(readConfig()).toEqual({ memory: { v3: { live: true } } });
+  });
+
+  test("adds memory.v3.live to a fresh workspace's existing config, preserving siblings", () => {
+    writeFileSync(
+      configPath,
+      JSON.stringify({ name: "Assistant", memory: { enabled: true } }),
+      "utf-8",
+    );
+
+    enableMemoryV3LiveForNewWorkspacesMigration.run(
+      workspaceDir,
+      NEW_WORKSPACE_CTX,
+    );
+
+    expect(readConfig()).toEqual({
+      name: "Assistant",
+      memory: { enabled: true, v3: { live: true } },
+    });
+  });
+
+  test("skips existing workspaces so they stay on v2 (no config written)", () => {
+    enableMemoryV3LiveForNewWorkspacesMigration.run(workspaceDir, UPGRADE_CTX);
+
+    expect(existsSync(configPath)).toBe(false);
+  });
+
+  test("treats a missing context as an existing workspace", () => {
+    enableMemoryV3LiveForNewWorkspacesMigration.run(workspaceDir);
+
+    expect(existsSync(configPath)).toBe(false);
+  });
+
+  test("leaves an explicit memory.v3.live value untouched on a fresh workspace", () => {
+    const original = JSON.stringify({ memory: { v3: { live: false } } });
+    writeFileSync(configPath, original, "utf-8");
+
+    enableMemoryV3LiveForNewWorkspacesMigration.run(
+      workspaceDir,
+      NEW_WORKSPACE_CTX,
+    );
+
+    expect(readFileSync(configPath, "utf-8")).toBe(original);
+  });
+
+  test("leaves malformed config.json untouched", () => {
+    writeFileSync(configPath, "{ not json", "utf-8");
+
+    enableMemoryV3LiveForNewWorkspacesMigration.run(
+      workspaceDir,
+      NEW_WORKSPACE_CTX,
+    );
+
+    expect(readFileSync(configPath, "utf-8")).toBe("{ not json");
+  });
+
+  test("is idempotent", () => {
+    enableMemoryV3LiveForNewWorkspacesMigration.run(
+      workspaceDir,
+      NEW_WORKSPACE_CTX,
+    );
+    const afterFirst = readFileSync(configPath, "utf-8");
+
+    enableMemoryV3LiveForNewWorkspacesMigration.run(
+      workspaceDir,
+      NEW_WORKSPACE_CTX,
+    );
+
+    expect(readFileSync(configPath, "utf-8")).toBe(afterFirst);
+  });
+
+  test("down is a no-op", () => {
+    enableMemoryV3LiveForNewWorkspacesMigration.run(
+      workspaceDir,
+      NEW_WORKSPACE_CTX,
+    );
+    const before = readFileSync(configPath, "utf-8");
+
+    enableMemoryV3LiveForNewWorkspacesMigration.down(workspaceDir);
+
+    expect(readFileSync(configPath, "utf-8")).toBe(before);
+  });
+});