vellum 0.2.1 → 0.2.2

package/src/__tests__/contacts-tools.test.ts

@@ -0,0 +1,331 @@
+import { describe, test, expect, beforeEach, afterAll, mock } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+const testDir = mkdtempSync(join(tmpdir(), 'contacts-tools-test-'));
+
+mock.module('../util/platform.js', () => ({
+  getDataDir: () => testDir,
+  isMacOS: () => process.platform === 'darwin',
+  isLinux: () => process.platform === 'linux',
+  isWindows: () => process.platform === 'win32',
+  getSocketPath: () => join(testDir, 'test.sock'),
+  getPidPath: () => join(testDir, 'test.pid'),
+  getDbPath: () => join(testDir, 'test.db'),
+  getLogPath: () => join(testDir, 'test.log'),
+  ensureDataDir: () => {},
+  migrateToDataLayout: () => {},
+  migrateToWorkspaceLayout: () => {},
+}));
+
+mock.module('../util/logger.js', () => ({
+  getLogger: () => new Proxy({} as Record<string, unknown>, {
+    get: () => () => {},
+  }),
+}));
+
+mock.module('../config/loader.js', () => ({
+  getConfig: () => ({ memory: {} }),
+}));
+
+import type { Database } from 'bun:sqlite';
+import { initializeDb, getDb, resetDb } from '../memory/db.js';
+import type { ToolContext } from '../tools/types.js';
+import { executeContactUpsert } from '../tools/contacts/contact-upsert.js';
+import { executeContactSearch } from '../tools/contacts/contact-search.js';
+import { executeContactMerge } from '../tools/contacts/contact-merge.js';
+
+initializeDb();
+
+afterAll(() => {
+  resetDb();
+  try { rmSync(testDir, { recursive: true }); } catch { /* best effort */ }
+});
+
+function getRawDb(): Database {
+  return (getDb() as unknown as { $client: Database }).$client;
+}
+
+const ctx: ToolContext = {
+  workingDir: '/tmp',
+  sessionId: 'test-session',
+  conversationId: 'test-conversation',
+};
+
+function clearContacts(): void {
+  getRawDb().run('DELETE FROM contact_channels');
+  getRawDb().run('DELETE FROM contacts');
+}
+
+// ── contact_upsert ──────────────────────────────────────────────────
+
+describe('contact_upsert tool', () => {
+  beforeEach(clearContacts);
+
+  test('creates a new contact with display name only', async () => {
+    const result = await executeContactUpsert({ display_name: 'Alice' }, ctx);
+
+    expect(result.isError).toBe(false);
+    expect(result.content).toContain('Created contact');
+    expect(result.content).toContain('Alice');
+    expect(result.content).toContain('Importance: 0.50');
+  });
+
+  test('creates a contact with all fields', async () => {
+    const result = await executeContactUpsert({
+      display_name: 'Bob',
+      relationship: 'colleague',
+      importance: 0.8,
+      response_expectation: 'within_hours',
+      preferred_tone: 'professional',
+      channels: [
+        { type: 'email', address: 'bob@example.com', is_primary: true },
+        { type: 'slack', address: '@bob' },
+      ],
+    }, ctx);
+
+    expect(result.isError).toBe(false);
+    expect(result.content).toContain('Bob');
+    expect(result.content).toContain('colleague');
+    expect(result.content).toContain('0.80');
+    expect(result.content).toContain('within_hours');
+    expect(result.content).toContain('professional');
+    expect(result.content).toContain('email: bob@example.com');
+    expect(result.content).toContain('slack: @bob');
+  });
+
+  test('updates an existing contact by ID', async () => {
+    const createResult = await executeContactUpsert({ display_name: 'Charlie' }, ctx);
+    expect(createResult.isError).toBe(false);
+
+    // Extract ID from output
+    const idMatch = createResult.content.match(/Contact (\S+)/);
+    expect(idMatch).not.toBeNull();
+    const contactId = idMatch![1];
+
+    const updateResult = await executeContactUpsert({
+      id: contactId,
+      display_name: 'Charlie Updated',
+      importance: 0.9,
+    }, ctx);
+
+    expect(updateResult.isError).toBe(false);
+    expect(updateResult.content).toContain('Updated contact');
+    expect(updateResult.content).toContain('Charlie Updated');
+    expect(updateResult.content).toContain('0.90');
+  });
+
+  test('auto-matches by channel address on create', async () => {
+    // Create a contact with an email
+    await executeContactUpsert({
+      display_name: 'Diana',
+      channels: [{ type: 'email', address: 'diana@example.com' }],
+    }, ctx);
+
+    // Upsert with same email but different display name
+    const result = await executeContactUpsert({
+      display_name: 'Diana Updated',
+      channels: [{ type: 'email', address: 'diana@example.com' }],
+    }, ctx);
+
+    expect(result.isError).toBe(false);
+    expect(result.content).toContain('Updated contact');
+    expect(result.content).toContain('Diana Updated');
+
+    // Should still be just 1 contact
+    const count = getRawDb().query('SELECT COUNT(*) as c FROM contacts').get() as { c: number };
+    expect(count.c).toBe(1);
+  });
+
+  test('rejects missing display_name', async () => {
+    const result = await executeContactUpsert({}, ctx);
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain('display_name is required');
+  });
+
+  test('rejects empty display_name', async () => {
+    const result = await executeContactUpsert({ display_name: '   ' }, ctx);
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain('display_name is required');
+  });
+
+  test('rejects importance out of range', async () => {
+    const result = await executeContactUpsert({
+      display_name: 'Test',
+      importance: 1.5,
+    }, ctx);
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain('importance must be a number between 0 and 1');
+  });
+
+  test('rejects negative importance', async () => {
+    const result = await executeContactUpsert({
+      display_name: 'Test',
+      importance: -0.1,
+    }, ctx);
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain('importance must be a number between 0 and 1');
+  });
+});
+
+// ── contact_search ──────────────────────────────────────────────────
+
+describe('contact_search tool', () => {
+  beforeEach(clearContacts);
+
+  test('searches by display name', async () => {
+    await executeContactUpsert({ display_name: 'Alice Smith' }, ctx);
+    await executeContactUpsert({ display_name: 'Bob Jones' }, ctx);
+
+    const result = await executeContactSearch({ query: 'Alice' }, ctx);
+
+    expect(result.isError).toBe(false);
+    expect(result.content).toContain('Alice Smith');
+    expect(result.content).not.toContain('Bob Jones');
+  });
+
+  test('searches by channel address', async () => {
+    await executeContactUpsert({
+      display_name: 'Charlie',
+      channels: [{ type: 'email', address: 'charlie@example.com' }],
+    }, ctx);
+
+    const result = await executeContactSearch({ channel_address: 'charlie@example' }, ctx);
+
+    expect(result.isError).toBe(false);
+    expect(result.content).toContain('Charlie');
+  });
+
+  test('searches by relationship', async () => {
+    await executeContactUpsert({ display_name: 'Diana', relationship: 'friend' }, ctx);
+    await executeContactUpsert({ display_name: 'Eve', relationship: 'colleague' }, ctx);
+
+    const result = await executeContactSearch({ relationship: 'friend' }, ctx);
+
+    expect(result.isError).toBe(false);
+    expect(result.content).toContain('Diana');
+    expect(result.content).not.toContain('Eve');
+  });
+
+  test('returns no results message when nothing matches', async () => {
+    await executeContactUpsert({ display_name: 'Existing' }, ctx);
+
+    const result = await executeContactSearch({ query: 'Nonexistent' }, ctx);
+
+    expect(result.isError).toBe(false);
+    expect(result.content).toContain('No contacts found');
+  });
+
+  test('rejects search with no criteria', async () => {
+    const result = await executeContactSearch({}, ctx);
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain('At least one search criterion is required');
+  });
+
+  test('searches by channel address with type filter', async () => {
+    await executeContactUpsert({
+      display_name: 'Frank',
+      channels: [
+        { type: 'email', address: 'frank@example.com' },
+        { type: 'slack', address: 'frank@example.com' },
+      ],
+    }, ctx);
+
+    const result = await executeContactSearch({
+      channel_address: 'frank@example',
+      channel_type: 'slack',
+    }, ctx);
+
+    expect(result.isError).toBe(false);
+    expect(result.content).toContain('Frank');
+  });
+});
+
+// ── contact_merge ───────────────────────────────────────────────────
+
+describe('contact_merge tool', () => {
+  beforeEach(clearContacts);
+
+  function extractContactId(result: { content: string }): string {
+    const match = result.content.match(/Contact (\S+)/);
+    expect(match).not.toBeNull();
+    return match![1];
+  }
+
+  test('merges two contacts', async () => {
+    const r1 = await executeContactUpsert({
+      display_name: 'Alice (Email)',
+      importance: 0.7,
+      channels: [{ type: 'email', address: 'alice@example.com' }],
+    }, ctx);
+    const r2 = await executeContactUpsert({
+      display_name: 'Alice (Slack)',
+      importance: 0.9,
+      channels: [{ type: 'slack', address: '@alice' }],
+    }, ctx);
+
+    const keepId = extractContactId(r1);
+    const mergeId = extractContactId(r2);
+
+    const result = await executeContactMerge({
+      keep_id: keepId,
+      merge_id: mergeId,
+    }, ctx);
+
+    expect(result.isError).toBe(false);
+    expect(result.content).toContain('Merged');
+    expect(result.content).toContain('Importance: 0.90'); // takes higher importance
+    expect(result.content).toContain('email: alice@example.com');
+    expect(result.content).toContain('slack: @alice');
+
+    // Verify donor is deleted
+    const count = getRawDb().query('SELECT COUNT(*) as c FROM contacts').get() as { c: number };
+    expect(count.c).toBe(1);
+  });
+
+  test('rejects missing keep_id', async () => {
+    const result = await executeContactMerge({ merge_id: 'some-id' }, ctx);
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain('keep_id is required');
+  });
+
+  test('rejects missing merge_id', async () => {
+    const result = await executeContactMerge({ keep_id: 'some-id' }, ctx);
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain('merge_id is required');
+  });
+
+  test('returns error for nonexistent keep_id', async () => {
+    const r = await executeContactUpsert({ display_name: 'Exists' }, ctx);
+    const existingId = extractContactId(r);
+
+    const result = await executeContactMerge({
+      keep_id: 'nonexistent',
+      merge_id: existingId,
+    }, ctx);
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain('not found');
+  });
+
+  test('returns error for nonexistent merge_id', async () => {
+    const r = await executeContactUpsert({ display_name: 'Exists' }, ctx);
+    const existingId = extractContactId(r);
+
+    const result = await executeContactMerge({
+      keep_id: existingId,
+      merge_id: 'nonexistent',
+    }, ctx);
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain('not found');
+  });
+});

package/src/__tests__/conversation-store.test.ts

@@ -23,7 +23,7 @@ mock.module('../util/logger.js', () => ({
   }),
 }));
 
-import { initializeDb, getDb } from '../memory/db.js';
+import { initializeDb, getDb, resetDb } from '../memory/db.js';
 import {
   createConversation,
   getConversation,
@@ -40,13 +40,13 @@ import {
   linkAttachmentToMessage,
   getAttachmentsForMessage,
   getAttachmentById,
-  getAttachmentsForMessageUnscoped,
 } from '../memory/attachments-store.js';
 
 // Initialize db once before all tests
 initializeDb();
 
 afterAll(() => {
+  resetDb();
   try { rmSync(testDir, { recursive: true }); } catch { /* best effort */ }
 });
 
@@ -236,11 +236,11 @@ describe('attachment orphan cleanup', () => {
     addMessage(conv.id, 'user', 'hello');
     const assistantMsg = addMessage(conv.id, 'assistant', 'Here is a file');
 
-    const stored = uploadAttachment('ast-1', 'chart.png', 'image/png', 'iVBOR');
+    const stored = uploadAttachment('chart.png', 'image/png', 'iVBOR');
     linkAttachmentToMessage(assistantMsg.id, stored.id, 0);
 
     // Verify attachment is linked
-    expect(getAttachmentsForMessageUnscoped(assistantMsg.id)).toHaveLength(1);
+    expect(getAttachmentsForMessage(assistantMsg.id)).toHaveLength(1);
 
     // Delete the exchange — should also clean up orphaned attachments
     deleteLastExchange(conv.id);
@@ -257,7 +257,7 @@ describe('attachment orphan cleanup', () => {
     addMessage(conv.id, 'user', 'question');
     const msg2 = addMessage(conv.id, 'assistant', 'second');
 
-    const shared = uploadAttachment('ast-1', 'shared.png', 'image/png', 'AAAA');
+    const shared = uploadAttachment('shared.png', 'image/png', 'AAAA');
     linkAttachmentToMessage(msg1.id, shared.id, 0);
     linkAttachmentToMessage(msg2.id, shared.id, 0);
 
@@ -273,7 +273,7 @@ describe('attachment orphan cleanup', () => {
   test('clearAll removes all attachments', () => {
     const conv = createConversation('test');
     const msg = addMessage(conv.id, 'assistant', 'file');
-    const stored = uploadAttachment('ast-1', 'doc.pdf', 'application/pdf', 'JVBER');
+    const stored = uploadAttachment('doc.pdf', 'application/pdf', 'JVBER');
     linkAttachmentToMessage(msg.id, stored.id, 0);
 
     clearAll();
@@ -291,11 +291,11 @@ describe('attachment orphan cleanup', () => {
     const assistantMsg = addMessage(conv.id, 'assistant', 'Here is a file');
 
     // An attachment linked to the assistant message (should be cleaned up)
-    const linked = uploadAttachment('ast-1', 'chart.png', 'image/png', 'iVBOR');
+    const linked = uploadAttachment('chart.png', 'image/png', 'iVBOR');
     linkAttachmentToMessage(assistantMsg.id, linked.id, 0);
 
     // A freshly uploaded attachment not linked to any message (should survive)
-    uploadAttachment('ast-1', 'pending.png', 'image/png', 'AAAA');
+    uploadAttachment('pending.png', 'image/png', 'AAAA');
 
     deleteLastExchange(conv.id);
 
@@ -440,7 +440,7 @@ describe('attachment reuse across thread lifecycles', () => {
   test('attachment uploaded in conversation A is retrievable by ID without any conversation reference', () => {
     const convA = createConversation('Thread A');
     const msgA = addMessage(convA.id, 'assistant', 'Here is a file');
-    const stored = uploadAttachment('ast-1', 'report.pdf', 'application/pdf', 'JVBER');
+    const stored = uploadAttachment('report.pdf', 'application/pdf', 'JVBER');
     linkAttachmentToMessage(msgA.id, stored.id, 0);
 
     // Create a completely separate conversation
@@ -448,8 +448,7 @@ describe('attachment reuse across thread lifecycles', () => {
     addMessage(convB.id, 'user', 'hello');
 
     // The attachment is retrievable by ID regardless of which conversation is active.
-    // getAttachmentById only scopes by assistantId, not conversationId.
-    const fetched = getAttachmentById('ast-1', stored.id);
+    const fetched = getAttachmentById(stored.id);
     expect(fetched).not.toBeNull();
     expect(fetched!.id).toBe(stored.id);
     expect(fetched!.originalFilename).toBe('report.pdf');
@@ -464,16 +463,16 @@ describe('attachment reuse across thread lifecycles', () => {
     const msgB = addMessage(convB.id, 'assistant', 'Reused file');
 
     // Upload once, link to both conversations
-    const stored = uploadAttachment('ast-1', 'shared.png', 'image/png', 'iVBORw0K');
+    const stored = uploadAttachment('shared.png', 'image/png', 'iVBORw0K');
     linkAttachmentToMessage(msgA.id, stored.id, 0);
     linkAttachmentToMessage(msgB.id, stored.id, 0);
 
     // Both messages see the attachment
-    const linkedA = getAttachmentsForMessage(msgA.id, 'ast-1');
+    const linkedA = getAttachmentsForMessage(msgA.id);
     expect(linkedA).toHaveLength(1);
     expect(linkedA[0].id).toBe(stored.id);
 
-    const linkedB = getAttachmentsForMessage(msgB.id, 'ast-1');
+    const linkedB = getAttachmentsForMessage(msgB.id);
     expect(linkedB).toHaveLength(1);
     expect(linkedB[0].id).toBe(stored.id);
   });
@@ -489,7 +488,7 @@ describe('attachment reuse across thread lifecycles', () => {
     addMessage(convB.id, 'user', 'Show me the chart');
     const msgB = addMessage(convB.id, 'assistant', 'Reused');
 
-    const stored = uploadAttachment('ast-1', 'chart.png', 'image/png', 'AAAA');
+    const stored = uploadAttachment('chart.png', 'image/png', 'AAAA');
     linkAttachmentToMessage(msgA.id, stored.id, 0);
     linkAttachmentToMessage(msgB.id, stored.id, 0);
 
@@ -497,11 +496,11 @@ describe('attachment reuse across thread lifecycles', () => {
     deleteLastExchange(convA.id);
 
     // Attachment survives because convB still references it
-    const fetched = getAttachmentById('ast-1', stored.id);
+    const fetched = getAttachmentById(stored.id);
     expect(fetched).not.toBeNull();
 
     // convB's message still has the attachment linked
-    const linkedB = getAttachmentsForMessage(msgB.id, 'ast-1');
+    const linkedB = getAttachmentsForMessage(msgB.id);
     expect(linkedB).toHaveLength(1);
     expect(linkedB[0].id).toBe(stored.id);
   });
@@ -514,8 +513,8 @@ describe('attachment reuse across thread lifecycles', () => {
     addMessage(convB.id, 'user', 'upload in B');
 
     // Same content uploaded in two different conversation contexts
-    const first = uploadAttachment('ast-1', 'photo.png', 'image/png', 'DEDUPCROSS');
-    const second = uploadAttachment('ast-1', 'photo.png', 'image/png', 'DEDUPCROSS');
+    const first = uploadAttachment('photo.png', 'image/png', 'DEDUPCROSS');
+    const second = uploadAttachment('photo.png', 'image/png', 'DEDUPCROSS');
 
     // Dedup returns the same attachment row
     expect(second.id).toBe(first.id);
@@ -540,11 +539,11 @@ describe('no private-thread attachment visibility boundary', () => {
     expect(privateConv.threadType).toBe('private');
 
     const msg = addMessage(privateConv.id, 'assistant', 'Private content');
-    const stored = uploadAttachment('ast-1', 'secret.pdf', 'application/pdf', 'JVBER');
+    const stored = uploadAttachment('secret.pdf', 'application/pdf', 'JVBER');
     linkAttachmentToMessage(msg.id, stored.id, 0);
 
     // Attachment is globally visible by ID — no thread-type filter exists
-    const fetched = getAttachmentById('ast-1', stored.id);
+    const fetched = getAttachmentById(stored.id);
     expect(fetched).not.toBeNull();
     expect(fetched!.originalFilename).toBe('secret.pdf');
   });
@@ -556,27 +555,26 @@ describe('no private-thread attachment visibility boundary', () => {
     const privateMsg = addMessage(privateConv.id, 'assistant', 'Private file');
     const standardMsg = addMessage(standardConv.id, 'assistant', 'Reusing private file');
 
-    const stored = uploadAttachment('ast-1', 'private-doc.png', 'image/png', 'PRIVDATA');
+    const stored = uploadAttachment('private-doc.png', 'image/png', 'PRIVDATA');
     linkAttachmentToMessage(privateMsg.id, stored.id, 0);
     linkAttachmentToMessage(standardMsg.id, stored.id, 0);
 
     // Both threads can see the attachment
-    const linkedPrivate = getAttachmentsForMessage(privateMsg.id, 'ast-1');
+    const linkedPrivate = getAttachmentsForMessage(privateMsg.id);
     expect(linkedPrivate).toHaveLength(1);
 
-    const linkedStandard = getAttachmentsForMessage(standardMsg.id, 'ast-1');
+    const linkedStandard = getAttachmentsForMessage(standardMsg.id);
     expect(linkedStandard).toHaveLength(1);
     expect(linkedStandard[0].id).toBe(stored.id);
   });
 
-  test('getAttachmentsForMessageUnscoped returns private thread attachments', () => {
+  test('getAttachmentsForMessage returns private thread attachments', () => {
     const privateConv = createConversation({ title: 'Private', threadType: 'private' });
     const msg = addMessage(privateConv.id, 'assistant', 'Private media');
-    const stored = uploadAttachment('ast-1', 'photo.jpg', 'image/jpeg', 'AAAA');
+    const stored = uploadAttachment('photo.jpg', 'image/jpeg', 'AAAA');
     linkAttachmentToMessage(msg.id, stored.id, 0);
 
-    // Unscoped retrieval has no thread-type filter
-    const linked = getAttachmentsForMessageUnscoped(msg.id);
+    const linked = getAttachmentsForMessage(msg.id);
     expect(linked).toHaveLength(1);
     expect(linked[0].id).toBe(stored.id);
   });
@@ -586,8 +584,8 @@ describe('no private-thread attachment visibility boundary', () => {
     createConversation({ title: 'Standard', threadType: 'standard' });
 
     // Same content uploaded in private and standard contexts
-    const fromPrivate = uploadAttachment('ast-1', 'file.png', 'image/png', 'CROSSTHREAD');
-    const fromStandard = uploadAttachment('ast-1', 'file.png', 'image/png', 'CROSSTHREAD');
+    const fromPrivate = uploadAttachment('file.png', 'image/png', 'CROSSTHREAD');
+    const fromStandard = uploadAttachment('file.png', 'image/png', 'CROSSTHREAD');
 
     // Dedup returns the same row — no thread-type isolation
     expect(fromStandard.id).toBe(fromPrivate.id);
@@ -600,8 +598,8 @@ describe('no private-thread attachment visibility boundary', () => {
     const privateMsg = addMessage(privateConv.id, 'assistant', 'Private file');
     const standardMsg = addMessage(standardConv.id, 'assistant', 'Standard file');
 
-    const att1 = uploadAttachment('ast-1', 'private.png', 'image/png', 'PRIV');
-    const att2 = uploadAttachment('ast-1', 'standard.png', 'image/png', 'STD');
+    const att1 = uploadAttachment('private.png', 'image/png', 'PRIV');
+    const att2 = uploadAttachment('standard.png', 'image/png', 'STD');
     linkAttachmentToMessage(privateMsg.id, att1.id, 0);
     linkAttachmentToMessage(standardMsg.id, att2.id, 0);
 

package/src/__tests__/credential-security-invariants.test.ts

@@ -185,6 +185,10 @@ describe('Invariant 2: no generic plaintext secret read API', () => {
       'email/providers/index.ts',      // email provider API key lookup
       'tools/network/script-proxy/session-manager.ts', // proxy credential injection at runtime
       'messaging/registry.ts',          // checks stored credentials for connected providers
+      'calls/twilio-config.ts',         // call infrastructure credential lookup
+      'calls/twilio-provider.ts',       // call infrastructure credential lookup
+      'runtime/http-server.ts',         // HTTP server credential lookup
+      'daemon/handlers/twitter-auth.ts', // Twitter OAuth token storage
     ]);
 
     const thisDir = dirname(fileURLToPath(import.meta.url));