npm - vellum - Versions diffs - 0.2.13 → 0.2.14 - Mend

vellum 0.2.13 → 0.2.14

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (207) hide show

package/README.md +32 -0
package/bun.lock +2 -2
package/docs/skills.md +4 -4
package/package.json +2 -2
package/src/__tests__/__snapshots__/ipc-snapshot.test.ts.snap +213 -3
package/src/__tests__/app-git-history.test.ts +176 -0
package/src/__tests__/app-git-service.test.ts +169 -0
package/src/__tests__/assistant-events-sse-hardening.test.ts +315 -0
package/src/__tests__/browser-skill-baseline-tool-payload.test.ts +8 -8
package/src/__tests__/browser-skill-endstate.test.ts +6 -6
package/src/__tests__/call-bridge.test.ts +105 -13
package/src/__tests__/call-domain.test.ts +163 -0
package/src/__tests__/call-orchestrator.test.ts +113 -0
package/src/__tests__/call-routes-http.test.ts +246 -6
package/src/__tests__/channel-approval-routes.test.ts +438 -0
package/src/__tests__/channel-approval.test.ts +266 -0
package/src/__tests__/channel-approvals.test.ts +393 -0
package/src/__tests__/channel-delivery-store.test.ts +447 -0
package/src/__tests__/checker.test.ts +607 -1048
package/src/__tests__/cli.test.ts +1 -56
package/src/__tests__/config-schema.test.ts +137 -18
package/src/__tests__/conflict-intent-tokenization.test.ts +141 -0
package/src/__tests__/conflict-policy.test.ts +121 -0
package/src/__tests__/conflict-store.test.ts +2 -0
package/src/__tests__/contacts-tools.test.ts +3 -3
package/src/__tests__/contradiction-checker.test.ts +99 -1
package/src/__tests__/credential-security-invariants.test.ts +22 -6
package/src/__tests__/credential-vault-unit.test.ts +780 -0
package/src/__tests__/elevenlabs-client.test.ts +62 -0
package/src/__tests__/ephemeral-permissions.test.ts +73 -23
package/src/__tests__/filesystem-tools.test.ts +579 -0
package/src/__tests__/gateway-only-enforcement.test.ts +114 -4
package/src/__tests__/handlers-add-trust-rule-metadata.test.ts +202 -0
package/src/__tests__/handlers-cu-observation-blob.test.ts +2 -1
package/src/__tests__/handlers-ipc-blob-probe.test.ts +2 -1
package/src/__tests__/handlers-slack-config.test.ts +2 -1
package/src/__tests__/handlers-telegram-config.test.ts +855 -0
package/src/__tests__/handlers-twitter-config.test.ts +141 -1
package/src/__tests__/hooks-runner.test.ts +6 -2
package/src/__tests__/host-file-edit-tool.test.ts +124 -0
package/src/__tests__/host-file-read-tool.test.ts +62 -0
package/src/__tests__/host-file-write-tool.test.ts +59 -0
package/src/__tests__/host-shell-tool.test.ts +251 -0
package/src/__tests__/ingress-reconcile.test.ts +581 -0
package/src/__tests__/ipc-snapshot.test.ts +100 -41
package/src/__tests__/ipc-validate.test.ts +50 -0
package/src/__tests__/key-migration.test.ts +23 -0
package/src/__tests__/memory-regressions.test.ts +99 -0
package/src/__tests__/memory-retrieval.benchmark.test.ts +1 -1
package/src/__tests__/oauth-callback-registry.test.ts +11 -4
package/src/__tests__/playbook-execution.test.ts +502 -0
package/src/__tests__/playbook-tools.test.ts +4 -6
package/src/__tests__/public-ingress-urls.test.ts +34 -0
package/src/__tests__/qdrant-manager.test.ts +267 -0
package/src/__tests__/recurrence-engine-rruleset.test.ts +97 -0
package/src/__tests__/recurrence-engine.test.ts +9 -0
package/src/__tests__/recurrence-types.test.ts +8 -0
package/src/__tests__/registry.test.ts +1 -1
package/src/__tests__/runtime-runs.test.ts +1 -25
package/src/__tests__/schedule-store.test.ts +16 -14
package/src/__tests__/schedule-tools.test.ts +83 -0
package/src/__tests__/scheduler-recurrence.test.ts +111 -10
package/src/__tests__/secret-allowlist.test.ts +18 -17
package/src/__tests__/secret-ingress-handler.test.ts +11 -0
package/src/__tests__/secret-scanner.test.ts +43 -0
package/src/__tests__/session-conflict-gate.test.ts +442 -6
package/src/__tests__/session-init.benchmark.test.ts +3 -0
package/src/__tests__/session-process-bridge.test.ts +242 -0
package/src/__tests__/session-skill-tools.test.ts +1 -1
package/src/__tests__/shell-identity.test.ts +256 -0
package/src/__tests__/skill-projection.benchmark.test.ts +11 -1
package/src/__tests__/subagent-tools.test.ts +637 -54
package/src/__tests__/task-management-tools.test.ts +936 -0
package/src/__tests__/task-runner.test.ts +2 -2
package/src/__tests__/terminal-tools.test.ts +840 -0
package/src/__tests__/tool-executor-shell-integration.test.ts +301 -0
package/src/__tests__/tool-executor.test.ts +85 -151
package/src/__tests__/tool-permission-simulate-handler.test.ts +336 -0
package/src/__tests__/trust-store.test.ts +27 -453
package/src/__tests__/twilio-provider.test.ts +153 -3
package/src/__tests__/twilio-routes-elevenlabs.test.ts +375 -0
package/src/__tests__/twilio-routes-twiml.test.ts +4 -4
package/src/__tests__/twilio-routes.test.ts +17 -262
package/src/__tests__/twitter-auth-handler.test.ts +2 -1
package/src/__tests__/twitter-cli-error-shaping.test.ts +208 -0
package/src/__tests__/twitter-cli-routing.test.ts +252 -0
package/src/__tests__/twitter-oauth-client.test.ts +209 -0
package/src/__tests__/workspace-policy.test.ts +213 -0
package/src/calls/call-bridge.ts +92 -19
package/src/calls/call-domain.ts +157 -5
package/src/calls/call-orchestrator.ts +93 -7
package/src/calls/call-store.ts +6 -0
package/src/calls/elevenlabs-client.ts +8 -0
package/src/calls/elevenlabs-config.ts +7 -5
package/src/calls/twilio-provider.ts +91 -0
package/src/calls/twilio-routes.ts +32 -37
package/src/calls/types.ts +3 -1
package/src/calls/voice-quality.ts +29 -7
package/src/cli/twitter.ts +200 -21
package/src/cli.ts +1 -20
package/src/config/bundled-skills/contacts/tools/contact-merge.ts +52 -4
package/src/config/bundled-skills/contacts/tools/contact-search.ts +55 -4
package/src/config/bundled-skills/contacts/tools/contact-upsert.ts +61 -4
package/src/config/bundled-skills/messaging/SKILL.md +17 -2
package/src/config/bundled-skills/messaging/tools/messaging-reply.ts +4 -1
package/src/config/bundled-skills/messaging/tools/messaging-send.ts +5 -1
package/src/config/bundled-skills/messaging/tools/shared.ts +5 -0
package/src/config/bundled-skills/phone-calls/SKILL.md +142 -34
package/src/config/bundled-skills/playbooks/tools/playbook-create.ts +95 -6
package/src/config/bundled-skills/playbooks/tools/playbook-delete.ts +51 -6
package/src/config/bundled-skills/playbooks/tools/playbook-list.ts +73 -6
package/src/config/bundled-skills/playbooks/tools/playbook-update.ts +110 -6
package/src/config/bundled-skills/public-ingress/SKILL.md +22 -5
package/src/config/bundled-skills/twitter/SKILL.md +103 -17
package/src/config/defaults.ts +10 -4
package/src/config/schema.ts +80 -21
package/src/config/types.ts +1 -0
package/src/config/vellum-skills/telegram-setup/SKILL.md +56 -61
package/src/daemon/assistant-attachments.ts +4 -2
package/src/daemon/handlers/apps.ts +69 -0
package/src/daemon/handlers/config.ts +543 -24
package/src/daemon/handlers/index.ts +1 -0
package/src/daemon/handlers/sessions.ts +22 -6
package/src/daemon/handlers/shared.ts +2 -1
package/src/daemon/handlers/skills.ts +5 -20
package/src/daemon/ipc-contract-inventory.json +28 -0
package/src/daemon/ipc-contract.ts +168 -10
package/src/daemon/ipc-validate.ts +17 -0
package/src/daemon/lifecycle.ts +2 -0
package/src/daemon/server.ts +78 -72
package/src/daemon/session-attachments.ts +1 -1
package/src/daemon/session-conflict-gate.ts +62 -6
package/src/daemon/session-notifiers.ts +1 -1
package/src/daemon/session-process.ts +62 -3
package/src/daemon/session-tool-setup.ts +1 -2
package/src/daemon/tls-certs.ts +189 -0
package/src/daemon/video-thumbnail.ts +5 -3
package/src/hooks/manager.ts +5 -9
package/src/memory/app-git-service.ts +295 -0
package/src/memory/app-store.ts +21 -0
package/src/memory/conflict-intent.ts +47 -4
package/src/memory/conflict-policy.ts +73 -0
package/src/memory/conflict-store.ts +9 -1
package/src/memory/contradiction-checker.ts +28 -0
package/src/memory/conversation-key-store.ts +15 -0
package/src/memory/db.ts +81 -0
package/src/memory/embedding-local.ts +3 -13
package/src/memory/external-conversation-store.ts +234 -0
package/src/memory/job-handlers/conflict.ts +22 -2
package/src/memory/jobs-worker.ts +67 -28
package/src/memory/runs-store.ts +54 -7
package/src/memory/schema.ts +20 -0
package/src/messaging/provider.ts +9 -0
package/src/messaging/providers/telegram-bot/adapter.ts +162 -0
package/src/messaging/providers/telegram-bot/client.ts +104 -0
package/src/messaging/providers/telegram-bot/types.ts +15 -0
package/src/messaging/registry.ts +1 -0
package/src/permissions/checker.ts +48 -44
package/src/permissions/prompter.ts +0 -4
package/src/permissions/shell-identity.ts +227 -0
package/src/permissions/trust-store.ts +76 -53
package/src/permissions/types.ts +0 -19
package/src/permissions/workspace-policy.ts +114 -0
package/src/providers/retry.ts +12 -37
package/src/runtime/assistant-event-hub.ts +41 -4
package/src/runtime/channel-approval-parser.ts +60 -0
package/src/runtime/channel-approval-types.ts +71 -0
package/src/runtime/channel-approvals.ts +145 -0
package/src/runtime/gateway-client.ts +16 -0
package/src/runtime/http-server.ts +29 -9
package/src/runtime/routes/call-routes.ts +52 -2
package/src/runtime/routes/channel-routes.ts +296 -16
package/src/runtime/routes/events-routes.ts +97 -28
package/src/runtime/routes/run-routes.ts +2 -7
package/src/runtime/run-orchestrator.ts +0 -3
package/src/schedule/recurrence-engine.ts +26 -2
package/src/schedule/recurrence-types.ts +1 -1
package/src/schedule/schedule-store.ts +12 -3
package/src/security/secret-scanner.ts +7 -0
package/src/tasks/ephemeral-permissions.ts +0 -2
package/src/tasks/task-scheduler.ts +2 -1
package/src/tools/calls/call-start.ts +8 -0
package/src/tools/execution-target.ts +21 -0
package/src/tools/execution-timeout.ts +49 -0
package/src/tools/executor.ts +6 -135
package/src/tools/network/web-search.ts +9 -32
package/src/tools/policy-context.ts +29 -0
package/src/tools/schedule/update.ts +8 -1
package/src/tools/terminal/parser.ts +16 -18
package/src/tools/types.ts +4 -11
package/src/twitter/oauth-client.ts +102 -0
package/src/twitter/router.ts +101 -0
package/src/util/debounce.ts +88 -0
package/src/util/network-info.ts +47 -0
package/src/util/platform.ts +29 -4
package/src/util/promise-guard.ts +37 -0
package/src/util/retry.ts +98 -0
package/src/util/truncate.ts +1 -1
package/src/workspace/git-service.ts +129 -112
package/src/tools/contacts/contact-merge.ts +0 -55
package/src/tools/contacts/contact-search.ts +0 -58
package/src/tools/contacts/contact-upsert.ts +0 -64
package/src/tools/playbooks/index.ts +0 -4
package/src/tools/playbooks/playbook-create.ts +0 -96
package/src/tools/playbooks/playbook-delete.ts +0 -52
package/src/tools/playbooks/playbook-list.ts +0 -74
package/src/tools/playbooks/playbook-update.ts +0 -111

package/src/__tests__/ipc-snapshot.test.ts CHANGED Viewed

@@ -4,7 +4,6 @@ import type {
   ClientMessage,
   ServerMessage,
 } from '../daemon/ipc-protocol.js';
-import type { ConfirmationRequest } from '../daemon/ipc-contract.js';
 /**
  * Snapshot tests for every IPC message type.
@@ -218,6 +217,8 @@ const clientMessages: Record<ClientMessageType, ClientMessage> = {
     pattern: 'git *',
     scope: '/projects/my-app',
     decision: 'allow',
+    allowHighRisk: true,
+    executionTarget: 'host',
   },
   trust_rules_list: {
     type: 'trust_rules_list',
@@ -327,6 +328,28 @@ const clientMessages: Record<ClientMessageType, ClientMessage> = {
     type: 'app_preview_request',
     appId: 'app-001',
   },
+  app_history_request: {
+    type: 'app_history_request',
+    appId: 'app-001',
+    limit: 25,
+  },
+  app_diff_request: {
+    type: 'app_diff_request',
+    appId: 'app-001',
+    fromCommit: 'abc123def456',
+    toCommit: '789abc123def',
+  },
+  app_file_at_version_request: {
+    type: 'app_file_at_version_request',
+    appId: 'app-001',
+    path: 'index.html',
+    commitHash: 'abc123def456',
+  },
+  app_restore_request: {
+    type: 'app_restore_request',
+    appId: 'app-001',
+    commitHash: 'abc123def456',
+  },
   share_app_cloud: {
     type: 'share_app_cloud',
     appId: 'app-001',
@@ -351,6 +374,10 @@ const clientMessages: Record<ClientMessageType, ClientMessage> = {
     type: 'twitter_integration_config',
     action: 'get',
   },
+  telegram_config: {
+    type: 'telegram_config',
+    action: 'get',
+  },
   twitter_auth_start: {
     type: 'twitter_auth_start',
   },
@@ -516,6 +543,17 @@ const clientMessages: Record<ClientMessageType, ClientMessage> = {
   identity_get: {
     type: 'identity_get',
   },
+  tool_permission_simulate: {
+    type: 'tool_permission_simulate',
+    toolName: 'bash',
+    input: { command: 'rm -rf /tmp/test' },
+    workingDir: '/projects/my-app',
+    isInteractive: true,
+    forcePromptSideEffects: false,
+  },
+  tool_names_list: {
+    type: 'tool_names_list',
+  },
 };
 // ---------------------------------------------------------------------------
@@ -605,9 +643,6 @@ const serverMessages: Record<ServerMessageType, ServerMessage> = {
     },
     sandboxed: false,
     sessionId: 'sess-001',
-    principalKind: 'skill',
-    principalId: 'my-skill',
-    principalVersion: 'sha256:abcdef1234567890',
   },
   message_complete: {
     type: 'message_complete',
@@ -1169,6 +1204,14 @@ const serverMessages: Record<ServerMessageType, ServerMessage> = {
     localClientConfigured: true,
     connected: false,
   },
+  telegram_config_response: {
+    type: 'telegram_config_response',
+    success: true,
+    hasBotToken: true,
+    botUsername: 'my_test_bot',
+    connected: true,
+    hasWebhookSecret: true,
+  },
   twitter_auth_result: {
     type: 'twitter_auth_result',
     success: true,
@@ -1195,6 +1238,37 @@ const serverMessages: Record<ServerMessageType, ServerMessage> = {
     appId: 'app-001',
     preview: 'base64-png-data',
   },
+  app_history_response: {
+    type: 'app_history_response',
+    appId: 'app-001',
+    versions: [
+      {
+        commitHash: 'abc123def456',
+        message: 'Initial app commit',
+        timestamp: 1700000000,
+      },
+      {
+        commitHash: '789abc123def',
+        message: 'Update landing page',
+        timestamp: 1700001000,
+      },
+    ],
+  },
+  app_diff_response: {
+    type: 'app_diff_response',
+    appId: 'app-001',
+    diff: 'diff --git a/index.html b/index.html',
+  },
+  app_file_at_version_response: {
+    type: 'app_file_at_version_response',
+    appId: 'app-001',
+    path: 'index.html',
+    content: '<html><body>Hello</body></html>',
+  },
+  app_restore_response: {
+    type: 'app_restore_response',
+    success: true,
+  },
   ui_surface_undo_result: {
     type: 'ui_surface_undo_result',
     sessionId: 'sess-001',
@@ -1490,6 +1564,28 @@ const serverMessages: Record<ServerMessageType, ServerMessage> = {
     emoji: '✨',
     home: '~/workspace',
   },
+  tool_permission_simulate_response: {
+    type: 'tool_permission_simulate_response',
+    success: true,
+    decision: 'prompt',
+    riskLevel: 'high',
+    reason: 'No matching trust rule; tool requires approval',
+    promptPayload: {
+      allowlistOptions: [
+        { label: 'Allow rm commands', description: 'Allow rm commands', pattern: 'bash:rm *' },
+      ],
+      scopeOptions: [
+        { label: 'In /projects/my-app', scope: '/projects/my-app' },
+      ],
+      persistentDecisionsAllowed: true,
+    },
+    executionTarget: 'host',
+    matchedRuleId: undefined,
+  },
+  tool_names_list_response: {
+    type: 'tool_names_list_response',
+    names: ['bash', 'file_read', 'file_write'],
+  },
 };
 // ---------------------------------------------------------------------------
@@ -1601,43 +1697,6 @@ describe('IPC message snapshots', () => {
     });
   });
-  // Baseline assertions for principal context in confirmation_request.
-  describe('confirmation principal context baselines', () => {
-    test('confirmation_request includes principal context fields', () => {
-      const req = serverMessages.confirmation_request as ConfirmationRequest;
-      expect(req.principalKind).toBe('skill');
-      expect(req.principalId).toBe('my-skill');
-      expect(req.principalVersion).toBe('sha256:abcdef1234567890');
-    });
-    test('confirmation_request principal fields are optional (backward-compatible)', () => {
-      // Core tools omit principal fields — verify the contract allows it
-      const minimal: typeof serverMessages.confirmation_request = {
-        type: 'confirmation_request',
-        requestId: 'req-minimal',
-        toolName: 'bash',
-        input: { command: 'ls' },
-        riskLevel: 'low',
-        allowlistOptions: [],
-        scopeOptions: [],
-      };
-      const serialized = serialize(minimal);
-      const parsed = JSON.parse(serialized.trimEnd());
-      expect(parsed.principalKind).toBeUndefined();
-      expect(parsed.principalId).toBeUndefined();
-      expect(parsed.principalVersion).toBeUndefined();
-    });
-    test('confirmation_request round-trips with all principal fields', () => {
-      const req = serverMessages.confirmation_request;
-      const serialized = serialize(req);
-      const parsed = JSON.parse(serialized.trimEnd());
-      expect(parsed.principalKind).toBe('skill');
-      expect(parsed.principalId).toBe('my-skill');
-      expect(parsed.principalVersion).toBe('sha256:abcdef1234567890');
-    });
-  });
   // Baseline assertions for error-related message contracts.
   // These document the current shape before error handling modernization.
   describe('error message baselines', () => {

package/src/__tests__/ipc-validate.test.ts CHANGED Viewed

@@ -295,6 +295,55 @@ describe('IPC Validate', () => {
       if (!result.valid) expect(result.reason).toContain('non-empty string "actionId"');
     });
+    // ─── High-risk: add_trust_rule ──────────────────────────────────────
+    test('accepts valid add_trust_rule', () => {
+      const result = validateClientMessage({
+        type: 'add_trust_rule',
+        toolName: 'Bash',
+        pattern: '*',
+        scope: 'global',
+        decision: 'allow',
+      });
+      expect(result.valid).toBe(true);
+    });
+    test('accepts all valid add_trust_rule decisions', () => {
+      for (const decision of ['allow', 'deny', 'ask']) {
+        const result = validateClientMessage({
+          type: 'add_trust_rule',
+          toolName: 'Bash',
+          pattern: '*',
+          scope: 'global',
+          decision,
+        });
+        expect(result.valid).toBe(true);
+      }
+    });
+    test('rejects add_trust_rule without toolName', () => {
+      const result = validateClientMessage({
+        type: 'add_trust_rule',
+        pattern: '*',
+        scope: 'global',
+        decision: 'allow',
+      });
+      expect(result.valid).toBe(false);
+      if (!result.valid) expect(result.reason).toContain('non-empty string "toolName"');
+    });
+    test('rejects add_trust_rule with invalid decision', () => {
+      const result = validateClientMessage({
+        type: 'add_trust_rule',
+        toolName: 'Bash',
+        pattern: '*',
+        scope: 'global',
+        decision: 'always_allow',
+      });
+      expect(result.valid).toBe(false);
+      if (!result.valid) expect(result.reason).toContain('"decision" must be one of');
+    });
     // ─── Extra properties are tolerated ─────────────────────────────────
     test('allows extra properties on known types', () => {
@@ -335,6 +384,7 @@ describe('IPC Validate', () => {
       secret_response: { requestId: 'r1' },
       ui_surface_action: { sessionId: 's1', surfaceId: 'sf1', actionId: 'a1' },
       ipc_blob_probe: { probeId: 'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee', nonceSha256: 'abc123' },
+      add_trust_rule: { toolName: 'Bash', pattern: '*', scope: 'global', decision: 'allow' },
       document_save: { surfaceId: 'doc1', conversationId: 'c1', title: 'Doc', content: 'text', wordCount: 1 },
       document_load: { surfaceId: 'doc1' },
       document_list: {},

package/src/__tests__/key-migration.test.ts CHANGED Viewed

@@ -31,6 +31,9 @@ mock.module('../util/platform.js', () => ({
     const logsDir = join(TEST_DIR, 'logs');
     if (!existsSync(logsDir)) mkdirSync(logsDir, { recursive: true });
   },
+  migrateToWorkspaceLayout: () => {},
+  migrateToDataLayout: () => {},
+  migratePath: () => {},
   isMacOS: () => false,
   isLinux: () => false,
   isWindows: () => false,
@@ -45,8 +48,23 @@ import { getSecureKey } from '../security/secure-keys.js';
 // Tests
 // ---------------------------------------------------------------------------
+// API key env vars that loadConfig checks — must be cleared during tests
+// so they don't override the migrated values under test.
+const API_KEY_ENV_VARS = [
+  'ANTHROPIC_API_KEY', 'OPENAI_API_KEY', 'GEMINI_API_KEY',
+  'OLLAMA_API_KEY', 'FIREWORKS_API_KEY', 'OPENROUTER_API_KEY',
+  'BRAVE_API_KEY', 'PERPLEXITY_API_KEY',
+];
 describe('key migration', () => {
+  const savedEnv: Record<string, string | undefined> = {};
   beforeEach(() => {
+    // Save and clear API key env vars
+    for (const key of API_KEY_ENV_VARS) {
+      savedEnv[key] = process.env[key];
+      delete process.env[key];
+    }
     if (existsSync(TEST_DIR)) {
       rmSync(TEST_DIR, { recursive: true, force: true });
     }
@@ -62,6 +80,11 @@ describe('key migration', () => {
     _setStorePath(null);
     _setBackend(undefined);
     invalidateConfigCache();
+    // Restore API key env vars
+    for (const key of API_KEY_ENV_VARS) {
+      if (savedEnv[key] === undefined) delete process.env[key];
+      else process.env[key] = savedEnv[key]!;
+    }
   });
   test('[experimental] migrates plaintext apiKeys from config.json to secure storage', () => {

package/src/__tests__/memory-regressions.test.ts CHANGED Viewed

@@ -1216,6 +1216,105 @@ describe('Memory regressions', () => {
     }
   });
+  test('background conflict resolver dismisses transient/non-durable conflicts without LLM call', async () => {
+    const db = getDb();
+    const now = 1_700_001_500_000;
+    const originalConflictsEnabled = TEST_CONFIG.memory.conflicts.enabled;
+    TEST_CONFIG.memory.conflicts.enabled = true;
+    try {
+      db.insert(conversations).values({
+        id: 'conv-conflicts-transient',
+        title: null,
+        createdAt: now,
+        updatedAt: now,
+        totalInputTokens: 0,
+        totalOutputTokens: 0,
+        totalEstimatedCost: 0,
+        contextSummary: null,
+        contextCompactedMessageCount: 0,
+        contextCompactedAt: null,
+      }).run();
+      db.insert(messages).values({
+        id: 'msg-conflicts-transient',
+        conversationId: 'conv-conflicts-transient',
+        role: 'user',
+        content: JSON.stringify([{ type: 'text', text: 'Keep the new one instead.' }]),
+        createdAt: now + 1,
+      }).run();
+      // Create a transient conflict: PR tracking statements should be dismissed
+      db.insert(memoryItems).values([
+        {
+          id: 'item-conflict-existing-transient',
+          kind: 'preference',
+          subject: 'pr-tracking',
+          statement: 'Currently tracking PR #42 for review.',
+          status: 'active',
+          confidence: 0.8,
+          fingerprint: 'fp-conflict-existing-transient',
+          verificationState: 'assistant_inferred',
+          scopeId: 'scope-conflicts-transient',
+          firstSeenAt: now - 10_000,
+          lastSeenAt: now - 5_000,
+          validFrom: now - 10_000,
+          invalidAt: null,
+        },
+        {
+          id: 'item-conflict-candidate-transient',
+          kind: 'preference',
+          subject: 'pr-tracking',
+          statement: 'Currently tracking PR #99 for review.',
+          status: 'pending_clarification',
+          confidence: 0.8,
+          fingerprint: 'fp-conflict-candidate-transient',
+          verificationState: 'assistant_inferred',
+          scopeId: 'scope-conflicts-transient',
+          firstSeenAt: now - 9_000,
+          lastSeenAt: now - 4_000,
+          validFrom: now - 9_000,
+          invalidAt: null,
+        },
+      ]).run();
+      const conflict = createOrUpdatePendingConflict({
+        scopeId: 'scope-conflicts-transient',
+        existingItemId: 'item-conflict-existing-transient',
+        candidateItemId: 'item-conflict-candidate-transient',
+        relationship: 'ambiguous_contradiction',
+      });
+      db.update(memoryItemConflicts)
+        .set({ createdAt: now, updatedAt: now })
+        .where(eq(memoryItemConflicts.id, conflict.id))
+        .run();
+      enqueueResolvePendingConflictsForMessageJob('msg-conflicts-transient', 'scope-conflicts-transient');
+      const processed = await runMemoryJobsOnce();
+      expect(processed).toBe(1);
+      const updatedConflict = getConflictById(conflict.id);
+      expect(updatedConflict?.status).toBe('dismissed');
+      expect(updatedConflict?.resolutionNote).toContain('conflict policy');
+      // Memory items should remain untouched (no LLM resolution was attempted)
+      const existing = db
+        .select()
+        .from(memoryItems)
+        .where(eq(memoryItems.id, 'item-conflict-existing-transient'))
+        .get();
+      const candidate = db
+        .select()
+        .from(memoryItems)
+        .where(eq(memoryItems.id, 'item-conflict-candidate-transient'))
+        .get();
+      expect(existing?.status).toBe('active');
+      expect(candidate?.status).toBe('pending_clarification');
+    } finally {
+      TEST_CONFIG.memory.conflicts.enabled = originalConflictsEnabled;
+    }
+  });
   test('cleanup job enqueue is deduped and retention overrides upgrade payload', () => {
     const db = getDb();

package/src/__tests__/memory-retrieval.benchmark.test.ts CHANGED Viewed

@@ -398,7 +398,7 @@ describe('Memory retrieval benchmark', () => {
     }
   });
-  test('recall.latencyMs tracks wall-clock within 20% tolerance', async () => {
+  test('recall.latencyMs tracks wall-clock within 50% tolerance', async () => {
     const conversationId = 'conv-bench-wallclock';
     const now = 1_700_500_000_000;
     seedMemoryItems(conversationId, 500, now);

package/src/__tests__/oauth-callback-registry.test.ts CHANGED Viewed

@@ -61,13 +61,20 @@ describe('OAuth callback registry', () => {
   test('TTL expiry rejects callback with timeout error', async () => {
     const promise = new Promise<string>((resolve, reject) => {
-      registerPendingCallback('state-ttl', resolve, reject, 50);
+      registerPendingCallback('state-ttl', resolve, reject, 100);
     });
-    // Wait for the TTL to expire
-    await new Promise((r) => setTimeout(r, 100));
+    // Attach a catch handler immediately to prevent unhandled rejection
+    // during the sleep. We capture the error and verify it afterwards.
+    let caughtError: Error | undefined;
+    const guarded = promise.catch((err) => { caughtError = err; });
-    await expect(promise).rejects.toThrow('OAuth callback timed out');
+    // Wait for the TTL to expire (generous margin)
+    await new Promise((r) => setTimeout(r, 300));
+    await guarded;
+    expect(caughtError).toBeDefined();
+    expect(caughtError!.message).toBe('OAuth callback timed out');
     // After expiry, consume should return false
     const consumed = consumeCallback('state-ttl', 'late-code');