@koda-sl/baker-bridge 0.118.0-dev.4a0a40cc5 → 0.118.0

package/dist/hono/bridge-job.test.js

@@ -18,6 +18,7 @@ vi.mock("./runtime-files.ts", async (importOriginal) => {
 import { AVATAR_CASTING_TOOL_NAME } from "./avatar-casting.js";
 import { BridgeJobExecutor, createStallDetector, isContextOverflowRefusal, isControlChannelDeny, parsePlanDecision, remapAnswersToQuestionText, } from "./bridge-job.js";
 import { CONNECTION_INPUT_TOOL_NAME } from "./connection-input.js";
+import { CREDENTIAL_INPUT_TOOL_NAME } from "./credential-input.js";
 import { FLOW_INPUT_TOOL_NAME } from "./flow-input.js";
 import { bridgeRuntimeFiles } from "./runtime-files.js";
 import { TAG_INPUT_TOOL_NAME } from "./tag-input.js";
@@ -49,6 +50,7 @@ function activeControls() {
         pendingTagInputs: new Map(),
         pendingFlowInputs: new Map(),
         pendingConnectionInputs: new Map(),
+        pendingCredentialInputs: new Map(),
         pendingVoiceCasts: new Map(),
         pendingAvatarCastings: new Map(),
         isActive: () => active,
@@ -82,6 +84,8 @@ function recordingRelay() {
         flowInputResolved: () => Promise.resolve(),
         connectionInputRequest: () => Promise.resolve(true),
         connectionInputResolved: () => Promise.resolve(),
+        credentialInputRequest: () => Promise.resolve(true),
+        credentialInputResolved: () => Promise.resolve(),
         avatarCastingRequest: () => Promise.resolve(true),
         avatarCastingResolved: () => Promise.resolve(),
         assistantEvent: (target, event, model) => {
@@ -1443,6 +1447,24 @@ describe("BridgeJobExecutor", () => {
         expect(queryInputs[0]?.prompt).toBe("make the headline bigger");
         expect(queryInputs[0]?.reminder).toContain('landing "Homepage" (slug: homepage)');
     });
+    it("explains a credential the message names beside it, together with the viewing reference", async () => {
+        const queryInputs = [];
+        const executor = createExecutor({
+            queryInputs,
+            queryResults: [scriptedMessages(resultMessage(0, "session_credential"))],
+        });
+        await executor.execute({
+            threadId: "thread_credential",
+            turnId: "turn_credential",
+            prompt: "log in with user admin and password {{credential:password}}",
+            history: history([]),
+            currentReference: { type: "landing", slug: "homepage", title: "Homepage" },
+            credentials: [{ name: "password", label: "Login password", allowedHosts: [] }],
+        }, activeControls());
+        expect(queryInputs[0]?.prompt).toBe("log in with user admin and password {{credential:password}}");
+        expect(queryInputs[0]?.reminder).toContain('landing "Homepage"');
+        expect(queryInputs[0]?.reminder).toContain("`{{credential:password}}` is a credential the user saved");
+    });
     it("strips newlines from the viewing reference so a crafted title can't inject instructions", async () => {
         const queryInputs = [];
         const executor = createExecutor({
@@ -2184,6 +2206,36 @@ describe("BridgeJobExecutor", () => {
             updatedInput: { resolution: { toolsReady: false, failedToLoad: ["acme"] } },
         });
     });
+    it("does not call an app ready when the reloaded tools do not include it", async () => {
+        const relay = recordingRelay();
+        relay.connectionInputRequest = () => Promise.resolve(true);
+        const controls = activeControls();
+        let decision;
+        const executor = new BridgeJobExecutor({
+            sdk: {
+                query: (input) => ({
+                    async *[Symbol.asyncIterator]() {
+                        const asked = input.options.canUseTool?.(CONNECTION_INPUT_TOOL_NAME, { connections: [{ app: "notion", reason: "r" }] }, { toolUseID: "t1", requestId: "req_t1", signal: new AbortController().signal });
+                        await new Promise((resolve) => setTimeout(resolve, 10));
+                        for (const [, pending] of controls.pendingConnectionInputs) {
+                            pending.resolve({ results: [{ status: "connected", app: "notion", scope: "company" }] });
+                        }
+                        decision = await asked;
+                        yield resultMessage(0, "session_after_missing_app");
+                    },
+                    setMcpServers: () => Promise.resolve({ added: [], removed: [], errors: {} }),
+                }),
+            },
+            model: "claude-test",
+            sessionStore: { load: async () => undefined, save: async () => undefined, clear: async () => undefined },
+            relay,
+            mcpServersProvider: () => Promise.resolve({}),
+        });
+        await executor.execute({ threadId: "thread_app", turnId: "turn_app", prompt: "Connect Notion" }, controls);
+        expect(decision).toMatchObject({
+            updatedInput: { resolution: { toolsReady: false, failedToLoad: ["notion"] } },
+        });
+    });
     it("leaves the turn's tools alone when only a platform was connected", async () => {
         const relay = recordingRelay();
         relay.connectionInputRequest = () => Promise.resolve(true);
@@ -2214,6 +2266,94 @@ describe("BridgeJobExecutor", () => {
         await executor.execute({ threadId: "thread_pl", turnId: "turn_pl", prompt: "Connect HubSpot" }, controls);
         expect(reloads).toBe(0);
     });
+    it("turns request_credential away in a Runtime without Credentials", async () => {
+        const relay = recordingRelay();
+        const requests = [];
+        relay.credentialInputRequest = (_target, request) => {
+            requests.push(request);
+            return Promise.resolve(true);
+        };
+        let decision;
+        const executor = new BridgeJobExecutor({
+            sdk: {
+                query: (input) => ({
+                    async *[Symbol.asyncIterator]() {
+                        decision = await input.options.canUseTool?.(CREDENTIAL_INPUT_TOOL_NAME, {
+                            label: "Shopify admin token",
+                            reason: "so I can update the theme",
+                            allowedHosts: ["acme.myshopify.com"],
+                        }, {
+                            toolUseID: "t1",
+                            requestId: "req_t1",
+                            signal: input.options.abortController?.signal ?? new AbortController().signal,
+                        });
+                        yield resultMessage(0, "session_credential_off");
+                    },
+                }),
+            },
+            model: "claude-test",
+            sessionStore: { load: async () => undefined, save: async () => undefined, clear: async () => undefined },
+            relay,
+        });
+        await executor.execute({ threadId: "thread_co", turnId: "turn_co", prompt: "Fix my theme" }, activeControls());
+        expect(requests).toEqual([]);
+        expect(decision).toMatchObject({ behavior: "deny", message: expect.stringContaining("not available") });
+    });
+    it("parks a credential request and hands the agent only the placeholder the user's answer stored", async () => {
+        vi.stubEnv("BAKER_CREDENTIALS", "1");
+        const relay = recordingRelay();
+        const requests = [];
+        relay.credentialInputRequest = (_target, request) => {
+            requests.push(request);
+            return Promise.resolve(true);
+        };
+        const controls = activeControls();
+        let decision;
+        const executor = new BridgeJobExecutor({
+            sdk: {
+                query: (input) => ({
+                    async *[Symbol.asyncIterator]() {
+                        const asked = input.options.canUseTool?.(CREDENTIAL_INPUT_TOOL_NAME, {
+                            label: "Shopify admin token",
+                            reason: "so I can update the theme",
+                            allowedHosts: ["acme.myshopify.com"],
+                        }, {
+                            toolUseID: "t1",
+                            requestId: "req_t1",
+                            signal: input.options.abortController?.signal ?? new AbortController().signal,
+                        });
+                        await new Promise((resolve) => setTimeout(resolve, 10));
+                        for (const [, pending] of controls.pendingCredentialInputs) {
+                            pending.resolve({
+                                status: "stored",
+                                name: "shopify-admin-token",
+                                placeholder: "{{credential:shopify-admin-token}}",
+                                allowedHosts: ["acme.myshopify.com"],
+                            });
+                        }
+                        decision = await asked;
+                        yield resultMessage(0, "session_credential");
+                    },
+                }),
+            },
+            model: "claude-test",
+            sessionStore: { load: async () => undefined, save: async () => undefined, clear: async () => undefined },
+            relay,
+        });
+        await executor.execute({ threadId: "thread_cr", turnId: "turn_cr", prompt: "Fix my theme" }, controls);
+        expect(requests).toEqual([
+            {
+                toolUseId: "t1",
+                label: "Shopify admin token",
+                reason: "so I can update the theme",
+                allowedHosts: ["acme.myshopify.com"],
+            },
+        ]);
+        expect(decision).toMatchObject({
+            behavior: "allow",
+            updatedInput: { resolution: { status: "stored", placeholder: "{{credential:shopify-admin-token}}" } },
+        });
+    });
     it("refuses to ask for an avatar's face in a tool that renders only text", async () => {
         // Shipped three times, in both modes, after the agent had just read the doc saying
         // not to: "Elige el rostro para Clara, tu presentadora de placas solares" with
@@ -3626,7 +3766,9 @@ describe("BridgeJobExecutor review mode", () => {
         const options = queryInputs[0]?.options;
         expect(options.model).toBe("claude-session-model");
         expect(options.outputFormat).toBeUndefined();
-        expect(options.hooks).toBeUndefined();
+        // Only the credential scrub, which every turn runs; none of the review's hooks.
+        expect(Object.keys(options.hooks ?? {})).toEqual(["PostToolUse"]);
+        expect(options.hooks?.PostToolUse).toHaveLength(1);
         expect(options.env?.MAX_STRUCTURED_OUTPUT_RETRIES).toBeUndefined();
         expect(options.disallowedTools).not.toContain("Write");
         expect(options.env?.BAKER_DEBUG_LOG).toBeUndefined();