@mycadet/assistant 0.12.10 → 0.13.0

package/src/runtime/migrations/__tests__/rebind-secrets-credentials.test.ts

@@ -1,184 +0,0 @@
-/**
- * Tests for credential-aware rebind-secrets screen behavior.
- *
- * Covers:
- * - All credentials imported successfully -> re-enter-secrets auto-completed
- * - Partial import failure -> targeted list of failed credentials
- * - Legacy bundles without credentials -> original rebind-secrets behavior
- */
-
-import { describe, expect, test } from "bun:test";
-
-import type { MigrationWizardState } from "../migration-wizard.js";
-import { createWizardState } from "../migration-wizard.js";
-import {
-  createTaskCompletionState,
-  deriveRebindSecretsScreenState,
-} from "../rebind-secrets-screen.js";
-
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-
-/**
- * Create a wizard state that has progressed to the rebind-secrets step.
- */
-function wizardAtRebindSecrets(
-  credentialsImported?: MigrationWizardState["credentialsImported"],
-): MigrationWizardState {
-  const base = createWizardState();
-  return {
-    ...base,
-    currentStep: "rebind-secrets",
-    direction: "managed-to-self-hosted",
-    steps: {
-      ...base.steps,
-      "select-direction": { status: "success" },
-      "upload-bundle": { status: "success" },
-      validate: { status: "success" },
-      "preflight-review": { status: "success" },
-      transfer: { status: "success" },
-      "rebind-secrets": { status: "idle" },
-      complete: { status: "idle" },
-    },
-    hasBundleData: true,
-    credentialsImported,
-  };
-}
-
-// ---------------------------------------------------------------------------
-// Tests
-// ---------------------------------------------------------------------------
-
-describe("rebind-secrets-screen credential awareness", () => {
-  test("all credentials imported successfully -> re-enter-secrets is auto-completed", () => {
-    const wizard = wizardAtRebindSecrets({
-      total: 3,
-      succeeded: 3,
-      failed: 0,
-      failedAccounts: [],
-    });
-    const completion = createTaskCompletionState();
-    const screen = deriveRebindSecretsScreenState(wizard, completion);
-
-    expect(screen.phase).toBe("active");
-    if (screen.phase !== "active") {
-      return;
-    }
-
-    const secretsTask = screen.tasks.find((t) => t.id === "re-enter-secrets");
-    expect(secretsTask).toBeDefined();
-    expect(secretsTask!.status).toBe("complete");
-    expect(secretsTask!.title).toBe("API keys and secrets transferred");
-    expect(secretsTask!.description).toContain("3 credential(s)");
-    expect(secretsTask!.description).toContain("automatically imported");
-  });
-
-  test("partial import failure -> shows only failed credentials", () => {
-    const wizard = wizardAtRebindSecrets({
-      total: 3,
-      succeeded: 2,
-      failed: 1,
-      failedAccounts: ["openai-key"],
-    });
-    const completion = createTaskCompletionState();
-    const screen = deriveRebindSecretsScreenState(wizard, completion);
-
-    expect(screen.phase).toBe("active");
-    if (screen.phase !== "active") {
-      return;
-    }
-
-    const secretsTask = screen.tasks.find((t) => t.id === "re-enter-secrets");
-    expect(secretsTask).toBeDefined();
-    expect(secretsTask!.status).toBe("pending");
-    expect(secretsTask!.title).toBe("Re-enter failed credentials");
-    expect(secretsTask!.description).toContain("2 of 3");
-    expect(secretsTask!.description).toContain('"openai-key"');
-    expect(secretsTask!.description).toContain("manual re-entry");
-  });
-
-  test("legacy bundle without credentials -> original rebind-secrets behavior", () => {
-    const wizard = wizardAtRebindSecrets(undefined);
-    const completion = createTaskCompletionState();
-    const screen = deriveRebindSecretsScreenState(wizard, completion);
-
-    expect(screen.phase).toBe("active");
-    if (screen.phase !== "active") {
-      return;
-    }
-
-    const secretsTask = screen.tasks.find((t) => t.id === "re-enter-secrets");
-    expect(secretsTask).toBeDefined();
-    expect(secretsTask!.status).toBe("pending");
-    expect(secretsTask!.title).toBe("Re-enter API keys and secrets");
-    expect(secretsTask!.description).toContain("redacted in export bundles");
-  });
-
-  test("all credentials imported -> allRequiredComplete reflects auto-completion", () => {
-    const wizard = wizardAtRebindSecrets({
-      total: 2,
-      succeeded: 2,
-      failed: 0,
-      failedAccounts: [],
-    });
-    // Mark all other required tasks as complete
-    let completion = createTaskCompletionState();
-    completion = {
-      ...completion,
-      "rebind-channels": true,
-      "reconfigure-auth": true,
-    };
-    const screen = deriveRebindSecretsScreenState(wizard, completion);
-
-    expect(screen.phase).toBe("active");
-    if (screen.phase !== "active") {
-      return;
-    }
-
-    // re-enter-secrets is auto-completed, rebind-channels and reconfigure-auth are manually done
-    expect(screen.allRequiredComplete).toBe(true);
-  });
-
-  test("partial failure -> allRequiredComplete is false when failed creds not manually acknowledged", () => {
-    const wizard = wizardAtRebindSecrets({
-      total: 3,
-      succeeded: 2,
-      failed: 1,
-      failedAccounts: ["anthropic-key"],
-    });
-    const completion = createTaskCompletionState();
-    const screen = deriveRebindSecretsScreenState(wizard, completion);
-
-    expect(screen.phase).toBe("active");
-    if (screen.phase !== "active") {
-      return;
-    }
-
-    // re-enter-secrets is still pending (partial failure), so not all required complete
-    expect(screen.allRequiredComplete).toBe(false);
-  });
-
-  test("multiple failed credentials are listed in description", () => {
-    const wizard = wizardAtRebindSecrets({
-      total: 4,
-      succeeded: 1,
-      failed: 3,
-      failedAccounts: ["openai-key", "anthropic-key", "github-token"],
-    });
-    const completion = createTaskCompletionState();
-    const screen = deriveRebindSecretsScreenState(wizard, completion);
-
-    expect(screen.phase).toBe("active");
-    if (screen.phase !== "active") {
-      return;
-    }
-
-    const secretsTask = screen.tasks.find((t) => t.id === "re-enter-secrets");
-    expect(secretsTask).toBeDefined();
-    expect(secretsTask!.description).toContain('"openai-key"');
-    expect(secretsTask!.description).toContain('"anthropic-key"');
-    expect(secretsTask!.description).toContain('"github-token"');
-    expect(secretsTask!.description).toContain("1 of 4");
-  });
-});

package/src/runtime/migrations/__tests__/staged-import-path.test.ts

@@ -1,110 +0,0 @@
-import {
-  mkdirSync,
-  mkdtempSync,
-  realpathSync,
-  symlinkSync,
-  writeFileSync,
-} from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { describe, expect, test } from "bun:test";
-
-import {
-  resolveStagedImportPath,
-  RESTORE_STAGING_DIRNAME,
-  StagedImportPathError,
-} from "../staged-import-path.js";
-
-function stagingWorkspace(): { workspace: string; staging: string } {
-  const workspace = realpathSync(mkdtempSync(join(tmpdir(), "staged-import-")));
-  const staging = join(workspace, RESTORE_STAGING_DIRNAME);
-  mkdirSync(staging, { recursive: true });
-  return { workspace, staging };
-}
-
-describe("resolveStagedImportPath", () => {
-  test("resolves a relative path inside the staging directory", () => {
-    const { workspace, staging } = stagingWorkspace();
-    const file = join(staging, "backup.vbundle");
-    writeFileSync(file, "bundle");
-
-    expect(
-      resolveStagedImportPath(
-        `${RESTORE_STAGING_DIRNAME}/backup.vbundle`,
-        workspace,
-      ),
-    ).toBe(realpathSync(file));
-  });
-
-  test("resolves an absolute path inside the staging directory", () => {
-    const { workspace, staging } = stagingWorkspace();
-    const file = join(staging, "backup.vbundle");
-    writeFileSync(file, "bundle");
-
-    expect(resolveStagedImportPath(file, workspace)).toBe(realpathSync(file));
-  });
-
-  test("rejects a missing file", () => {
-    const { workspace } = stagingWorkspace();
-    expect(() =>
-      resolveStagedImportPath(
-        `${RESTORE_STAGING_DIRNAME}/missing.vbundle`,
-        workspace,
-      ),
-    ).toThrow(StagedImportPathError);
-  });
-
-  test("rejects traversal out of the staging directory", () => {
-    const { workspace } = stagingWorkspace();
-    writeFileSync(join(workspace, "secret.vbundle"), "nope");
-
-    expect(() =>
-      resolveStagedImportPath(
-        `${RESTORE_STAGING_DIRNAME}/../secret.vbundle`,
-        workspace,
-      ),
-    ).toThrow(StagedImportPathError);
-  });
-
-  test("rejects a path outside the workspace", () => {
-    const { workspace } = stagingWorkspace();
-    const outside = join(tmpdir(), `outside-${Date.now()}.vbundle`);
-    writeFileSync(outside, "nope");
-
-    expect(() => resolveStagedImportPath(outside, workspace)).toThrow(
-      StagedImportPathError,
-    );
-  });
-
-  test("rejects a symlink even when it points at a staging file", () => {
-    const { workspace, staging } = stagingWorkspace();
-    const file = join(staging, "backup.vbundle");
-    writeFileSync(file, "bundle");
-    const link = join(staging, "alias.vbundle");
-    symlinkSync(file, link);
-
-    expect(() => resolveStagedImportPath(link, workspace)).toThrow(
-      StagedImportPathError,
-    );
-  });
-
-  test("rejects a non-.vbundle file in staging", () => {
-    const { workspace, staging } = stagingWorkspace();
-    const file = join(staging, "notes.txt");
-    writeFileSync(file, "nope");
-
-    expect(() =>
-      resolveStagedImportPath(
-        `${RESTORE_STAGING_DIRNAME}/notes.txt`,
-        workspace,
-      ),
-    ).toThrow(StagedImportPathError);
-  });
-
-  test("rejects an empty path", () => {
-    const { workspace } = stagingWorkspace();
-    expect(() => resolveStagedImportPath("   ", workspace)).toThrow(
-      StagedImportPathError,
-    );
-  });
-});

package/src/runtime/migrations/__tests__/v1-test-helpers.ts

@@ -1,112 +0,0 @@
-/**
- * Shared test helpers for vbundle v1 manifest fixture builders.
- *
- * Most tests don't care about the specific values of the assistant identity,
- * origin, compatibility, or export-options blocks — they just need the
- * builder/validator to accept their fixtures. Centralizing the defaults
- * keeps every test from re-spelling the same six required option fields.
- */
-
-import { randomUUID } from "node:crypto";
-
-import type {
-  BuildVBundleOptions,
-  VBundleAssistantInfo,
-  VBundleCompatibility,
-  VBundleExportOptions,
-  VBundleOriginInfo,
-} from "../vbundle-builder.js";
-import {
-  computeManifestChecksum,
-  type ManifestFileEntryType,
-  type ManifestType,
-} from "../vbundle-validator.js";
-
-export interface DefaultV1Options {
-  assistant: VBundleAssistantInfo;
-  origin: VBundleOriginInfo;
-  compatibility: VBundleCompatibility;
-  exportOptions: VBundleExportOptions;
-  secretsRedacted: boolean;
-}
-
-/**
- * Sensible defaults for the six caller-required v1 manifest options.
- *
- * `secretsRedacted` defaults to false to match the runtime's typical
- * "credentials included by design" path; tests that exercise the cloud
- * cross-field refine override `origin.mode` and `secretsRedacted` directly.
- */
-export function defaultV1Options(): DefaultV1Options {
-  return {
-    assistant: {
-      id: "self",
-      name: "Test",
-      runtime_version: "0.0.0-test",
-    },
-    origin: {
-      mode: "self-hosted-local",
-    },
-    compatibility: {
-      min_runtime_version: "0.0.0-test",
-      max_runtime_version: null,
-    },
-    exportOptions: {
-      include_logs: false,
-      include_browser_state: false,
-      include_memory_vectors: false,
-    },
-    secretsRedacted: false,
-  };
-}
-
-/**
- * Convenience: spread `defaultV1Options()` into a `BuildVBundleOptions`
- * with the supplied `files`. Saves repeating the spread at every call site.
- */
-export function buildVBundleTestOptions(
-  files: BuildVBundleOptions["files"],
-  overrides: Partial<DefaultV1Options> = {},
-): BuildVBundleOptions {
-  return {
-    files,
-    ...defaultV1Options(),
-    ...overrides,
-  };
-}
-
-/**
- * Build a v1 ManifestType for tests, mirroring buildManifestObject() in
- * vbundle-builder.ts. Use this in test fixtures that need a synthetic
- * manifest rather than calling buildVBundle (e.g. cross-version compat
- * tests that need to mutate fields between emit and validate).
- *
- * Pass `overrides` to override any field after the defaults are applied —
- * useful for negative-path tests that exercise specific schema rejections.
- * `schema_version` is widened to `number` so negative tests can write 0/2/etc.
- * The checksum is computed on the merged shape so overrides take effect.
- */
-export type BuildTestManifestOverrides = Partial<
-  Omit<ManifestType, "schema_version">
-> & { schema_version?: number };
-
-export function buildTestManifest(input: {
-  contents: ManifestFileEntryType[];
-  overrides?: BuildTestManifestOverrides;
-}): ManifestType {
-  const base = defaultV1Options();
-  const merged = {
-    schema_version: 1,
-    bundle_id: randomUUID(),
-    created_at: new Date().toISOString(),
-    assistant: base.assistant,
-    origin: base.origin,
-    compatibility: base.compatibility,
-    contents: input.contents,
-    checksum: "",
-    secrets_redacted: base.secretsRedacted,
-    export_options: base.exportOptions,
-    ...(input.overrides ?? {}),
-  } as ManifestType;
-  return { ...merged, checksum: computeManifestChecksum(merged) };
-}

package/src/runtime/migrations/__tests__/vbundle-builder-credentials.test.ts

@@ -1,285 +0,0 @@
-/**
- * Tests for credential inclusion in vbundle export.
- *
- * Covers:
- * - buildExportVBundle() with credentials includes credentials/* entries
- * - Credentials appear in the manifest with correct SHA-256 checksums
- * - Export with no credentials produces the same archive as before (backward compat)
- * - Streaming path (streamExportVBundle) includes credential entries
- */
-
-import { createHash } from "node:crypto";
-import { mkdirSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { gunzipSync } from "node:zlib";
-import { describe, expect, test } from "bun:test";
-
-import { buildExportVBundle, streamExportVBundle } from "../vbundle-builder.js";
-import { defaultV1Options } from "./v1-test-helpers.js";
-
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-
-const BLOCK_SIZE = 512;
-
-function sha256Hex(data: Uint8Array | string): string {
-  return createHash("sha256").update(data).digest("hex");
-}
-
-/** Parse a tar archive into its entries (name -> data). */
-function parseTar(tar: Uint8Array): Map<string, Uint8Array> {
-  const entries = new Map<string, Uint8Array>();
-  let offset = 0;
-  let paxPath: string | undefined;
-
-  while (offset + BLOCK_SIZE <= tar.length) {
-    const header = tar.subarray(offset, offset + BLOCK_SIZE);
-
-    // Check for end-of-archive (all zeros)
-    if (header.every((b) => b === 0)) {
-      break;
-    }
-
-    // Read file name
-    let name = "";
-    for (let i = 0; i < 100 && header[i] !== 0; i++) {
-      name += String.fromCharCode(header[i]);
-    }
-
-    // Read size (octal at offset 124, 12 bytes)
-    let sizeStr = "";
-    for (let i = 124; i < 136 && header[i] !== 0; i++) {
-      sizeStr += String.fromCharCode(header[i]);
-    }
-    const size = parseInt(sizeStr.trim(), 8) || 0;
-
-    // Type flag
-    const typeFlag = String.fromCharCode(header[156]);
-
-    offset += BLOCK_SIZE;
-
-    const data = tar.subarray(offset, offset + size);
-    const paddedSize = Math.ceil(size / BLOCK_SIZE) * BLOCK_SIZE;
-    offset += paddedSize;
-
-    if (typeFlag === "x") {
-      // PAX extended header — extract path
-      const paxStr = new TextDecoder().decode(data);
-      const match = paxStr.match(/\d+ path=(.+)\n/);
-      if (match) {
-        paxPath = match[1];
-      }
-      continue;
-    }
-
-    const entryName = paxPath ?? name;
-    paxPath = undefined;
-    entries.set(entryName, new Uint8Array(data));
-  }
-
-  return entries;
-}
-
-/** Create a minimal workspace directory with a config file for testing. */
-function createTestWorkspace(): { dir: string; cleanup: () => void } {
-  const dir = join(
-    tmpdir(),
-    `vbundle-test-${Date.now()}-${Math.random().toString(36).slice(2)}`,
-  );
-  mkdirSync(dir, { recursive: true });
-  writeFileSync(join(dir, "config.json"), JSON.stringify({ test: true }));
-  // Create a minimal data/db directory with a fake database file
-  const dbDir = join(dir, "data", "db");
-  mkdirSync(dbDir, { recursive: true });
-  writeFileSync(join(dbDir, "assistant.db"), "fake-db-content");
-  return {
-    dir,
-    cleanup: () => rmSync(dir, { recursive: true, force: true }),
-  };
-}
-
-// ---------------------------------------------------------------------------
-// Tests
-// ---------------------------------------------------------------------------
-
-describe("buildExportVBundle with credentials", () => {
-  test("includes credential entries under credentials/ prefix", () => {
-    const workspace = createTestWorkspace();
-    try {
-      const credentials = [
-        { account: "openai-key", value: "sk-test-123" },
-        { account: "anthropic-key", value: "sk-ant-456" },
-      ];
-
-      const result = buildExportVBundle({
-        ...defaultV1Options(),
-        workspaceDir: workspace.dir,
-        credentials,
-      });
-
-      const tar = gunzipSync(result.archive);
-      const entries = parseTar(tar);
-
-      expect(entries.has("credentials/openai-key")).toBe(true);
-      expect(entries.has("credentials/anthropic-key")).toBe(true);
-
-      const decoder = new TextDecoder();
-      expect(decoder.decode(entries.get("credentials/openai-key")!)).toBe(
-        "sk-test-123",
-      );
-      expect(decoder.decode(entries.get("credentials/anthropic-key")!)).toBe(
-        "sk-ant-456",
-      );
-    } finally {
-      workspace.cleanup();
-    }
-  });
-
-  test("credentials appear in manifest with correct SHA-256 checksums", () => {
-    const workspace = createTestWorkspace();
-    try {
-      const credentials = [
-        { account: "my-api-key", value: "secret-value-abc" },
-      ];
-
-      const result = buildExportVBundle({
-        ...defaultV1Options(),
-        workspaceDir: workspace.dir,
-        credentials,
-      });
-
-      const expectedHash = sha256Hex(
-        new TextEncoder().encode("secret-value-abc"),
-      );
-
-      const credEntry = result.manifest.contents.find(
-        (f) => f.path === "credentials/my-api-key",
-      );
-      expect(credEntry).toBeDefined();
-      expect(credEntry!.sha256).toBe(expectedHash);
-      expect(credEntry!.size_bytes).toBe(
-        new TextEncoder().encode("secret-value-abc").length,
-      );
-    } finally {
-      workspace.cleanup();
-    }
-  });
-
-  test("export with no credentials produces archive without credentials/ entries", () => {
-    const workspace = createTestWorkspace();
-    try {
-      const result = buildExportVBundle({
-        ...defaultV1Options(),
-        workspaceDir: workspace.dir,
-      });
-
-      const tar = gunzipSync(result.archive);
-      const entries = parseTar(tar);
-
-      const credentialEntries = [...entries.keys()].filter((k) =>
-        k.startsWith("credentials/"),
-      );
-      expect(credentialEntries).toHaveLength(0);
-
-      // Manifest should have no credential entries
-      const credManifestEntries = result.manifest.contents.filter((f) =>
-        f.path.startsWith("credentials/"),
-      );
-      expect(credManifestEntries).toHaveLength(0);
-    } finally {
-      workspace.cleanup();
-    }
-  });
-
-  test("export with empty credentials array produces archive without credentials/ entries", () => {
-    const workspace = createTestWorkspace();
-    try {
-      const result = buildExportVBundle({
-        ...defaultV1Options(),
-        workspaceDir: workspace.dir,
-        credentials: [],
-      });
-
-      const tar = gunzipSync(result.archive);
-      const entries = parseTar(tar);
-
-      const credentialEntries = [...entries.keys()].filter((k) =>
-        k.startsWith("credentials/"),
-      );
-      expect(credentialEntries).toHaveLength(0);
-    } finally {
-      workspace.cleanup();
-    }
-  });
-});
-
-describe("streamExportVBundle with credentials", () => {
-  test("includes credential entries in the streaming archive", async () => {
-    const workspace = createTestWorkspace();
-    let result: Awaited<ReturnType<typeof streamExportVBundle>> | undefined;
-    try {
-      const credentials = [
-        { account: "stream-key", value: "stream-secret-789" },
-      ];
-
-      result = await streamExportVBundle({
-        ...defaultV1Options(),
-        workspaceDir: workspace.dir,
-        credentials,
-      });
-
-      // Read the temp file and decompress
-      const archiveData = new Uint8Array(
-        await Bun.file(result.tempPath).arrayBuffer(),
-      );
-      const tar = gunzipSync(archiveData);
-      const entries = parseTar(tar);
-
-      expect(entries.has("credentials/stream-key")).toBe(true);
-
-      const decoder = new TextDecoder();
-      expect(decoder.decode(entries.get("credentials/stream-key")!)).toBe(
-        "stream-secret-789",
-      );
-
-      // Verify manifest entry
-      const credEntry = result.manifest.contents.find(
-        (f) => f.path === "credentials/stream-key",
-      );
-      expect(credEntry).toBeDefined();
-      expect(credEntry!.sha256).toBe(
-        sha256Hex(new TextEncoder().encode("stream-secret-789")),
-      );
-    } finally {
-      await result?.cleanup();
-      workspace.cleanup();
-    }
-  });
-
-  test("streaming export without credentials has no credentials/ entries", async () => {
-    const workspace = createTestWorkspace();
-    let result: Awaited<ReturnType<typeof streamExportVBundle>> | undefined;
-    try {
-      result = await streamExportVBundle({
-        ...defaultV1Options(),
-        workspaceDir: workspace.dir,
-      });
-
-      const archiveData = new Uint8Array(
-        await Bun.file(result.tempPath).arrayBuffer(),
-      );
-      const tar = gunzipSync(archiveData);
-      const entries = parseTar(tar);
-
-      const credentialEntries = [...entries.keys()].filter((k) =>
-        k.startsWith("credentials/"),
-      );
-      expect(credentialEntries).toHaveLength(0);
-    } finally {
-      await result?.cleanup();
-      workspace.cleanup();
-    }
-  });
-});