@mycadet/assistant 0.12.10 → 0.13.0

package/src/runtime/migrations/__tests__/vbundle-metadata-merge-integration.test.ts

@@ -1,428 +0,0 @@
-/**
- * Integration tests confirming both importers preserve the target's
- * `cadet:*` credential metadata entries across a bundle import.
- *
- * Covers:
- * - Buffer-based `commitImport`: target has all 4 cadet entries, bundle
- *   carries non-cadet user entries → target retains its cadet entries
- *   and gains the bundle's user entries.
- * - Streaming `streamCommitImport`: same scenario via the atomic-swap
- *   path.
- * - Bundle with rogue cadet entries → filtered out on both paths.
- * - Bundle without a metadata.json entry → target's preserved entries are
- *   restored on the buffer path.
- */
-
-import {
-  existsSync,
-  mkdirSync,
-  mkdtempSync,
-  readFileSync,
-  realpathSync,
-  rmSync,
-  writeFileSync,
-} from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { Readable } from "node:stream";
-import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-
-import { buildVBundle } from "../vbundle-builder.js";
-import { DefaultPathResolver } from "../vbundle-import-analyzer.js";
-import { commitImport } from "../vbundle-importer.js";
-import { streamCommitImport } from "../vbundle-streaming-importer.js";
-import { defaultV1Options } from "./v1-test-helpers.js";
-
-// ---------------------------------------------------------------------------
-// Metadata helpers
-// ---------------------------------------------------------------------------
-
-interface Record {
-  credentialId: string;
-  service: string;
-  field: string;
-  allowedTools: string[];
-  allowedDomains: string[];
-  createdAt: number;
-  updatedAt: number;
-}
-
-const CADET_FIELDS = [
-  "webhook_secret",
-  "assistant_api_key",
-  "platform_assistant_id",
-] as const;
-
-function record(service: string, field: string, prefix = "id"): Record {
-  const now = Date.now();
-  return {
-    credentialId: `${prefix}-${service}-${field}`,
-    service,
-    field,
-    allowedTools: [],
-    allowedDomains: [],
-    createdAt: now,
-    updatedAt: now,
-  };
-}
-
-function metadataJson(records: Record[]): string {
-  return JSON.stringify({ version: 5, credentials: records });
-}
-
-function cadetRecords(prefix = "target"): Record[] {
-  return CADET_FIELDS.map((field) => record("cadet", field, prefix));
-}
-
-function readMetadata(path: string): { credentials: Record[] } {
-  const raw = readFileSync(path, "utf-8");
-  return JSON.parse(raw) as { credentials: Record[] };
-}
-
-function keys(records: Record[]): Set<string> {
-  return new Set(records.map((r) => `${r.service}:${r.field}`));
-}
-
-function encode(s: string): Uint8Array {
-  return new TextEncoder().encode(s);
-}
-
-function readableFrom(buf: Uint8Array): Readable {
-  return Readable.from([Buffer.from(buf)]);
-}
-
-// ---------------------------------------------------------------------------
-// Fixture helpers
-// ---------------------------------------------------------------------------
-
-function freshWorkspace(): string {
-  const parent = realpathSync(
-    mkdtempSync(join(tmpdir(), "vbundle-metadata-merge-")),
-  );
-  return join(parent, "workspace");
-}
-
-function seedTargetMetadata(workspaceDir: string, records: Record[]): string {
-  const dir = join(workspaceDir, "data", "credentials");
-  mkdirSync(dir, { recursive: true });
-  const path = join(dir, "metadata.json");
-  writeFileSync(path, metadataJson(records));
-  return path;
-}
-
-// ---------------------------------------------------------------------------
-// Buffer-based `commitImport` integration
-// ---------------------------------------------------------------------------
-
-describe("commitImport — credential metadata merge", () => {
-  let workspaceDir: string;
-  beforeEach(() => {
-    workspaceDir = freshWorkspace();
-    mkdirSync(workspaceDir, { recursive: true });
-  });
-  afterEach(() => {
-    const parent = join(workspaceDir, "..");
-    try {
-      rmSync(parent, { recursive: true, force: true });
-    } catch {
-      /* best-effort */
-    }
-  });
-
-  test("target cadet:* entries survive; bundle user entries land", () => {
-    const metadataPath = seedTargetMetadata(workspaceDir, cadetRecords());
-
-    const bundleMetadata = metadataJson([
-      record("telegram", "bot_token", "source"),
-      record("slack_channel", "app_token", "source"),
-    ]);
-    const { archive } = buildVBundle({
-      files: [
-        {
-          path: "data/db/assistant.db",
-          data: new Uint8Array(),
-        },
-        {
-          path: "workspace/data/credentials/metadata.json",
-          data: encode(bundleMetadata),
-        },
-        // Include at least one other workspace entry so Step 1b fires.
-        { path: "workspace/noop.txt", data: encode("noop") },
-      ],
-      ...defaultV1Options(),
-    });
-
-    const result = commitImport({
-      archiveData: archive,
-      pathResolver: new DefaultPathResolver(workspaceDir),
-      workspaceDir,
-    });
-
-    expect(result.ok).toBe(true);
-    const merged = readMetadata(metadataPath);
-    const mergedKeys = keys(merged.credentials);
-    for (const field of CADET_FIELDS) {
-      expect(mergedKeys.has(`cadet:${field}`)).toBe(true);
-    }
-    expect(mergedKeys.has("telegram:bot_token")).toBe(true);
-    expect(mergedKeys.has("slack_channel:app_token")).toBe(true);
-
-    // Preserved cadet entries must carry target's credentialIds.
-    for (const r of merged.credentials) {
-      if (r.service === "cadet") {
-        expect(r.credentialId.startsWith("target-")).toBe(true);
-      }
-    }
-  });
-
-  test("rogue cadet entries in the bundle are dropped", () => {
-    const metadataPath = seedTargetMetadata(workspaceDir, cadetRecords());
-    const bundleMetadata = metadataJson([
-      record("cadet", "assistant_api_key", "source-rogue"),
-      record("cadet", "webhook_secret", "source-rogue"),
-      record("telegram", "bot_token", "source"),
-    ]);
-    const { archive } = buildVBundle({
-      files: [
-        {
-          path: "data/db/assistant.db",
-          data: new Uint8Array(),
-        },
-        {
-          path: "workspace/data/credentials/metadata.json",
-          data: encode(bundleMetadata),
-        },
-        { path: "workspace/noop.txt", data: encode("noop") },
-      ],
-      ...defaultV1Options(),
-    });
-
-    const result = commitImport({
-      archiveData: archive,
-      pathResolver: new DefaultPathResolver(workspaceDir),
-      workspaceDir,
-    });
-    expect(result.ok).toBe(true);
-
-    const merged = readMetadata(metadataPath);
-    const legacyRows = merged.credentials.filter((r) => r.service === "cadet");
-    expect(legacyRows.length).toBe(3);
-    for (const r of legacyRows) {
-      expect(r.credentialId.startsWith("target-")).toBe(true);
-    }
-    expect(keys(merged.credentials).has("telegram:bot_token")).toBe(true);
-  });
-
-  test("bundle without metadata.json still leaves target's cadet entries on disk", () => {
-    const metadataPath = seedTargetMetadata(workspaceDir, cadetRecords());
-
-    const { archive } = buildVBundle({
-      files: [
-        { path: "data/db/assistant.db", data: new Uint8Array() },
-        { path: "workspace/noop.txt", data: encode("noop") },
-      ],
-      ...defaultV1Options(),
-    });
-
-    const result = commitImport({
-      archiveData: archive,
-      pathResolver: new DefaultPathResolver(workspaceDir),
-      workspaceDir,
-    });
-    expect(result.ok).toBe(true);
-
-    expect(existsSync(metadataPath)).toBe(true);
-    const merged = readMetadata(metadataPath);
-    const mergedKeys = keys(merged.credentials);
-    for (const field of CADET_FIELDS) {
-      expect(mergedKeys.has(`cadet:${field}`)).toBe(true);
-    }
-  });
-
-  test("target without existing metadata.json → bundle's file lands verbatim", () => {
-    const { archive } = buildVBundle({
-      files: [
-        {
-          path: "data/db/assistant.db",
-          data: new Uint8Array(),
-        },
-        {
-          path: "workspace/data/credentials/metadata.json",
-          data: encode(
-            metadataJson([record("telegram", "bot_token", "source")]),
-          ),
-        },
-        { path: "workspace/noop.txt", data: encode("noop") },
-      ],
-      ...defaultV1Options(),
-    });
-
-    const result = commitImport({
-      archiveData: archive,
-      pathResolver: new DefaultPathResolver(workspaceDir),
-      workspaceDir,
-    });
-    expect(result.ok).toBe(true);
-
-    const merged = readMetadata(
-      join(workspaceDir, "data", "credentials", "metadata.json"),
-    );
-    expect(keys(merged.credentials)).toEqual(new Set(["telegram:bot_token"]));
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Streaming importer integration
-// ---------------------------------------------------------------------------
-
-describe("streamCommitImport — credential metadata merge", () => {
-  let workspaceDir: string;
-  beforeEach(() => {
-    workspaceDir = freshWorkspace();
-    mkdirSync(workspaceDir, { recursive: true });
-  });
-  afterEach(() => {
-    const parent = join(workspaceDir, "..");
-    try {
-      rmSync(parent, { recursive: true, force: true });
-    } catch {
-      /* best-effort */
-    }
-  });
-
-  test("target cadet:* entries survive atomic swap; bundle user entries land", async () => {
-    const metadataPath = seedTargetMetadata(workspaceDir, cadetRecords());
-
-    const bundleMetadata = metadataJson([
-      record("telegram", "bot_token", "source"),
-    ]);
-    const { archive } = buildVBundle({
-      files: [
-        {
-          path: "data/db/assistant.db",
-          data: new Uint8Array(),
-        },
-        {
-          path: "workspace/data/credentials/metadata.json",
-          data: encode(bundleMetadata),
-        },
-        { path: "workspace/noop.txt", data: encode("noop") },
-      ],
-      ...defaultV1Options(),
-    });
-
-    const result = await streamCommitImport({
-      source: readableFrom(archive),
-      pathResolver: new DefaultPathResolver(workspaceDir),
-      workspaceDir,
-    });
-
-    expect(result.ok).toBe(true);
-
-    const merged = readMetadata(metadataPath);
-    const mergedKeys = keys(merged.credentials);
-    for (const field of CADET_FIELDS) {
-      expect(mergedKeys.has(`cadet:${field}`)).toBe(true);
-    }
-    expect(mergedKeys.has("telegram:bot_token")).toBe(true);
-    for (const r of merged.credentials) {
-      if (r.service === "cadet") {
-        expect(r.credentialId.startsWith("target-")).toBe(true);
-      }
-    }
-  });
-
-  test("rogue cadet entries in bundle are dropped on streaming path", async () => {
-    const metadataPath = seedTargetMetadata(workspaceDir, cadetRecords());
-    const bundleMetadata = metadataJson([
-      record("cadet", "assistant_api_key", "source-rogue"),
-      record("telegram", "bot_token", "source"),
-    ]);
-    const { archive } = buildVBundle({
-      files: [
-        {
-          path: "data/db/assistant.db",
-          data: new Uint8Array(),
-        },
-        {
-          path: "workspace/data/credentials/metadata.json",
-          data: encode(bundleMetadata),
-        },
-        { path: "workspace/noop.txt", data: encode("noop") },
-      ],
-      ...defaultV1Options(),
-    });
-
-    const result = await streamCommitImport({
-      source: readableFrom(archive),
-      pathResolver: new DefaultPathResolver(workspaceDir),
-      workspaceDir,
-    });
-    expect(result.ok).toBe(true);
-
-    const merged = readMetadata(metadataPath);
-    for (const r of merged.credentials) {
-      if (r.service === "cadet") {
-        expect(r.credentialId.startsWith("target-")).toBe(true);
-      }
-    }
-    expect(keys(merged.credentials).has("telegram:bot_token")).toBe(true);
-  });
-
-  test("bundle without metadata.json keeps target's cadet entries after swap", async () => {
-    const metadataPath = seedTargetMetadata(workspaceDir, cadetRecords());
-
-    const { archive } = buildVBundle({
-      files: [
-        { path: "data/db/assistant.db", data: new Uint8Array() },
-        { path: "workspace/noop.txt", data: encode("noop") },
-      ],
-      ...defaultV1Options(),
-    });
-
-    const result = await streamCommitImport({
-      source: readableFrom(archive),
-      pathResolver: new DefaultPathResolver(workspaceDir),
-      workspaceDir,
-    });
-    expect(result.ok).toBe(true);
-
-    expect(existsSync(metadataPath)).toBe(true);
-    const merged = readMetadata(metadataPath);
-    const mergedKeys = keys(merged.credentials);
-    for (const field of CADET_FIELDS) {
-      expect(mergedKeys.has(`cadet:${field}`)).toBe(true);
-    }
-  });
-
-  test("target with no metadata.json → bundle's file lands on disk verbatim", async () => {
-    const { archive } = buildVBundle({
-      files: [
-        {
-          path: "data/db/assistant.db",
-          data: new Uint8Array(),
-        },
-        {
-          path: "workspace/data/credentials/metadata.json",
-          data: encode(
-            metadataJson([record("telegram", "bot_token", "source")]),
-          ),
-        },
-        { path: "workspace/noop.txt", data: encode("noop") },
-      ],
-      ...defaultV1Options(),
-    });
-
-    const result = await streamCommitImport({
-      source: readableFrom(archive),
-      pathResolver: new DefaultPathResolver(workspaceDir),
-      workspaceDir,
-    });
-    expect(result.ok).toBe(true);
-
-    const merged = readMetadata(
-      join(workspaceDir, "data", "credentials", "metadata.json"),
-    );
-    expect(keys(merged.credentials)).toEqual(new Set(["telegram:bot_token"]));
-  });
-});

package/src/runtime/migrations/__tests__/vbundle-metadata-merge.test.ts

@@ -1,220 +0,0 @@
-/**
- * Unit tests for the credential metadata merge helper used by the bundle
- * importers. Covers the behaviour the two importers rely on:
- *
- * - Bundle without cadet + target with cadet → target's cadet entries
- *   survive and the bundle's non-cadet entries are kept.
- * - Bundle with mixed user services → non-cadet entries import, any
- *   rogue cadet entries in the bundle are dropped.
- * - Live metadata empty / missing → bundle lands as-is.
- * - Malformed inputs → no corruption (bundle returned verbatim).
- */
-
-import { describe, expect, test } from "bun:test";
-
-import { mergeMetadataPreservingCadet } from "../vbundle-metadata-merge.js";
-
-interface Record {
-  credentialId: string;
-  service: string;
-  field: string;
-  allowedTools: string[];
-  allowedDomains: string[];
-  createdAt: number;
-  updatedAt: number;
-}
-
-function record(
-  overrides: Partial<Record> & Pick<Record, "service" | "field">,
-): Record {
-  const now = Date.now();
-  return {
-    credentialId: `id-${overrides.service}-${overrides.field}`,
-    allowedTools: [],
-    allowedDomains: [],
-    createdAt: now,
-    updatedAt: now,
-    ...overrides,
-  };
-}
-
-function file(records: Record[], version = 5): string {
-  return JSON.stringify({ version, credentials: records });
-}
-
-function parse(json: string): { version?: number; credentials: Record[] } {
-  const parsed = JSON.parse(json);
-  return {
-    version: parsed.version,
-    credentials: (parsed.credentials ?? []) as Record[],
-  };
-}
-
-function asKey(r: Record): string {
-  return `${r.service}:${r.field}`;
-}
-
-function keys(records: Record[]): Set<string> {
-  return new Set(records.map(asKey));
-}
-
-const CADET_FIELDS = [
-  "webhook_secret",
-  "assistant_api_key",
-  "platform_assistant_id",
-] as const;
-
-function cadetRecords(): Record[] {
-  return CADET_FIELDS.map((field) =>
-    record({ service: "cadet", field, credentialId: `target-${field}` }),
-  );
-}
-
-describe("mergeMetadataPreservingCadet", () => {
-  test("preserves all four target cadet:* entries when bundle has none", () => {
-    const target = cadetRecords();
-    const bundle = [
-      record({ service: "telegram", field: "bot_token" }),
-      record({ service: "slack_channel", field: "app_token" }),
-    ];
-
-    const merged = parse(
-      mergeMetadataPreservingCadet(file(bundle), file(target)),
-    );
-
-    const mergedKeys = keys(merged.credentials);
-    for (const field of CADET_FIELDS) {
-      expect(mergedKeys.has(`cadet:${field}`)).toBe(true);
-    }
-    expect(mergedKeys.has("telegram:bot_token")).toBe(true);
-    expect(mergedKeys.has("slack_channel:app_token")).toBe(true);
-  });
-
-  test("bundle non-cadet entries still import alongside preserved cadet entries", () => {
-    const target = cadetRecords();
-    const bundle = [
-      record({ service: "telegram", field: "bot_token" }),
-      record({ service: "telegram", field: "webhook_secret" }),
-      record({ service: "google", field: "access_token" }),
-    ];
-
-    const merged = parse(
-      mergeMetadataPreservingCadet(file(bundle), file(target)),
-    );
-
-    // 3 cadet + 3 user = 6 total.
-    expect(merged.credentials.length).toBe(6);
-    expect(keys(merged.credentials).size).toBe(6);
-
-    // Target's credentialIds for cadet are preserved (not the bundle's).
-    for (const r of merged.credentials) {
-      if (r.service === "cadet") {
-        expect(r.credentialId.startsWith("target-")).toBe(true);
-      }
-    }
-  });
-
-  test("drops bundle cadet:* entries and preserves target's identity", () => {
-    const target = cadetRecords();
-    // Bundle carries conflicting cadet entries — should be dropped even
-    // though the source would normally be filtered before this helper is
-    // called.
-    const bundle = [
-      record({
-        service: "cadet",
-        field: "assistant_api_key",
-        credentialId: "source-rogue",
-      }),
-      record({
-        service: "cadet",
-        field: "webhook_secret",
-        credentialId: "source-rogue-url",
-      }),
-      record({ service: "telegram", field: "bot_token" }),
-    ];
-
-    const merged = parse(
-      mergeMetadataPreservingCadet(file(bundle), file(target)),
-    );
-
-    const cadetRecordsOut = merged.credentials.filter(
-      (r) => r.service === "cadet",
-    );
-    expect(cadetRecordsOut.length).toBe(3);
-    for (const r of cadetRecordsOut) {
-      expect(r.credentialId.startsWith("target-")).toBe(true);
-    }
-    // Telegram entry still imports.
-    expect(
-      merged.credentials.some(
-        (r) => r.service === "telegram" && r.field === "bot_token",
-      ),
-    ).toBe(true);
-  });
-
-  test("no live metadata → bundle passes through unchanged (no cadet in bundle)", () => {
-    const bundle = [
-      record({ service: "telegram", field: "bot_token" }),
-      record({ service: "slack_channel", field: "app_token" }),
-    ];
-    const merged = parse(mergeMetadataPreservingCadet(file(bundle), null));
-    expect(keys(merged.credentials)).toEqual(
-      new Set(["telegram:bot_token", "slack_channel:app_token"]),
-    );
-  });
-
-  test("no live metadata still strips bundle cadet:* entries", () => {
-    const bundle = [
-      record({ service: "cadet", field: "assistant_api_key" }),
-      record({ service: "telegram", field: "bot_token" }),
-    ];
-    const merged = parse(mergeMetadataPreservingCadet(file(bundle), null));
-    // Bundle's cadet entry is always filtered.
-    expect(merged.credentials.length).toBe(1);
-    expect(merged.credentials[0]?.service).toBe("telegram");
-  });
-
-  test("preserves bundle version field verbatim", () => {
-    const bundle = file([record({ service: "telegram", field: "bot_token" })]);
-    const merged = JSON.parse(
-      mergeMetadataPreservingCadet(bundle, file(cadetRecords())),
-    );
-    expect(merged.version).toBe(5);
-  });
-
-  test("malformed bundle JSON → returned unchanged (never corrupt the file)", () => {
-    const bad = "{not valid json";
-    const live = file(cadetRecords());
-    const result = mergeMetadataPreservingCadet(bad, live);
-    expect(result).toBe(bad);
-  });
-
-  test("malformed live JSON → bundle returned as merged output without preservation", () => {
-    const bundle = file([record({ service: "telegram", field: "bot_token" })]);
-    const merged = parse(mergeMetadataPreservingCadet(bundle, "{bad"));
-    expect(keys(merged.credentials)).toEqual(new Set(["telegram:bot_token"]));
-  });
-
-  test("live metadata with extra non-cadet entries does NOT smuggle them in", () => {
-    const live = file([
-      ...cadetRecords(),
-      record({ service: "telegram", field: "bot_token" }),
-      record({ service: "notion", field: "api_key" }),
-    ]);
-    const bundle = file([
-      record({ service: "slack_channel", field: "app_token" }),
-    ]);
-
-    const merged = parse(mergeMetadataPreservingCadet(bundle, live));
-
-    // Only bundle's non-cadet + target's cadet. Target's user entries
-    // must NOT carry over (they belong to source-style flows, handled by
-    // the bundle).
-    expect(keys(merged.credentials).has("slack_channel:app_token")).toBe(true);
-    expect(keys(merged.credentials).has("telegram:bot_token")).toBe(false);
-    expect(keys(merged.credentials).has("notion:api_key")).toBe(false);
-    for (const field of CADET_FIELDS) {
-      expect(keys(merged.credentials).has(`cadet:${field}`)).toBe(true);
-    }
-  });
-});