@vellumai/assistant 0.11.2 → 0.11.3-staging.2

package/src/__tests__/file-ops-service.test.ts

@@ -11,6 +11,7 @@ import { join } from "node:path";
 import { afterEach, describe, expect, test } from "bun:test";
 
 import {
+  DEFAULT_READ_LINE_LIMIT,
   FileSystemOps,
   type PathPolicy,
 } from "../tools/shared/filesystem/file-ops-service.js";
@@ -44,12 +45,12 @@ function sandboxPolicyFor(boundary: string): PathPolicy {
 // ---------------------------------------------------------------------------
 
 describe("FileSystemOps.readFileSafe", () => {
-  test("reads a file successfully", () => {
+  test("reads a file successfully", async () => {
     const dir = makeTempDir();
     writeFileSync(join(dir, "hello.txt"), "line one\nline two\nline three\n");
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.readFileSafe({ path: "hello.txt" });
+    const result = await ops.readFileSafe({ path: "hello.txt" });
     expect(result.ok).toBe(true);
     if (!result.ok) {
       return;
@@ -59,11 +60,11 @@ describe("FileSystemOps.readFileSafe", () => {
     expect(result.value.content).toContain("line three");
   });
 
-  test("returns NOT_FOUND for missing file", () => {
+  test("returns NOT_FOUND for missing file", async () => {
     const dir = makeTempDir();
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.readFileSafe({ path: "nonexistent.txt" });
+    const result = await ops.readFileSafe({ path: "nonexistent.txt" });
     expect(result.ok).toBe(false);
     if (result.ok) {
       return;
@@ -71,12 +72,12 @@ describe("FileSystemOps.readFileSafe", () => {
     expect(result.error.code).toBe("NOT_FOUND");
   });
 
-  test("returns NOT_A_FILE for a directory", () => {
+  test("returns NOT_A_FILE for a directory", async () => {
     const dir = makeTempDir();
     mkdirSync(join(dir, "subdir"));
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.readFileSafe({ path: "subdir" });
+    const result = await ops.readFileSafe({ path: "subdir" });
     expect(result.ok).toBe(false);
     if (result.ok) {
       return;
@@ -84,13 +85,13 @@ describe("FileSystemOps.readFileSafe", () => {
     expect(result.error.code).toBe("NOT_A_FILE");
   });
 
-  test("returns SIZE_LIMIT_EXCEEDED for oversized file", () => {
+  test("returns SIZE_LIMIT_EXCEEDED for oversized file", async () => {
     const dir = makeTempDir();
     const filePath = join(dir, "big.txt");
     writeFileSync(filePath, "x".repeat(200));
 
     const ops = new FileSystemOps(sandboxPolicyFor(dir), { sizeLimit: 100 });
-    const result = ops.readFileSafe({ path: "big.txt" });
+    const result = await ops.readFileSafe({ path: "big.txt" });
     expect(result.ok).toBe(false);
     if (result.ok) {
       return;
@@ -98,11 +99,11 @@ describe("FileSystemOps.readFileSafe", () => {
     expect(result.error.code).toBe("SIZE_LIMIT_EXCEEDED");
   });
 
-  test("returns PATH_OUT_OF_BOUNDS for path outside sandbox", () => {
+  test("returns PATH_OUT_OF_BOUNDS for path outside sandbox", async () => {
     const dir = makeTempDir();
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.readFileSafe({ path: "../../../etc/passwd" });
+    const result = await ops.readFileSafe({ path: "../../../etc/passwd" });
     expect(result.ok).toBe(false);
     if (result.ok) {
       return;
@@ -110,20 +111,94 @@ describe("FileSystemOps.readFileSafe", () => {
     expect(result.error.code).toBe("PATH_OUT_OF_BOUNDS");
   });
 
-  test("respects offset and limit", () => {
+  test("respects offset and limit", async () => {
     const dir = makeTempDir();
     writeFileSync(join(dir, "lines.txt"), "a\nb\nc\nd\ne\n");
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.readFileSafe({ path: "lines.txt", offset: 2, limit: 2 });
+    const result = await ops.readFileSafe({
+      path: "lines.txt",
+      offset: 2,
+      limit: 2,
+    });
+    expect(result.ok).toBe(true);
+    if (!result.ok) {
+      return;
+    }
+    // Assert on the numbered lines rather than bare letters: the truncation
+    // notice is prose, so a bare `toContain("d")` matches its wording.
+    const [body] = result.value.content.split("\n\n[Truncated:");
+    expect(body).toContain("     2  b");
+    expect(body).toContain("     3  c");
+    expect(body).not.toContain("     1  a");
+    expect(body).not.toContain("     4  d");
+  });
+
+  test("caps an unbounded read at the default line limit and says so", async () => {
+    const dir = makeTempDir();
+    const total = DEFAULT_READ_LINE_LIMIT + 500;
+    const lines = Array.from({ length: total }, (_, i) => `line${i + 1}`);
+    writeFileSync(join(dir, "big.txt"), lines.join("\n"));
+    const ops = new FileSystemOps(sandboxPolicyFor(dir));
+
+    const result = await ops.readFileSafe({ path: "big.txt" });
+    expect(result.ok).toBe(true);
+    if (!result.ok) {
+      return;
+    }
+    const content = result.value.content;
+    expect(content).toContain(`  ${DEFAULT_READ_LINE_LIMIT}  line2000`);
+    expect(content).not.toContain("line2001");
+    expect(content).toContain(
+      `[Truncated: showing through line ${DEFAULT_READ_LINE_LIMIT} of ${total}. Read on with offset=${DEFAULT_READ_LINE_LIMIT + 1}`,
+    );
+  });
+
+  test("an explicit limit is honored rather than replaced by the default", async () => {
+    const dir = makeTempDir();
+    const lines = Array.from(
+      { length: DEFAULT_READ_LINE_LIMIT + 500 },
+      (_, i) => `line${i + 1}`,
+    );
+    writeFileSync(join(dir, "big.txt"), lines.join("\n"));
+    const ops = new FileSystemOps(sandboxPolicyFor(dir));
+
+    const result = await ops.readFileSafe({
+      path: "big.txt",
+      limit: DEFAULT_READ_LINE_LIMIT + 500,
+    });
+    expect(result.ok).toBe(true);
+    if (!result.ok) {
+      return;
+    }
+    expect(result.value.content).toContain("line2500");
+    expect(result.value.content).not.toContain("[Truncated:");
+  });
+
+  test("a read that reaches the last line carries no truncation notice", async () => {
+    const dir = makeTempDir();
+    writeFileSync(join(dir, "small.txt"), "a\nb\nc");
+    const ops = new FileSystemOps(sandboxPolicyFor(dir));
+
+    const result = await ops.readFileSafe({ path: "small.txt" });
+    expect(result.ok).toBe(true);
+    if (!result.ok) {
+      return;
+    }
+    expect(result.value.content).not.toContain("[Truncated:");
+  });
+
+  test("paging past the end is not reported as truncation", async () => {
+    const dir = makeTempDir();
+    writeFileSync(join(dir, "small.txt"), "a\nb\nc");
+    const ops = new FileSystemOps(sandboxPolicyFor(dir));
+
+    const result = await ops.readFileSafe({ path: "small.txt", offset: 100 });
     expect(result.ok).toBe(true);
     if (!result.ok) {
       return;
     }
-    expect(result.value.content).toContain("b");
-    expect(result.value.content).toContain("c");
-    expect(result.value.content).not.toContain("     1");
-    expect(result.value.content).not.toContain("d");
+    expect(result.value.content).not.toContain("[Truncated:");
   });
 });
 
@@ -132,11 +207,11 @@ describe("FileSystemOps.readFileSafe", () => {
 // ---------------------------------------------------------------------------
 
 describe("FileSystemOps.writeFileSafe", () => {
-  test("writes a new file", () => {
+  test("writes a new file", async () => {
     const dir = makeTempDir();
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.writeFileSafe({
+    const result = await ops.writeFileSafe({
       path: "new.txt",
       content: "hello world",
     });
@@ -150,12 +225,12 @@ describe("FileSystemOps.writeFileSafe", () => {
     expect(existsSync(join(dir, "new.txt"))).toBe(true);
   });
 
-  test("overwrites an existing file and returns old content", () => {
+  test("overwrites an existing file and returns old content", async () => {
     const dir = makeTempDir();
     writeFileSync(join(dir, "existing.txt"), "old stuff");
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.writeFileSafe({
+    const result = await ops.writeFileSafe({
       path: "existing.txt",
       content: "new stuff",
     });
@@ -168,11 +243,11 @@ describe("FileSystemOps.writeFileSafe", () => {
     expect(result.value.newContent).toBe("new stuff");
   });
 
-  test("creates parent directories when needed", () => {
+  test("creates parent directories when needed", async () => {
     const dir = makeTempDir();
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.writeFileSafe({
+    const result = await ops.writeFileSafe({
       path: "a/b/c/deep.txt",
       content: "deep",
     });
@@ -184,11 +259,11 @@ describe("FileSystemOps.writeFileSafe", () => {
     expect(existsSync(join(dir, "a/b/c/deep.txt"))).toBe(true);
   });
 
-  test("returns PATH_OUT_OF_BOUNDS for path outside sandbox", () => {
+  test("returns PATH_OUT_OF_BOUNDS for path outside sandbox", async () => {
     const dir = makeTempDir();
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.writeFileSafe({
+    const result = await ops.writeFileSafe({
       path: "../../../tmp/evil.txt",
       content: "bad",
     });
@@ -199,11 +274,11 @@ describe("FileSystemOps.writeFileSafe", () => {
     expect(result.error.code).toBe("PATH_OUT_OF_BOUNDS");
   });
 
-  test("returns SIZE_LIMIT_EXCEEDED for oversized content", () => {
+  test("returns SIZE_LIMIT_EXCEEDED for oversized content", async () => {
     const dir = makeTempDir();
     const ops = new FileSystemOps(sandboxPolicyFor(dir), { sizeLimit: 10 });
 
-    const result = ops.writeFileSafe({
+    const result = await ops.writeFileSafe({
       path: "big.txt",
       content: "x".repeat(50),
     });
@@ -220,11 +295,43 @@ describe("FileSystemOps.writeFileSafe", () => {
 // ---------------------------------------------------------------------------
 
 describe("FileSystemOps.editFileSafe", () => {
-  test("returns NOT_FOUND for nonexistent file", () => {
+  test("concurrent edits of the same file both land", async () => {
+    const dir = makeTempDir();
+    const ops = new FileSystemOps(sandboxPolicyFor(dir));
+    writeFileSync(join(dir, "shared.txt"), "alpha\nbeta\n");
+
+    // Without per-path serialization, both edits read the same original
+    // content and the later write drops the earlier edit.
+    const [first, second] = await Promise.all([
+      ops.editFileSafe({
+        path: "shared.txt",
+        oldString: "alpha",
+        newString: "ALPHA",
+        replaceAll: false,
+      }),
+      ops.editFileSafe({
+        path: "shared.txt",
+        oldString: "beta",
+        newString: "BETA",
+        replaceAll: false,
+      }),
+    ]);
+
+    expect(first.ok).toBe(true);
+    expect(second.ok).toBe(true);
+    const read = await ops.readFileSafe({ path: "shared.txt" });
+    expect(read.ok).toBe(true);
+    if (read.ok) {
+      expect(read.value.content).toContain("ALPHA");
+      expect(read.value.content).toContain("BETA");
+    }
+  });
+
+  test("returns NOT_FOUND for nonexistent file", async () => {
     const dir = makeTempDir();
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.editFileSafe({
+    const result = await ops.editFileSafe({
       path: "nope.txt",
       oldString: "a",
       newString: "b",
@@ -237,12 +344,12 @@ describe("FileSystemOps.editFileSafe", () => {
     expect(result.error.code).toBe("NOT_FOUND");
   });
 
-  test("returns NOT_A_FILE when target is a directory", () => {
+  test("returns NOT_A_FILE when target is a directory", async () => {
     const dir = makeTempDir();
     mkdirSync(join(dir, "subdir"));
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.editFileSafe({
+    const result = await ops.editFileSafe({
       path: "subdir",
       oldString: "a",
       newString: "b",
@@ -255,12 +362,12 @@ describe("FileSystemOps.editFileSafe", () => {
     expect(result.error.code).toBe("NOT_A_FILE");
   });
 
-  test("returns MATCH_NOT_FOUND when old_string is absent", () => {
+  test("returns MATCH_NOT_FOUND when old_string is absent", async () => {
     const dir = makeTempDir();
     writeFileSync(join(dir, "file.txt"), "hello world");
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.editFileSafe({
+    const result = await ops.editFileSafe({
       path: "file.txt",
       oldString: "xyz",
       newString: "abc",
@@ -273,12 +380,12 @@ describe("FileSystemOps.editFileSafe", () => {
     expect(result.error.code).toBe("MATCH_NOT_FOUND");
   });
 
-  test("returns MATCH_AMBIGUOUS when old_string matches multiple times", () => {
+  test("returns MATCH_AMBIGUOUS when old_string matches multiple times", async () => {
     const dir = makeTempDir();
     writeFileSync(join(dir, "file.txt"), "foo bar foo baz foo");
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.editFileSafe({
+    const result = await ops.editFileSafe({
       path: "file.txt",
       oldString: "foo",
       newString: "qux",
@@ -291,12 +398,12 @@ describe("FileSystemOps.editFileSafe", () => {
     expect(result.error.code).toBe("MATCH_AMBIGUOUS");
   });
 
-  test("replaces all occurrences when replaceAll is true", () => {
+  test("replaces all occurrences when replaceAll is true", async () => {
     const dir = makeTempDir();
     writeFileSync(join(dir, "file.txt"), "foo bar foo baz foo");
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.editFileSafe({
+    const result = await ops.editFileSafe({
       path: "file.txt",
       oldString: "foo",
       newString: "qux",
@@ -312,12 +419,12 @@ describe("FileSystemOps.editFileSafe", () => {
     expect(result.value.matchMethod).toBe("exact");
   });
 
-  test("performs a unique edit successfully", () => {
+  test("performs a unique edit successfully", async () => {
     const dir = makeTempDir();
     writeFileSync(join(dir, "file.txt"), "one two three");
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.editFileSafe({
+    const result = await ops.editFileSafe({
       path: "file.txt",
       oldString: "two",
       newString: "TWO",
@@ -333,12 +440,12 @@ describe("FileSystemOps.editFileSafe", () => {
     expect(result.value.filePath).toContain("file.txt");
   });
 
-  test("returns MATCH_NOT_FOUND for empty oldString", () => {
+  test("returns MATCH_NOT_FOUND for empty oldString", async () => {
     const dir = makeTempDir();
     writeFileSync(join(dir, "file.txt"), "hello world");
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.editFileSafe({
+    const result = await ops.editFileSafe({
       path: "file.txt",
       oldString: "",
       newString: "injected",
@@ -351,12 +458,12 @@ describe("FileSystemOps.editFileSafe", () => {
     expect(result.error.code).toBe("MATCH_NOT_FOUND");
   });
 
-  test("returns SIZE_LIMIT_EXCEEDED for oversized file on edit", () => {
+  test("returns SIZE_LIMIT_EXCEEDED for oversized file on edit", async () => {
     const dir = makeTempDir();
     writeFileSync(join(dir, "big.txt"), "x".repeat(200));
     const ops = new FileSystemOps(sandboxPolicyFor(dir), { sizeLimit: 100 });
 
-    const result = ops.editFileSafe({
+    const result = await ops.editFileSafe({
       path: "big.txt",
       oldString: "x",
       newString: "y",
@@ -369,11 +476,11 @@ describe("FileSystemOps.editFileSafe", () => {
     expect(result.error.code).toBe("SIZE_LIMIT_EXCEEDED");
   });
 
-  test("returns PATH_OUT_OF_BOUNDS for path outside sandbox", () => {
+  test("returns PATH_OUT_OF_BOUNDS for path outside sandbox", async () => {
     const dir = makeTempDir();
     const ops = new FileSystemOps(sandboxPolicyFor(dir));
 
-    const result = ops.editFileSafe({
+    const result = await ops.editFileSafe({
       path: "../../../etc/passwd",
       oldString: "root",
       newString: "toor",

package/src/__tests__/file-read-container-boundary.test.ts

@@ -0,0 +1,137 @@
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  realpathSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  test,
+} from "bun:test";
+
+import { finalizeTool } from "../tools/tool-defaults.js";
+import type { Tool, ToolContext } from "../tools/types.js";
+
+let fileReadTool: Tool;
+let fileWriteTool: Tool;
+
+beforeAll(async () => {
+  const [read, write] = await Promise.all([
+    import("../tools/filesystem/read.js"),
+    import("../tools/filesystem/write.js"),
+  ]);
+  fileReadTool = finalizeTool(read.fileReadTool, "file_read");
+  fileWriteTool = finalizeTool(write.fileWriteTool, "file_write");
+});
+
+const testDirs: string[] = [];
+
+function makeTempDir(prefix: string): string {
+  const dir = realpathSync(mkdtempSync(join(tmpdir(), prefix)));
+  testDirs.push(dir);
+  return dir;
+}
+
+function makeContext(workingDir: string): ToolContext {
+  return {
+    workingDir,
+    conversationId: "test-conversation",
+    trustClass: "guardian",
+  };
+}
+
+/**
+ * A skill installed outside the workspace, mirroring a bundled skill in the
+ * container's install tree (`/app/assistant/src/config/bundled-skills/<id>`).
+ * Skill bodies point the model at these reference files by absolute path.
+ */
+function makeInstalledSkill(id: string): string {
+  const installTree = makeTempDir("container-install-");
+  const directoryPath = join(installTree, id);
+  mkdirSync(join(directoryPath, "references"), { recursive: true });
+  writeFileSync(join(directoryPath, "SKILL.md"), `# ${id}\n`);
+  return directoryPath;
+}
+
+beforeEach(() => {
+  // The read allowance only changes behavior where the boundary is hard: on
+  // non-containerized installs out-of-workspace reads already fall back to
+  // host-style validation.
+  process.env.IS_CONTAINERIZED = "true";
+});
+
+afterEach(() => {
+  delete process.env.IS_CONTAINERIZED;
+  delete process.env.GATEWAY_SECURITY_DIR;
+  for (const dir of testDirs.splice(0)) {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+describe("file_read outside the workspace in a container", () => {
+  test("reads a reference file from the install tree", async () => {
+    const workspace = makeTempDir("container-workspace-");
+    const skillDir = makeInstalledSkill("image-studio");
+    const referencePath = join(skillDir, "references", "guide.md");
+    writeFileSync(referencePath, "# Guide\nreference body\n");
+
+    const result = await fileReadTool.execute(
+      { path: referencePath },
+      makeContext(workspace),
+    );
+
+    expect(result.isError).toBe(false);
+    expect(result.content).toContain("reference body");
+  });
+
+  test("denies the service security directory", async () => {
+    const workspace = makeTempDir("container-workspace-");
+    const securityDir = makeTempDir("container-security-");
+    writeFileSync(join(securityDir, "trust.json"), "trust body\n");
+    process.env.GATEWAY_SECURITY_DIR = securityDir;
+
+    const result = await fileReadTool.execute(
+      { path: join(securityDir, "trust.json") },
+      makeContext(workspace),
+    );
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("service security directory");
+    expect(result.content).not.toContain("trust body");
+  });
+
+  test("denies the daemon's own process environment", async () => {
+    const workspace = makeTempDir("container-workspace-");
+
+    const result = await fileReadTool.execute(
+      { path: "/proc/self/environ" },
+      makeContext(workspace),
+    );
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("process environment");
+  });
+
+  test("denies file_write outside the workspace", async () => {
+    const workspace = makeTempDir("container-workspace-");
+    const skillDir = makeInstalledSkill("image-studio");
+    const targetPath = join(skillDir, "references", "injected.md");
+
+    const result = await fileWriteTool.execute(
+      { path: targetPath, content: "injected body\n" },
+      makeContext(workspace),
+    );
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("outside the working directory");
+    expect(existsSync(targetPath)).toBe(false);
+  });
+});

package/src/__tests__/file-read-tool.test.ts

@@ -103,16 +103,20 @@ describe("file_read tool (sandbox)", () => {
     expect(result.content).toContain("outside content");
   });
 
-  test("rejects path traversal outside working dir when containerized", async () => {
+  test("reads a file outside the workspace boundary when containerized", async () => {
     const dir = makeTempDir();
+    const outside = makeTempDir();
+    const target = join(outside, "reference.md");
+    writeFileSync(target, "install tree content");
     process.env.IS_CONTAINERIZED = "true";
     try {
       const result = await fileReadTool.execute(
-        { path: "../../../etc/passwd" },
+        { path: target },
         makeContext(dir),
       );
-      expect(result.isError).toBe(true);
-      expect(result.content).toContain("outside the working directory");
+
+      expect(result.isError).toBe(false);
+      expect(result.content).toContain("install tree content");
     } finally {
       delete process.env.IS_CONTAINERIZED;
     }
@@ -206,32 +210,40 @@ describe("file_read image support", () => {
     expect(result.content).toContain("Image loaded");
   });
 
-  test("blocks image path traversal outside working dir when containerized", async () => {
+  test("reads an image outside the workspace boundary when containerized", async () => {
     const dir = makeTempDir();
+    const outside = makeTempDir();
+    writeFileSync(join(outside, "diagram.jpg"), JPEG_HEADER);
     process.env.IS_CONTAINERIZED = "true";
     try {
       const result = await fileReadTool.execute(
-        { path: "../../etc/secret.png" },
+        { path: join(outside, "diagram.jpg") },
         makeContext(dir),
       );
 
-      expect(result.isError).toBe(true);
-      expect(result.content).toContain("outside the working directory");
+      expect(result.isError).toBe(false);
+      expect(result.content).toContain("Image loaded");
     } finally {
       delete process.env.IS_CONTAINERIZED;
     }
   });
 });
 
-// ── Out-of-bounds hint for host_file_read (containerized) ─────────────
+// ── Out-of-bounds hint for host_file_read ─────────────────────────────
+//
+// Reads leave the workspace freely, so the boundary only holds when the
+// service security deny set cannot be mirrored: a relative override resolves
+// against the owning service's cwd, so the policy fails closed.
 
 describe("file_read out-of-bounds hint", () => {
   beforeEach(() => {
     process.env.IS_CONTAINERIZED = "true";
+    process.env.GATEWAY_SECURITY_DIR = "relative/security-dir";
   });
 
   afterEach(() => {
     delete process.env.IS_CONTAINERIZED;
+    delete process.env.GATEWAY_SECURITY_DIR;
   });
 
   test("suggests host_file_read for out-of-bounds text file path", async () => {