@vellumai/assistant 0.11.3 → 0.11.4-staging.1

package/src/__tests__/workspace-migration-145-collapse-profile-bindings-to-entries.test.ts

@@ -0,0 +1,325 @@
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { Database } from "bun:sqlite";
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+
+import { collapseProfileBindingsToEntriesMigration } from "../workspace/migrations/145-collapse-profile-bindings-to-entries.js";
+import { assertNotLiveDb } from "./assert-not-live-db.js";
+
+let workspaceDir: string;
+
+function writeConfig(data: Record<string, unknown>): void {
+  writeFileSync(
+    join(workspaceDir, "config.json"),
+    JSON.stringify(data, null, 2) + "\n",
+  );
+}
+
+function readProfiles(): Record<string, Record<string, unknown>> {
+  const raw = JSON.parse(
+    readFileSync(join(workspaceDir, "config.json"), "utf-8"),
+  ) as { llm?: { profiles?: Record<string, Record<string, unknown>> } };
+  return raw.llm?.profiles ?? {};
+}
+
+function seedRows(rows: Array<{ name: string; provider: string }>): void {
+  mkdirSync(join(workspaceDir, "data", "db"), { recursive: true });
+  const db = new Database(join(workspaceDir, "data", "db", "assistant.db"));
+  db.run(`CREATE TABLE IF NOT EXISTS provider_connections (
+    name TEXT PRIMARY KEY,
+    provider TEXT NOT NULL,
+    auth TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    updated_at INTEGER NOT NULL
+  )`);
+  for (const row of rows) {
+    db.query(
+      `INSERT INTO provider_connections (name, provider, auth, created_at, updated_at) VALUES (?, ?, '{"type":"api_key"}', 1, 1)`,
+    ).run(row.name, row.provider);
+  }
+  db.close();
+}
+
+function run(): void {
+  collapseProfileBindingsToEntriesMigration.run(workspaceDir);
+}
+
+beforeEach(() => {
+  workspaceDir = join(
+    tmpdir(),
+    `vellum-migration-145-test-${Date.now()}-${Math.random().toString(36).slice(2)}`,
+  );
+  mkdirSync(workspaceDir, { recursive: true });
+});
+
+afterEach(() => {
+  if (existsSync(workspaceDir)) {
+    assertNotLiveDb(workspaceDir);
+    rmSync(workspaceDir, { recursive: true, force: true });
+  }
+});
+
+describe("145-collapse-profile-bindings-to-entries", () => {
+  test("folds a kind-agreeing binding into provider as the entry name", () => {
+    seedRows([{ name: "anthropic-work", provider: "anthropic" }]);
+    writeConfig({
+      llm: {
+        profiles: {
+          work: {
+            provider: "anthropic",
+            provider_connection: "anthropic-work",
+            model: "claude-opus-4-8",
+          },
+        },
+      },
+    });
+
+    run();
+
+    const work = readProfiles().work;
+    expect(work.provider).toBe("anthropic-work");
+    expect(work).not.toHaveProperty("provider_connection");
+    expect(work.model).toBe("claude-opus-4-8");
+  });
+
+  test("maps identity kinds when judging agreement", () => {
+    seedRows([
+      { name: "team-managed", provider: "vellum" },
+      { name: "chatgpt-subscription", provider: "chatgpt" },
+    ]);
+    writeConfig({
+      llm: {
+        profiles: {
+          managed: {
+            provider: "anthropic",
+            provider_connection: "team-managed",
+            model: "claude-opus-4-8",
+          },
+          codex: {
+            provider: "openai",
+            provider_connection: "chatgpt-subscription",
+            model: "gpt-5.5",
+          },
+        },
+      },
+    });
+
+    run();
+
+    expect(readProfiles().managed.provider).toBe("team-managed");
+    expect(readProfiles().codex.provider).toBe("chatgpt-subscription");
+  });
+
+  test("keeps the vendor and drops a dangling binding with a warn", () => {
+    seedRows([]);
+    writeConfig({
+      llm: {
+        profiles: {
+          stale: {
+            provider: "anthropic",
+            provider_connection: "deleted-row",
+            model: "claude-opus-4-8",
+          },
+        },
+      },
+    });
+
+    run();
+
+    const stale = readProfiles().stale;
+    expect(stale.provider).toBe("anthropic");
+    expect(stale).not.toHaveProperty("provider_connection");
+  });
+
+  test("keeps the vendor and drops a kind-disagreeing binding", () => {
+    seedRows([{ name: "ollama-local", provider: "ollama" }]);
+    writeConfig({
+      llm: {
+        profiles: {
+          conflicted: {
+            provider: "anthropic",
+            provider_connection: "ollama-local",
+            model: "claude-opus-4-8",
+          },
+        },
+      },
+    });
+
+    run();
+
+    const conflicted = readProfiles().conflicted;
+    expect(conflicted.provider).toBe("anthropic");
+    expect(conflicted).not.toHaveProperty("provider_connection");
+  });
+
+  test("strips a stray binding from a routing-identity profile", () => {
+    seedRows([{ name: "vellum", provider: "vellum" }]);
+    writeConfig({
+      llm: {
+        profiles: {
+          managed: {
+            provider: "vellum",
+            provider_connection: "vellum",
+            model: "claude-opus-4-8",
+          },
+        },
+      },
+    });
+
+    run();
+
+    const managed = readProfiles().managed;
+    expect(managed.provider).toBe("vellum");
+    expect(managed).not.toHaveProperty("provider_connection");
+  });
+
+  test("deletes a self-referential binding when no row claims that name", () => {
+    seedRows([{ name: "anthropic-work", provider: "anthropic" }]);
+    writeConfig({
+      llm: {
+        profiles: {
+          plain: {
+            provider: "anthropic",
+            provider_connection: "anthropic",
+            model: "claude-opus-4-8",
+          },
+        },
+      },
+    });
+
+    run();
+
+    expect(readProfiles().plain.provider).toBe("anthropic");
+    expect(readProfiles().plain).not.toHaveProperty("provider_connection");
+  });
+
+  test("an absent DB file means genuinely dangling bindings (restored config)", () => {
+    writeConfig({
+      llm: {
+        profiles: {
+          bound: {
+            provider: "anthropic",
+            provider_connection: "anthropic-work",
+            model: "claude-opus-4-8",
+          },
+        },
+      },
+    });
+    // No DB at all: a config restored into a fresh workspace has no rows.
+
+    run();
+
+    const bound = readProfiles().bound;
+    expect(bound.provider).toBe("anthropic");
+    expect(bound).not.toHaveProperty("provider_connection");
+  });
+
+  test("throws (for retry) when bindings exist but the DB is unqueryable", () => {
+    writeConfig({
+      llm: {
+        profiles: {
+          bound: {
+            provider: "anthropic",
+            provider_connection: "anthropic-work",
+            model: "claude-opus-4-8",
+          },
+        },
+      },
+    });
+    // DB file exists but carries no provider_connections table.
+    mkdirSync(join(workspaceDir, "data", "db"), { recursive: true });
+    new Database(join(workspaceDir, "data", "db", "assistant.db")).close();
+
+    expect(() => run()).toThrow(/not readable/);
+    // Config untouched: no destructive guess was made.
+    expect(readProfiles().bound.provider_connection).toBe("anthropic-work");
+    expect(
+      collapseProfileBindingsToEntriesMigration.retryFailedCheckpoint,
+    ).toBe(true);
+  });
+
+  test("folds a canonical vellum binding only for identity-servable models", () => {
+    seedRows([{ name: "vellum", provider: "vellum" }]);
+    writeConfig({
+      llm: {
+        profiles: {
+          routable: {
+            provider: "anthropic",
+            provider_connection: "vellum",
+            model: "claude-opus-4-8",
+          },
+          stale: {
+            provider: "anthropic",
+            provider_connection: "vellum",
+            model: "claude-ancient-1",
+          },
+        },
+      },
+    });
+
+    run();
+
+    const routable = readProfiles().routable;
+    expect(routable.provider).toBe("vellum");
+    expect(routable).not.toHaveProperty("provider_connection");
+    // An unservable model would be stripped by the read-path schema if
+    // folded to the identity; the profile stays untouched instead.
+    const stale = readProfiles().stale;
+    expect(stale.provider).toBe("anthropic");
+    expect(stale.provider_connection).toBe("vellum");
+  });
+
+  test("keeps a self-named binding when a row by that name exists", () => {
+    seedRows([
+      { name: "anthropic", provider: "anthropic" },
+      { name: "anthropic-2", provider: "anthropic" },
+    ]);
+    writeConfig({
+      llm: {
+        profiles: {
+          pinned: {
+            provider: "anthropic",
+            provider_connection: "anthropic",
+            model: "claude-opus-4-8",
+          },
+        },
+      },
+    });
+
+    run();
+
+    // The explicit pin survives: with sibling rows, the bare vendor would
+    // auto-resolve differently.
+    expect(readProfiles().pinned.provider_connection).toBe("anthropic");
+  });
+
+  test("no-ops without bindings and is idempotent", () => {
+    seedRows([{ name: "anthropic-work", provider: "anthropic" }]);
+    writeConfig({
+      llm: {
+        profiles: {
+          work: {
+            provider: "anthropic",
+            provider_connection: "anthropic-work",
+            model: "claude-opus-4-8",
+          },
+          unbound: { provider: "vellum", model: "claude-opus-4-8" },
+        },
+      },
+    });
+
+    run();
+    const afterFirst = readProfiles();
+    run();
+
+    expect(readProfiles()).toEqual(afterFirst);
+    expect(afterFirst.unbound.provider).toBe("vellum");
+  });
+});

package/src/acp/__tests__/acp-claude-oauth.test.ts

@@ -59,8 +59,11 @@ beforeEach(() => {
 
 describe("CLAUDE_OAUTH_CONFIG", () => {
   test("matches the verified endpoints, client id, and scope", () => {
+    // The single literal pin for the endpoint. Every other test asserts
+    // against CLAUDE_OAUTH_CONFIG.authorizeUrl, so an endpoint change edits
+    // exactly this one value.
     expect(CLAUDE_OAUTH_CONFIG.authorizeUrl).toBe(
-      "https://claude.ai/oauth/authorize",
+      "https://claude.com/cai/oauth/authorize",
     );
     expect(CLAUDE_OAUTH_CONFIG.tokenExchangeUrl).toBe(
       "https://platform.claude.com/v1/oauth/token",
@@ -92,8 +95,10 @@ describe("buildClaudeAuthorizeUrl", () => {
     });
 
     const parsed = new URL(url);
+    // The property under test is that the builder uses the configured
+    // endpoint; the value itself is guarded by the literal pin above.
     expect(`${parsed.origin}${parsed.pathname}`).toBe(
-      "https://claude.ai/oauth/authorize",
+      CLAUDE_OAUTH_CONFIG.authorizeUrl,
     );
 
     const params = parsed.searchParams;
@@ -106,6 +111,9 @@ describe("buildClaudeAuthorizeUrl", () => {
     expect(params.get("state")).toBe("state-abc");
     expect(params.get("code_challenge")).toBe("challenge-123");
     expect(params.get("code_challenge_method")).toBe("S256");
+    // The manual flow's defining param: tells Claude to render `code#state`
+    // on the callback page. Claude rejects a manual-redirect grant without it.
+    expect(params.get("code")).toBe("true");
   });
 
   test("works with the manual redirect URI too", () => {

package/src/acp/__tests__/auth-required.test.ts

@@ -0,0 +1,161 @@
+/**
+ * Pins the two shapes a Claude auth failure travels in, plus the
+ * wire-contract literals. Losing either shape silently degrades an actionable
+ * "reconnect Claude" failure into an opaque one.
+ */
+
+import { describe, expect, test } from "bun:test";
+
+import { AcpAuthRequiredEventSchema } from "../../api/events/acp-auth-required.js";
+import { AcpSessionErrorEventSchema } from "../../api/events/acp-session-error.js";
+import {
+  ACP_CLAUDE_AUTH_REQUIRED_CODE,
+  AcpAuthRequiredError,
+  AUTH_REQUIRED_CODE,
+  CLAUDE_ACP_COMMAND,
+  isAcpAuthRequired,
+  isClaudeAuthFailureMessage,
+} from "../auth-required.js";
+
+describe("isAcpAuthRequired", () => {
+  test("recognizes the raw JSON-RPC rejection from the agent", () => {
+    // What the adapter actually sends: a plain object off the wire, not an
+    // instance of any class we control.
+    expect(isAcpAuthRequired({ code: AUTH_REQUIRED_CODE })).toBe(true);
+  });
+
+  test("recognizes our own error after the retry path gives up", () => {
+    expect(isAcpAuthRequired(new AcpAuthRequiredError("claude", "nope"))).toBe(
+      true,
+    );
+  });
+
+  test("does not fire on other failures", () => {
+    expect(isAcpAuthRequired(new Error("Internal error"))).toBe(false);
+    expect(isAcpAuthRequired({ code: -32601 })).toBe(false);
+    expect(isAcpAuthRequired(null)).toBe(false);
+    expect(isAcpAuthRequired(undefined)).toBe(false);
+    expect(isAcpAuthRequired("auth_required")).toBe(false);
+  });
+
+  test("uses the ACP-specified code", () => {
+    // Matches the SDK's RequestError.authRequired(); drifting from it would
+    // silently stop classifying every auth failure.
+    expect(AUTH_REQUIRED_CODE).toBe(-32000);
+  });
+});
+
+describe("isClaudeAuthFailureMessage", () => {
+  test("matches the live rejected-credential failure verbatim", () => {
+    // Captured from a real claude-agent-acp run against a revoked token: the
+    // adapter relays the CLI's failure as a -32603 internal error carrying
+    // this text, NOT as the structured auth_required rejection. This message
+    // is the reported bug, so it must classify.
+    expect(
+      isClaudeAuthFailureMessage(
+        "Internal error: Failed to authenticate. API Error: 401 OAuth access token has been revoked.",
+      ),
+    ).toBe(true);
+  });
+
+  test("is insensitive to the server's variable suffix", () => {
+    // The CLI-authored prefix is the stable part; the API's suffix varies.
+    expect(
+      isClaudeAuthFailureMessage(
+        "Failed to authenticate. API Error: 401 OAuth access token has expired. Re-authenticate to continue.",
+      ),
+    ).toBe(true);
+  });
+
+  test("matches the CLI's other auth phrasings", () => {
+    expect(
+      isClaudeAuthFailureMessage(
+        "Session expired. Please run /login to sign in again.",
+      ),
+    ).toBe(true);
+    expect(isClaudeAuthFailureMessage("Not logged in")).toBe(true);
+  });
+
+  test("does not fire on ordinary failures", () => {
+    expect(isClaudeAuthFailureMessage("Internal error")).toBe(false);
+    expect(isClaudeAuthFailureMessage("ECONNRESET: connection reset")).toBe(
+      false,
+    );
+    expect(
+      isClaudeAuthFailureMessage("Command failed: login.sh: not found"),
+    ).toBe(false);
+    expect(isClaudeAuthFailureMessage(undefined)).toBe(false);
+    expect(isClaudeAuthFailureMessage("")).toBe(false);
+  });
+});
+
+describe("AcpAuthRequiredError", () => {
+  test("is an Error that carries the agent id and its message", () => {
+    const err = new AcpAuthRequiredError("claude", "needs a reconnect");
+    expect(err).toBeInstanceOf(Error);
+    expect(err.name).toBe("AcpAuthRequiredError");
+    expect(err.agentId).toBe("claude");
+    expect(err.message).toBe("needs a reconnect");
+  });
+});
+
+describe("event shape is additive-safe for older clients", () => {
+  test("acp_session_error rejects unknown keys, which is why the signal is not a field on it", () => {
+    // Clients drop a whole event over an unknown key (strict schemas plus a
+    // safeParse fallback to `unknown`), so new signals must ride new event
+    // types; this pins the strictness that forces that.
+    const result = AcpSessionErrorEventSchema.safeParse({
+      type: "acp_session_error",
+      acpSessionId: "acp-1",
+      error: "boom",
+      someFutureField: "x",
+    });
+    expect(result.success).toBe(false);
+  });
+
+  test("acp_session_error still parses in its unchanged shape", () => {
+    expect(
+      AcpSessionErrorEventSchema.safeParse({
+        type: "acp_session_error",
+        acpSessionId: "acp-1",
+        error: "boom",
+      }).success,
+    ).toBe(true);
+  });
+
+  test("acp_auth_required carries the code and an optional anchor", () => {
+    const parsed = AcpAuthRequiredEventSchema.parse({
+      type: "acp_auth_required",
+      acpSessionId: "acp-1",
+      authCode: ACP_CLAUDE_AUTH_REQUIRED_CODE,
+      agent: "claude",
+      parentToolUseId: "tool-1",
+    });
+    expect(parsed.authCode).toBe(ACP_CLAUDE_AUTH_REQUIRED_CODE);
+    expect(parsed.parentToolUseId).toBe("tool-1");
+
+    // The anchor is optional: a run not started by a tool call has none.
+    expect(
+      AcpAuthRequiredEventSchema.safeParse({
+        type: "acp_auth_required",
+        acpSessionId: "acp-1",
+        authCode: ACP_CLAUDE_AUTH_REQUIRED_CODE,
+        agent: "claude",
+      }).success,
+    ).toBe(true);
+  });
+});
+
+describe("wire contract", () => {
+  test("the client marker matches the web literal", () => {
+    // Paired with ACP_CLAUDE_AUTH_REQUIRED_CODE in
+    // clients/web/src/domains/chat/utils/acp-connect.ts. A silent rename on
+    // either side turns the Connect card off with nothing failing.
+    expect(ACP_CLAUDE_AUTH_REQUIRED_CODE).toBe("acp_claude_auth_required");
+  });
+
+  test("the adapter gate matches the resolved command basename", () => {
+    // Compared against SessionEntry.command, which is already a basename.
+    expect(CLAUDE_ACP_COMMAND).toBe("claude-agent-acp");
+  });
+});

package/src/acp/acp-claude-oauth.ts

@@ -33,7 +33,14 @@ import {
  * `CLAUDE_CODE_OAUTH_TOKEN` requires.
  */
 export const CLAUDE_OAUTH_CONFIG: OAuth2Config = {
-  authorizeUrl: "https://claude.ai/oauth/authorize",
+  // The claude.ai-account authorize endpoint, matching the Claude Code CLI's
+  // own CLAUDE_AI_AUTHORIZE_URL. Shared by both flows: the loopback path
+  // builds its URL from this in `prepareOAuth2Flow`, the manual path in
+  // `buildClaudeAuthorizeUrl`. Only the claude.com/cai host completes a
+  // grant; the legacy claude.ai host still renders a working-looking consent
+  // screen but rejects every authorize POST, so a wrong host here looks
+  // functional until the final click of a real sign-in.
+  authorizeUrl: "https://claude.com/cai/oauth/authorize",
   tokenExchangeUrl: "https://platform.claude.com/v1/oauth/token",
   clientId: "9d1c250a-e61b-44d9-88ed-5944d1962f5e",
   scopes: ["user:inference"],
@@ -53,12 +60,22 @@ export const CLAUDE_OAUTH_CONFIG: OAuth2Config = {
 export const CLAUDE_MANUAL_REDIRECT_URI =
   "https://platform.claude.com/oauth/code/callback";
 
-/** Build the Claude authorize URL for a PKCE flow. */
+/**
+ * Build the Claude authorize URL for the MANUAL (paste) PKCE flow.
+ *
+ * `code=true` tells Claude to render the `code#state` string on the callback
+ * page for the user to copy, which is the whole mechanism of the manual flow;
+ * Claude rejects a manual-redirect grant without it. The loopback flow
+ * performs a real redirect instead and must NOT send it; that URL is built
+ * separately in `prepareOAuth2Flow`, which is why this builder can include
+ * the param unconditionally.
+ */
 export function buildClaudeAuthorizeUrl(
   redirectUri: string,
   pkce: { codeChallenge: string; state: string },
 ): string {
   const params = new URLSearchParams({
+    code: "true",
     response_type: "code",
     client_id: CLAUDE_OAUTH_CONFIG.clientId,
     redirect_uri: redirectUri,

package/src/acp/agent-process.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, test } from "bun:test";
 
 import { AcpAgentProcess } from "./agent-process.js";
+import { AcpAuthRequiredError, isAcpAuthRequired } from "./auth-required.js";
 import type { AcpAgentConfig } from "./types.js";
 
 const config: AcpAgentConfig = { command: "noop", args: [] };
@@ -114,3 +115,102 @@ describe("AcpAgentProcess.markStderr / stderrSince", () => {
     expect(proc.stderrSince(mark)).toBe("fresh failure");
   });
 });
+
+// ---------------------------------------------------------------------------
+// createSession: structured auth_required handling through the real retry path
+// ---------------------------------------------------------------------------
+
+/**
+ * Wires a process with a fake protocol connection and advertised auth methods,
+ * following the same no-child-process injection style as `feed` above. The
+ * retry logic under test (`withAuthRetry`, method selection, the typed throw)
+ * runs for real.
+ */
+function wireProcess(opts: {
+  authMethods: unknown[];
+  newSession: () => Promise<unknown>;
+  env?: Record<string, string>;
+}): { proc: AcpAgentProcess; authenticateCalls: () => number } {
+  const proc = new AcpAgentProcess("test-agent", config, clientFactory);
+  let authed = 0;
+  (proc as unknown as { connection: unknown }).connection = {
+    newSession: opts.newSession,
+    authenticate: async () => {
+      authed += 1;
+      return {};
+    },
+  };
+  (proc as unknown as { initializeResponse: unknown }).initializeResponse = {
+    authMethods: opts.authMethods,
+  };
+  (proc as unknown as { spawnedEnv: unknown }).spawnedEnv = opts.env ?? {};
+  return { proc, authenticateCalls: () => authed };
+}
+
+const TERMINAL_ONLY_METHODS = [
+  { id: "claude-ai-login", name: "Claude Subscription", type: "terminal" },
+];
+
+describe("AcpAgentProcess.createSession auth_required handling", () => {
+  test("a structured auth_required rejection with only terminal methods becomes AcpAuthRequiredError", async () => {
+    // The wire shape the adapter actually sends: a plain JSON-RPC error
+    // object, not an Error subclass. With no satisfiable env_var method the
+    // retry path must surface the typed error the session manager and the
+    // spawn tool classify on; losing the type here silently degrades the
+    // whole recovery surface back into a generic failure.
+    const { proc } = wireProcess({
+      authMethods: TERMINAL_ONLY_METHODS,
+      newSession: () =>
+        Promise.reject({ code: -32000, message: "Authentication required" }),
+    });
+
+    const err: unknown = await proc.createSession("/tmp").then(
+      () => null,
+      (e: unknown) => e,
+    );
+
+    expect(err).toBeInstanceOf(AcpAuthRequiredError);
+    expect((err as AcpAuthRequiredError).agentId).toBe("test-agent");
+    expect(isAcpAuthRequired(err)).toBe(true);
+  });
+
+  test("a satisfiable env_var method authenticates and retries instead of throwing", async () => {
+    let calls = 0;
+    const { proc, authenticateCalls } = wireProcess({
+      authMethods: [
+        {
+          id: "api-key",
+          name: "Use SOME_KEY",
+          type: "env_var",
+          vars: [{ name: "SOME_KEY" }],
+        },
+      ],
+      env: { SOME_KEY: "value" },
+      newSession: () => {
+        calls += 1;
+        return calls === 1
+          ? Promise.reject({ code: -32000, message: "Authentication required" })
+          : Promise.resolve({ sessionId: "session-1" });
+      },
+    });
+
+    await expect(proc.createSession("/tmp")).resolves.toBe("session-1");
+    expect(authenticateCalls()).toBe(1);
+  });
+
+  test("a non-auth rejection passes through untyped", async () => {
+    const { proc } = wireProcess({
+      authMethods: TERMINAL_ONLY_METHODS,
+      newSession: () =>
+        Promise.reject({ code: -32603, message: "Internal error" }),
+    });
+
+    const err: unknown = await proc.createSession("/tmp").then(
+      () => null,
+      (e: unknown) => e,
+    );
+
+    expect(err).not.toBeInstanceOf(AcpAuthRequiredError);
+    expect(isAcpAuthRequired(err)).toBe(false);
+  });
+});