@vellumai/assistant 0.11.6 → 0.11.7-staging.2

package/src/runtime/routes/__tests__/chatgpt-subscription-auth-routes.test.ts

@@ -0,0 +1,372 @@
+/**
+ * Tests for the ChatGPT subscription auth routes.
+ *
+ * The device-code path is driven by mocking `openai-device-auth` so the route's
+ * own contract is under test: `device-auth` returns the user code immediately
+ * and the status route reports `pending` until the background poll settles,
+ * then `connected` or `error` with the provider's error code. The credential +
+ * connection store is mocked so no CES or database write is attempted.
+ */
+
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+import type {
+  OAuth2FlowResult,
+  OAuth2TokenResult,
+} from "../../../security/oauth2.js";
+import type { DeviceAuthRequest } from "../../../security/openai-device-auth.js";
+
+// ---------------------------------------------------------------------------
+// Mocks, wired BEFORE importing the module under test.
+// ---------------------------------------------------------------------------
+
+const actualDeviceAuth =
+  await import("../../../security/openai-device-auth.js");
+const { DeviceAuthError } = actualDeviceAuth;
+
+const DEVICE_REQUEST: DeviceAuthRequest = {
+  deviceAuthId: "deviceauth_abc123",
+  userCode: "AMOO-SIISY",
+  verificationUrl: "https://auth.openai.com/codex/device",
+  expiresAt: "2099-01-01T00:00:00Z",
+  intervalSeconds: 5,
+};
+
+// Every mint gets its own id, as OpenAI's do, so one flow's background poll can
+// never settle a key another flow owns.
+let mintCount = 0;
+let lastMinted: DeviceAuthRequest = DEVICE_REQUEST;
+
+const requestDeviceCodeMock = mock(async () => {
+  mintCount++;
+  lastMinted = {
+    ...DEVICE_REQUEST,
+    deviceAuthId: `${DEVICE_REQUEST.deviceAuthId}_${mintCount}`,
+  };
+  return lastMinted;
+});
+
+/** Resolver handles for the in-flight poll each test drives by hand. */
+let resolveDeviceAuth: (result: OAuth2FlowResult) => void = () => {};
+let rejectDeviceAuth: (err: unknown) => void = () => {};
+/** Every signal the route handed the poll, in mint order. */
+const pollSignals: AbortSignal[] = [];
+/**
+ * Whether an abort settles the mocked poll. Off for the races where the poll
+ * has already returned an authorization code and the exchange is mid-flight,
+ * which is exactly the window the route has to guard on its own.
+ */
+let rejectPollOnAbort = true;
+
+const completeDeviceAuthMock = mock(
+  (
+    _config: unknown,
+    _request: DeviceAuthRequest,
+    options: { signal?: AbortSignal } = {},
+  ) =>
+    new Promise<OAuth2FlowResult>((resolve, reject) => {
+      resolveDeviceAuth = resolve;
+      rejectDeviceAuth = reject;
+      if (options.signal) {
+        pollSignals.push(options.signal);
+        // The real poll throws once the signal fires; mirroring that keeps the
+        // route's own settle path under test.
+        options.signal.addEventListener("abort", () => {
+          if (!rejectPollOnAbort) {
+            return;
+          }
+          reject(
+            new DeviceAuthError(
+              "Device authorization was cancelled.",
+              "aborted",
+            ),
+          );
+        });
+      }
+    }),
+);
+
+mock.module("../../../security/openai-device-auth.js", () => ({
+  ...actualDeviceAuth,
+  requestDeviceCode: requestDeviceCodeMock,
+  completeDeviceAuth: completeDeviceAuthMock,
+}));
+
+const actualChatgptAuth =
+  await import("../../../providers/inference/chatgpt-subscription-auth.js");
+/** When set, the store blocks on it, so a test can interleave a cancel. */
+let storeGate: Promise<void> | null = null;
+const storeChatgptSubscriptionTokensMock = mock(
+  async (_tokens: OAuth2TokenResult) => {
+    if (storeGate) {
+      await storeGate;
+    }
+  },
+);
+mock.module(
+  "../../../providers/inference/chatgpt-subscription-auth.js",
+  () => ({
+    ...actualChatgptAuth,
+    storeChatgptSubscriptionTokens: storeChatgptSubscriptionTokensMock,
+  }),
+);
+
+const { ROUTES } = await import("../chatgpt-subscription-auth-routes.js");
+
+const startDeviceAuthHandler = ROUTES.find(
+  (r) => r.operationId === "inference_chatgpt_subscription_device_auth",
+)!.handler;
+const deviceAuthStatusHandler = ROUTES.find(
+  (r) => r.operationId === "inference_chatgpt_subscription_device_auth_status",
+)!.handler;
+const cancelDeviceAuthHandler = ROUTES.find(
+  (r) => r.operationId === "inference_chatgpt_subscription_device_auth_cancel",
+)!.handler;
+const startAuthHandler = ROUTES.find(
+  (r) => r.operationId === "inference_chatgpt_subscription_auth",
+)!.handler;
+
+interface DeviceStartResult {
+  state: string;
+  user_code: string;
+  verification_url: string;
+  expires_at: string;
+  interval_seconds: number;
+}
+
+interface StatusResult {
+  status: "pending" | "connected" | "error";
+  error?: string;
+  error_code?: string;
+}
+
+const TOKENS: OAuth2FlowResult = {
+  tokens: {
+    accessToken: "access-1",
+    refreshToken: "refresh-1",
+    expiresIn: 3600,
+  },
+  grantedScopes: ["openid"],
+  rawTokenResponse: {},
+};
+
+async function startDeviceAuth(): Promise<DeviceStartResult> {
+  return (await startDeviceAuthHandler({})) as DeviceStartResult;
+}
+
+function readStatus(state: string): StatusResult {
+  return deviceAuthStatusHandler({ pathParams: { state } }) as StatusResult;
+}
+
+function cancelDeviceAuth(state: string): { cancelled: boolean } {
+  return cancelDeviceAuthHandler({ pathParams: { state } }) as {
+    cancelled: boolean;
+  };
+}
+
+/** Let the background `.then`/`.catch` chain run before asserting. */
+async function flush(): Promise<void> {
+  await Promise.resolve();
+  await Promise.resolve();
+  await Promise.resolve();
+}
+
+describe("chatgpt subscription device auth routes", () => {
+  beforeEach(() => {
+    requestDeviceCodeMock.mockClear();
+    completeDeviceAuthMock.mockClear();
+    storeChatgptSubscriptionTokensMock.mockClear();
+    pollSignals.length = 0;
+    rejectPollOnAbort = true;
+    storeGate = null;
+  });
+
+  test("returns the user code immediately and starts pending", async () => {
+    const result = await startDeviceAuth();
+
+    expect(result).toEqual({
+      state: lastMinted.deviceAuthId,
+      user_code: "AMOO-SIISY",
+      verification_url: "https://auth.openai.com/codex/device",
+      expires_at: "2099-01-01T00:00:00Z",
+      interval_seconds: 5,
+    });
+    expect(completeDeviceAuthMock).toHaveBeenCalledTimes(1);
+    expect(readStatus(result.state)).toEqual({ status: "pending" });
+  });
+
+  test("stores the tokens and flips to connected when the poll succeeds", async () => {
+    const result = await startDeviceAuth();
+
+    resolveDeviceAuth(TOKENS);
+    await flush();
+
+    expect(storeChatgptSubscriptionTokensMock).toHaveBeenCalledTimes(1);
+    expect(storeChatgptSubscriptionTokensMock.mock.calls[0]?.[0]).toEqual(
+      TOKENS.tokens,
+    );
+    expect(readStatus(result.state)).toEqual({ status: "connected" });
+  });
+
+  test("reports the provider error code when the poll fails", async () => {
+    const result = await startDeviceAuth();
+
+    rejectDeviceAuth(
+      new DeviceAuthError("Device auth is off.", "deviceauth_not_enabled"),
+    );
+    await flush();
+
+    expect(storeChatgptSubscriptionTokensMock).not.toHaveBeenCalled();
+    expect(readStatus(result.state)).toEqual({
+      status: "error",
+      error: "Device auth is off.",
+      error_code: "deviceauth_not_enabled",
+    });
+  });
+
+  test("falls back to a generic code for a non-device-auth failure", async () => {
+    const result = await startDeviceAuth();
+
+    rejectDeviceAuth(new Error("token exchange exploded"));
+    await flush();
+
+    expect(readStatus(result.state)).toEqual({
+      status: "error",
+      error: "token exchange exploded",
+      error_code: "device_auth_failed",
+    });
+  });
+
+  test("404s an unknown state", async () => {
+    expect(() => readStatus("deviceauth_missing")).toThrow(
+      /No active ChatGPT device sign-in/,
+    );
+  });
+});
+
+describe("chatgpt subscription device auth cancellation", () => {
+  beforeEach(() => {
+    requestDeviceCodeMock.mockClear();
+    completeDeviceAuthMock.mockClear();
+    storeChatgptSubscriptionTokensMock.mockClear();
+    pollSignals.length = 0;
+    rejectPollOnAbort = true;
+    storeGate = null;
+  });
+
+  test("stops the poll and reports the flow aborted", async () => {
+    const result = await startDeviceAuth();
+
+    expect(cancelDeviceAuth(result.state)).toEqual({ cancelled: true });
+
+    expect(pollSignals[0]?.aborted).toBe(true);
+    const status = readStatus(result.state);
+    expect(status.status).toBe("error");
+    expect(status.error_code).toBe("aborted");
+    await flush();
+    expect(readStatus(result.state).error_code).toBe("aborted");
+  });
+
+  test("leaves a flow that already settled alone", async () => {
+    const result = await startDeviceAuth();
+
+    resolveDeviceAuth(TOKENS);
+    await flush();
+
+    expect(cancelDeviceAuth(result.state)).toEqual({ cancelled: false });
+    expect(readStatus(result.state)).toEqual({ status: "connected" });
+  });
+
+  test("starting a flow aborts the one before it", async () => {
+    const first = await startDeviceAuth();
+    const second = await startDeviceAuth();
+    await flush();
+
+    expect(second.state).not.toBe(first.state);
+    expect(pollSignals[0]?.aborted).toBe(true);
+    expect(pollSignals[1]?.aborted).toBe(false);
+
+    const firstStatus = readStatus(first.state);
+    expect(firstStatus.status).toBe("error");
+    expect(firstStatus.error_code).toBe("aborted");
+    expect(readStatus(second.state)).toEqual({ status: "pending" });
+  });
+
+  test("404s an unknown state", async () => {
+    expect(() => cancelDeviceAuth("deviceauth_missing")).toThrow(
+      /No active ChatGPT device sign-in/,
+    );
+  });
+
+  test("discards tokens from a flow cancelled during the exchange", async () => {
+    rejectPollOnAbort = false;
+    const result = await startDeviceAuth();
+
+    expect(cancelDeviceAuth(result.state)).toEqual({ cancelled: true });
+    resolveDeviceAuth(TOKENS);
+    await flush();
+
+    expect(storeChatgptSubscriptionTokensMock).not.toHaveBeenCalled();
+    const status = readStatus(result.state);
+    expect(status.status).toBe("error");
+    expect(status.error_code).toBe("aborted");
+  });
+
+  test("leaves a flow cancelled mid-store marked aborted", async () => {
+    rejectPollOnAbort = false;
+    let releaseStore = () => {};
+    storeGate = new Promise<void>((resolve) => {
+      releaseStore = resolve;
+    });
+    const result = await startDeviceAuth();
+
+    resolveDeviceAuth(TOKENS);
+    await flush();
+    expect(storeChatgptSubscriptionTokensMock).toHaveBeenCalledTimes(1);
+
+    expect(cancelDeviceAuth(result.state)).toEqual({ cancelled: true });
+    releaseStore();
+    await flush();
+
+    const status = readStatus(result.state);
+    expect(status.status).toBe("error");
+    expect(status.error_code).toBe("aborted");
+  });
+
+  test("a superseded flow cannot store over the one that replaced it", async () => {
+    rejectPollOnAbort = false;
+    const first = await startDeviceAuth();
+    const resolveFirst = resolveDeviceAuth;
+    const second = await startDeviceAuth();
+
+    resolveFirst(TOKENS);
+    await flush();
+
+    expect(storeChatgptSubscriptionTokensMock).not.toHaveBeenCalled();
+    expect(readStatus(first.state).error_code).toBe("aborted");
+    expect(readStatus(second.state)).toEqual({ status: "pending" });
+  });
+});
+
+describe("chatgpt subscription paste flow", () => {
+  test("builds a PKCE authorize URL against OpenAI's client", async () => {
+    const result = (await startAuthHandler({})) as {
+      authorize_url: string;
+      state: string;
+    };
+
+    const url = new URL(result.authorize_url);
+    expect(url.origin + url.pathname).toBe(
+      "https://auth.openai.com/oauth/authorize",
+    );
+    expect(url.searchParams.get("client_id")).toBe(
+      "app_EMoamEEZ73f0CkXaXp7hrann",
+    );
+    expect(url.searchParams.get("code_challenge_method")).toBe("S256");
+    expect(url.searchParams.get("state")).toBe(result.state);
+    expect(url.searchParams.get("redirect_uri")).toBe(
+      "http://localhost:1455/auth/callback",
+    );
+    expect(url.searchParams.get("id_token_add_organizations")).toBe("true");
+  });
+});

package/src/runtime/routes/__tests__/contact-routes.test.ts

@@ -316,6 +316,7 @@ const nativeGatewayRead = {
   contactType: "human",
   lastInteraction: 9200,
   interactionCount: 11,
+  autoApproveThreshold: "high",
   createdAt: 1000,
   updatedAt: 1500,
   channels: [
@@ -376,6 +377,9 @@ describe("filtered/native contact reads: daemon filters, gateway hydrates teleme
     // (4/4200/4100).
     expect(contact.interactionCount).toBe(11);
     expect(contact.lastInteraction).toBe(9200);
+    expect(
+      (contact as { autoApproveThreshold?: string | null }).autoApproveThreshold,
+    ).toBe("high");
     const channel = contact.channels[0] as Record<string, unknown>;
     expect(channel.interactionCount).toBe(11);
     expect(channel.lastSeenAt).toBe(9100);
@@ -404,6 +408,9 @@ describe("filtered/native contact reads: daemon filters, gateway hydrates teleme
     const [contact] = result.contacts;
     expect(contact.interactionCount).toBe(0);
     expect(contact.lastInteraction).toBeNull();
+    expect(
+      (contact as { autoApproveThreshold?: string | null }).autoApproveThreshold,
+    ).toBeNull();
     const channel = contact.channels[0] as Record<string, unknown>;
     expect(channel.interactionCount).toBe(0);
     expect(channel.lastSeenAt).toBeNull();

package/src/runtime/routes/__tests__/conversation-query-routes.test.ts

@@ -50,6 +50,7 @@ mock.module("../../../persistence/embeddings/embedding-backend.js", () => ({
   },
 }));
 
+import { BACKUP_PROFILE_KEYS } from "../../../config/default-profile-names.js";
 import { getConfig, loadRawConfig } from "../../../config/loader.js";
 import { LLMConfigBase } from "../../../config/schemas/llm.js";
 import type { ConversationCreateType } from "../../../persistence/conversation-types.js";
@@ -836,6 +837,49 @@ describe("PUT /v1/config/llm/profiles/:name", () => {
     seedRawConfig();
   });
 
+  describe("fallbackProfile write protection", () => {
+    beforeEach(() => {
+      const llm = rawConfigFixture.llm as {
+        profiles: Record<string, Record<string, unknown>>;
+      };
+      llm.profiles.backup = {
+        provider: "anthropic",
+        model: "claude-sonnet-4-6",
+      };
+      seedRawConfig();
+    });
+
+    test("rejects a custom fallbackProfile without writing", async () => {
+      await expect(
+        replaceProfileRoute.handler({
+          pathParams: { name: "custom" },
+          body: {
+            provider: "anthropic",
+            model: "claude-sonnet-4-6",
+            fallbackProfile: "backup",
+          },
+        }),
+      ).rejects.toThrow(/Automatic fallbacks are code-owned/);
+      expect(persistedProfile("custom").fallbackProfile).toBeUndefined();
+      expect(initializeProvidersCalls).toBe(0);
+    });
+
+    test("rejects a custom pointer at a managed backup name", async () => {
+      await expect(
+        replaceProfileRoute.handler({
+          pathParams: { name: "custom" },
+          body: {
+            provider: "anthropic",
+            model: "claude-sonnet-4-6",
+            fallbackProfile: "balanced-backup",
+          },
+        }),
+      ).rejects.toThrow(/Automatic fallbacks are code-owned/);
+      expect(persistedProfile("custom").fallbackProfile).toBeUndefined();
+      expect(initializeProvidersCalls).toBe(0);
+    });
+  });
+
   test("owns contextWindow maxInputTokens while preserving non-UI profile leaves", async () => {
     const result = await replaceProfileRoute.handler({
       pathParams: { name: "custom" },
@@ -1242,6 +1286,48 @@ describe("PUT /v1/config/llm/profiles/:name", () => {
   });
 });
 
+describe("PATCH /v1/config fallbackProfile write protection", () => {
+  const patchRoute = ROUTES.find((r) => r.operationId === "config_patch")!;
+
+  beforeEach(() => {
+    initializeProvidersCalls = 0;
+    clearEmbeddingBackendCacheCalls = 0;
+    rawConfigFixture = {
+      llm: {
+        profiles: {
+          custom: { provider: "anthropic", model: "claude-sonnet-4-6" },
+          backup: { provider: "anthropic", model: "claude-sonnet-4-6" },
+        },
+      },
+    };
+    seedRawConfig();
+  });
+
+  test("rejects a custom fallbackProfile without writing", async () => {
+    await expect(
+      patchRoute.handler({
+        body: { llm: { profiles: { custom: { fallbackProfile: "backup" } } } },
+      }),
+    ).rejects.toThrow(/Automatic fallbacks are code-owned/);
+    expect(persistedProfile("custom").fallbackProfile).toBeUndefined();
+    expect(initializeProvidersCalls).toBe(0);
+  });
+
+  test("rejects a custom pointer at a managed backup name", async () => {
+    await expect(
+      patchRoute.handler({
+        body: {
+          llm: {
+            profiles: { custom: { fallbackProfile: "balanced-backup" } },
+          },
+        },
+      }),
+    ).rejects.toThrow(/Automatic fallbacks are code-owned/);
+    expect(persistedProfile("custom").fallbackProfile).toBeUndefined();
+    expect(initializeProvidersCalls).toBe(0);
+  });
+});
+
 describe("custom profile write normalization (complete overrides)", () => {
   const configPatchRoute = ROUTES.find(
     (r) => r.operationId === "config_patch",
@@ -1696,6 +1782,16 @@ describe("config invariant flag enrichment", () => {
     }
   });
 
+  test("GET /v1/config hides managed backups from the picker catalog", async () => {
+    const body = await configGetRoute.handler({});
+    const profiles = wireProfiles(body);
+
+    for (const name of BACKUP_PROFILE_KEYS) {
+      expect(profiles).not.toHaveProperty(name);
+    }
+    expect(profiles.balanced).toBeDefined();
+  });
+
   test("PATCH /v1/config stamps the flag on the response but never persists it", async () => {
     const body = await configPatchRoute.handler({
       body: { memory: { enabled: true } },

package/src/runtime/routes/__tests__/inference-profiles-routes.test.ts

@@ -64,6 +64,7 @@ mock.module("../../sync/resource-sync-events.js", () => ({
 // ── Real imports (after mocks) ────────────────────────────────────────────────
 
 import { setConfig } from "../../../__tests__/helpers/set-config.js";
+import { BACKUP_PROFILE_KEYS } from "../../../config/default-profile-names.js";
 import { loadRawConfig } from "../../../config/loader.js";
 import { getDb } from "../../../persistence/db-connection.js";
 import { initializeDb } from "../../../persistence/db-init.js";
@@ -625,6 +626,11 @@ describe("collectProfileReferences", () => {
           source: "user",
           mix: [{ profile: "my-fast", weight: 1 }],
         },
+        "my-primary": {
+          source: "user",
+          provider: "anthropic",
+          fallbackProfile: "my-fast",
+        },
       },
     };
     expect(collectProfileReferences(llm, "my-fast").sort()).toEqual(
@@ -633,6 +639,7 @@ describe("collectProfileReferences", () => {
         "llm.advisorProfile",
         "llm.callSites.memoryExtraction",
         "llm.profiles.my-mix.mix",
+        "llm.profiles.my-primary.fallbackProfile",
       ].sort(),
     );
   });
@@ -676,6 +683,22 @@ describe("DELETE inference/profiles/:name reference guard", () => {
     ).rejects.toThrow(/llm\.profiles\.my-mix\.mix/);
   });
 
+  test("rejects deletion referenced by another profile's fallbackProfile", async () => {
+    setConfig("llm", {
+      profiles: {
+        "my-fast": { source: "user", provider: "anthropic" },
+        "my-primary": {
+          source: "user",
+          provider: "anthropic",
+          fallbackProfile: "my-fast",
+        },
+      },
+    });
+    await expect(
+      call("inference_profiles_delete", { pathParams: { name: "my-fast" } }),
+    ).rejects.toThrow(/llm\.profiles\.my-primary\.fallbackProfile/);
+  });
+
   test("rejects deletion referenced by a call site", async () => {
     setConfig("llm", {
       callSites: { memoryExtraction: { profile: "my-fast" } },
@@ -706,6 +729,20 @@ describe("DELETE inference/profiles/:name reference guard", () => {
 // ── provider-aware list/get (Finding 2) ───────────────────────────────────────
 
 describe("GET inference/profiles honors llm.defaultProvider", () => {
+  test("omits managed backup routes from the user-facing catalog", async () => {
+    setConfig("llm", { profiles: {} });
+
+    const listed = (await call("inference_profiles_list", {})) as {
+      profiles: Array<{ name: string }>;
+    };
+    const names = new Set(listed.profiles.map((profile) => profile.name));
+
+    for (const key of BACKUP_PROFILE_KEYS) {
+      expect(names.has(key)).toBe(false);
+    }
+    expect(names.has("balanced")).toBe(true);
+  });
+
   test("expands balanced through a BYOK default provider, not the vellum column", async () => {
     setConfig("llm", {
       defaultProvider: { provider: "anthropic" },

package/src/runtime/routes/__tests__/ingress-status-routes.test.ts

@@ -36,8 +36,9 @@ const probeTunnelMock = mock(
 mock.module("../../../daemon/handlers/config-ingress.js", () => ({
   getIngressConfigResult: () => ingressConfig,
   isVelayManagedIngress: () => velayManaged,
-  loadLastTunnelRecord: () => lastTunnel,
   loadPairingTunnelRecord: () => pairingTunnel,
+  // Mirrors the real selector: a pairing-only record wins over the last run.
+  loadRestartTunnelRecord: () => pairingTunnel ?? lastTunnel,
   loadRecordedAssistantId: () => recordedAssistantId,
 }));
 

package/src/runtime/routes/__tests__/mcp-add-default-risk.test.ts

@@ -0,0 +1,87 @@
+/**
+ * `internal_mcp_add` must not freeze a risk level into the entry it writes.
+ *
+ * The shipped default lives in `McpServerConfigSchema`, which parses
+ * `config.json` on every load. An entry that carries no `defaultRiskLevel`
+ * therefore tracks that default; one that carries an explicit level keeps it.
+ * Writing a level the caller never asked for would pin every added server to
+ * whatever the default happened to be on the day it was added.
+ */
+
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+import { McpServerConfigSchema } from "../../../config/schemas/mcp.js";
+import { BadRequestError } from "../errors.js";
+
+let raw: Record<string, unknown> = {};
+let saved: Record<string, unknown> | undefined;
+
+const actualLoader = await import("../../../config/loader.js");
+mock.module("../../../config/loader.js", () => ({
+  ...actualLoader,
+  loadRawConfig: () => raw,
+  saveRawConfig: (next: Record<string, unknown>) => {
+    saved = next;
+  },
+}));
+
+mock.module("../../../daemon/mcp-reload-service.js", () => ({
+  reloadMcpServers: async () => {},
+}));
+
+const { ROUTES } = await import("../mcp-auth-routes.js");
+
+const addRoute = ROUTES.find((r) => r.operationId === "internal_mcp_add")!;
+
+function addedEntry(): Record<string, unknown> {
+  const mcp = saved?.mcp as { servers: Record<string, unknown> };
+  return mcp.servers["srv"] as Record<string, unknown>;
+}
+
+describe("internal_mcp_add risk level", () => {
+  beforeEach(() => {
+    raw = {};
+    saved = undefined;
+  });
+
+  test("omits defaultRiskLevel when the caller names no risk", async () => {
+    await addRoute.handler({
+      body: {
+        name: "srv",
+        transportType: "streamable-http",
+        url: "https://example.com/mcp",
+      },
+    });
+
+    const entry = addedEntry();
+    expect(entry).not.toHaveProperty("defaultRiskLevel");
+    expect(McpServerConfigSchema.parse(entry).defaultRiskLevel).toBe("medium");
+  });
+
+  test("persists an explicit risk level", async () => {
+    await addRoute.handler({
+      body: {
+        name: "srv",
+        transportType: "streamable-http",
+        url: "https://example.com/mcp",
+        risk: "high",
+      },
+    });
+
+    expect(addedEntry().defaultRiskLevel).toBe("high");
+  });
+
+  test("rejects an unknown risk level", async () => {
+    await expect(
+      addRoute.handler({
+        body: {
+          name: "srv",
+          transportType: "streamable-http",
+          url: "https://example.com/mcp",
+          risk: "extreme",
+        },
+      }),
+    ).rejects.toThrow(BadRequestError);
+    expect(saved).toBeUndefined();
+  });
+});