@vellumai/assistant 0.12.2 → 0.12.3-staging.1

package/src/cli/commands/oauth/request.test.ts

@@ -17,6 +17,7 @@ let handleRequestResult: {
   body: unknown;
   bodyEncoding?: "base64";
   account?: string | null;
+  hint?: string;
 } = {
   ok: true,
   status: 200,
@@ -71,18 +72,71 @@ afterEach(() => {
   process.exitCode = 0;
 });
 
-async function runRequestCommand(args: string[]): Promise<{
+/**
+ * Runs the command with both streams captured and `process.exit` recorded.
+ * The stream stubs honour a write callback the way the real streams do, so an
+ * exit that rides the last write lands in `exitCalls`, and only after every
+ * chunk written before it has been captured. `holdStderr` keeps stderr
+ * callbacks back and returns them, for the case where stderr is still in
+ * flight when stdout has drained.
+ */
+async function runRequestCommand(
+  args: string[],
+  options: { holdStderr?: boolean } = {},
+): Promise<{
   stdout: Buffer;
+  stderr: string;
   exitCode: number;
+  exitCalls: number[];
+  heldStderrCallbacks: Array<() => void>;
 }> {
   const chunks: Buffer[] = [];
+  const stderrChunks: string[] = [];
+  const exitCalls: number[] = [];
+  const heldStderrCallbacks: Array<() => void> = [];
   const originalWrite = process.stdout.write;
-  process.stdout.write = ((chunk: string | Uint8Array) => {
+  const originalStderrWrite = process.stderr.write;
+  const originalExit = process.exit;
+  const callbackOf = (rest: unknown[]): (() => void) | undefined =>
+    rest.find((arg) => typeof arg === "function") as (() => void) | undefined;
+  process.stdout.write = ((chunk: string | Uint8Array, ...rest: unknown[]) => {
     chunks.push(
       typeof chunk === "string" ? Buffer.from(chunk) : Buffer.from(chunk),
     );
+    callbackOf(rest)?.();
     return true;
   }) as typeof process.stdout.write;
+  process.stderr.write = ((chunk: string | Uint8Array, ...rest: unknown[]) => {
+    stderrChunks.push(String(chunk));
+    const callback = callbackOf(rest);
+    if (callback) {
+      if (options.holdStderr) {
+        heldStderrCallbacks.push(holdCallback(callback));
+      } else {
+        callback();
+      }
+    }
+    return true;
+  }) as typeof process.stderr.write;
+  const recordExit = ((code?: number) => {
+    exitCalls.push(code ?? Number(process.exitCode ?? 0));
+  }) as typeof process.exit;
+  process.exit = recordExit;
+  // A held callback runs after this function has restored the real
+  // `process.exit`, so it reinstalls the recorder for the duration of the
+  // call; the exit it triggers must land in `exitCalls`, never end the test
+  // process.
+  const holdCallback = (callback: () => void): (() => void) => {
+    return () => {
+      const current = process.exit;
+      process.exit = recordExit;
+      try {
+        callback();
+      } finally {
+        process.exit = current;
+      }
+    };
+  };
 
   try {
     const program = new Command();
@@ -101,11 +155,16 @@ async function runRequestCommand(args: string[]): Promise<{
     // Commander may throw under exitOverride for parse errors.
   } finally {
     process.stdout.write = originalWrite;
+    process.stderr.write = originalStderrWrite;
+    process.exit = originalExit;
   }
 
   return {
     stdout: Buffer.concat(chunks),
+    stderr: stderrChunks.join(""),
     exitCode: Number(process.exitCode ?? 0),
+    exitCalls,
+    heldStderrCallbacks,
   };
 }
 
@@ -308,6 +367,124 @@ describe("oauth request body output", () => {
     expect(parsed.bodyEncoding).toBe("base64");
   });
 
+  test("exits non-zero when the route reports failure inside a 2xx", async () => {
+    // The exit code follows the route's verdict, so a caller that only checks
+    // the exit code sees a refused call as a failure; the body still prints,
+    // since it carries the provider's own error code.
+    handleRequestResult = {
+      ok: false,
+      status: 200,
+      headers: { "content-type": "application/json" },
+      body: { ok: false, error: "not_in_channel" },
+      account: "user@example.com",
+    };
+    const { stdout, exitCode } = await runRequestCommand([
+      "--provider",
+      "slack_channel",
+      "-s",
+      "/chat.postMessage",
+    ]);
+
+    expect(exitCode).toBe(1);
+    expect(stdout.toString("utf8")).toContain("not_in_channel");
+  });
+
+  test("exits itself once the whole body has drained", async () => {
+    // The in-process route leaves handles open, so the command has to exit;
+    // and it must do so on the write callback, because a bare exit after a
+    // large piped write drops everything past the first 64 KB.
+    const body = "x".repeat(200_000);
+    handleRequestResult = {
+      ok: true,
+      status: 200,
+      headers: { "content-type": "text/plain" },
+      body,
+      account: "user@example.com",
+    };
+    const { stdout, exitCode, exitCalls } = await runRequestCommand([
+      "--provider",
+      "google",
+      "-s",
+      "https://api.google.com/v1/big",
+    ]);
+
+    expect(stdout.toString("utf8")).toBe(body + "\n");
+    expect(exitCode).toBe(0);
+    expect(exitCalls).toEqual([0]);
+  });
+
+  test("exits after writing an empty body to a file", async () => {
+    const target = join(tempDir, "empty.bin");
+    handleRequestResult = {
+      ok: true,
+      status: 204,
+      headers: {},
+      body: null,
+      account: "user@example.com",
+    };
+    const { exitCalls } = await runRequestCommand([
+      "--provider",
+      "google",
+      "-s",
+      "-o",
+      target,
+      "https://api.google.com/v1/none",
+    ]);
+
+    expect(readFileSync(target)).toHaveLength(0);
+    expect(exitCalls).toEqual([0]);
+  });
+
+  test("waits for stderr to drain before exiting when stdout carried nothing", async () => {
+    // With `-o`, stdout carries nothing, so the exit cannot ride a stdout
+    // write, and the diagnostics on stderr (the account line, a hint) may
+    // still be in flight. The exit waits for the last of them.
+    const target = join(tempDir, "body.json");
+    handleRequestResult = {
+      ok: false,
+      status: 200,
+      headers: { "content-type": "application/json" },
+      body: { ok: false, error: "not_in_channel" },
+      account: "user@example.com",
+      hint: "slack_channel answered HTTP 200 but reported ok: false",
+    };
+    const { stderr, exitCalls, heldStderrCallbacks } = await runRequestCommand(
+      ["--provider", "slack_channel", "-o", target, "/chat.postMessage"],
+      { holdStderr: true },
+    );
+
+    expect(stderr).toContain("Account: user@example.com");
+    expect(stderr).toContain("ok: false");
+    expect(heldStderrCallbacks).toHaveLength(2);
+    expect(exitCalls).toEqual([]);
+
+    heldStderrCallbacks[0]();
+    expect(exitCalls).toEqual([]);
+    heldStderrCallbacks[1]();
+    expect(exitCalls).toEqual([1]);
+  });
+
+  test("a stdout body waits for stderr diagnostics written before it", async () => {
+    handleRequestResult = {
+      ok: true,
+      status: 200,
+      headers: { "content-type": "application/json" },
+      body: { hello: "world" },
+      account: "user@example.com",
+    };
+    const { stdout, exitCalls, heldStderrCallbacks } = await runRequestCommand(
+      ["--provider", "google", "https://api.google.com/v1/me"],
+      { holdStderr: true },
+    );
+
+    expect(stdout.toString("utf8")).toContain("hello");
+    expect(heldStderrCallbacks).toHaveLength(1);
+    expect(exitCalls).toEqual([]);
+
+    heldStderrCallbacks[0]();
+    expect(exitCalls).toEqual([0]);
+  });
+
   test("writes text bodies as UTF-8 and appends a newline on stdout", async () => {
     handleRequestResult = {
       ok: true,

package/src/cli/commands/oauth/request.ts

@@ -142,11 +142,38 @@ export async function runAuthenticatedRequest(params: {
   const { providerKey, url, opts, cmd } = params;
   const jsonMode = shouldOutputJson(cmd);
 
+  // The command exits itself, once its last write on either stream has
+  // drained. Running the route in-process leaves handles open that the event
+  // loop waits on (the lazy CES connection the credential resolves through is
+  // never closed by the CLI), so returning from the action would leave the
+  // process alive after a complete response. A bare `process.exit()` is not
+  // the answer either: with a pipe on the other end, Bun flushes what the
+  // pipe accepts and drops the rest, so the exit rides write callbacks, which
+  // fire when the bytes are out. Stdout's last write carries `exit` itself;
+  // stderr's writes are counted, so an exit requested while one is still in
+  // flight waits for it. The pipe's capacity is not a bound to lean on: a
+  // busy host can shrink an unprivileged pipe to a single page.
+  let stderrInFlight = 0;
+  let exitRequested = false;
+  const exit = (): void => {
+    exitRequested = true;
+    if (stderrInFlight === 0) {
+      process.exit(Number(process.exitCode ?? 0));
+    }
+  };
+
   // Helper: write info to stderr (respects -s)
   const writeInfo = (msg: string): void => {
-    if (!opts.silent) {
-      process.stderr.write(msg + "\n");
+    if (opts.silent) {
+      return;
     }
+    stderrInFlight += 1;
+    process.stderr.write(msg + "\n", () => {
+      stderrInFlight -= 1;
+      if (exitRequested) {
+        exit();
+      }
+    });
   };
 
   try {
@@ -232,17 +259,18 @@ export async function runAuthenticatedRequest(params: {
         // reported the way every other failure here is, so `--json` gets its
         // envelope and the caller's diagnostics hint is not lost; only the
         // exit code comes from the route's status.
-        writeError(cmd, `${err.message}\n\n${params.diagnosticsHint}`);
         process.exitCode = exitCodeFromIpcResult({
           statusCode: err.statusCode,
         });
+        writeError(cmd, `${err.message}\n\n${params.diagnosticsHint}`, exit);
         return;
       }
       throw err;
     }
 
-    // Non-2xx exit code
-    if (result.status < 200 || result.status >= 300) {
+    // The route's verdict, not the status code: a provider that reports
+    // failure inside a 2xx (Slack's `ok: false`) is a failed request.
+    if (!result.ok) {
       process.exitCode = 1;
     }
 
@@ -261,7 +289,7 @@ export async function runAuthenticatedRequest(params: {
 
     // JSON output mode
     if (jsonMode) {
-      writeOutput(cmd, result);
+      writeOutput(cmd, result, exit);
       return;
     }
 
@@ -282,20 +310,23 @@ export async function runAuthenticatedRequest(params: {
       if (output) {
         if (opts.output) {
           writeFileSync(opts.output, output.bytes);
+        } else if (output.isBinary) {
+          process.stdout.write(output.bytes, exit);
+          return;
         } else {
           process.stdout.write(output.bytes);
-          if (!output.isBinary) {
-            process.stdout.write("\n");
-          }
+          process.stdout.write("\n", exit);
+          return;
         }
       }
     } else if (opts.output) {
       writeFileSync(opts.output, Buffer.alloc(0));
     }
+    exit();
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    writeError(cmd, `${message}\n\n${params.diagnosticsHint}`);
     process.exitCode = 1;
+    writeError(cmd, `${message}\n\n${params.diagnosticsHint}`, exit);
   }
 }
 

package/src/cli/commands/plugins.ts

@@ -238,11 +238,18 @@ export function registerPluginsCommand(program: Command): void {
               const platformEnabled =
                 libs.catalogLocal.arePlatformFeaturesEnabled();
               if (platformEnabled) {
-                const match = (
-                  await libs.catalogCache.getPluginCatalog(DEFAULT_PLUGIN_REF, {
-                    fetch: globalThis.fetch.bind(globalThis),
-                  })
-                ).matches.find((candidate) => candidate.name === nameOrUrl);
+                let match;
+                try {
+                  match = (
+                    await libs.catalogCache.getPluginCatalog(
+                      DEFAULT_PLUGIN_REF,
+                      { fetch: globalThis.fetch.bind(globalThis) },
+                    )
+                  ).matches.find((candidate) => candidate.name === nameOrUrl);
+                } catch {
+                  // The install endpoint remains authoritative and can succeed
+                  // independently when catalog discovery is unavailable.
+                }
                 if (match?.source.kind === "local") {
                   result = await libs.installGitHub.installPlugin(
                     {

package/src/cli/commands/schedules.ts

@@ -35,6 +35,7 @@ interface ScheduleRecord {
   mode: string;
   status: string;
   routingIntent: string;
+  quiet: boolean;
   reuseConversation: boolean;
   wakeConversationId: string | null;
   sourceKey: string | null;
@@ -268,6 +269,7 @@ export function registerSchedulesCommand(program: Command): void {
               formatScheduleInferenceProfile(schedule.inferenceProfile),
             ],
             ["Routing intent", schedule.routingIntent],
+            ["Quiet", schedule.quiet ? "yes" : "no"],
             ["Reuse conversation", schedule.reuseConversation ? "yes" : "no"],
             ["Wake conversation", schedule.wakeConversationId ?? "—"],
             ["Retry count", String(schedule.retryCount)],

package/src/cli/lib/__tests__/inspect-plugin.test.ts

@@ -19,6 +19,7 @@ import {
   PluginInspectNotFoundError,
 } from "../inspect-plugin.js";
 import { computeFingerprint } from "../plugin-fingerprint.js";
+import type { PluginCatalog } from "../search-plugins.js";
 
 const SHA_A = "a".repeat(40);
 const SHA_B = "b".repeat(40);
@@ -305,6 +306,59 @@ describe("inspectPlugin", () => {
     expect(result.remote?.commit).toBe(SHA_B);
   });
 
+  test("previews an uninstalled bundled provider offline without fetching GitHub", async () => {
+    const savedDisablePlatform = process.env.VELLUM_DISABLE_PLATFORM;
+    const savedIsPlatform = process.env.IS_PLATFORM;
+    process.env.VELLUM_DISABLE_PLATFORM = "true";
+    delete process.env.IS_PLATFORM;
+    let fetchCalls = 0;
+    const fetch = (async () => {
+      fetchCalls += 1;
+      throw new Error("offline");
+    }) as FetchLike;
+    const localCatalog: PluginCatalog = {
+      ref: "bundled",
+      matches: [
+        {
+          name: "fathom",
+          path: "local:plugins/mcp-catalog/fathom@1.0.0",
+          category: "productivity",
+          source: {
+            kind: "local",
+            path: "plugins/mcp-catalog/fathom",
+            version: "1.0.0",
+          },
+        },
+      ],
+    };
+
+    try {
+      const result = await inspectPlugin(
+        { name: "fathom" },
+        { fetch, workspacePluginsDir: workspace, localCatalog },
+      );
+
+      expect(result.status).toBe("not-installed");
+      expect(result.remote).toMatchObject({
+        kind: "local",
+        path: "plugins/mcp-catalog/fathom",
+        version: "1.0.0",
+      });
+      expect(fetchCalls).toBe(0);
+    } finally {
+      if (savedDisablePlatform === undefined) {
+        delete process.env.VELLUM_DISABLE_PLATFORM;
+      } else {
+        process.env.VELLUM_DISABLE_PLATFORM = savedDisablePlatform;
+      }
+      if (savedIsPlatform === undefined) {
+        delete process.env.IS_PLATFORM;
+      } else {
+        process.env.IS_PLATFORM = savedIsPlatform;
+      }
+    }
+  });
+
   test("reports remote-unavailable when the marketplace cannot be reached", async () => {
     // GIVEN an installed plugin and a failing marketplace fetch
     installPlugin(workspace, "level-up", { sidecar: { commit: SHA_A } });

package/src/cli/lib/__tests__/install-from-github.test.ts

@@ -39,6 +39,7 @@ import {
   resolveTreeRefPath,
   sanitizePluginName,
 } from "../install-from-github.js";
+import { readValidatedPluginIcon } from "../plugin-icon-file.js";
 
 const CANON_REPO = "vellum-ai/vellum-assistant";
 /** Synthetic host the fixtures use for Contents API `download_url`s. */
@@ -320,6 +321,46 @@ describe("installPlugin — install lifecycle", () => {
     ]);
   });
 
+  test("installs the reviewed Fathom package from the generated bundle", async () => {
+    const result = await installPlugin(
+      {
+        name: "fathom",
+        trustedSource: {
+          kind: "local",
+          path: "plugins/mcp-catalog/fathom",
+          version: "1.0.2",
+        },
+      },
+      {
+        fetch: (async () => {
+          throw new Error("local package install must not fetch");
+        }) as FetchLike,
+        runGit: unusedGitRunner,
+        workspacePluginsDir: pluginsDir,
+      },
+    );
+
+    expect(result).toMatchObject({
+      name: "fathom",
+      ref: "1.0.2",
+      commit: null,
+    });
+    expect(readValidatedPluginIcon(result.target).hasIcon).toBe(true);
+    expect(
+      readPluginMcpServers({ workspacePluginsDir: pluginsDir }).servers,
+    ).toEqual([
+      expect.objectContaining({
+        pluginName: "fathom",
+        serverKey: "fathom",
+        config: expect.objectContaining({
+          transport: expect.objectContaining({
+            url: "https://api.fathom.ai/mcp",
+          }),
+        }),
+      }),
+    ]);
+  });
+
   test("refuses to overwrite an existing install without --force", async () => {
     // GIVEN a plugin already installed at <pluginsDir>/caveman
     const target = join(pluginsDir, "caveman");