@vellumai/assistant 0.3.0

package/src/__tests__/diff.test.ts

@@ -0,0 +1,121 @@
+import { describe, expect, test } from 'bun:test';
+import { formatDiff, formatNewFileDiff } from '../util/diff.js';
+
+// Strip ANSI codes for easier assertion
+const stripAnsi = (str: string) => str.replace(/\x1b\[[0-9;]*m/g, '');
+
+describe('formatDiff', () => {
+  test('returns empty string for identical content', () => {
+    const result = formatDiff('hello\nworld\n', 'hello\nworld\n', 'test.ts');
+    expect(result).toBe('');
+  });
+
+  test('shows single line addition', () => {
+    const old = 'line1\nline2\nline3';
+    const updated = 'line1\nline2\nnew line\nline3';
+    const result = stripAnsi(formatDiff(old, updated, 'test.ts'));
+    expect(result).toContain('--- a/test.ts');
+    expect(result).toContain('+++ b/test.ts');
+    expect(result).toContain('+new line');
+    expect(result).not.toContain('-new line');
+  });
+
+  test('shows single line removal', () => {
+    const old = 'line1\nline2\nline3';
+    const updated = 'line1\nline3';
+    const result = stripAnsi(formatDiff(old, updated, 'test.ts'));
+    expect(result).toContain('-line2');
+    expect(result).not.toContain('+line2');
+  });
+
+  test('shows line replacement', () => {
+    const old = 'const x = 1;\nconst y = 2;\nconst z = 3;';
+    const updated = 'const x = 1;\nconst y = 42;\nconst z = 3;';
+    const result = stripAnsi(formatDiff(old, updated, 'file.ts'));
+    expect(result).toContain('-const y = 2;');
+    expect(result).toContain('+const y = 42;');
+  });
+
+  test('includes context lines', () => {
+    const lines = Array.from({ length: 10 }, (_, i) => `line${i + 1}`);
+    const old = lines.join('\n');
+    const newLines = [...lines];
+    newLines[5] = 'CHANGED';
+    const updated = newLines.join('\n');
+    const result = stripAnsi(formatDiff(old, updated, 'ctx.ts'));
+    // Should include context before and after the change
+    expect(result).toContain(' line4');
+    expect(result).toContain(' line5');
+    expect(result).toContain('-line6');
+    expect(result).toContain('+CHANGED');
+    expect(result).toContain(' line7');
+    expect(result).toContain(' line8');
+  });
+
+  test('handles multi-hunk diffs', () => {
+    const lines = Array.from({ length: 20 }, (_, i) => `line${i + 1}`);
+    const old = lines.join('\n');
+    const newLines = [...lines];
+    newLines[2] = 'CHANGED_A';
+    newLines[17] = 'CHANGED_B';
+    const updated = newLines.join('\n');
+    const result = stripAnsi(formatDiff(old, updated, 'multi.ts'));
+    expect(result).toContain('-line3');
+    expect(result).toContain('+CHANGED_A');
+    expect(result).toContain('-line18');
+    expect(result).toContain('+CHANGED_B');
+    // Should have two @@ hunk headers
+    const hunkHeaders = result.match(/@@/g);
+    expect(hunkHeaders!.length).toBeGreaterThanOrEqual(4); // 2 hunks, each with @@ ... @@
+  });
+
+  test('uses ANSI colors for added/removed lines', () => {
+    const old = 'old line';
+    const updated = 'new line';
+    const result = formatDiff(old, updated, 'test.ts');
+    // Red for removed
+    expect(result).toContain('\x1b[31m-old line\x1b[0m');
+    // Green for added
+    expect(result).toContain('\x1b[32m+new line\x1b[0m');
+  });
+
+  test('handles empty old content (new file)', () => {
+    const result = stripAnsi(formatDiff('', 'new content\nline 2', 'new.ts'));
+    expect(result).toContain('+new content');
+    expect(result).toContain('+line 2');
+  });
+
+  test('handles empty new content (file deleted)', () => {
+    const result = stripAnsi(formatDiff('old content\nline 2', '', 'del.ts'));
+    expect(result).toContain('-old content');
+    expect(result).toContain('-line 2');
+  });
+});
+
+describe('formatNewFileDiff', () => {
+  test('shows all lines as additions', () => {
+    const content = 'line1\nline2\nline3';
+    const result = stripAnsi(formatNewFileDiff(content, 'new.ts'));
+    expect(result).toContain('--- /dev/null');
+    expect(result).toContain('+++ b/new.ts');
+    expect(result).toContain('+line1');
+    expect(result).toContain('+line2');
+    expect(result).toContain('+line3');
+  });
+
+  test('truncates long files', () => {
+    const lines = Array.from({ length: 50 }, (_, i) => `line${i + 1}`);
+    const content = lines.join('\n');
+    const result = stripAnsi(formatNewFileDiff(content, 'big.ts', 10));
+    expect(result).toContain('+line1');
+    expect(result).toContain('+line10');
+    expect(result).not.toContain('+line11');
+    expect(result).toContain('... 40 more lines');
+  });
+
+  test('does not truncate short files', () => {
+    const content = 'a\nb\nc';
+    const result = stripAnsi(formatNewFileDiff(content, 'small.ts'));
+    expect(result).not.toContain('more lines');
+  });
+});

package/src/__tests__/domain-normalize.test.ts

@@ -0,0 +1,112 @@
+import { describe, test, expect } from 'bun:test';
+import { normalizeDomain } from '../tools/network/domain-normalize.js';
+
+describe('normalizeDomain', () => {
+  // ── Basic hostname parsing ──────────────────────────────────────────
+
+  test('parses simple hostname', () => {
+    const result = normalizeDomain('example.com');
+    expect(result).not.toBeNull();
+    expect(result!.hostname).toBe('example.com');
+    expect(result!.registrableDomain).toBe('example.com');
+  });
+
+  test('parses subdomain', () => {
+    const result = normalizeDomain('login.example.com');
+    expect(result).not.toBeNull();
+    expect(result!.hostname).toBe('login.example.com');
+    expect(result!.registrableDomain).toBe('example.com');
+  });
+
+  test('parses deep subdomain', () => {
+    const result = normalizeDomain('foo.bar.example.co.uk');
+    expect(result).not.toBeNull();
+    expect(result!.hostname).toBe('foo.bar.example.co.uk');
+    expect(result!.registrableDomain).toBe('example.co.uk');
+  });
+
+  // ── URL extraction ──────────────────────────────────────────────────
+
+  test('extracts hostname from full URL', () => {
+    const result = normalizeDomain('https://login.example.com/path?q=1');
+    expect(result).not.toBeNull();
+    expect(result!.hostname).toBe('login.example.com');
+    expect(result!.registrableDomain).toBe('example.com');
+  });
+
+  test('extracts hostname from URL with port', () => {
+    const result = normalizeDomain('https://example.com:8443/api');
+    expect(result).not.toBeNull();
+    expect(result!.hostname).toBe('example.com');
+  });
+
+  test('strips port from bare hostname', () => {
+    const result = normalizeDomain('example.com:8080');
+    expect(result).not.toBeNull();
+    expect(result!.hostname).toBe('example.com');
+    expect(result!.registrableDomain).toBe('example.com');
+  });
+
+  // ── Normalization ───────────────────────────────────────────────────
+
+  test('lowercases hostname', () => {
+    const result = normalizeDomain('Login.EXAMPLE.Com');
+    expect(result).not.toBeNull();
+    expect(result!.hostname).toBe('login.example.com');
+    expect(result!.registrableDomain).toBe('example.com');
+  });
+
+  test('strips trailing dot', () => {
+    const result = normalizeDomain('example.com.');
+    expect(result).not.toBeNull();
+    expect(result!.hostname).toBe('example.com');
+    expect(result!.registrableDomain).toBe('example.com');
+  });
+
+  // ── Punycode / IDN ──────────────────────────────────────────────────
+
+  test('handles punycode domain', () => {
+    const result = normalizeDomain('xn--nxasmq6b.example.com');
+    expect(result).not.toBeNull();
+    expect(result!.hostname).toBe('xn--nxasmq6b.example.com');
+    expect(result!.registrableDomain).toBe('example.com');
+  });
+
+  // ── Rejection cases ─────────────────────────────────────────────────
+
+  test('returns null for IPv4 address', () => {
+    expect(normalizeDomain('192.168.1.1')).toBeNull();
+  });
+
+  test('returns null for IPv6 address', () => {
+    expect(normalizeDomain('[::1]')).toBeNull();
+    expect(normalizeDomain('::1')).toBeNull();
+  });
+
+  test('returns null for localhost', () => {
+    expect(normalizeDomain('localhost')).toBeNull();
+  });
+
+  test('returns null for empty string', () => {
+    expect(normalizeDomain('')).toBeNull();
+  });
+
+  test('returns null for null-like input', () => {
+    expect(normalizeDomain(null as unknown as string)).toBeNull();
+    expect(normalizeDomain(undefined as unknown as string)).toBeNull();
+  });
+
+  // ── Co.uk / multi-part TLD ──────────────────────────────────────────
+
+  test('handles co.uk correctly', () => {
+    const result = normalizeDomain('www.bbc.co.uk');
+    expect(result).not.toBeNull();
+    expect(result!.registrableDomain).toBe('bbc.co.uk');
+  });
+
+  test('handles com.au correctly', () => {
+    const result = normalizeDomain('shop.example.com.au');
+    expect(result).not.toBeNull();
+    expect(result!.registrableDomain).toBe('example.com.au');
+  });
+});

package/src/__tests__/domain-policy.test.ts

@@ -0,0 +1,124 @@
+import { describe, test, expect } from 'bun:test';
+import { isDomainAllowed } from '../tools/credentials/domain-policy.js';
+
+describe('isDomainAllowed', () => {
+  // ── Exact host match ────────────────────────────────────────────────
+
+  test('allows exact hostname match', () => {
+    expect(isDomainAllowed('example.com', ['example.com'])).toBe(true);
+  });
+
+  test('allows exact hostname match (case insensitive)', () => {
+    expect(isDomainAllowed('Example.COM', ['example.com'])).toBe(true);
+  });
+
+  // ── Registrable-domain + subdomain ──────────────────────────────────
+
+  test('allows subdomain when registrable domain matches', () => {
+    expect(isDomainAllowed('login.example.com', ['example.com'])).toBe(true);
+  });
+
+  test('allows deep subdomain when registrable domain matches', () => {
+    expect(isDomainAllowed('a.b.c.example.com', ['example.com'])).toBe(true);
+  });
+
+  test('allows subdomain of co.uk domain', () => {
+    expect(isDomainAllowed('login.bbc.co.uk', ['bbc.co.uk'])).toBe(true);
+  });
+
+  // ── Deny cases ──────────────────────────────────────────────────────
+
+  test('denies unrelated domain', () => {
+    expect(isDomainAllowed('evil.com', ['example.com'])).toBe(false);
+  });
+
+  test('denies domain that looks similar but differs', () => {
+    expect(isDomainAllowed('notexample.com', ['example.com'])).toBe(false);
+  });
+
+  test('denies different TLD', () => {
+    expect(isDomainAllowed('example.org', ['example.com'])).toBe(false);
+  });
+
+  test('denies when allowed list is empty', () => {
+    expect(isDomainAllowed('example.com', [])).toBe(false);
+  });
+
+  test('denies when allowed list is undefined-like', () => {
+    expect(isDomainAllowed('example.com', undefined as unknown as string[])).toBe(false);
+  });
+
+  test('denies when request host is empty', () => {
+    expect(isDomainAllowed('', ['example.com'])).toBe(false);
+  });
+
+  test('denies when request host is invalid', () => {
+    expect(isDomainAllowed('not a valid host!!!', ['example.com'])).toBe(false);
+  });
+
+  test('denies malformed host even when same string is in allowed list', () => {
+    expect(isDomainAllowed('not a valid host!!!', ['not a valid host!!!'])).toBe(false);
+  });
+
+  test('denies hostname with consecutive dots', () => {
+    expect(isDomainAllowed('a..b', ['a..b'])).toBe(false);
+  });
+
+  test('denies hostname with label starting with hyphen', () => {
+    expect(isDomainAllowed('-foo.example.com', ['example.com'])).toBe(false);
+  });
+
+  test('denies hostname with label ending with hyphen', () => {
+    expect(isDomainAllowed('foo-.example.com', ['example.com'])).toBe(false);
+  });
+
+  test('denies IP addresses', () => {
+    expect(isDomainAllowed('192.168.1.1', ['192.168.1.1'])).toBe(false);
+  });
+
+  test('denies localhost', () => {
+    expect(isDomainAllowed('localhost', ['localhost'])).toBe(false);
+  });
+
+  // ── Internal / non-registrable hosts ────────────────────────────────
+
+  test('allows exact match for single-label intranet host', () => {
+    expect(isDomainAllowed('intranet', ['intranet'])).toBe(true);
+  });
+
+  test('allows exact match for internal two-label host', () => {
+    expect(isDomainAllowed('vault.corp', ['vault.corp'])).toBe(true);
+  });
+
+  // ── URL extraction ──────────────────────────────────────────────────
+
+  test('extracts hostname from full URL', () => {
+    expect(isDomainAllowed('https://login.example.com/path', ['example.com'])).toBe(true);
+  });
+
+  test('denies URL with wrong domain', () => {
+    expect(isDomainAllowed('https://evil.com/path', ['example.com'])).toBe(false);
+  });
+
+  // ── Subdomain in allowed list ──────────────────────────────────────
+
+  test('allows exact subdomain match when subdomain is in allowed list', () => {
+    expect(isDomainAllowed('login.example.com', ['login.example.com'])).toBe(true);
+  });
+
+  test('denies different subdomain when only specific subdomain is allowed', () => {
+    // When allowed is a subdomain (not the registrable domain itself),
+    // only exact matches should work
+    expect(isDomainAllowed('other.example.com', ['login.example.com'])).toBe(false);
+  });
+
+  // ── Multiple allowed domains ────────────────────────────────────────
+
+  test('matches against any domain in the allowed list', () => {
+    expect(isDomainAllowed('login.github.com', ['example.com', 'github.com'])).toBe(true);
+  });
+
+  test('denies when none of the allowed domains match', () => {
+    expect(isDomainAllowed('evil.com', ['example.com', 'github.com'])).toBe(false);
+  });
+});

package/src/__tests__/doordash-client.test.ts

@@ -0,0 +1,186 @@
+import { describe, it, expect } from 'bun:test';
+import { SessionExpiredError } from '../doordash/client.js';
+
+describe('SessionExpiredError', () => {
+  it('is an instance of Error', () => {
+    const err = new SessionExpiredError('test reason');
+    expect(err).toBeInstanceOf(Error);
+  });
+
+  it('has name set to SessionExpiredError', () => {
+    const err = new SessionExpiredError('test reason');
+    expect(err.name).toBe('SessionExpiredError');
+  });
+
+  it('preserves the reason as the message', () => {
+    const err = new SessionExpiredError('DoorDash session has expired.');
+    expect(err.message).toBe('DoorDash session has expired.');
+  });
+
+  it('can be distinguished from plain Error via instanceof', () => {
+    const sessionErr = new SessionExpiredError('expired');
+    const plainErr = new Error('something else');
+    expect(sessionErr instanceof SessionExpiredError).toBe(true);
+    expect(plainErr instanceof SessionExpiredError).toBe(false);
+  });
+
+  it('produces a useful stack trace', () => {
+    const err = new SessionExpiredError('no session');
+    expect(err.stack).toBeDefined();
+    expect(err.stack).toContain('SessionExpiredError');
+  });
+});
+
+describe('expired session classification', () => {
+  // The CDP response handler in cdpFetch classifies certain HTTP statuses
+  // as session-expired. We test the classification logic by simulating
+  // the parsed response structure that cdpFetch evaluates.
+
+  function classifyResponse(parsed: Record<string, unknown>): Error {
+    // Mirrors the classification logic from cdpFetch (client.ts lines 154-159)
+    if (parsed.__error) {
+      if (parsed.__status === 403 || parsed.__status === 401) {
+        return new SessionExpiredError('DoorDash session has expired.');
+      }
+      return new Error(
+        (parsed.__message as string) ??
+          `HTTP ${parsed.__status}: ${(parsed.__body as string) ?? ''}`,
+      );
+    }
+    return new Error('No error');
+  }
+
+  it('classifies HTTP 401 as SessionExpiredError', () => {
+    const err = classifyResponse({ __error: true, __status: 401, __body: 'Unauthorized' });
+    expect(err).toBeInstanceOf(SessionExpiredError);
+    expect(err.message).toBe('DoorDash session has expired.');
+  });
+
+  it('classifies HTTP 403 as SessionExpiredError', () => {
+    const err = classifyResponse({ __error: true, __status: 403, __body: 'Forbidden' });
+    expect(err).toBeInstanceOf(SessionExpiredError);
+    expect(err.message).toBe('DoorDash session has expired.');
+  });
+
+  it('classifies HTTP 500 as a generic Error, not session expired', () => {
+    const err = classifyResponse({ __error: true, __status: 500, __body: 'Internal Server Error' });
+    expect(err).not.toBeInstanceOf(SessionExpiredError);
+    expect(err.message).toBe('HTTP 500: Internal Server Error');
+  });
+
+  it('classifies HTTP 429 as a generic Error', () => {
+    const err = classifyResponse({ __error: true, __status: 429, __body: 'Rate limited' });
+    expect(err).not.toBeInstanceOf(SessionExpiredError);
+    expect(err.message).toBe('HTTP 429: Rate limited');
+  });
+
+  it('uses __message when available', () => {
+    const err = classifyResponse({ __error: true, __message: 'fetch failed' });
+    expect(err).not.toBeInstanceOf(SessionExpiredError);
+    expect(err.message).toBe('fetch failed');
+  });
+
+  it('handles response with no __body or __message gracefully', () => {
+    const err = classifyResponse({ __error: true, __status: 502 });
+    expect(err).not.toBeInstanceOf(SessionExpiredError);
+    expect(err.message).toBe('HTTP 502: ');
+  });
+});
+
+describe('CDP failure scenarios', () => {
+  // These test the error conditions that cdpFetch can encounter:
+  // 1. CDP protocol error (msg.error present)
+  // 2. Empty CDP response (no value in result)
+  // 3. Timeout (30s)
+  // 4. WebSocket connection failure
+
+  // We can test the error construction logic without connecting to a real CDP
+
+  it('CDP protocol error produces a descriptive message', () => {
+    // Simulates the error path at client.ts line 143
+    const cdpError = { message: 'Cannot find context with specified id' };
+    const err = new Error(`CDP error: ${cdpError.message}`);
+    expect(err.message).toBe('CDP error: Cannot find context with specified id');
+  });
+
+  it('Empty CDP response produces a clear error', () => {
+    // Simulates the error path at client.ts line 149
+    const value = undefined;
+    const err = !value ? new Error('Empty CDP response') : null;
+    expect(err).not.toBeNull();
+    expect(err!.message).toBe('Empty CDP response');
+  });
+
+  it('CDP timeout error message includes the timeout duration', () => {
+    // Simulates the timeout error at client.ts line 92
+    const err = new Error('CDP fetch timed out after 30s');
+    expect(err.message).toContain('30s');
+  });
+
+  it('WebSocket connection failure produces SessionExpiredError', () => {
+    // Simulates ws.onerror at client.ts line 172
+    const err = new SessionExpiredError('CDP connection failed.');
+    expect(err).toBeInstanceOf(SessionExpiredError);
+    expect(err.message).toBe('CDP connection failed.');
+  });
+
+  it('findDoordashTab failure when CDP is unavailable', () => {
+    // Simulates findDoordashTab at client.ts line 67
+    const err = new SessionExpiredError(
+      'Chrome CDP not available. Run `vellum doordash refresh` first.',
+    );
+    expect(err).toBeInstanceOf(SessionExpiredError);
+    expect(err.message).toContain('Chrome CDP not available');
+  });
+
+  it('findDoordashTab failure when no tab is available', () => {
+    // Simulates findDoordashTab at client.ts line 76
+    const err = new SessionExpiredError(
+      'No Chrome tab available for DoorDash requests.',
+    );
+    expect(err).toBeInstanceOf(SessionExpiredError);
+    expect(err.message).toContain('No Chrome tab available');
+  });
+
+  it('requireSession throws SessionExpiredError when no session exists', () => {
+    // Simulates requireSession at client.ts line 56
+    const session = null;
+    const err = !session
+      ? new SessionExpiredError('No DoorDash session found.')
+      : null;
+    expect(err).toBeInstanceOf(SessionExpiredError);
+    expect(err!.message).toBe('No DoorDash session found.');
+  });
+
+  it('GraphQL errors are joined with semicolons', () => {
+    // Simulates the error handling at client.ts lines 192-194
+    const errors = [
+      { message: 'Field "x" not found' },
+      { message: 'Unauthorized' },
+    ];
+    const msgs = errors.map(e => e.message || JSON.stringify(e)).join('; ');
+    const err = new Error(`GraphQL errors: ${msgs}`);
+    expect(err.message).toBe(
+      'GraphQL errors: Field "x" not found; Unauthorized',
+    );
+  });
+
+  it('GraphQL errors use JSON.stringify for errors without message', () => {
+    const errors = [{ extensions: { code: 'INTERNAL_ERROR' } }];
+    const msgs = errors
+      .map(e => (e as Record<string, unknown>).message || JSON.stringify(e))
+      .join('; ');
+    const err = new Error(`GraphQL errors: ${msgs}`);
+    expect(err.message).toContain('INTERNAL_ERROR');
+  });
+
+  it('Empty GraphQL response throws', () => {
+    // Simulates client.ts lines 196-198
+    const data = undefined;
+    const err = !data
+      ? new Error('Empty response from DoorDash API')
+      : null;
+    expect(err).not.toBeNull();
+    expect(err!.message).toBe('Empty response from DoorDash API');
+  });
+});