@vellumai/assistant 0.3.0

package/src/__tests__/fixtures/credential-security-fixtures.ts

@@ -0,0 +1,181 @@
+/**
+ * Shared fixtures for credential security invariant tests.
+ *
+ * These fixtures define table-driven test cases for the four locked
+ * security invariants that the credential hardening plan enforces.
+ */
+
+// Test-only value assembled to avoid pre-commit false positives
+const TEST_CREDENTIAL = ['inject', '-test-', '1234'].join('');
+
+// ---------------------------------------------------------------------------
+// 1. Context Injection — secrets must never enter LLM context
+// ---------------------------------------------------------------------------
+
+export interface ContextInjectionCase {
+  label: string;
+  /** Where the credential might leak into context */
+  vector: 'tool_output' | 'history_message' | 'confirmation_payload' | 'lifecycle_event';
+  /** Tool or action that handles the credential */
+  tool: string;
+  /** Input that triggers credential handling */
+  input: Record<string, unknown>;
+  /** The credential value that must NOT appear in the output vector */
+  forbiddenValue: string;
+}
+
+export const contextInjectionCases: ContextInjectionCase[] = [
+  {
+    label: 'credential_store store action output',
+    vector: 'tool_output',
+    tool: 'credential_store',
+    input: { action: 'store', service: 'github', field: 'token', value: TEST_CREDENTIAL },
+    forbiddenValue: TEST_CREDENTIAL,
+  },
+  {
+    label: 'credential_store list action output',
+    vector: 'tool_output',
+    tool: 'credential_store',
+    input: { action: 'list' },
+    forbiddenValue: TEST_CREDENTIAL,
+  },
+  {
+    label: 'browser_fill_credential result',
+    vector: 'tool_output',
+    tool: 'browser_fill_credential',
+    input: { service: 'github', field: 'token', selector: 'input[name="token"]' },
+    forbiddenValue: TEST_CREDENTIAL,
+  },
+  {
+    label: 'confirmation_request payload for credential_store',
+    vector: 'confirmation_payload',
+    tool: 'credential_store',
+    input: { action: 'store', service: 'github', field: 'token', value: TEST_CREDENTIAL },
+    forbiddenValue: TEST_CREDENTIAL,
+  },
+];
+
+// ---------------------------------------------------------------------------
+// 2. Direct Read Access — no generic plaintext read API
+// ---------------------------------------------------------------------------
+
+export interface DirectReadCase {
+  label: string;
+  /** Module path relative to src/ that should NOT export a plaintext getter */
+  modulePath: string;
+  /** Export name that should NOT exist or should be sealed */
+  exportName: string;
+}
+
+export const directReadCases: DirectReadCase[] = [
+  {
+    label: 'vault.ts getCredentialValue',
+    modulePath: 'tools/credentials/vault',
+    exportName: 'getCredentialValue',
+  },
+];
+
+// ---------------------------------------------------------------------------
+// 3. Logging Leakage — credentials must never appear in logs
+// ---------------------------------------------------------------------------
+
+export interface LogLeakageCase {
+  label: string;
+  /** Component where logging might leak credentials */
+  component: 'daemon_handler' | 'prompter' | 'tool_executor' | 'ipc_decode';
+  /** Description of what log output is checked */
+  logCheck: string;
+}
+
+export const logLeakageCases: LogLeakageCase[] = [
+  {
+    label: 'response handler does not log value',
+    component: 'daemon_handler',
+    logCheck: 'credential value not in log output',
+  },
+  {
+    label: 'prompter does not log response value',
+    component: 'prompter',
+    logCheck: 'resolved credential not logged',
+  },
+  {
+    label: 'tool executor lifecycle events redact sensitive fields',
+    component: 'tool_executor',
+    logCheck: 'password/token/value fields masked',
+  },
+  {
+    label: 'IPC decode failure does not dump raw line',
+    component: 'ipc_decode',
+    logCheck: 'malformed line not logged verbatim',
+  },
+];
+
+// ---------------------------------------------------------------------------
+// 4. Policy Misuse — credentials must only be used for allowed purpose
+// ---------------------------------------------------------------------------
+
+export interface PolicyMisuseCase {
+  label: string;
+  /** Type of policy violation */
+  violation: 'none' | 'wrong_tool' | 'wrong_domain' | 'missing_policy' | 'empty_allowlist';
+  credentialId: string;
+  requestingTool: string;
+  requestDomain?: string;
+  /** Allowed tools on the credential (empty = deny all) */
+  allowedTools: string[];
+  /** Allowed domains on the credential (empty = deny all) */
+  allowedDomains: string[];
+  /** Expected outcome */
+  expectedDenied: boolean;
+}
+
+export const policyMisuseCases: PolicyMisuseCase[] = [
+  {
+    label: 'browser_fill_credential denied when tool not in allowedTools',
+    violation: 'wrong_tool',
+    credentialId: 'cred-001',
+    requestingTool: 'browser_fill_credential',
+    allowedTools: ['some_other_tool'],
+    allowedDomains: ['example.com'],
+    expectedDenied: true,
+  },
+  {
+    label: 'browser_fill_credential denied when domain not in allowedDomains',
+    violation: 'wrong_domain',
+    credentialId: 'cred-002',
+    requestingTool: 'browser_fill_credential',
+    requestDomain: 'evil.com',
+    allowedTools: ['browser_fill_credential'],
+    allowedDomains: ['example.com'],
+    expectedDenied: true,
+  },
+  {
+    label: 'credential with no policy defaults to deny',
+    violation: 'missing_policy',
+    credentialId: 'cred-003',
+    requestingTool: 'browser_fill_credential',
+    allowedTools: [],
+    allowedDomains: [],
+    expectedDenied: true,
+  },
+  {
+    label: 'credential with empty allowlist denied',
+    violation: 'empty_allowlist',
+    credentialId: 'cred-004',
+    requestingTool: 'browser_fill_credential',
+    requestDomain: 'example.com',
+    allowedTools: [],
+    allowedDomains: [],
+    expectedDenied: true,
+  },
+  {
+    label: 'browser_fill_credential allowed when tool and domain match',
+    violation: 'none',
+    credentialId: 'cred-005',
+    requestingTool: 'browser_fill_credential',
+    requestDomain: 'login.example.com',
+    allowedTools: ['browser_fill_credential'],
+    allowedDomains: ['example.com'],
+    expectedDenied: false,
+  },
+];

package/src/__tests__/fixtures/media-reuse-fixtures.ts

@@ -0,0 +1,126 @@
+/**
+ * Shared fixtures for media-reuse testing.
+ *
+ * Provides deterministic attachment blobs, message links, and approval
+ * response helpers used by the proxy and asset tool test suites.
+ */
+
+import type { StoredAttachment } from '../../memory/attachments-store.js';
+import type { UserDecision } from '../../permissions/types.js';
+
+// ---------------------------------------------------------------------------
+// Fake attachment data
+// ---------------------------------------------------------------------------
+
+/** A tiny 1x1 red PNG pixel, base64-encoded. */
+export const TINY_PNG_BASE64 =
+  'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8/5+hHgAHggJ/PchI7wAAAABJRU5ErkJggg==';
+
+/** A tiny 1x1 JPEG pixel, base64-encoded. */
+export const TINY_JPEG_BASE64 =
+  '/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAMCAgMCAgMDAwMEAwMEBQgFBQQEBQoHBwYIDAoMCwsKCwsM' +
+  'CgwMDQwMCwwMDQsLCwwODQoMEAwMEQ4ODwwLDgz/2wBDAQMEBAUEBQkFBQkMCwkLDAwMDAwMDAwMDAwM' +
+  'DAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAz/wAARCAABAAEDASIAAhEBAxEB/8QAFAABAAAAAAAAAAAAAAAAAAAACf/EABQQAQAAAAAAAAAAAAAAAAAAAAD/xAAUAQEAAAAAAAAAAAAAAAAAAAAA/8QAFBEBAAAAAAAAAAAAAAAAAAAAAP/aAAwDAQACEQMRAD8AKwA//9k=';
+
+// ---------------------------------------------------------------------------
+// Deterministic attachment records
+// ---------------------------------------------------------------------------
+
+const NOW = 1700000000000;
+
+/** A fake selfie image attachment with deterministic IDs. */
+export const FAKE_SELFIE_ATTACHMENT: StoredAttachment = {
+  id: 'att-selfie-001',
+  originalFilename: 'selfie.png',
+  mimeType: 'image/png',
+  sizeBytes: Buffer.from(TINY_PNG_BASE64, 'base64').length,
+  kind: 'image',
+  thumbnailBase64: null,
+  createdAt: NOW,
+};
+
+/** A fake document attachment. */
+export const FAKE_DOCUMENT_ATTACHMENT: StoredAttachment = {
+  id: 'att-doc-001',
+  originalFilename: 'report.pdf',
+  mimeType: 'application/pdf',
+  sizeBytes: 4096,
+  kind: 'document',
+  thumbnailBase64: null,
+  createdAt: NOW,
+};
+
+/** A fake JPEG photo attachment. */
+export const FAKE_PHOTO_ATTACHMENT: StoredAttachment = {
+  id: 'att-photo-001',
+  originalFilename: 'photo.jpg',
+  mimeType: 'image/jpeg',
+  sizeBytes: Buffer.from(TINY_JPEG_BASE64, 'base64').length,
+  kind: 'image',
+  thumbnailBase64: null,
+  createdAt: NOW,
+};
+
+// ---------------------------------------------------------------------------
+// Message link helpers
+// ---------------------------------------------------------------------------
+
+export interface FakeMessageLink {
+  messageId: string;
+  attachmentId: string;
+  conversationId: string;
+  position: number;
+}
+
+/** A deterministic message-attachment link for the selfie. */
+export const FAKE_SELFIE_LINK: FakeMessageLink = {
+  messageId: 'msg-001',
+  attachmentId: FAKE_SELFIE_ATTACHMENT.id,
+  conversationId: 'conv-001',
+  position: 0,
+};
+
+/** A second link showing multiple attachments on one message. */
+export const FAKE_DOCUMENT_LINK: FakeMessageLink = {
+  messageId: 'msg-001',
+  attachmentId: FAKE_DOCUMENT_ATTACHMENT.id,
+  conversationId: 'conv-001',
+  position: 1,
+};
+
+// ---------------------------------------------------------------------------
+// Approval response helpers
+// ---------------------------------------------------------------------------
+
+export interface FakeApprovalResponse {
+  decision: UserDecision;
+  /** Pattern for "always allow" decisions (undefined for one-shot allow/deny). */
+  pattern?: string;
+  /** Scope prefix for trust rule creation. */
+  scope?: string;
+}
+
+/** Returns a one-shot allow decision. */
+export function fakeAllowOnce(): FakeApprovalResponse {
+  return { decision: 'allow' };
+}
+
+/** Returns a deny decision. */
+export function fakeDeny(): FakeApprovalResponse {
+  return { decision: 'deny' };
+}
+
+/** Returns an "always allow" decision with a pattern for the trust rule. */
+export function fakeAlwaysAllow(pattern: string, scope = '/tmp/test-project'): FakeApprovalResponse {
+  return { decision: 'always_allow', pattern, scope };
+}
+
+/** Returns an "always allow high risk" decision. */
+export function fakeAlwaysAllowHighRisk(pattern: string, scope = '/tmp/test-project'): FakeApprovalResponse {
+  return { decision: 'always_allow_high_risk', pattern, scope };
+}
+
+/** Returns an "always deny" decision. */
+export function fakeAlwaysDeny(): FakeApprovalResponse {
+  return { decision: 'always_deny' };
+}

package/src/__tests__/fixtures/mock-signup-server.ts

@@ -0,0 +1,387 @@
+/**
+ * Mock signup server test fixture.
+ *
+ * A local Bun HTTP server that simulates a realistic multi-step account signup
+ * flow. Used by integration tests to verify account-setup tools.
+ */
+
+// ── Types ───────────────────────────────────────────────────────────
+
+interface SignupSession {
+  step: number; // 0 = not started, 1 = name done, 2 = username done, 3 = verified, 4 = captcha done
+  firstName?: string;
+  lastName?: string;
+  username?: string;
+  password?: string;
+  verificationCode: string;
+}
+
+interface Account {
+  username: string;
+  firstName: string;
+  lastName: string;
+}
+
+export interface MockSignupServer {
+  start(): Promise<{ port: number; url: string }>;
+  stop(): Promise<void>;
+  getAccounts(): Array<Account>;
+  getVerificationCode(): string;
+  reset(): void;
+}
+
+// ── Helpers ─────────────────────────────────────────────────────────
+
+const TAKEN_USERNAMES = ['taken', 'admin', 'root'];
+
+function generateVerificationCode(): string {
+  return String(Math.floor(100_000 + Math.random() * 900_000));
+}
+
+function parseCookies(header: string | null): Record<string, string> {
+  if (!header) return {};
+  const cookies: Record<string, string> = {};
+  for (const pair of header.split(';')) {
+    const eqIdx = pair.indexOf('=');
+    if (eqIdx === -1) continue;
+    const key = pair.slice(0, eqIdx).trim();
+    const value = pair.slice(eqIdx + 1).trim();
+    cookies[key] = value;
+  }
+  return cookies;
+}
+
+function parseFormBody(body: string): Record<string, string> {
+  const params = new URLSearchParams(body);
+  const result: Record<string, string> = {};
+  for (const [key, value] of params.entries()) {
+    result[key] = value;
+  }
+  return result;
+}
+
+function htmlPage(title: string, bodyContent: string): string {
+  return [
+    '<!DOCTYPE html>',
+    '<html lang="en">',
+    '<head><meta charset="utf-8"><title>' + escapeHtml(title) + '</title></head>',
+    '<body>',
+    bodyContent,
+    '</body>',
+    '</html>',
+  ].join('\n');
+}
+
+function escapeHtml(text: string): string {
+  return text
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;');
+}
+
+function errorDiv(message: string): string {
+  return '<div class="error">' + escapeHtml(message) + '</div>';
+}
+
+// ── HTML templates ──────────────────────────────────────────────────
+
+function nameForm(error?: string): string {
+  return htmlPage('Sign Up - Name', [
+    '<h1>Create your account</h1>',
+    error ? errorDiv(error) : '',
+    '<form method="POST" action="/signup/step1">',
+    '  <label for="first_name">First Name</label>',
+    '  <input type="text" id="first_name" name="first_name">',
+    '  <label for="last_name">Last Name</label>',
+    '  <input type="text" id="last_name" name="last_name">',
+    '  <button type="submit">Continue</button>',
+    '</form>',
+  ].join('\n'));
+}
+
+function usernameForm(error?: string): string {
+  return htmlPage('Sign Up - Username', [
+    '<h1>Choose a username</h1>',
+    error ? errorDiv(error) : '',
+    '<form method="POST" action="/signup/step2">',
+    '  <label for="username">Username</label>',
+    '  <input type="text" id="username" name="username">',
+    '  <label for="password">Password</label>',
+    '  <input type="password" id="password" name="password">',
+    '  <button type="submit">Continue</button>',
+    '</form>',
+  ].join('\n'));
+}
+
+function verifyForm(error?: string): string {
+  return htmlPage('Sign Up - Verify', [
+    '<h1>Verify your identity</h1>',
+    '<p>Enter the 6-digit verification code.</p>',
+    error ? errorDiv(error) : '',
+    '<form method="POST" action="/signup/step3">',
+    '  <label for="code">Verification Code</label>',
+    '  <input type="text" id="code" name="code">',
+    '  <button type="submit">Verify</button>',
+    '</form>',
+  ].join('\n'));
+}
+
+function captchaForm(error?: string): string {
+  return htmlPage('Sign Up - CAPTCHA', [
+    '<h1>One last step</h1>',
+    error ? errorDiv(error) : '',
+    '<form method="POST" action="/signup/step4">',
+    '  <div class="g-recaptcha">',
+    '    <label for="captcha_solved">I am not a robot</label>',
+    '    <input type="checkbox" id="captcha_solved" name="captcha_solved" value="true">',
+    '  </div>',
+    '  <button type="submit">Complete Sign Up</button>',
+    '</form>',
+  ].join('\n'));
+}
+
+function completePage(username: string): string {
+  return htmlPage('Sign Up - Complete', [
+    '<h1>Account created successfully!</h1>',
+    '<p>Welcome, <strong>' + escapeHtml(username) + '</strong>!</p>',
+  ].join('\n'));
+}
+
+// ── Server factory ──────────────────────────────────────────────────
+
+export function createMockSignupServer(): MockSignupServer {
+  let server: ReturnType<typeof Bun.serve> | null = null;
+  let sessions = new Map<string, SignupSession>();
+  let accounts: Account[] = [];
+  /** Stores the most recently generated verification code (for the test-only endpoint). */
+  let lastVerificationCode = '';
+
+  function getOrCreateSession(cookieHeader: string | null): { session: SignupSession; id: string } {
+    const cookies = parseCookies(cookieHeader);
+    const existing = cookies['signup_session'];
+    if (existing && sessions.has(existing)) {
+      return { session: sessions.get(existing)!, id: existing };
+    }
+    const id = crypto.randomUUID();
+    const code = generateVerificationCode();
+    lastVerificationCode = code;
+    const session: SignupSession = { step: 0, verificationCode: code };
+    sessions.set(id, session);
+    return { session, id };
+  }
+
+  function sessionCookie(id: string): string {
+    return `signup_session=${id}; Path=/; HttpOnly`;
+  }
+
+  function redirect(path: string, sessionId: string): Response {
+    return new Response(null, {
+      status: 302,
+      headers: {
+        Location: path,
+        'Set-Cookie': sessionCookie(sessionId),
+      },
+    });
+  }
+
+  function htmlResponse(html: string, sessionId: string, status = 200): Response {
+    return new Response(html, {
+      status,
+      headers: {
+        'Content-Type': 'text/html; charset=utf-8',
+        'Set-Cookie': sessionCookie(sessionId),
+      },
+    });
+  }
+
+  async function handleRequest(req: Request): Promise<Response> {
+    const url = new URL(req.url);
+    const path = url.pathname;
+    const method = req.method;
+    const cookieHeader = req.headers.get('cookie');
+
+    // ── Early 404 for non-signup paths ────────────────────────────
+    // Avoid creating orphaned sessions for requests to unknown routes.
+    if (!path.startsWith('/signup')) {
+      return new Response('Not Found', { status: 404 });
+    }
+
+    // ── Test-only endpoint ────────────────────────────────────────
+    // Returns the verification code for the caller's session (looked up
+    // via the session cookie) so parallel / multi-session tests work.
+    if (method === 'GET' && path === '/signup/verify-code') {
+      const cookies = parseCookies(cookieHeader);
+      const sid = cookies['signup_session'];
+      const sess = sid ? sessions.get(sid) : undefined;
+      const code = sess ? sess.verificationCode : lastVerificationCode;
+      return new Response(JSON.stringify({ code }), {
+        headers: { 'Content-Type': 'application/json' },
+      });
+    }
+
+    const { session, id } = getOrCreateSession(cookieHeader);
+
+    // ── Step 1: Name form ─────────────────────────────────────────
+    if (method === 'GET' && path === '/signup') {
+      return htmlResponse(nameForm(), id);
+    }
+
+    if (method === 'POST' && path === '/signup/step1') {
+      const body = parseFormBody(await req.text());
+      const firstName = (body['first_name'] ?? '').trim();
+      const lastName = (body['last_name'] ?? '').trim();
+
+      if (!firstName || !lastName) {
+        return htmlResponse(nameForm('Both first name and last name are required.'), id, 400);
+      }
+      if (firstName.length > 50 || lastName.length > 50) {
+        return htmlResponse(nameForm('Names must be 50 characters or fewer.'), id, 400);
+      }
+
+      session.firstName = firstName;
+      session.lastName = lastName;
+      session.step = 1;
+      return redirect('/signup/username', id);
+    }
+
+    // ── Step 2: Username / password form ──────────────────────────
+    if (method === 'GET' && path === '/signup/username') {
+      if (session.step < 1) {
+        return redirect('/signup', id);
+      }
+      return htmlResponse(usernameForm(), id);
+    }
+
+    if (method === 'POST' && path === '/signup/step2') {
+      if (session.step < 1) {
+        return redirect('/signup', id);
+      }
+      const body = parseFormBody(await req.text());
+      const username = (body['username'] ?? '').trim();
+      const password = body['password'] ?? '';
+
+      if (!username) {
+        return htmlResponse(usernameForm('Username is required.'), id, 400);
+      }
+      if (username.length < 3 || username.length > 30) {
+        return htmlResponse(usernameForm('Username must be between 3 and 30 characters.'), id, 400);
+      }
+      if (!/^[a-zA-Z0-9.]+$/.test(username)) {
+        return htmlResponse(usernameForm('Username may only contain letters, numbers, and dots.'), id, 400);
+      }
+      if (TAKEN_USERNAMES.includes(username.toLowerCase())) {
+        return htmlResponse(usernameForm('Username is already taken.'), id, 400);
+      }
+      if (password.length < 8) {
+        return htmlResponse(usernameForm('Password must be at least 8 characters.'), id, 400);
+      }
+
+      session.username = username;
+      session.password = password;
+      session.step = 2;
+      return redirect('/signup/verify', id);
+    }
+
+    // ── Step 3: Verification code ─────────────────────────────────
+    if (method === 'GET' && path === '/signup/verify') {
+      if (session.step < 2) {
+        return redirect('/signup', id);
+      }
+      return htmlResponse(verifyForm(), id);
+    }
+
+    if (method === 'POST' && path === '/signup/step3') {
+      if (session.step < 2) {
+        return redirect('/signup', id);
+      }
+      const body = parseFormBody(await req.text());
+      const code = (body['code'] ?? '').trim();
+
+      if (!code) {
+        return htmlResponse(verifyForm('Verification code is required.'), id, 400);
+      }
+      if (code !== session.verificationCode) {
+        return htmlResponse(verifyForm('Invalid verification code.'), id, 400);
+      }
+
+      session.step = 3;
+      return redirect('/signup/captcha', id);
+    }
+
+    // ── Step 4: CAPTCHA ───────────────────────────────────────────
+    if (method === 'GET' && path === '/signup/captcha') {
+      if (session.step < 3) {
+        return redirect('/signup', id);
+      }
+      return htmlResponse(captchaForm(), id);
+    }
+
+    if (method === 'POST' && path === '/signup/step4') {
+      if (session.step < 3) {
+        return redirect('/signup', id);
+      }
+      // Guard: if already completed, redirect to the completion page
+      // instead of creating a duplicate account.
+      if (session.step >= 4) {
+        return redirect('/signup/complete', id);
+      }
+      const body = parseFormBody(await req.text());
+      const captchaSolved = body['captcha_solved'];
+
+      if (captchaSolved !== 'true') {
+        return htmlResponse(captchaForm('Please complete the CAPTCHA.'), id, 400);
+      }
+
+      session.step = 4;
+      accounts.push({
+        username: session.username!,
+        firstName: session.firstName!,
+        lastName: session.lastName!,
+      });
+      return redirect('/signup/complete', id);
+    }
+
+    // ── Complete page ─────────────────────────────────────────────
+    if (method === 'GET' && path === '/signup/complete') {
+      if (session.step < 4) {
+        return redirect('/signup', id);
+      }
+      return htmlResponse(completePage(session.username!), id);
+    }
+
+    return new Response('Not Found', { status: 404 });
+  }
+
+  return {
+    async start() {
+      server = Bun.serve({
+        port: 0,
+        fetch: handleRequest,
+      });
+      const port = server.port as number;
+      return { port, url: `http://localhost:${port}` };
+    },
+
+    async stop() {
+      if (server) {
+        server.stop(true);
+        server = null;
+      }
+    },
+
+    getAccounts() {
+      return [...accounts];
+    },
+
+    getVerificationCode() {
+      return lastVerificationCode;
+    },
+
+    reset() {
+      sessions = new Map();
+      accounts = [];
+      lastVerificationCode = '';
+    },
+  };
+}