@vellumai/assistant 0.4.35 → 0.4.37

package/src/__tests__/secure-keys.test.ts

@@ -24,79 +24,55 @@ mock.module("../util/logger.js", () => ({
 }));
 
 // ---------------------------------------------------------------------------
-// Mock platform detection so tests can simulate non-macOS environments
-// where keychain backend selection is exercised.
+// Broker client mock — set up before importing secure-keys so the
+// module-level `createBrokerClient()` call picks up our mock.
 // ---------------------------------------------------------------------------
 
-let mockIsMacOS = false;
-
-mock.module("../util/platform.js", () => ({
-  isMacOS: () => mockIsMacOS,
-  isLinux: () => !mockIsMacOS,
-  isWindows: () => false,
-  getPlatformName: () => (mockIsMacOS ? "darwin" : "linux"),
-  getClipboardCommand: () => null,
+let mockBrokerAvailable = false;
+let mockBrokerStore: Map<string, string> = new Map();
+let mockBrokerGetError = false;
+let mockBrokerSetError = false;
+let mockBrokerDelError = false;
+
+mock.module("../security/keychain-broker-client.js", () => ({
+  createBrokerClient: () => ({
+    isAvailable: () => mockBrokerAvailable,
+    ping: async () => (mockBrokerAvailable ? { pong: true } : null),
+    get: async (account: string) => {
+      // null = broker error (fall back to encrypted store)
+      if (mockBrokerGetError) return null;
+      const value = mockBrokerStore.get(account);
+      if (value !== undefined) return { found: true, value };
+      return { found: false };
+    },
+    set: async (account: string, value: string) => {
+      if (mockBrokerSetError) return false;
+      mockBrokerStore.set(account, value);
+      return true;
+    },
+    del: async (account: string) => {
+      if (mockBrokerDelError) return false;
+      const existed = mockBrokerStore.has(account);
+      mockBrokerStore.delete(account);
+      return existed;
+    },
+    list: async () => Array.from(mockBrokerStore.keys()),
+  }),
 }));
 
-// ---------------------------------------------------------------------------
-// Keychain simulation via _overrideDeps — avoids process-global mock.module
-// for keychain.js which leaks into keychain.test.ts.
-// ---------------------------------------------------------------------------
-
-import { _overrideDeps, _resetDeps } from "../security/keychain.js";
-
-let keychainAvailable = false;
-let keychainFailAtRuntime = false;
-const keychainStore = new Map<string, string>();
-
-function installKeychainDeps(): void {
-  _overrideDeps({
-    isMacOS: () => keychainAvailable,
-    isLinux: () => false,
-    execFileSync: ((cmd: string, args: string[]) => {
-      if (keychainFailAtRuntime) throw new Error("Keychain runtime error");
-
-      if (cmd === "security") {
-        if (args.includes("list-keychains")) return "";
-
-        if (args.includes("find-generic-password")) {
-          const aIdx = args.indexOf("-a");
-          const account = args[aIdx + 1];
-          const val = keychainStore.get(account);
-          if (!val) throw Object.assign(new Error("not found"), { status: 44 });
-          return val + "\n";
-        }
-
-        if (args.includes("add-generic-password")) {
-          const aIdx = args.indexOf("-a");
-          const account = args[aIdx + 1];
-          const wIdx = args.indexOf("-w");
-          const value = args[wIdx + 1];
-          keychainStore.set(account, value);
-          return "";
-        }
-
-        if (args.includes("delete-generic-password")) {
-          const aIdx = args.indexOf("-a");
-          const account = args[aIdx + 1];
-          keychainStore.delete(account);
-          return "";
-        }
-      }
-
-      return "";
-    }) as typeof import("node:child_process").execFileSync,
-  });
-}
-
 import { _setStorePath } from "../security/encrypted-store.js";
 import {
   _resetBackend,
   _setBackend,
   deleteSecureKey,
+  deleteSecureKeyAsync,
+  getBackendType,
   getSecureKey,
+  getSecureKeyAsync,
+  isDowngradedFromKeychain,
   listSecureKeys,
   setSecureKey,
+  setSecureKeyAsync,
 } from "../security/secure-keys.js";
 
 // ---------------------------------------------------------------------------
@@ -111,13 +87,14 @@ const STORE_PATH = join(TEST_DIR, "keys.enc");
 
 describe("secure-keys", () => {
   beforeEach(() => {
-    // Clean state
-    keychainAvailable = false;
-    keychainFailAtRuntime = false;
-    mockIsMacOS = false;
-    keychainStore.clear();
     _resetBackend();
-    installKeychainDeps();
+
+    // Reset broker mock state
+    mockBrokerAvailable = false;
+    mockBrokerStore = new Map();
+    mockBrokerGetError = false;
+    mockBrokerSetError = false;
+    mockBrokerDelError = false;
 
     if (existsSync(TEST_DIR)) {
       rmSync(TEST_DIR, { recursive: true });
@@ -132,7 +109,6 @@ describe("secure-keys", () => {
   });
 
   afterAll(() => {
-    _resetDeps();
     if (existsSync(TEST_DIR)) {
       rmSync(TEST_DIR, { recursive: true });
     }
@@ -142,54 +118,24 @@ describe("secure-keys", () => {
   // Backend selection
   // -----------------------------------------------------------------------
   describe("backend selection", () => {
-    test("uses encrypted store when keychain is unavailable", () => {
-      keychainAvailable = false;
-      _resetBackend();
-      setSecureKey("anthropic", "sk-test-123");
-      expect(getSecureKey("anthropic")).toBe("sk-test-123");
-      // Should be in encrypted store, not keychain
-      expect(keychainStore.has("anthropic")).toBe(false);
-      expect(existsSync(STORE_PATH)).toBe(true);
+    test("returns encrypted when broker is unavailable", () => {
+      expect(getBackendType()).toBe("encrypted");
     });
 
-    test("uses keychain when available", () => {
-      keychainAvailable = true;
-      _resetBackend();
-      setSecureKey("anthropic", "sk-test-456");
-      expect(getSecureKey("anthropic")).toBe("sk-test-456");
-      // Should be in keychain, not encrypted store
-      expect(keychainStore.get("anthropic")).toBe("sk-test-456");
-      expect(existsSync(STORE_PATH)).toBe(false);
+    test("returns broker when broker is available", () => {
+      mockBrokerAvailable = true;
+      expect(getBackendType()).toBe("broker");
     });
 
-    test("caches backend selection", () => {
-      keychainAvailable = false;
-      _resetBackend();
-      setSecureKey("test", "val1");
-
-      // Change availability — should still use encrypted store
-      keychainAvailable = true;
-      setSecureKey("test2", "val2");
-      expect(keychainStore.has("test2")).toBe(false);
-      expect(existsSync(STORE_PATH)).toBe(true);
-    });
-
-    test("uses encrypted store on macOS even when keychain is available", () => {
-      mockIsMacOS = true;
-      keychainAvailable = true;
-      _resetBackend();
-      setSecureKey("anthropic", "sk-mac-test");
-      expect(getSecureKey("anthropic")).toBe("sk-mac-test");
-      // Should be in encrypted store, not keychain
-      expect(keychainStore.has("anthropic")).toBe(false);
-      expect(existsSync(STORE_PATH)).toBe(true);
+    test("isDowngradedFromKeychain always returns false", () => {
+      expect(isDowngradedFromKeychain()).toBe(false);
     });
   });
 
   // -----------------------------------------------------------------------
-  // CRUD operations (via encrypted store backend)
+  // CRUD operations (via encrypted store backend — sync)
   // -----------------------------------------------------------------------
-  describe("CRUD with encrypted backend", () => {
+  describe("CRUD with encrypted backend (sync)", () => {
     test("set and get a key", () => {
       setSecureKey("openai", "sk-openai-789");
       expect(getSecureKey("openai")).toBe("sk-openai-789");
@@ -201,12 +147,12 @@ describe("secure-keys", () => {
 
     test("delete removes a key", () => {
       setSecureKey("gemini", "gem-key");
-      expect(deleteSecureKey("gemini")).toBe(true);
+      expect(deleteSecureKey("gemini")).toBe("deleted");
       expect(getSecureKey("gemini")).toBeUndefined();
     });
 
-    test("delete returns false for nonexistent key", () => {
-      expect(deleteSecureKey("missing")).toBe(false);
+    test("delete returns not-found for nonexistent key", () => {
+      expect(deleteSecureKey("missing")).toBe("not-found");
     });
 
     test("listSecureKeys returns all keys", () => {
@@ -220,143 +166,156 @@ describe("secure-keys", () => {
   });
 
   // -----------------------------------------------------------------------
-  // CRUD operations (via keychain backend)
+  // Sync variants always use encrypted store even when broker is available
   // -----------------------------------------------------------------------
-  describe("CRUD with keychain backend", () => {
-    beforeEach(() => {
-      keychainAvailable = true;
-      _resetBackend();
+  describe("sync variants ignore broker", () => {
+    test("getSecureKey uses encrypted store even when broker is available", () => {
+      mockBrokerAvailable = true;
+      mockBrokerStore.set("api-key", "broker-value");
+      // Sync getter should not see broker-only keys
+      expect(getSecureKey("api-key")).toBeUndefined();
+      // But encrypted store keys should work
+      setSecureKey("api-key", "encrypted-value");
+      expect(getSecureKey("api-key")).toBe("encrypted-value");
     });
 
-    test("set and get a key", () => {
-      setSecureKey("anthropic", "sk-ant-123");
-      expect(getSecureKey("anthropic")).toBe("sk-ant-123");
+    test("setSecureKey uses encrypted store even when broker is available", () => {
+      mockBrokerAvailable = true;
+      setSecureKey("api-key", "encrypted-value");
+      expect(getSecureKey("api-key")).toBe("encrypted-value");
+      // Should not have written to broker
+      expect(mockBrokerStore.has("api-key")).toBe(false);
     });
 
-    test("delete removes a key", () => {
-      setSecureKey("anthropic", "sk-ant-123");
-      deleteSecureKey("anthropic");
-      expect(getSecureKey("anthropic")).toBeUndefined();
-    });
-
-    test("listSecureKeys returns empty for keychain backend", () => {
-      setSecureKey("anthropic", "val");
-      // Keychain doesn't support listing
-      expect(listSecureKeys()).toEqual([]);
+    test("deleteSecureKey uses encrypted store even when broker is available", () => {
+      mockBrokerAvailable = true;
+      mockBrokerStore.set("api-key", "broker-value");
+      setSecureKey("api-key", "encrypted-value");
+      deleteSecureKey("api-key");
+      expect(getSecureKey("api-key")).toBeUndefined();
+      // Broker value should be untouched
+      expect(mockBrokerStore.has("api-key")).toBe(true);
     });
   });
 
   // -----------------------------------------------------------------------
-  // _setBackend
+  // Async variants — broker available path
   // -----------------------------------------------------------------------
-  describe("_setBackend", () => {
-    test("forces encrypted backend", () => {
-      _setBackend("encrypted");
-      setSecureKey("test", "value");
-      expect(existsSync(STORE_PATH)).toBe(true);
-      expect(keychainStore.has("test")).toBe(false);
+  describe("async variants with broker available", () => {
+    test("getSecureKeyAsync returns broker value when available", async () => {
+      mockBrokerAvailable = true;
+      mockBrokerStore.set("api-key", "broker-value");
+      setSecureKey("api-key", "encrypted-value");
+      expect(await getSecureKeyAsync("api-key")).toBe("broker-value");
     });
 
-    test("forces keychain backend", () => {
-      keychainAvailable = true;
-      _setBackend("keychain");
-      setSecureKey("test", "value");
-      expect(keychainStore.get("test")).toBe("value");
+    test("getSecureKeyAsync falls back to encrypted store when broker reports not-found", async () => {
+      mockBrokerAvailable = true;
+      // Broker has nothing for this key — returns { found: false }.
+      // Keys may exist only in the encrypted store (written while broker
+      // was unavailable or via sync setSecureKey), so we must fall back.
+      setSecureKey("api-key", "encrypted-value");
+      expect(await getSecureKeyAsync("api-key")).toBe("encrypted-value");
     });
 
-    test("reset re-evaluates backend", () => {
-      keychainAvailable = true;
-      _setBackend("keychain");
-      setSecureKey("k1", "v1");
-      expect(keychainStore.get("k1")).toBe("v1");
-
-      _setBackend(undefined); // reset
-      keychainAvailable = false;
-      setSecureKey("k2", "v2");
-      expect(keychainStore.has("k2")).toBe(false);
-      expect(getSecureKey("k2")).toBe("v2");
+    test("getSecureKeyAsync returns undefined when neither broker nor encrypted store has key", async () => {
+      mockBrokerAvailable = true;
+      // Neither store has the key — should return undefined
+      expect(await getSecureKeyAsync("missing-key")).toBeUndefined();
     });
-  });
 
-  // -----------------------------------------------------------------------
-  // Keychain runtime failure fallback
-  // -----------------------------------------------------------------------
-  describe("keychain runtime fallback", () => {
-    beforeEach(() => {
-      keychainAvailable = true;
-      _resetBackend();
+    test("getSecureKeyAsync falls back to encrypted store on broker error", async () => {
+      mockBrokerAvailable = true;
+      mockBrokerGetError = true;
+      setSecureKey("api-key", "encrypted-value");
+      expect(await getSecureKeyAsync("api-key")).toBe("encrypted-value");
     });
 
-    test("setSecureKey falls back to encrypted store when keychain fails at runtime", () => {
-      keychainFailAtRuntime = true;
-      const result = setSecureKey("anthropic", "sk-test-fallback");
+    test("setSecureKeyAsync writes to broker and encrypted store", async () => {
+      mockBrokerAvailable = true;
+      const result = await setSecureKeyAsync("api-key", "new-value");
       expect(result).toBe(true);
-      // Should have stored in encrypted store
-      expect(keychainStore.has("anthropic")).toBe(false);
-      expect(existsSync(STORE_PATH)).toBe(true);
-      // Subsequent gets should also use encrypted store now
-      expect(getSecureKey("anthropic")).toBe("sk-test-fallback");
+      expect(mockBrokerStore.get("api-key")).toBe("new-value");
+      // Also persisted to encrypted store for sync callers
+      expect(getSecureKey("api-key")).toBe("new-value");
     });
 
-    test("deleteSecureKey for nonexistent key does not downgrade backend", () => {
-      // Deleting a key that doesn't exist should NOT trigger a downgrade
-      const result = deleteSecureKey("nonexistent");
+    test("setSecureKeyAsync returns false on broker set error (no silent fallback)", async () => {
+      mockBrokerAvailable = true;
+      mockBrokerSetError = true;
+      const result = await setSecureKeyAsync("api-key", "new-value");
+      // Must return false — falling through to encrypted-only write would
+      // leave the broker with stale data that async readers still see.
       expect(result).toBe(false);
-      // Backend should still be keychain — verify by storing a new key
-      setSecureKey("anthropic", "sk-still-keychain");
-      expect(keychainStore.get("anthropic")).toBe("sk-still-keychain");
-      expect(existsSync(STORE_PATH)).toBe(false);
+      expect(mockBrokerStore.has("api-key")).toBe(false);
+      // Encrypted store should NOT have been written either.
+      expect(getSecureKey("api-key")).toBeUndefined();
     });
 
-    test("deleteSecureKey falls back to encrypted store when keychain fails at runtime", () => {
-      // First store successfully in encrypted store via fallback
-      keychainFailAtRuntime = true;
-      setSecureKey("openai", "sk-openai-test");
-      // Delete should also use encrypted store
-      const result = deleteSecureKey("openai");
-      expect(result).toBe(true);
-      expect(getSecureKey("openai")).toBeUndefined();
+    test("deleteSecureKeyAsync deletes from broker and encrypted store", async () => {
+      mockBrokerAvailable = true;
+      mockBrokerStore.set("api-key", "broker-value");
+      setSecureKey("api-key", "encrypted-value");
+      const result = await deleteSecureKeyAsync("api-key");
+      expect(result).toBe("deleted");
+      expect(mockBrokerStore.has("api-key")).toBe(false);
+      expect(getSecureKey("api-key")).toBeUndefined();
     });
 
-    test("deleteSecureKey triggers downgrade when key exists in keychain but keychain starts failing", () => {
-      // Step 1: Store a key while keychain is working
-      setSecureKey("anthropic", "sk-ant-exists");
-      expect(keychainStore.get("anthropic")).toBe("sk-ant-exists");
+    test("deleteSecureKeyAsync returns error on broker del error (no silent fallback)", async () => {
+      mockBrokerAvailable = true;
+      mockBrokerDelError = true;
+      setSecureKey("api-key", "encrypted-value");
+      const result = await deleteSecureKeyAsync("api-key");
+      // Must return "error" — falling through to encrypted-only delete would
+      // leave the broker with the key, and async readers would still see it.
+      expect(result).toBe("error");
+      // Encrypted store should NOT have been modified either.
+      expect(getSecureKey("api-key")).toBe("encrypted-value");
+    });
+  });
 
-      // Step 2: Keychain starts failing at runtime
-      keychainFailAtRuntime = true;
+  // -----------------------------------------------------------------------
+  // Async variants — broker unavailable path
+  // -----------------------------------------------------------------------
+  describe("async variants with broker unavailable", () => {
+    test("getSecureKeyAsync uses encrypted store", async () => {
+      setSecureKey("api-key", "encrypted-value");
+      expect(await getSecureKeyAsync("api-key")).toBe("encrypted-value");
+    });
 
-      // Step 3: Attempt to delete — should trigger fallback/downgrade
-      const result = deleteSecureKey("anthropic");
-      // deleteKey returns false because keychain is failing, and fallback
-      // encrypted store doesn't have the key, so the overall result is false.
-      // But the important thing is that the backend was downgraded.
-      expect(result).toBe(false);
+    test("getSecureKeyAsync returns undefined for missing key", async () => {
+      expect(await getSecureKeyAsync("missing")).toBeUndefined();
+    });
 
-      // Step 4: Verify the backend has been downgraded to encrypted store.
-      // Subsequent operations should use encrypted store.
-      keychainFailAtRuntime = false;
-      setSecureKey("openai", "sk-openai-new");
-      // Should be in encrypted store, not keychain
-      expect(keychainStore.has("openai")).toBe(false);
-      expect(getSecureKey("openai")).toBe("sk-openai-new");
+    test("setSecureKeyAsync uses encrypted store", async () => {
+      const result = await setSecureKeyAsync("api-key", "new-value");
+      expect(result).toBe(true);
+      expect(getSecureKey("api-key")).toBe("new-value");
     });
 
-    test("backend permanently downgrades after keychain runtime failure", () => {
-      // Start with working keychain
-      setSecureKey("anthropic", "key1");
-      expect(keychainStore.get("anthropic")).toBe("key1");
-
-      // Keychain starts failing
-      keychainFailAtRuntime = true;
-      setSecureKey("openai", "key2");
-
-      // Backend should now be encrypted — even if keychain "recovers"
-      keychainFailAtRuntime = false;
-      setSecureKey("gemini", "key3");
-      // gemini should be in encrypted store, not keychain
-      expect(keychainStore.has("gemini")).toBe(false);
-      expect(getSecureKey("gemini")).toBe("key3");
+    test("deleteSecureKeyAsync uses encrypted store", async () => {
+      setSecureKey("api-key", "value");
+      const result = await deleteSecureKeyAsync("api-key");
+      expect(result).toBe("deleted");
+      expect(getSecureKey("api-key")).toBeUndefined();
+    });
+  });
+
+  // -----------------------------------------------------------------------
+  // _setBackend / _resetBackend (no-ops kept for test compat)
+  // -----------------------------------------------------------------------
+  describe("_setBackend", () => {
+    test("_setBackend is a no-op but does not throw", () => {
+      _setBackend("encrypted");
+      setSecureKey("test", "value");
+      expect(existsSync(STORE_PATH)).toBe(true);
+    });
+
+    test("_resetBackend is a no-op but does not throw", () => {
+      _resetBackend();
+      setSecureKey("test", "value");
+      expect(getSecureKey("test")).toBe("value");
     });
   });
 });

package/src/__tests__/session-confirmation-signals.test.ts

@@ -85,7 +85,7 @@ mock.module("../config/loader.js", () => ({
     apiKeys: {},
     skills: { entries: {}, allowBundled: true },
     memory: { retrieval: { injectionStrategy: "inline" } },
-    permissions: { mode: "legacy" },
+    permissions: { mode: "workspace" },
   }),
   loadRawConfig: () => ({}),
   saveRawConfig: () => {},

package/src/__tests__/session-messaging-secret-redirect.test.ts

@@ -26,7 +26,7 @@ const metadataByKey = new Map<
 mock.module("../security/secure-keys.js", () => ({
   getSecureKey: () => undefined,
   setSecureKey: setSecureKeyMock,
-  deleteSecureKey: () => true,
+  deleteSecureKey: () => "deleted",
   listSecureKeys: () => [],
   getBackendType: () => null,
   isDowngradedFromKeychain: () => false,

package/src/__tests__/session-queue.test.ts

@@ -76,7 +76,8 @@ mock.module("../config/loader.js", () => ({
     apiKeys: {},
     skills: { entries: {}, allowBundled: true },
     memory: { retrieval: { injectionStrategy: "inline" } },
-    permissions: { mode: "legacy" },
+    permissions: { mode: "workspace" },
+    sandbox: { enabled: false },
     daemon: {
       startupSocketWaitMs: 5000,
       stopTimeoutMs: 5000,

package/src/__tests__/session-tool-setup-app-refresh.test.ts

@@ -520,7 +520,7 @@ describe("session-tool-setup app refresh side effects", () => {
   // ── app_create side effects ─────────────────────────────────────────
 
   describe("app_create side effects", () => {
-    test("broadcasts app_files_changed after app_create", async () => {
+    test("broadcasts app_files_changed immediately after app_create", async () => {
       const ctx = makeCtx();
       const executor = makeFakeExecutor({
         content: JSON.stringify({ id: "new-app-1", name: "My App" }),
@@ -539,7 +539,7 @@ describe("session-tool-setup app refresh side effects", () => {
 
       await toolFn("app_create", { name: "My App", html: "<h1>hi</h1>" });
 
-      expect(broadcastSpy).toHaveBeenCalledTimes(1);
+      expect(broadcastSpy.mock.calls.length).toBeGreaterThanOrEqual(1);
       expect((broadcastSpy.mock.calls as unknown[][])[0][0]).toEqual({
         type: "app_files_changed",
         appId: "new-app-1",

package/src/__tests__/skill-feature-flags-integration.test.ts

@@ -30,7 +30,10 @@ let currentConfig: Record<string, unknown> = {
 const DECLARED_SKILL_ID = "hatch-new-assistant";
 const DECLARED_FLAG_KEY = "feature_flags.hatch-new-assistant.enabled";
 
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const realPlatform = require("../util/platform.js");
 mock.module("../util/platform.js", () => ({
+  ...realPlatform,
   getRootDir: () => TEST_DIR,
   getDataDir: () => TEST_DIR,
   getWorkspaceDir: () => TEST_DIR,
@@ -54,31 +57,53 @@ mock.module("../util/platform.js", () => ({
   isWindows: () => false,
   getPlatformName: () => "linux",
   getClipboardCommand: () => null,
+  readSessionToken: () => null,
   removeSocketFile: () => {},
   migratePath: () => {},
   migrateToWorkspaceLayout: () => {},
   migrateToDataLayout: () => {},
 }));
 
+const noopLogger = new Proxy({} as Record<string, unknown>, {
+  get: (_target, prop) => (prop === "child" ? () => noopLogger : () => {}),
+});
+
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const realLogger = require("../util/logger.js");
 mock.module("../util/logger.js", () => ({
-  getLogger: () =>
-    new Proxy({} as Record<string, unknown>, {
-      get: () => () => {},
-    }),
+  ...realLogger,
+  getLogger: () => noopLogger,
+  getCliLogger: () => noopLogger,
   isDebug: () => false,
   truncateForLog: (v: string) => v,
+  initLogger: () => {},
+  pruneOldLogFiles: () => 0,
 }));
 
 mock.module("../config/loader.js", () => ({
   getConfig: () => currentConfig,
+  loadConfig: () => currentConfig,
+  loadRawConfig: () => ({}),
+  saveConfig: () => {},
+  saveRawConfig: () => {},
+  invalidateConfigCache: () => {},
+  getNestedValue: () => undefined,
+  setNestedValue: () => {},
+  syncConfigToLockfile: () => {},
 }));
 
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const realUserReference = require("../config/user-reference.js");
 mock.module("../config/user-reference.js", () => ({
+  ...realUserReference,
   resolveUserReference: () => "TestUser",
   resolveUserPronouns: () => null,
 }));
 
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const realCredentialMetadataStore = require("../tools/credentials/metadata-store.js");
 mock.module("../tools/credentials/metadata-store.js", () => ({
+  ...realCredentialMetadataStore,
   listCredentialMetadata: () => [],
 }));