@vellumai/assistant 0.5.1 → 0.5.3

package/src/__tests__/http-conversation-lineage.test.ts

@@ -0,0 +1,251 @@
+import { mkdtempSync, realpathSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
+
+const testDir = realpathSync(
+  mkdtempSync(join(tmpdir(), "http-conversation-lineage-test-")),
+);
+
+mock.module("../util/platform.js", () => ({
+  getRootDir: () => join(testDir, ".vellum"),
+  getDataDir: () => join(testDir, ".vellum", "workspace", "data"),
+  getWorkspaceDir: () => join(testDir, ".vellum", "workspace"),
+  getConversationsDir: () =>
+    join(testDir, ".vellum", "workspace", "conversations"),
+  isMacOS: () => process.platform === "darwin",
+  isLinux: () => process.platform === "linux",
+  isWindows: () => process.platform === "win32",
+  getPidPath: () => join(testDir, "test.pid"),
+  getDbPath: () => join(testDir, "test.db"),
+  getLogPath: () => join(testDir, "test.log"),
+  ensureDataDir: () => {},
+}));
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+mock.module("../config/env.js", () => ({
+  isHttpAuthDisabled: () => true,
+  hasUngatedHttpAuthDisabled: () => false,
+  getGatewayInternalBaseUrl: () => "http://127.0.0.1:7830",
+  getGatewayPort: () => 7830,
+  getRuntimeHttpPort: () => 7821,
+  getRuntimeHttpHost: () => "127.0.0.1",
+  getRuntimeGatewayOriginSecret: () => undefined,
+  getIngressPublicBaseUrl: () => undefined,
+  setIngressPublicBaseUrl: () => {},
+}));
+
+mock.module("../config/loader.js", () => ({
+  getConfig: () => ({
+    ui: {},
+    model: "test",
+    provider: "test",
+    memory: { enabled: false },
+    rateLimit: { maxRequestsPerMinute: 0 },
+    secretDetection: { enabled: false },
+  }),
+}));
+
+import {
+  batchSetDisplayOrders,
+  createConversation,
+  updateConversationTitle,
+} from "../memory/conversation-crud.js";
+import { getDb, initializeDb, rawRun, resetDb } from "../memory/db.js";
+import { RuntimeHttpServer } from "../runtime/http-server.js";
+
+initializeDb();
+
+type ConversationSummary = {
+  id: string;
+  title: string;
+  displayOrder?: number | null;
+  isPinned?: boolean;
+  forkParent?: {
+    conversationId: string;
+    messageId: string;
+    title: string;
+  };
+};
+
+describe("conversation lineage in HTTP reads", () => {
+  let server: RuntimeHttpServer | null = null;
+
+  beforeEach(async () => {
+    await server?.stop();
+    server = null;
+    clearTables();
+  });
+
+  afterAll(async () => {
+    await server?.stop();
+    resetDb();
+    try {
+      rmSync(testDir, { recursive: true, force: true });
+    } catch {
+      /* best effort */
+    }
+  });
+
+  test("GET /v1/conversations returns forkParent for surviving parents", async () => {
+    const { child, parent } = seedForkedConversation();
+    await startServer();
+
+    const response = await fetch(url("/conversations"));
+    expect(response.status).toBe(200);
+
+    const body = (await response.json()) as {
+      conversations: ConversationSummary[];
+      hasMore: boolean;
+    };
+    const listedChild = body.conversations.find((item) => item.id === child.id);
+
+    expect(listedChild).toMatchObject({
+      id: child.id,
+      title: child.title ?? "Untitled",
+      forkParent: {
+        conversationId: parent.id,
+        messageId: "parent-msg-1",
+        title: parent.title ?? "Untitled",
+      },
+    });
+    expect(body.hasMore).toBe(false);
+  });
+
+  test("GET /v1/conversations/:id returns forkParent for surviving parents", async () => {
+    const { child, parent } = seedForkedConversation();
+    await startServer();
+
+    const response = await fetch(url(`/conversations/${child.id}`));
+    expect(response.status).toBe(200);
+
+    const body = (await response.json()) as {
+      conversation: ConversationSummary;
+    };
+
+    expect(body.conversation).toMatchObject({
+      id: child.id,
+      title: child.title ?? "Untitled",
+      forkParent: {
+        conversationId: parent.id,
+        messageId: "parent-msg-1",
+        title: parent.title ?? "Untitled",
+      },
+    });
+  });
+
+  test("GET /v1/conversations/:id includes pin metadata when present", async () => {
+    const conversation = createConversation("Pinned conversation");
+    batchSetDisplayOrders([
+      { id: conversation.id, displayOrder: 7, isPinned: true },
+    ]);
+    await startServer();
+
+    const response = await fetch(url(`/conversations/${conversation.id}`));
+    expect(response.status).toBe(200);
+
+    const body = (await response.json()) as {
+      conversation: ConversationSummary;
+    };
+
+    expect(body.conversation).toMatchObject({
+      id: conversation.id,
+      title: conversation.title ?? "Untitled",
+      displayOrder: 7,
+      isPinned: true,
+    });
+  });
+
+  test("GET /v1/conversations/:id resolves the parent's current title at read time", async () => {
+    const { child, parent } = seedForkedConversation({
+      parentTitle: "Original parent title",
+    });
+    updateConversationTitle(parent.id, "Renamed parent title", 0);
+    await startServer();
+
+    const response = await fetch(url(`/conversations/${child.id}`));
+    expect(response.status).toBe(200);
+
+    const body = (await response.json()) as {
+      conversation: ConversationSummary;
+    };
+
+    expect(body.conversation.forkParent).toEqual({
+      conversationId: parent.id,
+      messageId: "parent-msg-1",
+      title: "Renamed parent title",
+    });
+  });
+
+  test("deleted parents are omitted from list and detail responses", async () => {
+    const { child, parent } = seedForkedConversation();
+    rawRun("DELETE FROM conversations WHERE id = ?", parent.id);
+    await startServer();
+
+    const listResponse = await fetch(url("/conversations"));
+    expect(listResponse.status).toBe(200);
+    const listBody = (await listResponse.json()) as {
+      conversations: ConversationSummary[];
+    };
+    const listedChild = listBody.conversations.find(
+      (item) => item.id === child.id,
+    );
+    expect(listedChild).toBeDefined();
+    expect(listedChild?.forkParent).toBeUndefined();
+
+    const detailResponse = await fetch(url(`/conversations/${child.id}`));
+    expect(detailResponse.status).toBe(200);
+    const detailBody = (await detailResponse.json()) as {
+      conversation: ConversationSummary;
+    };
+    expect(detailBody.conversation.forkParent).toBeUndefined();
+  });
+
+  function clearTables(): void {
+    const db = getDb();
+    db.run("DELETE FROM conversation_assistant_attention_state");
+    db.run("DELETE FROM external_conversation_bindings");
+    db.run("DELETE FROM conversation_keys");
+    db.run("DELETE FROM messages");
+    db.run("DELETE FROM conversations");
+  }
+
+  function seedForkedConversation(opts?: { parentTitle?: string }) {
+    const parent = createConversation(
+      opts?.parentTitle ?? "Parent conversation",
+    );
+    const child = createConversation("Forked conversation");
+
+    rawRun(
+      `
+        UPDATE conversations
+        SET fork_parent_conversation_id = ?, fork_parent_message_id = ?
+        WHERE id = ?
+      `,
+      parent.id,
+      "parent-msg-1",
+      child.id,
+    );
+
+    return { parent, child };
+  }
+
+  async function startServer(): Promise<void> {
+    server = new RuntimeHttpServer({
+      port: 0,
+      bearerToken: "test-bearer-token",
+    });
+    await server.start();
+  }
+
+  function url(pathname: string): string {
+    if (!server) throw new Error("server not started");
+    return `http://127.0.0.1:${server.actualPort}/v1${pathname}`;
+  }
+});

package/src/__tests__/image-source-path-reinject.test.ts

@@ -0,0 +1,136 @@
+import { describe, expect, test } from "bun:test";
+
+import { reinjectImageSourcePaths } from "../daemon/conversation-lifecycle.js";
+import type { ContentBlock } from "../providers/types.js";
+
+// ---------------------------------------------------------------------------
+// reinjectImageSourcePaths — re-inject [Attached image source: /path]
+// annotations when loading conversation history from DB
+// ---------------------------------------------------------------------------
+
+describe("reinjectImageSourcePaths", () => {
+  const baseContent: ContentBlock[] = [
+    { type: "text", text: "what is this?" },
+    {
+      type: "image",
+      source: { type: "base64", media_type: "image/jpeg", data: "base64img" },
+    },
+  ];
+
+  test("adds annotation when user message has imageSourcePaths in metadata", () => {
+    const metadata = JSON.stringify({
+      imageSourcePaths: { "photo.jpg": "/Users/me/Desktop/photo.jpg" },
+    });
+    const result = reinjectImageSourcePaths(baseContent, "user", metadata);
+
+    expect(result).toHaveLength(3);
+    const annotation = result[2] as { type: "text"; text: string };
+    expect(annotation.type).toBe("text");
+    expect(annotation.text).toBe(
+      "[Attached image source: /Users/me/Desktop/photo.jpg]",
+    );
+  });
+
+  test("does NOT annotate assistant messages even if metadata has imageSourcePaths", () => {
+    const metadata = JSON.stringify({
+      imageSourcePaths: { "photo.jpg": "/Users/me/Desktop/photo.jpg" },
+    });
+    const result = reinjectImageSourcePaths(baseContent, "assistant", metadata);
+
+    // Should return the original content unchanged
+    expect(result).toBe(baseContent);
+    expect(result).toHaveLength(2);
+  });
+
+  test("returns content unchanged when metadata is null", () => {
+    const result = reinjectImageSourcePaths(baseContent, "user", null);
+    expect(result).toBe(baseContent);
+    expect(result).toHaveLength(2);
+  });
+
+  test("returns content unchanged when metadata has no imageSourcePaths", () => {
+    const metadata = JSON.stringify({
+      userMessageChannel: "desktop",
+    });
+    const result = reinjectImageSourcePaths(baseContent, "user", metadata);
+    expect(result).toBe(baseContent);
+    expect(result).toHaveLength(2);
+  });
+
+  test("returns content unchanged when imageSourcePaths is empty object", () => {
+    const metadata = JSON.stringify({
+      imageSourcePaths: {},
+    });
+    const result = reinjectImageSourcePaths(baseContent, "user", metadata);
+    expect(result).toBe(baseContent);
+    expect(result).toHaveLength(2);
+  });
+
+  test("handles multiple image source paths", () => {
+    const metadata = JSON.stringify({
+      imageSourcePaths: {
+        "a.jpg": "/path/to/a.jpg",
+        "b.png": "/path/to/b.png",
+      },
+    });
+    const result = reinjectImageSourcePaths(baseContent, "user", metadata);
+
+    expect(result).toHaveLength(3);
+    const annotation = result[2] as { type: "text"; text: string };
+    expect(annotation.type).toBe("text");
+    expect(annotation.text).toBe(
+      "[Attached image source: /path/to/a.jpg]\n[Attached image source: /path/to/b.png]",
+    );
+  });
+
+  test("gracefully handles malformed metadata JSON", () => {
+    const result = reinjectImageSourcePaths(
+      baseContent,
+      "user",
+      "not-valid-json{{{",
+    );
+    // Should return original content, not throw
+    expect(result).toBe(baseContent);
+    expect(result).toHaveLength(2);
+  });
+
+  test("filters out non-string values in imageSourcePaths", () => {
+    const metadata = JSON.stringify({
+      imageSourcePaths: {
+        "photo.jpg": "/Users/me/Desktop/photo.jpg",
+        "bad.jpg": 42,
+        "also_bad.jpg": null,
+      },
+    });
+    const result = reinjectImageSourcePaths(baseContent, "user", metadata);
+
+    expect(result).toHaveLength(3);
+    const annotation = result[2] as { type: "text"; text: string };
+    expect(annotation.text).toBe(
+      "[Attached image source: /Users/me/Desktop/photo.jpg]",
+    );
+  });
+
+  test("returns content unchanged when imageSourcePaths has only non-string values", () => {
+    const metadata = JSON.stringify({
+      imageSourcePaths: {
+        "bad.jpg": 42,
+        "also_bad.jpg": null,
+      },
+    });
+    const result = reinjectImageSourcePaths(baseContent, "user", metadata);
+    expect(result).toBe(baseContent);
+    expect(result).toHaveLength(2);
+  });
+
+  test("preserves original content blocks in returned array", () => {
+    const metadata = JSON.stringify({
+      imageSourcePaths: { "photo.jpg": "/path/photo.jpg" },
+    });
+    const result = reinjectImageSourcePaths(baseContent, "user", metadata);
+
+    // First two blocks should be identical to the originals
+    expect(result[0]).toEqual(baseContent[0]);
+    expect(result[1]).toEqual(baseContent[1]);
+  });
+});

package/src/__tests__/inline-command-runner.test.ts

@@ -0,0 +1,311 @@
+import { describe, expect, mock, test } from "bun:test";
+
+import type { InlineCommandResult } from "../skills/inline-command-runner.js";
+
+// ---------------------------------------------------------------------------
+// Mocks — must be declared before the module under test is imported
+// ---------------------------------------------------------------------------
+
+const mockConfig = {
+  provider: "anthropic",
+  model: "test",
+  maxTokens: 4096,
+  dataDir: "/tmp",
+  sandbox: { enabled: true },
+  timeouts: {
+    shellDefaultTimeoutSec: 120,
+    shellMaxTimeoutSec: 600,
+    permissionTimeoutSec: 300,
+  },
+  rateLimit: { maxRequestsPerMinute: 0 },
+  secretDetection: {
+    enabled: true,
+    action: "warn" as const,
+    entropyThreshold: 4.0,
+  },
+  auditLog: { retentionDays: 0 },
+};
+
+mock.module("../config/loader.js", () => ({
+  getConfig: () => mockConfig,
+  loadConfig: () => mockConfig,
+  invalidateConfigCache: () => {},
+  saveConfig: () => {},
+  loadRawConfig: () => ({}),
+  saveRawConfig: () => {},
+  getNestedValue: () => undefined,
+  setNestedValue: () => {},
+}));
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+// Track wrapCommand calls to verify sandbox-only execution
+let lastWrapCall: {
+  command: string;
+  workingDir: string;
+  config: { enabled: boolean };
+  options?: { networkMode?: string };
+} | null = null;
+
+mock.module("../tools/terminal/sandbox.js", () => ({
+  wrapCommand: (
+    command: string,
+    workingDir: string,
+    config: { enabled: boolean },
+    options?: { networkMode?: string },
+  ) => {
+    lastWrapCall = { command, workingDir, config, options };
+    return {
+      command: "bash",
+      args: ["-c", "--", command],
+      sandboxed: false,
+    };
+  },
+}));
+
+mock.module("../tools/terminal/safe-env.js", () => ({
+  buildSanitizedEnv: () => ({
+    PATH: process.env.PATH ?? "/usr/bin:/bin",
+    HOME: process.env.HOME ?? "/tmp",
+  }),
+}));
+
+import { runInlineCommand } from "../skills/inline-command-runner.js";
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+const CWD = process.cwd();
+
+function expectOk(result: InlineCommandResult): void {
+  expect(result.ok).toBe(true);
+  expect(result.failureReason).toBeUndefined();
+}
+
+function expectFailure(
+  result: InlineCommandResult,
+  reason: InlineCommandResult["failureReason"],
+): void {
+  expect(result.ok).toBe(false);
+  expect(result.failureReason).toBe(reason);
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("runInlineCommand", () => {
+  // ── Sandbox enforcement ──────────────────────────────────────────────────
+
+  describe("sandbox enforcement", () => {
+    test("always passes sandbox config with enabled=true", async () => {
+      lastWrapCall = null;
+      await runInlineCommand("echo sandbox-check", CWD);
+
+      expect(lastWrapCall).not.toBeNull();
+      expect(lastWrapCall!.config.enabled).toBe(true);
+    });
+
+    test("always passes networkMode=off", async () => {
+      lastWrapCall = null;
+      await runInlineCommand("echo network-check", CWD);
+
+      expect(lastWrapCall).not.toBeNull();
+      expect(lastWrapCall!.options?.networkMode).toBe("off");
+    });
+
+    test("uses the provided workingDir as cwd", async () => {
+      lastWrapCall = null;
+      const customDir = "/tmp/my-project";
+      await runInlineCommand("echo cwd-check", customDir);
+
+      expect(lastWrapCall).not.toBeNull();
+      expect(lastWrapCall!.workingDir).toBe(customDir);
+    });
+
+    test("passes the literal command string to the sandbox", async () => {
+      lastWrapCall = null;
+      await runInlineCommand("git log --oneline -n 5", CWD);
+
+      expect(lastWrapCall).not.toBeNull();
+      expect(lastWrapCall!.command).toBe("git log --oneline -n 5");
+    });
+  });
+
+  // ── Successful execution ─────────────────────────────────────────────────
+
+  describe("successful execution", () => {
+    test("captures stdout from a simple echo", async () => {
+      const result = await runInlineCommand("echo hello-world", CWD);
+
+      expectOk(result);
+      expect(result.output).toBe("hello-world");
+    });
+
+    test("captures multi-line stdout", async () => {
+      const result = await runInlineCommand(
+        "printf 'line1\\nline2\\nline3'",
+        CWD,
+      );
+
+      expectOk(result);
+      expect(result.output).toContain("line1");
+      expect(result.output).toContain("line2");
+      expect(result.output).toContain("line3");
+    });
+
+    test("returns empty string for command with no output", async () => {
+      const result = await runInlineCommand("true", CWD);
+
+      expectOk(result);
+      expect(result.output).toBe("");
+    });
+  });
+
+  // ── ANSI stripping ──────────────────────────────────────────────────────
+
+  describe("ANSI stripping", () => {
+    test("strips SGR color codes from output", async () => {
+      const result = await runInlineCommand(
+        "printf '\\033[31mred\\033[0m normal'",
+        CWD,
+      );
+
+      expectOk(result);
+      expect(result.output).toBe("red normal");
+      expect(result.output).not.toContain("\x1b");
+    });
+
+    test("strips cursor movement sequences", async () => {
+      const result = await runInlineCommand("printf '\\033[2Ahello'", CWD);
+
+      expectOk(result);
+      expect(result.output).toBe("hello");
+    });
+  });
+
+  // ── Binary output rejection ──────────────────────────────────────────────
+
+  describe("binary output rejection", () => {
+    test("rejects binary-ish output", async () => {
+      // Generate output with >10% control characters
+      const result = await runInlineCommand(
+        "printf '\\x00\\x01\\x02\\x03\\x04\\x05\\x06\\x07abc'",
+        CWD,
+      );
+
+      expectFailure(result, "binary_output");
+      expect(result.output).toBe("Inline command produced binary output.");
+    });
+  });
+
+  // ── Output clamping ──────────────────────────────────────────────────────
+
+  describe("output clamping", () => {
+    test("truncates output exceeding the cap", async () => {
+      // Generate output larger than a small cap
+      const result = await runInlineCommand("printf '%0.s-' {1..200}", CWD, {
+        maxOutputChars: 50,
+      });
+
+      expectOk(result);
+      expect(result.output.length).toBeLessThanOrEqual(
+        50 + "\n[output truncated]".length,
+      );
+      expect(result.output).toContain("[output truncated]");
+    });
+
+    test("does not truncate output under the cap", async () => {
+      const result = await runInlineCommand("echo short", CWD, {
+        maxOutputChars: 1000,
+      });
+
+      expectOk(result);
+      expect(result.output).toBe("short");
+      expect(result.output).not.toContain("[output truncated]");
+    });
+  });
+
+  // ── Timeout handling ─────────────────────────────────────────────────────
+
+  describe("timeout handling", () => {
+    test("produces deterministic timeout result", async () => {
+      const result = await runInlineCommand("sleep 60", CWD, {
+        timeoutMs: 200,
+      });
+
+      expectFailure(result, "timeout");
+      expect(result.output).toBe("Inline command timed out after 200ms.");
+    });
+  });
+
+  // ── Non-zero exit ────────────────────────────────────────────────────────
+
+  describe("non-zero exit", () => {
+    test("produces deterministic failure for exit code 1", async () => {
+      const result = await runInlineCommand("exit 1", CWD);
+
+      expectFailure(result, "non_zero_exit");
+      expect(result.output).toBe("Inline command failed (exit code 1).");
+    });
+
+    test("produces deterministic failure for exit code 127", async () => {
+      const result = await runInlineCommand(
+        "nonexistent_command_that_does_not_exist_xyz",
+        CWD,
+      );
+
+      expectFailure(result, "non_zero_exit");
+      expect(result.output).toMatch(
+        /Inline command failed \(exit code \d+\)\./,
+      );
+    });
+
+    test("does not expose stderr in the error result", async () => {
+      const result = await runInlineCommand("echo err-msg >&2 && exit 1", CWD);
+
+      expectFailure(result, "non_zero_exit");
+      expect(result.output).not.toContain("err-msg");
+      expect(result.output).toBe("Inline command failed (exit code 1).");
+    });
+  });
+
+  // ── Spawn failures ───────────────────────────────────────────────────────
+
+  describe("spawn failures", () => {
+    test("returns spawn_failure when cwd does not exist", async () => {
+      // When the working directory doesn't exist, the child process fails to
+      // start (ENOENT from posix_spawn). The runner should catch this and
+      // return a deterministic spawn_failure result.
+      const result = await runInlineCommand(
+        "echo hello",
+        "/nonexistent/path/that/does/not/exist",
+      );
+
+      expectFailure(result, "spawn_failure");
+      expect(result.output).toBe("Inline command could not be started.");
+    });
+  });
+
+  // ── stderr suppression ─────────────────────────────────────────────────
+
+  describe("stderr suppression", () => {
+    test("does not include stderr in successful output", async () => {
+      const result = await runInlineCommand(
+        "echo stdout-only && echo stderr-msg >&2",
+        CWD,
+      );
+
+      // Command may succeed (exit 0) — stderr should not leak into output
+      expectOk(result);
+      expect(result.output).toBe("stdout-only");
+      expect(result.output).not.toContain("stderr-msg");
+    });
+  });
+});