@vellumai/assistant 0.5.13 → 0.5.15

package/src/cli/commands/platform/__tests__/connect.test.ts

@@ -1,4 +1,4 @@
-import { mkdtempSync } from "node:fs";
+import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { beforeEach, describe, expect, mock, test } from "bun:test";
@@ -21,7 +21,7 @@ mock.module("../../../lib/daemon-credential-client.js", () => ({
   getSecureKeyViaDaemon: (account: string) =>
     mockGetSecureKeyViaDaemon(account),
   deleteSecureKeyViaDaemon: async () => "not-found" as const,
-  setSecureKeyViaDaemon: async () => false,
+  setSecureKeyViaDaemon: async () => true,
   getProviderKeyViaDaemon: async () => undefined,
   getSecureKeyResultViaDaemon: async () => ({
     value: undefined,
@@ -97,6 +97,14 @@ mock.module("../../../../util/platform.js", () => ({
   getLogPath: () => join(testDir, "test.log"),
   getWorkspaceDirDisplay: () => testDir,
   getWorkspacePromptPath: (file: string) => join(testDir, file),
+  getProtectedDir: () => join(testDir, "protected"),
+  getDeprecatedDir: () => join(testDir, "workspace", "deprecated"),
+  getExternalDir: () => join(testDir, "external"),
+  getBinDir: () => join(testDir, "bin"),
+  getDotEnvPath: () => join(testDir, ".env"),
+  getDaemonStderrLogPath: () => join(testDir, "daemon-stderr.log"),
+  getDaemonStartupLockPath: () => join(testDir, "daemon-startup.lock"),
+  getEmbedWorkerPidPath: () => join(testDir, "embed-worker.pid"),
   ensureDataDir: () => {},
 }));
 
@@ -175,50 +183,68 @@ describe("assistant platform connect", () => {
   beforeEach(() => {
     mockGetSecureKeyViaDaemon = async () => undefined;
     process.exitCode = 0;
+    // Remove any signal file left by previous tests
+    try {
+      rmSync(join(testDir, "signals"), { recursive: true, force: true });
+    } catch {
+      // ignore
+    }
   });
 
-  test.todo(
-    "already connected returns success with existing base URL",
-    async () => {
-      /**
-       * When the assistant already has stored platform credentials (base
-       * URL and API key), the connect command should short-circuit and
-       * report that it is already connected, returning the existing base
-       * URL.
-       *
-       * NOTE: The connect command is currently stubbed — the full
-       * credential-collection flow via a secure UI component is not yet
-       * implemented. This test validates the already-connected early-exit
-       * path, which IS implemented. It is skipped because the stub path
-       * still sets a non-zero exit code before reaching this branch
-       * under certain conditions. Unskip once the full connect flow
-       * lands.
-       */
-
-      // GIVEN stored platform credentials already exist
-      mockGetSecureKeyViaDaemon = async (account: string) => {
-        if (account === "credential/vellum/platform_base_url")
-          return "https://platform.vellum.ai";
-        if (account === "credential/vellum/assistant_api_key")
-          return "sk-existing-key";
-        return undefined;
-      };
-
-      // WHEN the connect command is run with --json
-      const { exitCode, stdout } = await runCommand([
-        "platform",
-        "connect",
-        "--json",
-      ]);
-
-      // THEN the command succeeds
-      expect(exitCode).toBe(0);
-
-      // AND the output indicates already connected with the base URL
-      const parsed = JSON.parse(stdout);
-      expect(parsed.ok).toBe(true);
-      expect(parsed.alreadyConnected).toBe(true);
-      expect(parsed.baseUrl).toBe("https://platform.vellum.ai");
-    },
-  );
+  test("writes emit-event signal file and reports success", async () => {
+    // GIVEN no existing platform credentials
+    mockGetSecureKeyViaDaemon = async () => undefined;
+
+    // WHEN the connect command is run with --json
+    const { exitCode, stdout } = await runCommand([
+      "platform",
+      "connect",
+      "--json",
+    ]);
+
+    // THEN the command succeeds
+    expect(exitCode).toBe(0);
+
+    // AND the output confirms the login UI was triggered
+    const parsed = JSON.parse(stdout);
+    expect(parsed.ok).toBe(true);
+    expect(parsed.showPlatformLogin).toBe(true);
+
+    // AND a show_platform_login emit-event signal file was written
+    const signalPath = join(testDir, "signals", "emit-event");
+    expect(existsSync(signalPath)).toBe(true);
+    const payload = JSON.parse(readFileSync(signalPath, "utf-8"));
+    expect(payload).toEqual({ type: "show_platform_login" });
+  });
+
+  test("already connected returns success with existing base URL", async () => {
+    // GIVEN stored platform credentials already exist
+    mockGetSecureKeyViaDaemon = async (account: string) => {
+      if (account === "credential/vellum/platform_base_url")
+        return "https://platform.vellum.ai";
+      if (account === "credential/vellum/assistant_api_key")
+        return "sk-existing-key";
+      return undefined;
+    };
+
+    // WHEN the connect command is run with --json
+    const { exitCode, stdout } = await runCommand([
+      "platform",
+      "connect",
+      "--json",
+    ]);
+
+    // THEN the command succeeds
+    expect(exitCode).toBe(0);
+
+    // AND the output indicates already connected with the base URL
+    const parsed = JSON.parse(stdout);
+    expect(parsed.ok).toBe(true);
+    expect(parsed.alreadyConnected).toBe(true);
+    expect(parsed.baseUrl).toBe("https://platform.vellum.ai");
+
+    // AND no emit-event signal file was written
+    const signalPath = join(testDir, "signals", "emit-event");
+    expect(existsSync(signalPath)).toBe(false);
+  });
 });

package/src/cli/commands/platform/__tests__/disconnect.test.ts

@@ -1,4 +1,4 @@
-import { mkdtempSync } from "node:fs";
+import { existsSync, mkdtempSync, readFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { beforeEach, describe, expect, mock, test } from "bun:test";
@@ -21,10 +21,20 @@ let mockDeleteSecureKeyViaDaemonCalls: Array<{
 let mockDeleteSecureKeyViaDaemonResult: "deleted" | "not-found" | "error" =
   "deleted";
 
+let mockIsPlatformRemote = false;
+
 // ---------------------------------------------------------------------------
 // Mocks
 // ---------------------------------------------------------------------------
 
+mock.module("../../../../config/env-registry.js", () => ({
+  getIsContainerized: () => false,
+  isPlatformRemote: () => mockIsPlatformRemote,
+  getDebugStdoutLogs: () => false,
+  getWorkspaceDirOverride: () => undefined,
+  checkUnrecognizedEnvVars: () => [],
+}));
+
 mock.module("../../../../inbound/platform-callback-registration.js", () => ({
   resolvePlatformCallbackRegistrationContext: async () => ({
     containerized: false,
@@ -82,7 +92,15 @@ mock.module("../../../../util/platform.js", () => ({
   getWorkspaceHooksDir: () => join(testDir, "workspace", "hooks"),
   getWorkspaceConfigPath: () => join(testDir, "workspace", "config.json"),
   getHooksDir: () => join(testDir, "hooks"),
+  getProtectedDir: () => join(testDir, "protected"),
+  getDeprecatedDir: () => join(testDir, "workspace", "deprecated"),
   getSignalsDir: () => join(testDir, "signals"),
+  getDaemonStderrLogPath: () => join(testDir, "daemon-stderr.log"),
+  getDaemonStartupLockPath: () => join(testDir, "daemon-startup.lock"),
+  getExternalDir: () => join(testDir, "external"),
+  getBinDir: () => join(testDir, "bin"),
+  getDotEnvPath: () => join(testDir, ".env"),
+  getEmbedWorkerPidPath: () => join(testDir, "embed-worker.pid"),
   getConversationsDir: () => join(testDir, "conversations"),
   getEmbeddingModelsDir: () => join(testDir, "models"),
   getSandboxRootDir: () => join(testDir, "sandbox"),
@@ -187,6 +205,7 @@ describe("assistant platform disconnect", () => {
     mockGetSecureKeyViaDaemon = async () => undefined;
     mockDeleteSecureKeyViaDaemonCalls = [];
     mockDeleteSecureKeyViaDaemonResult = "deleted";
+    mockIsPlatformRemote = false;
     process.exitCode = 0;
   });
 
@@ -233,5 +252,39 @@ describe("assistant platform disconnect", () => {
     expect(deletedNames).toContain("vellum:platform_assistant_id");
     expect(deletedNames).toContain("vellum:platform_organization_id");
     expect(deletedNames).toContain("vellum:platform_user_id");
+
+    // AND a platform_disconnected signal was emitted for connected clients
+    const signalPath = join(testDir, "signals", "emit-event");
+    expect(existsSync(signalPath)).toBe(true);
+    const signal = JSON.parse(readFileSync(signalPath, "utf-8"));
+    expect(signal).toEqual({ type: "platform_disconnected" });
+  });
+
+  test("rejects with error when running on a platform-hosted assistant", async () => {
+    /**
+     * Platform-hosted (containerized) assistants are managed by the platform
+     * and should not allow manual disconnect via the CLI.
+     */
+
+    // GIVEN the assistant is running inside a platform host
+    mockIsPlatformRemote = true;
+
+    // WHEN the disconnect command is run with --json
+    const { exitCode, stdout } = await runCommand([
+      "platform",
+      "disconnect",
+      "--json",
+    ]);
+
+    // THEN the command fails
+    expect(exitCode).toBe(1);
+
+    // AND the error message explains why
+    const parsed = JSON.parse(stdout);
+    expect(parsed.ok).toBe(false);
+    expect(parsed.error).toContain("platform-hosted");
+
+    // AND no credentials were deleted
+    expect(mockDeleteSecureKeyViaDaemonCalls).toHaveLength(0);
   });
 });

package/src/cli/commands/platform/__tests__/status.test.ts

@@ -102,6 +102,14 @@ mock.module("../../../../util/platform.js", () => ({
   getLogPath: () => join(testDir, "test.log"),
   getWorkspaceDirDisplay: () => testDir,
   getWorkspacePromptPath: (file: string) => join(testDir, file),
+  getProtectedDir: () => join(testDir, "protected"),
+  getDeprecatedDir: () => join(testDir, "workspace", "deprecated"),
+  getExternalDir: () => join(testDir, "external"),
+  getBinDir: () => join(testDir, "bin"),
+  getDotEnvPath: () => join(testDir, ".env"),
+  getDaemonStderrLogPath: () => join(testDir, "daemon-stderr.log"),
+  getDaemonStartupLockPath: () => join(testDir, "daemon-startup.lock"),
+  getEmbedWorkerPidPath: () => join(testDir, "embed-worker.pid"),
   ensureDataDir: () => {},
 }));
 
@@ -243,4 +251,32 @@ describe("assistant platform status", () => {
     expect(parsed.organizationId).toBe("org-456");
     expect(parsed.userId).toBe("user-789");
   });
+
+  test("plain text mode does not emit JSON to stdout", async () => {
+    /**
+     * Without --json, the status command should only produce log output
+     * (via the CLI logger) and NOT write JSON to stdout. Previously both
+     * JSON and plain text were emitted, duplicating the information.
+     */
+
+    // GIVEN a disconnected environment with no stored credentials
+    mockResolvePlatformCallbackRegistrationContext = async () => ({
+      containerized: false,
+      platformBaseUrl: "",
+      assistantId: "",
+      hasInternalApiKey: false,
+      hasAssistantApiKey: false,
+      authHeader: null,
+      enabled: false,
+    });
+
+    // WHEN the status command is run without --json
+    const { exitCode, stdout } = await runCommand(["platform", "status"]);
+
+    // THEN the command succeeds
+    expect(exitCode).toBe(0);
+
+    // AND stdout contains no JSON (writeOutput is skipped in plain text mode)
+    expect(stdout.trim()).toBe("");
+  });
 });

package/src/cli/commands/platform/connect.ts

@@ -1,6 +1,10 @@
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
 import type { Command } from "commander";
 
 import { credentialKey } from "../../../security/credential-key.js";
+import { getSignalsDir } from "../../../util/platform.js";
 import { getSecureKeyViaDaemon } from "../../lib/daemon-credential-client.js";
 import { getCliLogger } from "../../logger.js";
 import { shouldOutputJson, writeOutput } from "../../output.js";
@@ -32,8 +36,8 @@ export function registerPlatformConnectCommand(platform: Command): void {
     .addHelpText(
       "after",
       `
-Initiates a platform connection flow. Credentials are collected via a secure
-UI component rendered by the assistant client.
+Initiates a platform connection flow. Emits a signal for connected clients
+to show a platform login UI where the user can sign in and store credentials.
 
 Use 'assistant platform status' to check the current connection state and
 'assistant platform disconnect' to remove stored credentials.
@@ -83,15 +87,21 @@ Examples:
           return;
         }
 
-        // TODO: Send a UI component to collect credentials from the user
-        writeError(
-          "Platform connect UI component not yet implemented. " +
-            "Credentials will be collected via a secure client-side flow.",
+        // Emit a signal for the daemon to show the platform login UI
+        // on connected clients.
+        const signalsDir = getSignalsDir();
+        mkdirSync(signalsDir, { recursive: true });
+        writeFileSync(
+          join(signalsDir, "emit-event"),
+          JSON.stringify({ type: "show_platform_login" }),
         );
 
+        writeOutput(cmd, { ok: true, showPlatformLogin: true });
+
         if (!jsonMode) {
           log.info(
-            "Platform connect will be available once the client-side credential flow is implemented.",
+            "Showing the platform login screen on connected clients. " +
+              "Please complete the sign-in flow in the app.",
           );
         }
       } catch (err) {

package/src/cli/commands/platform/disconnect.ts

@@ -1,6 +1,11 @@
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
 import type { Command } from "commander";
 
+import { isPlatformRemote } from "../../../config/env-registry.js";
 import { credentialKey } from "../../../security/credential-key.js";
+import { getSignalsDir } from "../../../util/platform.js";
 import {
   deleteSecureKeyViaDaemon,
   getSecureKeyViaDaemon,
@@ -46,7 +51,17 @@ Examples:
 
       try {
         // ---------------------------------------------------------------
-        // 1. Check if connected
+        // 1. Reject if running inside a platform host
+        // ---------------------------------------------------------------
+        if (isPlatformRemote()) {
+          writeError(
+            "Cannot disconnect from the platform on a platform-hosted assistant.",
+          );
+          return;
+        }
+
+        // ---------------------------------------------------------------
+        // 2. Check if connected
         // ---------------------------------------------------------------
         const baseUrl = await getSecureKeyViaDaemon(
           credentialKey(
@@ -70,7 +85,7 @@ Examples:
         }
 
         // ---------------------------------------------------------------
-        // 2. Delete all platform credentials
+        // 3. Delete all platform credentials
         // ---------------------------------------------------------------
         const keysToDelete = [
           CREDENTIAL_KEYS.baseUrl,
@@ -97,7 +112,17 @@ Examples:
         }
 
         // ---------------------------------------------------------------
-        // 3. Output result
+        // 4. Notify connected clients
+        // ---------------------------------------------------------------
+        const signalsDir = getSignalsDir();
+        mkdirSync(signalsDir, { recursive: true });
+        writeFileSync(
+          join(signalsDir, "emit-event"),
+          JSON.stringify({ type: "platform_disconnected" }),
+        );
+
+        // ---------------------------------------------------------------
+        // 5. Output result
         // ---------------------------------------------------------------
         writeOutput(cmd, {
           ok: true,

package/src/cli/commands/platform/index.ts

@@ -123,9 +123,9 @@ Examples:
           userId: userId || null,
         };
 
-        writeOutput(cmd, result);
-
-        if (!shouldOutputJson(cmd)) {
+        if (shouldOutputJson(cmd)) {
+          writeOutput(cmd, result);
+        } else {
           log.info(`Containerized: ${result.containerized}`);
           log.info(`Base URL: ${result.baseUrl || "(not set)"}`);
           log.info(`Assistant ID: ${result.assistantId || "(not set)"}`);