@vellumai/assistant 0.5.6 → 0.5.7

package/src/__tests__/provider-managed-proxy-integration.test.ts

@@ -193,13 +193,12 @@ describe("managed proxy integration — credential precedence", () => {
 
       const provider = getProvider("anthropic");
 
-      // Unwrap RetryProvider → LogfireProvider → AnthropicProvider to inspect
-      // the Anthropic SDK client's baseURL. The wrappers use private `inner`
-      // and AnthropicProvider stores the SDK client as private `client`.
+      // Unwrap RetryProvider → AnthropicProvider to inspect the Anthropic
+      // SDK client's baseURL. RetryProvider stores the inner provider as
+      // private `inner` and AnthropicProvider stores the SDK client as
+      // private `client`.
       const retryInner = (provider as any).inner;
-      // retryInner is the logfire wrapper; it also has an `inner` property
-      const logfireInner = (retryInner as any).inner ?? retryInner;
-      const anthropicClient = (logfireInner as any).client;
+      const anthropicClient = (retryInner as any).client;
 
       expect(anthropicClient).toBeDefined();
       const baseURL: string = anthropicClient.baseURL;

package/src/__tests__/qdrant-manager.test.ts

@@ -312,9 +312,10 @@ describe("QdrantManager", () => {
       expect(existsSync(pidPath)).toBe(false);
     }, 10_000);
 
-    test("cleans up when process exits immediately", async () => {
+    test("fails fast with exit code when process exits immediately", async () => {
       const pidPath = join(testDataDir, "qdrant", "qdrant.pid");
 
+      // GIVEN a Qdrant binary that exits immediately with code 1
       placeFakeBinary("#!/bin/sh\nexit 1");
 
       const port = getTestPort();
@@ -323,9 +324,34 @@ describe("QdrantManager", () => {
         ...FAST_TIMEOUTS,
       });
 
-      await expect(mgr.start()).rejects.toThrow("did not become ready");
+      // WHEN we start the manager
+      const startTime = Date.now();
+      await expect(mgr.start()).rejects.toThrow(
+        /exited with code \d+ before becoming ready/,
+      );
+      const elapsed = Date.now() - startTime;
+
+      // THEN it fails fast (well under the 100ms readyz timeout)
+      expect(elapsed).toBeLessThan(FAST_TIMEOUTS.readyzTimeoutMs);
+
+      // AND the PID file is cleaned up
       expect(existsSync(pidPath)).toBe(false);
     }, 10_000);
+
+    test("includes stderr in error when process crashes", async () => {
+      // GIVEN a Qdrant binary that writes to stderr before crashing
+      placeFakeBinary('#!/bin/sh\necho "fatal: storage corrupted" >&2\nexit 1');
+
+      const port = getTestPort();
+      const mgr = new QdrantManager({
+        url: `http://127.0.0.1:${port}`,
+        ...FAST_TIMEOUTS,
+      });
+
+      // WHEN we start the manager
+      // THEN the error includes the stderr output
+      await expect(mgr.start()).rejects.toThrow("storage corrupted");
+    }, 10_000);
   });
 
   // ── Binary Detection ─────────────────────────────────────────

package/src/__tests__/registry.test.ts

@@ -173,12 +173,6 @@ describe("baseline characterization: hardcoded tool loading", () => {
       expect(eagerModuleToolNames).not.toContain(name);
     }
   });
-
-  test("claude_code is NOT in global registry after initializeTools()", async () => {
-    await initializeTools();
-    const tool = getTool("claude_code");
-    expect(tool).toBeUndefined();
-  });
 });
 
 describe("baseline characterization: core app tool surface", () => {

package/src/__tests__/runtime-attachment-metadata.test.ts

@@ -47,10 +47,6 @@ mock.module("../config/loader.js", () => ({
   }),
 }));
 
-mock.module("../security/secret-ingress.js", () => ({
-  checkIngressForSecrets: () => ({ blocked: false }),
-}));
-
 import { upsertContact } from "../contacts/contact-store.js";
 import {
   linkAttachmentToMessage,

package/src/__tests__/secret-routes-managed-proxy.test.ts

@@ -75,10 +75,6 @@ mock.module("../config/loader.js", () => ({
   invalidateConfigCache: () => {},
 }));
 
-mock.module("../logfire.js", () => ({
-  wrapWithLogfire: (provider: unknown) => provider,
-}));
-
 mock.module("../security/secure-keys.js", () => ({
   getSecureKeyAsync: async (key: string) => secureKeyStore[key],
   setSecureKeyAsync: async (key: string, value: string) => {

package/src/__tests__/secure-keys.test.ts

@@ -23,58 +23,13 @@ mock.module("../util/logger.js", () => ({
     }),
 }));
 
-// ---------------------------------------------------------------------------
-// Broker client mock — set up before importing secure-keys so the
-// module-level `createBrokerClient()` call picks up our mock.
-// ---------------------------------------------------------------------------
-
-let mockBrokerAvailable = false;
-let mockBrokerStore: Map<string, string> = new Map();
-let mockBrokerGetError = false;
-let mockBrokerSetError = false;
-let mockBrokerDelError = false;
-let mockBrokerGetCalled = false;
-let mockBrokerSetCalled = false;
-
-mock.module("../security/keychain-broker-client.js", () => ({
-  createBrokerClient: () => ({
-    isAvailable: () => mockBrokerAvailable,
-    ping: async () => (mockBrokerAvailable ? { pong: true } : null),
-    get: async (account: string) => {
-      mockBrokerGetCalled = true;
-      // null = broker error (fall back to encrypted store)
-      if (mockBrokerGetError) return null;
-      const value = mockBrokerStore.get(account);
-      if (value !== undefined) return { found: true, value };
-      return { found: false };
-    },
-    set: async (account: string, value: string) => {
-      mockBrokerSetCalled = true;
-      if (mockBrokerSetError)
-        return {
-          status: "rejected" as const,
-          code: "KEYCHAIN_ERROR",
-          message: "mock error",
-        };
-      mockBrokerStore.set(account, value);
-      return { status: "ok" as const };
-    },
-    del: async (account: string) => {
-      if (mockBrokerDelError) return false;
-      const existed = mockBrokerStore.has(account);
-      mockBrokerStore.delete(account);
-      return existed;
-    },
-    list: async () => Array.from(mockBrokerStore.keys()),
-  }),
-}));
-
 import * as encryptedStore from "../security/encrypted-store.js";
 import { _setStorePath } from "../security/encrypted-store.js";
 import {
   _resetBackend,
   deleteSecureKeyAsync,
   getSecureKeyAsync,
+  getSecureKeyResultAsync,
   listSecureKeysAsync,
   setSecureKeyAsync,
 } from "../security/secure-keys.js";
@@ -93,17 +48,9 @@ describe("secure-keys", () => {
   beforeEach(() => {
     _resetBackend();
 
-    // Reset broker mock state
-    mockBrokerAvailable = false;
-    mockBrokerStore = new Map();
-    mockBrokerGetError = false;
-    mockBrokerSetError = false;
-    mockBrokerDelError = false;
-    mockBrokerGetCalled = false;
-    mockBrokerSetCalled = false;
-
-    // Ensure VELLUM_DEV is NOT set so broker tests work by default
+    // Ensure VELLUM_DEV and VELLUM_DESKTOP_APP are NOT set
     delete process.env.VELLUM_DEV;
+    delete process.env.VELLUM_DESKTOP_APP;
 
     if (existsSync(TEST_DIR)) {
       rmSync(TEST_DIR, { recursive: true });
@@ -116,6 +63,7 @@ describe("secure-keys", () => {
     _setStorePath(null);
     _resetBackend();
     delete process.env.VELLUM_DEV;
+    delete process.env.VELLUM_DESKTOP_APP;
   });
 
   afterAll(() => {
@@ -125,9 +73,9 @@ describe("secure-keys", () => {
   });
 
   // -----------------------------------------------------------------------
-  // CRUD operations (via encrypted store backend — broker unavailable)
+  // CRUD operations (encrypted store backend)
   // -----------------------------------------------------------------------
-  describe("CRUD with encrypted backend (broker unavailable)", () => {
+  describe("CRUD with encrypted backend", () => {
     test("set and get a key", async () => {
       await setSecureKeyAsync("openai", "sk-openai-789");
       expect(await getSecureKeyAsync("openai")).toBe("sk-openai-789");
@@ -149,143 +97,90 @@ describe("secure-keys", () => {
   });
 
   // -----------------------------------------------------------------------
-  // Single-writer: writes go to keychain only when broker available
+  // Desktop app uses encrypted store (same as dev/CLI)
   // -----------------------------------------------------------------------
-  describe("single-writer with broker available", () => {
-    test("setSecureKeyAsync writes to broker only (not encrypted store)", async () => {
-      mockBrokerAvailable = true;
+  describe("desktop app uses encrypted store", () => {
+    test("VELLUM_DESKTOP_APP=1 writes to encrypted store", async () => {
+      process.env.VELLUM_DESKTOP_APP = "1";
       _resetBackend();
 
       const result = await setSecureKeyAsync("api-key", "new-value");
       expect(result).toBe(true);
-      // Value is in the broker store
-      expect(mockBrokerStore.get("api-key")).toBe("new-value");
-      // Value should NOT be in the encrypted store (single-writer)
-      expect(encryptedStore.getKey("api-key")).toBeUndefined();
+      expect(encryptedStore.getKey("api-key")).toBe("new-value");
     });
 
-    test("setSecureKeyAsync returns false on broker set error", async () => {
-      mockBrokerAvailable = true;
-      mockBrokerSetError = true;
+    test("VELLUM_DESKTOP_APP=1 reads from encrypted store", async () => {
+      process.env.VELLUM_DESKTOP_APP = "1";
       _resetBackend();
 
-      const result = await setSecureKeyAsync("api-key", "new-value");
-      expect(result).toBe(false);
-      expect(mockBrokerStore.has("api-key")).toBe(false);
-    });
-  });
-
-  // -----------------------------------------------------------------------
-  // Reads: primary backend first, legacy fallback to encrypted store
-  // -----------------------------------------------------------------------
-  describe("reads with broker available", () => {
-    test("getSecureKeyAsync reads from broker (primary backend)", async () => {
-      mockBrokerAvailable = true;
-      _resetBackend();
+      encryptedStore.setKey("api-key", "encrypted-value");
 
-      mockBrokerStore.set("api-key", "broker-value");
       const result = await getSecureKeyAsync("api-key");
-      expect(result).toBe("broker-value");
-      expect(mockBrokerGetCalled).toBe(true);
-    });
-
-    test("getSecureKeyAsync falls back to encrypted store for legacy keys", async () => {
-      mockBrokerAvailable = true;
-      _resetBackend();
-
-      // Pre-populate encrypted store directly (legacy key not in broker)
-      encryptedStore.setKey("legacy-key", "legacy-value");
-
-      const result = await getSecureKeyAsync("legacy-key");
-      expect(result).toBe("legacy-value");
-      // Broker was checked first (returned nothing), then encrypted store
-      expect(mockBrokerGetCalled).toBe(true);
-    });
-
-    test("getSecureKeyAsync returns undefined when neither store has the key", async () => {
-      mockBrokerAvailable = true;
-      _resetBackend();
-
-      expect(await getSecureKeyAsync("missing-key")).toBeUndefined();
+      expect(result).toBe("encrypted-value");
     });
 
-    test("getSecureKeyAsync returns broker value even when encrypted store also has a value", async () => {
-      mockBrokerAvailable = true;
+    test("VELLUM_DESKTOP_APP=1 deletes from encrypted store", async () => {
+      process.env.VELLUM_DESKTOP_APP = "1";
       _resetBackend();
 
-      // Both stores have a value — broker (primary) should win
-      mockBrokerStore.set("api-key", "broker-value");
       encryptedStore.setKey("api-key", "encrypted-value");
 
-      const result = await getSecureKeyAsync("api-key");
-      expect(result).toBe("broker-value");
+      const result = await deleteSecureKeyAsync("api-key");
+      expect(result).toBe("deleted");
+      expect(encryptedStore.getKey("api-key")).toBeUndefined();
     });
   });
 
   // -----------------------------------------------------------------------
-  // Dev mode bypass — VELLUM_DEV=1 uses encrypted store only
+  // Dev mode — VELLUM_DEV=1 uses encrypted store
   // -----------------------------------------------------------------------
-  describe("dev mode bypass (VELLUM_DEV=1)", () => {
-    test("setSecureKeyAsync writes to encrypted store only, ignoring broker", async () => {
+  describe("dev mode (VELLUM_DEV=1)", () => {
+    test("setSecureKeyAsync writes to encrypted store", async () => {
       process.env.VELLUM_DEV = "1";
-      mockBrokerAvailable = true;
       _resetBackend();
 
       const result = await setSecureKeyAsync("api-key", "dev-value");
       expect(result).toBe(true);
-      // Written to encrypted store
       expect(encryptedStore.getKey("api-key")).toBe("dev-value");
-      // NOT written to broker
-      expect(mockBrokerStore.has("api-key")).toBe(false);
-      expect(mockBrokerSetCalled).toBe(false);
     });
 
-    test("getSecureKeyAsync reads from encrypted store only, ignoring broker", async () => {
+    test("getSecureKeyAsync reads from encrypted store", async () => {
       process.env.VELLUM_DEV = "1";
-      mockBrokerAvailable = true;
       _resetBackend();
 
-      mockBrokerStore.set("api-key", "broker-value");
       encryptedStore.setKey("api-key", "encrypted-value");
 
       const result = await getSecureKeyAsync("api-key");
       expect(result).toBe("encrypted-value");
-      // Broker should not have been contacted
-      expect(mockBrokerGetCalled).toBe(false);
     });
 
-    test("getSecureKeyAsync returns undefined when encrypted store is empty (does not check broker)", async () => {
+    test("getSecureKeyAsync returns undefined when encrypted store is empty", async () => {
       process.env.VELLUM_DEV = "1";
-      mockBrokerAvailable = true;
       _resetBackend();
 
-      mockBrokerStore.set("api-key", "broker-value");
-
       const result = await getSecureKeyAsync("api-key");
       expect(result).toBeUndefined();
-      expect(mockBrokerGetCalled).toBe(false);
     });
   });
 
   // -----------------------------------------------------------------------
-  // Delete always attempts both stores
+  // Non-desktop topology uses encrypted store
   // -----------------------------------------------------------------------
-  describe("delete attempts both stores", () => {
-    test("deleteSecureKeyAsync removes from both stores when broker available", async () => {
-      mockBrokerAvailable = true;
+  describe("non-desktop topology", () => {
+    test("uses encrypted store", async () => {
       _resetBackend();
 
-      mockBrokerStore.set("api-key", "broker-value");
-      encryptedStore.setKey("api-key", "encrypted-value");
-
-      const result = await deleteSecureKeyAsync("api-key");
-      expect(result).toBe("deleted");
-      expect(mockBrokerStore.has("api-key")).toBe(false);
-      expect(encryptedStore.getKey("api-key")).toBeUndefined();
+      const result = await setSecureKeyAsync("api-key", "new-value");
+      expect(result).toBe(true);
+      expect(encryptedStore.getKey("api-key")).toBe("new-value");
     });
+  });
 
-    test("deleteSecureKeyAsync returns deleted when only encrypted store has key", async () => {
-      // Broker unavailable — only encrypted store
+  // -----------------------------------------------------------------------
+  // Delete — single backend
+  // -----------------------------------------------------------------------
+  describe("delete from encrypted store", () => {
+    test("deleteSecureKeyAsync removes key from encrypted store", async () => {
       encryptedStore.setKey("api-key", "encrypted-value");
 
       const result = await deleteSecureKeyAsync("api-key");
@@ -293,116 +188,29 @@ describe("secure-keys", () => {
       expect(encryptedStore.getKey("api-key")).toBeUndefined();
     });
 
-    test("deleteSecureKeyAsync returns error when broker delete fails", async () => {
-      mockBrokerAvailable = true;
-      mockBrokerDelError = true;
-      _resetBackend();
-
-      mockBrokerStore.set("api-key", "broker-value");
-      encryptedStore.setKey("api-key", "encrypted-value");
-
-      const result = await deleteSecureKeyAsync("api-key");
-      expect(result).toBe("error");
-    });
-
-    test("deleteSecureKeyAsync in dev mode still attempts both stores", async () => {
+    test("deleteSecureKeyAsync in dev mode deletes from encrypted store", async () => {
       process.env.VELLUM_DEV = "1";
-      mockBrokerAvailable = true;
+      process.env.VELLUM_DESKTOP_APP = "1";
       _resetBackend();
 
-      mockBrokerStore.set("api-key", "broker-value");
       encryptedStore.setKey("api-key", "encrypted-value");
 
       const result = await deleteSecureKeyAsync("api-key");
       expect(result).toBe("deleted");
-      expect(mockBrokerStore.has("api-key")).toBe(false);
       expect(encryptedStore.getKey("api-key")).toBeUndefined();
     });
 
-    test("deleteSecureKeyAsync returns not-found when key missing from both stores", async () => {
-      // Broker unavailable, encrypted store empty
+    test("deleteSecureKeyAsync returns not-found when key missing", async () => {
       const result = await deleteSecureKeyAsync("missing-key");
       expect(result).toBe("not-found");
     });
   });
 
   // -----------------------------------------------------------------------
-  // Legacy read fallback
-  // -----------------------------------------------------------------------
-  describe("legacy read fallback", () => {
-    test("returns encrypted store value when broker has no key (legacy migration)", async () => {
-      mockBrokerAvailable = true;
-      _resetBackend();
-
-      // Simulate a legacy key that was written to encrypted store before
-      // the single-writer migration — broker doesn't have it.
-      encryptedStore.setKey("legacy-account", "legacy-secret");
-
-      const result = await getSecureKeyAsync("legacy-account");
-      expect(result).toBe("legacy-secret");
-    });
-
-    test("does not fall back to encrypted store when already using encrypted store backend", async () => {
-      // Broker unavailable — primary backend IS the encrypted store.
-      // No fallback needed.
-      encryptedStore.setKey("account", "value");
-      encryptedStore.setKey("other-account", "other-value");
-
-      // Should read directly from encrypted store (primary)
-      const result = await getSecureKeyAsync("account");
-      expect(result).toBe("value");
-      // Broker should not have been contacted
-      expect(mockBrokerGetCalled).toBe(false);
-    });
-  });
-
-  // -----------------------------------------------------------------------
-  // Stale-value prevention
-  // -----------------------------------------------------------------------
-  describe("stale-value prevention", () => {
-    test("setSecureKeyAsync failure does not corrupt broker store", async () => {
-      mockBrokerAvailable = true;
-      _resetBackend();
-
-      // Pre-seed broker with original value
-      mockBrokerStore.set("api-key", "original-value");
-
-      // Now fail the next set
-      mockBrokerSetError = true;
-      const ok = await setSecureKeyAsync("api-key", "new-value");
-      expect(ok).toBe(false);
-
-      // Broker should still have original value
-      expect(mockBrokerStore.get("api-key")).toBe("original-value");
-    });
-  });
-
-  // -----------------------------------------------------------------------
-  // listSecureKeysAsync — merged/deduplicated key listing
+  // listSecureKeysAsync — single-backend key listing
   // -----------------------------------------------------------------------
   describe("listSecureKeysAsync", () => {
-    test("returns merged, deduplicated keys when broker is primary and encrypted store has legacy keys", async () => {
-      mockBrokerAvailable = true;
-      _resetBackend();
-
-      // Broker has some keys
-      mockBrokerStore.set("broker-key-1", "val1");
-      mockBrokerStore.set("shared-key", "broker-val");
-
-      // Encrypted store has legacy keys (some overlapping)
-      encryptedStore.setKey("legacy-key-1", "val2");
-      encryptedStore.setKey("shared-key", "enc-val");
-
-      const keys = await listSecureKeysAsync();
-      expect(keys).toContain("broker-key-1");
-      expect(keys).toContain("legacy-key-1");
-      expect(keys).toContain("shared-key");
-      // Should be exactly 3 unique keys (no duplicates)
-      expect(keys.length).toBe(3);
-    });
-
-    test("returns only encrypted store keys when broker is unavailable", async () => {
-      // Broker unavailable (default state) — primary backend is encrypted store
+    test("returns encrypted store keys", async () => {
       encryptedStore.setKey("enc-key-1", "val1");
       encryptedStore.setKey("enc-key-2", "val2");
 
@@ -412,60 +220,72 @@ describe("secure-keys", () => {
       expect(keys.length).toBe(2);
     });
 
-    test("returns only encrypted store keys when VELLUM_DEV=1 (even if broker available)", async () => {
+    test("returns encrypted store keys with VELLUM_DEV=1", async () => {
       process.env.VELLUM_DEV = "1";
-      mockBrokerAvailable = true;
       _resetBackend();
 
-      // Broker has keys that should be ignored
-      mockBrokerStore.set("broker-only", "val1");
-
-      // Encrypted store has keys
       encryptedStore.setKey("dev-key-1", "val2");
       encryptedStore.setKey("dev-key-2", "val3");
 
       const keys = await listSecureKeysAsync();
       expect(keys).toContain("dev-key-1");
       expect(keys).toContain("dev-key-2");
-      // broker-only key should NOT appear since primary backend is encrypted store
-      expect(keys).not.toContain("broker-only");
       expect(keys.length).toBe(2);
     });
 
-    test("returns broker-only keys when encrypted store is empty", async () => {
-      mockBrokerAvailable = true;
+    test("returns encrypted store keys with VELLUM_DESKTOP_APP=1", async () => {
+      process.env.VELLUM_DESKTOP_APP = "1";
       _resetBackend();
 
-      mockBrokerStore.set("broker-key-1", "val1");
-      mockBrokerStore.set("broker-key-2", "val2");
+      encryptedStore.setKey("desktop-key-1", "val1");
+      encryptedStore.setKey("desktop-key-2", "val2");
 
       const keys = await listSecureKeysAsync();
-      expect(keys).toContain("broker-key-1");
-      expect(keys).toContain("broker-key-2");
+      expect(keys).toContain("desktop-key-1");
+      expect(keys).toContain("desktop-key-2");
       expect(keys.length).toBe(2);
     });
 
-    test("deduplicates keys that exist in both stores", async () => {
-      mockBrokerAvailable = true;
-      _resetBackend();
+    test("returns empty array when store is empty", async () => {
+      const keys = await listSecureKeysAsync();
+      expect(keys).toEqual([]);
+    });
+  });
+
+  // -----------------------------------------------------------------------
+  // getSecureKeyResultAsync — richer result with unreachable flag
+  // -----------------------------------------------------------------------
+  describe("getSecureKeyResultAsync", () => {
+    test("returns value and unreachable false on success", async () => {
+      encryptedStore.setKey("api-key", "stored-value");
 
-      // Same key in both stores
-      mockBrokerStore.set("api-key", "broker-val");
-      encryptedStore.setKey("api-key", "enc-val");
+      const result = await getSecureKeyResultAsync("api-key");
+      expect(result.value).toBe("stored-value");
+      expect(result.unreachable).toBe(false);
+    });
 
-      const keys = await listSecureKeysAsync();
-      expect(keys).toContain("api-key");
-      // Only one copy, not two
-      expect(keys.length).toBe(1);
-      expect(keys.filter((k) => k === "api-key").length).toBe(1);
+    test("returns unreachable false when key missing (encrypted store always reachable)", async () => {
+      const result = await getSecureKeyResultAsync("missing-key");
+      expect(result.value).toBeUndefined();
+      expect(result.unreachable).toBe(false);
     });
 
-    test("returns empty array when both stores are empty", async () => {
-      mockBrokerAvailable = true;
+    test("returns unreachable false in dev mode", async () => {
+      process.env.VELLUM_DEV = "1";
       _resetBackend();
 
-      const keys = await listSecureKeysAsync();
-      expect(keys).toEqual([]);
+      const result = await getSecureKeyResultAsync("missing-key");
+      expect(result.value).toBeUndefined();
+      expect(result.unreachable).toBe(false);
+    });
+
+    test("returns unreachable false with VELLUM_DESKTOP_APP=1", async () => {
+      process.env.VELLUM_DESKTOP_APP = "1";
+      _resetBackend();
+
+      const result = await getSecureKeyResultAsync("missing-key");
+      expect(result.value).toBeUndefined();
+      expect(result.unreachable).toBe(false);
     });
   });
 });