@vellumai/assistant 0.6.0 → 0.6.2

package/src/__tests__/identity-routes.test.ts

@@ -0,0 +1,328 @@
+/**
+ * Tests for identity/health route handlers, focusing on profiler metadata
+ * in /v1/health and /v1/healthz responses.
+ *
+ * Proves:
+ * - Backward compatibility: health endpoints return expected shape when
+ *   profiler mode is off (no env vars).
+ * - Profiler payload: when profiler env vars are set, the response includes
+ *   a `profiler` object with the expected structure and budget state.
+ * - Artifact detection: when run manifests and Bun summary files exist,
+ *   the response correctly reports artifact counts and lastCompletedRun.
+ */
+import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+
+// Silence logger before any imports that use it
+mock.module("../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+import { handleDetailedHealth } from "../runtime/routes/identity-routes.js";
+import { getWorkspaceDir } from "../util/platform.js";
+
+// ── Env helpers ─────────────────────────────────────────────────────────
+
+let savedEnv: Record<string, string | undefined>;
+
+const PROFILER_ENV_KEYS = [
+  "VELLUM_PROFILER_RUN_ID",
+  "VELLUM_PROFILER_MODE",
+  "VELLUM_PROFILER_MAX_BYTES",
+  "VELLUM_PROFILER_MAX_RUNS",
+  "VELLUM_PROFILER_MIN_FREE_MB",
+] as const;
+
+function clearProfilerEnv(): void {
+  for (const key of PROFILER_ENV_KEYS) {
+    delete process.env[key];
+  }
+}
+
+function setProfilerEnv(
+  mode: string,
+  runId: string,
+  opts?: { maxBytes?: number; maxRuns?: number; minFreeMb?: number },
+): void {
+  process.env.VELLUM_PROFILER_RUN_ID = runId;
+  process.env.VELLUM_PROFILER_MODE = mode;
+  if (opts?.maxBytes !== undefined) {
+    process.env.VELLUM_PROFILER_MAX_BYTES = String(opts.maxBytes);
+  }
+  if (opts?.maxRuns !== undefined) {
+    process.env.VELLUM_PROFILER_MAX_RUNS = String(opts.maxRuns);
+  }
+  if (opts?.minFreeMb !== undefined) {
+    process.env.VELLUM_PROFILER_MIN_FREE_MB = String(opts.minFreeMb);
+  }
+}
+
+// ── Filesystem helpers ──────────────────────────────────────────────────
+
+function ensureProfilerRunDir(runId: string): string {
+  const wsDir = getWorkspaceDir();
+  const runDir = join(wsDir, "data", "profiler", "runs", runId);
+  mkdirSync(runDir, { recursive: true });
+  return runDir;
+}
+
+function writeRunManifest(
+  runId: string,
+  manifest: {
+    status: "active" | "completed";
+    createdAt?: string;
+    updatedAt?: string;
+    completedAt?: string;
+    totalBytes?: number;
+  },
+): void {
+  const runDir = ensureProfilerRunDir(runId);
+  const m: Record<string, unknown> = {
+    runId,
+    status: manifest.status,
+    createdAt: manifest.createdAt ?? new Date().toISOString(),
+    updatedAt: manifest.updatedAt ?? new Date().toISOString(),
+    totalBytes: manifest.totalBytes ?? 0,
+  };
+  if (manifest.completedAt) {
+    m.completedAt = manifest.completedAt;
+  }
+  writeFileSync(join(runDir, "manifest.json"), JSON.stringify(m, null, 2));
+}
+
+function writeArtifactFile(
+  runId: string,
+  filename: string,
+  sizeBytes: number,
+): void {
+  const runDir = ensureProfilerRunDir(runId);
+  writeFileSync(join(runDir, filename), Buffer.alloc(sizeBytes));
+}
+
+// ── Setup / teardown ────────────────────────────────────────────────────
+
+beforeEach(() => {
+  savedEnv = {};
+  for (const key of PROFILER_ENV_KEYS) {
+    savedEnv[key] = process.env[key];
+  }
+  clearProfilerEnv();
+
+  // Clean up any profiler run directories from previous tests so
+  // rescanRuns() doesn't pick up stale state in the shared workspace.
+  const profilerRunsDir = join(getWorkspaceDir(), "data", "profiler", "runs");
+  if (existsSync(profilerRunsDir)) {
+    rmSync(profilerRunsDir, { recursive: true, force: true });
+  }
+});
+
+afterEach(() => {
+  for (const [key, value] of Object.entries(savedEnv)) {
+    if (value === undefined) {
+      delete process.env[key];
+    } else {
+      process.env[key] = value;
+    }
+  }
+});
+
+// ── Tests ───────────────────────────────────────────────────────────────
+
+describe("identity routes — health endpoint", () => {
+  describe("backward compatibility (profiler disabled)", () => {
+    test("/v1/health returns expected shape without profiler key when env vars are absent", async () => {
+      const res = handleDetailedHealth();
+      expect(res.status).toBe(200);
+
+      const body = (await res.json()) as Record<string, unknown>;
+      expect(body.status).toBe("healthy");
+      expect(body.timestamp).toBeDefined();
+      expect(body.version).toBeDefined();
+      expect(body.disk).toBeDefined();
+      expect(body.memory).toBeDefined();
+      expect(body.cpu).toBeDefined();
+      expect(body.migrations).toBeDefined();
+
+      // Profiler should either be absent or show enabled: false
+      if ("profiler" in body) {
+        const profiler = body.profiler as Record<string, unknown>;
+        expect(profiler.enabled).toBe(false);
+        expect(profiler.mode).toBeNull();
+        expect(profiler.runId).toBeNull();
+        expect(profiler.budget).toBeNull();
+      }
+    });
+
+    test("/v1/healthz returns the same shape as /v1/health", async () => {
+      // Both endpoints call handleDetailedHealth, so the shape must match
+      const res = handleDetailedHealth();
+      const body = (await res.json()) as Record<string, unknown>;
+
+      expect(body.status).toBe("healthy");
+      expect(body.timestamp).toBeDefined();
+      expect(body.migrations).toBeDefined();
+    });
+  });
+
+  describe("profiler payload (profiler enabled)", () => {
+    test("returns profiler object with enabled=true when env vars are set", async () => {
+      setProfilerEnv("cpu", "run-health-test-1", {
+        maxBytes: 10_000_000,
+        minFreeMb: 10,
+      });
+      ensureProfilerRunDir("run-health-test-1");
+
+      const res = handleDetailedHealth();
+      const body = (await res.json()) as Record<string, unknown>;
+
+      expect(body.profiler).toBeDefined();
+      const profiler = body.profiler as Record<string, unknown>;
+      expect(profiler.enabled).toBe(true);
+      expect(profiler.mode).toBe("cpu");
+      expect(profiler.runId).toBe("run-health-test-1");
+      expect(profiler.runDir).toContain("run-health-test-1");
+      expect(typeof profiler.totalBytes).toBe("number");
+      expect(typeof profiler.artifactCount).toBe("number");
+    });
+
+    test("includes budget block with expected fields", async () => {
+      setProfilerEnv("heap", "run-budget-test", {
+        maxBytes: 50_000_000,
+        minFreeMb: 100,
+      });
+      ensureProfilerRunDir("run-budget-test");
+
+      const res = handleDetailedHealth();
+      const body = (await res.json()) as Record<string, unknown>;
+      const profiler = body.profiler as Record<string, unknown>;
+      const budget = profiler.budget as Record<string, unknown>;
+
+      expect(budget).toBeDefined();
+      expect(budget.maxBytes).toBe(50_000_000);
+      expect(typeof budget.remainingBytes).toBe("number");
+      expect(budget.minFreeMb).toBe(100);
+      expect(typeof budget.freeMb).toBe("number");
+      expect(typeof budget.overBudget).toBe("boolean");
+    });
+
+    test("reports artifact count from .cpuprofile files", async () => {
+      setProfilerEnv("cpu", "run-artifact-count", {
+        maxBytes: 100_000_000,
+        minFreeMb: 0,
+      });
+      writeArtifactFile("run-artifact-count", "profile-1.cpuprofile", 1024);
+      writeArtifactFile("run-artifact-count", "profile-2.cpuprofile", 2048);
+      // Non-artifact file should not count
+      writeArtifactFile("run-artifact-count", "log.txt", 512);
+
+      const res = handleDetailedHealth();
+      const body = (await res.json()) as Record<string, unknown>;
+      const profiler = body.profiler as Record<string, unknown>;
+
+      expect(profiler.artifactCount).toBe(2);
+    });
+
+    test("detects over-budget state when total bytes exceed maxBytes", async () => {
+      setProfilerEnv("cpu+heap", "run-over-budget", {
+        maxBytes: 100, // Very small budget
+        minFreeMb: 0,
+      });
+      // Write a file larger than the budget
+      writeArtifactFile("run-over-budget", "big.cpuprofile", 5000);
+
+      const res = handleDetailedHealth();
+      const body = (await res.json()) as Record<string, unknown>;
+      const profiler = body.profiler as Record<string, unknown>;
+      const budget = profiler.budget as Record<string, unknown>;
+
+      expect(budget.overBudget).toBe(true);
+      expect(budget.remainingBytes).toBe(0);
+    });
+  });
+
+  describe("lastCompletedRun", () => {
+    test("returns null when no completed runs exist", async () => {
+      setProfilerEnv("cpu", "run-no-completed", {
+        maxBytes: 100_000_000,
+        minFreeMb: 0,
+      });
+      ensureProfilerRunDir("run-no-completed");
+
+      const res = handleDetailedHealth();
+      const body = (await res.json()) as Record<string, unknown>;
+      const profiler = body.profiler as Record<string, unknown>;
+
+      expect(profiler.lastCompletedRun).toBeNull();
+    });
+
+    test("returns completed run summary with artifact count and hasSummaries", async () => {
+      setProfilerEnv("cpu", "active-run-xyz", {
+        maxBytes: 100_000_000,
+        minFreeMb: 0,
+      });
+      ensureProfilerRunDir("active-run-xyz");
+
+      // Create a completed run with artifacts and a summary file
+      const completedId = "completed-run-abc";
+      const expectedCompletedAt = "2025-06-01T00:30:00Z";
+      writeRunManifest(completedId, {
+        status: "completed",
+        createdAt: "2025-06-01T00:00:00Z",
+        updatedAt: "2025-06-01T01:00:00Z",
+        completedAt: expectedCompletedAt,
+        totalBytes: 4096,
+      });
+      writeArtifactFile(completedId, "profile.cpuprofile", 3072);
+      writeArtifactFile(completedId, "summary.md", 256);
+
+      const res = handleDetailedHealth();
+      const body = (await res.json()) as Record<string, unknown>;
+      const profiler = body.profiler as Record<string, unknown>;
+      const last = profiler.lastCompletedRun as Record<string, unknown>;
+
+      expect(last).toBeDefined();
+      expect(last.runId).toBe(completedId);
+      expect(last.artifactCount).toBe(1); // Only .cpuprofile counts
+      expect(last.hasSummaries).toBe(true);
+      expect(typeof last.totalBytes).toBe("number");
+      // completedAt should reflect the manifest's completedAt value,
+      // not the current time or updatedAt.
+      expect(last.completedAt).toBe(expectedCompletedAt);
+    });
+
+    test("selects the most recent completed run when multiple exist", async () => {
+      setProfilerEnv("heap", "active-multi", {
+        maxBytes: 100_000_000,
+        maxRuns: 100,
+        minFreeMb: 0,
+      });
+      ensureProfilerRunDir("active-multi");
+
+      writeRunManifest("older-completed", {
+        status: "completed",
+        createdAt: "2025-01-01T00:00:00Z",
+        updatedAt: "2025-01-01T01:00:00Z",
+      });
+      writeArtifactFile("older-completed", "old.heapsnapshot", 512);
+
+      writeRunManifest("newer-completed", {
+        status: "completed",
+        createdAt: "2025-06-15T00:00:00Z",
+        updatedAt: "2025-06-15T01:00:00Z",
+      });
+      writeArtifactFile("newer-completed", "new.heapsnapshot", 1024);
+
+      const res = handleDetailedHealth();
+      const body = (await res.json()) as Record<string, unknown>;
+      const profiler = body.profiler as Record<string, unknown>;
+      const last = profiler.lastCompletedRun as Record<string, unknown>;
+
+      expect(last).toBeDefined();
+      expect(last.runId).toBe("newer-completed");
+    });
+  });
+});

package/src/__tests__/init-feature-flag-overrides.test.ts

@@ -0,0 +1,167 @@
+/**
+ * Tests for initFeatureFlagOverrides() — the async gateway fetch that
+ * pre-populates the feature flag cache before CLI program construction.
+ */
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
+
+import {
+  clearFeatureFlagOverridesCache,
+  initFeatureFlagOverrides,
+  isAssistantFeatureFlagEnabled,
+} from "../config/assistant-feature-flags.js";
+import * as tokenService from "../runtime/auth/token-service.js";
+import { getMockFetchCalls, mockFetch, resetMockFetch } from "./mock-fetch.js";
+
+const VALID_HEX_KEY = "ab".repeat(32);
+
+beforeEach(() => {
+  clearFeatureFlagOverridesCache();
+  tokenService._resetSigningKeyForTesting();
+
+  // Set up a signing key so mintEdgeRelayToken() works
+  process.env.ACTOR_TOKEN_SIGNING_KEY = VALID_HEX_KEY;
+  tokenService.initAuthSigningKey(tokenService.resolveSigningKey());
+});
+
+afterEach(() => {
+  resetMockFetch();
+  clearFeatureFlagOverridesCache();
+  tokenService._resetSigningKeyForTesting();
+  delete process.env.ACTOR_TOKEN_SIGNING_KEY;
+});
+
+describe("initFeatureFlagOverrides", () => {
+  it("populates cache from gateway fetch response", async () => {
+    mockFetch(
+      "/v1/feature-flags",
+      { method: "GET" },
+      {
+        body: {
+          flags: [
+            {
+              key: "foo-enabled",
+              enabled: true,
+              label: "Foo",
+              defaultEnabled: false,
+              description: "",
+            },
+            {
+              key: "bar-enabled",
+              enabled: true,
+              label: "Bar",
+              defaultEnabled: true,
+              description: "",
+            },
+          ],
+        },
+        status: 200,
+      },
+    );
+
+    await initFeatureFlagOverrides();
+
+    const config = {} as any;
+    expect(isAssistantFeatureFlagEnabled("foo-enabled", config)).toBe(true);
+    expect(isAssistantFeatureFlagEnabled("bar-enabled", config)).toBe(true);
+
+    // Verify fetch was called with correct URL and auth header
+    const calls = getMockFetchCalls();
+    expect(calls.length).toBe(1);
+    expect(calls[0].path).toContain("/v1/feature-flags");
+    const headers = calls[0].init.headers as Record<string, string> | undefined;
+    expect(headers).toHaveProperty("Authorization");
+  });
+
+  it("sends a valid Bearer JWT in the Authorization header", async () => {
+    mockFetch(
+      "/v1/feature-flags",
+      { method: "GET" },
+      { body: { flags: [] }, status: 200 },
+    );
+
+    await initFeatureFlagOverrides();
+
+    const calls = getMockFetchCalls();
+    expect(calls.length).toBe(1);
+    const headers = calls[0].init.headers as Record<string, string> | undefined;
+    const authHeader = headers?.Authorization;
+
+    expect(authHeader).toBeDefined();
+    expect(authHeader).toMatch(/^Bearer /);
+
+    // Verify it's a valid JWT (three dot-separated base64url segments)
+    const token = authHeader!.replace("Bearer ", "");
+    const parts = token.split(".");
+    expect(parts.length).toBe(3);
+  });
+
+  it("falls back gracefully when gateway is unreachable", async () => {
+    mockFetch("/v1/feature-flags", { method: "GET" }, { status: 500 });
+
+    // Should not throw
+    await initFeatureFlagOverrides();
+
+    // Without gateway data or file, undeclared flags default to true
+    const config = {} as any;
+    expect(isAssistantFeatureFlagEnabled("foo-enabled", config)).toBe(true);
+  });
+
+  it("falls back gracefully on non-OK HTTP status", async () => {
+    mockFetch(
+      "/v1/feature-flags",
+      { method: "GET" },
+      { body: "Unauthorized", status: 401 },
+    );
+
+    await initFeatureFlagOverrides();
+
+    // Undeclared flags default to true without overrides
+    const config = {} as any;
+    expect(isAssistantFeatureFlagEnabled("foo-enabled", config)).toBe(true);
+  });
+
+  it("initializes signing key lazily when not yet set", async () => {
+    // Reset signing key to simulate fresh CLI subprocess
+    tokenService._resetSigningKeyForTesting();
+    delete process.env.ACTOR_TOKEN_SIGNING_KEY;
+
+    expect(tokenService.isSigningKeyInitialized()).toBe(false);
+
+    mockFetch(
+      "/v1/feature-flags",
+      { method: "GET" },
+      {
+        body: {
+          flags: [{ key: "expected-enabled", enabled: true }],
+        },
+        status: 200,
+      },
+    );
+
+    await initFeatureFlagOverrides();
+
+    // Signing key should have been initialized during the fetch
+    expect(tokenService.isSigningKeyInitialized()).toBe(true);
+
+    // And the flag should be resolved correctly
+    const config = {} as any;
+    expect(isAssistantFeatureFlagEnabled("expected-enabled", config)).toBe(
+      true,
+    );
+  });
+
+  it("does not cache empty gateway response", async () => {
+    mockFetch(
+      "/v1/feature-flags",
+      { method: "GET" },
+      { body: { flags: [] }, status: 200 },
+    );
+
+    await initFeatureFlagOverrides();
+
+    // Undeclared flags without overrides default to true (not false from
+    // a cached empty map)
+    const config = {} as any;
+    expect(isAssistantFeatureFlagEnabled("foo-enabled", config)).toBe(true);
+  });
+});

package/src/__tests__/injection-block.test.ts

@@ -125,6 +125,18 @@ describe("assembleInjectionBlock", () => {
     expect(result).toContain("[skill]");
     expect(result).toContain("→ use skill_load to activate");
   });
+
+  test("assembleInjectionBlock omits skill_load suffix for CLI commands", () => {
+    const node = makeScoredNode({
+      type: "procedural",
+      content:
+        'cli:bash\nThe "assistant bash" CLI command is available. Execute a shell command.',
+    });
+    const result = assembleInjectionBlock([node]);
+    expect(result).not.toContain("[skill]");
+    expect(result).not.toContain("skill_load to activate");
+    expect(result).toContain("CLI command is available");
+  });
 });
 
 describe("assembleContextBlock — procedural nodes", () => {
@@ -139,6 +151,18 @@ describe("assembleContextBlock — procedural nodes", () => {
     expect(result).toContain("use skill_load to activate");
   });
 
+  test("omits skill_load suffix for CLI commands", () => {
+    const node = makeScoredNode({
+      type: "procedural",
+      content:
+        'cli:bash\nThe "assistant bash" CLI command is available. Execute a shell command.',
+    });
+    const result = assembleContextBlock([node]);
+    expect(result).toContain("### Skills You Can Use");
+    expect(result).not.toContain("skill_load to activate");
+    expect(result).toContain("CLI command is available");
+  });
+
   test("strips skill: prefix from old-format content", () => {
     const node = makeScoredNode({
       type: "procedural",

package/src/__tests__/inline-command-runner.test.ts

@@ -11,7 +11,6 @@ const mockConfig = {
   model: "test",
   maxTokens: 4096,
   dataDir: "/tmp",
-  sandbox: { enabled: true },
   timeouts: {
     shellDefaultTimeoutSec: 120,
     shellMaxTimeoutSec: 600,
@@ -104,20 +103,23 @@ describe("runInlineCommand", () => {
   // ── Sandbox enforcement ──────────────────────────────────────────────────
 
   describe("sandbox enforcement", () => {
-    test("always passes sandbox config with enabled=true", async () => {
+    test("always passes sandbox config with enabled=false", async () => {
       lastWrapCall = null;
       await runInlineCommand("echo sandbox-check", CWD);
 
       expect(lastWrapCall).not.toBeNull();
-      expect(lastWrapCall!.config.enabled).toBe(true);
+      expect(lastWrapCall!.config.enabled).toBe(false);
     });
 
-    test("always passes networkMode=off", async () => {
+    test("does not pass networkMode when sandbox is disabled", async () => {
       lastWrapCall = null;
       await runInlineCommand("echo network-check", CWD);
 
       expect(lastWrapCall).not.toBeNull();
-      expect(lastWrapCall!.options?.networkMode).toBe("off");
+      // networkMode is a no-op when sandbox is disabled (wrapCommand returns
+      // a plain bash invocation), so it is not passed. Network isolation is
+      // provided by the Docker/platform-managed container.
+      expect(lastWrapCall!.options).toBeUndefined();
     });
 
     test("uses the provided workingDir as cwd", async () => {

package/src/__tests__/install-skill-routing.test.ts

@@ -32,7 +32,7 @@ const mockInstallExternalSkill = mock(
 );
 const mockGetCatalog = mock(async () => []);
 const mockInstallSkillLocally = mock(async () => {});
-const mockSeedCatalogSkillMemories = mock(() => {});
+const mockSeedSkillGraphNodes = mock(() => {});
 const mockEnsureSkillEntry = mock(
   (_raw: Record<string, unknown>, _id: string) => ({
     enabled: false,
@@ -115,9 +115,10 @@ mock.module("../skills/managed-store.js", () => ({
   removeSkillsIndexEntry: () => {},
   validateManagedSkillId: () => null,
 }));
-mock.module("../skills/skill-memory.js", () => ({
-  deleteSkillCapabilityMemory: () => {},
-  seedCatalogSkillMemories: mockSeedCatalogSkillMemories,
+mock.module("../memory/graph/capability-seed.js", () => ({
+  deleteSkillCapabilityNode: () => {},
+  seedSkillGraphNodes: mockSeedSkillGraphNodes,
+  seedUninstalledCatalogSkillMemories: async () => {},
 }));
 mock.module("../util/platform.js", () => ({
   getWorkspaceSkillsDir: () => "/tmp/test-skills",
@@ -158,7 +159,7 @@ describe("installSkill routing", () => {
     mockInstallExternalSkill.mockReset();
     mockGetCatalog.mockReset();
     mockInstallSkillLocally.mockReset();
-    mockSeedCatalogSkillMemories.mockReset();
+    mockSeedSkillGraphNodes.mockReset();
     mockEnsureSkillEntry.mockReset();
 
     // Defaults
@@ -167,7 +168,7 @@ describe("installSkill routing", () => {
     mockInstallExternalSkill.mockResolvedValue(undefined);
     mockGetCatalog.mockResolvedValue([]);
     mockInstallSkillLocally.mockResolvedValue(undefined);
-    mockSeedCatalogSkillMemories.mockReturnValue(undefined);
+    mockSeedSkillGraphNodes.mockReturnValue(undefined);
     mockEnsureSkillEntry.mockReturnValue({ enabled: false });
   });