@vellumai/assistant 0.6.2 → 0.6.3

package/src/__tests__/mcp-health-check.test.ts

@@ -3,12 +3,16 @@ import { beforeEach, describe, expect, jest, mock, test } from "bun:test";
 const mockConnect = jest.fn();
 const mockDisconnect = jest.fn();
 let mockIsConnected = true;
+let mockLastError: Error | null = null;
 
 mock.module("../mcp/client.js", () => ({
   McpClient: class {
     get isConnected() {
       return mockIsConnected;
     }
+    get lastError() {
+      return mockLastError;
+    }
     connect = mockConnect;
     disconnect = mockDisconnect;
   },
@@ -32,6 +36,7 @@ describe("checkServerHealth", () => {
     mockConnect.mockReset();
     mockDisconnect.mockReset();
     mockIsConnected = true;
+    mockLastError = null;
   });
 
   test("returns Connected when server connects successfully", async () => {
@@ -43,7 +48,7 @@ describe("checkServerHealth", () => {
     expect(mockDisconnect).toHaveBeenCalled();
   });
 
-  test("returns Needs authentication when isConnected is false", async () => {
+  test("returns Needs authentication when isConnected is false and no lastError", async () => {
     mockConnect.mockResolvedValue(undefined);
     mockIsConnected = false;
 
@@ -51,8 +56,10 @@ describe("checkServerHealth", () => {
     expect(result).toContain("Needs authentication");
   });
 
-  test("returns Error when connect throws", async () => {
-    mockConnect.mockRejectedValue(new Error("Connection refused"));
+  test("returns Error when connect fails with lastError", async () => {
+    mockConnect.mockResolvedValue(undefined);
+    mockIsConnected = false;
+    mockLastError = new Error("Connection refused");
     mockDisconnect.mockResolvedValue(undefined);
 
     const result = await checkServerHealth("test", serverConfig());

package/src/__tests__/migration-cross-version-compatibility.test.ts

@@ -834,7 +834,9 @@ describe("round-trip: export -> validate -> preflight -> import", () => {
       expect(sha256Hex(writtenDb)).toBe(sha256Hex(dbData));
 
       const writtenConfig = readFileSync(testConfigPath, "utf8");
-      expect(writtenConfig).toBe('{"model":"test-round-trip"}');
+      expect(writtenConfig).toBe(
+        JSON.stringify({ model: "test-round-trip" }, null, 2) + "\n",
+      );
     }
   });
 

package/src/__tests__/migration-export-http.test.ts

@@ -75,7 +75,7 @@ beforeAll(() => {
   // Write test fixture files so the export reads real data
   mkdirSync(testDbDir, { recursive: true });
   writeFileSync(testDbPath, SQLITE_HEADER);
-  writeFileSync(testConfigPath, JSON.stringify(TEST_CONFIG, null, 2));
+  writeFileSync(testConfigPath, JSON.stringify(TEST_CONFIG, null, 2) + "\n");
 });
 
 // ---------------------------------------------------------------------------
@@ -323,7 +323,7 @@ describe("export data population", () => {
     );
     expect(configFile).toBeDefined();
     const expectedConfigSize = Buffer.byteLength(
-      JSON.stringify(TEST_CONFIG, null, 2),
+      JSON.stringify(TEST_CONFIG, null, 2) + "\n",
     );
     expect(configFile!.size).toBe(expectedConfigSize);
   });
@@ -428,6 +428,65 @@ describe("export graceful fallback", () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// Config sanitization tests
+// ---------------------------------------------------------------------------
+
+describe("export config sanitization", () => {
+  test("exported config.json has environment-specific fields stripped", async () => {
+    // Write a config with environment-specific fields that should be stripped
+    const configWithEnvFields = {
+      provider: "anthropic",
+      model: "test-model",
+      ingress: {
+        publicBaseUrl: "https://my-tunnel.example.com",
+        enabled: true,
+        port: 8080,
+      },
+      daemon: {
+        autoStart: true,
+        logLevel: "debug",
+      },
+      skills: {
+        load: {
+          extraDirs: ["/home/user/custom-skills", "/opt/skills"],
+          autoReload: true,
+        },
+      },
+      memory: { enabled: true },
+    };
+    writeFileSync(testConfigPath, JSON.stringify(configWithEnvFields, null, 2));
+
+    const req = new Request("http://localhost/v1/migrations/export", {
+      method: "POST",
+    });
+
+    const res = await handleMigrationExport(req);
+    const archiveData = new Uint8Array(await res.arrayBuffer());
+    const entries = parseTarEntries(archiveData);
+
+    const configEntry = entries.find((e) => e.name === "workspace/config.json");
+    expect(configEntry).toBeDefined();
+
+    const parsedConfig = JSON.parse(
+      new TextDecoder().decode(configEntry!.data),
+    );
+
+    // Environment-specific fields should be stripped/reset
+    expect(parsedConfig.ingress.publicBaseUrl).toBe("");
+    expect(parsedConfig.ingress.enabled).toBeUndefined();
+    expect(parsedConfig.daemon).toBeUndefined();
+    expect(parsedConfig.skills.load.extraDirs).toEqual([]);
+
+    // Non-environment-specific fields should be preserved
+    expect(parsedConfig.provider).toBe("anthropic");
+    expect(parsedConfig.model).toBe("test-model");
+    expect(parsedConfig.ingress.port).toBe(8080);
+    expect(parsedConfig.skills.load.autoReload).toBe(true);
+    expect(parsedConfig.memory.enabled).toBe(true);
+  });
+});
+
 // ---------------------------------------------------------------------------
 // Auth policy registration tests
 // ---------------------------------------------------------------------------

package/src/__tests__/migration-export-streaming.test.ts

@@ -285,6 +285,72 @@ describe("streamExportVBundle round-trip", () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// Streaming config sanitization test
+// ---------------------------------------------------------------------------
+
+describe("streamExportVBundle config sanitization", () => {
+  test("exported config.json has environment-specific fields stripped", async () => {
+    // Write a config with environment-specific fields that should be stripped
+    const configWithEnvFields = {
+      provider: "anthropic",
+      model: "test-model",
+      ingress: {
+        publicBaseUrl: "https://my-tunnel.example.com",
+        enabled: true,
+        port: 8080,
+      },
+      daemon: {
+        autoStart: true,
+        logLevel: "debug",
+      },
+      skills: {
+        load: {
+          extraDirs: ["/home/user/custom-skills", "/opt/skills"],
+          autoReload: true,
+        },
+      },
+      memory: { enabled: true },
+    };
+    writeFileSync(testConfigPath, JSON.stringify(configWithEnvFields, null, 2));
+
+    const result = await streamExportVBundle({
+      workspaceDir: testDir,
+    });
+
+    try {
+      const archiveData = new Uint8Array(readFileSync(result.tempPath));
+      const entries = parseTarEntries(archiveData);
+
+      const configEntry = entries.find(
+        (e) => e.name === "workspace/config.json",
+      );
+      expect(configEntry).toBeDefined();
+
+      const parsedConfig = JSON.parse(
+        new TextDecoder().decode(configEntry!.data),
+      );
+
+      // Environment-specific fields should be stripped/reset
+      expect(parsedConfig.ingress.publicBaseUrl).toBe("");
+      expect(parsedConfig.ingress.enabled).toBeUndefined();
+      expect(parsedConfig.daemon).toBeUndefined();
+      expect(parsedConfig.skills.load.extraDirs).toEqual([]);
+
+      // Non-environment-specific fields should be preserved
+      expect(parsedConfig.provider).toBe("anthropic");
+      expect(parsedConfig.model).toBe("test-model");
+      expect(parsedConfig.ingress.port).toBe(8080);
+      expect(parsedConfig.skills.load.autoReload).toBe(true);
+      expect(parsedConfig.memory.enabled).toBe(true);
+    } finally {
+      // Restore original config for subsequent tests
+      writeFileSync(testConfigPath, JSON.stringify(TEST_CONFIG, null, 2));
+      await result.cleanup();
+    }
+  });
+});
+
 // ---------------------------------------------------------------------------
 // Cleanup idempotency test
 // ---------------------------------------------------------------------------

package/src/__tests__/migration-import-commit-http.test.ts

@@ -731,7 +731,9 @@ describe("commitImport", () => {
       expect(writtenDb).toEqual(newDbData);
 
       const writtenConfig = readFileSync(testConfigPath, "utf8");
-      expect(writtenConfig).toBe('{"model":"claude"}');
+      expect(writtenConfig).toBe(
+        JSON.stringify({ model: "claude" }, null, 2) + "\n",
+      );
     }
   });
 });
@@ -872,6 +874,104 @@ describe("commitImport — workspace clearing", () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// Config sanitization tests
+// ---------------------------------------------------------------------------
+
+describe("commitImport — config sanitization", () => {
+  test("imported workspace/config.json has environment-specific fields stripped", () => {
+    const configWithEnvFields = {
+      provider: "anthropic",
+      model: "test-model",
+      ingress: {
+        publicBaseUrl: "https://my-tunnel.example.com",
+        enabled: true,
+        port: 8080,
+      },
+      daemon: {
+        autoStart: true,
+        logLevel: "debug",
+      },
+      skills: {
+        load: {
+          extraDirs: ["/home/user/custom-skills"],
+          autoReload: true,
+        },
+      },
+      memory: { enabled: true },
+    };
+    const configData = new TextEncoder().encode(
+      JSON.stringify(configWithEnvFields, null, 2),
+    );
+
+    const vbundle = createValidVBundle([
+      { path: "workspace/config.json", data: configData },
+    ]);
+
+    const resolver = new DefaultPathResolver(testDir);
+    const result = commitImport({
+      archiveData: vbundle,
+      pathResolver: resolver,
+      workspaceDir: testDir,
+    });
+
+    expect(result.ok).toBe(true);
+    if (!result.ok) return;
+
+    // Read the written config from disk and verify sanitization
+    const writtenConfig = JSON.parse(readFileSync(testConfigPath, "utf8"));
+
+    // Environment-specific fields should be stripped/reset
+    expect(writtenConfig.ingress.publicBaseUrl).toBe("");
+    expect(writtenConfig.ingress.enabled).toBeUndefined();
+    expect(writtenConfig.daemon).toBeUndefined();
+    expect(writtenConfig.skills.load.extraDirs).toEqual([]);
+
+    // Non-environment-specific fields should be preserved
+    expect(writtenConfig.provider).toBe("anthropic");
+    expect(writtenConfig.model).toBe("test-model");
+    expect(writtenConfig.ingress.port).toBe(8080);
+    expect(writtenConfig.skills.load.autoReload).toBe(true);
+    expect(writtenConfig.memory.enabled).toBe(true);
+  });
+
+  test("imported config/settings.json (legacy) has environment-specific fields stripped", () => {
+    const configWithEnvFields = {
+      provider: "openai",
+      daemon: { autoStart: false },
+      ingress: {
+        publicBaseUrl: "https://old-tunnel.example.com",
+        enabled: false,
+      },
+      skills: { load: { extraDirs: ["/legacy/skills"] } },
+    };
+    const configData = new TextEncoder().encode(
+      JSON.stringify(configWithEnvFields, null, 2),
+    );
+
+    const vbundle = createValidVBundle([
+      { path: "config/settings.json", data: configData },
+    ]);
+
+    const resolver = new DefaultPathResolver(testDir);
+    const result = commitImport({
+      archiveData: vbundle,
+      pathResolver: resolver,
+    });
+
+    expect(result.ok).toBe(true);
+    if (!result.ok) return;
+
+    const writtenConfig = JSON.parse(readFileSync(testConfigPath, "utf8"));
+
+    expect(writtenConfig.ingress.publicBaseUrl).toBe("");
+    expect(writtenConfig.ingress.enabled).toBeUndefined();
+    expect(writtenConfig.daemon).toBeUndefined();
+    expect(writtenConfig.skills.load.extraDirs).toEqual([]);
+    expect(writtenConfig.provider).toBe("openai");
+  });
+});
+
 // ---------------------------------------------------------------------------
 // Auth policy registration tests
 // ---------------------------------------------------------------------------

package/src/__tests__/native-host-marker-sync-guard.test.ts

@@ -0,0 +1,157 @@
+/**
+ * Sync guard: the `NATIVE_HOST_MARKER_HEADER` and
+ * `NATIVE_HOST_MARKER_VALUE` constants are referenced from two coupled
+ * files that MUST stay in lockstep:
+ *
+ *   - assistant/src/runtime/routes/browser-extension-pair-routes.ts
+ *     (the runtime side that rejects unmarked pair requests with 403)
+ *   - clients/chrome-extension/native-host/src/index.ts
+ *     (the native messaging helper that stamps the marker on every
+ *     pair POST before forwarding to the assistant)
+ *
+ * If either side drifts (typo in the header name, or a different
+ * value), the pair flow silently breaks end-to-end: the native host
+ * sends an unrecognizable header, the runtime rejects the request as
+ * if it came from a drive-by webpage, and the extension never gets a
+ * token.
+ *
+ * This guard reads the raw source text of both files at test time and
+ * uses regexes to extract the literal string values of each constant.
+ * It deliberately does NOT `import` the constants — the whole point is
+ * to catch the physical file divergence that an import-based test
+ * would paper over (a typo'd export still type-checks if both files
+ * are updated independently but inconsistently).
+ *
+ * Modeled on `extension-id-sync-guard.test.ts`.
+ */
+
+import { readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { describe, expect, test } from "bun:test";
+
+const repoRoot = resolve(__dirname, "..", "..", "..");
+
+const ASSISTANT_PAIR_ROUTE_PATH =
+  "assistant/src/runtime/routes/browser-extension-pair-routes.ts";
+const NATIVE_HOST_INDEX_PATH =
+  "clients/chrome-extension/native-host/src/index.ts";
+
+/**
+ * Extract the string literal value of an exported const from raw
+ * TypeScript source text. Accepts both single- and double-quoted
+ * forms and is permissive about whitespace so minor formatter changes
+ * don't break the guard.
+ *
+ * Returns the literal string (without quotes) or `null` if the export
+ * cannot be found.
+ */
+function extractExportedConstString(
+  source: string,
+  constName: string,
+): string | null {
+  // Matches: export const FOO = "bar";  (also ' and whitespace
+  // variations). The value group stops at the next matching quote.
+  const re = new RegExp(
+    `export\\s+const\\s+${constName}\\s*=\\s*(['"])([^'"]*)\\1`,
+  );
+  const match = source.match(re);
+  if (!match) return null;
+  return match[2] ?? null;
+}
+
+describe("native-host marker sync guard", () => {
+  test("NATIVE_HOST_MARKER_HEADER matches across runtime route and native host", () => {
+    const assistantSource = readFileSync(
+      join(repoRoot, ASSISTANT_PAIR_ROUTE_PATH),
+      "utf8",
+    );
+    const nativeHostSource = readFileSync(
+      join(repoRoot, NATIVE_HOST_INDEX_PATH),
+      "utf8",
+    );
+
+    const assistantHeader = extractExportedConstString(
+      assistantSource,
+      "NATIVE_HOST_MARKER_HEADER",
+    );
+    const nativeHostHeader = extractExportedConstString(
+      nativeHostSource,
+      "NATIVE_HOST_MARKER_HEADER",
+    );
+
+    expect(assistantHeader).not.toBeNull();
+    expect(nativeHostHeader).not.toBeNull();
+    // Also require a non-empty value so an accidental `""` in either
+    // file trips the guard.
+    expect(assistantHeader!.length).toBeGreaterThan(0);
+    expect(nativeHostHeader!.length).toBeGreaterThan(0);
+
+    if (assistantHeader !== nativeHostHeader) {
+      throw new Error(
+        `NATIVE_HOST_MARKER_HEADER drift detected:\n` +
+          `  ${ASSISTANT_PAIR_ROUTE_PATH}: ${JSON.stringify(
+            assistantHeader,
+          )}\n` +
+          `  ${NATIVE_HOST_INDEX_PATH}: ${JSON.stringify(nativeHostHeader)}\n\n` +
+          `Both files must declare the same header name or pairing ` +
+          `silently breaks (the runtime rejects the native host's ` +
+          `requests as unmarked drive-by browser fetches).`,
+      );
+    }
+  });
+
+  test("NATIVE_HOST_MARKER_VALUE matches across runtime route and native host", () => {
+    const assistantSource = readFileSync(
+      join(repoRoot, ASSISTANT_PAIR_ROUTE_PATH),
+      "utf8",
+    );
+    const nativeHostSource = readFileSync(
+      join(repoRoot, NATIVE_HOST_INDEX_PATH),
+      "utf8",
+    );
+
+    const assistantValue = extractExportedConstString(
+      assistantSource,
+      "NATIVE_HOST_MARKER_VALUE",
+    );
+    const nativeHostValue = extractExportedConstString(
+      nativeHostSource,
+      "NATIVE_HOST_MARKER_VALUE",
+    );
+
+    expect(assistantValue).not.toBeNull();
+    expect(nativeHostValue).not.toBeNull();
+    expect(assistantValue!.length).toBeGreaterThan(0);
+    expect(nativeHostValue!.length).toBeGreaterThan(0);
+
+    if (assistantValue !== nativeHostValue) {
+      throw new Error(
+        `NATIVE_HOST_MARKER_VALUE drift detected:\n` +
+          `  ${ASSISTANT_PAIR_ROUTE_PATH}: ${JSON.stringify(
+            assistantValue,
+          )}\n` +
+          `  ${NATIVE_HOST_INDEX_PATH}: ${JSON.stringify(nativeHostValue)}\n\n` +
+          `Both files must declare the same marker value or pairing ` +
+          `silently breaks (the runtime rejects the native host's ` +
+          `requests as unmarked drive-by browser fetches).`,
+      );
+    }
+  });
+
+  test("extractExportedConstString helper handles both quote styles", () => {
+    // Smoke-test the parser helper itself so a regression in the
+    // regex can't silently mask a real drift in the coupled files.
+    expect(
+      extractExportedConstString(`export const FOO = "hello";`, "FOO"),
+    ).toBe("hello");
+    expect(
+      extractExportedConstString(`export const FOO = 'hello';`, "FOO"),
+    ).toBe("hello");
+    expect(
+      extractExportedConstString(`export  const   FOO   =   "spaced";`, "FOO"),
+    ).toBe("spaced");
+    expect(
+      extractExportedConstString(`export const OTHER = "x";`, "FOO"),
+    ).toBeNull();
+  });
+});

package/src/__tests__/oauth-apps-routes.test.ts

@@ -2,14 +2,14 @@ import { describe, expect, mock, test } from "bun:test";
 
 const mockGetApp = mock((_appId: string) => ({
   id: "app-1",
-  providerKey: "google",
+  provider: "google",
   clientId: "client-1",
 }));
 
 const mockListConnections = mock(() => [
   {
     id: "conn-1",
-    providerKey: "google",
+    provider: "google",
     accountInfo: '{"email":"alice@example.com"}',
     grantedScopes: '["email","profile"]',
     status: "active",
@@ -20,7 +20,7 @@ const mockListConnections = mock(() => [
   },
   {
     id: "conn-2",
-    providerKey: "google",
+    provider: "google",
     accountInfo: null,
     grantedScopes: [],
     status: "active",
@@ -37,28 +37,33 @@ mock.module("../oauth/oauth-store.js", () => ({
   getApp: mockGetApp,
   getAppClientSecret: mock(() => Promise.resolve(undefined)),
   getConnection: mock(() => undefined),
-  getProvider: mock((providerKey: string) =>
-    providerKey === "google"
+  getProvider: mock((provider: string) =>
+    provider === "google"
       ? {
-          providerKey: "google",
-          displayName: "Google",
+          provider: "google",
+          displayLabel: "Google",
           description: "Google OAuth provider",
           dashboardUrl: "https://console.cloud.google.com/apis/credentials",
+          logoUrl: null,
           clientIdPlaceholder: null,
           requiresClientSecret: 1,
           managedServiceConfigKey: "google-oauth",
-          authUrl: "https://accounts.google.com/o/oauth2/v2/auth",
-          tokenUrl: "https://oauth2.googleapis.com/token",
-          tokenEndpointAuthMethod: null,
+          authorizeUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+          tokenExchangeUrl: "https://oauth2.googleapis.com/token",
+          refreshUrl: null,
+          tokenEndpointAuthMethod: "client_secret_post",
           userinfoUrl: null,
           baseUrl: null,
           defaultScopes: "[]",
           scopePolicy: "[]",
-          extraParams: null,
+          scopeSeparator: null,
+          authorizeParams: null,
           pingUrl: null,
           pingMethod: null,
           pingHeaders: null,
           pingBody: null,
+          revokeUrl: null,
+          revokeBodyTemplate: null,
           loopbackPort: null,
           injectionTemplates: null,
           appType: null,
@@ -80,7 +85,7 @@ mock.module("../oauth/oauth-store.js", () => ({
   upsertApp: mock(() =>
     Promise.resolve({
       id: "app-1",
-      providerKey: "google",
+      provider: "google",
       clientId: "client-1",
       createdAt: 1735689500000,
       updatedAt: 1735689550000,