@vellumai/assistant 0.6.3 → 0.6.5

package/src/__tests__/credential-health-service.test.ts

@@ -0,0 +1,352 @@
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+// ── Mutable state for mocks ──────────────────────────────────────────
+
+const secureKeyValues = new Map<string, string>();
+
+let mockProviders: Array<{
+  provider: string;
+  defaultScopes: string;
+  pingUrl: string | null;
+  pingMethod: string | null;
+  pingHeaders: string | null;
+  pingBody: string | null;
+}> = [];
+
+let mockConnections: Map<
+  string,
+  Array<{
+    id: string;
+    provider: string;
+    accountInfo: string | null;
+    grantedScopes: string;
+    expiresAt: number | null;
+    hasRefreshToken: number;
+    status: string;
+  }>
+> = new Map();
+
+let mockFetchResponse: { ok: boolean; status: number } = {
+  ok: true,
+  status: 200,
+};
+let mockFetchThrows = false;
+
+// ── Module mocks ─────────────────────────────────────────────────────
+
+mock.module("../security/secure-keys.js", () => ({
+  getSecureKeyAsync: async (account: string) => secureKeyValues.get(account),
+  setSecureKeyAsync: async () => {},
+  deleteSecureKeyAsync: async () => "deleted",
+  listSecureKeysAsync: async () => [],
+  getProviderKeyAsync: async () => undefined,
+  getMaskedProviderKey: () => undefined,
+}));
+
+mock.module("../oauth/oauth-store.js", () => ({
+  listProviders: () => mockProviders,
+  listActiveConnectionsByProvider: (provider: string) =>
+    mockConnections.get(provider) ?? [],
+  getProvider: (provider: string) =>
+    mockProviders.find((p) => p.provider === provider),
+  isProviderConnected: () => false,
+}));
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () => ({
+    info: () => {},
+    warn: () => {},
+    debug: () => {},
+    error: () => {},
+  }),
+}));
+
+// ── Import under test ────────────────────────────────────────────────
+
+const {
+  checkAllCredentials,
+  checkCredentialForProvider,
+  _setFetchFn,
+} = await import("../credential-health/credential-health-service.js");
+
+// Inject mock fetch via the test helper (Bun's global fetch can't be
+// overridden via globalThis assignment).
+_setFetchFn((async () => {
+  if (mockFetchThrows) {
+    throw new Error("Network error");
+  }
+  return {
+    ok: mockFetchResponse.ok,
+    status: mockFetchResponse.status,
+  } as Response;
+}) as unknown as typeof fetch);
+
+// ── Helpers ──────────────────────────────────────────────────────────
+
+function addProvider(
+  provider: string,
+  opts?: {
+    defaultScopes?: string[];
+    pingUrl?: string | null;
+    pingMethod?: string | null;
+  },
+) {
+  mockProviders.push({
+    provider,
+    defaultScopes: JSON.stringify(opts?.defaultScopes ?? []),
+    pingUrl: opts?.pingUrl ?? null,
+    pingMethod: opts?.pingMethod ?? null,
+    pingHeaders: null,
+    pingBody: null,
+  });
+}
+
+function addConnection(
+  provider: string,
+  id: string,
+  opts?: {
+    expiresAt?: number | null;
+    hasRefreshToken?: boolean;
+    grantedScopes?: string[];
+    accountInfo?: string | null;
+  },
+) {
+  const conns = mockConnections.get(provider) ?? [];
+  conns.push({
+    id,
+    provider,
+    accountInfo: opts?.accountInfo ?? `user@${provider}.com`,
+    grantedScopes: JSON.stringify(opts?.grantedScopes ?? []),
+    expiresAt: opts?.expiresAt ?? null,
+    hasRefreshToken: opts?.hasRefreshToken ? 1 : 0,
+    status: "active",
+  });
+  mockConnections.set(provider, conns);
+}
+
+function setToken(connectionId: string, token = "mock-token") {
+  secureKeyValues.set(
+    `oauth_connection/${connectionId}/access_token`,
+    token,
+  );
+}
+
+// ── Tests ────────────────────────────────────────────────────────────
+
+describe("credential-health-service", () => {
+  beforeEach(() => {
+    secureKeyValues.clear();
+    mockProviders = [];
+    mockConnections = new Map();
+    mockFetchResponse = { ok: true, status: 200 };
+    mockFetchThrows = false;
+  });
+
+  test("returns empty report when no providers exist", async () => {
+    const report = await checkAllCredentials();
+    expect(report.results).toHaveLength(0);
+    expect(report.unhealthy).toHaveLength(0);
+    expect(report.checkedAt).toBeGreaterThan(0);
+  });
+
+  test("returns empty report when provider has no connections", async () => {
+    addProvider("google");
+    const report = await checkAllCredentials();
+    expect(report.results).toHaveLength(0);
+    expect(report.unhealthy).toHaveLength(0);
+  });
+
+  test("returns healthy for connection with valid token and future expiry", async () => {
+    addProvider("google");
+    addConnection("google", "conn-1", {
+      expiresAt: Date.now() + 30 * 24 * 60 * 60 * 1000, // 30 days
+      hasRefreshToken: true,
+    });
+    setToken("conn-1");
+
+    const report = await checkAllCredentials();
+    expect(report.results).toHaveLength(1);
+    expect(report.results[0]!.status).toBe("healthy");
+    expect(report.unhealthy).toHaveLength(0);
+  });
+
+  test("returns missing_token when no access token in secure storage", async () => {
+    addProvider("google");
+    addConnection("google", "conn-1");
+    // Don't set token
+
+    const report = await checkAllCredentials();
+    expect(report.results).toHaveLength(1);
+    expect(report.results[0]!.status).toBe("missing_token");
+    expect(report.results[0]!.canAutoRecover).toBe(false);
+    expect(report.unhealthy).toHaveLength(1);
+  });
+
+  test("returns expired when token is past expiresAt without refresh token", async () => {
+    addProvider("google");
+    addConnection("google", "conn-1", {
+      expiresAt: Date.now() - 60_000, // 1 minute ago
+      hasRefreshToken: false,
+    });
+    setToken("conn-1");
+
+    const report = await checkAllCredentials();
+    expect(report.results[0]!.status).toBe("expired");
+    expect(report.results[0]!.canAutoRecover).toBe(false);
+  });
+
+  test("returns expiring when token is past expiresAt with refresh token", async () => {
+    addProvider("google");
+    addConnection("google", "conn-1", {
+      expiresAt: Date.now() - 60_000, // 1 minute ago
+      hasRefreshToken: true,
+    });
+    setToken("conn-1");
+
+    const report = await checkAllCredentials();
+    expect(report.results[0]!.status).toBe("expiring");
+    expect(report.results[0]!.canAutoRecover).toBe(true);
+  });
+
+  test("returns expiring when token expires within 7 days without refresh token", async () => {
+    addProvider("google");
+    addConnection("google", "conn-1", {
+      expiresAt: Date.now() + 3 * 24 * 60 * 60 * 1000, // 3 days from now
+      hasRefreshToken: false,
+    });
+    setToken("conn-1");
+
+    const report = await checkAllCredentials();
+    expect(report.results[0]!.status).toBe("expiring");
+    expect(report.results[0]!.canAutoRecover).toBe(false);
+  });
+
+  test("returns healthy when token expires within 7 days but has refresh token", async () => {
+    addProvider("google");
+    addConnection("google", "conn-1", {
+      expiresAt: Date.now() + 3 * 24 * 60 * 60 * 1000, // 3 days from now
+      hasRefreshToken: true,
+    });
+    setToken("conn-1");
+
+    const report = await checkAllCredentials();
+    expect(report.results[0]!.status).toBe("healthy");
+  });
+
+  test("returns missing_scopes when grantedScopes is subset of defaultScopes", async () => {
+    addProvider("slack", {
+      defaultScopes: ["chat:write", "channels:read", "im:write"],
+    });
+    addConnection("slack", "conn-1", {
+      grantedScopes: ["chat:write"],
+      expiresAt: Date.now() + 30 * 24 * 60 * 60 * 1000,
+    });
+    setToken("conn-1");
+
+    const report = await checkAllCredentials();
+    expect(report.results[0]!.status).toBe("missing_scopes");
+    expect(report.results[0]!.missingScopes).toEqual([
+      "channels:read",
+      "im:write",
+    ]);
+    expect(report.results[0]!.canAutoRecover).toBe(false);
+  });
+
+  test("returns revoked when ping returns 401", async () => {
+    mockFetchResponse = { ok: false, status: 401 };
+    addProvider("google", {
+      pingUrl: "https://www.googleapis.com/oauth2/v2/userinfo",
+    });
+    addConnection("google", "conn-1", {
+      expiresAt: Date.now() + 30 * 24 * 60 * 60 * 1000,
+    });
+    setToken("conn-1");
+
+    const report = await checkAllCredentials();
+    expect(report.results[0]!.status).toBe("revoked");
+    expect(report.results[0]!.canAutoRecover).toBe(false);
+  });
+
+  test("returns ping_failed on non-auth ping error", async () => {
+    mockFetchResponse = { ok: false, status: 500 };
+    addProvider("google", {
+      pingUrl: "https://www.googleapis.com/oauth2/v2/userinfo",
+    });
+    addConnection("google", "conn-1", {
+      expiresAt: Date.now() + 30 * 24 * 60 * 60 * 1000,
+    });
+    setToken("conn-1");
+
+    const report = await checkAllCredentials();
+    expect(report.results[0]!.status).toBe("ping_failed");
+  });
+
+  test("returns ping_failed on network error (does not throw)", async () => {
+    mockFetchThrows = true;
+    addProvider("google", {
+      pingUrl: "https://www.googleapis.com/oauth2/v2/userinfo",
+    });
+    addConnection("google", "conn-1", {
+      expiresAt: Date.now() + 30 * 24 * 60 * 60 * 1000,
+    });
+    setToken("conn-1");
+
+    const report = await checkAllCredentials();
+    // Network error -> ping_failed (non-auth), not an exception
+    expect(report.results[0]!.status).toBe("ping_failed");
+  });
+
+  test("checks multiple providers and connections", async () => {
+    addProvider("google");
+    addProvider("slack", {
+      defaultScopes: ["chat:write", "channels:read"],
+    });
+
+    addConnection("google", "conn-g1");
+    setToken("conn-g1");
+    addConnection("slack", "conn-s1", {
+      grantedScopes: ["chat:write", "channels:read"],
+      expiresAt: Date.now() + 30 * 24 * 60 * 60 * 1000,
+    });
+    setToken("conn-s1");
+
+    const report = await checkAllCredentials();
+    expect(report.results).toHaveLength(2);
+
+    const google = report.results.find((r) => r.provider === "google");
+    const slack = report.results.find((r) => r.provider === "slack");
+
+    // Google: token set, no expiry -> healthy
+    expect(google!.status).toBe("healthy");
+    // Slack: all scopes present, valid token -> healthy
+    expect(slack!.status).toBe("healthy");
+  });
+
+  describe("checkCredentialForProvider", () => {
+    test("returns null when no connections exist", async () => {
+      const result = await checkCredentialForProvider("google");
+      expect(result).toBeNull();
+    });
+
+    test("returns health result for the most recent connection", async () => {
+      addProvider("google");
+      addConnection("google", "conn-1", {
+        expiresAt: Date.now() + 30 * 24 * 60 * 60 * 1000,
+      });
+      setToken("conn-1");
+
+      const result = await checkCredentialForProvider("google");
+      expect(result).not.toBeNull();
+      expect(result!.status).toBe("healthy");
+      expect(result!.connectionId).toBe("conn-1");
+    });
+
+    test("returns unhealthy for missing token", async () => {
+      addProvider("google");
+      addConnection("google", "conn-1");
+
+      const result = await checkCredentialForProvider("google");
+      expect(result!.status).toBe("missing_token");
+    });
+  });
+});

package/src/__tests__/credential-security-invariants.test.ts

@@ -172,7 +172,6 @@ describe("Invariant 2: no generic plaintext secret read API", () => {
       "daemon/handlers/config-vercel.ts", // Vercel API token management
       "runtime/routes/integrations/twilio.ts", // Twilio credential management (HTTP control-plane)
       "security/token-manager.ts", // OAuth token refresh flow
-      "email/providers/index.ts", // email provider API key lookup
       "tools/network/script-proxy/session-manager.ts", // proxy credential injection at runtime
       "calls/call-domain.ts", // caller identity resolution (user phone number lookup)
       "calls/twilio-config.ts", // call infrastructure credential lookup
@@ -185,7 +184,9 @@ describe("Invariant 2: no generic plaintext secret read API", () => {
       "runtime/channel-readiness-service.ts", // channel readiness probes for Telegram connectivity
       "messaging/providers/whatsapp/adapter.ts", // WhatsApp credential lookup for connectivity check
       "messaging/providers/slack/adapter.ts", // Slack bot token lookup for Socket Mode connectivity check
+      "credential-health/credential-health-service.ts", // proactive credential health monitoring
       "daemon/handlers/config-slack-channel.ts", // Slack channel config credential management
+      "daemon/handlers/slack-channel-oauth-install.ts", // Slack OAuth loopback reads client credentials for token exchange
       "providers/managed-proxy/context.ts", // managed proxy API key lookup for provider initialization
       "platform/client.ts", // platform client credential store fallback for standalone CLI auth
       "mcp/mcp-oauth-provider.ts", // MCP OAuth token/client/discovery persistence
@@ -200,10 +201,9 @@ describe("Invariant 2: no generic plaintext secret read API", () => {
       "oauth/oauth-store.ts", // OAuth provider disconnect (delete stored tokens)
       "oauth/manual-token-connection.ts", // manual-token provider backfill (credential store existence check)
       "workspace/provider-commit-message-generator.ts", // commit message generation provider key lookup
-      "config/bundled-skills/transcribe/tools/transcribe-media.ts", // transcription tool API key lookup
+      "cli/commands/image-generation.ts", // CLI image-generation command API key lookup
       "config/bundled-skills/image-studio/tools/media-generate-image.ts", // image generation tool API key lookup
       "config/bundled-skills/media-processing/tools/analyze-keyframes.ts", // keyframe analysis tool API key lookup
-      "config/bundled-skills/media-processing/tools/extract-keyframes.ts", // keyframe extraction tool API key lookup
       "providers/registry.ts", // provider registry API key lookup for initialization
       "providers/provider-availability.ts", // provider availability API key check
       "media/app-icon-generator.ts", // app icon generation API key lookup
@@ -217,6 +217,11 @@ describe("Invariant 2: no generic plaintext secret read API", () => {
       "providers/speech-to-text/resolve.ts", // STT provider API key lookup
       "daemon/lifecycle.ts", // CES client injection into secure-keys at startup
       "inbound/platform-callback-registration.ts", // managed credential lookup for platform base URL, assistant ID, and API key
+      "tts/providers/elevenlabs-provider.ts", // ElevenLabs TTS API key lookup
+      "tts/providers/deepgram-provider.ts", // Deepgram TTS API key lookup
+      "tts/providers/xai-provider.ts", // xAI TTS API key lookup
+      "meet/session-manager.ts", // Meet bot container provisioning (provider API key lookup for Deepgram/TTS)
+      "credential-health/credential-health-service.ts", // credential health check reads access tokens for liveness pings
     ]);
 
     const thisDir = dirname(fileURLToPath(import.meta.url));

package/src/__tests__/credential-storage-oauth-compat.test.ts

@@ -413,6 +413,24 @@ describe("RefreshCircuitBreaker", () => {
     expect(breaker.isOpen("service-x")).toBe(true);
     expect(breaker.isOpen("service-y")).toBe(false);
   });
+
+  test("transient (non-credential) failures do not trip the breaker", () => {
+    const breaker = new RefreshCircuitBreaker();
+    for (let i = 0; i < REFRESH_FAILURE_THRESHOLD + 5; i++) {
+      breaker.recordFailure("transient-svc", false);
+    }
+    expect(breaker.isOpen("transient-svc")).toBe(false);
+    expect(breaker.getState("transient-svc")).toBeUndefined();
+  });
+
+  test("tracks isCredentialError flag on breaker state", () => {
+    const breaker = new RefreshCircuitBreaker();
+    for (let i = 0; i < REFRESH_FAILURE_THRESHOLD; i++) {
+      breaker.recordFailure("cred-svc", true);
+    }
+    expect(breaker.isOpen("cred-svc")).toBe(true);
+    expect(breaker.getState("cred-svc")!.isCredentialError).toBe(true);
+  });
 });
 
 // ---------------------------------------------------------------------------

package/src/__tests__/credential-storage-static-compat.test.ts

@@ -371,6 +371,34 @@ describe("static credential storage compatibility", () => {
     });
   });
 
+  describe("canonical capability key storage", () => {
+    test("stores credential with canonical assistant_browser_fill_credential key", () => {
+      const created = store.upsert("github", "token", {
+        allowedTools: ["assistant_browser_fill_credential"],
+      });
+
+      const result = store.getByServiceField("github", "token");
+      expect(result).toBeDefined();
+      expect(result!.credentialId).toBe(created.credentialId);
+      expect(result!.allowedTools).toEqual([
+        "assistant_browser_fill_credential",
+      ]);
+    });
+
+    test("legacy browser_fill_credential metadata is preserved on read", () => {
+      const created = store.upsert("github", "pat", {
+        allowedTools: ["browser_fill_credential"],
+      });
+
+      const result = store.getByServiceField("github", "pat");
+      expect(result).toBeDefined();
+      expect(result!.credentialId).toBe(created.credentialId);
+      // The raw stored value is returned unchanged — alias resolution
+      // happens at policy-check time, not at storage time.
+      expect(result!.allowedTools).toEqual(["browser_fill_credential"]);
+    });
+  });
+
   describe("path management", () => {
     test("setPath changes the metadata file location", () => {
       store.upsert("github", "token");