@vellumai/assistant 0.6.5 → 0.7.0

package/src/__tests__/extension-id-sync-guard.test.ts

@@ -1,241 +0,0 @@
-/**
- * Guard tests for Chrome extension allowlist configuration.
- *
- * Single source of truth:
- *   meta/browser-extension/chrome-extension-allowlist.json
- *
- * This guard ensures:
- *   1) Canonical config has a valid shape and valid extension IDs.
- *   2) Assistant runtime allowlist mirrors canonical config.
- *   3) The concrete extension ID literal appears only in canonical config
- *      (not duplicated across runtime/tests/docs).
- */
-
-import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
-import { homedir } from "node:os";
-import { join, resolve } from "node:path";
-import { describe, expect, test } from "bun:test";
-
-import { ALLOWED_EXTENSION_ORIGINS } from "../runtime/routes/browser-extension-pair-routes.js";
-
-const repoRoot = resolve(__dirname, "..", "..", "..");
-const CANONICAL_CONFIG_REL_PATH =
-  "meta/browser-extension/chrome-extension-allowlist.json";
-const CANONICAL_CONFIG_ABS_PATH = join(repoRoot, CANONICAL_CONFIG_REL_PATH);
-const LOCAL_OVERRIDE_PATH = join(
-  homedir(),
-  ".vellum",
-  "chrome-extension-allowlist.local.json",
-);
-
-const EXTENSION_ID_REGEX = /^[a-p]{32}$/;
-const PLACEHOLDER_ID_REGEX = /^TODO_[A-Z0-9_]+$/;
-
-type AllowlistConfig = {
-  version: number;
-  allowedExtensionIds: string[];
-};
-
-function parseCanonicalConfig(): AllowlistConfig {
-  const raw = readFileSync(CANONICAL_CONFIG_ABS_PATH, "utf8");
-  const parsed = JSON.parse(raw) as Partial<AllowlistConfig>;
-
-  if (!Number.isInteger(parsed.version) || (parsed.version ?? 0) <= 0) {
-    throw new Error(
-      "Invalid canonical config: version must be a positive integer",
-    );
-  }
-
-  if (!Array.isArray(parsed.allowedExtensionIds)) {
-    throw new Error(
-      "Invalid canonical config: allowedExtensionIds must be an array",
-    );
-  }
-
-  if (parsed.allowedExtensionIds.length === 0) {
-    throw new Error(
-      "Invalid canonical config: allowedExtensionIds must contain at least one id",
-    );
-  }
-
-  const seen = new Set<string>();
-  const validIds: string[] = [];
-  for (const id of parsed.allowedExtensionIds) {
-    if (typeof id !== "string") {
-      throw new Error(`Invalid canonical extension id: ${String(id)}`);
-    }
-    if (seen.has(id)) {
-      throw new Error(`Duplicate canonical extension id: ${id}`);
-    }
-    seen.add(id);
-
-    if (EXTENSION_ID_REGEX.test(id)) {
-      validIds.push(id);
-    } else if (!PLACEHOLDER_ID_REGEX.test(id)) {
-      throw new Error(`Invalid canonical extension id: ${id}`);
-    }
-  }
-
-  if (validIds.length === 0) {
-    throw new Error(
-      "Invalid canonical config: allowedExtensionIds must contain at least one real extension id",
-    );
-  }
-
-  return {
-    version: parsed.version as number,
-    allowedExtensionIds: validIds,
-  };
-}
-
-function listTextFilesRecursively(root: string): string[] {
-  const ignoredDirs = new Set([
-    ".git",
-    "node_modules",
-    "dist",
-    "build",
-    "coverage",
-    ".next",
-    ".turbo",
-    ".idea",
-    ".vscode",
-    ".codex-worktrees",
-  ]);
-
-  const allowedExtensions = new Set([
-    ".ts",
-    ".tsx",
-    ".js",
-    ".jsx",
-    ".mjs",
-    ".cjs",
-    ".json",
-    ".md",
-    ".swift",
-    ".sh",
-    ".toml",
-    ".yml",
-    ".yaml",
-    ".txt",
-  ]);
-
-  const out: string[] = [];
-
-  function walk(dir: string): void {
-    let entries;
-    try {
-      entries = readdirSync(dir, { withFileTypes: true });
-    } catch (err) {
-      // Directory may have been removed by a concurrent test; skip it.
-      if ((err as NodeJS.ErrnoException).code === "ENOENT") return;
-      throw err;
-    }
-    for (const entry of entries) {
-      if (entry.name.startsWith(".DS_Store")) continue;
-      // Skip temp fixtures created by parallel tests (e.g. .test-starter-bundle-<pid>).
-      if (entry.name.startsWith(".test-")) continue;
-      const absPath = join(dir, entry.name);
-      if (entry.isDirectory()) {
-        if (ignoredDirs.has(entry.name)) continue;
-        walk(absPath);
-        continue;
-      }
-      if (!entry.isFile()) continue;
-
-      const ext = entry.name.slice(entry.name.lastIndexOf("."));
-      if (!allowedExtensions.has(ext)) continue;
-
-      // Skip large files to keep this guard lightweight.
-      let size: number;
-      try {
-        size = statSync(absPath).size;
-      } catch (err) {
-        if ((err as NodeJS.ErrnoException).code === "ENOENT") continue;
-        throw err;
-      }
-      if (size > 1_000_000) continue;
-      out.push(absPath);
-    }
-  }
-
-  walk(root);
-  return out;
-}
-
-describe("Chrome extension allowlist guard", () => {
-  test("canonical allowlist config is valid", () => {
-    const config = parseCanonicalConfig();
-    expect(config.version).toBeGreaterThan(0);
-    expect(config.allowedExtensionIds.length).toBeGreaterThan(0);
-  });
-
-  test("assistant runtime allowlist contains every canonical origin", () => {
-    // The runtime set is the union of canonical + local override
-    // (~/.vellum/chrome-extension-allowlist.local.json) + env var. A dev
-    // machine may have extras; we only assert the canonical IDs are present.
-    const config = parseCanonicalConfig();
-    for (const id of config.allowedExtensionIds) {
-      const origin = `chrome-extension://${id}/`;
-      expect(ALLOWED_EXTENSION_ORIGINS.has(origin)).toBe(true);
-    }
-  });
-
-  test("assistant runtime allowlist exactly mirrors canonical when no override sources are active", () => {
-    // Exact-equality invariant: when neither the local override file nor
-    // the env-var override is active, the runtime set must equal the
-    // canonical set — nothing extra, nothing missing. A dev machine with
-    // an unpacked-extension override will skip this deterministic check
-    // and rely on the subset assertion above.
-    if (existsSync(LOCAL_OVERRIDE_PATH)) return;
-    if (
-      process.env.VELLUM_CHROME_EXTENSION_IDS ||
-      process.env.VELLUM_CHROME_EXTENSION_ID
-    ) {
-      return;
-    }
-
-    const config = parseCanonicalConfig();
-    const expectedOrigins = new Set(
-      config.allowedExtensionIds.map((id) => `chrome-extension://${id}/`),
-    );
-    expect(new Set(ALLOWED_EXTENSION_ORIGINS)).toEqual(expectedOrigins);
-  });
-
-  test("concrete extension IDs appear only in canonical config or CWS URLs", () => {
-    // The canonical extension ID may also appear in Chrome Web Store URLs
-    // (e.g. chromewebstore.google.com/detail/.../ID) or in documentation
-    // referencing the published extension. Those are acceptable — they
-    // reference the published extension, not duplicate config. We flag
-    // files where the ID appears outside of a CWS URL context.
-    const config = parseCanonicalConfig();
-    const allFiles = listTextFilesRecursively(repoRoot);
-
-    const CWS_URL_PATTERN =
-      /chromewebstore\.google\.com\/detail\/[^/]+\/[a-p]{32}/g;
-
-    for (const extensionId of config.allowedExtensionIds) {
-      const unexpectedMatches: string[] = [];
-      for (const absPath of allFiles) {
-        const relPath = absPath.replace(`${repoRoot}/`, "");
-        let content: string;
-        try {
-          content = readFileSync(absPath, "utf8");
-        } catch (err) {
-          // File may have been removed by a concurrent test between listing and reading.
-          if ((err as NodeJS.ErrnoException).code === "ENOENT") continue;
-          throw err;
-        }
-        if (!content.includes(extensionId)) continue;
-        if (relPath === CANONICAL_CONFIG_REL_PATH) continue;
-
-        // Strip all CWS URLs and check if the ID still appears — if it
-        // does, the file is using the ID as a standalone config value.
-        const stripped = content.replace(CWS_URL_PATTERN, "");
-        if (stripped.includes(extensionId)) {
-          unexpectedMatches.push(relPath);
-        }
-      }
-      expect(unexpectedMatches).toEqual([]);
-    }
-  });
-});

package/src/__tests__/hooks-blocking.test.ts

@@ -1,178 +0,0 @@
-import {
-  chmodSync,
-  mkdirSync,
-  readFileSync,
-  rmSync,
-  writeFileSync,
-} from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-
-// Set VELLUM_WORKSPACE_DIR before importing modules that use getWorkspaceDir()
-const testDir = join(tmpdir(), `hooks-blocking-test-${Date.now()}`);
-process.env.VELLUM_WORKSPACE_DIR = testDir;
-
-import { saveHooksConfig } from "../hooks/config.js";
-import { HookManager, resetHookManager } from "../hooks/manager.js";
-
-function createHook(
-  hooksDir: string,
-  name: string,
-  events: string[],
-  scriptContent: string,
-  blocking = false,
-): void {
-  const hookDir = join(hooksDir, name);
-  mkdirSync(hookDir, { recursive: true });
-  writeFileSync(
-    join(hookDir, "hook.json"),
-    JSON.stringify({
-      name,
-      description: `Test hook ${name}`,
-      version: "1.0.0",
-      events,
-      script: "run.sh",
-      ...(blocking ? { blocking: true } : {}),
-    }),
-  );
-  const scriptPath = join(hookDir, "run.sh");
-  writeFileSync(scriptPath, scriptContent);
-  chmodSync(scriptPath, 0o755);
-}
-
-describe("Blocking Hooks", () => {
-  let hooksDir: string;
-
-  beforeEach(() => {
-    hooksDir = join(testDir, "hooks");
-    mkdirSync(hooksDir, { recursive: true });
-    resetHookManager();
-  });
-
-  afterEach(() => {
-    resetHookManager();
-    rmSync(testDir, { recursive: true, force: true });
-  });
-
-  test("blocking hook on pre-* event cancels action on non-zero exit", async () => {
-    createHook(
-      hooksDir,
-      "guard",
-      ["pre-tool-execute"],
-      "#!/bin/bash\nexit 1",
-      true,
-    );
-    saveHooksConfig({ version: 1, hooks: { guard: { enabled: true } } });
-
-    const manager = new HookManager();
-    manager.initialize();
-
-    const result = await manager.trigger("pre-tool-execute", {
-      toolName: "bash",
-    });
-    expect(result.blocked).toBe(true);
-    expect(result.blockedBy).toBe("guard");
-  });
-
-  test("blocking hook on pre-* event allows action on zero exit", async () => {
-    createHook(
-      hooksDir,
-      "pass-guard",
-      ["pre-tool-execute"],
-      "#!/bin/bash\nexit 0",
-      true,
-    );
-    saveHooksConfig({ version: 1, hooks: { "pass-guard": { enabled: true } } });
-
-    const manager = new HookManager();
-    manager.initialize();
-
-    const result = await manager.trigger("pre-tool-execute", {
-      toolName: "bash",
-    });
-    expect(result.blocked).toBe(false);
-  });
-
-  test("non-blocking hook does not cancel even on non-zero exit", async () => {
-    createHook(
-      hooksDir,
-      "logger",
-      ["pre-tool-execute"],
-      "#!/bin/bash\nexit 1",
-      false,
-    );
-    saveHooksConfig({ version: 1, hooks: { logger: { enabled: true } } });
-
-    const manager = new HookManager();
-    manager.initialize();
-
-    const result = await manager.trigger("pre-tool-execute", {
-      toolName: "bash",
-    });
-    expect(result.blocked).toBe(false);
-  });
-
-  test("blocking hook on non-pre event does not cancel", async () => {
-    createHook(
-      hooksDir,
-      "post-guard",
-      ["post-tool-execute"],
-      "#!/bin/bash\nexit 1",
-      true,
-    );
-    saveHooksConfig({ version: 1, hooks: { "post-guard": { enabled: true } } });
-
-    const manager = new HookManager();
-    manager.initialize();
-
-    const result = await manager.trigger("post-tool-execute", {
-      toolName: "bash",
-    });
-    expect(result.blocked).toBe(false);
-  });
-
-  test("blocking hook stops subsequent hooks from running", async () => {
-    const outputFile = join(testDir, "after-block.txt");
-    createHook(
-      hooksDir,
-      "blocker",
-      ["pre-llm-call"],
-      "#!/bin/bash\nexit 1",
-      true,
-    );
-    createHook(
-      hooksDir,
-      "logger",
-      ["pre-llm-call"],
-      `#!/bin/bash\necho "ran" > "${outputFile}"`,
-      false,
-    );
-    saveHooksConfig({
-      version: 1,
-      hooks: {
-        blocker: { enabled: true },
-        logger: { enabled: true },
-      },
-    });
-
-    const manager = new HookManager();
-    manager.initialize();
-
-    const result = await manager.trigger("pre-llm-call", {});
-    expect(result.blocked).toBe(true);
-    expect(result.blockedBy).toBe("blocker");
-
-    // Logger should NOT have run because blocker runs first (alphabetical order)
-    await new Promise((r) => setTimeout(r, 100));
-    expect(() => readFileSync(outputFile, "utf-8")).toThrow();
-  });
-
-  test("trigger returns not blocked when no hooks match", async () => {
-    const manager = new HookManager();
-    manager.initialize();
-
-    const result = await manager.trigger("pre-tool-execute", {});
-    expect(result.blocked).toBe(false);
-  });
-});

package/src/__tests__/hooks-cli.test.ts

@@ -1,182 +0,0 @@
-import {
-  chmodSync,
-  cpSync,
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  rmSync,
-  writeFileSync,
-} from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-
-import { discoverHooks } from "../hooks/discovery.js";
-
-let hooksDir: string;
-
-function makeManifest(
-  name: string,
-  events: string[] = ["pre-llm-call"],
-  extra: Record<string, unknown> = {},
-): string {
-  return JSON.stringify({
-    name,
-    description: `Test hook: ${name}`,
-    version: "1.0.0",
-    events,
-    script: "run.sh",
-    ...extra,
-  });
-}
-
-function installHook(
-  name: string,
-  events: string[] = ["pre-llm-call"],
-  extra: Record<string, unknown> = {},
-): void {
-  const hookDir = join(hooksDir, name);
-  mkdirSync(hookDir, { recursive: true });
-  writeFileSync(join(hookDir, "hook.json"), makeManifest(name, events, extra));
-  writeFileSync(join(hookDir, "run.sh"), "#!/bin/sh\nexit 0\n", {
-    mode: 0o755,
-  });
-}
-
-describe("hooks CLI operations", () => {
-  beforeEach(() => {
-    hooksDir = join(
-      tmpdir(),
-      `hooks-cli-test-${Date.now()}-${Math.random().toString(36).slice(2)}`,
-    );
-    mkdirSync(hooksDir, { recursive: true });
-  });
-
-  afterEach(() => {
-    rmSync(hooksDir, { recursive: true, force: true });
-  });
-
-  test("discoverHooks lists installed hooks", () => {
-    installHook("hook-a", ["pre-llm-call"]);
-    installHook("hook-b", ["post-tool-execute", "pre-tool-execute"]);
-
-    const hooks = discoverHooks(hooksDir);
-
-    expect(hooks).toHaveLength(2);
-    expect(hooks[0].name).toBe("hook-a");
-    expect(hooks[0].manifest.events).toEqual(["pre-llm-call"]);
-    expect(hooks[1].name).toBe("hook-b");
-    expect(hooks[1].manifest.events).toEqual([
-      "post-tool-execute",
-      "pre-tool-execute",
-    ]);
-  });
-
-  test("discoverHooks returns empty when no hooks", () => {
-    const hooks = discoverHooks(hooksDir);
-    expect(hooks).toHaveLength(0);
-  });
-
-  test("enable/disable toggles hook config", () => {
-    // Write a config.json in hooksDir
-    const configPath = join(hooksDir, "config.json");
-    writeFileSync(
-      configPath,
-      JSON.stringify({ version: 1, hooks: { "my-hook": { enabled: false } } }),
-    );
-
-    // Since setHookEnabled uses getHooksDir() internally, we test the lower-level functions
-    // Read config directly
-    const config = JSON.parse(readFileSync(configPath, "utf-8"));
-    expect(config.hooks["my-hook"].enabled).toBe(false);
-
-    // Simulate enable
-    config.hooks["my-hook"].enabled = true;
-    writeFileSync(configPath, JSON.stringify(config, null, 2));
-
-    const updated = JSON.parse(readFileSync(configPath, "utf-8"));
-    expect(updated.hooks["my-hook"].enabled).toBe(true);
-
-    // Simulate disable
-    updated.hooks["my-hook"].enabled = false;
-    writeFileSync(configPath, JSON.stringify(updated, null, 2));
-
-    const final = JSON.parse(readFileSync(configPath, "utf-8"));
-    expect(final.hooks["my-hook"].enabled).toBe(false);
-  });
-
-  test("removeHook removes config entry", () => {
-    const configPath = join(hooksDir, "config.json");
-    writeFileSync(
-      configPath,
-      JSON.stringify({
-        version: 1,
-        hooks: {
-          "keep-me": { enabled: true },
-          "remove-me": { enabled: false },
-        },
-      }),
-    );
-
-    // Simulate removeHook by manipulating the config directly
-    const config = JSON.parse(readFileSync(configPath, "utf-8"));
-    delete config.hooks["remove-me"];
-    writeFileSync(configPath, JSON.stringify(config, null, 2));
-
-    const updated = JSON.parse(readFileSync(configPath, "utf-8"));
-    expect(updated.hooks["keep-me"]).toBeDefined();
-    expect(updated.hooks["remove-me"]).toBeUndefined();
-  });
-
-  test("install copies directory and creates config entry", () => {
-    // Create a source hook
-    const srcDir = join(hooksDir, "_source");
-    mkdirSync(srcDir, { recursive: true });
-    writeFileSync(
-      join(srcDir, "hook.json"),
-      makeManifest("test-install", ["daemon-start"]),
-    );
-    writeFileSync(join(srcDir, "run.sh"), "#!/bin/sh\necho installed\n", {
-      mode: 0o755,
-    });
-
-    // Simulate install: copy to hooks dir
-    // cpSync and chmodSync imported at top level
-    const targetDir = join(hooksDir, "test-install");
-    cpSync(srcDir, targetDir, { recursive: true });
-    chmodSync(join(targetDir, "run.sh"), 0o755);
-
-    // Verify files exist
-    expect(existsSync(join(targetDir, "hook.json"))).toBe(true);
-    expect(existsSync(join(targetDir, "run.sh"))).toBe(true);
-
-    // Verify hook is discoverable
-    const hooks = discoverHooks(hooksDir);
-    const installed = hooks.find((h) => h.name === "test-install");
-    expect(installed).toBeDefined();
-    expect(installed!.manifest.events).toEqual(["daemon-start"]);
-  });
-
-  test("remove deletes hook directory", () => {
-    installHook("to-remove");
-    expect(existsSync(join(hooksDir, "to-remove"))).toBe(true);
-
-    // Simulate remove
-    rmSync(join(hooksDir, "to-remove"), { recursive: true, force: true });
-
-    expect(existsSync(join(hooksDir, "to-remove"))).toBe(false);
-    const hooks = discoverHooks(hooksDir);
-    expect(hooks.find((h) => h.name === "to-remove")).toBeUndefined();
-  });
-
-  test("list shows version and events for hooks with metadata", () => {
-    installHook("versioned-hook", ["pre-llm-call", "post-llm-call"], {
-      version: "2.3.1",
-    });
-
-    const hooks = discoverHooks(hooksDir);
-    expect(hooks).toHaveLength(1);
-    expect(hooks[0].manifest.version).toBe("2.3.1");
-    expect(hooks[0].manifest.events).toEqual(["pre-llm-call", "post-llm-call"]);
-  });
-});

package/src/__tests__/hooks-config.test.ts

@@ -1,108 +0,0 @@
-import {
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  rmSync,
-  writeFileSync,
-} from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-
-// Set VELLUM_WORKSPACE_DIR before importing modules that use getWorkspaceDir()
-const testDir = join(tmpdir(), `hooks-config-test-${Date.now()}`);
-process.env.VELLUM_WORKSPACE_DIR = testDir;
-
-import {
-  ensureHookInConfig,
-  isHookEnabled,
-  loadHooksConfig,
-  saveHooksConfig,
-  setHookEnabled,
-} from "../hooks/config.js";
-
-describe("Hooks Config", () => {
-  beforeEach(() => {
-    const hooksDir = join(testDir, "hooks");
-    mkdirSync(hooksDir, { recursive: true });
-  });
-
-  afterEach(() => {
-    rmSync(testDir, { recursive: true, force: true });
-  });
-
-  test("loadHooksConfig returns defaults when no config file exists", () => {
-    const config = loadHooksConfig();
-    expect(config.version).toBe(1);
-    expect(config.hooks).toEqual({});
-  });
-
-  test("loadHooksConfig reads existing config", () => {
-    const configPath = join(testDir, "hooks", "config.json");
-    writeFileSync(
-      configPath,
-      JSON.stringify({
-        version: 1,
-        hooks: { "my-hook": { enabled: true } },
-      }),
-    );
-
-    const config = loadHooksConfig();
-    expect(config.hooks["my-hook"].enabled).toBe(true);
-  });
-
-  test("loadHooksConfig returns defaults for invalid JSON", () => {
-    const configPath = join(testDir, "hooks", "config.json");
-    writeFileSync(configPath, "NOT VALID JSON {{{");
-
-    const config = loadHooksConfig();
-    expect(config.version).toBe(1);
-    expect(config.hooks).toEqual({});
-  });
-
-  test("loadHooksConfig returns defaults for invalid structure", () => {
-    const configPath = join(testDir, "hooks", "config.json");
-    writeFileSync(configPath, JSON.stringify({ foo: "bar" }));
-
-    const config = loadHooksConfig();
-    expect(config.version).toBe(1);
-    expect(config.hooks).toEqual({});
-  });
-
-  test("saveHooksConfig writes config to disk", () => {
-    const config = { version: 1, hooks: { "test-hook": { enabled: true } } };
-    saveHooksConfig(config);
-
-    const configPath = join(testDir, "hooks", "config.json");
-    expect(existsSync(configPath)).toBe(true);
-    const read = JSON.parse(readFileSync(configPath, "utf-8"));
-    expect(read.hooks["test-hook"].enabled).toBe(true);
-  });
-
-  test("isHookEnabled returns false for unknown hook", () => {
-    expect(isHookEnabled("nonexistent")).toBe(false);
-  });
-
-  test("setHookEnabled enables a hook", () => {
-    setHookEnabled("my-hook", true);
-    expect(isHookEnabled("my-hook")).toBe(true);
-  });
-
-  test("setHookEnabled disables a hook", () => {
-    setHookEnabled("my-hook", true);
-    setHookEnabled("my-hook", false);
-    expect(isHookEnabled("my-hook")).toBe(false);
-  });
-
-  test("ensureHookInConfig adds hook if missing", () => {
-    ensureHookInConfig("new-hook", { enabled: false });
-    const config = loadHooksConfig();
-    expect(config.hooks["new-hook"]).toEqual({ enabled: false });
-  });
-
-  test("ensureHookInConfig does not overwrite existing hook", () => {
-    setHookEnabled("existing", true);
-    ensureHookInConfig("existing", { enabled: false });
-    expect(isHookEnabled("existing")).toBe(true);
-  });
-});