@vellumai/assistant 0.7.1 → 0.7.3

package/src/__tests__/host-bash-routes.test.ts

@@ -0,0 +1,459 @@
+/**
+ * Unit tests for the /v1/host-bash-result route handler.
+ *
+ * Covers the client-identity validation introduced by the targeted-host-proxy
+ * plan: when a pending interaction has a `targetClientId`, the submitting
+ * client must supply a matching `x-vellum-client-id` header or be rejected
+ * with 400 (missing) or 403 (mismatch).
+ */
+import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
+
+// ── Module mocks ─────────────────────────────────────────────────────
+
+mock.module("../config/env.js", () => ({
+  isHttpAuthDisabled: () => true,
+  hasUngatedHttpAuthDisabled: () => false,
+}));
+
+import type { PendingInteraction } from "../runtime/pending-interactions.js";
+
+// Stored pending interactions keyed by requestId.
+const pendingStore = new Map<string, PendingInteraction>();
+const resolvedIds: string[] = [];
+
+mock.module("../runtime/pending-interactions.js", () => ({
+  get: (requestId: string) => pendingStore.get(requestId),
+  resolve: (requestId: string) => {
+    const entry = pendingStore.get(requestId);
+    if (entry) {
+      pendingStore.delete(requestId);
+      resolvedIds.push(requestId);
+    }
+    return entry;
+  },
+}));
+
+interface ResolveCall {
+  requestId: string;
+  result: {
+    stdout: string;
+    stderr: string;
+    exitCode: number | null;
+    timedOut: boolean;
+  };
+}
+
+const resolveSpy: ResolveCall[] = [];
+
+mock.module("../daemon/host-bash-proxy.js", () => ({
+  HostBashProxy: {
+    get instance() {
+      return {
+        resolveResult(
+          requestId: string,
+          result: {
+            stdout: string;
+            stderr: string;
+            exitCode: number | null;
+            timedOut: boolean;
+          },
+        ) {
+          // resolveResult() internally calls pendingInteractions.resolve() in the real
+          // implementation; simulate that here so resolvedIds assertions still hold.
+          resolvedIds.push(requestId);
+          resolveSpy.push({ requestId, result });
+        },
+      };
+    },
+  },
+}));
+
+// Stored actor-principal-id keyed by clientId, populated by tests.
+const clientActorPrincipals = new Map<string, string>();
+
+mock.module("../runtime/assistant-event-hub.js", () => ({
+  assistantEventHub: {
+    getActorPrincipalIdForClient: (clientId: string) =>
+      clientActorPrincipals.get(clientId),
+  },
+}));
+
+// ── Real imports (after mocks) ───────────────────────────────────────
+
+import {
+  BadRequestError,
+  ConflictError,
+  ForbiddenError,
+  NotFoundError,
+} from "../runtime/routes/errors.js";
+import { ROUTES } from "../runtime/routes/host-bash-routes.js";
+
+afterAll(() => {
+  mock.restore();
+});
+
+const handleHostBashResult = ROUTES.find(
+  (r) => r.endpoint === "host-bash-result",
+)!.handler;
+
+// ── Helpers ──────────────────────────────────────────────────────────
+
+function registerPending(
+  requestId: string,
+  overrides: Partial<PendingInteraction> = {},
+): void {
+  // Mirror the production proxy behavior: capture the target's actor
+  // principal at registration time so the result-route check compares
+  // against the persisted value rather than a live hub lookup.
+  const targetActorPrincipalId =
+    overrides.targetActorPrincipalId ??
+    (overrides.targetClientId
+      ? clientActorPrincipals.get(overrides.targetClientId)
+      : undefined);
+  pendingStore.set(requestId, {
+    conversationId: "conv-1",
+    kind: "host_bash",
+    ...overrides,
+    targetActorPrincipalId,
+  });
+}
+
+function bashBody(requestId: string): Record<string, unknown> {
+  return {
+    requestId,
+    stdout: "hello\n",
+    stderr: "",
+    exitCode: 0,
+    timedOut: false,
+  };
+}
+
+// ── Tests ────────────────────────────────────────────────────────────
+
+describe("handleHostBashResult", () => {
+  beforeEach(() => {
+    pendingStore.clear();
+    resolvedIds.length = 0;
+    resolveSpy.length = 0;
+    clientActorPrincipals.clear();
+  });
+
+  // ── Happy paths ────────────────────────────────────────────────────
+
+  describe("untargeted request (no targetClientId)", () => {
+    test("accepts when header is present", async () => {
+      const requestId = "req-untargeted-with-header";
+      registerPending(requestId);
+
+      const result = await handleHostBashResult({
+        body: bashBody(requestId),
+        headers: { "x-vellum-client-id": "client-abc" },
+      });
+
+      expect(result).toEqual({ accepted: true });
+      expect(resolveSpy).toHaveLength(1);
+      expect(resolvedIds).toContain(requestId);
+    });
+
+    test("accepts when header is absent", async () => {
+      const requestId = "req-untargeted-no-header";
+      registerPending(requestId);
+
+      const result = await handleHostBashResult({
+        body: bashBody(requestId),
+      });
+
+      expect(result).toEqual({ accepted: true });
+      expect(resolveSpy).toHaveLength(1);
+      expect(resolvedIds).toContain(requestId);
+    });
+  });
+
+  describe("targeted request (targetClientId set)", () => {
+    test("accepts when x-vellum-client-id matches targetClientId", async () => {
+      const requestId = "req-targeted-match";
+      clientActorPrincipals.set("client-abc", "principal-1");
+      registerPending(requestId, { targetClientId: "client-abc" });
+
+      const result = await handleHostBashResult({
+        body: bashBody(requestId),
+        headers: {
+          "x-vellum-client-id": "client-abc",
+          "x-vellum-actor-principal-id": "principal-1",
+        },
+      });
+
+      expect(result).toEqual({ accepted: true });
+      expect(resolveSpy).toHaveLength(1);
+      expect(resolveSpy[0].requestId).toBe(requestId);
+      expect(resolvedIds).toContain(requestId);
+    });
+
+    test("trims whitespace from x-vellum-client-id before comparing", async () => {
+      const requestId = "req-targeted-trim";
+      clientActorPrincipals.set("client-abc", "principal-1");
+      registerPending(requestId, { targetClientId: "client-abc" });
+
+      const result = await handleHostBashResult({
+        body: bashBody(requestId),
+        headers: {
+          "x-vellum-client-id": "  client-abc  ",
+          "x-vellum-actor-principal-id": "principal-1",
+        },
+      });
+
+      expect(result).toEqual({ accepted: true });
+    });
+  });
+
+  // ── Same-user actor binding (defense-in-depth) ─────────────────────
+
+  describe("targeted request — actor principal binding", () => {
+    test("accepts when submitting actor matches target client's actor", async () => {
+      const requestId = "req-actor-match";
+      clientActorPrincipals.set("client-abc", "principal-shared");
+      registerPending(requestId, { targetClientId: "client-abc" });
+
+      const result = await handleHostBashResult({
+        body: bashBody(requestId),
+        headers: {
+          "x-vellum-client-id": "client-abc",
+          "x-vellum-actor-principal-id": "principal-shared",
+        },
+      });
+
+      expect(result).toEqual({ accepted: true });
+      expect(resolveSpy).toHaveLength(1);
+      expect(resolvedIds).toContain(requestId);
+    });
+
+    test("throws ForbiddenError (403) when submitting actor does not match target client's actor", () => {
+      const requestId = "req-actor-mismatch";
+      clientActorPrincipals.set("client-abc", "principal-victim");
+      registerPending(requestId, { targetClientId: "client-abc" });
+
+      expect(() =>
+        handleHostBashResult({
+          body: bashBody(requestId),
+          headers: {
+            "x-vellum-client-id": "client-abc",
+            "x-vellum-actor-principal-id": "principal-attacker",
+          },
+        }),
+      ).toThrow(ForbiddenError);
+    });
+
+    test("interaction is NOT resolved on cross-actor 403 (still pending)", () => {
+      const requestId = "req-actor-mismatch-stays";
+      clientActorPrincipals.set("client-abc", "principal-victim");
+      registerPending(requestId, { targetClientId: "client-abc" });
+
+      try {
+        handleHostBashResult({
+          body: bashBody(requestId),
+          headers: {
+            "x-vellum-client-id": "client-abc",
+            "x-vellum-actor-principal-id": "principal-attacker",
+          },
+        });
+      } catch {
+        // expected
+      }
+
+      expect(resolvedIds).not.toContain(requestId);
+      expect(pendingStore.has(requestId)).toBe(true);
+    });
+
+    test("throws ForbiddenError (403) when x-vellum-actor-principal-id header is missing entirely", () => {
+      const requestId = "req-actor-missing";
+      clientActorPrincipals.set("client-abc", "principal-victim");
+      registerPending(requestId, { targetClientId: "client-abc" });
+
+      expect(() =>
+        handleHostBashResult({
+          body: bashBody(requestId),
+          headers: { "x-vellum-client-id": "client-abc" },
+        }),
+      ).toThrow(ForbiddenError);
+    });
+
+    test("interaction is NOT resolved when submitting actor is missing (still pending)", () => {
+      const requestId = "req-actor-missing-stays";
+      clientActorPrincipals.set("client-abc", "principal-victim");
+      registerPending(requestId, { targetClientId: "client-abc" });
+
+      try {
+        handleHostBashResult({
+          body: bashBody(requestId),
+          headers: { "x-vellum-client-id": "client-abc" },
+        });
+      } catch {
+        // expected
+      }
+
+      expect(resolvedIds).not.toContain(requestId);
+      expect(pendingStore.has(requestId)).toBe(true);
+    });
+
+    test("throws ForbiddenError (403) when target client has no stored actor principal", () => {
+      // Target client connected without a verified principal (e.g. legacy
+      // service token) — refuse the submission rather than silently allow
+      // any actor through.
+      const requestId = "req-actor-target-missing";
+      registerPending(requestId, { targetClientId: "client-abc" });
+      // Note: no entry in clientActorPrincipals for "client-abc".
+
+      expect(() =>
+        handleHostBashResult({
+          body: bashBody(requestId),
+          headers: {
+            "x-vellum-client-id": "client-abc",
+            "x-vellum-actor-principal-id": "principal-1",
+          },
+        }),
+      ).toThrow(ForbiddenError);
+    });
+  });
+
+  // ── Untargeted-request behavior (regression for new check) ─────────
+
+  describe("untargeted request — actor principal check is skipped", () => {
+    test("accepts even when submitting actor is absent and no target client is set", async () => {
+      const requestId = "req-untargeted-no-actor";
+      registerPending(requestId);
+
+      const result = await handleHostBashResult({
+        body: bashBody(requestId),
+        headers: {},
+      });
+
+      expect(result).toEqual({ accepted: true });
+      expect(resolveSpy).toHaveLength(1);
+      expect(resolvedIds).toContain(requestId);
+    });
+  });
+
+  // ── Error: missing header on targeted request ──────────────────────
+
+  describe("targeted request — missing x-vellum-client-id header", () => {
+    test("throws BadRequestError (400) when header is absent", () => {
+      const requestId = "req-targeted-no-header";
+      registerPending(requestId, { targetClientId: "client-abc" });
+
+      expect(() => handleHostBashResult({ body: bashBody(requestId) })).toThrow(
+        BadRequestError,
+      );
+    });
+
+    test("throws BadRequestError (400) when header is empty string", () => {
+      const requestId = "req-targeted-empty-header";
+      registerPending(requestId, { targetClientId: "client-abc" });
+
+      expect(() =>
+        handleHostBashResult({
+          body: bashBody(requestId),
+          headers: { "x-vellum-client-id": "   " },
+        }),
+      ).toThrow(BadRequestError);
+    });
+
+    test("interaction is NOT resolved on 400 (still pending)", () => {
+      const requestId = "req-targeted-no-header-stays";
+      registerPending(requestId, { targetClientId: "client-abc" });
+
+      try {
+        handleHostBashResult({ body: bashBody(requestId) });
+      } catch {
+        // expected
+      }
+
+      expect(resolvedIds).not.toContain(requestId);
+      expect(pendingStore.has(requestId)).toBe(true);
+    });
+  });
+
+  // ── Error: wrong client ────────────────────────────────────────────
+
+  describe("targeted request — mismatched x-vellum-client-id", () => {
+    test("throws ForbiddenError (403) when client ID does not match", () => {
+      const requestId = "req-targeted-mismatch";
+      registerPending(requestId, { targetClientId: "client-abc" });
+
+      expect(() =>
+        handleHostBashResult({
+          body: bashBody(requestId),
+          headers: { "x-vellum-client-id": "client-xyz" },
+        }),
+      ).toThrow(ForbiddenError);
+    });
+
+    test("ForbiddenError message names both the submitting and expected client", () => {
+      const requestId = "req-targeted-mismatch-msg";
+      registerPending(requestId, { targetClientId: "client-abc" });
+
+      let caught: unknown;
+      try {
+        handleHostBashResult({
+          body: bashBody(requestId),
+          headers: { "x-vellum-client-id": "client-xyz" },
+        });
+      } catch (e) {
+        caught = e;
+      }
+
+      expect(caught).toBeInstanceOf(ForbiddenError);
+      const msg = (caught as ForbiddenError).message;
+      expect(msg).toContain("client-xyz");
+      expect(msg).toContain("client-abc");
+    });
+
+    test("interaction is NOT resolved on 403 (still pending)", () => {
+      const requestId = "req-targeted-mismatch-stays";
+      registerPending(requestId, { targetClientId: "client-abc" });
+
+      try {
+        handleHostBashResult({
+          body: bashBody(requestId),
+          headers: { "x-vellum-client-id": "client-xyz" },
+        });
+      } catch {
+        // expected
+      }
+
+      expect(resolvedIds).not.toContain(requestId);
+      expect(pendingStore.has(requestId)).toBe(true);
+    });
+  });
+
+  // ── Other existing validations (regression) ────────────────────────
+
+  test("throws BadRequestError when body is missing", () => {
+    expect(() => handleHostBashResult({})).toThrow(BadRequestError);
+  });
+
+  test("throws BadRequestError when requestId is missing", () => {
+    expect(() => handleHostBashResult({ body: { stdout: "x" } })).toThrow(
+      BadRequestError,
+    );
+  });
+
+  test("throws NotFoundError for unknown requestId", () => {
+    expect(() =>
+      handleHostBashResult({
+        body: bashBody("unknown-req-id"),
+      }),
+    ).toThrow(NotFoundError);
+  });
+
+  test("throws ConflictError when pending interaction is not host_bash kind", () => {
+    const requestId = "req-wrong-kind";
+    pendingStore.set(requestId, {
+      conversationId: "conv-1",
+      kind: "confirmation",
+    });
+
+    expect(() => handleHostBashResult({ body: bashBody(requestId) })).toThrow(
+      ConflictError,
+    );
+  });
+});

package/src/__tests__/host-browser-proxy.test.ts

@@ -18,7 +18,7 @@ mock.module("../runtime/assistant-event-hub.js", () => ({
     publish: async (event: unknown, _options?: unknown) => {
       publishedEvents.push(event);
     },
-    getMostRecentClientByCapability: (cap: string) =>
+    getPreferredClientByCapability: (cap: string, _preference?: unknown) =>
       cap === "host_browser" && mockHasConnection
         ? {
             type: "client",
@@ -28,19 +28,19 @@ mock.module("../runtime/assistant-event-hub.js", () => ({
           }
         : undefined,
   },
-}));
-
-mock.module("../runtime/assistant-event.js", () => ({
-  buildAssistantEvent: (message: unknown) => ({ message }),
+  broadcastMessage: (msg: unknown) => {
+    publishedEvents.push(msg);
+  },
 }));
 
 // ── Real imports (after mocks) ───────────────────────────────────────
 
+const pendingInteractions = await import("../runtime/pending-interactions.js");
 const { HostBrowserProxy } = await import("../daemon/host-browser-proxy.js");
 
 /** Extract the ServerMessage payloads from published events. */
 function getPublishedMessages(): unknown[] {
-  return publishedEvents.map((e) => (e as { message: unknown }).message);
+  return publishedEvents;
 }
 
 // ── Tests ────────────────────────────────────────────────────────────
@@ -50,6 +50,7 @@ describe("HostBrowserProxy", () => {
 
   beforeEach(() => {
     HostBrowserProxy.reset();
+    pendingInteractions.clear();
     publishedEvents = [];
     mockHasConnection = true;
     proxy = HostBrowserProxy.instance;
@@ -57,6 +58,7 @@ describe("HostBrowserProxy", () => {
 
   afterEach(() => {
     HostBrowserProxy.reset();
+    pendingInteractions.clear();
   });
 
   describe("request/resolve lifecycle (happy path)", () => {
@@ -78,14 +80,14 @@ describe("HostBrowserProxy", () => {
       expect(typeof sent.requestId).toBe("string");
 
       const requestId = sent.requestId as string;
-      expect(proxy.hasPendingRequest(requestId)).toBe(true);
+      expect(pendingInteractions.get(requestId)).toBeDefined();
 
-      proxy.resolve(requestId, { content: "ok", isError: false });
+      proxy.resolveResult(requestId, { content: "ok", isError: false });
 
       const result = await resultPromise;
       expect(result.content).toBe("ok");
       expect(result.isError).toBe(false);
-      expect(proxy.hasPendingRequest(requestId)).toBe(false);
+      expect(pendingInteractions.get(requestId)).toBeUndefined();
     });
 
     test("forwards cdpParams and cdpSessionId on the emitted envelope", async () => {
@@ -108,7 +110,7 @@ describe("HostBrowserProxy", () => {
       });
       expect(sent.cdpSessionId).toBe("session-abc");
 
-      proxy.resolve(sent.requestId as string, {
+      proxy.resolveResult(sent.requestId as string, {
         content: "Example Domain",
         isError: false,
       });
@@ -123,7 +125,7 @@ describe("HostBrowserProxy", () => {
       );
 
       const sent = getPublishedMessages()[0] as Record<string, unknown>;
-      proxy.resolve(sent.requestId as string, {
+      proxy.resolveResult(sent.requestId as string, {
         content: "Navigation failed",
         isError: true,
       });
@@ -143,11 +145,11 @@ describe("HostBrowserProxy", () => {
 
       const sent = getPublishedMessages()[0] as Record<string, unknown>;
       const requestId = sent.requestId as string;
-      expect(proxy.hasPendingRequest(requestId)).toBe(true);
+      expect(pendingInteractions.get(requestId)).toBeDefined();
 
-      proxy.resolve(requestId, { content: "ok", isError: false });
+      proxy.resolveResult(requestId, { content: "ok", isError: false });
 
-      expect(proxy.hasPendingRequest(requestId)).toBe(false);
+      expect(pendingInteractions.get(requestId)).toBeUndefined();
       await resultPromise;
     });
   });
@@ -165,14 +167,14 @@ describe("HostBrowserProxy", () => {
 
       const sent = getPublishedMessages()[0] as Record<string, unknown>;
       const requestId = sent.requestId as string;
-      expect(proxy.hasPendingRequest(requestId)).toBe(true);
+      expect(pendingInteractions.get(requestId)).toBeDefined();
 
       await new Promise((r) => setTimeout(r, 50));
 
       const result = await resultPromise;
       expect(result.isError).toBe(true);
       expect(result.content).toContain("Host browser proxy timed out");
-      expect(proxy.hasPendingRequest(requestId)).toBe(false);
+      expect(pendingInteractions.get(requestId)).toBeUndefined();
     });
   });
 
@@ -202,14 +204,14 @@ describe("HostBrowserProxy", () => {
 
       const sent = getPublishedMessages()[0] as Record<string, unknown>;
       const requestId = sent.requestId as string;
-      expect(proxy.hasPendingRequest(requestId)).toBe(true);
+      expect(pendingInteractions.get(requestId)).toBeDefined();
 
       controller.abort();
 
       const result = await resultPromise;
       expect(result.content).toBe("Aborted");
       expect(result.isError).toBe(true);
-      expect(proxy.hasPendingRequest(requestId)).toBe(false);
+      expect(pendingInteractions.get(requestId)).toBeUndefined();
 
       // Cancel envelope should have been sent.
       expect(getPublishedMessages()).toHaveLength(2);
@@ -251,8 +253,8 @@ describe("HostBrowserProxy", () => {
 
       proxy.dispose();
 
-      expect(proxy.hasPendingRequest(requestIds[0]!)).toBe(false);
-      expect(proxy.hasPendingRequest(requestIds[1]!)).toBe(false);
+      expect(pendingInteractions.get(requestIds[0]!)).toBeUndefined();
+      expect(pendingInteractions.get(requestIds[1]!)).toBeUndefined();
 
       await expect(p1).rejects.toThrow("Host browser proxy disposed");
       await expect(p2).rejects.toThrow("Host browser proxy disposed");
@@ -270,7 +272,7 @@ describe("HostBrowserProxy", () => {
 
   describe("resolve with unknown requestId", () => {
     test("silently ignores unknown requestId", () => {
-      proxy.resolve("nonexistent", { content: "stale", isError: false });
+      proxy.resolveResult("nonexistent", { content: "stale", isError: false });
     });
   });
 
@@ -342,7 +344,7 @@ describe("HostBrowserProxy", () => {
 
       const requestId = (getPublishedMessages()[0] as Record<string, unknown>)
         .requestId as string;
-      proxy.resolve(requestId, { content: "ok", isError: false });
+      proxy.resolveResult(requestId, { content: "ok", isError: false });
       await resultPromise;
 
       expect(spy.removeCalls).toEqual(["abort"]);