@vellumai/assistant 0.7.1 → 0.7.3

package/src/__tests__/mcp-auth-routes.test.ts

@@ -0,0 +1,197 @@
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+// ── Module mocks (must precede imports) ───────────────────────────────────────
+
+const mockReloadMcpServers = mock(async () => {});
+
+mock.module("../daemon/mcp-reload-service.js", () => ({
+  reloadMcpServers: () => mockReloadMcpServers(),
+}));
+
+const mockOrchestrateConnect = mock(
+  async (_args: { serverId: string; transport: unknown }) => ({
+    auth_url: "https://provider.example.com/authorize?state=abc",
+  }),
+);
+
+mock.module("../mcp/mcp-auth-orchestrator.js", () => ({
+  orchestrateMcpOAuthConnect: mockOrchestrateConnect,
+}));
+
+const mockGetMcpAuthState = mock((_serverId: string) => null as unknown);
+
+mock.module("../mcp/mcp-auth-state.js", () => ({
+  getMcpAuthState: mockGetMcpAuthState,
+}));
+
+mock.module("../config/loader.js", () => ({
+  loadRawConfig: () => ({
+    mcp: {
+      servers: {
+        "my-server": {
+          transport: { type: "sse", url: "https://mcp.example.com" },
+          enabled: true,
+          defaultRiskLevel: "high",
+        },
+      },
+    },
+  }),
+}));
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, {
+      get: () => () => {},
+    }),
+}));
+
+// ── Import SUT after mocks ─────────────────────────────────────────────────────
+
+const { ROUTES } = await import("../runtime/routes/mcp-auth-routes.js");
+
+// ── Helpers ────────────────────────────────────────────────────────────────────
+
+function findRoute(operationId: string) {
+  const route = ROUTES.find((r) => r.operationId === operationId);
+  if (!route) throw new Error(`Route ${operationId} not found`);
+  return route;
+}
+
+// ── Tests ──────────────────────────────────────────────────────────────────────
+
+describe("mcp-auth-routes", () => {
+  beforeEach(() => {
+    mockOrchestrateConnect.mockClear();
+    mockGetMcpAuthState.mockClear();
+    mockGetMcpAuthState.mockImplementation(() => null);
+    mockReloadMcpServers.mockClear();  // ← add this line
+  });
+
+  describe("POST internal/mcp/auth/start", () => {
+    test("happy path returns { auth_url, state }", async () => {
+      const startRoute = findRoute("internal_mcp_auth_start");
+      const result = await startRoute.handler({
+        body: { serverId: "my-server" },
+      });
+
+      expect(result).toEqual({
+        auth_url: "https://provider.example.com/authorize?state=abc",
+        state: "my-server",
+      });
+    });
+
+    test("rejects unknown serverId with BadRequestError", async () => {
+      const startRoute = findRoute("internal_mcp_auth_start");
+
+      await expect(
+        startRoute.handler({ body: { serverId: "unknown-server" } }),
+      ).rejects.toMatchObject({
+        name: "BadRequestError",
+        message: expect.stringContaining("not configured"),
+      });
+    });
+
+    test("wraps orchestrator error in InternalError", async () => {
+      mockOrchestrateConnect.mockImplementationOnce(async () => {
+        throw new Error("orchestrator blew up");
+      });
+
+      const startRoute = findRoute("internal_mcp_auth_start");
+
+      await expect(
+        startRoute.handler({ body: { serverId: "my-server" } }),
+      ).rejects.toMatchObject({
+        name: "InternalError",
+        message: "orchestrator blew up",
+      });
+    });
+  });
+
+  describe("GET internal/mcp/auth/status/:serverId", () => {
+    test("returns pending state", async () => {
+      mockGetMcpAuthState.mockImplementation(() => ({
+        status: "pending",
+        authUrl: "https://auth.example.com",
+        expiresAt: Date.now() + 300_000,
+      }));
+
+      const statusRoute = findRoute("internal_mcp_auth_status");
+      const result = await statusRoute.handler({
+        pathParams: { serverId: "my-server" },
+      });
+
+      expect(result).toEqual({
+        status: "pending",
+        auth_url: "https://auth.example.com",
+      });
+    });
+
+    test("returns complete state", async () => {
+      mockGetMcpAuthState.mockImplementation(() => ({
+        status: "complete",
+        serverId: "my-server",
+        completedAt: Date.now(),
+      }));
+
+      const statusRoute = findRoute("internal_mcp_auth_status");
+      const result = await statusRoute.handler({
+        pathParams: { serverId: "my-server" },
+      });
+
+      expect(result).toEqual({ status: "complete" });
+    });
+
+    test("returns error state", async () => {
+      mockGetMcpAuthState.mockImplementation(() => ({
+        status: "error",
+        error: "access_denied",
+        failedAt: Date.now(),
+      }));
+
+      const statusRoute = findRoute("internal_mcp_auth_status");
+      const result = await statusRoute.handler({
+        pathParams: { serverId: "my-server" },
+      });
+
+      expect(result).toEqual({ status: "error", error: "access_denied" });
+    });
+
+    test("throws NotFoundError for unknown serverId", async () => {
+      // mockGetMcpAuthState returns null by default (set in beforeEach)
+
+      const statusRoute = findRoute("internal_mcp_auth_status");
+
+      expect(() =>
+        statusRoute.handler({ pathParams: { serverId: "unknown-server" } }),
+      ).toThrow(
+        expect.objectContaining({
+          name: "NotFoundError",
+        }),
+      );
+    });
+  });
+
+  describe("POST internal/mcp/reload", () => {
+    test("happy path returns { ok: true } and kicks off reload", async () => {
+      const reloadRoute = findRoute("internal_mcp_reload");
+      const result = await reloadRoute.handler({ body: {} });
+
+      expect(result).toEqual({ ok: true });
+      // Flush the micro-task queue so the void promise runs
+      await new Promise((r) => setTimeout(r, 0));
+      expect(mockReloadMcpServers).toHaveBeenCalledTimes(1);
+    });
+
+    test("reload-throws-async still returns { ok: true } (fire-and-forget)", async () => {
+      mockReloadMcpServers.mockImplementationOnce(async () => {
+        throw new Error("reload failed");
+      });
+
+      const reloadRoute = findRoute("internal_mcp_reload");
+      // Must not throw even though the reload promise rejects
+      const result = await reloadRoute.handler({ body: {} });
+
+      expect(result).toEqual({ ok: true });
+    });
+  });
+});

package/src/__tests__/mcp-cli.test.ts

@@ -15,6 +15,41 @@ import { Command } from "commander";
 
 // ── Module mocks (must precede imports that pull them in) ──────────────
 
+type MockIpcResult = { ok: boolean; result?: unknown; error?: string };
+let mockCliIpcCallFn: ReturnType<
+  typeof mock<
+    (
+      method: string,
+      params?: Record<string, unknown>,
+      opts?: { timeoutMs?: number },
+    ) => Promise<MockIpcResult>
+  >
+> = mock(
+  (
+    _method: string,
+    _params?: Record<string, unknown>,
+    _opts?: { timeoutMs?: number },
+  ): Promise<MockIpcResult> =>
+    Promise.resolve({
+      ok: false,
+      error: "Could not connect to assistant daemon. Is it running?",
+    }),
+);
+
+mock.module("../ipc/cli-client.js", () => ({
+  cliIpcCall: (
+    method: string,
+    params?: Record<string, unknown>,
+    opts?: { timeoutMs?: number },
+  ) => mockCliIpcCallFn(method, params, opts),
+}));
+
+let mockOpenInHostBrowserFn = mock(async (_url: string) => {});
+
+mock.module("../util/browser.js", () => ({
+  openInHostBrowser: (url: string) => mockOpenInHostBrowserFn(url),
+}));
+
 let stdoutLines: string[] = [];
 let stderrLines: string[] = [];
 
@@ -26,7 +61,9 @@ mock.module("../util/logger.js", () => ({
     error: (...args: unknown[]) => {
       stderrLines.push(args.map(String).join(" "));
     },
-    warn: () => {},
+    warn: (...args: unknown[]) => {
+      stderrLines.push(args.map(String).join(" "));
+    },
     debug: () => {},
     trace: () => {},
     fatal: () => {},
@@ -39,7 +76,6 @@ mock.module("../util/logger.js", () => ({
 
 mock.module("../mcp/mcp-oauth-provider.js", () => ({
   deleteMcpOAuthCredentials: async () => {},
-  McpOAuthProvider: class {},
 }));
 
 mock.module("../mcp/client.js", () => ({
@@ -392,6 +428,23 @@ describe("assistant mcp add", () => {
     const server = servers?.["default-risk"] as Record<string, unknown>;
     expect(server.defaultRiskLevel).toBe("high");
   });
+
+  test("calls cliIpcCall with internal_mcp_reload after saving server", async () => {
+    mockCliIpcCallFn = mock(() => Promise.resolve({ ok: true }));
+
+    await runMcpAdd("reload-test-server", [
+      "-t",
+      "sse",
+      "-u",
+      "https://example.com/sse",
+    ]);
+
+    const reloadCall = mockCliIpcCallFn.mock.calls.find(
+      (c) => c[0] === "internal_mcp_reload",
+    );
+    expect(reloadCall).toBeDefined();
+    expect(reloadCall![1]).toEqual({ body: {} });
+  });
 });
 
 describe("assistant mcp remove", () => {
@@ -475,3 +528,286 @@ describe("assistant mcp remove", () => {
     expect(servers?.["keep-me"]).toBeDefined();
   });
 });
+
+describe("assistant mcp reload", () => {
+  beforeAll(() => {
+    testDataDir = join(
+      tmpdir(),
+      `vellum-mcp-reload-test-${Date.now()}-${Math.random().toString(36).slice(2)}`,
+    );
+    mkdirSync(testDataDir, { recursive: true });
+    configPath = join(testDataDir, "config.json");
+    writeConfig({});
+  });
+
+  afterAll(() => {
+    rmSync(testDataDir, { recursive: true, force: true });
+  });
+
+  beforeEach(() => {
+    mockCliIpcCallFn = mock(() => Promise.resolve({ ok: true }));
+  });
+
+  test("calls cliIpcCall with internal_mcp_reload", async () => {
+    const { stdout } = await runMcp("reload");
+
+    const reloadCall = mockCliIpcCallFn.mock.calls.find(
+      (c) => c[0] === "internal_mcp_reload",
+    );
+    expect(reloadCall).toBeDefined();
+    expect(reloadCall![1]).toEqual({ body: {} });
+    expect(stdout).toContain("MCP reload signal sent");
+  });
+
+  test("warns but does not fail when daemon is unreachable", async () => {
+    mockCliIpcCallFn = mock(() =>
+      Promise.resolve({
+        ok: false,
+        error: "Could not connect to assistant daemon",
+      }),
+    );
+
+    const { exitCode, stderr } = await runMcp("reload");
+
+    expect(exitCode).toBe(0); // best-effort, not fatal
+    expect(stderr).toContain("Could not signal reload");
+  });
+});
+
+describe("assistant mcp auth — IPC path", () => {
+  let ipcTestDataDir: string;
+  let ipcConfigPath: string;
+
+  beforeAll(() => {
+    ipcTestDataDir = join(
+      tmpdir(),
+      `vellum-mcp-auth-ipc-test-${Date.now()}-${Math.random().toString(36).slice(2)}`,
+    );
+    mkdirSync(ipcTestDataDir, { recursive: true });
+    ipcConfigPath = join(ipcTestDataDir, "config.json");
+    writeFileSync(
+      ipcConfigPath,
+      JSON.stringify({
+        mcp: {
+          servers: {
+            srv: {
+              transport: { type: "sse", url: "https://mcp.example.com/sse" },
+              enabled: true,
+              defaultRiskLevel: "high",
+            },
+          },
+        },
+      }),
+      "utf-8",
+    );
+  });
+
+  afterAll(() => {
+    rmSync(ipcTestDataDir, { recursive: true, force: true });
+  });
+
+  beforeEach(() => {
+    // runMcp() sets VELLUM_WORKSPACE_DIR = testDataDir; align the module-level
+    // variable with the IPC-specific directory so the config loader sees the
+    // SSE server config created in beforeAll.
+    testDataDir = ipcTestDataDir;
+    mockCliIpcCallFn = mock(() =>
+      Promise.resolve({
+        ok: false,
+        error: "Could not connect to assistant daemon. Is it running?",
+      }),
+    );
+    mockOpenInHostBrowserFn = mock(async (_url: string) => {});
+    stdoutLines = [];
+    stderrLines = [];
+    process.exitCode = 0;
+  });
+
+  test("mcp auth calls IPC internal_mcp_auth_start first", async () => {
+    let ipcCallIndex = 0;
+    mockCliIpcCallFn = mock(() => {
+      ipcCallIndex++;
+      if (ipcCallIndex === 1) {
+        // start call
+        return Promise.resolve({
+          ok: true,
+          result: { auth_url: "https://auth.example.com", state: "srv" },
+        });
+      }
+      // poll calls → complete
+      return Promise.resolve({
+        ok: true,
+        result: { status: "complete" },
+      });
+    });
+
+    await runMcp("auth", ["srv"]);
+
+    expect(mockCliIpcCallFn.mock.calls[0][0]).toBe("internal_mcp_auth_start");
+    expect(mockCliIpcCallFn.mock.calls[0][1]).toEqual({
+      body: { serverId: "srv" },
+    });
+    expect(mockOpenInHostBrowserFn).toHaveBeenCalledWith(
+      "https://auth.example.com",
+    );
+  });
+
+  test("IPC start returns ok=false (daemon unavailable) → exits 1 with helpful error", async () => {
+    mockCliIpcCallFn = mock(() =>
+      Promise.resolve({
+        ok: false,
+        error: "Could not connect to assistant daemon. Is it running?",
+      }),
+    );
+
+    const { exitCode, stderr } = await runMcp("auth", ["srv"]);
+
+    expect(exitCode).toBe(1);
+    expect(stderr).toContain("Is it running?");
+  });
+
+  test("IPC start returns ok=false (Unknown method) → exits 1 with helpful error", async () => {
+    mockCliIpcCallFn = mock(() =>
+      Promise.resolve({
+        ok: false,
+        error: "Unknown method: internal_mcp_auth_start",
+      }),
+    );
+
+    const { exitCode, stderr } = await runMcp("auth", ["srv"]);
+
+    expect(exitCode).toBe(1);
+    expect(stderr).toContain("Is it running?");
+  });
+
+  test("IPC start returns ok=false with a real daemon error → exits 1 without falling back to loopback", async () => {
+    mockCliIpcCallFn = mock(() =>
+      Promise.resolve({
+        ok: false,
+        error: "MCP server not configured for OAuth",
+      }),
+    );
+
+    await runMcp("auth", ["srv"]);
+
+    // Should have surfaced the daemon error and set exit code 1, not fallen
+    // back to loopback (which would have constructed the OAuth provider and
+    // possibly opened a browser via the loopback path).
+    expect(process.exitCode).toBe(1);
+    expect(mockOpenInHostBrowserFn).not.toHaveBeenCalled();
+    // Exactly one IPC call (the start) — no polling, no retry.
+    expect(mockCliIpcCallFn.mock.calls.length).toBe(1);
+    expect(mockCliIpcCallFn.mock.calls[0][0]).toBe("internal_mcp_auth_start");
+  });
+
+  test("polling complete → exits 0 (daemon-side reload triggers itself; CLI no longer writes file signal)", async () => {
+    let ipcCallIndex = 0;
+    mockCliIpcCallFn = mock(() => {
+      ipcCallIndex++;
+      if (ipcCallIndex === 1) {
+        return Promise.resolve({
+          ok: true,
+          result: { auth_url: "https://auth.example.com", state: "srv" },
+        });
+      }
+      return Promise.resolve({
+        ok: true,
+        result: { status: "complete" },
+      });
+    });
+
+    const { exitCode, stdout } = await runMcp("auth", ["srv"]);
+
+    expect(exitCode).toBe(0);
+    expect(stdout).toContain("Authentication successful");
+    // The IPC success path relies on the daemon-side orchestrator to call
+    // reloadMcpServers() itself on completion — no CLI-side signal needed.
+  });
+
+  test("polling error → exits 1 with error message", async () => {
+    let ipcCallIndex = 0;
+    mockCliIpcCallFn = mock(() => {
+      ipcCallIndex++;
+      if (ipcCallIndex === 1) {
+        return Promise.resolve({
+          ok: true,
+          result: { auth_url: "https://auth.example.com", state: "srv" },
+        });
+      }
+      return Promise.resolve({
+        ok: true,
+        result: { status: "error", error: "access_denied" },
+      });
+    });
+
+    const { exitCode, stderr } = await runMcp("auth", ["srv"]);
+
+    expect(exitCode).toBe(1);
+    expect(stderr).toMatch(/cancelled|access_denied|OAuth failed/);
+  });
+
+  test("polling gets NotFoundError (daemon restarted) → exits 1 with helpful message immediately", async () => {
+    let ipcCallIndex = 0;
+    mockCliIpcCallFn = mock(() => {
+      ipcCallIndex++;
+      if (ipcCallIndex === 1) {
+        return Promise.resolve({
+          ok: true,
+          result: { auth_url: "https://auth.example.com", state: "srv" },
+        });
+      }
+      // Daemon restarted — state lost
+      return Promise.resolve({
+        ok: false,
+        error: 'No active OAuth flow for server "srv"',
+      });
+    });
+
+    const { exitCode, stderr } = await runMcp("auth", ["srv"]);
+
+    expect(exitCode).toBe(1);
+    expect(stderr).toMatch(/assistant may have restarted|OAuth flow was lost/);
+  });
+
+  test("IPC start returns ok=true with already_authenticated → exits 0 without OAuth flow", async () => {
+    mockCliIpcCallFn = mock(() =>
+      Promise.resolve({
+        ok: true,
+        result: { auth_url: "", state: "srv", already_authenticated: true },
+      }),
+    );
+
+    const { exitCode, stdout } = await runMcp("auth", ["srv"]);
+
+    expect(exitCode).toBe(0);
+    expect(stdout).toContain("already authenticated");
+    // Should not have opened the browser or started polling
+    expect(mockOpenInHostBrowserFn).not.toHaveBeenCalled();
+    expect(mockCliIpcCallFn.mock.calls.length).toBe(1);
+  });
+
+  test("polling gets a non-notfound IPC error → exits 1 immediately with the error message", async () => {
+    let ipcCallIndex = 0;
+    mockCliIpcCallFn = mock(() => {
+      ipcCallIndex++;
+      if (ipcCallIndex === 1) {
+        return Promise.resolve({
+          ok: true,
+          result: { auth_url: "https://auth.example.com", state: "srv" },
+        });
+      }
+      // Unexpected IPC error (not "No active OAuth flow")
+      return Promise.resolve({
+        ok: false,
+        error: "Internal server error during polling",
+      });
+    });
+
+    const { exitCode, stderr } = await runMcp("auth", ["srv"]);
+
+    expect(exitCode).toBe(1);
+    expect(stderr).toMatch(/Internal server error during polling/);
+    // Should fail fast — only 1 start call + 1 poll call, not the full timeout
+    expect(mockCliIpcCallFn.mock.calls.length).toBe(2);
+  });
+});

package/src/__tests__/memory-admin-recall.test.ts

@@ -15,7 +15,6 @@ interface CapturedSearch {
 
 const capturedSearches: CapturedSearch[] = [];
 const getConfiguredProviderCalls: string[] = [];
-const scopeByConversation = new Map<string, string | undefined>();
 const testConfig = {} as AssistantConfig;
 
 mock.module("../config/loader.js", () => ({
@@ -56,13 +55,11 @@ mock.module("../memory/embedding-backend.js", () => ({
 
 mock.module("../memory/conversation-crud.js", () => ({
   addMessage: () => ({ id: "msg-1" }),
-  createConversation: () => ({ id: "conv-1", memoryScopeId: "default" }),
+  createConversation: () => ({ id: "conv-1" }),
   deleteConversation: () => true,
   getAssistantMessageIdsInTurn: () => [],
   getConversation: () => null,
   getConversationHostAccess: () => false,
-  getConversationMemoryScopeId: (conversationId: string) =>
-    scopeByConversation.get(conversationId),
   getConversationOverrideProfile: () => undefined,
   getConversationSource: () => null,
   getMessageById: () => null,
@@ -165,12 +162,9 @@ describe("memory admin recall", () => {
   beforeEach(() => {
     capturedSearches.length = 0;
     getConfiguredProviderCalls.length = 0;
-    scopeByConversation.clear();
   });
 
-  test("uses the conversation memory scope and safe admin sources", async () => {
-    scopeByConversation.set("conv-admin", "scope-admin");
-
+  test("uses safe admin sources", async () => {
     const result = await queryMemory("launch notes", "conv-admin");
 
     expect(capturedSearches).toHaveLength(1);
@@ -180,7 +174,6 @@ describe("memory admin recall", () => {
     });
     expect(capturedSearches[0].context).toMatchObject({
       workingDir: getWorkspaceDir(),
-      memoryScopeId: "scope-admin",
       conversationId: "conv-admin",
       config: testConfig,
     });
@@ -202,13 +195,12 @@ describe("memory admin recall", () => {
     });
   });
 
-  test("falls back to default scope without invoking a provider", async () => {
+  test("does not invoke a provider for deterministic recall", async () => {
     await queryMemory("offline recall", "missing-conversation");
 
     expect(capturedSearches).toHaveLength(1);
     expect(capturedSearches[0].context).toMatchObject({
       workingDir: getWorkspaceDir(),
-      memoryScopeId: "default",
       conversationId: "missing-conversation",
     });
     expect(capturedSearches[0].input.sources).toEqual([