@vellumai/assistant 0.7.2 → 0.7.3

package/src/__tests__/host-cu-proxy.test.ts

@@ -2,12 +2,22 @@ import { afterEach, describe, expect, jest, mock, test } from "bun:test";
 
 const sentMessages: unknown[] = [];
 let mockHasClient = false;
+type MockClient = {
+  clientId: string;
+  capabilities: string[];
+  actorPrincipalId?: string;
+};
+let mockClients: MockClient[] = [];
 
 mock.module("../runtime/assistant-event-hub.js", () => ({
   broadcastMessage: (msg: unknown) => sentMessages.push(msg),
   assistantEventHub: {
     getMostRecentClientByCapability: (cap: string) =>
       cap === "host_cu" && mockHasClient ? { id: "mock-client" } : null,
+    getClientById: (id: string) =>
+      mockClients.find((c) => c.clientId === id) ?? undefined,
+    getActorPrincipalIdForClient: (id: string) =>
+      mockClients.find((c) => c.clientId === id)?.actorPrincipalId,
   },
 }));
 
@@ -21,6 +31,7 @@ describe("HostCuProxy", () => {
   function setup(maxSteps?: number) {
     sentMessages.length = 0;
     mockHasClient = false;
+    mockClients = [];
     pendingInteractions.clear();
     proxy = new HostCuProxy(maxSteps);
   }
@@ -974,7 +985,203 @@ describe("HostCuProxy", () => {
     });
   });
 
-  // targetClientId validation lives at the surfaceProxyResolver layer (so an
-  // invalid ID does not burn a step or pollute action history before being
-  // rejected). See cu-unified-flow.test.ts for those tests.
+  // -------------------------------------------------------------------------
+  // targetClientId validation
+  //
+  // The surfaceProxyResolver layer validates first (so an invalid ID does
+  // not burn a step or pollute action history — see cu-unified-flow.test.ts
+  // for those tests). The proxy ALSO validates internally because it is
+  // exposed as a separately-callable API; these tests exercise that
+  // backstop along with the same-user enforcement.
+  // -------------------------------------------------------------------------
+
+  describe("targetClientId validation", () => {
+    test("rejects when targetClientId does not match any connected client", async () => {
+      setup();
+      mockClients = [
+        {
+          clientId: "real-client",
+          capabilities: ["host_cu"],
+          actorPrincipalId: "user-1",
+        },
+      ];
+
+      const result = await proxy.request(
+        "computer_use_click",
+        { element_id: 1 },
+        "session-1",
+        1,
+        undefined,
+        undefined,
+        "ghost-client",
+        "user-1",
+      );
+
+      expect(result.isError).toBe(true);
+      expect(result.content).toContain("ghost-client");
+      expect(result.content).toContain("host_cu");
+      expect(sentMessages).toHaveLength(0);
+    });
+
+    test("rejects when target client lacks host_cu capability", async () => {
+      setup();
+      mockClients = [
+        {
+          clientId: "no-cu-client",
+          capabilities: ["host_bash"],
+          actorPrincipalId: "user-1",
+        },
+      ];
+
+      const result = await proxy.request(
+        "computer_use_click",
+        { element_id: 1 },
+        "session-1",
+        1,
+        undefined,
+        undefined,
+        "no-cu-client",
+        "user-1",
+      );
+
+      expect(result.isError).toBe(true);
+      expect(result.content).toContain("does not support host_cu");
+      expect(sentMessages).toHaveLength(0);
+    });
+
+    test("succeeds when caller and target share the same actor principal", async () => {
+      setup();
+      mockClients = [
+        {
+          clientId: "cu-client",
+          capabilities: ["host_cu"],
+          actorPrincipalId: "user-1",
+        },
+      ];
+
+      const resultPromise = proxy.request(
+        "computer_use_click",
+        { element_id: 1 },
+        "session-1",
+        1,
+        undefined,
+        undefined,
+        "cu-client",
+        "user-1",
+      );
+
+      expect(sentMessages).toHaveLength(1);
+      const sent = sentMessages[0] as Record<string, unknown>;
+      expect(sent.type).toBe("host_cu_request");
+      expect(sent.targetClientId).toBe("cu-client");
+
+      proxy.processObservation(sent.requestId as string, { axTree: "ok" });
+      const result = await resultPromise;
+      expect(result.isError).toBe(false);
+    });
+
+    test("rejects cross-user targeted request", async () => {
+      setup();
+      mockClients = [
+        {
+          clientId: "cu-client",
+          capabilities: ["host_cu"],
+          actorPrincipalId: "user-2",
+        },
+      ];
+
+      const result = await proxy.request(
+        "computer_use_click",
+        { element_id: 1 },
+        "session-1",
+        1,
+        undefined,
+        undefined,
+        "cu-client",
+        "user-1",
+      );
+
+      expect(result.isError).toBe(true);
+      expect(result.content).toContain(
+        "Submitting actor does not match the target client's actor",
+      );
+      expect(sentMessages).toHaveLength(0);
+    });
+
+    test("rejects when source actor principal is missing", async () => {
+      setup();
+      mockClients = [
+        {
+          clientId: "cu-client",
+          capabilities: ["host_cu"],
+          actorPrincipalId: "user-1",
+        },
+      ];
+
+      const result = await proxy.request(
+        "computer_use_click",
+        { element_id: 1 },
+        "session-1",
+        1,
+        undefined,
+        undefined,
+        "cu-client",
+        // sourceActorPrincipalId omitted
+      );
+
+      expect(result.isError).toBe(true);
+      expect(result.content).toContain(
+        "Submitting actor does not match the target client's actor",
+      );
+      expect(sentMessages).toHaveLength(0);
+    });
+
+    test("rejects when target actor principal is missing", async () => {
+      setup();
+      mockClients = [
+        {
+          clientId: "cu-client",
+          capabilities: ["host_cu"],
+          // actorPrincipalId omitted
+        },
+      ];
+
+      const result = await proxy.request(
+        "computer_use_click",
+        { element_id: 1 },
+        "session-1",
+        1,
+        undefined,
+        undefined,
+        "cu-client",
+        "user-1",
+      );
+
+      expect(result.isError).toBe(true);
+      expect(result.content).toContain(
+        "Submitting actor does not match the target client's actor",
+      );
+      expect(sentMessages).toHaveLength(0);
+    });
+
+    test("untargeted request bypasses same-user check", async () => {
+      setup();
+      // No targetClientId, no sourceActorPrincipalId — flow proceeds.
+      const resultPromise = proxy.request(
+        "computer_use_click",
+        { element_id: 1 },
+        "session-1",
+        1,
+      );
+
+      expect(sentMessages).toHaveLength(1);
+      const sent = sentMessages[0] as Record<string, unknown>;
+      expect(sent.type).toBe("host_cu_request");
+      expect(sent.targetClientId).toBeUndefined();
+
+      proxy.processObservation(sent.requestId as string, { axTree: "ok" });
+      const result = await resultPromise;
+      expect(result.isError).toBe(false);
+    });
+  });
 });

package/src/__tests__/host-cu-routes-targeted.test.ts

@@ -42,7 +42,6 @@ mock.module("../config/env.js", () => ({
   getPlatformOrganizationId: () => "test-org-id",
   setPlatformUserId: () => {},
   getPlatformUserId: () => "test-user-id",
-  getPlatformInternalApiKey: () => "test-api-key",
   validateEnv: () => {},
 }));
 
@@ -71,19 +70,30 @@ interface CuResolveCall {
 const cuResolveSpy: CuResolveCall[] = [];
 
 // Controlled conversation map: conversationId → conversation object
-const conversationStore = new Map<string, { hostCuProxy?: { processObservation: (...args: unknown[]) => void } }>();
+const conversationStore = new Map<
+  string,
+  { hostCuProxy?: { processObservation: (...args: unknown[]) => void } }
+>();
 
 mock.module("../daemon/conversation-store.js", () => ({
-  findConversation: (conversationId: string) => conversationStore.get(conversationId),
+  findConversation: (conversationId: string) =>
+    conversationStore.get(conversationId),
+}));
+
+// Controlled actor-principal map: clientId → actorPrincipalId
+const actorPrincipalByClient = new Map<string, string>();
+
+mock.module("../runtime/assistant-event-hub.js", () => ({
+  assistantEventHub: {
+    getActorPrincipalIdForClient: (clientId: string) =>
+      actorPrincipalByClient.get(clientId),
+  },
 }));
 
 // ── Real imports (after mocks) ──────────────────────────────────────────────
 // Use dynamic import to ensure the mocks above are applied before loading.
 
-import {
-  BadRequestError,
-  ForbiddenError,
-} from "../runtime/routes/errors.js";
+import { BadRequestError, ForbiddenError } from "../runtime/routes/errors.js";
 
 const { ROUTES } = await import("../runtime/routes/host-cu-routes.js");
 
@@ -101,10 +111,16 @@ function registerPending(
   requestId: string,
   overrides: Partial<PendingInteraction> = {},
 ): void {
+  const targetActorPrincipalId =
+    overrides.targetActorPrincipalId ??
+    (overrides.targetClientId
+      ? actorPrincipalByClient.get(overrides.targetClientId)
+      : undefined);
   const entry: PendingInteraction = {
     conversationId: "conv-cu-1",
     kind: "host_cu",
     ...overrides,
+    targetActorPrincipalId,
   };
   pendingStore.set(requestId, entry);
 }
@@ -139,6 +155,7 @@ describe("handleHostCuResult — Phase 2 targetClientId guard", () => {
   beforeEach(() => {
     pendingStore.clear();
     conversationStore.clear();
+    actorPrincipalByClient.clear();
     resolvedIds.length = 0;
     cuResolveSpy.length = 0;
     // Default: register a conversation with a hostCuProxy
@@ -150,11 +167,15 @@ describe("handleHostCuResult — Phase 2 targetClientId guard", () => {
   describe("targeted + correct x-vellum-client-id header", () => {
     test("returns { accepted: true } and resolves the interaction", async () => {
       const requestId = "req-cu-targeted-match";
+      actorPrincipalByClient.set("client-A", "user-1");
       registerPending(requestId, { targetClientId: "client-A" });
 
       const result = await handleHostCuResult({
         body: cuBody(requestId),
-        headers: { "x-vellum-client-id": "client-A" },
+        headers: {
+          "x-vellum-client-id": "client-A",
+          "x-vellum-actor-principal-id": "user-1",
+        },
       });
 
       expect(result).toEqual({ accepted: true });
@@ -165,11 +186,15 @@ describe("handleHostCuResult — Phase 2 targetClientId guard", () => {
 
     test("trims whitespace from header before comparing", async () => {
       const requestId = "req-cu-targeted-trim";
+      actorPrincipalByClient.set("client-A", "user-1");
       registerPending(requestId, { targetClientId: "client-A" });
 
       const result = await handleHostCuResult({
         body: cuBody(requestId),
-        headers: { "x-vellum-client-id": "  client-A  " },
+        headers: {
+          "x-vellum-client-id": "  client-A  ",
+          "x-vellum-actor-principal-id": "user-1",
+        },
       });
 
       expect(result).toEqual({ accepted: true });
@@ -183,9 +208,9 @@ describe("handleHostCuResult — Phase 2 targetClientId guard", () => {
       const requestId = "req-cu-targeted-no-header";
       registerPending(requestId, { targetClientId: "client-A" });
 
-      expect(() =>
-        handleHostCuResult({ body: cuBody(requestId) }),
-      ).toThrow(BadRequestError);
+      expect(() => handleHostCuResult({ body: cuBody(requestId) })).toThrow(
+        BadRequestError,
+      );
     });
 
     test("throws BadRequestError (400) when header is empty string", () => {
@@ -268,6 +293,110 @@ describe("handleHostCuResult — Phase 2 targetClientId guard", () => {
     });
   });
 
+  // ── 3b. Actor-principal-id (PR 7) — defense-in-depth ──────────────────────
+
+  describe("targeted + actor-principal-id binding", () => {
+    test("accepts when submitting actor matches target client's stored actor", async () => {
+      const requestId = "req-cu-actor-match";
+      actorPrincipalByClient.set("client-A", "user-1");
+      registerPending(requestId, { targetClientId: "client-A" });
+
+      const result = await handleHostCuResult({
+        body: cuBody(requestId),
+        headers: {
+          "x-vellum-client-id": "client-A",
+          "x-vellum-actor-principal-id": "user-1",
+        },
+      });
+
+      expect(result).toEqual({ accepted: true });
+      expect(cuResolveSpy).toHaveLength(1);
+      expect(resolvedIds).toContain(requestId);
+    });
+
+    test("throws ForbiddenError (403) when submitting actor does not match target client's actor", () => {
+      const requestId = "req-cu-actor-mismatch";
+      actorPrincipalByClient.set("client-A", "user-1");
+      registerPending(requestId, { targetClientId: "client-A" });
+
+      expect(() =>
+        handleHostCuResult({
+          body: cuBody(requestId),
+          headers: {
+            "x-vellum-client-id": "client-A",
+            "x-vellum-actor-principal-id": "user-2",
+          },
+        }),
+      ).toThrow(ForbiddenError);
+    });
+
+    test("interaction NOT consumed on 403 actor mismatch", () => {
+      const requestId = "req-cu-actor-mismatch-stays";
+      actorPrincipalByClient.set("client-A", "user-1");
+      registerPending(requestId, { targetClientId: "client-A" });
+
+      try {
+        handleHostCuResult({
+          body: cuBody(requestId),
+          headers: {
+            "x-vellum-client-id": "client-A",
+            "x-vellum-actor-principal-id": "user-2",
+          },
+        });
+      } catch {
+        // expected
+      }
+
+      expect(resolvedIds).not.toContain(requestId);
+      expect(pendingStore.has(requestId)).toBe(true);
+    });
+
+    test("throws ForbiddenError (403) when submitting actor header is missing", () => {
+      const requestId = "req-cu-actor-missing";
+      actorPrincipalByClient.set("client-A", "user-1");
+      registerPending(requestId, { targetClientId: "client-A" });
+
+      expect(() =>
+        handleHostCuResult({
+          body: cuBody(requestId),
+          headers: { "x-vellum-client-id": "client-A" },
+        }),
+      ).toThrow(ForbiddenError);
+    });
+
+    test("throws ForbiddenError (403) when target client has no stored actor principal id", () => {
+      const requestId = "req-cu-target-no-actor";
+      registerPending(requestId, { targetClientId: "client-A" });
+      // No actorPrincipalByClient entry for client-A.
+
+      expect(() =>
+        handleHostCuResult({
+          body: cuBody(requestId),
+          headers: {
+            "x-vellum-client-id": "client-A",
+            "x-vellum-actor-principal-id": "user-1",
+          },
+        }),
+      ).toThrow(ForbiddenError);
+    });
+
+    test("throws ForbiddenError (403) when submitting actor header is whitespace only", () => {
+      const requestId = "req-cu-actor-whitespace";
+      actorPrincipalByClient.set("client-A", "user-1");
+      registerPending(requestId, { targetClientId: "client-A" });
+
+      expect(() =>
+        handleHostCuResult({
+          body: cuBody(requestId),
+          headers: {
+            "x-vellum-client-id": "client-A",
+            "x-vellum-actor-principal-id": "   ",
+          },
+        }),
+      ).toThrow(ForbiddenError);
+    });
+  });
+
   // ── 4. Untargeted — regression ────────────────────────────────────────────
 
   describe("untargeted request (no targetClientId)", () => {

package/src/__tests__/host-file-proxy-targeted.test.ts

@@ -14,11 +14,24 @@ const sentMessages: unknown[] = [];
 const sentMessageOptions: unknown[] = [];
 const resolvedInteractionIds: string[] = [];
 let mockHasClient = false;
-let mockCapableClients: Array<{ clientId: string; capabilities: string[] }> = [];
-let mockClientRegistry: Map<string, { clientId: string; capabilities: string[] }> = new Map();
+type MockClient = {
+  clientId: string;
+  capabilities: string[];
+  actorPrincipalId?: string;
+};
+let mockCapableClients: Array<MockClient> = [];
+let mockClientRegistry: Map<string, MockClient> = new Map();
+
+// Pre-existing Phase 2 routing tests use a single user identity. The same-user
+// check added in PR 3 is exercised separately in `host-file-proxy.test.ts`.
+const TEST_PRINCIPAL = "test-user";
 
 mock.module("../runtime/assistant-event-hub.js", () => ({
-  broadcastMessage: (msg: unknown, _conversationId?: string, options?: unknown) => {
+  broadcastMessage: (
+    msg: unknown,
+    _conversationId?: string,
+    options?: unknown,
+  ) => {
     sentMessages.push(msg);
     sentMessageOptions.push(options);
   },
@@ -27,6 +40,8 @@ mock.module("../runtime/assistant-event-hub.js", () => ({
       cap === "host_file" && mockHasClient ? { id: "mock-client" } : null,
     listClientsByCapability: (_cap: string) => mockCapableClients,
     getClientById: (clientId: string) => mockClientRegistry.get(clientId),
+    getActorPrincipalIdForClient: (clientId: string) =>
+      mockClientRegistry.get(clientId)?.actorPrincipalId,
   },
 }));
 
@@ -42,9 +57,10 @@ mock.module("../runtime/pending-interactions.js", () => ({
     return interaction;
   },
   get: (requestId: string) => pendingInteractionMap.get(requestId),
-  getByKind: (_kind: string) => Array.from(pendingInteractionMap.entries())
-    .filter(([, v]) => v.kind === _kind)
-    .map(([requestId, v]) => ({ requestId, ...v })),
+  getByKind: (_kind: string) =>
+    Array.from(pendingInteractionMap.entries())
+      .filter(([, v]) => v.kind === _kind)
+      .map(([requestId, v]) => ({ requestId, ...v })),
   getByConversation: () => [],
   removeByConversation: () => {},
 }));
@@ -66,7 +82,11 @@ describe("HostFileProxy — targetClientId (Phase 2)", () => {
   }
 
   function setupSingleClient(clientId = "client-1") {
-    const entry = { clientId, capabilities: ["host_file"] };
+    const entry: MockClient = {
+      clientId,
+      capabilities: ["host_file"],
+      actorPrincipalId: TEST_PRINCIPAL,
+    };
     mockCapableClients = [entry];
     mockClientRegistry.set(clientId, entry);
   }
@@ -75,6 +95,7 @@ describe("HostFileProxy — targetClientId (Phase 2)", () => {
     mockCapableClients = clientIds.map((id) => ({
       clientId: id,
       capabilities: ["host_file"],
+      actorPrincipalId: TEST_PRINCIPAL,
     }));
     for (const entry of mockCapableClients) {
       mockClientRegistry.set(entry.clientId, entry);
@@ -104,6 +125,9 @@ describe("HostFileProxy — targetClientId (Phase 2)", () => {
           targetClientId: "client-mac",
         },
         "session-1",
+        undefined,
+        undefined,
+        TEST_PRINCIPAL,
       );
 
       expect(sentMessages).toHaveLength(1);
@@ -140,7 +164,9 @@ describe("HostFileProxy — targetClientId (Phase 2)", () => {
 
       expect(result.isError).toBe(true);
       expect(result.content).toContain("client-unknown");
-      expect(result.content).toContain("assistant clients list --capability host_file");
+      expect(result.content).toContain(
+        "assistant clients list --capability host_file",
+      );
       // No pending entry should have been created
       expect(sentMessages).toHaveLength(0);
     });
@@ -200,6 +226,9 @@ describe("HostFileProxy — targetClientId (Phase 2)", () => {
       const resultPromise = proxy.request(
         { operation: "read", path: "/tmp/file.txt" },
         "session-1",
+        undefined,
+        undefined,
+        TEST_PRINCIPAL,
       );
 
       expect(sentMessages).toHaveLength(1);
@@ -257,6 +286,8 @@ describe("HostFileProxy — targetClientId (Phase 2)", () => {
         { operation: "read", path: "/tmp/file.txt" },
         "session-1",
         controller.signal,
+        undefined,
+        TEST_PRINCIPAL,
       );
 
       const sent = sentMessages[0] as Record<string, unknown>;
@@ -273,7 +304,9 @@ describe("HostFileProxy — targetClientId (Phase 2)", () => {
       expect(cancelMsg.requestId).toBe(requestId);
       expect(cancelMsg.targetClientId).toBe("client-abc");
 
-      const cancelOpts = sentMessageOptions[1] as Record<string, unknown> | undefined;
+      const cancelOpts = sentMessageOptions[1] as
+        | Record<string, unknown>
+        | undefined;
       expect(cancelOpts?.targetClientId).toBe("client-abc");
     });
   });
@@ -288,6 +321,9 @@ describe("HostFileProxy — targetClientId (Phase 2)", () => {
       const p = proxy.request(
         { operation: "read", path: "/tmp/file.txt" },
         "session-1",
+        undefined,
+        undefined,
+        TEST_PRINCIPAL,
       );
       p.catch(() => {}); // expected rejection on dispose
 
@@ -320,6 +356,9 @@ describe("HostFileProxy — targetClientId (Phase 2)", () => {
         const resultPromise = proxy.request(
           { operation: "read", path: "/tmp/slow.txt" },
           "session-1",
+          undefined,
+          undefined,
+          TEST_PRINCIPAL,
         );
 
         const sent = sentMessages[0] as Record<string, unknown>;