@vellumai/assistant 0.8.0 → 0.8.1

package/src/__tests__/config-set-platform-guard.test.ts

@@ -4,6 +4,11 @@ import { Command } from "commander";
 
 // ---------------------------------------------------------------------------
 // Mock state
+//
+// The `config` CLI is now an IPC-tagged command (routed via cliIpcCall) so
+// these tests assert on the IPC calls the CLI emits, not on direct loader
+// writes. The only non-IPC interaction is `requirePlatformConnection`, which
+// reads the platform client - mocked below.
 // ---------------------------------------------------------------------------
 
 let mockPlatformClientCreate: () => Promise<Record<
@@ -11,20 +16,20 @@ let mockPlatformClientCreate: () => Promise<Record<
   unknown
 > | null> = async () => null;
 
-let mockLoadRawConfig: () => Record<string, unknown> = () => ({});
-const mockSaveRawConfigCalls: Array<Record<string, unknown>> = [];
-const mockSetNestedValueCalls: Array<{
-  obj: Record<string, unknown>;
-  key: string;
-  value: unknown;
+const mockIpcCalls: Array<{
+  method: string;
+  params?: Record<string, unknown>;
 }> = [];
-let mockGetNestedValue: (
-  obj: Record<string, unknown>,
-  key: string,
-) => unknown = () => undefined;
+
+let mockIpcResult: {
+  ok: boolean;
+  result?: unknown;
+  error?: string;
+  statusCode?: number;
+} = { ok: true, result: { ok: true } };
 
 // ---------------------------------------------------------------------------
-// Mocks — platform/client (controls requirePlatformConnection)
+// Mocks - platform/client (controls requirePlatformConnection)
 // ---------------------------------------------------------------------------
 
 mock.module("../platform/client.js", () => ({
@@ -34,57 +39,37 @@ mock.module("../platform/client.js", () => ({
 }));
 
 // ---------------------------------------------------------------------------
-// Mocks — config/loader
+// Mocks - ipc/cli-client (the CLI's only write path)
 // ---------------------------------------------------------------------------
 
-mock.module("../config/loader.js", () => ({
-  getConfig: () => ({ services: {} }),
-  loadConfig: () => ({ services: {} }),
-  invalidateConfigCache: () => {},
-  loadRawConfig: () => mockLoadRawConfig(),
-  saveRawConfig: (raw: Record<string, unknown>) => {
-    mockSaveRawConfigCalls.push(raw);
-  },
-  applyNestedDefaults: (c: unknown) => c,
-  deepMergeOverwrite: (a: unknown) => a,
-  mergeDefaultWorkspaceConfig: () => {},
-  getNestedValue: (obj: Record<string, unknown>, key: string) =>
-    mockGetNestedValue(obj, key),
-  setNestedValue: (
-    obj: Record<string, unknown>,
-    key: string,
-    value: unknown,
+mock.module("../ipc/cli-client.js", () => ({
+  cliIpcCall: async (
+    method: string,
+    params?: Record<string, unknown>,
   ) => {
-    mockSetNestedValueCalls.push({ obj, key, value });
-    const keys = key.split(".");
-    let current = obj;
-    for (let i = 0; i < keys.length - 1; i++) {
-      const segment = keys[i]!;
-      if (
-        current[segment] == null ||
-        typeof current[segment] !== "object" ||
-        Array.isArray(current[segment])
-      ) {
-        current[segment] = {};
-      }
-      current = current[segment] as Record<string, unknown>;
+    mockIpcCalls.push({ method, params });
+    return mockIpcResult;
+  },
+  exitFromIpcResult: (r: {
+    error?: string;
+    statusCode?: number;
+  }) => {
+    process.stderr.write((r.error ?? "Unknown error") + "\n");
+    if (r.statusCode === undefined) {
+      process.exitCode = 10;
+    } else if (r.statusCode >= 500) {
+      process.exitCode = 3;
+    } else if (r.statusCode >= 400) {
+      process.exitCode = 2;
+    } else {
+      process.exitCode = 1;
     }
-    current[keys[keys.length - 1]!] = value;
+    throw new Error(`exitFromIpcResult(${r.statusCode ?? "no-status"})`);
   },
-  API_KEY_PROVIDERS: [
-    "anthropic",
-    "openai",
-    "gemini",
-    "ollama",
-    "fireworks",
-    "openrouter",
-    "brave",
-    "perplexity",
-  ],
 }));
 
 // ---------------------------------------------------------------------------
-// Mocks — util/logger (suppress log output)
+// Mocks - util/logger (suppress log output)
 // ---------------------------------------------------------------------------
 
 mock.module("../util/logger.js", () => ({
@@ -103,7 +88,7 @@ mock.module("../util/logger.js", () => ({
 }));
 
 // ---------------------------------------------------------------------------
-// Mocks — oauth/oauth-store (transitive dep of oauth/shared.ts)
+// Mocks - oauth/oauth-store (transitive dep guard for oauth/shared.ts)
 // ---------------------------------------------------------------------------
 
 mock.module("../oauth/oauth-store.js", () => ({
@@ -187,38 +172,15 @@ async function runCli(
 // Tests
 // ---------------------------------------------------------------------------
 
-describe("config set — platform connection guard for service mode paths", () => {
+describe("config set - platform connection guard for service mode paths", () => {
   beforeEach(() => {
     // Default: not connected to platform
     mockPlatformClientCreate = async () => null;
-    mockLoadRawConfig = () => ({});
-    mockSaveRawConfigCalls.length = 0;
-    mockSetNestedValueCalls.length = 0;
-    mockGetNestedValue = () => undefined;
-  });
-
-  test("config set services.inference.mode managed — fails when not connected", async () => {
-    const { exitCode, stdout } = await runCli([
-      "node",
-      "assistant",
-      "--json",
-      "config",
-      "set",
-      "services.inference.mode",
-      "managed",
-    ]);
-
-    expect(exitCode).toBe(1);
-    const parsed = JSON.parse(stdout);
-    expect(parsed.ok).toBe(false);
-    expect(parsed.error).toContain("vellum platform connect");
-    expect(parsed.error).toContain("Not connected");
-    // Config should NOT have been written
-    expect(mockSaveRawConfigCalls).toHaveLength(0);
-    expect(mockSetNestedValueCalls).toHaveLength(0);
+    mockIpcCalls.length = 0;
+    mockIpcResult = { ok: true, result: { ok: true } };
   });
 
-  test("config set services.image-generation.mode your-own — succeeds without platform connection", async () => {
+  test("config set services.image-generation.mode your-own - succeeds without platform connection", async () => {
     const { exitCode } = await runCli([
       "node",
       "assistant",
@@ -230,16 +192,18 @@ describe("config set — platform connection guard for service mode paths", () =
     ]);
 
     expect(exitCode).toBe(0);
-    // Config should have been written — setting to "your-own" doesn't need platform
-    expect(mockSetNestedValueCalls).toHaveLength(1);
-    expect(mockSetNestedValueCalls[0]!.key).toBe(
-      "services.image-generation.mode",
-    );
-    expect(mockSetNestedValueCalls[0]!.value).toBe("your-own");
-    expect(mockSaveRawConfigCalls).toHaveLength(1);
+    // The CLI should have emitted exactly one config_set IPC call.
+    const setCalls = mockIpcCalls.filter((c) => c.method === "config_set");
+    expect(setCalls).toHaveLength(1);
+    expect(setCalls[0]!.params).toEqual({
+      body: {
+        path: "services.image-generation.mode",
+        value: "your-own",
+      },
+    });
   });
 
-  test("config set calls.enabled true — succeeds without platform connection", async () => {
+  test("config set calls.enabled true - succeeds without platform connection and parses to boolean", async () => {
     const { exitCode } = await runCli([
       "node",
       "assistant",
@@ -250,21 +214,17 @@ describe("config set — platform connection guard for service mode paths", () =
     ]);
 
     expect(exitCode).toBe(0);
-    // Config should have been written
-    expect(mockSetNestedValueCalls).toHaveLength(1);
-    expect(mockSetNestedValueCalls[0]!.key).toBe("calls.enabled");
-    expect(mockSetNestedValueCalls[0]!.value).toBe(true);
-    expect(mockSaveRawConfigCalls).toHaveLength(1);
-  });
-
-  test("config set ingress.publicBaseUrl overwrites existing value", async () => {
-    mockLoadRawConfig = () => ({
-      ingress: {
-        publicBaseUrl: "https://stale-velay.example.test",
-        publicBaseUrlManagedBy: "velay",
-      },
+    const setCalls = mockIpcCalls.filter((c) => c.method === "config_set");
+    expect(setCalls).toHaveLength(1);
+    expect(setCalls[0]!.params).toEqual({
+      body: { path: "calls.enabled", value: true },
     });
+  });
 
+  test("config set ingress.publicBaseUrl - sends the new value to the daemon", async () => {
+    // Daemon-side semantics (sibling preservation, deep-merge avoidance) are
+    // covered by daemon route tests. Here we only verify the CLI sends the
+    // correct dotted-path + value pair via IPC.
     const { exitCode } = await runCli([
       "node",
       "assistant",
@@ -275,36 +235,17 @@ describe("config set — platform connection guard for service mode paths", () =
     ]);
 
     expect(exitCode).toBe(0);
-    expect(mockSaveRawConfigCalls).toHaveLength(1);
-    expect(mockSaveRawConfigCalls[0]).toEqual({
-      ingress: {
-        publicBaseUrl: "https://manual.example.test",
-        publicBaseUrlManagedBy: "velay",
+    const setCalls = mockIpcCalls.filter((c) => c.method === "config_set");
+    expect(setCalls).toHaveLength(1);
+    expect(setCalls[0]!.params).toEqual({
+      body: {
+        path: "ingress.publicBaseUrl",
+        value: "https://manual.example.test",
       },
     });
   });
 
-  test("config get services.inference.mode — works without platform connection", async () => {
-    mockGetNestedValue = (_obj, key) => {
-      if (key === "services.inference.mode") return "your-own";
-      return undefined;
-    };
-
-    const { exitCode } = await runCli([
-      "node",
-      "assistant",
-      "config",
-      "get",
-      "services.inference.mode",
-    ]);
-
-    expect(exitCode).toBe(0);
-    // No writes should have occurred
-    expect(mockSaveRawConfigCalls).toHaveLength(0);
-    expect(mockSetNestedValueCalls).toHaveLength(0);
-  });
-
-  test("config set services.web-search.mode managed — fails when not connected", async () => {
+  test("config set services.web-search.mode managed - fails when not connected, no IPC write emitted", async () => {
     const { exitCode, stdout } = await runCli([
       "node",
       "assistant",
@@ -319,28 +260,10 @@ describe("config set — platform connection guard for service mode paths", () =
     const parsed = JSON.parse(stdout);
     expect(parsed.ok).toBe(false);
     expect(parsed.error).toContain("vellum platform connect");
-    expect(mockSaveRawConfigCalls).toHaveLength(0);
-  });
-
-  test("config set services.inference.mode managed — succeeds when connected", async () => {
-    mockPlatformClientCreate = async () => ({
-      platformAssistantId: "asst-123",
-      fetch: async () => new Response(),
-    });
-
-    const { exitCode } = await runCli([
-      "node",
-      "assistant",
-      "config",
-      "set",
-      "services.inference.mode",
-      "managed",
-    ]);
-
-    expect(exitCode).toBe(0);
-    expect(mockSetNestedValueCalls).toHaveLength(1);
-    expect(mockSetNestedValueCalls[0]!.key).toBe("services.inference.mode");
-    expect(mockSetNestedValueCalls[0]!.value).toBe("managed");
-    expect(mockSaveRawConfigCalls).toHaveLength(1);
+    // The guard runs *before* the IPC call - no config_set should have been
+    // emitted.
+    expect(
+      mockIpcCalls.filter((c) => c.method === "config_set"),
+    ).toHaveLength(0);
   });
 });

package/src/__tests__/config-set-route.test.ts

@@ -0,0 +1,198 @@
+/**
+ * Daemon-side tests for the `config_set` and `config_allowlist_validate`
+ * IPC routes. Exercises input validation + error handling on the route
+ * handlers directly (Codex review feedback on PR #30262).
+ */
+
+import { describe, expect, mock, test } from "bun:test";
+
+import { makeMockLogger } from "./helpers/mock-logger.js";
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () => makeMockLogger(),
+}));
+
+// ---------------------------------------------------------------------------
+// Mocks for handleSetConfig's transitive deps
+// ---------------------------------------------------------------------------
+
+let savedRaw: Record<string, unknown> | null = null;
+let rawConfig: Record<string, unknown> = {};
+
+mock.module("../config/loader.js", () => ({
+  loadRawConfig: () => structuredClone(rawConfig),
+  saveRawConfig: (raw: Record<string, unknown>) => {
+    savedRaw = raw;
+  },
+  deepMergeOverwrite: () => {},
+  getConfig: () => rawConfig,
+  invalidateConfigCache: () => {},
+  // setNestedValue is also exported by loader; handleSetConfig imports the
+  // real one from this module, so we re-export a thin implementation that
+  // mutates in place (matches loader's behavior).
+  setNestedValue: (
+    obj: Record<string, unknown>,
+    path: string,
+    value: unknown,
+  ) => {
+    const keys = path.split(".");
+    let current: Record<string, unknown> = obj;
+    for (let i = 0; i < keys.length - 1; i++) {
+      const key = keys[i]!;
+      if (current[key] == null || typeof current[key] !== "object") {
+        current[key] = {};
+      }
+      current = current[key] as Record<string, unknown>;
+    }
+    current[keys[keys.length - 1]!] = value;
+  },
+}));
+
+mock.module("../providers/registry.js", () => ({
+  initializeProviders: async () => {},
+}));
+
+mock.module("../memory/embedding-backend.js", () => ({
+  clearEmbeddingBackendCache: () => {},
+}));
+
+// ---------------------------------------------------------------------------
+// Mock the allowlist module so we can drive throw / return paths
+// ---------------------------------------------------------------------------
+
+let mockAllowlistResult:
+  | { kind: "ok"; value: Array<{ index: number; pattern: string; message: string }> | null }
+  | { kind: "throw"; error: Error } = { kind: "ok", value: null };
+
+mock.module("../security/secret-allowlist.js", () => ({
+  validateAllowlistFile: () => {
+    if (mockAllowlistResult.kind === "throw") {
+      throw mockAllowlistResult.error;
+    }
+    return mockAllowlistResult.value;
+  },
+}));
+
+import { ROUTES } from "../runtime/routes/conversation-query-routes.js";
+import { BadRequestError } from "../runtime/routes/errors.js";
+
+const configSetRoute = ROUTES.find((r) => r.operationId === "config_set")!;
+const allowlistRoute = ROUTES.find(
+  (r) => r.operationId === "config_allowlist_validate",
+)!;
+
+// ---------------------------------------------------------------------------
+// config_set request validation
+// ---------------------------------------------------------------------------
+
+describe("config_set route - request validation", () => {
+  test("rejects body with missing value field (P2 - Codex)", async () => {
+    // Body has a path but no value key — would otherwise pass `undefined`
+    // through setNestedValue and silently drop the key on save.
+    await expect(
+      configSetRoute.handler({ body: { path: "foo.bar" } }),
+    ).rejects.toThrow(BadRequestError);
+    await expect(
+      configSetRoute.handler({ body: { path: "foo.bar" } }),
+    ).rejects.toThrow("`value` is required");
+  });
+
+  test("accepts body with explicit null value", async () => {
+    rawConfig = { heartbeat: { activeHoursStart: "09:00" } };
+    savedRaw = null;
+    const result = await configSetRoute.handler({
+      body: { path: "heartbeat.activeHoursStart", value: null },
+    });
+    expect(result).toEqual({ ok: true });
+    expect(savedRaw).not.toBeNull();
+    const heartbeat = (savedRaw as unknown as Record<string, unknown>)
+      .heartbeat as Record<string, unknown>;
+    expect(heartbeat.activeHoursStart).toBeNull();
+  });
+
+  test("rejects body missing path field", async () => {
+    await expect(
+      configSetRoute.handler({ body: { value: "foo" } }),
+    ).rejects.toThrow(BadRequestError);
+  });
+
+  test("rejects body that is not a plain object", async () => {
+    // Pass null/array via the unknown cast because RouteHandlerArgs.body
+    // narrows to Record<string, unknown> | undefined - we explicitly want
+    // to test the runtime guard against malformed inputs.
+    await expect(
+      configSetRoute.handler({
+        body: null as unknown as Record<string, unknown>,
+      }),
+    ).rejects.toThrow(BadRequestError);
+    await expect(
+      configSetRoute.handler({
+        body: [] as unknown as Record<string, unknown>,
+      }),
+    ).rejects.toThrow(BadRequestError);
+  });
+
+  test("accepts a normal scalar set and writes to raw config", async () => {
+    rawConfig = {};
+    savedRaw = null;
+    const result = await configSetRoute.handler({
+      body: { path: "calls.enabled", value: true },
+    });
+    expect(result).toEqual({ ok: true });
+    const calls = (savedRaw as unknown as Record<string, unknown>)
+      .calls as Record<string, unknown>;
+    expect(calls.enabled).toBe(true);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// config_allowlist_validate error handling
+// ---------------------------------------------------------------------------
+
+describe("config_allowlist_validate route - error handling", () => {
+  test("returns parseError when validateAllowlistFile throws (P3 - Codex)", () => {
+    mockAllowlistResult = {
+      kind: "throw",
+      error: new SyntaxError("Unexpected token } in JSON at position 42"),
+    };
+
+    const result = allowlistRoute.handler({}) as {
+      exists: boolean;
+      parseError?: string;
+      errors: unknown[];
+    };
+    expect(result.exists).toBe(true);
+    expect(result.parseError).toContain("Unexpected token");
+    expect(result.errors).toEqual([]);
+  });
+
+  test("returns { exists: false } when file is absent", () => {
+    mockAllowlistResult = { kind: "ok", value: null };
+    const result = allowlistRoute.handler({}) as { exists: boolean };
+    expect(result.exists).toBe(false);
+  });
+
+  test("returns { exists: true, errors } when file is valid", () => {
+    mockAllowlistResult = { kind: "ok", value: [] };
+    const result = allowlistRoute.handler({}) as {
+      exists: boolean;
+      errors: unknown[];
+    };
+    expect(result.exists).toBe(true);
+    expect(result.errors).toEqual([]);
+  });
+
+  test("returns { exists: true, errors } with details when patterns are invalid", () => {
+    mockAllowlistResult = {
+      kind: "ok",
+      value: [{ index: 0, pattern: "(", message: "Unterminated group" }],
+    };
+    const result = allowlistRoute.handler({}) as {
+      exists: boolean;
+      errors: Array<{ index: number; pattern: string; message: string }>;
+    };
+    expect(result.exists).toBe(true);
+    expect(result.errors).toHaveLength(1);
+    expect(result.errors[0]?.message).toBe("Unterminated group");
+  });
+});

package/src/__tests__/config-watcher.test.ts

@@ -118,6 +118,12 @@ mock.module("../providers/registry.js", () => ({
   listProviders: () => [],
   getProviderRoutingSource: () => undefined,
   initializeProviders: () => {},
+  // Required by `providers/inference/connections.ts` and
+  // `providers/connection-resolution.ts`, both loaded transitively when
+  // ConfigWatcher's deps resolve. Without these, the import chain throws
+  // "Export named '...' not found in module 'registry.ts'".
+  clearConnectionProviderCache: () => {},
+  resolveProviderFromConnection: async () => null,
 }));
 
 mock.module("../daemon/mcp-reload-service.js", () => ({