@vellumai/assistant 0.8.6 → 0.8.7-dev.202606052118.34cd356

package/src/runtime/routes/acp-routes.test.ts

@@ -2,26 +2,28 @@
  * Tests for the ACP route handlers.
  *
  * Suites:
- *  - POST /v1/acp/spawn — the three failure paths produced by
- *    `resolveAcpAgent` (acp_disabled, unknown_agent, binary_not_found).
+ *  - POST /v1/acp/spawn: resolver failure paths (acp_disabled,
+ *    unknown_agent) and the body-shape guard. The binary_not_found /
+ *    auto-install surface is covered in `__tests__/acp-routes.test.ts`.
  *  - POST /v1/acp/spawn (env injection) — CLAUDE_CODE_OAUTH_TOKEN is read
- *    from the secure store under the canonical
- *    `credential/acp/claude_oauth_token` key (built by `credentialKey()`)
- *    and merged into `agentConfig.env` ONLY for the `claude` agent.
+ *    from the credential broker (policy-gated + audited) and merged into
+ *    `agentConfig.env` ONLY for the `claude` agent.
  *  - DELETE /v1/acp/sessions?status=completed — the bulk-clear route that
  *    wipes terminal-state rows (completed/failed/cancelled) from
- *    `acp_session_history` while leaving running/initializing rows intact.
+ *    `acp_session_history` while leaving running/initializing rows and
+ *    rows with an in-flight resume intact.
  *  - DELETE /v1/acp/sessions/:id — single-row delete: completed → 200,
- *    running → 409, unknown id → idempotent { deleted: false }.
+ *    running or mid-resume → 409, unknown id → idempotent
+ *    { deleted: false }.
  *
  * The spawn tests mirror the resolver's test setup using the shared
  * `installAcpConfigStub` and `installWhichStub` helpers so the host
  * environment doesn't influence the resolver's PATH preflight.
  *
- * The single-id delete tests stub `getAcpSessionManager` so we can drive
- * the in-memory-status check without spawning real ACP child processes,
- * and use the real DB (initialized via the test preload's per-file
- * workspace) to verify the row is actually removed.
+ * The delete tests stub `getAcpSessionManager` so we can drive the
+ * in-memory-status and pending-resume checks without spawning real ACP
+ * child processes, and use the real DB (initialized via the test preload's
+ * per-file workspace) to verify the row is actually removed.
  */
 
 import {
@@ -49,8 +51,10 @@ afterAll(() => {
 // in-memory-status check without spawning real ACP processes, and so the
 // env-injection spawn tests can capture the `agentConfig` arg without
 // launching a real subprocess. Stored in mutable state so individual tests
-// can plant arbitrary states / inspect capture.
+// can plant arbitrary states / inspect capture. `pendingResumeIds` models
+// ids reserved by an in-flight resumeFromHistory (no SessionEntry yet).
 const inMemoryStates = new Map<string, AcpSessionState>();
+const pendingResumeIds = new Set<string>();
 
 interface CapturedSpawn {
   agent: string;
@@ -71,6 +75,9 @@ mock.module("../../acp/index.js", () => ({
       if (!state) throw new Error(`ACP session "${id}" not found`);
       return state;
     },
+    getActiveAndPendingIds: () => [
+      ...new Set([...inMemoryStates.keys(), ...pendingResumeIds]),
+    ],
     spawn: async (
       agent: string,
       agentConfig: { env?: Record<string, string> },
@@ -84,12 +91,83 @@ mock.module("../../acp/index.js", () => ({
   }),
 }));
 
-// Stub secure-keys so env-injection tests can plant a known token (or
-// absence). Driven via `secureKeyStore` per test in beforeEach.
-const secureKeyStore = new Map<string, string>();
+// Stub credential broker + metadata store so env-injection tests can plant
+// a known token (or absence) without touching the real credential store.
+// The broker mock mirrors the real serverUse policy: metadata must exist
+// and allowedTools must include the requesting tool.
+const vaultStore = new Map<string, string>();
+const metadataStore = new Map<
+  string,
+  { allowedTools: string[]; usageDescription?: string }
+>();
+
+mock.module("../../tools/credentials/metadata-store.js", () => ({
+  getCredentialMetadata: (service: string, field: string) => {
+    const key = `${service}/${field}`;
+    const entry = metadataStore.get(key);
+    if (!entry) return undefined;
+    return {
+      credentialId: `cred-${key}`,
+      service,
+      field,
+      allowedTools: entry.allowedTools,
+      allowedDomains: [],
+      usageDescription: entry.usageDescription,
+      createdAt: 0,
+      updatedAt: 0,
+    };
+  },
+  upsertCredentialMetadata: (
+    service: string,
+    field: string,
+    policy?: { allowedTools?: string[]; usageDescription?: string },
+  ) => {
+    const key = `${service}/${field}`;
+    const existing = metadataStore.get(key);
+    metadataStore.set(key, {
+      allowedTools: policy?.allowedTools ?? existing?.allowedTools ?? [],
+      usageDescription:
+        policy?.usageDescription ?? existing?.usageDescription,
+    });
+    return {
+      credentialId: `cred-${key}`,
+      service,
+      field,
+      allowedTools: metadataStore.get(key)!.allowedTools,
+      allowedDomains: [],
+      createdAt: 0,
+      updatedAt: 0,
+    };
+  },
+}));
 
-mock.module("../../security/secure-keys.js", () => ({
-  getSecureKeyAsync: async (key: string) => secureKeyStore.get(key),
+mock.module("../../tools/credentials/broker.js", () => ({
+  credentialBroker: {
+    serverUse: async <T>(request: {
+      service: string;
+      field: string;
+      toolName: string;
+      execute: (value: string) => Promise<T>;
+    }) => {
+      const key = `${request.service}/${request.field}`;
+      const meta = metadataStore.get(key);
+      if (!meta) {
+        return { success: false, reason: `No credential found for ${key}` };
+      }
+      if (!meta.allowedTools.includes(request.toolName)) {
+        return {
+          success: false,
+          reason: `Tool "${request.toolName}" not allowed`,
+        };
+      }
+      const value = vaultStore.get(key);
+      if (!value) {
+        return { success: false, reason: `No stored value for ${key}` };
+      }
+      const result = await request.execute(value);
+      return { success: true, result };
+    },
+  },
 }));
 
 import { eq } from "drizzle-orm";
@@ -113,7 +191,8 @@ beforeEach(() => {
   config.setConfig({});
   which.setWhich((cmd) => `/usr/local/bin/${cmd}`);
   capturedSpawns.length = 0;
-  secureKeyStore.clear();
+  vaultStore.clear();
+  metadataStore.clear();
 });
 
 // ---------------------------------------------------------------------------
@@ -155,22 +234,6 @@ describe("POST /v1/acp/spawn", () => {
     ).rejects.toThrow('Unknown agent "nonexistent"');
   });
 
-  test("throws FailedDependencyError when the agent binary is missing", async () => {
-    config.setConfig({ agents: {} });
-    which.setWhich({});
-
-    const handler = getSpawnHandler();
-    await expect(
-      handler({
-        body: {
-          agent: "codex",
-          task: "do a thing",
-          conversationId: "conv-1",
-        },
-      }),
-    ).rejects.toThrow("codex-acp is not on PATH");
-  });
-
   test("body-shape guard short-circuits before the resolver runs", async () => {
     config.setConfig({ enabled: false });
 
@@ -186,29 +249,27 @@ describe("POST /v1/acp/spawn", () => {
 //
 // claude-agent-acp authenticates via CLAUDE_CODE_OAUTH_TOKEN. The route
 // accepts the token from two provisioning routes:
-//   1. Secure store under the canonical `credential/acp/claude_oauth_token`
-//      key (built by `credentialKey()`), populated by
-//      `assistant credentials set --service acp --field claude_oauth_token`.
+//   1. Credential broker (policy-gated + audited) reading from the secure
+//      store — provisioned via `assistant credentials set --service acp
+//      --field claude_oauth_token`.
 //   2. `acp.agents.claude.env.CLAUDE_CODE_OAUTH_TOKEN` in the user's
 //      config.json, surfaced on `resolved.agent.env` by the resolver.
-// After merging the secure-store value into `agentConfig.env`, the route
-// preflights for the token and throws `FailedDependencyError` if it is
-// still absent. The "fail-fast" behavior is symmetric with the existing
-// `binary_not_found` preflight and avoids the zombie-subprocess footgun
-// where claude-agent-acp launches, crashes on auth, and leaves the
-// caller with no useful signal.
+// After broker-mediated resolution, the route preflights for the token
+// and throws `FailedDependencyError` if it is still absent.
 //
 // These tests pin both the happy paths and the throw path so a future
 // drift in the key path, the env-override route, or the preflight check
 // fails the suite loudly.
 // ---------------------------------------------------------------------------
 
+/** Seed a vault entry to simulate `assistant credentials set`. */
+function seedVaultToken(token: string): void {
+  vaultStore.set("acp/claude_oauth_token", token);
+}
+
 describe("POST /v1/acp/spawn — CLAUDE_CODE_OAUTH_TOKEN injection", () => {
-  test("injects CLAUDE_CODE_OAUTH_TOKEN from credential/acp/claude_oauth_token for the claude agent", async () => {
-    secureKeyStore.set(
-      "credential/acp/claude_oauth_token",
-      "test-token-abc123",
-    );
+  test("injects CLAUDE_CODE_OAUTH_TOKEN from the vault via the broker for the claude agent", async () => {
+    seedVaultToken("test-token-abc123");
 
     const handler = getSpawnHandler();
     await handler({
@@ -226,11 +287,7 @@ describe("POST /v1/acp/spawn — CLAUDE_CODE_OAUTH_TOKEN injection", () => {
     );
   });
 
-  test("accepts CLAUDE_CODE_OAUTH_TOKEN from acp.agents.claude.env (config.json override) without a secure-store entry", async () => {
-    // The user-supplied config.json env override is the first-priority
-    // provisioning route. resolveAcpAgent returns it on `resolved.agent.env`,
-    // which the route then preserves on `agentConfig.env`. The preflight
-    // should accept this path with no secure-store entry needed.
+  test("accepts CLAUDE_CODE_OAUTH_TOKEN from acp.agents.claude.env (config.json override) without a vault entry", async () => {
     config.setConfig({
       agents: {
         claude: {
@@ -256,12 +313,8 @@ describe("POST /v1/acp/spawn — CLAUDE_CODE_OAUTH_TOKEN injection", () => {
     );
   });
 
-  test("config.json env override wins over a secure-store token (precedence pin)", async () => {
-    // Codex review feedback (PR #31901 / P2): when a user explicitly sets
-    // CLAUDE_CODE_OAUTH_TOKEN under `acp.agents.<id>.env` (per-workspace,
-    // rotated, scoped credential, etc.), the secure-store value must NOT
-    // silently overwrite it. Vault is fallback, not override.
-    secureKeyStore.set("credential/acp/claude_oauth_token", "vault-token-AAA");
+  test("config.json env override wins over a vault token (precedence pin)", async () => {
+    seedVaultToken("vault-token-AAA");
     config.setConfig({
       agents: {
         claude: {
@@ -288,11 +341,7 @@ describe("POST /v1/acp/spawn — CLAUDE_CODE_OAUTH_TOKEN injection", () => {
   });
 
   test("injects via command match for a user-defined agent id aliased to claude-agent-acp", async () => {
-    // Codex review feedback (PR #31901 / P2): gating is keyed off the
-    // resolved command (basename), not the agent id. A custom agent id
-    // pointing at claude-agent-acp still needs CLAUDE_CODE_OAUTH_TOKEN,
-    // so injection + preflight must fire regardless of the id string.
-    secureKeyStore.set("credential/acp/claude_oauth_token", "vault-token-zzz");
+    seedVaultToken("vault-token-zzz");
     config.setConfig({
       agents: {
         "my-claude": {
@@ -319,12 +368,6 @@ describe("POST /v1/acp/spawn — CLAUDE_CODE_OAUTH_TOKEN injection", () => {
   });
 
   test("throws FailedDependencyError when no CLAUDE_CODE_OAUTH_TOKEN is available from any source", async () => {
-    // secureKeyStore intentionally empty AND no agentConfig.env override —
-    // simulates a fresh install where the user hasn't provisioned a token
-    // via either route. Fail-fast preflight surfaces this immediately
-    // instead of letting claude-agent-acp launch, crash on auth, and leave
-    // a zombie subprocess behind.
-
     const handler = getSpawnHandler();
     await expect(
       handler({
@@ -339,14 +382,7 @@ describe("POST /v1/acp/spawn — CLAUDE_CODE_OAUTH_TOKEN injection", () => {
   });
 
   test("does NOT inject CLAUDE_CODE_OAUTH_TOKEN for agents whose command is not claude-agent-acp", async () => {
-    // Token-injection AND preflight are scoped to claude-agent-acp by
-    // command basename. A codex-acp spawn with the secure-store key set
-    // must still launch without that env var — and must not be blocked
-    // by claude's preflight.
-    secureKeyStore.set(
-      "credential/acp/claude_oauth_token",
-      "test-token-abc123",
-    );
+    seedVaultToken("test-token-abc123");
 
     const handler = getSpawnHandler();
     await handler({
@@ -363,28 +399,6 @@ describe("POST /v1/acp/spawn — CLAUDE_CODE_OAUTH_TOKEN injection", () => {
       capturedSpawns[0]?.agentConfig.env?.CLAUDE_CODE_OAUTH_TOKEN,
     ).toBeUndefined();
   });
-
-  test("does NOT pick up a token planted at the legacy non-`credential/` key path", async () => {
-    // Regression guard: the original implementation used the raw key
-    // "acp/claude/oauth_token". The fix routes through `credentialKey()`
-    // so the CLI (`assistant credentials set --service acp --field
-    // claude_oauth_token`) is the canonical provisioning path. Pin this
-    // by planting the token ONLY under the legacy key — the preflight
-    // should fail-fast because the canonical path is empty.
-    secureKeyStore.set("acp/claude/oauth_token", "legacy-token-should-miss");
-
-    const handler = getSpawnHandler();
-    await expect(
-      handler({
-        body: {
-          agent: "claude",
-          task: "do a thing",
-          conversationId: "conv-1",
-        },
-      }),
-    ).rejects.toThrow(/CLAUDE_CODE_OAUTH_TOKEN/);
-    expect(capturedSpawns).toHaveLength(0);
-  });
 });
 
 // ---------------------------------------------------------------------------
@@ -435,6 +449,8 @@ describe("DELETE /v1/acp/sessions?status=completed", () => {
   });
 
   beforeEach(() => {
+    inMemoryStates.clear();
+    pendingResumeIds.clear();
     getSqlite().run("DELETE FROM acp_session_history");
   });
 
@@ -460,6 +476,57 @@ describe("DELETE /v1/acp/sessions?status=completed", () => {
     ]);
   });
 
+  test("excludes terminal rows whose session is active in memory (resumed sessions)", async () => {
+    // A resumed session reuses its original id: the in-memory state is
+    // `running` while its history row still carries the old terminal
+    // status until the next terminal upsert. The bulk delete must not
+    // remove that row out from under the live session.
+    seedHistoryRow("row-resumed", "completed", 1000);
+    seedHistoryRow("row-completed", "completed", 2000);
+    inMemoryStates.set("row-resumed", {
+      id: "row-resumed",
+      agentId: "claude",
+      acpSessionId: "proto-resumed",
+      parentConversationId: "conv-test",
+      status: "running",
+      startedAt: 1000,
+    });
+
+    const handler = getBulkDeleteHandler();
+    const result = (await handler({
+      queryParams: { status: "completed" },
+    })) as {
+      deleted: number;
+    };
+    expect(result.deleted).toBe(1);
+
+    const remaining = listRows();
+    expect(remaining).toEqual([{ id: "row-resumed", status: "completed" }]);
+  });
+
+  test("excludes terminal rows whose session has a resume in flight", async () => {
+    // A resume that is still awaiting env preparation has no in-memory
+    // SessionEntry yet, but its history row (still terminal) must survive:
+    // deleting it mid-resume would let the later terminal upsert resurrect
+    // it as an orphan row.
+    seedHistoryRow("row-pending-resume", "completed", 1000);
+    seedHistoryRow("row-completed", "completed", 2000);
+    pendingResumeIds.add("row-pending-resume");
+
+    const handler = getBulkDeleteHandler();
+    const result = (await handler({
+      queryParams: { status: "completed" },
+    })) as {
+      deleted: number;
+    };
+    expect(result.deleted).toBe(1);
+
+    const remaining = listRows();
+    expect(remaining).toEqual([
+      { id: "row-pending-resume", status: "completed" },
+    ]);
+  });
+
   test("returns deleted=0 when no terminal rows are present", async () => {
     seedHistoryRow("row-running", "running", 1000);
 
@@ -537,6 +604,7 @@ describe("DELETE /v1/acp/sessions/:id", () => {
 
   beforeEach(() => {
     inMemoryStates.clear();
+    pendingResumeIds.clear();
     getDb().delete(acpSessionHistory).run();
   });
 
@@ -588,6 +656,24 @@ describe("DELETE /v1/acp/sessions/:id", () => {
     },
   );
 
+  test("returns 409 when the session has a resume in flight (not yet in memory)", async () => {
+    pendingResumeIds.add("sess-resuming");
+    insertHistoryRow({ id: "sess-resuming", status: "completed" });
+
+    const handler = getDeleteSessionHandler();
+    expect(() => handler({ pathParams: { id: "sess-resuming" } })).toThrow(
+      "resume in flight",
+    );
+
+    // Row untouched.
+    const remaining = getDb()
+      .select()
+      .from(acpSessionHistory)
+      .where(eq(acpSessionHistory.id, "sess-resuming"))
+      .all();
+    expect(remaining).toHaveLength(1);
+  });
+
   test("idempotent for unknown id — returns { deleted: false }", async () => {
     const handler = getDeleteSessionHandler();
     const result = (await handler({