@vellumai/assistant 0.8.6 → 0.8.7-dev.202606052118.34cd356

package/src/telemetry/usage-telemetry-reporter.ts

@@ -15,6 +15,7 @@ import {
   getPlatformUserId,
 } from "../config/env.js";
 import { getConfig } from "../config/loader.js";
+import { queryUnreportedAuthFallbackEvents } from "../memory/auth-fallback-events-store.js";
 import {
   getMemoryCheckpoint,
   setMemoryCheckpoint,
@@ -47,6 +48,10 @@ const CHECKPOINT_KEY_ONBOARDING_WATERMARK =
   "telemetry:onboarding:last_reported_at";
 const CHECKPOINT_KEY_ONBOARDING_WATERMARK_ID =
   "telemetry:onboarding:last_reported_id";
+const CHECKPOINT_KEY_AUTH_FALLBACK_WATERMARK =
+  "telemetry:auth_fallback:last_reported_at";
+const CHECKPOINT_KEY_AUTH_FALLBACK_WATERMARK_ID =
+  "telemetry:auth_fallback:last_reported_id";
 const REPORT_INTERVAL_MS = 5 * 60 * 1000;
 const INITIAL_FLUSH_DELAY_MS = 30_000; // Delay first flush to let CES handshake complete
 const BATCH_SIZE = 500;
@@ -139,6 +144,7 @@ export class UsageTelemetryReporter {
         setMemoryCheckpoint(CHECKPOINT_KEY_TURN_WATERMARK, now);
         setMemoryCheckpoint(CHECKPOINT_KEY_LIFECYCLE_WATERMARK, now);
         setMemoryCheckpoint(CHECKPOINT_KEY_ONBOARDING_WATERMARK, now);
+        setMemoryCheckpoint(CHECKPOINT_KEY_AUTH_FALLBACK_WATERMARK, now);
         return;
       }
 
@@ -171,6 +177,14 @@ export class UsageTelemetryReporter {
         getMemoryCheckpoint(CHECKPOINT_KEY_ONBOARDING_WATERMARK_ID) ??
         undefined;
 
+      // Read auth-fallback watermark (compound cursor: createdAt + id)
+      const authFallbackWatermark = Number(
+        getMemoryCheckpoint(CHECKPOINT_KEY_AUTH_FALLBACK_WATERMARK) ?? "0",
+      );
+      const authFallbackWatermarkId =
+        getMemoryCheckpoint(CHECKPOINT_KEY_AUTH_FALLBACK_WATERMARK_ID) ??
+        undefined;
+
       // Query unreported events
       const events = queryUnreportedUsageEvents(
         watermark,
@@ -192,12 +206,18 @@ export class UsageTelemetryReporter {
         onboardingWatermarkId,
         BATCH_SIZE,
       );
+      const authFallbackEvents = queryUnreportedAuthFallbackEvents(
+        authFallbackWatermark,
+        authFallbackWatermarkId,
+        BATCH_SIZE,
+      );
 
       if (
         events.length === 0 &&
         turnEvents.length === 0 &&
         lifecycleEvents.length === 0 &&
-        onboardingEvents.length === 0
+        onboardingEvents.length === 0 &&
+        authFallbackEvents.length === 0
       )
         return;
 
@@ -211,6 +231,7 @@ export class UsageTelemetryReporter {
           turnCount: turnEvents.length,
           lifecycleCount: lifecycleEvents.length,
           onboardingCount: onboardingEvents.length,
+          authFallbackCount: authFallbackEvents.length,
         },
         "Telemetry flush: resolved auth context",
       );
@@ -241,6 +262,13 @@ export class UsageTelemetryReporter {
             inference_profile_source: e.inferenceProfileSource,
             cost: e.estimatedCostUsd ?? null,
             recorded_at: e.createdAt,
+            // Record-time version when present; otherwise the running
+            // binary's `APP_VERSION` (a legacy row from before
+            // migration 267 ran). We deliberately don't emit explicit
+            // `null` — under the platform contract a present-but-null
+            // per-event value would override the envelope, and we'd
+            // rather have a concrete version than no version.
+            assistant_version: e.assistantVersion ?? APP_VERSION,
           }),
         ),
         ...turnEvents.map((e): TelemetryEvent => {
@@ -278,6 +306,18 @@ export class UsageTelemetryReporter {
             interface_id: e.interfaceId,
             channel_id: e.channelId,
             client,
+            // Turn events derive from `messages` + `conversations`
+            // rather than a dedicated table. Adding `assistant_version`
+            // to `messages` is a separate (larger) migration; until
+            // then we stamp the running binary's `APP_VERSION` so the
+            // wire value is concrete (matches what the envelope would
+            // have provided, but per-event so it survives the platform
+            // contract that treats present per-event values as winning
+            // over the envelope). Same upload-time attribution risk
+            // for turn events as before this PR — lifecycle, onboarding
+            // and turn events all still rely on the envelope; only
+            // llm_usage is record-time accurate in this PR.
+            assistant_version: APP_VERSION,
           };
         }),
         ...lifecycleEvents.map(
@@ -286,6 +326,12 @@ export class UsageTelemetryReporter {
             daemon_event_id: e.id,
             event_name: e.eventName,
             recorded_at: e.createdAt,
+            // Lifecycle events fall back to the envelope `assistant_version`
+            // — same upload-time attribution risk as before this PR. Adding
+            // the record-time column to `lifecycle_events` (#18112) is a
+            // separate follow-up that mirrors what this PR does for
+            // `llm_usage_events`.
+            assistant_version: APP_VERSION,
           }),
         ),
         ...onboardingEvents.map(
@@ -304,6 +350,31 @@ export class UsageTelemetryReporter {
               ? { google_scopes: JSON.parse(e.googleScopesJson) }
               : {}),
             ...(e.abVariant ? { ab_variant: e.abVariant } : {}),
+            // Onboarding events fall back to the envelope `assistant_version`
+            // — same upload-time attribution risk as before this PR. Adding
+            // the record-time column to `onboarding_events` (#30733) is a
+            // separate follow-up that mirrors what this PR does for
+            // `llm_usage_events`.
+            assistant_version: APP_VERSION,
+          }),
+        ),
+        ...authFallbackEvents.map(
+          (e): TelemetryEvent => ({
+            type: "auth_fallback",
+            daemon_event_id: e.id,
+            recorded_at: e.createdAt,
+            guard: e.guard,
+            path: e.path,
+            failure_kind: e.failureKind,
+            count: e.count,
+            window_start: e.windowStart,
+            window_end: e.windowEnd,
+            // Aggregated counts forwarded by the gateway carry no record-time
+            // binary version; stamp the running binary's `APP_VERSION` so the
+            // wire value is concrete rather than an explicit null that would
+            // override the envelope under the platform's per-event-wins
+            // contract.
+            assistant_version: APP_VERSION,
           }),
         ),
       ];
@@ -391,12 +462,27 @@ export class UsageTelemetryReporter {
         );
       }
 
+      // Advance auth-fallback watermark (compound cursor)
+      if (authFallbackEvents.length > 0) {
+        const lastAuthFallback =
+          authFallbackEvents[authFallbackEvents.length - 1];
+        setMemoryCheckpoint(
+          CHECKPOINT_KEY_AUTH_FALLBACK_WATERMARK,
+          String(lastAuthFallback.createdAt),
+        );
+        setMemoryCheckpoint(
+          CHECKPOINT_KEY_AUTH_FALLBACK_WATERMARK_ID,
+          lastAuthFallback.id,
+        );
+      }
+
       // If we got a full batch of any type, there may be more — recurse
       if (
         events.length === BATCH_SIZE ||
         turnEvents.length === BATCH_SIZE ||
         lifecycleEvents.length === BATCH_SIZE ||
-        onboardingEvents.length === BATCH_SIZE
+        onboardingEvents.length === BATCH_SIZE ||
+        authFallbackEvents.length === BATCH_SIZE
       ) {
         await this._doFlush(batchCount + 1);
       }

package/src/tools/acp/context.ts

@@ -0,0 +1,20 @@
+/**
+ * Shared ToolContext accessors for the ACP tools.
+ */
+
+import type { ServerMessage } from "../../daemon/message-protocol.js";
+import type { ToolContext } from "../types.js";
+
+/**
+ * Narrows `ToolContext.sendToClient` to the `ServerMessage` sender the ACP
+ * session manager expects. ToolContext types the callback against an
+ * index-signature message shape (`{ type: string; [key: string]: unknown }`)
+ * that ServerMessage's union members don't structurally satisfy, so the
+ * cast lives here once instead of being duplicated at every ACP tool call
+ * site.
+ */
+export function getSendToClient(
+  context: ToolContext,
+): ((msg: ServerMessage) => void) | undefined {
+  return context.sendToClient as ((msg: ServerMessage) => void) | undefined;
+}

package/src/tools/acp/list-agents.test.ts

@@ -47,7 +47,7 @@ describe("executeAcpListAgents", () => {
     expect(parsed.hint).toContain("config.json");
   });
 
-  test("enabled, no user config: both defaults present with source 'default' and available based on Bun.which", async () => {
+  test("enabled, no user config: all defaults present with source 'default' and available based on Bun.which", async () => {
     config.setConfig({ agents: {} });
 
     const result = await executeAcpListAgents({}, makeContext());
@@ -58,6 +58,7 @@ describe("executeAcpListAgents", () => {
     expect(parsed.agents.map((a: { id: string }) => a.id)).toEqual([
       "claude",
       "codex",
+      "gemini",
     ]);
     for (const entry of parsed.agents) {
       expect(entry.source).toBe("default");
@@ -108,6 +109,11 @@ describe("executeAcpListAgents", () => {
     expect(codex.unavailableReason).toBe("'codex-acp' is not on PATH");
     expect(codex.setupHint).toBe("npm i -g @zed-industries/codex-acp");
 
+    const gemini = parsed.agents.find((a: { id: string }) => a.id === "gemini");
+    expect(gemini.available).toBe(false);
+    expect(gemini.unavailableReason).toBe("'gemini' is not on PATH");
+    expect(gemini.setupHint).toBe("npm i -g @google/gemini-cli");
+
     const claude = parsed.agents.find((a: { id: string }) => a.id === "claude");
     expect(claude.available).toBe(true);
     expect(claude.setupHint).toBeUndefined();

package/src/tools/acp/spawn.test.ts

@@ -1,7 +1,7 @@
-import * as realChildProcess from "node:child_process";
 import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
 
 import { installAcpConfigStub } from "../../acp/__tests__/helpers/acp-config-stub.js";
+import { installExecFileStub } from "../../acp/__tests__/helpers/exec-file-stub.js";
 import { installWhichStub } from "../../acp/__tests__/helpers/which-stub.js";
 import type { ToolContext } from "../types.js";
 
@@ -9,55 +9,11 @@ import type { ToolContext } from "../types.js";
 // Mock infrastructure
 // ---------------------------------------------------------------------------
 
-type ExecCallback = (
-  err: Error | null,
-  stdout: string | Buffer,
-  stderr: string | Buffer,
-) => void;
-
-interface ExecScript {
-  /** When set, the call rejects with this error. */
-  error?: Error;
-  /** When set, the call resolves with this stdout. */
-  stdout?: string;
-}
-
-/**
- * Per-call scripted responses for `execFile`. Keyed by `${command} ${args[0]}`
- * so tests can target `npm ls` and `npm view` independently.
- */
-const execScripts: Map<string, ExecScript> = new Map();
-
-const execFileMock = mock(
-  (
-    command: string,
-    args: string[],
-    _options: unknown,
-    callback?: ExecCallback,
-  ) => {
-    const key = `${command} ${args[0]}`;
-    const script = execScripts.get(key);
-    queueMicrotask(() => {
-      if (!callback) return;
-      if (!script) {
-        callback(new Error(`No script for ${key}`), "", "");
-        return;
-      }
-      if (script.error) {
-        callback(script.error, "", "");
-        return;
-      }
-      callback(null, script.stdout ?? "", "");
-    });
-    // Return value is not used by execFileWithTimeout.
-    return {} as ReturnType<typeof realChildProcess.execFile>;
-  },
-);
-
-mock.module("node:child_process", () => ({
-  ...realChildProcess,
-  execFile: execFileMock,
-}));
+const {
+  execScripts,
+  execFileMock,
+  reset: resetExecFileStub,
+} = installExecFileStub();
 
 // Default ACP config used by these tests: the `unknown-agent` entry is here
 // to give the "no version check" test a configured agent whose binary isn't
@@ -82,23 +38,83 @@ mock.module("../../util/logger.js", () => ({
     }),
 }));
 
-// Stub secure-keys so the `prepareAgentEnv` preflight finds a token without
-// the test having to populate the real OS keyring. Driven via `secureKeyStore`
-// per test in beforeEach; the default seeds a vault token so existing tests
-// (which assume claude spawns succeed) keep passing.
-//
-// The real module's other exports are spread in so transitive importers
-// (e.g. session-manager → pending-interactions → credential-routes, which
-// imports `getSecureKeyResultAsync`) still resolve at parse time. Bun's
-// `mock.module` is process-global and returns *exactly* the keys the factory
-// returns — without the spread, any consumer pulling a non-`getSecureKeyAsync`
-// export errors with "Export named '<X>' not found".
-const secureKeyStore = new Map<string, string>();
-const realSecureKeys = await import("../../security/secure-keys.js");
-
-mock.module("../../security/secure-keys.js", () => ({
-  ...realSecureKeys,
-  getSecureKeyAsync: async (key: string) => secureKeyStore.get(key),
+// Stub credential broker + metadata store so `prepareAgentEnv` can resolve
+// tokens without the real OS keyring. Driven via `vaultStore` per test in
+// beforeEach; the default seeds a vault token so existing tests (which assume
+// claude spawns succeed) keep passing.
+const vaultStore = new Map<string, string>();
+const metadataStore = new Map<
+  string,
+  { allowedTools: string[]; usageDescription?: string }
+>();
+
+mock.module("../../tools/credentials/metadata-store.js", () => ({
+  getCredentialMetadata: (service: string, field: string) => {
+    const key = `${service}/${field}`;
+    const entry = metadataStore.get(key);
+    if (!entry) return undefined;
+    return {
+      credentialId: `cred-${key}`,
+      service,
+      field,
+      allowedTools: entry.allowedTools,
+      allowedDomains: [],
+      usageDescription: entry.usageDescription,
+      createdAt: 0,
+      updatedAt: 0,
+    };
+  },
+  upsertCredentialMetadata: (
+    service: string,
+    field: string,
+    policy?: { allowedTools?: string[]; usageDescription?: string },
+  ) => {
+    const key = `${service}/${field}`;
+    const existing = metadataStore.get(key);
+    metadataStore.set(key, {
+      allowedTools: policy?.allowedTools ?? existing?.allowedTools ?? [],
+      usageDescription:
+        policy?.usageDescription ?? existing?.usageDescription,
+    });
+    return {
+      credentialId: `cred-${key}`,
+      service,
+      field,
+      allowedTools: metadataStore.get(key)!.allowedTools,
+      allowedDomains: [],
+      createdAt: 0,
+      updatedAt: 0,
+    };
+  },
+}));
+
+mock.module("../../tools/credentials/broker.js", () => ({
+  credentialBroker: {
+    serverUse: async <T>(request: {
+      service: string;
+      field: string;
+      toolName: string;
+      execute: (value: string) => Promise<T>;
+    }) => {
+      const key = `${request.service}/${request.field}`;
+      const meta = metadataStore.get(key);
+      if (!meta) {
+        return { success: false, reason: `No credential found for ${key}` };
+      }
+      if (!meta.allowedTools.includes(request.toolName)) {
+        return {
+          success: false,
+          reason: `Tool "${request.toolName}" not allowed`,
+        };
+      }
+      const value = vaultStore.get(key);
+      if (!value) {
+        return { success: false, reason: `No stored value for ${key}` };
+      }
+      const result = await request.execute(value);
+      return { success: true, result };
+    },
+  },
 }));
 
 // Stub session manager so we don't actually spawn child processes.
@@ -129,6 +145,9 @@ mock.module("../../acp/index.js", () => ({
 
 const { executeAcpSpawn, _resetAdapterVersionCacheForTests } =
   await import("./spawn.js");
+const { _resetAdapterInstallCacheForTests } = await import(
+  "../../acp/auto-install.js"
+);
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -144,20 +163,18 @@ function makeContext(): ToolContext {
 }
 
 beforeEach(() => {
-  execScripts.clear();
-  execFileMock.mockClear();
+  resetExecFileStub();
   spawnMock.mockClear();
   _resetAdapterVersionCacheForTests();
+  _resetAdapterInstallCacheForTests();
   config.setConfig({ agents: DEFAULT_TEST_AGENTS });
   which.setWhich((cmd) => `/usr/local/bin/${cmd}`);
   // Default: vault has a claude token so the preflight in `prepareAgentEnv`
   // succeeds for tests that don't care about env injection. Env-injection
   // tests below clear/override this explicitly.
-  secureKeyStore.clear();
-  secureKeyStore.set(
-    "credential/acp/claude_oauth_token",
-    "default-test-token",
-  );
+  vaultStore.clear();
+  metadataStore.clear();
+  vaultStore.set("acp/claude_oauth_token", "default-test-token");
 });
 
 // ---------------------------------------------------------------------------
@@ -333,8 +350,9 @@ describe("executeAcpSpawn — input validation", () => {
     expect(result.content).toContain("acp.enabled");
   });
 
-  test("missing binary returns install hint", async () => {
+  test("missing binary returns install hint when auto-install fails", async () => {
     which.setWhich({});
+    execScripts.set("npm i", { error: new Error("npm not installed") });
     const result = await executeAcpSpawn(
       { agent: "claude", task: "do something" },
       makeContext(),
@@ -368,6 +386,101 @@ describe("executeAcpSpawn — input validation", () => {
   });
 });
 
+describe("executeAcpSpawn: auto-install on missing binary", () => {
+  test("known command: installs the mapped package and spawn proceeds with a note", async () => {
+    // Binary appears on PATH only after `npm i -g` runs, simulating a
+    // successful global install.
+    let binaryOnPath = false;
+    which.setWhich((cmd) => (binaryOnPath ? `/usr/local/bin/${cmd}` : null));
+    execScripts.set("npm i", {
+      stdout: "",
+      onCall: () => {
+        binaryOnPath = true;
+      },
+    });
+    // Version probes after the install: best-effort, scripted to skip.
+    execScripts.set("npm ls", { error: new Error("skip") });
+    execScripts.set("npm view", { error: new Error("skip") });
+
+    const result = await executeAcpSpawn(
+      { agent: "claude", task: "do something" },
+      makeContext(),
+    );
+
+    expect(result.isError).toBe(false);
+    expect(spawnMock).toHaveBeenCalledTimes(1);
+    const [payloadJson] = result.content.split("\n\n");
+    const payload = JSON.parse(payloadJson);
+    expect(payload.message).toContain(
+      "Installed @agentclientprotocol/claude-agent-acp automatically.",
+    );
+    const installCalls = execFileMock.mock.calls.filter(
+      (call) => (call[1] as string[])[0] === "i",
+    );
+    expect(installCalls).toHaveLength(1);
+    expect(installCalls[0][1]).toEqual([
+      "i",
+      "-g",
+      "@agentclientprotocol/claude-agent-acp",
+    ]);
+  });
+
+  test("unknown command: no install attempted, plain hint returned", async () => {
+    which.setWhich({});
+
+    const result = await executeAcpSpawn(
+      { agent: "unknown-agent", task: "do something" },
+      makeContext(),
+    );
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("some-other-binary is not on PATH");
+    expect(result.content).toContain("Install 'some-other-binary'");
+    expect(result.content).not.toContain("auto-install failed");
+    expect(execFileMock).not.toHaveBeenCalled();
+    expect(spawnMock).not.toHaveBeenCalled();
+  });
+
+  test("no client connected: no install attempted even when the binary is missing", async () => {
+    // The no-client guard is a pure precondition and must run BEFORE the
+    // auto-install side effect: without a client the spawn fails anyway, so
+    // the host must not be mutated by `npm i -g` (which can also block for
+    // up to the install timeout).
+    which.setWhich({});
+
+    const result = await executeAcpSpawn(
+      { agent: "claude", task: "do something" },
+      { ...makeContext(), sendToClient: undefined },
+    );
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("No client connected");
+    expect(execFileMock).not.toHaveBeenCalled();
+    expect(spawnMock).not.toHaveBeenCalled();
+  });
+
+  test("npm failure: hint and install failure both surface", async () => {
+    which.setWhich({});
+    execScripts.set("npm i", {
+      error: new Error("EACCES: permission denied"),
+    });
+
+    const result = await executeAcpSpawn(
+      { agent: "claude", task: "do something" },
+      makeContext(),
+    );
+
+    expect(result.isError).toBe(true);
+    expect(result.content).toContain("claude-agent-acp is not on PATH");
+    expect(result.content).toContain(
+      "npm i -g @agentclientprotocol/claude-agent-acp",
+    );
+    expect(result.content).toContain("auto-install failed");
+    expect(result.content).toContain("EACCES");
+    expect(spawnMock).not.toHaveBeenCalled();
+  });
+});
+
 describe("executeAcpSpawn — per-agent resume hint", () => {
   test("claude payload includes the `claude --resume` hint", async () => {
     execScripts.set("npm ls", { error: new Error("npm not installed") });
@@ -382,7 +495,7 @@ describe("executeAcpSpawn — per-agent resume hint", () => {
     const [payloadJson] = result.content.split("\n\n");
     const payload = JSON.parse(payloadJson);
     expect(payload.message).toContain("claude --resume");
-    expect(payload.message).toContain("To resume this session later");
+    expect(payload.message).toContain("To resume:");
   });
 
   test("non-claude payload omits the `claude --resume` hint", async () => {
@@ -400,7 +513,7 @@ describe("executeAcpSpawn — per-agent resume hint", () => {
     const [payloadJson] = result.content.split("\n\n");
     const payload = JSON.parse(payloadJson);
     expect(payload.message).not.toContain("claude --resume");
-    expect(payload.message).not.toContain("To resume this session later");
+    expect(payload.message).not.toContain("To resume:");
   });
 });
 
@@ -420,12 +533,10 @@ describe("executeAcpSpawn — per-agent resume hint", () => {
 // ---------------------------------------------------------------------------
 
 describe("executeAcpSpawn — CLAUDE_CODE_OAUTH_TOKEN injection", () => {
-  test("injects CLAUDE_CODE_OAUTH_TOKEN from the secure store for the claude agent", async () => {
-    secureKeyStore.clear();
-    secureKeyStore.set(
-      "credential/acp/claude_oauth_token",
-      "tool-vault-token-abc",
-    );
+  test("injects CLAUDE_CODE_OAUTH_TOKEN from the vault via the broker for the claude agent", async () => {
+    vaultStore.clear();
+    metadataStore.clear();
+    vaultStore.set("acp/claude_oauth_token", "tool-vault-token-abc");
     execScripts.set("npm ls", { error: new Error("npm not installed") });
     execScripts.set("npm view", { error: new Error("npm not installed") });
 
@@ -445,10 +556,8 @@ describe("executeAcpSpawn — CLAUDE_CODE_OAUTH_TOKEN injection", () => {
   });
 
   test("accepts CLAUDE_CODE_OAUTH_TOKEN from config.json agent.env without a vault entry", async () => {
-    // Mirrors the route-level precedence test: a config.json env override
-    // is the first-priority provisioning route. The resolver surfaces it
-    // on `resolved.agent.env`, which the helper preserves.
-    secureKeyStore.clear();
+    vaultStore.clear();
+    metadataStore.clear();
     config.setConfig({
       agents: {
         claude: {
@@ -478,11 +587,8 @@ describe("executeAcpSpawn — CLAUDE_CODE_OAUTH_TOKEN injection", () => {
   });
 
   test("returns isError when no token is available from either route (preflight throw mapped to tool result)", async () => {
-    // Both routes empty. The helper throws `FailedDependencyError`; the
-    // tool catches it and returns `{ isError: true, content: <msg> }`
-    // rather than letting it propagate (the tool boundary is a sync
-    // ToolExecutionResult, not an HTTP response).
-    secureKeyStore.clear();
+    vaultStore.clear();
+    metadataStore.clear();
 
     const result = await executeAcpSpawn(
       { agent: "claude", task: "do something" },
@@ -491,7 +597,6 @@ describe("executeAcpSpawn — CLAUDE_CODE_OAUTH_TOKEN injection", () => {
 
     expect(result.isError).toBe(true);
     expect(result.content).toContain("CLAUDE_CODE_OAUTH_TOKEN");
-    // Spawn was NEVER called — preflight fired before the subprocess started.
     expect(spawnMock).not.toHaveBeenCalled();
   });
 });