@vellumai/assistant 0.8.9-staging.1 → 0.8.9-staging.2

package/src/__tests__/pre-model-call-sanitize.test.ts

@@ -0,0 +1,109 @@
+import { describe, expect, test } from "bun:test";
+
+import { preModelCallSanitize } from "../agent/loop.js";
+import type { Message } from "../providers/types.js";
+
+/**
+ * `preModelCallSanitize` is the loop's single pre-send transform: it converts
+ * historical `web_search_tool_result` blocks to text alongside the media and
+ * AX-tree strips, so every provider call — first call, post-compaction, and
+ * recovery reruns — is sanitized in one place. These tests guard that the
+ * helper actually performs the web-search conversion and is idempotent.
+ */
+describe("preModelCallSanitize", () => {
+  test("passes through history with nothing to sanitize", () => {
+    // GIVEN a plain conversation with no media, AX trees, or web-search blocks
+    const messages: Message[] = [
+      { role: "user", content: [{ type: "text", text: "Hello" }] },
+      { role: "assistant", content: [{ type: "text", text: "Hi" }] },
+    ];
+
+    // WHEN the loop sanitizes the outbound history
+    const result = preModelCallSanitize(messages);
+
+    // THEN the history is returned unchanged
+    expect(result).toEqual(messages);
+  });
+
+  test("converts historical web_search_tool_result blocks to text summaries", () => {
+    // GIVEN an assistant turn whose web_search_tool_result carries an opaque
+    // encrypted_content token that would be rejected if replayed
+    const messages: Message[] = [
+      { role: "user", content: [{ type: "text", text: "Search cats" }] },
+      {
+        role: "assistant",
+        content: [
+          {
+            type: "server_tool_use",
+            id: "stu_1",
+            name: "web_search",
+            input: { query: "cats" },
+          },
+          {
+            type: "web_search_tool_result",
+            tool_use_id: "stu_1",
+            content: [
+              {
+                type: "web_search_result",
+                url: "https://cats.com",
+                title: "Cats!",
+                encrypted_content: "expired_token_1",
+              },
+            ],
+          },
+        ],
+      },
+    ];
+
+    // WHEN the loop sanitizes the outbound history
+    const result = preModelCallSanitize(messages);
+
+    // THEN the opaque block is replaced with a plaintext title+URL summary and
+    // the paired server_tool_use is dropped, so no expired token is replayed
+    const assistantMsg = result[1];
+    expect(assistantMsg.content.map((b) => b.type)).toEqual(["text"]);
+    const summary = assistantMsg.content[0];
+    expect(summary.type).toBe("text");
+    if (summary.type === "text") {
+      expect(summary.text).toContain("Cats!");
+      expect(summary.text).toContain("https://cats.com");
+      expect(summary.text).not.toContain("expired_token_1");
+    }
+  });
+
+  test("is idempotent — re-sanitizing already-sanitized history is a no-op", () => {
+    // GIVEN history that has already been sanitized once
+    const messages: Message[] = [
+      {
+        role: "assistant",
+        content: [
+          {
+            type: "server_tool_use",
+            id: "stu_A",
+            name: "web_search",
+            input: { query: "alpha" },
+          },
+          {
+            type: "web_search_tool_result",
+            tool_use_id: "stu_A",
+            content: [
+              {
+                type: "web_search_result",
+                url: "https://a.example",
+                title: "A",
+                encrypted_content: "tok_A",
+              },
+            ],
+          },
+        ],
+      },
+    ];
+    const once = preModelCallSanitize(messages);
+
+    // WHEN it is sanitized a second time (every outbound call re-runs the helper)
+    const twice = preModelCallSanitize(once);
+
+    // THEN the second pass changes nothing
+    expect(twice).toEqual(once);
+  });
+});

package/src/acp/__tests__/helpers/exec-file-stub.ts

@@ -1,11 +1,15 @@
 /**
  * Shared test helper: stub `execFile` from `node:child_process` for ACP tests.
  *
- * Several ACP suites (the `acp_spawn` tool's version probes, the adapter
- * auto-installer, and the `/v1/acp/spawn` route) shell out via
- * `execFileWithTimeout`. Each test file used to duplicate the same
- * `mock.module("node:child_process", ...)` + scripted-responses boilerplate;
- * this helper consolidates it, mirroring `which-stub.ts`.
+ * Several ACP suites (the adapter auto-installer and the `/v1/acp/spawn`
+ * route) shell out via `execFileWithTimeout` (e.g. `bun add --global`). Each
+ * test file used to duplicate the same `mock.module("node:child_process",
+ * ...)` + scripted-responses boilerplate; this helper consolidates it,
+ * mirroring `which-stub.ts`.
+ *
+ * The mock records every call's args, INCLUDING the options object (cwd, env,
+ * ...) at `execFileMock.mock.calls[i][2]`, so tests can assert the installer's
+ * sandboxed cwd and sanitized env.
  *
  * Like the other helpers here, the hook is process-global by design (Bun's
  * `mock.module` is process-global). Each test file should call
@@ -45,8 +49,9 @@ type ExecFileMock = ReturnType<
 export interface ExecFileStubHandle {
   /**
    * Per-call scripted responses, keyed by `${command} ${args[0]}` so tests
-   * can target `npm ls`, `npm view`, and `npm i` independently. Calls with
-   * no script reject with a recognizable "No script for <key>" error.
+   * can target distinct subcommands (e.g. `<bunPath> add`) independently.
+   * Calls with no script reject with a recognizable "No script for <key>"
+   * error.
    */
   execScripts: Map<string, ExecScript>;
   execFileMock: ExecFileMock;

package/src/acp/__tests__/prepare-agent-env.test.ts

@@ -216,22 +216,6 @@ describe("prepareAgentEnv — claude-agent-acp gating", () => {
     expect(prepared.env?.CLAUDE_CODE_OAUTH_TOKEN).toBe("vault-FFF");
   });
 
-  test("injects the token for the bunx-rewritten claude adapter (adapterCommand gate)", async () => {
-    // The resolver rewrites a missing claude-agent-acp binary to run via
-    // `bun x --bun <pkg>` and preserves the canonical identity on
-    // `adapterCommand`. Without this gate, bunx-resolved spawns would start
-    // with no auth and die as zombies on the first prompt.
-    seedVaultToken("vault-bunx");
-
-    const prepared = await prepareAgentEnv({
-      command: "bun",
-      args: ["x", "--bun", "@agentclientprotocol/claude-agent-acp"],
-      adapterCommand: "claude-agent-acp",
-    });
-
-    expect(prepared.env?.CLAUDE_CODE_OAUTH_TOKEN).toBe("vault-bunx");
-  });
-
   test("does NOT mutate the caller's agentConfig", async () => {
     seedVaultToken("vault-GGG");
     const original = {
@@ -276,18 +260,6 @@ describe("prepareAgentEnv - gemini gating", () => {
     expect(meta!.allowedTools).toContain("acp_spawn");
   });
 
-  test("injects the key for the bunx-rewritten gemini CLI (adapterCommand gate)", async () => {
-    seedVaultGeminiKey("vault-gem-bunx");
-
-    const prepared = await prepareAgentEnv({
-      command: "bun",
-      args: ["x", "--bun", "@google/gemini-cli", "--acp"],
-      adapterCommand: "gemini",
-    });
-
-    expect(prepared.env?.GEMINI_API_KEY).toBe("vault-gem-bunx");
-  });
-
   test("a vault miss does NOT throw and spawns without GEMINI_API_KEY (key is optional)", async () => {
     const prepared = await prepareAgentEnv({
       command: "gemini",
@@ -369,18 +341,6 @@ describe("prepareAgentEnv — non-claude commands", () => {
     expect(prepared.env).toEqual({});
   });
 
-  test("no injection for a bunx-rewritten non-claude adapter", async () => {
-    seedVaultToken("vault-should-not-leak");
-
-    const prepared = await prepareAgentEnv({
-      command: "bun",
-      args: ["x", "--bun", "@zed-industries/codex-acp"],
-      adapterCommand: "codex-acp",
-    });
-
-    expect(prepared.env).toEqual({});
-  });
-
   test("returns the config unchanged for an unrecognized command basename", async () => {
     seedVaultToken("vault-HHH");
 

package/src/acp/__tests__/session-manager-resume.test.ts

@@ -9,7 +9,8 @@
  * VellumAcpClientHandler so replay suppression is exercised end to end.
  */
 
-import { beforeEach, describe, expect, mock, test } from "bun:test";
+import { tmpdir } from "node:os";
+import { afterAll, beforeEach, describe, expect, mock, test } from "bun:test";
 
 mock.module("../../util/logger.js", () => ({
   getLogger: () =>
@@ -52,7 +53,7 @@ class FakeAcpAgentProcess {
     public readonly config: {
       command: string;
       args: string[];
-      adapterCommand?: string;
+      env?: Record<string, string | undefined>;
     },
     private readonly clientFactory: (agent: unknown) => FakeClient,
   ) {
@@ -123,14 +124,30 @@ mock.module("../agent-process.js", () => ({
   AcpAgentProcess: FakeAcpAgentProcess,
 }));
 
-// Identity env-prep: credential-broker plumbing has its own suite. Tests
-// that need to observe the manager mid-resume (dispose, pending-id
-// visibility) set `prepareAgentEnvGate` to stall the resume here.
+// Env-prep stub: credential-broker plumbing has its own suite. Tests that
+// need to observe the manager mid-resume (dispose, pending-id visibility)
+// set `prepareAgentEnvGate` to stall the resume here. Each resolved command
+// it is called with is recorded so resume tests can assert it ran AFTER
+// resolution (the real helper is the sole token-injection point), and it
+// mirrors that contract by injecting CLAUDE_CODE_OAUTH_TOKEN into the
+// returned config — at spawn time only, never during the auto-install phase.
 let prepareAgentEnvGate: Promise<void> | null = null;
+let prepareAgentEnvCommands: string[] = [];
 mock.module("../prepare-agent-env.js", () => ({
-  prepareAgentEnv: async (agentConfig: unknown) => {
+  prepareAgentEnv: async (agentConfig: {
+    command: string;
+    args: string[];
+    env?: Record<string, string | undefined>;
+  }) => {
     if (prepareAgentEnvGate) await prepareAgentEnvGate;
-    return agentConfig;
+    prepareAgentEnvCommands.push(agentConfig.command);
+    return {
+      ...agentConfig,
+      env: {
+        ...agentConfig.env,
+        CLAUDE_CODE_OAUTH_TOKEN: process.env.CLAUDE_CODE_OAUTH_TOKEN,
+      },
+    };
   },
 }));
 
@@ -138,7 +155,7 @@ mock.module("../prepare-agent-env.js", () => ({
 type ResolveResult =
   | {
       ok: true;
-      agent: { command: string; args: string[]; adapterCommand?: string };
+      agent: { command: string; args: string[] };
     }
   | { ok: false; reason: "binary_not_found"; hint: string; command: string };
 let resolveImpl: (id: string) => ResolveResult = () => ({
@@ -151,6 +168,23 @@ mock.module("../resolve-agent.js", () => ({
   resolveAcpAgent: (id: string) => resolveImpl(id),
 }));
 
+// Auto-install stubs: resume now resolves through resolveAgentWithAutoInstall
+// (the same sandboxed `bun` path as spawn), so a binary_not_found resolution
+// reaches `ensureAdapterInstalled`, which probes `bun` via Bun.which and
+// shells out via execFile. Stub both — process-global, installed BEFORE the
+// session-manager (and thus auto-install) module is imported below — so the
+// install is never a real one. Default: bun absent (no install attempted).
+import { installExecFileStub } from "./helpers/exec-file-stub.js";
+import { installWhichStub } from "./helpers/which-stub.js";
+
+const { execScripts, execFileMock, reset: resetExecStub } =
+  installExecFileStub();
+const which = installWhichStub();
+/** Fixed resolved `bun` path so install script keys are predictable. */
+const BUN_BIN = "/usr/local/bin/bun";
+/** Key the exec stub uses for the global install. */
+const BUN_ADD_KEY = `${BUN_BIN} add`;
+
 import type { ServerMessage } from "../../daemon/message-protocol.js";
 import type { AcpSessionUpdate } from "../../daemon/message-types/acp.js";
 import { getSqlite } from "../../memory/db-connection.js";
@@ -164,6 +198,9 @@ import {
 
 const { AcpResumeError, AcpSessionManager, AcpSessionNotFoundError } =
   await import("../session-manager.js");
+// Imported dynamically (after the exec/which stubs above) so auto-install.js
+// binds to the mocked node:child_process, exactly like session-manager.js.
+const { _resetAdapterInstallCacheForTests } = await import("../auto-install.js");
 
 initializeDb();
 
@@ -190,6 +227,10 @@ function internals(
   return manager as unknown as ManagerInternals;
 }
 
+afterAll(() => {
+  which.restore();
+});
+
 beforeEach(() => {
   clearHistory();
   fakeInstances.length = 0;
@@ -198,11 +239,17 @@ beforeEach(() => {
   replayChunks = [];
   promptThrowsSync = false;
   prepareAgentEnvGate = null;
+  prepareAgentEnvCommands = [];
   resumeSessionGate = null;
   resolveImpl = () => ({
     ok: true,
     agent: { command: "claude-agent-acp", args: [] },
   });
+  // Default: bun absent, no install scripts, install cache cleared. Tests
+  // that exercise the auto-install path opt in via which/execScripts.
+  resetExecStub();
+  _resetAdapterInstallCacheForTests();
+  which.setWhich({});
 });
 
 const PERSISTED_EVENT: AcpSessionUpdate = {
@@ -329,55 +376,160 @@ describe("AcpSessionManager.resumeFromHistory", () => {
     expect(internals(manager).eventBuffers.has("no-caps-1")).toBe(false);
   });
 
-  test("bunx-rewritten resolver output flows through resume with the canonical adapter command", async () => {
-    // resolveAcpAgent rewrites a missing claude-agent-acp binary to run via
-    // `bun x --bun <pkg>`; resumeFromHistory re-resolves through it, so the
-    // rewritten config must reach the agent process while the SessionEntry
-    // keeps the canonical adapter command (resume hints gate on it).
+  test("re-resolves via resolveAgentWithAutoInstall: an already-installed real binary flows through resume", async () => {
+    // resumeFromHistory resolves through resolveAgentWithAutoInstall. When the
+    // adapter is already on PATH the resolver returns the real binary (a full
+    // path here) with no install, and the SessionEntry tracks its basename for
+    // resume-hint gating.
     fakeCaps.resume = true;
-    insertHistoryRow({ id: "bunx-resume-1" });
+    insertHistoryRow({ id: "installed-resume-1" });
     resolveImpl = () => ({
       ok: true,
       agent: {
-        command: "bun",
-        args: ["x", "--bun", "@agentclientprotocol/claude-agent-acp"],
-        adapterCommand: "claude-agent-acp",
+        command: "/usr/local/bin/claude-agent-acp",
+        args: [],
       },
     });
 
     const manager = new AcpSessionManager(4);
-    await manager.resumeFromHistory("bunx-resume-1", () => {});
+    await manager.resumeFromHistory("installed-resume-1", () => {});
 
     const fake = fakeInstances[0]!;
-    expect(fake.config.command).toBe("bun");
-    expect(fake.config.args).toEqual([
-      "x",
-      "--bun",
+    expect(fake.config.command).toBe("/usr/local/bin/claude-agent-acp");
+    expect(fake.resumeSessionCalls).toEqual([
+      { sessionId: "proto-old", cwd: "/tmp/proj" },
+    ]);
+    // The SessionEntry command is the basename (resume hints gate on it).
+    expect(
+      internals(manager).sessions.get("installed-resume-1")!.command,
+    ).toBe("claude-agent-acp");
+  });
+
+  test("missing adapter on resume: installs via sandboxed bun, then resumes against the real binary", async () => {
+    // The adapter binary is missing but maps to an allowlisted package and
+    // bun is present. resumeFromHistory must trigger the same one-time
+    // sandboxed install as spawn, then resume against the now-installed real
+    // binary, with the OAuth token injected only at spawn (never during the
+    // install).
+    fakeCaps.resume = true;
+    insertHistoryRow({ id: "resume-install-1" });
+
+    // Resolver: binary missing until the install flips `installed`, then the
+    // real installed binary (a full path, as a global bin would resolve).
+    let installed = false;
+    resolveImpl = () =>
+      installed
+        ? {
+            ok: true,
+            agent: { command: "/usr/local/bin/claude-agent-acp", args: [] },
+          }
+        : {
+            ok: false,
+            reason: "binary_not_found",
+            hint: "bun add -g @agentclientprotocol/claude-agent-acp",
+            command: "claude-agent-acp",
+          };
+    which.setWhich({ bun: BUN_BIN });
+    execScripts.set(BUN_ADD_KEY, {
+      stdout: "",
+      onCall: () => {
+        installed = true;
+      },
+    });
+
+    // Seed the secrets on the ambient env so we can assert they are stripped
+    // from the installer env and only reappear at spawn time.
+    process.env.CLAUDE_CODE_OAUTH_TOKEN = "should-not-leak";
+    process.env.GEMINI_API_KEY = "should-not-leak-either";
+
+    const manager = new AcpSessionManager(4);
+    try {
+      await manager.resumeFromHistory("resume-install-1", () => {});
+    } finally {
+      delete process.env.CLAUDE_CODE_OAUTH_TOKEN;
+      delete process.env.GEMINI_API_KEY;
+    }
+
+    // The install ran via bun (never npm) in a sandboxed temp dir (NOT the
+    // project dir), with the secrets stripped from its env.
+    expect(execFileMock).toHaveBeenCalledTimes(1);
+    const [command, args, options] = execFileMock.mock.calls[0];
+    expect(command).toBe(BUN_BIN);
+    expect(command).not.toBe("npm");
+    expect(args).toEqual([
+      "add",
+      "--global",
       "@agentclientprotocol/claude-agent-acp",
     ]);
+    const { cwd, env } = options as { cwd?: string; env?: NodeJS.ProcessEnv };
+    expect(cwd).toBeDefined();
+    expect(cwd!.startsWith(tmpdir())).toBe(true);
+    expect(cwd).not.toBe(process.cwd());
+    expect(cwd).toContain("vellum-acp-install-");
+    expect(env!.CLAUDE_CODE_OAUTH_TOKEN).toBeUndefined();
+    expect(env!.GEMINI_API_KEY).toBeUndefined();
+
+    // Resume then succeeded against the now-installed real binary.
+    const fake = fakeInstances[0]!;
+    expect(fake.config.command).toBe("/usr/local/bin/claude-agent-acp");
     expect(fake.resumeSessionCalls).toEqual([
       { sessionId: "proto-old", cwd: "/tmp/proj" },
     ]);
     expect(
-      internals(manager).sessions.get("bunx-resume-1")!.command,
-    ).toBe("claude-agent-acp");
+      (manager.getStatus("resume-install-1") as AcpSessionState).status,
+    ).toBe("running");
+
+    // prepareAgentEnv ran AFTER resolution, on the resolved real binary, and
+    // injected the token at spawn time — the sole point the token is in scope.
+    expect(prepareAgentEnvCommands).toEqual(["/usr/local/bin/claude-agent-acp"]);
+    expect(fake.config.env?.CLAUDE_CODE_OAUTH_TOKEN).toBe("should-not-leak");
+  });
+
+  test("install failure on resume surfaces the actionable error (no process spawned)", async () => {
+    fakeCaps.resume = true;
+    insertHistoryRow({ id: "resume-install-fail-1" });
+    resolveImpl = () => ({
+      ok: false,
+      reason: "binary_not_found",
+      hint: "bun add -g @agentclientprotocol/claude-agent-acp",
+      command: "claude-agent-acp",
+    });
+    which.setWhich({ bun: BUN_BIN });
+    execScripts.set(BUN_ADD_KEY, { error: new Error("network is down") });
+
+    const manager = new AcpSessionManager(4);
+    const promise = manager.resumeFromHistory("resume-install-fail-1", () => {});
+    await expect(promise).rejects.toThrow(/claude-agent-acp is not on PATH/);
+    await expect(promise).rejects.toThrow(
+      /auto-install failed: .*network is down/,
+    );
+
+    // The install was attempted via bun (never npm) but no child process
+    // spawned, and the reservation was released.
+    for (const call of execFileMock.mock.calls) {
+      expect(call[0]).not.toBe("npm");
+    }
+    expect(fakeInstances).toHaveLength(0);
+    expect(internals(manager).pendingResumes.size).toBe(0);
   });
 
-  test("resolver failures surface the actionable hint", async () => {
+  test("bun absent on resume surfaces the actionable install hint, attempts no install", async () => {
     insertHistoryRow({ id: "no-bin-1" });
     resolveImpl = () => ({
       ok: false,
       reason: "binary_not_found",
-      hint: "npm i -g @agentclientprotocol/claude-agent-acp",
+      hint: "bun add -g @agentclientprotocol/claude-agent-acp",
       command: "claude-agent-acp",
     });
+    which.setWhich({}); // bun not on PATH (the beforeEach default, made explicit)
 
     const manager = new AcpSessionManager(4);
     await expect(
       manager.resumeFromHistory("no-bin-1", () => {}),
     ).rejects.toThrow(
-      "claude-agent-acp is not on PATH. npm i -g @agentclientprotocol/claude-agent-acp",
+      "claude-agent-acp is not on PATH. bun add -g @agentclientprotocol/claude-agent-acp",
     );
+    expect(execFileMock).not.toHaveBeenCalled();
   });
 
   test("already-active id and concurrency limit reuse spawn's guards", async () => {