@vellumai/cli 0.10.11-dev.202607220701.38c4eff → 0.10.11-dev.202607220955.d4134f8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/cli",
-  "version": "0.10.11-dev.202607220701.38c4eff",
+  "version": "0.10.11-dev.202607220955.d4134f8",
   "description": "CLI tools for vellum-assistant",
   "type": "module",
   "exports": {

package/src/__tests__/flags.test.ts

@@ -188,14 +188,7 @@ describe("vellum flags --assistant routing", () => {
       ],
       "alice-1",
     );
-    process.argv = [
-      "bun",
-      "vellum",
-      "flags",
-      "set",
-      "voice-mode",
-      "true",
-    ];
+    process.argv = ["bun", "vellum", "flags", "set", "voice-mode", "true"];
 
     await flags();
 

package/src/__tests__/input-history.test.ts

@@ -1,10 +1,5 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import {
-  existsSync,
-  mkdtempSync,
-  readFileSync,
-  rmSync,
-} from "node:fs";
+import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { join } from "node:path";
 

package/src/__tests__/login-loopback.test.ts

@@ -3,7 +3,9 @@ import { describe, expect, test } from "bun:test";
 import { startLoopbackListener } from "../commands/login.js";
 
 /** Resolve "settled"/"pending" — proves whether `waitForCode` resolved. */
-async function settleState(p: Promise<unknown>): Promise<"settled" | "pending"> {
+async function settleState(
+  p: Promise<unknown>,
+): Promise<"settled" | "pending"> {
   return Promise.race([
     p.then(
       () => "settled" as const,
@@ -49,7 +51,9 @@ describe("startLoopbackListener", () => {
         () => null,
         (e: Error) => e,
       );
-      const res = await fetch(`${listener.redirectUri}?error=access_denied&state=st`);
+      const res = await fetch(
+        `${listener.redirectUri}?error=access_denied&state=st`,
+      );
       expect(res.status).toBe(400);
       const err = await settled;
       expect(err?.message).toMatch(/access_denied/);

package/src/__tests__/pair.test.ts

@@ -15,7 +15,7 @@ import { join } from "node:path";
 const testDir = mkdtempSync(join(tmpdir(), "pair-command-test-"));
 process.env.VELLUM_LOCKFILE_DIR = testDir;
 
-import { pair } from "../commands/pair.js";
+import { buildAppConnectUrl, pair } from "../commands/pair.js";
 
 // Distinct loopback (mint) vs reachable (advertised) URLs to verify the split.
 const LOCAL_URL = "http://127.0.0.1:7830";
@@ -800,4 +800,438 @@ describe("pair command", () => {
       `${LOCAL_URL}/v1/assistants/pair-test/feature-flags`,
     );
   });
+
+  test("buildAppConnectUrl composes and encodes the connect link", () => {
+    expect(
+      buildAppConnectUrl(
+        "vellum-assistant",
+        "https://pair.example.ts.net",
+        "device-code",
+      ),
+    ).toBe(
+      "vellum-assistant://connect?url=https%3A%2F%2Fpair.example.ts.net&code=device-code",
+    );
+    // Path prefixes and fragment-hostile characters survive the encoding.
+    expect(
+      buildAppConnectUrl(
+        "vellum-assistant-dev",
+        "https://host.example.ts.net/assistant-123",
+        "a+b/c=",
+      ),
+    ).toBe(
+      "vellum-assistant-dev://connect?url=https%3A%2F%2Fhost.example.ts.net%2Fassistant-123&code=a%2Bb%2Fc%3D",
+    );
+  });
+
+  test("--qr --app emits an app connect URL alongside the browser URL", async () => {
+    const origFetch = globalThis.fetch;
+    globalThis.fetch = (async (url: string) => {
+      if (url === `${LOCAL_URL}/v1/assistants/pair-test/feature-flags`) {
+        return new Response(
+          JSON.stringify({
+            flags: [{ key: "web-remote-ingress", enabled: true }],
+          }),
+          { status: 200, headers: { "content-type": "application/json" } },
+        );
+      }
+      if (url === `${LOCAL_URL}/v1/remote-web/pairing-challenge`) {
+        return new Response(
+          JSON.stringify({
+            deviceCode: "device-code",
+            userCode: "ABCD-EFGH",
+            verificationUri: "https://pair.example.ts.net/assistant/pair",
+            expiresAt: "2026-06-04T00:10:00.000Z",
+            expiresInSeconds: 600,
+          }),
+          { status: 200, headers: { "content-type": "application/json" } },
+        );
+      }
+      if (url === `${LOCAL_URL}/v1/remote-web/pairing-verification`) {
+        return new Response(
+          JSON.stringify({
+            status: "approved",
+            verificationUri: "https://pair.example.ts.net/assistant/pair",
+            expiresAt: "2026-06-04T00:10:00.000Z",
+          }),
+          { status: 200, headers: { "content-type": "application/json" } },
+        );
+      }
+      return new Response("not found", { status: 404 });
+    }) as unknown as typeof fetch;
+
+    const logs: string[] = [];
+    const logSpy = spyOn(console, "log").mockImplementation(
+      (...a: unknown[]) => {
+        logs.push(a.join(" "));
+      },
+    );
+
+    process.argv = [
+      "bun",
+      "vellum",
+      "pair",
+      "--qr",
+      "--app",
+      "--app-scheme",
+      "vellum-assistant-dev",
+      "--url",
+      "https://pair.example.ts.net",
+      "--json",
+    ];
+    try {
+      await pair();
+    } finally {
+      logSpy.mockRestore();
+      globalThis.fetch = origFetch;
+    }
+
+    const out = JSON.parse(logs.join("\n"));
+    expect(out.appUrl).toBe(
+      "vellum-assistant-dev://connect?url=https%3A%2F%2Fpair.example.ts.net&code=device-code",
+    );
+    // The browser URL stays available as the no-app fallback.
+    expect(out.pairUrl).toBe(
+      "https://pair.example.ts.net/assistant/pair#device_code=device-code",
+    );
+    expect(out.deviceCode).toBe("device-code");
+  });
+
+  test("--app without --qr is refused", async () => {
+    let fetchCalled = false;
+    const origFetch = globalThis.fetch;
+    globalThis.fetch = (async () => {
+      fetchCalled = true;
+      return new Response("{}", { status: 200 });
+    }) as unknown as typeof fetch;
+    const errors: string[] = [];
+    const errSpy = spyOn(console, "error").mockImplementation(
+      (...a: unknown[]) => {
+        errors.push(a.join(" "));
+      },
+    );
+    const exitSpy = spyOn(process, "exit").mockImplementation(((
+      code?: number,
+    ) => {
+      throw new Error(`exit:${code}`);
+    }) as never);
+
+    process.argv = ["bun", "vellum", "pair", "--app"];
+    let exited = false;
+    try {
+      await pair();
+    } catch (e) {
+      exited = (e as Error).message === "exit:1";
+    } finally {
+      errSpy.mockRestore();
+      exitSpy.mockRestore();
+      globalThis.fetch = origFetch;
+    }
+
+    expect(exited).toBe(true);
+    expect(errors.join("\n")).toContain("--qr");
+    expect(fetchCalled).toBe(false);
+  });
+
+  test("--qr with no --url uses the tunnel-saved ingress URL", async () => {
+    const workspaceDir = mkdtempSync(join(tmpdir(), "vellum-pair-ingress-"));
+    // Point the synthesized instance dir at an empty temp XDG root so the
+    // resolution deterministically falls through to VELLUM_WORKSPACE_DIR.
+    const xdgDir = mkdtempSync(join(tmpdir(), "vellum-pair-xdg-"));
+    process.env.XDG_DATA_HOME = xdgDir;
+    writeFileSync(
+      join(workspaceDir, "config.json"),
+      JSON.stringify({
+        ingress: {
+          publicBaseUrl: "https://saved.example.ts.net",
+          enabled: true,
+        },
+      }),
+    );
+    process.env.VELLUM_WORKSPACE_DIR = workspaceDir;
+
+    const calls: string[] = [];
+    const origFetch = globalThis.fetch;
+    globalThis.fetch = (async (url: string, init?: RequestInit) => {
+      calls.push(url);
+      if (url === `${LOCAL_URL}/v1/assistants/pair-test/feature-flags`) {
+        return new Response(
+          JSON.stringify({
+            flags: [{ key: "web-remote-ingress", enabled: true }],
+          }),
+          { status: 200, headers: { "content-type": "application/json" } },
+        );
+      }
+      if (url === `${LOCAL_URL}/v1/remote-web/pairing-challenge`) {
+        // The minted challenge must advertise the SAVED ingress URL.
+        expect(JSON.parse(init?.body as string)).toEqual({
+          publicBaseUrl: "https://saved.example.ts.net",
+        });
+        return new Response(
+          JSON.stringify({
+            deviceCode: "device-code",
+            userCode: "ABCD-EFGH",
+            verificationUri: "https://saved.example.ts.net/assistant/pair",
+            expiresAt: "2026-06-04T00:10:00.000Z",
+            expiresInSeconds: 600,
+          }),
+          { status: 200, headers: { "content-type": "application/json" } },
+        );
+      }
+      if (url === `${LOCAL_URL}/v1/remote-web/pairing-verification`) {
+        return new Response(
+          JSON.stringify({
+            status: "approved",
+            verificationUri: "https://saved.example.ts.net/assistant/pair",
+            expiresAt: "2026-06-04T00:10:00.000Z",
+          }),
+          { status: 200, headers: { "content-type": "application/json" } },
+        );
+      }
+      return new Response("not found", { status: 404 });
+    }) as unknown as typeof fetch;
+
+    const logs: string[] = [];
+    const logSpy = spyOn(console, "log").mockImplementation(
+      (...a: unknown[]) => {
+        logs.push(a.join(" "));
+      },
+    );
+
+    process.argv = ["bun", "vellum", "pair", "--qr"];
+    try {
+      await pair();
+    } finally {
+      logSpy.mockRestore();
+      globalThis.fetch = origFetch;
+      delete process.env.VELLUM_WORKSPACE_DIR;
+      delete process.env.XDG_DATA_HOME;
+      rmSync(workspaceDir, { recursive: true, force: true });
+      rmSync(xdgDir, { recursive: true, force: true });
+    }
+
+    expect(calls).toContain(`${LOCAL_URL}/v1/remote-web/pairing-challenge`);
+    const output = logs.join("\n");
+    expect(output).toContain(
+      "Using saved ingress URL https://saved.example.ts.net",
+    );
+    expect(output).toContain(
+      "https://saved.example.ts.net/assistant/pair#device_code=device-code",
+    );
+  });
+
+  test("--url beats the saved ingress URL", async () => {
+    const workspaceDir = mkdtempSync(join(tmpdir(), "vellum-pair-ingress-"));
+    // Point the synthesized instance dir at an empty temp XDG root so the
+    // resolution deterministically falls through to VELLUM_WORKSPACE_DIR.
+    const xdgDir = mkdtempSync(join(tmpdir(), "vellum-pair-xdg-"));
+    process.env.XDG_DATA_HOME = xdgDir;
+    writeFileSync(
+      join(workspaceDir, "config.json"),
+      JSON.stringify({
+        ingress: {
+          publicBaseUrl: "https://saved.example.ts.net",
+          enabled: true,
+        },
+      }),
+    );
+    process.env.VELLUM_WORKSPACE_DIR = workspaceDir;
+
+    const origFetch = globalThis.fetch;
+    globalThis.fetch = (async (url: string, init?: RequestInit) => {
+      if (url === `${LOCAL_URL}/v1/assistants/pair-test/feature-flags`) {
+        return new Response(
+          JSON.stringify({
+            flags: [{ key: "web-remote-ingress", enabled: true }],
+          }),
+          { status: 200, headers: { "content-type": "application/json" } },
+        );
+      }
+      if (url === `${LOCAL_URL}/v1/remote-web/pairing-challenge`) {
+        expect(JSON.parse(init?.body as string)).toEqual({
+          publicBaseUrl: "https://explicit.example.ts.net",
+        });
+        return new Response(
+          JSON.stringify({
+            deviceCode: "device-code",
+            userCode: "ABCD-EFGH",
+            verificationUri: "https://explicit.example.ts.net/assistant/pair",
+            expiresAt: "2026-06-04T00:10:00.000Z",
+            expiresInSeconds: 600,
+          }),
+          { status: 200, headers: { "content-type": "application/json" } },
+        );
+      }
+      if (url === `${LOCAL_URL}/v1/remote-web/pairing-verification`) {
+        return new Response(
+          JSON.stringify({
+            status: "approved",
+            verificationUri: "https://explicit.example.ts.net/assistant/pair",
+            expiresAt: "2026-06-04T00:10:00.000Z",
+          }),
+          { status: 200, headers: { "content-type": "application/json" } },
+        );
+      }
+      return new Response("not found", { status: 404 });
+    }) as unknown as typeof fetch;
+
+    const logs: string[] = [];
+    const logSpy = spyOn(console, "log").mockImplementation(
+      (...a: unknown[]) => {
+        logs.push(a.join(" "));
+      },
+    );
+
+    process.argv = [
+      "bun",
+      "vellum",
+      "pair",
+      "--qr",
+      "--url",
+      "https://explicit.example.ts.net",
+    ];
+    try {
+      await pair();
+    } finally {
+      logSpy.mockRestore();
+      globalThis.fetch = origFetch;
+      delete process.env.VELLUM_WORKSPACE_DIR;
+      delete process.env.XDG_DATA_HOME;
+      rmSync(workspaceDir, { recursive: true, force: true });
+      rmSync(xdgDir, { recursive: true, force: true });
+    }
+
+    expect(logs.join("\n")).not.toContain("Using saved ingress URL");
+  });
+
+  test("a non-https saved ingress URL is ignored", async () => {
+    const workspaceDir = mkdtempSync(join(tmpdir(), "vellum-pair-ingress-"));
+    // Point the synthesized instance dir at an empty temp XDG root so the
+    // resolution deterministically falls through to VELLUM_WORKSPACE_DIR.
+    const xdgDir = mkdtempSync(join(tmpdir(), "vellum-pair-xdg-"));
+    process.env.XDG_DATA_HOME = xdgDir;
+    writeFileSync(
+      join(workspaceDir, "config.json"),
+      JSON.stringify({
+        ingress: {
+          publicBaseUrl: "http://insecure.example.com",
+          enabled: true,
+        },
+      }),
+    );
+    process.env.VELLUM_WORKSPACE_DIR = workspaceDir;
+
+    const origFetch = globalThis.fetch;
+    let minted = false;
+    globalThis.fetch = (async (url: string) => {
+      if (url === `${LOCAL_URL}/v1/assistants/pair-test/feature-flags`) {
+        return new Response(
+          JSON.stringify({
+            flags: [{ key: "web-remote-ingress", enabled: true }],
+          }),
+          { status: 200, headers: { "content-type": "application/json" } },
+        );
+      }
+      minted = true;
+      return new Response("{}", { status: 200 });
+    }) as unknown as typeof fetch;
+
+    const errors: string[] = [];
+    const errSpy = spyOn(console, "error").mockImplementation(
+      (...a: unknown[]) => {
+        errors.push(a.join(" "));
+      },
+    );
+    const exitSpy = spyOn(process, "exit").mockImplementation(((
+      code?: number,
+    ) => {
+      throw new Error(`exit:${code}`);
+    }) as never);
+
+    process.argv = ["bun", "vellum", "pair", "--qr"];
+    let exited = false;
+    try {
+      await pair();
+    } catch (e) {
+      exited = (e as Error).message === "exit:1";
+    } finally {
+      errSpy.mockRestore();
+      exitSpy.mockRestore();
+      globalThis.fetch = origFetch;
+      delete process.env.VELLUM_WORKSPACE_DIR;
+      delete process.env.XDG_DATA_HOME;
+      rmSync(workspaceDir, { recursive: true, force: true });
+      rmSync(xdgDir, { recursive: true, force: true });
+    }
+
+    // The saved http URL is skipped, so --qr falls through to the (non-https)
+    // runtime URL and refuses — proving the saved value was not advertised.
+    expect(exited).toBe(true);
+    expect(errors.join("\n")).toContain(RUNTIME_URL);
+    expect(minted).toBe(false);
+  });
+
+  test("a saved ingress URL with ingress disabled is ignored", async () => {
+    const workspaceDir = mkdtempSync(join(tmpdir(), "vellum-pair-ingress-"));
+    // Point the synthesized instance dir at an empty temp XDG root so the
+    // resolution deterministically falls through to VELLUM_WORKSPACE_DIR.
+    const xdgDir = mkdtempSync(join(tmpdir(), "vellum-pair-xdg-"));
+    process.env.XDG_DATA_HOME = xdgDir;
+    writeFileSync(
+      join(workspaceDir, "config.json"),
+      JSON.stringify({
+        ingress: {
+          publicBaseUrl: "https://saved.example.ts.net",
+          enabled: false,
+        },
+      }),
+    );
+    process.env.VELLUM_WORKSPACE_DIR = workspaceDir;
+
+    const origFetch = globalThis.fetch;
+    let minted = false;
+    globalThis.fetch = (async (url: string) => {
+      if (url === `${LOCAL_URL}/v1/assistants/pair-test/feature-flags`) {
+        return new Response(
+          JSON.stringify({
+            flags: [{ key: "web-remote-ingress", enabled: true }],
+          }),
+          { status: 200, headers: { "content-type": "application/json" } },
+        );
+      }
+      minted = true;
+      return new Response("{}", { status: 200 });
+    }) as unknown as typeof fetch;
+
+    const errors: string[] = [];
+    const errSpy = spyOn(console, "error").mockImplementation(
+      (...a: unknown[]) => {
+        errors.push(a.join(" "));
+      },
+    );
+    const exitSpy = spyOn(process, "exit").mockImplementation(((
+      code?: number,
+    ) => {
+      throw new Error(`exit:${code}`);
+    }) as never);
+
+    process.argv = ["bun", "vellum", "pair", "--qr"];
+    let exited = false;
+    try {
+      await pair();
+    } catch (e) {
+      exited = (e as Error).message === "exit:1";
+    } finally {
+      errSpy.mockRestore();
+      exitSpy.mockRestore();
+      globalThis.fetch = origFetch;
+      delete process.env.VELLUM_WORKSPACE_DIR;
+      delete process.env.XDG_DATA_HOME;
+      rmSync(workspaceDir, { recursive: true, force: true });
+      rmSync(xdgDir, { recursive: true, force: true });
+    }
+
+    expect(exited).toBe(true);
+    expect(errors.join("\n")).toContain(RUNTIME_URL);
+    expect(minted).toBe(false);
+  });
 });

package/src/__tests__/platform-client.test.ts

@@ -240,7 +240,11 @@ describe("fetchAssistantDetail / fetchUpgradeInProgress", () => {
       current_release_version: "0.7.0",
       release_channel: "preview",
     });
-    const detail = await fetchAssistantDetail(TOKEN, ASSISTANT_ID, PLATFORM_URL);
+    const detail = await fetchAssistantDetail(
+      TOKEN,
+      ASSISTANT_ID,
+      PLATFORM_URL,
+    );
     expect(detail).toEqual({
       currentReleaseVersion: "0.7.0",
       releaseChannel: "preview",
@@ -251,7 +255,11 @@ describe("fetchAssistantDetail / fetchUpgradeInProgress", () => {
 
   test("fetchAssistantDetail defaults missing fields", async () => {
     mockFetchJson({});
-    const detail = await fetchAssistantDetail(TOKEN, ASSISTANT_ID, PLATFORM_URL);
+    const detail = await fetchAssistantDetail(
+      TOKEN,
+      ASSISTANT_ID,
+      PLATFORM_URL,
+    );
     expect(detail).toEqual({
       currentReleaseVersion: null,
       releaseChannel: "stable",

package/src/__tests__/statefulset.test.ts

@@ -56,7 +56,9 @@ describe("getBuilderManagedEnvKeys", () => {
 
   test("gateway hostForwarded equals the three spec host entries", () => {
     const { hostForwarded } = getBuilderManagedEnvKeys("gateway");
-    const sorted = [...hostForwarded].sort((a, b) => a.name.localeCompare(b.name));
+    const sorted = [...hostForwarded].sort((a, b) =>
+      a.name.localeCompare(b.name),
+    );
     expect(sorted).toEqual([
       { name: "VELAY_BASE_URL", hostVar: "VELAY_BASE_URL" },
       { name: "VELLUM_ENVIRONMENT", hostVar: "VELLUM_ENVIRONMENT" },