@vellumai/cli 0.11.2 → 0.11.3-staging.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/cli",
-  "version": "0.11.2",
+  "version": "0.11.3-staging.2",
   "description": "CLI tools for vellum-assistant",
   "type": "module",
   "exports": {
@@ -30,6 +30,7 @@
   "license": "MIT",
   "dependencies": {
     "@vellumai/environments": "file:../packages/environments",
+    "@vellumai/ipc-server-utils": "file:../packages/ipc-server-utils",
     "@vellumai/local-mode": "file:../packages/local-mode",
     "@vellumai/service-contracts": "file:../packages/service-contracts",
     "chalk": "5.6.2",
@@ -40,6 +41,7 @@
   },
   "bundledDependencies": [
     "@vellumai/environments",
+    "@vellumai/ipc-server-utils",
     "@vellumai/local-mode",
     "@vellumai/service-contracts"
   ],

package/src/__tests__/client-token.test.ts

@@ -27,11 +27,36 @@ const testDir = mkdtempSync(join(tmpdir(), "client-token-test-"));
 const ORIGINAL_LOCKFILE_DIR = process.env.VELLUM_LOCKFILE_DIR;
 const ORIGINAL_ARGV = [...process.argv];
 
-import { parseArgs } from "../commands/client.js";
+import { isSameOriginRequest, parseArgs } from "../commands/client.js";
 
 // A clearly non-local URL so maybeSwapToLocalhost won't rewrite it to 127.0.0.1.
 const REMOTE_URL = "http://192.0.2.50:7830";
 
+describe("client web proxy credential proof", () => {
+  test("rejects a request without browser same-origin proof", () => {
+    expect(
+      isSameOriginRequest(
+        new Request("http://127.0.0.1:3000/assistant", {
+          headers: { host: "127.0.0.1:3000" },
+        }),
+      ),
+    ).toBe(false);
+  });
+
+  test("accepts a request with a matching Origin", () => {
+    expect(
+      isSameOriginRequest(
+        new Request("http://127.0.0.1:3000/assistant", {
+          headers: {
+            host: "127.0.0.1:3000",
+            origin: "http://127.0.0.1:3000",
+          },
+        }),
+      ),
+    ).toBe(true);
+  });
+});
+
 describe("client --token (ephemeral)", () => {
   beforeEach(() => {
     process.env.VELLUM_LOCKFILE_DIR = testDir;

package/src/__tests__/guardian-token.test.ts

@@ -261,6 +261,7 @@ describe("refreshGuardianToken", () => {
       isNew: false,
       deviceId: "dev",
       leasedAt: new Date().toISOString(),
+      pairedGatewayUrl: "https://gw.example.com",
     });
   }
 
@@ -302,6 +303,9 @@ describe("refreshGuardianToken", () => {
 
     expect(result?.accessToken).toBe("new-acc");
     expect(loadGuardianToken("px")?.accessToken).toBe("new-acc");
+    expect(loadGuardianToken("px")?.pairedGatewayUrl).toBe(
+      "https://gw.example.com",
+    );
     expect(sawSignal).toBe(true); // fetch carries a timeout AbortSignal
     expect(existsSync(lockPath("px"))).toBe(false); // lock released
   });

package/src/__tests__/nginx-ingress-command.test.ts

@@ -1,9 +1,45 @@
-import { afterAll, beforeEach, describe, expect, test } from "bun:test";
+import {
+  afterAll,
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  mock,
+  spyOn,
+  test,
+} from "bun:test";
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
-import { resolveNginxIngressTarget } from "../commands/nginx-ingress.js";
+import * as nginxIngressLib from "../lib/nginx-ingress.js";
+
+const realNginxIngressLib = { ...nginxIngressLib };
+
+const ensureTunnelEdgeMock = mock<typeof nginxIngressLib.ensureTunnelEdge>(
+  async () => ({ port: 7840, started: true, includesWebApp: true }),
+);
+const getIngressPidMock = mock<typeof nginxIngressLib.getIngressPid>(
+  () => null,
+);
+
+mock.module("../lib/nginx-ingress.js", () => ({
+  ...nginxIngressLib,
+  ensureTunnelEdge: ensureTunnelEdgeMock,
+  getIngressPid: getIngressPidMock,
+}));
+
+// Restore the real module once this file finishes so the mock does not leak
+// into sibling test files in the same `bun test` run.
+afterAll(() => {
+  mock.module("../lib/nginx-ingress.js", () => realNginxIngressLib);
+});
+
+import {
+  resolveNginxIngressTarget,
+  status,
+  up,
+} from "../commands/nginx-ingress.js";
 import type { AssistantEntry } from "../lib/assistant-config.js";
 
 const testDir = mkdtempSync(join(tmpdir(), "cli-nginx-ingress-command-test-"));
@@ -29,6 +65,20 @@ function writeLockfile(
   );
 }
 
+afterAll(() => {
+  if (originalLockfileDir === undefined) {
+    delete process.env.VELLUM_LOCKFILE_DIR;
+  } else {
+    process.env.VELLUM_LOCKFILE_DIR = originalLockfileDir;
+  }
+  if (originalWorkspaceDir === undefined) {
+    delete process.env.VELLUM_WORKSPACE_DIR;
+  } else {
+    process.env.VELLUM_WORKSPACE_DIR = originalWorkspaceDir;
+  }
+  rmSync(testDir, { recursive: true, force: true });
+});
+
 describe("resolveNginxIngressTarget", () => {
   beforeEach(() => {
     process.env.VELLUM_LOCKFILE_DIR = testDir;
@@ -36,20 +86,6 @@ describe("resolveNginxIngressTarget", () => {
     rmSync(join(testDir, ".vellum.lock.json"), { force: true });
   });
 
-  afterAll(() => {
-    if (originalLockfileDir === undefined) {
-      delete process.env.VELLUM_LOCKFILE_DIR;
-    } else {
-      process.env.VELLUM_LOCKFILE_DIR = originalLockfileDir;
-    }
-    if (originalWorkspaceDir === undefined) {
-      delete process.env.VELLUM_WORKSPACE_DIR;
-    } else {
-      process.env.VELLUM_WORKSPACE_DIR = originalWorkspaceDir;
-    }
-    rmSync(testDir, { recursive: true, force: true });
-  });
-
   test("derives the gateway port from runtimeUrl when resources are absent", () => {
     writeLockfile([
       {
@@ -67,3 +103,127 @@ describe("resolveNginxIngressTarget", () => {
     });
   });
 });
+
+describe("up", () => {
+  let logs: string[];
+  let logSpy: ReturnType<typeof spyOn<typeof console, "log">>;
+
+  beforeEach(() => {
+    ensureTunnelEdgeMock.mockClear();
+    logs = [];
+    logSpy = spyOn(console, "log").mockImplementation((...args: unknown[]) => {
+      logs.push(args.join(" "));
+    });
+  });
+
+  afterEach(() => {
+    logSpy.mockRestore();
+  });
+
+  test("starts the webhooks-only edge when the flag is off and states the mode", async () => {
+    ensureTunnelEdgeMock.mockResolvedValue({
+      port: 7845,
+      started: true,
+      includesWebApp: false,
+    });
+
+    await up({
+      assistantId: "assistant-1",
+      workspaceDir,
+      gatewayPort: 7830,
+    });
+
+    expect(ensureTunnelEdgeMock).toHaveBeenCalledTimes(1);
+    expect(ensureTunnelEdgeMock.mock.calls[0]?.[0]).toMatchObject({
+      assistantId: "assistant-1",
+      workspaceDir,
+      gatewayPort: 7830,
+    });
+    const output = logs.join("\n");
+    expect(output).toContain("http://127.0.0.1:7845 (webhooks only)");
+    expect(output).toContain("web-remote-ingress");
+    expect(output).toContain("vellum tunnel --provider ngrok");
+  });
+
+  test("states the remote web mode when the flag is on", async () => {
+    ensureTunnelEdgeMock.mockResolvedValue({
+      port: 7840,
+      started: true,
+      includesWebApp: true,
+    });
+
+    await up({
+      assistantId: "assistant-1",
+      workspaceDir,
+      gatewayPort: 7830,
+    });
+
+    const output = logs.join("\n");
+    expect(output).toContain("http://127.0.0.1:7840 (remote web + webhooks)");
+    expect(output).not.toContain("Enable the web-remote-ingress feature flag");
+  });
+});
+
+describe("status", () => {
+  const statusWorkspace = join(testDir, "status-workspace");
+  let logs: string[];
+  let logSpy: ReturnType<typeof spyOn<typeof console, "log">>;
+
+  beforeEach(() => {
+    getIngressPidMock.mockReset();
+    getIngressPidMock.mockReturnValue(4242);
+    logs = [];
+    logSpy = spyOn(console, "log").mockImplementation((...args: unknown[]) => {
+      logs.push(args.join(" "));
+    });
+  });
+
+  afterEach(() => {
+    logSpy.mockRestore();
+    rmSync(statusWorkspace, { recursive: true, force: true });
+  });
+
+  function writeIngressState(nginx: Record<string, unknown>): void {
+    mkdirSync(statusWorkspace, { recursive: true });
+    writeFileSync(
+      join(statusWorkspace, "config.json"),
+      JSON.stringify({ ingress: { nginx } }) + "\n",
+    );
+  }
+
+  test("prints the recorded gateway upstream, not the requested one", async () => {
+    writeIngressState({
+      listenPort: 7845,
+      includeWebApp: false,
+      gatewayPort: 7900,
+    });
+
+    await status({ workspaceDir: statusWorkspace, gatewayPort: 7830 });
+
+    const output = logs.join("\n");
+    expect(output).toContain("nginx ingress: running");
+    expect(output).toContain("Listen:  http://127.0.0.1:7845");
+    expect(output).toContain("Gateway: http://127.0.0.1:7900");
+    expect(output).not.toContain("http://127.0.0.1:7830");
+    expect(output).not.toContain("(unverified)");
+    expect(output).toContain("Mode:    webhooks only");
+  });
+
+  test("marks the requested gateway port unverified when the record predates the field", async () => {
+    writeIngressState({ listenPort: 7845 });
+
+    await status({ workspaceDir: statusWorkspace, gatewayPort: 7830 });
+
+    const output = logs.join("\n");
+    expect(output).toContain("Gateway: http://127.0.0.1:7830 (unverified)");
+    expect(output).toContain("Mode:    remote web + webhooks");
+  });
+
+  test("reports a stopped edge", async () => {
+    getIngressPidMock.mockReturnValue(null);
+
+    await status({ workspaceDir: statusWorkspace, gatewayPort: 7830 });
+
+    expect(logs.join("\n")).toContain("nginx ingress: not running");
+  });
+});