@vellumai/cli 0.11.6 → 0.11.7-staging.2

package/src/__tests__/provider-secrets.test.ts

@@ -4,6 +4,8 @@ import { EventEmitter } from "node:events";
 import {
   ensureProviderApiKey,
   injectGatewayApiKey,
+  promptLine,
+  promptProviderChoice,
   promptSecret,
   readGatewayApiKey,
   type ProviderSecretFetch,
@@ -322,3 +324,159 @@ describe("provider secret helpers", () => {
     expect(calls).toHaveLength(1);
   });
 });
+
+function fakeOutput(): { write: (text: string) => boolean; text: string } {
+  const state = { write: (_text: string) => true, text: "" };
+  state.write = (text: string) => {
+    state.text += text;
+    return true;
+  };
+  return state;
+}
+
+describe("promptLine", () => {
+  test("resolves on newline", async () => {
+    const input = new FakePromptInput();
+    const output = fakeOutput();
+
+    const resultPromise = promptLine("Pick one: ", {
+      input: input as unknown as NodeJS.ReadStream,
+      output: output as unknown as NodeJS.WriteStream,
+    });
+    input.emit("data", Buffer.from("2\n"));
+
+    await expect(resultPromise).resolves.toBe("2");
+    expect(output.text).toBe("Pick one: ");
+    expect(input.rawModes).toEqual([]);
+  });
+
+  test("buffers across multiple data chunks", async () => {
+    const input = new FakePromptInput();
+    const output = fakeOutput();
+
+    const resultPromise = promptLine("Pick one: ", {
+      input: input as unknown as NodeJS.ReadStream,
+      output: output as unknown as NodeJS.WriteStream,
+    });
+    input.emit("data", Buffer.from("1"));
+    input.emit("data", Buffer.from("0"));
+    input.emit("data", Buffer.from("\n"));
+
+    await expect(resultPromise).resolves.toBe("10");
+    expect(input.rawModes).toEqual([]);
+  });
+
+  test("resolves to an empty string on EOF instead of hanging", async () => {
+    const input = new FakePromptInput();
+    const output = fakeOutput();
+
+    const resultPromise = promptLine("Pick one: ", {
+      input: input as unknown as NodeJS.ReadStream,
+      output: output as unknown as NodeJS.WriteStream,
+    });
+    input.emit("end");
+
+    await expect(resultPromise).resolves.toBe("");
+  });
+});
+
+describe("promptProviderChoice", () => {
+  const choices = ["anthropic", "openai", "gemini"] as const;
+
+  test("resolves the selected provider immediately", async () => {
+    const input = new FakePromptInput();
+    const output = fakeOutput();
+
+    const resultPromise = promptProviderChoice({
+      input: input as unknown as NodeJS.ReadStream,
+      output: output as unknown as NodeJS.WriteStream,
+      choices,
+    });
+    input.emit("data", Buffer.from("2\n"));
+
+    await expect(resultPromise).resolves.toBe("openai");
+    expect(output.text).toContain("1) Anthropic (default)");
+    expect(output.text).toContain("2) OpenAI");
+  });
+
+  test("re-prompts on invalid input before accepting a valid choice", async () => {
+    const input = new FakePromptInput();
+    const output = fakeOutput();
+
+    const resultPromise = promptProviderChoice({
+      input: input as unknown as NodeJS.ReadStream,
+      output: output as unknown as NodeJS.WriteStream,
+      choices,
+    });
+    input.emit("data", Buffer.from("nope\n"));
+    input.emit("data", Buffer.from("99\n"));
+    input.emit("data", Buffer.from("3\n"));
+
+    await expect(resultPromise).resolves.toBe("gemini");
+    expect(output.text).toContain(
+      "Please enter a number between 1 and 3, or press Enter to skip.",
+    );
+  });
+
+  test("does not lose lines pasted in a single chunk ahead of a retry", async () => {
+    const input = new FakePromptInput();
+    const output = fakeOutput();
+
+    const resultPromise = promptProviderChoice({
+      input: input as unknown as NodeJS.ReadStream,
+      output: output as unknown as NodeJS.WriteStream,
+      choices,
+    });
+    // A paste can deliver several lines in one "data" event, all before the
+    // retry loop has re-registered for the next answer.
+    input.emit("data", Buffer.from("99\n3\n"));
+
+    await expect(resultPromise).resolves.toBe("gemini");
+  });
+
+  test("resolves null on blank input", async () => {
+    const input = new FakePromptInput();
+    const output = fakeOutput();
+
+    const resultPromise = promptProviderChoice({
+      input: input as unknown as NodeJS.ReadStream,
+      output: output as unknown as NodeJS.WriteStream,
+      choices,
+    });
+    input.emit("data", Buffer.from("\n"));
+
+    await expect(resultPromise).resolves.toBeNull();
+  });
+
+  test("resolves null instead of hanging when input hits EOF (Ctrl-D)", async () => {
+    const input = new FakePromptInput();
+    const output = fakeOutput();
+
+    const resultPromise = promptProviderChoice({
+      input: input as unknown as NodeJS.ReadStream,
+      output: output as unknown as NodeJS.WriteStream,
+      choices,
+    });
+    input.emit("end");
+
+    await expect(resultPromise).resolves.toBeNull();
+  });
+
+  test("validates against a custom, shorter choice list", async () => {
+    const input = new FakePromptInput();
+    const output = fakeOutput();
+
+    const resultPromise = promptProviderChoice({
+      input: input as unknown as NodeJS.ReadStream,
+      output: output as unknown as NodeJS.WriteStream,
+      choices: ["anthropic", "openai"],
+    });
+    input.emit("data", Buffer.from("3\n"));
+    input.emit("data", Buffer.from("1\n"));
+
+    await expect(resultPromise).resolves.toBe("anthropic");
+    expect(output.text).toContain(
+      "Please enter a number between 1 and 2, or press Enter to skip.",
+    );
+  });
+});

package/src/__tests__/tunnel.test.ts

@@ -13,6 +13,7 @@ import * as childProcess from "node:child_process";
 import type { ChildProcess } from "node:child_process";
 import { EventEmitter } from "node:events";
 import {
+  appendFileSync,
   mkdirSync,
   mkdtempSync,
   readFileSync,
@@ -28,6 +29,7 @@ import * as cloudflareTunnel from "../lib/cloudflare-tunnel.js";
 import * as ngrok from "../lib/ngrok.js";
 import * as nginxIngress from "../lib/nginx-ingress.js";
 import * as tailscaleTunnel from "../lib/tailscale-tunnel.js";
+import { getLogDir } from "../lib/xdg-log.js";
 import type { AssistantEntry } from "../lib/assistant-config.js";
 
 const realCloudflareTunnel = { ...cloudflareTunnel };
@@ -214,7 +216,7 @@ async function runTunnelCapturingLogs(): Promise<string> {
 
 describe("tunnel edge targeting", () => {
   beforeEach(() => {
-    process.argv = ["bun", "vellum", "tunnel"];
+    process.argv = ["bun", "vellum", "tunnel", "--provider", "tailscale"];
     writeLockfile(makeLocalEntry());
     globalThis.fetch = (async () => {
       throw new Error("gateway unavailable");
@@ -647,42 +649,49 @@ describe("tunnel edge targeting", () => {
     expect(logs).toContain("serves webhooks only");
   });
 
-  test("a bare invocation defaults to the tailscale provider", async () => {
-    const entry = makeLocalEntry();
-    writeLockfile(entry);
+  test("a bare invocation exits listing the providers to choose from", async () => {
+    writeLockfile(makeLocalEntry());
     process.argv = ["bun", "vellum", "tunnel"];
 
-    await runTunnelCapturingLogs();
+    const { exited, errors } = await runTunnelExpectingExit1();
 
-    expect(runTailscaleTunnelMock).toHaveBeenCalledWith({
-      port: EDGE_PORT,
-      assistantId: "assistant-1",
-      workspaceDir: join(entry.resources!.instanceDir, ".vellum", "workspace"),
-    });
+    expect(exited).toBe(true);
+    expect(errors).toContain("--provider is required");
+    expect(errors).toContain("vellum tunnel --provider ngrok");
+    expect(errors).toContain("vellum tunnel --provider cloudflare");
+    expect(errors).toContain("vellum tunnel --provider tailscale");
+    // Nothing is started and nothing is recorded until the user has chosen.
+    expect(ensureTunnelEdgeMock).not.toHaveBeenCalled();
+    expect(runTailscaleTunnelMock).not.toHaveBeenCalled();
     expect(runNgrokTunnelMock).not.toHaveBeenCalled();
     expect(runCloudflareTunnelMock).not.toHaveBeenCalled();
   });
 
-  test("a bare invocation refuses tailscale when webhook integrations are configured", async () => {
-    const entry = makeLocalEntry();
-    writeLockfile(entry);
-    writeEntryWorkspaceConfig(entry, {
-      telegram: { botUsername: "example_bot" },
-    });
-    process.argv = ["bun", "vellum", "tunnel"];
+  test("a named assistant without --provider exits before resolving it", async () => {
+    writeLockfile(makeLocalEntry());
+    process.argv = ["bun", "vellum", "tunnel", "Ada"];
 
     const { exited, errors } = await runTunnelExpectingExit1();
 
     expect(exited).toBe(true);
-    expect(errors).toContain("reachable only from your own tailnet");
-    expect(errors).toContain("vellum tunnel --provider ngrok");
-    expect(errors).toContain("vellum tunnel --provider tailscale");
-    // Nothing is started and nothing is recorded until the user has chosen.
+    expect(errors).toContain("--provider is required");
+    // The suggestions keep the assistant that was asked for, so pasting one
+    // cannot tunnel the active assistant instead.
+    expect(errors).toContain("vellum tunnel Ada --provider ngrok");
+    expect(errors).toContain("vellum tunnel Ada --provider tailscale");
     expect(ensureTunnelEdgeMock).not.toHaveBeenCalled();
-    expect(runTailscaleTunnelMock).not.toHaveBeenCalled();
   });
 
-  test("an explicit --provider tailscale keeps the webhook callback base and says so", async () => {
+  test("a shell-sensitive assistant name is quoted in the suggestions", async () => {
+    writeLockfile(makeLocalEntry());
+    process.argv = ["bun", "vellum", "tunnel", "Bob&Alice"];
+
+    const { errors } = await runTunnelExpectingExit1();
+
+    expect(errors).toContain("vellum tunnel 'Bob&Alice' --provider ngrok");
+  });
+
+  test("--provider tailscale keeps the webhook callback base and says so", async () => {
     const entry = makeLocalEntry();
     writeLockfile(entry);
     const workspaceDir = writeEntryWorkspaceConfig(entry, {
@@ -1452,3 +1461,171 @@ describe("ngrok --domain spawn args", () => {
     expect(config.ingress.ngrok?.domain).toBe("foo.ngrok.app");
   });
 });
+
+describe("tunnel --detach", () => {
+  const originalXdgConfigHome = process.env.XDG_CONFIG_HOME;
+
+  function makeFakeChild(pid: number): ChildProcess {
+    const emitter = new EventEmitter();
+    return Object.assign(emitter, {
+      stdout: null,
+      stderr: null,
+      killed: false,
+      kill: () => true,
+      unref: () => {},
+      pid,
+    }) as unknown as ChildProcess;
+  }
+
+  const spawnMock = mock((..._args: unknown[]) => makeFakeChild(9999));
+
+  // spawnDetachedTunnel() scopes the log filename to its own (parent) pid,
+  // which in-process is this test runner's pid.
+  function detachedLogPath(): string {
+    return join(getLogDir(), `tunnel-${process.pid}.log`);
+  }
+
+  beforeAll(() => {
+    mock.module("node:child_process", () => ({
+      ...realChildProcess,
+      spawn: spawnMock,
+    }));
+  });
+
+  afterAll(() => {
+    mock.module("node:child_process", () => realChildProcess);
+  });
+
+  beforeEach(() => {
+    spawnMock.mockClear();
+    const configHome = mkdtempSync(join(tmpdir(), "vellum-tunnel-xdg-"));
+    tempDirs.push(configHome);
+    process.env.XDG_CONFIG_HOME = configHome;
+    writeLockfile(makeLocalEntry());
+  });
+
+  afterEach(() => {
+    if (originalXdgConfigHome === undefined) {
+      delete process.env.XDG_CONFIG_HOME;
+    } else {
+      process.env.XDG_CONFIG_HOME = originalXdgConfigHome;
+    }
+    for (const dir of tempDirs.splice(0)) {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  test("--detach re-invokes without the flag as a detached child and reports readiness", async () => {
+    process.argv = [
+      "bun",
+      "vellum",
+      "tunnel",
+      "--provider",
+      "ngrok",
+      "--detach",
+    ];
+
+    // Simulate the detached child writing its readiness line to the log file
+    // the moment it is spawned.
+    spawnMock.mockImplementationOnce(() => {
+      appendFileSync(
+        detachedLogPath(),
+        "Tunnel established: https://foo.ngrok.app\n",
+      );
+      return makeFakeChild(9999);
+    });
+
+    const logs = await runTunnelCapturingLogs();
+
+    expect(spawnMock).toHaveBeenCalledTimes(1);
+    const [, args, opts] = spawnMock.mock.calls[0] as unknown as [
+      string,
+      string[],
+      Record<string, unknown>,
+    ];
+    expect(args).toContain("tunnel");
+    expect(args).toContain("--provider");
+    expect(args).toContain("ngrok");
+    expect(args).not.toContain("--detach");
+    expect(args).not.toContain("-d");
+    expect(opts.detached).toBe(true);
+
+    expect(logs).toContain("Tunnel established: https://foo.ngrok.app");
+    expect(logs).toContain("Running in background (pid 9999)");
+    expect(logs).toContain("Stop with: kill 9999");
+
+    // The parent hands the actual tunnel workflow off to the child: it never
+    // runs the provider or edge setup itself.
+    expect(runNgrokTunnelMock).not.toHaveBeenCalled();
+    expect(ensureTunnelEdgeMock).not.toHaveBeenCalled();
+  });
+
+  test("-d is equivalent to --detach", async () => {
+    process.argv = ["bun", "vellum", "tunnel", "--provider", "tailscale", "-d"];
+    spawnMock.mockImplementationOnce(() => {
+      appendFileSync(
+        detachedLogPath(),
+        "Tunnel established: https://tailnet.example.ts.net\n",
+      );
+      return makeFakeChild(1234);
+    });
+
+    await runTunnelCapturingLogs();
+
+    const [, args] = spawnMock.mock.calls[0] as unknown as [string, string[]];
+    expect(args).not.toContain("-d");
+    expect(args).not.toContain("--detach");
+  });
+
+  test("reports an early child exit instead of hanging", async () => {
+    process.argv = [
+      "bun",
+      "vellum",
+      "tunnel",
+      "--provider",
+      "ngrok",
+      "--detach",
+    ];
+    spawnMock.mockImplementationOnce(() => {
+      const child = makeFakeChild(4242);
+      // Listeners attach synchronously right after spawn() returns; defer the
+      // exit so they're in place before it fires.
+      setTimeout(() => (child as unknown as EventEmitter).emit("exit", 1), 0);
+      return child;
+    });
+
+    const { exited, errors } = await runTunnelExpectingExit1();
+
+    expect(exited).toBe(true);
+    expect(errors).toContain("exited during startup (exit code 1)");
+    expect(runNgrokTunnelMock).not.toHaveBeenCalled();
+  });
+
+  test("an adopted ngrok tunnel gets an accurate stop message, not a false kill claim", async () => {
+    process.argv = [
+      "bun",
+      "vellum",
+      "tunnel",
+      "--provider",
+      "ngrok",
+      "--detach",
+    ];
+    spawnMock.mockImplementationOnce(() => {
+      appendFileSync(
+        detachedLogPath(),
+        "Found existing ngrok tunnel: https://already-up.ngrok.app\n",
+      );
+      return makeFakeChild(5555);
+    });
+
+    const logs = await runTunnelCapturingLogs();
+
+    expect(logs).toContain("Tunnel established: https://already-up.ngrok.app");
+    expect(logs).toContain("Running in background (pid 5555)");
+    // The supervisor did not spawn this ngrok agent, so killing it must not
+    // be advertised as the way to stop the tunnel.
+    expect(logs).not.toContain("Stop with: kill 5555");
+    expect(logs).toContain("only");
+    expect(logs).toContain("stops this supervisor, not the ngrok tunnel");
+  });
+});

package/src/__tests__/wake.test.ts

@@ -1192,8 +1192,10 @@ describe("vellum wake — tunnel edge restore", () => {
     expect(warnSpy).toHaveBeenCalledWith(
       expect.stringContaining("brew install nginx"),
     );
+    // No tunnel is recorded here, so no provider can be named and the advice
+    // points at the help that lists them.
     expect(warnSpy).toHaveBeenCalledWith(
-      expect.stringContaining("Run `vellum tunnel` to rebuild the edge."),
+      expect.stringContaining("Run `vellum tunnel --help` to rebuild the edge."),
     );
     expect(maybeStartNgrokTunnelMock).toHaveBeenCalledWith(
       7830,
@@ -1203,6 +1205,54 @@ describe("vellum wake — tunnel edge restore", () => {
     expect(logSpy).toHaveBeenCalledWith("Wake complete.");
   });
 
+  test("a failed rebuild names the provider that last tunneled here", async () => {
+    loadRawConfigMock.mockReturnValue({
+      ...webhookConfig,
+      ingress: {
+        lastTunnel: {
+          provider: "cloudflare",
+          publicBaseUrl: "https://assistant.example.com",
+        },
+      },
+    });
+    ensureTunnelEdgeMock.mockRejectedValue(new Error("edge rebuild failed"));
+
+    await wake();
+
+    expect(warnSpy).toHaveBeenCalledWith(
+      expect.stringContaining(
+        "Run `vellum tunnel local-assistant --provider cloudflare` to rebuild the edge.",
+      ),
+    );
+  });
+
+  test("a failed rebuild prefers the pairing tunnel over the public one beside it", async () => {
+    // A tailnet pairing tunnel leaves the older public record in place, so the
+    // advice has to name the tunnel actually in front of this assistant.
+    loadRawConfigMock.mockReturnValue({
+      ...webhookConfig,
+      ingress: {
+        lastTunnel: {
+          provider: "cloudflare",
+          publicBaseUrl: "https://assistant.example.com",
+        },
+        pairingTunnel: {
+          provider: "tailscale",
+          publicBaseUrl: "https://assistant.example.ts.net",
+        },
+      },
+    });
+    ensureTunnelEdgeMock.mockRejectedValue(new Error("edge rebuild failed"));
+
+    await wake();
+
+    expect(warnSpy).toHaveBeenCalledWith(
+      expect.stringContaining(
+        "Run `vellum tunnel local-assistant --provider tailscale` to rebuild the edge.",
+      ),
+    );
+  });
+
   test("a reused edge still points the tunnel at its listen port", async () => {
     loadRawConfigMock.mockReturnValue(enabledConfig);
     ensureTunnelEdgeMock.mockResolvedValue({

package/src/adapters/install.sh

@@ -133,7 +133,8 @@ ensure_bun() {
     fi
 
     info "Installing bun..."
-    curl -fsSL https://bun.sh/install | bash
+    # Pinned. Keep in sync with .tool-versions.
+    curl -fsSL https://bun.sh/install | bash -s "bun-v1.3.11"
     export BUN_INSTALL="$HOME/.bun"
     export PATH="$BUN_INSTALL/bin:$PATH"
 

package/src/adapters/openclaw.ts

@@ -87,7 +87,8 @@ if ! command -v bun >/dev/null 2>&1; then
     echo "Installing unzip (required by bun)..."
     apt-get install -y unzip
   fi
-  curl -fsSL https://bun.sh/install | bash
+  # Pinned. Keep in sync with .tool-versions.
+  curl -fsSL https://bun.sh/install | bash -s "bun-v1.3.11"
   export BUN_INSTALL="\$HOME/.bun"
   export PATH="\$BUN_INSTALL/bin:\$PATH"
   echo "bun version: $(bun --version)"