@vellumai/cli 0.8.11 → 0.8.12-dev.202606122337.5897832

package/src/__tests__/platform-releases.test.ts

@@ -0,0 +1,117 @@
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+
+import {
+  fetchReleases,
+  resolveImageRefsDetailed,
+} from "../lib/platform-releases.js";
+
+const originalFetch = globalThis.fetch;
+
+function mockFetchJson(body: unknown, status = 200) {
+  const fetchMock = mock(
+    async (_url: RequestInfo | URL, _init?: RequestInit) =>
+      new Response(JSON.stringify(body), { status }),
+  );
+  globalThis.fetch = fetchMock as unknown as typeof globalThis.fetch;
+  return fetchMock;
+}
+
+function mockFetchError() {
+  globalThis.fetch = mock(async () => {
+    throw new TypeError("fetch failed");
+  }) as unknown as typeof globalThis.fetch;
+}
+
+beforeEach(() => {
+  process.env.VELLUM_PLATFORM_URL = "https://platform.test";
+});
+
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+  delete process.env.VELLUM_PLATFORM_URL;
+});
+
+const RELEASE = {
+  version: "0.7.0",
+  assistant_image_ref: "gcr.io/vellum/assistant@sha256:aaa",
+  gateway_image_ref: "gcr.io/vellum/gateway@sha256:bbb",
+  credential_executor_image_ref: "gcr.io/vellum/ces@sha256:ccc",
+};
+
+describe("fetchReleases", () => {
+  test("defaults to stable=true and returns the list", async () => {
+    const fetchMock = mockFetchJson([RELEASE]);
+    const releases = await fetchReleases();
+    expect(releases).toEqual([RELEASE]);
+    const url = String(fetchMock.mock.calls[0][0]);
+    expect(url).toContain("/v1/releases/?stable=true");
+    expect(url).toContain("limit=100");
+  });
+
+  test("passes the channel param when given", async () => {
+    const fetchMock = mockFetchJson([RELEASE]);
+    await fetchReleases({ channel: "preview" });
+    const url = String(fetchMock.mock.calls[0][0]);
+    expect(url).toContain("/v1/releases/?channel=preview");
+    expect(url).toContain("limit=100");
+  });
+
+  test("uses the platformUrl override over the resolved default", async () => {
+    const fetchMock = mockFetchJson([RELEASE]);
+    await fetchReleases({ platformUrl: "https://other-platform.test" });
+    const url = String(fetchMock.mock.calls[0][0]);
+    expect(url).toContain("https://other-platform.test/v1/releases/");
+  });
+
+  test("returns null on non-OK response", async () => {
+    mockFetchJson({ detail: "nope" }, 500);
+    expect(await fetchReleases()).toBeNull();
+  });
+
+  test("returns null on network error", async () => {
+    mockFetchError();
+    expect(await fetchReleases()).toBeNull();
+  });
+});
+
+describe("resolveImageRefsDetailed", () => {
+  test("returns platform refs when the version is found", async () => {
+    mockFetchJson([RELEASE]);
+    const result = await resolveImageRefsDetailed("v0.7.0");
+    expect(result.status).toBe("platform");
+    if (result.status === "platform") {
+      expect(result.imageTags.assistant).toBe(RELEASE.assistant_image_ref);
+      expect(result.imageTags.gateway).toBe(RELEASE.gateway_image_ref);
+    }
+  });
+
+  test("falls back to DockerHub for a null credential-executor ref", async () => {
+    mockFetchJson([{ ...RELEASE, credential_executor_image_ref: null }]);
+    const result = await resolveImageRefsDetailed("0.7.0");
+    expect(result.status).toBe("platform");
+    if (result.status === "platform") {
+      expect(result.imageTags["credential-executor"]).toContain(":0.7.0");
+    }
+  });
+
+  test("returns version-not-found when the platform list lacks the version", async () => {
+    mockFetchJson([RELEASE]);
+    const result = await resolveImageRefsDetailed("v9.9.9");
+    expect(result.status).toBe("version-not-found");
+  });
+
+  test("returns dockerhub-fallback when the platform is unreachable", async () => {
+    mockFetchError();
+    const result = await resolveImageRefsDetailed("v0.7.0");
+    expect(result.status).toBe("dockerhub-fallback");
+    if (result.status === "dockerhub-fallback") {
+      expect(result.imageTags.assistant).toContain(":v0.7.0");
+    }
+  });
+
+  test("returns dockerhub-fallback when required refs are missing", async () => {
+    mockFetchJson([{ ...RELEASE, assistant_image_ref: null }]);
+    const result = await resolveImageRefsDetailed("0.7.0");
+    expect(result.status).toBe("dockerhub-fallback");
+  });
+});

package/src/__tests__/upgrade-preflight.test.ts

@@ -0,0 +1,203 @@
+import { describe, expect, test } from "bun:test";
+
+import {
+  evaluateUpgradePoll,
+  resolveUpgradeTarget,
+} from "../lib/upgrade-preflight.js";
+
+const RELEASES = [
+  { version: "0.8.0", is_stable: false },
+  { version: "0.7.0" },
+  { version: "0.6.0" },
+];
+
+describe("resolveUpgradeTarget", () => {
+  test("explicit version present in releases resolves ok", () => {
+    const result = resolveUpgradeTarget({
+      explicitVersion: "v0.7.0",
+      releases: RELEASES,
+      currentVersion: "0.6.0",
+    });
+    expect(result.kind).toBe("ok");
+    expect(result.target).toBe("v0.7.0");
+    expect(result.isNoOp).toBe(false);
+    expect(result.isDowngrade).toBe(false);
+  });
+
+  test("explicit version absent from releases is version-not-found", () => {
+    const result = resolveUpgradeTarget({
+      explicitVersion: "v9.9.9",
+      releases: RELEASES,
+      currentVersion: "0.6.0",
+    });
+    expect(result.kind).toBe("version-not-found");
+    expect(result.target).toBeNull();
+  });
+
+  test("explicit version is trusted when releases are unavailable", () => {
+    const result = resolveUpgradeTarget({
+      explicitVersion: "v0.7.0",
+      releases: null,
+      currentVersion: "0.6.0",
+    });
+    expect(result.kind).toBe("ok");
+    expect(result.target).toBe("v0.7.0");
+  });
+
+  test("default target skips non-stable heads", () => {
+    const result = resolveUpgradeTarget({
+      explicitVersion: null,
+      releases: RELEASES,
+      currentVersion: "0.6.0",
+    });
+    expect(result.kind).toBe("ok");
+    expect(result.target).toBe("0.7.0");
+  });
+
+  test("default target falls back to first release when none are stable", () => {
+    const result = resolveUpgradeTarget({
+      explicitVersion: null,
+      releases: [{ version: "0.8.0", is_stable: false }],
+      currentVersion: "0.6.0",
+    });
+    expect(result.target).toBe("0.8.0");
+  });
+
+  test("no explicit version with unreachable releases is no-releases", () => {
+    const result = resolveUpgradeTarget({
+      explicitVersion: null,
+      releases: null,
+      currentVersion: "0.6.0",
+    });
+    expect(result.kind).toBe("no-releases");
+    expect(result.target).toBeNull();
+  });
+
+  test("no explicit version with empty releases is no-releases", () => {
+    const result = resolveUpgradeTarget({
+      explicitVersion: null,
+      releases: [],
+      currentVersion: "0.6.0",
+    });
+    expect(result.kind).toBe("no-releases");
+  });
+
+  test("detects no-op across v prefix", () => {
+    const result = resolveUpgradeTarget({
+      explicitVersion: "v0.7.0",
+      releases: RELEASES,
+      currentVersion: "0.7.0",
+    });
+    expect(result.isNoOp).toBe(true);
+    expect(result.isDowngrade).toBe(false);
+  });
+
+  test("detects downgrade", () => {
+    const result = resolveUpgradeTarget({
+      explicitVersion: "v0.6.0",
+      releases: RELEASES,
+      currentVersion: "0.7.0",
+    });
+    expect(result.isDowngrade).toBe(true);
+    expect(result.isNoOp).toBe(false);
+  });
+
+  test("unknown current version yields no flags", () => {
+    const result = resolveUpgradeTarget({
+      explicitVersion: "v0.7.0",
+      releases: RELEASES,
+      currentVersion: undefined,
+    });
+    expect(result.comparison).toBeNull();
+    expect(result.isNoOp).toBe(false);
+    expect(result.isDowngrade).toBe(false);
+  });
+});
+
+describe("evaluateUpgradePoll", () => {
+  test("known target completes on version match", () => {
+    expect(
+      evaluateUpgradePoll({
+        targetVersion: "v0.7.0",
+        initialVersion: "0.6.0",
+        observedVersion: "0.7.0",
+        inProgress: null,
+        sawInProgress: false,
+      }),
+    ).toBe("complete");
+  });
+
+  test("known target pends until the version matches", () => {
+    expect(
+      evaluateUpgradePoll({
+        targetVersion: "0.7.0",
+        initialVersion: "0.6.0",
+        observedVersion: "0.6.0",
+        inProgress: false,
+        sawInProgress: false,
+      }),
+    ).toBe("pending");
+  });
+
+  test("unknown target completes when the in-progress lock releases", () => {
+    expect(
+      evaluateUpgradePoll({
+        targetVersion: null,
+        initialVersion: "0.6.0",
+        observedVersion: "0.6.0",
+        inProgress: false,
+        sawInProgress: true,
+      }),
+    ).toBe("complete");
+  });
+
+  test("unknown target pends while the lock was never observed", () => {
+    expect(
+      evaluateUpgradePoll({
+        targetVersion: null,
+        initialVersion: "0.6.0",
+        observedVersion: "0.6.0",
+        inProgress: false,
+        sawInProgress: false,
+      }),
+    ).toBe("pending");
+  });
+
+  test("unknown target without upgrade-status completes on version change", () => {
+    expect(
+      evaluateUpgradePoll({
+        targetVersion: null,
+        initialVersion: "0.6.0",
+        observedVersion: "0.7.0",
+        inProgress: null,
+        sawInProgress: false,
+      }),
+    ).toBe("complete");
+  });
+
+  test("unknown target completes on version change even when the lock was never observed", () => {
+    // Upgrade finished before the first poll: in_progress already false,
+    // sawInProgress never set — the version change alone must complete.
+    expect(
+      evaluateUpgradePoll({
+        targetVersion: null,
+        initialVersion: "0.6.0",
+        observedVersion: "0.7.0",
+        inProgress: false,
+        sawInProgress: false,
+      }),
+    ).toBe("complete");
+  });
+
+  test("unknown target without upgrade-status pends while the version is unchanged", () => {
+    expect(
+      evaluateUpgradePoll({
+        targetVersion: null,
+        initialVersion: "0.6.0",
+        observedVersion: "v0.6.0",
+        inProgress: null,
+        sawInProgress: false,
+      }),
+    ).toBe("pending");
+  });
+});

package/src/__tests__/version-compat.test.ts

@@ -4,6 +4,8 @@ import {
   parseVersion,
   compareVersions,
   isVersionCompatible,
+  stripVersionPrefix,
+  versionsEqual,
 } from "../lib/version-compat.js";
 
 describe("parseVersion", () => {
@@ -204,3 +206,32 @@ describe("isVersionCompatible", () => {
     expect(isVersionCompatible("bad", "1.0.0")).toBe(false);
   });
 });
+
+describe("stripVersionPrefix", () => {
+  test("strips v prefix", () => {
+    expect(stripVersionPrefix("v0.7.0")).toBe("0.7.0");
+  });
+
+  test("strips V prefix", () => {
+    expect(stripVersionPrefix("V0.7.0")).toBe("0.7.0");
+  });
+
+  test("leaves unprefixed versions unchanged", () => {
+    expect(stripVersionPrefix("0.7.0")).toBe("0.7.0");
+  });
+});
+
+describe("versionsEqual", () => {
+  test("equal across v prefix", () => {
+    expect(versionsEqual("v0.7.0", "0.7.0")).toBe(true);
+  });
+
+  test("different versions are not equal", () => {
+    expect(versionsEqual("0.7.0", "0.7.1")).toBe(false);
+  });
+
+  test("unparseable falls back to prefix-stripped string equality", () => {
+    expect(versionsEqual("vweird-build", "weird-build")).toBe(true);
+    expect(versionsEqual("weird-build", "other-build")).toBe(false);
+  });
+});

package/src/__tests__/wake.test.ts

@@ -272,12 +272,23 @@ describe("vellum wake", () => {
     expect(leaseGuardianTokenMock).not.toHaveBeenCalled();
   });
 
-  test("skips re-provision when a guardian token already exists", async () => {
+  test("re-provisions even when a guardian token already exists", async () => {
+    // A connect can 401 off a token whose local state looks healthy
+    // (revoked, mis-seeded, wrong principal). The user explicitly confirmed
+    // the destructive repair, so the flag forces a re-lease instead of
+    // guessing from local token state and recreating the no-op loop.
     process.argv = ["bun", "vellum", "wake", "--repair-guardian", "local-assistant"];
-    // loadGuardianToken returns a token by default — recovery must not run.
+    // loadGuardianToken returns a healthy-looking token by default.
     await wake();
 
-    expect(resetGuardianBootstrapMock).not.toHaveBeenCalled();
-    expect(leaseGuardianTokenMock).not.toHaveBeenCalled();
+    expect(resetGuardianBootstrapMock).toHaveBeenCalledWith(
+      "http://127.0.0.1:7830",
+      "generated-bootstrap-secret",
+    );
+    expect(leaseGuardianTokenMock).toHaveBeenCalledWith(
+      "http://127.0.0.1:7830",
+      "local-assistant",
+      "generated-bootstrap-secret",
+    );
   });
 });

package/src/__tests__/workos-pkce.test.ts

@@ -0,0 +1,314 @@
+import { afterEach, describe, expect, mock, test } from "bun:test";
+
+import {
+  buildAuthorizeUrl,
+  exchangeAccessTokenForSession,
+  exchangeCodeWithWorkos,
+  fetchWorkosClientId,
+  generatePkcePair,
+  selectWorkosClientId,
+} from "../lib/workos-pkce.js";
+
+const originalFetch = globalThis.fetch;
+
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+});
+
+/**
+ * Route fetch responses by URL substring so each WorkOS/platform call can be
+ * inspected. The module talks to remote hosts via loopbackSafeFetch, which
+ * delegates to globalThis.fetch.
+ */
+function mockFetchByUrl(responses: Record<string, () => Response>) {
+  const calls: Array<{ url: string; init?: RequestInit }> = [];
+  globalThis.fetch = mock(
+    async (input: RequestInfo | URL, init?: RequestInit) => {
+      const url = String(input);
+      calls.push({ url, init });
+      const match = Object.entries(responses).find(([prefix]) =>
+        url.includes(prefix),
+      );
+      if (!match) throw new Error(`Unexpected fetch: ${url}`);
+      return match[1]();
+    },
+  ) as unknown as typeof globalThis.fetch;
+  return calls;
+}
+
+describe("generatePkcePair", () => {
+  test("challenge is the base64url sha256 of the verifier", async () => {
+    const { verifier, challenge } = generatePkcePair();
+    const digest = await crypto.subtle.digest(
+      "SHA-256",
+      new TextEncoder().encode(verifier),
+    );
+    const expected = Buffer.from(digest).toString("base64url");
+    expect(challenge).toBe(expected);
+  });
+
+  test("verifiers are unique", () => {
+    expect(generatePkcePair().verifier).not.toBe(generatePkcePair().verifier);
+  });
+});
+
+describe("buildAuthorizeUrl", () => {
+  const base = {
+    clientId: "client_123",
+    redirectUri: "http://127.0.0.1:4242/auth/callback",
+    challenge: "chal",
+    state: "st",
+  };
+
+  test("targets user_management/authorize with PKCE and authkit defaults", () => {
+    const url = new URL(buildAuthorizeUrl(base));
+    expect(url.origin).toBe("https://api.workos.com");
+    expect(url.pathname).toBe("/user_management/authorize");
+    expect(url.searchParams.get("client_id")).toBe("client_123");
+    expect(url.searchParams.get("redirect_uri")).toBe(base.redirectUri);
+    expect(url.searchParams.get("response_type")).toBe("code");
+    expect(url.searchParams.get("scope")).toBe("openid profile email");
+    expect(url.searchParams.get("code_challenge")).toBe("chal");
+    expect(url.searchParams.get("code_challenge_method")).toBe("S256");
+    expect(url.searchParams.get("state")).toBe("st");
+    expect(url.searchParams.get("provider")).toBe("authkit");
+    // Session reuse: never force a fresh IdP login.
+    expect(url.searchParams.has("prompt")).toBe(false);
+  });
+
+  test("provider hint replaces authkit", () => {
+    const url = new URL(
+      buildAuthorizeUrl({ ...base, providerHint: "GoogleOAuth" }),
+    );
+    expect(url.searchParams.get("provider")).toBe("GoogleOAuth");
+  });
+
+  test("login hint is forwarded", () => {
+    // generic-examples:ignore-next-line — reason: test fixture for URL encoding, not a real email
+    const url = new URL(buildAuthorizeUrl({ ...base, loginHint: "a@b.co" }));
+    // generic-examples:ignore-next-line — reason: test fixture for URL encoding, not a real email
+    expect(url.searchParams.get("login_hint")).toBe("a@b.co");
+
+    const noHint = new URL(buildAuthorizeUrl(base));
+    expect(noHint.searchParams.has("login_hint")).toBe(false);
+  });
+});
+
+describe("selectWorkosClientId", () => {
+  // During coexistence the platform lists two providers that share the
+  // "workos-oidc" id; only the OAuth2 one (no discovery URL) is usable.
+  const legacy = {
+    id: "workos-oidc",
+    name: "WorkOS OIDC",
+    client_id: "client_connect",
+    flows: ["provider_redirect", "provider_token"],
+    openid_configuration_url:
+      "https://x.authkit.app/.well-known/openid-configuration",
+  };
+  const modern = {
+    id: "workos-oidc",
+    name: "WorkOS",
+    client_id: "client_um",
+    flows: ["provider_redirect", "provider_token"],
+  };
+
+  test("picks the OAuth2 entry during coexistence", () => {
+    expect(selectWorkosClientId([legacy, modern])).toBe("client_um");
+    expect(selectWorkosClientId([modern, legacy])).toBe("client_um");
+  });
+
+  test("returns null when the platform lacks token auth", () => {
+    const preTokenAuth = { ...modern, flows: ["provider_redirect"] };
+    expect(selectWorkosClientId([legacy, preTokenAuth])).toBeNull();
+    expect(selectWorkosClientId([])).toBeNull();
+  });
+
+  test("ignores an entry missing client_id", () => {
+    const noClientId = { id: "workos-oidc", flows: ["provider_token"] };
+    expect(selectWorkosClientId([noClientId])).toBeNull();
+  });
+});
+
+describe("fetchWorkosClientId", () => {
+  test("resolves the client id from the headless config", async () => {
+    const calls = mockFetchByUrl({
+      "/_allauth/app/v1/config": () =>
+        new Response(
+          JSON.stringify({
+            data: {
+              socialaccount: {
+                providers: [
+                  {
+                    id: "workos-oidc",
+                    client_id: "client_um",
+                    flows: ["provider_token"],
+                  },
+                ],
+              },
+            },
+          }),
+          { status: 200 },
+        ),
+    });
+
+    expect(await fetchWorkosClientId("https://platform.example")).toBe(
+      "client_um",
+    );
+    expect(calls[0]!.url).toBe(
+      "https://platform.example/_allauth/app/v1/config",
+    );
+  });
+
+  test("derives the config URL from the origin, ignoring any path", async () => {
+    const calls = mockFetchByUrl({
+      "/_allauth/app/v1/config": () =>
+        new Response(
+          JSON.stringify({
+            data: {
+              socialaccount: {
+                providers: [
+                  { client_id: "client_um", flows: ["provider_token"] },
+                ],
+              },
+            },
+          }),
+          { status: 200 },
+        ),
+    });
+
+    await fetchWorkosClientId("https://platform.example/some/path");
+    expect(calls[0]!.url).toBe(
+      "https://platform.example/_allauth/app/v1/config",
+    );
+  });
+
+  test("throws a clear error when no token-auth provider is advertised", async () => {
+    mockFetchByUrl({
+      "/_allauth/app/v1/config": () =>
+        new Response(
+          JSON.stringify({ data: { socialaccount: { providers: [] } } }),
+          { status: 200 },
+        ),
+    });
+
+    await expect(
+      fetchWorkosClientId("https://platform.example"),
+    ).rejects.toThrow(/does not advertise/);
+  });
+
+  test("throws on a non-OK config response", async () => {
+    mockFetchByUrl({
+      "/_allauth/app/v1/config": () => new Response("nope", { status: 500 }),
+    });
+
+    await expect(
+      fetchWorkosClientId("https://platform.example"),
+    ).rejects.toThrow(/500/);
+  });
+});
+
+describe("exchangeCodeWithWorkos", () => {
+  test("posts a public-client PKCE exchange and returns the access token", async () => {
+    const calls = mockFetchByUrl({
+      "/user_management/authenticate": () =>
+        new Response(JSON.stringify({ access_token: "at_1", user: {} }), {
+          status: 200,
+        }),
+    });
+
+    const token = await exchangeCodeWithWorkos({
+      clientId: "client_um",
+      code: "c",
+      verifier: "v",
+    });
+
+    expect(token).toBe("at_1");
+    expect(calls[0]!.url).toBe(
+      "https://api.workos.com/user_management/authenticate",
+    );
+    const body = JSON.parse(String(calls[0]!.init?.body));
+    // Public client: no secret, no API key.
+    expect(body).toEqual({
+      client_id: "client_um",
+      grant_type: "authorization_code",
+      code: "c",
+      code_verifier: "v",
+    });
+  });
+
+  test("throws with upstream detail on failure", async () => {
+    mockFetchByUrl({
+      "/user_management/authenticate": () =>
+        new Response(JSON.stringify({ error: "invalid_grant" }), {
+          status: 400,
+        }),
+    });
+
+    await expect(
+      exchangeCodeWithWorkos({ clientId: "c", code: "x", verifier: "v" }),
+    ).rejects.toThrow(/400/);
+  });
+
+  test("throws when the exchange returns no access token", async () => {
+    mockFetchByUrl({
+      "/user_management/authenticate": () =>
+        new Response(JSON.stringify({}), { status: 200 }),
+    });
+
+    await expect(
+      exchangeCodeWithWorkos({ clientId: "c", code: "x", verifier: "v" }),
+    ).rejects.toThrow(/no access token/);
+  });
+});
+
+describe("exchangeAccessTokenForSession", () => {
+  test("posts the headless token payload and returns the session token", async () => {
+    const calls = mockFetchByUrl({
+      "/_allauth/app/v1/auth/provider/token": () =>
+        new Response(JSON.stringify({ meta: { session_token: "sess_1" } }), {
+          status: 200,
+        }),
+    });
+
+    const token = await exchangeAccessTokenForSession(
+      "https://platform.example",
+      "client_um",
+      "at_1",
+    );
+
+    expect(token).toBe("sess_1");
+    expect(calls[0]!.url).toBe(
+      "https://platform.example/_allauth/app/v1/auth/provider/token",
+    );
+    const body = JSON.parse(String(calls[0]!.init?.body));
+    expect(body).toEqual({
+      provider: "workos",
+      process: "login",
+      token: { client_id: "client_um", access_token: "at_1" },
+    });
+  });
+
+  test("throws on a rejected token", async () => {
+    mockFetchByUrl({
+      "/_allauth/app/v1/auth/provider/token": () =>
+        new Response(JSON.stringify({ errors: [{ code: "invalid_token" }] }), {
+          status: 400,
+        }),
+    });
+
+    await expect(
+      exchangeAccessTokenForSession("https://platform.example", "c", "bad"),
+    ).rejects.toThrow(/400/);
+  });
+
+  test("throws when the session exchange returns no session token", async () => {
+    mockFetchByUrl({
+      "/_allauth/app/v1/auth/provider/token": () =>
+        new Response(JSON.stringify({ meta: {} }), { status: 200 }),
+    });
+
+    await expect(
+      exchangeAccessTokenForSession("https://platform.example", "c", "at"),
+    ).rejects.toThrow(/no session token/);
+  });
+});