@vellumai/cli 0.8.5 → 0.8.7-dev.202606052118.34cd356

package/src/__tests__/unpair.test.ts

@@ -0,0 +1,163 @@
+/**
+ * Tests for `vellum unpair <name>`: forget a paired (cloud:"paired") assistant
+ * by removing its lockfile entry + guardian token. Refuses non-paired entries.
+ */
+import {
+  afterAll,
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  spyOn,
+  test,
+} from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const testDir = mkdtempSync(join(tmpdir(), "unpair-test-"));
+const ORIGINAL_LOCKFILE_DIR = process.env.VELLUM_LOCKFILE_DIR;
+const ORIGINAL_CONFIG_HOME = process.env.XDG_CONFIG_HOME;
+const ORIGINAL_ARGV = [...process.argv];
+
+import { unpair } from "../commands/unpair.js";
+import {
+  findAssistantByName,
+  saveAssistantEntry,
+} from "../lib/assistant-config.js";
+import {
+  deleteGuardianToken,
+  loadGuardianToken,
+  saveGuardianToken,
+} from "../lib/guardian-token.js";
+
+function seedToken(assistantId: string): void {
+  saveGuardianToken(assistantId, {
+    guardianPrincipalId: "imported",
+    accessToken: "acc",
+    accessTokenExpiresAt: Date.now() + 3_600_000,
+    refreshToken: "ref",
+    refreshTokenExpiresAt: Date.now() + 3_600_000,
+    refreshAfter: "",
+    isNew: false,
+    deviceId: "dev",
+    leasedAt: new Date().toISOString(),
+  });
+}
+
+/** Run unpair with console.error + process.exit spied. */
+async function runUnpair(): Promise<{ exited: boolean; errors: string }> {
+  const errors: string[] = [];
+  const logSpy = spyOn(console, "log").mockImplementation(() => {});
+  const errSpy = spyOn(console, "error").mockImplementation(
+    (...a: unknown[]) => {
+      errors.push(a.join(" "));
+    },
+  );
+  const exitSpy = spyOn(process, "exit").mockImplementation(((c?: number) => {
+    throw new Error(`exit:${c}`);
+  }) as never);
+  let exited = false;
+  try {
+    await unpair();
+  } catch (e) {
+    exited = (e as Error).message === "exit:1";
+  } finally {
+    logSpy.mockRestore();
+    errSpy.mockRestore();
+    exitSpy.mockRestore();
+  }
+  return { exited, errors: errors.join("\n") };
+}
+
+describe("vellum unpair", () => {
+  beforeEach(() => {
+    process.env.VELLUM_LOCKFILE_DIR = testDir;
+    process.env.XDG_CONFIG_HOME = testDir;
+  });
+
+  afterEach(() => {
+    process.argv = [...ORIGINAL_ARGV];
+    if (ORIGINAL_LOCKFILE_DIR === undefined)
+      delete process.env.VELLUM_LOCKFILE_DIR;
+    else process.env.VELLUM_LOCKFILE_DIR = ORIGINAL_LOCKFILE_DIR;
+    if (ORIGINAL_CONFIG_HOME === undefined) delete process.env.XDG_CONFIG_HOME;
+    else process.env.XDG_CONFIG_HOME = ORIGINAL_CONFIG_HOME;
+  });
+
+  afterAll(() => {
+    rmSync(testDir, { recursive: true, force: true });
+  });
+
+  test("removes a paired entry's lockfile entry and guardian token", async () => {
+    saveAssistantEntry({
+      assistantId: "px",
+      name: "Paired Box",
+      runtimeUrl: "http://10.0.0.9:7830",
+      cloud: "paired",
+      paired: true,
+      species: "vellum",
+    });
+    seedToken("px");
+    expect(findAssistantByName("px")).not.toBeNull();
+    expect(loadGuardianToken("px")).not.toBeNull();
+
+    // Non-interactive test env → use --yes to bypass the confirmation prompt.
+    process.argv = ["bun", "vellum", "unpair", "px", "--yes"];
+    const { exited } = await runUnpair();
+
+    expect(exited).toBe(false);
+    expect(findAssistantByName("px")).toBeNull();
+    expect(loadGuardianToken("px")).toBeNull();
+  });
+
+  test("refuses to unpair without --yes in a non-interactive terminal", async () => {
+    saveAssistantEntry({
+      assistantId: "py",
+      name: "Paired Two",
+      runtimeUrl: "http://10.0.0.9:7830",
+      cloud: "paired",
+      paired: true,
+      species: "vellum",
+    });
+    seedToken("py");
+
+    process.argv = ["bun", "vellum", "unpair", "py"]; // no --yes
+    const { exited, errors } = await runUnpair();
+
+    expect(exited).toBe(true);
+    expect(errors).toContain("--yes");
+    // Not removed — confirmation was required.
+    expect(findAssistantByName("py")).not.toBeNull();
+    expect(loadGuardianToken("py")).not.toBeNull();
+  });
+
+  test("refuses a non-paired (local) assistant and leaves it intact", async () => {
+    saveAssistantEntry({
+      assistantId: "desk",
+      name: "Desk",
+      runtimeUrl: "http://127.0.0.1:7830",
+      cloud: "local",
+      species: "vellum",
+    });
+
+    process.argv = ["bun", "vellum", "unpair", "desk"];
+    const { exited, errors } = await runUnpair();
+
+    expect(exited).toBe(true);
+    expect(errors).toContain("vellum retire");
+    expect(findAssistantByName("desk")).not.toBeNull(); // untouched
+  });
+
+  test("errors on an unknown name", async () => {
+    process.argv = ["bun", "vellum", "unpair", "nope"];
+    const { exited } = await runUnpair();
+    expect(exited).toBe(true);
+  });
+
+  test("deleteGuardianToken is a no-op when the token is absent", () => {
+    // No token seeded for this id; calling (twice) must not throw.
+    expect(() => deleteGuardianToken("ghost")).not.toThrow();
+    expect(() => deleteGuardianToken("ghost")).not.toThrow();
+  });
+});

package/src/__tests__/wake.test.ts

@@ -0,0 +1,215 @@
+import {
+  afterAll,
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  mock,
+  spyOn,
+  test,
+} from "bun:test";
+import { mkdirSync, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import * as assistantConfig from "../lib/assistant-config.js";
+import * as docker from "../lib/docker.js";
+import * as guardianToken from "../lib/guardian-token.js";
+import * as local from "../lib/local.js";
+import * as ngrok from "../lib/ngrok.js";
+import * as processLib from "../lib/process.js";
+import type { AssistantEntry } from "../lib/assistant-config.js";
+
+const realAssistantConfig = { ...assistantConfig };
+const realDocker = { ...docker };
+const realGuardianToken = { ...guardianToken };
+const realLocal = { ...local };
+const realNgrok = { ...ngrok };
+const realProcessLib = { ...processLib };
+
+const resolveTargetAssistantMock = mock<
+  typeof assistantConfig.resolveTargetAssistant
+>();
+const saveAssistantEntryMock = mock<typeof assistantConfig.saveAssistantEntry>(
+  () => {},
+);
+const getDaemonPidPathMock = mock<typeof assistantConfig.getDaemonPidPath>(
+  (resources) => join(resources!.instanceDir, ".vellum", "daemon.pid"),
+);
+
+mock.module("../lib/assistant-config.js", () => ({
+  ...realAssistantConfig,
+  resolveTargetAssistant: resolveTargetAssistantMock,
+  saveAssistantEntry: saveAssistantEntryMock,
+  getDaemonPidPath: getDaemonPidPathMock,
+}));
+
+const dockerResourceNamesMock = mock<typeof docker.dockerResourceNames>(
+  realDocker.dockerResourceNames,
+);
+const wakeContainersMock = mock<typeof docker.wakeContainers>(async () => {});
+
+mock.module("../lib/docker.js", () => ({
+  ...realDocker,
+  dockerResourceNames: dockerResourceNamesMock,
+  wakeContainers: wakeContainersMock,
+}));
+
+const seedGuardianTokenFromSiblingEnvMock = mock<
+  typeof guardianToken.seedGuardianTokenFromSiblingEnv
+>(() => false);
+
+mock.module("../lib/guardian-token.js", () => ({
+  ...realGuardianToken,
+  seedGuardianTokenFromSiblingEnv: seedGuardianTokenFromSiblingEnvMock,
+}));
+
+const resolveProcessStateMock = mock<typeof processLib.resolveProcessState>(
+  async (_pidFile, _port, label) => ({
+    status: "healthy",
+    pid: label === "Gateway" ? 456 : 123,
+  }),
+);
+const stopProcessByPidFileMock = mock<typeof processLib.stopProcessByPidFile>(
+  async () => true,
+);
+
+mock.module("../lib/process", () => ({
+  ...realProcessLib,
+  resolveProcessState: resolveProcessStateMock,
+  stopProcessByPidFile: stopProcessByPidFileMock,
+}));
+
+const generateLocalSigningKeyMock = mock<typeof local.generateLocalSigningKey>(
+  () => "generated-bootstrap-secret",
+);
+const isAssistantWatchModeAvailableMock = mock<
+  typeof local.isAssistantWatchModeAvailable
+>(() => false);
+const isGatewayWatchModeAvailableMock = mock<
+  typeof local.isGatewayWatchModeAvailable
+>(() => false);
+const startLocalDaemonMock = mock<typeof local.startLocalDaemon>(async () => {});
+const startGatewayMock = mock<typeof local.startGateway>(
+  async () => "http://127.0.0.1:7830",
+);
+
+mock.module("../lib/local", () => ({
+  ...realLocal,
+  generateLocalSigningKey: generateLocalSigningKeyMock,
+  isAssistantWatchModeAvailable: isAssistantWatchModeAvailableMock,
+  isGatewayWatchModeAvailable: isGatewayWatchModeAvailableMock,
+  startLocalDaemon: startLocalDaemonMock,
+  startGateway: startGatewayMock,
+}));
+
+const maybeStartNgrokTunnelMock = mock<typeof ngrok.maybeStartNgrokTunnel>(
+  async () => null,
+);
+
+mock.module("../lib/ngrok", () => ({
+  ...realNgrok,
+  maybeStartNgrokTunnel: maybeStartNgrokTunnelMock,
+}));
+
+const { wake } = await import("../commands/wake.js");
+
+let tempDir: string;
+let originalArgv: string[];
+let logSpy: ReturnType<typeof spyOn>;
+
+function makeLocalEntry(): AssistantEntry {
+  tempDir = mkdtempSync(join(tmpdir(), "vellum-wake-test-"));
+  mkdirSync(join(tempDir, ".vellum"), { recursive: true });
+  return {
+    assistantId: "local-assistant",
+    runtimeUrl: "http://127.0.0.1:7830",
+    cloud: "local",
+    resources: {
+      instanceDir: tempDir,
+      daemonPort: 7821,
+      gatewayPort: 7830,
+      qdrantPort: 6333,
+      cesPort: 7822,
+      signingKey: "existing-signing-key",
+    },
+  };
+}
+
+beforeEach(() => {
+  originalArgv = [...process.argv];
+  tempDir = "";
+  process.argv = ["bun", "vellum", "wake", "--watch", "local-assistant"];
+  logSpy = spyOn(console, "log").mockImplementation(() => {});
+
+  const entry = makeLocalEntry();
+  resolveTargetAssistantMock.mockReset();
+  resolveTargetAssistantMock.mockReturnValue(entry);
+  saveAssistantEntryMock.mockReset();
+  getDaemonPidPathMock.mockReset();
+  getDaemonPidPathMock.mockImplementation((resources) =>
+    join(resources!.instanceDir, ".vellum", "daemon.pid"),
+  );
+  resolveProcessStateMock.mockReset();
+  resolveProcessStateMock.mockImplementation(async (_pidFile, _port, label) => ({
+    status: "healthy",
+    pid: label === "Gateway" ? 456 : 123,
+  }));
+  stopProcessByPidFileMock.mockReset();
+  stopProcessByPidFileMock.mockResolvedValue(true);
+  generateLocalSigningKeyMock.mockReset();
+  generateLocalSigningKeyMock.mockReturnValue("generated-bootstrap-secret");
+  isAssistantWatchModeAvailableMock.mockReset();
+  isAssistantWatchModeAvailableMock.mockReturnValue(false);
+  isGatewayWatchModeAvailableMock.mockReset();
+  isGatewayWatchModeAvailableMock.mockReturnValue(false);
+  startLocalDaemonMock.mockReset();
+  startLocalDaemonMock.mockResolvedValue(undefined);
+  startGatewayMock.mockReset();
+  startGatewayMock.mockResolvedValue("http://127.0.0.1:7830");
+  seedGuardianTokenFromSiblingEnvMock.mockReset();
+  seedGuardianTokenFromSiblingEnvMock.mockReturnValue(false);
+  maybeStartNgrokTunnelMock.mockReset();
+  maybeStartNgrokTunnelMock.mockResolvedValue(null);
+});
+
+afterEach(() => {
+  process.argv = originalArgv;
+  logSpy.mockRestore();
+  if (tempDir) {
+    rmSync(tempDir, { recursive: true, force: true });
+  }
+});
+
+afterAll(() => {
+  mock.module("../lib/assistant-config.js", () => realAssistantConfig);
+  mock.module("../lib/docker.js", () => realDocker);
+  mock.module("../lib/guardian-token.js", () => realGuardianToken);
+  mock.module("../lib/process", () => realProcessLib);
+  mock.module("../lib/local", () => realLocal);
+  mock.module("../lib/ngrok", () => realNgrok);
+});
+
+describe("vellum wake", () => {
+  test("restarts a running gateway without watch mode when backfilling the bootstrap secret", async () => {
+    await wake();
+
+    expect(saveAssistantEntryMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        guardianBootstrapSecret: "generated-bootstrap-secret",
+      }),
+    );
+    expect(stopProcessByPidFileMock).toHaveBeenCalledWith(
+      join(tempDir, ".vellum", "gateway.pid"),
+      "gateway",
+    );
+    expect(startGatewayMock).toHaveBeenCalledWith(
+      false,
+      expect.objectContaining({ instanceDir: tempDir }),
+      {
+        signingKey: "existing-signing-key",
+        bootstrapSecret: "generated-bootstrap-secret",
+      },
+    );
+  });
+});

package/src/commands/backup.ts

@@ -93,6 +93,7 @@ export async function backup(): Promise<void> {
       const freshToken = await leaseGuardianToken(
         entry.runtimeUrl,
         entry.assistantId,
+        entry.guardianBootstrapSecret,
       );
       accessToken = freshToken.accessToken;
     } catch (err) {
@@ -129,6 +130,7 @@ export async function backup(): Promise<void> {
         const freshToken = await leaseGuardianToken(
           entry.runtimeUrl,
           entry.assistantId,
+          entry.guardianBootstrapSecret,
         );
         refreshedToken = freshToken.accessToken;
       } catch {