@vellumai/cli 0.8.7 → 0.8.8-dev.202606060043.60454ad

package/src/__tests__/cloudflare-tunnel.test.ts

@@ -0,0 +1,137 @@
+import { describe, expect, test } from "bun:test";
+import { EventEmitter } from "node:events";
+import type { ChildProcess } from "node:child_process";
+
+import { waitForCloudflareTunnelUrl } from "../lib/cloudflare-tunnel.js";
+
+// ── Helpers ───────────────────────────────────────────────────────────────────
+
+/**
+ * Build a minimal fake ChildProcess whose stdout and stderr are plain
+ * EventEmitters. Tests control what data is emitted and when.
+ */
+function makeChild(): {
+  child: ChildProcess;
+  stdout: EventEmitter;
+  stderr: EventEmitter;
+  emitExit: (code: number | null) => void;
+} {
+  const stdout = new EventEmitter();
+  const stderr = new EventEmitter();
+  const childEmitter = new EventEmitter();
+
+  const child = Object.assign(childEmitter, {
+    stdout,
+    stderr,
+    killed: false,
+    kill: () => false,
+    pid: 99999,
+  }) as unknown as ChildProcess;
+
+  const emitExit = (code: number | null) => childEmitter.emit("exit", code);
+
+  return { child, stdout, stderr, emitExit };
+}
+
+// ── Tests ─────────────────────────────────────────────────────────────────────
+
+describe("waitForCloudflareTunnelUrl", () => {
+  test("resolves when the URL appears on stderr", async () => {
+    const { child, stderr } = makeChild();
+    const promise = waitForCloudflareTunnelUrl(child);
+
+    stderr.emit(
+      "data",
+      Buffer.from(
+        "2024-01-01T00:00:00Z INF |  https://quick-slug-test.trycloudflare.com  |\n",
+      ),
+    );
+
+    await expect(promise).resolves.toBe(
+      "https://quick-slug-test.trycloudflare.com",
+    );
+  });
+
+  test("resolves when the URL appears on stdout", async () => {
+    const { child, stdout } = makeChild();
+    const promise = waitForCloudflareTunnelUrl(child);
+
+    stdout.emit(
+      "data",
+      Buffer.from("https://another-slug.trycloudflare.com\n"),
+    );
+
+    await expect(promise).resolves.toBe(
+      "https://another-slug.trycloudflare.com",
+    );
+  });
+
+  test("resolves with the first URL when multiple lines contain one", async () => {
+    const { child, stderr } = makeChild();
+    const promise = waitForCloudflareTunnelUrl(child);
+
+    stderr.emit(
+      "data",
+      Buffer.from(
+        "INFO https://first-slug.trycloudflare.com\nINFO https://second-slug.trycloudflare.com\n",
+      ),
+    );
+
+    await expect(promise).resolves.toBe("https://first-slug.trycloudflare.com");
+  });
+
+  test("handles a URL split across two data chunks", async () => {
+    const { child, stderr } = makeChild();
+    const promise = waitForCloudflareTunnelUrl(child);
+
+    // First chunk ends mid-line before the URL
+    stderr.emit("data", Buffer.from("INFO Visit: "));
+    // Second chunk completes the line
+    stderr.emit(
+      "data",
+      Buffer.from("https://chunked-slug.trycloudflare.com\n"),
+    );
+
+    await expect(promise).resolves.toBe(
+      "https://chunked-slug.trycloudflare.com",
+    );
+  });
+
+  test("rejects when the process exits before a URL is found", async () => {
+    const { child, emitExit } = makeChild();
+    const promise = waitForCloudflareTunnelUrl(child);
+
+    emitExit(1);
+
+    await expect(promise).rejects.toThrow("exited with code 1");
+  });
+
+  test("rejects on null exit code (killed by signal)", async () => {
+    const { child, emitExit } = makeChild();
+    const promise = waitForCloudflareTunnelUrl(child);
+
+    emitExit(null);
+
+    await expect(promise).rejects.toThrow("exited with code unknown");
+  });
+
+  test("rejects after the timeout when no URL appears", async () => {
+    const { child } = makeChild();
+    // Use a very short timeout so the test runs fast
+    const promise = waitForCloudflareTunnelUrl(child, 50);
+
+    await expect(promise).rejects.toThrow("did not appear within");
+  });
+
+  test("does not resolve for non-trycloudflare.com hostnames", async () => {
+    const { child, stderr, emitExit } = makeChild();
+    const promise = waitForCloudflareTunnelUrl(child, 50);
+
+    // Emit a line with a URL that is not a Cloudflare quick-tunnel URL
+    stderr.emit("data", Buffer.from("Connecting to https://example.com/api\n"));
+
+    // Should still time out — the fake URL does not match the pattern
+    emitExit(null);
+    await expect(promise).rejects.toThrow();
+  });
+});

package/src/__tests__/connect-import.test.ts

@@ -0,0 +1,317 @@
+/**
+ * Tests for `vellum connect import <blob>`: decode a `vellum pair` bundle and
+ * persist a lockfile entry + guardian token under a unique local id.
+ */
+import {
+  afterAll,
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  spyOn,
+  test,
+} from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const testDir = mkdtempSync(join(tmpdir(), "connect-import-test-"));
+const ORIGINAL_LOCKFILE_DIR = process.env.VELLUM_LOCKFILE_DIR;
+const ORIGINAL_CONFIG_HOME = process.env.XDG_CONFIG_HOME;
+const ORIGINAL_ARGV = [...process.argv];
+
+import { connectImport } from "../commands/connect/import.js";
+import {
+  findAssistantByName,
+  saveAssistantEntry,
+} from "../lib/assistant-config.js";
+import { loadGuardianToken } from "../lib/guardian-token.js";
+
+function bundleFor(overrides: Record<string, unknown> = {}): string {
+  const obj = {
+    gatewayUrl: "http://10.0.0.5:7830",
+    assistantId: "self",
+    token: "test-token",
+    deviceId: "dev-aaa",
+    ...overrides,
+  };
+  return Buffer.from(JSON.stringify(obj)).toString("base64");
+}
+
+describe("connect import", () => {
+  beforeEach(() => {
+    process.env.VELLUM_LOCKFILE_DIR = testDir;
+    process.env.XDG_CONFIG_HOME = testDir;
+  });
+
+  afterEach(() => {
+    process.argv = [...ORIGINAL_ARGV];
+    if (ORIGINAL_LOCKFILE_DIR === undefined)
+      delete process.env.VELLUM_LOCKFILE_DIR;
+    else process.env.VELLUM_LOCKFILE_DIR = ORIGINAL_LOCKFILE_DIR;
+    if (ORIGINAL_CONFIG_HOME === undefined) delete process.env.XDG_CONFIG_HOME;
+    else process.env.XDG_CONFIG_HOME = ORIGINAL_CONFIG_HOME;
+  });
+
+  afterAll(() => {
+    rmSync(testDir, { recursive: true, force: true });
+  });
+
+  test("writes a lockfile entry + guardian token from a valid bundle", async () => {
+    process.argv = ["bun", "vellum", "connect", "import", bundleFor()];
+    const logSpy = spyOn(console, "log").mockImplementation(() => {});
+    try {
+      await connectImport();
+    } finally {
+      logSpy.mockRestore();
+    }
+
+    const entry = findAssistantByName("paired-dev-aaa");
+    expect(entry).not.toBeNull();
+    expect(entry!.runtimeUrl).toBe("http://10.0.0.5:7830");
+    expect(entry!.cloud).toBe("paired");
+    expect(loadGuardianToken("paired-dev-aaa")?.accessToken).toBe("test-token");
+    // Back-compat: a bundle without refresh fields imports access-only.
+    expect(loadGuardianToken("paired-dev-aaa")?.refreshToken).toBe("");
+  });
+
+  test("persists the refresh credential when the bundle carries one", async () => {
+    process.argv = [
+      "bun",
+      "vellum",
+      "connect",
+      "import",
+      bundleFor({
+        deviceId: "dev-refresh",
+        token: "acc-tok",
+        refreshToken: "refresh-tok",
+        refreshTokenExpiresAt: "2027-01-01T00:00:00.000Z",
+        refreshAfter: "2026-07-01T00:00:00.000Z",
+      }),
+    ];
+    const logSpy = spyOn(console, "log").mockImplementation(() => {});
+    try {
+      await connectImport();
+    } finally {
+      logSpy.mockRestore();
+    }
+
+    const tok = loadGuardianToken("paired-dev-refresh");
+    expect(tok?.accessToken).toBe("acc-tok");
+    expect(tok?.refreshToken).toBe("refresh-tok");
+    expect(tok?.refreshTokenExpiresAt).toBe("2027-01-01T00:00:00.000Z");
+    expect(tok?.refreshAfter).toBe("2026-07-01T00:00:00.000Z");
+  });
+
+  test("preserves a numeric (epoch-ms) refreshTokenExpiresAt", async () => {
+    // GuardianTokenData allows refreshTokenExpiresAt to be an epoch-ms number;
+    // a numeric value in the bundle must round-trip, not be dropped to 0.
+    const expiresMs = 1893456000000; // 2030-01-01
+    process.argv = [
+      "bun",
+      "vellum",
+      "connect",
+      "import",
+      bundleFor({
+        deviceId: "dev-num",
+        refreshToken: "refresh-tok",
+        refreshTokenExpiresAt: expiresMs,
+      }),
+    ];
+    const logSpy = spyOn(console, "log").mockImplementation(() => {});
+    try {
+      await connectImport();
+    } finally {
+      logSpy.mockRestore();
+    }
+
+    expect(loadGuardianToken("paired-dev-num")?.refreshTokenExpiresAt).toBe(
+      expiresMs,
+    );
+  });
+
+  test("two different bundles (both assistantId 'self') do not collide", async () => {
+    process.argv = [
+      "bun",
+      "vellum",
+      "connect",
+      "import",
+      bundleFor({ deviceId: "dev-one", token: "tok1" }),
+    ];
+    const logSpy = spyOn(console, "log").mockImplementation(() => {});
+    try {
+      await connectImport();
+      process.argv = [
+        "bun",
+        "vellum",
+        "connect",
+        "import",
+        bundleFor({ deviceId: "dev-two", token: "tok2" }),
+      ];
+      await connectImport();
+    } finally {
+      logSpy.mockRestore();
+    }
+
+    expect(findAssistantByName("paired-dev-one")).not.toBeNull();
+    expect(findAssistantByName("paired-dev-two")).not.toBeNull();
+    expect(loadGuardianToken("paired-dev-one")?.accessToken).toBe("tok1");
+    expect(loadGuardianToken("paired-dev-two")?.accessToken).toBe("tok2");
+  });
+
+  test("--name registers the entry under that name", async () => {
+    process.argv = [
+      "bun",
+      "vellum",
+      "connect",
+      "import",
+      bundleFor({ deviceId: "dev-named" }),
+      "--name",
+      "Desk Box",
+    ];
+    const logSpy = spyOn(console, "log").mockImplementation(() => {});
+    try {
+      await connectImport();
+    } finally {
+      logSpy.mockRestore();
+    }
+    // Slugified to a stable id.
+    expect(findAssistantByName("desk-box")).not.toBeNull();
+  });
+
+  test("sanitizes a malicious bundle deviceId (no path traversal in the local id)", async () => {
+    process.argv = [
+      "bun",
+      "vellum",
+      "connect",
+      "import",
+      bundleFor({ deviceId: "-/../../tmp/x", token: "tokX" }),
+    ];
+    const logs: string[] = [];
+    const logSpy = spyOn(console, "log").mockImplementation(
+      (...a: unknown[]) => {
+        logs.push(a.join(" "));
+      },
+    );
+    try {
+      await connectImport();
+    } finally {
+      logSpy.mockRestore();
+    }
+
+    // The registered id must contain no path separators or `..`.
+    const m = logs.join("\n").match(/paired assistant '([^']+)'/);
+    expect(m).not.toBeNull();
+    const id = m![1];
+    expect(id).not.toContain("/");
+    expect(id).not.toContain("..");
+    expect(loadGuardianToken(id)?.accessToken).toBe("tokX");
+  });
+
+  test("does not overwrite an existing non-paired assistant", async () => {
+    saveAssistantEntry({
+      assistantId: "desk",
+      name: "Desk",
+      runtimeUrl: "http://127.0.0.1:7830",
+      cloud: "local",
+      species: "vellum",
+    });
+    process.argv = [
+      "bun",
+      "vellum",
+      "connect",
+      "import",
+      bundleFor({ deviceId: "dx" }),
+      "--name",
+      "desk",
+    ];
+    const errSpy = spyOn(console, "error").mockImplementation(() => {});
+    const exitSpy = spyOn(process, "exit").mockImplementation(((c?: number) => {
+      throw new Error(`exit:${c}`);
+    }) as never);
+    let exited = false;
+    try {
+      await connectImport();
+    } catch (e) {
+      exited = (e as Error).message === "exit:1";
+    } finally {
+      errSpy.mockRestore();
+      exitSpy.mockRestore();
+    }
+    expect(exited).toBe(true);
+    // The original local assistant is untouched (not overwritten).
+    const e = findAssistantByName("desk");
+    expect(e!.runtimeUrl).toBe("http://127.0.0.1:7830");
+    expect(e!.paired).toBeUndefined();
+  });
+
+  test("re-importing the same pairing updates in place", async () => {
+    const logSpy = spyOn(console, "log").mockImplementation(() => {});
+    try {
+      process.argv = [
+        "bun",
+        "vellum",
+        "connect",
+        "import",
+        bundleFor({ deviceId: "dev-re", token: "t1" }),
+      ];
+      await connectImport();
+      process.argv = [
+        "bun",
+        "vellum",
+        "connect",
+        "import",
+        bundleFor({ deviceId: "dev-re", token: "t2" }),
+      ];
+      await connectImport();
+    } finally {
+      logSpy.mockRestore();
+    }
+    expect(loadGuardianToken("paired-dev-re")?.accessToken).toBe("t2");
+  });
+
+  test("rejects a bundle whose gatewayUrl is not http(s)", async () => {
+    process.argv = [
+      "bun",
+      "vellum",
+      "connect",
+      "import",
+      bundleFor({ gatewayUrl: "ftp://nope", deviceId: "dz" }),
+    ];
+    const errSpy = spyOn(console, "error").mockImplementation(() => {});
+    const exitSpy = spyOn(process, "exit").mockImplementation(((c?: number) => {
+      throw new Error(`exit:${c}`);
+    }) as never);
+    let exited = false;
+    try {
+      await connectImport();
+    } catch (e) {
+      exited = (e as Error).message === "exit:1";
+    } finally {
+      errSpy.mockRestore();
+      exitSpy.mockRestore();
+    }
+    expect(exited).toBe(true);
+    expect(findAssistantByName("paired-dz")).toBeNull();
+  });
+
+  test("a malformed bundle exits 1 and registers nothing", async () => {
+    process.argv = ["bun", "vellum", "connect", "import", "not-valid-base64!!"];
+    const errSpy = spyOn(console, "error").mockImplementation(() => {});
+    const exitSpy = spyOn(process, "exit").mockImplementation(((c?: number) => {
+      throw new Error(`exit:${c}`);
+    }) as never);
+    let exited = false;
+    try {
+      await connectImport();
+    } catch (e) {
+      exited = (e as Error).message === "exit:1";
+    } finally {
+      errSpy.mockRestore();
+      exitSpy.mockRestore();
+    }
+    expect(exited).toBe(true);
+    // A malformed bundle has no deviceId, so no `paired-*` entry is created.
+    expect(findAssistantByName("paired-")).toBeNull();
+  });
+});