@vellumai/credential-executor 0.4.55 → 0.4.56

package/src/__tests__/command-workspace.test.ts

@@ -937,6 +937,36 @@ describe("validateContainedPath", () => {
     expect(err).toBeDefined();
     expect(err).toContain("escapes");
   });
+
+  test("accepts multi-level non-existent path under symlinked root", () => {
+    // On macOS /tmp is a symlink to /private/tmp. Create a real directory
+    // under /tmp so the root resolves through the symlink, then validate a
+    // path with multiple non-existent levels (e.g., reports/output.json where
+    // reports/ also doesn't exist). This exercises the while-loop in the
+    // catch branch iterating more than once before finding an existing ancestor.
+    const base = join("/tmp", `ces-test-multilevel-${randomUUID()}`);
+    mkdirSync(base, { recursive: true });
+    try {
+      // Neither "reports/" nor "reports/output.json" exist on disk
+      const deepPath = join(base, "reports", "output.json");
+      const err = validateContainedPath(deepPath, base, "test");
+      expect(err).toBeUndefined();
+
+      // Verify it also works with even deeper non-existent paths
+      const deeperPath = join(base, "a", "b", "c", "file.txt");
+      const err2 = validateContainedPath(deeperPath, base, "test");
+      expect(err2).toBeUndefined();
+
+      // Verify escape detection still works with multi-level non-existent paths
+      // under a symlinked root — path outside the root should still be rejected
+      const outsidePath = join("/tmp", `ces-test-other-${randomUUID()}`, "a", "b", "file.txt");
+      const err3 = validateContainedPath(outsidePath, base, "test");
+      expect(err3).toBeDefined();
+      expect(err3).toContain("escapes");
+    } finally {
+      rmSync(base, { recursive: true, force: true });
+    }
+  });
 });
 
 describe("checkSymlinkEscape", () => {

package/src/__tests__/grant-store.test.ts

@@ -4,7 +4,7 @@
  * Covers:
  * - Persistent store: initialization, duplicate prevention by canonical grant
  *   hash, fail-closed behavior on corrupt/unreadable files.
- * - Temporary store: allow_once consumption, allow_10m expiry, allow_thread
+ * - Temporary store: allow_once consumption, allow_10m expiry, allow_conversation
  *   scoping by conversation ID, clearConversation cleanup.
  */
 
@@ -40,6 +40,9 @@ function makeGrant(overrides?: Partial<PersistentGrant>): PersistentGrant {
     pattern: overrides?.pattern ?? "npm install",
     scope: overrides?.scope ?? "/project",
     createdAt: overrides?.createdAt ?? Date.now(),
+    sessionId: overrides?.sessionId ?? "test-session",
+    revokedAt: overrides?.revokedAt,
+    revokedReason: overrides?.revokedReason,
   };
 }
 
@@ -133,6 +136,121 @@ describe("PersistentGrantStore", () => {
     });
   });
 
+  describe("reactivation of revoked grants", () => {
+    test("adding a grant with same ID as revoked returns true and reactivates", () => {
+      const store = new PersistentGrantStore(tmpDir);
+      store.init();
+
+      const grant = makeGrant({ id: "revoke-reactivate" });
+      store.add(grant);
+      store.markRevoked("revoke-reactivate", "test revocation");
+
+      // Revoked grant should not appear in getAll
+      expect(store.getAll()).toHaveLength(0);
+
+      // Re-add with same ID — should reactivate
+      const reactivated = store.add(
+        makeGrant({ id: "revoke-reactivate", pattern: "bun install" }),
+      );
+      expect(reactivated).toBe(true);
+    });
+
+    test("reactivated grant appears in getAll()", () => {
+      const store = new PersistentGrantStore(tmpDir);
+      store.init();
+
+      store.add(makeGrant({ id: "revoke-visible" }));
+      store.markRevoked("revoke-visible");
+      store.add(makeGrant({ id: "revoke-visible" }));
+
+      const all = store.getAll();
+      expect(all).toHaveLength(1);
+      expect(all[0].id).toBe("revoke-visible");
+      expect(all[0].revokedAt).toBeUndefined();
+      expect(all[0].revokedReason).toBeUndefined();
+    });
+
+    test("reactivated grant fields are updated from the new grant", () => {
+      const store = new PersistentGrantStore(tmpDir);
+      store.init();
+
+      store.add(
+        makeGrant({
+          id: "revoke-update",
+          tool: "host_bash",
+          pattern: "npm install",
+          scope: "/old-project",
+          sessionId: "session-1",
+        }),
+      );
+      store.markRevoked("revoke-update", "no longer needed");
+
+      const newGrant = makeGrant({
+        id: "revoke-update",
+        tool: "command",
+        pattern: "bun install",
+        scope: "/new-project",
+        sessionId: "session-2",
+      });
+      store.add(newGrant);
+
+      const result = store.getById("revoke-update");
+      expect(result).toBeDefined();
+      expect(result!.tool).toBe("command");
+      expect(result!.pattern).toBe("bun install");
+      expect(result!.scope).toBe("/new-project");
+      expect(result!.sessionId).toBe("session-2");
+      expect(result!.revokedAt).toBeUndefined();
+      expect(result!.revokedReason).toBeUndefined();
+    });
+
+    test("reactivated grant round-trips through serialization", () => {
+      const store = new PersistentGrantStore(tmpDir);
+      store.init();
+
+      store.add(makeGrant({ id: "revoke-persist" }));
+      store.markRevoked("revoke-persist", "reason");
+      store.add(makeGrant({ id: "revoke-persist", pattern: "bun test" }));
+
+      // Load from a fresh store instance to verify serialization
+      const store2 = new PersistentGrantStore(tmpDir);
+      const grants = store2.getAll();
+      expect(grants).toHaveLength(1);
+      expect(grants[0].id).toBe("revoke-persist");
+      expect(grants[0].pattern).toBe("bun test");
+      expect(grants[0].revokedAt).toBeUndefined();
+      expect(grants[0].revokedReason).toBeUndefined();
+    });
+  });
+
+  describe("legacy sessionId migration", () => {
+    test("backfills sessionId on legacy grants during init", () => {
+      // Write a grants file with a grant missing sessionId (legacy format)
+      const legacyGrant = {
+        id: "legacy-grant",
+        tool: "host_bash",
+        pattern: "npm install",
+        scope: "/project",
+        createdAt: Date.now(),
+      };
+      writeFileSync(
+        join(tmpDir, "grants.json"),
+        JSON.stringify({ version: 1, grants: [legacyGrant] }, null, 2),
+      );
+
+      const store = new PersistentGrantStore(tmpDir);
+      store.init();
+
+      const grants = store.getAll();
+      expect(grants).toHaveLength(1);
+      expect(grants[0].sessionId).toBe("unknown");
+
+      // Verify it was persisted
+      const raw = JSON.parse(readFileSync(join(tmpDir, "grants.json"), "utf-8"));
+      expect(raw.grants[0].sessionId).toBe("unknown");
+    });
+  });
+
   describe("getById and has", () => {
     test("returns grant by ID", () => {
       const store = new PersistentGrantStore(tmpDir);
@@ -339,35 +457,35 @@ describe("TemporaryGrantStore", () => {
     });
   });
 
-  describe("allow_thread", () => {
+  describe("allow_conversation", () => {
     test("requires conversationId", () => {
-      expect(() => store.add("allow_thread", "hash-t", {})).toThrow(
+      expect(() => store.add("allow_conversation", "hash-t", {})).toThrow(
         /conversationId/,
       );
     });
 
     test("scoped to conversation ID", () => {
-      store.add("allow_thread", "hash-t", { conversationId: "conv-1" });
+      store.add("allow_conversation", "hash-t", { conversationId: "conv-1" });
 
-      expect(store.check("allow_thread", "hash-t", "conv-1")).toBe(true);
+      expect(store.check("allow_conversation", "hash-t", "conv-1")).toBe(true);
       // Different conversation should not match
-      expect(store.check("allow_thread", "hash-t", "conv-2")).toBe(false);
+      expect(store.check("allow_conversation", "hash-t", "conv-2")).toBe(false);
     });
 
     test("same proposal hash in different conversations are independent", () => {
-      store.add("allow_thread", "hash-t", { conversationId: "conv-a" });
-      store.add("allow_thread", "hash-t", { conversationId: "conv-b" });
+      store.add("allow_conversation", "hash-t", { conversationId: "conv-a" });
+      store.add("allow_conversation", "hash-t", { conversationId: "conv-b" });
 
-      expect(store.check("allow_thread", "hash-t", "conv-a")).toBe(true);
-      expect(store.check("allow_thread", "hash-t", "conv-b")).toBe(true);
+      expect(store.check("allow_conversation", "hash-t", "conv-a")).toBe(true);
+      expect(store.check("allow_conversation", "hash-t", "conv-b")).toBe(true);
     });
 
-    test("not consumed on check (persists within thread)", () => {
-      store.add("allow_thread", "hash-t", { conversationId: "conv-1" });
+    test("not consumed on check (persists within conversation)", () => {
+      store.add("allow_conversation", "hash-t", { conversationId: "conv-1" });
 
-      expect(store.check("allow_thread", "hash-t", "conv-1")).toBe(true);
-      expect(store.check("allow_thread", "hash-t", "conv-1")).toBe(true);
-      expect(store.check("allow_thread", "hash-t", "conv-1")).toBe(true);
+      expect(store.check("allow_conversation", "hash-t", "conv-1")).toBe(true);
+      expect(store.check("allow_conversation", "hash-t", "conv-1")).toBe(true);
+      expect(store.check("allow_conversation", "hash-t", "conv-1")).toBe(true);
     });
   });
 
@@ -384,9 +502,9 @@ describe("TemporaryGrantStore", () => {
       expect(store.checkAny("hash-any-t")).toBe("allow_10m");
     });
 
-    test("finds allow_thread grant with conversationId", () => {
-      store.add("allow_thread", "hash-any-th", { conversationId: "conv-x" });
-      expect(store.checkAny("hash-any-th", "conv-x")).toBe("allow_thread");
+    test("finds allow_conversation grant with conversationId", () => {
+      store.add("allow_conversation", "hash-any-th", { conversationId: "conv-x" });
+      expect(store.checkAny("hash-any-th", "conv-x")).toBe("allow_conversation");
     });
 
     test("returns undefined when no grants match", () => {
@@ -414,28 +532,28 @@ describe("TemporaryGrantStore", () => {
   });
 
   describe("clearConversation", () => {
-    test("removes all thread grants for a conversation", () => {
-      store.add("allow_thread", "hash-1", { conversationId: "conv-clear" });
-      store.add("allow_thread", "hash-2", { conversationId: "conv-clear" });
-      store.add("allow_thread", "hash-3", { conversationId: "conv-keep" });
+    test("removes all conversation grants for a conversation", () => {
+      store.add("allow_conversation", "hash-1", { conversationId: "conv-clear" });
+      store.add("allow_conversation", "hash-2", { conversationId: "conv-clear" });
+      store.add("allow_conversation", "hash-3", { conversationId: "conv-keep" });
 
       store.clearConversation("conv-clear");
 
-      expect(store.check("allow_thread", "hash-1", "conv-clear")).toBe(false);
-      expect(store.check("allow_thread", "hash-2", "conv-clear")).toBe(false);
+      expect(store.check("allow_conversation", "hash-1", "conv-clear")).toBe(false);
+      expect(store.check("allow_conversation", "hash-2", "conv-clear")).toBe(false);
       // Other conversation unaffected
-      expect(store.check("allow_thread", "hash-3", "conv-keep")).toBe(true);
+      expect(store.check("allow_conversation", "hash-3", "conv-keep")).toBe(true);
     });
 
-    test("does not affect non-thread grants", () => {
-      store.add("allow_once", "hash-non-thread");
-      store.add("allow_10m", "hash-non-thread-t");
+    test("does not affect non-conversation grants", () => {
+      store.add("allow_once", "hash-non-conv");
+      store.add("allow_10m", "hash-non-conv-t");
 
       store.clearConversation("any-conv");
 
-      // Non-thread grants unaffected
-      expect(store.check("allow_once", "hash-non-thread")).toBe(true);
-      expect(store.check("allow_10m", "hash-non-thread-t")).toBe(true);
+      // Non-conversation grants unaffected
+      expect(store.check("allow_once", "hash-non-conv")).toBe(true);
+      expect(store.check("allow_10m", "hash-non-conv-t")).toBe(true);
     });
   });
 
@@ -443,7 +561,7 @@ describe("TemporaryGrantStore", () => {
     test("removes all grants", () => {
       store.add("allow_once", "h1");
       store.add("allow_10m", "h2");
-      store.add("allow_thread", "h3", { conversationId: "c1" });
+      store.add("allow_conversation", "h3", { conversationId: "c1" });
 
       store.clear();
       expect(store.size).toBe(0);
@@ -454,7 +572,7 @@ describe("TemporaryGrantStore", () => {
     test("grants do not survive new store instance", () => {
       store.add("allow_once", "hash-restart");
       store.add("allow_10m", "hash-restart-t");
-      store.add("allow_thread", "hash-restart-th", {
+      store.add("allow_conversation", "hash-restart-th", {
         conversationId: "conv-r",
       });
 

package/src/__tests__/http-executor.test.ts

@@ -43,6 +43,7 @@ import { PersistentGrantStore } from "../grants/persistent-store.js";
 import { TemporaryGrantStore } from "../grants/temporary-store.js";
 import { LocalMaterialiser } from "../materializers/local.js";
 import type { OAuthConnectionLookup, LocalSubjectResolverDeps } from "../subjects/local.js";
+import { AuditStore } from "../audit/store.js";
 
 // ---------------------------------------------------------------------------
 // Test helpers
@@ -89,7 +90,7 @@ function buildStaticRecord(
     credentialId: overrides.credentialId ?? "cred-uuid-1",
     service: overrides.service ?? "github",
     field: overrides.field ?? "api_key",
-    allowedTools: overrides.allowedTools ?? [],
+    allowedTools: overrides.allowedTools ?? ["make_authenticated_request"],
     allowedDomains: overrides.allowedDomains ?? [],
     createdAt: overrides.createdAt ?? Date.now(),
     updatedAt: overrides.updatedAt ?? Date.now(),
@@ -281,9 +282,10 @@ function buildDeps(
       metadataStore: fixture.metadataStore,
       oauthConnections: createOAuthLookup(oauthConnections),
     },
-    sessionId: "test-session",
+    sessionId: { current: "test-session" },
     logger: silentLogger,
     ...overrides,
+    auditStore: overrides.auditStore ?? new AuditStore(fixture.tmpDir),
   };
 }
 
@@ -317,6 +319,7 @@ describe("HTTP executor: local static secrets", () => {
       pattern: "GET https://api.github.com/repos/owner/repo",
       scope: handle,
       createdAt: Date.now(),
+      sessionId: "test-session",
     });
 
     const { fetch: fetchFn, requests } = mockFetchRecorder(
@@ -356,6 +359,7 @@ describe("HTTP executor: local static secrets", () => {
       pattern: "GET https://api.github.com/user",
       scope: handle,
       createdAt: Date.now(),
+      sessionId: "test-session",
     });
 
     // Simulate API echoing back the token in response
@@ -390,6 +394,7 @@ describe("HTTP executor: local static secrets", () => {
       pattern: "GET https://api.github.com/data",
       scope: handle,
       createdAt: Date.now(),
+      sessionId: "test-session",
     });
 
     const fetchFn = mockFetch(200, '{"ok": true}', {
@@ -454,6 +459,7 @@ describe("HTTP executor: local OAuth", () => {
       pattern: "GET https://www.googleapis.com/calendar/v3/calendars/primary/events",
       scope: handle,
       createdAt: Date.now(),
+      sessionId: "test-session",
     });
 
     const { fetch: fetchFn, requests } = mockFetchRecorder(
@@ -494,6 +500,7 @@ describe("HTTP executor: local OAuth", () => {
       pattern: "GET https://www.googleapis.com/oauth2/v1/tokeninfo",
       scope: handle,
       createdAt: Date.now(),
+      sessionId: "test-session",
     });
 
     // Simulate tokeninfo endpoint echoing the token
@@ -545,6 +552,7 @@ describe("HTTP executor: platform_oauth handles", () => {
       pattern: "GET https://api.slack.com/api/conversations.list",
       scope: handle,
       createdAt: Date.now(),
+      sessionId: "test-session",
     });
 
     // Mock the platform catalog response
@@ -555,30 +563,31 @@ describe("HTTP executor: platform_oauth handles", () => {
       const urlStr = url.toString();
 
       // Platform catalog
-      if (urlStr.includes("/v1/ces/catalog")) {
+      if (urlStr.includes("/oauth/managed/catalog")) {
         return new Response(
-          JSON.stringify({
-            connections: [
-              {
-                id: "conn-platform-1",
-                provider: "slack",
-                account_info: "workspace@slack.com",
-                granted_scopes: ["channels:read"],
-                status: "active",
-              },
-            ],
-          }),
+          JSON.stringify([
+            {
+              handle: "platform_oauth:conn-platform-1",
+              connection_id: "conn-platform-1",
+              provider: "slack",
+              account_label: "workspace@slack.com",
+              scopes_granted: ["channels:read"],
+              status: "active",
+            },
+          ]),
           { status: 200, headers: { "Content-Type": "application/json" } },
         );
       }
 
       // Platform token materialization
-      if (urlStr.includes("/v1/ces/connections/conn-platform-1/materialize")) {
+      if (urlStr.includes("/oauth/managed/materialize")) {
         return new Response(
           JSON.stringify({
             access_token: "xoxp-platform-token-12345678",
             token_type: "Bearer",
-            expires_in: 3600,
+            expires_at: new Date(Date.now() + 3600_000).toISOString(),
+            provider: "slack",
+            handle: "platform_oauth:conn-platform-1",
           }),
           { status: 200, headers: { "Content-Type": "application/json" } },
         );
@@ -603,11 +612,13 @@ describe("HTTP executor: platform_oauth handles", () => {
       managedSubjectOptions: {
         platformBaseUrl: "https://api.vellum.ai",
         assistantApiKey: "test-api-key",
+        assistantId: "test-assistant-id",
         fetch: platformCatalogFetch,
       },
       managedMaterializerOptions: {
         platformBaseUrl: "https://api.vellum.ai",
         assistantApiKey: "test-api-key",
+        assistantId: "test-assistant-id",
         fetch: platformCatalogFetch,
       },
     });
@@ -640,6 +651,7 @@ describe("HTTP executor: platform_oauth handles", () => {
       pattern: "GET https://api.slack.com/data",
       scope: handle,
       createdAt: Date.now(),
+      sessionId: "test-session",
     });
 
     // No managedSubjectOptions or managedMaterializerOptions
@@ -772,6 +784,7 @@ describe("HTTP executor: forbidden header rejection", () => {
       pattern: "GET https://api.github.com/user",
       scope: handle,
       createdAt: Date.now(),
+      sessionId: "test-session",
     });
 
     const { fetch: fetchFn, requests } = mockFetchRecorder(200, '{"ok": true}');
@@ -803,6 +816,7 @@ describe("HTTP executor: forbidden header rejection", () => {
       pattern: "GET https://api.github.com/user",
       scope: handle,
       createdAt: Date.now(),
+      sessionId: "test-session",
     });
 
     const { fetch: fetchFn, requests } = mockFetchRecorder(200, '{"ok": true}');
@@ -833,6 +847,7 @@ describe("HTTP executor: forbidden header rejection", () => {
       pattern: "GET https://api.github.com/user",
       scope: handle,
       createdAt: Date.now(),
+      sessionId: "test-session",
     });
 
     const deps = buildDeps(fixture, []);
@@ -882,6 +897,7 @@ describe("HTTP executor: redirect denial", () => {
       pattern: "GET https://api.github.com/repos/owner/repo",
       scope: handle,
       createdAt: Date.now(),
+      sessionId: "test-session",
     });
 
     // Redirect to an evil domain
@@ -910,6 +926,73 @@ describe("HTTP executor: redirect denial", () => {
     expect(result.error!.message).toContain("denied");
   });
 
+  test("303 redirect evaluates policy against GET, not original method", async () => {
+    const handle = localStaticHandle("github", "api_key");
+
+    // Grant only covers GET — no POST grant exists
+    fixture.persistentStore.add({
+      id: "grant-github-get-only",
+      tool: "http",
+      pattern: "GET https://api.github.com/repos/owner/repo/result",
+      scope: handle,
+      createdAt: Date.now(),
+      sessionId: "test-session",
+    });
+
+    // Also add a grant for the original POST endpoint
+    fixture.persistentStore.add({
+      id: "grant-github-post",
+      tool: "http",
+      pattern: "POST https://api.github.com/repos/owner/repo/action",
+      scope: handle,
+      createdAt: Date.now(),
+      sessionId: "test-session",
+    });
+
+    // POST -> 303 redirect to a GET-only granted endpoint
+    let callCount = 0;
+    const requests: Array<{ url: string; method: string }> = [];
+    const fetchFn = asFetch(async (
+      url: string | URL | Request,
+      init?: RequestInit,
+    ) => {
+      callCount++;
+      requests.push({ url: url.toString(), method: init?.method ?? "GET" });
+      if (callCount === 1) {
+        return new Response(null, {
+          status: 303,
+          headers: { Location: "https://api.github.com/repos/owner/repo/result" },
+        });
+      }
+      return new Response('{"status": "done"}', {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      });
+    });
+
+    const deps = buildDeps(fixture, [], { fetch: fetchFn });
+
+    const result = await executeAuthenticatedHttpRequest(
+      {
+        credentialHandle: handle,
+        method: "POST",
+        url: "https://api.github.com/repos/owner/repo/action",
+        body: '{"trigger": true}',
+        purpose: "Trigger action",
+      },
+      deps,
+    );
+
+    // Should succeed — policy evaluates GET (post-303 method) against the grant
+    expect(result.success).toBe(true);
+    expect(result.statusCode).toBe(200);
+
+    // Verify the redirect hop actually used GET
+    expect(requests).toHaveLength(2);
+    expect(requests[0].method).toBe("POST");
+    expect(requests[1].method).toBe("GET");
+  });
+
   test("allows redirect to path covered by same grant", async () => {
     const handle = localStaticHandle("github", "api_key");
 
@@ -920,6 +1003,7 @@ describe("HTTP executor: redirect denial", () => {
       pattern: "GET https://api.github.com/repos/owner/repo",
       scope: handle,
       createdAt: Date.now(),
+      sessionId: "test-session",
     });
 
     // Redirect to the same domain/path that matches the grant
@@ -986,6 +1070,7 @@ describe("HTTP executor: filtered response behaviour", () => {
       pattern: "GET https://api.example.com/protected",
       scope: handle,
       createdAt: Date.now(),
+      sessionId: "test-session",
     });
 
     const fetchFn = mockFetch(401, '{"error": "unauthorized"}', {
@@ -1020,6 +1105,7 @@ describe("HTTP executor: filtered response behaviour", () => {
       pattern: "GET https://api.example.com/data",
       scope: handle,
       createdAt: Date.now(),
+      sessionId: "test-session",
     });
 
     const fetchFn = mockFetch(200, '{"ok": true}', {
@@ -1077,6 +1163,7 @@ describe("HTTP executor: audit summary integrity", () => {
       pattern: "GET https://api.github.com/user",
       scope: handle,
       createdAt: Date.now(),
+      sessionId: "test-session",
     });
 
     const fetchFn = mockFetch(200, '{"login": "octocat"}');
@@ -1110,6 +1197,7 @@ describe("HTTP executor: audit summary integrity", () => {
       pattern: "GET https://api.github.com/user",
       scope: badHandle,
       createdAt: Date.now(),
+      sessionId: "test-session",
     });
 
     const deps = buildDeps(fixture, []);
@@ -1191,6 +1279,7 @@ describe("HTTP executor: network error handling", () => {
       pattern: "GET https://api.example.com/data",
       scope: handle,
       createdAt: Date.now(),
+      sessionId: "test-session",
     });
 
     const fetchFn = asFetch(async () => {
@@ -1224,6 +1313,7 @@ describe("HTTP executor: network error handling", () => {
       pattern: "GET https://api.example.com/data",
       scope: handle,
       createdAt: Date.now(),
+      sessionId: "test-session",
     });
 
     const fetchFn = asFetch(async () => {