gloomberb 0.13.1 → 0.13.3

package/src/plugins/builtin/chat/controller.test.ts

@@ -1,8 +1,16 @@
-import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { afterEach, beforeEach, describe, expect, jest, test } from "bun:test";
 import type { AppNotificationRequest } from "../../../types/plugin";
 import { MemoryPluginPersistence as MemoryPersistence } from "../../../test-support/plugin-persistence";
-import { apiClient, type ChatChannel, type ChatMessage, type ChatNotification } from "../../../api-client";
+import {
+  apiClient,
+  type ChatChannel,
+  type ChatMessage,
+  type ChatNotification,
+  type ChatStateResponse,
+} from "../../../api-client";
+import { ApiRequestError } from "../../../api-client/errors";
 import { ChatController } from "./controller";
+import { SESSION_RETRY_MS } from "./controller/state";
 
 const TRANSCRIPT_KIND = "channel-transcript";
 const TRANSCRIPT_KEY = "everyone";
@@ -14,6 +22,7 @@ const originalGetMessages = apiClient.getMessages.bind(apiClient);
 const originalGetChannels = apiClient.getChannels.bind(apiClient);
 const originalGetChatPresence = apiClient.getChatPresence.bind(apiClient);
 const originalGetChatState = apiClient.getChatState.bind(apiClient);
+const originalGetAccountProfile = apiClient.getAccountProfile.bind(apiClient);
 const originalUpdateChatChannelState = apiClient.updateChatChannelState.bind(apiClient);
 const originalMarkChatNotificationsDelivered = apiClient.markChatNotificationsDelivered.bind(apiClient);
 const originalSubscribeChatNotifications = apiClient.subscribeChatNotifications.bind(apiClient);
@@ -91,6 +100,7 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  jest.useRealTimers();
   apiClient.dispose();
   apiClient.setSessionToken(null);
   apiClient.setCookieSessionMode(false);
@@ -100,6 +110,7 @@ afterEach(() => {
   apiClient.getChannels = originalGetChannels;
   apiClient.getChatPresence = originalGetChatPresence;
   apiClient.getChatState = originalGetChatState;
+  apiClient.getAccountProfile = originalGetAccountProfile;
   apiClient.updateChatChannelState = originalUpdateChatChannelState;
   apiClient.markChatNotificationsDelivered = originalMarkChatNotificationsDelivered;
   apiClient.subscribeChatNotifications = originalSubscribeChatNotifications;
@@ -453,9 +464,15 @@ describe("ChatController", () => {
     }
   });
 
-  test("keeps a persisted native session when get-session returns no user", async () => {
+  test("validates a persisted native session through protected chat state", async () => {
     const persistence = new MemoryPersistence();
     const controller = new ChatController();
+    const directChannel: ChatChannel = {
+      id: "dm:u2",
+      name: "u2",
+      kind: "direct",
+      created_at: "2026-03-28T00:00:00.000Z",
+    };
 
     persistence.setState("session", {
       sessionToken: "token-123",
@@ -463,11 +480,22 @@ describe("ChatController", () => {
     }, { schemaVersion: 1 });
 
     controller.attachPersistence(persistence);
-    apiClient.getSession = async () => null;
+    apiClient.getSession = async () => {
+      apiClient.restoreCachedUser(null);
+      return null;
+    };
+    apiClient.getChatState = async () => ({
+      channels: [...SERVER_CHAT_CHANNELS, directChannel],
+      onlineCount: 0,
+      channelStates: [],
+      notifications: [],
+    });
 
     await controller.refreshSession();
 
     expect(apiClient.getSessionToken()).toBe("token-123");
+    expect(apiClient.getCurrentUser()?.id).toBe("u1");
+    expect(controller.getChannels()).toContainEqual(directChannel);
     expect(persistence.getState<{
       sessionToken: string;
       user: { id: string; username: string; emailVerified: boolean };
@@ -483,6 +511,232 @@ describe("ChatController", () => {
     controller.dispose();
   });
 
+  test("clears an expired persisted session when protected chat rejects it", async () => {
+    const persistence = new MemoryPersistence();
+    const controller = new ChatController();
+
+    persistence.setState("session", {
+      sessionToken: "expired-token",
+      user: { id: "u1", username: "vince", emailVerified: true },
+    }, { schemaVersion: 1 });
+
+    controller.attachPersistence(persistence);
+    apiClient.getSession = async () => {
+      apiClient.restoreCachedUser(null);
+      return null;
+    };
+    apiClient.getChatState = async () => {
+      throw new ApiRequestError("Unauthorized", 401);
+    };
+
+    await controller.refreshSession();
+
+    expect(apiClient.getSessionToken()).toBeNull();
+    expect(apiClient.getCurrentUser()).toBeNull();
+    expect(controller.getSnapshot().user).toBeNull();
+    expect(persistence.getState("session", { schemaVersion: 1 })).toEqual({
+      sessionToken: null,
+      user: null,
+    });
+    controller.dispose();
+  });
+
+  test("clears an expired persisted session for an unverified user", async () => {
+    const persistence = new MemoryPersistence();
+    const controller = new ChatController();
+    let profileRequests = 0;
+
+    persistence.setState("session", {
+      sessionToken: "expired-token",
+      user: { id: "u1", username: "vince", emailVerified: false },
+    }, { schemaVersion: 1 });
+
+    controller.attachPersistence(persistence);
+    apiClient.getSession = async () => {
+      apiClient.restoreCachedUser(null);
+      return null;
+    };
+    apiClient.getAccountProfile = async () => {
+      profileRequests += 1;
+      throw new ApiRequestError("Unauthorized", 401);
+    };
+
+    await controller.refreshSession();
+
+    expect(profileRequests).toBe(1);
+    expect(apiClient.getSessionToken()).toBeNull();
+    expect(apiClient.getCurrentUser()).toBeNull();
+    expect(controller.getSnapshot().user).toBeNull();
+    controller.dispose();
+  });
+
+  test("downgrades stale verification state when protected chat rejects it", async () => {
+    const persistence = new MemoryPersistence();
+    const controller = new ChatController();
+
+    persistence.setState("session", {
+      sessionToken: "token-123",
+      user: { id: "u1", username: "vince", emailVerified: true },
+    }, { schemaVersion: 1 });
+
+    controller.attachPersistence(persistence);
+    apiClient.getSession = async () => {
+      apiClient.restoreCachedUser(null);
+      return null;
+    };
+    apiClient.getChatState = async () => {
+      throw new ApiRequestError("Email verification required", 403);
+    };
+
+    await controller.refreshSession();
+
+    expect(apiClient.getSessionToken()).toBe("token-123");
+    expect(apiClient.getCurrentUser()?.emailVerified).toBe(false);
+    expect(controller.getSnapshot().user?.emailVerified).toBe(false);
+    expect(persistence.getState<{
+      sessionToken: string;
+      user: { id: string; username: string; emailVerified: boolean };
+    }>("session", { schemaVersion: 1 })?.user.emailVerified).toBe(false);
+    controller.dispose();
+  });
+
+  test("does not let a stale validation failure clear a replacement session", async () => {
+    const persistence = new MemoryPersistence();
+    const controller = new ChatController();
+    let rejectProbe: ((error: Error) => void) | null = null;
+    let markProbeStarted: (() => void) | null = null;
+    const probeStarted = new Promise<void>((resolve) => {
+      markProbeStarted = resolve;
+    });
+
+    persistence.setState("session", {
+      sessionToken: "old-token",
+      user: { id: "u1", username: "vince", emailVerified: true },
+    }, { schemaVersion: 1 });
+
+    controller.attachPersistence(persistence);
+    apiClient.getSession = async () => {
+      apiClient.restoreCachedUser(null);
+      return null;
+    };
+    apiClient.getChatState = () => new Promise((_, reject) => {
+      rejectProbe = reject;
+      markProbeStarted?.();
+    });
+
+    const refresh = controller.refreshSession();
+    await probeStarted;
+    controller.adoptSession("new-token", {
+      id: "u2",
+      username: "mara",
+      emailVerified: true,
+    });
+    rejectProbe?.(new ApiRequestError("Unauthorized", 401));
+    await refresh;
+
+    expect(apiClient.getSessionToken()).toBe("new-token");
+    expect(apiClient.getCurrentUser()?.id).toBe("u2");
+    expect(controller.getSnapshot().user?.id).toBe("u2");
+    expect(persistence.getState<{
+      sessionToken: string;
+      user: { id: string };
+    }>("session", { schemaVersion: 1 })).toMatchObject({
+      sessionToken: "new-token",
+      user: { id: "u2" },
+    });
+    controller.dispose();
+  });
+
+  test("does not apply stale chat state after a replacement session", async () => {
+    const persistence = new MemoryPersistence();
+    const controller = new ChatController();
+    let resolveProbe: ((state: ChatStateResponse) => void) | null = null;
+    let markProbeStarted: (() => void) | null = null;
+    const probeStarted = new Promise<void>((resolve) => {
+      markProbeStarted = resolve;
+    });
+    const oldDirectChannel: ChatChannel = {
+      id: "dm:old-account",
+      name: "old-account",
+      kind: "direct",
+      created_at: "2026-03-28T00:00:00.000Z",
+    };
+
+    persistence.setState("session", {
+      sessionToken: "old-token",
+      user: { id: "u1", username: "vince", emailVerified: true },
+    }, { schemaVersion: 1 });
+
+    controller.attachPersistence(persistence);
+    apiClient.getSession = async () => {
+      apiClient.restoreCachedUser(null);
+      return null;
+    };
+    apiClient.getChatState = () => new Promise<ChatStateResponse>((resolve) => {
+      resolveProbe = resolve;
+      markProbeStarted?.();
+    });
+
+    const refresh = controller.refreshSession();
+    await probeStarted;
+    controller.adoptSession("new-token", {
+      id: "u2",
+      username: "mara",
+      emailVerified: true,
+    });
+    resolveProbe?.({
+      channels: [...SERVER_CHAT_CHANNELS, oldDirectChannel],
+      onlineCount: 0,
+      channelStates: [],
+      notifications: [],
+    });
+    await refresh;
+
+    expect(apiClient.getSessionToken()).toBe("new-token");
+    expect(controller.getSnapshot().user?.id).toBe("u2");
+    expect(controller.getChannels()).not.toContainEqual(oldDirectChannel);
+    controller.dispose();
+  });
+
+  test("revalidates a persisted session after an offline validation probe", async () => {
+    jest.useFakeTimers();
+    const persistence = new MemoryPersistence();
+    const controller = new ChatController();
+
+    persistence.setState("session", {
+      sessionToken: "token-123",
+      user: { id: "u1", username: "vince", emailVerified: true },
+    }, { schemaVersion: 1 });
+
+    controller.attachPersistence(persistence);
+    apiClient.getSession = async () => {
+      apiClient.restoreCachedUser(null);
+      return null;
+    };
+    apiClient.getChatState = async () => {
+      throw new Error("network down");
+    };
+
+    await controller.refreshSession();
+
+    expect(apiClient.getSessionToken()).toBe("token-123");
+    expect(apiClient.getCurrentUser()?.id).toBe("u1");
+    expect(controller.getSnapshot().user?.id).toBe("u1");
+    expect((controller as any).realtime.sessionRetryTimer).not.toBeNull();
+
+    apiClient.getChatState = async () => {
+      throw new ApiRequestError("Unauthorized", 401);
+    };
+    jest.advanceTimersByTime(SESSION_RETRY_MS);
+    await controller.refreshSession();
+
+    expect(apiClient.getSessionToken()).toBeNull();
+    expect(controller.getSnapshot().user).toBeNull();
+    expect((controller as any).realtime.sessionRetryTimer).toBeNull();
+    controller.dispose();
+    jest.useRealTimers();
+  });
+
   test("signs out when get-session returns no user and no token is stored", async () => {
     const persistence = new MemoryPersistence();
     const controller = new ChatController();
@@ -530,6 +784,8 @@ describe("ChatController", () => {
       username: "vince",
       emailVerified: true,
     });
+    expect((controller as any).realtime.sessionRetryTimer).not.toBeNull();
+    controller.dispose();
   });
 
   test("refreshes the public transcript without requiring a session", async () => {

package/src/plugins/builtin/cloud/askg/executor.test.ts

@@ -0,0 +1,160 @@
+import { describe, expect, test } from "bun:test";
+import type { MarketContext } from "../../../../cli/types";
+import type { PaneFunctionCatalog } from "../../../../cli/pane-functions/catalog";
+import type { RemoteControlResponse } from "../../../../remote/types";
+import {
+  MAX_TOOL_RESULT_BYTES,
+  type ASKGToolCallEvent,
+  type ClientToolManifest,
+} from "./protocol";
+import { createASKGToolExecutor } from "./executor";
+
+const emptyRegistry: PaneFunctionCatalog = {
+  panes: new Map(),
+  paneTemplates: new Map(),
+  destroy() {},
+};
+const emptyContext = {} as MarketContext;
+
+const headlessManifest: ClientToolManifest = {
+  name: "val",
+  source: "headless",
+  title: "Valuation",
+  description: "Read valuation data.",
+  writeTier: "read",
+  shape: "rows",
+  argument: { kind: "none" },
+  options: [],
+  confirm: "never",
+  timeoutMs: 30_000,
+};
+
+const resourceManifest: ClientToolManifest = {
+  name: "app.get_resource",
+  source: "remote-op",
+  title: "App: Get resource",
+  description: "Read an app resource.",
+  writeTier: "read",
+  inputSchema: { type: "object" },
+  confirm: "never",
+  timeoutMs: 10_000,
+};
+
+function call(
+  manifest: ClientToolManifest,
+  overrides: Partial<ASKGToolCallEvent> = {},
+): ASKGToolCallEvent {
+  return {
+    seq: 1,
+    type: "tool-call",
+    turnId: "turn-1",
+    toolCallId: "tool-1",
+    name: manifest.name,
+    args: {},
+    writeTier: manifest.writeTier,
+    requiresConfirmation: false,
+    preview: null,
+    timeoutMs: 1_000,
+    expiresAt: new Date(Date.now() + 60_000).toISOString(),
+    ...overrides,
+  };
+}
+
+function executor(options: {
+  manifests?: ClientToolManifest[];
+  remoteHandler?: (request: unknown) => Promise<RemoteControlResponse>;
+  headlessExecutor?: Parameters<typeof createASKGToolExecutor>[0]["headlessExecutor"];
+}) {
+  return createASKGToolExecutor({
+    manifests: options.manifests ?? [headlessManifest],
+    registry: emptyRegistry,
+    context: emptyContext,
+    remoteHandler: options.remoteHandler ?? (async () => ({ ok: true, data: {} })),
+    ...(options.headlessExecutor ? { headlessExecutor: options.headlessExecutor } : {}),
+  });
+}
+
+describe("ASKG delegated tool executor", () => {
+  test("denies a server tier that does not match the advertised tier", async () => {
+    let executions = 0;
+    const tools = executor({
+      headlessExecutor: async () => {
+        executions += 1;
+        return { result: { rows: [] }, rowCount: 0 };
+      },
+    });
+
+    const result = await tools.execute(call(headlessManifest, { writeTier: "ui-write" }));
+
+    expect(result.status).toBe("denied");
+    expect(result.note).toContain("tier mismatch");
+    expect(executions).toBe(0);
+  });
+
+  test("returns timeout without waiting for a stalled loader", async () => {
+    const tools = executor({
+      headlessExecutor: async () => new Promise(() => {}),
+    });
+
+    const result = await tools.execute(call(headlessManifest, { timeoutMs: 5 }));
+
+    expect(result.status).toBe("timeout");
+    expect(result.elapsedMs).toBeLessThan(500);
+  });
+
+  test("cancels an in-flight delegated load", async () => {
+    const started = Promise.withResolvers<void>();
+    const tools = executor({
+      headlessExecutor: async () => {
+        started.resolve();
+        return new Promise(() => {});
+      },
+    });
+    const controller = new AbortController();
+    const pending = tools.execute(call(headlessManifest), { signal: controller.signal });
+    await started.promise;
+    controller.abort();
+
+    const result = await pending;
+
+    expect(result.status).toBe("cancelled");
+  });
+
+  test("truncates the complete wire payload under the byte cap", async () => {
+    const tools = executor({
+      manifests: [resourceManifest],
+      remoteHandler: async () => ({ ok: true, data: { rows: [{ text: "x".repeat(MAX_TOOL_RESULT_BYTES * 2) }] } }),
+    });
+
+    const result = await tools.execute(call(resourceManifest, {
+      args: { resource: "app://snapshot" },
+    }));
+
+    expect(result.status).toBe("partial");
+    expect(result.truncated).toBe(true);
+    expect(result.rowCount).toBe(1);
+    expect(new TextEncoder().encode(JSON.stringify(result)).byteLength).toBeLessThanOrEqual(MAX_TOOL_RESULT_BYTES);
+    expect(result.result).toMatchObject({ originalBytes: expect.any(Number) });
+  });
+
+  test("returns remote failures as error values", async () => {
+    const tools = executor({
+      manifests: [resourceManifest],
+      remoteHandler: async () => ({
+        ok: false,
+        error: { code: "upstream_unavailable", message: "Upstream source is unavailable." },
+      }),
+    });
+
+    const result = await tools.execute(call(resourceManifest, {
+      args: { resource: "app://snapshot" },
+    }));
+
+    expect(result).toMatchObject({
+      status: "error",
+      result: { code: "upstream_unavailable" },
+      note: "Upstream source is unavailable.",
+      truncated: false,
+    });
+  });
+});