vellum 0.0.16 → 0.2.0

package/src/__tests__/runtime-attachment-metadata.test.ts

@@ -0,0 +1,190 @@
+import { describe, test, expect, beforeEach, afterEach, afterAll, mock } from 'bun:test';
+import { mkdtempSync, rmSync, realpathSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+const testDir = realpathSync(mkdtempSync(join(tmpdir(), 'runtime-attach-meta-test-')));
+
+mock.module('../util/platform.js', () => ({
+  getDataDir: () => testDir,
+  isMacOS: () => process.platform === 'darwin',
+  isLinux: () => process.platform === 'linux',
+  isWindows: () => process.platform === 'win32',
+  getSocketPath: () => join(testDir, 'test.sock'),
+  getPidPath: () => join(testDir, 'test.pid'),
+  getDbPath: () => join(testDir, 'test.db'),
+  getLogPath: () => join(testDir, 'test.log'),
+  ensureDataDir: () => {},
+  getRootDir: () => testDir,
+}));
+
+mock.module('../util/logger.js', () => ({
+  getLogger: () => new Proxy({} as Record<string, unknown>, {
+    get: () => () => {},
+  }),
+}));
+
+mock.module('../config/loader.js', () => ({
+  getConfig: () => ({
+    model: 'test',
+    provider: 'test',
+    apiKeys: {},
+    memory: { enabled: false },
+    rateLimit: { maxRequestsPerMinute: 0, maxTokensPerSession: 0 },
+  }),
+}));
+
+import { initializeDb, getDb } from '../memory/db.js';
+import * as conversationStore from '../memory/conversation-store.js';
+import { getOrCreateConversation } from '../memory/conversation-key-store.js';
+import {
+  uploadAttachment,
+  linkAttachmentToMessage,
+} from '../memory/attachments-store.js';
+import { RuntimeHttpServer } from '../runtime/http-server.js';
+
+initializeDb();
+
+afterAll(() => {
+  try { rmSync(testDir, { recursive: true }); } catch { /* best effort */ }
+});
+
+const TEST_TOKEN = 'test-bearer-token-attach';
+const AUTH_HEADERS = { Authorization: `Bearer ${TEST_TOKEN}` };
+
+describe('Runtime attachment metadata', () => {
+  let server: RuntimeHttpServer;
+  let port: number;
+
+  beforeEach(async () => {
+    const db = getDb();
+    db.run('DELETE FROM message_attachments');
+    db.run('DELETE FROM attachments');
+    db.run('DELETE FROM messages');
+    db.run('DELETE FROM conversations');
+    db.run('DELETE FROM conversation_keys');
+
+    // Use a random port to avoid conflicts
+    port = 17000 + Math.floor(Math.random() * 1000);
+    server = new RuntimeHttpServer({ port, bearerToken: TEST_TOKEN });
+    await server.start();
+  });
+
+  afterEach(async () => {
+    await server?.stop();
+  });
+
+  afterAll(async () => {
+    await server?.stop();
+  });
+
+  test('GET /messages includes attachment metadata for assistant messages', async () => {
+    const assistantId = 'ast-test-1';
+    const conversationKey = 'test-conv-1';
+
+    // Set up conversation and messages
+    const mapping = getOrCreateConversation(assistantId, conversationKey);
+    conversationStore.addMessage(mapping.conversationId, 'user', 'Hello');
+    const assistantMsg = conversationStore.addMessage(
+      mapping.conversationId,
+      'assistant',
+      JSON.stringify([{ type: 'text', text: 'Here is a chart' }]),
+    );
+
+    // Upload and link an attachment
+    const stored = uploadAttachment(assistantId, 'chart.png', 'image/png', 'iVBOR');
+    linkAttachmentToMessage(assistantMsg.id, stored.id, 0);
+
+    const res = await fetch(
+      `http://127.0.0.1:${port}/v1/assistants/${assistantId}/messages?conversationKey=${conversationKey}`,
+      { headers: AUTH_HEADERS },
+    );
+    const body = await res.json() as { messages: Array<{ role: string; content: string; attachments: Array<{ id: string; filename: string; mimeType: string; sizeBytes: number; kind: string }> }> };
+
+    expect(res.status).toBe(200);
+
+    // Find the assistant message
+    const aMsg = body.messages.find((m) => m.role === 'assistant');
+    expect(aMsg).toBeDefined();
+    expect(aMsg!.attachments).toHaveLength(1);
+    expect(aMsg!.attachments[0].id).toBe(stored.id);
+    expect(aMsg!.attachments[0].filename).toBe('chart.png');
+    expect(aMsg!.attachments[0].mimeType).toBe('image/png');
+    expect(aMsg!.attachments[0].kind).toBe('image');
+    expect(aMsg!.attachments[0].sizeBytes).toBeGreaterThan(0);
+
+    // User message should have empty attachments
+    const uMsg = body.messages.find((m) => m.role === 'user');
+    expect(uMsg).toBeDefined();
+    expect(uMsg!.attachments).toEqual([]);
+  });
+
+  test('GET /messages returns empty attachments when none linked', async () => {
+    const assistantId = 'ast-test-2';
+    const conversationKey = 'test-conv-2';
+
+    const mapping = getOrCreateConversation(assistantId, conversationKey);
+    conversationStore.addMessage(mapping.conversationId, 'user', 'Hello');
+    conversationStore.addMessage(
+      mapping.conversationId,
+      'assistant',
+      JSON.stringify([{ type: 'text', text: 'No attachments here' }]),
+    );
+
+    const res = await fetch(
+      `http://127.0.0.1:${port}/v1/assistants/${assistantId}/messages?conversationKey=${conversationKey}`,
+      { headers: AUTH_HEADERS },
+    );
+    const body = await res.json() as { messages: Array<{ role: string; attachments: unknown[] }> };
+
+    expect(res.status).toBe(200);
+    const aMsg = body.messages.find((m) => m.role === 'assistant');
+    expect(aMsg).toBeDefined();
+    expect(aMsg!.attachments).toEqual([]);
+  });
+
+  test('GET /attachments/:id returns attachment with payload', async () => {
+    const assistantId = 'ast-test-3';
+    const stored = uploadAttachment(assistantId, 'report.pdf', 'application/pdf', 'JVBER');
+
+    const res = await fetch(
+      `http://127.0.0.1:${port}/v1/assistants/${assistantId}/attachments/${stored.id}`,
+      { headers: AUTH_HEADERS },
+    );
+    const body = await res.json() as {
+      id: string; filename: string; mimeType: string; sizeBytes: number; kind: string; data: string;
+    };
+
+    expect(res.status).toBe(200);
+    expect(body.id).toBe(stored.id);
+    expect(body.filename).toBe('report.pdf');
+    expect(body.mimeType).toBe('application/pdf');
+    expect(body.kind).toBe('document');
+    expect(body.data).toBe('JVBER');
+    expect(body.sizeBytes).toBeGreaterThan(0);
+  });
+
+  test('GET /attachments/:id returns 404 for wrong assistant', async () => {
+    const stored = uploadAttachment('ast-owner', 'secret.txt', 'text/plain', 'c2VjcmV0');
+
+    const res = await fetch(
+      `http://127.0.0.1:${port}/v1/assistants/ast-other/attachments/${stored.id}`,
+      { headers: AUTH_HEADERS },
+    );
+    const body = await res.json() as { error: string };
+
+    expect(res.status).toBe(404);
+    expect(body.error).toBe('Attachment not found');
+  });
+
+  test('GET /attachments/:id returns 404 for nonexistent attachment', async () => {
+    const res = await fetch(
+      `http://127.0.0.1:${port}/v1/assistants/ast-test-4/attachments/nonexistent-id`,
+      { headers: AUTH_HEADERS },
+    );
+    const body = await res.json() as { error: string };
+
+    expect(res.status).toBe(404);
+    expect(body.error).toBe('Attachment not found');
+  });
+});

package/src/__tests__/runtime-runs-http.test.ts

@@ -0,0 +1,451 @@
+/**
+ * HTTP-layer integration tests for the run API endpoints.
+ *
+ * Tests POST /runs, GET /runs/:id, and POST /runs/:id/decision
+ * through RuntimeHttpServer with a real RunOrchestrator instance.
+ */
+import { describe, test, expect, beforeEach, afterAll, mock } from 'bun:test';
+import { mkdtempSync, rmSync, realpathSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import type { ServerMessage } from '../daemon/ipc-protocol.js';
+import type { Session } from '../daemon/session.js';
+
+const testDir = realpathSync(mkdtempSync(join(tmpdir(), 'runtime-runs-http-test-')));
+
+mock.module('../util/platform.js', () => ({
+  getRootDir: () => testDir,
+  getDataDir: () => testDir,
+  isMacOS: () => process.platform === 'darwin',
+  isLinux: () => process.platform === 'linux',
+  isWindows: () => process.platform === 'win32',
+  getSocketPath: () => join(testDir, 'test.sock'),
+  getPidPath: () => join(testDir, 'test.pid'),
+  getDbPath: () => join(testDir, 'test.db'),
+  getLogPath: () => join(testDir, 'test.log'),
+  ensureDataDir: () => {},
+}));
+
+mock.module('../util/logger.js', () => ({
+  getLogger: () => new Proxy({} as Record<string, unknown>, {
+    get: () => () => {},
+  }),
+}));
+
+mock.module('../config/loader.js', () => ({
+  getConfig: () => ({
+    model: 'test',
+    provider: 'test',
+    apiKeys: {},
+    memory: { enabled: false },
+    rateLimit: { maxRequestsPerMinute: 0, maxTokensPerSession: 0 },
+    secretDetection: { enabled: false },
+  }),
+}));
+
+import { initializeDb, getDb, resetDb } from '../memory/db.js';
+import { RuntimeHttpServer } from '../runtime/http-server.js';
+import { RunOrchestrator } from '../runtime/run-orchestrator.js';
+
+initializeDb();
+
+// ---------------------------------------------------------------------------
+// Session helpers
+// ---------------------------------------------------------------------------
+
+function makeCompletingSession(): Session {
+  let processing = false;
+  return {
+    isProcessing: () => processing,
+    persistUserMessage: () => undefined as unknown as string,
+    setAssistantId: () => {},
+    updateClient: () => {},
+    runAgentLoop: async () => {
+      processing = true;
+      await new Promise((r) => setTimeout(r, 20));
+      processing = false;
+    },
+    handleConfirmationResponse: () => {},
+  } as unknown as Session;
+}
+
+function makeFailingSession(errorMsg: string): Session {
+  return {
+    isProcessing: () => false,
+    persistUserMessage: () => undefined as unknown as string,
+    setAssistantId: () => {},
+    updateClient: () => {},
+    runAgentLoop: async (_content: string, _messageId: string, onEvent: (msg: ServerMessage) => void) => {
+      onEvent({ type: 'error', message: errorMsg });
+    },
+    handleConfirmationResponse: () => {},
+  } as unknown as Session;
+}
+
+function makeConfirmationSession(toolName: string): Session {
+  let clientHandler: (msg: ServerMessage) => void = () => {};
+  return {
+    isProcessing: () => false,
+    persistUserMessage: () => undefined as unknown as string,
+    setAssistantId: () => {},
+    updateClient: (handler: (msg: ServerMessage) => void) => {
+      clientHandler = handler;
+    },
+    runAgentLoop: async () => {
+      clientHandler({
+        type: 'confirmation_request',
+        requestId: 'req-1',
+        toolName,
+        input: { objective: 'test task' },
+        riskLevel: 'medium',
+        allowlistOptions: [],
+        scopeOptions: [],
+      });
+      // Hang to simulate waiting for decision
+      await new Promise<void>(() => {});
+    },
+    handleConfirmationResponse: () => {},
+  } as unknown as Session;
+}
+
+function makeHangingSession(): Session {
+  let processing = false;
+  return {
+    isProcessing: () => processing,
+    persistUserMessage: () => undefined as unknown as string,
+    setAssistantId: () => {},
+    updateClient: () => {},
+    runAgentLoop: async () => {
+      processing = true;
+      await new Promise<void>(() => {});
+    },
+    handleConfirmationResponse: () => {},
+  } as unknown as Session;
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+const ASSISTANT_ID = 'ast-run-http';
+const TEST_TOKEN = 'test-bearer-token-runs';
+const AUTH_HEADERS = { Authorization: `Bearer ${TEST_TOKEN}` };
+
+describe('runtime runs — HTTP layer', () => {
+  let server: RuntimeHttpServer;
+  let port: number;
+
+  beforeEach(() => {
+    const db = getDb();
+    db.run('DELETE FROM message_runs');
+    db.run('DELETE FROM messages');
+    db.run('DELETE FROM conversations');
+    db.run('DELETE FROM conversation_keys');
+  });
+
+  afterAll(() => {
+    resetDb();
+    try { rmSync(testDir, { recursive: true, force: true }); } catch { /* best effort */ }
+  });
+
+  async function startServer(sessionFactory: () => Session): Promise<{ orchestrator: RunOrchestrator }> {
+    port = 18000 + Math.floor(Math.random() * 1000);
+    const orchestrator = new RunOrchestrator({
+      getOrCreateSession: async () => sessionFactory(),
+      resolveAttachments: () => [],
+    });
+    server = new RuntimeHttpServer({ port, bearerToken: TEST_TOKEN, runOrchestrator: orchestrator });
+    await server.start();
+    return { orchestrator };
+  }
+
+  async function stopServer(): Promise<void> {
+    await server?.stop();
+  }
+
+  function runsUrl(path = ''): string {
+    return `http://127.0.0.1:${port}/v1/assistants/${ASSISTANT_ID}/runs${path}`;
+  }
+
+  // ── Auth ────────────────────────────────────────────────────────────
+
+  test('returns 401 when bearer token is missing', async () => {
+    await startServer(() => makeCompletingSession());
+
+    const res = await fetch(runsUrl(), {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ conversationKey: 'conv-noauth', content: 'Hi' }),
+    });
+
+    expect(res.status).toBe(401);
+    await stopServer();
+  });
+
+  test('returns 401 when bearer token is wrong', async () => {
+    await startServer(() => makeCompletingSession());
+
+    const res = await fetch(runsUrl(), {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Authorization: 'Bearer wrong-token' },
+      body: JSON.stringify({ conversationKey: 'conv-badauth', content: 'Hi' }),
+    });
+
+    expect(res.status).toBe(401);
+    await stopServer();
+  });
+
+  test('healthz is accessible without auth and includes disk space info', async () => {
+    await startServer(() => makeCompletingSession());
+
+    const res = await fetch(`http://127.0.0.1:${port}/healthz`);
+    expect(res.status).toBe(200);
+
+    const body = await res.json() as { status: string; disk: { path: string; totalMb: number; usedMb: number; freeMb: number } | null };
+    expect(body.status).toBe('healthy');
+    if (body.disk !== null) {
+      expect(typeof body.disk.path).toBe('string');
+      expect(body.disk.totalMb).toBeGreaterThan(0);
+      expect(body.disk.usedMb).toBeGreaterThanOrEqual(0);
+      expect(body.disk.freeMb).toBeGreaterThanOrEqual(0);
+    }
+
+    await stopServer();
+  });
+
+  // ── POST /runs ──────────────────────────────────────────────────────
+
+  test('POST /runs creates a run and returns 201', async () => {
+    await startServer(() => makeCompletingSession());
+
+    const res = await fetch(runsUrl(), {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', ...AUTH_HEADERS },
+      body: JSON.stringify({ conversationKey: 'conv-1', content: 'Hello' }),
+    });
+    const body = await res.json() as { id: string; status: string; messageId: string; createdAt: string };
+
+    expect(res.status).toBe(201);
+    expect(body.id).toBeDefined();
+    expect(body.status).toBe('running');
+    expect(body.messageId).toBeNull();
+    expect(body.createdAt).toBeDefined();
+
+    await stopServer();
+  });
+
+  test('POST /runs returns 400 when conversationKey missing', async () => {
+    await startServer(() => makeCompletingSession());
+
+    const res = await fetch(runsUrl(), {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', ...AUTH_HEADERS },
+      body: JSON.stringify({ content: 'Hello' }),
+    });
+
+    expect(res.status).toBe(400);
+    const body = await res.json() as { error: string };
+    expect(body.error).toContain('conversationKey');
+
+    await stopServer();
+  });
+
+  test('POST /runs returns 400 when content is empty', async () => {
+    await startServer(() => makeCompletingSession());
+
+    const res = await fetch(runsUrl(), {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', ...AUTH_HEADERS },
+      body: JSON.stringify({ conversationKey: 'conv-2', content: '' }),
+    });
+
+    expect(res.status).toBe(400);
+
+    await stopServer();
+  });
+
+  test('POST /runs returns 409 when session busy', async () => {
+    const session = makeHangingSession();
+    await startServer(() => session);
+
+    // First run starts and hangs
+    const res1 = await fetch(runsUrl(), {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', ...AUTH_HEADERS },
+      body: JSON.stringify({ conversationKey: 'conv-busy', content: 'First' }),
+    });
+    expect(res1.status).toBe(201);
+
+    await new Promise((r) => setTimeout(r, 30));
+
+    // Second run should be rejected
+    const res2 = await fetch(runsUrl(), {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', ...AUTH_HEADERS },
+      body: JSON.stringify({ conversationKey: 'conv-busy', content: 'Second' }),
+    });
+    expect(res2.status).toBe(409);
+
+    await stopServer();
+  });
+
+  // ── GET /runs/:id ───────────────────────────────────────────────────
+
+  test('GET /runs/:id returns run status', async () => {
+    await startServer(() => makeHangingSession());
+
+    const createRes = await fetch(runsUrl(), {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', ...AUTH_HEADERS },
+      body: JSON.stringify({ conversationKey: 'conv-get', content: 'Test' }),
+    });
+    const { id } = await createRes.json() as { id: string };
+
+    const getRes = await fetch(runsUrl(`/${id}`), { headers: AUTH_HEADERS });
+    const body = await getRes.json() as { id: string; status: string; messageId: string };
+
+    expect(getRes.status).toBe(200);
+    expect(body.id).toBe(id);
+    expect(body.status).toBe('running');
+
+    await stopServer();
+  });
+
+  test('GET /runs/:id returns completed after agent loop finishes', async () => {
+    await startServer(() => makeCompletingSession());
+
+    const createRes = await fetch(runsUrl(), {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', ...AUTH_HEADERS },
+      body: JSON.stringify({ conversationKey: 'conv-done', content: 'Build it' }),
+    });
+    const { id } = await createRes.json() as { id: string };
+
+    await new Promise((r) => setTimeout(r, 100));
+
+    const getRes = await fetch(runsUrl(`/${id}`), { headers: AUTH_HEADERS });
+    const body = await getRes.json() as { id: string; status: string };
+
+    expect(getRes.status).toBe(200);
+    expect(body.status).toBe('completed');
+
+    await stopServer();
+  });
+
+  test('GET /runs/:id returns failed with error', async () => {
+    await startServer(() => makeFailingSession('Backend error'));
+
+    const createRes = await fetch(runsUrl(), {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', ...AUTH_HEADERS },
+      body: JSON.stringify({ conversationKey: 'conv-fail', content: 'Do it' }),
+    });
+    const { id } = await createRes.json() as { id: string };
+
+    await new Promise((r) => setTimeout(r, 50));
+
+    const getRes = await fetch(runsUrl(`/${id}`), { headers: AUTH_HEADERS });
+    const body = await getRes.json() as { id: string; status: string; error: string };
+
+    expect(getRes.status).toBe(200);
+    expect(body.status).toBe('failed');
+    expect(body.error).toBe('Backend error');
+
+    await stopServer();
+  });
+
+  test('GET /runs/:id returns 404 for unknown run', async () => {
+    await startServer(() => makeCompletingSession());
+
+    const res = await fetch(runsUrl('/nonexistent'), { headers: AUTH_HEADERS });
+    expect(res.status).toBe(404);
+
+    await stopServer();
+  });
+
+  test('GET /runs/:id returns 404 for different assistant', async () => {
+    await startServer(() => makeCompletingSession());
+
+    const createRes = await fetch(runsUrl(), {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', ...AUTH_HEADERS },
+      body: JSON.stringify({ conversationKey: 'conv-scope', content: 'Test' }),
+    });
+    const { id } = await createRes.json() as { id: string };
+
+    // Try to access via a different assistant
+    const res = await fetch(`http://127.0.0.1:${port}/v1/assistants/other-assistant/runs/${id}`, { headers: AUTH_HEADERS });
+    expect(res.status).toBe(404);
+
+    await stopServer();
+  });
+
+  // ── POST /runs/:id/decision ─────────────────────────────────────────
+
+  test('POST /runs/:id/decision returns accepted for pending confirmation', async () => {
+    await startServer(() => makeConfirmationSession('swarm_delegate'));
+
+    const createRes = await fetch(runsUrl(), {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', ...AUTH_HEADERS },
+      body: JSON.stringify({ conversationKey: 'conv-decide', content: 'Approve' }),
+    });
+    const { id } = await createRes.json() as { id: string };
+
+    await new Promise((r) => setTimeout(r, 50));
+
+    // Verify pending state via GET
+    const getRes = await fetch(runsUrl(`/${id}`), { headers: AUTH_HEADERS });
+    const runBody = await getRes.json() as { status: string; pendingConfirmation: { toolName: string } };
+    expect(runBody.status).toBe('needs_confirmation');
+    expect(runBody.pendingConfirmation.toolName).toBe('swarm_delegate');
+
+    // Submit decision
+    const decisionRes = await fetch(runsUrl(`/${id}/decision`), {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', ...AUTH_HEADERS },
+      body: JSON.stringify({ decision: 'allow' }),
+    });
+    const decisionBody = await decisionRes.json() as { accepted: boolean };
+
+    expect(decisionRes.status).toBe(200);
+    expect(decisionBody.accepted).toBe(true);
+
+    await stopServer();
+  });
+
+  test('POST /runs/:id/decision returns 400 for invalid decision', async () => {
+    await startServer(() => makeHangingSession());
+
+    const createRes = await fetch(runsUrl(), {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', ...AUTH_HEADERS },
+      body: JSON.stringify({ conversationKey: 'conv-bad-dec', content: 'Test' }),
+    });
+    const { id } = await createRes.json() as { id: string };
+
+    const res = await fetch(runsUrl(`/${id}/decision`), {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', ...AUTH_HEADERS },
+      body: JSON.stringify({ decision: 'maybe' }),
+    });
+
+    expect(res.status).toBe(400);
+
+    await stopServer();
+  });
+
+  test('POST /runs/:id/decision returns 404 for unknown run', async () => {
+    await startServer(() => makeCompletingSession());
+
+    const res = await fetch(runsUrl('/nonexistent/decision'), {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', ...AUTH_HEADERS },
+      body: JSON.stringify({ decision: 'allow' }),
+    });
+
+    expect(res.status).toBe(404);
+
+    await stopServer();
+  });
+});