vellum 0.2.13 → 0.3.2

package/src/__tests__/host-file-write-tool.test.ts

@@ -1,77 +0,0 @@
-import { afterEach, describe, expect, test } from 'bun:test';
-import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
-import { join } from 'node:path';
-import { tmpdir } from 'node:os';
-
-import { hostFileWriteTool } from '../tools/host-filesystem/write.js';
-import type { ToolContext } from '../tools/types.js';
-
-const testDirs: string[] = [];
-
-function makeContext(): ToolContext {
-  return {
-    workingDir: '/tmp',
-    sessionId: 'test-session',
-    conversationId: 'test-conversation',
-  };
-}
-
-afterEach(() => {
-  for (const dir of testDirs.splice(0)) {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-describe('host_file_write tool', () => {
-  test('rejects relative paths', async () => {
-    const result = await hostFileWriteTool.execute({ path: 'relative.txt', content: 'hi' }, makeContext());
-    expect(result.isError).toBe(true);
-    expect(result.content).toContain('must be absolute');
-  });
-
-  test('rejects non-string content', async () => {
-    const dir = mkdtempSync(join(tmpdir(), 'host-file-write-test-'));
-    testDirs.push(dir);
-    const filePath = join(dir, 'out.txt');
-
-    const result = await hostFileWriteTool.execute({ path: filePath, content: 42 }, makeContext());
-    expect(result.isError).toBe(true);
-    expect(result.content).toContain('content is required and must be a string');
-  });
-
-  test('writes new file and returns diff', async () => {
-    const dir = mkdtempSync(join(tmpdir(), 'host-file-write-test-'));
-    testDirs.push(dir);
-    const filePath = join(dir, 'nested', 'new.txt');
-
-    const result = await hostFileWriteTool.execute({ path: filePath, content: 'new content' }, makeContext());
-
-    expect(result.isError).toBe(false);
-    expect(existsSync(filePath)).toBe(true);
-    expect(readFileSync(filePath, 'utf-8')).toBe('new content');
-    expect(result.diff).toEqual({
-      filePath,
-      oldContent: '',
-      newContent: 'new content',
-      isNewFile: true,
-    });
-  });
-
-  test('overwrites existing file and returns previous content in diff', async () => {
-    const dir = mkdtempSync(join(tmpdir(), 'host-file-write-test-'));
-    testDirs.push(dir);
-    const filePath = join(dir, 'existing.txt');
-
-    await hostFileWriteTool.execute({ path: filePath, content: 'old' }, makeContext());
-    const result = await hostFileWriteTool.execute({ path: filePath, content: 'updated' }, makeContext());
-
-    expect(result.isError).toBe(false);
-    expect(readFileSync(filePath, 'utf-8')).toBe('updated');
-    expect(result.diff).toEqual({
-      filePath,
-      oldContent: 'old',
-      newContent: 'updated',
-      isNewFile: false,
-    });
-  });
-});

package/src/__tests__/host-shell-tool.test.ts

@@ -1,311 +0,0 @@
-import { afterEach, describe, expect, mock, test } from 'bun:test';
-import { mkdtempSync, realpathSync, rmSync } from 'node:fs';
-import { join } from 'node:path';
-import { tmpdir } from 'node:os';
-import * as realChildProcess from 'node:child_process';
-
-// Capture the real spawn before mock.module replaces it
-const originalSpawn = realChildProcess.spawn;
-
-// Capture spawn calls to verify the host tool spawns 'bash' directly
-const spawnCalls: { command: string; args: string[] }[] = [];
-const spawnSpy = mock((...args: Parameters<typeof realChildProcess.spawn>) => {
-  spawnCalls.push({ command: args[0] as string, args: args[1] as string[] });
-  return (originalSpawn as (...a: unknown[]) => unknown)(...args);
-});
-
-mock.module('node:child_process', () => ({
-  ...realChildProcess,
-  spawn: spawnSpy,
-}));
-
-const mockConfig = {
-  provider: 'anthropic',
-  model: 'test',
-  apiKeys: {},
-  maxTokens: 4096,
-  dataDir: '/tmp',
-  timeouts: {
-    shellDefaultTimeoutSec: 120,
-    shellMaxTimeoutSec: 600,
-    permissionTimeoutSec: 300,
-  },
-  sandbox: { enabled: true },
-  rateLimit: { maxRequestsPerMinute: 0, maxTokensPerSession: 0 },
-  secretDetection: { enabled: true, action: 'warn' as const, entropyThreshold: 4.0 },
-  auditLog: { retentionDays: 0 },
-};
-
-// Track whether wrapCommand was ever called — host_bash must never invoke it
-let wrapCommandCallCount = 0;
-
-mock.module('../config/loader.js', () => ({
-  getConfig: () => mockConfig,
-  loadConfig: () => mockConfig,
-  invalidateConfigCache: () => {},
-  saveConfig: () => {},
-  loadRawConfig: () => ({}),
-  saveRawConfig: () => {},
-  getNestedValue: () => undefined,
-  setNestedValue: () => {},
-}));
-
-mock.module('../util/logger.js', () => ({
-  getLogger: () => new Proxy({} as Record<string, unknown>, {
-    get: () => () => {},
-  }),
-}));
-
-mock.module('../tools/terminal/sandbox.js', () => ({
-  wrapCommand: (...args: unknown[]) => {
-    wrapCommandCallCount++;
-    return { command: 'bash', args: ['-c', '--', args[0]], sandboxed: false };
-  },
-}));
-
-import { hostShellTool } from '../tools/host-terminal/host-shell.js';
-import type { ToolContext } from '../tools/types.js';
-
-const testDirs: string[] = [];
-
-function makeContext(): ToolContext {
-  return {
-    workingDir: '/tmp',
-    sessionId: 'test-session',
-    conversationId: 'test-conversation',
-  };
-}
-
-afterEach(() => {
-  for (const dir of testDirs.splice(0)) {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-describe('host_bash tool', () => {
-  test('rejects relative working_dir', async () => {
-    const result = await hostShellTool.execute({
-      command: 'pwd',
-      working_dir: 'relative/path',
-    }, makeContext());
-
-    expect(result.isError).toBe(true);
-    expect(result.content).toContain('working_dir must be absolute');
-  });
-
-  test('executes command in provided absolute working_dir', async () => {
-    const dir = mkdtempSync(join(tmpdir(), 'host-shell-test-'));
-    testDirs.push(dir);
-
-    const result = await hostShellTool.execute({
-      command: 'pwd',
-      working_dir: dir,
-    }, makeContext());
-
-    expect(result.isError).toBe(false);
-    expect(result.content.trim()).toBe(realpathSync(dir));
-  });
-
-  test('returns error for non-zero exit commands', async () => {
-    const result = await hostShellTool.execute({ command: 'exit 12' }, makeContext());
-    expect(result.isError).toBe(true);
-    expect(result.content).toContain('<command_exit code="12" />');
-  });
-
-  test('does not route through sandbox wrapCommand', async () => {
-    wrapCommandCallCount = 0;
-
-    const dir = mkdtempSync(join(tmpdir(), 'host-shell-nosandbox-'));
-    testDirs.push(dir);
-
-    const result = await hostShellTool.execute({
-      command: 'echo isolation-test',
-      working_dir: dir,
-    }, makeContext());
-
-    expect(result.isError).toBe(false);
-    expect(result.content.trim()).toBe('isolation-test');
-    // The sandbox wrapCommand must never be called for host_bash
-    expect(wrapCommandCallCount).toBe(0);
-  });
-
-  test('spawns plain bash without sandbox-exec or bwrap', async () => {
-    const dir = mkdtempSync(join(tmpdir(), 'host-shell-plain-'));
-    testDirs.push(dir);
-
-    // Verify the tool executes successfully even when sandbox is enabled in config,
-    // proving it bypasses the sandbox entirely
-    expect(mockConfig.sandbox.enabled).toBe(true);
-
-    spawnCalls.length = 0;
-
-    const result = await hostShellTool.execute({
-      command: 'echo hello',
-      working_dir: dir,
-    }, makeContext());
-
-    expect(result.isError).toBe(false);
-    // Verify spawn was called with 'bash' directly — not 'bwrap' or 'sandbox-exec'
-    expect(spawnCalls.length).toBe(1);
-    expect(spawnCalls[0].command).toBe('bash');
-    expect(spawnCalls[0].args).toEqual(['-c', '--', 'echo hello']);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Baseline: host_bash bypasses all sandbox wrappers
-// ---------------------------------------------------------------------------
-
-describe('host_bash — baseline: no sandbox isolation', () => {
-  test('does not use Docker wrapper (no "docker" as spawn command)', async () => {
-    const dir = mkdtempSync(join(tmpdir(), 'host-shell-no-docker-'));
-    testDirs.push(dir);
-
-    spawnCalls.length = 0;
-
-    const result = await hostShellTool.execute({
-      command: 'echo baseline',
-      working_dir: dir,
-    }, makeContext());
-
-    expect(result.isError).toBe(false);
-    // The spawn command must be 'bash', never 'docker'
-    expect(spawnCalls.length).toBe(1);
-    expect(spawnCalls[0].command).toBe('bash');
-    expect(spawnCalls[0].command).not.toBe('docker');
-  });
-
-  test('does not use sandbox-exec or bwrap wrapper', async () => {
-    const dir = mkdtempSync(join(tmpdir(), 'host-shell-no-native-'));
-    testDirs.push(dir);
-
-    spawnCalls.length = 0;
-
-    const result = await hostShellTool.execute({
-      command: 'echo no-native-sandbox',
-      working_dir: dir,
-    }, makeContext());
-
-    expect(result.isError).toBe(false);
-    expect(spawnCalls[0].command).not.toBe('sandbox-exec');
-    expect(spawnCalls[0].command).not.toBe('bwrap');
-  });
-
-  test('runs directly with bash -c -- <command> args format', async () => {
-    const dir = mkdtempSync(join(tmpdir(), 'host-shell-args-'));
-    testDirs.push(dir);
-
-    spawnCalls.length = 0;
-
-    await hostShellTool.execute({
-      command: 'ls -la /tmp',
-      working_dir: dir,
-    }, makeContext());
-
-    expect(spawnCalls[0].command).toBe('bash');
-    expect(spawnCalls[0].args[0]).toBe('-c');
-    expect(spawnCalls[0].args[1]).toBe('--');
-    expect(spawnCalls[0].args[2]).toBe('ls -la /tmp');
-  });
-
-  test('sandbox config being enabled does not affect host_bash', async () => {
-    // The mock config has sandbox.enabled = true
-    expect(mockConfig.sandbox.enabled).toBe(true);
-
-    const dir = mkdtempSync(join(tmpdir(), 'host-shell-sandbox-cfg-'));
-    testDirs.push(dir);
-
-    spawnCalls.length = 0;
-    wrapCommandCallCount = 0;
-
-    const result = await hostShellTool.execute({
-      command: 'echo sandbox-enabled-irrelevant',
-      working_dir: dir,
-    }, makeContext());
-
-    expect(result.isError).toBe(false);
-    // Must never call wrapCommand regardless of config
-    expect(wrapCommandCallCount).toBe(0);
-    // Must still spawn plain bash
-    expect(spawnCalls[0].command).toBe('bash');
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Regression: host_bash must NOT gain proxied-mode properties
-// ---------------------------------------------------------------------------
-// The sandboxed `bash` tool gained `network_mode` and `credential_ids` in
-// the media-reuse rollout (PR 13). The `host_bash` tool must never acquire
-// these — it runs unsandboxed on the host and has no proxy infrastructure.
-// These tests lock that boundary so any accidental addition is caught.
-
-describe('host_bash — regression: no proxied-mode additions', () => {
-  const definition = hostShellTool.getDefinition();
-  const schemaProps = (definition.input_schema as Record<string, unknown>).properties as Record<string, unknown>;
-
-  test('schema does not include network_mode property', () => {
-    expect(schemaProps).not.toHaveProperty('network_mode');
-  });
-
-  test('schema does not include credential_ids property', () => {
-    expect(schemaProps).not.toHaveProperty('credential_ids');
-  });
-
-  test('schema only contains the expected properties (command, working_dir, timeout_seconds, reason)', () => {
-    const propertyNames = Object.keys(schemaProps).sort();
-    expect(propertyNames).toEqual(['command', 'reason', 'timeout_seconds', 'working_dir']);
-  });
-
-  test('execute ignores network_mode even if supplied in input', async () => {
-    const dir = mkdtempSync(join(tmpdir(), 'host-shell-ignore-network-'));
-    testDirs.push(dir);
-
-    spawnCalls.length = 0;
-    wrapCommandCallCount = 0;
-
-    // Pass network_mode as if the model hallucinated the parameter —
-    // host_bash must ignore it and run the command normally.
-    const result = await hostShellTool.execute({
-      command: 'echo should-work',
-      working_dir: dir,
-      network_mode: 'proxied',
-    }, makeContext());
-
-    expect(result.isError).toBe(false);
-    expect(result.content.trim()).toBe('should-work');
-    // Must still spawn plain bash, not anything proxy-related
-    expect(spawnCalls.length).toBe(1);
-    expect(spawnCalls[0].command).toBe('bash');
-    // Must never route through sandbox wrapCommand, even with proxied-mode input
-    expect(wrapCommandCallCount).toBe(0);
-  });
-
-  test('execute ignores credential_ids even if supplied in input', async () => {
-    const dir = mkdtempSync(join(tmpdir(), 'host-shell-ignore-creds-'));
-    testDirs.push(dir);
-
-    spawnCalls.length = 0;
-    wrapCommandCallCount = 0;
-
-    const result = await hostShellTool.execute({
-      command: 'echo creds-ignored',
-      working_dir: dir,
-      credential_ids: ['gmail-oauth', 'github-token'],
-    }, makeContext());
-
-    expect(result.isError).toBe(false);
-    expect(result.content.trim()).toBe('creds-ignored');
-    expect(spawnCalls.length).toBe(1);
-    expect(spawnCalls[0].command).toBe('bash');
-    // Must never route through sandbox wrapCommand, even with credential inputs
-    expect(wrapCommandCallCount).toBe(0);
-  });
-
-  test('tool name is host_bash (not bash)', () => {
-    expect(definition.name).toBe('host_bash');
-  });
-
-  test('required fields contains command and reason', () => {
-    expect((definition.input_schema as Record<string, unknown>).required).toEqual(['command', 'reason']);
-  });
-});

package/src/__tests__/ingress-url-consistency.test.ts

@@ -1,214 +0,0 @@
-import { describe, test, expect, beforeEach, afterEach, mock } from 'bun:test';
-import { createHmac } from 'node:crypto';
-
-// ---------------------------------------------------------------------------
-// Mocks — silence logger output during tests
-// ---------------------------------------------------------------------------
-
-function makeLoggerStub(): Record<string, unknown> {
-  const stub: Record<string, unknown> = {};
-  for (const m of ['info', 'warn', 'error', 'debug', 'trace', 'fatal', 'silent', 'child']) {
-    stub[m] = m === 'child' ? () => makeLoggerStub() : () => {};
-  }
-  return stub;
-}
-
-mock.module('../util/logger.js', () => ({
-  getLogger: () => makeLoggerStub(),
-}));
-
-import {
-  getPublicBaseUrl,
-  getTwilioVoiceWebhookUrl,
-  getTwilioStatusCallbackUrl,
-  type IngressConfig,
-} from '../inbound/public-ingress-urls.js';
-
-// ---------------------------------------------------------------------------
-// Helpers — simulate Twilio signature validation the same way the gateway does
-// ---------------------------------------------------------------------------
-
-/**
- * Reproduce the gateway's canonical URL reconstruction logic from
- * gateway/src/twilio/validate-webhook.ts (lines 72-76).
- */
-function reconstructGatewayCanonicalUrl(
-  ingressPublicBaseUrl: string | undefined,
-  requestUrl: string,
-): string {
-  const parsedUrl = new URL(requestUrl);
-  if (ingressPublicBaseUrl) {
-    return ingressPublicBaseUrl.replace(/\/$/, '') + parsedUrl.pathname + parsedUrl.search;
-  }
-  return requestUrl;
-}
-
-/**
- * Reproduce Twilio's HMAC-SHA1 signature algorithm (same as
- * gateway/src/twilio/verify.ts).
- */
-function computeTwilioSignature(
-  url: string,
-  params: Record<string, string>,
-  authToken: string,
-): string {
-  const sortedKeys = Object.keys(params).sort();
-  let data = url;
-  for (const key of sortedKeys) {
-    data += key + params[key];
-  }
-  return createHmac('sha1', authToken).update(data).digest('base64');
-}
-
-// ---------------------------------------------------------------------------
-// Tests
-// ---------------------------------------------------------------------------
-
-describe('Ingress URL consistency between assistant and gateway', () => {
-  let savedIngressEnv: string | undefined;
-
-  beforeEach(() => {
-    savedIngressEnv = process.env.INGRESS_PUBLIC_BASE_URL;
-    delete process.env.INGRESS_PUBLIC_BASE_URL;
-  });
-
-  afterEach(() => {
-    if (savedIngressEnv !== undefined) {
-      process.env.INGRESS_PUBLIC_BASE_URL = savedIngressEnv;
-    } else {
-      delete process.env.INGRESS_PUBLIC_BASE_URL;
-    }
-  });
-
-  test('assistant callback URL and gateway signature reconstruction use same base when config is set', () => {
-    const config: IngressConfig = {
-      ingress: { publicBaseUrl: 'https://my-tunnel.ngrok.io' },
-    };
-
-    // What the assistant would generate as the Twilio voice webhook callback
-    const assistantCallbackUrl = getTwilioVoiceWebhookUrl(config, 'session-abc');
-
-    // Simulate: when hatch.ts spawns the gateway, it reads config.ingress.publicBaseUrl
-    // and passes it as INGRESS_PUBLIC_BASE_URL. The gateway stores this as
-    // config.ingressPublicBaseUrl.
-    const gatewayIngressPublicBaseUrl = getPublicBaseUrl(config);
-
-    // When Twilio calls the gateway, the gateway reconstructs the canonical URL
-    // from the inbound request URL (which is localhost) + the configured base.
-    const inboundRequestUrl = 'http://127.0.0.1:7830/webhooks/twilio/voice?callSessionId=session-abc';
-    const gatewayCanonicalUrl = reconstructGatewayCanonicalUrl(
-      gatewayIngressPublicBaseUrl,
-      inboundRequestUrl,
-    );
-
-    // Both must resolve to the same URL for Twilio signatures to validate
-    expect(gatewayCanonicalUrl).toBe(assistantCallbackUrl);
-  });
-
-  test('Twilio signature computed against assistant URL validates at gateway', () => {
-    const publicBase = 'https://my-tunnel.ngrok.io';
-    const authToken = 'test-twilio-auth-token-12345';
-    const config: IngressConfig = {
-      ingress: { publicBaseUrl: publicBase },
-    };
-
-    // Assistant generates the callback URL and registers it with Twilio
-    const callbackUrl = getTwilioStatusCallbackUrl(config);
-    expect(callbackUrl).toBe('https://my-tunnel.ngrok.io/webhooks/twilio/status');
-
-    // Twilio signs the request using the callback URL
-    const params = { CallSid: 'CA123', CallStatus: 'completed' };
-    const twilioSignature = computeTwilioSignature(callbackUrl, params, authToken);
-
-    // Gateway receives the request on its local address
-    const localRequestUrl = 'http://127.0.0.1:7830/webhooks/twilio/status';
-
-    // Gateway reconstructs the canonical URL using its configured base
-    // (which was passed from the assistant's config via INGRESS_PUBLIC_BASE_URL)
-    const gatewayIngressPublicBaseUrl = getPublicBaseUrl(config);
-    const canonicalUrl = reconstructGatewayCanonicalUrl(
-      gatewayIngressPublicBaseUrl,
-      localRequestUrl,
-    );
-
-    // Verify the signature matches
-    const recomputedSignature = computeTwilioSignature(canonicalUrl, params, authToken);
-    expect(recomputedSignature).toBe(twilioSignature);
-  });
-
-  test('mismatch scenario: gateway without config creates signature validation failure', () => {
-    const authToken = 'test-twilio-auth-token-12345';
-
-    // Assistant uses config-based URL
-    const assistantConfig: IngressConfig = {
-      ingress: { publicBaseUrl: 'https://my-tunnel.ngrok.io' },
-    };
-    const callbackUrl = getTwilioStatusCallbackUrl(assistantConfig);
-
-    // Twilio signs against the callback URL the assistant registered
-    const params = { CallSid: 'CA123', CallStatus: 'completed' };
-    const twilioSignature = computeTwilioSignature(callbackUrl, params, authToken);
-
-    // Gateway does NOT have the ingress URL configured (simulating the bug)
-    const localRequestUrl = 'http://127.0.0.1:7830/webhooks/twilio/status';
-    const canonicalUrlWithout = reconstructGatewayCanonicalUrl(undefined, localRequestUrl);
-
-    // Signature should NOT match — this proves the mismatch bug
-    const recomputedWithout = computeTwilioSignature(canonicalUrlWithout, params, authToken);
-    expect(recomputedWithout).not.toBe(twilioSignature);
-
-    // Now simulate the fix: gateway has the same ingress URL
-    const canonicalUrlWith = reconstructGatewayCanonicalUrl(
-      'https://my-tunnel.ngrok.io',
-      localRequestUrl,
-    );
-    const recomputedWith = computeTwilioSignature(canonicalUrlWith, params, authToken);
-    expect(recomputedWith).toBe(twilioSignature);
-  });
-
-  test('env var fallback produces consistent URLs across assistant and gateway', () => {
-    // When no config.ingress.publicBaseUrl is set, both assistant and gateway
-    // fall back to the INGRESS_PUBLIC_BASE_URL env var.
-    process.env.INGRESS_PUBLIC_BASE_URL = 'https://env-tunnel.example.com';
-
-    const config: IngressConfig = {};
-
-    // Assistant resolves the base URL from env
-    const assistantBase = getPublicBaseUrl(config);
-    expect(assistantBase).toBe('https://env-tunnel.example.com');
-
-    // Gateway would also read the same env var (process.env.INGRESS_PUBLIC_BASE_URL)
-    // and store it as config.ingressPublicBaseUrl.
-    const gatewayIngressPublicBaseUrl = process.env.INGRESS_PUBLIC_BASE_URL;
-
-    // Callback URL generated by assistant
-    const callbackUrl = getTwilioVoiceWebhookUrl(config, 'session-xyz');
-
-    // Gateway canonical URL reconstruction
-    const localUrl = 'http://127.0.0.1:7830/webhooks/twilio/voice?callSessionId=session-xyz';
-    const gatewayCanonical = reconstructGatewayCanonicalUrl(
-      gatewayIngressPublicBaseUrl,
-      localUrl,
-    );
-
-    expect(gatewayCanonical).toBe(callbackUrl);
-  });
-
-  test('trailing slashes are normalized consistently', () => {
-    const config: IngressConfig = {
-      ingress: { publicBaseUrl: 'https://my-tunnel.ngrok.io///' },
-    };
-
-    const assistantBase = getPublicBaseUrl(config);
-    expect(assistantBase).toBe('https://my-tunnel.ngrok.io');
-
-    const callbackUrl = getTwilioVoiceWebhookUrl(config, 'session-1');
-
-    // Gateway would receive the normalized value (hatch.ts trims trailing slashes)
-    const gatewayBase = 'https://my-tunnel.ngrok.io';
-    const localUrl = 'http://127.0.0.1:7830/webhooks/twilio/voice?callSessionId=session-1';
-    const gatewayCanonical = reconstructGatewayCanonicalUrl(gatewayBase, localUrl);
-
-    expect(gatewayCanonical).toBe(callbackUrl);
-  });
-});