v2.9.6 (#682)

Co-authored-by: Clément Drouin <clement.drouin@mistral.ai>
Co-authored-by: Michel Thomazo <51709227+michelTho@users.noreply.github.com>
Co-authored-by: Pierre Rossinès <pierre.rossines@mistral.ai>
Co-authored-by: Mistral Vibe <vibe@mistral.ai>

tests/core/test_build_ssl_context.py

@@ -0,0 +1,78 @@
+from __future__ import annotations
+
+import ssl
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from vibe.core.utils.http import build_ssl_context
+
+
+@pytest.fixture(autouse=True)
+def _clear_ssl_cache():
+    build_ssl_context.cache_clear()
+    yield
+    build_ssl_context.cache_clear()
+
+
+def test_build_ssl_context_returns_ssl_context():
+    ctx = build_ssl_context()
+    assert isinstance(ctx, ssl.SSLContext)
+
+
+def test_build_ssl_context_loads_custom_cert_file(monkeypatch, tmp_path):
+    cert_file = tmp_path / "custom.pem"
+    cert_file.write_text("dummy")
+    monkeypatch.setenv("SSL_CERT_FILE", str(cert_file))
+    monkeypatch.delenv("SSL_CERT_DIR", raising=False)
+
+    mock_ctx = MagicMock(spec=ssl.SSLContext)
+    with patch(
+        "vibe.core.utils.http.ssl.create_default_context", return_value=mock_ctx
+    ):
+        build_ssl_context()
+
+    mock_ctx.load_verify_locations.assert_called_once_with(
+        cafile=str(cert_file), capath=None
+    )
+
+
+def test_build_ssl_context_loads_custom_cert_dir(monkeypatch, tmp_path):
+    cert_dir = tmp_path / "certs"
+    cert_dir.mkdir()
+    monkeypatch.delenv("SSL_CERT_FILE", raising=False)
+    monkeypatch.setenv("SSL_CERT_DIR", str(cert_dir))
+
+    mock_ctx = MagicMock(spec=ssl.SSLContext)
+    with patch(
+        "vibe.core.utils.http.ssl.create_default_context", return_value=mock_ctx
+    ):
+        build_ssl_context()
+
+    mock_ctx.load_verify_locations.assert_called_once_with(
+        cafile=None, capath=str(cert_dir)
+    )
+
+
+def test_build_ssl_context_warns_on_invalid_cert(monkeypatch, caplog):
+    monkeypatch.setenv("SSL_CERT_FILE", "/nonexistent/path/cert.pem")
+    monkeypatch.delenv("SSL_CERT_DIR", raising=False)
+
+    ctx = build_ssl_context()
+    assert isinstance(ctx, ssl.SSLContext)
+    assert any(
+        "Failed to load custom SSL certificates" in r.message for r in caplog.records
+    )
+
+
+def test_build_ssl_context_no_custom_certs(monkeypatch):
+    monkeypatch.delenv("SSL_CERT_FILE", raising=False)
+    monkeypatch.delenv("SSL_CERT_DIR", raising=False)
+
+    mock_ctx = MagicMock(spec=ssl.SSLContext)
+    with patch(
+        "vibe.core.utils.http.ssl.create_default_context", return_value=mock_ctx
+    ):
+        build_ssl_context()
+
+    mock_ctx.load_verify_locations.assert_not_called()

tests/core/test_config_resolution.py

@@ -293,6 +293,68 @@ class TestMigrateLeavesFindInBashAllowlist:
         assert "tools" not in result
 
 
+class TestMigrateStripsBashAllowlistWildcardSuffix:
+    def test_strips_trailing_wildcard_from_bash_allowlist_entries(
+        self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        monkeypatch.setenv("VIBE_HOME", str(tmp_path))
+        config_file = tmp_path / "config.toml"
+        data = {
+            "tools": {"bash": {"allowlist": ["git commit *", "npm install *", "echo"]}}
+        }
+        with config_file.open("wb") as f:
+            tomli_w.dump(data, f)
+
+        reset_harness_files_manager()
+        init_harness_files_manager("user")
+        VibeConfig._migrate()
+
+        with config_file.open("rb") as f:
+            result = tomllib.load(f)
+        assert result["tools"]["bash"]["allowlist"] == [
+            "echo",
+            "find",
+            "git commit",
+            "npm install",
+        ]
+
+    def test_dedupes_when_stripping_collides_with_existing_entry(
+        self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        monkeypatch.setenv("VIBE_HOME", str(tmp_path))
+        config_file = tmp_path / "config.toml"
+        data = {
+            "tools": {"bash": {"allowlist": ["git commit *", "git commit", "find"]}}
+        }
+        with config_file.open("wb") as f:
+            tomli_w.dump(data, f)
+
+        reset_harness_files_manager()
+        init_harness_files_manager("user")
+        VibeConfig._migrate()
+
+        with config_file.open("rb") as f:
+            result = tomllib.load(f)
+        assert result["tools"]["bash"]["allowlist"] == ["find", "git commit"]
+
+    def test_noop_when_no_wildcard_suffix_present(
+        self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        monkeypatch.setenv("VIBE_HOME", str(tmp_path))
+        config_file = tmp_path / "config.toml"
+        data = {"tools": {"bash": {"allowlist": ["echo", "find", "ls"]}}}
+        with config_file.open("wb") as f:
+            tomli_w.dump(data, f)
+
+        reset_harness_files_manager()
+        init_harness_files_manager("user")
+        VibeConfig._migrate()
+
+        with config_file.open("rb") as f:
+            result = tomllib.load(f)
+        assert result["tools"]["bash"]["allowlist"] == ["echo", "find", "ls"]
+
+
 class TestMigrateMistralVibeCliLatestDefaults:
     def test_updates_alias_temperature_and_thinking_for_default_model(
         self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch