feat(yerin): global security chat endpoint /api/security/yerin

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/api/security_yerin.test.js

@@ -0,0 +1,39 @@
+import { describe, it, expect, beforeAll } from 'vitest';
+import { fileURLToPath } from 'url';
+import request from 'supertest';
+import { pool } from '../../lib/db/pool.js';
+import { createApp } from '../../server.js';
+import { resetDb } from '../helpers/db.js';
+import { migrateUp } from '../../lib/db/migrate.js';
+
+const FAKE = fileURLToPath(new URL('../fixtures/fake-claude-security.js', import.meta.url));
+let app;
+beforeAll(async () => {
+  await resetDb(); await migrateUp();
+  process.env.OWNER_TOKEN = 'test-token';
+  app = createApp();
+  app.locals.claudeExe = FAKE;
+});
+const auth = (r) => r.set('Authorization', 'Bearer test-token');
+
+describe('Yerin security API', () => {
+  it('GET creates the global conversation and returns Yerin + empty history', async () => {
+    const res = await auth(request(app).get('/api/security/yerin'));
+    expect(res.status).toBe(200);
+    expect(res.body.agent.slug).toBe('yerin');
+    expect(res.body.conversation_id).toBeTruthy();
+    expect(res.body.messages).toEqual([]);
+  });
+  it('POST /turn streams SSE and persists user+assistant; no draft event', async () => {
+    const res = await auth(request(app).post('/api/security/yerin/turn')).send({ text: 'any new threats?' });
+    expect(res.status).toBe(200);
+    expect(res.headers['content-type']).toMatch(/text\/event-stream/);
+    expect(res.text).toMatch(/event: delta/);
+    expect(res.text).toMatch(/event: tool/);
+    expect(res.text).toMatch(/event: done/);
+    expect(res.text).not.toMatch(/event: draft/);
+    const { rows: msgs } = await pool.query(`SELECT role, body FROM messages ORDER BY created_at`);
+    expect(msgs.map(m => m.role)).toEqual(['user', 'assistant']);
+    expect(msgs[1].body).toBe('No new threats.');
+  });
+});

tests/fixtures/fake-claude-security.js

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+// Fake claude CLI for the Yerin security route test. Emits text deltas + one
+// security tool call (mcp__void__audit_log) + a result. No propose_change/draft.
+const TOOL_USE_ID = 'toolu_yerin_01';
+const lines = [
+  { type: 'system', subtype: 'init', session_id: 'fake-yerin', tools: [], cwd: '/tmp' },
+  { type: 'stream_event', event: { type: 'content_block_start', index: 0, content_block: { type: 'text', text: '' } } },
+  { type: 'stream_event', event: { type: 'content_block_delta', index: 0, delta: { type: 'text_delta', text: 'No new threats.' } } },
+  { type: 'stream_event', event: { type: 'content_block_stop', index: 0 } },
+  { type: 'stream_event', event: { type: 'content_block_start', index: 1, content_block: { type: 'tool_use', id: TOOL_USE_ID, name: 'mcp__void__audit_log', input: {} } } },
+  { type: 'stream_event', event: { type: 'content_block_stop', index: 1 } },
+  { type: 'tool_result', tool_use_id: TOOL_USE_ID, content: [{ type: 'text', text: JSON.stringify({ entries: [] }) }] },
+  { type: 'result', subtype: 'success', is_error: false, result: 'No new threats.', stop_reason: 'end_turn', session_id: 'fake-yerin', total_cost_usd: 0.0001, usage: { input_tokens: 40, output_tokens: 4 } }
+];
+for (const l of lines) process.stdout.write(JSON.stringify(l) + '\n');
+process.exit(0);