From 2e42b8efce546f998e7335574ce88851600e9c33 Mon Sep 17 00:00:00 2001 From: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com> Date: Tue, 14 Jul 2026 15:40:09 -0300 Subject: [PATCH] fix(tests+providers): env-dependent tests exposed by GH-hosted runners (#6634 selfref shallow checkout + yuanbao live-network 401) (#7174) * fix(tests): #6634 selfref test tolerates shallow checkouts (fetch origin/main on demand, skip offline) * fix(providers): yuanbao cookie validation rejects foreign pairs locally (was a hidden live-network test dependency) --- changelog.d/fixes/yuanbao-cookie-validation.md | 1 + changelog.d/maintenance/selfref-6634-shallow.md | 1 + open-sse/executors/yuanbao-web.ts | 9 +++++++-- .../check-test-masking-selfref-6634.test.ts | 17 +++++++++++++++-- tests/unit/providers-yuanbao-web.test.ts | 8 ++++++++ 5 files changed, 32 insertions(+), 4 deletions(-) create mode 100644 changelog.d/fixes/yuanbao-cookie-validation.md create mode 100644 changelog.d/maintenance/selfref-6634-shallow.md diff --git a/changelog.d/fixes/yuanbao-cookie-validation.md b/changelog.d/fixes/yuanbao-cookie-validation.md new file mode 100644 index 0000000000..eb91b6edba --- /dev/null +++ b/changelog.d/fixes/yuanbao-cookie-validation.md @@ -0,0 +1 @@ +- **Providers**: yuanbao-web no longer forwards a foreign single cookie pair upstream — `buildYuanbaoCookie` only trusts `hy_user`/`hy_token` extractions the input explicitly names, so a missing session token now fails fast with the local 401 guidance instead of a live Tencent round-trip diff --git a/changelog.d/maintenance/selfref-6634-shallow.md b/changelog.d/maintenance/selfref-6634-shallow.md new file mode 100644 index 0000000000..6f0c1b345a --- /dev/null +++ b/changelog.d/maintenance/selfref-6634-shallow.md @@ -0,0 +1 @@ +- **Tests**: the #6634 self-reference test now fetches `origin/main` on demand and skips cleanly when the ref is unreachable — it failed as a false positive on shallow/single-ref checkouts (GitHub-hosted runners) diff --git a/open-sse/executors/yuanbao-web.ts b/open-sse/executors/yuanbao-web.ts index 20ef5662e0..75a3d2c615 100644 --- a/open-sse/executors/yuanbao-web.ts +++ b/open-sse/executors/yuanbao-web.ts @@ -106,8 +106,13 @@ function buildPrompt(messages: Array>): string { /** Build the `hy_source=web; hy_user=...; hy_token=...` cookie from the pasted header. */ function buildYuanbaoCookie(rawApiKey: string): { cookie: string; hasToken: boolean } { const raw = stripCookieInputPrefix(rawApiKey || ""); - const hyUser = extractCookieValue(raw, "hy_user"); - const hyToken = extractCookieValue(raw, "hy_token"); + // Guard the extractCookieValue bare-value fallback: for input that is a single + // FOREIGN pair (e.g. "some_other=abc") the helper returns the whole string, which + // used to fool this validation into forwarding garbage upstream (the request only + // failed when Tencent replied 401 — a live-network dependency). Yuanbao needs the + // two distinct cookies, so only trust an extraction the input explicitly names. + const hyUser = raw.includes("hy_user=") ? extractCookieValue(raw, "hy_user") : null; + const hyToken = raw.includes("hy_token=") ? extractCookieValue(raw, "hy_token") : null; if (hyUser && hyToken) { return { cookie: `hy_source=web; hy_user=${hyUser}; hy_token=${hyToken}`, hasToken: true }; diff --git a/tests/unit/check-test-masking-selfref-6634.test.ts b/tests/unit/check-test-masking-selfref-6634.test.ts index 6d91a2e7c2..97171e07ba 100644 --- a/tests/unit/check-test-masking-selfref-6634.test.ts +++ b/tests/unit/check-test-masking-selfref-6634.test.ts @@ -33,10 +33,23 @@ function git(args: string[]): string { return execFileSync("git", args, { encoding: "utf8" }); } -test("#6634: check-test-masking.test.ts's own tautology fixtures must not self-flag as weakening", () => { +test("#6634: check-test-masking.test.ts's own tautology fixtures must not self-flag as weakening", (t) => { // origin/main predates the #6404 fixtures (countBareTautologies/scanBareTautologies // tests) that legitimately embed tautology-pattern literals as string fixtures. - const baseSrc = git(["show", "origin/main:" + FILE]); + // Shallow/single-ref checkouts (GitHub-hosted runners) have no origin/main — + // fetch it on demand; skip (never fail) when the ref is unreachable offline. + let baseSrc: string; + try { + baseSrc = git(["show", "origin/main:" + FILE]); + } catch { + try { + git(["fetch", "--depth=1", "origin", "main"]); + baseSrc = git(["show", "origin/main:" + FILE]); + } catch { + t.skip("origin/main unavailable (shallow checkout, offline) — nothing to compare against"); + return; + } + } const headSrc = git(["show", "HEAD:" + FILE]); const perFile = [ diff --git a/tests/unit/providers-yuanbao-web.test.ts b/tests/unit/providers-yuanbao-web.test.ts index 2feab63371..48477c83d4 100644 --- a/tests/unit/providers-yuanbao-web.test.ts +++ b/tests/unit/providers-yuanbao-web.test.ts @@ -71,6 +71,13 @@ async function readStreamText(res: Response): Promise { } test("missing hy_token cookie returns a 401 auth error", async () => { + // Hermetic: the 401 must come from the executor's own cookie validation, never + // from the real upstream — on GitHub-hosted runners the Tencent endpoint is + // unreachable and a live call turns this into a 71s 502 false-negative. + const original = globalThis.fetch; + globalThis.fetch = (async () => { + throw new Error("network disabled in this test — executor must reject before fetching"); + }) as typeof fetch; const exec = new YuanbaoWebExecutor(); const { response } = await exec.execute({ model: "deepseek-v3", @@ -84,6 +91,7 @@ test("missing hy_token cookie returns a 401 auth error", async () => { assert.match(body.error.message, /hy_user|hy_token|session cookie/); // Never leak stack traces. assert.ok(!body.error.message.includes("at /")); + globalThis.fetch = original; }); test("streaming request translates think/text events into OpenAI chunks", async () => {