diff --git a/.env.example b/.env.example index 60b5074e6e..4a0198dc28 100644 --- a/.env.example +++ b/.env.example @@ -505,7 +505,9 @@ NEXT_PUBLIC_CLOUD_URL= #OMNIROUTE_CROF_USAGE_URL=https://crof.ai/usage_api/ #OMNIROUTE_CODEWHISPERER_BASE_URL=https://codewhisperer.us-east-1.amazonaws.com #OMNIROUTE_OPENCODE_QUOTA_URL=https://opencode.ai/zen/go/v1/quota -#OMNIROUTE_OPENCODE_GO_QUOTA_URL=https://api.z.ai/api/monitor/usage/quota/limit +# OpenCode Go has no public quota API — this has no default and stays +# unset unless you explicitly opt in to a self-hosted/mirrored endpoint: +#OMNIROUTE_OPENCODE_GO_QUOTA_URL= #OMNIROUTE_OPENCODE_GO_DASHBOARD_URL=https://opencode.ai/workspace #OMNIROUTE_OLLAMA_CLOUD_USAGE_URL=https://ollama.com/settings diff --git a/.env.homolog.example b/.env.homolog.example new file mode 100644 index 0000000000..03920a7707 --- /dev/null +++ b/.env.homolog.example @@ -0,0 +1,9 @@ +# Homologação E2E real — copie para .env.homolog (NUNCA commitar o real) +HOMOLOG_BASE_URL=http://192.168.0.15:20128 +# Senha de management do dashboard da VPS (a mesma do /login) +HOMOLOG_ADMIN_PASSWORD= +# Deixe vazio: a suíte cria uma API key efêmera via admin e revoga no fim. +# Só preencha para depurar uma camada isolada com uma key fixa. +HOMOLOG_API_KEY= +# Tier crítico (chat real, max_tokens=5). Demais providers: só validação de catálogo. +HOMOLOG_CRITICAL_PROVIDERS=openai,anthropic,gemini,codex,grok,glm,deepseek,openrouter diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2cdbc4dbd3..df99b771ae 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -33,6 +33,7 @@ jobs: docs: ${{ steps.classify.outputs.docs }} i18n: ${{ steps.classify.outputs.i18n }} workflow: ${{ steps.classify.outputs.workflow }} + testsOnly: ${{ steps.classify.outputs.testsOnly }} steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 with: @@ -124,11 +125,23 @@ jobs: - run: npm run check:route-guard-membership - run: npm run check:test-discovery - run: npm run check:tracked-artifacts + # WS1.7 (v3.8.49 plan): Dockerfile lint (hadolint, pinned by digest). + # failure-threshold=error keeps the 5 pre-existing warnings (DL3008/DL3003/ + # DL3016 version pinning / WORKDIR) visible without blocking; any ERROR fails. + - name: hadolint (Dockerfile) + run: docker run --rm -i hadolint/hadolint@sha256:27086352fd5e1907ea2b934eb1023f217c5ae087992eb59fde121dce9c9ff21e hadolint --failure-threshold error - < Dockerfile - run: npm run check:lockfile - run: npm run check:licenses # check:docs-sync is run by the docs-sync-strict job (via check:docs-all) and the # husky pre-commit hook; the standalone copy here was redundant (ROI dedup). - run: npm run typecheck:core + # #7033: typecheck:core's curated file allowlist does not cover + # src/app/(dashboard) TSX (and next.config.mjs sets ignoreBuildErrors: + # true, so `next build` never type-checks it either) — orphaned + # identifiers there (see #6625/#6909) were invisible to CI. This gate + # runs tsc scoped to the dashboard tree against a frozen baseline of + # pre-existing errors; only NEW errors fail it. + - run: npm run check:dashboard-typecheck # typecheck:noimplicit:core dropped from this job (2026-07 optimize): # it was advisory (continue-on-error) and largely subsumed by the blocking # check:type-coverage ratchet in quality-gate. Local: npm run typecheck:noimplicit:core. @@ -148,7 +161,7 @@ jobs: # The coverage.* metrics degrade gracefully: the download is continue-on-error and # the ratchet runs with --allow-missing, so absent coverage is skipped, not failed. # Path filter: code-only — pure docs/i18n PRs have nothing for these ratchets to guard. - if: ${{ !cancelled() && (github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true' && (needs.lint.result == 'success' || needs.lint.result == 'failure'))) }} + if: ${{ !cancelled() && !contains(github.event.pull_request.labels.*.name, 'hotfix') && (github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true' && (needs.lint.result == 'success' || needs.lint.result == 'failure'))) }} # security-events: read lets the CodeQL ratchet read open code-scanning alerts # via `gh api .../code-scanning/alerts`. contents: read keeps checkout working. permissions: @@ -258,7 +271,7 @@ jobs: # P3 (plano mestre): a release-PR viva fica DRAFT o ciclo inteiro — jobs pesados pulam # drafts (ciclo v3.8.44: 123 runs pesados re-disparados por merges na release, 88 cancelados). # Path filter: code-only (scanners/ratchets target production surface). - if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true') }} + if: ${{ !contains(github.event.pull_request.labels.*.name, 'hotfix') && (github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true')) }} steps: # fetch-depth: 0 — the OpenAPI breaking-change gate (oasdiff) reads the base # spec via `git show :docs/openapi.yaml`; a shallow clone @@ -609,12 +622,26 @@ jobs: - name: Assert dist/server.js exists run: test -f dist/server.js || (echo "dist/server.js missing — build:cli did not assemble correctly" && exit 1) - run: npm run check:pack-artifact + # WS1.2 (#7065 class): pack the real tarball, install it into a clean prefix and + # BOOT it to a healthy /api/monitoring/health — the gate that structure checks + # cannot provide (3 releases shipped boot-crashing tarballs with green lists). + - name: Boot-smoke the packed tarball + run: npm run check:pack-boot electron-package-smoke: - name: Electron Package Smoke - runs-on: ubuntu-latest - timeout-minutes: 25 + name: Electron Package Smoke (${{ matrix.os }}) + runs-on: ${{ matrix.os }} + timeout-minutes: 30 needs: build + # WS1.5 (v3.8.49 plan): the Electron rebuild/spawn path previously executed for + # the FIRST time on the release tag — the v3.8.48 Windows bug (npx.cmd spawned + # without shell, CVE-2024-27980 behavior change) could only surface at release. + # windows-latest runs prepare:bundle (the ABI rebuild + spawn plan) per release + # PR; ubuntu keeps the full pack + headless smoke. + strategy: + fail-fast: false + matrix: + os: [ubuntu-latest, windows-latest] env: JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation CSC_IDENTITY_AUTO_DISCOVERY: "false" @@ -640,9 +667,15 @@ jobs: working-directory: electron run: npm install --no-audit --no-fund - name: Pack Electron app + if: runner.os == 'Linux' working-directory: electron run: npm run pack + - name: Prepare Electron standalone (Windows ABI rebuild + spawn path) + if: runner.os == 'Windows' + working-directory: electron + run: npm run prepare:bundle - name: Smoke packaged Electron app + if: runner.os == 'Linux' env: ELECTRON_SMOKE_TIMEOUT_MS: 60000 run: xvfb-run -a npm run electron:smoke:packaged @@ -725,12 +758,23 @@ jobs: - uses: ./.github/actions/npm-ci-retry # The second test runner (CLAUDE.md: "Both test runners must pass") — was never # wired into CI until the 2026-06-09 quality audit (Fase 6A.2). - - run: npm run test:vitest - # vitest:ui is RED today (14 fails — UI component drift accumulated while the - # suite never ran in CI). Informational until the Fase 6A triage (2026-06-16+) - # fixes the components/tests; then drop continue-on-error to make it blocking. - - run: npm run test:vitest:ui + # WS5.2/5.3 (v3.8.49 plan): JUnit output feeds Trunk Flaky Tests (advisory upload + # below). node:test stays OUT of the first wave (fd1-sensitive reporter stream). + - run: npm run test:vitest -- --reporter=default --reporter=junit --outputFile.junit=trunk-junit/vitest-mcp.xml + # vitest:ui went back to 870/870 green in the v3.8.49 quality plan (WS6.1, + # PR #7127 — 69 fails triaged: matchMedia polyfill, node:test→vitest migration, + # CompareTab D22 cap). Promoted to BLOCKING per the plan's post-merge step. + - run: npm run test:vitest:ui -- --reporter=default --reporter=junit --outputFile.junit=trunk-junit/vitest-ui.xml + # Trunk Flaky Tests upload — advisory (never blocks), own-origin only (fork PRs + # have no TRUNK_TOKEN). Pinned by SHA (tag v2.1.2). + - name: Upload test results to Trunk (advisory) + if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }} continue-on-error: true + uses: trunk-io/analytics-uploader@385f1ccdf345b4532dc4b6c665dd432b702b8e28 # v2.1.2 + with: + junit-paths: trunk-junit/**/*.xml + org-slug: omniroute + token: ${{ secrets.TRUNK_TOKEN }} # Node 24/26 compatibility matrices moved to .github/workflows/nightly-compat.yml # (plano mestre testes+CI, Eixo D2 — they cost ~28% of every heavy run to catch a @@ -741,7 +785,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 needs: test-unit - if: ${{ !cancelled() && needs.test-unit.result == 'success' }} + if: ${{ !cancelled() && needs.test-unit.result == 'success' && !contains(github.event.pull_request.labels.*.name, 'hotfix') }} env: JWT_SECRET: ci-test-secret-with-sufficient-length-for-validation API_KEY_SECRET: ci-test-api-key-secret-long @@ -789,6 +833,7 @@ jobs: --merge-async \ --reporter=text-summary \ --reporter=json-summary \ + --reporter=lcov \ --exclude=tests/** \ --exclude=**/*.test.* \ --check-coverage \ @@ -810,6 +855,18 @@ jobs: > coverage/coverage-report.md fi cat coverage/coverage-report.md >> "$GITHUB_STEP_SUMMARY" + # WS5.6 (D7, v3.8.49 plan): patch coverage on the PR diff via Codecov — + # informational during calibration (codecov.yml sets informational: true); + # promote to blocking only after ~2 weeks without false blocks. The lcov + # reporter above also fixes coverage/lcov.info being silently absent + # (if-no-files-found: warn) — Sonar consumes the same file. + - name: Upload coverage to Codecov (informational) + if: always() + uses: codecov/codecov-action@04b047e8bb82a0c002c8312c1c880fbc6a999d45 # v5 + with: + files: coverage/lcov.info + token: ${{ secrets.CODECOV_TOKEN }} + fail_ci_if_error: false - name: Upload coverage artifacts if: always() uses: actions/upload-artifact@v7 @@ -834,10 +891,14 @@ jobs: with: persist-credentials: false fetch-depth: 0 + # The upload strips the common `coverage/` prefix, so the artifact root holds + # lcov.info directly — download into coverage/ so it lands at coverage/lcov.info, + # where sonar.javascript.lcov.reportPaths expects it (path: . left the Sonar + # new-code coverage at 0% every scan). - uses: actions/download-artifact@v8 with: name: coverage-report - path: . + path: coverage/ - name: Explain SonarQube skip if: ${{ github.event_name != 'pull_request' || env.SONAR_TOKEN == '' || env.SONAR_HOST_URL == '' }} run: | @@ -956,7 +1017,12 @@ jobs: # ~33%. Playwright browser is cached across runs (~1.5min saved per shard). # Heavy shard target: ≤20min (was ~40min). Timeout 45min to cover slow runners. timeout-minutes: 45 - needs: build + needs: [build, changes] + # WS3.1 hotfix fast-lane: the 9-shard E2E matrix is the CI critical path (~25min). + # It skips for (a) PRs labeled `hotfix` (entry policy in docs/ops/RELEASE_CHECKLIST.md: + # production-broken only, full-suite evidence from the previous green run linked in the + # PR) and (b) tests-only diffs outside tests/e2e/ (cannot change the served app). + if: ${{ needs.changes.outputs.testsOnly != 'true' && !contains(github.event.pull_request.labels.*.name, 'hotfix') }} strategy: fail-fast: false matrix: @@ -991,7 +1057,33 @@ jobs: - name: Extract Next.js build artifact run: | tar -xzf /tmp/e2e-build.tar.gz - - run: npx playwright test tests/e2e/*.spec.ts --shard=${{ matrix.shard }}/9 + # WS4.1: duration-balanced shards (LPT over config/quality/e2e-timings.json). + # Measured skew of plain --shard was 14× (24m47s vs 1m47s) — E2E was the CI + # critical path. The balancer self-verifies completeness and exits non-zero on + # any inconsistency, falling back to plain --shard (never fewer specs). + - name: Run E2E tests (duration-balanced shard) + env: + SHARD: ${{ matrix.shard }} + PLAYWRIGHT_JUNIT_OUTPUT_NAME: junit-e2e-results.xml + run: | + if FILES=$(node scripts/quality/balance-e2e-shards.mjs "$SHARD" 9); then + if [ -z "$FILES" ]; then echo "[e2e-balance] shard $SHARD has no files"; exit 0; fi + echo "[e2e-balance] shard $SHARD runs:"; echo "$FILES" + # shellcheck disable=SC2086 — FILES is our own newline-separated path list + npx playwright test $(echo "$FILES" | tr '\n' ' ') --reporter=line,junit + else + echo "[e2e-balance] balancer unavailable — plain --shard fallback" + npx playwright test tests/e2e/*.spec.ts --shard="$SHARD"/9 --reporter=line,junit + fi + # WS5.2/5.3: Trunk Flaky Tests upload — advisory, own-origin only, SHA-pinned. + - name: Upload test results to Trunk (advisory) + if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }} + continue-on-error: true + uses: trunk-io/analytics-uploader@385f1ccdf345b4532dc4b6c665dd432b702b8e28 # v2.1.2 + with: + junit-paths: junit-e2e-results.xml + org-slug: omniroute + token: ${{ secrets.TRUNK_TOKEN }} test-integration: name: Integration Tests (${{ matrix.shard }}/2) diff --git a/.github/workflows/dast-smoke.yml b/.github/workflows/dast-smoke.yml index 5d8676cea7..e1b5c757e5 100644 --- a/.github/workflows/dast-smoke.yml +++ b/.github/workflows/dast-smoke.yml @@ -10,7 +10,10 @@ jobs: # ADVISORY while this new gate matures (repo convention: advisory -> blocking). # Flip to blocking (remove continue-on-error) once it's proven stable across a few PRs. continue-on-error: true - timeout-minutes: 12 + # Build CLI bundle alone varies 6-11min on GitHub-hosted runners (3 consecutive + # timeouts observed on 2026-07-14 with the old 12min cap killing schemathesis + # mid-run) — 25min leaves real headroom for the actual DAST steps. + timeout-minutes: 25 env: JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation API_KEY_SECRET: ci-api-key-secret-with-sufficient-length-aaaa diff --git a/.github/workflows/nightly-release-green.yml b/.github/workflows/nightly-release-green.yml index 0ba8e9301d..9d1d20b565 100644 --- a/.github/workflows/nightly-release-green.yml +++ b/.github/workflows/nightly-release-green.yml @@ -1,11 +1,18 @@ -name: Nightly Release-Green +name: Release-Green (continuous) # Solution D — continuous, NON-BLOCKING drift signal for the active release branch. # # WHY: the full gate (ci.yml) only runs on the release PR (PR → main), so reds # accrue silently on release/** and explode — in layers — at release time. This -# nightly reproduces the release-equivalent validation on the active release branch -# HEAD and, when there are HARD failures, opens/updates a single tracking issue. +# workflow reproduces the release-equivalent validation on the release branch and, +# when there are HARD failures, opens/updates a single tracking issue. +# +# WS5.1 (v3.8.49 quality plan) — two modes: +# push to release/v* (code paths) → --quick (fast HARD gates, ~5-8min). Catches the +# captain's direct pushes (sync-back — the one ungated write path) AND the merged +# COMBINATION right after every PR merge, attributing the offending push range in +# the issue. Base-red MTTD drops from ≤24h to ≤~15min after the offending push. +# schedule (3×/day) → full --with-build --full-ci (the deep sweep incl. build+suites). # # It is NOT a required status check and never touches a contributor PR — it only # reports. Ratchet drift (eslint warnings / cognitive-complexity / file-size) is @@ -14,8 +21,23 @@ name: Nightly Release-Green # package-artifact) flip the issue open. on: + push: + branches: ["release/v*"] + paths: + - "src/**" + - "open-sse/**" + - "bin/**" + - "electron/**" + - "scripts/**" + - "tests/**" + - "config/**" + - "package.json" + - "package-lock.json" + - "tsconfig*.json" schedule: - - cron: "23 5 * * *" # 05:23 UTC daily — off-peak, distinct from other nightlies + - cron: "23 5 * * *" # full sweep — off-peak, distinct from other nightlies + - cron: "23 12 * * *" # full sweep — midday (WS5.1: 3×/day instead of 1×) + - cron: "23 18 * * *" # full sweep — evening workflow_dispatch: inputs: branch: @@ -28,7 +50,9 @@ permissions: issues: write concurrency: - group: nightly-release-green + # push storms during merge campaigns collapse to the newest commit per branch; + # scheduled full sweeps keep their own single lane. + group: release-green-${{ github.event_name }}-${{ github.ref }} cancel-in-progress: true env: @@ -56,10 +80,15 @@ jobs: id: branch env: INPUT_BRANCH: ${{ github.event.inputs.branch }} + EVENT_NAME: ${{ github.event_name }} + PUSHED_REF: ${{ github.ref_name }} run: | set -euo pipefail if [ -n "${INPUT_BRANCH:-}" ]; then TARGET="$INPUT_BRANCH" + elif [ "$EVENT_NAME" = "push" ]; then + # validate exactly what was pushed, not the highest branch + TARGET="$PUSHED_REF" else # highest release/vX.Y.Z by semver among remote branches TARGET=$(git for-each-ref --format='%(refname:short)' 'refs/remotes/origin/release/v*' \ @@ -93,16 +122,26 @@ jobs: - name: Release-green validation (full) id: validate + env: + EVENT_NAME: ${{ github.event_name }} run: | set +e # --hermetic: scrub live-test trigger vars (self-hosted runner may carry # operator env; hosted ignores the unknown flag before #6300 lands). - # --full-ci: ALSO run every static gate from ci.yml's gate jobs (lint, - # quality-gate, quality-extended, docs-sync-strict, pr-test-policy). PRs into - # release/** only get the fast-gates, so these accrue silently and explode in - # layers on the release PR (v3.8.46: 11 static base-reds leaked). Running them - # nightly opens the tracking issue the moment one lands, not at release time. - node scripts/quality/validate-release-green.mjs --json --with-build --hermetic --full-ci \ + # push → --quick: fast HARD gates only (~5-8min), per-merge signal. + # schedule/dispatch → --with-build --full-ci: ALSO run every static gate from + # ci.yml's gate jobs (lint, quality-gate, quality-extended, docs-sync-strict, + # pr-test-policy) + build + full suites. PRs into release/** only get the + # fast-gates, so these accrue silently and explode in layers on the release PR + # (v3.8.46: 11 static base-reds leaked). + if [ "$EVENT_NAME" = "push" ]; then + MODE="--quick" + else + MODE="--with-build --full-ci" + fi + echo "[release-green] mode: $MODE (event: $EVENT_NAME)" + # shellcheck disable=SC2086 — MODE is an intentional flag list + node scripts/quality/validate-release-green.mjs --json --hermetic $MODE \ 1> release-green.json 2> release-green.log echo "exit=$?" >> "$GITHUB_OUTPUT" echo "------- report -------" @@ -114,15 +153,28 @@ jobs: GH_TOKEN: ${{ github.token }} TARGET: ${{ steps.branch.outputs.target }} RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} + EVENT_NAME: ${{ github.event_name }} + BEFORE_SHA: ${{ github.event.before }} + AFTER_SHA: ${{ github.event.after }} run: | set -euo pipefail TITLE="🔴 Release branch not green: ${TARGET}" { - echo "The nightly **release-green** validation found HARD failures on \`${TARGET}\`." + echo "The **release-green** validation found HARD failures on \`${TARGET}\`." echo "These are real defects that would block the release PR — fix them in the" echo "originating PR branch (via co-authorship), not by demanding it from contributors." echo "" - echo "**Run:** ${RUN_URL}" + echo "**Run:** ${RUN_URL} (mode: ${EVENT_NAME})" + # WS5.1 attribution: on push events the offending change IS this push's range + # (one merge per push in the normal queue), so name it — no bisect needed. + if [ "$EVENT_NAME" = "push" ] && [ -n "${BEFORE_SHA:-}" ] && \ + git cat-file -e "$BEFORE_SHA" 2>/dev/null; then + echo "" + echo "**Offending push range** (\`${BEFORE_SHA:0:9}..${AFTER_SHA:0:9}\`):" + echo '```' + git log --no-decorate --oneline "${BEFORE_SHA}..${AFTER_SHA}" | head -20 + echo '```' + fi echo "" echo '```' sed -n '/──────── verdict ────────/,$p' release-green.log || tail -40 release-green.log diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index 8e74b96d46..1edd3c09e0 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -22,6 +22,14 @@ on: - latest - next - historic + publish_mode: + description: "staged = npm stage publish (owner approves with 2FA after the staged boot-verify); direct = legacy immediate publish (emergency fallback only)" + required: false + default: "staged" + type: choice + options: + - staged + - direct workflow_call: inputs: version: @@ -166,8 +174,34 @@ jobs: TAG: ${{ github.ref_name }} run: gh release upload "$TAG" sbom-npm.cdx.json --clobber - - name: Publish to npm + # WS1.2/WS1.3 (#7065 class): the artifact that is about to be published must + # BOOT. build:cli already assembled dist/ above; this packs+installs+boots the + # real tarball and fails the publish before anything reaches the registry. + - name: Boot-smoke the tarball before ANY publish if: steps.resolve.outputs.skip != 'true' + run: npm run check:pack-boot + + # WS1.3 (D2, v3.8.49 plan): STAGED publishing by default — `npm stage publish` + # parks the exact bytes on the registry WITHOUT making them installable; the + # owner then verifies and approves with 2FA (`npm stage approve`), moving the + # human gate to AFTER the proof instead of before it. Requires npm >= 11.15 + # (staged publishing GA 2026-05-22). publish_mode=direct is the emergency + # fallback (legacy immediate publish) via workflow_dispatch. + - name: Ensure npm supports staged publishing + if: steps.resolve.outputs.skip != 'true' && (github.event_name != 'workflow_dispatch' || inputs.publish_mode != 'direct') + run: | + set -euo pipefail + CUR=$(npm --version) + if ! node -e "const [a,b]='$(npm --version)'.split('.').map(Number); process.exit(a>11||(a===11&&b>=15)?0:1)"; then + # Pinned exact version (supply-chain: never float @latest in the publish + # job); bump deliberately when a newer npm is required. + echo "npm $CUR < 11.15 — installing pinned npm 11.15.0 for staged publishing" + npm install -g --ignore-scripts npm@11.15.0 + fi + npm --version + + - name: Publish to npm (staged — owner approves with 2FA) + if: steps.resolve.outputs.skip != 'true' && (github.event_name != 'workflow_dispatch' || inputs.publish_mode != 'direct') env: VERSION: ${{ steps.resolve.outputs.version }} TAG: ${{ steps.resolve.outputs.tag }} @@ -175,10 +209,32 @@ jobs: run: | set -euo pipefail # Always pass --tag explicitly. Defense in depth: even if VERSION is - # accidentally an older release, `npm publish --tag historic` will - # NOT promote it to `@latest`. + # accidentally an older release, the historic tag will NOT claim `@latest`. + npm stage publish --provenance --access public --tag "$TAG" + { + echo "## 📦 omniroute@$VERSION STAGED (not yet installable)" + echo "" + echo "The exact bytes are parked on the registry. To release them:" + echo '```' + echo "npm stage list omniroute # find the stage id" + echo "npm stage approve # owner 2FA — THE publish" + echo '```' + echo "To verify the staged bytes first: npm stage download → run" + echo "scripts/check/check-pack-boot.mjs against them (see RELEASE_CHECKLIST)." + echo "To discard: npm stage reject ." + } >> "$GITHUB_STEP_SUMMARY" + echo "✅ Staged omniroute@$VERSION (dist-tag=$TAG) — awaiting owner 'npm stage approve'" + + - name: Publish to npm (DIRECT — emergency fallback) + if: steps.resolve.outputs.skip != 'true' && github.event_name == 'workflow_dispatch' && inputs.publish_mode == 'direct' + env: + VERSION: ${{ steps.resolve.outputs.version }} + TAG: ${{ steps.resolve.outputs.tag }} + NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} + run: | + set -euo pipefail npm publish --provenance --access public --tag "$TAG" - echo "✅ Published omniroute@$VERSION (dist-tag=$TAG)" + echo "✅ Published omniroute@$VERSION (dist-tag=$TAG) [DIRECT mode]" - name: Publish to GitHub Packages if: steps.resolve.outputs.skip != 'true' diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index f6cdbe4d98..e54c4ac4c2 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -62,7 +62,7 @@ jobs: docs-gates: name: Docs Gates (fast-path) needs: changes - if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && (needs.changes.outputs.docs == 'true' || needs.changes.outputs.code == 'true')) }} + if: ${{ github.event_name != 'pull_request' || ((github.event.pull_request.draft == false || startsWith(github.head_ref, 'mergify/merge-queue/')) && (needs.changes.outputs.docs == 'true' || needs.changes.outputs.code == 'true')) }} runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 @@ -82,7 +82,7 @@ jobs: name: Fast Quality Gates needs: changes # Code surface only — pure docs/i18n PRs skip this bag (docs-gates covers docs). - if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true') }} + if: ${{ github.event_name != 'pull_request' || ((github.event.pull_request.draft == false || startsWith(github.head_ref, 'mergify/merge-queue/')) && needs.changes.outputs.code == 'true') }} # Dynamic runner (same rule as ci.yml): use the self-hosted VPS pool only when the # release captain has USE_VPS_RUNNER=true AND this is not a fork PR (own-origin # branches only — a fork PR must never execute on the LAN runner). Var unset/false @@ -143,6 +143,24 @@ jobs: - run: npm run check:complexity-ratchets - name: Typecheck (core) run: npm run typecheck:core + # #7033: dashboard-scoped typecheck gate — src/app/(dashboard) TSX is not + # covered by typecheck:core's curated allowlist. See check-dashboard-typecheck.mjs. + - name: Typecheck (dashboard) + run: npm run check:dashboard-typecheck + # WS4.2 (v3.8.49 plan): TypeScript 7 native-compiler SHADOW — advisory only. + # TS7 went GA 2026-07-08 with 8-12x type-check speedups; its Compiler API only + # arrives in 7.1, so typescript-eslint / type-coverage / Stryker stay on 6.x + # (the hybrid is the officially documented pattern). Isolated npx on purpose: + # installing an alias package could collide node_modules/.bin/tsc with 6.x. + # Promote to the blocking gate after ~1 week of parity with the step above. + - name: Typecheck (core) — TS7 native shadow (advisory) + continue-on-error: true + run: | + RC=0 + START=$(date +%s) + npx -y -p typescript@7 tsc --pretty false -p tsconfig.typecheck-core.json || RC=$? + echo "[ts7-shadow] exit=$RC elapsed=$(( $(date +%s) - START ))s — the 6.x step above stays authoritative" + exit $RC # TIA: build the impact map at runtime (gitignored, ~21MB) and run only the # unit tests impacted by this PR's changed files. On hub/unmapped changes the # selector returns __RUN_ALL__ — full-suite authority is the parallel @@ -196,7 +214,7 @@ jobs: fast-vitest: name: Vitest (fast-path) needs: changes - if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true') }} + if: ${{ github.event_name != 'pull_request' || ((github.event.pull_request.draft == false || startsWith(github.head_ref, 'mergify/merge-queue/')) && needs.changes.outputs.code == 'true') }} # Dynamic runner — see fast-gates (own-origin + flag; fork/unset → ubuntu-latest). runs-on: ${{ (vars.USE_VPS_RUNNER == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)) && fromJSON('["self-hosted","omni-release"]') || 'ubuntu-latest' }} env: @@ -212,12 +230,23 @@ jobs: node-version: ${{ env.CI_NODE_VERSION }} cache: npm - run: npm ci - - run: npm run test:vitest + # WS5.2/5.3: JUnit feeds Trunk Flaky Tests — the fast-path runs on EVERY PR, + # which is where flaky-detection volume actually comes from (ci.yml's heavy + # jobs only run on the release PR). Advisory upload, own-origin only. + - run: npm run test:vitest -- --reporter=default --reporter=junit --outputFile.junit=trunk-junit/vitest-fastpath.xml + - name: Upload test results to Trunk (advisory) + if: ${{ always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }} + continue-on-error: true + uses: trunk-io/analytics-uploader@385f1ccdf345b4532dc4b6c665dd432b702b8e28 # v2.1.2 + with: + junit-paths: trunk-junit/**/*.xml + org-slug: omniroute + token: ${{ secrets.TRUNK_TOKEN }} fast-unit: name: Unit Tests fast-path (${{ matrix.shard }}/4) needs: changes - if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true') }} + if: ${{ github.event_name != 'pull_request' || ((github.event.pull_request.draft == false || startsWith(github.head_ref, 'mergify/merge-queue/')) && needs.changes.outputs.code == 'true') }} # Dynamic runner — see fast-gates (own-origin + flag; fork/unset → ubuntu-latest). # This is the heaviest fast-path job; 4-way sharding (was 2, #6781) halves the # critical path again (~8.5min → ~4.5min on ubuntu-latest; ~2min on the 8-slot @@ -263,7 +292,7 @@ jobs: lint-guard: name: No new ESLint warnings needs: changes - if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false && needs.changes.outputs.code == 'true') }} + if: ${{ github.event_name != 'pull_request' || ((github.event.pull_request.draft == false || startsWith(github.head_ref, 'mergify/merge-queue/')) && needs.changes.outputs.code == 'true') }} runs-on: ubuntu-latest continue-on-error: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true }} steps: @@ -302,7 +331,7 @@ jobs: merge-integrity: name: Merge integrity (changelog + generated skills) # Always on non-draft PRs — CHANGELOG/skills can break on docs-only merges too. - if: ${{ github.event_name != 'pull_request' || github.event.pull_request.draft == false }} + if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.draft == false || startsWith(github.head_ref, 'mergify/merge-queue/')) }} runs-on: ubuntu-latest continue-on-error: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == true }} env: diff --git a/.gitignore b/.gitignore index 67d69b3d5d..b7406dbfca 100644 --- a/.gitignore +++ b/.gitignore @@ -72,6 +72,7 @@ yarn-error.log* # env files (can opt-in for committing if needed) .env* !.env.example +!.env.homolog.example # Provider API keys (never commit) *.api-key .nvidia-api-key @@ -242,3 +243,9 @@ _artifacts/ # CI/local quality artifacts (eslint-results.json, etc.) .artifacts/ + +# Homologation E2E suite (npm run homolog) — real-environment credentials + report output +.env.homolog +tests/homolog/.auth/ +tests/homolog/ui/.auth/ +homolog-report/ diff --git a/.gitleaks.toml b/.gitleaks.toml index 0051e694b2..8b9978a454 100644 --- a/.gitleaks.toml +++ b/.gitleaks.toml @@ -74,3 +74,16 @@ # '''tests/unit/''', # ] # + +[[rules]] + # Falsos-positivos comprovados do generic-api-key — zerados em 2026-07-13 (WS6/D3, + # plano v3.8.49). Revisar em v3.9.0. Nenhum é credencial: dois são NOMES DE CAMPO + # de métricas de latência; o terceiro é o valor PÚBLICO de um beta header da API + # da Anthropic (documentado publicamente, não é segredo). + id = "generic-api-key" + [rules.allowlist] + description = "Field names + public Anthropic beta-header value (não são segredos)" + regexes = [ + '''latencyP\d{2}Ms''', + '''interleaved-thinking-2025-05-14''', + ] diff --git a/.mergify.yml b/.mergify.yml new file mode 100644 index 0000000000..131c6d71a9 --- /dev/null +++ b/.mergify.yml @@ -0,0 +1,55 @@ +# Mergify merge queue — WS3.4/D5 of the v3.8.49 quality/velocity master plan. +# +# WHY: ~85-100 active PR authors/month and 300+ PRs/week peaks, all merged by ONE +# identity. The manual merge-train validated batches by hand; this queue automates +# it with batching + automatic batch bisection (a red batch of N costs ~log2(N) +# revalidations instead of N). Mergify Open Source plan: free, unlimited, public repo. +# +# GOVERNANCE (non-negotiable, mirrors CLAUDE.md Hard Rules #21/#22 + the owner's +# pre-merge ⭐ gate): +# • A PR enters the queue ONLY via the `queue` label — applied by the owner (or a +# session acting for the owner) AFTER the pre-merge ⭐ report/decision. The label +# IS the merge approval; Mergify only executes it. +# • During a release-freeze (open issue labeled `release-freeze`), do NOT label PRs +# targeting the frozen branch — the freeze is a human-honored coordination signal +# the queue cannot see. Retarget to the active release/vX+1 first (Hard Rule #21). +# • Never label a PR another session is actively working (Hard Rule #22b). +# • Fallback path if Mergify misbehaves or the OSS plan changes: the manual +# merge-train runbook (docs/ops/MERGE_TRAIN.md) — remove labels, proceed by hand. + +queue_rules: + - name: release + # Any current or future release branch — the reason GitHub's native queue was + # rejected (no wildcard support on personal-account repos). + queue_conditions: + - base~=^release/v\d+\.\d+\.\d+$ + - label=queue + - -draft + - -conflict + # "Everything that ran is green, nothing still running, AND the always-on + # anchor check succeeded" — robust to the path-filtered fast-gates (docs-only + # PRs skip code jobs; matrix shard names vary) while never fail-open: a PR with + # zero checks cannot vacuously merge, because `Merge integrity` runs on EVERY + # non-draft PR (quality.yml) and must be an affirmative success. Review approval + # is intentionally NOT a condition here: the owner-applied `queue` label IS the + # approval in this repo's single-maintainer model (see governance header). + merge_conditions: + - "#check-failure=0" + - "#check-pending=0" + - "#check-success>=1" + - check-success=Merge integrity (changelog + generated skills) + # Batching: validate up to 10 queued PRs together (the manual train's sweet spot); + # don't hold a lone PR hostage waiting for siblings. + batch_size: 10 + batch_max_wait_time: 5 min + # Squash keeps the one-commit-per-PR history the CHANGELOG reconciliation expects. + merge_method: squash + +pull_request_rules: + - name: clean up the queue label after merge + conditions: + - merged + actions: + label: + remove: + - queue diff --git a/AGENTS.md b/AGENTS.md index cadfff6e33..42209a90d0 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -3,12 +3,12 @@ ## Project Unified AI proxy/router — route any LLM through one endpoint. Multi-provider support -with **248 provider entries** (OpenAI, Anthropic, Gemini, DeepSeek, Groq, xAI, Mistral, Fireworks, +with **250 provider entries** (OpenAI, Anthropic, Gemini, DeepSeek, Groq, xAI, Mistral, Fireworks, Cohere, NVIDIA, Cerebras, Pollinations, Puter, Cloudflare AI, HuggingFace, DeepInfra, SambaNova, Meta Llama API, Moonshot AI, AI21 Labs, Databricks, Snowflake, and many more) with **MCP Server** (94 tools), **A2A v0.3 Protocol**, and **Electron desktop app**. -> **Live counts (v3.8.47)**: providers 248 · MCP tools 94 · MCP scopes 30 · A2A skills 6 · +> **Live counts (v3.8.47)**: providers 250 · MCP tools 94 · MCP scopes 30 · A2A skills 6 · > open-sse services 134 · routing strategies 17 · auto-combo scoring factors 12 · > DB modules 95 · DB migrations 110 · base tables 17 · search providers 11 · > i18n locales 42. **Refresh with `npm run check:docs-all`.** diff --git a/CHANGELOG.md b/CHANGELOG.md index b5d48a1f07..3ab0f12866 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,7 +4,24 @@ --- -## [3.8.47] — TBD +## [3.8.49] — TBD + +--- + +## [3.8.48] — 2026-07-13 + +> ⚠️ **Hotfix release.** The published npm package for 3.8.47 crashed on every boot ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065)) and was deprecated — **3.8.48 is the first installable release of the v3.8.47 cycle**, so everything listed under [3.8.47] below ships here. + +### 🐛 Bug Fixes + +- **fix(build):** ship `dist/head-response-guard.cjs` in the npm tarball — the prepublish prune allowlist lacked it, so every `omniroute` boot of the published 3.8.47 crashed with `ERR_MODULE_NOT_FOUND` (3rd occurrence of this class after tls-options/3.8.41); now allowlisted, enforced by `check:pack-artifact`, and guarded by a closure test that derives every `server-ws.mjs` sibling import ([#7065](https://github.com/diegosouzapw/OmniRoute/issues/7065), [#7040](https://github.com/diegosouzapw/OmniRoute/issues/7040)) +- **fix(build):** Electron Windows packaging — the better-sqlite3 Electron-ABI rebuild now spawns `npx.cmd` through a shell (Node's CVE-2024-27980 hardening made the shell-less spawn fail with `status null` on Windows runners, breaking the v3.8.47 desktop build) +- **fix(ci):** Sonar quality gate zeroed on new code — the coverage lcov now reaches the scanner at `coverage/lcov.info` (it read 0% on every scan), the async `isCloudEnabled()` gate in the Kiro auto-import route is awaited (cloud sync ran even when disabled), the dead `structuredClone` fallback in the reasoning-split clone is a real JSON fallback, the codex executor handles the async `reader.cancel()` rejection, deterministic `localeCompare` sorts, a path-traversal guard in `classify-pr-changes.mjs`, and the Docker better-sqlite3 rebuild uses npm's bundled node-gyp instead of `npx --yes` +- **chore(ci):** the Sonar quality gate is informational (`sonar.qualitygate.wait=false`) while the org's SonarCloud plan cannot associate the tuned "OmniRoute way" gate (coverage ≥60 aligned with the repo floor) + +--- + +## [3.8.47] — 2026-07-13 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._ @@ -12,6 +29,19 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral ### ✨ New Features +- **feat(plugins):** Langfuse observability plugin. ([#6577](https://github.com/diegosouzapw/OmniRoute/pull/6577) — thanks @chirag127) + +- **feat(combo):** context requirements config for per-target filtering in combos. ([#6907](https://github.com/diegosouzapw/OmniRoute/pull/6907) — thanks @oyi77) +- **feat(providers):** icons for 46 providers that were missing images. ([#6926](https://github.com/diegosouzapw/OmniRoute/pull/6926) — thanks @oyi77) +- **feat(compression):** vendored GCF (Headroom) codec updated to spec v3.2 (nested flattening). ([#6838](https://github.com/diegosouzapw/OmniRoute/pull/6838) — thanks @blackwell-systems) +- **feat(proxy):** shorthand proxy formats + protocol header mode for bulk import. ([#6867](https://github.com/diegosouzapw/OmniRoute/pull/6867) — thanks @growab) +- **feat(provider):** OpenVecta AI inference gateway. ([#6833](https://github.com/diegosouzapw/OmniRoute/pull/6833) — thanks @hajilok) +- **feat(i18n):** Traditional Chinese (zh-TW) localization for frontend and CLI. ([#6320](https://github.com/diegosouzapw/OmniRoute/pull/6320) — thanks @lunkerchen) +- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint. ([#6709](https://github.com/diegosouzapw/OmniRoute/pull/6709) — thanks @diegosouzapw) +- **feat(routing):** per-model web-search/web-fetch interception rules. ([#3384](https://github.com/diegosouzapw/OmniRoute/issues/3384), [#6814](https://github.com/diegosouzapw/OmniRoute/pull/6814) — thanks @diegosouzapw) +- **feat(release):** `changelog.d/` fragments — eliminates the CHANGELOG merge-storm cascade. ([#6783](https://github.com/diegosouzapw/OmniRoute/pull/6783) — thanks @diegosouzapw) +- **feat(quality):** `validate-release-green --full-ci` reproduces the entire ci.yml static gate set locally. ([#6583](https://github.com/diegosouzapw/OmniRoute/pull/6583) — thanks @diegosouzapw) + - **feat(dashboard):** sidebar quick-filter — a search input at the top of the expanded dashboard sidebar (`src/shared/components/Sidebar.tsx`) filters nav sections/groups/items client-side by label as you type, reusing the existing `common.search`/`common.noResults` i18n keys (zero new locale edits) and the shared `Input` `icon="search"` pattern; matching sections auto-expand while searching (bypassing the accordion/pin state) and collapse back to normal once the query is cleared. Pure filtering logic extracted into `filterSidebarSectionsByQuery()` (`src/shared/utils/sidebarSearch.ts`) for isolated unit testing. Regression guard: `tests/unit/sidebar-search-filter.test.ts`, `src/shared/components/Sidebar.search.test.tsx`. (#4013 — thanks @crochabe-cyber) - **feat(combo):** `auto/*` combos gain a strict budget-cap fallback policy — `X-OmniRoute-Budget-Fallback: strict` (or the persisted `config.budgetFallback: "strict"`) makes an over-budget request fail fast with `HTTP 402` instead of the previous silent fallback to the globally cheapest candidate, which could still exceed the cap. The default (`cheapest`) preserves existing behavior. Builds on the existing `X-OmniRoute-Budget`/`X-OmniRoute-Mode` per-request controls (#6023/#6024/#6025), consolidated into `resolveRequestAutoControls()`. Regression guard: `tests/unit/auto-combo-budget-fallback-3470.test.ts`. (#3470) - **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625) @@ -28,9 +58,64 @@ _Living section — bullets land here as PRs merge into `release/v3.8.47` (paral - **fix(providers):** register OpenRouter as a rerank provider so `openrouter/cohere/rerank-*` models resolve instead of erroring `Invalid rerank model` (#6574 — thanks @rafpigna) - **fix(api):** `HEAD` requests no longer hang until client timeout on any route — valid, unknown, authed, or unauthed ([#6400](https://github.com/diegosouzapw/OmniRoute/issues/6400)), broader follow-up to the route-specific #6517 (`/v1/models`). Root cause: Next.js 16's App Router _route-handler_ pipeline (`next/dist/server/send-response.js`) correctly skips piping a `Response` body for `HEAD`, but its _page_-rendering pipeline (`next/dist/server/pipe-readable.js` → `pipeToNodeResponse`, used for every app-router page/layout render — including the `not-found` boundary any unmatched path falls through to) has no such check and always streams the full rendered body regardless of method; combined with Node's default keep-alive framing this left some clients unsure whether the (implicitly bodyless) `HEAD` response had actually finished. A new `scripts/dev/head-response-guard.cjs`, wired into both the dev/start custom server (`scripts/dev/run-next.mjs`) and the packaged standalone server (`scripts/dev/standalone-server-ws.mjs`) at the same tier as the existing `http-method-guard.cjs`/`peer-stamp.mjs` wrappers, discards any body bytes written for a `HEAD` request and forces `Connection: close` once `.end()` is called — independent of route existence or auth state, satisfying RFC 9110 §9.3.2. Regression guard: `tests/unit/head-request-closes-6400.test.ts`. - **feat(dashboard):** Provider Quota page (`Dashboard → Quota`) fills horizontal whitespace before stacking vertically ([#3520](https://github.com/diegosouzapw/OmniRoute/issues/3520)) — `QuotaCardGrid` previously stacked every provider group in a single vertical `flex flex-col`, and each group's own card grid didn't go multi-column until `md` (`grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4`). Provider groups now flow into a 2-column CSS multi-column layout on very wide (`2xl`) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately (`grid-cols-2 md:grid-cols-3 xl:grid-cols-4`), reaching higher density sooner on narrower-but-not-mobile viewports. Regression guard: `tests/unit/quota-card-grid-horizontal-layout.test.ts` (thanks @gdevenyi). +- **feat(ws):** the live-dashboard WebSocket server now auto-starts in-process (via `instrumentation-node.ts`) across every deployment mode — dev, production, Docker, Electron — with no separate sidecar script; the default WS port moved from 20129 to **20132** to avoid colliding with `API_PORT` in split-port setups, the deprecated `OMNIROUTE_DISABLE_LIVE_WS` env was consolidated into `OMNIROUTE_ENABLE_LIVE_WS` (default enabled), and the WS path is now derived from `NEXT_PUBLIC_LIVE_WS_PUBLIC_URL`'s pathname (`/live-ws` fallback) (#6072 — thanks @ianriizky). +- **feat(compression):** new **omniglyph** engine (context-as-image) — renders system prompt, tool docs, and dense history as compact PNG pages the model reads instead of text (~10× fewer tokens on the converted block; 59–70% end-to-end measured). Works stacked with RTK/Caveman (`stackPriority: 90`) or standalone (`mode: omniglyph`); restricted to Claude Fable 5 over the direct Anthropic route, fail-closed gates with `skip:` techniques, preview (`stable: false`, off by default) (#6556). Dependency bumped to `omniglyph@^1.0.2` for upstream ReDoS fixes (#6661). +- **feat(sandbox):** the skill sandbox gained a container-provider abstraction that auto-detects and uses the best native runtime per host — Apple Container (macOS 26+), WSL container (`wslc.exe`), OrbStack, Podman — instead of hardcoding `docker run`, removing the Docker Desktop requirement on macOS/Windows (#6611 — thanks @KooshaPari). +- **fix(sse):** skip `thinkingConfig` for Gemma models on the OpenAI→Gemini path so OpenAI-shape clients no longer get a 400 from Vertex. (thanks @chy1211) +- **feat(xai):** route xAI clients to Grok's native `/v1/responses` endpoint instead of the chat-completions bridge. (thanks @ryanngit) +- **feat(models):** add a Settings → AI "Model Overrides" UI plus `/api/model-capability-overrides` CRUD and a `model_capability_overrides` table, letting operators set a manual max-output-token override per provider/model (#6727 — thanks @xz-dev). +- **feat(resilience):** operator-configurable account rotation policy — a new `rotationConfig` layer lets operators tune how connections rotate on failure, wired into `accountFallback` (#6763 — thanks @artickc). +- **chore(cursor): add Grok 4.5 effort/fast model IDs** (#6774 — thanks @andrewmunsell). +- **feat(codex):** Codex provider model discovery now fetches the live catalog from `chatgpt.com/backend-api/codex/models` using Codex-shaped headers, falling back to a GitHub-hosted model manifest and then to the local static catalog when the live/GitHub sources are unavailable or return an unexpected shape — new `src/app/api/providers/[id]/models/discovery/codex.ts` (normalization, version-gating, merge/enrich against the local catalog) covered by `tests/unit/provider-models-discovery-split.test.ts` and `tests/unit/provider-models-route-codex.test.ts` (#6776 — thanks @JxnLexn). +- **feat(cursor):** register the Opus 4.8, Fable 5, and Sonnet 5 model families for the Cursor Agent provider so the latest Claude/Fable model ids route correctly (#6779 — thanks @andrewmunsell). +- **Changelog fragments (`changelog.d/`)**: PRs now add their changelog entry as a new fragment file (`changelog.d/{features|fixes|maintenance}/-.md`) instead of editing `CHANGELOG.md` — two PRs never touch the same file, structurally eliminating the CHANGELOG-eat merge conflicts that forced a re-sync push + full CI re-run after every sibling merge (O(N²) CI runs in a merge-storm). `scripts/release/aggregate-changelog.mjs` (npm run changelog:aggregate) folds fragments into the living section at release reconciliation, and `check:changelog-integrity` now also validates fragment well-formedness. Regression guard: `tests/unit/changelog-fragments.test.ts`. +- **feat(proxy):** add a latency-optimized proxy rotation strategy that ranks pool entries by measured round-trip latency, extending the existing round-robin/random/sticky proxy-pool selection (#6798 — thanks @iamraydoan). +- **feat(fusion):** the fusion judge may now draw on its own knowledge and override the panel when every panel answer is wrong or incomplete, instead of being restricted to synthesizing only from panel output (#6804 — thanks @chirag127). +- **feat(dashboard):** search box on the Playground's raw model ` = "e.g. Production Key" +// - após criar, abre o "Created Key Modal" (t("keyCreated")) — fechar pelo botão t("done")="Done" +// - cada key vira uma linha div.grid-cols-12; o botão de deletar tem title={t("deleteKey")}="Delete key" +// - handleDeleteKey usa window.confirm(t("deleteConfirm")) — não é modal de UI, +// precisa do listener page.on("dialog", ...). +const KEY_NAME = `homolog-ui-${Date.now()}`; + +test("cria e revoga uma API key pela UI", async ({ page }) => { + page.on("dialog", (dialog) => dialog.accept()); + + await page.goto("/dashboard/api-manager"); + await page.getByRole("button", { name: "Create API Key" }).first().click(); + await page.getByPlaceholder("e.g. Production Key").fill(KEY_NAME); + // segundo "Create API Key" é o submit do modal (o primeiro é o botão que o abriu) + await page.getByRole("button", { name: "Create API Key" }).last().click(); + + // fecha o modal "API Key Created" + await page.getByRole("button", { name: "Done" }).click(); + const row = page.locator("div.grid-cols-12", { hasText: KEY_NAME }); + await expect(row).toHaveCount(1); + + // revoga a mesma key (cleanup — a suíte não deixa lixo na VPS) + await row.getByTitle("Delete key").click(); + await expect(page.locator("div.grid-cols-12", { hasText: KEY_NAME })).toHaveCount(0); +}); diff --git a/tests/homolog/ui/auth.setup.ts b/tests/homolog/ui/auth.setup.ts new file mode 100644 index 0000000000..e38f11be4a --- /dev/null +++ b/tests/homolog/ui/auth.setup.ts @@ -0,0 +1,13 @@ +import { test as setup, expect } from "@playwright/test"; +import { STORAGE_STATE } from "./playwright.config"; + +// Locators confirmados em src/app/login/page.tsx: dentro de um +//
com . +setup("autentica e salva storageState", async ({ page }) => { + await page.goto("/login"); + await page.locator('input[type="password"]').fill(process.env.HOMOLOG_ADMIN_PASSWORD!); + await page.locator('button[type="submit"]').click(); + await page.waitForURL(/\/dashboard/); + await expect(page).toHaveURL(/dashboard/); + await page.context().storageState({ path: STORAGE_STATE }); +}); diff --git a/tests/homolog/ui/playwright.config.ts b/tests/homolog/ui/playwright.config.ts new file mode 100644 index 0000000000..78e099debe --- /dev/null +++ b/tests/homolog/ui/playwright.config.ts @@ -0,0 +1,42 @@ +import { defineConfig } from "@playwright/test"; +import path from "node:path"; +import { fileURLToPath } from "node:url"; + +const HERE = path.dirname(fileURLToPath(import.meta.url)); +export const STORAGE_STATE = path.join(HERE, ".auth", "admin.json"); + +export default defineConfig({ + testDir: ".", + timeout: 60_000, + retries: 1, + // Sem fullyParallel, os 98 testes de routes.spec.ts (mesmo arquivo) rodam + // SERIALIZADOS num único worker (~10min); com ele, distribuem entre os workers. + fullyParallel: true, + workers: 8, + reporter: [ + ["list"], + [ + // outputDir ABSOLUTO: o reporter resolve paths relativos contra o CWD do + // processo (não contra o config) — um path relativo escapava do worktree. + "playwright-ctrf-json-reporter", + { + outputDir: path.resolve(HERE, "..", "..", "..", "homolog-report"), + outputFile: "ui-ctrf.json", + }, + ], + ], + use: { + baseURL: process.env.HOMOLOG_BASE_URL || "http://192.168.0.15:20128", + trace: "retain-on-failure", + screenshot: "only-on-failure", + }, + projects: [ + { name: "setup", testMatch: /auth\.setup\.ts/ }, + { + name: "homolog", + testMatch: /.*\.spec\.ts/, + dependencies: ["setup"], + use: { storageState: STORAGE_STATE }, + }, + ], +}); diff --git a/tests/homolog/ui/routes.spec.ts b/tests/homolog/ui/routes.spec.ts new file mode 100644 index 0000000000..febc68749c --- /dev/null +++ b/tests/homolog/ui/routes.spec.ts @@ -0,0 +1,40 @@ +import { test, expect } from "@playwright/test"; +import fs from "node:fs"; +import path from "node:path"; +import { fileURLToPath } from "node:url"; + +// Descobre as rotas estáticas do dashboard a partir do próprio repo: +// cada page.tsx sob src/app/(dashboard)/dashboard vira uma rota; grupos (x) somem +// do path e rotas dinâmicas [param] são puladas (sem dado real garantido). +const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../.."); +const BASE = path.join(ROOT, "src", "app", "(dashboard)", "dashboard"); + +function discoverRoutes(dir: string, prefix = "/dashboard"): string[] { + const routes: string[] = []; + if (fs.existsSync(path.join(dir, "page.tsx"))) routes.push(prefix || "/"); + for (const e of fs.readdirSync(dir, { withFileTypes: true })) { + if (!e.isDirectory() || e.name.startsWith("[") || e.name.startsWith("_")) continue; + const seg = e.name.startsWith("(") ? "" : `/${e.name}`; + routes.push(...discoverRoutes(path.join(dir, e.name), `${prefix}${seg}`)); + } + return [...new Set(routes)]; +} + +for (const route of discoverRoutes(BASE)) { + test(`rota ${route} carrega sem crash`, async ({ page }) => { + const pageErrors: string[] = []; + page.on("pageerror", (err) => pageErrors.push(err.message)); + + const res = await page.goto(route, { waitUntil: "domcontentloaded" }); + expect(res!.status(), `HTTP em ${route}`).toBeLessThan(400); + // "networkidle" nunca assenta em telas com polling/websocket ao vivo (30s x 98 rotas + // estourava o run inteiro) — "load" + um settle curto e suficiente para hidratar e + // deixar um crash de client component (pageerror / error boundary) aparecer. + await page.waitForLoadState("load", { timeout: 10_000 }).catch(() => {}); + await page.waitForTimeout(1_500); + + // Error boundary do Next: nunca pode aparecer + await expect(page.locator("text=Application error")).toHaveCount(0); + expect(pageErrors, `pageerror em ${route}: ${pageErrors.join(" | ")}`).toHaveLength(0); + }); +} diff --git a/tests/unit/agent-bridge-dns-toggle-method-7157.test.ts b/tests/unit/agent-bridge-dns-toggle-method-7157.test.ts new file mode 100644 index 0000000000..53a7c4311a --- /dev/null +++ b/tests/unit/agent-bridge-dns-toggle-method-7157.test.ts @@ -0,0 +1,24 @@ +import test from "node:test"; +import assert from "node:assert/strict"; +import { readFileSync } from "node:fs"; +import { fileURLToPath } from "node:url"; +import path from "node:path"; + +const __dirname = path.dirname(fileURLToPath(import.meta.url)); +const clientPath = path.resolve( + __dirname, + "../../src/app/(dashboard)/dashboard/tools/agent-bridge/AgentBridgePageClient.tsx" +); +const source = readFileSync(clientPath, "utf8"); + +test("#7157: dns toggle fetch call uses method POST (route.ts only exports POST)", () => { + const dnsCallMatch = source.match( + /\/api\/tools\/agent-bridge\/agents\/\$\{agentId\}\/dns`,\s*\{\s*method:\s*"([A-Z]+)"/ + ); + assert.ok(dnsCallMatch, "expected to find the dns fetch call in AgentBridgePageClient.tsx"); + assert.equal( + dnsCallMatch?.[1], + "POST", + "dns fetch call must use method: 'POST' to match the route.ts export (issue #7157)" + ); +}); diff --git a/tests/unit/balance-e2e-shards.test.ts b/tests/unit/balance-e2e-shards.test.ts new file mode 100644 index 0000000000..6484dfccb2 --- /dev/null +++ b/tests/unit/balance-e2e-shards.test.ts @@ -0,0 +1,75 @@ +import { test } from "node:test"; +import assert from "node:assert/strict"; +import fs from "node:fs"; +import path from "node:path"; +import { fileURLToPath } from "node:url"; +import { lptAssign, weightItems } from "../../scripts/quality/balance-e2e-shards.mjs"; + +// WS4.1 (v3.8.49 quality plan) — the E2E matrix skew was 14× (24m47s vs 1m47s) +// because Playwright --shard distributes by count, not duration. These tests pin +// the LPT packing invariants; the hard one is COMPLETENESS (a lost spec would +// silently hollow the suite — the CLI self-checks it and falls back to --shard). + +const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../.."); + +test("lptAssign puts the heaviest item alone before doubling up lighter shards", () => { + const shards = lptAssign( + [ + { file: "huge.spec.ts", weight: 100 }, + { file: "a.spec.ts", weight: 30 }, + { file: "b.spec.ts", weight: 30 }, + { file: "c.spec.ts", weight: 30 }, + ], + 2 + ); + assert.deepEqual(shards[0].files, ["huge.spec.ts"]); + assert.deepEqual(shards[1].files, ["a.spec.ts", "b.spec.ts", "c.spec.ts"]); + assert.equal(shards[0].total, 100); + assert.equal(shards[1].total, 90); +}); + +test("lptAssign is deterministic on equal weights (filename tiebreak)", () => { + const items = [ + { file: "b.spec.ts", weight: 10 }, + { file: "a.spec.ts", weight: 10 }, + ]; + const s1 = lptAssign(items, 2); + const s2 = lptAssign([...items].reverse(), 2); + assert.deepEqual(s1, s2); +}); + +test("completeness: every file lands in exactly one shard", () => { + const items = Array.from({ length: 37 }, (_, i) => ({ + file: `f${String(i).padStart(2, "0")}.spec.ts`, + weight: (i * 7) % 40, + })); + const shards = lptAssign(items, 9); + const union = shards.flatMap((s) => s.files).sort(); + assert.deepEqual(union, items.map((i) => i.file).sort()); +}); + +test("weightItems gives unknown/new specs the median weight, not an extreme", () => { + const items = weightItems(["new.spec.ts", "big.spec.ts", "small.spec.ts"], { + _meta: "x", + "big.spec.ts": 600, + "small.spec.ts": 20, + "other.spec.ts": 100, + }); + const byFile = Object.fromEntries(items.map((i) => [i.file, i.weight])); + assert.equal(byFile["big.spec.ts"], 600); + assert.equal(byFile["small.spec.ts"], 20); + assert.equal(byFile["new.spec.ts"], 100); // median of [20,100,600] +}); + +test("the committed timings seed covers every current e2e spec (no drift)", () => { + const timings = JSON.parse( + fs.readFileSync(path.join(ROOT, "config", "quality", "e2e-timings.json"), "utf8") + ); + const specs = fs + .readdirSync(path.join(ROOT, "tests", "e2e")) + .filter((f) => f.endsWith(".spec.ts")); + const missing = specs.filter((f) => !(f in timings)); + // Missing entries are tolerated at runtime (median fallback) — this assert keeps + // the seed honest so balance quality does not silently rot as specs are added. + assert.deepEqual(missing, [], `add to config/quality/e2e-timings.json: ${missing.join(", ")}`); +}); diff --git a/tests/unit/build/check-dashboard-typecheck.test.ts b/tests/unit/build/check-dashboard-typecheck.test.ts new file mode 100644 index 0000000000..dec6d54fad --- /dev/null +++ b/tests/unit/build/check-dashboard-typecheck.test.ts @@ -0,0 +1,111 @@ +// tests/unit/build/check-dashboard-typecheck.test.ts +// Unit tests for the pure parsing/diff helpers in check-dashboard-typecheck.mjs. +// No child process is spawned — synthetic tsc-style output only, so the suite is +// fast and hermetic. Proves the gate actually DETECTS the #6625/#6909 bug class +// (an orphaned identifier — used but not declared — in a dashboard TSX file), +// not just that the script runs. + +import test from "node:test"; +import assert from "node:assert/strict"; +import { + parseTscOutput, + diffAgainstBaseline, +} from "../../../scripts/check/check-dashboard-typecheck.mjs"; + +test("parseTscOutput: parses a TS2304 orphaned-identifier error (the #6625/#6909 bug class)", () => { + const raw = + `src/app/(dashboard)/dashboard/settings/components/ProxyRegistryManager.tsx(564,7): error TS2304: Cannot find name 'setPoolLoaded'.\n` + + `src/app/(dashboard)/dashboard/settings/components/ProxyRegistryManager.tsx(1204,12): error TS2304: Cannot find name 'poolLoaded'.\n`; + + const counts = parseTscOutput(raw); + + assert.deepEqual(counts, { + "src/app/(dashboard)/dashboard/settings/components/ProxyRegistryManager.tsx": { + TS2304: 2, + }, + }); +}); + +test("parseTscOutput: ignores non-error lines (summary/info output)", () => { + const raw = + `Some info line that is not an error\n` + + `src/app/(dashboard)/dashboard/foo.tsx(1,1): error TS2339: Property 'bar' does not exist.\n` + + `Found 1 error in 1 file.\n`; + + const counts = parseTscOutput(raw); + + assert.deepEqual(counts, { + "src/app/(dashboard)/dashboard/foo.tsx": { TS2339: 1 }, + }); +}); + +test("parseTscOutput: returns empty map for clean output", () => { + assert.deepEqual(parseTscOutput(""), {}); + assert.deepEqual(parseTscOutput("Found 0 errors.\n"), {}); +}); + +test("diffAgainstBaseline: flags a brand-new orphaned-identifier error as a regression", () => { + const baseline = {}; + const live = { + "src/app/(dashboard)/dashboard/settings/components/ProxyRegistryManager.tsx": { + TS2304: 5, + }, + }; + + const { regressions, improvements } = diffAgainstBaseline(live, baseline); + + assert.equal(regressions.length, 1); + assert.equal( + regressions[0].file, + "src/app/(dashboard)/dashboard/settings/components/ProxyRegistryManager.tsx" + ); + assert.equal(regressions[0].code, "TS2304"); + assert.equal(regressions[0].liveCount, 5); + assert.equal(regressions[0].baselineCount, 0); + assert.equal(improvements.length, 0); +}); + +test("diffAgainstBaseline: does NOT flag a frozen pre-existing error within its baselined count", () => { + const baseline = { "src/app/(dashboard)/dashboard/foo.tsx": { TS2339: 3 } }; + const live = { "src/app/(dashboard)/dashboard/foo.tsx": { TS2339: 3 } }; + + const { regressions, improvements } = diffAgainstBaseline(live, baseline); + + assert.equal(regressions.length, 0); + assert.equal(improvements.length, 0); +}); + +test("diffAgainstBaseline: flags a count INCREASE beyond the frozen baseline as a regression", () => { + const baseline = { "src/app/(dashboard)/dashboard/foo.tsx": { TS2339: 2 } }; + const live = { "src/app/(dashboard)/dashboard/foo.tsx": { TS2339: 3 } }; + + const { regressions } = diffAgainstBaseline(live, baseline); + + assert.equal(regressions.length, 1); + assert.equal(regressions[0].baselineCount, 2); + assert.equal(regressions[0].liveCount, 3); +}); + +test("diffAgainstBaseline: reports (does not fail on) a count DECREASE as an improvement", () => { + const baseline = { "src/app/(dashboard)/dashboard/foo.tsx": { TS2339: 3 } }; + const live = { "src/app/(dashboard)/dashboard/foo.tsx": { TS2339: 1 } }; + + const { regressions, improvements } = diffAgainstBaseline(live, baseline); + + assert.equal(regressions.length, 0); + assert.equal(improvements.length, 1); + assert.equal(improvements[0].baselineCount, 3); + assert.equal(improvements[0].liveCount, 1); +}); + +test("diffAgainstBaseline: a baselined error that fully disappears is reported as an improvement, not a failure", () => { + const baseline = { "src/app/(dashboard)/dashboard/foo.tsx": { TS2339: 2 } }; + const live = {}; + + const { regressions, improvements } = diffAgainstBaseline(live, baseline); + + assert.equal(regressions.length, 0); + assert.equal(improvements.length, 1); + assert.equal(improvements[0].liveCount, 0); + assert.equal(improvements[0].baselineCount, 2); +}); diff --git a/tests/unit/check-pack-boot.test.ts b/tests/unit/check-pack-boot.test.ts new file mode 100644 index 0000000000..b22ca557b5 --- /dev/null +++ b/tests/unit/check-pack-boot.test.ts @@ -0,0 +1,57 @@ +import { test } from "node:test"; +import assert from "node:assert/strict"; +import { readFileSync } from "node:fs"; +import path from "node:path"; +import { fileURLToPath } from "node:url"; +import { pickTarball, evaluateBoot, pickPort } from "../../scripts/check/check-pack-boot.mjs"; + +// WS1.2 (T1, v3.8.49 quality plan) — pure-function guards for the tarball boot-smoke +// gate that kills the #7065 class (published artifact crashes on every boot because a +// packaging list drifted; 3rd recurrence). The end-to-end path runs in CI's +// package-artifact job; these tests pin the decision logic. + +const SCRIPT_PATH = path.join( + path.dirname(fileURLToPath(import.meta.url)), + "../../scripts/check/check-pack-boot.mjs" +); + +test("pickTarball extracts the filename from npm pack --json output", () => { + assert.equal(pickTarball('[{"filename":"omniroute-3.8.49.tgz","size":1}]'), "omniroute-3.8.49.tgz"); +}); + +test("pickTarball normalizes scoped slashes to the on-disk dash form", () => { + assert.equal(pickTarball('[{"filename":"@scope/pkg-1.0.0.tgz"}]'), "@scope-pkg-1.0.0.tgz"); +}); + +test("pickTarball throws on empty/odd npm output instead of booting garbage", () => { + assert.throws(() => pickTarball("[]")); + assert.throws(() => pickTarball("{}")); +}); + +test("evaluateBoot passes on HTTP 200 + matching version, whatever the health status", () => { + const r = evaluateBoot(200, { version: "3.8.49", status: "warning" }, "3.8.49"); + assert.equal(r.ok, true); + assert.deepEqual(r.failures, []); +}); + +test("evaluateBoot fails on non-200, non-JSON body, and version mismatch", () => { + assert.equal(evaluateBoot(503, { version: "3.8.49" }, "3.8.49").ok, false); + assert.equal(evaluateBoot(200, null, "3.8.49").ok, false); + const wrong = evaluateBoot(200, { version: "3.8.48" }, "3.8.49"); + assert.equal(wrong.ok, false); + assert.match(wrong.failures[0], /3\.8\.48/); +}); + +test("pickPort stays inside the reserved smoke range for any pid", () => { + for (const seed of [0, 1, 4000, 65535, 123456]) { + const p = pickPort(seed); + assert.ok(p >= 23000 && p < 27000, `port ${p} out of range for seed ${seed}`); + } +}); + +test("source guard: the gate polls the real health endpoint of the INSTALLED binary", () => { + const src = readFileSync(SCRIPT_PATH, "utf8"); + assert.ok(src.includes('"install", "-g", "--prefix"'), "must install the packed tarball into a clean prefix"); + assert.ok(src.includes("/api/monitoring/health"), "must poll the health endpoint"); + assert.ok(src.indexOf("npm") < src.indexOf("spawn"), "pack+install must precede the boot spawn"); +}); diff --git a/tests/unit/check-test-masking-selfref-6634.test.ts b/tests/unit/check-test-masking-selfref-6634.test.ts index 6d91a2e7c2..97171e07ba 100644 --- a/tests/unit/check-test-masking-selfref-6634.test.ts +++ b/tests/unit/check-test-masking-selfref-6634.test.ts @@ -33,10 +33,23 @@ function git(args: string[]): string { return execFileSync("git", args, { encoding: "utf8" }); } -test("#6634: check-test-masking.test.ts's own tautology fixtures must not self-flag as weakening", () => { +test("#6634: check-test-masking.test.ts's own tautology fixtures must not self-flag as weakening", (t) => { // origin/main predates the #6404 fixtures (countBareTautologies/scanBareTautologies // tests) that legitimately embed tautology-pattern literals as string fixtures. - const baseSrc = git(["show", "origin/main:" + FILE]); + // Shallow/single-ref checkouts (GitHub-hosted runners) have no origin/main — + // fetch it on demand; skip (never fail) when the ref is unreachable offline. + let baseSrc: string; + try { + baseSrc = git(["show", "origin/main:" + FILE]); + } catch { + try { + git(["fetch", "--depth=1", "origin", "main"]); + baseSrc = git(["show", "origin/main:" + FILE]); + } catch { + t.skip("origin/main unavailable (shallow checkout, offline) — nothing to compare against"); + return; + } + } const headSrc = git(["show", "HEAD:" + FILE]); const perFile = [ diff --git a/tests/unit/classify-pr-changes.test.ts b/tests/unit/classify-pr-changes.test.ts index a2815786cc..4f4e30154d 100644 --- a/tests/unit/classify-pr-changes.test.ts +++ b/tests/unit/classify-pr-changes.test.ts @@ -15,7 +15,7 @@ import { classifyPaths } from "../../scripts/quality/classify-pr-changes.mjs"; test("pure docs PR → docs only (no code unit/lint bag)", () => { const c = classifyPaths(["docs/architecture/QUALITY_GATES.md", "README.md"]); - assert.deepEqual(c, { code: false, docs: true, i18n: false, workflow: false }); + assert.deepEqual(c, { code: false, docs: true, i18n: false, workflow: false, testsOnly: false }); }); test("openapi under docs/ → docs (contract gates live in docs-sync, not unit)", () => { @@ -26,7 +26,7 @@ test("openapi under docs/ → docs (contract gates live in docs-sync, not unit)" test("pure message catalog → i18n only (not full unit suite)", () => { const c = classifyPaths(["src/i18n/messages/en.json", "src/i18n/messages/ko.json"]); - assert.deepEqual(c, { code: false, docs: false, i18n: true, workflow: false }); + assert.deepEqual(c, { code: false, docs: false, i18n: true, workflow: false, testsOnly: false }); }); test("i18n tooling/scripts → i18n + code (tooling can break runtime paths)", () => { @@ -49,7 +49,7 @@ test("workflow change → workflow + code (gates protect the gates)", () => { test("production source → code", () => { const c = classifyPaths(["open-sse/handlers/chatCore.ts", "src/lib/db/core.ts"]); - assert.deepEqual(c, { code: true, docs: false, i18n: false, workflow: false }); + assert.deepEqual(c, { code: true, docs: false, i18n: false, workflow: false, testsOnly: false }); }); test("mixed docs + code → both flags (jobs union their filters)", () => { @@ -65,5 +65,31 @@ test("unknown path → code fail-safe (never skip heavy gates by accident)", () test("empty change list → all false (nothing to validate)", () => { const c = classifyPaths([]); - assert.deepEqual(c, { code: false, docs: false, i18n: false, workflow: false }); + assert.deepEqual(c, { code: false, docs: false, i18n: false, workflow: false, testsOnly: false }); +}); + +// WS3.1 (v3.8.49 quality plan) — testsOnly powers the hotfix/test-only fast lane: +// a diff touching ONLY tests/ (and no tests/e2e/ spec) does not change the served +// app, so the 9-shard E2E matrix adds wall-time without coverage. e2e specs are +// excluded from the shortcut — changing an e2e spec REQUIRES running e2e. + +test("testsOnly: pure unit-test diff → true (still code)", () => { + const c = classifyPaths(["tests/unit/foo.test.ts", "tests/integration/bar.test.ts"]); + assert.equal(c.testsOnly, true); + assert.equal(c.code, true); +}); + +test("testsOnly: any non-test file flips it false", () => { + const c = classifyPaths(["tests/unit/foo.test.ts", "src/lib/db/core.ts"]); + assert.equal(c.testsOnly, false); +}); + +test("testsOnly: touching an e2e spec is NOT tests-only (e2e must run)", () => { + const c = classifyPaths(["tests/e2e/login.spec.ts"]); + assert.equal(c.testsOnly, false); +}); + +test("testsOnly: empty change list → false (fail-safe)", () => { + const c = classifyPaths([]); + assert.equal(c.testsOnly, false); }); diff --git a/tests/unit/combo-diagnostics-trace.test.ts b/tests/unit/combo-diagnostics-trace.test.ts index be25e64c77..fe8bb546a4 100644 --- a/tests/unit/combo-diagnostics-trace.test.ts +++ b/tests/unit/combo-diagnostics-trace.test.ts @@ -79,3 +79,41 @@ test("combo diagnostics: secret containment — non-whitelisted fields never sur assert.ok(!serialized.includes("accessToken"), "no accessToken KEY survives"); assert.ok(!serialized.includes("token"), "no token KEY survives"); }); + +test("combo diagnostics: terminalReason with a non-Latin1 char (em dash) must not crash Response construction (#6612)", () => { + const terminalReason = "reasoning consumed 5/5 tokens — no content output"; + assert.doesNotThrow(() => { + const res = errorResponseWithComboDiagnostics( + 502, + `Upstream response failed quality validation: ${terminalReason}`, + { + poolSize: 4, + attempted: 1, + excluded: [{ provider: "deepseek", model: "deepseek-v4-flash-free", reason: "quality — bad" }], + attemptOrder: [{ provider: "deepseek", model: "deepseek-v4-flash-free" }], + terminalReason, + } + ); + assert.equal(res.status, 502); + }); +}); + +test("combo diagnostics: JSON body keeps the original non-Latin1 text even though headers are ASCII-sanitized (#6612)", async () => { + const terminalReason = "reasoning consumed 5/5 tokens — no content output"; + const res = errorResponseWithComboDiagnostics( + 502, + `Upstream response failed quality validation: ${terminalReason}`, + { + poolSize: 1, + attempted: 1, + excluded: [], + attemptOrder: [{ provider: "deepseek", model: "deepseek-v4-flash-free" }], + terminalReason, + } + ); + // Header value must be a valid Latin1 ByteString — em dash (U+2014) replaced. + assert.equal(res.headers.get("x-omniroute-combo-terminal-reason"), terminalReason.replace("—", "?")); + const body = await res.json(); + // JSON body keeps the original, readable (unsanitized) em dash. + assert.equal(body.diagnostics.terminalReason, terminalReason); +}); diff --git a/tests/unit/combo-proxy-assignments-parse-7149.test.ts b/tests/unit/combo-proxy-assignments-parse-7149.test.ts new file mode 100644 index 0000000000..7afb82b487 --- /dev/null +++ b/tests/unit/combo-proxy-assignments-parse-7149.test.ts @@ -0,0 +1,32 @@ +import test from "node:test"; +import assert from "node:assert/strict"; +import { parseComboProxyAssignmentIds } from "../../src/app/(dashboard)/dashboard/combos/useComboProxyAssignments.ts"; + +test("#7149: parseComboProxyAssignmentIds extracts scopeIds from valid combo assignments", () => { + const data = { + items: [ + { scopeId: "combo-1", proxyId: "proxy-1", scope: "combo" }, + { scopeId: "combo-2", proxyId: "proxy-2", scope: "combo" }, + ], + }; + assert.deepEqual(parseComboProxyAssignmentIds(data), ["combo-1", "combo-2"]); +}); + +test("#7149: parseComboProxyAssignmentIds drops entries missing scopeId or proxyId", () => { + const data = { + items: [ + { scopeId: "combo-1", proxyId: "proxy-1" }, + { scopeId: "combo-2", proxyId: null }, + { scopeId: null, proxyId: "proxy-3" }, + {}, + ], + }; + assert.deepEqual(parseComboProxyAssignmentIds(data), ["combo-1"]); +}); + +test("#7149: parseComboProxyAssignmentIds returns [] for missing/malformed items", () => { + assert.deepEqual(parseComboProxyAssignmentIds(null), []); + assert.deepEqual(parseComboProxyAssignmentIds(undefined), []); + assert.deepEqual(parseComboProxyAssignmentIds({}), []); + assert.deepEqual(parseComboProxyAssignmentIds({ items: "not-an-array" }), []); +}); diff --git a/tests/unit/combo-scope-proxy-dead-7149.test.ts b/tests/unit/combo-scope-proxy-dead-7149.test.ts new file mode 100644 index 0000000000..8d301763e9 --- /dev/null +++ b/tests/unit/combo-scope-proxy-dead-7149.test.ts @@ -0,0 +1,87 @@ +import test from "node:test"; +import assert from "node:assert/strict"; +import fs from "node:fs"; +import os from "node:os"; +import path from "node:path"; + +const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-combo-proxy-7149-")); +process.env.DATA_DIR = TEST_DATA_DIR; +process.env.API_KEY_SECRET = "test-secret"; + +const core = await import("../../src/lib/db/core.ts"); +const proxiesDb = await import("../../src/lib/db/proxies.ts"); +const providersDb = await import("../../src/lib/db/providers.ts"); +const combosDb = await import("../../src/lib/db/combos.ts"); +const settingsDb = await import("../../src/lib/db/settings.ts"); + +type ProxyResolutionLike = { + proxy?: { host?: string } | null; + level?: string; + levelId?: string | null; +} | null; + +async function resetStorage() { + core.resetDbInstance(); + fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true }); + fs.mkdirSync(TEST_DATA_DIR, { recursive: true }); +} + +test.after(async () => { + core.resetDbInstance(); + fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true }); +}); + +test("#7149: a proxy assigned to a Combo via the dashboard (registry scope='combo') is honored when resolving the proxy for a request routed through that combo", async () => { + await resetStorage(); + + const comboProxy = await proxiesDb.createProxy({ + name: "Combo-Assigned Proxy", + type: "http", + host: "10.20.30.40", + port: 8888, + }); + assert.ok(comboProxy?.id); + + const combo = await combosDb.createCombo({ + name: "diy_deepseek-v4-flash", + strategy: "round-robin", + models: ["openai/gpt-4"], + }); + const comboRecord = combo as Record; + assert.ok(comboRecord?.id); + const comboId = comboRecord.id as string; + + const assignment = await proxiesDb.assignProxyToScope("combo", comboId, comboProxy!.id); + assert.ok(assignment, "assignProxyToScope('combo', ...) should persist the assignment"); + + const directRegistryLookup = (await proxiesDb.resolveProxyForScopeFromRegistry( + "combo", + comboId + )) as ProxyResolutionLike; + assert.ok( + directRegistryLookup?.proxy, + "the registry must be able to answer a direct combo-scope lookup" + ); + assert.equal(directRegistryLookup?.proxy?.host, "10.20.30.40"); + + const connection = await providersDb.createProviderConnection({ + provider: "openai", + authType: "apikey", + apiKey: "sk-test-1234", + name: "openai-account-1", + }); + const connectionRecord = connection as Record | null; + const connectionId = connectionRecord?.id as string; + assert.ok(connectionId, "test setup requires a real connection id"); + + const resolved = (await settingsDb.resolveProxyForConnection( + connectionId + )) as ProxyResolutionLike; + + assert.equal( + resolved?.level, + "combo", + `expected the combo-assigned proxy to be resolved (level="combo"), got level="${resolved?.level}" — the registry-based combo proxy assignment is never consulted by resolveProxyForConnection()` + ); + assert.equal(resolved?.proxy?.host, "10.20.30.40"); +}); diff --git a/tests/unit/compression/adaptive-context-budget-config.test.ts b/tests/unit/compression/adaptive-context-budget-config.test.ts new file mode 100644 index 0000000000..4dd4acb68c --- /dev/null +++ b/tests/unit/compression/adaptive-context-budget-config.test.ts @@ -0,0 +1,84 @@ +// Regression test for #7005 — adaptive context-budget dial not configurable. +// +// The compute engine for the adaptive context-budget ("dial") shipped in PR #4716 +// (Phase 4C), but it was never wired to persistence or the API: the PUT schema +// rejected any `contextBudget` payload (strict schema, no such key) and the DB-backed +// GET path never surfaced a `contextBudget` field. This test proves both halves of +// the wiring: the Zod schema accepts a `contextBudget` write, and the DB read/write +// path round-trips it. +import { describe, it, beforeEach, afterEach, after } from "node:test"; +import assert from "node:assert/strict"; +import fs from "node:fs"; +import os from "node:os"; +import path from "node:path"; + +const TEST_DATA_DIR = fs.mkdtempSync( + path.join(os.tmpdir(), "omniroute-adaptive-context-budget-db-") +); +const ORIGINAL_DATA_DIR = process.env.DATA_DIR; +process.env.DATA_DIR = TEST_DATA_DIR; + +const core = await import("../../../src/lib/db/core.ts"); +const { getCompressionSettings, updateCompressionSettings } = await import( + "../../../src/lib/db/compression.ts" +); +const { compressionSettingsUpdateSchema } = await import( + "../../../src/shared/validation/compressionConfigSchemas.ts" +); +const { DEFAULT_CONTEXT_BUDGET } = await import( + "../../../open-sse/services/compression/adaptiveCompression/types.ts" +); + +beforeEach(() => { + core.resetDbInstance(); + fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true }); + fs.mkdirSync(TEST_DATA_DIR, { recursive: true }); +}); + +afterEach(() => { + core.resetDbInstance(); +}); + +after(() => { + core.resetDbInstance(); + fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true }); + if (ORIGINAL_DATA_DIR === undefined) { + delete process.env.DATA_DIR; + } else { + process.env.DATA_DIR = ORIGINAL_DATA_DIR; + } +}); + +describe("bug #7005: adaptive context-budget dial is configurable", () => { + it("compressionSettingsUpdateSchema accepts a contextBudget write", () => { + const result = compressionSettingsUpdateSchema.safeParse({ + contextBudget: { + mode: "floor", + policy: "percentage", + outputReserve: 2048, + safetyMargin: 512, + pct: 0.75, + absoluteBudget: 0, + }, + }); + assert.equal(result.success, true, JSON.stringify("error" in result ? result.error : null)); + }); + + it("getCompressionSettings() defaults contextBudget to DEFAULT_CONTEXT_BUDGET when absent", async () => { + const settings = await getCompressionSettings(); + assert.deepEqual(settings.contextBudget, DEFAULT_CONTEXT_BUDGET); + }); + + it("updateCompressionSettings() persists a partial contextBudget merge", async () => { + await updateCompressionSettings({ + contextBudget: { ...DEFAULT_CONTEXT_BUDGET, mode: "floor", policy: "absolute", absoluteBudget: 8000 }, + }); + const settings = await getCompressionSettings(); + assert.equal(settings.contextBudget?.mode, "floor"); + assert.equal(settings.contextBudget?.policy, "absolute"); + assert.equal(settings.contextBudget?.absoluteBudget, 8000); + // Untouched fields keep their defaults (this is a JSON-column replace like ultra/aggressive, + // not a deep merge — the caller sends the full object, mirroring the existing pattern). + assert.equal(settings.contextBudget?.outputReserve, DEFAULT_CONTEXT_BUDGET.outputReserve); + }); +}); diff --git a/tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts b/tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts index 36d0441362..17e9952a46 100644 --- a/tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts +++ b/tests/unit/dockerfile-better-sqlite3-node-gyp-6700.test.ts @@ -44,7 +44,7 @@ test("#6700 builder stage compiles better-sqlite3 via a direct node-gyp rebuild, assert.match( stage, - /cd node_modules\/better-sqlite3\s*&&\s*npx\s+(--yes\s+)?node-gyp rebuild/, + /cd node_modules\/better-sqlite3\s*(\\\s*)?&&\s*(npx\s+(--yes\s+)?node-gyp|node \/usr\/local\/lib\/node_modules\/npm\/node_modules\/node-gyp\/bin\/node-gyp\.js) rebuild/, "builder stage must compile better-sqlite3 by invoking node-gyp directly inside its " + "package directory (bypasses npm's rebuild-script indirection)" ); @@ -64,7 +64,7 @@ test("#6700 the better-sqlite3 rebuild happens after `npm ci --ignore-scripts` a const stage = lines.slice(start, end).filter((l) => !l.trim().startsWith("#")); const ignoreScriptsIdx = stage.findIndex((l) => /npm ci\b.*--ignore-scripts/.test(l)); - const rebuildIdx = stage.findIndex((l) => /node-gyp rebuild/.test(l)); + const rebuildIdx = stage.findIndex((l) => /node-gyp(\.js)? rebuild/.test(l)); const smokeLoadIdx = stage.findIndex((l) => /node -e ".*require\('better-sqlite3'\)\(':memory:'\)\.close\(\)"/.test(l) ); diff --git a/tests/unit/duckduckgo-vqd-429-misclassification-6996.test.ts b/tests/unit/duckduckgo-vqd-429-misclassification-6996.test.ts new file mode 100644 index 0000000000..8b00ac5dc3 --- /dev/null +++ b/tests/unit/duckduckgo-vqd-429-misclassification-6996.test.ts @@ -0,0 +1,99 @@ +import { describe, it, before, after } from "node:test"; +import assert from "node:assert/strict"; +import fs from "node:fs"; +import os from "node:os"; +import path from "node:path"; + +const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-6996-")); +process.env.DATA_DIR = TEST_DATA_DIR; + +const { DuckDuckGoWebExecutor, STATUS_URL } = await import( + "../../open-sse/executors/duckduckgo-web.ts" +); +const { resetDbInstance } = await import("../../src/lib/db/core.ts"); +const executeInputBase = { + model: "gpt-4o-mini", + body: { + model: "gpt-4o-mini", + messages: [{ role: "user", content: "hi" }], + stream: false, + }, + stream: false, + credentials: {}, +}; + +describe("#6996 DuckDuckGo VQD 429 misclassification", () => { + let originalFetch: typeof fetch; + + before(() => { + originalFetch = globalThis.fetch; + }); + + after(() => { + globalThis.fetch = originalFetch; + resetDbInstance(); + fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true }); + }); + + it("propagates upstream 429 instead of masking it as a generic 503", async () => { + // Set the mock AFTER the module import so it wins over + // open-sse/utils/proxyFetch.ts's own module-load-time + // `globalThis.fetch = patchedFetch` side effect. + globalThis.fetch = (async (input: RequestInfo | URL) => { + const url = typeof input === "string" ? input : (input as URL | Request).toString(); + if (url === STATUS_URL) { + return new Response("", { + status: 429, + headers: { "Retry-After": "30" }, + }); + } + if (url.includes("/duckchat/v1/chat")) { + throw new Error("unexpected chat POST reached without a VQD token"); + } + return new Response("", { status: 200 }); + }) as typeof fetch; + + const executor = new DuckDuckGoWebExecutor(); + const response = await executor.execute(executeInputBase); + + const httpResponse = + response instanceof Response + ? response + : (response as { response: Response }).response; + const bodyText = await httpResponse.text(); + + assert.equal( + httpResponse.status, + 429, + `expected the executor to surface DuckDuckGo's real 429 rate-limit status, got ${httpResponse.status} (body: ${bodyText})` + ); + }); + + it("still returns 503 fallback for a genuine 5xx status on the VQD endpoint", async () => { + globalThis.fetch = (async (input: RequestInfo | URL) => { + const url = typeof input === "string" ? input : (input as URL | Request).toString(); + if (url === STATUS_URL) { + return new Response("", { status: 500 }); + } + if (url.includes("/duckchat/v1/chat")) { + throw new Error("unexpected chat POST reached without a VQD token"); + } + return new Response("", { status: 200 }); + }) as typeof fetch; + + const executor = new DuckDuckGoWebExecutor(); + const response = await executor.execute(executeInputBase); + + const httpResponse = + response instanceof Response + ? response + : (response as { response: Response }).response; + const bodyText = await httpResponse.text(); + + assert.equal( + httpResponse.status, + 503, + `expected the executor to keep the 503 fallback for a genuine upstream 5xx, got ${httpResponse.status} (body: ${bodyText})` + ); + }); +}); diff --git a/tests/unit/electron-rebuild-spawn-win.test.ts b/tests/unit/electron-rebuild-spawn-win.test.ts new file mode 100644 index 0000000000..bf0f9ff1db --- /dev/null +++ b/tests/unit/electron-rebuild-spawn-win.test.ts @@ -0,0 +1,22 @@ +import { test } from "node:test"; +import assert from "node:assert/strict"; +import { buildRebuildSpawnPlan } from "../../scripts/build/electronRebuildPlan.mjs"; + +// Regression: v3.8.47 tag build — spawnSync("npx.cmd", ...) WITHOUT shell:true fails with +// status null on Windows runners (Node's CVE-2024-27980 hardening blocks spawning .cmd/.bat +// without a shell), killing the better-sqlite3 Electron-ABI rebuild: +// "[electron] better-sqlite3 rebuild against electron 43.1.0 failed (exit null)". + +test("win32 rebuild plan spawns through a shell (cmd shims need it since CVE-2024-27980)", () => { + const plan = buildRebuildSpawnPlan("win32"); + assert.equal(plan.command, "npx.cmd"); + assert.equal(plan.shell, true); + assert.deepEqual(plan.args, ["--yes", "node-gyp", "rebuild"]); +}); + +test("posix rebuild plan spawns npx directly, no shell", () => { + const plan = buildRebuildSpawnPlan("linux"); + assert.equal(plan.command, "npx"); + assert.equal(plan.shell, false); + assert.deepEqual(plan.args, ["--yes", "node-gyp", "rebuild"]); +}); diff --git a/tests/unit/free-pool-tab.test.tsx b/tests/unit/free-pool-tab.test.tsx index 6279174fa4..91ee249776 100644 --- a/tests/unit/free-pool-tab.test.tsx +++ b/tests/unit/free-pool-tab.test.tsx @@ -91,13 +91,13 @@ afterEach(() => { // ── Tests ───────────────────────────────────────────────────────────────────── describe("FreePoolTab source toggles", () => { - it("renders a toggle group with exactly 3 buttons", async () => { + it("renders a toggle group with exactly 4 buttons", async () => { const el = renderTab(); await waitForCondition(() => el.querySelector("[role='group']") !== null); const bar = el.querySelector("[role='group']")!; expect(bar).toBeTruthy(); const buttons = bar.querySelectorAll("button"); - expect(buttons.length).toBe(3); + expect(buttons.length).toBe(4); }); it("all toggles start enabled (aria-pressed=true)", async () => { @@ -160,7 +160,7 @@ describe("FreePoolTab source toggles", () => { expect(stored).toContain("1proxy"); }); - it("button labels are 1proxy, Proxifly, IPLocate", async () => { + it("button labels are 1proxy, Proxifly, IPLocate, Webshare", async () => { const el = renderTab(); await waitForCondition(() => el.querySelector("[role='group']") !== null); const texts = Array.from(el.querySelector("[role='group']")!.querySelectorAll("button")).map( @@ -169,6 +169,7 @@ describe("FreePoolTab source toggles", () => { expect(texts).toContain("1proxy"); expect(texts).toContain("Proxifly"); expect(texts).toContain("IPLocate"); + expect(texts).toContain("Webshare"); }); }); diff --git a/tests/unit/gemini-web.test.ts b/tests/unit/gemini-web.test.ts index 5e4a25d0cf..8ae1fe9675 100644 --- a/tests/unit/gemini-web.test.ts +++ b/tests/unit/gemini-web.test.ts @@ -266,15 +266,20 @@ test("#2832: GeminiWebExecutor catch block sanitizes Playwright launch errors (i // ─── StreamGenerate parsing ───────────────────────────────────────────────── -test("parseStreamResponse concatenates Gemini Web text from multiple wrb.fr chunks", () => { +test("parseStreamResponse keeps only the final cumulative StreamGenerate snapshot (no duplication) — regression for #7163", () => { const makeChunk = (text: string) => { const inner = new Array(80).fill(null); inner[4] = [[null, [text]]]; return `[["wrb.fr", null, ${JSON.stringify(JSON.stringify(inner))}]]`; }; - const raw = `)]}'\n10\n${makeChunk("First ")}\n5\n${makeChunk("chunk")}`; - assert.equal(parseStreamResponse(raw), "First chunk"); + // Gemini's StreamGenerate frames are CUMULATIVE snapshots: each later frame + // repeats the full answer generated so far, not just the new characters. + const frame1 = "Hello!"; + const frame2 = "Hello! How can I"; + const frame3 = "Hello! How can I help you out today?"; + const raw = `)]}'\n10\n${makeChunk(frame1)}\n5\n${makeChunk(frame2)}\n5\n${makeChunk(frame3)}`; + assert.equal(parseStreamResponse(raw), frame3); }); test("parseStreamResponse ignores wrb.fr lines whose first entry is not an array", () => { diff --git a/tests/unit/homolog-admin-client.test.ts b/tests/unit/homolog-admin-client.test.ts new file mode 100644 index 0000000000..225f66073c --- /dev/null +++ b/tests/unit/homolog-admin-client.test.ts @@ -0,0 +1,17 @@ +import { test } from "node:test"; +import assert from "node:assert/strict"; +import { extractJwtCookie, extractApiKey } from "../../scripts/homolog/lib/adminClient.mjs"; + +test("extrai o cookie JWT do set-cookie do login", () => { + const jwt = extractJwtCookie(["auth_token=abc.def.ghi; Path=/; HttpOnly; SameSite=Lax"]); + assert.equal(jwt, "auth_token=abc.def.ghi"); +}); + +test("retorna null sem set-cookie de token", () => { + assert.equal(extractJwtCookie(["other=1; Path=/"]), null); +}); + +test("extrai key e id do POST /api/keys", () => { + const r = extractApiKey({ key: "or-abc123", id: "k1", name: "homolog-run" }); + assert.deepEqual(r, { key: "or-abc123", id: "k1" }); +}); diff --git a/tests/unit/homolog-parity.test.ts b/tests/unit/homolog-parity.test.ts new file mode 100644 index 0000000000..0c3d779f41 --- /dev/null +++ b/tests/unit/homolog-parity.test.ts @@ -0,0 +1,29 @@ +import { test } from "node:test"; +import assert from "node:assert/strict"; +import { evaluateParity } from "../../scripts/homolog/lib/parity.mjs"; + +test("parity OK quando health bate com a versão esperada", () => { + const r = evaluateParity( + { status: "healthy", version: "3.8.49" }, + { expectedVersion: "3.8.49", httpStatus: 200 } + ); + assert.equal(r.ok, true); + assert.deepEqual(r.failures, []); +}); + +test("parity falha listando cada divergência", () => { + const r = evaluateParity( + { status: "degraded", version: "3.8.47" }, + { expectedVersion: "3.8.49", httpStatus: 200 } + ); + assert.equal(r.ok, false); + assert.equal(r.failures.length, 2); // status!=healthy, version mismatch +}); + +test("parity falha em HTTP não-200 mesmo com body bom", () => { + const r = evaluateParity( + { status: "healthy", version: "3.8.49" }, + { expectedVersion: "3.8.49", httpStatus: 503 } + ); + assert.equal(r.ok, false); +}); diff --git a/tests/unit/homolog-promptfoo-ctrf.test.ts b/tests/unit/homolog-promptfoo-ctrf.test.ts new file mode 100644 index 0000000000..d22dd652ee --- /dev/null +++ b/tests/unit/homolog-promptfoo-ctrf.test.ts @@ -0,0 +1,18 @@ +import { test } from "node:test"; +import assert from "node:assert/strict"; +import { promptfooToCtrf } from "../../scripts/homolog/lib/promptfooToCtrf.mjs"; + +test("mapeia resultados do promptfoo para tests CTRF", () => { + const ctrf = promptfooToCtrf({ + results: { + results: [ + { provider: { label: "openai" }, success: true, latencyMs: 812 }, + { provider: { label: "grok" }, success: false, latencyMs: 30000, error: "timeout" }, + ], + }, + }); + assert.equal(ctrf.results.summary.tests, 2); + assert.equal(ctrf.results.summary.passed, 1); + assert.equal(ctrf.results.tests[1].status, "failed"); + assert.equal(ctrf.results.tests[1].name, "provider-smoke: grok"); +}); diff --git a/tests/unit/homolog-provider-tiers.test.ts b/tests/unit/homolog-provider-tiers.test.ts new file mode 100644 index 0000000000..3c793da73f --- /dev/null +++ b/tests/unit/homolog-provider-tiers.test.ts @@ -0,0 +1,24 @@ +import { test } from "node:test"; +import assert from "node:assert/strict"; +import { pickSmokeModels } from "../../scripts/homolog/lib/providerTiers.mjs"; + +const CATALOG = [ + { id: "openai/gpt-5-mini" }, + { id: "openai/gpt-5" }, + { id: "anthropic/claude-sonnet-5" }, + { id: "mistral/mistral-small" }, + { id: "grok/grok-4-fast" }, +]; + +test("1 modelo por provider crítico (o primeiro do catálogo)", () => { + const picks = pickSmokeModels(CATALOG, ["openai", "anthropic", "grok"]); + assert.deepEqual( + picks.map((p) => p.model), + ["openai/gpt-5-mini", "anthropic/claude-sonnet-5", "grok/grok-4-fast"] + ); +}); + +test("provider crítico ausente do catálogo vira miss reportável", () => { + const picks = pickSmokeModels(CATALOG, ["openai", "nvidia"]); + assert.equal(picks.find((p) => p.provider === "nvidia").model, null); +}); diff --git a/tests/unit/homolog-sse-parser.test.ts b/tests/unit/homolog-sse-parser.test.ts new file mode 100644 index 0000000000..b51c226385 --- /dev/null +++ b/tests/unit/homolog-sse-parser.test.ts @@ -0,0 +1,28 @@ +import { test } from "node:test"; +import assert from "node:assert/strict"; +import { parseSseChunk, summarizeStream } from "../../scripts/homolog/lib/sseCheck.mjs"; + +test("parseSseChunk separa eventos data: e detecta [DONE]", () => { + const events = parseSseChunk('data: {"choices":[{"delta":{"content":"O"}}]}\n\ndata: [DONE]\n\n'); + assert.equal(events.length, 2); + assert.equal(events[1], "[DONE]"); +}); + +test("parseSseChunk acha data: mesmo precedido de comment-lines SSE no mesmo bloco", () => { + // Formato real da VPS (v3.8.47): trailers de telemetria como comments (`: x-omniroute-*`) + // no MESMO bloco do data: [DONE] — o parser não pode olhar só o início do bloco. + const chunk = + 'data: {"choices":[{"delta":{"content":"OK"}}]}\n\n' + + ": x-omniroute-cache-hit=false\n: x-omniroute-latency-ms=67\ndata: [DONE]\n\n"; + const events = parseSseChunk(chunk); + assert.deepEqual(events, ['{"choices":[{"delta":{"content":"OK"}}]}', "[DONE]"]); +}); + +test("summarizeStream exige >=1 delta de conteúdo e terminador [DONE]", () => { + const good = summarizeStream(['{"choices":[{"delta":{"content":"OK"}}]}', "[DONE]"]); + assert.equal(good.ok, true); + const noDone = summarizeStream(['{"choices":[{"delta":{"content":"OK"}}]}']); + assert.equal(noDone.ok, false); + const noContent = summarizeStream(["[DONE]"]); + assert.equal(noContent.ok, false); +}); diff --git a/tests/unit/issue-7071-ollama-session-quota.test.ts b/tests/unit/issue-7071-ollama-session-quota.test.ts new file mode 100644 index 0000000000..25b297c0ad --- /dev/null +++ b/tests/unit/issue-7071-ollama-session-quota.test.ts @@ -0,0 +1,103 @@ +/** + * Issue #7071 — Ollama Cloud's 5-hour "session" usage-limit 429 is never + * recognized as quota-exhausted. The upstream returns a body like: + * "you () have reached your session usage limit" + * + * This exactly mirrors the already-fixed "weekly usage limit" gap (#3709, + * #6638): ollama-cloud is an apikey-category provider (not oauth), so the + * oauth-only `shouldUseQuotaSignal` gate in checkFallbackError skips the + * generic subscription-quota-text branch (#2321) for its 429s. Without a + * dedicated, ungated session check the account fell through to the generic + * 429 backoff (~3s, capped low) and got retried within the same 5-hour + * session window instead of cooling down for the session's duration — + * combo/LKGP routing cycled back to the "exhausted" account instead of + * advancing to the next one. + * + * This test proves: (1) the session-usage-limit text is classified as + * QUOTA_EXHAUSTED with a cooldown far longer than the generic backoff cap, + * for BOTH apikey and oauth provider categories, and (2) unrelated + * session-expired/auth wording and the sibling weekly-quota text are + * unaffected. + */ +import test from "node:test"; +import assert from "node:assert/strict"; + +const { checkFallbackError } = await import("../../open-sse/services/accountFallback.ts"); +const { isSessionUsageLimitText, buildSessionQuotaFallback, isWeeklyUsageLimitText } = + await import("../../open-sse/services/quotaTextCooldowns.ts"); +const { RateLimitReason, BACKOFF_CONFIG } = await import("../../open-sse/config/constants.ts"); +const { BACKOFF_CONFIG: ERROR_BACKOFF_CONFIG } = await import("../../open-sse/config/errorConfig.ts"); + +const SESSION_BODY = "you (acme-corp) have reached your session usage limit"; +const SESSION_COOLDOWN_MS = 5 * 60 * 60 * 1000; // 5 hours + +test("#7071 sanity: weekly text IS recognized (already fixed by #3709/#6638)", () => { + assert.equal(isWeeklyUsageLimitText("you (acme-corp) have reached your weekly usage limit"), true); +}); + +test("#7071 isSessionUsageLimitText matches the ollama-cloud 429 body", () => { + assert.equal(isSessionUsageLimitText(SESSION_BODY.toLowerCase()), true); + assert.equal(isSessionUsageLimitText("session limit reached, try later"), true); + assert.equal(isSessionUsageLimitText("rate_limit_exceeded: too many requests"), false); + // Must not false-positive on unrelated "session expired" auth errors. + assert.equal(isSessionUsageLimitText("your session has expired, please log in again"), false); + assert.equal(isSessionUsageLimitText("session token invalid"), false); +}); + +test("#7071 buildSessionQuotaFallback returns a 5h QUOTA_EXHAUSTED cooldown, far above the generic backoff cap", () => { + const result = buildSessionQuotaFallback(SESSION_BODY); + assert.ok(result, "expected a non-null fallback for session-usage-limit text"); + assert.equal(result!.reason, RateLimitReason.QUOTA_EXHAUSTED); + assert.equal(result!.cooldownMs, SESSION_COOLDOWN_MS); + assert.ok(result!.cooldownMs > (ERROR_BACKOFF_CONFIG.max ?? BACKOFF_CONFIG.max)); +}); + +test("#7071 buildSessionQuotaFallback returns null for unrelated error text", () => { + assert.equal(buildSessionQuotaFallback("rate_limit_exceeded: too many requests"), null); + assert.equal(buildSessionQuotaFallback("your session has expired, please log in again"), null); +}); + +test("#7071 BUG: checkFallbackError misclassifies ollama-cloud session-quota 429 as generic RATE_LIMIT_EXCEEDED instead of QUOTA_EXHAUSTED", () => { + const out = checkFallbackError( + 429, + SESSION_BODY, + 0, // backoffLevel + null, // model + "ollama-cloud", // provider (apikey category) + null, // headers + null, // profileOverride + null // structuredError + ); + + assert.equal(out.shouldFallback, true); + assert.equal( + out.reason, + RateLimitReason.QUOTA_EXHAUSTED, + `expected QUOTA_EXHAUSTED for session-usage-limit text, got reason=${out.reason} cooldownMs=${out.cooldownMs}` + ); + assert.equal(out.cooldownMs, SESSION_COOLDOWN_MS); +}); + +test("#7071 checkFallbackError: oauth-category provider with session-limit text also gets the long cooldown", () => { + const out = checkFallbackError(429, SESSION_BODY, 0, null, "claude", null, null, null); + assert.equal(out.reason, RateLimitReason.QUOTA_EXHAUSTED); + assert.equal(out.cooldownMs, SESSION_COOLDOWN_MS); +}); + +test("#7071 checkFallbackError: ollama-cloud generic rate-limit body is unaffected (no false positive)", () => { + const out = checkFallbackError( + 429, + "rate_limit_exceeded: too many requests", + 0, + null, + "ollama-cloud", + null, + null, + null + ); + assert.equal(out.reason, RateLimitReason.RATE_LIMIT_EXCEEDED); + assert.ok( + out.cooldownMs <= 2 * 60 * 1000, + "generic rate limit text must keep the normal short backoff, not the 5h session cooldown" + ); +}); diff --git a/tests/unit/main-server-keepalive-timeout-7003.test.ts b/tests/unit/main-server-keepalive-timeout-7003.test.ts new file mode 100644 index 0000000000..fd20f19774 --- /dev/null +++ b/tests/unit/main-server-keepalive-timeout-7003.test.ts @@ -0,0 +1,202 @@ +import { describe, it } from "node:test"; +import assert from "node:assert/strict"; +import http from "node:http"; +import net from "node:net"; +import { getMainServerTimeoutConfig } from "../../src/shared/utils/runtimeTimeouts.ts"; + +// #7003 — JetBrains AI Assistant ("Test Connection" / completions) reported +// "HTTP/1.1 header parser received no bytes". The main OmniRoute server +// (scripts/dev/run-next.mjs) boots a bare `http.createServer(...)` and never +// configures `keepAliveTimeout`/`headersTimeout`, leaving Node's http.Server +// default of keepAliveTimeout=5_000ms with no `Keep-Alive: timeout=N` response +// hint. JetBrains AI Assistant's JVM `java.net.http.HttpClient` connection pool +// can reuse a socket idle for longer than that window; the server has already +// torn the socket down, so the client gets 0 response bytes back instead of a +// fresh HTTP response. +// +// This spec proves both halves: +// 1. `getMainServerTimeoutConfig()` raises the defaults well above Node's +// unconfigured 5_000ms window (the actual fix wired into run-next.mjs). +// 2. A bare http.Server left at Node's defaults drops a socket reused after +// an idle gap past 5s, while the same server configured via +// `getMainServerTimeoutConfig()` keeps serving the reused connection. + +describe("#7003 getMainServerTimeoutConfig", () => { + it("defaults keepAliveTimeout/headersTimeout well above Node's 5_000ms default", () => { + const config = getMainServerTimeoutConfig({}); + assert.equal(config.keepAliveTimeoutMs, 65_000); + assert.equal(config.headersTimeoutMs, 66_000); + assert.ok(config.keepAliveTimeoutMs > 5_000, "must exceed Node's unconfigured default"); + assert.ok( + config.headersTimeoutMs > config.keepAliveTimeoutMs, + "headersTimeout must stay above keepAliveTimeout per Node's own requirement" + ); + }); + + it("honors env overrides and keeps headersTimeout coherent with a raised keepAliveTimeout", () => { + const config = getMainServerTimeoutConfig({ + MAIN_SERVER_KEEPALIVE_TIMEOUT_MS: "120000", + MAIN_SERVER_HEADERS_TIMEOUT_MS: "121000", + }); + assert.equal(config.keepAliveTimeoutMs, 120_000); + assert.equal(config.headersTimeoutMs, 121_000); + }); + + it("bumps an inconsistent explicit headersTimeout override above keepAliveTimeout", () => { + const config = getMainServerTimeoutConfig({ + MAIN_SERVER_KEEPALIVE_TIMEOUT_MS: "120000", + MAIN_SERVER_HEADERS_TIMEOUT_MS: "1000", + }); + assert.equal(config.keepAliveTimeoutMs, 120_000); + assert.equal(config.headersTimeoutMs, 121_000); + }); + + it("falls back to defaults on invalid env values", () => { + const config = getMainServerTimeoutConfig({ + MAIN_SERVER_KEEPALIVE_TIMEOUT_MS: "not-a-number", + }); + assert.equal(config.keepAliveTimeoutMs, 65_000); + }); +}); + +/** + * Sends a raw HTTP/1.1 GET over an already-connected keep-alive socket and + * resolves with whatever bytes arrive within a short settle window (empty + * string if nothing comes back — the exact "0 bytes back" failure mode + * JetBrains AI Assistant surfaces as "header parser received no bytes"). + * + * The socket is opened with `allowHalfOpen: true` so it faithfully mimics a + * JVM/OkHttp-style client: Node's default `allowHalfOpen: false` proactively + * ends the writable side the instant it processes an incoming FIN, turning + * the reused write into a synchronous "socket has been ended" error instead + * of the real-world race — a write that is accepted locally (the server + * already destroyed the connection, so it never arrives) whose response + * settles as 0 bytes. + */ +function sendKeepAliveRequest(socket: net.Socket, port: number): Promise { + return new Promise((resolve) => { + let received = ""; + let settleTimer: NodeJS.Timeout; + const finish = () => { + socket.off("data", onData); + clearTimeout(settleTimer); + resolve(received); + }; + // A short settle window once the full chunked response has arrived (fast + // path); a generous cap in case nothing ever comes back — the torn-down + // connection case this test proves, and a safety margin against first-run + // JIT/module-load jitter under the test runner. + const onData = (chunk: Buffer) => { + received += chunk.toString("utf8"); + if (received.endsWith("0\r\n\r\n")) { + clearTimeout(settleTimer); + settleTimer = setTimeout(finish, 50); + } + }; + socket.on("data", onData); + socket.write(`GET / HTTP/1.1\r\nHost: 127.0.0.1:${port}\r\nConnection: keep-alive\r\n\r\n`); + settleTimer = setTimeout(finish, 3_000); + }); +} + +function startEchoServer(configure: (server: http.Server) => void): Promise { + return new Promise((resolve) => { + const server = http.createServer((_req, res) => { + res.writeHead(200, { "content-type": "text/plain" }); + res.end("ok"); + }); + configure(server); + server.listen(0, "127.0.0.1", () => resolve(server)); + }); +} + +async function withServer( + configure: (server: http.Server) => void, + run: (port: number) => Promise +): Promise { + const server = await startEchoServer(configure); + try { + const address = server.address(); + if (typeof address !== "object" || address === null) { + throw new Error("expected server to bind a TCP address"); + } + await run(address.port); + } finally { + await new Promise((resolve) => server.close(() => resolve())); + } +} + +// Node's default keepAliveTimeout is 5_000ms, but the server only starts that +// timer once the response has fully flushed and there is a small amount of +// internal scheduling overhead before the socket is actually torn down — +// empirically ~5.8-6s end-to-end on loopback. 6.5s reliably clears that +// window without relying on a hair-trigger race. +const IDLE_GAP_MS = 6_500; + +describe("#7003 keep-alive socket reuse across an idle gap", () => { + it( + "current Node defaults (keepAliveTimeout=5000ms): a pooled socket reused after 6.5s idle gets 0 bytes back", + { timeout: 30_000 }, + async () => { + await withServer( + () => { + /* leave Node's http.Server defaults untouched (keepAliveTimeout=5000ms) */ + }, + async (port) => { + const socket = net.connect({ port, host: "127.0.0.1", allowHalfOpen: true }); + await new Promise((resolve, reject) => { + socket.once("connect", () => resolve()); + socket.once("error", reject); + }); + + const first = await sendKeepAliveRequest(socket, port); + assert.match(first, /200/, "first request on a fresh socket must succeed"); + + await new Promise((resolve) => setTimeout(resolve, IDLE_GAP_MS)); + + const second = await sendKeepAliveRequest(socket, port); + assert.equal( + second, + "", + "reusing the idle-torn-down socket must get exactly 0 bytes back (the reported bug)" + ); + socket.destroy(); + } + ); + } + ); + + it( + "fixed config (getMainServerTimeoutConfig): the same reused connection stays alive past 6.5s idle", + { timeout: 30_000 }, + async () => { + const fixedTimeouts = getMainServerTimeoutConfig({}); + await withServer( + (server) => { + server.keepAliveTimeout = fixedTimeouts.keepAliveTimeoutMs; + server.headersTimeout = fixedTimeouts.headersTimeoutMs; + }, + async (port) => { + const socket = net.connect({ port, host: "127.0.0.1", allowHalfOpen: true }); + await new Promise((resolve, reject) => { + socket.once("connect", () => resolve()); + socket.once("error", reject); + }); + + const first = await sendKeepAliveRequest(socket, port); + assert.match(first, /200/, "first request on a fresh socket must succeed"); + + await new Promise((resolve) => setTimeout(resolve, IDLE_GAP_MS)); + + const second = await sendKeepAliveRequest(socket, port); + assert.match( + second, + /200/, + "the reused connection must still get a valid response after the fix" + ); + socket.destroy(); + } + ); + } + ); +}); diff --git a/tests/unit/minimax-m3-model-registry.test.ts b/tests/unit/minimax-m3-model-registry.test.ts index 820cbc77ca..2aae2b3a69 100644 --- a/tests/unit/minimax-m3-model-registry.test.ts +++ b/tests/unit/minimax-m3-model-registry.test.ts @@ -29,13 +29,11 @@ describe("MiniMax M3 model registration (#3110)", () => { assert.equal(m3.contextLength, 1_048_576); }); - it("opencode provider has minimax-m3-free with 1M context", () => { + it("opencode provider does NOT list minimax-m3-free (#6998 — delisted upstream, 401)", () => { const entry = REGISTRY.opencode; assert.ok(entry, "opencode registry entry must exist"); const m3 = entry.models.find((m) => m.id === "minimax-m3-free"); - assert.ok(m3, "minimax-m3-free must be in opencode models"); - assert.equal(m3.name, "MiniMax M3 Free"); - assert.equal(m3.contextLength, 1_048_576); + assert.equal(m3, undefined, "minimax-m3-free was delisted from OpenCode Zen's free tier (#6998)"); }); it("opencode-go provider has minimax-m3 with Claude targetFormat", () => { diff --git a/tests/unit/next-config.test.ts b/tests/unit/next-config.test.ts index 29821fa4ec..9281175217 100644 --- a/tests/unit/next-config.test.ts +++ b/tests/unit/next-config.test.ts @@ -288,6 +288,30 @@ test("turbopack.ignoreIssue suppresses the agentSkills over-bundling warning (#6 assert.match(String(agentSkillsRule.description), /Overly broad patterns/); }); +test("turbopack.ignoreIssue suppresses the compression module over-bundling warning (#7051)", async () => { + // open-sse/services/compression/ruleLoader.ts and + // .../engines/rtk/filterLoader.ts both define an identical getModuleDir() + // helper that walks up directories via path.resolve(anchor) + + // fs.existsSync(...) in a loop with a non-literal argument — the same + // class of dynamic-path fs access that #6582 suppressed for + // src/lib/agentSkills/**, but that narrow allowlist glob didn't cover this + // module, so the warning kept firing (610 times) for every entry point + // transitively importing the compression module. This guards the config + // shape so the suppression rule isn't silently dropped in a future edit. + const { default: nextConfig } = await loadNextConfig("ignore-issue-compression"); + const rules = nextConfig.turbopack?.ignoreIssue; + + assert.ok(Array.isArray(rules), "expected turbopack.ignoreIssue to be an array"); + const compressionRule = rules.find((rule) => + String(rule.path).includes("open-sse/services/compression") + ); + assert.ok( + compressionRule, + "expected an ignoreIssue rule targeting open-sse/services/compression/**" + ); + assert.match(String(compressionRule.description), /Overly broad patterns/); +}); + test("optimizePackageImports excludes the internal @omniroute/open-sse workspace (build-OOM guard)", async () => { // Regression guard: adding the internal `@omniroute/open-sse` workspace to // optimizePackageImports makes Next.js resolve its entire barrel at build diff --git a/tests/unit/noAuthProxyResolution.relayAuth.test.ts b/tests/unit/noAuthProxyResolution.relayAuth.test.ts new file mode 100644 index 0000000000..f838038a0f --- /dev/null +++ b/tests/unit/noAuthProxyResolution.relayAuth.test.ts @@ -0,0 +1,49 @@ +import { test } from "node:test"; +import assert from "node:assert/strict"; +import { resolveAccountProxies } from "../../src/sse/services/noAuthProxyResolution.ts"; + +test("resolveAccountProxies preserves relayAuth for relay-type (vercel/deno/cloudflare) pool proxies", async () => { + const fakeVercelProxyRow = { + id: "proxy-1", + type: "vercel", + host: "my-relay-abc123.vercel.app", + port: 443, + username: null, + password: null, + notes: JSON.stringify({ relayAuth: "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef" }), + }; + + const resolved = await resolveAccountProxies( + [{ fingerprint: "acct-1", proxyId: "proxy-1" }], + async (id) => (id === "proxy-1" ? fakeVercelProxyRow : null) + ); + + const proxy = resolved[0].proxy as unknown as { type?: string; relayAuth?: string }; + assert.equal(proxy?.type, "vercel"); + assert.equal( + proxy?.relayAuth, + "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef", + "relayAuth must survive resolveAccountProxies() for relay-type (vercel/deno/cloudflare) proxies" + ); +}); + +test("resolveAccountProxies leaves relayAuth absent for plain non-relay (socks5/http) pool proxies", async () => { + const fakeSocksProxyRow = { + id: "proxy-2", + type: "socks5", + host: "1.2.3.4", + port: 1080, + username: "u", + password: "p", + notes: JSON.stringify({ relayAuth: "should-not-leak-onto-non-relay-types" }), + }; + + const resolved = await resolveAccountProxies( + [{ fingerprint: "acct-2", proxyId: "proxy-2" }], + async (id) => (id === "proxy-2" ? fakeSocksProxyRow : null) + ); + + const proxy = resolved[0].proxy as unknown as { type?: string; relayAuth?: string }; + assert.equal(proxy?.type, "socks5"); + assert.equal(proxy?.relayAuth, undefined); +}); diff --git a/tests/unit/opencode-free-tier-catalog-stale-6998.test.ts b/tests/unit/opencode-free-tier-catalog-stale-6998.test.ts new file mode 100644 index 0000000000..c1d3eeae09 --- /dev/null +++ b/tests/unit/opencode-free-tier-catalog-stale-6998.test.ts @@ -0,0 +1,40 @@ +import test from "node:test"; +import assert from "node:assert/strict"; + +const { opencodeProvider } = await import( + "../../open-sse/config/providers/registry/opencode/index.ts" +); + +function modelIds(): string[] { + return (opencodeProvider.models ?? []).map((m) => m.id); +} + +const DELISTED_FREE_MODELS = [ + "minimax-m3-free", + "minimax-m2.5-free", + "ling-2.6-1t-free", + "trinity-large-preview-free", + "nemotron-3-super-free", + "qwen3.6-plus-free", +]; + +const LIVE_FREE_MODELS_MISSING_FROM_CATALOG = [ + "mimo-v2.5-free", + "hy3-free", + "nemotron-3-ultra-free", + "north-mini-code-free", +]; + +test("issue #6998: oc registry does not advertise delisted free-tier models", () => { + const ids = modelIds(); + for (const delisted of DELISTED_FREE_MODELS) { + assert.ok(!ids.includes(delisted), `oc registry still advertises delisted upstream model "${delisted}"`); + } +}); + +test("issue #6998: oc registry advertises the current live free-tier models", () => { + const ids = modelIds(); + for (const live of LIVE_FREE_MODELS_MISSING_FROM_CATALOG) { + assert.ok(ids.includes(live), `oc registry is missing live upstream free-tier model "${live}"`); + } +}); diff --git a/tests/unit/opencode-go-quota-no-zai.test.ts b/tests/unit/opencode-go-quota-no-zai.test.ts new file mode 100644 index 0000000000..b4775040fa --- /dev/null +++ b/tests/unit/opencode-go-quota-no-zai.test.ts @@ -0,0 +1,31 @@ +import assert from "node:assert/strict"; +import { test } from "node:test"; + +import { getOpenCodeGoUsage } from "../../open-sse/services/opencodeOllamaUsage.ts"; + +test("getOpenCodeGoUsage does not send the user's OpenCode Go API key to api.z.ai by default", async () => { + const originalFetch = globalThis.fetch; + const originalEnv = process.env.OMNIROUTE_OPENCODE_GO_QUOTA_URL; + delete process.env.OMNIROUTE_OPENCODE_GO_QUOTA_URL; + + let calledHost: string | null = null; + globalThis.fetch = (async (input: RequestInfo | URL) => { + const url = typeof input === "string" ? input : input.toString(); + calledHost = new URL(url).host; + throw new Error(`unexpected outbound fetch to ${url}`); + }) as typeof fetch; + + try { + const result = await getOpenCodeGoUsage("sk-fake-opencode-go-key", undefined); + assert.notStrictEqual(calledHost, "api.z.ai"); + assert.strictEqual(calledHost, null); + assert.ok( + typeof result.message === "string" && result.message.length > 0, + "expected a descriptive message when no quota URL is configured" + ); + } finally { + globalThis.fetch = originalFetch; + if (originalEnv === undefined) delete process.env.OMNIROUTE_OPENCODE_GO_QUOTA_URL; + else process.env.OMNIROUTE_OPENCODE_GO_QUOTA_URL = originalEnv; + } +}); diff --git a/tests/unit/opencode-go-usage.test.ts b/tests/unit/opencode-go-usage.test.ts index 64e6357800..302a95f244 100644 --- a/tests/unit/opencode-go-usage.test.ts +++ b/tests/unit/opencode-go-usage.test.ts @@ -1,9 +1,25 @@ -import test from "node:test"; +import test, { after } from "node:test"; import assert from "node:assert/strict"; +// The OpenCode Go quota-by-API-key path is opt-in only (see #7022 — there is no +// working default quota endpoint, so OMNIROUTE_OPENCODE_GO_QUOTA_URL must be set +// explicitly by the operator). The module reads this env var once at import time, +// so it has to be set BEFORE the dynamic import below for the opt-in tests in this +// file (which simulate an operator who configured the URL) to exercise the fetch path. +const ORIGINAL_OPENCODE_GO_QUOTA_URL = process.env.OMNIROUTE_OPENCODE_GO_QUOTA_URL; +process.env.OMNIROUTE_OPENCODE_GO_QUOTA_URL = "https://api.z.ai/api/monitor/usage/quota/limit"; + const usage = await import("../../open-sse/services/usage.ts"); const { USAGE_SUPPORTED_PROVIDERS } = await import("../../src/shared/constants/providers.ts"); +after(() => { + if (ORIGINAL_OPENCODE_GO_QUOTA_URL === undefined) { + delete process.env.OMNIROUTE_OPENCODE_GO_QUOTA_URL; + } else { + process.env.OMNIROUTE_OPENCODE_GO_QUOTA_URL = ORIGINAL_OPENCODE_GO_QUOTA_URL; + } +}); + test("USAGE_SUPPORTED_PROVIDERS includes opencode-go", () => { assert.ok( (USAGE_SUPPORTED_PROVIDERS as string[]).includes("opencode-go"), @@ -298,7 +314,8 @@ test("getUsageForProvider returns message for invalid OpenCode Go API keys", asy })) as { message: string }; assert.equal( result.message, - "OpenCode Go API key is valid for chat/models but cannot read quota from the Z.AI quota API. " + + "OpenCode Go API key is valid for chat/models but cannot read quota from the configured " + + "OMNIROUTE_OPENCODE_GO_QUOTA_URL endpoint. " + "Set OPENCODE_GO_WORKSPACE_ID and OPENCODE_GO_AUTH_COOKIE to enable dashboard quota scraping." ); } finally { @@ -342,7 +359,8 @@ test("getUsageForProvider returns message when OpenCode Go quota API returns 200 })) as { message: string }; assert.equal( result.message, - "OpenCode Go API key is valid for chat/models but cannot read quota from the Z.AI quota API. " + + "OpenCode Go API key is valid for chat/models but cannot read quota from the configured " + + "OMNIROUTE_OPENCODE_GO_QUOTA_URL endpoint. " + "Set OPENCODE_GO_WORKSPACE_ID and OPENCODE_GO_AUTH_COOKIE to enable dashboard quota scraping." ); } finally { diff --git a/tests/unit/pack-artifact-entrypoint-closures.test.ts b/tests/unit/pack-artifact-entrypoint-closures.test.ts new file mode 100644 index 0000000000..78b4826417 --- /dev/null +++ b/tests/unit/pack-artifact-entrypoint-closures.test.ts @@ -0,0 +1,125 @@ +import { test } from "node:test"; +import assert from "node:assert/strict"; +import fs from "node:fs"; +import path from "node:path"; +import { fileURLToPath } from "node:url"; +import { + APP_STAGING_ALLOWED_EXACT_PATHS, + PACK_ARTIFACT_REQUIRED_PATHS, +} from "../../scripts/build/pack-artifact-policy.ts"; + +// Generalization of pack-artifact-server-ws-closure.test.ts (#7065 class, 3rd recurrence: +// tls-options/3.8.41, head-response-guard VPS #7040 + npm #7065). assembleStandalone copies +// wrapper modules to the dist ROOT; the prepublish prune then deletes anything not in +// APP_STAGING_ALLOWED_EXACT_PATHS, and check:pack-artifact only fails for entries in +// PACK_ARTIFACT_REQUIRED_PATHS. The original test hardcoded ONE wrapper (server-ws.mjs) +// and ONE import form (static `from "./x"`). This suite derives the full closure from the +// sources of truth — EXTRA_MODULE_ENTRIES in assembleStandalone.mjs plus each wrapper's own +// imports (static, dynamic import() and require()) — so adding an import to ANY npm-shipped +// wrapper without updating both lists fails here instead of shipping a boot-crashing tarball. + +const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../.."); +const ASSEMBLE = path.join(ROOT, "scripts", "build", "assembleStandalone.mjs"); +const BIN_ENTRY = path.join(ROOT, "bin", "omniroute.mjs"); + +interface WrapperEntry { + src: string; + dest: string; +} + +// EXTRA_MODULE_ENTRIES entries whose dest is a bare module filename at the dist root — +// these are the boot-path wrappers the prune can silently drop (the #7065 shape). +function distRootWrappers(): WrapperEntry[] { + const text = fs.readFileSync(ASSEMBLE, "utf8"); + const entries = [...text.matchAll(/src:\s*\[([^\]]+)\],?\s*dest:\s*\[([^\]]+)\]/gs)]; + const toPath = (segmentList: string) => + segmentList + .split(",") + .map((s) => s.trim().replace(/^"|"$/g, "")) + .filter(Boolean) + .join("/"); + return entries + .map((m) => ({ src: toPath(m[1]), dest: toPath(m[2]) })) + .filter((e) => !e.dest.includes("/") && /\.(mjs|cjs|js)$/.test(e.dest)); +} + +// Local sibling imports of a module: static `from "./x"`, dynamic `import("./x")`, +// and CommonJS `require("./x")`. The original test missed the dynamic form — server-ws +// boots dist/server.js via `await import("./server.js")`. +function localImports(filePath: string): string[] { + const src = fs.readFileSync(filePath, "utf8"); + const patterns = [ + /from\s+["']\.\/([^"']+)["']/g, + /import\(\s*["']\.\/([^"']+)["']\s*\)/g, + /require\(\s*["']\.\/([^"']+)["']\s*\)/g, + ]; + return [...new Set(patterns.flatMap((re) => [...src.matchAll(re)].map((m) => m[1])))]; +} + +// Wrappers that ship in the npm channel are exactly those whose dest survives the prune. +// Wrappers intentionally outside the npm tarball (e.g. healthcheck.mjs, Docker-only) are +// excluded: their imports live or die with them, consistently. +function npmShippedWrappers(): WrapperEntry[] { + return distRootWrappers().filter((e) => APP_STAGING_ALLOWED_EXACT_PATHS.includes(e.dest)); +} + +test("sanity: EXTRA_MODULE_ENTRIES parsing finds the known dist-root wrappers", () => { + const dests = distRootWrappers().map((e) => e.dest); + for (const known of ["server-ws.mjs", "peer-stamp.mjs", "head-response-guard.cjs"]) { + assert.ok(dests.includes(known), `parser lost known wrapper ${known}: got ${dests.join(", ")}`); + } + assert.ok(dests.length >= 7, `parsed only ${dests.length} dist-root wrappers`); +}); + +test("every local import of every npm-shipped wrapper survives the prune (allowlist)", () => { + for (const wrapper of npmShippedWrappers()) { + const srcPath = path.join(ROOT, wrapper.src); + assert.ok(fs.existsSync(srcPath), `EXTRA_MODULE_ENTRIES src missing on disk: ${wrapper.src}`); + const missing = localImports(srcPath).filter( + (f) => !APP_STAGING_ALLOWED_EXACT_PATHS.includes(f) + ); + assert.deepEqual( + missing, + [], + `${wrapper.dest}: add to APP_STAGING_ALLOWED_EXACT_PATHS: ${missing.join(", ")}` + ); + } +}); + +test("every local import of every npm-shipped wrapper is enforced by check:pack-artifact", () => { + for (const wrapper of npmShippedWrappers()) { + const missing = localImports(path.join(ROOT, wrapper.src)).filter( + (f) => !PACK_ARTIFACT_REQUIRED_PATHS.includes(`dist/${f}`) + ); + assert.deepEqual( + missing, + [], + `${wrapper.dest}: add dist/ to PACK_ARTIFACT_REQUIRED_PATHS: ${missing.join(", ")}` + ); + } +}); + +test("dynamic import() closure is covered (server-ws boots dist/server.js)", () => { + const serverWs = distRootWrappers().find((e) => e.dest === "server-ws.mjs"); + assert.ok(serverWs, "server-ws.mjs wrapper not found in EXTRA_MODULE_ENTRIES"); + const imports = localImports(path.join(ROOT, serverWs.src)); + assert.ok( + imports.includes("server.js"), + `dynamic import extraction broken — server.js not among: ${imports.join(", ")}` + ); +}); + +test("every bin/omniroute.mjs local import is enforced by check:pack-artifact", () => { + // The CLI boot path (bin/omniroute.mjs → bin/cli/*) is covered by allowlist PREFIXES, + // so a file vanishing from the tarball never fails the unexpected-paths check — only + // PACK_ARTIFACT_REQUIRED_PATHS makes its absence loud. Derive the requirement from + // the entrypoint's own imports. + const missing = localImports(BIN_ENTRY).filter( + (f) => !PACK_ARTIFACT_REQUIRED_PATHS.includes(`bin/${f}`) + ); + assert.deepEqual( + missing, + [], + `add bin/ to PACK_ARTIFACT_REQUIRED_PATHS: ${missing.join(", ")}` + ); +}); diff --git a/tests/unit/pack-artifact-policy.test.ts b/tests/unit/pack-artifact-policy.test.ts index 098ac4483e..ae24d23dea 100644 --- a/tests/unit/pack-artifact-policy.test.ts +++ b/tests/unit/pack-artifact-policy.test.ts @@ -105,9 +105,12 @@ test("findMissingArtifactPaths flags missing root runtime files in the tarball", // alphabetically (bin/ < dist/ < scripts/ < src/), minus the paths present // above (dist/server.js, bin/omniroute.mjs, package.json, the postinstall scripts). assert.deepEqual(missingPaths, [ + "bin/cli/data-dir.mjs", "bin/cli/program.mjs", + "bin/cli/utils/storageKeyProvision.mjs", "bin/mcp-server.mjs", "bin/nodeRuntimeSupport.mjs", + "dist/head-response-guard.cjs", "dist/http-method-guard.cjs", "dist/open-sse/services/compression/engines/rtk/filters/generic-output.json", "dist/open-sse/services/compression/rules/en/filler.json", diff --git a/tests/unit/pack-artifact-server-ws-closure.test.ts b/tests/unit/pack-artifact-server-ws-closure.test.ts new file mode 100644 index 0000000000..000bb759dc --- /dev/null +++ b/tests/unit/pack-artifact-server-ws-closure.test.ts @@ -0,0 +1,40 @@ +import { test } from "node:test"; +import assert from "node:assert/strict"; +import fs from "node:fs"; +import path from "node:path"; +import { fileURLToPath } from "node:url"; +import { + APP_STAGING_ALLOWED_EXACT_PATHS, + PACK_ARTIFACT_REQUIRED_PATHS, +} from "../../scripts/build/pack-artifact-policy.ts"; + +// #7065 (3rd occurrence of this class — tls-options/3.8.41, head-response-guard/3.8.47): +// dist/server-ws.mjs imports sibling files that assembleStandalone copies into dist/, +// but the prepublish prune deletes anything not in APP_STAGING_ALLOWED_EXACT_PATHS and +// check:pack-artifact only fails for entries in PACK_ARTIFACT_REQUIRED_PATHS. Any local +// import missing from EITHER list ships a tarball that crashes on boot. This test derives +// the closure from the source of truth (the wrapper's own imports) so the class is closed. + +const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../.."); +const WRAPPER = path.join(ROOT, "scripts", "dev", "standalone-server-ws.mjs"); + +function localImports(): string[] { + const src = fs.readFileSync(WRAPPER, "utf8"); + return [...src.matchAll(/from\s+"\.\/([^"]+)"/g)].map((m) => m[1]); +} + +test("every server-ws.mjs local import survives the prepublish prune (allowlist)", () => { + const missing = localImports().filter((f) => !APP_STAGING_ALLOWED_EXACT_PATHS.includes(f)); + assert.deepEqual(missing, [], `add to APP_STAGING_ALLOWED_EXACT_PATHS: ${missing.join(", ")}`); +}); + +test("every server-ws.mjs local import is enforced by check:pack-artifact (required)", () => { + const missing = localImports().filter( + (f) => !PACK_ARTIFACT_REQUIRED_PATHS.includes(`dist/${f}`) + ); + assert.deepEqual(missing, [], `add dist/ to PACK_ARTIFACT_REQUIRED_PATHS: ${missing.join(", ")}`); +}); + +test("sanity: the wrapper actually has local imports (regex not silently broken)", () => { + assert.ok(localImports().length >= 5, `parsed only ${localImports().length} imports`); +}); diff --git a/tests/unit/probe-6699-jules-executor-misroute.test.ts b/tests/unit/probe-6699-jules-executor-misroute.test.ts new file mode 100644 index 0000000000..a2072814f4 --- /dev/null +++ b/tests/unit/probe-6699-jules-executor-misroute.test.ts @@ -0,0 +1,40 @@ +// Probe for issue #6699 -- "Google Jules provider validation rejects a valid API key". +// +// A second reporter (MohammadMD1383) supplied screenshots showing that OmniRoute, when +// actually routing a chat-completion request for a saved "jules" connection, sends the +// request to https://api.openai.com/v1/chat/completions and surfaces OpenAI's own +// "Incorrect API key provided ... platform.openai.com" error -- even though the provider +// is displayed as JULES with target "jules/jules". This probe proves the executor-level +// root cause directly: getExecutor("jules") has no specialized executor and no REGISTRY +// entry, so DefaultExecutor's constructor silently falls back to PROVIDERS.openai, +// making buildUrl() return OpenAI's endpoint for a provider the user believes is Jules. +import test from "node:test"; +import assert from "node:assert/strict"; +import { getExecutor, hasSpecializedExecutor } from "../../open-sse/executors/index.ts"; + +test("#6699: jules has no specialized executor (falls through to DefaultExecutor)", () => { + assert.equal(hasSpecializedExecutor("jules"), false); +}); + +test("#6699: a chat-completion request routed to provider 'jules' must not silently hit OpenAI's endpoint", () => { + // Desired behavior: the Jules provider (a cloud-agent, registered only in + // CLOUD_AGENT_PROVIDERS/staticModels, never in the chat REGISTRY) must not silently + // resolve to OpenAI's chat/completions endpoint when routed through the normal + // chat-completions executor path. getExecutor() now throws a clear, sanitized error + // for this narrow set of chat-unsupported cloud-agent providers instead of falling + // through to DefaultExecutor's `PROVIDERS.openai` fallback (which produced the + // "Incorrect API key provided ... platform.openai.com" error the reporter saw for a + // genuine Jules key). Before the fix, getExecutor("jules") returned a working + // executor whose buildUrl() resolved to OpenAI's endpoint -- this assertion FAILS on + // unfixed release/v3.8.49 code because no error is thrown at all. + assert.throws( + () => getExecutor("jules"), + (err) => { + assert.match(err.message, /cloud-agent provider/i); + assert.match(err.message, /does not support direct chat completions/i); + assert.equal(err.status, 400); + return true; + }, + "provider 'jules' must raise a clear error instead of silently inheriting OpenAI's base URL/config" + ); +}); diff --git a/tests/unit/probe-6835-cyclebreaker.test.ts b/tests/unit/probe-6835-cyclebreaker.test.ts new file mode 100644 index 0000000000..fda653124d --- /dev/null +++ b/tests/unit/probe-6835-cyclebreaker.test.ts @@ -0,0 +1,28 @@ +import { test } from "node:test"; +import assert from "node:assert/strict"; +import fs from "node:fs"; +import os from "node:os"; +import path from "node:path"; + +test("getDbInstance() caps the probe-failed/restore cycle at 3 attempts (#6835)", async () => { + const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-6835-")); + process.env.DATA_DIR = tmpDir; + const sqliteFile = path.join(tmpDir, "storage.sqlite"); + const backupFile = `${sqliteFile}.probe-failed-1000000000000`; + fs.writeFileSync(backupFile, Buffer.from("not a real sqlite file, always fails to open")); + const core = await import("../../src/lib/db/core.ts"); + const errors: string[] = []; + for (let i = 0; i < 6; i++) { + try { + core.getDbInstance(); + errors.push("(no error)"); + break; + } catch (err: unknown) { + errors.push(err instanceof Error ? err.message : String(err)); + } + } + const abortIndex = errors.findIndex((e) => e.includes("Aborting startup")); + assert.notEqual(abortIndex, -1, "Expected the cap to trip; got: " + errors.join(" | ")); + assert.ok(abortIndex <= 4, "Expected cap by call #4; took until #" + abortIndex); + fs.rmSync(tmpDir, { recursive: true, force: true }); +}); diff --git a/tests/unit/probe-6835-oom-uncapped.test.ts b/tests/unit/probe-6835-oom-uncapped.test.ts new file mode 100644 index 0000000000..9b91101646 --- /dev/null +++ b/tests/unit/probe-6835-oom-uncapped.test.ts @@ -0,0 +1,58 @@ +import { test } from "node:test"; +import assert from "node:assert/strict"; +import fs from "node:fs"; +import os from "node:os"; +import path from "node:path"; + +test("getDbInstance() eventually caps a persistently-OOMing sql.js probe (#6835)", async () => { + const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-6835-oom-")); + process.env.DATA_DIR = tmpDir; + const sqliteFile = path.join(tmpDir, "storage.sqlite"); + fs.mkdirSync(sqliteFile); // forces better-sqlite3/node:sqlite to fail synchronously (EISDIR-style) + await import("../../src/lib/db/adapters/driverFactory.ts"); + const core = await import("../../src/lib/db/core.ts"); + const fakeAdapter = { + driver: "sql.js" as const, + open: true, + name: sqliteFile, + prepare() { + throw new Error("out of memory"); + }, + exec() { + throw new Error("out of memory"); + }, + pragma() { + throw new Error("out of memory"); + }, + transaction(fn: (...a: unknown[]) => T) { + return fn; + }, + immediate() {}, + async backup() {}, + checkpoint() {}, + close() {}, + raw: null, + }; + ( + globalThis as unknown as { __omnirouteSqlJsAdapters: Map } + ).__omnirouteSqlJsAdapters = new Map([[sqliteFile, fakeAdapter]]); + const errors: string[] = []; + for (let i = 0; i < 8; i++) { + try { + core.getDbInstance(); + errors.push("(no error)"); + break; + } catch (err: unknown) { + errors.push(err instanceof Error ? err.message : String(err)); + } + } + const anyAborted = errors.some((e) => e.includes("Aborting startup")); + assert.ok( + anyAborted, + "Expected getDbInstance() to eventually give up with a terminal " + + "'Aborting startup'-style diagnostic after repeated OOM probe failures, the same way it " + + "already does for generic corruption (#6632). Instead every call re-threw an identical, " + + "uncapped OOM error:\n" + errors.map((e, i) => ` [${i}] ${e}`).join("\n") + ); + fs.rmSync(tmpDir, { recursive: true, force: true }); +}); diff --git a/tests/unit/probe-7134-claude-web-empty-error-body.test.ts b/tests/unit/probe-7134-claude-web-empty-error-body.test.ts new file mode 100644 index 0000000000..b62659616a --- /dev/null +++ b/tests/unit/probe-7134-claude-web-empty-error-body.test.ts @@ -0,0 +1,102 @@ +import test from "node:test"; +import assert from "node:assert/strict"; +import { writeFile } from "node:fs/promises"; + +// Issue #7134 — claude-web reported "Claude Web API error (400) with no +// response body" even when Claude's upstream DID send a real JSON error body. +// +// Root cause: tlsFetchStreaming() streams the upstream response to a temp +// file via tls-client-node's `streamOutputPath` mode. For a non-SSE, +// non-2xx response, the native binding resolves with an EMPTY in-memory +// `body` field (it only populates `body` for its non-streaming mode) even +// though the real error bytes were already written to the temp file and +// even peeked (`looksLikeSse`) to decide the response wasn't SSE. The old +// code read the empty `r.body` instead of the file it just peeked, throwing +// away the real upstream error detail. +// +// This test injects a fake `client` (matching the `{ request }` shape +// tlsFetchStreaming already accepts for DI) that reproduces the exact +// tls-client-node contract under `streamOutputPath`: write bytes to the file, +// resolve with an empty `body`. No `--experimental-test-module-mocks` flag +// needed — this exercises the real, unmodified `tlsFetchStreaming` via +// dependency injection instead of module-mocking `tls-client-node`. + +const { tlsFetchStreaming } = await import("../../open-sse/services/claudeTlsClient.ts"); + +const REAL_CLAUDE_ERROR_BODY = JSON.stringify({ + type: "error", + error: { + type: "invalid_request_error", + message: "This conversation UUID does not exist or you do not have access to it.", + }, +}); + +function makeFakeClient(status: number, bodyOnFile: string) { + return { + request: async (_url: string, opts: Record) => { + const streamOutputPath = opts.streamOutputPath as string; + await writeFile(streamOutputPath, bodyOnFile); + return { + status, + headers: {}, + // tls-client-node does not populate `body` for streamed requests — + // this is the exact defect condition. + body: "", + cookies: {}, + text: async () => "", + json: async () => ({}), + bytes: async () => new Uint8Array(), + }; + }, + }; +} + +test("issue #7134: tlsFetchStreaming surfaces the real error body for a non-SSE 400 under stream:true", async () => { + const client = makeFakeClient(400, REAL_CLAUDE_ERROR_BODY); + + const result = await tlsFetchStreaming( + client, + "https://claude.ai/api/organizations/x/chat_conversations/y/completion", + { method: "POST" }, + "[DONE]", + null, + 5_000 + ); + + assert.equal(result.status, 400); + assert.equal(result.body, null); + assert.ok( + result.text && result.text.includes("does not exist or you do not have access to it"), + `expected the real Claude error body to be surfaced, got: ${JSON.stringify(result.text)}` + ); +}); + +test("issue #7134: tlsFetchStreaming still uses r.body when the native client DOES populate it", async () => { + const client = { + request: async (_url: string, opts: Record) => { + const streamOutputPath = opts.streamOutputPath as string; + await writeFile(streamOutputPath, "{}"); + return { + status: 403, + headers: {}, + body: "populated body from native client", + cookies: {}, + text: async () => "", + json: async () => ({}), + bytes: async () => new Uint8Array(), + }; + }, + }; + + const result = await tlsFetchStreaming( + client, + "https://claude.ai/api/organizations/x/chat_conversations/y/completion", + { method: "POST" }, + "[DONE]", + null, + 5_000 + ); + + assert.equal(result.status, 403); + assert.equal(result.text, "populated body from native client"); +}); diff --git a/tests/unit/provider-registry-qwen-vision.test.ts b/tests/unit/provider-registry-qwen-vision.test.ts index 9382027aed..1b2ddaa3f2 100644 --- a/tests/unit/provider-registry-qwen-vision.test.ts +++ b/tests/unit/provider-registry-qwen-vision.test.ts @@ -63,16 +63,17 @@ test("#2822 opencode-go/qwen3.6-plus deve ter supportsVision !== true", () => { ); }); -// #3328 — o oposto do #2822: MiniMax M3 (opencode) É multimodal (verificado -// empiricamente: descreve imagens base64 via o upstream opencode). Deve ter -// supportsVision: true para não ser barrado/strippado em requests com imagem. -test("#3328 opencode/minimax-m3-free deve ter supportsVision: true", () => { +// #3328 — o oposto do #2822: MiniMax M3 (opencode) era multimodal (verificado +// empiricamente: descrevia imagens base64 via o upstream opencode). #6998: +// minimax-m3-free foi deslistado do free tier da OpenCode Zen (401 "not +// supported") em 2026-07-14 e removido do catálogo estático — este teste +// agora confirma a remoção. +test("#6998 opencode/minimax-m3-free não deve mais estar registrado (deslistado upstream)", () => { const model = getModel("opencode", "minimax-m3-free"); - assert.ok(model, "minimax-m3-free deve estar registrado em opencode"); - assert.strictEqual( - model.supportsVision, - true, - "opencode/minimax-m3-free é multimodal — supportsVision deve ser true" + assert.equal( + model, + undefined, + "opencode/minimax-m3-free foi deslistado do free tier da OpenCode Zen (#6998)" ); }); diff --git a/tests/unit/provider-validation-web-cookie-auth007.test.ts b/tests/unit/provider-validation-web-cookie-auth007.test.ts index c53705af04..344b1e865b 100644 --- a/tests/unit/provider-validation-web-cookie-auth007.test.ts +++ b/tests/unit/provider-validation-web-cookie-auth007.test.ts @@ -1,15 +1,18 @@ import test from "node:test"; import assert from "node:assert/strict"; -// The validator probes the provider's /models endpoint via safeOutboundFetch → -// fetchWithTimeout, which binds globalThis.fetch at MODULE LOAD time. The mock MUST be -// installed BEFORE importing validation.ts — a late reassignment (inside a test) is -// ignored and the validator hits the real network instead. (That made the 401/403 -// assertions pass only by coincidence — live chatgpt.com returns 401/403 — while the -// 200 case failed.) A mutable `nextResponse` lets each test vary the probe result, and -// `fetchCalls` proves the mocked probe ran rather than the live network. +// The validator probes the provider's /models endpoint via validationRead → safeOutboundFetch +// → fetchWithTimeout, which reads `globalThis.fetch` dynamically at CALL time (#7058 — routed +// through the proxy-aware patched fetch instead of a bypassing directHttpsRequest). Importing +// validation.ts pulls in the proxy-patch module, which installs its own `globalThis.fetch` +// exactly once at import time — so the mock must be (re)installed AFTER the import, not before, +// or the patch silently clobbers it. A mutable `nextResponse` lets each test vary the probe +// result, and `fetchCalls` proves the mocked probe ran rather than the live network. let nextResponse: { status: number; body: string } = { status: 200, body: "{}" }; let fetchCalls = 0; + +const { validateWebCookieProvider } = await import("../../src/lib/providers/validation.ts"); + globalThis.fetch = (async () => { fetchCalls++; return new Response(nextResponse.body, { @@ -18,8 +21,6 @@ globalThis.fetch = (async () => { }); }) as typeof fetch; -const { validateWebCookieProvider } = await import("../../src/lib/providers/validation.ts"); - function mockFetch(status: number, body: string) { nextResponse = { status, body }; fetchCalls = 0; diff --git a/tests/unit/providers-yuanbao-web.test.ts b/tests/unit/providers-yuanbao-web.test.ts index 2feab63371..48477c83d4 100644 --- a/tests/unit/providers-yuanbao-web.test.ts +++ b/tests/unit/providers-yuanbao-web.test.ts @@ -71,6 +71,13 @@ async function readStreamText(res: Response): Promise { } test("missing hy_token cookie returns a 401 auth error", async () => { + // Hermetic: the 401 must come from the executor's own cookie validation, never + // from the real upstream — on GitHub-hosted runners the Tencent endpoint is + // unreachable and a live call turns this into a 71s 502 false-negative. + const original = globalThis.fetch; + globalThis.fetch = (async () => { + throw new Error("network disabled in this test — executor must reject before fetching"); + }) as typeof fetch; const exec = new YuanbaoWebExecutor(); const { response } = await exec.execute({ model: "deepseek-v3", @@ -84,6 +91,7 @@ test("missing hy_token cookie returns a 401 auth error", async () => { assert.match(body.error.message, /hy_user|hy_token|session cookie/); // Never leak stack traces. assert.ok(!body.error.message.includes("at /")); + globalThis.fetch = original; }); test("streaming request translates think/text events into OpenAI chunks", async () => { diff --git a/tests/unit/quota-card-grid-horizontal-layout.test.ts b/tests/unit/quota-card-grid-horizontal-layout.test.ts index 9966034ba9..5e9fcd52ba 100644 --- a/tests/unit/quota-card-grid-horizontal-layout.test.ts +++ b/tests/unit/quota-card-grid-horizontal-layout.test.ts @@ -6,8 +6,11 @@ // the shipped JSX structure and grouping logic directly: // 1. Grouping still produces one header per distinct provider with the // correct account count ("N account(s)"). -// 2. The per-group card grid starts multi-column (`grid-cols-2`), not -// single-column, so cards fill horizontal space sooner. +// 2. The per-group card grid keeps a single-column mobile fallback +// (`grid-cols-1`) below the `sm:` breakpoint (restored by #7072 after +// PR #6815 dropped it and clipped labels on phone-width viewports), +// while still going multi-column (`sm:grid-cols-2`) from `sm:` up so +// cards fill horizontal space sooner on larger screens. // 3. Provider groups themselves flow into multiple columns on wide screens // (`columns-*`) instead of an unconditional vertical `flex flex-col` // stack. @@ -104,14 +107,14 @@ test("QuotaCardGrid (#3520) — outer container flows groups into multiple colum assert.notEqual(outerClassName, "flex flex-col gap-6"); }); -test("QuotaCardGrid (#3520) — per-group card grid starts multi-column (grid-cols-2), not single-column", () => { +test("QuotaCardGrid (#3520/#7072) — per-group card grid keeps a mobile grid-cols-1 fallback and goes multi-column from sm: up", () => { const classNames = extractDivClassNames(COMPONENT_PATH); const cardGridClassName = classNames.find( (c) => /\bgrid\b/.test(c) && /grid-cols-/.test(c) ); assert.ok(cardGridClassName, "expected to find the per-group card grid's className"); - assert.match(cardGridClassName!, /\bgrid-cols-2\b/); - assert.doesNotMatch(cardGridClassName!, /\bgrid-cols-1\b/); + assert.match(cardGridClassName!, /\bgrid-cols-1\b/); + assert.match(cardGridClassName!, /\bsm:grid-cols-2\b/); }); test("QuotaCardGrid (#3520) — early-returns null when there are no connections", () => { diff --git a/tests/unit/quota-card-grid-mobile-7072.test.ts b/tests/unit/quota-card-grid-mobile-7072.test.ts new file mode 100644 index 0000000000..aeede949a8 --- /dev/null +++ b/tests/unit/quota-card-grid-mobile-7072.test.ts @@ -0,0 +1,79 @@ +// #7072 — Provider Quota page card grid clipped on mobile. +// +// PR #6815 changed QuotaCardGrid.tsx's per-group card grid from +// `grid-cols-1 md:grid-cols-2 xl:grid-cols-3 2xl:grid-cols-4` to +// `grid-cols-2 md:grid-cols-3 xl:grid-cols-4`, dropping the mobile (<768px) +// single-column fallback that every other card-grid in the dashboard still +// has (ProviderQuotaWidget.tsx, EvalsTab.tsx, MediaPageClient.tsx, +// SystemStorageTab.tsx). Forcing 2 columns even on phone widths squeezes +// each QuotaCard, and since QuotaCard's outer Card uses `overflow-hidden`, +// the overflowing button/label text is clipped instead of wrapping. +// +// This regression guard parses QuotaCardGrid.tsx's JSX via the TypeScript +// compiler API and asserts the per-group card grid's className restores an +// unprefixed `grid-cols-1` mobile fallback, while keeping the #6815 density +// gains (grid-cols-2 at `sm:` and up). + +import { test } from "node:test"; +import assert from "node:assert/strict"; +import fs from "node:fs"; +import path from "node:path"; +import ts from "typescript"; + +const COMPONENT_PATH = path.resolve( + import.meta.dirname, + "../../src/app/(dashboard)/dashboard/usage/components/ProviderLimits/QuotaCardGrid.tsx" +); + +function extractDivClassNames(sourcePath: string): string[] { + const sourceText = fs.readFileSync(sourcePath, "utf8"); + const sourceFile = ts.createSourceFile( + sourcePath, + sourceText, + ts.ScriptTarget.Latest, + true, + ts.ScriptKind.TSX + ); + const classNames: string[] = []; + + function visit(node: ts.Node) { + if (ts.isJsxOpeningElement(node) || ts.isJsxSelfClosingElement(node)) { + const tagName = node.tagName.getText(sourceFile); + if (tagName === "div") { + for (const attr of node.attributes.properties) { + if (ts.isJsxAttribute(attr) && attr.name.getText(sourceFile) === "className") { + const init = attr.initializer; + if (init && ts.isStringLiteral(init)) { + classNames.push(init.text); + } else if ( + init && + ts.isJsxExpression(init) && + init.expression && + ts.isStringLiteral(init.expression) + ) { + classNames.push(init.expression.text); + } + } + } + } + } + ts.forEachChild(node, visit); + } + visit(sourceFile); + return classNames; +} + +test("QuotaCardGrid (#7072) — per-group card grid keeps a single-column mobile fallback", () => { + const classNames = extractDivClassNames(COMPONENT_PATH); + const cardGridClassName = classNames.find((c) => /\bgrid\b/.test(c) && /grid-cols-/.test(c)); + assert.ok(cardGridClassName, "expected to find the per-group card grid's className"); + + const tokens = cardGridClassName!.split(/\s+/); + const unprefixedGridCols = tokens.find((t) => /^grid-cols-\d+$/.test(t)); + assert.equal( + unprefixedGridCols, + "grid-cols-1", + `expected unprefixed grid-cols-1 (mobile fallback), got className="${cardGridClassName}"` + ); + assert.match(cardGridClassName!, /\bsm:grid-cols-2\b/, "expected sm:grid-cols-2 to be preserved"); +}); diff --git a/tests/unit/shared/components/ProxyConfigModal.test.tsx b/tests/unit/shared/components/ProxyConfigModal.test.tsx index 12299359d1..a63ebe9801 100644 --- a/tests/unit/shared/components/ProxyConfigModal.test.tsx +++ b/tests/unit/shared/components/ProxyConfigModal.test.tsx @@ -389,3 +389,66 @@ describe("ProxyConfigModal custom registry saves", () => { ).toBe(false); }); }); + +describe("ProxyConfigModal test connection (saved proxy)", () => { + beforeEach(() => { + ( + globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT?: boolean } + ).IS_REACT_ACT_ENVIRONMENT = true; + fetchCalls = []; + }); + + afterEach(() => { + while (cleanupCallbacks.length > 0) { + cleanupCallbacks.pop()?.(); + } + document.body.innerHTML = ""; + vi.unstubAllGlobals(); + vi.restoreAllMocks(); + }); + + it("includes proxyId when testing a saved SOCKS5 registry proxy so the server can load its stored credentials", async () => { + installFetchMock((url, init) => { + const method = String(init?.method || "GET").toUpperCase(); + if (method === "GET" && url === "/api/settings/proxies") { + return { + body: { + items: [ + { + id: "socks5-1", + name: "Geonode SOCKS5", + type: "socks5", + host: "proxy.geonode.io", + port: 12000, + username: "***", + password: "***", + source: "manual", + }, + ], + total: 1, + socks5Enabled: true, + }, + }; + } + if (url.startsWith("/api/settings/proxies/assignments?") && url.includes("scope=provider")) { + return { + body: { items: [{ proxyId: "socks5-1", scope: "provider", scopeId: "claude" }], total: 1 }, + }; + } + if (method === "POST" && url === "/api/settings/proxy/test") { + return { body: { success: true, publicIp: "1.2.3.4", latencyMs: 500 } }; + } + return defaultProxyConfigResponses(url) || { status: 404, body: {} }; + }); + + const { container } = await renderProxyConfigModal(); + await clickButton(container, "testConnection"); + await waitForCall((call) => call.method === "POST" && call.url === "/api/settings/proxy/test"); + + const testCall = fetchCalls.find( + (call) => call.method === "POST" && call.url === "/api/settings/proxy/test" + ); + expect(testCall).toBeTruthy(); + expect(testCall?.body?.proxyId).toBe("socks5-1"); + }, 20000); +}); diff --git a/tests/unit/sonar-quality-gate-fixes.test.ts b/tests/unit/sonar-quality-gate-fixes.test.ts new file mode 100644 index 0000000000..1f39367501 --- /dev/null +++ b/tests/unit/sonar-quality-gate-fixes.test.ts @@ -0,0 +1,61 @@ +import { test } from "node:test"; +import assert from "node:assert/strict"; +import { spawnSync } from "node:child_process"; +import fs from "node:fs"; +import os from "node:os"; +import path from "node:path"; +import { fileURLToPath } from "node:url"; + +// Regression guards for the Sonar quality-gate fixes (release PR #6569 findings). +// Two classes of real defect are locked down here: +// 1. jssecurity:S8707 — classify-pr-changes.mjs read any path handed on argv; +// the CLI now confines the list file to the working directory. +// 2. typescript:S6544 — `isCloudEnabled()` is async; a bare `if (isCloudEnabled())` +// is always truthy, so cloud sync ran even with cloud disabled. + +const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../.."); +const CLASSIFY = path.join(ROOT, "scripts", "quality", "classify-pr-changes.mjs"); + +test("classify-pr-changes rejects a list path that escapes the workspace", () => { + const cwd = fs.mkdtempSync(path.join(os.tmpdir(), "classify-guard-")); + try { + const outside = path.join(os.tmpdir(), "classify-outside.txt"); + fs.writeFileSync(outside, "src/lib/db/core.ts\n"); + const res = spawnSync(process.execPath, [CLASSIFY, outside], { + cwd, + encoding: "utf8", + }); + assert.equal(res.status, 1, `expected exit 1, got ${res.status}\n${res.stdout}${res.stderr}`); + assert.match(res.stderr, /escapes the workspace/); + fs.rmSync(outside, { force: true }); + } finally { + fs.rmSync(cwd, { recursive: true, force: true }); + } +}); + +test("classify-pr-changes still accepts a workspace-relative list file", () => { + const cwd = fs.mkdtempSync(path.join(os.tmpdir(), "classify-ok-")); + try { + fs.writeFileSync(path.join(cwd, "changed-files.txt"), "docs/README.md\n"); + const res = spawnSync(process.execPath, [CLASSIFY, "changed-files.txt"], { + cwd, + encoding: "utf8", + }); + assert.equal(res.status, 0, `expected exit 0, got ${res.status}\n${res.stderr}`); + assert.match(res.stdout, /docs=true/); + assert.match(res.stdout, /code=false/); + } finally { + fs.rmSync(cwd, { recursive: true, force: true }); + } +}); + +test("kiro auto-import awaits the async isCloudEnabled() gate (S6544)", () => { + const src = fs.readFileSync( + path.join(ROOT, "src", "app", "api", "oauth", "kiro", "auto-import", "route.ts"), + "utf8" + ); + // `isCloudEnabled()` returns a Promise — a bare truthiness check is always true, + // which made syncToCloud() run even when cloud sync is disabled. + assert.doesNotMatch(src, /if\s*\(\s*isCloudEnabled\(\)/, "bare `if (isCloudEnabled())` found"); + assert.match(src, /if\s*\(\s*await isCloudEnabled\(\)/); +}); diff --git a/tests/unit/standalone-server-ws-keepalive-timeout-7003.test.ts b/tests/unit/standalone-server-ws-keepalive-timeout-7003.test.ts new file mode 100644 index 0000000000..076e84b1e4 --- /dev/null +++ b/tests/unit/standalone-server-ws-keepalive-timeout-7003.test.ts @@ -0,0 +1,73 @@ +import test from "node:test"; +import assert from "node:assert/strict"; +import fs from "node:fs"; +import path from "node:path"; +import { fileURLToPath } from "node:url"; + +// #7003 — the RED/GREEN spec in main-server-keepalive-timeout-7003.test.ts proves +// getMainServerTimeoutConfig() raises keepAliveTimeout/headersTimeout above Node's +// unconfigured 5_000ms default, and that the original fix wired it into +// scripts/dev/run-next.mjs. But run-next.mjs only runs `npm run dev`/`npm start` +// from a source checkout. The server real end users run — `omniroute serve` +// (npm-installed CLI), Docker, and Electron — spawns the standalone Next build's +// server.js via scripts/dev/run-standalone.mjs, which prefers server-ws.mjs +// (built from scripts/dev/standalone-server-ws.mjs, copied byte-for-byte into +// dist/server-ws.mjs by scripts/build/assembleStandalone.mjs) over the bare +// server.js specifically because it wraps `http.createServer` with production +// behavior the bare server lacks (peer-IP stamping, method/HEAD guards, WS +// proxying, TLS). Before this fix, that wrapper left Node's http.Server +// keepAliveTimeout/headersTimeout at their unconfigured defaults, so the +// JetBrains AI Assistant reconnect bug reproduced by main-server-keepalive-timeout +// -7003.test.ts still hit the production entry point every real user runs. +// +// standalone-server-ws.mjs has top-level side effects (monkeypatches +// http.createServer, generates a random UUID, and unconditionally +// `await import("./server.js")` — a file that only exists in the assembled +// standalone output, not in the source tree) so it cannot be imported +// in-process. Guard the fix by inspecting the source, mirroring the pattern +// used for run-next.mjs in run-next-node-env.test.ts. +const here = path.dirname(fileURLToPath(import.meta.url)); +const source = fs.readFileSync( + path.resolve(here, "../../scripts/dev/standalone-server-ws.mjs"), + "utf8" +); + +test("standalone-server-ws.mjs imports getMainServerTimeoutConfig", () => { + assert.match( + source, + /import\s*\{\s*getMainServerTimeoutConfig\s*\}\s*from\s*["'][^"']*runtimeTimeouts(?:\.ts)?["']/, + "expected the production server wrapper to import getMainServerTimeoutConfig, " + + "the same helper run-next.mjs uses" + ); +}); + +test("standalone-server-ws.mjs applies keepAliveTimeout/headersTimeout to the wrapped server", () => { + assert.match( + source, + /server\.keepAliveTimeout\s*=\s*\w*[Tt]imeouts?\.keepAliveTimeoutMs/, + "expected the wrapped server object to have keepAliveTimeout set from getMainServerTimeoutConfig()" + ); + assert.match( + source, + /server\.headersTimeout\s*=\s*\w*[Tt]imeouts?\.headersTimeoutMs/, + "expected the wrapped server object to have headersTimeout set from getMainServerTimeoutConfig()" + ); +}); + +test("keepAliveTimeout/headersTimeout are applied inside createServerWithResponsesWs, before the server is returned", () => { + const factoryIdx = source.search(/function createServerWithResponsesWs/); + const keepAliveIdx = source.search(/server\.keepAliveTimeout\s*=/); + const returnIdx = source.search(/return server;/); + + assert.ok(factoryIdx !== -1, "expected createServerWithResponsesWs to exist"); + assert.ok(keepAliveIdx !== -1, "expected a server.keepAliveTimeout assignment to exist"); + assert.ok(returnIdx !== -1, "expected the wrapped server to be returned"); + assert.ok( + keepAliveIdx > factoryIdx, + "timeout wiring must happen inside createServerWithResponsesWs" + ); + assert.ok( + keepAliveIdx < returnIdx, + "timeout wiring must happen before the server object is returned to the caller" + ); +}); diff --git a/tests/unit/sync-next-cycle.test.ts b/tests/unit/sync-next-cycle.test.ts index 8fdbb8b429..fb5ecfdf15 100644 --- a/tests/unit/sync-next-cycle.test.ts +++ b/tests/unit/sync-next-cycle.test.ts @@ -123,3 +123,31 @@ test("i18n resync also propagates the FINALIZED [prevVersion] section into the m "syncs the shipped (finalized) section — without this all 42 mirrors keep it as TBD" ); }); + +// WS0.3 (v3.8.49 quality plan): the captain's sync-back push is the one write path +// with NO CI gate — the merged tree must pass release-green --quick BEFORE the push, +// or the whole PR queue inherits a red tip (G1). --skip-green-gate is the documented +// emergency escape hatch (pre-existing tip reds verified by hand). + +test("greenGateArgs returns the quick release-green command by default", async () => { + const { greenGateArgs } = await import("../../scripts/release/sync-next-cycle.mjs"); + assert.deepEqual(greenGateArgs(["node", "script", "3.8.49"]), [ + "scripts/quality/validate-release-green.mjs", + "--quick", + ]); +}); + +test("greenGateArgs returns null only with the explicit --skip-green-gate flag", async () => { + const { greenGateArgs } = await import("../../scripts/release/sync-next-cycle.mjs"); + assert.equal(greenGateArgs(["node", "script", "3.8.49", "--skip-green-gate"]), null); + assert.notEqual(greenGateArgs(["node", "script", "3.8.49", "--other"]), null); +}); + +test("sync-next-cycle gates the push on release-green (source guard)", () => { + const src = readFileSync(SCRIPT_PATH, "utf8"); + const mainIdx = src.indexOf("function main()"); + const gateCallIdx = src.indexOf("greenGateArgs(process.argv)", mainIdx); + const pushIdx = src.indexOf('git(["push", "origin", BRANCH]'); + assert.ok(gateCallIdx > mainIdx, "main() must call greenGateArgs(process.argv)"); + assert.ok(pushIdx > gateCallIdx, "the release-green gate must run BEFORE the push"); +}); diff --git a/tests/unit/translator-gemini-thinking-budget-6943.test.ts b/tests/unit/translator-gemini-thinking-budget-6943.test.ts new file mode 100644 index 0000000000..eca7107a43 --- /dev/null +++ b/tests/unit/translator-gemini-thinking-budget-6943.test.ts @@ -0,0 +1,83 @@ +// Relocated from open-sse/translator/request/__tests__/openai-to-gemini.test.ts (#6943): +// that path is collected by NO runner (vitest excludes open-sse/translator; node:test globs +// only cover tests/**), so the suite never ran — flagged by check:test-discovery in the +// v3.8.47 release pre-flight. Converted from vitest to node:test in place. +import test from "node:test"; +import assert from "node:assert/strict"; + +const { openaiToGeminiRequest } = await import( + "../../open-sse/translator/request/openai-to-gemini.ts" +); + +type GeminiReq = { + generationConfig?: { thinkingConfig?: { thinkingBudget?: number; includeThoughts?: boolean } }; +}; + +const base = (extra: Record) => ({ + model: "gemini/gemini-2.5-flash", + messages: [{ role: "user", content: "hi" }], + safetySettings: [], + ...extra, +}); + +test("#6813: budget_tokens 0 passes through without dropping to default", () => { + const r = openaiToGeminiRequest( + "gemini/gemini-2.5-flash", + base({ thinking: { type: "enabled", budget_tokens: 0 } }), + false + ) as GeminiReq; + assert.equal(r.generationConfig?.thinkingConfig?.thinkingBudget, 0); + assert.equal(r.generationConfig?.thinkingConfig?.includeThoughts, false); +}); + +test("#6813: budget_tokens 1 passes through", () => { + const r = openaiToGeminiRequest( + "gemini/gemini-2.5-flash", + base({ thinking: { type: "enabled", budget_tokens: 1 } }), + false + ) as GeminiReq; + assert.equal(r.generationConfig?.thinkingConfig?.thinkingBudget, 1); +}); + +test("#4170: no-knob case still injects default thinkingConfig with includeThoughts", () => { + const r = openaiToGeminiRequest("gemini/gemini-2.5-flash", base({}), false) as GeminiReq; + assert.equal(r.generationConfig?.thinkingConfig?.includeThoughts, true); + assert.ok((r.generationConfig?.thinkingConfig?.thinkingBudget ?? 0) > 0); +}); + +test("#6813: reasoning_effort none is the explicit off-switch (budget 0, no thoughts)", () => { + const r = openaiToGeminiRequest( + "gemini/gemini-2.5-flash", + base({ reasoning_effort: "none" }), + false + ) as GeminiReq; + assert.equal(r.generationConfig?.thinkingConfig?.thinkingBudget, 0); + assert.equal(r.generationConfig?.thinkingConfig?.includeThoughts, false); +}); + +test("reasoning_effort low maps to thinkingBudget 1024", () => { + const r = openaiToGeminiRequest( + "gemini/gemini-2.5-flash", + base({ reasoning_effort: "low" }), + false + ) as GeminiReq; + assert.equal(r.generationConfig?.thinkingConfig?.thinkingBudget, 1024); +}); + +test("reasoning_effort medium falls back to the model default budget (>=1024)", () => { + const r = openaiToGeminiRequest( + "custom-model", + { ...base({ reasoning_effort: "medium" }), model: "custom-model" }, + false + ) as GeminiReq; + assert.ok((r.generationConfig?.thinkingConfig?.thinkingBudget ?? 0) >= 1024); +}); + +test("reasoning_effort high maps to the flash cap 24576", () => { + const r = openaiToGeminiRequest( + "gemini/gemini-2.5-flash", + base({ reasoning_effort: "high" }), + false + ) as GeminiReq; + assert.equal(r.generationConfig?.thinkingConfig?.thinkingBudget, 24576); +}); diff --git a/tests/unit/translator-openai-to-gemini.test.ts b/tests/unit/translator-openai-to-gemini.test.ts index 4156a58461..9be3c9e9b0 100644 --- a/tests/unit/translator-openai-to-gemini.test.ts +++ b/tests/unit/translator-openai-to-gemini.test.ts @@ -518,8 +518,12 @@ test("OpenAI -> Gemini helper IDs and JSON parsing stay in the expected format", }); test("OpenAI -> Cloud Code Gemini applies native request defaults", () => { + // gemini-3.1-pro is thinking-capable; the previous fixture (gemini-3-flash-preview, + // supportsThinking: false / cap 0) encoded the pre-#6943 bug of requesting thoughts + // from a non-thinking model — reasoning_effort on a capped-at-0 model now correctly + // yields thinkingBudget 0 / includeThoughts false (see the flash assertion below). const request = openaiToCloudCodeGeminiRequest( - "gemini-3-flash-preview", + "gemini-3.1-pro", { messages: [{ role: "user", content: "Hello" }], reasoning_effort: "high", @@ -527,8 +531,16 @@ test("OpenAI -> Cloud Code Gemini applies native request defaults", () => { true ) as any; - assert.equal(request.model, "gemini-3-flash-preview"); + assert.equal(request.model, "gemini-3.1-pro"); assert.equal(request.generationConfig.thinkingConfig.includeThoughts, true); + + const flash = openaiToCloudCodeGeminiRequest( + "gemini-3-flash-preview", + { messages: [{ role: "user", content: "Hello" }], reasoning_effort: "high" }, + true + ) as { generationConfig: { thinkingConfig: { thinkingBudget: number; includeThoughts: boolean } } }; + assert.equal(flash.generationConfig.thinkingConfig.thinkingBudget, 0); + assert.equal(flash.generationConfig.thinkingConfig.includeThoughts, false); assert.equal(request.generationConfig.topK, undefined); assert.equal(request.contents.at(-1).parts[0].text, "Hello"); }); diff --git a/tests/unit/ui/CliAgentsPage.test.tsx b/tests/unit/ui/CliAgentsPage.test.tsx index 82f4a5205f..257f5e4149 100644 --- a/tests/unit/ui/CliAgentsPage.test.tsx +++ b/tests/unit/ui/CliAgentsPage.test.tsx @@ -54,12 +54,18 @@ const { default: CliAgentsPageClient } = await import( // ── Fixtures ────────────────────────────────────────────────────────────────── -/** 6 agent tool ids from the catalog (§3.2 of plan-14) */ +/** + * Agent tool ids from the catalog (§3.2 of plan-14, category: "agent" in + * src/shared/constants/cliTools.ts). "omp" and "letta" were added to the + * catalog after plan-14 shipped, bringing the count from 6 to 8. + */ const AGENT_IDS = [ "openclaw", "hermes-agent", "goose", "interpreter", + "omp", + "letta", "warp", "agent-deck", ] as const; @@ -144,9 +150,9 @@ describe("CliAgentsPageClient", () => { expect(container.textContent).toContain("pageTitle"); }, 15000); - it("2. renders exactly 6 agent tool cards", async () => { + it("2. renders exactly 8 agent tool cards", async () => { const container = await renderPage(); - expect(countAgentCards(container)).toBe(6); + expect(countAgentCards(container)).toBe(8); }, 15000); it("3. search filter — 'hermes' shows 1 card (hermes-agent)", async () => { diff --git a/tests/unit/ui/HermesAgentToolCard-model-aliases.test.tsx b/tests/unit/ui/HermesAgentToolCard-model-aliases.test.tsx new file mode 100644 index 0000000000..5d58e13640 --- /dev/null +++ b/tests/unit/ui/HermesAgentToolCard-model-aliases.test.tsx @@ -0,0 +1,46 @@ +import { describe, expect, it } from "vitest"; +import { readFileSync } from "node:fs"; +import { fileURLToPath } from "node:url"; +import { dirname, resolve } from "node:path"; + +// Regression probe for issue #7151: OpenRouter (and every other +// `passthroughModels` provider — requesty, dgrid, agentrouter, charm-hyper, +// etc.) never appears in the Hermes Agent role model picker. +// +// Root cause: derives a passthrough provider's model list +// from the `modelAliases` prop (ModelSelectModal.tsx groupedModels → +// buildPassthroughAliasModels(modelAliases, providerId)). When `modelAliases` +// is `{}` (the component default), that helper returns `[]` and the provider +// group is skipped entirely — see modelSelectModalHelpers.ts. Every sibling +// CLI tool card (Codex, Claude, Cline, Kilo, Droid, OpenClaw, Antigravity) +// fetches `/api/models/alias` and passes the result through, but +// HermesAgentToolCard never does, so OpenRouter's managed-available-model +// aliases (synced automatically after the connection is tested — see +// syncManagedAvailableModelAliases in src/lib/providerModels/managedAvailableModels.ts) +// are invisible to it. + +const __dirname = dirname(fileURLToPath(import.meta.url)); +const CARD_PATH = resolve( + __dirname, + "../../../src/app/(dashboard)/dashboard/cli-code/components/HermesAgentToolCard.tsx" +); + +describe("HermesAgentToolCard model alias wiring (#7151)", () => { + const source = readFileSync(CARD_PATH, "utf8"); + + it("declares modelAliases state", () => { + expect(source).toMatch(/const \[modelAliases, setModelAliases\] = useState\(\{\}\)/); + }); + + it("fetches /api/models/alias when expanded", () => { + expect(source).toContain('fetch("/api/models/alias")'); + }); + + it("passes modelAliases prop to ModelSelectModal", () => { + // Regression guard: this prop is what unlocks passthrough provider groups + // (OpenRouter, Requesty, DGrid, AgentRouter, Charm Hyper, ...) in the + // Hermes Agent role picker. Without it, OpenRouter is silently absent + // from the "Select" modal for every role (Default, Delegation, ...). + expect(source).toMatch(/modelAliases=\{modelAliases\}/); + }); +}); diff --git a/tests/unit/ui/agent-bridge-server-card-a11y.test.tsx b/tests/unit/ui/agent-bridge-server-card-a11y.test.tsx index 9db239e614..b1892179c6 100644 --- a/tests/unit/ui/agent-bridge-server-card-a11y.test.tsx +++ b/tests/unit/ui/agent-bridge-server-card-a11y.test.tsx @@ -2,7 +2,7 @@ * a11y tests for AgentBridgeServerCard — each action button must have aria-label. * Uses source-text inspection (no JSDOM render needed) for the structural assertion. */ -import { describe, it } from "node:test"; +import { describe, it } from "vitest"; import assert from "node:assert/strict"; import { readFileSync } from "node:fs"; import { fileURLToPath } from "node:url"; diff --git a/tests/unit/ui/cli-tools-no-mitm-tab.test.tsx b/tests/unit/ui/cli-tools-no-mitm-tab.test.tsx index bce2f28fcc..cba7c99ffe 100644 --- a/tests/unit/ui/cli-tools-no-mitm-tab.test.tsx +++ b/tests/unit/ui/cli-tools-no-mitm-tab.test.tsx @@ -4,7 +4,7 @@ * * Uses source-text inspection — no JSDOM render needed. */ -import { describe, it } from "node:test"; +import { describe, it } from "vitest"; import assert from "node:assert/strict"; import { readFileSync } from "node:fs"; import { fileURLToPath } from "node:url"; diff --git a/tests/unit/ui/compressionHub-context-editing.test.tsx b/tests/unit/ui/compressionHub-context-editing.test.tsx index 88fee2e490..6abeb667b6 100644 --- a/tests/unit/ui/compressionHub-context-editing.test.tsx +++ b/tests/unit/ui/compressionHub-context-editing.test.tsx @@ -139,8 +139,11 @@ describe("CompressionHub — Context Editing", () => { }); await flush(); + // CompressionHub deliberately does NOT use useTranslations (see the + // hydration note at the top of CompressionHub.tsx) — its strings are + // literal English text, exactly like EngineConfigPage. const text = container.textContent ?? ""; - expect(text).toContain("Compressão delegada ao provedor"); + expect(text).toContain("Provider-delegated compression"); expect(text).toContain("Context Editing (Claude)"); }); @@ -156,8 +159,8 @@ describe("CompressionHub — Context Editing", () => { await flush(); const text = container.textContent ?? ""; - expect(text).toContain("apenas para Claude"); - expect(text).toContain("não reescrevemos a mensagem"); + expect(text).toContain("available for Claude (Anthropic) only"); + expect(text).toContain("we do not rewrite the message"); }); it("PUTs contextEditing: { enabled: true } when the toggle is flipped on", async () => { diff --git a/tests/unit/ui/compressionHub.test.tsx b/tests/unit/ui/compressionHub.test.tsx index 166c0fef04..27d380d3f0 100644 --- a/tests/unit/ui/compressionHub.test.tsx +++ b/tests/unit/ui/compressionHub.test.tsx @@ -111,28 +111,13 @@ async function flush() { // ── Tests ───────────────────────────────────────────────────────────────── describe("CompressionHub", () => { - it("renders the master switch, mode selector, and the layered pipeline", async () => { - setupFetchMock({ enabled: true, mode: "stacked", pipeline: [{ engine: "rtk" }] }); - const { default: CompressionHub } = - await import("../../../src/app/(dashboard)/dashboard/context/combos/CompressionHub"); - - let container!: HTMLElement; - await act(async () => { - container = mountInContainer(); - }); - await flush(); - - const text = container.textContent ?? ""; - expect(text).toContain("Compression Hub"); - expect(text).toContain("Token Saver"); - expect(text).toContain("Stacked"); - // Active pipeline engine (from the default combo) renders - expect(text).toContain("RTK"); - // Inactive engines from the catalog render too - expect(text).toContain("Caveman"); - // Active-pipeline callout shows when enabled && stacked - expect(text).toContain("Layer pipeline is active"); - }); + // NOTE: the master Token Saver toggle, mode selector, and layered-pipeline + // preview this describe block used to assert on were removed by the Phase 2 + // Hub redesign (see the "Phase 2" comment at the top of CompressionHub.tsx — + // the Hub is now a thin overview with just an active-profile selector + the + // Context Editing toggle). That redesign, including the explicit assertion + // that the master toggle/mode selector/reorder buttons no longer render, is + // covered by compressionHub-active-selector.test.tsx. it("INVARIANT #1: no per-layer control issues a PUT/POST to /api/context/combos/default", { timeout: 20000 }, async () => { const comboWrites: { method: string }[] = []; @@ -186,22 +171,6 @@ describe("CompressionHub", () => { expect(comboWrites).toHaveLength(0); }); - - it("shows the activation warning when Token Saver is off", async () => { - setupFetchMock({ enabled: false, mode: "off", pipeline: [] }); - const { default: CompressionHub } = - await import("../../../src/app/(dashboard)/dashboard/context/combos/CompressionHub"); - - let container!: HTMLElement; - await act(async () => { - container = mountInContainer(); - }); - await flush(); - - const text = container.textContent ?? ""; - expect(text).toContain("Enable Token Saver"); - expect(text).toContain("only run in Stacked mode"); - }); }); describe("CompressionCombosPageClient", () => { diff --git a/tests/unit/ui/conversation-tab-separators.test.tsx b/tests/unit/ui/conversation-tab-separators.test.tsx index 7faad9b6b1..5723955a56 100644 --- a/tests/unit/ui/conversation-tab-separators.test.tsx +++ b/tests/unit/ui/conversation-tab-separators.test.tsx @@ -3,7 +3,7 @@ * Validates the rendering logic: both sections appear when both request/response have turns; * only CONTEXT HISTORY appears when response is empty. */ -import { describe, it } from "node:test"; +import { describe, it } from "vitest"; import assert from "node:assert/strict"; import { normalizeConversation } from "../../../src/mitm/inspector/conversationNormalizer.ts"; import type { InterceptedRequest } from "../../../src/mitm/inspector/types.ts"; diff --git a/tests/unit/ui/conversation-tab.test.tsx b/tests/unit/ui/conversation-tab.test.tsx index 62d405258e..92f8ab213c 100644 --- a/tests/unit/ui/conversation-tab.test.tsx +++ b/tests/unit/ui/conversation-tab.test.tsx @@ -1,7 +1,7 @@ /** * Tests for ConversationTab — normalizeConversation + chat bubble rendering logic */ -import { describe, it } from "node:test"; +import { describe, it } from "vitest"; import assert from "node:assert/strict"; import { normalizeConversation } from "../../../src/mitm/inspector/conversationNormalizer.ts"; import type { InterceptedRequest } from "../../../src/mitm/inspector/types.ts"; diff --git a/tests/unit/ui/historic-session-banner.test.tsx b/tests/unit/ui/historic-session-banner.test.tsx index 910178514d..fb27927710 100644 --- a/tests/unit/ui/historic-session-banner.test.tsx +++ b/tests/unit/ui/historic-session-banner.test.tsx @@ -1,7 +1,7 @@ /** * Tests for HistoricSessionBanner — render with sessionName/null + backToLive callback */ -import { describe, it } from "node:test"; +import { describe, it } from "vitest"; import assert from "node:assert/strict"; // Pure logic tests — no DOM needed (no next-intl in node:test runner) diff --git a/tests/unit/ui/home-topology-hidden-4596.test.tsx b/tests/unit/ui/home-topology-hidden-4596.test.tsx index cdb3a64662..2c3ba169b6 100644 --- a/tests/unit/ui/home-topology-hidden-4596.test.tsx +++ b/tests/unit/ui/home-topology-hidden-4596.test.tsx @@ -19,6 +19,14 @@ describe("home topology hidden networking (#4596)", () => { globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT?: boolean } ).IS_REACT_ACT_ENVIRONMENT = true; websocketMock.mockClear(); + // useLiveDashboard runs a runtime handshake (GET /api/v1/ws?handshake=1) to + // discover the public WS URL before it opens the socket, so it never + // connects to the hardcoded default and then flaps to the public URL. Stub + // it to fail fast instead of letting the real global fetch hit the network. + vi.stubGlobal( + "fetch", + vi.fn(() => Promise.reject(new Error("network unavailable in test"))) + ); vi.stubGlobal( "WebSocket", class WebSocketMock { @@ -59,9 +67,14 @@ describe("home topology hidden networking (#4596)", () => { expect(websocketMock).not.toHaveBeenCalled(); }); - it("opens a WebSocket when the topology section is enabled", () => { - act(() => { + it("opens a WebSocket when the topology section is enabled", async () => { + await act(async () => { root!.render(); + // Let the handshake fetch's rejection propagate through .catch()/.finally() + // so `wsUrlResolved` flips to true and the connect effect re-runs. + await Promise.resolve(); + await Promise.resolve(); + await Promise.resolve(); }); expect(websocketMock).toHaveBeenCalledTimes(1); }); diff --git a/tests/unit/ui/memories-tab.test.tsx b/tests/unit/ui/memories-tab.test.tsx index cb56eaf143..845e1e4d7e 100644 --- a/tests/unit/ui/memories-tab.test.tsx +++ b/tests/unit/ui/memories-tab.test.tsx @@ -292,18 +292,27 @@ describe("MemoriesTab", () => { }); it("calls DELETE when delete confirmed", async () => { - const mockFetch = vi.fn(); - mockFetch.mockResolvedValueOnce({ - ok: true, - json: async () => ({ - data: MOCK_MEMORIES, - total: 2, - totalPages: 1, - stats: { total: 2, tokensUsed: 0, hitRate: 0, cacheStats: { hits: 0, misses: 0 } }, - }), + // MemoriesTab fires two independent fetches on mount: an immediate health + // check (/api/memory/health) and a 300ms-debounced memories list fetch + // (/api/memory?...). A call-order-dependent mock (mockResolvedValueOnce + + // fallback) is fragile here because the health check resolves first and + // would consume the "once" response meant for the list. Key off the URL + // instead, like the rest of this file's fetch mocks do. + const mockFetch = vi.fn((url: string) => { + if (typeof url === "string" && url.startsWith("/api/memory?")) { + return Promise.resolve({ + ok: true, + json: async () => ({ + data: MOCK_MEMORIES, + total: 2, + totalPages: 1, + stats: { total: 2, tokensUsed: 0, hitRate: 0, cacheStats: { hits: 0, misses: 0 } }, + }), + }); + } + return Promise.resolve({ ok: true, json: async () => ({}) }); }); - mockFetch.mockResolvedValue({ ok: true, json: async () => ({}) }); - globalThis.fetch = mockFetch; + globalThis.fetch = mockFetch as unknown as typeof fetch; const { default: MemoriesTab } = await import( "../../../src/app/(dashboard)/dashboard/memory/components/tabs/MemoriesTab" ); diff --git a/tests/unit/ui/model-select-modal-hidden-models-7156.test.tsx b/tests/unit/ui/model-select-modal-hidden-models-7156.test.tsx new file mode 100644 index 0000000000..957f033a7f --- /dev/null +++ b/tests/unit/ui/model-select-modal-hidden-models-7156.test.tsx @@ -0,0 +1,68 @@ +// @vitest-environment jsdom +import React, { act } from "react"; +import { createRoot } from "react-dom/client"; +import { afterEach, beforeEach, describe, expect, it, vi } from "vitest"; +import ModelSelectModal from "@/shared/components/ModelSelectModal"; + +vi.mock("next-intl", () => ({ + useTranslations: () => (key: string) => key, +})); + +const roots: Array<{ root: ReturnType; el: HTMLDivElement }> = []; + +async function render(props: React.ComponentProps): Promise { + const el = document.createElement("div"); + document.body.appendChild(el); + const root = createRoot(el); + await act(async () => { + root.render(); + }); + roots.push({ root, el }); + return el; +} + +beforeEach(() => { + (globalThis as any).IS_REACT_ACT_ENVIRONMENT = true; + vi.stubGlobal( + "fetch", + vi.fn(async (input: RequestInfo | URL) => { + const url = String(input); + if (url.includes("/api/combos")) return new Response(JSON.stringify({ combos: [] }), { status: 200 }); + if (url.includes("/api/provider-nodes")) return new Response(JSON.stringify({ nodes: [] }), { status: 200 }); + if (url.includes("/api/provider-models")) { + return new Response( + JSON.stringify({ + models: { + requesty: [ + { id: "visible-model-1", name: "Visible Model", source: "imported" }, + { id: "hidden-model-1", name: "Hidden Model", source: "imported", isHidden: true }, + ], + }, + modelCompatOverrides: [], + }), + { status: 200 } + ); + } + return new Response(JSON.stringify({}), { status: 200 }); + }) + ); +}); + +afterEach(() => { + for (const { root, el } of roots.splice(0)) { act(() => root.unmount()); el.remove(); } + vi.unstubAllGlobals(); + vi.clearAllMocks(); +}); + +describe("ModelSelectModal hidden-model filtering (#7156)", () => { + it("does not list a custom model explicitly flagged isHidden:true", async () => { + const el = await render({ + isOpen: true, onClose: vi.fn(), onSelect: vi.fn(), + activeProviders: [{ provider: "requesty", id: "conn-1" }], + modelAliases: {}, title: "Add model to combo", + }); + await act(async () => { await new Promise((r) => setTimeout(r, 0)); }); + expect(el.textContent).toContain("Visible Model"); + expect(el.textContent).not.toContain("Hidden Model"); + }); +}); diff --git a/tests/unit/ui/playground-build-tab.test.tsx b/tests/unit/ui/playground-build-tab.test.tsx index c954679818..2699aa4c53 100644 --- a/tests/unit/ui/playground-build-tab.test.tsx +++ b/tests/unit/ui/playground-build-tab.test.tsx @@ -64,6 +64,52 @@ function renderBuildTab(config = BASE_CONFIG): HTMLDivElement { return el; } +// ── BuildWizard navigation helpers ────────────────────────────────────────── +// +// BuildTab now renders behind a 3-step wizard (BuildWizard.tsx): +// step 1 — pick a mode (Tools / JSON / Both) +// step 2 — configure tools and/or the JSON schema, depending on the mode +// step 3 — run + toolbar badges + prompt textarea +// +// next-intl is mocked as a key pass-through above, so every translated label +// renders as its raw i18n key (e.g. "nextButton", "modeToolsTitle"). + +type BuildMode = "tools" | "json" | "both"; + +function clickNext(el: HTMLDivElement): void { + const nextBtn = Array.from(el.querySelectorAll("button")).find((b) => + b.textContent?.includes("nextButton"), + ) as HTMLButtonElement; + act(() => { + nextBtn.click(); + }); +} + +function selectMode(el: HTMLDivElement, mode: BuildMode): void { + // Step 1's default mode is already "tools" — only click a mode card when a + // different mode is required. + if (mode === "tools") return; + const key = mode === "json" ? "modeJsonTitle" : "modeBothTitle"; + const card = Array.from(el.querySelectorAll("button")).find((b) => + b.textContent?.includes(key), + ) as HTMLButtonElement; + act(() => { + card.click(); + }); +} + +/** Drive the wizard from step 1 to step 2, selecting `mode` along the way. */ +function goToStep2(el: HTMLDivElement, mode: BuildMode = "tools"): void { + selectMode(el, mode); + clickNext(el); +} + +/** Drive the wizard from step 1 all the way to step 3 (run screen). */ +function goToStep3(el: HTMLDivElement, mode: BuildMode = "tools"): void { + goToStep2(el, mode); + clickNext(el); +} + afterEach(() => { for (const { root, el } of containers) { act(() => root.unmount()); @@ -76,28 +122,34 @@ afterEach(() => { describe("BuildTab", () => { it("renders Run button", () => { const el = renderBuildTab(); - const runBtn = el.querySelector("[class*='bg-primary']"); - expect(runBtn?.textContent).toContain("runLabel"); + goToStep3(el); + const runBtn = Array.from(el.querySelectorAll("button")).find((b) => + b.textContent?.includes("runButton"), + ); + expect(runBtn).not.toBeUndefined(); }); it("renders Function calling section", () => { const el = renderBuildTab(); - expect(el.textContent).toContain("Function calling"); + goToStep2(el, "tools"); + expect(el.textContent).toContain("toolsLabel"); expect(el.textContent).toContain("Add tool"); }); it("renders Structured output section", () => { const el = renderBuildTab(); - expect(el.textContent).toContain("Structured output"); + goToStep2(el, "json"); + expect(el.textContent).toContain("structuredOutputLabel"); expect(el.textContent).toContain("JSON mode"); }); it("adds a tool and shows it in function calling UI", async () => { const el = renderBuildTab(); + goToStep2(el, "tools"); - // Find add tool form inputs in the right panel + // Find add tool form inputs in the tools panel const allInputs = el.querySelectorAll("input[type='text']") as NodeListOf; - // The first or second input should be the function name + // The first input is the function name const nameInput = allInputs[0]; act(() => setInputValue(nameInput, "search_web")); @@ -115,16 +167,15 @@ describe("BuildTab", () => { it("shows validation error for invalid JSON in tool params", async () => { const el = renderBuildTab(); + goToStep2(el, "tools"); const allInputs = el.querySelectorAll("input[type='text']") as NodeListOf; act(() => setInputValue(allInputs[0], "bad_tool")); // The parameters textarea is in the Add tool form section — it has default valid JSON. - // We need to find the textarea labeled "JSON schema for parameters" in the add form. const paramsTextareas = Array.from(el.querySelectorAll("textarea")).filter( (t) => t.getAttribute("aria-label") === "JSON schema for parameters", ); - // The last one is in the Add tool form (the first may be the message prompt textarea) const paramsTextarea = paramsTextareas[paramsTextareas.length - 1] as HTMLTextAreaElement; act(() => setInputValue(paramsTextarea, "NOT JSON {{{")); @@ -140,6 +191,7 @@ describe("BuildTab", () => { it("enables JSON mode toggle and shows schema editor", async () => { const el = renderBuildTab(); + goToStep2(el, "json"); const toggle = el.querySelector("[role='switch']") as HTMLButtonElement; expect(toggle).not.toBeNull(); @@ -153,6 +205,7 @@ describe("BuildTab", () => { it("shows tool badge in toolbar when tools are added", async () => { const el = renderBuildTab(); + goToStep2(el, "tools"); const allInputs = el.querySelectorAll("input[type='text']") as NodeListOf; act(() => setInputValue(allInputs[0], "my_tool")); @@ -163,7 +216,9 @@ describe("BuildTab", () => { ) as HTMLButtonElement; await act(async () => { addToolBtn.click(); }); - // Badge "1 tool" should appear in toolbar + clickNext(el); // step 2 -> step 3 + + // Badge "1 tool" should appear in the step-3 toolbar expect(el.textContent).toContain("1 tool"); }); @@ -183,6 +238,7 @@ describe("BuildTab", () => { ); const el = renderBuildTab(); + goToStep2(el, "tools"); // Add a tool const allInputs = el.querySelectorAll("input[type='text']") as NodeListOf; @@ -193,14 +249,16 @@ describe("BuildTab", () => { ) as HTMLButtonElement; await act(async () => { addToolBtn.click(); }); - // Type a prompt - const promptTextarea = el.querySelector("textarea[placeholder*='message']") as HTMLTextAreaElement; + clickNext(el); // step 2 -> step 3 + + // Type a prompt (the only textarea left on step 3 is the prompt input) + const promptTextarea = el.querySelector("textarea") as HTMLTextAreaElement; act(() => setInputValue(promptTextarea, "Run this tool")); - // Click Run (label is "runLabel" via mocked t()) + // Click Run (label is "runButton" via mocked t()) const runBtns = el.querySelectorAll("button"); const runBtn = Array.from(runBtns).find( - (b) => b.textContent?.includes("runLabel") && !b.textContent?.includes("clearAll"), + (b) => b.textContent?.includes("runButton"), ) as HTMLButtonElement; await act(async () => { runBtn.click(); }); await act(async () => { @@ -218,8 +276,12 @@ describe("BuildTab", () => { it("shows JSON mode badge in toolbar when JSON mode is enabled", async () => { const el = renderBuildTab(); + goToStep2(el, "json"); const toggle = el.querySelector("[role='switch']") as HTMLButtonElement; await act(async () => { toggle.click(); }); + + clickNext(el); // step 2 -> step 3 + expect(el.textContent).toContain("JSON mode"); }); }); diff --git a/tests/unit/ui/playground-compare-tab.test.tsx b/tests/unit/ui/playground-compare-tab.test.tsx index bbb12ebe53..82fc3ad0e8 100644 --- a/tests/unit/ui/playground-compare-tab.test.tsx +++ b/tests/unit/ui/playground-compare-tab.test.tsx @@ -92,9 +92,9 @@ function renderCompareTab(config = BASE_CONFIG): HTMLDivElement { return el; } -function setInputValue(el: HTMLInputElement, value: string) { +function setInputValue(el: HTMLInputElement | HTMLTextAreaElement, value: string) { const nativeSetter = Object.getOwnPropertyDescriptor( - window.HTMLInputElement.prototype, + el instanceof HTMLTextAreaElement ? window.HTMLTextAreaElement.prototype : window.HTMLInputElement.prototype, "value", )?.set; nativeSetter?.call(el, value); @@ -204,6 +204,10 @@ describe("CompareTab", () => { act(() => setInputValue(input, "model-2")); await act(async () => { addBtn.click(); }); + // Run all is disabled until a prompt is entered + const promptTextarea = el.querySelector("[aria-label='User prompt']") as HTMLTextAreaElement; + act(() => setInputValue(promptTextarea, "Compare this")); + const runBtn = el.querySelector("[aria-label='Run all columns']") as HTMLButtonElement; await act(async () => { runBtn.click(); }); @@ -219,6 +223,11 @@ describe("CompareTab", () => { ); const el = renderCompareTab(); + + // Run all is disabled until a prompt is entered + const promptTextarea = el.querySelector("[aria-label='User prompt']") as HTMLTextAreaElement; + act(() => setInputValue(promptTextarea, "Compare this")); + const runBtn = el.querySelector("[aria-label='Run all columns']") as HTMLButtonElement; act(() => { runBtn.click(); }); diff --git a/tests/unit/ui/playground-studio.test.tsx b/tests/unit/ui/playground-studio.test.tsx index 8a975219ba..91db18dbf8 100644 --- a/tests/unit/ui/playground-studio.test.tsx +++ b/tests/unit/ui/playground-studio.test.tsx @@ -68,6 +68,10 @@ vi.mock("@/shared/components/MonacoEditor", () => ({ vi.mock("@/shared/constants/providers", () => ({ ALIAS_TO_ID: {}, + AI_PROVIDERS: {}, + OPENAI_COMPATIBLE_PREFIX: "openai-compatible-", + ANTHROPIC_COMPATIBLE_PREFIX: "anthropic-compatible-", + CLAUDE_CODE_COMPATIBLE_PREFIX: "anthropic-compatible-cc-", })); vi.mock("@/shared/utils/maskEmail", () => ({ diff --git a/tests/unit/ui/provider-plan-config.test.tsx b/tests/unit/ui/provider-plan-config.test.tsx deleted file mode 100644 index 0351a92a54..0000000000 --- a/tests/unit/ui/provider-plan-config.test.tsx +++ /dev/null @@ -1,134 +0,0 @@ -// @vitest-environment jsdom -import React from "react"; -import { act } from "react"; -import { createRoot } from "react-dom/client"; -import { afterEach, beforeEach, describe, expect, it, vi } from "vitest"; - -vi.mock("next-intl", () => ({ - useTranslations: () => (key: string) => key, -})); - -vi.mock("@/shared/components", () => ({ - Button: ({ - children, - onClick, - disabled, - }: { - children: React.ReactNode; - onClick?: () => void; - disabled?: boolean; - }) => ( - - ), -})); - -vi.mock("@/shared/components/ProviderIcon", () => ({ - default: () => , -})); - -vi.mock("@/lib/quota/planRegistry", () => ({ - knownProviders: () => ["openai", "anthropic"], - getKnownPlan: (prov: string) => { - if (prov === "openai") { - return { dimensions: [{ unit: "tokens", window: "daily", limit: 100000 }] }; - } - return null; - }, -})); - -const MOCK_CONNECTIONS = [ - { id: "conn_1", provider: "openai", name: "GPT Account" }, - { id: "conn_2", provider: "anthropic", email: "user@example.com" }, -]; - -const mockFetch = vi.fn(); -vi.stubGlobal("fetch", mockFetch); - -const { default: ProviderPlanConfigClient } = await import( - "../../../src/app/(dashboard)/dashboard/costs/quota-share/plans/ProviderPlanConfigClient" -); - -let container: HTMLDivElement | null = null; -let root: ReturnType | null = null; - -async function renderPage() { - (globalThis as typeof globalThis & { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = - true; - container = document.createElement("div"); - document.body.appendChild(container); - await act(async () => { - root = createRoot(container!); - root.render(); - }); - // Wait for initial fetch effect to resolve - await act(async () => { - await new Promise((r) => setTimeout(r, 30)); - }); -} - -describe("ProviderPlanConfigClient", { timeout: 15000 }, () => { - beforeEach(() => { - mockFetch.mockImplementation((url: string) => { - if (String(url).includes("/api/providers/client")) { - return Promise.resolve({ - ok: true, - json: () => Promise.resolve({ connections: MOCK_CONNECTIONS }), - } as unknown as Response); - } - if (String(url).includes("/api/quota/plans")) { - return Promise.resolve({ - ok: true, - json: () => Promise.resolve([]), - } as unknown as Response); - } - return Promise.resolve({ - ok: true, - json: () => Promise.resolve({}), - } as unknown as Response); - }); - }); - - afterEach(() => { - if (root && container) act(() => root!.unmount()); - container?.remove(); - container = null; - root = null; - vi.clearAllMocks(); - }); - - it("renders the page title", async () => { - await renderPage(); - expect(document.body.innerHTML).toContain("title"); - }); - - it("renders catalog section with known providers", async () => { - await renderPage(); - // catalogTitle key should appear - expect(document.body.innerHTML).toContain("catalogTitle"); - expect(document.body.innerHTML).toContain("openai"); - }); - - it("renders connection selector with options", async () => { - await renderPage(); - const select = document.querySelector("select") as HTMLSelectElement; - expect(select).not.toBeNull(); - expect(select.options.length).toBeGreaterThan(1); - }); - - it("shows right-panel placeholder when no connection selected", async () => { - await renderPage(); - expect(document.body.innerHTML).toContain("unknownProviderNotice"); - }); - - it("renders save button after selecting a connection", async () => { - await renderPage(); - const select = document.querySelector("select") as HTMLSelectElement; - await act(async () => { - select.value = "conn_1"; - select.dispatchEvent(new Event("change", { bubbles: true })); - }); - expect(document.body.innerHTML).toContain("saveOverrideButton"); - }); -}); diff --git a/tests/unit/ui/same-context-filter.test.tsx b/tests/unit/ui/same-context-filter.test.tsx index ddc9aaef0b..40bcc16b57 100644 --- a/tests/unit/ui/same-context-filter.test.tsx +++ b/tests/unit/ui/same-context-filter.test.tsx @@ -6,7 +6,7 @@ * - RequestRow exports an onSameContext prop * - useTrafficFilters.setSameContext is referenced from TrafficInspectorPageClient */ -import { describe, it } from "node:test"; +import { describe, it } from "vitest"; import assert from "node:assert/strict"; import fs from "node:fs"; import path from "node:path"; @@ -17,21 +17,35 @@ const ROOT = path.resolve( __dirname, "../../../src/app/(dashboard)/dashboard/tools/traffic-inspector" ); +const SRC_ROOT = path.resolve(__dirname, "../../../src"); function read(rel: string): string { return fs.readFileSync(path.join(ROOT, rel), "utf8"); } +function readSrc(rel: string): string { + return fs.readFileSync(path.join(SRC_ROOT, rel), "utf8"); +} + describe("R5-4 same-context filter end-to-end", () => { it("useTrafficStream.applyFilter has sameContextKey branch", () => { - const src = read("hooks/useTrafficStream.ts"); + // The comparison itself now lives in the extracted, independently-testable + // matchesTrafficFilter() helper (src/lib/inspector/matchesTrafficFilter.ts) — + // useTrafficStream.applyFilter just delegates to it. + const hookSrc = read("hooks/useTrafficStream.ts"); assert.ok( - src.includes("sameContextKey") && src.includes("contextKey"), - "applyFilter should branch on sameContextKey / contextKey" + hookSrc.includes("matchesTrafficFilter"), + "applyFilter should delegate to matchesTrafficFilter" + ); + + const matcherSrc = readSrc("lib/inspector/matchesTrafficFilter.ts"); + assert.ok( + matcherSrc.includes("sameContextKey") && matcherSrc.includes("contextKey"), + "matchesTrafficFilter should branch on sameContextKey / contextKey" ); // Must actually exclude requests where contextKey differs assert.ok( - src.includes("req.contextKey !== f.sameContextKey"), + matcherSrc.includes("req.contextKey !== f.sameContextKey"), "should exclude when contextKey !== sameContextKey" ); }); diff --git a/tests/unit/ui/search-tools-compare-tab.test.tsx b/tests/unit/ui/search-tools-compare-tab.test.tsx index 3e014faf8a..3cb92d0ffc 100644 --- a/tests/unit/ui/search-tools-compare-tab.test.tsx +++ b/tests/unit/ui/search-tools-compare-tab.test.tsx @@ -270,12 +270,13 @@ describe("CompareTab", () => { await new Promise((r) => setTimeout(r, 150)); }); - // Check that the table exists and contains overlap info - const table = el.querySelector("table"); - if (table) { + // The results panel renders as a div-based side-by-side layout (not a ) — + // the overlap summary footer lives inside [data-testid='compare-results']. + const resultsPanel = el.querySelector("[data-testid='compare-results']"); + if (resultsPanel) { // URL overlap row should contain a fraction like "1/2" - const tableText = table.textContent ?? ""; - expect(tableText).toMatch(/URL overlap|\d+\/\d+/); + const panelText = resultsPanel.textContent ?? ""; + expect(panelText).toMatch(/in common|\d+\/\d+/); } else { // Loading state is still active — acceptable expect(el.querySelector("[data-testid='compare-loading']")).toBeTruthy(); diff --git a/tests/unit/ui/search-tools-scrape-tab.test.tsx b/tests/unit/ui/search-tools-scrape-tab.test.tsx index 67509d4f47..f63bac664b 100644 --- a/tests/unit/ui/search-tools-scrape-tab.test.tsx +++ b/tests/unit/ui/search-tools-scrape-tab.test.tsx @@ -112,7 +112,9 @@ describe("ScrapeTab", () => { }); const errorEl = el.querySelector("[data-testid='url-error']"); expect(errorEl).toBeTruthy(); - expect(errorEl?.textContent).toContain("URL"); + // next-intl is mocked as a key pass-through above (per repo convention), so the + // rendered text is the raw i18n key, not the translated "URL is required" copy. + expect(errorEl?.textContent).toContain("scrapeUrlRequired"); }); it("shows error for invalid URL", () => { diff --git a/tests/unit/ui/session-recorder-bar.test.tsx b/tests/unit/ui/session-recorder-bar.test.tsx index 2363617277..d4e88c48e3 100644 --- a/tests/unit/ui/session-recorder-bar.test.tsx +++ b/tests/unit/ui/session-recorder-bar.test.tsx @@ -1,7 +1,7 @@ /** * Tests for SessionRecorderBar — start/stop flow + timer logic */ -import { describe, it } from "node:test"; +import { describe, it } from "vitest"; import assert from "node:assert/strict"; function formatElapsed(s: number): string { diff --git a/tests/unit/ui/stats-tab.test.tsx b/tests/unit/ui/stats-tab.test.tsx index 3cdd100ee8..03703966e0 100644 --- a/tests/unit/ui/stats-tab.test.tsx +++ b/tests/unit/ui/stats-tab.test.tsx @@ -2,7 +2,7 @@ * Asserts that StatsTab lazy-loads StatsCharts via next/dynamic (ssr: false) * and does NOT statically import anything from "recharts". */ -import { describe, it } from "node:test"; +import { describe, it } from "vitest"; import assert from "node:assert/strict"; import { readFileSync } from "node:fs"; import { fileURLToPath } from "node:url"; diff --git a/tests/unit/ui/timing-i18n.test.tsx b/tests/unit/ui/timing-i18n.test.tsx index 5d2ee14a77..e52f840c82 100644 --- a/tests/unit/ui/timing-i18n.test.tsx +++ b/tests/unit/ui/timing-i18n.test.tsx @@ -5,7 +5,7 @@ * Round-3 F-I18N translated ConversationTab/StatsTab/StatsCharts but missed * TimingTab (5 labels) and TimingWaterfall (2 labels). Round-4 closed the gap. */ -import { describe, it } from "node:test"; +import { describe, it } from "vitest"; import assert from "node:assert/strict"; import { readFileSync } from "node:fs"; import { fileURLToPath } from "node:url"; diff --git a/tests/unit/ui/traffic-inspector-page.test.tsx b/tests/unit/ui/traffic-inspector-page.test.tsx index f908eab22b..67f1cbd1c0 100644 --- a/tests/unit/ui/traffic-inspector-page.test.tsx +++ b/tests/unit/ui/traffic-inspector-page.test.tsx @@ -1,7 +1,7 @@ /** * Smoke tests for Traffic Inspector page structure and constants */ -import { describe, it } from "node:test"; +import { describe, it } from "vitest"; import assert from "node:assert/strict"; describe("Traffic Inspector page smoke tests", () => { diff --git a/tests/unit/ui/use-resizable-panels.test.tsx b/tests/unit/ui/use-resizable-panels.test.tsx index 156d653738..5dee3cdcf1 100644 --- a/tests/unit/ui/use-resizable-panels.test.tsx +++ b/tests/unit/ui/use-resizable-panels.test.tsx @@ -1,7 +1,7 @@ /** * Tests for useResizablePanels — drag changes width, collapse to 48px, localStorage persistence */ -import { describe, it } from "node:test"; +import { describe, it } from "vitest"; import assert from "node:assert/strict"; const MIN_WIDTH = 280; diff --git a/tests/unit/ui/use-session-recorder.test.tsx b/tests/unit/ui/use-session-recorder.test.tsx index f4889b244a..f39277a653 100644 --- a/tests/unit/ui/use-session-recorder.test.tsx +++ b/tests/unit/ui/use-session-recorder.test.tsx @@ -4,7 +4,7 @@ * Verifies that during recording, new traffic WS events trigger * POST to /api/tools/traffic-inspector/sessions/{id}/requests. */ -import { describe, it, before, after } from "node:test"; +import { describe, it } from "vitest"; import assert from "node:assert/strict"; import fs from "node:fs"; import path from "node:path"; diff --git a/tests/unit/ui/use-system-proxy-exit-guard.test.tsx b/tests/unit/ui/use-system-proxy-exit-guard.test.tsx index af1eaeeb1b..fa6d7597a5 100644 --- a/tests/unit/ui/use-system-proxy-exit-guard.test.tsx +++ b/tests/unit/ui/use-system-proxy-exit-guard.test.tsx @@ -6,7 +6,7 @@ * This matches how use-traffic-stream.test.tsx tests hook logic (pure logic, * no React renderer needed). */ -import { describe, it, beforeEach } from "node:test"; +import { describe, it, beforeEach } from "vitest"; import assert from "node:assert/strict"; // --------------------------------------------------------------------------- diff --git a/tests/unit/ui/use-traffic-stream.test.tsx b/tests/unit/ui/use-traffic-stream.test.tsx index ce8804fa9b..39ca601e28 100644 --- a/tests/unit/ui/use-traffic-stream.test.tsx +++ b/tests/unit/ui/use-traffic-stream.test.tsx @@ -1,7 +1,7 @@ /** * Tests for useTrafficStream — WebSocket snapshot/new/update/clear + reconnect backoff */ -import { describe, it, before, after, mock } from "node:test"; +import { describe, it } from "vitest"; import assert from "node:assert/strict"; import fs from "node:fs"; import path from "node:path"; diff --git a/tests/unit/ui/use-virtual-list.test.tsx b/tests/unit/ui/use-virtual-list.test.tsx index 5ef5e689fb..bfb1bc9a53 100644 --- a/tests/unit/ui/use-virtual-list.test.tsx +++ b/tests/unit/ui/use-virtual-list.test.tsx @@ -1,7 +1,7 @@ /** * Tests for useVirtualList — virtualizes 1000+ items without rendering all */ -import { describe, it } from "node:test"; +import { describe, it } from "vitest"; import assert from "node:assert/strict"; const ESTIMATED_ROW_HEIGHT = 48; diff --git a/tests/unit/verify-published.test.ts b/tests/unit/verify-published.test.ts new file mode 100644 index 0000000000..b4a9be09df --- /dev/null +++ b/tests/unit/verify-published.test.ts @@ -0,0 +1,40 @@ +import { test } from "node:test"; +import assert from "node:assert/strict"; +import { + parseVersionArg, + buildDockerArgs, + CONTAINER_SCRIPT, +} from "../../scripts/release/verify-published.mjs"; + +// WS1.4 (v3.8.49 quality plan) — pure-function guards for the post-publish verifier +// (clean-container install of the PUBLISHED bytes + boot). The end-to-end path is +// exercised live against the registry; these pin the safety-relevant logic. + +test("parseVersionArg accepts strict semver incl. prerelease", () => { + assert.equal(parseVersionArg("3.8.48"), "3.8.48"); + assert.equal(parseVersionArg("3.9.0-rc.1"), "3.9.0-rc.1"); +}); + +test("parseVersionArg rejects shell-hostile and malformed input", () => { + for (const bad of ["", "3.8", "latest", "3.8.48; rm -rf /", "$(whoami)", "3.8.48 && x"]) { + assert.equal(parseVersionArg(bad), null, `should reject: ${bad}`); + } +}); + +test("buildDockerArgs passes the version via env, never into the script body", () => { + const args = buildDockerArgs("3.8.48"); + assert.equal(args[0], "run"); + assert.ok(args.includes("VERIFY_VERSION=3.8.48"), "version must travel as -e env"); + const script = args[args.length - 1]; + assert.equal(script, CONTAINER_SCRIPT); + assert.ok(!script.includes("3.8.48"), "script body must not embed the version (Hard Rule #13)"); + assert.ok(args.includes("node:24-slim"), "clean base image"); + assert.ok(args.includes("--rm"), "container must not linger"); +}); + +test("container script installs from the registry and polls health with a version match", () => { + assert.ok(CONTAINER_SCRIPT.includes('npm install -g "omniroute@${VERIFY_VERSION}"')); + assert.ok(CONTAINER_SCRIPT.includes("/api/monitoring/health")); + assert.ok(CONTAINER_SCRIPT.includes("body.version === want"), "must assert the served version"); + assert.ok(CONTAINER_SCRIPT.includes("WRONG VERSION"), "must fail loudly on version mismatch"); +}); diff --git a/tests/unit/web-cookie-validation-proxy-7058.test.ts b/tests/unit/web-cookie-validation-proxy-7058.test.ts new file mode 100644 index 0000000000..9c573020bc --- /dev/null +++ b/tests/unit/web-cookie-validation-proxy-7058.test.ts @@ -0,0 +1,98 @@ +// Regression test for #7058 — zai-web (and every other entry-bearing web-cookie +// provider) never honored a configured HTTP/SOCKS proxy during connection-test / +// cookie validation. +// +// Root cause: validateWebCookieProvider() probed `${baseUrl}/models` via +// directHttpsRequest(), which hardcodes `bypassProxyPatch: true` — forcing +// safeOutboundFetch to use the pre-patch native fetch and skip proxy-context/ +// env-var resolution entirely. That bypass was introduced in #3226 as a narrow, +// documented exception for a single NVIDIA NIM workaround +// (see tests/unit/proxy-bypass-scope-guard-3226.test.ts) but validateWebCookieProvider +// adopted it as its default transport from inception (#4023), silently extending the +// bypass to every web-cookie provider with a registry entry (zai-web among them). +// +// This test proves the cookie-validation probe reaches a local forward proxy +// (via a real CONNECT tunnel — the same mechanism undici uses for both HTTP and +// HTTPS targets) when one is configured via HTTP_PROXY, exactly like the +// specialty web-cookie validators (chatgpt-web, grok-web, ...) already do via +// validationRead/validationWrite. +import test from "node:test"; +import assert from "node:assert/strict"; +import http from "node:http"; +import net from "node:net"; + +const { validateWebCookieProvider } = await import("../../src/lib/providers/validation.ts"); +const { REGISTRY } = await import("../../open-sse/config/providerRegistry.ts"); +const { clearDispatcherCache } = await import("../../open-sse/utils/proxyDispatcher.ts"); + +const zaiWebEntry = REGISTRY["zai-web"] as { baseUrl?: string } | undefined; +const ORIGINAL_BASE_URL = zaiWebEntry?.baseUrl; +const ORIGINAL_HTTP_PROXY = process.env.HTTP_PROXY; + +test.after(() => { + if (zaiWebEntry && ORIGINAL_BASE_URL !== undefined) { + zaiWebEntry.baseUrl = ORIGINAL_BASE_URL; + } + if (ORIGINAL_HTTP_PROXY === undefined) { + delete process.env.HTTP_PROXY; + } else { + process.env.HTTP_PROXY = ORIGINAL_HTTP_PROXY; + } + clearDispatcherCache(); +}); + +test("zai-web cookie validation routes through the configured HTTP_PROXY (#7058)", async () => { + assert.ok(zaiWebEntry, "zai-web must have a providerRegistry entry for this test to be meaningful"); + + // Stand-in for chat.z.ai's /models probe target. + const target = http.createServer((_req, res) => { + res.writeHead(200, { "content-type": "application/json" }); + res.end("{}"); + }); + await new Promise((resolve) => target.listen(0, () => resolve())); + const targetPort = (target.address() as net.AddressInfo).port; + + // Minimal forward proxy that only speaks CONNECT (like a real corporate proxy) and + // always tunnels to the local target above, regardless of the requested host — this + // lets the "upstream" host be a non-resolvable placeholder without any real DNS + // dependency, while still proving the request actually reached the proxy. + let sawConnect = false; + const proxy = http.createServer((_req, res) => { + res.writeHead(501); + res.end("CONNECT only"); + }); + proxy.on("connect", (_req, socket) => { + sawConnect = true; + const upstream = net.connect(targetPort, "127.0.0.1", () => { + socket.write("HTTP/1.1 200 Connection Established\r\n\r\n"); + upstream.pipe(socket); + socket.pipe(upstream); + }); + upstream.on("error", () => socket.destroy()); + socket.on("error", () => upstream.destroy()); + }); + await new Promise((resolve) => proxy.listen(0, () => resolve())); + const proxyPort = (proxy.address() as net.AddressInfo).port; + + // A non-local-looking hostname: isLocalAddress()/resolveProxyForRequest() force a + // direct connection for any 127.*/localhost/LAN target, which would defeat this test. + zaiWebEntry!.baseUrl = "http://zai-web-validation-probe-7058.invalid"; + process.env.HTTP_PROXY = `http://127.0.0.1:${proxyPort}`; + clearDispatcherCache(); + + try { + const result = await validateWebCookieProvider({ provider: "zai-web", apiKey: "token=fake" }); + + assert.equal( + sawConnect, + true, + "BUG #7058: zai-web cookie validation never reached the configured HTTP_PROXY " + + "(bypassProxyPatch:true unconditionally uses the native, unpatched fetch)" + ); + assert.equal(result.valid, true, `expected a valid session, got ${JSON.stringify(result)}`); + } finally { + target.close(); + proxy.close(); + clearDispatcherCache(); + } +}); diff --git a/tsconfig.typecheck-dashboard.json b/tsconfig.typecheck-dashboard.json new file mode 100644 index 0000000000..a6cfaddf7c --- /dev/null +++ b/tsconfig.typecheck-dashboard.json @@ -0,0 +1,8 @@ +{ + "extends": "./tsconfig.json", + "compilerOptions": { + "noEmit": true, + "incremental": false + }, + "include": ["src/app/(dashboard)/**/*.ts", "src/app/(dashboard)/**/*.tsx"] +} diff --git a/vitest.config.ts b/vitest.config.ts index 4664608302..6f8d643da5 100644 --- a/vitest.config.ts +++ b/vitest.config.ts @@ -6,6 +6,7 @@ export default defineConfig({ test: { environment: "jsdom", globals: true, + setupFiles: ["./tests/_setup/vitestUiPolyfills.ts"], pool: "threads", maxWorkers: 20, fileParallelism: true,