mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-26 09:52:11 +03:00
* chore(release): continue v3.8.25 development cycle after main code-sync (r5) main fast-forwarded to release/v3.8.25 (#3863): unblocked Build+Docker via #3864, plus #3837 (mimocode proxy) and #3862 (trivy bump). This marker re-opens the umbrella PR for further v3.8.25 work. No version bump. * fix(db): persist the Keep-latest-backups retention setting (#3834) (#3867) * fix(oauth): clear GitLab Duo setup message instead of 500 (#3861) (#3868) * test(oauth): prove refresh_token preserved on real gemini-cli/antigravity dispatch (#3850) (#3869) * feat(compression-ui): unified compression config UI — per-engine pages + combos editor + menu + WS default-on (#3860) Integrated into release/v3.8.25 — feat(compression-ui): unified compression configuration UI (Compression Hub + per-engine Lite/Aggressive/Ultra pages + combos editor + sidebar entry + live-WS default-on). File-size re-baselined for sidebarVisibility.ts/chatCore.ts growth; orphan ws test relocated to a collected path. * docs(changelog): complete the v3.8.25 release notes + credit all contributors Audited every commit since v3.8.24 and filled the gaps the [3.8.25] section was missing: a New Features section (compression engines + Compression Studios #3848, compression UI #3860, injection-guard #3857, kiro discovery #3836, Veo #3839, mimocode proxy #3837, Arena ELO flag #3821), 9 more Fixed entries (#3811/#3807/#3759/#3849/#3838/#3835/#3814/#3820/#3819), a Security section (CCR IDOR #3859, supply-chain #3824), and an Internal/Quality section. Every contributor and issue reporter is now credited. * docs(changelog): restore + complete the v3.8.25 release notes Re-adds CHANGELOG.md (a prior server-side commit accidentally dropped it) with the complete, audited [3.8.25] section: New Features, the full Fixed list, Security & Hardening, and Internal/Quality — every contributor and issue reporter credited. * chore(release): finalize v3.8.25 — reconcile CHANGELOG + i18n mirrors, document OMNIROUTE_MAX_PENDING_MIGRATIONS, green the unit suite Release-gate reconciliation for v3.8.25: - CHANGELOG: dated 2026-06-14, linked #3826, rolled up file-size re-baselines (#3823/#3833), recorded the test-greening; re-synced all 41 i18n CHANGELOG mirrors. - Documented OMNIROUTE_MAX_PENDING_MIGRATIONS (#3416) in .env.example + ENVIRONMENT.md. - Greened the unit suite (was merged red on 4 CI shards): aligned 10 stale tests to this cycle's intended behavior (#3838/#3822/#3501/SOCKS5/Vertex-Express/Antigravity) and the same-provider 503 fall-through test; de-flaked the compression benchmark reproducibility and ServiceSupervisor crash tests. No production code changed. * ci(security): clear OpenSSF Scorecard code-scanning noise + harden workflow token permissions The Security tab held 155 open alerts, ALL from the advisory OpenSSF Scorecard tool (#3824) — supply-chain/posture scores, not code vulnerabilities — which drowned out real CodeQL findings. - scorecard.yml: stop uploading SARIF to the code-scanning tab (drop the upload-sarif step + the now-unused security-events: write). The run still produces the OpenSSF badge (publish_results) and a downloadable SARIF artifact. - TokenPermissions hardening (the high-severity, genuinely-valuable subset): set each workflow's top-level token to read-only and grant the exact writes at the job level that needs them — npm-publish (id-token/packages on publish jobs), docker-publish (packages on build), electron-release (contents on build/release, id-token/packages on publish-npm), build-fork (packages on build), claude (empty top-level; job grants its own). The 155 existing alerts were dismissed. Not adopting repo-wide SHA-pinning (143 PinnedDependencies advisories) — declined. * test(integration): align stale wiring/socks5 integration tests to this cycle's behavior These were red on the CI Integration job (pre-existing). No production code changed: - integration-wiring: the combos page no longer renders a per-page EmailPrivacyToggle (#3822 consolidated it into Settings → Appearance); the provider-detail test-result masking and upstream-proxy copy moved to decomposed components (#3501 BatchTestResultsModal / UpstreamProxyCard) — assertions now read the owning files. - api-routes-critical: SOCKS5 is now enabled by default (opt-out), so the disabled- rejection test must set ENABLE_SOCKS5_PROXY=false explicitly (an unset env now means enabled). (The ~32 live-Gemini integration tests are gated on OMNIROUTE_API_KEY and skip in CI; they only 'fail' locally when that key is present without a running server.)
198 lines
6.5 KiB
TypeScript
198 lines
6.5 KiB
TypeScript
import test from "node:test";
|
|
import assert from "node:assert/strict";
|
|
|
|
const { checkFallbackError } = await import("../../open-sse/services/accountFallback.ts");
|
|
const { handleComboChat } = await import("../../open-sse/services/combo.ts");
|
|
const { resetAllCircuitBreakers } = await import("../../src/shared/utils/circuitBreaker.ts");
|
|
|
|
test.beforeEach(() => {
|
|
resetAllCircuitBreakers();
|
|
});
|
|
|
|
function createLog() {
|
|
const entries = [];
|
|
return {
|
|
info: (tag: string, msg: string) => entries.push({ level: "info", tag, msg }),
|
|
warn: (tag: string, msg: string) => entries.push({ level: "warn", tag, msg }),
|
|
error: (tag: string, msg: string) => entries.push({ level: "error", tag, msg }),
|
|
debug: (tag: string, msg: string) => entries.push({ level: "debug", tag, msg }),
|
|
entries,
|
|
};
|
|
}
|
|
|
|
function createStatusSequenceHandler(sequence) {
|
|
let idx = 0;
|
|
return async () => {
|
|
const step = sequence[idx++] || { status: 200 };
|
|
if (step.status === 200) {
|
|
return new Response(JSON.stringify({ ok: true }), { status: 200 });
|
|
}
|
|
return new Response(
|
|
JSON.stringify({
|
|
error: { message: step.message || `Error ${step.status}` },
|
|
}),
|
|
{
|
|
status: step.status,
|
|
headers: step.headers || { "content-type": "application/json" },
|
|
}
|
|
);
|
|
};
|
|
}
|
|
|
|
test("T23: 429 with long Retry-After uses real reset cooldown instead of short exponential backoff", () => {
|
|
const headers = new Headers({ "retry-after": "3600" });
|
|
const result = checkFallbackError(429, "Rate limit exceeded", 2, null, "groq", headers);
|
|
|
|
assert.equal(result.shouldFallback, true);
|
|
assert.equal(result.reason, "rate_limit_exceeded");
|
|
assert.equal(result.newBackoffLevel, 0);
|
|
assert.ok(result.cooldownMs > 3_590_000);
|
|
});
|
|
|
|
test("T24: combo awaits short 503 cooldown before falling through to next model", async () => {
|
|
const log = createLog();
|
|
|
|
const result = await handleComboChat({
|
|
body: {},
|
|
combo: {
|
|
name: "t24-short-cooldown",
|
|
strategy: "priority",
|
|
// Cross-provider targets: a 503 marks the failing provider's remaining same-provider
|
|
// targets for skip (#1731v2), so the fallthrough target must be a DIFFERENT provider
|
|
// for this cooldown-wait test to exercise the fall-through-to-next-model path.
|
|
models: [
|
|
{ model: "groq/model-a", weight: 0 },
|
|
{ model: "openai/model-b", weight: 0 },
|
|
],
|
|
config: { fallbackDelayMs: 2000, maxRetries: 1 },
|
|
},
|
|
// Two transient failures on first model, then success on fallback model.
|
|
handleSingleModel: createStatusSequenceHandler([
|
|
{ status: 503 },
|
|
{ status: 503 },
|
|
{ status: 200 },
|
|
]),
|
|
isModelAvailable: () => true,
|
|
log,
|
|
settings: null,
|
|
allCombos: null,
|
|
});
|
|
|
|
assert.equal(result.ok, true);
|
|
// checkFallbackError returns COOLDOWN_MS.transient (5000ms) for a plain 503.
|
|
// fallbackDelayMs=2000, cooldownMs=5000 ≤ MAX_FALLBACK_WAIT_MS(5000) → fallbackWaitMs=2000ms.
|
|
// The combo MUST emit a debug log before waiting, proving the wait behavior is wired.
|
|
const waitLog = log.entries.find((e) => e.msg.includes("Waiting") && e.msg.includes("fallback"));
|
|
assert.ok(waitLog, "combo must emit a debug wait-before-fallback log for short 503 cooldowns");
|
|
});
|
|
|
|
test("T24: combo skips wait when 503 cooldown is long (>5s)", async () => {
|
|
const log = createLog();
|
|
|
|
const result = await handleComboChat({
|
|
body: {},
|
|
combo: {
|
|
name: "t24-long-cooldown",
|
|
strategy: "priority",
|
|
// Cross-provider targets (see t24-short-cooldown): the fall-through target must be a
|
|
// different provider so the #1731v2 same-provider skip doesn't short-circuit it.
|
|
models: [
|
|
{ model: "groq/model-a", weight: 0 },
|
|
{ model: "openai/model-b", weight: 0 },
|
|
],
|
|
config: { fallbackDelayMs: 2000, maxRetries: 1 },
|
|
},
|
|
handleSingleModel: createStatusSequenceHandler([
|
|
{
|
|
status: 503,
|
|
message: "rate limit exceeded",
|
|
headers: { "content-type": "application/json", "retry-after": "120" },
|
|
},
|
|
{
|
|
status: 503,
|
|
message: "rate limit exceeded",
|
|
headers: { "content-type": "application/json", "retry-after": "120" },
|
|
},
|
|
{ status: 200 },
|
|
]),
|
|
isModelAvailable: () => true,
|
|
log,
|
|
settings: null,
|
|
allCombos: null,
|
|
});
|
|
|
|
assert.equal(result.ok, true);
|
|
const waitLog = log.entries.find((e) => e.msg.includes("Waiting") && e.msg.includes("fallback"));
|
|
assert.equal(waitLog, undefined);
|
|
});
|
|
|
|
test("T24: all inactive accounts return 503 service_unavailable (not 406)", async () => {
|
|
const result = await handleComboChat({
|
|
body: {},
|
|
combo: {
|
|
name: "t24-all-inactive",
|
|
strategy: "priority",
|
|
models: [
|
|
{ model: "groq/model-a", weight: 0 },
|
|
{ model: "groq/model-b", weight: 0 },
|
|
],
|
|
},
|
|
handleSingleModel: async () => {
|
|
throw new Error("handleSingleModel should not be called when all models are unavailable");
|
|
},
|
|
isModelAvailable: () => false,
|
|
log: createLog(),
|
|
settings: null,
|
|
allCombos: null,
|
|
});
|
|
|
|
assert.equal(result.status, 503);
|
|
const body = (await result.json()) as any;
|
|
assert.equal(body.error?.code, "ALL_ACCOUNTS_INACTIVE");
|
|
});
|
|
|
|
test("combo falls through 400s and reaches the next model", async () => {
|
|
const calls = [];
|
|
const sequence = [
|
|
{ status: 429, message: "No capacity available for model gemini-3.1-pro-preview" },
|
|
{ status: 400, message: "bad request" },
|
|
{ status: 200 },
|
|
];
|
|
|
|
const result = await handleComboChat({
|
|
body: {},
|
|
combo: {
|
|
name: "t24-provider-scoped-400",
|
|
strategy: "priority",
|
|
models: [
|
|
{ model: "free/gemini-3.1-pro-preview", weight: 0 },
|
|
{ model: "aio/gemini-3.1-pro-preview-thinking-high", weight: 0 },
|
|
{ model: "openrouter/google/gemini-3.1-pro-preview", weight: 0 },
|
|
],
|
|
config: { maxRetries: 0 },
|
|
},
|
|
handleSingleModel: async (_body, modelStr) => {
|
|
calls.push(modelStr);
|
|
const step = sequence[calls.length - 1] || { status: 200 };
|
|
if (step.status === 200) {
|
|
return new Response(JSON.stringify({ ok: true }), { status: 200 });
|
|
}
|
|
return new Response(JSON.stringify({ error: { message: step.message } }), {
|
|
status: step.status,
|
|
headers: { "content-type": "application/json" },
|
|
});
|
|
},
|
|
isModelAvailable: () => true,
|
|
log: createLog(),
|
|
settings: null,
|
|
allCombos: null,
|
|
});
|
|
|
|
assert.equal(result.ok, true);
|
|
assert.deepEqual(calls, [
|
|
"free/gemini-3.1-pro-preview",
|
|
"aio/gemini-3.1-pro-preview-thinking-high",
|
|
"openrouter/google/gemini-3.1-pro-preview",
|
|
]);
|
|
});
|