mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-12 18:22:48 +03:00
* fix(quality): green release/v3.8.50 base-reds — env-doc sync + file-size freeze (#9985) Sweep base-reds from issue #9985 on release/v3.8.50: - env-doc-sync: add COMMANDCODE_API_URL + ANTIGRAVITY_ALLOW_SIGNATURE_BYPASS to .env.example and ENVIRONMENT.md (in code, missing from docs); add OMNIROUTE_STRICT_SYSTEM_PROVIDERS + TLS_FINGERPRINT_PROVIDERS to ENVIRONMENT.md (in .env.example, missing from doc). Restores the 3-way env contract. - file-size: freeze open-sse/utils/proxyFetch.ts at 1207 (new proxied-TLS fetch helper over the 1000 cap). Owner-authorized quick rebaseline; slim for v3.9.0. Co-authored-by: OmniRoute maintenance <maintainers@omniroute.local> * fix(quality): green open-sse+dashboard typecheck base-reds (#9985) Release-equivalent fast-gates surface 5 real TS regressions inherited by the base from merged Fal/guardrails/cursor work (fast-gates PR->release do not run these, so they accrued on release/v3.8.50): - open-sse/handlers/imageGeneration/providers/fal.ts: normalizeProviderImagePayload missing 4th 'b64_json' arg (TS2554). - open-sse/handlers/videoGeneration/falHandler.ts: narrow video to Record before .url. - src/app/api/v1/images/generations/route.ts: type the toJsonErrorPayload read. - src/lib/guardrails/visionBridgeHelpers.ts: cast through unknown for UA fetch. - src/lib/providers/mergeProviderModelListing.ts: drop index-signature requirement that made interface RegistryModel[] unassignable (TS2322, from #9911). All fixed in source (keeps the gates meaningful); each reproduces on the base tip. Co-authored-by: OmniRoute maintenance <maintainers@omniroute.local> * fix(quality): allowlist onnxruntime-node in dependency allowlist (#9985) check:deps base-red — onnxruntime-node is a real production dep (transformers embedding path) landed via the LLMLingua/transformers bump (#9962) without an allowlist entry. Legit package: microsoft onnxruntime, verified in registry. * fix(quality): rebaseline CodeQL ratchet 1->2 for #9940 fingerprint alerts (#9985) Base-red: 2nd js/insufficient-password-hash alert on chatBodyAdmission API-key fingerprints (sha256->16-hex admission-lane key), not password verification. Reproduces on release/v3.8.50 tip. Owner-authorized rebaseline (revisit v3.9.0). * fix(quality): green release/v3.8.50 unit base-reds (#9985) 8 unit-test base-reds reproducing on the pristine release tip, fixed in-source (fast-gates PR->release do not run the unit suite, so these accrued silently): - ServiceSupervisor: spawn-failure now resolves with error status (was throwing); health-probe-failure path still rejects. Distinct via spawnFailed flag. - stream + responseSanitizer: numeric passthrough id preserved as string (was regenerated chatcmpl-); finish chunk with empty delta no longer swallowed by the emptyChoices guard. - proxyFetch: genuine (non-abort) proxy transport failures keep the underlying reason in the surfaced error. - auto-combo builtinCatalog: advertised undefined-variant auto/* ids (auto/chat, auto/best-chat, auto/pro-chat) materialize instead of throwing 'Unknown'. - getTranslations en.json: add missing providers.iconUrlInvalid. - optional-transformers-dependency.test: reconcile to #9962's deliberate move of @huggingface/transformers to a regular dep (napi onnxruntime). Co-authored-by: OmniRoute maintenance <maintainers@omniroute.local> --------- Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouzapw@gmail.com> Co-authored-by: OmniRoute maintenance <maintainers@omniroute.local> Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>
61 lines
2.7 KiB
TypeScript
61 lines
2.7 KiB
TypeScript
import test from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import { readFileSync } from "node:fs";
|
|
import { join } from "node:path";
|
|
|
|
const repoRoot = process.cwd();
|
|
|
|
function readJson<T = Record<string, unknown>>(relPath: string): T {
|
|
return JSON.parse(readFileSync(join(repoRoot, relPath), "utf8")) as T;
|
|
}
|
|
|
|
test("@huggingface/transformers is a regular dependency so npm ci never skips it", () => {
|
|
// #9962 deliberately moved @huggingface/transformers out of optionalDependencies:
|
|
// as an optional dep, npm silently skipped the whole subtree on Node 24/26 (old
|
|
// pin dragged onnxruntime-node@1.21.0 whose NAN build no longer compiles), which
|
|
// broke `npm ci`/`next build` with "Can't resolve @huggingface/transformers"
|
|
// (lazy import in src/lib/memory/embedding/transformersLocal.ts). As a regular
|
|
// dep with onnxruntime-node@~1.24.3 (napi prebuilds, no node-gyp) it stays
|
|
// installable and the memory embedding path requires() cleanly.
|
|
const pkg = readJson<{
|
|
dependencies?: Record<string, string>;
|
|
optionalDependencies?: Record<string, string>;
|
|
}>("package.json");
|
|
|
|
assert.equal(
|
|
pkg.dependencies?.["@huggingface/transformers"],
|
|
"^4.2.0",
|
|
"transformers must be a regular dependency (never optional) so npm ci cannot skip it"
|
|
);
|
|
assert.equal(pkg.optionalDependencies?.["@huggingface/transformers"], undefined);
|
|
});
|
|
|
|
test("transformers + onnxruntime-node are regular dependencies (not optional)", () => {
|
|
const pkg = readJson<{
|
|
dependencies?: Record<string, string>;
|
|
optionalDependencies?: Record<string, string>;
|
|
}>("package.json");
|
|
|
|
assert.equal(
|
|
pkg.dependencies?.["onnxruntime-node"],
|
|
"~1.24.3",
|
|
"onnxruntime-node is a regular dep (napi prebuilds, installable on Node 24/26)"
|
|
);
|
|
assert.equal(pkg.optionalDependencies?.["onnxruntime-node"], undefined);
|
|
|
|
const lock = readJson<{
|
|
packages: Record<string, { optional?: boolean; dependencies?: Record<string, string>; optionalDependencies?: Record<string, string> }>;
|
|
}>("package-lock.json");
|
|
|
|
assert.equal(
|
|
lock.packages[""]?.dependencies?.["@huggingface/transformers"],
|
|
"^4.2.0",
|
|
"root lock dependencies must hold transformers as a regular (non-optional) dep"
|
|
);
|
|
// Optional flag is only written `true` for genuinely optional packages;
|
|
// regular deps leave it absent/null. Assert each is NOT optional.
|
|
assert.ok(!lock.packages["node_modules/@huggingface/transformers"]?.optional, "transformers must not be marked optional in the lockfile");
|
|
assert.ok(!lock.packages["node_modules/onnxruntime-node"]?.optional, "onnxruntime-node must not be marked optional in the lockfile");
|
|
assert.ok(!lock.packages["node_modules/onnxruntime-common"]?.optional, "onnxruntime-common must not be marked optional in the lockfile");
|
|
});
|