mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-26 09:02:11 +03:00
65e81158ab
Landed with the design call resolved per the owner's pick — **option 1**: the synced store is now endpoint-agnostic (persistDiscoveredModels and managedModelImport no longer drop non-chat models at write time), and chat selectability moved to read time (auto-pool expansion in autoStrategy applies filterChatSelectableModels; the models-route projection already had its chatOnly filter). Your discovery test now passes end-to-end (3/3): /api/show capabilities persist per connection and image/embedding requests route through the advertising host. Reconciliation notes: conflicted areas merged onto the current tip (adobe discovery import, requestedModel preflight signature, resolvedProvider fast-path coexists with the synced-route override — explicit resolution wins); carried base-red drains (#10055 memoization, #11071 test variants) dropped as already-landed; the managed-model-import exclusion test was propagated to the new contract (image/video models persist; the read filter still hides them from chat pickers — pinned by a new assertion). Full battery: 205/206 focused (the one red is a confirmed periodic-timer timing flake on the loaded devbox — 20/20 isolated), autoCombo vitest 30/30, combo suites 46/46, gates + typecheck clean. Thank you @yourspraveen — the capability probe + routing design was right; it just needed the store contract opened up. Fixes #11087.
77 lines
2.7 KiB
TypeScript
77 lines
2.7 KiB
TypeScript
import test from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import fs from "node:fs";
|
|
import path from "node:path";
|
|
|
|
/**
|
|
* Static scan, not behavior: a new `setup-*` command that writes a CLI-tool
|
|
* config must not silently no-op inside the OmniRoute container. Anything that
|
|
* writes has to route through the container guard first.
|
|
*/
|
|
|
|
const COMMANDS_DIR = path.join(process.cwd(), "bin/cli/commands");
|
|
const WRITE_CALLS = /\b(writeFileSync|writeAtomic|cpSync|copyFileSync|renameSync)\s*\(/;
|
|
const GUARD_CALL = /guardHostConfigTarget\s*\(/;
|
|
|
|
/**
|
|
* Commands whose writes never target a host CLI's own config (they write to a
|
|
* user-chosen --out path, OmniRoute's own data dir, etc.). Keep this list tiny
|
|
* and justified — an entry here is an opt-out from the guard.
|
|
*/
|
|
const NOT_CLI_TOOL_CONFIG = new Set<string>([]);
|
|
|
|
function setupCommandFiles(): string[] {
|
|
return fs
|
|
.readdirSync(COMMANDS_DIR)
|
|
.filter((name) => name.startsWith("setup-") && name.endsWith(".mjs"))
|
|
.sort();
|
|
}
|
|
|
|
test("every setup-* command that writes files calls the container guard", () => {
|
|
const offenders: string[] = [];
|
|
|
|
for (const name of setupCommandFiles()) {
|
|
if (NOT_CLI_TOOL_CONFIG.has(name)) continue;
|
|
const source = fs.readFileSync(path.join(COMMANDS_DIR, name), "utf8");
|
|
if (!WRITE_CALLS.test(source)) continue;
|
|
if (!GUARD_CALL.test(source)) offenders.push(name);
|
|
}
|
|
|
|
assert.deepEqual(
|
|
offenders,
|
|
[],
|
|
`these setup-* commands write config without guardHostConfigTarget(): ${offenders.join(", ")}`
|
|
);
|
|
});
|
|
|
|
test("every guarded setup-* command exposes --allow-container-write", () => {
|
|
const offenders: string[] = [];
|
|
|
|
for (const name of setupCommandFiles()) {
|
|
const source = fs.readFileSync(path.join(COMMANDS_DIR, name), "utf8");
|
|
if (!GUARD_CALL.test(source)) continue;
|
|
if (!source.includes("--allow-container-write")) offenders.push(name);
|
|
}
|
|
|
|
assert.deepEqual(offenders, [], `missing the --allow-container-write escape hatch: ${offenders}`);
|
|
});
|
|
|
|
test("the scan actually sees the commands it is meant to protect", () => {
|
|
const files = setupCommandFiles();
|
|
assert.ok(files.length >= 12, `expected the setup-* family, found ${files.length}`);
|
|
for (const expected of ["setup-codex.mjs", "setup-claude.mjs", "setup-crush.mjs"]) {
|
|
assert.ok(files.includes(expected), `${expected} should be scanned`);
|
|
}
|
|
});
|
|
|
|
test("config set and configure are guarded too", () => {
|
|
for (const name of ["config.mjs", "configure.mjs"]) {
|
|
const source = fs.readFileSync(path.join(COMMANDS_DIR, name), "utf8");
|
|
assert.match(source, GUARD_CALL, `${name} should call the container guard`);
|
|
assert.ok(
|
|
source.includes("--allow-container-write"),
|
|
`${name} should expose --allow-container-write`
|
|
);
|
|
}
|
|
});
|