Files
OmniRoute/tests/unit/guardrails/vision-bridge-selfloop-key.test.ts
Hernan Javier Ardila Sanchez d7d98fe356 fix(guardrails): vision bridge reroute/pool/self-loop fixes (#9946)
- auto/best-vision and auto/pro-vision now resolve to the vision CATEGORY
  (candidate filter by capability) instead of the flat smart variant, so the
  vision-bridge describe/reroute target can actually see images
  (resolveBuiltinAutoSpec in builtinCatalog).
- vision candidate pool excludes registry entries whose catalog OVERSTATES
  vision support (opencode-go/opencode-zen/tokenrouter are forced through the
  vision bridge by isVisionBridgeForcedModel) in both the auto-combo candidate
  filter (suffixComposition) and the vision router (visionBridgeRouter).
- reroute guard: an auto/* target is a virtual combo; a missing 'auto' provider
  row (hasUsableCredentials=false) must never block the reroute.
- claude-wire backends (minimax, zai, ...) reject remote image URLs (MiniMax
  403 2013): ensureBase64ImagesForClaudeWire resolves URLs to base64 before
  rerouting, and the describe self-loop normalizes to base64 for those targets
  (isClaudeWireFormatModel).
- self-loop describe uses a real DB-backed key (resolveSelfLoopApiKey) instead
  of the sk_omniroute sentinel rejected by REQUIRE_API_KEY instances, and
  bypasses the runtime's hooked global fetch via undici (ProxyFetch with a dead
  local proxy would otherwise break every describe); compression is disabled
  on the self-loop sub-request so image payloads are never mangled.

Tests: vision-bridge-auto-reroute (2), vision-bridge-selfloop-key (4),
vision-bridge-claude-wire (6), builtin-vision-spec (4),
vision-filter-excludes-forced (4).

Co-authored-by: herjarsa <herjarsa@users.noreply.github.com>
2026-08-10 03:25:18 -03:00

65 lines
2.5 KiB
TypeScript

/**
* Regression: the vision-bridge SELF-LOOP must authenticate with a real
* DB-backed API key, not the `sk_omniroute` sentinel.
*
* Root cause on runtime v3.8.49: `callVisionModelSingle` used
* `resolvedApiKey || "sk_omniroute"` for the Authorization header of the
* OmniRoute self-loop request. On instances with REQUIRE_API_KEY enabled the
* runtime rejects `sk_omniroute` with 401 "Missing API key", so EVERY
* vision-bridge describe call failed and image requests were never processed.
*/
import test from "node:test";
import assert from "node:assert/strict";
const { resolveSelfLoopApiKey } = await import(
"../../../src/lib/guardrails/visionBridgeHelpers.ts"
);
test("uses VISION_BRIDGE_API_KEY when set", async () => {
const previous = process.env.VISION_BRIDGE_API_KEY;
process.env.VISION_BRIDGE_API_KEY = "sk-operator-key";
try {
const key = await resolveSelfLoopApiKey(async () => "sk-db-key");
assert.strictEqual(key, "sk-operator-key");
} finally {
if (previous === undefined) delete process.env.VISION_BRIDGE_API_KEY;
else process.env.VISION_BRIDGE_API_KEY = previous;
}
});
test("falls back to the injected resolver (DB key) when no env key is set", async () => {
const previous = process.env.VISION_BRIDGE_API_KEY;
delete process.env.VISION_BRIDGE_API_KEY;
try {
const key = await resolveSelfLoopApiKey(async () => "sk-real-db-key");
assert.strictEqual(key, "sk-real-db-key");
} finally {
if (previous === undefined) delete process.env.VISION_BRIDGE_API_KEY;
else process.env.VISION_BRIDGE_API_KEY = previous;
}
});
test("never returns the sk_omniroute sentinel when a real key is resolvable", async () => {
const previous = process.env.VISION_BRIDGE_API_KEY;
delete process.env.VISION_BRIDGE_API_KEY;
try {
const key = await resolveSelfLoopApiKey(async () => "sk-db-key");
assert.notStrictEqual(key, "sk_omniroute");
} finally {
if (previous === undefined) delete process.env.VISION_BRIDGE_API_KEY;
else process.env.VISION_BRIDGE_API_KEY = previous;
}
});
test("falls back to sk_omniroute only when nothing else is available", async () => {
const previous = process.env.VISION_BRIDGE_API_KEY;
delete process.env.VISION_BRIDGE_API_KEY;
try {
const key = await resolveSelfLoopApiKey(async () => "");
assert.strictEqual(key, "sk_omniroute");
} finally {
if (previous === undefined) delete process.env.VISION_BRIDGE_API_KEY;
else process.env.VISION_BRIDGE_API_KEY = previous;
}
});