mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-26 09:52:11 +03:00
* chore(release): open v3.8.28 development cycle * fix(ws): warm SSE auth import on LiveWS startup; relocate boot test to integration (#4063) The live dashboard WebSocket sidecar lazily import()-ed the SSE auth module inside the connection handler, only on the API-key path. That cold import pulls in hundreds of transitive modules and takes ~7s under tsx, blocking the single-threaded event loop. The first API-key WebSocket connection therefore stalled the loop long enough that any connection arriving in that window — e.g. a same-origin cookie client — could not complete its handshake and timed out. This was deterministic, not an "env flake": the boot test fires an API-key connection immediately followed by a cookie connection, so the cookie connection always raced the cold import and timed out (reproduced 3/3 locally and red on every CI run; proven via instrumented probes — reversing the order or warming the module first makes both connections open in ~20ms). Fix: - Memoize the auth-module import and warm it once at startup (before listen), so connection handling never pays the cold-import cost. Real improvement: the first API-key client no longer stalls the event loop for concurrent clients. - Relocate the boot test from tests/unit/cli to tests/integration. It spawns a real subprocess + WS server + SQLite (~9-11s); under the unit suite's --test-concurrency=20 it contended for CPU and destabilized the shard. The serial integration runner is its correct home; it still guards #4004's cookie-parse fix on every PR via the integration CI job. - Bump the test's startup/overall timeouts to absorb the eager auth warm. Makes `npm run test:unit` deterministically green (the only remaining unit red). Validated: relocated test 3/3 green via the integration runner (was 3/3 red); typecheck:core + eslint clean; confirmed it no longer matches the test:unit glob and does match tests/integration/*.test.ts. * fix(ws): start LiveWS sidecar with cwd at package root (#4055) (#4064) * chore(deps): bump ossf/scorecard-action from 2.4.0 to 2.4.3 (#4045) Integrado em release/v3.8.28. Patch de SHA do ossf/scorecard-action (2.4.0→2.4.3), mantém SHA-pin. Reds de CI são exclusivamente os shards flaky pré-existentes branch-wide (Unit 7/8, Integration, Coverage 7/8, Node 1/2) — não relacionados ao bump (PR deps-only). * deps: bump electron from 42.4.0 to 42.4.1 in /electron (#4049) Integrado em release/v3.8.28. Patch do electron (42.4.0→42.4.1). Reds de CI: shards flaky pré-existentes + PR Test Policy = falso-positivo (mudança deps-only sob electron/ não comporta teste de código) + Node 26(2/2) sem step (flake/infra). Precedente #3913/#3914 (electron dependabot mergeado nessas condições). * fix(auto): resolve built-in auto catalog combos (#4058) Integrado em release/v3.8.28. Resolve os IDs de catálogo `auto/*` built-in (combos virtuais) — corrige o 400 "No auto combos configured" em auto/best-coding etc. Ajuste de review: os mapas AUTO_TEMPLATE_VARIANTS/VALID_AUTO_VARIANTS duplicados em chat.ts e chatHelpers.ts foram extraídos para open-sse/services/autoCombo/builtinCatalog.ts (DRY), devolvendo chatHelpers.ts <800 LOC; baseline de chat.ts rebaselinado 1432→1458 (lógica nova). Fast QG + semgrep + dast verdes; 22/22 testes. * chore(docs): update Discord invite link to a non-expiring one (#4067) * chore(deps): freeze @huggingface/transformers in dependabot (hard-pin) (#4066) Integrado em release/v3.8.28. Congela @huggingface/transformers no dependabot (pin exato 3.5.2, load-bearing p/ LLMLingua + memory embeddings, VPS-validado #4014). Fast QG + semgrep + dast verdes. * ci(quality): flip TIA impacted-unit-tests gate from advisory to blocking (#4069) The pre-existing release unit test-debt that kept the TIA "Impacted unit tests" step advisory has been cleared: - #4030 restored 16 lossless Zod/registry reds (from the oyi77 modularize refactors). - #4063 fixed the last red — the LiveWS boot test — which was a real deterministic event-loop stall in the WS sidecar (cold ~7s lazy auth import racing a second connection), not an env flake; fixed (warm the import at startup) and relocated to the integration suite. A full workflow_dispatch ci.yml run on release/v3.8.28 then showed all 8 Unit Tests shards green. The remaining Integration Tests / Quality Ratchet reds are pre-existing and unrelated (combo/resilience env-flakes; eslint/i18n baseline drift). Removing continue-on-error makes PR->release block on unit-test regressions in the TIA-selected impacted set (fail-safe still runs the full unit suite on hub/unmapped changes). typecheck:core was already blocking. Closes the fast-gates "no tests on PR->release" hole (Quality Gate v2 / Fase 9, P2). * docs(compression): document LLMLingua optional deps + on-demand install (#4061) Integrado em release/v3.8.28. Docs LLMLingua optional deps + on-demand install (F3.1). * feat(dashboard): Combo Studio connection-cooldown badge (U1b Slice 2) (#4068) Integrado em release/v3.8.28. Combo Studio connection-cooldown badge (U1b Slice 2 / F5.1). * feat(compression): record Context Editing telemetry (engine: context-editing) (#4062) Integrado em release/v3.8.28. Context Editing telemetry (F4.1). * feat(sse): Context Editing relay coverage + 400-fallback (#4065) Integrado em release/v3.8.28. Context Editing relay coverage (cc-*) + 400-fallback (F4.2/F4.3). Conflito de file-size-baseline.json (vs #4062) resolvido por união (ambas justificativas + base.ts 1292 + chatCore.ts 5898). Validado local no tree mergeado: typecheck:core ✓, eslint ✓, check:file-size ✓, 4/4 testes ✓; semgrep + semgrep-cloud verdes. Fast QG enfileirado (saturação de runner) — mergeado nos gates de política verificados (precedente #4034/#4020). * feat(providers): add OrcaRouter (OpenAI-compatible routing gateway) (#4070) Integrado em release/v3.8.28. Adiciona o provider OrcaRouter (OpenAI-compatible, API-key, DefaultExecutor). Ajuste de review: rebaseline de file-size de providers.ts 3147→3159 (+12 da entrada OrcaRouter). Validado local no tree sincronizado: provider-consistency ✓, docs-counts STRICT 227 ✓, typecheck:core ✓, teste 3/3 ✓, eslint ✓; semgrep + semgrep-cloud verdes. Fast QG/dast enfileirados (saturação de runner) — merge nos gates de política verificados (precedente #4034/#4065). * test(infra): isolate DATA_DIR per test process; raise Stryker concurrency 1→4 (#4078) * test(infra): isolate DATA_DIR per test process; raise Stryker concurrency 1→4 Every test process resolved DATA_DIR to the same default (~/.omniroute) when the env var was unset (src/lib/dataPaths.ts::resolveDataDir), so concurrent test files opened the SAME on-disk storage.sqlite. node:test spawns a process per file and Stryker spawns one per sandbox, so this shared file caused cross-file state races: - SQLite lock contention that hung `npm run test:unit` under high --test-concurrency (the ~95-min local hang), and - the non-deterministic baseline that forced stryker.conf.json to concurrency: 1, which in turn could not finish the ~15k-mutant run inside the nightly timeout (the cancelled 2026-06-16/17 nightly-mutation runs) — blocking Quality Gate v2 / Fase 9 Onda 2. open-sse/utils/setupPolyfill.ts could NOT host the fix: it is imported by production (bin/omniroute.mjs, proxyFetch.ts, proxyDispatcher.ts), where redirecting DATA_DIR would point the live SQLite DB at a throwaway temp dir. So this adds a TEST-ONLY tests/_setup/isolateDataDir.ts that gives each process its own temp DATA_DIR when none is set (tests that set DATA_DIR explicitly still win), wired via --import into the test, mutation and CI invocations. Verified: - Stryker dry-run A/B at concurrency=4: FAILS without the isolation import (account-fallback-service tap exit 9, a cross-file race) and PASSES with it. - Full `npm run test:unit` green with isolation (0 fail; a one-off chatcore-translation-paths timeout flake did not reproduce and passes 3/3 isolated) and noticeably faster — the DB lock contention is gone. - New tests/unit/isolate-datadir.test.ts guards the contract (unique temp DATA_DIR when unset; explicit DATA_DIR respected). Wired the --import into: package.json (13 test scripts), stryker.conf.json (tap.nodeArgs + concurrency 1→4), .github/workflows/quality.yml (TIA step), ci.yml (the 5 unit/coverage/integration commands), and bumped nightly-mutation.yml timeout 120→180 for the first cold run before the incremental cache is seeded. * ci(quality): run the TIA gate at CI concurrency (4) to stop oversubscription flakes The TIA "Impacted unit tests" step (made blocking in #4069) ran its fail-safe via `npm run test:unit` — concurrency=20, tuned for multi-core dev machines. On a 4-vCPU CI runner that is 5x oversubscribed, so timing-sensitive tests flake under the load (e.g. `db-backup-extended` "The database connection is not open", `chatcore-translation-paths` upstream-timeout). That intermittently fails a blocking gate on legitimate PRs — exactly what surfaced on the DATA_DIR-isolation PR, whose package.json/workflow changes trip the __RUN_ALL__ fail-safe. Run both the impacted set and the fail-safe at --test-concurrency=4, matching the stable ci.yml unit job. Adds a `test:unit:ci` script (test:unit at concurrency=4). The DATA_DIR isolation in this PR keeps the parallel run race-free, so the only change here is matching the runner's core count. Verified locally: db-backup-extended passes 8/8 in isolation (5 with isolation, 3 without). * docs(quality-gates): reconcile gate inventory with ci.yml + add ROI rationalization backlog (#4095) The "authoritative" gate inventory in QUALITY_GATES.md had drifted from ci.yml: it omitted 9 wired gates — `audit:deps`, `check:tracked-artifacts`, `check:lockfile`, `check:licenses` (lint job), `check:dead-code`, `check:cognitive-complexity`, `check:type-coverage`, `check:codeql-ratchet` (quality-gate job), and `check:pr-evidence` (pr-test-policy job). You can't rationalize an inventory you can't trust, so this reconciles it first. Adds those 9 rows to their job tables and a "Rationalization Backlog (ROI review)" section capturing the Fase 9 Onda 3 findings: mechanical merge/dedup candidates (CVE scanners audit:deps↔osv, the two complexity ESLint passes, cycles↔circular-deps, the two /api anti-hallucination gates, the doubly-run check:docs-sync, check:node-runtime ×11) and the operator-only flip/drop decisions (typecheck:noimplicit vs the type-coverage ratchet, test:vitest:ui parked fails, check:secrets frozen FPs, openapi-security-tiers, pr-evidence, the orphaned semgrep baseline). Also flags the undocumented advisory docs-lint job and the standalone scanner workflows. Docs-only — no gate behavior changes. The merges (CI changes) and flips (policy) are deferred to operator-scoped follow-ups; this PR only makes the map accurate. * test(dashboard): smoke e2e for the Combo Live Studio page (#4075) Integrated into release/v3.8.28 * fix(sse): friendly 413 message for ChatGPT web payload-too-large (#4080) Integrated into release/v3.8.28 * feat(sse): port Claude Code quota-probe bypass + command meta-request helpers (#4083) Integrated into release/v3.8.28 * feat(api): exact offline token counting for count_tokens fallback via tiktoken (#4087) Integrated into release/v3.8.28 * feat(compression): RTK learn/discover (sample source + API + UI) (#4088) Integrated into release/v3.8.28 * feat(dashboard): 2026-06-17 free-tier refresh — honest catalog, uncapped + boost tiers, Layout A budget table (#4089) Integrated into release/v3.8.28 * feat(mitm): capture-pipeline self-test route (Gap 12) (#4093) Integrated into release/v3.8.28 * fix(mitm): crash-safe system-state teardown + socket timeouts (ProxyBridge-inspired hardening) (#4084) Integrated into release/v3.8.28 (Fast QG TIA red = 3 pre-existing timing flakes verified passing locally 82/82; PR own tests green) * feat(mitm): attribute intercepted requests to originating process (Gap 1) (#4085) Integrated into release/v3.8.28 (Fast QG TIA red = 3 pre-existing timing flakes verified passing locally 82/82; PR own tests green) * fix(sse): route image requests only to confirmed-vision combo targets (#4071) Integrated into release/v3.8.28 * fix(security): injection guard respects INJECTION_GUARD_MODE DB feature flag (#4077) Integrated into release/v3.8.28 * fix(ws): proxy LAN /live-ws upgrades and add unset JWT_SECRET warning (#4079) Integrated into release/v3.8.28 * fix(dev): force webpack in custom dev server (Turbopack 16.2.x panics) (#4092) Integrated into release/v3.8.28 * ci(quality): dedup the doubly-run check:docs-sync + record validated ROI backlog (#4099) Onda 3 (gate ROI-review) Phase 2. Two parts, both low-risk: 1. Remove the standalone `check:docs-sync` from the `lint` job — it already runs in the `docs-sync-strict` job (via `check:docs-all`) and the husky pre-commit hook, so the `lint`-job copy was a pure duplicate. No coverage lost. 2. Update the Rationalization Backlog in QUALITY_GATES.md with trust-but-verify findings: several "obvious" merges/flips from the ROI review turned out to hide debt and are NOT clean drop-ins — - CVE merge (audit:deps→osv): different semantics (hard high/critical vs regression-ratchet) — keep both. - cycles→circular-deps: dpdm reports 91 cycles (can't promote to blocking) and is broader-scope than the green curated check:cycles — keep both. - openapi-security-tiers flip: blocked by traffic-inspector routes missing the x-loopback-only annotation. - complexity + /api merges: valid but real config/script surgery — deferred. - node-runtime ×11: ~10s savings vs a cheap guard — low ROI, skip. The remaining flips (typecheck:noimplicit, test:vitest:ui, check:secrets, pr-evidence, semgrep) are operator policy decisions, left for the owner. * chore(deps): bump actions/github-script from 7 to 9 (#4046) Integrated into release/v3.8.28 (dependabot GH-Action bump; SHA-pin preserved) * chore(deps): bump actions/setup-node from 4 to 6 (#4048) Integrated into release/v3.8.28 (dependabot GH-Action bump; SHA-pin preserved) * chore(deps): bump actions/upload-artifact from 4 to 7 (#4044) Integrated into release/v3.8.28 (dependabot GH-Action bump; SHA-pin preserved) * chore(deps): bump actions/cache from 4.3.0 to 5.0.5 (#4047) Integrated into release/v3.8.28 (dependabot GH-Action bump; SHA-pin preserved) * deps: bump the development group with 10 updates (#4051) Integrated into release/v3.8.28 (dependabot dev group; cyclonedx 4->5 verified compatible with the SBOM invocation --ignore-npm-errors/--output-format JSON/--output-file) * fix(dashboard): event-driven fail-open auto-refresh for embedded log views (#4054) (#4103) The Request Logger gated each auto-refresh tick on a static document.visibilityState === "visible" read. Hosts that report a permanent non-"visible" state without ever firing a visibilitychange event (Docker dashboard wrappers, embedded/proxied webviews) froze auto-refresh entirely — only the manual Refresh button worked, a regression from 3.8.24's unconditional polling. The pause is now event-driven and fail-open: visibleRef starts true and is only flipped to false on a real visibilitychange → hidden transition, so a host that never signals a genuine background transition keeps polling, while normal browser tabs still pause when actually backgrounded. Regression test reproduces the misreporting-host case (RED) and the perf guard is re-encoded under the event-driven semantics. * fix(docker): raise build-stage Node heap to stop production-build OOM (#4076) (#4104) The Docker builder stage ran `npm run build` with V8's default heap ceiling (~2 GB). After #4052 forced the heavier webpack engine (Turbopack panics on this Next.js version), the production optimization pass exceeded that ceiling and the build died with "FATAL ERROR: ... JavaScript heap out of memory" at [builder] npm run build. The builder stage now sets NODE_OPTIONS=--max-old-space-size (default 4096 MB, overridable via --build-arg OMNIROUTE_BUILD_MEMORY_MB) before the build; the value propagates to the spawned next build (resolveNextBuildEnv spreads process.env). Build-only — the runtime heap on the runner stage is unchanged, and CI/local builds (which invoke npm run build directly) are unaffected. Regression guard: tests/unit/dockerfile-build-heap-4076.test.ts asserts the builder stage sets the heap ceiling, before npm run build, at >= 4096 MB. * feat(agent-bridge): portable JSON import/export of config (Gap 4) (#4094) Integrated into release/v3.8.28 * feat(cli): add 'omniroute launch' zero-config Claude Code launcher (#4097) Integrated into release/v3.8.28 (Fast QG TIA red = pre-existing env-doc-contract drift [MITM_IDLE_TIMEOUT_MS/TURBOPACK from #4084/#4092] + opencode-plugin-dist env flake; #4097 own test 3/3 green) * feat(mitm): loop-guard self-check + verbosity control in server.cjs (Gaps 14+15) (#4101) Integrated into release/v3.8.28 (rebased onto release — dropped the already-squash-merged #4084 commits; only the Gaps 14+15 loop-guard/verbosity delta remains) * feat(sse): generic 400 field-downgrade retry + Groq field stripping (#4096) Integrated into release/v3.8.28 * feat(providers): add Wafer AI (Anthropic-compatible, Bearer auth) (#4098) Integrated into release/v3.8.28 * chore(docs) * fix(responses): clear /v1/responses keepalive timer on cancel/abort (timer + CPU leak) (#4105) Integrated into release/v3.8.28 (r7). * perf(gemini): cache reasoning close-tag regex instead of recompiling per token (#4106) Integrated into release/v3.8.28 (r7). * fix(usage): reap orphaned pending-request details (unbounded memory leak) (#4107) Integrated into release/v3.8.28 (r7). * perf(stream): use structuredClone instead of JSON round-trip for per-chunk reasoning split (#4108) Integrated into release/v3.8.28 (r7). * fix(dashboard): restore Update Available banner with npm-binary-free version fallback (#4100) (#4112) getLatestNpmVersion() derived the latest version only from the npm CLI binary and returned null on any error, so Docker/desktop/locked-down installs without npm on PATH silently hid the home banner even when an update existed. Add resolveLatestVersion() (npm CLI -> registry HTTP fallback -> logged warning) and harden version parsing for v-prefix/pre-release strings. Extracted into testable src/lib/system/versionCheck.ts with TDD coverage. * fix(auth): prune expired entries from login brute-force guard map (unbounded growth) (#4111) Integrated into release/v3.8.28 (r8) * fix(logger): hard-cap the error-dedup map to bound memory under unique-message bursts (#4113) Integrated into release/v3.8.28 (r8) * fix(circuit-breaker): enforce MAX_REGISTRY_SIZE (declared but never applied) (#4114) Integrated into release/v3.8.28 (r8) * perf(obfuscation): cache per-word regexes instead of recompiling every request (#4109) Integrated into release/v3.8.28 (r8) * perf(registry): precompute model->provider index in parseModelFromRegistry (#4110) Integrated into release/v3.8.28 (r8) * fix(timers): unref background interval timers so they don't block clean shutdown (#4117) Integrated into release/v3.8.28 (r8) * fix(webhook): clear abort timer in finally to avoid dangling timers on fetch error (#4115) Integrated into release/v3.8.28 (r8) * fix(combo): detach per-target listener from shared hedge abort signal (#4116) Integrated into release/v3.8.28 (r8) * chore(release): finalize v3.8.28 CHANGELOG + reconcile env-doc contract - Build the complete [3.8.28] CHANGELOG section (55 bullets) covering every commit since v3.8.27, grouped by type with PR back-references and human contributor attribution (artickc's memory-leak/perf cluster, OrcaRouter, Wafer AI, MITM gaps, etc.); move the OrcaRouter bullet out of [Unreleased]. - Inject the EN [3.8.28] section into all 41 i18n CHANGELOG mirrors (parity). - Reconcile the env/docs contract: document MITM_IDLE_TIMEOUT_MS + MITM_VERBOSE in .env.example and ENVIRONMENT.md; allowlist the framework-internal TURBOPACK and the Claude Code ANTHROPIC_AUTH_TOKEN in check-env-doc-sync. - Fix 3 broken relative links in docs/providers/AGENTROUTER.md (regressed when the file was relocated this cycle) so docs-sync-strict passes. * fix(quality): treat test→test renames as relocations, not deletions The anti-test-masking gate's subcheck-1 collected deleted AND renamed test files via `--diff-filter=DR --name-only` and flagged every one as "deleted — human review required", contradicting its own documented contract ("DELETADOS ou renomeados-e-NÃO-substituídos"): a rename test→test IS a substitution (the test moved, coverage preserved). This false-positived on #4063's legitimate relocation of live-ws-startup.test.ts (unit/cli → integration, asserts 2→2) and would block every PR that relocates a test — surfacing only at release-day because the Fast QG (PR→release) doesn't run test-masking. The gate now parses `--name-status -M`: true deletions and test→non-test renames still flag; a test→test rename is run through the assert-reduction check across the move, so a clean relocation passes while gutting-via-rename (dropped asserts / new tautologies / skips) still fires. Adds partitionDeletedRenamed + 6 regression tests. --------- Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Demiurge The Single <megamen932@gmail.com> Co-authored-by: jinhaosong-source <jinhao.song@myflashcloud.com> Co-authored-by: diego-anselmo <contato@diegoanselmo.com.br> Co-authored-by: Felipe Almeman <4226997+zhiru@users.noreply.github.com> Co-authored-by: Rahul sharma <sharmaR0810@gmail.com> Co-authored-by: Chirag Singhal <76880977+chirag127@users.noreply.github.com> Co-authored-by: NOXX - Commiter <artur1992123@mail.ru>
253 lines
12 KiB
JSON
253 lines
12 KiB
JSON
{
|
||
"$schema": "https://stryker-mutator.io/schemas/stryker-schema.json",
|
||
"_comment": [
|
||
"Mutation testing for the ~8 critical modules (Task 11 — Fase 7).",
|
||
"NIGHTLY ONLY — DO NOT run on every PR. Mutation testing is expensive:",
|
||
" - Each mutant requires a full test suite execution.",
|
||
" - The 8 modules produce ~200–500 mutants; est. 30–90 min per run.",
|
||
" - Wired to the nightly CI workflow (.github/workflows/nightly-mutation.yml),",
|
||
" NOT to the 'lint' / 'quality-gate' PR jobs.",
|
||
"",
|
||
"TEST RUNNER — @stryker-mutator/tap-runner (NOT vitest):",
|
||
" The 8 critical modules are covered by node:test files in tests/unit/",
|
||
" (run via `node --import tsx --test`), NOT by vitest. The vitest config",
|
||
" only includes a small set of .test.tsx + open-sse/**/__tests__ files, so",
|
||
" the vitest-runner would find ZERO covering tests for these modules. The",
|
||
" tap-runner spawns each node:test file individually and parses its TAP",
|
||
" output, which matches how this repo actually exercises the modules.",
|
||
" Each test file is loaded with tsx (TypeScript/ESM) + the project polyfill,",
|
||
" the same way `npm run test:unit` runs.",
|
||
"",
|
||
"Install before running (not bundled to avoid E2E / CI bloat):",
|
||
" npm install --save-dev @stryker-mutator/core @stryker-mutator/tap-runner",
|
||
"",
|
||
"Run manually:",
|
||
" npm run test:mutation # full run (slow — nightly budget)",
|
||
" npx stryker run --dryRunOnly # validate the baseline only (no mutants)",
|
||
" (single-module probe: temporarily narrow `mutate` + `tap.testFiles` in this file)",
|
||
"",
|
||
"VALIDATED 2026-06-15: `npx stryker run --dryRunOnly` exits 0 — all 129 covering",
|
||
"test files run green in the Stryker sandbox and the perTest coverage map builds for",
|
||
"all 8 instrumented modules (15k+ mutants). The baseline dry-run takes ~20 min with",
|
||
"concurrency=1; the full mutation phase runs on top (advisory, capped by the workflow",
|
||
"timeout). So the nightly produces REAL mutation scores for the 8 modules.",
|
||
"",
|
||
"Mutation score per module → quality-baseline.json key 'mutationScore.<module>'",
|
||
"Direction: up (score can only improve; ratchet blocks drops — wired in a later INT phase)."
|
||
],
|
||
"packageManager": "npm",
|
||
"incremental": true,
|
||
"incrementalFile": "reports/mutation/stryker-incremental.json",
|
||
"testRunner": "tap",
|
||
"plugins": ["@stryker-mutator/tap-runner"],
|
||
"tap": {
|
||
"testFiles": [
|
||
"tests/unit/account-fallback-anthropic-quota.test.ts",
|
||
"tests/unit/account-fallback-route-restriction-403.test.ts",
|
||
"tests/unit/account-fallback-service.test.ts",
|
||
"tests/unit/api-key-rotator-health.test.ts",
|
||
"tests/unit/appearance-widget-settings-schema.test.ts",
|
||
"tests/unit/auth-clear-account-error.test.ts",
|
||
"tests/unit/auth-disable-cooling-2997.test.ts",
|
||
"tests/unit/auth-extract-api-key.test.ts",
|
||
"tests/unit/auth-noauth-fallback-loop-3061.test.ts",
|
||
"tests/unit/auth-ollama-cloud-per-model-403-3027.test.ts",
|
||
"tests/unit/auth-opencode-zen-noauth-fallback.test.ts",
|
||
"tests/unit/auth-terminal-status.test.ts",
|
||
"tests/unit/authz/routeGuard.test.ts",
|
||
"tests/unit/auto-combo-context-advertising.test.ts",
|
||
"tests/unit/auto-combo-engine.test.ts",
|
||
"tests/unit/auto-combo-scoring-clamp.test.ts",
|
||
"tests/unit/build/check-circular-deps.test.ts",
|
||
"tests/unit/cache-sweeps.test.ts",
|
||
"tests/unit/cc-compatible-provider.test.ts",
|
||
"tests/unit/chat-context-relay.test.ts",
|
||
"tests/unit/chat-cooldown-aware-retry.test.ts",
|
||
"tests/unit/chat-helpers.test.ts",
|
||
"tests/unit/chat-route-coverage.test.ts",
|
||
"tests/unit/chat-route-edge-cases.test.ts",
|
||
"tests/unit/chatcore-compression-integration.test.ts",
|
||
"tests/unit/chatcore-extracted-modules-3821.test.ts",
|
||
"tests/unit/chatcore-imports-cleanly.test.ts",
|
||
"tests/unit/chatcore-sanitization.test.ts",
|
||
"tests/unit/chatcore-strip-stale-headers.test.ts",
|
||
"tests/unit/chatcore-translation-paths.test.ts",
|
||
"tests/unit/check-error-helper.test.ts",
|
||
"tests/unit/check-route-guard-membership.test.ts",
|
||
"tests/unit/check-test-discovery.test.ts",
|
||
"tests/unit/circuit-breaker-failure-kind.test.ts",
|
||
"tests/unit/claude-code-parity.test.ts",
|
||
"tests/unit/claude-effort-suffix-strip.test.ts",
|
||
"tests/unit/claude-oauth-provider.test.ts",
|
||
"tests/unit/claude-passthrough-stream-boolean.test.ts",
|
||
"tests/unit/claude-passthrough-thinking-2454.test.ts",
|
||
"tests/unit/cli-simulate.test.ts",
|
||
"tests/unit/codex-failover.test.ts",
|
||
"tests/unit/codex-stream-false.test.ts",
|
||
"tests/unit/collect-metrics-module-coverage.test.ts",
|
||
"tests/unit/combo-499-abort.test.ts",
|
||
"tests/unit/combo-auto-candidate-expansion.test.ts",
|
||
"tests/unit/combo-cache-invalidation.test.ts",
|
||
"tests/unit/combo-config.test.ts",
|
||
"tests/unit/combo-context-relay.test.ts",
|
||
"tests/unit/combo-health-autopilot.test.ts",
|
||
"tests/unit/combo-health-dashboard.test.ts",
|
||
"tests/unit/combo-health-route.test.ts",
|
||
"tests/unit/combo-hedging.test.ts",
|
||
"tests/unit/combo-max-depth-config.test.ts",
|
||
"tests/unit/combo-omnimodel-tag-stripping.test.ts",
|
||
"tests/unit/combo-prescreen.test.ts",
|
||
"tests/unit/combo-provider-cooldown.test.ts",
|
||
"tests/unit/combo-provider-diversity-wiring.test.ts",
|
||
"tests/unit/combo-quality-validator-reasoning.test.ts",
|
||
"tests/unit/combo-quota-soft-penalty.test.ts",
|
||
"tests/unit/combo-round-robin-streaming-lock-3811.test.ts",
|
||
"tests/unit/combo-routing-engine.test.ts",
|
||
"tests/unit/combo-scoring-inspector.test.ts",
|
||
"tests/unit/combo-sessionless-pin-3825.test.ts",
|
||
"tests/unit/combo-strategies.test.ts",
|
||
"tests/unit/combo-strategy-fallbacks.test.ts",
|
||
"tests/unit/combo-streaming-empty-content-failover.test.ts",
|
||
"tests/unit/combo-target-defensive-modelstr.test.ts",
|
||
"tests/unit/complexity-aware-scoring-wiring.test.ts",
|
||
"tests/unit/context-pinning-tool-calls.test.ts",
|
||
"tests/unit/correctness/combo.property.test.ts",
|
||
"tests/unit/correctness/sanitizers.property.test.ts",
|
||
"tests/unit/custom-model-target-format.test.ts",
|
||
"tests/unit/db-reset-module-state.test.ts",
|
||
"tests/unit/domain-persistence.test.ts",
|
||
"tests/unit/embeddings-auth.test.ts",
|
||
"tests/unit/error-classification.test.ts",
|
||
"tests/unit/error-message-sanitization.test.ts",
|
||
"tests/unit/executor-antigravity.test.ts",
|
||
"tests/unit/executor-web-cookie-sweep.test.ts",
|
||
"tests/unit/gemini-web-missing-browser-3516.test.ts",
|
||
"tests/unit/guardrails-api-3496.test.ts",
|
||
"tests/unit/memory-embedding-remote.test.ts",
|
||
"tests/unit/memory-embedding-transformers.test.ts",
|
||
"tests/unit/model-cooldowns-route-auth.test.ts",
|
||
"tests/unit/model-cooldowns-route.test.ts",
|
||
"tests/unit/model-lockout-decay.test.ts",
|
||
"tests/unit/oauth-providers-config.test.ts",
|
||
"tests/unit/oauth-redirect-uri-mismatch.test.ts",
|
||
"tests/unit/observability-fase04.test.ts",
|
||
"tests/unit/observability-payloads.test.ts",
|
||
"tests/unit/plan3-p0.test.ts",
|
||
"tests/unit/plugin-sandbox-permissions.test.ts",
|
||
"tests/unit/plugins-route-error-sanitization.test.ts",
|
||
"tests/unit/provider-error-rules.test.ts",
|
||
"tests/unit/provider-health-autopilot.test.ts",
|
||
"tests/unit/provider-health-matrix.test.ts",
|
||
"tests/unit/provider-request-failure-pipeline.test.ts",
|
||
"tests/unit/public-client-ids-3493.test.ts",
|
||
"tests/unit/publicCreds.test.ts",
|
||
"tests/unit/qoder-oauth-config.test.ts",
|
||
"tests/unit/quota-groups-route.test.ts",
|
||
"tests/unit/quota-key-models-route.test.ts",
|
||
"tests/unit/quota-policy-generalization.test.ts",
|
||
"tests/unit/quota-pool-log-route.test.ts",
|
||
"tests/unit/quota-streaming-consumption-usd.test.ts",
|
||
"tests/unit/rate-limit-enhanced.test.ts",
|
||
"tests/unit/rate-limit-manager.test.ts",
|
||
"tests/unit/responses-handler.test.ts",
|
||
"tests/unit/route-explainability.test.ts",
|
||
"tests/unit/route-guard-plugins-local-only.test.ts",
|
||
"tests/unit/route-guard-private-lan.test.ts",
|
||
"tests/unit/route-guard-provider-login-local-only.test.ts",
|
||
"tests/unit/router-strategies.test.ts",
|
||
"tests/unit/service-combo-metrics.test.ts",
|
||
"tests/unit/services-branch-hardening.test.ts",
|
||
"tests/unit/services/combo-metrics-memory.test.ts",
|
||
"tests/unit/settings/authz-bypass.test.ts",
|
||
"tests/unit/skip-provider-breaker-consumer-2743.test.ts",
|
||
"tests/unit/sse-auth.test.ts",
|
||
"tests/unit/strict-random-deck.test.ts",
|
||
"tests/unit/system-role-extraction.test.ts",
|
||
"tests/unit/t23-t24-fallback-resilience.test.ts",
|
||
"tests/unit/tag-routing.test.ts",
|
||
"tests/unit/thundering-herd.test.ts",
|
||
"tests/unit/token-refresh-race-comprehensive.test.ts",
|
||
"tests/unit/token-refresh-service.test.ts",
|
||
"tests/unit/tools-filter-anthropic-format.test.ts",
|
||
"tests/unit/usage-service-hardening.test.ts",
|
||
"tests/unit/validate-response-quality.test.ts"
|
||
],
|
||
"nodeArgs": [
|
||
"--import",
|
||
"tsx",
|
||
"--import",
|
||
"./open-sse/utils/setupPolyfill.ts",
|
||
"--import",
|
||
"./tests/_setup/isolateDataDir.ts",
|
||
"--test-reporter=tap",
|
||
"-r",
|
||
"{{hookFile}}",
|
||
"{{testFile}}"
|
||
]
|
||
},
|
||
"mutate": [
|
||
"open-sse/handlers/chatCore.ts",
|
||
"open-sse/services/combo.ts",
|
||
"open-sse/services/accountFallback.ts",
|
||
"src/sse/services/auth.ts",
|
||
"src/server/authz/routeGuard.ts",
|
||
"open-sse/utils/error.ts",
|
||
"open-sse/utils/publicCreds.ts",
|
||
"src/shared/utils/circuitBreaker.ts"
|
||
],
|
||
"_ignorePatterns_comment": [
|
||
"ignorePatterns = files NOT copied into the Stryker sandbox. It does NOT scope",
|
||
"what gets mutated (that is the `mutate` array above). The test files MUST be",
|
||
"copied so the tap-runner can find covering tests, so DO NOT ignore tests/ here.",
|
||
"We only exclude heavy, mutation-irrelevant trees to keep sandbox creation fast:",
|
||
"build output, coverage, the huge docs/i18n translation tree, and other worktrees."
|
||
],
|
||
"ignorePatterns": [
|
||
".next",
|
||
"dist",
|
||
"dist-electron",
|
||
".build",
|
||
"coverage",
|
||
"playwright-report",
|
||
"test-results",
|
||
"reports",
|
||
"docs/i18n",
|
||
".worktrees",
|
||
".stryker-tmp"
|
||
],
|
||
"reporters": ["progress", "html", "json"],
|
||
"htmlReporter": {
|
||
"fileName": "reports/mutation/mutation.html"
|
||
},
|
||
"jsonReporter": {
|
||
"fileName": "reports/mutation/mutation.json"
|
||
},
|
||
"coverageAnalysis": "perTest",
|
||
"timeoutMS": 60000,
|
||
"timeoutFactor": 2.5,
|
||
"concurrency": 4,
|
||
"disableTypeChecks": true,
|
||
"checkers": [],
|
||
"thresholds": {
|
||
"high": 70,
|
||
"low": 50,
|
||
"break": null
|
||
},
|
||
"tempDirName": ".stryker-tmp",
|
||
"cleanTempDir": true,
|
||
"_tapTestFiles_comment": [
|
||
"tap.testFiles is the explicit set of node:test files that cover the 8 mutated",
|
||
"modules (union of files importing any of them), MINUS a few timing/heap/streaming-",
|
||
"sensitive integration tests that can flake under Stryker concurrent runners and",
|
||
"would break the required all-green baseline dry-run (e.g. body-timeout-integration,",
|
||
"heap-pressure, sse-heartbeat-integration, *-stream-readiness, chatcore-memory-pressure).",
|
||
"It is enumerated (not a broad glob) so the Stryker dry-run stays tractable for the",
|
||
"nightly budget — a glob over the full ~1300-file unit suite would make the per-test",
|
||
"dry-run take hours. coverageAnalysis:perTest then narrows which files run per mutant.",
|
||
"Regenerate the base union after adding/renaming covering tests, then re-prune flaky ones:",
|
||
" grep -rlE \"circuitBreaker|publicCreds|accountFallback|routeGuard|services/auth|chatCore|services/combo|utils/error|public-client|account-fallback|route-guard|circuit-breaker\" tests/unit --include=\"*.test.ts\" | sort -u"
|
||
],
|
||
"dryRunTimeoutMinutes": 30,
|
||
"_concurrency_comment": "concurrency=4 (was 1): the covering node:test files used to share SQLite/module state via the default DATA_DIR (~/.omniroute), so running them concurrently in the Stryker sandbox caused cross-file races that failed the all-green baseline. tap.nodeArgs now imports ./tests/_setup/isolateDataDir.ts, which gives each spawned test process its own temp DATA_DIR — eliminating the shared on-disk DB, so concurrency>1 is deterministic. A/B verified 2026-06-17: dry-run at concurrency=4 fails WITHOUT the isolation import (account-fallback-service tap exit 9) and passes WITH it. Raise further only if the runner has spare cores."
|
||
}
|