Files
OmniRoute/tests/unit/request-logger-endpoints.test.ts
Diego Rodrigues de Sa e Souza fa367dd99e Release v3.8.27 (#3968)
* chore(release): open v3.8.27 development cycle

* fix(security): polynomial ReDoS in comboAgentMiddleware regex (#3982)

* fix(security): eliminate polynomial ReDoS in comboAgentMiddleware <omniModel> regex (CodeQL js/polynomial-redos)

CACHE_TAG_PATTERN wrapped the tag in an unbounded `(?:\\n|\n|\r)*` prefix/suffix.
On an unanchored `.test()`/`.exec()` that is O(n²) on inputs with many newlines
(CodeQL js/polynomial-redos, alerts #612/#613). The surrounding runs are irrelevant
to detecting/capturing the tag, so the detection pattern now matches only the core
`<omniModel>([^<]+)</omniModel>`; the global strip pattern still consumes the
wrapping newlines (combo.ts streaming, #531) but BOUNDED ({0,16}) so it stays linear.

Behavior preserved: detection, model extraction, multi-tag stripping (#454) and
blank-line cleanup all unchanged (107 related tests green). Adds ReDoS-safety
regression tests (50k-newline inputs complete in <1ms).

* docs(changelog): add #3982 ReDoS fix to [3.8.27]

* ci(security): harden workflows — artipacked persist-credentials + cache-poisoning + SC2086 (#3965)

* Refine provider quota card display (#3969)

Integrated into release/v3.8.27

* feat: add sidebar group separator toggles (#3971)

Integrated into release/v3.8.27

* Gate control-plane proxy direct fallback (#3963)

Integrated into release/v3.8.27

* Capture actual upstream provider requests (#3941)

Integrated into release/v3.8.27

* ci(quality): flip require-tighten + osv + Trivy to blocking (v3.8.27 cycle-end) (#3984)

* fix(resilience): respect connection cooldown stored as numeric epoch (#3954) (#3995)

rate_limited_until is a TEXT column, but setConnectionRateLimitUntil (Antigravity full-quota path) persists a raw epoch number that SQLite coerces to a numeric string ("1781696905131.0"). The selection predicate isAccountUnavailable then did new Date("1781696905131.0") -> NaN, so the cooling connection was never skipped and the router kept dispatching to rate-limited accounts. Normalize numeric-epoch strings (and number/Date/ISO) via a shared cooldownUntilMs() helper in isAccountUnavailable / getEarliestRateLimitedUntil / filterAvailableAccounts / parseFutureDateMs. ISO behavior preserved.

* fix(providers): fetch live /models for LLM7 and BytePlus (#3976) (#3996)

llm7 and byteplus carry a real modelsUrl but were not classified by any live-fetch branch of the model-import route, so their hardcoded 4-entry registry catalog was served (source local_catalog) instead of the upstream catalog. Add both to NAMED_OPENAI_STYLE_PROVIDERS so the route probes <baseUrl>/models and serves the live list, falling back to the local catalog only on fetch failure.

* fix(dashboard): logs auto-refresh reads live visibility, not a stale mount ref (#3972) (#3997)

The auto-refresh interval gated each tick on visibleRef, seeded once at mount and updated only by a visibilitychange event. A tab mounted while document.visibilityState is 'hidden' (background load, bfcache, embedded/proxied webviews) with no later visibilitychange left the ref false forever, so the interval ticked but never fetched — only the manual button worked. Read the live document.visibilityState in the tick instead.

* feat(compression): add Indonesian caveman rules and language pack (#3975)

Integrated into release/v3.8.27

(cherry picked from commit c9b5b1a892)

* fix(combo): shuffle strict-random fallback remainder to spread load (#3959) (#3998)

strict-random shuffled only the deck-selected slot 0 and left the fallback remainder in fixed priority order, so after a failing deck pick the chain always fell through to the same top-priority model — a persistently-failing model was retried on essentially every request and fallback load never spread across peers. Shuffle the remainder too (like the random strategy).

* Add provider auth visibility controls (#3953)

Integrated into release/v3.8.27

* fix(claude): forward client tool-search-tool anthropic-beta on the Claude OAuth path (#3974) (#3999)

The client-negotiated anthropic-beta: tool-search-tool-2025-10-19 was dropped on both Claude code paths (default executor rebuilt from static ANTHROPIC_BETA_CLAUDE_OAUTH; selectBetaFlags only read the client beta to gate thinking/effort), so claude.ai rejected deferred-tool requests with 400 'Tool reference not found'. Add an allowlist-merge (mergeClientAnthropicBeta) that unions the client's allowlisted betas into the outbound set on both paths, preserving #3415 (no forced thinking/effort).

* feat(providers): add model search filter to provider dashboard (#3950)

Integrated into release/v3.8.27

* fix(vision-bridge): force bridge for tokenrouter deepseek models (#3946)

Integrated into release/v3.8.27

* fix(executor): strip stream_options on non-streaming requests (#3884) (#4000)

Clients that send stream_options:{include_usage:true} regardless of stream (e.g. the OpenAI Python SDK) had it passed through on non-streaming calls; NVIDIA NIM rejected it with 400 'Stream options can only be defined when stream=True'. DefaultExecutor.transformRequest only injected/cleared stream_options on the streaming branch and never stripped a client-sent value when stream=false. Add a !stream strip branch; the streaming injection path is unchanged. Global to openai-compat providers.

* fix(qwen-web): cookie validation false-positive - check response body for user object (#3958)

Integrated into release/v3.8.27

* fix(db): persist backup retention days (#3970)

Integrated into release/v3.8.27

* 大量UI显示和i18n优化 (#3973)

Integrated into release/v3.8.27

* deps: bump the npm_and_yarn group across 1 directory with 2 updates (#3943)

Integrated into release/v3.8.27

* deps: bump form-data from 4.0.5 to 4.0.6 (#3944)

Integrated into release/v3.8.27

* deps: bump vite from 8.0.5 to 8.0.16 (#3942)

Integrated into release/v3.8.27

* chore(quality): re-baseline validation.ts 4407->4428 (#3958 qwen body-check)

The qwen-web validation body-check merged in #3958 pushed validation.ts past its
frozen size on the integrated release tip. Bump the baseline with justification;
no logic is separately extractable from the existing qwen-web validation branch.

* deps: bump the production group with 13 updates (#3915)

Integrated into release/v3.8.27 — low-risk group (playwright 1.60→1.61 minor + transitive patches; fumadocs-core 16.9→16.10 minor).

* chore(deps): ignore jscpd major bumps (v5 Rust rewrite breaks the duplication gate)

Our duplication ratchet (scripts/check/check-duplication.mjs) is pinned to jscpd@4
and parses jscpd-report.json against a frozen baseline. jscpd v5 is a native Rust
binary with no Node.js API and a different report/bin, so a major bump would break
the gate. Migrate deliberately, not via dependabot. Closes the noise from #3916.

* fix(perplexity-web): parse schematized diff_block stream so answers aren't empty (#4001)

Integrated into release/v3.8.27 — schematized diff_block parsing follow-up to #3938.

* refactor: modularize providerRegistry.ts into 159 individual provider plugins (#3993)

Modularize provider registry (#3594). Integrated into release/v3.8.27 after rebase + behavior-preservation verification (provider-consistency gate 159/232/0, typecheck, registry tests, build 556/556).

Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>

* fix(registry): restore byteplus + mimocode dropped by #3993 modularization

The provider-registry modularization (#3993) was cut from a base predating the
byteplus (#3877) and mimocode (#3837) registry entries, so merging it silently
dropped both providers (getRegistryEntry returned undefined → validation reported
'not supported'). Re-add them as registry modules in the new structure; registered
count 159→161, provider-consistency 161/232/0.

Also align the pre-existing qwen-web validator test to #3958: since the validator
now requires a real `user` object in the 200 body, the mock must carry one.

* refactor: modularize schemas (non-stacked) (#3988)

Modularize validation schemas (#3594). Integrated into release/v3.8.27 after rebase (reconciled the merged hiddenSidebarGroupLabels #3971 + intelligenceSyncRequestSchema into the new modules) + behavior verification (typecheck, 195 schema/settings/validation tests, build 556/556).

Co-authored-by: diegosouzapw <diegosouza.pw@gmail.com>

* fix(default-executor): honor custom providerSpecificData.baseUrl for OpenAI-format providers (#4002)

Integrated into release/v3.8.27 — honor custom providerSpecificData.baseUrl in DefaultExecutor (openai-format), tested.

* feat(openai): honor custom base URL in model discovery + complete openai/codex pricing (#4005)

Integrated into release/v3.8.27 — openai model-discovery honors custom base URL (SSRF-guarded) + pricing rows for new openai/codex models. Tested + baselines bumped.

* fix(live-ws): bridge sidecar events to dashboard (#4004)

Integrated into release/v3.8.27 — repair LiveWS sidecar (startup, same-origin /live-ws, main→sidecar compression.completed bridge, early-msg queue). Fixed the cookie-parse regex (\s) + added a focused unit test; baseline bumped for the non-blocking chatCore bridge.

* docs(troubleshooting): note MITM proxy cannot intercept Windows-host apps under WSL (#4003)

Integrated into release/v3.8.27 — MITM/WSL troubleshooting note.

* fix(repo): untrack accidentally-committed root node_modules symlink + gitignore it

A worktree node_modules symlink (-> the main checkout's node_modules) was staged by a
`git add -A` during the #3988 merge and committed into 05213ac6a. The symlink points
at the repo's own node_modules path, so checking it out turns the main checkout's
node_modules into a self-referential symlink (breaking tsx/all node ops). Untrack it and
add a root-anchored /node_modules ignore so the symlink form can't be re-committed (the
existing 'node_modules/' only matches directories).

* fix(quality): allowlist socks dep (declared by #4004, never allowlisted)

socks@^2.8.7 was added to package.json in #4004 (LiveWS sidecar, 02302131f)
as a phantom-dep cleanup but never added to dependency-allowlist.json, so
check:deps has been red on the release tip ever since. socks is the standard
SOCKS proxy client (dep of fetch-socks), legitimate and years old.

* feat(sse): real LLMLingua-2 ONNX compression engine (stable) (#4014)

Integrated into release/v3.8.27.

Adjustments before merge:
- Synced with the current release tip (was 11 commits behind).
- Added the 3 LLMLingua-2 ONNX optional-runtime deps to dependency-allowlist.json
  (@atjsh/llmlingua-2, @tensorflow/tfjs, js-tiktoken) — the only gate that was red.
- socks was allowlisted directly on release (separate fix d7db5c73d; it was declared
  by #4004 but never allowlisted, leaving check:deps red release-wide).

Verified locally: check:deps OK, file-size OK, public-creds OK, provider-consistency
161/232/0, typecheck:core clean, 24/24 LLMLingua tests pass. The only remaining Fast-QG
red is the pre-existing #3972 orphan test (request-logger-autorefresh-visibility-3972.test.tsx),
which is release-wide and unrelated to this PR.

* test(dashboard): rehome #3972 logs auto-refresh test so a runner collects it

tests/unit/request-logger-autorefresh-visibility-3972.test.tsx (added by #3972
via #3997) sat at the top level of tests/unit/ as a .tsx vitest test, which NO
runner collects: the node runner only globs *.test.ts, and test:vitest:ui only
runs tests/unit/ui. So the #3972 regression guard never executed in CI and
check:test-discovery was red release-wide. Move it under tests/unit/ui/ (the
collected vitest:ui path) and fix the relative import depth. Verified: the test
now runs and passes (2/2), and check:test-discovery is green.

* feat(compression): capture per-engine analytics (#3960) + Lite schema fix (#3952) (#4018)

Captures the net-new value from #3960 (per-engine breakdown analytics) and #3952 (Lite engine schema fix) onto release/v3.8.27. Fast QG green; 622/622 compression+analytics tests pass.

* fix(sse): guard model-less registry entries in getUnsupportedParams (mimocode) (#4015)

Real bugfix: guard model-less registry entries (mimocode) in getUnsupportedParams so handleChatCore no longer throws 'entry.models is not iterable' / reports 'All models failed' for unrelated requests. Includes a regression test. Fast QG green.

* feat(ci): Quality Gate v2 — Onda 0 + Onda 1 (gate flips, TIA, SAST, DAST-smoke, mutation infra) (#4016)

* docs(ops): add quality-gate assessment + replication playbook (Fase 9 foundation)

* feat(ci): flip oasdiff breaking-change gate to blocking (ratchet)

* docs(ops): deliver main branch-protection ruleset for owner to apply

* fix(ci): run typecheck:core in PR->release fast-gates (close fast-gates hole, part 1)

* perf(mutation): enable Stryker incremental mode + cache (scales the 60/80 rollout)

* feat(ci): commit CodeQL advanced config (security-extended), replacing default-setup

* feat(ci): version semgrep SAST workflow (owasp/secrets), advisory

* feat(quality): TIA test-impact map builder (import-graph; map built at runtime, gitignored)

* feat(quality): TIA impacted-test selector with run-all fail-safe

* fix(ci): run TIA-impacted unit tests in PR->release fast-gates (build map at runtime, fail-safe full)

* feat(ci): DAST-smoke per-PR (schemathesis subset + promptfoo injection-guard, blocking)

* fix(ci): unbreak Fase 9 PR CI (MDX frontmatter, CodeQL conflict, dast-smoke advisory)

- Add MDX frontmatter to docs/ops/{BRANCH_PROTECTION_MAIN,QUALITY_GATE_PLAYBOOK}.md.
  fumadocs rejects frontmatter-less docs -> 'npm run build' failed -> broke dast-smoke's
  build step (the release fast-gates never runs build, so this only surfaced on the PR).
- codeql.yml: workflow_dispatch-only until the owner switches repo CodeQL Default->Advanced
  (advanced configs cannot be processed while default setup is enabled; documented inline).
- dast-smoke.yml: job-level continue-on-error (advisory) so this brand-new gate matures
  before it blocks (repo convention: advisory -> blocking).

* ci(quality): make TIA unit-test step advisory until release test-debt is cleared

release/v3.8.27 carries ~17 pre-existing failing unit tests (budget #3537, apiKey
#3552, several Zod schemas, Puter/Qwen executors, mimocode entry, etc.) unrelated to
this PR — the new 'run tests on PR->release' gate surfaced them. Per the repo's
advisory->blocking convention, this step enters advisory (it still runs + reports)
so pre-existing debt doesn't block the gate program. typecheck:core stays blocking.
Flip to blocking (remove continue-on-error) once the release suite is green.

* fix(sse): preserve Kiro streaming finish_reason tool_calls (#3980) (#4025)

* fix(guardrails): preserve original image when vision-bridge describe fails (#4012) (#4026)

* feat(api): advertise combo capabilities on import surfaces (#3979) (#4027)

* feat(sse): delegated Anthropic Context Editing for Claude (clear_tool_uses) (#4021)

Opt-in Claude-only delegated compression: injects context_management.clear_tool_uses_20250919 at the Claude pre-serialization chokepoint (composes with clear_thinking, thinking first), threaded via ExecuteInput from handleChatCore. Pure edit-builder + 11 tests (7 unit + 4 e2e fetch-capture). Beta context-management-2025-06-27 already advertised; allowlist done. Telemetry/400-fallback/claude-web coverage deferred.

* fix(opencode): map x-session-affinity to x-opencode-session for custom providers (#4022) (#4028)

* fix(dashboard): Playground Compare tab loading + HTTP method guard (#4024)

randomUUID non-HTTPS fallback + static CompareTab import; raw HTTP TRACE->405 method guard wired into dev + standalone servers. Integrated into release/v3.8.27.

* refactor(dashboard): settings UI layout + API Keys naming (#4020)

Presentation/relabel refactor of the Settings dashboard (API Manager -> API Keys), card relocations, Toggle adoption, present-but-disabled engine steps. Auth-file changes are string/comment-only (no behavior change). Integrated into release/v3.8.27.

* fix: restore unit regressions dropped by lossy schema/registry modularizations (#4030)

Restores schema fields (combo reasoningTokenBuffer, budget-0 #3537, openrouter preset, proxy family #3777, resilience degradation/providerCooldown), qwen-web v2 endpoint+catalog, mimocode models key — all dropped by #3988/#3993 — and aligns 3 tests to #3941/#3993. Verified: 8 failing regression tests on release tip -> 131/131 green on this branch. Integrated into release/v3.8.27.

* fix(api): return 400 (not 500) for malformed JSON on /api/auth/login (#4031)

Wrap request.json() so a malformed/non-JSON login body returns a structured 400 instead of falling through to the 500 catch. Fixes the schemathesis high-risk-endpoint DAST finding (verified: schemathesis step now passes). +TDD test. Integrated into release/v3.8.27.

* feat(dashboard): real circuit-breaker state in the Combo Live cascade (U1b) (#4029)

Overlays real provider circuit-breaker state (GET /api/monitoring/health) onto the Combo Live cascade as a 'CB: OPEN · 41s' badge. Pure enrichRunWithBreakers + fail-soft useProviderBreakerHealth poll; graceful when health is absent. +13 tests. Integrated into release/v3.8.27.

* Fix promptfoo security assertion parsing (#4032)

* chore(deps): dependabot security bumps + drop unused gray-matter (#4036)

Integrated into release/v3.8.27 — dependabot security bumps (form-data/js-yaml/protobufjs/dompurify/hono) + drop unused gray-matter. Unblocks the npm audit:deps gate (Lint) branch-wide.

* fix(ci): scope TIA to node:test unit files only (mirror test:unit glob) (#4035)

Integrated into release/v3.8.27 — scopes the advisory TIA step to the test:unit node:test glob, fixing the 99 false failures. +4 TDD.

* Refine compression settings, storage labels, and sidebar grouping (#4033)

Integrated into release/v3.8.27 — relocate Token Saver into Compression Settings (controlled component), reorder Security/Authz tabs, storage labels + i18n relabel. Thanks @rdself!

* [codex] add per-key local usage command (#4034)

Integrated into release/v3.8.27 — per-key local @@om-usage command (cached quota, no upstream routing). Rebased onto modularized schemas/keys.ts + file-size rebaseline. Thanks @Witroch4!

* chore(release): reconcile v3.8.27 CHANGELOG + i18n mirrors

* ci(quality): unblock v3.8.27 release gates (zizmor pin + test-masking allowlist)

- zizmor ratchet (151→139, no regression): SHA-pin every action ref ADDED this
  cycle — codeql/dast-smoke/semgrep (3 new workflows) + trivy-action (docker-publish)
  + actions/cache (nightly-mutation). Pre-existing tag refs keep the repo convention.
- test-masking: add config/quality/test-masking-allowlist.json + allowlist support in
  check-test-masking.mjs (exempts ONLY the net-assert-reduction signal; tautology/skip/
  deletion still fire). Allowlists 2 verified-legitimate reductions:
  appearance-widget-settings-schema (#4033 removed showTokenSaverOnEndpoint field) and
  dashboard-shell-tabs (#3973 tabs→redirect refactor, asserts replaced). +4 gate tests.

* test(quality): reword test-masking self-test comments to avoid literal masking patterns

The added allowlist-test comments contained the literal strings 'assert.ok(true)' and
'.skip' which the masking detector's own regexes match as text — making the gate flag
its own test file (net +1 tautology/skip/extended-tautology vs main). Reworded to plain
prose ('a new tautology', 'a new skip marker'); test logic unchanged (24/24 pass).

* fix(quality): unblock v3.8.27 release — align 3 stale tests + restore modularized settings-schema parity

Release-PR full CI surfaced 3 deterministic test failures (no live product regression),
all stale vs legitimate cycle changes:

- settings-schema parity (#3988): the modularized updateSettingsSchema barrel
  (schemas/settings.ts) had diverged from the canonical settingsSchemas.ts (45 vs 85
  fields — 40 dropped + 6 extra), a lossy-modularization dead-code copy. Re-export from
  the canonical source so the barrel can never diverge again (runtime already uses
  canonical). Parity test now passes.
- api-manager permissions modal: #4034 added a 4th self-service switch (per-key usage
  allowance); a11y invariant (every switch type="button") still holds. Updated the
  static count 3 -> 4.
- pack-artifact policy: dist/http-method-guard.cjs became a required runtime path;
  added it to the test's expected missing-paths list.

Also documents the gate gap for Fase 9 (QUALITY_GATE_PLAYBOOK Parte 6): G1 run the
deterministic unit layer + test-masking on PR->release (not just PR->main), G2 a
modularization-parity gate (would have caught the #3988 drop at its PR), G3 flake
quarantine. Env flakes (LiveWS startup timeout, integration server-startup cascade)
are pre-existing/CI-env, triaged separately.

---------

Co-authored-by: Randi <55005611+rdself@users.noreply.github.com>
Co-authored-by: Veier04 <118300867+Veier04@users.noreply.github.com>
Co-authored-by: Felipe Sartori <felipesartori.ti@gmail.com>
Co-authored-by: WormAlien <164898390+WormAlien@users.noreply.github.com>
Co-authored-by: thezukiru <121331256+thezukiru@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: NOXX - Commiter <artur1992123@mail.ru>
Co-authored-by: Paijo <14921983+oyi77@users.noreply.github.com>
Co-authored-by: Demiurge The Single <megamen932@gmail.com>
Co-authored-by: Witroch4 <witalo_rocha@hotmail.com>
2026-06-17 02:43:21 -03:00

687 lines
26 KiB
TypeScript

import test from "node:test";
import assert from "node:assert/strict";
import fs from "node:fs";
import os from "node:os";
import path from "node:path";
const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-reqlogger-ep-"));
process.env.DATA_DIR = TEST_DATA_DIR;
const core = await import("../../src/lib/db/core.ts");
const usageHistory = await import("../../src/lib/usage/usageHistory.ts");
const callLogs = await import("../../src/lib/usage/callLogs.ts");
test.after(() => {
core.resetDbInstance();
fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
});
// ─── Active log endpoint removal ─────────────────────────────────────────
test("/api/logs/active route is removed", () => {
assert.equal(
fs.existsSync("src/app/api/logs/active/route.ts"),
false,
"active logs must not expose an in-memory timing-sensitive endpoint"
);
});
test("RequestLoggerV2 detail fetch uses /api/logs/[id] and not /api/logs/active", () => {
const content = fs.readFileSync("src/shared/components/RequestLoggerV2.tsx", "utf8");
assert.match(content, /fetch\(`\/api\/logs\/\$\{[^}]+\.id\}`,\s*\{\s*cache:\s*"no-store"/);
assert.doesNotMatch(content, /fetch\(["'`]\/api\/logs\/active/);
assert.match(content, /detailState:\s*"pending"/);
});
// ─── usageHistory module behaviour ───────────────────────────────────────
test("trackPendingRequest creates a detail entry", () => {
usageHistory.clearPendingRequests();
usageHistory.trackPendingRequest("gpt-4", "openai", "conn-1", true, {
clientRequest: { messages: [{ role: "user", content: "hi" }] },
providerRequest: { model: "gpt-4" },
providerUrl: "https://api.openai.com/v1/chat/completions",
});
const pending = usageHistory.getPendingRequests();
const detail = pending.details["conn-1"]?.["gpt-4 (openai)"]?.[0];
assert.ok(detail, "should create detail entry");
assert.equal(detail.model, "gpt-4");
assert.equal(detail.provider, "openai");
assert.equal(detail.connectionId, "conn-1");
assert.ok(detail.id, "should have an id");
assert.ok(detail.startedAt > 0, "should have startedAt timestamp");
assert.ok(detail.clientRequest, "should preserve clientRequest");
assert.equal(detail.clientRequest.messages[0].content, "hi");
});
test("trackPendingRequest decrements and removes detail on finish", () => {
usageHistory.clearPendingRequests();
usageHistory.trackPendingRequest("gpt-4", "openai", "conn-1", true);
assert.equal(usageHistory.getPendingRequests().details["conn-1"]?.["gpt-4 (openai)"]?.length, 1);
usageHistory.trackPendingRequest("gpt-4", "openai", "conn-1", false);
const after = usageHistory.getPendingRequests();
assert.equal(after.details["conn-1"]?.["gpt-4 (openai)"]?.length ?? 0, 0);
});
test("trackPendingRequest does not go negative", () => {
usageHistory.clearPendingRequests();
usageHistory.trackPendingRequest("gpt-4", "openai", "conn-1", false);
usageHistory.trackPendingRequest("gpt-4", "openai", "conn-1", false);
const pending = usageHistory.getPendingRequests();
assert.equal(pending.byModel["gpt-4 (openai)"], 0);
});
test("updatePendingRequestStreamChunks stores stream chunks in the detail", () => {
usageHistory.clearPendingRequests();
usageHistory.trackPendingRequest("gpt-4", "openai", "conn-1", true);
const chunks = { provider: ['data: {"a":1}'], openai: [], client: [] };
usageHistory.updatePendingRequestStreamChunks("gpt-4", "openai", "conn-1", chunks);
const pending = usageHistory.getPendingRequests();
const detail = pending.details["conn-1"]?.["gpt-4 (openai)"]?.[0];
assert.ok(detail.streamChunks, "streamChunks should be set");
assert.equal(detail.streamChunks.provider.length, 1);
assert.equal(detail.streamChunks.provider[0], 'data: {"a":1}');
});
test("updatePendingRequest keeps pending detail API view in sync", () => {
usageHistory.clearPendingRequests();
const requestId = usageHistory.trackPendingRequest(
"claude-sonnet-4-6",
"cc-test",
"conn-1",
true,
{
clientRequest: { model: "cc-test/claude-sonnet-4-6", reasoning_effort: "xhigh" },
providerRequest: { model: "claude-sonnet-4-6", reasoning_effort: "xhigh" },
}
);
assert.ok(requestId, "trackPendingRequest should return an id");
usageHistory.updatePendingRequest("claude-sonnet-4-6", "cc-test", "conn-1", {
providerRequest: { model: "claude-sonnet-4-6", reasoning_effort: "high" },
stage: "provider_response_started",
});
const modelKey = "claude-sonnet-4-6 (cc-test)";
const detailFromQueue = usageHistory.getPendingRequests().details["conn-1"]?.[modelKey]?.[0];
const detailFromId = usageHistory.getPendingById().get(requestId);
assert.equal(detailFromId, detailFromQueue);
assert.deepEqual(detailFromId?.providerRequest, {
model: "claude-sonnet-4-6",
reasoning_effort: "high",
});
assert.deepEqual(detailFromId?.clientRequest, {
model: "cc-test/claude-sonnet-4-6",
reasoning_effort: "xhigh",
});
});
test("updatePendingRequestById updates and finalizes the exact overlapping request", () => {
usageHistory.clearPendingRequests();
const firstId = usageHistory.trackPendingRequest("claude-sonnet-4-6", "cc-test", "conn-1", true, {
providerRequest: { request: "first", reasoning_effort: "xhigh" },
});
const secondId = usageHistory.trackPendingRequest(
"claude-sonnet-4-6",
"cc-test",
"conn-1",
true,
{
providerRequest: { request: "second", reasoning_effort: "xhigh" },
}
);
assert.ok(firstId);
assert.ok(secondId);
const updated = usageHistory.updatePendingRequestById(firstId, {
providerRequest: { request: "first", reasoning_effort: "high" },
stage: "sending_to_provider",
});
assert.equal(updated, true);
const modelKey = "claude-sonnet-4-6 (cc-test)";
const details = usageHistory.getPendingRequests().details["conn-1"]?.[modelKey];
assert.equal(details?.length, 2);
assert.deepEqual(details?.[0]?.providerRequest, {
request: "first",
reasoning_effort: "high",
});
assert.deepEqual(details?.[1]?.providerRequest, {
request: "second",
reasoning_effort: "xhigh",
});
const completed = usageHistory.finalizePendingRequestById(firstId, {
clientResponse: { ok: true },
});
assert.equal(completed, true);
assert.deepEqual(usageHistory.getCompletedDetails().get(firstId)?.providerRequest, {
request: "first",
reasoning_effort: "high",
});
assert.equal(usageHistory.getPendingById().has(secondId), true);
});
test("updatePendingRequestStreamChunks stores empty streamChunks object (not null)", () => {
usageHistory.clearPendingRequests();
usageHistory.trackPendingRequest("gpt-4", "openai", "conn-1", true);
// Call with empty arrays (as pushStreamChunks does before data flows)
const empty = { provider: [], openai: [], client: [] };
usageHistory.updatePendingRequestStreamChunks("gpt-4", "openai", "conn-1", empty);
const pending = usageHistory.getPendingRequests();
const detail = pending.details["conn-1"]?.["gpt-4 (openai)"]?.[0];
assert.ok(detail.streamChunks, "streamChunks should be set even when empty");
assert.deepEqual(detail.streamChunks, { provider: [], openai: [], client: [] });
// Verify the reference is live: mutations to the original object are visible
empty.provider.push("data: hello");
assert.equal(detail.streamChunks.provider.length, 1);
assert.equal(detail.streamChunks.provider[0], "data: hello");
});
test("clearPendingRequests resets all counts and details", () => {
usageHistory.clearPendingRequests();
usageHistory.trackPendingRequest("m1", "p1", "c1", true);
usageHistory.trackPendingRequest("m2", "p2", "c2", true);
assert.equal(Object.keys(usageHistory.getPendingRequests().byModel).length, 2);
usageHistory.clearPendingRequests();
const pending = usageHistory.getPendingRequests();
assert.equal(Object.keys(pending.byModel).length, 0);
assert.equal(Object.keys(pending.byAccount).length, 0);
assert.equal(Object.keys(pending.details).length, 0);
});
// ─── Pending request data remains available for internal usage stats ─────
test("pending request detail shape remains available internally", () => {
usageHistory.clearPendingRequests();
usageHistory.trackPendingRequest("claude-3-opus", "anthropic", "conn-2", true, {
clientRequest: { messages: [{ role: "user", content: "hello" }] },
providerRequest: { model: "claude-3-opus" },
providerUrl: "https://api.anthropic.com/v1/messages",
});
const pending = usageHistory.getPendingRequests();
const entries = Object.entries(pending.details).flatMap(([connectionId, models]) =>
Object.entries(models).flatMap(([modelKey, details]) =>
details.map((detail) => ({
id: detail.id,
model: detail.model,
provider: detail.provider,
connectionId,
startedAt: detail.startedAt,
clientRequest: detail.clientRequest ?? null,
providerRequest: detail.providerRequest ?? null,
providerUrl: detail.providerUrl ?? null,
streamChunks: detail.streamChunks ?? null,
}))
)
);
assert.equal(entries.length, 1);
const row = entries[0];
assert.ok(row.id);
assert.equal(row.model, "claude-3-opus");
assert.equal(row.provider, "anthropic");
assert.equal(row.connectionId, "conn-2");
assert.ok(row.startedAt > 0);
assert.ok(row.clientRequest, "clientRequest should be present");
assert.ok(row.providerRequest, "providerRequest should be present");
assert.ok(row.providerUrl, "providerUrl should be present");
assert.equal(row.streamChunks, null, "streamChunks should be null initially");
});
// ─── /api/usage/call-logs/[id] route structure ────────────────────────────
test("GET /api/usage/call-logs/[id] route exists and uses auth", () => {
const content = fs.readFileSync("src/app/api/usage/call-logs/[id]/route.ts", "utf8");
assert.ok(content.includes("export async function GET"), "should export GET handler");
assert.ok(content.includes("requireManagementAuth"), "should check auth");
assert.ok(content.includes("getCallLogById"), "should import getCallLogById");
});
test("GET /api/usage/call-logs includes completed in-memory fallback rows", async () => {
const { buildCallLogListRows } = await import("../../src/app/api/usage/call-logs/route.ts");
usageHistory.clearPendingRequests();
const requestId = usageHistory.trackPendingRequest("gpt-4", "openai", "completed-conn-1", true, {
clientEndpoint: "/v1/chat/completions",
});
assert.ok(requestId);
const completed = usageHistory.finalizePendingRequestById(requestId, {
clientResponse: { choices: [{ message: { content: "done" } }] },
});
assert.equal(completed, true);
const completedDetail = usageHistory.getCompletedDetails().get(requestId);
assert.ok(completedDetail);
const rows = buildCallLogListRows({
logs: [],
connections: [{ id: "completed-conn-1", displayName: "Completed Account" }],
pendingDetails: usageHistory.getPendingById().values(),
completedDetails: usageHistory.getCompletedDetails().values(),
now: completedDetail!.startedAt + 60_000,
});
assert.equal(rows.length, 1);
assert.equal(rows[0].id, requestId);
assert.equal(rows[0].detailState, "in-memory");
assert.equal(rows[0].completed, true);
assert.equal(rows[0].account, "Completed Account");
assert.equal(rows[0].duration, completedDetail!.durationMs);
});
test("GET /api/usage/call-logs rows are globally timestamp ordered", async () => {
const { buildCallLogListRows } = await import("../../src/app/api/usage/call-logs/route.ts");
const rows = buildCallLogListRows({
logs: [
{
id: "persisted-newest",
timestamp: new Date(3000).toISOString(),
active: false,
},
{
id: "persisted-oldest",
timestamp: new Date(1000).toISOString(),
active: false,
},
],
connections: [],
pendingDetails: [],
completedDetails: [
{
id: "completed-middle",
model: "gpt-4",
provider: "openai",
connectionId: "conn",
startedAt: 2000,
completedAt: 2500,
durationMs: 500,
},
],
now: 4000,
});
assert.deepEqual(
rows.map((row) => row.id),
["persisted-newest", "completed-middle", "persisted-oldest"]
);
});
test("getCallLogById returns null for unknown id", async () => {
const log = await callLogs.getCallLogById("nonexistent-id-12345");
assert.equal(log, null);
});
// ─── Merged view data shape ────────────────────────────────────────────
test("normalized active row has expected fields for the grid view", () => {
const rawRow = {
id: "test-id-1",
model: "gpt-4",
provider: "openai",
account: "conn-1",
startedAt: Date.now() - 5000,
runningTimeMs: 5000,
stage: "streaming",
stageUpdatedAt: Date.now(),
clientRequest: { messages: [] },
providerRequest: { model: "gpt-4" },
providerUrl: "https://api.openai.com/v1",
streamChunks: null,
};
const normalized = {
active: true,
id: rawRow.id,
model: rawRow.model,
provider: rawRow.provider,
account: rawRow.account,
timestamp: new Date(rawRow.startedAt).toISOString(),
duration: Math.max(0, Date.now() - rawRow.startedAt),
status: 0,
sourceFormat: null,
tokens: null,
comboName: null,
apiKeyName: null,
apiKeyId: null,
cacheSource: null,
requestedModel: null,
stage: rawRow.stage,
stageUpdatedAt: rawRow.stageUpdatedAt,
_activeRow: rawRow,
};
assert.equal(normalized.active, true);
assert.equal(normalized.id, "test-id-1");
assert.equal(normalized.model, "gpt-4");
assert.equal(normalized.provider, "openai");
assert.equal(normalized.status, 0);
assert.ok(normalized.duration >= 5000);
assert.ok(normalized.duration < 60000);
assert.equal(normalized.tokens, null);
assert.equal(normalized.cacheSource, null);
assert.equal(normalized.stage, "streaming");
});
// ─── requestLoggerSignature module ────────────────────────────────────────
const sigMod = await import("../../src/shared/components/requestLoggerSignature.ts");
test("resolveInitialVisibility returns true when document is undefined (SSR)", () => {
assert.equal(sigMod.resolveInitialVisibility(), true);
});
test("shouldAutoRefresh returns true when recording and on first page", () => {
assert.equal(sigMod.shouldAutoRefresh(true, 50, 50), true);
assert.equal(sigMod.shouldAutoRefresh(true, 25, 50), true);
});
test("shouldAutoRefresh returns false when not recording or past first page", () => {
assert.equal(sigMod.shouldAutoRefresh(false, 50, 50), false);
assert.equal(sigMod.shouldAutoRefresh(true, 100, 50), false);
assert.equal(sigMod.shouldAutoRefresh(false, 100, 50), false);
});
test("computeLogsSignature produces different signatures for different data", () => {
const a = sigMod.computeLogsSignature([
{ id: "1", status: 200, duration: 100, tokens: { out: 50 } },
]);
const b = sigMod.computeLogsSignature([
{ id: "1", status: 200, duration: 150, tokens: { out: 50 } },
]);
assert.notEqual(a, b, "different duration should change signature");
});
test("computeLogsSignature returns empty string for non-array input", () => {
assert.equal(sigMod.computeLogsSignature(null), "");
assert.equal(sigMod.computeLogsSignature(undefined), "");
assert.equal(sigMod.computeLogsSignature({}), "");
});
// ─── Duration live computation ───────────────────────────────────────────
test("duration is computed from startedAt and grows over time", () => {
const startedAt = Date.now() - 3000;
const duration = Math.max(0, Date.now() - startedAt);
assert.ok(duration >= 3000, "duration should be at least 3s");
assert.ok(duration < 60000, "duration should be within reason");
});
// ─── Navigation logic ────────────────────────────────────────────────────
test("handlePrev at first item closes modal (no wrap-around)", () => {
const items = [
{ id: "a", active: false },
{ id: "b", active: false },
{ id: "c", active: false },
];
const selectedId = "a";
const idx = items.findIndex((l) => l.id === selectedId);
assert.equal(idx, 0);
// handlePrev should NOT wrap to last item
if (idx > 0) {
assert.equal(items[idx - 1].id, "should not reach");
} else {
// closes modal
assert.ok(true, "prev at first item closes modal");
}
});
test("handlePrev navigates backward when not at first item", () => {
const items = [
{ id: "a", active: false },
{ id: "b", active: false },
{ id: "c", active: false },
];
const selectedId = "b";
const idx = items.findIndex((l) => l.id === selectedId);
assert.equal(idx, 1);
if (idx > 0) {
assert.equal(items[idx - 1].id, "a", "should navigate to previous item");
}
});
test("handleNext at last item closes modal (no wrap-around)", () => {
const items = [
{ id: "a", active: false },
{ id: "b", active: false },
];
const selectedId = "b";
const idx = items.findIndex((l) => l.id === selectedId);
assert.equal(idx, items.length - 1);
// handleNext at last item should close
if (idx < items.length - 1) {
assert.equal(items[idx + 1].id, "should not reach");
} else {
assert.ok(true, "next at last item closes modal");
}
});
test("handleNext navigates forward when not at last item", () => {
const items = [
{ id: "a", active: false },
{ id: "b", active: false },
];
const selectedId = "a";
const idx = items.findIndex((l) => l.id === selectedId);
if (idx < items.length - 1) {
assert.equal(items[idx + 1].id, "b", "should navigate to next item");
}
});
// ─── Detail endpoint polling ─────────────────────────────────────────────
test("deep-linked missing request id is kept pending for /api/logs/[id] polling", () => {
const content = fs.readFileSync("src/shared/components/RequestLoggerV2.tsx", "utf8");
assert.match(content, /pendingLookup:\s*true/);
// A deep-linked id that 404s while still active is kept pending...
assert.match(content, /setDetailData\(\{\s*detailState:\s*"pending"\s*\}\)/);
// ...and the detail-polling effect re-runs on that pending state.
assert.match(content, /detailData\?\.detailState/);
assert.doesNotMatch(content, /activeRequests|completedRows|completedRow/);
});
// ─── End-to-end streamChunks integration ──────────────────────────────────
test("createRequestLogger with connectionId/model/provider populates streamChunks on pending request", async () => {
const { createRequestLogger } = await import("../../open-sse/utils/requestLogger.ts");
usageHistory.clearPendingRequests();
// track request so the pending detail entry exists
usageHistory.trackPendingRequest("gpt-4", "openai", "test-conn-1", true, {
clientRequest: { messages: [{ role: "user", content: "hi" }] },
});
const logger = await createRequestLogger("openai", "openai", "gpt-4", {
enabled: true,
captureStreamChunks: true,
connectionId: "test-conn-1",
model: "gpt-4",
provider: "openai",
});
// append a provider chunk — this should call pushStreamChunks() → updatePendingRequestStreamChunks()
logger.appendProviderChunk('data: {"content":"hello"}');
logger.appendProviderChunk('data: {"content":" world"}');
const pending = usageHistory.getPendingRequests();
const detail = pending.details["test-conn-1"]?.["gpt-4 (openai)"]?.[0];
assert.ok(detail, "pending request detail should exist");
assert.ok(detail.streamChunks, "streamChunks should be non-null after appendProviderChunk");
assert.ok(Array.isArray(detail.streamChunks.provider), "provider array should exist");
assert.equal(detail.streamChunks.provider.length, 2, "should have 2 provider chunks");
assert.equal(detail.streamChunks.provider[0], 'data: {"content":"hello"}');
assert.equal(detail.streamChunks.provider[1], 'data: {"content":" world"}');
assert.deepEqual(detail.streamChunks.openai, []);
assert.deepEqual(detail.streamChunks.client, []);
});
test("createRequestLogger requestId binds streamChunks to the exact pending request", async () => {
const { createRequestLogger } = await import("../../open-sse/utils/requestLogger.ts");
usageHistory.clearPendingRequests();
const firstId = usageHistory.trackPendingRequest("gpt-4", "openai", "test-conn-a", true);
const secondId = usageHistory.trackPendingRequest("gpt-4", "openai", "test-conn-b", true);
const logger = await createRequestLogger("openai", "openai", "gpt-4", {
enabled: true,
captureStreamChunks: true,
requestId: secondId,
});
logger.appendProviderChunk('data: {"content":"second"}');
const first = usageHistory.getPendingById().get(firstId);
const second = usageHistory.getPendingById().get(secondId);
assert.equal(first?.streamChunks, undefined);
assert.equal(second?.streamChunks?.provider[0], 'data: {"content":"second"}');
});
test("createRequestLogger fallback match does not cross connectionId boundaries", async () => {
const { createRequestLogger } = await import("../../open-sse/utils/requestLogger.ts");
usageHistory.clearPendingRequests();
usageHistory.trackPendingRequest("gpt-4", "openai", "test-conn-a", true);
const secondId = usageHistory.trackPendingRequest("gpt-4", "openai", "test-conn-b", true);
const logger = await createRequestLogger("openai", "openai", "gpt-4", {
enabled: true,
captureStreamChunks: true,
connectionId: "test-conn-b",
model: "gpt-4",
provider: "openai",
});
logger.appendProviderChunk('data: {"content":"conn-b"}');
const second = usageHistory.getPendingById().get(secondId);
assert.equal(second?.streamChunks?.provider[0], 'data: {"content":"conn-b"}');
});
test("createRequestLogger without connectionId does not populate streamChunks", async () => {
const { createRequestLogger } = await import("../../open-sse/utils/requestLogger.ts");
usageHistory.clearPendingRequests();
usageHistory.trackPendingRequest("gpt-4", "openai", "test-conn-2", true, {
clientRequest: { messages: [{ role: "user", content: "hi" }] },
});
// create logger WITHOUT connectionId/model/provider — pushStreamChunks will bail
const logger = await createRequestLogger("openai", "openai", "gpt-4", {
enabled: true,
captureStreamChunks: true,
// intentionally omit connectionId, model, provider
});
logger.appendProviderChunk('data: {"content":"hello"}');
const pending = usageHistory.getPendingRequests();
const detail = pending.details["test-conn-2"]?.["gpt-4 (openai)"]?.[0];
assert.ok(detail, "pending request detail should exist");
assert.equal(
detail.streamChunks,
undefined,
"streamChunks should be undefined when connectionId not provided to createRequestLogger"
);
});
test("createRequestLogger appendOpenAIChunk and appendConvertedChunk also populate streamChunks", async () => {
const { createRequestLogger } = await import("../../open-sse/utils/requestLogger.ts");
usageHistory.clearPendingRequests();
usageHistory.trackPendingRequest("claude-3", "anthropic", "test-conn-3", true);
const logger = await createRequestLogger("anthropic", "openai", "claude-3", {
enabled: true,
captureStreamChunks: true,
connectionId: "test-conn-3",
model: "claude-3",
provider: "anthropic",
});
logger.appendOpenAIChunk('data: {"role":"assistant","content":"hi"}');
logger.appendConvertedChunk('data: {"content":"there"}');
const pending = usageHistory.getPendingRequests();
const detail = pending.details["test-conn-3"]?.["claude-3 (anthropic)"]?.[0];
assert.ok(detail?.streamChunks, "streamChunks should be set");
assert.equal(detail.streamChunks.openai.length, 1);
assert.equal(detail.streamChunks.openai[0], 'data: {"role":"assistant","content":"hi"}');
assert.equal(detail.streamChunks.client.length, 1);
assert.equal(detail.streamChunks.client[0], 'data: {"content":"there"}');
});
test("createRequestLogger captures stream chunks even when enabled: false", async () => {
const { createRequestLogger } = await import("../../open-sse/utils/requestLogger.ts");
usageHistory.clearPendingRequests();
usageHistory.trackPendingRequest("gpt-4", "openai", "test-conn-4", true);
// Logger is disabled (enabled: false) — previously this would return a
// no-op logger that didn't capture any chunks. Now stream chunks are
// always captured regardless of the enabled flag.
const logger = await createRequestLogger("openai", "openai", "gpt-4", {
enabled: false,
captureStreamChunks: true,
connectionId: "test-conn-4",
model: "gpt-4",
provider: "openai",
});
logger.appendProviderChunk('data: {"content":"hello"}');
const pending = usageHistory.getPendingRequests();
const detail = pending.details["test-conn-4"]?.["gpt-4 (openai)"]?.[0];
assert.ok(detail?.streamChunks, "streamChunks should be set even when logger is disabled");
assert.equal(detail.streamChunks.provider.length, 1);
assert.equal(detail.streamChunks.provider[0], 'data: {"content":"hello"}');
// But getPipelinePayloads should return null when disabled
assert.equal(
logger.getPipelinePayloads(),
null,
"pipeline payloads should be null when disabled"
);
});
test("createRequestLogger disabled logger other methods are no-ops", async () => {
const { createRequestLogger } = await import("../../open-sse/utils/requestLogger.ts");
const logger = await createRequestLogger("openai", "openai", "gpt-4", {
enabled: false,
captureStreamChunks: false,
});
// These should not throw
logger.logClientRawRequest("/endpoint", { foo: "bar" });
logger.logOpenAIRequest({ model: "gpt-4" });
logger.logTargetRequest("https://api.openai.com", {}, { model: "gpt-4" });
logger.logProviderResponse(200, "OK", {}, {});
logger.logConvertedResponse({ choices: [] });
logger.logError(new Error("test"));
logger.appendProviderChunk("test");
logger.appendOpenAIChunk("test");
logger.appendConvertedChunk("test");
assert.equal(logger.getPipelinePayloads(), null);
});