OpenCode
68a9071cf1
Local branch had diverged from origin/master (sibling commits on the same base). Rewrote local history linearly on top of origin/master, folding in all local content: exa/hot-platform discovery hunters, leaks ledger, nightly sweep orchestrator, updated .gitignore and skill docs, plus the latest hunt output and vault state. Remote-only files (vault keys, channel scripts) were restored rather than dropped, so the resulting tree is a full union of both sides.
1 line
11 KiB
JSON
1 line
11 KiB
JSON
{"repo": "atvirokodosprendimai/ai-pipeline-template", "files": {"pipeline/tests/test_goose_env.py": {"d8cb7b629a2d4a4be08c384b5a82b51f28b1395a": {"t": 1786068240.2559566, "n": 9892, "h": "af869e67dc4b2160", "c": "from __future__ import annotations\n\nfrom dataclasses import dataclass\n\nimport pytest\n\nfrom wgmesh_pipeline.goose.runner import _is_secret_var, build_goose_env\nfrom wgmesh_pipeline.models import ModelProfile\n\n\n@dataclass(frozen=True)\nclass _Cfg:\n zai_api_key: str | None = \"zai-secret\"\n anthropic_host: str = \"https://api.z.ai/api/anthropic\"\n\n\ndef test_secret_vars_detected() -> None:\n for name in (\n \"WGMESH_BOT_PAT\", # caught by explicit known-names set (no marker, PAT~PATH)\n \"LANGSMITH_API_KEY\",\n \"GITHUB_TOKEN\",\n \"APP_PRIVATE_KEY\",\n \"AWS_SECRET_ACCESS_KEY\",\n \"DB_PASSWORD\",\n \"SOME_CREDENTIAL\",\n \"HCLOUD_TOKEN\",\n ):\n assert _is_secret_var(name) is True\n # plain non-secret vars are kept — PATH must NOT be mistaken for a PAT\n for name in (\"PATH\", \"HOME\", \"LANG\", \"TERM\", \"SHELL\"):\n assert _is_secret_var(name) is False\n\n\ndef test_build_goose_env_allowlist_drops_secrets_keeps_safe_and_llm_cred() -> None:\n base = {\n \"PATH\": \"/usr/bin\",\n \"HOME\": \"/home/bot\",\n \"LC_ALL\": \"C.UTF-8\",\n \"SSL_CERT_FILE\": \"/etc/ssl/cert.pem\",\n \"SSH_AUTH_SOCK\": \"/run/ssh\",\n \"WGMESH_BOT_PAT\": \"ghp_secret\",\n \"LANGSMITH_API_KEY\": \"ls-secret\",\n \"GITHUB_TOKEN\": \"tok\",\n \"APP_PRIVATE_KEY\": \"-----BEGIN-----\",\n \"DB_PASSWORD\": \"hunter2\",\n # fail-closed cases: real credentials whose NAME carries no secret marker\n \"NPM_AUTH\": \"npm-cred\",\n \"SENTRY_DSN\": \"https://abc@sentry.io/1\",\n \"PAT\": \"bare-pat\",\n }\n env = build_goose_env(_Cfg(), base_env=base)\n\n # allowlisted safe vars retained (PATH/HOME/locale/TLS/ssh-agent)\n assert env[\"PATH\"] == \"/usr/bin\"\n assert env[\"HOME\"] == \"/home/bot\"\n assert env[\"LC_ALL\"] == \"C.UTF-8\"\n assert env[\"SSL_CERT_FILE\"] == \"/etc/ssl/cert.pem\"\n assert env[\"SSH_AUTH_SOCK\"] == \"/run/ssh\"\n # EVERYTHING not allowlisted is dropped — incl. marker-less credentials\n for leaked in (\n \"WGMESH_BOT_PAT\", \"LANGSMITH_API_KEY\", \"GITHUB_TOKEN\", \"APP_PRIVATE_KEY\",\n \"DB_PASSWORD\", \"NPM_AUTH\", \"SENTRY_DSN\", \"PAT\",\n ):\n assert leaked not in env\n # the single LLM credential Goose needs is added back explicitly\n assert env[\"ANTHROPIC_API_KEY\"] == \"zai-secret\"\n assert env[\"ANTHROPIC_HOST\"].endswith(\"/anthropic\")\n assert env[\"GOOSE_PROVIDER\"] == \"anthropic\"\n assert env[\"GOOSE_MODEL\"]\n\n\ndef test_build_goose_env_only_anthropic_key_is_secret_shaped() -> None:\n # Property: nothing secret-shaped leaks. The only secret in the output is the\n # explicitly re-added LLM credential.\n base = {\n \"PATH\": \"/usr/bin\", \"HOME\": \"/h\", \"FOO_TOKEN\": \"x\", \"BAR_SECRET\": \"y\",\n \"RANDOM_THING\": \"z\", \"AWS_SECRET_ACCESS_KEY\": \"k\",\n }\n env = build_goose_env(_Cfg(), base_env=base)\n for key in env:\n assert key == \"ANTHROPIC_API_KEY\" or not _is_secret_var(key)\n\n\ndef test_build_goose_env_without_zai_key_omits_anthropic_key() -> None:\n env = build_goose_env(_Cfg(zai_api_key=None), base_env={\"PATH\": \"/usr/bin\"})\n assert \"ANTHROPIC_API_KEY\" not in env\n assert env[\"ANTHROPIC_HOST\"]\n\n\ndef test_build_goose_env_prefers_explicit_goose_provider_model_from_base_env() -> None:\n env = build_goose_env(\n _Cfg(),\n base_env={\n \"PATH\": \"/usr/bin\",\n \"GOOSE_PROVIDER\": \"anthropic\",\n \"GOOSE_MODEL\": \"custom-zai-model\",\n },\n )\n\n assert env[\"GOOSE_PROVIDER\"] == \"anthropic\"\n assert env[\"GOOSE_MODEL\"] == \"custom-zai-model\"\n\n\ndef test_build_goose_env_passes_langfuse_creds_for_cost_capture() -> None:\n \"\"\"Goose gets LANGFUSE_URL/PUBLIC_KEY/SECRET_KEY so it exports its own LLM\n generations (model + token usage + cost) to Langfuse — the price half of\n price/performance. SECRET_KEY is re-added past the allowlist.\"\"\"\n from dataclasses import dataclass\n\n @dataclass(frozen=True)\n class _LfCfg:\n zai_api_key: str | None = \"zai-secret\"\n anthropic_host: str = \"https://api.z.ai/api/anthropic\"\n langfuse_host: str | None = \"http://lf:3000\"\n langfuse_public_key: str | None = \"pk-lf-x\"\n langfuse_secret_key: str | None = \"sk-lf-x\"\n\n env = build_goose_env(_LfCfg(), base_env={\"PATH\": \"/usr/bin\"})\n assert env[\"LANGFUSE_URL\"] == \"http://lf:3000\"\n assert env[\"LANGFUSE_PUBLIC_KEY\"] == \"pk-lf-x\"\n assert env[\"LANGFUSE_SECRET_KEY\"] == \"sk-lf-x\"\n\n\ndef test_build_goose_env_omits_langfuse_when_unconfigured() -> None:\n env = build_goose_env(_Cfg(), base_env={\"PATH\": \"/usr/bin\"})\n assert \"LANGFUSE_URL\" not in env\n assert \"LANGFUSE_SECRET_KEY\" not in env\n\n\n# --- profile-driven routing (U2) ---------------------------------------------\n\n_ZAI = ModelProfile(\n key=\"spec-cheap\",\n provider=\"anthropic\",\n model=\"GLM-4.7\",\n billing=\"native\",\n credential_env=\"ZAI_API_KEY\",\n host=\"https://api.z.ai/api/anthropic\",\n)\n_REAL_ANTHROPIC = ModelProfile(\n key=\"impl-claude\",\n provider=\"anthropic\",\n model=\"claude-sonnet-4-6\",\n billing=\"native\",\n credential_env=\"ANTHROPIC_API_KEY\",\n host=\"https://api.anthropic.com\",\n)\n_OPENROUTER = ModelProfile(\n key=\"impl-or\",\n provider=\"openrouter\",\n model=\"deepseek/deepseek-chat\",\n billing=\"openrouter\",\n credential_env=\"OPENROUTER_API_KEY\",\n)\n\n\ndef test_profile_native_anthropic_zai() -> None:\n env = build_goose_env(\n _Cfg(), base_env={\"PATH\": \"/usr/bin\", \"ZAI_API_KEY\": \"zai-key\"}, profile=_ZAI\n )\n assert env[\"GOOSE_PROVIDER\"] == \"anthropic\"\n assert env[\"GOOSE_MODEL\"] == \"GLM-4.7\"\n assert env[\"ANTHROPIC_API_KEY\"] == \"zai-key\"\n assert env[\"ANTHROPIC_HOST\"] == \"https://api.z.ai/api/anthropic\"\n\n\ndef test_two_anthropic_profiles_do_not_collide() -> None:\n # R2 regression guard: z.ai-as-Anthropic and real Anthropic built in the\n # same process produce distinct envs — no global ANTHROPIC_API_KEY hijack.\n base = {\"PATH\": \"/usr/bin\", \"ZAI_API_KEY\": \"zai-key\", \"ANTHROPIC_API_KEY\": \"real-key\"}\n zai_env = build_goose_env(_Cfg(), base_env=base, profile=_ZAI)\n real_env = build_goose_env(_Cfg(), base_env=base, profile=_REAL_ANTHROPIC)\n assert zai_env[\"ANTHROPIC_API_KEY\"] == \"zai-key\"\n assert zai_env[\"ANTHROPIC_HOST\"] == \"https://api.z.ai/api/anthropic\"\n assert real_env[\"ANTHROPIC_API_KEY\"] == \"real-key\"\n assert real_env[\"ANTHROPIC_HOST\"] == \"https://api.anthropic.com\"\n assert real_env[\"GOOSE_MODEL\"] == \"claude-sonnet-4-6\"\n\n\ndef test_profile_openrouter() -> None:\n env = build_goose_env(\n _Cfg(),\n base_env={\"PATH\": \"/usr/bin\", \"OPENROUTER_API_KEY\": \"or-key\"},\n profile=_OPENROUTER,\n )\n assert env[\"GOOSE_PROVIDER\"] == \"openrouter\"\n assert env[\"GOOSE_MODEL\"] == \"deepseek/deepseek-chat\"\n assert env[\"OPENROUTER_API_KEY\"] == \"or-key\"\n assert \"ANTHROPIC_API_KEY\" not in env\n assert \"ANTHROPIC_HOST\" not in env\n\n\ndef test_profile_still_strips_box_secrets() -> None:\n base = {\"PATH\": \"/usr/bin\", \"ZAI_API_KEY\": \"zai-key\", \"WGMESH_BOT_PAT\": \"ghp_x\", \"DB_PASSWORD\": \"p\"}\n env = build_goose_env(_Cfg(), base_env=base, profile=_ZAI)\n assert \"WGMESH_BOT_PAT\" not in env\n assert \"DB_PASSWORD\" not in env\n\n\ndef test_profile_keeps_langfuse_creds() -> None:\n @dataclass(frozen=True)\n class _LfCfg:\n zai_api_key: str | None = None\n anthropic_host: str = \"https://api.z.ai/api/anthropic\"\n langfuse_host: str | None = \"http://lf:3000\"\n langfuse_public_key: str | None = \"pk\"\n langfuse_secret_key: str | None = \"sk\"\n\n env = build_goose_env(\n _LfCfg(), base_env={\"PATH\": \"/usr/bin\", \"ZAI_API_KEY\": \"zai-key\"}, profile=_ZAI\n )\n assert env[\"LANGFUSE_URL\"] == \"http://lf:3000\"\n assert env[\"LANGFUSE_SECRET_KEY\"] == \"sk\"\n\n\ndef test_profile_missing_credential_raises() -> None:\n with pytest.raises(ValueError, match=\"ZAI_API_KEY, which is unset\"):\n build_goose_env(_Cfg(), base_env={\"PATH\": \"/usr/bin\"}, profile=_ZAI)\n\n\ndef test_new_provider_creds_stripped_when_profile_does_not_reference_them() -> None:\n # U4 leak-guard: the openrouter profile pulls in ONLY OPENROUTER_API_KEY;\n # every other provider key in the box env is dropped by the allowlist.\n base = {\n \"PATH\": \"/usr/bin\",\n \"OPENROUTER_API_KEY\": \"or-key\",\n \"DEEPSEEK_API_KEY\": \"ds-key\",\n \"OPENAI_API_KEY\": \"oa-key\",\n \"MINIMAX_API_KEY\": \"mm-key\",\n \"ANTHROPIC_API_KEY\": \"real-anthropic\",\n }\n env = build_goose_env(_Cfg(zai_api_key=None), base_env=base, profile=_OPENROUTER)\n assert env[\"OPENROUTER_API_KEY\"] == \"or-key\"\n for leaked in (\"DEEPSEEK_API_KEY\", \"OPENAI_API_KEY\", \"MINIMAX_API_KEY\", \"ANTHROPIC_API_KEY\"):\n assert leaked not in env\n\n\ndef test_new_provider_cred_names_are_secret_shaped() -> None:\n for name in (\"DEEPSEEK_API_KEY\", \"OPENAI_API_KEY\", \"MINIMAX_API_KEY\", \"OPENROUTER_API_KEY\"):\n assert _is_secret_var(name) is True\n\n\ndef test_attribution_otel_attrs_carry_stage_and_model_key() -> None:\n env = build_goose_env(\n _Cfg(),\n base_env={\"PATH\": \"/usr/bin\", \"ZAI_API_KEY\": \"zai-key\"},\n profile=_ZAI,\n stage=\"spec\",\n )\n attrs = env[\"OTEL_RESOURCE_ATTRIBUTES\"]\n assert \"wgmesh.stage=spec\" in attrs\n assert \"wgmesh.model_key=spec-cheap\" in attrs\n\n\ndef test_attribution_absent_without_stage_or_profile() -> None:\n env = build_goose_env(_Cfg(), base_env={\"PATH\": \"/usr/bin\"})\n assert \"OTEL_RESOURCE_ATTRIBUTES\" not in env\n\n\ndef test_profile_unsupported_native_provider_raises() -> None:\n minimax_native = ModelProfile(\n key=\"minimax\",\n provider=\"minimax\",\n model=\"abab6.5\",\n billing=\"native\",\n credential_env=\"MINIMAX_API_KEY\",\n )\n with pytest.raises(ValueError, match=\"route it via OpenRouter\"):\n build_goose_env(\n _Cfg(), base_env={\"PATH\": \"/usr/bin\", \"MINIMAX_API_KEY\": \"m\"}, profile=minimax_native\n )\n"}}}} |