test(sandbox): carry the resolved read denials through consumer policy assertions

The policy home's resolve() now stamps readDenyPaths, so every consumer that pins the resolved shape (bash-sandbox hand-off, tool-fs stamps) carries it, and three uncovered branches gained real tests: landlock reporting partial enforcement for a denial it cannot express, the policy's default under programmatic construction, and both ambient credential paths in llm-deepseek without a mounted seam.
2026-07-30 16:11:21 +08:00
parent 7606a99813
commit 9626c15c6b
19 changed files with 239 additions and 20 deletions
@@ -0,0 +1,116 @@
+/**
+ * Real-composition guard for the dormant pi-ai posture: LlmService,
+ * settings-local, credentials-local, and a bare `llm-pi-ai` row boot from a
+ * test-only cordis.yml through the actual Loader + Include path, an external
+ * edit of settings.yaml registers the route live, and the next request
+ * carries the credential the .env supplies. A hand-mounted `ctx.plugin` cannot
+ * catch Loader export-shape failures, which is why the twin adapter has the
+ * same guard.
+ */
+
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { Context } from 'cordis'
+import Loader from '@cordisjs/plugin-loader'
+import Include from '@cordisjs/plugin-include'
+import LlmService from '@deepseek-ai/dsh-llm'
+import CredentialsLocal from '@deepseek-ai/dsh-credentials-local'
+import SettingsLocal from '@deepseek-ai/dsh-settings-local'
+import * as LlmPiAi from '@deepseek-ai/dsh-llm-pi-ai'
+import { assemble } from './assemble.ts'
+import { closeMockServers, mockServer, textEvents } from './mock-server.ts'
+
+let root: string | undefined
+let context: Context | undefined
+
+afterEach(async () => {
+  await context?.fiber.dispose()
+  context = undefined
+  if (root !== undefined) await rm(root, { recursive: true, force: true })
+  root = undefined
+  await closeMockServers()
+  vi.unstubAllEnvs()
+})
+
+/** Boot the dormant composition: a bare `llm-pi-ai` row with no config at all. */
+async function loadComposition(): Promise<{ ctx: Context; settingsPath: string }> {
+  root = await mkdtemp(join(tmpdir(), 'dsh-pi-composition-'))
+  const settingsPath = join(root, 'settings.yaml')
+  await writeFile(settingsPath, '# personal settings\n')
+  await writeFile(join(root, '.env'), 'PI_COMPOSITION_KEY=key-from-store\n')
+
+  const configPath = join(root, 'cordis.yml')
+  await writeFile(configPath, [
+    '- id: llm',
+    "  name: 'test-llm-service'",
+    '- id: settings',
+    "  name: '@deepseek-ai/dsh-settings-local'",
+    '  config:',
+    `    path: ${JSON.stringify(settingsPath)}`,
+    '    debounceMs: 10',
+    '- id: credentials',
+    "  name: '@deepseek-ai/dsh-credentials-local'",
+    '  config:',
+    `    path: ${JSON.stringify(join(root, '.env'))}`,
+    '    debounceMs: 10',
+    '- id: llm-pi-ai',
+    "  name: '@deepseek-ai/dsh-llm-pi-ai'",
+    '',
+  ].join('\n'))
+
+  const ctx = new Context()
+  context = ctx
+  ctx.baseUrl = pathToFileURL(root).href + '/'
+  await ctx.plugin(Loader)
+  ctx.loader.builtins.include = Include
+  const modules = new Map<string, unknown>([
+    ['test-llm-service', LlmService],
+    ['@deepseek-ai/dsh-settings-local', SettingsLocal],
+    ['@deepseek-ai/dsh-credentials-local', CredentialsLocal],
+    ['@deepseek-ai/dsh-llm-pi-ai', LlmPiAi],
+  ])
+  ctx.loader.internal = {
+    version: 'v2',
+    async import(specifier: string) {
+      if (!modules.has(specifier)) throw new Error(`unexpected Loader import: ${specifier}`)
+      return modules.get(specifier)
+    },
+  } as unknown as NonNullable<typeof ctx.loader.internal>
+  await ctx.loader.create({
+    name: 'cordis:include',
+    config: { path: pathToFileURL(configPath).href },
+  })
+  await ctx.loader.await()
+  return { ctx, settingsPath }
+}
+
+describe('llm-pi-ai real dormant composition', () => {
+  it('boots with zero routes and registers one the moment settings supply a profile', async () => {
+    vi.stubEnv('PI_COMPOSITION_KEY', '')
+    const server = await mockServer([{ events: textEvents }])
+    const { ctx, settingsPath } = await loadComposition()
+
+    // The shipped posture: the adapter exists, no route does.
+    expect(ctx.llm.listProviders()).toEqual([])
+
+    // Exactly what the web Models page leaves on disk.
+    await writeFile(settingsPath, [
+      'llm-pi-ai:',
+      '  providers:',
+      '    deepseek:',
+      '      apiKeyEnv: PI_COMPOSITION_KEY',
+      `      baseURL: ${server.url}`,
+      '',
+    ].join('\n'))
+    await vi.waitFor(() => {
+      expect(ctx.llm.listProviders().map(provider => provider.id)).toEqual(['deepseek'])
+    }, { timeout: 5000 })
+
+    const result = await assemble(ctx, { provider: 'deepseek', model: 'deepseek-v4-flash', messages: [] })
+    expect(result.message.content).toEqual([{ type: 'text', text: 'hello' }])
+    expect(server.headers[0]?.authorization).toBe('Bearer key-from-store')
+  })
+})