File size: 7,401 Bytes
f778c12 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 | /** Local capability runners must materialize the selected agent's saved-account SecretRefs. */
import { join } from "node:path";
import { Command } from "commander";
import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
import { updateAuthProfileStoreWithLock } from "../../agents/auth-profiles/store-runtime.js";
import { resolveApiKeyForProviderCore } from "../../agents/model-auth.js";
import { setRuntimeConfigSnapshot } from "../../config/runtime-snapshot.js";
import type { OpenClawConfig } from "../../config/types.openclaw.js";
import { clearSecretsRuntimeSnapshotState } from "../../secrets/runtime-state.js";
import { setupSecretsRuntimeSnapshotTestHooks } from "../../secrets/runtime.test-support.ts";
import {
createOpenClawTestState,
type OpenClawTestState,
} from "../../test-utils/openclaw-test-state.js";
setupSecretsRuntimeSnapshotTestHooks();
type ProviderEgressParams = { cfg?: OpenClawConfig; config?: OpenClawConfig; agentDir?: string };
const hoisted = vi.hoisted(() => {
const rawCfg: OpenClawConfig = {};
const egressAuth: Array<{ source?: string; apiKey?: string }> = [];
return { rawCfg, egressAuth };
});
// Stands in for the provider plugin at its egress boundary: it performs the same
// saved-account auth lookup a real provider runs before sending a request.
async function resolveEgressAuth(params: ProviderEgressParams): Promise<void> {
const auth = await resolveApiKeyForProviderCore({
provider: "customacct",
cfg: params.cfg ?? params.config,
agentDir: params.agentDir,
});
hoisted.egressAuth.push({ source: auth.source, apiKey: auth.apiKey });
}
vi.mock("../../image-generation/runtime.js", async (importOriginal) => ({
...(await importOriginal<typeof import("../../image-generation/runtime.js")>()),
generateImage: vi.fn(async (params: ProviderEgressParams) => {
await resolveEgressAuth(params);
return { provider: "customacct", model: "test-model", attempts: [], images: [] };
}),
}));
vi.mock("../../video-generation/runtime.js", async (importOriginal) => ({
...(await importOriginal<typeof import("../../video-generation/runtime.js")>()),
generateVideo: vi.fn(async (params: ProviderEgressParams) => {
await resolveEgressAuth(params);
return { provider: "customacct", model: "test-model", attempts: [], videos: [] };
}),
}));
vi.mock("../../media-understanding/runtime.js", async (importOriginal) => {
const understandMedia = async (params: ProviderEgressParams) => {
await resolveEgressAuth(params);
return { text: "synthetic-ok", provider: "customacct", model: "test-model" };
};
return {
...(await importOriginal<typeof import("../../media-understanding/runtime.js")>()),
describeImageFile: vi.fn(understandMedia),
describeVideoFile: vi.fn(understandMedia),
transcribeAudioFile: vi.fn(understandMedia),
};
});
vi.mock("../../plugin-sdk/memory-core-bundled-runtime.js", async (importOriginal) => ({
...(await importOriginal<typeof import("../../plugin-sdk/memory-core-bundled-runtime.js")>()),
createEmbeddingProvider: vi.fn(async (params: ProviderEgressParams) => {
await resolveEgressAuth(params);
return {
provider: {
id: "customacct",
model: "test-model",
embedBatch: async (texts: string[]) => texts.map(() => [0.5]),
},
};
}),
}));
vi.mock("../../config/config.js", async (importOriginal) => ({
...(await importOriginal<typeof import("../../config/config.js")>()),
getRuntimeConfig: () => hoisted.rawCfg,
}));
vi.mock("../cli-utils.js", () => ({
runCommandWithRuntime: vi.fn(async (_runtime: unknown, run: () => Promise<void>) => await run()),
}));
vi.mock("./output.js", () => ({
emitJsonOrText: vi.fn(),
formatEnvelopeForText: vi.fn(),
providerSummaryText: vi.fn(),
}));
import { registerAudioCapabilityCommands } from "./audio.js";
import { registerEmbeddingCapabilityCommands } from "./embedding.js";
import { registerImageCapabilityCommands } from "./image.js";
import { registerVideoCapabilityCommands } from "./video.js";
// Synthetic-only credential for local-path proof. Never a real key or endpoint.
const ENV_ACCOUNT_KEY = "OPENCLAW_TEST_CAPABILITY_ACCOUNT_KEY";
const ACCOUNT_KEY_VALUE = "synthetic-capability-account-key"; // pragma: allowlist secret
function buildRawCfg(agentDir: string): OpenClawConfig {
return {
agents: {
defaults: { workspace: join(agentDir, "workspace") },
entries: { ops: { agentDir } },
},
models: {
providers: {
customacct: { api: "openai-completions", baseUrl: "http://127.0.0.1:1/v1", models: [] },
},
},
};
}
async function runLocalCapability(argv: string[], agent = "ops"): Promise<void> {
const capability = new Command();
registerImageCapabilityCommands(capability);
registerEmbeddingCapabilityCommands(capability);
registerAudioCapabilityCommands(capability);
registerVideoCapabilityCommands(capability);
await capability.parseAsync([...argv, "--agent", agent, "--json"], { from: "user" });
}
describe("local capability runners saved-account SecretRefs", () => {
let state: OpenClawTestState;
beforeEach(async () => {
state = await createOpenClawTestState({
prefix: "openclaw-capability-account-",
env: { [ENV_ACCOUNT_KEY]: ACCOUNT_KEY_VALUE },
});
const agentDir = state.agentDir("ops");
hoisted.rawCfg = buildRawCfg(agentDir);
// Production CLI boot pins the authored config as the runtime source first.
setRuntimeConfigSnapshot(structuredClone(hoisted.rawCfg), structuredClone(hoisted.rawCfg));
hoisted.egressAuth.length = 0;
const seeded = await updateAuthProfileStoreWithLock({
agentDir,
updater: (store) => {
store.profiles["customacct:saved"] = {
type: "api_key",
provider: "customacct",
keyRef: { source: "env", provider: "default", id: ENV_ACCOUNT_KEY },
};
return true;
},
});
expect(seeded).not.toBeNull();
});
afterEach(async () => {
clearSecretsRuntimeSnapshotState();
await state.cleanup();
});
it.each([
["image generate", ["image", "generate", "--prompt", "a red square"]],
["image describe", ["image", "describe", "--file", "input.png"]],
["embedding create", ["embedding", "create", "--text", "hello", "--provider", "customacct"]],
["audio transcribe", ["audio", "transcribe", "--file", "input.wav"]],
["video generate", ["video", "generate", "--prompt", "a red square"]],
["video describe", ["video", "describe", "--file", "input.mp4"]],
])("infer %s uses only the durable owner’s saved credential", async (_name, argv) => {
await runLocalCapability(argv);
expect(hoisted.egressAuth).toHaveLength(1);
expect(hoisted.egressAuth[0]).toEqual({
source: "profile:customacct:saved",
apiKey: ACCOUNT_KEY_VALUE,
});
hoisted.rawCfg = {
...hoisted.rawCfg,
agents: {
...hoisted.rawCfg.agents,
entries: { restored: { agentDir: state.agentDir("ops") } },
},
};
for (const activeSnapshot of [true, false]) {
if (!activeSnapshot) {
clearSecretsRuntimeSnapshotState();
}
await expect(runLocalCapability(argv, "restored")).rejects.toThrow(
"belongs to agent ops; requested agent restored",
);
expect(hoisted.egressAuth).toHaveLength(1);
}
});
});
|