$DSH_HOME/.env carried two incompatible jobs. As credentials-local's writable secret store it could not be hoisted into process.env — hoisting makes every stored key read as a read-only launch override and blocks rotation from the TUI and the web page. But its name and dotenv format promise an environment file, so a DEEPSEEK_BASE_URL sitting beside a working DEEPSEEK_API_KEY in the same file was silently ignored: only the credential provider read the document, and it addresses credential references alone. Split the two jobs into two files. .credentials.yaml is the provider-managed store: a strict YAML mapping of CredentialRef to non-empty string, no version field, no wrapper level. Because it holds credentials and nothing else, a non-mapping root, a non-identifier key, a non-string value, an empty string, a duplicate key, and malformed YAML are all rejections rather than skipped entries — loud at boot and at a write, warn-and-keep-last-good on a live reload. The dotenv physical-line editor gives way to a patch of the parsed document, so comments and untouched entries keep their formatting and any string value round-trips, multi-line included. Writer lock, read-modify-write, atomic 0600 write under a 0700 directory, watcher, self-write suppression, and quiescent disposal are unchanged. $DSH_HOME/.env becomes the user's ordinary environment layer. app-boot's new loadLayeredEnv loads the invoking directory's .env then the Harness home's, giving user < project < inherited; the home resolves from the inherited environment first, so a project .env cannot redirect it. Credential precedence is unchanged: the live environment still wins read-only over the file, and shadowed writes still reject. Whether a provider-managed store should instead win over the environment is a separate decision. No migration: a key already in $DSH_HOME/.env keeps resolving through the new environment layer, as a read-only env source that shadows the stored one.
117 lines
4.3 KiB
TypeScript
117 lines
4.3 KiB
TypeScript
/**
|
|
* Real-composition guard for the dormant pi-ai posture: LlmService,
|
|
* settings-local, credentials-local, and a bare `llm-pi-ai` row boot from a
|
|
* test-only cordis.yml through the actual Loader + Include path, an external
|
|
* edit of settings.yaml registers the route live, and the next request
|
|
* carries the credential the credentials document supplies. A hand-mounted `ctx.plugin` cannot
|
|
* catch Loader export-shape failures, which is why the twin adapter has the
|
|
* same guard.
|
|
*/
|
|
|
|
import { mkdtemp, rm, writeFile } from 'node:fs/promises'
|
|
import { tmpdir } from 'node:os'
|
|
import { join } from 'node:path'
|
|
import { pathToFileURL } from 'node:url'
|
|
import { afterEach, describe, expect, it, vi } from 'vitest'
|
|
import { Context } from 'cordis'
|
|
import Loader from '@cordisjs/plugin-loader'
|
|
import Include from '@cordisjs/plugin-include'
|
|
import LlmService from '@deepseek-ai/dsh-llm'
|
|
import CredentialsLocal from '@deepseek-ai/dsh-credentials-local'
|
|
import SettingsLocal from '@deepseek-ai/dsh-settings-local'
|
|
import * as LlmPiAi from '@deepseek-ai/dsh-llm-pi-ai'
|
|
import { assemble } from './assemble.ts'
|
|
import { closeMockServers, mockServer, textEvents } from './mock-server.ts'
|
|
|
|
let root: string | undefined
|
|
let context: Context | undefined
|
|
|
|
afterEach(async () => {
|
|
await context?.fiber.dispose()
|
|
context = undefined
|
|
if (root !== undefined) await rm(root, { recursive: true, force: true })
|
|
root = undefined
|
|
await closeMockServers()
|
|
vi.unstubAllEnvs()
|
|
})
|
|
|
|
/** Boot the dormant composition: a bare `llm-pi-ai` row with no config at all. */
|
|
async function loadComposition(): Promise<{ ctx: Context; settingsPath: string }> {
|
|
root = await mkdtemp(join(tmpdir(), 'dsh-pi-composition-'))
|
|
const settingsPath = join(root, 'settings.yaml')
|
|
await writeFile(settingsPath, '# personal settings\n')
|
|
await writeFile(join(root, '.credentials.yaml'), 'PI_COMPOSITION_KEY: key-from-store\n')
|
|
|
|
const configPath = join(root, 'cordis.yml')
|
|
await writeFile(configPath, [
|
|
'- id: llm',
|
|
" name: 'test-llm-service'",
|
|
'- id: settings',
|
|
" name: '@deepseek-ai/dsh-settings-local'",
|
|
' config:',
|
|
` path: ${JSON.stringify(settingsPath)}`,
|
|
' debounceMs: 10',
|
|
'- id: credentials',
|
|
" name: '@deepseek-ai/dsh-credentials-local'",
|
|
' config:',
|
|
` path: ${JSON.stringify(join(root, '.credentials.yaml'))}`,
|
|
' debounceMs: 10',
|
|
'- id: llm-pi-ai',
|
|
" name: '@deepseek-ai/dsh-llm-pi-ai'",
|
|
'',
|
|
].join('\n'))
|
|
|
|
const ctx = new Context()
|
|
context = ctx
|
|
ctx.baseUrl = pathToFileURL(root).href + '/'
|
|
await ctx.plugin(Loader)
|
|
ctx.loader.builtins.include = Include
|
|
const modules = new Map<string, unknown>([
|
|
['test-llm-service', LlmService],
|
|
['@deepseek-ai/dsh-settings-local', SettingsLocal],
|
|
['@deepseek-ai/dsh-credentials-local', CredentialsLocal],
|
|
['@deepseek-ai/dsh-llm-pi-ai', LlmPiAi],
|
|
])
|
|
ctx.loader.internal = {
|
|
version: 'v2',
|
|
async import(specifier: string) {
|
|
if (!modules.has(specifier)) throw new Error(`unexpected Loader import: ${specifier}`)
|
|
return modules.get(specifier)
|
|
},
|
|
} as unknown as NonNullable<typeof ctx.loader.internal>
|
|
await ctx.loader.create({
|
|
name: 'cordis:include',
|
|
config: { path: pathToFileURL(configPath).href },
|
|
})
|
|
await ctx.loader.await()
|
|
return { ctx, settingsPath }
|
|
}
|
|
|
|
describe('llm-pi-ai real dormant composition', () => {
|
|
it('boots with zero routes and registers one the moment settings supply a profile', async () => {
|
|
vi.stubEnv('PI_COMPOSITION_KEY', '')
|
|
const server = await mockServer([{ events: textEvents }])
|
|
const { ctx, settingsPath } = await loadComposition()
|
|
|
|
// The shipped posture: the adapter exists, no route does.
|
|
expect(ctx.llm.listProviders()).toEqual([])
|
|
|
|
// Exactly what the web Models page leaves on disk.
|
|
await writeFile(settingsPath, [
|
|
'llm-pi-ai:',
|
|
' providers:',
|
|
' deepseek:',
|
|
' apiKeyEnv: PI_COMPOSITION_KEY',
|
|
` baseURL: ${server.url}`,
|
|
'',
|
|
].join('\n'))
|
|
await vi.waitFor(() => {
|
|
expect(ctx.llm.listProviders().map(provider => provider.id)).toEqual(['deepseek'])
|
|
}, { timeout: 5000 })
|
|
|
|
const result = await assemble(ctx, { provider: 'deepseek', model: 'deepseek-v4-flash', messages: [] })
|
|
expect(result.message.content).toEqual([{ type: 'text', text: 'hello' }])
|
|
expect(server.headers[0]?.authorization).toBe('Bearer key-from-store')
|
|
})
|
|
})
|