|
| 1 | +// Reproduction tests for openclaw/openclaw#78407 — `openclaw doctor --fix` |
| 2 | +// rewrites every `openai-codex/*` model ref to `openai/*` and sets |
| 3 | +// `agentRuntime.id: "pi"` when the codex CLI plugin isn't installed, leaving |
| 4 | +// users who authenticate only via openai-codex OAuth (ChatGPT account) with |
| 5 | +// no working auth on first boot. |
| 6 | +// |
| 7 | +// The first test reproduces the user-visible regression with `it.fails` — |
| 8 | +// when the migration learns to skip or compensate for the missing |
| 9 | +// `openai/*` auth profile, vitest will start passing the test and force |
| 10 | +// removal of the `.fails` marker. |
| 11 | +// |
| 12 | +// The second test is a generic invariant any future migration should |
| 13 | +// satisfy: don't leave the primary model ref pointing at a provider with no |
| 14 | +// usable auth profile. It passes today on a clean fixture and is wired up |
| 15 | +// to assert post-repair state for additional regressions filed against |
| 16 | +// this code path. |
| 17 | +// |
| 18 | +// Sibling scaffolding for the broader transport-parity gate proposed in |
| 19 | +// openclaw/openclaw#78457 lives in `extensions/qa-lab/transport-parity-gate.md`. |
| 20 | + |
| 21 | +import { beforeEach, describe, expect, it, vi } from "vitest"; |
| 22 | +import type { OpenClawConfig } from "../../../config/types.openclaw.js"; |
| 23 | + |
| 24 | +const mocks = vi.hoisted(() => ({ |
| 25 | + ensureAuthProfileStore: vi.fn(), |
| 26 | + evaluateStoredCredentialEligibility: vi.fn(), |
| 27 | + getInstalledPluginRecord: vi.fn(), |
| 28 | + isInstalledPluginEnabled: vi.fn(), |
| 29 | + loadInstalledPluginIndex: vi.fn(), |
| 30 | + resolveAuthProfileOrder: vi.fn(), |
| 31 | + resolveProfileUnusableUntilForDisplay: vi.fn(), |
| 32 | +})); |
| 33 | + |
| 34 | +vi.mock("../../../agents/auth-profiles.js", () => ({ |
| 35 | + ensureAuthProfileStore: mocks.ensureAuthProfileStore, |
| 36 | + resolveAuthProfileOrder: mocks.resolveAuthProfileOrder, |
| 37 | + resolveProfileUnusableUntilForDisplay: mocks.resolveProfileUnusableUntilForDisplay, |
| 38 | +})); |
| 39 | + |
| 40 | +vi.mock("../../../agents/auth-profiles/credential-state.js", () => ({ |
| 41 | + evaluateStoredCredentialEligibility: mocks.evaluateStoredCredentialEligibility, |
| 42 | +})); |
| 43 | + |
| 44 | +vi.mock("../../../plugins/installed-plugin-index.js", async (importOriginal) => ({ |
| 45 | + ...(await importOriginal<typeof import("../../../plugins/installed-plugin-index.js")>()), |
| 46 | + getInstalledPluginRecord: mocks.getInstalledPluginRecord, |
| 47 | + isInstalledPluginEnabled: mocks.isInstalledPluginEnabled, |
| 48 | + loadInstalledPluginIndex: mocks.loadInstalledPluginIndex, |
| 49 | +})); |
| 50 | + |
| 51 | +import { maybeRepairCodexRoutes } from "./codex-route-warnings.js"; |
| 52 | + |
| 53 | +// Mirrors the 5-location footprint observed in the user's openclaw.json |
| 54 | +// before/after diff in #78407 — defaults primary + fallbacks, modelCatalog, |
| 55 | +// and per-agent + per-channel modelOverride blocks. |
| 56 | +function buildOpenAICodexFixture(): OpenClawConfig { |
| 57 | + return { |
| 58 | + agents: { |
| 59 | + defaults: { |
| 60 | + model: "openai-codex/gpt-5.5", |
| 61 | + modelOverride: { |
| 62 | + primary: "openai-codex/gpt-5.5", |
| 63 | + fallbacks: ["openai-codex/gpt-5.4", "openai-codex/gpt-5.4-mini"], |
| 64 | + }, |
| 65 | + modelCatalog: { |
| 66 | + "openai-codex/gpt-5.4": {}, |
| 67 | + "openai-codex/gpt-5.4-mini": {}, |
| 68 | + "openai-codex/gpt-5.4-pro": {}, |
| 69 | + "openai-codex/gpt-5.5": {}, |
| 70 | + "openai-codex/gpt-5.5-pro": {}, |
| 71 | + }, |
| 72 | + }, |
| 73 | + list: [ |
| 74 | + { |
| 75 | + id: "main", |
| 76 | + modelOverride: { |
| 77 | + primary: "openai-codex/gpt-5.5", |
| 78 | + fallbacks: ["openai-codex/gpt-5.4", "openai-codex/gpt-5.4-mini"], |
| 79 | + }, |
| 80 | + }, |
| 81 | + ], |
| 82 | + }, |
| 83 | + channels: { |
| 84 | + webchat: { |
| 85 | + modelOverride: { |
| 86 | + primary: "openai-codex/gpt-5.5", |
| 87 | + fallbacks: ["openai-codex/gpt-5.4", "openai-codex/gpt-5.4-mini"], |
| 88 | + }, |
| 89 | + }, |
| 90 | + }, |
| 91 | + } as unknown as OpenClawConfig; |
| 92 | +} |
| 93 | + |
| 94 | +// Generic invariant any migration should preserve. Returns the list of |
| 95 | +// model refs in the post-migration config that point at a provider with no |
| 96 | +// usable auth profile in `authProfileProviders`. Empty list = invariant |
| 97 | +// holds. |
| 98 | +function findModelRefsWithoutAuth( |
| 99 | + cfg: OpenClawConfig, |
| 100 | + authProfileProviders: ReadonlySet<string>, |
| 101 | +): string[] { |
| 102 | + const orphans: string[] = []; |
| 103 | + const visit = (ref: unknown, path: string): void => { |
| 104 | + if (typeof ref !== "string") return; |
| 105 | + const slash = ref.indexOf("/"); |
| 106 | + if (slash <= 0) return; |
| 107 | + const provider = ref.slice(0, slash); |
| 108 | + if (!authProfileProviders.has(provider)) { |
| 109 | + orphans.push(`${path}=${ref}`); |
| 110 | + } |
| 111 | + }; |
| 112 | + const walk = (node: unknown, path: string): void => { |
| 113 | + if (Array.isArray(node)) { |
| 114 | + node.forEach((value, index) => walk(value, `${path}[${index}]`)); |
| 115 | + return; |
| 116 | + } |
| 117 | + if (node && typeof node === "object") { |
| 118 | + for (const [key, value] of Object.entries(node as Record<string, unknown>)) { |
| 119 | + const nextPath = path ? `${path}.${key}` : key; |
| 120 | + if (key === "primary" || key === "model") { |
| 121 | + visit(value, nextPath); |
| 122 | + continue; |
| 123 | + } |
| 124 | + if (key === "fallbacks" && Array.isArray(value)) { |
| 125 | + value.forEach((entry, idx) => visit(entry, `${nextPath}[${idx}]`)); |
| 126 | + continue; |
| 127 | + } |
| 128 | + if (key === "modelCatalog" && value && typeof value === "object") { |
| 129 | + for (const catalogKey of Object.keys(value as Record<string, unknown>)) { |
| 130 | + visit(catalogKey, `${nextPath}.${catalogKey}`); |
| 131 | + } |
| 132 | + continue; |
| 133 | + } |
| 134 | + walk(value, nextPath); |
| 135 | + } |
| 136 | + } |
| 137 | + }; |
| 138 | + walk(cfg, ""); |
| 139 | + return orphans; |
| 140 | +} |
| 141 | + |
| 142 | +describe("maybeRepairCodexRoutes — issue #78407 no-openai-auth regression", () => { |
| 143 | + beforeEach(() => { |
| 144 | + vi.clearAllMocks(); |
| 145 | + |
| 146 | + // The user has only an openai-codex OAuth profile (ChatGPT account). |
| 147 | + mocks.ensureAuthProfileStore.mockReturnValue({ |
| 148 | + profiles: { |
| 149 | + "openai-codex:user@example.com": { |
| 150 | + type: "oauth", |
| 151 | + provider: "openai-codex", |
| 152 | + access: "stub", |
| 153 | + refresh: "stub", |
| 154 | + expires: Date.now() + 86_400_000, |
| 155 | + email: "user@example.com", |
| 156 | + }, |
| 157 | + }, |
| 158 | + usageStats: {}, |
| 159 | + }); |
| 160 | + mocks.resolveAuthProfileOrder.mockImplementation( |
| 161 | + ({ provider }: { provider: string }) => |
| 162 | + provider === "openai-codex" ? ["openai-codex:user@example.com"] : [], |
| 163 | + ); |
| 164 | + mocks.evaluateStoredCredentialEligibility.mockReturnValue({ |
| 165 | + eligible: true, |
| 166 | + reasonCode: "ok", |
| 167 | + }); |
| 168 | + mocks.resolveProfileUnusableUntilForDisplay.mockReturnValue(null); |
| 169 | + |
| 170 | + // The codex CLI plugin is not installed (the mainstream OAuth-only |
| 171 | + // user shape — they auth via ChatGPT OAuth, not the codex CLI |
| 172 | + // subprocess wrapper). |
| 173 | + mocks.getInstalledPluginRecord.mockReturnValue(undefined); |
| 174 | + mocks.isInstalledPluginEnabled.mockReturnValue(false); |
| 175 | + mocks.loadInstalledPluginIndex.mockReturnValue({ plugins: [] }); |
| 176 | + }); |
| 177 | + |
| 178 | + // EXPECTED FAILURE — reproduces #78407. The migration currently rewrites |
| 179 | + // every `openai-codex/*` ref to `openai/*` and sets `agentRuntime.id: |
| 180 | + // "pi"`, even though the user has no `openai:*` auth profile and no |
| 181 | + // codex CLI plugin installed. Once the migration learns to either (a) |
| 182 | + // skip rewriting when no compensating auth exists, (b) alias the |
| 183 | + // openai-codex profile under openai, or (c) keep the openai-codex |
| 184 | + // transport via `agentRuntime.id: "codex"` when only OAuth is present, |
| 185 | + // this test should pass and the `.fails` marker must be removed. |
| 186 | + it.fails( |
| 187 | + "preserves auth-resolvable model refs after the legacy openai-codex repair", |
| 188 | + () => { |
| 189 | + const cfg = buildOpenAICodexFixture(); |
| 190 | + const result = maybeRepairCodexRoutes({ cfg, shouldRepair: true }); |
| 191 | + |
| 192 | + const orphans = findModelRefsWithoutAuth( |
| 193 | + result.cfg, |
| 194 | + new Set(["openai-codex", "anthropic"]), |
| 195 | + ); |
| 196 | + |
| 197 | + // Today this fails: every `openai-codex/*` ref was rewritten to |
| 198 | + // `openai/*`, but the user has no `openai:*` auth profile, so every |
| 199 | + // rewritten ref is an orphan. |
| 200 | + expect(orphans).toEqual([]); |
| 201 | + }, |
| 202 | + ); |
| 203 | + |
| 204 | + // GENERIC INVARIANT — any migration that mutates model refs must leave |
| 205 | + // every primary/fallback/catalog ref pointing at a provider for which |
| 206 | + // the user has at least one usable auth profile. This test passes today |
| 207 | + // on a no-op input and is wired up so future regressions of the same |
| 208 | + // shape (e.g. a renamed-provider migration that forgets to map auth) |
| 209 | + // can extend it cheaply. |
| 210 | + it("invariant holds when the fixture matches available auth providers", () => { |
| 211 | + const cfg: OpenClawConfig = { |
| 212 | + agents: { |
| 213 | + defaults: { |
| 214 | + model: "openai-codex/gpt-5.5", |
| 215 | + modelOverride: { primary: "openai-codex/gpt-5.5" }, |
| 216 | + }, |
| 217 | + }, |
| 218 | + } as unknown as OpenClawConfig; |
| 219 | + |
| 220 | + const orphans = findModelRefsWithoutAuth( |
| 221 | + cfg, |
| 222 | + new Set(["openai-codex", "anthropic"]), |
| 223 | + ); |
| 224 | + |
| 225 | + expect(orphans).toEqual([]); |
| 226 | + }); |
| 227 | + |
| 228 | + it("invariant detects orphan refs after a hypothetical bad migration", () => { |
| 229 | + const corruptedCfg: OpenClawConfig = { |
| 230 | + agents: { |
| 231 | + defaults: { |
| 232 | + model: "openai/gpt-5.5", |
| 233 | + modelOverride: { |
| 234 | + primary: "openai/gpt-5.5", |
| 235 | + fallbacks: ["openai/gpt-5.4"], |
| 236 | + }, |
| 237 | + }, |
| 238 | + }, |
| 239 | + } as unknown as OpenClawConfig; |
| 240 | + |
| 241 | + const orphans = findModelRefsWithoutAuth( |
| 242 | + corruptedCfg, |
| 243 | + new Set(["openai-codex", "anthropic"]), |
| 244 | + ); |
| 245 | + |
| 246 | + expect(orphans).toEqual( |
| 247 | + expect.arrayContaining([ |
| 248 | + expect.stringContaining("openai/gpt-5.5"), |
| 249 | + expect.stringContaining("openai/gpt-5.4"), |
| 250 | + ]), |
| 251 | + ); |
| 252 | + }); |
| 253 | +}); |
0 commit comments