aki-pro-max 2.3.3 → 2.3.4

package/test/web-session-builder.test.mjs

@@ -1,124 +0,0 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { loadConfig, webSessionUrl } from '../src/config.mjs';
-import { normalizeOpenAIRequest } from '../src/openai.mjs';
-import { buildPostmanRequest } from '../src/postman-request.mjs';
-import { buildWebSessionTextRequest } from '../src/web-session-request.mjs';
-import { createProviderServer } from '../src/server.mjs';
-import { listen, request } from './helpers.mjs';
-
-const base = {
-  PROVIDER_API_KEY: 'facade-test-dummy',
-  PROVIDER_MODELS: 'public-model',
-  POSTMAN_TRANSPORT_STRATEGY: 'web_session',
-  POSTMAN_SESSION_COOKIE: 'session-test-dummy',
-  POSTMAN_WORKSPACE_SUBDOMAIN: 'team-7',
-  POSTMAN_WORKSPACE_ID: 'workspace-test-dummy',
-  POSTMAN_WEB_SESSION_SELECTED_MODEL: 'UPSTREAM_PIN_TEST',
-  MAX_BODY_BYTES: '4096',
-};
-const config = () => loadConfig(base);
-const normalized = (body = {}) => normalizeOpenAIRequest({ model: 'public-model', messages: [{ role: 'system', content: 'be exact' }, { role: 'user', content: 'hello' }], ...body }, config());
-
-test('web_session config derives one exact HTTPS Postman chat URL', () => {
-  const c = config();
-  const url = webSessionUrl(c);
-  assert.equal(url.href, 'https://team-7.postman.co/_gw/chat');
-  assert.equal(url.origin, 'https://team-7.postman.co');
-  assert.equal(url.hostname, 'team-7.postman.co');
-});
-
-test('strategy is closed, web-session fields require explicit strategy, and credentials are exclusive', () => {
-  assert.throws(() => loadConfig({ ...base, POSTMAN_TRANSPORT_STRATEGY: 'other' }), /must be access_token or web_session/);
-  const { POSTMAN_TRANSPORT_STRATEGY, ...implicit } = base;
-  assert.throws(() => loadConfig(implicit), /STRATEGY is required/);
-  assert.throws(() => loadConfig({ ...base, POSTMAN_ACCESS_TOKEN: 'token-test-dummy' }), /web_session forbids/);
-  assert.throws(() => loadConfig({ ...base, POSTMAN_ORIGIN: 'https:\/\/gateway.example.test' }), /web_session forbids/);
-  assert.throws(() => loadConfig({ ...base, POSTMAN_CHAT_PATH: '/chat' }), /web_session forbids/);
-  const legacy = loadConfig({ PROVIDER_API_KEY: 'a', PROVIDER_MODELS: 'm', POSTMAN_ACCESS_TOKEN: 'b', POSTMAN_WORKSPACE_ID: 'w', POSTMAN_ORIGIN: 'https://gateway.example.test' });
-  assert.equal(legacy.transportStrategy, 'access_token');
-  assert.equal(legacy.transportStrategyExplicit, false);
-});
-
-test('cookie and subdomain reject injection, whole-cookie syntax, lookalikes, and bounds', () => {
-  for (const value of ['x\rY: z', 'x\ny', 'x y', 'x;y', 'x,y', 'x\\y', '\0x', 'é', 'x'.repeat(4097)]) assert.throws(() => loadConfig({ ...base, POSTMAN_SESSION_COOKIE: value }), /POSTMAN_SESSION_COOKIE/);
-  assert.equal(loadConfig({ ...base, POSTMAN_SESSION_COOKIE: 'x'.repeat(4096) }).webSessionCookie.length, 4096);
-  for (const value of ['foo.bar', 'foo.postman.co', 'postman.co', 'foo%2ebar', 'Foo', 'foo_bar', '-foo', 'foo-', 'foo/', 'foo/bar', 'foo:443', 'foo:80', 'foo@bar', 'xn--fsq', 'é', 'x'.repeat(64)]) assert.throws(() => loadConfig({ ...base, POSTMAN_WORKSPACE_SUBDOMAIN: value }), /POSTMAN_WORKSPACE_SUBDOMAIN/);
-});
-
-test('pure builder returns exact allowlisted URL/init and keeps facade/token headers separate', () => {
-  const raw = buildWebSessionTextRequest(normalized(), config());
-  assert.equal(raw.url.href, 'https://team-7.postman.co/_gw/chat');
-  assert.equal(raw.init.method, 'POST');
-  assert.equal(raw.init.redirect, 'error');
-  assert.deepEqual(Object.keys(raw.init.headers).sort(), ['accept', 'content-type', 'cookie', 'origin', 'referer', 'user-agent', 'x-pstmn-req-service'].sort());
-  assert.equal(raw.init.headers.cookie, 'postman.sid=session-test-dummy');
-  assert.equal(raw.init.headers.origin, 'https://team-7.postman.co');
-  assert.equal(raw.init.headers.referer, 'https://team-7.postman.co/');
-  assert.equal(raw.init.headers.authorization, undefined);
-  assert.equal(raw.init.headers['x-access-token'], undefined);
-  assert.equal(JSON.stringify(raw).includes('facade-test-dummy'), false);
-});
-
-test('body is deterministic, config-owned, fresh text-only, and does not mutate caller input', () => {
-  const source = { model: 'public-model', messages: [{ role: 'user', content: 'hello' }], platform: 'ATTACK', workspaceId: 'ATTACK', conversationId: 'ATTACK', cookie: 'ATTACK', origin: 'ATTACK', selectedModel: 'ATTACK', devModeOptions: { selectedModel: 'ATTACK' } };
-  const before = structuredClone(source);
-  const c = config();
-  const request = normalizeOpenAIRequest(source, c);
-  const a = buildWebSessionTextRequest(request, c);
-  const b = buildWebSessionTextRequest(request, c);
-  assert.equal(a.init.body, b.init.body);
-  assert.deepEqual(source, before);
-  const body = JSON.parse(a.init.body);
-  assert.equal(body.platform, 'WEB');
-  assert.equal(body.mandatoryContext.workspaceId, 'workspace-test-dummy');
-  assert.equal(body.input.conversationId, null);
-  assert.equal(body.devModeOptions.selectedModel, 'UPSTREAM_PIN_TEST');
-  assert.equal(body.devModeOptions.isParallelToolCallingSupported, false);
-  assert.deepEqual(body.clientTools, { native: [] });
-  assert.equal(a.init.body.includes('ATTACK'), false);
-  const query = JSON.parse(body.input.query);
-  assert.equal(query.format, 'openai-full-history-v1');
-  assert.deepEqual(query.messages, [{ role: 'user', content: 'hello' }]);
-});
-
-test('web-session builder advertises tools, preserves assistant tool history, and rejects uncorrelated results and named tool choice', () => {
-  const c = config();
-  const tool = { type: 'function', function: { name: 'lookup', parameters: { type: 'object', properties: {} } } };
-  const built=buildWebSessionTextRequest(normalizeOpenAIRequest({ model: 'public-model', messages: [{ role: 'user', content: 'x' }], tools: [tool] }, c), c);
-  assert.deepEqual(JSON.parse(built.init.body).clientTools.thirdParty['proxy-tools'].tools.map(value=>value.name), ['openai__lookup']);
-  const fake = { ...normalized(), messages: [{ role: 'assistant', content: '', tool_calls: [{ id: 'x' }] }], toolChoice: 'none' };
-  const historyBody=JSON.parse(buildWebSessionTextRequest(fake, c).init.body);
-  const historyQuery=JSON.parse(historyBody.input.query);
-  assert.equal(historyQuery.messages[0].role,'assistant');
-  assert.equal(historyQuery.messages[0].tool_calls[0].id,'x');
-  assert.throws(() => buildWebSessionTextRequest({ ...normalized(), toolResults: [{ toolCallId: 'x', content: 'y' }] }, c), error=>error.code==='unknown_tool_call');
-  assert.throws(() => buildWebSessionTextRequest({ ...normalized(), toolChoice: {type:'function',name:'lookup'} }, c), /named tool_choice/);
-});
-
-test('serialized body obeys MAX_BODY_BYTES and optional app version is validated/allowlisted', () => {
-  const c = loadConfig({ ...base, MAX_BODY_BYTES: '1024', POSTMAN_APP_VERSION: 'app-test-1' });
-  const raw = buildWebSessionTextRequest(normalizeOpenAIRequest({ model: 'public-model', messages: [{ role: 'user', content: 'ok' }] }, c), c);
-  assert.equal(raw.init.headers['x-app-version'], 'app-test-1');
-  assert.throws(() => buildWebSessionTextRequest(normalizeOpenAIRequest({ model: 'public-model', messages: [{ role: 'user', content: 'x'.repeat(2000) }] }, c), c), error => error.code === 'request_too_large' && error.status === 413);
-  assert.throws(() => loadConfig({ ...base, POSTMAN_APP_VERSION: 'bad\r\nheader' }), /POSTMAN_APP_VERSION/);
-});
-
-test('existing live request dispatcher rejects web_session before fetch/event parsing', () => {
-  assert.throws(() => buildPostmanRequest(normalized(), config()), error => error.code === 'web_session_transport_not_active' && error.status === 400);
-});
-
-test('provider server activates web_session only when the explicit strategy is configured', async () => {
-  const c = { ...config(), timeoutMs: 1000, maxConcurrent: 1, correlationPendingTtlMs: 1000, correlationTerminalTtlMs: 1000, correlationInflightTtlMs: 1000, correlationMaxGroups: 10, correlationMaxCalls: 10, correlationMaxBytes: 4096, maxEventBytes: 4096, maxOutputBytes: 4096, maxToolArgumentBytes: 1024, maxToolResultBytes: 1024, exposeHealthDetails: false };
-  let fetchCalls = 0;
-  const server = createProviderServer(c, { fetchImpl: async () => { fetchCalls++; return new Response('data: {"eventType":"textChunk","data":{"textContent":"active"}}\n\ndata: [DONE]\n\n', { status: 200, headers: { 'content-type': 'text/event-stream' } }); }, logger: { error() {} } });
-  const baseUrl = await listen(server);
-  try {
-    const response = await request(baseUrl, '/v1/chat/completions', { method: 'POST', token: 'facade-test-dummy', body: { model: 'public-model', messages: [{ role: 'user', content: 'hello' }] } });
-    assert.equal(response.status, 200);
-    assert.equal((await response.json()).choices[0].message.content, 'active');
-    assert.equal(fetchCalls, 1);
-  } finally {
-    await new Promise(resolve => server.close(resolve));
-  }
-});

package/test/web-session-events.test.mjs

@@ -1,241 +0,0 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { createWebSessionEventParser } from '../src/web-session-events.mjs';
-
-const encoder = new TextEncoder();
-const bytes = value => encoder.encode(value);
-const jsonFrame = (value, options = {}) => {
-  const payload = JSON.stringify(value);
-  const lines = options.splitDataAt === undefined
-    ? [`data: ${payload}`]
-    : [`data: ${payload.slice(0, options.splitDataAt)}`, `data:${payload.slice(options.splitDataAt)}`];
-  return `${options.event ? `event: ${options.event}\n` : ''}${lines.join('\n')}\n\n`;
-};
-const make = options => createWebSessionEventParser({ maxEventBytes: 4096, maxOutputBytes: 4096, maxObservationBytes: 256, maxEvents: 32, requestedModel: 'public-model', selectedUpstreamModel: 'SELECTED_PIN', allowedObservedModels: ['OBSERVED_PIN'], ...options });
-const feedPieces = (parser, source, cuts) => {
-  const encoded = bytes(source);
-  let start = 0;
-  for (const end of cuts) { parser.feed(encoded.slice(start, end)); start = end; }
-  if (start < encoded.length) parser.feed(encoded.slice(start));
-  return parser.end();
-};
-const throwsCode = (fn, code) => assert.throws(fn, error => error?.code === code && !String(error?.upstreamDetail?.message ?? '').includes('secret-test-value'));
-
-test('fragmented UTF-8, CRLF boundaries, source-backed progress, observations, and explicit DONE succeed', () => {
-  const parser = make();
-  const source = [
-    jsonFrame({ eventType: 'conversation', data: { id: 'conversation-1' } }).replaceAll('\n', '\r\n'),
-    jsonFrame({ eventType: 'planningChunk', data: {} }),
-    jsonFrame({ eventType: 'progressUpdate', data: {} }),
-    jsonFrame({ eventType: 'todoChunk', data: {} }),
-    jsonFrame({ eventType: 'streamingFormat', data: {} }),
-    jsonFrame({ eventType: 'thinkingComplete', data: {} }),
-    jsonFrame({ eventType: 'usage', data: { usageState: 'AVAILABLE', inputTokens: 2, outputTokens: 3, totalTokens: 5 } }),
-    jsonFrame({ eventType: 'textChunk', data: { textContent: 'héllo 🌍', metadata: { model: 'OBSERVED_PIN' } } }),
-    'data: [DONE]\n\n',
-  ].join('');
-  const encoded = bytes(source);
-  const emoji = bytes('🌍');
-  const emojiAt = Buffer.from(encoded).indexOf(Buffer.from(emoji));
-  const result = feedPieces(parser, source, [1, 7, 19, emojiAt + 1, emojiAt + 3, encoded.length - 2]);
-  assert.equal(result.outcome, 'complete_explicit');
-  assert.equal(result.successful, true);
-  assert.equal(result.text, 'héllo 🌍');
-  assert.equal(result.error, null);
-  assert.deepEqual(result.observations.usage, { prompt_tokens: 2, completion_tokens: 3, total_tokens: 5, estimated: false });
-  assert.equal(result.observations.conversationId, 'conversation-1');
-  assert.equal(result.observations.requestedModel, 'public-model');
-  assert.equal(result.observations.selectedUpstreamModel, 'SELECTED_PIN');
-  assert.equal(result.observations.observedUpstreamModel, 'OBSERVED_PIN');
-  assert.equal(result.observations.modelVerification, 'matched');
-  assert.equal(result.observations.parserBufferComplete, true);
-  assert.deepEqual(result.observations.eventTypes, ['conversation', 'planningChunk', 'progressUpdate', 'todoChunk', 'streamingFormat', 'thinkingComplete', 'usage', 'textChunk']);
-});
-
-test('multiple data lines form one JSON payload and an absent model observation stays unobserved', () => {
-  const event = { eventType: 'textChunk', data: { textContent: 'split' } };
-  const frame = jsonFrame(event, { splitDataAt: JSON.stringify(event).indexOf(',') + 1 });
-  const parser = make();
-  parser.feed(bytes(frame));
-  parser.feed(bytes('data: [DONE]\n\n'));
-  const result = parser.end();
-  assert.equal(result.text, 'split');
-  assert.equal(result.successful, true);
-  assert.equal(result.observations.observedUpstreamModel, null);
-  assert.equal(result.observations.modelVerification, 'unobserved');
-});
-
-test('EOF after terminated text frame is explicitly ambiguous and exposes text without successful final', () => {
-  const parser = make();
-  parser.feed(bytes(jsonFrame({ eventType: 'textChunk', data: { textContent: 'partial answer' } })));
-  const result = parser.end();
-  assert.equal(result.outcome, 'ambiguous_eof');
-  assert.equal(result.successful, false);
-  assert.equal(result.text, 'partial answer');
-  assert.equal(result.error.code, 'upstream_completion_ambiguous');
-  assert.equal(result.observations.parserBufferComplete, true);
-});
-
-test('partial final line, partial frame, and partial UTF-8 EOF never silently flush or succeed', () => {
-  const partialLine = make();
-  partialLine.feed(bytes('data: {"eventType":"textChunk","data":{"textContent":"x"}}'));
-  let result = partialLine.end();
-  assert.equal(result.outcome, 'incomplete_truncated');
-  assert.equal(result.text, '');
-  assert.equal(result.error.code, 'upstream_incomplete_stream');
-
-  const partialFrame = make();
-  partialFrame.feed(bytes('data: {"eventType":"textChunk","data":{"textContent":"x"}}\n'));
-  result = partialFrame.end();
-  assert.equal(result.outcome, 'incomplete_truncated');
-  assert.equal(result.text, '');
-  assert.equal(result.error.code, 'upstream_incomplete_stream');
-
-  const partialUtf8 = make();
-  const encoded = bytes(jsonFrame({ eventType: 'textChunk', data: { textContent: '🌍' } }));
-  const emojiAt = Buffer.from(encoded).indexOf(Buffer.from(bytes('🌍')));
-  partialUtf8.feed(encoded.slice(0, emojiAt + 2));
-  result = partialUtf8.end();
-  assert.equal(result.outcome, 'incomplete_truncated');
-  assert.equal(result.successful, false);
-  assert.equal(result.error.code, 'upstream_invalid_utf8');
-});
-
-test('empty/metadata-only EOF is incomplete and exact DONE may complete an otherwise empty stream', () => {
-  let parser = make();
-  assert.equal(parser.end().outcome, 'incomplete_empty');
-  parser = make();
-  parser.feed(bytes(jsonFrame({ eventType: 'ping', data: {} })));
-  assert.equal(parser.end().outcome, 'incomplete_empty');
-  parser = make();
-  parser.feed(bytes('data: [DONE]\n\n'));
-  const result = parser.end();
-  assert.equal(result.outcome, 'complete_explicit');
-  assert.equal(result.successful, true);
-  assert.equal(result.text, '');
-});
-
-test('captures conversation identifiers repeated on non-conversation chunks', () => {
-  const parser = make();
-  parser.feed(bytes(jsonFrame({ eventType: 'textChunk', data: { textContent: 'ok', metadata: { conversationId: 'conversation-late' } } })));
-  parser.feed(bytes('data: [DONE]\n\n'));
-  const result = parser.end();
-  assert.equal(result.observations.conversationId, 'conversation-late');
-});
-
-test('unknown events, malformed tool fragments, loop approval, malformed JSON, invalid event values, and invalid terminal forms fail closed', () => {
-  const cases = [
-    [jsonFrame({ eventType: 'futureChunk', data: {} }), 'upstream_unverified_event_shape'],
-    [jsonFrame({ eventType: 'toolCallChunk', data: { secret: 'secret-test-value' } }), 'upstream_tool_fragment_error'],
-    [jsonFrame({ eventType: 'loopApprovalChunk', data: { message: 'secret-test-value' } }), 'upstream_web_session_loop_approval_unsupported'],
-    ['data: {bad json secret-test-value}\n\n', 'upstream_invalid_json'],
-    ['data: []\n\n', 'upstream_invalid_event'],
-    ['event: completion\ndata: [DONE]\n\n', 'upstream_invalid_terminal'],
-  ];
-  for (const [source, code] of cases) {
-    const parser = make();
-    throwsCode(() => parser.feed(bytes(source)), code);
-    const result = parser.end();
-    assert.equal(result.successful, false);
-    assert.equal(result.error.code, code);
-    assert.equal(JSON.stringify(result).includes('secret-test-value'), false);
-  }
-});
-
-test('failure and credit states after text preserve bounded text but never become successful', () => {
-  for (const [event, code] of [
-    [{ eventType: 'failure', data: { message: 'secret-test-value' } }, 'upstream_gateway_failure'],
-    [{ eventType: 'error', data: { error: 'secret-test-value' } }, 'upstream_gateway_failure'],
-    [{ eventType: 'usage', data: { usageState: 'BLOCKED' } }, 'upstream_credit_blocked'],
-    [{ eventType: 'usage', data: { usageState: 'MYSTERY' } }, 'upstream_unknown_credit_state'],
-  ]) {
-    const parser = make();
-    parser.feed(bytes(jsonFrame({ eventType: 'textChunk', data: { textContent: 'visible' } })));
-    throwsCode(() => parser.feed(bytes(jsonFrame(event))), code);
-    const result = parser.end();
-    assert.equal(result.text, 'visible');
-    assert.equal(result.successful, false);
-    assert.equal(result.error.code, code);
-    assert.equal(JSON.stringify(result).includes('secret-test-value'), false);
-  }
-});
-
-test('model requested/selected/observed remain distinct; missing mapping is unverified and exact configured mismatch fails', () => {
-  let parser = make({ allowedObservedModels: [] });
-  parser.feed(bytes(jsonFrame({ eventType: 'textChunk', data: { textContent: 'x', metadata: { model: 'UNMAPPED_OBSERVATION' } } })));
-  parser.feed(bytes('data: [DONE]\n\n'));
-  let result = parser.end();
-  assert.equal(result.successful, true);
-  assert.equal(result.observations.modelVerification, 'unverified');
-  assert.equal(result.observations.requestedModel, 'public-model');
-  assert.equal(result.observations.selectedUpstreamModel, 'SELECTED_PIN');
-  assert.equal(result.observations.observedUpstreamModel, 'UNMAPPED_OBSERVATION');
-
-  parser = make();
-  throwsCode(() => parser.feed(bytes(jsonFrame({ eventType: 'textChunk', data: { textContent: 'x', metadata: { model: 'WRONG' } } }))), 'upstream_model_mismatch');
-  result = parser.end();
-  assert.equal(result.successful, false);
-  assert.equal(result.text, '');
-  assert.equal(result.observations.modelVerification, 'mismatched');
-
-  parser = make();
-  parser.feed(bytes(jsonFrame({ eventType: 'textChunk', data: { textContent: 'visible', metadata: { model: 'OBSERVED_PIN' } } })));
-  throwsCode(() => parser.feed(bytes(jsonFrame({ eventType: 'info', data: { metadata: { model: 'WRONG' } } }))), 'upstream_model_mismatch');
-  result = parser.end();
-  assert.equal(result.text, 'visible');
-  assert.equal(result.successful, false);
-});
-
-test('event, output, observation, and parser-buffer bounds fail without silent truncation', () => {
-  let parser = make({ maxOutputBytes: 4 });
-  throwsCode(() => parser.feed(bytes(jsonFrame({ eventType: 'textChunk', data: { textContent: '12345' } }))), 'upstream_output_too_large');
-  assert.equal(parser.end().text, '');
-
-  parser = make({ maxObservationBytes: 4 });
-  throwsCode(() => parser.feed(bytes(jsonFrame({ eventType: 'conversation', data: { id: '12345' } }))), 'upstream_invalid_conversation');
-
-  parser = make({ maxEvents: 1 });
-  parser.feed(bytes(jsonFrame({ eventType: 'ping', data: {} })));
-  throwsCode(() => parser.feed(bytes(jsonFrame({ eventType: 'info', data: {} }))), 'upstream_event_count_exceeded');
-
-  parser = make({ maxEventBytes: 64 });
-  throwsCode(() => parser.feed(bytes(`data: ${'x'.repeat(80)}\n\n`)), 'upstream_event_too_large');
-});
-
-test('data after terminal, invalid bytes, wrong chunk type, and feed after end are rejected', () => {
-  let parser = make();
-  parser.feed(bytes('data: [DONE]\n\n'));
-  throwsCode(() => parser.feed(bytes(jsonFrame({ eventType: 'ping', data: {} }))), 'upstream_data_after_terminal');
-
-  parser = make();
-  parser.feed(bytes('data: [DONE]\n\ntrailing-secret-test-value'));
-  let result = parser.end();
-  assert.equal(result.successful, false);
-  assert.equal(result.error.code, 'upstream_data_after_terminal');
-  assert.equal(JSON.stringify(result).includes('secret-test-value'), false);
-
-  parser = make();
-  parser.feed(bytes('data: [DONE]\n\n'));
-  throwsCode(() => parser.feed(bytes('data: [DONE]\n\n')), 'upstream_data_after_terminal');
-
-  parser = make();
-  throwsCode(() => parser.feed(new Uint8Array([0xff])), 'upstream_invalid_utf8');
-
-  parser = make();
-  assert.throws(() => parser.feed('data: [DONE]\n\n'), /Uint8Array/);
-  parser.feed(bytes('data: [DONE]\n\n'));
-  parser.end();
-  assert.throws(() => parser.feed(bytes('')), /after end/);
-});
-
-test('502 upstream_model_mismatch carries observedModel on the error object', () => {
-  const parser = make();
-  try {
-    parser.feed(bytes(jsonFrame({ eventType: 'textChunk', data: { textContent: 'x', metadata: { model: 'REAL_WIRELABEL_CLAUDE_TEST' } } })));
-    assert.fail('should have thrown');
-  } catch (err) {
-    assert.equal(err.code, 'upstream_model_mismatch');
-    assert.equal(err.observedModel, 'REAL_WIRELABEL_CLAUDE_TEST');
-    assert.equal(err.observedModelField, 'data.metadata.model');
-  }
-});

package/test/web-session-integration.test.mjs

@@ -1,103 +0,0 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { createProviderServer } from '../src/server.mjs';
-import { loadConfig } from '../src/config.mjs';
-import { listen, request, fixture } from './helpers.mjs';
-
-const env = {
-  PROVIDER_API_KEY: 'facade-dummy-key', PROVIDER_MODELS: 'public-model',
-  POSTMAN_TRANSPORT_STRATEGY: 'web_session', POSTMAN_SESSION_COOKIE: 'dummy-cookie-value',
-  POSTMAN_WORKSPACE_SUBDOMAIN: 'fixture-team', POSTMAN_WORKSPACE_ID: 'fixture-workspace',
-  POSTMAN_WEB_SESSION_SELECTED_MODEL: 'GPT_56_SOL', POSTMAN_WEB_SESSION_OBSERVED_MODELS: 'gpt-5.6-sol',
-  REQUEST_TIMEOUT_MS: '1000', MAX_BODY_BYTES: '8192', MAX_EVENT_BYTES: '8192', MAX_OUTPUT_BYTES: '8192',
-  MAX_TOOL_ARGUMENT_BYTES: '1024', MAX_TOOL_RESULT_BYTES: '1024', MAX_TOOLS: '8', MAX_CONCURRENT_REQUESTS: '2',
-};
-const encoder = new TextEncoder();
-const response = ({ events = [], done = true, status = 200, contentType = 'text/event-stream', suffix = '' }) => {
-  const wire = events.map(event => `data: ${JSON.stringify(event)}\n\n`).join('') + (done ? 'data: [DONE]\n\n' : '') + suffix;
-  return new Response(new ReadableStream({ start(controller) { controller.enqueue(encoder.encode(wire)); controller.close(); } }), { status, headers: { 'content-type': contentType } });
-};
-async function withServer(fetchImpl, fn, override = {}) {
-  const server = createProviderServer({ ...loadConfig(env), ...override }, { fetchImpl, logger: { error() {} } });
-  const base = await listen(server);
-  try { await fn(base); } finally { await new Promise(resolve => server.close(resolve)); }
-}
-const body = stream => ({ model: 'public-model', messages: [{ role: 'user', content: 'Reply exactly.' }], stream });
-
-test('explicit web_session returns OpenAI JSON from source-derived observed-DONE fixture and isolates auth headers', async () => {
-  const source = await fixture('web-session-observed-done');
-  let capture;
-  await withServer(async (url, init) => { capture = { url: String(url), init, requestBody: JSON.parse(init.body) }; return response(source); }, async base => {
-    const result = await request(base, '/v1/chat/completions', { method: 'POST', token: 'facade-dummy-key', body: body(false) });
-    assert.equal(result.status, 200);
-    const value = await result.json();
-    assert.equal(value.choices[0].message.content, 'PROXY_OBSERVATION_OK');
-    assert.equal(value.choices[0].finish_reason, 'stop');
-    assert.equal(capture.url, 'https://fixture-team.postman.co/_gw/chat');
-    assert.equal(capture.init.headers.cookie, 'postman.sid=dummy-cookie-value');
-    assert.equal(capture.init.headers.authorization, undefined);
-    assert.equal(capture.init.headers['x-access-token'], undefined);
-    assert.equal(JSON.stringify(capture).includes('facade-dummy-key'), false);
-    assert.equal(capture.requestBody.devModeOptions.selectedModel, 'GPT_56_SOL');
-  });
-});
-
-test('explicit web_session returns OpenAI SSE with content, stop, and DONE only after proven upstream DONE', async () => {
-  const source = await fixture('web-session-observed-done');
-  await withServer(() => response(source), async base => {
-    const result = await request(base, '/v1/chat/completions', { method: 'POST', token: 'facade-dummy-key', body: body(true) });
-    assert.match(result.headers.get('content-type'), /text\/event-stream/);
-    const wire = await result.text();
-    assert.match(wire, /"content":"PROXY_OBSERVATION_OK"/);
-    assert.match(wire, /"finish_reason":"stop"/);
-    assert.match(wire, /data: \[DONE\]/);
-  });
-});
-
-test('missing model observation is allowed but configured observed mismatch fails before successful response', async () => {
-  await withServer(() => response({ events: [{ eventType: 'textChunk', data: { textContent: 'unobserved' } }] }), async base => {
-    const result = await request(base, '/v1/chat/completions', { method: 'POST', token: 'facade-dummy-key', body: body(false) });
-    assert.equal(result.status, 200); assert.equal((await result.json()).choices[0].message.content, 'unobserved');
-  });
-  await withServer(() => response({ events: [{ eventType: 'textChunk', data: { textContent: 'wrong', metadata: { model: 'other-model' } } }] }), async base => {
-    const result = await request(base, '/v1/chat/completions', { method: 'POST', token: 'facade-dummy-key', body: body(false) });
-    assert.equal(result.status, 502); assert.equal((await result.json()).error.code, 'upstream_model_mismatch');
-  });
-});
-
-test('error event, ambiguous EOF, wrong content type, and HTTP failure never become successful web_session completions', async () => {
-  const cases = [
-    [() => response({ events: [{ eventType: 'textChunk', data: { textContent: 'partial' } }, { eventType: 'error', data: { error: 'secret-upstream-value' } }] }), 502, 'upstream_gateway_failure'],
-    [() => response({ events: [{ eventType: 'textChunk', data: { textContent: 'partial' } }], done: false }), 502, 'upstream_completion_ambiguous'],
-    [() => response({ events: [], contentType: 'application/json' }), 502, 'upstream_content_type_error'],
-    [() => response({ events: [], status: 401 }), 401, 'upstream_http_error'],
-    [() => response({ events: [], status: 503 }), 503, 'upstream_http_error'],
-  ];
-  for (const [upstream, status, code] of cases) await withServer(upstream, async base => {
-    const result = await request(base, '/v1/chat/completions', { method: 'POST', token: 'facade-dummy-key', body: body(false) });
-    assert.equal(result.status, status); const wire = await result.text(); assert.equal(JSON.parse(wire).error.code, code); assert.equal(wire.includes('secret-upstream-value'), false);
-  });
-});
-
-test('web_session accepts declared tools while preserving ingress auth failure isolation', async () => {
-  let calls = 0; let capture;
-  await withServer(async (_url, init) => { calls++; capture=JSON.parse(init.body); return response({ events: [] }); }, async base => {
-    const toolBody = { ...body(false), tools: [{ type: 'function', function: { name: 'lookup', parameters: { type: 'object', properties: {} } } }] };
-    let result = await request(base, '/v1/chat/completions', { method: 'POST', token: 'facade-dummy-key', body: toolBody });
-    assert.equal(result.status, 200); assert.deepEqual(capture.clientTools.thirdParty['proxy-tools'].tools.map(tool=>tool.name), ['openai__lookup']); assert.equal(calls, 1);
-    result = await request(base, '/v1/chat/completions', { method: 'POST', token: 'wrong-key', body: body(false) });
-    assert.equal(result.status, 401); assert.equal((await result.json()).error.code, 'invalid_api_key'); assert.equal(calls, 1);
-  });
-});
-
-test('web_session propagates client abort to injected upstream', async () => {
-  let upstreamAborted = false;
-  await withServer((url, init) => new Promise((resolve, reject) => init.signal.addEventListener('abort', () => { upstreamAborted = true; reject(init.signal.reason); }, { once: true })), async base => {
-    const controller = new AbortController();
-    const pending = request(base, '/v1/chat/completions', { method: 'POST', token: 'facade-dummy-key', body: body(false), signal: controller.signal });
-    setTimeout(() => controller.abort(new DOMException('fixture abort', 'AbortError')), 20);
-    await assert.rejects(pending, error => error?.name === 'AbortError');
-    await new Promise(resolve => setTimeout(resolve, 20));
-    assert.equal(upstreamAborted, true);
-  });
-});

package/test/web-session-tools.test.mjs

@@ -1,52 +0,0 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { createProviderServer } from '../src/server.mjs';
-import { loadConfig } from '../src/config.mjs';
-import { CorrelationStore } from '../src/correlation-store.mjs';
-import { listen, request, fixture } from './helpers.mjs';
-
-const env={PROVIDER_API_KEY:'key',PROVIDER_MODELS:'m',POSTMAN_TRANSPORT_STRATEGY:'web_session',POSTMAN_SESSION_COOKIE:'dummy',POSTMAN_WORKSPACE_SUBDOMAIN:'team',POSTMAN_WORKSPACE_ID:'ws',POSTMAN_WEB_SESSION_SELECTED_MODEL:'GPT',REQUEST_TIMEOUT_MS:'1000',MAX_BODY_BYTES:'65536',MAX_EVENT_BYTES:'65536',MAX_OUTPUT_BYTES:'65536',MAX_TOOL_ARGUMENT_BYTES:'4096',MAX_TOOL_RESULT_BYTES:'4096',MAX_TOOLS:'8',MAX_CONCURRENT_REQUESTS:'4'};
-const config=loadConfig(env); const encoder=new TextEncoder();
-const sse=(events,{done=true}={})=>new Response(new ReadableStream({start(c){for(const e of events)c.enqueue(encoder.encode(`data: ${JSON.stringify(e)}\n\n`));if(done)c.enqueue(encoder.encode('data: [DONE]\n\n'));c.close();}}),{status:200,headers:{'content-type':'text/event-stream'}});
-const tools=[
- {type:'function',function:{name:'lookup',description:'Lookup',parameters:{type:'object',properties:{q:{type:'string'}},required:['q'],additionalProperties:false}}},
- {type:'function',function:{name:'count',description:'Count',parameters:{type:'object',properties:{n:{type:'integer'}},required:['n'],additionalProperties:false}}},
-];
-const body=(messages= [{role:'user',content:'use tools'}],more={})=>({model:'m',messages,tools,stream:false,...more});
-async function withServer(fetchImpl,fn,override={}){const server=createProviderServer({...config,...override},{fetchImpl,logger:{error(){}}});const base=await listen(server);try{await fn(base);}finally{await new Promise(r=>server.close(r));}}
-
-test('web_session advertises minimal catalog, buffers grouped fragments, continues with correlated TOOL_RESPONSE, and rejects replay',async()=>{
- const source=await fixture('web-session-tool-fragments'); let turn=0; const captures=[];
- await withServer(async(url,init)=>{captures.push(JSON.parse(init.body));return turn++===0?sse(source.events):sse([{eventType:'conversation',data:{id:'conv_source_fixture'}},{eventType:'textChunk',data:{textContent:'final'}}]);},async base=>{
-  const first=await request(base,'/v1/chat/completions',{method:'POST',token:'key',body:body()}); assert.equal(first.status,200); const v=await first.json(); assert.equal(v.choices[0].finish_reason,'tool_calls'); const assistant=v.choices[0].message; assert.equal(assistant.tool_calls.length,2); assert.match(assistant.tool_calls[0].id,/^call_pmn_/); assert.deepEqual(JSON.parse(assistant.tool_calls[0].function.arguments),{q:'x'}); assert.deepEqual(JSON.parse(assistant.tool_calls[1].function.arguments),{n:2});
-  assert.deepEqual(captures[0].clientTools.thirdParty['proxy-tools'].tools.map(t=>t.name),['openai__lookup','openai__count']); assert.equal(captures[0].devModeOptions.autoRun,true);
-  const continuation=body([{role:'user',content:'use tools'},assistant,{role:'tool',tool_call_id:assistant.tool_calls[0].id,content:'A'},{role:'tool',tool_call_id:assistant.tool_calls[1].id,content:'B'}]);
-  const second=await request(base,'/v1/chat/completions',{method:'POST',token:'key',body:continuation}); assert.equal(second.status,200); assert.equal((await second.json()).choices[0].message.content,'final'); assert.equal(captures[1].input.chatType,'TOOL_RESPONSE'); assert.equal(captures[1].input.toolCallGroupId,'up_group_1'); assert.equal(captures[1].input.toolCallId,'up_call_a'); assert.deepEqual(JSON.parse(captures[1].input.toolResponse).map(x=>x.toolCallId),['up_call_a','up_call_b']);
-  const replay=await request(base,'/v1/chat/completions',{method:'POST',token:'key',body:continuation}); assert.equal(replay.status,409); assert.equal((await replay.json()).error.code,'tool_call_already_consumed'); assert.equal(captures.length,2);
- });
-});
-
-test('AICoworker-style continuation preserves role=tool correlation and dispatches exactly once',async()=>{
- const source=await fixture('web-session-tool-fragments'); let turn=0; const captures=[];
- await withServer(async(url,init)=>{captures.push(JSON.parse(init.body));return turn++===0?sse(source.events):sse([{eventType:'conversation',data:{id:'conv_source_fixture'}},{eventType:'textChunk',data:{textContent:'AKI_ONCE'}}]);},async base=>{
-  const first=await request(base,'/v1/chat/completions',{method:'POST',token:'key',body:body()}); const assistant=(await first.json()).choices[0].message;
-  const continuation=body([{role:'user',content:'use tools'},assistant,{role:'tool',tool_call_id:assistant.tool_calls[0].id,content:[{type:'text',text:'A'}]},{role:'tool',tool_call_id:assistant.tool_calls[1].id,content:[{type:'text',text:'B'}]}]);
-  const second=await request(base,'/v1/chat/completions',{method:'POST',token:'key',body:continuation}); assert.equal(second.status,200); assert.equal((await second.json()).choices[0].message.content,'AKI_ONCE');
-  assert.equal(captures.length,2); assert.equal(captures[1].input.chatType,'TOOL_RESPONSE'); assert.equal(captures[1].input.toolCallId,'up_call_a'); assert.deepEqual(JSON.parse(captures[1].input.toolResponse).map(x=>x.content),['A','B']);
- });
-});
-
-test('web_session rejects bad arguments, partial group, loop approval, and ambiguous EOF before admission',async()=>{
- const cases=[
-  [[{eventType:'conversation',data:{id:'c'}},{eventType:'toolCallChunk',data:{id:'a',index:0,name:'openai__count',arguments:'{\"n\":\"bad\"}'}}],{},'upstream_tool_schema_mismatch'],
-  [[{eventType:'conversation',data:{id:'c'}},{eventType:'toolCallChunk',data:{toolCalls:[{id:'a',index:0,name:'openai__lookup',toolCallGroupId:'g',arguments:'{\"q\":\"x\"}'},{id:'b',index:1,name:'openai__count',arguments:'{\"n\":2}' }]}}],{},'upstream_ungrouped_tool_batch'],
-  [[{eventType:'loopApprovalChunk',data:{message:'approve'}}],{},'upstream_web_session_loop_approval_unsupported'],
-  [[{eventType:'conversation',data:{id:'c'}},{eventType:'toolCallChunk',data:{id:'a',index:0,name:'openai__lookup',arguments:'{\"q\":\"x\"}'}}],{done:false},'upstream_completion_ambiguous'],
- ];
- for(const [events,opts,code] of cases){let calls=0;await withServer(()=>{calls++;return sse(events,opts);},async base=>{const r=await request(base,'/v1/chat/completions',{method:'POST',token:'key',body:body()});const expectedStatus=code==='upstream_web_session_loop_approval_unsupported'?400:502;assert.equal(r.status,expectedStatus);assert.equal((await r.json()).error.code,code);assert.equal(calls,1);});}
-});
-
-test('correlation binds principal, strategy and origin without mutating pending record',()=>{
- const store=new CorrelationStore(); const common={principalId:'p',workspaceId:'ws',model:'m',transportStrategy:'web_session',transportOrigin:'https://team.postman.co',conversationId:'c',transcript:[{role:'user',content:'u'},{role:'assistant',content:'',tool_calls:[{id:'up',type:'function',function:{name:'lookup',arguments:'{\"q\":\"x\"}'}}]}],toolsBinding:{tools:[tools[0]],toolChoice:'auto'},catalogMetadata:{strategy:'web_session'},calls:[{upstreamToolCallId:'up',upstreamGroupId:null,originalName:'lookup',argumentsJson:'{\"q\":\"x\"}',schemaHash:'s'}]}; const g=store.admit(common); const result=[{toolCallId:g.calls[0].publicToolCallId,content:'ok'}]; const claim={principalId:'p',results:result,workspaceId:'ws',model:'m',transportStrategy:'web_session',transportOrigin:'https://team.postman.co',transcript:g.transcript,toolsBinding:common.toolsBinding,catalogMetadata:common.catalogMetadata};
- assert.throws(()=>store.claim({...claim,transportStrategy:'access_token'}),e=>e.code==='continuation_strategy_mismatch'); assert.equal(g.state,'PENDING'); assert.throws(()=>store.claim({...claim,transportOrigin:'https://other.postman.co'}),e=>e.code==='continuation_origin_mismatch'); assert.equal(g.state,'PENDING'); assert.throws(()=>store.claim({...claim,principalId:'other'}),e=>e.code==='unknown_tool_call');
-});