create-workframe 0.1.5 → 0.1.7

package/workframe-api/test_ensure_native_profile.py

@@ -0,0 +1,29 @@
+"""ponytail self-check: empty Hermes data must seed workframe-agent for gateway boot.
+
+Run: python services/workframe-api/test_ensure_native_profile.py
+"""
+import json
+import os
+import sys
+import tempfile
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import server  # noqa: E402
+
+td = Path(tempfile.mkdtemp())
+os.environ["HERMES_DATA"] = str(td)
+server.HERMES_DATA = td
+server.ROUTES_JSON = td / "workframe" / "routes.json"
+
+slug = server._native_profile_slug()
+assert slug == "workframe-agent"
+assert not server._native_profile_present()
+assert server._seed_native_profile_on_disk(slug)
+assert server._native_profile_present()
+assert (td / "profiles" / slug / "config.yaml").is_file()
+routes = json.loads((td / "workframe" / "routes.json").read_text(encoding="utf-8"))
+assert any(row.get("profile") == slug for row in routes.get("routes", []))
+
+print("ensure native profile self-check ok")

package/workframe-api/test_oauth_llm.py

@@ -0,0 +1,58 @@
+"""ponytail self-check: OAuth LLM providers (Codex/Nous) must pass chat gates without API keys.
+
+Run: python services/workframe-api/test_oauth_llm.py
+"""
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import server  # noqa: E402
+
+keys = server._hermes_oauth_auth_keys("openai-codex")
+assert "openai-codex" in keys
+assert "codex" in keys
+assert "openai_codex" in keys
+
+pool_only = {
+    "version": 1,
+    "providers": {},
+    "credential_pool": {"openai-codex": [{"id": "x", "auth_type": "oauth"}]},
+}
+assert server._auth_json_has_oauth_material(pool_only)
+
+# credential_pool-only auth must merge into profile auth
+merged: dict = {"version": 1, "providers": {}, "credential_pool": {}}
+assert server._merge_oauth_auth_into_profile(merged, pool_only, "openai-codex")
+assert merged["credential_pool"].get("openai-codex")
+
+# Without live tokens require path must fail
+try:
+    server._require_runtime_owner_provider("user-1", "ws-1", "codex")
+    raise AssertionError("expected ValueError without oauth tokens")
+except ValueError:
+    pass
+
+_orig = server._hermes_oauth_tokens_present
+
+
+def _fake_present(_user: str, _auth_id: str) -> bool:
+    return True
+
+
+server._hermes_oauth_tokens_present = _fake_present
+try:
+    resolved = server._require_runtime_owner_provider(
+        "550e8400-e29b-41d4-a716-446655440000",
+        "ws-1",
+        "codex",
+    )
+    assert resolved.get("credential_type") == "oauth"
+    assert resolved.get("credential_ref") == "oauth:openai-codex"
+finally:
+    server._hermes_oauth_tokens_present = _orig
+
+mvp = server.PROVIDER_MVP_MODELS["codex"]["primary"]
+assert mvp == "gpt-5.4-medium"
+
+print("oauth llm self-check ok")

package/workframe-api/test_provider_model_surface.py

@@ -0,0 +1,31 @@
+"""ponytail: connected providers → model offers → billing alignment.
+
+Run: python services/workframe-api/test_provider_model_surface.py
+"""
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import server  # noqa: E402
+
+codex_rows = server._model_catalog_rows_for_provider("codex")
+codex_models = {row["model"] for row in codex_rows}
+assert "gpt-5.4-medium" in codex_models, codex_models
+assert "gpt-5.4-mini" in codex_models, codex_models
+assert all("gemini" not in m for m in codex_models)
+
+assert server._resolve_billing_provider_for_model("gpt-5.4-mini", {"codex"}) == "codex"
+assert server._resolve_billing_provider_for_model("google/gemini-2.5-flash", {"codex"}) == ""
+assert server._resolve_billing_provider_for_model(
+    "google/gemini-2.5-flash", {"openrouter"}
+) == "openrouter"
+
+stack = server._suggestions_for_connected_llm_providers({"codex", "openrouter"})
+models = {row["model"] for row in stack}
+assert "gpt-5.4-medium" in models
+assert any(m.startswith("google/") for m in models)
+
+assert server._billing_provider_id_from_hermes_config("openai-codex") == "codex"
+
+print("provider model surface self-check ok")

package/workframe-api/test_stack_config_install_smtp.py

@@ -0,0 +1,51 @@
+"""ponytail: install window must ignore compose SMTP env (clean install, not migration).
+
+Run: python services/workframe-api/test_stack_config_install_smtp.py
+"""
+import os
+import sys
+import tempfile
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+import stack_config  # noqa: E402
+
+td = Path(tempfile.mkdtemp())
+stack_config.DATA_DIR = td
+stack_config.CONFIG_PATH = td / "stack_config.json"
+
+os.environ["SMTP_HOST"] = "smtp.ghost.example"
+os.environ["SMTP_USER"] = "ghost@example.com"
+os.environ["SMTP_PASS"] = "secret"
+
+# Fresh install: no stack file, install window open → env ignored
+assert stack_config._install_window_open()
+resolved = stack_config.resolved_smtp()
+assert resolved.get("source") == "none", resolved
+assert not stack_config.smtp_configured()
+
+# Wizard saves SMTP to stack file
+stack_config.patch_stack_config(
+    {
+        "smtp": {
+            "host": "smtp.wizard.example",
+            "port": 587,
+            "user": "admin@wizard.example",
+            "password": "wizard-pass",
+            "from": "admin@wizard.example",
+        }
+    }
+)
+resolved = stack_config.resolved_smtp()
+assert resolved.get("host") == "smtp.wizard.example", resolved
+assert resolved.get("source") == "stack_config", resolved
+
+# After install complete, env wins for ops overrides
+stack_config.patch_stack_config({"install_complete": True})
+assert not stack_config._install_window_open()
+resolved = stack_config.resolved_smtp()
+assert resolved.get("host") == "smtp.ghost.example", resolved
+assert resolved.get("source") == "env", resolved
+
+print("stack_config install-window smtp self-check ok")

package/workframe-api/time-bind-chat.py

@@ -1,99 +1,99 @@
-#!/usr/bin/env python3
-"""Time bind + credential lease on running workframe-api (docker exec)."""
-from __future__ import annotations
-
-import sqlite3
-import sys
-import time
-
-import server
-
-
-def main() -> int:
-    conn = sqlite3.connect(str(server.DATA_DIR / "workframe.db"))
-    conn.row_factory = sqlite3.Row
-    room = conn.execute(
-        """
-        SELECT r.id, r.workspace_id, r.agent_profile_id, ap.slug AS agent_slug
-        FROM rooms r
-        JOIN agent_profiles ap ON ap.id = r.agent_profile_id
-        JOIN room_memberships rm ON rm.room_id = r.id AND rm.status = 'active'
-        WHERE r.room_type = 'direct' AND r.deleted_at IS NULL
-          AND ap.slug = 'workframe-agent'
-        ORDER BY r.updated_at DESC
-        LIMIT 1
-        """,
-    ).fetchone()
-    if not room:
-        print("no workframe-agent room", file=sys.stderr)
-        return 1
-    user = conn.execute(
-        """
-        SELECT u.id FROM users u
-        JOIN room_memberships rm ON rm.user_id = u.id AND rm.room_id = ?
-        WHERE u.status = 'active'
-        LIMIT 1
-        """,
-        (str(room["id"]),),
-    ).fetchone()
-    conn.close()
-    if not room or not user:
-        print("no room/user", file=sys.stderr)
-        return 1
-
-    user_id = str(user["id"])
-    room_id = str(room["id"])
-    workspace_id = str(room["workspace_id"])
-    payload = {
-        "room_id": room_id,
-        "workspace_id": workspace_id,
-        "source_id": "timing",
-        "client_id": "timing",
-        "binding_version": 2,
-    }
-
-    t_rt = time.perf_counter()
-    prof = server._resolve_chat_hermes_profile("workframe-agent", user_id, room_id, workspace_id)
-    rt_ms = (time.perf_counter() - t_rt) * 1000
-    print(f"resolve_runtime_ms={rt_ms:.0f} profile={prof}")
-
-    provider = server._llm_billing_provider(prof)
-    t_api = time.perf_counter()
-    server.ensure_profile_api(prof, user_id, workspace_id)
-    api_ms = (time.perf_counter() - t_api) * 1000
-    t_llm = time.perf_counter()
-    server._overlay_chat_llm_env(prof, user_id, workspace_id, provider)
-    llm_ms = (time.perf_counter() - t_llm) * 1000
-    print(f"ensure_profile_api_ms={api_ms:.0f} overlay_llm_ms={llm_ms:.0f}")
-
-    t0 = time.perf_counter()
-    session = server.profile_chat_session("workframe-agent", payload, user_id=user_id)
-    session_ms = (time.perf_counter() - t0) * 1000
-    sid = str(session.get("session_id") or "")
-    print(f"session_ms={session_ms:.0f} session={sid[:40]}")
-
-    t_hist = time.perf_counter()
-    history = server.chat_messages(prof, sid)
-    hist_ms = (time.perf_counter() - t_hist) * 1000
-    print(f"history_ms={hist_ms:.0f} messages={len(history.get('messages') or [])}")
-
-    healthy = server._profile_api_healthy(prof)
-    print(f"profile_api_healthy={healthy} port={server._profile_api_port(prof)}")
-
-    run_a = "timing-run-a"
-    run_b = "timing-run-b"
-    t1 = time.perf_counter()
-    server._apply_turn_credential_lease(prof, user_id, workspace_id, provider, run_a)
-    lease1_ms = (time.perf_counter() - t1) * 1000
-    t2 = time.perf_counter()
-    server._apply_turn_credential_lease(prof, user_id, workspace_id, provider, run_b)
-    lease2_ms = (time.perf_counter() - t2) * 1000
-    print(f"lease_cold_ms={lease1_ms:.0f} lease_reuse_ms={lease2_ms:.0f} provider={provider}")
-
-    _, model = server._read_model_from_config(prof)
-    print(f"model={model}")
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
+#!/usr/bin/env python3
+"""Time bind + credential lease on running workframe-api (docker exec)."""
+from __future__ import annotations
+
+import sqlite3
+import sys
+import time
+
+import server
+
+
+def main() -> int:
+    conn = sqlite3.connect(str(server.DATA_DIR / "workframe.db"))
+    conn.row_factory = sqlite3.Row
+    room = conn.execute(
+        """
+        SELECT r.id, r.workspace_id, r.agent_profile_id, ap.slug AS agent_slug
+        FROM rooms r
+        JOIN agent_profiles ap ON ap.id = r.agent_profile_id
+        JOIN room_memberships rm ON rm.room_id = r.id AND rm.status = 'active'
+        WHERE r.room_type = 'direct' AND r.deleted_at IS NULL
+          AND ap.slug = 'workframe-agent'
+        ORDER BY r.updated_at DESC
+        LIMIT 1
+        """,
+    ).fetchone()
+    if not room:
+        print("no workframe-agent room", file=sys.stderr)
+        return 1
+    user = conn.execute(
+        """
+        SELECT u.id FROM users u
+        JOIN room_memberships rm ON rm.user_id = u.id AND rm.room_id = ?
+        WHERE u.status = 'active'
+        LIMIT 1
+        """,
+        (str(room["id"]),),
+    ).fetchone()
+    conn.close()
+    if not room or not user:
+        print("no room/user", file=sys.stderr)
+        return 1
+
+    user_id = str(user["id"])
+    room_id = str(room["id"])
+    workspace_id = str(room["workspace_id"])
+    payload = {
+        "room_id": room_id,
+        "workspace_id": workspace_id,
+        "source_id": "timing",
+        "client_id": "timing",
+        "binding_version": 2,
+    }
+
+    t_rt = time.perf_counter()
+    prof = server._resolve_chat_hermes_profile("workframe-agent", user_id, room_id, workspace_id)
+    rt_ms = (time.perf_counter() - t_rt) * 1000
+    print(f"resolve_runtime_ms={rt_ms:.0f} profile={prof}")
+
+    provider = server._llm_billing_provider(prof)
+    t_api = time.perf_counter()
+    server.ensure_profile_api(prof, user_id, workspace_id)
+    api_ms = (time.perf_counter() - t_api) * 1000
+    t_llm = time.perf_counter()
+    server._overlay_chat_llm_env(prof, user_id, workspace_id, provider)
+    llm_ms = (time.perf_counter() - t_llm) * 1000
+    print(f"ensure_profile_api_ms={api_ms:.0f} overlay_llm_ms={llm_ms:.0f}")
+
+    t0 = time.perf_counter()
+    session = server.profile_chat_session("workframe-agent", payload, user_id=user_id)
+    session_ms = (time.perf_counter() - t0) * 1000
+    sid = str(session.get("session_id") or "")
+    print(f"session_ms={session_ms:.0f} session={sid[:40]}")
+
+    t_hist = time.perf_counter()
+    history = server.chat_messages(prof, sid)
+    hist_ms = (time.perf_counter() - t_hist) * 1000
+    print(f"history_ms={hist_ms:.0f} messages={len(history.get('messages') or [])}")
+
+    healthy = server._profile_api_healthy(prof)
+    print(f"profile_api_healthy={healthy} port={server._profile_api_port(prof)}")
+
+    run_a = "timing-run-a"
+    run_b = "timing-run-b"
+    t1 = time.perf_counter()
+    server._apply_turn_credential_lease(prof, user_id, workspace_id, provider, run_a)
+    lease1_ms = (time.perf_counter() - t1) * 1000
+    t2 = time.perf_counter()
+    server._apply_turn_credential_lease(prof, user_id, workspace_id, provider, run_b)
+    lease2_ms = (time.perf_counter() - t2) * 1000
+    print(f"lease_cold_ms={lease1_ms:.0f} lease_reuse_ms={lease2_ms:.0f} provider={provider}")
+
+    _, model = server._read_model_from_config(prof)
+    print(f"model={model}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())