fix: block code agent non-2xx readiness

2026-05-23 02:39:41 +00:00
parent 892a0276bd
commit 6961baedb7
8 changed files with 722 additions and 157 deletions
@@ -2,9 +2,14 @@ import assert from "node:assert/strict";
 import test from "node:test";

 import {
+  classifyCodeAgentBrowserJourney,
  classifyLiveDeploymentIdentity,
-  classifyLiveWebAssetIdentity
+  classifyLiveWebAssetIdentity,
+  sanitizeAgentChatBody
 } from "./src/dev-cloud-workbench-smoke-lib.mjs";
+import {
+  classifyCodeAgentChatReadiness
+} from "./src/code-agent-response-contract.mjs";

 const sourceIdentity = Object.freeze({
  status: "observed",
@@ -100,3 +105,133 @@ test("live web asset identity blocks stale deployed primary assets", () => {
  assert.deepEqual(stale.mismatches, ["styles.css", "app.mjs"]);
  assert.match(stale.summary, /Deployment drift/u);
 });
+
+test("Code Agent browser classifier blocks provider 502 response shapes", () => {
+  const summary = sanitizeAgentChatBody({
+    status: "completed",
+    provider: "openai-responses",
+    model: "gpt-5.5",
+    backend: "hwlab-cloud-api/openai-responses",
+    traceId: "trc_provider_502",
+    reply: {
+      content: "must not count"
+    },
+    error: {
+      code: "provider_unavailable",
+      message: "OpenAI Responses returned HTTP 502: request rejected",
+      providerStatus: 502,
+      missingEnv: []
+    }
+  }, { httpStatus: 502 });
+
+  assert.equal(summary.status, "failed");
+  assert.equal(summary.hasReply, false);
+  assert.equal(summary.error.code, "provider_unavailable");
+  assert.equal(summary.error.providerStatus, 502);
+
+  const classification = classifyCodeAgentBrowserJourney({
+    responseSummary: summary,
+    httpOk: false,
+    httpStatus: 502,
+    ui: {
+      agentChatStatus: "DEV-LIVE 回复",
+      completedMessageVisible: true,
+      failedMessageVisible: false
+    }
+  });
+  assert.equal(classification.status, "blocked");
+  assert.equal(classification.blocker, "provider-upstream");
+});
+
+test("Code Agent readiness classifier blocks completed payloads over any non-2xx HTTP status", () => {
+  const completedPayload = {
+    conversationId: "cnv_completed_non_2xx",
+    sessionId: "cnv_completed_non_2xx",
+    messageId: "msg_completed_non_2xx",
+    status: "completed",
+    provider: "openai-responses",
+    model: "gpt-5.5",
+    backend: "hwlab-cloud-api/openai-responses",
+    traceId: "trc_completed_non_2xx",
+    reply: {
+      content: "must only count over HTTP 2xx"
+    }
+  };
+
+  const accepted = classifyCodeAgentChatReadiness(completedPayload, { realDevLive: true, httpStatus: 200 });
+  assert.equal(accepted.status, "pass");
+  assert.equal(accepted.devLiveReplyPass, true);
+
+  for (const httpStatus of [400, 401, 403, 429, 500, 502, 503, 504]) {
+    const blocked = classifyCodeAgentChatReadiness(completedPayload, { realDevLive: true, httpStatus });
+    assert.equal(blocked.status, "blocked", `HTTP ${httpStatus} must block`);
+    assert.equal(blocked.blocker, "provider-upstream", `HTTP ${httpStatus} blocker`);
+    assert.equal(blocked.devLiveReplyPass, false, `HTTP ${httpStatus} must not pass DEV-LIVE`);
+    assert.equal(blocked.providerStatus, httpStatus, `HTTP ${httpStatus} providerStatus`);
+    assert.match(blocked.reason, /HTTP non-2xx|upstream response/u, `HTTP ${httpStatus} reason`);
+  }
+});
+
+test("Code Agent browser classifier accepts only completed HTTP success plus completed UI and real provider evidence", () => {
+  const summary = sanitizeAgentChatBody({
+    status: "completed",
+    provider: "openai-responses",
+    model: "gpt-5.5",
+    backend: "hwlab-cloud-api/openai-responses",
+    traceId: "trc_completed",
+    reply: {
+      content: "ok"
+    }
+  }, { httpStatus: 200 });
+
+  const pass = classifyCodeAgentBrowserJourney({
+    responseSummary: summary,
+    httpOk: true,
+    httpStatus: 200,
+    ui: {
+      agentChatStatus: "DEV-LIVE 回复",
+      completedMessageVisible: true,
+      failedMessageVisible: false
+    }
+  });
+  assert.equal(pass.status, "pass");
+
+  const blocked = classifyCodeAgentBrowserJourney({
+    responseSummary: summary,
+    httpOk: false,
+    httpStatus: 500,
+    ui: {
+      agentChatStatus: "DEV-LIVE 回复",
+      completedMessageVisible: true,
+      failedMessageVisible: false
+    }
+  });
+  assert.equal(blocked.status, "blocked");
+  assert.equal(blocked.blocker, "provider-upstream");
+});
+
+test("Code Agent browser classifier blocks completed payloads without backend evidence", () => {
+  const summary = sanitizeAgentChatBody({
+    status: "completed",
+    provider: "openai-responses",
+    model: "gpt-5.5",
+    traceId: "trc_missing_backend",
+    reply: {
+      content: "must not count"
+    }
+  }, { httpStatus: 200 });
+
+  const classification = classifyCodeAgentBrowserJourney({
+    responseSummary: summary,
+    httpOk: true,
+    httpStatus: 200,
+    ui: {
+      agentChatStatus: "DEV-LIVE 回复",
+      completedMessageVisible: true,
+      failedMessageVisible: false
+    }
+  });
+
+  assert.equal(classification.status, "blocked");
+  assert.equal(classification.blocker, "untrusted-completion");
+});