fix: 收口 CaseRun API 超时与路径可见性

tools/hwlab-cli/caserun-transport.test.ts

@@ -39,6 +39,10 @@ test("CLI defaults to local and requires explicit over-api for base-url", async
   const result = await runHwlabCli(["case", "run", "start", record.caseId, "--run-id", record.runId], { caseRunTransportFactory: () => local });
   assert.equal(result.exitCode, 0);
   assert.equal(result.payload.transport, "local");
+  assert.equal(result.payload.service, "native-harnessrl-application-service");
+  assert.equal(result.payload.baseUrl, null);
+  assert.equal(result.payload.route, null);
+  assert.equal(result.payload.method, null);
   assert.equal(result.payload.workflowRunId, record.workflowRunId);
 
   const rejected = await runHwlabCli(["case", "run", "status", record.runId, "--base-url", "http://api.test"]);
@@ -59,3 +63,29 @@ test("API adapter uses only the explicit CaseRun origin and preserves typed erro
   const failed = createApiCaseRunTransport({ baseUrl: "http://api.test", fetchImpl: async () => Response.json({ ok: false, error: { code: "caserun_run_not_found", message: "missing", details: { runId: record.runId } } }, { status: 404 }) });
   await assert.rejects(failed.execute({ kind: "status", runId: record.runId }), (error: any) => error instanceof CaseRunTransportError && error.code === "caserun_run_not_found");
 });
+
+test("API adapter times out through its real AbortSignal path with typed route details", async () => {
+  const transport = createApiCaseRunTransport({ baseUrl: "http://api.test", timeoutMs: 5, fetchImpl: async (_input, init) => {
+    await new Promise((_resolve, reject) => init?.signal?.addEventListener("abort", () => reject(new DOMException("aborted", "AbortError")), { once: true }));
+    throw new Error("unreachable");
+  }});
+  await assert.rejects(transport.execute({ kind: "status", runId: record.runId }), (error: any) => {
+    assert.equal(error instanceof CaseRunTransportError, true);
+    assert.equal(error.code, "caserun_api_timeout");
+    assert.deepEqual(error.details, { timeoutMs: 5, baseUrl: "http://api.test", route: `/v1/caserun/runs/${record.runId}`, method: "GET" });
+    return true;
+  });
+});
+
+test("over-api CLI discloses bounded origin route and method without credentials", async () => {
+  const result = await runHwlabCli(["case", "run", "events", record.runId, "--over-api", "--base-url", "http://api.test", "--timeout-ms", "25"], {
+    env: { HWLAB_API_KEY: "hwl_live_secret" },
+    fetchImpl: async () => Response.json({ ok: true, ...record, events: [] })
+  });
+  assert.equal(result.exitCode, 0);
+  assert.equal(result.payload.transport, "api");
+  assert.equal(result.payload.baseUrl, "http://api.test");
+  assert.equal(result.payload.route, `/v1/caserun/runs/${record.runId}/events`);
+  assert.equal(result.payload.method, "GET");
+  assert.equal(JSON.stringify(result.payload).includes("hwl_live_secret"), false);
+});