fix: guard code agent provider env readiness

2026-05-23 00:50:10 +00:00
parent 89d64092a0
commit eb4686f452
8 changed files with 638 additions and 10 deletions
@@ -1,7 +1,76 @@
 import assert from "node:assert/strict";
 import test from "node:test";

-import { compareRuntimeIdentityEnv, decideDevTemplateJobReplacement, resolveApplySourceCommit } from "./dev-deploy-apply.mjs";
+import {
+  compareRuntimeIdentityEnv,
+  decideDevTemplateJobReplacement,
+  inspectCodeAgentProviderDesiredState,
+  inspectCodeAgentProviderLiveDeployment,
+  resolveApplySourceCommit
+} from "./dev-deploy-apply.mjs";
+
+const codeAgentBaseUrl = "http://172.26.26.227:17680/v1/responses";
+
+function codeAgentDeploy(env = {}) {
+  return {
+    services: [
+      {
+        serviceId: "hwlab-cloud-api",
+        env: {
+          HWLAB_CODE_AGENT_PROVIDER: "openai",
+          HWLAB_CODE_AGENT_MODEL: "gpt-5.5",
+          HWLAB_CODE_AGENT_OPENAI_BASE_URL: codeAgentBaseUrl,
+          OPENAI_API_KEY: "secretRef:hwlab-code-agent-provider/openai-api-key",
+          ...env
+        }
+      }
+    ]
+  };
+}
+
+function codeAgentWorkloads(envOverrides = []) {
+  return {
+    kind: "List",
+    items: [
+      {
+        kind: "Deployment",
+        metadata: {
+          name: "hwlab-cloud-api",
+          namespace: "hwlab-dev",
+          labels: {
+            "hwlab.pikastech.local/service-id": "hwlab-cloud-api"
+          }
+        },
+        spec: {
+          template: {
+            spec: {
+              containers: [
+                {
+                  name: "hwlab-cloud-api",
+                  env: [
+                    { name: "HWLAB_CODE_AGENT_PROVIDER", value: "openai" },
+                    { name: "HWLAB_CODE_AGENT_MODEL", value: "gpt-5.5" },
+                    { name: "HWLAB_CODE_AGENT_OPENAI_BASE_URL", value: codeAgentBaseUrl },
+                    {
+                      name: "OPENAI_API_KEY",
+                      valueFrom: {
+                        secretKeyRef: {
+                          name: "hwlab-code-agent-provider",
+                          key: "openai-api-key"
+                        }
+                      }
+                    },
+                    ...envOverrides
+                  ]
+                }
+              ]
+            }
+          }
+        }
+      }
+    ]
+  };
+}

 test("allowlisted suspended template Job image change plans replacement", () => {
  const decision = decideDevTemplateJobReplacement({
@@ -127,3 +196,39 @@ test("runtime identity env comparator detects stale cloud-web env drift", () =>
    ["HWLAB_COMMIT_ID", "HWLAB_IMAGE", "HWLAB_IMAGE_TAG"]
  );
 });
+
+test("Code Agent provider desired state preserves Secret ref and egress base URL", () => {
+  const inspection = inspectCodeAgentProviderDesiredState(codeAgentDeploy(), codeAgentWorkloads());
+
+  assert.equal(inspection.ready, true);
+  assert.equal(inspection.status, "pass");
+  assert.equal(inspection.secretRef.present, true);
+  assert.equal(inspection.secretMaterialRead, false);
+  assert.equal(inspection.egress.deployMatchesDevProxy, true);
+  assert.equal(inspection.egress.workloadMatchesDevProxy, true);
+});
+
+test("Code Agent provider desired state blocks direct public OpenAI base URL", () => {
+  const inspection = inspectCodeAgentProviderDesiredState(
+    codeAgentDeploy({ HWLAB_CODE_AGENT_OPENAI_BASE_URL: "https://api.openai.com/v1/responses" }),
+    codeAgentWorkloads([
+      { name: "HWLAB_CODE_AGENT_OPENAI_BASE_URL", value: "https://api.openai.com/v1/responses" }
+    ])
+  );
+
+  assert.equal(inspection.ready, false);
+  assert.equal(inspection.status, "blocked");
+  assert.equal(inspection.egress.directPublicOpenAi, true);
+  assert.ok(inspection.missingEgressContract.some((entry) => entry.includes("api.openai.com")));
+});
+
+test("Code Agent live Deployment inspection reads only env metadata", () => {
+  const deployment = codeAgentWorkloads().items[0];
+  const inspection = inspectCodeAgentProviderLiveDeployment(deployment);
+
+  assert.equal(inspection.ready, true);
+  assert.equal(inspection.secretRef.present, true);
+  assert.equal(inspection.secretValuesRead, false);
+  assert.equal(inspection.kubernetesSecretDataRead, false);
+  assert.equal(inspection.validationScope, "deployment-env-and-secretKeyRef-metadata-only");
+});