2a95791992
run_agent.py: delete the `# noqa: F401` re-export block (agent.process_bootstrap
OpenAI/_SafeWriter/_get_proxy_*, model_tools get_tool_definitions/
handle_function_call/check_toolset_requirements, FailoverReason,
_qwen_portal_headers/_routermint_headers, session_persistence names,
estimate_request_tokens_rough, ContextCompressor + friends, jittered_backoff,
prompt_builder names, message_sanitization names, tool_dispatch_helpers
names) — 41 names run_agent never used itself — and the `_STREAM_DIAG_HEADERS`
back-compat class alias (no in-tree reader). run_agent now imports only what
it uses (get_toolset_for_tool, is_local_endpoint, coalesce/uniquify tool-call
ids, cleanup_vm/get_active_env from terminal_tool_lifecycle).
agent/*: `_ra().X` late-binds that only reached a re-export now import the
defining module directly (agent_runtime_helpers -> process_bootstrap.OpenAI,
model_tools.handle_function_call, session_persistence._safe_session_filename_component;
agent_init -> model_tools.get_tool_definitions/check_toolset_requirements,
_lazy_headers("agent.client_lifecycle", ...) for qwen/routermint;
system_prompt -> agent.prompt_builder / model_tools directly, dropping its
own _ra() shim and the `_r` parameter threading). `_ra()` stays for
run_agent-resident names (logger, AIAgent, _hermes_home, _set_interrupt, ...).
toolsets.py: remove resolve_multiple_toolsets (shim-only, restored by
34abf954bd); tests/test_toolsets.py pins the same union behavior via
resolve_toolset over each name.
providers/__init__.py: drop the OMIT_TEMPERATURE re-export (no callers via the
package); ProviderProfile stays because __init__ uses it for annotations —
2 tests repointed to providers.base.
agent/iteration_budget.py: drop the "run_agent re-exports the class"
docstring pointer; 4 tests import IterationBudget from its home.
model_tools.py (arg_coercion names), agent/tool_executor.py, and
hermes_cli/cli_session_mixin.py repoints landed via a sibling commit on this
shared worktree.
Callers repointed: gateway/run.py, hermes_cli/cli_chat_turn_mixin.py,
hermes_cli/cli_tui_mixin.py, tui_gateway/session_workdir.py,
agent/transports/codex.py (one-line imports) + comment pointers in
tools/file_state.py, tools/schema_sanitizer.py, scripts/tool_search_livetest.py.
Tests: patch("run_agent.X") / monkeypatch.setattr(run_agent, "X") /
`from run_agent import X` -> defining module across 99 test files.
97 lines
3.4 KiB
Python
97 lines
3.4 KiB
Python
"""Regression guard: opencode-free client keyless header handling.
|
|
|
|
OpenCode's free tier at ``https://opencode.ai/zen/v1`` is served ANONYMOUSLY:
|
|
requests with no recognizable Authorization bearer succeed, while any bearer
|
|
the relay doesn't recognize — placeholders included — is rejected with 401
|
|
"Invalid API key" (verified live 2026-08-21).
|
|
|
|
The client therefore must ship an EMPTY ``Authorization`` default header for
|
|
every opencode-free build, which overrides the OpenAI SDK's always-injected
|
|
``Authorization: Bearer <api_key>`` so no credential-shaped value ever
|
|
reaches the wire.
|
|
"""
|
|
from unittest.mock import MagicMock, patch
|
|
|
|
from agent.agent_runtime_helpers import create_openai_client
|
|
|
|
ZEN_V1 = "https://opencode.ai/zen/v1"
|
|
|
|
|
|
class _FakeAgent:
|
|
def __init__(self, api_key):
|
|
self.provider = "opencode-free"
|
|
self.base_url = ZEN_V1
|
|
self.api_key = api_key
|
|
self.model = "x-preview-f-free"
|
|
self.api_mode = "chat_completions"
|
|
|
|
def _client_log_context(self):
|
|
return {}
|
|
|
|
def _build_keepalive_http_client(self, base_url, verify=True):
|
|
return None
|
|
|
|
|
|
def _zen_call_headers(mock_openai):
|
|
matching = [
|
|
c for c in mock_openai.call_args_list
|
|
if c.kwargs.get("base_url") == ZEN_V1
|
|
]
|
|
assert matching, "OpenAI was never constructed with the zen base_url"
|
|
return dict(matching[-1].kwargs.get("default_headers") or {})
|
|
|
|
|
|
@patch("agent.process_bootstrap.OpenAI")
|
|
def test_opencode_free_blanks_authorization_header(mock_openai):
|
|
"""Whatever api_key value reaches the client build (placeholder, stale
|
|
key, empty), the Authorization default header must be blanked so the
|
|
SDK's Bearer never hits the wire."""
|
|
mock_openai.return_value = MagicMock()
|
|
for key in ("opencode-zen-free-keyless", "no-key-required", "", "sk-stale"):
|
|
mock_openai.reset_mock()
|
|
create_openai_client(
|
|
_FakeAgent(api_key=key),
|
|
{"api_key": key, "base_url": ZEN_V1},
|
|
reason="test",
|
|
shared=False,
|
|
)
|
|
headers = _zen_call_headers(mock_openai)
|
|
assert headers.get("Authorization") == "", (
|
|
f"opencode-free with api_key={key!r} must blank Authorization; "
|
|
f"got {headers!r}"
|
|
)
|
|
|
|
|
|
@patch("agent.process_bootstrap.OpenAI")
|
|
def test_opencode_free_sends_hermes_attribution(mock_openai):
|
|
"""Keyless requests still identify as Hermes (attribution headers match
|
|
the opencode zen/go profiles)."""
|
|
mock_openai.return_value = MagicMock()
|
|
create_openai_client(
|
|
_FakeAgent(api_key="opencode-zen-free-keyless"),
|
|
{"api_key": "opencode-zen-free-keyless", "base_url": ZEN_V1},
|
|
reason="test",
|
|
shared=False,
|
|
)
|
|
headers = _zen_call_headers(mock_openai)
|
|
assert headers.get("X-Title") == "Hermes Agent"
|
|
assert str(headers.get("User-Agent", "")).startswith("HermesAgent/")
|
|
|
|
|
|
@patch("agent.process_bootstrap.OpenAI")
|
|
def test_other_providers_unaffected(mock_openai):
|
|
"""The opencode-free header policy must not leak to other providers."""
|
|
mock_openai.return_value = MagicMock()
|
|
agent = _FakeAgent(api_key="sk-real")
|
|
agent.provider = "opencode-zen"
|
|
create_openai_client(
|
|
agent,
|
|
{"api_key": "sk-real", "base_url": ZEN_V1},
|
|
reason="test",
|
|
shared=False,
|
|
)
|
|
headers = _zen_call_headers(mock_openai)
|
|
assert "Authorization" not in headers, (
|
|
"opencode-zen (keyed) must not have its Authorization header blanked"
|
|
)
|