diff --git a/docs/reference/spec-v01-agentrun-mgr.md b/docs/reference/spec-v01-agentrun-mgr.md index 277ec14..c44e15c 100644 --- a/docs/reference/spec-v01-agentrun-mgr.md +++ b/docs/reference/spec-v01-agentrun-mgr.md @@ -53,6 +53,7 @@ POST /api/v1/sessions/:sessionId/control GET /api/v1/backends GET /api/v1/provider-profiles GET /api/v1/provider-profiles/:profile +DELETE /api/v1/provider-profiles/:profile PUT /api/v1/provider-profiles/:profile/credential POST /api/v1/provider-profiles/:profile/validate GET /api/v1/provider-profiles/:profile/validations/:validationId diff --git a/docs/reference/spec-v01-cli.md b/docs/reference/spec-v01-cli.md index f55a028..f2ed7cd 100644 --- a/docs/reference/spec-v01-cli.md +++ b/docs/reference/spec-v01-cli.md @@ -51,6 +51,7 @@ CLI 官方 TypeScript 入口固定为 `scripts/agentrun-cli.ts`。在 G14 非交 ./scripts/agentrun secrets codex render --dry-run [--profile codex|deepseek|minimax-m3] [--codex-home ] ./scripts/agentrun provider-profiles list ./scripts/agentrun provider-profiles show +./scripts/agentrun provider-profiles remove ./scripts/agentrun provider-profiles set-key --key-stdin ./scripts/agentrun provider-profiles validate [--wait] [--timeout-ms ] ./scripts/agentrun backends list @@ -89,7 +90,7 @@ CLI 官方 TypeScript 入口固定为 `scripts/agentrun-cli.ts`。在 G14 非交 - `server logs` 必须返回有界日志尾部、bytes、truncated 和 logPath；找不到日志文件时也必须返回非空 JSON。 - `server stop` 必须按 pidFile 与端口进程清理本地 manager，并返回 before/after 状态；不得要求人工用 `ps/kill/ss` 组合命令清理常见临时服务。 - `secrets codex render --dry-run` 返回 Codex stdio profile Secret 创建计划、输入文件 bytes/hash、SecretRef、manifest 摘要和 apply 命令形状；`--profile codex` 默认 Secret name 为 `agentrun-v01-provider-codex`，`--profile deepseek` 默认 Secret name 为 `agentrun-v01-provider-deepseek`，`--profile minimax-m3` 默认 Secret name 为 `agentrun-v01-provider-minimax-m3`；它不得输出 Secret value 或执行 Kubernetes 写操作。 -- `provider-profiles` 命令族调用 manager REST 管理 API，覆盖 profile status、API Key 写入和 canary 验证。`set-key --key-stdin` 从 stdin 读取 API Key，响应只显示 SecretRef、resourceVersion、hash 后缀和 failureKind；不得输出 key、Codex auth/config 或 Secret data。 +- `provider-profiles` 命令族调用 manager REST 管理 API，覆盖 profile status、删除、API Key 写入和 canary 验证。`set-key --key-stdin` 从 stdin 读取 API Key，响应只显示 SecretRef、resourceVersion、hash 后缀和 failureKind；不得输出 key、Codex auth/config 或 Secret data。 - `backends list` 必须显示 `codex`、`deepseek` 与 `minimax-m3` profile 的 backendKind、protocol、transport、command、requiredSecretKeys 和状态；不得因为某个 provider Secret 尚未配置就隐藏 capability。 - `queue dispatch` 是 Q2 的受控手动调度入口，只对单个 task 显式创建 attempt 和 Core run/command/runner job；不得伪装成自动 scheduler。 - `queue refresh` 只根据 Queue task 中保存的 Core run/command 引用回写 Queue attempt 状态，不读取 Core trace 反推 commander 或统计。 @@ -131,7 +132,7 @@ CLI 官方 TypeScript 入口固定为 `scripts/agentrun-cli.ts`。在 G14 非交 ### T5.1 Provider profile 管理 CLI -阅读本文和 [spec-v01-provider-profile-management.md](spec-v01-provider-profile-management.md)，然后用 `./scripts/agentrun provider-profiles list`、`set-key deepseek --key-stdin` 和 `validate deepseek --wait` 验证 profile 管理闭环。确认 CLI 调 manager REST，不直连 Postgres，不读取 Kubernetes Secret value；输出包含 validationId/runId/commandId/jobName/resourceVersion/hash 后缀，且不包含 API Key、Codex auth/config 或 Secret data。 +阅读本文和 [spec-v01-provider-profile-management.md](spec-v01-provider-profile-management.md)，然后用 `./scripts/agentrun provider-profiles list`、`remove `、`set-key deepseek --key-stdin` 和 `validate deepseek --wait` 验证 profile 管理闭环。确认 CLI 调 manager REST，不直连 Postgres，不读取 Kubernetes Secret value；输出包含 validationId/runId/commandId/jobName/resourceVersion/hash 后缀，且不包含 API Key、Codex auth/config 或 Secret data。 ### T6 Queue 与 Session CLI 分层 @@ -153,5 +154,5 @@ CLI 官方 TypeScript 入口固定为 `scripts/agentrun-cli.ts`。在 G14 非交 | Session CLI | 已实现/Q3 | 已提供 `sessions ps/show/turn/steer/cancel/trace/output/read`；默认 ps 只显示 running/unread，terminal 后自动 unread，read cursor 由 CLI 标记。 | | CLI 测试规格 | 已定义/已验证主闭环 | 综合联调见 [spec-v01-validation.md](spec-v01-validation.md)；每次发布仍按手动交互验收复跑。 | | `deepseek` profile CLI | 已实现/已通过主闭环 | `secrets codex render --profile deepseek`、`backends list`、`runner start --backend`、`runner job` 和 JSON 错误可见性已实现；真实 CLI/RESTful 联调已通过 `codex -> deepseek -> codex` 切换主闭环。 | -| Provider profile 管理 CLI | 已实现 | `provider-profiles list/show/set-key/validate` 调用 manager REST API，用于 HWLAB 委托和 operator 验收；输出必须持续保持 Secret/API Key 脱敏。 | +| Provider profile 管理 CLI | 已实现 | `provider-profiles list/show/remove/set-key/validate` 调用 manager REST API，用于 HWLAB 委托和 operator 验收；输出必须持续保持 Secret/API Key 脱敏。 | | `minimax-m3` profile CLI | 已实现/待真实主闭环 | `secrets codex render --profile minimax-m3`、`backends list`、`runner start --backend`、`runner job`、`sessions turn --profile minimax-m3|M3` 和 JSON 错误可见性已实现；真实 CLI/RESTful 联调需要按 `codex -> deepseek -> minimax-m3 -> codex` 手动验收。 | diff --git a/docs/reference/spec-v01-provider-profile-management.md b/docs/reference/spec-v01-provider-profile-management.md index 2a25096..dbaec7c 100644 --- a/docs/reference/spec-v01-provider-profile-management.md +++ b/docs/reference/spec-v01-provider-profile-management.md @@ -40,6 +40,7 @@ Provider profile 管理 API 属于 `agentrun-mgr` 公共 REST API 的服务端 ```http GET /api/v1/provider-profiles GET /api/v1/provider-profiles/:profile +DELETE /api/v1/provider-profiles/:profile GET /api/v1/provider-profiles/:profile/config PUT /api/v1/provider-profiles/:profile/config PUT /api/v1/provider-profiles/:profile/credential @@ -65,6 +66,14 @@ GET /api/v1/provider-profiles/:profile/validations/:validationId Secret 缺失时仍要返回 profile capability，并把状态标为 `configured=false` 或 `failureKind=secret-unavailable`；不得因为 Secret 未配置而隐藏 profile。 +### `DELETE /api/v1/provider-profiles/:profile` + +删除 profile 对应 Kubernetes Secret。 + +- 内建 profile（`codex`、`deepseek`、`minimax-m3`、`dsflash-go`）删除后，capability 仍必须保留在 `GET /api/v1/provider-profiles` 列表中，但状态回到 `configured=false` / `failureKind=secret-unavailable`。 +- 动态 slug 删除后，若没有剩余 Secret，对应 slug 不再出现在 collection list 中；显式 `GET /api/v1/provider-profiles/:profile` 仍可返回该 slug 的未配置状态。 +- 响应必须返回 `removed` 或 `alreadyAbsent`，并保持 Secret/API Key 脱敏。 + ### `GET/PUT /api/v1/provider-profiles/:profile/config` `GET` 返回当前 profile 的 `configToml`、SecretRef、resourceVersion 和 hash 后缀，供 HWLAB admin 管理页查看。`PUT` 接收 `configToml`，保存时只替换同一 Secret 的 `config.toml`，保留现有 `auth.json`，并返回 resourceVersion 和 `configHashSuffix`。 @@ -150,6 +159,7 @@ AgentRun CLI 提供 operator 和综合联调入口： ./scripts/agentrun provider-profiles list ./scripts/agentrun provider-profiles show deepseek ./scripts/agentrun provider-profiles config deepseek +./scripts/agentrun provider-profiles remove deepseek ./scripts/agentrun provider-profiles set-key deepseek --key-stdin ./scripts/agentrun provider-profiles set-config deepseek --config-stdin ./scripts/agentrun provider-profiles validate deepseek --wait --timeout-ms 120000 @@ -183,13 +193,17 @@ Manager 审计事件允许记录：profile、action、delegatedBy.system、deleg 检查 manager 日志、AgentRun events、CLI 输出和 validation result，确认不包含 API Key 原文、Codex `auth.json`、`config.toml`、Secret data 或 Authorization header。 +### T6 profile 删除 + +用 `./scripts/agentrun provider-profiles remove ` 删除一个动态 slug，再删除一个内建 profile。确认动态 slug 从 collection list 消失；内建 profile 仍留在 list 中但 `configured=false`；CLI/日志/响应不输出 Secret value。 + ## 实现状态 | 能力 | 状态 | 说明 | | --- | --- | --- | | Provider profile 管理规格 | 已定义/已落地 | 本文为 AgentRun `v0.1` profile 管理权威规格。 | -| REST 管理 API | 已实现 | `agentrun-mgr` 提供 `/api/v1/provider-profiles*`，覆盖 list/show/set-key/validate/validation。 | -| CLI 管理入口 | 已实现 | `./scripts/agentrun provider-profiles list/show/set-key/validate` 调用 manager REST API，不直连 Secret value。 | +| REST 管理 API | 已实现 | `agentrun-mgr` 提供 `/api/v1/provider-profiles*`，覆盖 list/show/remove/set-key/validate/validation。 | +| CLI 管理入口 | 已实现 | `./scripts/agentrun provider-profiles list/show/remove/set-key/validate` 调用 manager REST API，不直连 Secret value。 | | DeepSeek Secret 写入 | 已实现/需硬化 | 已按受控 SecretRef 更新 `auth.json`/`config.toml` 并保持 HWLAB Moon Bridge 官方链路；后续必须去除 credential update 产生 `last-applied-configuration` 注解的副作用。 | | Provider canary | 已实现 | canary 通过真实 run/command/runner-job 路径执行，并返回 validationId、runId、commandId、jobName 和 terminal status。 | | HWLAB 委托信任边界 | 已验证 | HWLAB v0.2 通过 Cloud API 委托调用本 API；AgentRun 不读取 HWLAB Web session，也不做用户级鉴权。 | diff --git a/scripts/src/cli.ts b/scripts/src/cli.ts index 7464fa6..d0fe8a4 100644 --- a/scripts/src/cli.ts +++ b/scripts/src/cli.ts @@ -42,6 +42,7 @@ async function dispatch(args: ParsedArgs): Promise { if (group === "provider-profiles" && command === "list") return client(args).get("/api/v1/provider-profiles"); if (group === "provider-profiles" && command === "show" && id) return client(args).get(`/api/v1/provider-profiles/${encodeURIComponent(normalizeProfile(id))}`); if (group === "provider-profiles" && command === "config" && id) return client(args).get(`/api/v1/provider-profiles/${encodeURIComponent(normalizeProfile(id))}/config`); + if (group === "provider-profiles" && (command === "remove" || command === "delete" || command === "rm") && id) return removeProviderProfileCli(id, args); if (group === "provider-profiles" && command === "set-key" && id) return setProviderProfileKey(args, id); if (group === "provider-profiles" && command === "set-config" && id) return setProviderProfileConfig(args, id); if (group === "provider-profiles" && command === "validate" && id) return validateProviderProfileCli(args, id); @@ -438,6 +439,11 @@ async function setProviderProfileConfig(args: ParsedArgs, profileValue: string): }) as JsonRecord; } +async function removeProviderProfileCli(profileValue: string, args: ParsedArgs): Promise { + const profile = normalizeProfile(profileValue); + return await client(args).delete(`/api/v1/provider-profiles/${encodeURIComponent(profile)}`) as JsonRecord; +} + async function validateProviderProfileCli(args: ParsedArgs, profileValue: string): Promise { const profile = normalizeProfile(profileValue); const started = await client(args).post(`/api/v1/provider-profiles/${encodeURIComponent(profile)}/validate`, {}) as JsonRecord; @@ -790,6 +796,7 @@ function help(): JsonRecord { "provider-profiles list", "provider-profiles show ", "provider-profiles config ", + "provider-profiles remove ", "provider-profiles set-key --key-stdin [--model ] [--base-url ]", "provider-profiles set-config --config-stdin", "provider-profiles validate [--wait] [--timeout-ms ]", diff --git a/scripts/src/gitops-render.ts b/scripts/src/gitops-render.ts index 0c19002..e846a93 100644 --- a/scripts/src/gitops-render.ts +++ b/scripts/src/gitops-render.ts @@ -367,7 +367,7 @@ metadata: rules: - apiGroups: [""] resources: ["secrets"] - verbs: ["create", "get", "list", "patch", "update"] + verbs: ["create", "delete", "get", "list", "patch", "update"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding diff --git a/src/mgr/provider-profiles.ts b/src/mgr/provider-profiles.ts index 86a598d..a447f42 100644 --- a/src/mgr/provider-profiles.ts +++ b/src/mgr/provider-profiles.ts @@ -75,6 +75,37 @@ export async function getProviderProfileConfig(profileValue: string, options: Pr }; } +export async function removeProviderProfile(profileValue: string, options: ProviderProfileOptions = {}): Promise { + const profile = validateBackendProfile(profileValue); + const spec = requiredSpec(profile); + const namespace = profileNamespace(options); + const secret = await kubectlGetSecret(spec.defaultSecretName, namespace, options.kubectlCommand ?? "kubectl"); + const data = asOptionalRecord(secret?.data); + const annotations = asOptionalRecord(asOptionalRecord(secret?.metadata)?.annotations); + if (secret) await kubectlDeleteSecret(spec.defaultSecretName, namespace, options.kubectlCommand ?? "kubectl"); + return { + action: "provider-profile-removed", + mutation: true, + profile, + configured: false, + removed: Boolean(secret), + ...(secret ? {} : { alreadyAbsent: true }), + ...(isBuiltinProviderProfile(profile) ? { builtinCapabilityRetained: true } : {}), + secretRef: secretRefSummary(profile, namespace), + deletedResourceVersion: stringPath(secret, ["metadata", "resourceVersion"]), + credentialHashSuffix: hashDataKey(data, "auth.json") ?? stringPath(annotations, [`${credentialAnnotationPrefix}-credential-hash-suffix`]), + configHashSuffix: hashDataKey(data, "config.toml") ?? stringPath(annotations, [`${credentialAnnotationPrefix}-config-hash-suffix`]), + updatedAt: new Date().toISOString(), + valuesPrinted: false, + pollCommands: { + list: "./scripts/agentrun provider-profiles list", + show: `./scripts/agentrun provider-profiles show ${profile}`, + setKey: `./scripts/agentrun provider-profiles set-key ${profile} --key-stdin`, + setConfig: `./scripts/agentrun provider-profiles set-config ${profile} --config-stdin`, + }, + }; +} + export async function setProviderProfileConfig(profileValue: string, body: unknown, options: ProviderProfileOptions = {}): Promise { const profile = validateBackendProfile(profileValue); const spec = requiredSpec(profile); @@ -304,6 +335,10 @@ function compareProviderProfiles(left: string, right: string): number { return left.localeCompare(right); } +function isBuiltinProviderProfile(profile: BackendProfile): boolean { + return backendProfileSpecs.some((item) => item.profile === profile); +} + function providerProfileFromSecret(secret: JsonRecord): BackendProfile | null { const metadata = asOptionalRecord(secret.metadata); const labels = asOptionalRecord(metadata?.labels); @@ -615,6 +650,13 @@ async function kubectlUpsertSecret(manifest: JsonRecord, kubectlCommand: string) throw new AgentRunError("infra-failed", `kubectl replace provider profile secret ${namespace}/${name} failed with code ${replace.code}`, { httpStatus: 502, details: redactJson({ stderr: redactText(replace.stderr.slice(-2000)), stdout: redactText(replace.stdout.slice(-1000)) }) }); } +async function kubectlDeleteSecret(name: string, namespace: string, kubectlCommand: string): Promise { + const result = await runKubectl(kubectlCommand, ["delete", "secret", name, "-n", namespace, "--ignore-not-found=true"]); + if (result.code !== 0) { + throw new AgentRunError("infra-failed", `kubectl delete provider profile secret ${namespace}/${name} failed with code ${result.code}`, { httpStatus: 502, details: redactJson({ stderr: redactText(result.stderr.slice(-2000)), stdout: redactText(result.stdout.slice(-1000)) }) }); + } +} + function isKubectlNotFoundFailure(result: { stdout: string; stderr: string }): boolean { return /notfound|not found|not-found/iu.test(`${result.stderr}\n${result.stdout}`); } diff --git a/src/mgr/server.ts b/src/mgr/server.ts index ff39a32..0426c2f 100644 --- a/src/mgr/server.ts +++ b/src/mgr/server.ts @@ -14,7 +14,7 @@ import { runnerJobStatusSummary } from "./runner-job-status.js"; import { createSessionPvc, deleteSessionPvc, getSessionPvcSummary, refreshSessionPvcSummary, runSessionStorageGc } from "./session-pvc.js"; import type { SessionPvcSummary } from "./session-pvc.js"; import type { SessionPvcOptions } from "./session-pvc.js"; -import { getProviderProfileConfig, getProviderProfileValidation, listProviderProfiles, setProviderProfileConfig, setProviderProfileCredential, showProviderProfile, validateProviderProfile } from "./provider-profiles.js"; +import { getProviderProfileConfig, getProviderProfileValidation, listProviderProfiles, removeProviderProfile, setProviderProfileConfig, setProviderProfileCredential, showProviderProfile, validateProviderProfile } from "./provider-profiles.js"; function pvcOptions(defaults: { kubectlCommand?: string } | undefined): SessionPvcOptions { return defaults?.kubectlCommand ? { kubectlCommand: defaults.kubectlCommand } : {}; @@ -96,6 +96,7 @@ async function route({ method, url, body, store, sourceCommit, runnerJobDefaults if (method === "GET" && path === "/api/v1/provider-profiles") return await listProviderProfiles(providerProfileDefaults) as JsonValue; const providerProfileMatch = path.match(/^\/api\/v1\/provider-profiles\/([^/]+)$/u); if (method === "GET" && providerProfileMatch) return await showProviderProfile(providerProfileMatch[1] ?? "", providerProfileDefaults) as JsonValue; + if (method === "DELETE" && providerProfileMatch) return await removeProviderProfile(providerProfileMatch[1] ?? "", providerProfileDefaults) as JsonValue; const providerConfigMatch = path.match(/^\/api\/v1\/provider-profiles\/([^/]+)\/config$/u); if (method === "GET" && providerConfigMatch) return await getProviderProfileConfig(providerConfigMatch[1] ?? "", providerProfileDefaults) as JsonValue; if (method === "PUT" && providerConfigMatch) return await setProviderProfileConfig(providerConfigMatch[1] ?? "", body, providerProfileDefaults) as JsonValue; diff --git a/src/selftest/cases/45-provider-profile-management.ts b/src/selftest/cases/45-provider-profile-management.ts index 96794e4..979d96a 100644 --- a/src/selftest/cases/45-provider-profile-management.ts +++ b/src/selftest/cases/45-provider-profile-management.ts @@ -12,7 +12,7 @@ const secretText = "sk-selftest-provider-profile-secret"; const selfTest: SelfTestCase = async (context) => { const gitopsRenderer = await readFile(path.join(context.root, "scripts/src/gitops-render.ts"), "utf8"); assert.equal(gitopsRenderer.includes("agentrun-v01-mgr-provider-secret-manager"), true); - assert.equal(gitopsRenderer.includes('verbs: ["create", "get", "list", "patch", "update"]'), true); + assert.equal(gitopsRenderer.includes('verbs: ["create", "delete", "get", "list", "patch", "update"]'), true); assert.equal(gitopsRenderer.includes('resourceNames: ["agentrun-v01-provider-codex", "agentrun-v01-provider-deepseek", "agentrun-v01-provider-minimax-m3", "agentrun-v01-provider-dsflash-go"]'), false); assert.equal(gitopsRenderer.includes('resources: ["secrets"]'), true); @@ -23,9 +23,11 @@ const selfTest: SelfTestCase = async (context) => { const createdJobPath = path.join(context.tmp, "provider-validation-job.json"); const secretStateDir = path.join(context.tmp, "provider-secret-state"); await writeFile(fakeKubectl, `#!/usr/bin/env bun +import { rmSync } from "node:fs"; const args = Bun.argv.slice(2); const secretStateDir = ${JSON.stringify(secretStateDir)}; const secretStatePath = (name) => secretStateDir + "/" + name + ".json"; +const deletedMarkerPath = (name) => secretStateDir + "/" + name + ".deleted"; const fixtureSecret = (name) => ({ apiVersion: "v1", kind: "Secret", metadata: { name, namespace: "agentrun-v01", resourceVersion: "rv-selftest", creationTimestamp: "2026-06-05T00:00:00.000Z" }, data: { "auth.json": Buffer.from(JSON.stringify({ token: "redacted-fixture" })).toString("base64"), "config.toml": Buffer.from("model = \\\"fixture\\\"\\n").toString("base64") } }); const readStdin = async () => { const chunks = []; @@ -34,7 +36,12 @@ const readStdin = async () => { }; if (args[0] === "get" && args[1] === "secret") { const name = args[2]; + const deletedMarker = Bun.file(deletedMarkerPath(name)); const stateFile = Bun.file(secretStatePath(name)); + if (await deletedMarker.exists()) { + console.error('Error from server (NotFound): secrets "' + name + '" not found'); + process.exit(1); + } if (await stateFile.exists()) { console.log(await stateFile.text()); process.exit(0); @@ -49,11 +56,14 @@ if (args[0] === "get" && args[1] === "secret") { process.exit(0); } if (args[0] === "get" && args[1] === "secrets") { - const items = [fixtureSecret("agentrun-v01-provider-codex"), fixtureSecret("agentrun-v01-provider-deepseek"), fixtureSecret("agentrun-v01-provider-minimax-m3")]; + const items = []; + if (!(await Bun.file(deletedMarkerPath("agentrun-v01-provider-codex")).exists())) items.push(fixtureSecret("agentrun-v01-provider-codex")); + if (!(await Bun.file(deletedMarkerPath("agentrun-v01-provider-deepseek")).exists())) items.push(fixtureSecret("agentrun-v01-provider-deepseek")); + if (!(await Bun.file(deletedMarkerPath("agentrun-v01-provider-minimax-m3")).exists())) items.push(fixtureSecret("agentrun-v01-provider-minimax-m3")); const dsflashState = Bun.file(secretStatePath("agentrun-v01-provider-dsflash-go")); - if (await dsflashState.exists()) items.push(JSON.parse(await dsflashState.text())); + if (!(await Bun.file(deletedMarkerPath("agentrun-v01-provider-dsflash-go")).exists()) && await dsflashState.exists()) items.push(JSON.parse(await dsflashState.text())); const dynamicState = Bun.file(secretStatePath("agentrun-v01-provider-dsflash-go-cli-selftest")); - if (await dynamicState.exists()) items.push(JSON.parse(await dynamicState.text())); + if (!(await Bun.file(deletedMarkerPath("agentrun-v01-provider-dsflash-go-cli-selftest")).exists()) && await dynamicState.exists()) items.push(JSON.parse(await dynamicState.text())); console.log(JSON.stringify({ apiVersion: "v1", kind: "SecretList", items })); process.exit(0); } @@ -79,6 +89,7 @@ if (args[0] === "patch" && args[1] === "secret") { if (args[0] === "replace") { const text = await readStdin(); const manifest = JSON.parse(text); + try { rmSync(deletedMarkerPath(manifest.metadata.name)); } catch {} const stateFile = Bun.file(secretStatePath(manifest.metadata.name)); if (!(await stateFile.exists())) { console.error('Error from server (NotFound): secrets "' + manifest.metadata.name + '" not found'); @@ -94,6 +105,7 @@ if (args[0] === "create") { const text = await readStdin(); const manifest = JSON.parse(text); if (manifest.kind === "Secret") { + try { rmSync(deletedMarkerPath(manifest.metadata.name)); } catch {} const annotations = manifest.metadata?.annotations ?? {}; await Bun.write(${JSON.stringify(createdSecretPath)}, JSON.stringify({ args, manifest }, null, 2)); await Bun.write(secretStatePath(manifest.metadata.name), JSON.stringify({ ...manifest, metadata: { ...(manifest.metadata ?? {}), resourceVersion: "rv-created", annotations } })); @@ -104,6 +116,13 @@ if (args[0] === "create") { console.log(JSON.stringify({ apiVersion: manifest.apiVersion, kind: manifest.kind, metadata: { uid: "job-provider-validation", resourceVersion: "rv-job", name: manifest.metadata.name, namespace: manifest.metadata.namespace } })); process.exit(0); } +if (args[0] === "delete" && args[1] === "secret") { + const name = args[2]; + try { rmSync(secretStatePath(name)); } catch {} + await Bun.write(deletedMarkerPath(name), "deleted\n"); + console.log(JSON.stringify({ kind: "Status", status: "Success", details: { name } })); + process.exit(0); +} console.error("unsupported fake kubectl args: " + JSON.stringify(args)); process.exit(1); `); @@ -256,6 +275,30 @@ process.exit(1); assert.equal(dynamicListItems.some((item) => item.profile === dynamicProfile), true); assertNoSecretLeak(dynamicCredential); + const removedDeepseek = await client.delete("/api/v1/provider-profiles/deepseek") as JsonRecord; + assert.equal(removedDeepseek.profile, "deepseek"); + assert.equal(removedDeepseek.removed, true); + assert.equal(removedDeepseek.builtinCapabilityRetained, true); + assertNoSecretLeak(removedDeepseek); + const deepseekShownAfterRemove = await client.get("/api/v1/provider-profiles/deepseek") as JsonRecord; + assert.equal(deepseekShownAfterRemove.configured, false); + assert.equal(deepseekShownAfterRemove.failureKind, "secret-unavailable"); + const listAfterBuiltinRemove = await client.get("/api/v1/provider-profiles") as JsonRecord; + assert.equal(listAfterBuiltinRemove.count, 5); + const deepseekAfterRemove = ((listAfterBuiltinRemove.items as JsonRecord[]) ?? []).find((item) => item.profile === "deepseek") as JsonRecord | undefined; + assert.equal(deepseekAfterRemove?.configured, false); + assert.equal(deepseekAfterRemove?.failureKind, "secret-unavailable"); + + const removedDynamic = await client.delete(`/api/v1/provider-profiles/${encodeURIComponent(dynamicProfile)}`) as JsonRecord; + assert.equal(removedDynamic.profile, dynamicProfile); + assert.equal(removedDynamic.removed, true); + assert.equal(removedDynamic.builtinCapabilityRetained, undefined); + assertNoSecretLeak(removedDynamic); + const listAfterDynamicRemove = await client.get("/api/v1/provider-profiles") as JsonRecord; + assert.equal(listAfterDynamicRemove.count, 4); + const itemsAfterDynamicRemove = (listAfterDynamicRemove.items as JsonRecord[]) ?? []; + assert.equal(itemsAfterDynamicRemove.some((item) => item.profile === dynamicProfile), false); + await assert.rejects( () => client.put("/api/v1/provider-profiles/deepseek/credential", { apiKey: secretText, config: { baseUrl: "https://hyueapi.com/v1" } }), (error) => error instanceof Error && error.message.includes("not hyueapi.com"), @@ -279,7 +322,7 @@ process.exit(1); assert.equal(finalValidation.status, "completed"); assert.equal(JSON.stringify(finalValidation).includes(secretText), false); assertNoSecretLeak(finalValidation); - return { name: "provider-profile-management", tests: ["provider-profiles-list-redacted", "provider-profile-config", "provider-profile-set-key-redacted", "provider-profile-secret-replace-annotation-cleanup", "provider-profile-secret-create-upsert", "provider-profile-config-only-create", "provider-profile-dynamic-slug-roundtrip", "provider-profile-deepseek-moon-bridge", "provider-profile-manager-secret-rbac", "provider-profile-validation-runner-job"] }; + return { name: "provider-profile-management", tests: ["provider-profiles-list-redacted", "provider-profile-config", "provider-profile-set-key-redacted", "provider-profile-secret-replace-annotation-cleanup", "provider-profile-secret-create-upsert", "provider-profile-config-only-create", "provider-profile-dynamic-slug-roundtrip", "provider-profile-remove-builtin", "provider-profile-remove-dynamic-slug", "provider-profile-deepseek-moon-bridge", "provider-profile-manager-secret-rbac", "provider-profile-validation-runner-job"] }; } finally { await new Promise((resolve) => server.server.close(() => resolve())); }