Files
openchamber/packages/ui/src/lib/opencode/client.test.ts
T
Bohdan Triapitsyn 859b4529da feat: add private relay for end-to-end-encrypted remote access (#2087)
Adds OpenChamber Relay — an opt-in way to reach an instance from a phone,
browser, or another desktop from anywhere, with no open inbound ports, no
tunnel, and no shared LAN. The instance dials outbound to a relay; all app
traffic (HTTP, the event stream, terminal, dictation) is multiplexed and
encrypted through a single connection per client, so the relay only ever
forwards opaque ciphertext.

Transport
- End-to-end-encrypted channel over WebCrypto (ECDH P-256 -> HKDF ->
  AES-256-GCM) with a capability-negotiated handshake and a small
  HTTP/SSE/WebSocket multiplexing protocol. A byte-compatible JS host mirror
  is cross-checked by tests.
- Host: outbound connection manager, per-client tunnel dispatcher to the local
  server over loopback, reuse of the existing instance identity key, and
  management routes. Disabled by default; explicit opt-in.
- Client: plugs into the existing runtime layer (runtime-fetch/-url/-switch/
  -auth, event pipeline, terminal, dictation) so features work over the relay
  unchanged; direct-URL and Electron realtime-proxy paths are untouched.

Pairing & UX
- Relay section in Settings -> Remote Instances (live status, QR/link pairing,
  revocation via the existing client-token list) and the mobile connect flow.
- Frame batching and idle-gated keepalive keep tunnel message volume low
  without affecting streaming smoothness.

Security
- The tunnel is transport only; the server authenticates every tunneled
  request exactly as for a direct remote client.
  fragments only. The relay stores no keys, tokens, or payloads.

Operability
- The endpoint can be pinned to a self-hosted rel
  paired clients inherit it from the offer automatically.
- Relay module DOCUMENTATION.md and a relay-trans
  invariants that future WebSocket/streaming changes must follow.

The relay transport is complete and tested; the UI for enabling and pairing
is gated behind openchamber_relay_gate and stays
2026-07-08 03:44:02 +03:00

164 lines
5.3 KiB
TypeScript

import { beforeEach, describe, expect, mock, test } from 'bun:test';
type ConfigResponse = { data: Record<string, unknown> };
(mock as unknown as { restore?: () => void }).restore?.();
const configResolvers: Array<(response: ConfigResponse) => void> = [];
let configCalls = 0;
const promptAsyncCalls: unknown[][] = [];
const promptAsyncResults: Array<unknown> = [];
const promptAsyncMock = mock(async (...args: unknown[]) => {
promptAsyncCalls.push(args);
const next = promptAsyncResults.shift();
if (next instanceof Error) throw next;
return next ?? { response: new Response(null, { status: 200 }) };
});
mock.module('@opencode-ai/sdk/v2', () => ({
createOpencodeClient: mock(() => ({
config: {
get: mock(() => {
configCalls += 1;
return new Promise<ConfigResponse>((resolve) => {
configResolvers.push(resolve);
});
}),
},
session: {
promptAsync: promptAsyncMock,
},
})),
}));
mock.module('@/contexts/runtimeAPIRegistry', () => ({
getRegisteredRuntimeAPIs: mock(() => null),
}));
mock.module('@/lib/runtime-url', () => ({
getRuntimeUrlResolver: mock(() => ({
api: (path: string) => path,
})),
}));
mock.module('@/lib/runtime-switch', () => ({
getRuntimeApiBaseUrl: mock(() => ''),
getRuntimeKey: mock(() => 'test-runtime'),
}));
mock.module('@/lib/runtime-fetch', () => ({
runtimeFetch: mock(async () => new Response(JSON.stringify([]), {
headers: { 'Content-Type': 'application/json' },
})),
}));
mock.module('@/lib/startupTrace', () => ({
markStartupTrace: mock(() => undefined),
}));
const { opencodeClient } = await import(`./client?cache-test=${Date.now()}`);
beforeEach(() => {
promptAsyncCalls.length = 0;
promptAsyncResults.length = 0;
});
describe('opencodeClient getConfig cache', () => {
test('cleared stale in-flight requests do not repopulate cache or delete newer in-flight requests', async () => {
const first = opencodeClient.getConfig('/workspace/project');
expect(configCalls).toBe(1);
opencodeClient.clearConfigCache();
const second = opencodeClient.getConfig('/workspace/project');
expect(configCalls).toBe(2);
configResolvers[0]?.({ data: { model: 'old/model' } });
expect(await first).toEqual({ model: 'old/model' });
const third = opencodeClient.getConfig('/workspace/project');
expect(configCalls).toBe(2);
configResolvers[1]?.({ data: { model: 'new/model' } });
expect(await second).toEqual({ model: 'new/model' });
expect(await third).toEqual({ model: 'new/model' });
const cached = await opencodeClient.getConfig('/workspace/project');
expect(cached).toEqual({ model: 'new/model' });
expect(configCalls).toBe(2);
});
});
describe('opencodeClient prompt retry behavior', () => {
const sendPrompt = (providerID = 'anthropic') => opencodeClient.sendMessage({
id: 'ses_1',
providerID,
modelID: 'claude-sonnet',
text: 'hello',
});
test('does not retry 504 prompt responses because the POST may already be accepted', async () => {
promptAsyncResults.push({ response: new Response('gateway timeout', { status: 504 }) });
let error: unknown = null;
try {
await sendPrompt('anthropic-504');
} catch (caught) {
error = caught;
}
expect(promptAsyncCalls.length).toBe(1);
expect(error instanceof Error ? error.message : String(error)).toContain('Failed to send message (504)');
});
test('does not retry transport failures because the tunnel may have lost only the response', async () => {
promptAsyncResults.push(new TypeError('Failed to fetch'));
let error: unknown = null;
try {
await sendPrompt('anthropic-network');
} catch (caught) {
error = caught;
}
expect(promptAsyncCalls.length).toBe(1);
expect(error instanceof Error ? error.message : String(error)).toContain('Failed to fetch');
});
test('does not fabricate an HTTP 500 when the SDK swallows a transport failure into result.error', async () => {
// The SDK catches thrown fetch errors and returns { error, response: undefined }.
// That is a transport failure, not a server 500 — it must surface as a
// descriptive transport error, never as "Failed to send message (500): {}".
promptAsyncResults.push({ error: new TypeError('relay tunnel reset: plaintext frame on established channel'), response: undefined });
let error: unknown = null;
try {
await sendPrompt('anthropic-transport');
} catch (caught) {
error = caught;
}
expect(promptAsyncCalls.length).toBe(1);
const message = error instanceof Error ? error.message : String(error);
expect(message).not.toContain('Failed to send message (500)');
expect(message).toContain('transport failure');
expect(message).toContain('relay tunnel reset');
expect((error as Error & { status?: number }).status).toBe(undefined);
});
test('does not retry 503 prompt responses because proxy errors can be ambiguous too', async () => {
promptAsyncResults.push({ response: new Response('starting', { status: 503 }) });
let error: unknown = null;
try {
await sendPrompt('anthropic-503');
} catch (caught) {
error = caught;
}
expect(promptAsyncCalls.length).toBe(1);
expect(error instanceof Error ? error.message : String(error)).toContain('Failed to send message (503)');
});
});