fix(review): run claude-cli models directly

2026-08-23 00:23:02 -04:00
parent 6b131e1427
commit 0db44a4d73
5 changed files with 215 additions and 4 deletions
@@ -1,5 +1,8 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
+import { chmod, mkdtemp, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 import { chat } from '../src/lib/router.js';

 test('review router client disables model fallbacks explicitly', async () => {
@@ -32,3 +35,72 @@ test('review router client disables model fallbacks explicitly', async () => {
  assert.equal(body.raw, true);
  assert.equal(body.stream, false);
 });
+
+test('claude-cli models bypass the router and use subscription credentials', async () => {
+  const dir = await mkdtemp(join(tmpdir(), 'granthi-review-claude-'));
+  const fakeClaude = join(dir, 'claude');
+  await writeFile(fakeClaude, `#!/bin/sh
+case " $* " in
+  *" --model claude-sonnet-4-6 "*) ;;
+  *) exit 21 ;;
+esac
+case " $* " in
+  *" --tools  --permission-mode dontAsk --no-session-persistence "*) ;;
+  *) exit 22 ;;
+esac
+[ -z "\${ANTHROPIC_API_KEY:-}" ] || exit 23
+[ -z "\${ANTHROPIC_TOKEN:-}" ] || exit 24
+printf '%s' '{"result":"{\\"axes\\":{},\\"overall\\":90,\\"grade\\":\\"A\\",\\"findings\\":[]}"}'
+`);
+  await chmod(fakeClaude, 0o700);
+
+  const originalFetch = globalThis.fetch;
+  const originalApiKey = process.env.ANTHROPIC_API_KEY;
+  const originalToken = process.env.ANTHROPIC_TOKEN;
+  globalThis.fetch = async () => { throw new Error('router must not be called'); };
+  process.env.ANTHROPIC_API_KEY = 'test-api-key';
+  process.env.ANTHROPIC_TOKEN = 'test-token';
+
+  try {
+    const result = await chat({
+      routerUrl: 'http://router.test',
+      model: 'claude-cli/claude-sonnet-4-6',
+      messages: [{ role: 'user', content: 'review this diff' }],
+      agentId: 'code-reviewer',
+      sessionId: 'review-test',
+      tenantId: 'nirlab',
+      timeoutMs: 1000,
+      claudeBin: fakeClaude
+    });
+    assert.match(result.content, /"overall":90/);
+    assert.equal(result.servedModel, 'claude-cli/claude-sonnet-4-6');
+  } finally {
+    globalThis.fetch = originalFetch;
+    if (originalApiKey === undefined) delete process.env.ANTHROPIC_API_KEY;
+    else process.env.ANTHROPIC_API_KEY = originalApiKey;
+    if (originalToken === undefined) delete process.env.ANTHROPIC_TOKEN;
+    else process.env.ANTHROPIC_TOKEN = originalToken;
+  }
+});
+
+test('claude-cli failures do not leak the review prompt', async () => {
+  const dir = await mkdtemp(join(tmpdir(), 'granthi-review-claude-error-'));
+  const fakeClaude = join(dir, 'claude');
+  await writeFile(fakeClaude, '#!/bin/sh\nprintf "%s\\n" "$*" >&2\nexit 25\n');
+  await chmod(fakeClaude, 0o700);
+
+  await assert.rejects(
+    chat({
+      routerUrl: 'http://router.test',
+      model: 'claude-cli/claude-sonnet-4-6',
+      messages: [{ role: 'user', content: 'SECRET_REVIEW_DIFF_MARKER' }],
+      timeoutMs: 1000,
+      claudeBin: fakeClaude
+    }),
+    (error) => {
+      assert.match(error.message, /claude-cli failed/);
+      assert.doesNotMatch(error.message, /SECRET_REVIEW_DIFF_MARKER/);
+      return true;
+    }
+  );
+});