// Covers MCP HTTP transport redirects, SSRF guardrails, and auth/TLS handoff.

import { beforeEach, describe, expect, it, vi } from "vitest";

import { resolveMcpTransport } from "./mcp-transport.js";

}

function latestStreamableTransportOptions(): StreamableTransportOptions {

// The SDK transport is constructor-injected; tests inspect the most recent

// options to exercise OpenClaw's wrapped fetch implementation directly.

const latestCall = streamableTransportConstructorMock.mock.calls[

streamableTransportConstructorMock.mock.calls.length - 1

] as unknown[] | undefined;

});

it("scrubs custom headers when streamable HTTP follows a cross-origin redirect", async () => {

// Cross-origin redirects keep safe protocol headers but drop operator

// secrets such as API keys before following the Location target.

runtimeFetchMock

.mockResolvedValueOnce(redirectResponse("https://redirect.example/next"))

.mockResolvedValueOnce(new Response("ok"));

});

it("preserves replayable request bodies for cross-origin streamable HTTP redirects", async () => {

// 307/308 redirects preserve method/body, while custom auth headers are

// still stripped when the destination origin changes.

runtimeFetchMock

.mockResolvedValueOnce(redirectResponse("https://redirect.example/mcp", 307))

.mockResolvedValueOnce(new Response("ok"));

// Verifies memory-search config resolution across providers, sync, and batching.

import { afterEach, beforeEach, describe, expect, it } from "vitest";

import type { OpenClawConfig } from "../config/config.js";

import {

const asConfig = (cfg: OpenClawConfig): OpenClawConfig => cfg;

function registerBaseMemoryEmbeddingProviders(options?: { includeGemini?: boolean }): void {

// Register provider contracts locally so config tests do not depend on the

// plugin loader or live embedding backends.

registerMemoryEmbeddingProvider({

id: "openai",

defaultModel: "text-embedding-3-small",

}

function expectDefaultRemoteBatch(resolved: ReturnType<typeof resolveMemorySearchConfig>): void {

// Remote providers default to non-batch mode; explicit batch config must

// opt in so memory search does not introduce hidden async polling.

expect(resolved?.remote?.batch).toEqual({

enabled: false,

wait: true,

});

it("resolves custom provider ids through their configured api owner", () => {

// Workspace provider aliases inherit embedding defaults from their API

// owner while keeping the configured provider id for auth/routing.

const cfg = asConfig({

models: {

providers: {

// Covers MiniMax VLM auth/header normalization and provider-specific routing.

import { afterEach, describe, expect, it, vi } from "vitest";

import { withFetchPreconnect } from "../test-utils/fetch-mock.js";

import { isMinimaxVlmModel, minimaxUnderstandImage } from "./minimax-vlm.js";

});

async function runNormalizationCase(apiKey: string) {

// Headers must be Latin-1 and line-break free; normalize user/API-key

// input before constructing the Authorization header.

const fetchSpy = vi.fn(async (_input: RequestInfo | URL, init?: RequestInit) => {

const auth = (init?.headers as Record<string, string> | undefined)?.Authorization;

expect(auth).toBe("Bearer minimax-test-key");

});

it("bounds large provider error response bodies", async () => {

// Provider error bodies can be large. Read enough for diagnostics, then

// cancel the stream so failures stay bounded.

let canceled = false;

const body = new ReadableStream<Uint8Array>({

start(controller) {

// Live-gated MiniMax text smoke probe.

import { completeSimple, type Model } from "openclaw/plugin-sdk/llm";

import { describe, expect, it } from "vitest";

import {

const describeLive = LIVE && MINIMAX_KEY ? describe : describe.skip;

async function runMinimaxTextProbe(model: Model<"anthropic-messages">, maxTokens: number) {

// MiniMax uses the Anthropic-compatible message surface, so the smoke probe

// goes through completeSimple instead of provider-specific helpers.

const res = await completeSimple(

model,

{

// Verifies env API-key lookup through plugin provider-auth aliases.

import { beforeEach, describe, expect, it, vi } from "vitest";

import { resolveEnvApiKey } from "./model-auth-env.js";

});

it("reuses the current scoped metadata snapshot while resolving provider auth aliases", () => {

// The active scoped snapshot already reflects workspace/plugin filtering;

// reloading metadata here can accidentally see a broader plugin set.

expect(

resolveEnvApiKey(

"cloud-alias",

});

it("passes config and workspace scope to setup-provider fallback", () => {

// Setup providers can derive env/config keys from workspace context, so the

// fallback must receive the same scope as metadata resolution.

const config = {};

const env = {} as NodeJS.ProcessEnv;

setupRegistryMocks.resolvePluginSetupProvider.mockReturnValue({