mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-09-14 16:08:41 +00:00
* feat(extensions): add gateway services and routers * feat(extensions): add standalone reference extension * fix(extensions): harden contributed gateway routes * docs(extensions): document gateway contribution points * feat(extensions): add operator CLI for packaged extension management Add `deerflow extensions install/list/enable/disable/remove` plus the root `make extension-*` wrappers, backed by an `ExtensionManager` that owns one transaction over backend/pyproject.toml, backend/uv.lock, the managed source snapshot, the uv environment, and the `plugins:` block in config.yaml. Install accepts a package requirement, a public HTTPS Git URL, or a local directory. Local directories are copied to backend/extensions/sources/ as deployable snapshots rather than editable installs, and the root .dockerignore re-includes that tree so snapshots reach the backend builder. Remote sources are HTTPS-only; SSH Git, file:// and local wheels are rejected because the stock Docker builder cannot reproduce them. Because environment configuration can still resolve a plain package name to a local wheel (a UV_FIND_LINKS wheelhouse, say), every uv add/remove is followed by an audit of the new lock: any local reference the stock image build cannot reproduce rolls back the whole transaction. A config carrying duplicate top-level `plugins:` keys is rejected outright rather than managed against one block while the Gateway reads another. Dependency synchronization now has one lock authority. The `extensions` dependency group joins [tool.uv].default-groups, every startup path syncs the same lock with --locked and launches with --no-sync, and the Docker images move to uv 0.11.1 for the --no-workspace boundary the manager needs. Loader gains `enabled`, `name` and `package` fields so a disabled extension is skipped before resolution and import. Co-authored-by: Codex <codex@openai.com> * fix(extensions): stop the managed plugins rewrite from destroying config Two data-safety defects in the managed `plugins:` block writer. The "next top-level key" boundary was a regex matching only `[A-Za-z_][A-Za-z0-9_-]*` or a quoted key. `AppConfig` is `extra="allow"`, so a config may legally carry any top-level key, and a key the pattern cannot recognize did not fail loudly — it read as "no next section", and the rewrite replaced that neighbour and its entire subtree with the managed block. `my.key`, `2fa`, `$schema`, `my key` and non-ASCII keys were all silently deleted by a plain `extension-enable`/`disable`. Both boundaries now come from the YAML parser's node marks, so key shape is irrelevant. The file-final branch never consulted the trailing-comment scan the has-next-key branch used, so any comment below the block was dropped. Since the manager appends `plugins:` at end of file, that is the steady-state shape for most installs: an operator note below the block was destroyed on the next toggle. Separately, every managed install wrote `required: true` while the loader defaults to false. That turned any later load failure — broken wheel, missing native library, deleted snapshot — into a Gateway startup abort recoverable only with shell access. New records are now written `required: false`, with an explicit `install --required` opt-in; adopting an existing hand-written record still preserves the operator's own choice. * fix(extensions): harden the manager transaction and correct its docs Follow-up hardening on the extension package manager. Security posture, which the docs already claimed: - Scrub `UV_PYTHON`, `UV_INSECURE_HOST`, `UV_CONSTRAINT` and `UV_NO_BUILD_ISOLATION` from the controlled uv environment. `UV_PYTHON` swaps the interpreter that the entry-point probe then imports and calls, and every later `uv run --no-sync` startup uses; `UV_INSECURE_HOST` removes the TLS validation the HTTPS-only source rule depends on. Neither is an index, proxy, cache or credential-provider setting, so neither was covered by the carve-out. - Recognize run-together and all-caps secret query parameters (`accesstoken`, `ACCESSTOKEN`, `key`, `pw`, `sas`, `code`). The camel-case splitter only fires on case transitions, so only the separated spellings were caught. Short generic words stay boundary-anchored, so `?keyword=` remains installable. - Validate the config before running any uv command. `uv add`/`uv sync` execute the package's build backend, so a config the manager could never write to must fail before that code runs rather than afterwards through rollback. Transaction integrity: - Run the second dependency-file restore from a `finally`. The recovery sync runs without `--locked` when the checkout had no lock, so uv writes one while resolving; if that sync then failed, the restore was skipped and the operator kept a lock file they never had. A failing recovery sync now also reports the original failure instead of replacing it. - Skip the recovery sync on cancellation. Answering Ctrl-C with a full dependency resolve invites a second interrupt that escapes the handler and strands the checkout mid-transaction; the declarations are already restored and the next locked startup sync reconciles the environment. - Retry a non-blocking lock on Windows instead of using `msvcrt.LK_LOCK`, which gives up after ~10s — far shorter than a real `uv add` plus `uv sync`, so contention surfaced as `Permission denied` rather than serializing. - Locate the entry-point probe's JSON payload instead of parsing stdout's first line, so a `sitecustomize`/`.pth` banner cannot roll back a good install. - Warn when the lock records a loopback source. `127.0.0.1` inside the image builder is a different machine, but unlike an environment-driven wheelhouse resolution this is a source the operator typed deliberately, so it is reported rather than rolled back. Private-network indexes are untouched: a builder on that network can reach them. Docs: the blanket claim that failed operations restore the config file was wrong — the conflict branches deliberately preserve a concurrent external edit and leave `remove` deactivated. Document that, the `required: false` default, the config preflight, the interrupt behaviour, and where the plugins-block boundaries come from. * test(gateway): pin the request-path projection agreement `get_request_route_path()` imports the private `starlette._utils.get_route_path` so the auth and CSRF predicates classify the exact string Starlette's router matches on. Its requirement is not "strip root_path correctly" but "return what the dispatcher is matching", so delegating to the router's own implementation keeps the two in lockstep by construction. Keep the private import rather than vendoring a copy: an import that disappears fails loudly at startup, while a stale copy diverges silently at a security boundary. Cover the property directly instead of the mechanism, so the tests survive a future reimplementation: - projection edge cases, including the segment-boundary guard that keeps root_path="/api" from slicing "/apifoo/models" into a string the router would never match - agreement with the router under nested mounts - the two bypasses these predicates exist to prevent: a protected route mounted under the "/health" public prefix must still 401, and a POST mounted under "/api/webhooks" must still require a CSRF token Both are verified to fail when the projection is reverted to `request.url.path` (9/13 red) and when a plausible vendored copy omits the boundary guard (the 2 boundary cases red). Declare starlette as a bounded direct dependency so a bump — which is security-relevant here — shows up in review rather than arriving silently through FastAPI. * ci: pin uv to the version production ships ExtensionManager is not a consumer of uv the build tool -- it is a program whose whole job is driving `uv` as a subprocess, depending on its CLI behavior (`--no-workspace`, `--no-sync`, what `uv add` writes into `[dependency-groups] extensions`) and on the `uv.lock` serialization format. uv is closer to a runtime dependency with a contract than to incidental tooling. backend/Dockerfile pins that binary to 0.11.1, but all eight astral-sh/setup-uv steps installed whatever was latest at run time, so CI exercised the manager against a uv that is not the uv production runs. The sharpest failure that allows: a newer uv bumps uv.lock's `revision`, CI stays green because the same uv reads back what it wrote, and the pinned uv in the production image cannot read the committed lock. `uv lock --check` is version-sensitive for the same reason -- it verifies the lock is what *this* uv would produce, and two versions can emit equivalent but non-identical output. Pin every step to 0.11.1 and lift the one lingering setup-uv@v3 to v7 so the steps share input and caching behavior. Pinning alone drifts apart again on the next bump, so add a constraint test in the style of test_compose_default_bind_host.py: the Dockerfile's UV_IMAGE tag is the single source of truth, and both compose defaults plus every setup-uv step must match it. Verified to fail when a pin drifts, when a step omits `version`, and -- the real scenario -- when the Dockerfile is bumped alone, which lights up the workflows and both compose files at once. * fix(gateway): state the extension route auth limit and abort a failed dev sync Two scoped review follow-ups. README: contributed routers cannot enter the host's reserved public prefixes, which makes every extension endpoint session-authenticated -- there is no way to expose an unauthenticated route. The rejection rule was documented but its consequence was not, so inbound provider webhooks and public status endpoints read as merely undocumented rather than out of scope for this release. docker/dev-entrypoint.sh: the self-heal retry reuses `--locked`, so it repairs a corrupt .venv but never a lock that disagrees with pyproject.toml. `set -e` already stopped the script there -- uvicorn was not being started against a stale environment -- but it exited on a bare uv exit code with no indication of what to do. Abort explicitly with the cause and the fix. Tests slice the sync block out of the real script and run it against a stub uv, so they exercise the shipped code rather than a copy of it (/app/backend only exists inside the container). They cover the success path, the retry that recovers, the abort, and the guidance. Verified against the pre-fix script: only the guidance case goes red, confirming the abort itself was already correct. * fix(extensions): point Git SSH shorthand at the HTTPS correction Git's SCP-like shorthand carries no URL scheme, so `git+git@host:org/repo.git` reached the scheme rules looking like a bare path and was rejected with "local path references are not deployable; pass a local directory so DeerFlow can snapshot it". The operator asked for a remote source, so that guidance points at the wrong fix. Detect the shorthand ahead of the scheme rules and report the public-HTTPS correction instead. The bare `git@host:org/repo.git` spelling took a different wrong turn: packaging parses it as a direct reference named `git`, leaving `host:org/repo.git`, whose `host` reads as a URL scheme and produced the generic HTTPS message. Both spellings now share one message, as does the PEP 508 named form. * docs: keep the root extension summary within its new budget #4799 split the depth out of the module guides and added a size gate; the root file's job is now orientation, and this branch had pushed it 192 bytes past the soft limit. The manager transaction, source rules, and lock discipline are already stated in full in the extensions guide, so the root keeps the one-line orientation and points there instead of restating them. --------- Co-authored-by: Codex <codex@openai.com>
412 lines
16 KiB
Python
412 lines
16 KiB
Python
"""Tests for config-driven extension loading."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import pytest
|
|
|
|
from deerflow.extensions.loader import (
|
|
Diagnostic,
|
|
ExtensionLoadError,
|
|
ExtensionSpec,
|
|
load_extensions,
|
|
)
|
|
from extension_test_fixtures import demo_extensions
|
|
|
|
_FIXTURE = "extension_test_fixtures.demo_extensions"
|
|
|
|
|
|
@pytest.fixture(autouse=True)
|
|
def _reset_fixture_state():
|
|
demo_extensions.INSTALLED.clear()
|
|
yield
|
|
demo_extensions.INSTALLED.clear()
|
|
|
|
|
|
def test_no_specs_yields_empty_result():
|
|
loaded, diagnostics = load_extensions([])
|
|
assert diagnostics == []
|
|
assert loaded.has_middleware_contributors is False
|
|
|
|
|
|
def test_host_disabled_required_extension_is_skipped_before_resolution(monkeypatch):
|
|
def _must_not_resolve(path: str):
|
|
raise AssertionError(f"disabled extension was resolved: {path}")
|
|
|
|
monkeypatch.setattr("deerflow.extensions.loader.resolve_variable", _must_not_resolve)
|
|
|
|
loaded, diagnostics = load_extensions([ExtensionSpec(use="missing_extension:install", enabled=False, required=True)])
|
|
|
|
assert diagnostics == []
|
|
assert loaded.has_middleware_contributors is False
|
|
|
|
|
|
def test_manager_metadata_is_accepted_without_reaching_the_install_hook():
|
|
spec = ExtensionSpec(
|
|
name="demo",
|
|
package="deerflow-extension-demo",
|
|
use=f"{_FIXTURE}:install_ok",
|
|
enabled=False,
|
|
)
|
|
|
|
assert spec.name == "demo"
|
|
assert spec.package == "deerflow-extension-demo"
|
|
|
|
|
|
def test_successful_install_registers_and_attributes():
|
|
spec = ExtensionSpec(use=f"{_FIXTURE}:install_ok")
|
|
loaded, diagnostics = load_extensions([spec])
|
|
assert diagnostics == []
|
|
assert demo_extensions.INSTALLED == ["ok"]
|
|
assert loaded.middleware_contributors[0][0] == f"{_FIXTURE}:install_ok"
|
|
|
|
|
|
def test_config_block_is_passed_through_verbatim():
|
|
spec = ExtensionSpec(use=f"{_FIXTURE}:install_reads_config", config={"mode": "fast"})
|
|
load_extensions([spec])
|
|
assert demo_extensions.INSTALLED == ["config:fast"]
|
|
|
|
|
|
def test_disabled_extension_registers_nothing():
|
|
spec = ExtensionSpec(use=f"{_FIXTURE}:install_disabled", config={"enabled": False})
|
|
loaded, diagnostics = load_extensions([spec])
|
|
assert diagnostics == []
|
|
assert loaded.has_middleware_contributors is False
|
|
|
|
|
|
def test_load_order_follows_config_order():
|
|
specs = [
|
|
ExtensionSpec(use=f"{_FIXTURE}:install_ok"),
|
|
ExtensionSpec(use=f"{_FIXTURE}:install_stamped"),
|
|
]
|
|
load_extensions(specs)
|
|
assert demo_extensions.INSTALLED == ["ok", "stamped"]
|
|
|
|
|
|
def test_unresolvable_entry_point_is_skipped_with_an_error_diagnostic():
|
|
specs = [
|
|
ExtensionSpec(use="extension_test_fixtures.demo_extensions:does_not_exist"),
|
|
ExtensionSpec(use=f"{_FIXTURE}:install_ok"),
|
|
]
|
|
loaded, diagnostics = load_extensions(specs)
|
|
assert [d.level for d in diagnostics] == ["error"]
|
|
assert "does_not_exist" in diagnostics[0].source
|
|
assert demo_extensions.INSTALLED == ["ok"], "a broken extension must not stop the rest"
|
|
|
|
|
|
def test_non_callable_entry_point_is_rejected():
|
|
spec = ExtensionSpec(use=f"{_FIXTURE}:NOT_CALLABLE")
|
|
loaded, diagnostics = load_extensions([spec])
|
|
assert diagnostics[0].level == "error"
|
|
assert "callable" in diagnostics[0].message
|
|
|
|
|
|
def test_install_failure_rolls_back_partial_registration():
|
|
specs = [
|
|
ExtensionSpec(use=f"{_FIXTURE}:install_partial_then_raise"),
|
|
ExtensionSpec(use=f"{_FIXTURE}:install_ok"),
|
|
]
|
|
loaded, diagnostics = load_extensions(specs)
|
|
assert diagnostics[0].level == "error"
|
|
assert "boom" in diagnostics[0].message
|
|
sources = {source for source, _ in loaded.middleware_contributors}
|
|
assert sources == {f"{_FIXTURE}:install_ok"}
|
|
assert len(loaded.middleware_contributors) == 1, "rollback must clear every partial registration"
|
|
assert loaded.task_lifecycle == (), "rollback must clear partial lifecycle registrations too"
|
|
assert loaded.system_model_observers == ()
|
|
assert loaded.services == ()
|
|
assert loaded.routers == ()
|
|
|
|
|
|
def test_rollback_does_not_remove_a_different_specs_registrations_sharing_the_same_use():
|
|
"""Two specs may legitimately share `use` with different config (e.g. the
|
|
same extension mounted twice with different settings). Rollback on the
|
|
second's install failure must be positional, not keyed by `use` — it must
|
|
not erase the first instance's already-successful registrations just
|
|
because they share a source string."""
|
|
specs = [
|
|
ExtensionSpec(use=f"{_FIXTURE}:install_shared_use", config={"label": "first"}),
|
|
ExtensionSpec(use=f"{_FIXTURE}:install_shared_use", config={"label": "second", "fail": True}),
|
|
]
|
|
loaded, diagnostics = load_extensions(specs)
|
|
assert [d.level for d in diagnostics] == ["error"]
|
|
assert "boom-shared" in diagnostics[0].message
|
|
assert len(loaded.middleware_contributors) == 1
|
|
source, contributor = loaded.middleware_contributors[0]
|
|
assert source == f"{_FIXTURE}:install_shared_use"
|
|
assert contributor.tag == "shared:first"
|
|
|
|
|
|
def test_required_extension_failure_aborts_startup():
|
|
spec = ExtensionSpec(use=f"{_FIXTURE}:install_partial_then_raise", required=True)
|
|
with pytest.raises(ExtensionLoadError):
|
|
load_extensions([spec])
|
|
|
|
|
|
def test_required_unresolvable_extension_aborts_startup():
|
|
spec = ExtensionSpec(use="nope.nothing:here", required=True)
|
|
with pytest.raises(ExtensionLoadError):
|
|
load_extensions([spec])
|
|
|
|
|
|
def test_incompatible_declared_api_is_refused_with_actionable_message():
|
|
spec = ExtensionSpec(use=f"{_FIXTURE}:install_future_api")
|
|
loaded, diagnostics = load_extensions([spec])
|
|
assert diagnostics[0].level == "error"
|
|
assert "99.0" in diagnostics[0].message
|
|
assert "pip install" in diagnostics[0].message
|
|
assert demo_extensions.INSTALLED == [], "an incompatible extension must not run"
|
|
|
|
|
|
def test_optional_extension_with_non_string_api_marker_is_skipped_with_a_diagnostic(monkeypatch):
|
|
monkeypatch.setattr(demo_extensions.install_ok, "__deerflow_api__", 101, raising=False)
|
|
spec = ExtensionSpec(use=f"{_FIXTURE}:install_ok")
|
|
|
|
loaded, diagnostics = load_extensions([spec])
|
|
|
|
assert loaded.has_middleware_contributors is False
|
|
assert demo_extensions.INSTALLED == [], "an invalid API marker must be rejected before install()"
|
|
assert len(diagnostics) == 1
|
|
assert diagnostics[0].level == "error"
|
|
assert diagnostics[0].source == spec.use
|
|
assert "invalid extension-api version marker" in diagnostics[0].message
|
|
assert "int" in diagnostics[0].message
|
|
|
|
|
|
def test_required_extension_with_non_string_iterable_api_marker_fails_closed(monkeypatch):
|
|
class _IterableAPIMarker:
|
|
def split(self, separator: str) -> list[object]:
|
|
return [object()]
|
|
|
|
def __str__(self) -> str:
|
|
return "non-string iterable marker"
|
|
|
|
monkeypatch.setattr(
|
|
demo_extensions.install_ok,
|
|
"__deerflow_api__",
|
|
_IterableAPIMarker(),
|
|
raising=False,
|
|
)
|
|
spec = ExtensionSpec(
|
|
use=f"{_FIXTURE}:install_ok",
|
|
required=True,
|
|
)
|
|
|
|
with pytest.raises(ExtensionLoadError, match="declares invalid api marker"):
|
|
load_extensions([spec])
|
|
|
|
assert demo_extensions.INSTALLED == [], "an invalid API marker must be rejected before install()"
|
|
|
|
|
|
def test_optional_extension_with_unrenderable_api_marker_still_returns_a_diagnostic(monkeypatch):
|
|
class _UnrenderableAPIMarker:
|
|
def __str__(self) -> str:
|
|
raise RuntimeError("API marker string rendering exploded")
|
|
|
|
monkeypatch.setattr(
|
|
demo_extensions.install_ok,
|
|
"__deerflow_api__",
|
|
_UnrenderableAPIMarker(),
|
|
raising=False,
|
|
)
|
|
spec = ExtensionSpec(use=f"{_FIXTURE}:install_ok")
|
|
|
|
loaded, diagnostics = load_extensions([spec])
|
|
|
|
assert loaded.has_middleware_contributors is False
|
|
assert demo_extensions.INSTALLED == []
|
|
assert len(diagnostics) == 1
|
|
assert diagnostics[0].level == "error"
|
|
assert "invalid extension-api version marker" in diagnostics[0].message
|
|
assert "_UnrenderableAPIMarker" in diagnostics[0].message
|
|
|
|
|
|
@pytest.mark.parametrize("required", [False, True])
|
|
def test_extension_api_marker_getter_failure_obeys_required_policy(monkeypatch, required):
|
|
class _ExplodingMarkerInstall:
|
|
@property
|
|
def __deerflow_api__(self):
|
|
raise RuntimeError("API marker getter exploded")
|
|
|
|
def __call__(self, registry, config):
|
|
raise AssertionError("install must not run after marker inspection fails")
|
|
|
|
monkeypatch.setattr(
|
|
"deerflow.extensions.loader.resolve_variable",
|
|
lambda path: _ExplodingMarkerInstall(),
|
|
)
|
|
spec = ExtensionSpec(use="hostile_extension:install", required=required)
|
|
|
|
if required:
|
|
with pytest.raises(ExtensionLoadError, match="could not inspect api marker"):
|
|
load_extensions([spec])
|
|
return
|
|
|
|
loaded, diagnostics = load_extensions([spec])
|
|
assert loaded.has_middleware_contributors is False
|
|
assert len(diagnostics) == 1
|
|
assert "could not inspect extension-api version marker" in diagnostics[0].message
|
|
|
|
|
|
def test_string_subclass_api_marker_cannot_break_incompatibility_diagnostics(monkeypatch):
|
|
class _HostileString(str):
|
|
def split(self, separator: str):
|
|
raise RuntimeError("API marker split exploded")
|
|
|
|
def __str__(self) -> str:
|
|
raise RuntimeError("API marker string rendering exploded")
|
|
|
|
def __format__(self, format_spec: str) -> str:
|
|
raise RuntimeError("API marker formatting exploded")
|
|
|
|
monkeypatch.setattr(
|
|
demo_extensions.install_ok,
|
|
"__deerflow_api__",
|
|
_HostileString("99.0"),
|
|
raising=False,
|
|
)
|
|
spec = ExtensionSpec(use=f"{_FIXTURE}:install_ok")
|
|
|
|
loaded, diagnostics = load_extensions([spec])
|
|
|
|
assert loaded.has_middleware_contributors is False
|
|
assert demo_extensions.INSTALLED == []
|
|
assert len(diagnostics) == 1
|
|
assert "99.0" in diagnostics[0].message
|
|
|
|
|
|
def test_compatible_string_subclass_api_marker_can_load(monkeypatch):
|
|
class _HostileString(str):
|
|
def split(self, separator: str):
|
|
raise RuntimeError("API marker split exploded")
|
|
|
|
def __str__(self) -> str:
|
|
raise RuntimeError("API marker string rendering exploded")
|
|
|
|
def __format__(self, format_spec: str) -> str:
|
|
raise RuntimeError("API marker formatting exploded")
|
|
|
|
monkeypatch.setattr(
|
|
demo_extensions.install_ok,
|
|
"__deerflow_api__",
|
|
_HostileString("0.1.0"),
|
|
raising=False,
|
|
)
|
|
|
|
loaded, diagnostics = load_extensions([ExtensionSpec(use=f"{_FIXTURE}:install_ok")])
|
|
|
|
assert diagnostics == []
|
|
assert loaded.has_middleware_contributors is True
|
|
assert demo_extensions.INSTALLED == ["ok"]
|
|
|
|
|
|
def test_newer_minor_declared_api_is_refused():
|
|
"""Before 1.0, minors carry no compatibility promise: an extension written
|
|
against 0.2 may use contracts a 0.1 host does not implement, and the host
|
|
must refuse it with an actionable message."""
|
|
spec = ExtensionSpec(use=f"{_FIXTURE}:install_newer_minor_api")
|
|
loaded, diagnostics = load_extensions([spec])
|
|
assert diagnostics[0].level == "error"
|
|
assert "0.2" in diagnostics[0].message
|
|
assert "pip install" in diagnostics[0].message
|
|
assert demo_extensions.INSTALLED == [], "a newer-minor extension must not run on an older host"
|
|
|
|
|
|
def test_newer_minor_required_extension_aborts_startup():
|
|
spec = ExtensionSpec(use=f"{_FIXTURE}:install_newer_minor_api", required=True)
|
|
with pytest.raises(ExtensionLoadError):
|
|
load_extensions([spec])
|
|
|
|
|
|
def test_compatible_declared_api_loads():
|
|
spec = ExtensionSpec(use=f"{_FIXTURE}:install_stamped")
|
|
loaded, diagnostics = load_extensions([spec])
|
|
assert diagnostics == []
|
|
assert demo_extensions.INSTALLED == ["stamped"]
|
|
assert loaded.has_task_lifecycle is True
|
|
assert loaded.task_lifecycle[0][0] == f"{_FIXTURE}:install_stamped"
|
|
|
|
|
|
def test_compatible_follows_semver_windows():
|
|
"""0.x: minors may break — the window is same major.minor with patches
|
|
additive (host >= declared). From 1.0 on: contracts only grow within a
|
|
major. Comparisons are numeric (1.10 > 1.9), not lexicographic."""
|
|
from deerflow.extensions.loader import _compatible
|
|
|
|
# 0.x window: same major.minor, patch-level growth only.
|
|
assert _compatible("0.1", "0.1")
|
|
assert _compatible("0.1", "0.1.1"), "patch growth stays compatible"
|
|
assert not _compatible("0.1.1", "0.1"), "a newer patch declaration exceeds what the host provides"
|
|
assert not _compatible("0.2", "0.1"), "0.x minors may break: a 0.1 host must refuse 0.2 extensions"
|
|
assert not _compatible("0.1", "0.2"), "0.x minors promise nothing in the other direction either"
|
|
|
|
# 1.x+ window: same major, contracts only grow.
|
|
assert _compatible("1.0", "1.0")
|
|
assert _compatible("1.0", "1.1"), "a newer host still provides everything a 1.0 extension declared"
|
|
assert _compatible("1.9", "1.10"), "minor comparison is numeric, not lexicographic"
|
|
assert not _compatible("1.1", "1.0"), "the 1.0 host lacks the 1.1 contract additions"
|
|
assert not _compatible("1.10", "1.9")
|
|
assert not _compatible("1.0.1", "1.0"), "even a newer patch declaration exceeds what the host provides"
|
|
assert not _compatible("2.0", "1.5"), "major mismatch"
|
|
assert not _compatible("1.0", "2.0"), "major mismatch"
|
|
assert not _compatible("not-a-version", "1.0"), "unparseable versions are refused, not waved through"
|
|
|
|
|
|
def test_undeclared_api_is_allowed():
|
|
"""The decorator is optional; pip constraints remain the primary gate."""
|
|
spec = ExtensionSpec(use=f"{_FIXTURE}:install_ok")
|
|
_, diagnostics = load_extensions([spec])
|
|
assert diagnostics == []
|
|
|
|
|
|
def test_a_successful_load_is_reported(caplog):
|
|
"""Every other branch is failure-only, so without this line an operator has
|
|
no way to tell a clean load from a `plugins:` block the host never read."""
|
|
with caplog.at_level("INFO", logger="deerflow.extensions.loader"):
|
|
load_extensions([ExtensionSpec(use=f"{_FIXTURE}:install_ok")])
|
|
|
|
assert f"Extensions loaded: 1/1 ({_FIXTURE}:install_ok)" in caplog.text
|
|
|
|
|
|
def test_the_report_counts_skipped_extensions_apart_from_loaded_ones(caplog):
|
|
specs = [
|
|
ExtensionSpec(use=f"{_FIXTURE}:install_ok"),
|
|
ExtensionSpec(use="does.not.exist:install"),
|
|
]
|
|
with caplog.at_level("INFO", logger="deerflow.extensions.loader"):
|
|
load_extensions(specs)
|
|
|
|
assert f"Extensions loaded: 1/2 ({_FIXTURE}:install_ok)" in caplog.text
|
|
|
|
|
|
def test_an_all_failed_load_reports_none_rather_than_an_empty_list(caplog):
|
|
with caplog.at_level("INFO", logger="deerflow.extensions.loader"):
|
|
load_extensions([ExtensionSpec(use="does.not.exist:install")])
|
|
|
|
assert "Extensions loaded: 0/1 (none)" in caplog.text
|
|
|
|
|
|
def test_no_configured_plugins_stays_off_the_info_log(caplog):
|
|
"""The default state for nearly every deployment; a line here is boot noise."""
|
|
with caplog.at_level("INFO", logger="deerflow.extensions.loader"):
|
|
load_extensions([])
|
|
|
|
assert "Extensions loaded" not in caplog.text
|
|
|
|
|
|
def test_diagnostic_helpers_set_level():
|
|
assert Diagnostic.error("s", "m").level == "error"
|
|
assert Diagnostic.warning("s", "m").level == "warning"
|
|
assert Diagnostic.info("s", "m").level == "info"
|
|
assert Diagnostic.debug("s", "m").level == "debug"
|
|
|
|
|
|
def test_host_registry_satisfies_the_public_contract():
|
|
"""Extensions annotate install(registry: ExtensionRegistry, ...) against
|
|
the contract package alone; the host's concrete registry must satisfy that
|
|
Protocol, or every correctly-annotated extension is lying about its types."""
|
|
from deerflow_extension_api import ExtensionRegistry as ContractRegistry
|
|
|
|
from deerflow.extensions.registry import ExtensionRegistry as HostRegistry
|
|
|
|
assert isinstance(HostRegistry(), ContractRegistry)
|