tenant.openagents/omega

1use serde::Deserialize;
2
3#[derive(Debug, Deserialize)]
4struct AllowList {
5    version: u32,
6    owner: String,
7    enforcement: String,
8    normal_start_forbidden_hosts: Vec<String>,
9    entries: Vec<AllowListEntry>,
10}
11
12#[derive(Debug, Deserialize)]
13struct AllowListEntry {
14    host: String,
15    purpose: String,
16    owner: String,
17    disposition: String,
18    expiry: String,
19    #[serde(default)]
20    paths: Vec<String>,
21    #[serde(default)]
22    compatibility_override: Option<String>,
23}
24
25fn load_allowlist() -> AllowList {
26    let path =
27        std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("fixtures/endpoint_allowlist.json");
28    let text = std::fs::read_to_string(&path)
29        .unwrap_or_else(|error| panic!("read {}: {error}", path.display()));
30    serde_json::from_str(&text).unwrap_or_else(|error| panic!("parse allowlist: {error}"))
31}
32
33#[test]
34fn zed_production_services_are_disabled_by_default() {
35    assert!(!super::ZED_PRODUCTION_SERVICES_ENABLED);
36    // The env override is opt-in and not set during tests.
37    assert!(!super::zed_production_services_enabled());
38}
39
40#[test]
41fn endpoint_allowlist_blocks_zed_hosts_for_normal_start() {
42    let allowlist = load_allowlist();
43    assert_eq!(allowlist.version, 1);
44    assert_eq!(allowlist.owner, "OpenAgents");
45    assert_eq!(allowlist.enforcement, "release-proof-evidence-only");
46
47    for host in [
48        "zed.dev",
49        "api.zed.dev",
50        "cloud.zed.dev",
51        "collab.zed.dev",
52        "status.zed.dev",
53    ] {
54        assert!(
55            allowlist
56                .normal_start_forbidden_hosts
57                .iter()
58                .any(|forbidden| forbidden == host),
59            "missing forbidden host {host}"
60        );
61    }
62
63    for entry in &allowlist.entries {
64        assert!(!entry.purpose.is_empty());
65        assert_eq!(entry.owner, "OpenAgents");
66        assert!(!entry.expiry.is_empty());
67        if entry.host.contains("zed.") {
68            assert_eq!(entry.disposition, "blocked-by-default");
69            assert_eq!(
70                entry.compatibility_override.as_deref(),
71                Some("OMEGA_ALLOW_ZED_SERVICES=1")
72            );
73        }
74    }
75
76    for (host, required_path, purpose) in [
77        (
78            "cdn.agentclientprotocol.com",
79            "/registry/v1/",
80            "ACP registry",
81        ),
82        ("nodejs.org", "/dist/", "Node.js and npm"),
83        ("registry.npmjs.org", "/", "npm metadata and tarballs"),
84    ] {
85        assert!(allowlist.entries.iter().any(|entry| {
86            entry.host == host
87                && entry.purpose.contains(purpose)
88                && entry.disposition == "approved"
89                && entry.paths.iter().any(|path| path == required_path)
90        }));
91    }
92}
93
94#[test]
95fn default_settings_enable_registry_acp_without_enabling_zed_production() {
96    let path =
97        std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../../assets/settings/default.json");
98    let text = std::fs::read_to_string(&path)
99        .unwrap_or_else(|error| panic!("read {}: {error}", path.display()));
100    let settings: serde_json::Value = settings_json::parse_json_with_comments(&text)
101        .unwrap_or_else(|error| panic!("parse {}: {error}", path.display()));
102
103    assert_eq!(settings["disable_ai"], false);
104    // OMEGA-DELTA-0027. Full Auto is routed through this agent, so an empty
105    // `agent_servers` is a Full Auto run that cannot start.
106    assert_eq!(settings["agent_servers"]["codex-acp"]["type"], "registry");
107    // The next four are OMEGA-DELTA-0026: the settings-layer half of the
108    // service isolation this test is named for. `auto_update` and
109    // `auto_install_extensions` look off-topic here and are not — they are the
110    // two defaults that reach a Zed production host without any account. Do not
111    // tidy them away; the delta cites these exact assertions, and
112    // `the_service_isolation_test_still_asserts_the_registered_defaults` in
113    // `crates/omega_deltas` fails if they go.
114    assert_eq!(settings["server_url"], "https://services.openagents.invalid");
115    assert_eq!(settings["auto_update"], false);
116    assert_eq!(settings["edit_predictions"]["provider"], "none");
117    assert_eq!(settings["auto_install_extensions"], serde_json::json!({}));
118    // OMEGA-DELTA-0004.
119    assert_eq!(settings["telemetry"]["diagnostics"], false);
120    assert_eq!(settings["telemetry"]["metrics"], false);
121    assert!(!text.contains("\"server_url\": \"https://zed.dev\""));
122    // A direct provider, not a Zed-hosted one. What this assertion protects is
123    // that the default never points at a Zed service; it is not a claim about
124    // which direct provider the owner prefers.
125    assert_eq!(settings["agent"]["default_model"]["provider"], "google");
126    assert!(!super::zed_production_services_enabled());
127}
128