Merge remote-tracking branch 'origin/master' into pr-6635-ci

scripts/no-unknown-casts.baseline.json

@@ -459,9 +459,6 @@
   "packages/client/ui-commands/tests/browser-plugin.client.spec.ts": {
     "04984a2ce1486250236e638e0197da0a1a840855ed3975c59130a85358c7e5fe": 1
   },
-  "packages/client/ui-conversation/src/client/apply.ts": {
-    "4c73f40f3ce989f285848573d7154fb295886bba707ad829e2c8c089e326aeea": 1
-  },
   "packages/client/ui-conversation/src/client/conversation/location-index.ts": {
     "a7d8cc8d42e37ad5cc4882241492ac572ed8163c7fb8663180e893c7178e906f": 1
   },

scripts/test-official-listing-guard.spec.ts

@@ -0,0 +1,26 @@
+/** Unit suites cannot reach the official DeepSeek model listing unless they answer `fetch` themselves. */
+import { createServer } from 'node:http'
+import { afterEach, expect, it } from 'vitest'
+import type { Server } from 'node:http'
+
+const servers: Server[] = []
+afterEach(async () => {
+  await Promise.all(servers.splice(0).map(server => new Promise(resolve => server.close(resolve))))
+})
+
+it.each([
+  ['string', () => fetch('https://api.deepseek.com/models')],
+  ['URL', () => fetch(new URL('https://api.deepseek.com/models'))],
+  ['Request', () => fetch(new Request('https://api.deepseek.com/models', { headers: { 'x-api-key': 'fixture-key' } }))],
+])('rejects the official model listing given as a %s', async (_kind, request) => {
+  await expect(request()).rejects.toThrow('unit suites do not reach https://api.deepseek.com/models; answer it with a fetch stub')
+})
+
+it('passes every other request to the ambient fetch', async () => {
+  const server = createServer((_request, response) => { response.end('local') })
+  servers.push(server)
+  await new Promise<void>(resolve => server.listen(0, '127.0.0.1', resolve))
+  const address = server.address()
+  if (address === null || typeof address === 'string') throw new Error('no port')
+  await expect((await fetch(`http://127.0.0.1:${address.port}/models`)).text()).resolves.toBe('local')
+})

scripts/test-official-listing-guard.ts

@@ -0,0 +1,22 @@
+/**
+ * Keep unit suites from requesting the official DeepSeek model listing.
+ *
+ * The API-key and account routes request `GET https://api.deepseek.com/models` whenever they hold a
+ * credential for the official endpoint, and suites routinely boot those routes with a dummy key or
+ * inherit a developer's real one. Such a request would reach production and, on a network that never
+ * answers, hold the route's first catalog access for its whole listing deadline. Here it fails at once,
+ * so the route serves its built-in catalog; a suite that exercises the listing replaces `fetch` itself.
+ * @module
+ */
+
+/** The listing endpoint of the official DeepSeek API. */
+const OFFICIAL_LISTING = 'https://api.deepseek.com/models'
+
+const ambientFetch = globalThis.fetch
+globalThis.fetch = (input, init) => {
+  const url = input instanceof Request ? input.url : input instanceof URL ? input.href : input
+  if (url === OFFICIAL_LISTING) {
+    return Promise.reject(new TypeError(`unit suites do not reach ${OFFICIAL_LISTING}; answer it with a fetch stub`))
+  }
+  return ambientFetch(input, init)
+}