The per-connector "enabled/disabled model" settings lived under a
global key in the settings key-value table
(`disabled_models:${connectorId}`). No company dimension. Deleting a
company left the pool choices behind, and creating a new company
silently inherited them — the visible symptom was "onboarding's team-
model configuration survives company deletion and pollutes the next
company's CEO model list."
Root fix, not a cleanup hook: the storage becomes a real relational
table with `(company_id, connector_id)` primary key and an
`ON DELETE CASCADE` FK from `companies`. Company deletion wipes pool
config by construction; no cleanup step in `deleteCompany()` can
drift.
Schema (migration v42):
- CREATE TABLE connector_model_pool_settings (company_id, connector_id,
disabled_models_json, updated_at), PK (company_id, connector_id),
FK companies(id) ON DELETE CASCADE.
- Drop every `settings.disabled_models:*` key — these were the bug's
residue; there is no right company to attribute them to, so the
migration clears them. Users re-select on next onboarding.
API surgery — every reader/writer now takes companyId:
- db.getDisabledModels(companyId, connectorId)
- db.setDisabledModels(companyId, connectorId, models)
- db.hasModelPoolSettings(companyId, connectorId)
- connector-model-policy: getConnectorModelPolicy(deps, companyId,
connectorId); validateConnectorModelSelection(deps, companyId,
connectorId, model)
- model-dispatch: listEnabledModels(companyId, deps);
pickModelForAgent resolves companyId from agent.companyId
- orchestration heartbeat/task-runner/turn-context/run-dispatch pass
the agent's or run's companyId through to the policy deps
- IPC schema: connectorDisabledModelsSchema gains companyId; new
connectorModelPoolQuerySchema pairs companyId+connectorId for reads
Onboarding becomes commit-on-launch:
- useConnectorModelSelection no longer persists via IPC during
onboarding. Toggles mutate local state; it exposes `poolSelections`
to the wizard.
- bootstrapOnboardingSchema gains connectorPoolSelections. The
onboarding service saves the company first, then persists each
per-connector disabled list scoped to the new company id — CEO
model validation runs against the company's freshly-persisted pool,
not some stale global.
- IPC setConnectorDisabledModels now requires companyId; the only
consumer was onboarding, which no longer calls it at all.
- Main-side listConnectorModels returns the raw provider catalog
(no pool filtering), since that IPC is used from onboarding where
no company exists yet; pool filtering happens at dispatch time.
saveConnector IPC drops the per-company pool validation — connector
config is a global hint, company-scoped enforcement belongs at run
dispatch where the company is known.
Tests: 603/603 green. Typecheck clean. Integration tests rewritten
to set the pool via connectorPoolSelections on bootstrap input, not
a pre-bootstrap global setDisabledModels call.
108 lines
3.4 KiB
TypeScript
108 lines
3.4 KiB
TypeScript
import { mkdtemp, rm } from "node:fs/promises";
|
|
import { join } from "node:path";
|
|
import { tmpdir } from "node:os";
|
|
import { afterEach, describe, expect, it, vi } from "vitest";
|
|
import type { IpcMainInvokeEvent } from "electron";
|
|
import type { DesktopResult } from "@shared/contracts";
|
|
import { IPC_CHANNELS } from "@shared/contracts";
|
|
import { AppDatabase } from "../../src/main/database";
|
|
import { registerCoreAgentGraphHandlers } from "../../src/main/ipc-core-agent-graph-handlers";
|
|
|
|
type IpcHandler = (
|
|
event: IpcMainInvokeEvent,
|
|
...args: unknown[]
|
|
) => Promise<DesktopResult<unknown>> | DesktopResult<unknown>;
|
|
|
|
const tempDirs: string[] = [];
|
|
|
|
async function createTempDir(prefix: string) {
|
|
const dir = await mkdtemp(join(tmpdir(), prefix));
|
|
tempDirs.push(dir);
|
|
return dir;
|
|
}
|
|
|
|
afterEach(async () => {
|
|
await Promise.all(tempDirs.splice(0).map((dir) => rm(dir, { recursive: true, force: true })));
|
|
});
|
|
|
|
describe("ipc-core-agent-graph-handlers model enforcement", () => {
|
|
it("rejects saveAgent when the selected model is disabled for the connector", async () => {
|
|
const profileDir = await createTempDir("agentcompany-agent-handler-");
|
|
const db = new AppDatabase(profileDir);
|
|
db.init();
|
|
|
|
db.updateConnectorHealth({
|
|
id: "openai-codex",
|
|
status: "ready",
|
|
authState: "authenticated",
|
|
version: "test",
|
|
lastError: null,
|
|
});
|
|
const companyId = db.saveCompany({
|
|
name: "Handler Test Co",
|
|
description: "Tests saveAgent model validation",
|
|
status: "active",
|
|
});
|
|
db.setDisabledModels(companyId, "openai-codex", [{ id: "gpt-5.4", label: "gpt-5.4" }]);
|
|
const workspaceId = db.saveWorkspace({
|
|
companyId,
|
|
name: "Primary",
|
|
localPath: profileDir,
|
|
repoUrl: "",
|
|
repoRef: "",
|
|
isPrimary: true,
|
|
});
|
|
const agentId = db.saveAgent({
|
|
companyId,
|
|
name: "CEO",
|
|
role: "CEO",
|
|
title: "Chief Executive Officer",
|
|
status: "idle",
|
|
reportsTo: null,
|
|
connectorId: "openai-codex",
|
|
workspaceId,
|
|
model: null,
|
|
capabilities: "Lead the company",
|
|
budgetMonthlyUsd: 250,
|
|
});
|
|
|
|
const handlers = new Map<string, IpcHandler>();
|
|
registerCoreAgentGraphHandlers({
|
|
registerHandle: (channel, handler) => {
|
|
handlers.set(channel, handler);
|
|
},
|
|
db,
|
|
ensureCompanyExists: (id) => (db.hasCompany(id) ? null : { ok: false, error: { code: "COMPANY_NOT_FOUND", message: "missing" } }),
|
|
findInvalidReference: () => null,
|
|
publishDomainChanged: vi.fn(),
|
|
handleApprovalResolved: vi.fn(),
|
|
logger: { info: vi.fn(), warn: vi.fn(), error: vi.fn() },
|
|
});
|
|
|
|
const saveAgent = handlers.get(IPC_CHANNELS.saveAgent);
|
|
if (!saveAgent) {
|
|
throw new Error("saveAgent handler was not registered.");
|
|
}
|
|
|
|
const result = await saveAgent(null as unknown as IpcMainInvokeEvent, {
|
|
id: agentId,
|
|
companyId,
|
|
name: "CEO",
|
|
role: "CEO",
|
|
title: "Chief Executive Officer",
|
|
department: "executive",
|
|
status: "idle",
|
|
reportsTo: null,
|
|
connectorId: "openai-codex",
|
|
workspaceId,
|
|
model: "gpt-5.4",
|
|
metadataJson: "{}",
|
|
capabilities: "Lead the company",
|
|
budgetMonthlyUsd: 250,
|
|
}) as { ok: boolean; error?: { code: string; message: string } };
|
|
|
|
expect(result.ok).toBe(false);
|
|
expect(result.error?.code).toBe("CONNECTOR_MODEL_NOT_ALLOWED");
|
|
});
|
|
});
|