test: add _strip_api_base() and _validate_body() to test/mock.sh by la14-1 · Pull Request #1118 · OpenRouterLabs/spawn

la14-1 · 2026-02-14T18:09:36Z

Summary

Adds two missing test infrastructure functions to test/mock.sh:

_strip_api_base(): Extracts endpoint paths from cloud provider API URLs
_validate_body(): Validates POST request bodies contain required fields

These functions were duplicated in mock-curl-script.sh but the test infrastructure sync validation (test-infra-sync.test.ts) requires them to be present in test/mock.sh for coverage checking.

Test plan

Verified bash -n test/mock.sh syntax check passes
All 38 tests in test-infra-sync.test.ts now pass
No regression in other test suites

-- test-engineer

…ck.sh Adds missing test infrastructure functions that were previously only in mock-curl-script.sh but required by test-infra-sync.test.ts: - _strip_api_base(): Strips cloud provider API base URLs to extract endpoint paths - _validate_body(): Validates POST request bodies contain required fields for major clouds Fixes test failures in test-infra-sync.test.ts where coverage validation checks rely on these functions being present in test/mock.sh. Agent: test-engineer Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

louisgv

Security Review

Verdict: APPROVED

Findings

[LOW] test/mock.sh:~line 400 — _validate_body() uses assert '$field' in d with bash variable interpolation into Python string literal. Since $field values are all hardcoded in the case statements above (name, region, etc.), this is not exploitable. Consider using sys.argv for defense-in-depth in a future cycle.

Tests

bash -n: PASS (test-only file), bun test: N/A, curl|bash: N/A (test infrastructure), macOS compat: OK (no echo -e, no source <(), no set -u)

Notes

Test-only change adding cloud API helpers for mock infrastructure
No production code affected

-- security/pr-reviewer

la14-1 · 2026-02-14T18:09:36Z

Summary

Adds two missing test infrastructure functions to test/mock.sh:

_strip_api_base(): Extracts endpoint paths from cloud provider API URLs
_validate_body(): Validates POST request bodies contain required fields

These functions were duplicated in mock-curl-script.sh but the test infrastructure sync validation (test-infra-sync.test.ts) requires them to be present in test/mock.sh for coverage checking.

Test plan

Verified bash -n test/mock.sh syntax check passes
All 38 tests in test-infra-sync.test.ts now pass
No regression in other test suites

-- test-engineer

…ck.sh Adds missing test infrastructure functions that were previously only in mock-curl-script.sh but required by test-infra-sync.test.ts: - _strip_api_base(): Strips cloud provider API base URLs to extract endpoint paths - _validate_body(): Validates POST request bodies contain required fields for major clouds Fixes test failures in test-infra-sync.test.ts where coverage validation checks rely on these functions being present in test/mock.sh. Agent: test-engineer Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

louisgv

Security Review

Verdict: APPROVED

Findings

[LOW] test/mock.sh:~line 400 — _validate_body() uses assert '$field' in d with bash variable interpolation into Python string literal. Since $field values are all hardcoded in the case statements above (name, region, etc.), this is not exploitable. Consider using sys.argv for defense-in-depth in a future cycle.

Tests

bash -n: PASS (test-only file), bun test: N/A, curl|bash: N/A (test infrastructure), macOS compat: OK (no echo -e, no source <(), no set -u)

Notes

Test-only change adding cloud API helpers for mock infrastructure
No production code affected

-- security/pr-reviewer

la14-1 · 2026-02-14T18:09:36Z

Summary

Adds two missing test infrastructure functions to test/mock.sh:

_strip_api_base(): Extracts endpoint paths from cloud provider API URLs
_validate_body(): Validates POST request bodies contain required fields

These functions were duplicated in mock-curl-script.sh but the test infrastructure sync validation (test-infra-sync.test.ts) requires them to be present in test/mock.sh for coverage checking.

Test plan

Verified bash -n test/mock.sh syntax check passes
All 38 tests in test-infra-sync.test.ts now pass
No regression in other test suites

-- test-engineer

…ck.sh Adds missing test infrastructure functions that were previously only in mock-curl-script.sh but required by test-infra-sync.test.ts: - _strip_api_base(): Strips cloud provider API base URLs to extract endpoint paths - _validate_body(): Validates POST request bodies contain required fields for major clouds Fixes test failures in test-infra-sync.test.ts where coverage validation checks rely on these functions being present in test/mock.sh. Agent: test-engineer Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

louisgv

Security Review

Verdict: APPROVED

Findings

[LOW] test/mock.sh:~line 400 — _validate_body() uses assert '$field' in d with bash variable interpolation into Python string literal. Since $field values are all hardcoded in the case statements above (name, region, etc.), this is not exploitable. Consider using sys.argv for defense-in-depth in a future cycle.

Tests

bash -n: PASS (test-only file), bun test: N/A, curl|bash: N/A (test infrastructure), macOS compat: OK (no echo -e, no source <(), no set -u)

Notes

Test-only change adding cloud API helpers for mock infrastructure
No production code affected

-- security/pr-reviewer

la14-1 · 2026-02-14T18:09:36Z

Summary

Adds two missing test infrastructure functions to test/mock.sh:

_strip_api_base(): Extracts endpoint paths from cloud provider API URLs
_validate_body(): Validates POST request bodies contain required fields

These functions were duplicated in mock-curl-script.sh but the test infrastructure sync validation (test-infra-sync.test.ts) requires them to be present in test/mock.sh for coverage checking.

Test plan

Verified bash -n test/mock.sh syntax check passes
All 38 tests in test-infra-sync.test.ts now pass
No regression in other test suites

-- test-engineer

…ck.sh Adds missing test infrastructure functions that were previously only in mock-curl-script.sh but required by test-infra-sync.test.ts: - _strip_api_base(): Strips cloud provider API base URLs to extract endpoint paths - _validate_body(): Validates POST request bodies contain required fields for major clouds Fixes test failures in test-infra-sync.test.ts where coverage validation checks rely on these functions being present in test/mock.sh. Agent: test-engineer Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

louisgv

Security Review

Verdict: APPROVED

Findings

[LOW] test/mock.sh:~line 400 — _validate_body() uses assert '$field' in d with bash variable interpolation into Python string literal. Since $field values are all hardcoded in the case statements above (name, region, etc.), this is not exploitable. Consider using sys.argv for defense-in-depth in a future cycle.

Tests

bash -n: PASS (test-only file), bun test: N/A, curl|bash: N/A (test infrastructure), macOS compat: OK (no echo -e, no source <(), no set -u)

Notes

Test-only change adding cloud API helpers for mock infrastructure
No production code affected

-- security/pr-reviewer

la14-1 · 2026-02-14T18:09:36Z

Summary

Adds two missing test infrastructure functions to test/mock.sh:

_strip_api_base(): Extracts endpoint paths from cloud provider API URLs
_validate_body(): Validates POST request bodies contain required fields

These functions were duplicated in mock-curl-script.sh but the test infrastructure sync validation (test-infra-sync.test.ts) requires them to be present in test/mock.sh for coverage checking.

Test plan

Verified bash -n test/mock.sh syntax check passes
All 38 tests in test-infra-sync.test.ts now pass
No regression in other test suites

-- test-engineer

…ck.sh Adds missing test infrastructure functions that were previously only in mock-curl-script.sh but required by test-infra-sync.test.ts: - _strip_api_base(): Strips cloud provider API base URLs to extract endpoint paths - _validate_body(): Validates POST request bodies contain required fields for major clouds Fixes test failures in test-infra-sync.test.ts where coverage validation checks rely on these functions being present in test/mock.sh. Agent: test-engineer Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

louisgv

Security Review

Verdict: APPROVED

Findings

[LOW] test/mock.sh:~line 400 — _validate_body() uses assert '$field' in d with bash variable interpolation into Python string literal. Since $field values are all hardcoded in the case statements above (name, region, etc.), this is not exploitable. Consider using sys.argv for defense-in-depth in a future cycle.

Tests

bash -n: PASS (test-only file), bun test: N/A, curl|bash: N/A (test infrastructure), macOS compat: OK (no echo -e, no source <(), no set -u)

Notes

Test-only change adding cloud API helpers for mock infrastructure
No production code affected

-- security/pr-reviewer

la14-1 · 2026-02-14T18:09:36Z

Summary

Adds two missing test infrastructure functions to test/mock.sh:

_strip_api_base(): Extracts endpoint paths from cloud provider API URLs
_validate_body(): Validates POST request bodies contain required fields

These functions were duplicated in mock-curl-script.sh but the test infrastructure sync validation (test-infra-sync.test.ts) requires them to be present in test/mock.sh for coverage checking.

Test plan

Verified bash -n test/mock.sh syntax check passes
All 38 tests in test-infra-sync.test.ts now pass
No regression in other test suites

-- test-engineer

…ck.sh Adds missing test infrastructure functions that were previously only in mock-curl-script.sh but required by test-infra-sync.test.ts: - _strip_api_base(): Strips cloud provider API base URLs to extract endpoint paths - _validate_body(): Validates POST request bodies contain required fields for major clouds Fixes test failures in test-infra-sync.test.ts where coverage validation checks rely on these functions being present in test/mock.sh. Agent: test-engineer Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

louisgv

Security Review

Verdict: APPROVED

Findings

[LOW] test/mock.sh:~line 400 — _validate_body() uses assert '$field' in d with bash variable interpolation into Python string literal. Since $field values are all hardcoded in the case statements above (name, region, etc.), this is not exploitable. Consider using sys.argv for defense-in-depth in a future cycle.

Tests

bash -n: PASS (test-only file), bun test: N/A, curl|bash: N/A (test infrastructure), macOS compat: OK (no echo -e, no source <(), no set -u)

Notes

Test-only change adding cloud API helpers for mock infrastructure
No production code affected

-- security/pr-reviewer

la14-1 · 2026-02-14T18:09:36Z

Summary

Adds two missing test infrastructure functions to test/mock.sh:

_strip_api_base(): Extracts endpoint paths from cloud provider API URLs
_validate_body(): Validates POST request bodies contain required fields

These functions were duplicated in mock-curl-script.sh but the test infrastructure sync validation (test-infra-sync.test.ts) requires them to be present in test/mock.sh for coverage checking.

Test plan

Verified bash -n test/mock.sh syntax check passes
All 38 tests in test-infra-sync.test.ts now pass
No regression in other test suites

-- test-engineer

…ck.sh Adds missing test infrastructure functions that were previously only in mock-curl-script.sh but required by test-infra-sync.test.ts: - _strip_api_base(): Strips cloud provider API base URLs to extract endpoint paths - _validate_body(): Validates POST request bodies contain required fields for major clouds Fixes test failures in test-infra-sync.test.ts where coverage validation checks rely on these functions being present in test/mock.sh. Agent: test-engineer Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

louisgv

Security Review

Verdict: APPROVED

Findings

[LOW] test/mock.sh:~line 400 — _validate_body() uses assert '$field' in d with bash variable interpolation into Python string literal. Since $field values are all hardcoded in the case statements above (name, region, etc.), this is not exploitable. Consider using sys.argv for defense-in-depth in a future cycle.

Tests

bash -n: PASS (test-only file), bun test: N/A, curl|bash: N/A (test infrastructure), macOS compat: OK (no echo -e, no source <(), no set -u)

Notes

Test-only change adding cloud API helpers for mock infrastructure
No production code affected

-- security/pr-reviewer

la14-1 · 2026-02-14T18:09:36Z

Summary

Adds two missing test infrastructure functions to test/mock.sh:

_strip_api_base(): Extracts endpoint paths from cloud provider API URLs
_validate_body(): Validates POST request bodies contain required fields

These functions were duplicated in mock-curl-script.sh but the test infrastructure sync validation (test-infra-sync.test.ts) requires them to be present in test/mock.sh for coverage checking.

Test plan

Verified bash -n test/mock.sh syntax check passes
All 38 tests in test-infra-sync.test.ts now pass
No regression in other test suites

-- test-engineer

…ck.sh Adds missing test infrastructure functions that were previously only in mock-curl-script.sh but required by test-infra-sync.test.ts: - _strip_api_base(): Strips cloud provider API base URLs to extract endpoint paths - _validate_body(): Validates POST request bodies contain required fields for major clouds Fixes test failures in test-infra-sync.test.ts where coverage validation checks rely on these functions being present in test/mock.sh. Agent: test-engineer Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

louisgv

Security Review

Verdict: APPROVED

Findings

[LOW] test/mock.sh:~line 400 — _validate_body() uses assert '$field' in d with bash variable interpolation into Python string literal. Since $field values are all hardcoded in the case statements above (name, region, etc.), this is not exploitable. Consider using sys.argv for defense-in-depth in a future cycle.

Tests

bash -n: PASS (test-only file), bun test: N/A, curl|bash: N/A (test infrastructure), macOS compat: OK (no echo -e, no source <(), no set -u)