peptiderepo 696b4d8062 test(smoke): match real key token, not the sk-or- placeholder (#25) ...

The write-only security check in 08-pr-vision-admin.spec.ts asserted
page.content() does not contain 'sk-or-'. The password input for the
API key renders with placeholder="sk-or-…" (an ellipsis format hint
shown when the key is admin-managed). This placeholder contains the
literal string 'sk-or-' so the naive toContain assertion trips even
though value="" and no real key is in the page.

Fix: replace toContain('sk-or-') with toMatch(/sk-or-v1-[A-Za-z0-9]{20,}/).
A real OpenRouter key uses the format 'sk-or-v1-<20+ alnum chars>';
the placeholder ellipsis 'sk-or-…' never matches this pattern, so the
false-positive is eliminated. The assertion still catches any real key
accidentally rendered in server-side HTML.

The value="" assertion is unchanged and continues to guard the core
write-only invariant independently.

Agent-Session: fix-smoke-key-assertion-20260617

Co-authored-by: peptiderepo <bot@peptiderepo.com>

2026-06-17 13:07:56 +07:00

9.1 KiB

Raw Blame History

View Raw