Address CodeRabbit provider feedback

apps/workshop/tests/openrouter-mock.mjs

@@ -28,12 +28,23 @@ const server = createServer(async (request, response) => {
     json(response, 400, { error: { message: "Unexpected upstream model" } });
     return;
   }
+  const forbiddenRoutingField = ["models", "provider", "route", "plugins", "transforms"].find((field) => field in body);
+  if (forbiddenRoutingField) {
+    json(response, 400, { error: { message: `Client routing field was forwarded: ${forbiddenRoutingField}` } });
+    return;
+  }
+  if (body.messages?.some((message) => message.content === "upstream failure")) {
+    json(response, 503, { error: { message: "Simulated upstream failure" } });
+    return;
+  }
 
   const completion = {
     id: "gen-workshop-test",
     object: "chat.completion",
     model: body.model,
-    choices: [{ index: 0, message: { role: "assistant", content: "Hello from the Homarr provider" }, finish_reason: "stop" }],
+    choices: [
+      { index: 0, message: { role: "assistant", content: "Hello from the Homarr provider" }, finish_reason: "stop" },
+    ],
     usage: { prompt_tokens: 12, completion_tokens: 7, total_tokens: 19, cost: 0.00041 },
   };
   if (!body.stream) {

apps/workshop/tests/workshop.integration.mjs

@@ -229,12 +229,13 @@ while (true) {
   if (chunk.done) break;
   streamText += new TextDecoder().decode(chunk.value);
 }
-const streamFinishedAt = performance.now();
+const dataFrames = streamText.split(/\r?\n/u).filter((line) => line.startsWith("data:"));
 if (
   firstChunk.done ||
   !streamText.includes("Hello from ") ||
   !streamText.includes("the Homarr provider") ||
-  streamFinishedAt - firstChunkAt < 50 ||
+  dataFrames.length < 3 ||
+  dataFrames.at(-1)?.trim() !== "data: [DONE]" ||
   firstChunkAt - streamStartedAt > 5_000
 ) {
   throw new Error("The Homarr provider did not preserve the upstream SSE stream");
@@ -260,6 +261,11 @@ const toolResponse = await fetch(`${baseUrl}/api/ai/v1/chat/completions`, {
       { role: "tool", tool_call_id: "two", content: "{}" },
     ],
     stream: false,
+    models: ["attacker/model"],
+    provider: { order: ["attacker"] },
+    route: "fallback",
+    plugins: ["web"],
+    transforms: ["middle-out"],
   }),
 });
 if (!toolResponse.ok || toolResponse.headers.get("x-homarr-quota-remaining") !== "46") {
@@ -271,6 +277,23 @@ if (afterToolsUsage.used !== 4 || afterToolsUsage.remaining !== 46) {
   throw new Error(`Tool request accounting is incorrect: ${JSON.stringify(afterToolsUsage)}`);
 }
 
+const upstreamFailure = await fetch(`${baseUrl}/api/ai/v1/chat/completions`, {
+  method: "POST",
+  headers: { "content-type": "application/json", ...authorSession.headers },
+  body: JSON.stringify({
+    model: "homarr/deepseek-v4-flash-latest",
+    messages: [{ role: "user", content: "upstream failure" }],
+    stream: false,
+  }),
+});
+if (upstreamFailure.status !== 503 || upstreamFailure.headers.get("x-homarr-quota-remaining") !== "46") {
+  throw new Error("Failed upstream requests must refund their Homarr provider allowance");
+}
+const afterFailureUsage = await request("/api/ai/usage", { headers: authorSession.headers });
+if (afterFailureUsage.used !== 4 || afterFailureUsage.remaining !== 46) {
+  throw new Error(`Failed upstream request was charged: ${JSON.stringify(afterFailureUsage)}`);
+}
+
 const publicActivities = await request("/api/collections/assistant_activity/records?sort=-created&perPage=10");
 if (
   publicActivities.items.length < 2 ||
@@ -306,6 +329,18 @@ if (
 ) {
   throw new Error("Private provider accounting must identify the user without storing request content");
 }
+const requestToRetain = privateRequests.items.find((item) => item.publicActivity);
+if (!requestToRetain) throw new Error("Expected a private request linked to public activity");
+await request(`/api/collections/assistant_activity/records/${requestToRetain.publicActivity}`, {
+  method: "DELETE",
+  headers: rootHeaders,
+});
+const retainedRequest = await request(`/api/collections/assistant_requests/records/${requestToRetain.id}`, {
+  headers: rootHeaders,
+});
+if (retainedRequest.id !== requestToRetain.id || retainedRequest.publicActivity) {
+  throw new Error("Pruning public activity must retain private accounting records");
+}
 const quotas = await request("/api/collections/assistant_quotas/records?perPage=20", { headers: rootHeaders });
 const authorQuota = quotas.items.find((item) => item.user === author.id);
 if (!authorQuota || authorQuota.dailyLimit !== 50 || authorQuota.used !== 4 || authorQuota.totalTokens !== 38) {