Smoke test: exercise scripts/soporte-action.ts against the live support-action contract
The gap that let VENUS-373's four defects accumulate undetected. support-action/route.ts and soporte-action-lib.ts have unit tests; scripts/soporte-action.ts is their ONLY agent-facing client and NOTHING checks the two agree. Three contract changes landed across VENUS-252 and VENUS-371 (secret rename, required idempotencyKey) and each silently broke the CLI with every existing test green. WHY IT STAYED INVISIBLE, which the test must fix: every failure was LOCAL or PRE-REQUEST. The wrong secret name failed at the script's own env check before any HTTP call, so prod logs recorded nothing — there was no error anywhere to notice. A test that only asserts 'route rejects a bad request' would still pass today; the missing assertion is that the CLIENT constructs a request the route ACCEPTS. MINIMUM SHAPE (no network needed, so it can run in the normal gate): import parseSoporteCommand from soporte-action-lib.ts, build the request body exactly as soporte-action.ts does for each op it supports, and assert parse returns ok:true. That alone would have caught the missing idempotencyKey. Add an assertion that the env var the script reads is the same name resolveBearerSecret() reads in the route — a string-equality check on the two identifiers, since there is no fallback left to absorb drift. ALSO WORTH COVERING: the script supports only reply|close while the route accepts reply|note|close|reopen|notify-set|assign|create plus GET/LIST (per VENUS-371). That divergence is not a bug today but it is the same drift class, so the test should fail loudly when the route gains an op the CLI cannot reach, or the gap should at least be asserted deliberately rather than by accident. Do NOT make the gate depend on a live prod call — SUPPORT_API_KEY is a write-only Vercel sensitive var and is not readable in CI (mem:reference_vercel_sensitive_env_unreadable). Contract-level assertions only. Filed per pm-venus-cc 2026-08-16, low priority, not urgent.
Questions
Activity
-
parent=#2698
-
SCOPE CLARIFICATION — the VENUS-373 harness (47cf1446) does NOT close this item. Read before assuming coverage. What shipped there: scripts/pg-harness.sh + src/lib/__tests__/support-reply-agent-label.test.ts, which execute replyCore SQL against a real loopback Postgres. That proves the DB statement writes the right values into the right columns. It says nothing about whether scripts/soporte-action.ts builds a request the route accepts, which is this WI and is a different plane entirely — all three original drifts were LOCAL or PRE-REQUEST failures that never reached SQL. Concretely: every defect this WI exists to catch would still be invisible today. The wrong secret name fails at the script env check, the dead self-heal fails in a swallowed catch, the missing idempotencyKey fails at route parse — none of them reach replyCore, so a green harness run is fully compatible with a totally dead CLI. Do not let the new integration coverage read as satisfying this. Minimum shape stated in the description is unchanged and still correct: import parseSoporteCommand, build the body exactly as the CLI does per op, assert ok:true; plus a string-equality assertion between the env var the script reads and the one resolveBearerSecret() reads, since no fallback remains to absorb drift. No network, so it runs in the normal gate. One thing the harness DID establish that helps here: venus has full Postgres server binaries and pg-harness.sh, so if this WI ever wants a genuine end-to-end leg it now has a no-egress place to run one. Not required — contract-level assertions remain the right scope, and the description is right that the gate must not depend on a live prod call. Still backlog, priority 3, assigned coder-venus-cc.
-
SHIPPED e9d5ca6 v1.13.9 (live-confirmed, githubCommitSha match). Contract smoke test binding scripts/soporte-action.ts to the support-action route: 5 tests, each falsification-verified against a reproduced historical VENUS-373 defect. Extracted buildSoporteActionBody as an import-free leaf shared by CLI+test to prevent re-drift. Class-S, self-verified, no audit needed.