源码快照 @ 2026-09-02 (source-only, 剔除非源码素材)

packaging/helm/openwork-ee/tests/automations-enabled.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+chart_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+tmp_dir="$(mktemp -d)"
+trap 'rm -rf "$tmp_dir"' EXIT
+
+assert_contains() {
+  local file="$1"
+  local needle="$2"
+  if ! grep -F -q -- "$needle" "$file"; then
+    printf 'Expected rendered chart to contain %s\n' "$needle" >&2
+    return 1
+  fi
+}
+
+default_rendered="$tmp_dir/default.yaml"
+helm template openwork-ee "$chart_dir" > "$default_rendered"
+assert_contains "$default_rendered" 'DEN_AUTOMATIONS_ENABLED: "false"'
+assert_contains "$default_rendered" 'DEN_AUTOMATIONS_RUNTIME_ENABLED: "true"'
+
+enabled_values="$tmp_dir/enabled-values.yaml"
+enabled_rendered="$tmp_dir/enabled.yaml"
+printf '%s\n' 'config:' '  public:' '    automationsEnabled: "true"' > "$enabled_values"
+helm template openwork-ee "$chart_dir" -f "$enabled_values" > "$enabled_rendered"
+assert_contains "$enabled_rendered" 'DEN_AUTOMATIONS_ENABLED: "true"'
+
+disabled_values="$tmp_dir/disabled-values.yaml"
+disabled_rendered="$tmp_dir/disabled.yaml"
+printf '%s\n' 'config:' '  public:' '    automationsRuntimeEnabled: "false"' > "$disabled_values"
+helm template openwork-ee "$chart_dir" -f "$disabled_values" > "$disabled_rendered"
+assert_contains "$disabled_rendered" 'DEN_AUTOMATIONS_RUNTIME_ENABLED: "false"'
+
+printf 'automations-enabled chart checks passed\n'

packaging/helm/openwork-ee/tests/custom-ca-mysql-tls.mjs

@@ -0,0 +1,271 @@
+import { spawnSync } from "node:child_process";
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+const chartDir = join(dirname(fileURLToPath(import.meta.url)), "..");
+const repoRoot = join(chartDir, "..", "..", "..");
+const denDbDir = join(repoRoot, "ee", "packages", "den-db");
+const denDbPackage = join(denDbDir, "package.json");
+const denDbRequire = createRequire(denDbPackage);
+const mysql = denDbRequire("mysql2/promise");
+const bootstrapPath = join(denDbDir, "dist", "scripts", "bootstrap.js");
+const currentSchemaPath = join(denDbDir, "dist", "current-schema.sql");
+const denDbIndexPath = join(denDbDir, "dist", "index.js");
+const image = process.env.OPENWORK_EVAL_MYSQL_IMAGE?.trim() || "mysql:8.4";
+const containerName = `openwork-custom-ca-mysql-${process.pid}-${Date.now()}`;
+const tmp = mkdtempSync(join(tmpdir(), "openwork-custom-ca-mysql-"));
+const certsDir = join(tmp, "certs");
+const caKey = join(certsDir, "ca.key");
+const caCert = join(certsDir, "ca.crt");
+const serverKey = join(certsDir, "server.key");
+const serverCsr = join(certsDir, "server.csr");
+const serverCert = join(certsDir, "server.crt");
+const opensslConfig = join(tmp, "openssl.cnf");
+const mysqlConfig = join(tmp, "tls.cnf");
+const databaseName = "openwork_den";
+const databaseUser = "openwork";
+const databasePassword = "openwork_tls_test_password";
+let containerStarted = false;
+
+function run(command, args, options = {}) {
+  return spawnSync(command, args, {
+    cwd: repoRoot,
+    encoding: "utf8",
+    maxBuffer: 20 * 1024 * 1024,
+    timeout: 180_000,
+    ...options,
+  });
+}
+
+function ensureSuccess(result, description) {
+  if (result.status !== 0) {
+    throw new Error(`${description} failed\nstdout:\n${result.stdout}\nstderr:\n${result.stderr}`);
+  }
+}
+
+function runOpenSsl(args) {
+  ensureSuccess(run("openssl", args), `openssl ${args.join(" ")}`);
+}
+
+function ensureBuildArtifacts() {
+  if (existsSync(bootstrapPath) && existsSync(currentSchemaPath) && existsSync(denDbIndexPath)) {
+    return;
+  }
+
+  const result = run("pnpm", ["--dir", denDbDir, "run", "build"], { timeout: 240_000 });
+  ensureSuccess(result, "pnpm --dir ee/packages/den-db run build");
+  console.log("Built @openwork-ee/den-db migration artifacts");
+}
+
+function generateCertificates() {
+  mkdirSync(certsDir, { recursive: true });
+  writeFileSync(
+    opensslConfig,
+    `[req]
+distinguished_name = dn
+prompt = no
+req_extensions = v3_req
+[dn]
+CN = localhost
+[v3_req]
+basicConstraints = CA:FALSE
+keyUsage = digitalSignature,keyEncipherment
+extendedKeyUsage = serverAuth
+subjectAltName = @alt_names
+[alt_names]
+DNS.1 = localhost
+DNS.2 = mysql.private.test
+IP.1 = 127.0.0.1
+`,
+  );
+
+  runOpenSsl(["req", "-x509", "-newkey", "rsa:2048", "-nodes", "-days", "1", "-subj", "/CN=OpenWork Test MySQL CA", "-keyout", caKey, "-out", caCert]);
+  runOpenSsl(["req", "-newkey", "rsa:2048", "-nodes", "-keyout", serverKey, "-out", serverCsr, "-config", opensslConfig]);
+  runOpenSsl(["x509", "-req", "-in", serverCsr, "-CA", caCert, "-CAkey", caKey, "-CAcreateserial", "-out", serverCert, "-days", "1", "-extensions", "v3_req", "-extfile", opensslConfig]);
+  chmodSync(serverKey, 0o644);
+  chmodSync(serverCert, 0o644);
+  chmodSync(caCert, 0o644);
+
+  writeFileSync(
+    mysqlConfig,
+    `[mysqld]
+ssl-ca=/etc/mysql/certs/ca.crt
+ssl-cert=/etc/mysql/certs/server.crt
+ssl-key=/etc/mysql/certs/server.key
+require_secure_transport=ON
+tls_version=TLSv1.2,TLSv1.3
+`,
+  );
+  chmodSync(mysqlConfig, 0o644);
+  console.log("Generated private CA and MySQL server certificate with SAN DNS:localhost, DNS:mysql.private.test, IP:127.0.0.1");
+}
+
+function docker(args, options = {}) {
+  return run("docker", args, { timeout: 240_000, ...options });
+}
+
+function startMysqlContainer() {
+  const result = docker([
+    "run",
+    "--rm",
+    "--detach",
+    "--name",
+    containerName,
+    "--publish",
+    "127.0.0.1::3306",
+    "--env",
+    "MYSQL_ROOT_PASSWORD=openwork_root_password",
+    "--env",
+    "MYSQL_ROOT_HOST=%",
+    "--env",
+    `MYSQL_DATABASE=${databaseName}`,
+    "--env",
+    `MYSQL_USER=${databaseUser}`,
+    "--env",
+    `MYSQL_PASSWORD=${databasePassword}`,
+    "--volume",
+    `${certsDir}:/etc/mysql/certs:ro`,
+    "--volume",
+    `${mysqlConfig}:/etc/mysql/conf.d/tls.cnf:ro`,
+    image,
+  ]);
+  ensureSuccess(result, `docker run ${image}`);
+  containerStarted = true;
+  console.log(`Started TLS-enabled MySQL container ${containerName} from ${image}`);
+}
+
+function mappedPort() {
+  const result = docker(["port", containerName, "3306/tcp"]);
+  ensureSuccess(result, "docker port");
+  const endpoint = result.stdout.trim().split("\n").find(Boolean);
+  const port = endpoint?.split(":").pop();
+  if (!port) {
+    throw new Error(`Unable to resolve mapped MySQL port from: ${result.stdout}`);
+  }
+  return Number(port);
+}
+
+async function waitForMysql(port) {
+  const started = Date.now();
+  let lastError = "";
+  while (Date.now() - started < 90_000) {
+    try {
+      const connection = await mysql.createConnection({
+        host: "127.0.0.1",
+        port,
+        user: databaseUser,
+        password: databasePassword,
+        database: databaseName,
+        ssl: { rejectUnauthorized: false },
+      });
+      await connection.query("select 1");
+      await connection.end();
+      return;
+    } catch (error) {
+      lastError = error instanceof Error ? error.message : String(error);
+      await new Promise((resolve) => setTimeout(resolve, 750));
+    }
+  }
+
+  const logs = docker(["logs", containerName], { timeout: 30_000 });
+  throw new Error(`MySQL container did not become ready: ${lastError}\n${logs.stdout}\n${logs.stderr}`);
+}
+
+function strictDatabaseUrl(port) {
+  return `mysql://${databaseUser}:${databasePassword}@127.0.0.1:${port}/${databaseName}?sslmode=verify-full`;
+}
+
+function redactedDatabaseUrl(port) {
+  return `mysql://${databaseUser}:REDACTED@127.0.0.1:${port}/${databaseName}?sslmode=verify-full`;
+}
+
+function childEnv(extra = {}) {
+  const env = { ...process.env, ...extra };
+  delete env.NODE_TLS_REJECT_UNAUTHORIZED;
+  return env;
+}
+
+function runOpenWorkMysqlQuery(databaseUrl, query, extraEnv = {}) {
+  const source = `
+import { createRequire } from "node:module";
+const mysql = createRequire(process.argv[1])("mysql2/promise");
+const { parseMySqlConnectionConfig } = await import(process.argv[2]);
+const connection = await mysql.createConnection(parseMySqlConnectionConfig(process.argv[3]));
+try {
+  const [rows] = await connection.query(process.argv[4]);
+  console.log(JSON.stringify(rows));
+} finally {
+  await connection.end();
+}
+`;
+
+  return run(process.execPath, ["--input-type=module", "-e", source, denDbPackage, pathToFileURL(denDbIndexPath).href, databaseUrl, query], {
+    env: childEnv(extraEnv),
+    timeout: 90_000,
+  });
+}
+
+function runBootstrap(databaseUrl) {
+  return run(process.execPath, [bootstrapPath], {
+    cwd: denDbDir,
+    env: childEnv({
+      DATABASE_URL: databaseUrl,
+      DEN_DB_ENCRYPTION_KEY: "openwork-custom-ca-mysql-tls-test-key-1234567890",
+      NODE_EXTRA_CA_CERTS: caCert,
+      OPENWORK_DEN_DB_ENV_PATH: join(tmp, "does-not-exist.env"),
+    }),
+    timeout: 180_000,
+  });
+}
+
+function cleanup() {
+  if (containerStarted) {
+    docker(["rm", "-f", containerName], { timeout: 30_000 });
+  }
+  rmSync(tmp, { recursive: true, force: true });
+}
+
+try {
+  ensureBuildArtifacts();
+  generateCertificates();
+  startMysqlContainer();
+  const port = mappedPort();
+  await waitForMysql(port);
+  const databaseUrl = strictDatabaseUrl(port);
+  console.log(`TLS MySQL endpoint ready at ${redactedDatabaseUrl(port)}`);
+
+  const withoutCa = runOpenWorkMysqlQuery(databaseUrl, "select 1 as ok");
+  if (withoutCa.status === 0) {
+    throw new Error("Strict OpenWork/mysql2 unexpectedly connected without NODE_EXTRA_CA_CERTS");
+  }
+  const withoutCaError = `${withoutCa.stdout}\n${withoutCa.stderr}`.trim();
+  if (!/certificate|verify|self-signed|unable/i.test(withoutCaError)) {
+    throw new Error(`Strict OpenWork/mysql2 failed for a non-certificate reason:\n${withoutCaError}`);
+  }
+  const certificateError = withoutCaError.split("\n").find((line) => /certificate|verify|self-signed|unable/i.test(line)) ?? withoutCaError.split("\n").find(Boolean);
+  console.log(`Strict OpenWork/mysql2 without custom CA: rejected (${certificateError})`);
+
+  const bootstrap = runBootstrap(databaseUrl);
+  ensureSuccess(bootstrap, "OpenWork migration bootstrap with NODE_EXTRA_CA_CERTS");
+  console.log("OpenWork migration bootstrap completed with NODE_EXTRA_CA_CERTS and strict DATABASE_URL");
+  console.log(bootstrap.stdout.trim());
+
+  const query = runOpenWorkMysqlQuery(
+    databaseUrl,
+    "select (select count(*) from information_schema.tables where table_schema = database()) as table_count, (select count(*) from `__drizzle_migrations`) as migration_count",
+    { NODE_EXTRA_CA_CERTS: caCert },
+  );
+  ensureSuccess(query, "OpenWork/mysql2 strict post-migration query with NODE_EXTRA_CA_CERTS");
+  const rows = JSON.parse(query.stdout.trim());
+  const tableCount = Number(rows[0]?.table_count ?? 0);
+  const migrationCount = Number(rows[0]?.migration_count ?? 0);
+  if (tableCount <= 0 || migrationCount <= 0) {
+    throw new Error(`Expected migrated OpenWork tables and migration ledger rows, got ${query.stdout}`);
+  }
+  console.log(`OpenWork/mysql2 strict query succeeded after migration: tables=${tableCount}, migrations=${migrationCount}`);
+} finally {
+  cleanup();
+}

packaging/helm/openwork-ee/tests/custom-ca-node-trust.mjs

@@ -0,0 +1,147 @@
+import { spawn, spawnSync } from "node:child_process";
+import { createServer } from "node:https";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+const tmp = mkdtempSync(join(tmpdir(), "openwork-custom-ca-"));
+const caKey = join(tmp, "ca.key");
+const caCert = join(tmp, "ca.crt");
+const serverKey = join(tmp, "server.key");
+const serverCsr = join(tmp, "server.csr");
+const serverCert = join(tmp, "server.crt");
+const opensslConfig = join(tmp, "openssl.cnf");
+
+function runOpenSsl(args) {
+  const result = spawnSync("openssl", args, { encoding: "utf8" });
+  if (result.status !== 0) {
+    throw new Error(`openssl ${args.join(" ")} failed\n${result.stderr}`);
+  }
+}
+
+function clientEnvironment(caPath) {
+  const env = { ...process.env };
+  delete env.NODE_EXTRA_CA_CERTS;
+  delete env.NODE_TLS_REJECT_UNAUTHORIZED;
+  if (caPath) {
+    env.NODE_EXTRA_CA_CERTS = caPath;
+  }
+  return env;
+}
+
+function runClient(url, caPath) {
+  const clientSource = `
+const https = require("node:https");
+https.get(process.argv[1], (response) => {
+  let body = "";
+  response.setEncoding("utf8");
+  response.on("data", (chunk) => { body += chunk; });
+  response.on("end", () => {
+    if (response.statusCode === 200 && body === "openwork-custom-ca-ok") {
+      console.log(body);
+      process.exit(0);
+    }
+    console.error(\`unexpected response: \${response.statusCode} \${body}\`);
+    process.exit(1);
+  });
+}).on("error", (error) => {
+  console.error(error.code || error.message);
+  process.exit(2);
+});
+`;
+
+  return new Promise((resolve) => {
+    const child = spawn(process.execPath, ["-e", clientSource, url], {
+      env: clientEnvironment(caPath),
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk;
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk;
+    });
+    child.on("close", (status) => {
+      resolve({ status, stdout, stderr });
+    });
+  });
+}
+
+function listen(server) {
+  return new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      server.off("error", reject);
+      resolve();
+    });
+  });
+}
+
+function close(server) {
+  return new Promise((resolve, reject) => {
+    server.close((error) => {
+      if (error) {
+        reject(error);
+      } else {
+        resolve();
+      }
+    });
+  });
+}
+
+try {
+  writeFileSync(
+    opensslConfig,
+    `[req]
+distinguished_name = dn
+prompt = no
+[dn]
+CN = localhost
+[v3_req]
+subjectAltName = @alt_names
+[alt_names]
+DNS.1 = localhost
+IP.1 = 127.0.0.1
+`,
+  );
+
+  runOpenSsl(["req", "-x509", "-newkey", "rsa:2048", "-nodes", "-days", "1", "-subj", "/CN=OpenWork Test CA", "-keyout", caKey, "-out", caCert]);
+  runOpenSsl(["req", "-newkey", "rsa:2048", "-nodes", "-keyout", serverKey, "-out", serverCsr, "-config", opensslConfig]);
+  runOpenSsl(["x509", "-req", "-in", serverCsr, "-CA", caCert, "-CAkey", caKey, "-CAcreateserial", "-out", serverCert, "-days", "1", "-extensions", "v3_req", "-extfile", opensslConfig]);
+
+  const server = createServer(
+    {
+      key: readFileSync(serverKey),
+      cert: readFileSync(serverCert),
+    },
+    (_request, response) => {
+      response.end("openwork-custom-ca-ok");
+    },
+  );
+
+  await listen(server);
+  const address = server.address();
+  const url = `https://127.0.0.1:${address.port}/`;
+
+  try {
+    const withoutCustomCa = await runClient(url);
+    if (withoutCustomCa.status === 0) {
+      throw new Error("Strict TLS unexpectedly trusted the private CA without NODE_EXTRA_CA_CERTS");
+    }
+
+    const withCustomCa = await runClient(url, caCert);
+    if (withCustomCa.status !== 0) {
+      throw new Error(`Strict TLS did not trust NODE_EXTRA_CA_CERTS=${caCert}\n${withCustomCa.stderr}`);
+    }
+
+    console.log(`Strict TLS without NODE_EXTRA_CA_CERTS: rejected (${withoutCustomCa.stderr.trim()})`);
+    console.log(`Strict TLS with NODE_EXTRA_CA_CERTS=${caCert}: accepted (${withCustomCa.stdout.trim()})`);
+    console.log("Focused runtime trust check passed; this verifies Node's strict TLS trust path without starting MySQL.");
+  } finally {
+    await close(server);
+  }
+} finally {
+  rmSync(tmp, { recursive: true, force: true });
+}

packaging/helm/openwork-ee/tests/custom-ca.sh

@@ -0,0 +1,189 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+chart_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+tmp_dir="$(mktemp -d)"
+trap 'rm -rf "$tmp_dir"' EXIT
+
+assert_count() {
+  local file="$1"
+  local needle="$2"
+  local expected="$3"
+  local count
+  count="$(grep -F -c -- "$needle" "$file" || true)"
+  if [[ "$count" != "$expected" ]]; then
+    printf 'Expected %s occurrences of %s, found %s\n' "$expected" "$needle" "$count" >&2
+    return 1
+  fi
+}
+
+assert_contains() {
+  local file="$1"
+  local needle="$2"
+  if ! grep -F -q -- "$needle" "$file"; then
+    printf 'Expected rendered chart to contain %s\n' "$needle" >&2
+    return 1
+  fi
+}
+
+assert_not_contains() {
+  local file="$1"
+  local needle="$2"
+  if grep -F -q -- "$needle" "$file"; then
+    printf 'Expected rendered chart not to contain %s\n' "$needle" >&2
+    return 1
+  fi
+}
+
+assert_failure() {
+  local values_file="$1"
+  local expected="$2"
+  local output_file="$tmp_dir/failure-output.yaml"
+  local error_file="$tmp_dir/failure-error.txt"
+
+  if helm template openwork-ee "$chart_dir" -f "$values_file" > "$output_file" 2> "$error_file"; then
+    printf 'Expected helm template to fail for %s\n' "$values_file" >&2
+    return 1
+  fi
+  assert_contains "$error_file" "$expected"
+}
+
+default_rendered="$tmp_dir/default.yaml"
+disabled_values="$tmp_dir/disabled-values.yaml"
+disabled_rendered="$tmp_dir/disabled.yaml"
+helm template openwork-ee "$chart_dir" --set inference.enabled=true > "$default_rendered"
+cat > "$disabled_values" <<'YAML'
+inference:
+  enabled: true
+customCa:
+  enabled: false
+  existingSecret: ignored-ca-secret
+  key: ignored.pem
+YAML
+helm template openwork-ee "$chart_dir" -f "$disabled_values" > "$disabled_rendered"
+cmp -s "$default_rendered" "$disabled_rendered"
+assert_not_contains "$default_rendered" 'name: NODE_EXTRA_CA_CERTS'
+assert_not_contains "$default_rendered" '/etc/openwork/custom-ca'
+assert_not_contains "$default_rendered" 'name: custom-ca'
+
+secret_values="$tmp_dir/secret-values.yaml"
+secret_rendered="$tmp_dir/secret.yaml"
+cat > "$secret_values" <<'YAML'
+customCa:
+  enabled: true
+  existingSecret: openwork-ca-secret
+  key: corp-root.pem
+YAML
+helm template openwork-ee "$chart_dir" -f "$secret_values" > "$secret_rendered"
+assert_count "$secret_rendered" 'name: NODE_EXTRA_CA_CERTS' 4
+assert_count "$secret_rendered" 'value: "/etc/openwork/custom-ca/ca-bundle.pem"' 5
+assert_count "$secret_rendered" 'name: custom-ca' 8
+assert_count "$secret_rendered" 'secretName: "openwork-ca-secret"' 4
+assert_count "$secret_rendered" 'key: "corp-root.pem"' 4
+assert_count "$secret_rendered" 'path: ca-bundle.pem' 4
+assert_count "$secret_rendered" 'mountPath: "/etc/openwork/custom-ca"' 4
+assert_not_contains "$secret_rendered" 'subPath:'
+assert_not_contains "$secret_rendered" 'name: "openwork-ca-config"'
+assert_not_contains "$secret_rendered" 'name: openwork-ee-inference'
+
+configmap_values="$tmp_dir/configmap-values.yaml"
+configmap_rendered="$tmp_dir/configmap.yaml"
+cat > "$configmap_values" <<'YAML'
+inference:
+  enabled: true
+customCa:
+  enabled: true
+  existingConfigMap: openwork-ca-config
+  key: ca.crt
+YAML
+helm template openwork-ee "$chart_dir" -f "$configmap_values" > "$configmap_rendered"
+assert_contains "$configmap_rendered" 'name: openwork-ee-den-api'
+assert_contains "$configmap_rendered" 'name: openwork-ee-den-web'
+assert_contains "$configmap_rendered" 'name: openwork-ee-inference'
+assert_contains "$configmap_rendered" 'name: openwork-ee-migrate'
+assert_count "$configmap_rendered" 'name: NODE_EXTRA_CA_CERTS' 5
+assert_count "$configmap_rendered" 'value: "/etc/openwork/custom-ca/ca-bundle.pem"' 6
+assert_count "$configmap_rendered" 'name: custom-ca' 10
+assert_count "$configmap_rendered" 'name: "openwork-ca-config"' 5
+assert_count "$configmap_rendered" 'key: "ca.crt"' 5
+assert_count "$configmap_rendered" 'path: ca-bundle.pem' 5
+assert_count "$configmap_rendered" 'mountPath: "/etc/openwork/custom-ca"' 5
+assert_not_contains "$configmap_rendered" 'subPath:'
+assert_not_contains "$configmap_rendered" 'secretName: "openwork-ca-secret"'
+
+installer_values="$tmp_dir/installer-values.yaml"
+installer_rendered="$tmp_dir/installer.yaml"
+cat > "$installer_values" <<'YAML'
+customCa:
+  enabled: true
+  existingSecret: openwork-ca-secret
+installerArtifacts:
+  enabled: true
+  existingClaim: installer-artifacts-pvc
+YAML
+helm template openwork-ee "$chart_dir" -f "$installer_values" > "$installer_rendered"
+assert_contains "$installer_rendered" 'name: installer-artifacts'
+assert_contains "$installer_rendered" 'claimName: "installer-artifacts-pvc"'
+assert_contains "$installer_rendered" 'name: OPENWORK_INSTALLER_ARTIFACTS_DIR'
+assert_contains "$installer_rendered" 'name: custom-ca'
+assert_contains "$installer_rendered" 'name: NODE_EXTRA_CA_CERTS'
+
+missing_source_values="$tmp_dir/missing-source-values.yaml"
+cat > "$missing_source_values" <<'YAML'
+customCa:
+  enabled: true
+YAML
+assert_failure "$missing_source_values" 'customCa.existingSecret or customCa.existingConfigMap is required when customCa.enabled=true'
+
+multiple_sources_values="$tmp_dir/multiple-sources-values.yaml"
+cat > "$multiple_sources_values" <<'YAML'
+customCa:
+  enabled: true
+  existingSecret: openwork-ca-secret
+  existingConfigMap: openwork-ca-config
+YAML
+assert_failure "$multiple_sources_values" 'customCa.existingSecret and customCa.existingConfigMap are mutually exclusive when customCa.enabled=true'
+
+empty_key_values="$tmp_dir/empty-key-values.yaml"
+cat > "$empty_key_values" <<'YAML'
+customCa:
+  enabled: true
+  existingSecret: openwork-ca-secret
+  key: ""
+YAML
+assert_failure "$empty_key_values" 'customCa.key is required when customCa.enabled=true'
+
+den_api_conflict_values="$tmp_dir/den-api-conflict-values.yaml"
+cat > "$den_api_conflict_values" <<'YAML'
+customCa:
+  enabled: true
+  existingSecret: openwork-ca-secret
+denApi:
+  env:
+    NODE_EXTRA_CA_CERTS: /already/set.pem
+YAML
+assert_failure "$den_api_conflict_values" 'denApi.env.NODE_EXTRA_CA_CERTS conflicts with customCa.enabled=true; remove it and use customCa instead'
+
+den_web_conflict_values="$tmp_dir/den-web-conflict-values.yaml"
+cat > "$den_web_conflict_values" <<'YAML'
+customCa:
+  enabled: true
+  existingSecret: openwork-ca-secret
+denWeb:
+  env:
+    NODE_EXTRA_CA_CERTS: /already/set.pem
+YAML
+assert_failure "$den_web_conflict_values" 'denWeb.env.NODE_EXTRA_CA_CERTS conflicts with customCa.enabled=true; remove it and use customCa instead'
+
+inference_conflict_values="$tmp_dir/inference-conflict-values.yaml"
+cat > "$inference_conflict_values" <<'YAML'
+customCa:
+  enabled: true
+  existingSecret: openwork-ca-secret
+inference:
+  env:
+    NODE_EXTRA_CA_CERTS: /already/set.pem
+YAML
+assert_failure "$inference_conflict_values" 'inference.env.NODE_EXTRA_CA_CERTS conflicts with customCa.enabled=true; remove it and use customCa instead'
+
+node "$chart_dir/tests/custom-ca-node-trust.mjs"

packaging/helm/openwork-ee/tests/dashboards-enabled.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+chart_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+tmp_dir="$(mktemp -d)"
+trap 'rm -rf "$tmp_dir"' EXIT
+
+assert_contains() {
+  local file="$1"
+  local needle="$2"
+  if ! grep -F -q -- "$needle" "$file"; then
+    printf 'Expected rendered chart to contain %s\n' "$needle" >&2
+    return 1
+  fi
+}
+
+default_rendered="$tmp_dir/default.yaml"
+helm template openwork-ee "$chart_dir" > "$default_rendered"
+assert_contains "$default_rendered" 'DEN_DASHBOARDS_ENABLED: "false"'
+
+enabled_values="$tmp_dir/enabled-values.yaml"
+enabled_rendered="$tmp_dir/enabled.yaml"
+printf '%s\n' 'config:' '  public:' '    dashboardsEnabled: "true"' > "$enabled_values"
+helm template openwork-ee "$chart_dir" -f "$enabled_values" > "$enabled_rendered"
+assert_contains "$enabled_rendered" 'DEN_DASHBOARDS_ENABLED: "true"'
+
+printf 'dashboards-enabled chart checks passed\n'

packaging/helm/openwork-ee/tests/observability-env.sh

@@ -0,0 +1,150 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+chart_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+repo_root="$(cd "$chart_dir/../../.." && pwd)"
+tmp_dir="$(mktemp -d)"
+trap 'rm -rf "$tmp_dir"' EXIT
+
+assert_count() {
+  local file="$1"
+  local needle="$2"
+  local expected="$3"
+  local count
+  count="$(grep -F -c -- "$needle" "$file" || true)"
+  if [[ "$count" != "$expected" ]]; then
+    printf 'Expected %s occurrences of %s, found %s\n' "$expected" "$needle" "$count" >&2
+    return 1
+  fi
+}
+
+assert_contains() {
+  local file="$1"
+  local needle="$2"
+  if ! grep -F -q -- "$needle" "$file"; then
+    printf 'Expected rendered chart to contain %s\n' "$needle" >&2
+    return 1
+  fi
+}
+
+assert_not_contains() {
+  local file="$1"
+  local needle="$2"
+  if grep -F -q -- "$needle" "$file"; then
+    printf 'Expected rendered chart not to contain %s\n' "$needle" >&2
+    return 1
+  fi
+}
+
+assert_file_contains() {
+  assert_contains "$1" "$2"
+}
+
+assert_file_not_contains() {
+  assert_not_contains "$1" "$2"
+}
+
+default_rendered="$tmp_dir/default.yaml"
+helm template openwork-ee "$chart_dir" --set inference.enabled=true > "$default_rendered"
+assert_contains "$default_rendered" 'DEN_API_NODE_OPTIONS: ""'
+assert_count "$default_rendered" 'name: NODE_OPTIONS' 2
+assert_count "$default_rendered" 'valueFrom: null' 1
+assert_not_contains "$default_rendered" 'key: DEN_API_NODE_OPTIONS'
+assert_count "$default_rendered" 'name: DEN_OBSERVABILITY_BACKEND' 2
+assert_count "$default_rendered" 'value: "none"' 2
+assert_not_contains "$default_rendered" 'name: OTEL_EXPORTER_OTLP_HEADERS'
+assert_not_contains "$default_rendered" 'name: SENTRY_DSN'
+
+otel_values="$tmp_dir/otel-values.yaml"
+otel_rendered="$tmp_dir/otel.yaml"
+cat > "$otel_values" <<'YAML'
+inference:
+  enabled: true
+config:
+  denApiNodeOptions: --max-old-space-size=4096
+observability:
+  backend: otel
+  otel:
+    endpoint: https://otel.example.test/otlp
+    tracesEndpoint: https://otel.example.test/v1/traces
+    metricsEndpoint: https://otel.example.test/v1/metrics
+    logsEndpoint: https://otel.example.test/v1/logs
+    exporters:
+      metrics: none
+    tracesSampler: parentbased_always_on
+    headers:
+      existingSecret: otel-runtime
+      key: otlp-headers
+denApi:
+  env:
+    CUSTOM_DEN_API_ENV: api
+denWeb:
+  env:
+    CUSTOM_DEN_WEB_ENV: web
+YAML
+helm template openwork-ee "$chart_dir" -f "$otel_values" > "$otel_rendered"
+assert_contains "$otel_rendered" 'DEN_API_NODE_OPTIONS: "--max-old-space-size=4096"'
+assert_contains "$otel_rendered" 'value: "--max-old-space-size=4096"'
+assert_count "$otel_rendered" 'name: DEN_OBSERVABILITY_BACKEND' 2
+assert_count "$otel_rendered" 'value: "otel"' 2
+assert_count "$otel_rendered" 'name: OTEL_EXPORTER_OTLP_HEADERS' 2
+assert_count "$otel_rendered" 'name: OTEL_SERVICE_NAME' 2
+assert_count "$otel_rendered" 'name: OTEL_METRICS_EXPORTER' 2
+assert_count "$otel_rendered" 'value: "parentbased_always_on"' 2
+assert_not_contains "$otel_rendered" 'name: OTEL_TRACES_SAMPLER_ARG'
+assert_contains "$otel_rendered" 'value: "den-api"'
+assert_contains "$otel_rendered" 'value: "den-web"'
+assert_contains "$otel_rendered" 'name: "otel-runtime"'
+assert_contains "$otel_rendered" 'key: "otlp-headers"'
+assert_contains "$otel_rendered" 'name: CUSTOM_DEN_API_ENV'
+assert_contains "$otel_rendered" 'name: CUSTOM_DEN_WEB_ENV'
+assert_not_contains "$otel_rendered" 'name: SENTRY_AUTH_TOKEN'
+
+legacy_values="$tmp_dir/legacy-node-options-values.yaml"
+legacy_rendered="$tmp_dir/legacy-node-options.yaml"
+cat > "$legacy_values" <<'YAML'
+denApi:
+  env:
+    NODE_OPTIONS: --tls-max-v1.2
+YAML
+helm template openwork-ee "$chart_dir" -f "$legacy_values" > "$legacy_rendered"
+assert_count "$legacy_rendered" 'name: NODE_OPTIONS' 2
+assert_contains "$legacy_rendered" 'value: "--tls-max-v1.2"'
+assert_not_contains "$legacy_rendered" 'valueFrom: null'
+assert_not_contains "$legacy_rendered" 'key: DEN_API_NODE_OPTIONS'
+
+sentry_values="$tmp_dir/sentry-values.yaml"
+sentry_rendered="$tmp_dir/sentry.yaml"
+cat > "$sentry_values" <<'YAML'
+inference:
+  enabled: true
+observability:
+  backend: sentry
+  sentry:
+    dsnSecret:
+      existingSecret: sentry-runtime
+      key: dsn
+    tracesSampleRate: "0.75"
+    environment: production
+    release: "2026.07.11"
+    dist: web
+YAML
+helm template openwork-ee "$chart_dir" -f "$sentry_values" > "$sentry_rendered"
+assert_count "$sentry_rendered" 'name: DEN_OBSERVABILITY_BACKEND' 2
+assert_count "$sentry_rendered" 'value: "sentry"' 2
+assert_count "$sentry_rendered" 'name: SENTRY_DSN' 2
+assert_contains "$sentry_rendered" 'name: "sentry-runtime"'
+assert_not_contains "$sentry_rendered" 'SENTRY_AUTH_TOKEN'
+assert_not_contains "$sentry_rendered" 'SENTRY_ORG'
+assert_not_contains "$sentry_rendered" 'SENTRY_PROJECT'
+assert_not_contains "$sentry_rendered" 'SENTRY_URL'
+assert_not_contains "$sentry_rendered" 'name: OTEL_EXPORTER_OTLP_HEADERS'
+
+assert_file_contains "$repo_root/packaging/docker/Dockerfile.den" '/app/ee/apps/den-api/dist/main.js'
+assert_file_not_contains "$repo_root/packaging/docker/Dockerfile.den" '/app/ee/apps/den-api/dist/server.js'
+assert_file_contains "$repo_root/packaging/docker/docker-compose.den-dev.yml" '/app/ee/apps/den-api/dist/main.js'
+assert_file_not_contains "$repo_root/packaging/docker/docker-compose.den-dev.yml" '/app/ee/apps/den-api/dist/server.js'
+assert_file_contains "$repo_root/.devcontainer/start-daytona-server.sh" 'pnpm --filter @openwork-ee/den-api exec tsx watch src/main.ts'
+assert_file_not_contains "$repo_root/.devcontainer/start-daytona-server.sh" 'ee/apps/den-api/src/server.ts'
+assert_file_contains "$repo_root/evals/packages/hosts/src/den-stack.ts" '"tsx", "src/main.ts"'
+assert_file_not_contains "$repo_root/evals/packages/hosts/src/den-stack.ts" '"tsx", "src/server.ts"'

packaging/helm/openwork-ee/tests/openwork-web-enabled.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+chart_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+tmp_dir="$(mktemp -d)"
+trap 'rm -rf "$tmp_dir"' EXIT
+
+assert_contains() {
+  local file="$1"
+  local needle="$2"
+  if ! grep -F -q -- "$needle" "$file"; then
+    printf 'Expected rendered chart to contain %s\n' "$needle" >&2
+    return 1
+  fi
+}
+
+default_rendered="$tmp_dir/default.yaml"
+helm template openwork-ee "$chart_dir" > "$default_rendered"
+assert_contains "$default_rendered" 'DEN_OPENWORK_WEB_ENABLED: "false"'
+
+enabled_values="$tmp_dir/enabled-values.yaml"
+enabled_rendered="$tmp_dir/enabled.yaml"
+printf '%s\n' 'config:' '  public:' '    openworkWebEnabled: "true"' > "$enabled_values"
+helm template openwork-ee "$chart_dir" -f "$enabled_values" > "$enabled_rendered"
+assert_contains "$enabled_rendered" 'DEN_OPENWORK_WEB_ENABLED: "true"'
+
+printf 'openwork-web-enabled chart checks passed\n'

packaging/helm/openwork-ee/tests/private-mcp-urls.sh

@@ -0,0 +1,173 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+chart_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+tmp_dir="$(mktemp -d)"
+trap 'rm -rf "$tmp_dir"' EXIT
+
+assert_count() {
+  local file="$1"
+  local needle="$2"
+  local expected="$3"
+  local count
+  count="$(grep -F -c -- "$needle" "$file" || true)"
+  if [[ "$count" != "$expected" ]]; then
+    printf 'Expected %s occurrences of %s, found %s\n' "$expected" "$needle" "$count" >&2
+    return 1
+  fi
+}
+
+assert_contains() {
+  local file="$1"
+  local needle="$2"
+  if ! grep -F -q -- "$needle" "$file"; then
+    printf 'Expected rendered chart to contain %s\n' "$needle" >&2
+    return 1
+  fi
+}
+
+assert_not_contains() {
+  local file="$1"
+  local needle="$2"
+  if grep -F -q -- "$needle" "$file"; then
+    printf 'Expected rendered chart not to contain %s\n' "$needle" >&2
+    return 1
+  fi
+}
+
+assert_failure() {
+  local values_file="$1"
+  local expected="$2"
+  local output_file="$tmp_dir/failure-output.yaml"
+  local error_file="$tmp_dir/failure-error.txt"
+
+  if helm template openwork-ee "$chart_dir" -f "$values_file" > "$output_file" 2> "$error_file"; then
+    printf 'Expected helm template to fail for %s\n' "$values_file" >&2
+    return 1
+  fi
+  assert_contains "$error_file" "$expected"
+}
+
+assert_source_contains() {
+  local file="$1"
+  local source="$2"
+  local needle="$3"
+  local in_source=0
+  local found=0
+  local line
+
+  while IFS= read -r line; do
+    if [[ "$line" == '# Source: openwork-ee/templates/'* ]]; then
+      if [[ "$line" == "# Source: openwork-ee/templates/$source" ]]; then
+        in_source=1
+      else
+        in_source=0
+      fi
+    fi
+    if [[ "$in_source" == 1 && "$line" == *"$needle"* ]]; then
+      found=1
+      break
+    fi
+  done < "$file"
+
+  if [[ "$found" != 1 ]]; then
+    printf 'Expected %s to contain %s\n' "$source" "$needle" >&2
+    return 1
+  fi
+}
+
+assert_source_not_contains() {
+  local file="$1"
+  local source="$2"
+  local needle="$3"
+  local in_source=0
+  local line
+
+  while IFS= read -r line; do
+    if [[ "$line" == '# Source: openwork-ee/templates/'* ]]; then
+      if [[ "$line" == "# Source: openwork-ee/templates/$source" ]]; then
+        in_source=1
+      else
+        in_source=0
+      fi
+    fi
+    if [[ "$in_source" == 1 && "$line" == *"$needle"* ]]; then
+      printf 'Expected %s not to contain %s\n' "$source" "$needle" >&2
+      return 1
+    fi
+  done < "$file"
+}
+
+default_rendered="$tmp_dir/default.yaml"
+helm template openwork-ee "$chart_dir" > "$default_rendered"
+assert_count "$default_rendered" 'DEN_ALLOW_PRIVATE_MCP_URLS' 0
+assert_not_contains "$default_rendered" 'openwork-ee-den-api-private-mcp-urls'
+
+enabled_values="$tmp_dir/enabled-values.yaml"
+enabled_rendered="$tmp_dir/enabled.yaml"
+cat > "$enabled_values" <<'YAML'
+inference:
+  enabled: true
+config:
+  public:
+    allowPrivateMcpUrls: "1"
+YAML
+helm template openwork-ee "$chart_dir" -f "$enabled_values" > "$enabled_rendered"
+assert_count "$enabled_rendered" 'DEN_ALLOW_PRIVATE_MCP_URLS' 2
+assert_count "$enabled_rendered" 'name: DEN_ALLOW_PRIVATE_MCP_URLS' 2
+assert_count "$enabled_rendered" 'value: "1"' 2
+assert_not_contains "$enabled_rendered" 'key: DEN_ALLOW_PRIVATE_MCP_URLS'
+assert_not_contains "$enabled_rendered" 'configMapKeyRef:'
+assert_not_contains "$enabled_rendered" 'openwork-ee-den-api-private-mcp-urls'
+assert_source_contains "$enabled_rendered" 'den-api.yaml' 'name: DEN_ALLOW_PRIVATE_MCP_URLS'
+assert_source_contains "$enabled_rendered" 'den-api.yaml' 'value: "1"'
+assert_source_not_contains "$enabled_rendered" 'den-web.yaml' 'DEN_ALLOW_PRIVATE_MCP_URLS'
+assert_source_not_contains "$enabled_rendered" 'inference.yaml' 'DEN_ALLOW_PRIVATE_MCP_URLS'
+
+disabled_values="$tmp_dir/disabled-values.yaml"
+disabled_rendered="$tmp_dir/disabled.yaml"
+cat > "$disabled_values" <<'YAML'
+config:
+  public:
+    allowPrivateMcpUrls: "0"
+YAML
+helm template openwork-ee "$chart_dir" -f "$disabled_values" > "$disabled_rendered"
+assert_count "$disabled_rendered" 'DEN_ALLOW_PRIVATE_MCP_URLS' 0
+
+false_values="$tmp_dir/false-values.yaml"
+false_rendered="$tmp_dir/false.yaml"
+cat > "$false_values" <<'YAML'
+config:
+  public:
+    allowPrivateMcpUrls: "false"
+YAML
+helm template openwork-ee "$chart_dir" -f "$false_values" > "$false_rendered"
+assert_count "$false_rendered" 'DEN_ALLOW_PRIVATE_MCP_URLS' 0
+
+blank_values="$tmp_dir/blank-values.yaml"
+blank_rendered="$tmp_dir/blank.yaml"
+cat > "$blank_values" <<'YAML'
+config:
+  public:
+    allowPrivateMcpUrls: ""
+YAML
+helm template openwork-ee "$chart_dir" -f "$blank_values" > "$blank_rendered"
+assert_count "$blank_rendered" 'DEN_ALLOW_PRIVATE_MCP_URLS' 0
+
+invalid_true_values="$tmp_dir/invalid-true-values.yaml"
+cat > "$invalid_true_values" <<'YAML'
+config:
+  public:
+    allowPrivateMcpUrls: "true"
+YAML
+assert_failure "$invalid_true_values" 'config.public.allowPrivateMcpUrls must be blank, 0, false, or "1"'
+
+invalid_yes_values="$tmp_dir/invalid-yes-values.yaml"
+cat > "$invalid_yes_values" <<'YAML'
+config:
+  public:
+    allowPrivateMcpUrls: "yes"
+YAML
+assert_failure "$invalid_yes_values" 'config.public.allowPrivateMcpUrls must be blank, 0, false, or "1"'
+
+printf 'private-mcp-urls chart checks passed\n'