fix(providers): harden discovery path and test isolation

Author: olddonkey

src/providers/model-discovery.ts

@@ -90,7 +90,10 @@ export function providerModelDiscoverySpecError(spec: ProviderModelDiscoverySpec
     if (/^[a-z][a-z\d+.-]*:/i.test(path) || path.startsWith("//") || path.includes("?") || path.includes("#")) {
       return "discovery path must be a query-free relative/origin path";
     }
-    if (path.split("/").includes("..")) return "discovery path must not contain parent-directory segments";
+    if (path.includes("\\")) return "discovery path must use forward slashes";
+    if (path.split("/").some(segment => segment.replace(/%2e/gi, ".") === "..")) {
+      return "discovery path must not contain parent-directory segments";
+    }
   }
   const queryEntries = Object.entries(spec.query ?? {});
   if (queryEntries.length > 32) return "discovery query may contain at most 32 entries";

tests/helpers/provider-registry-discovery.ts

@@ -5,7 +5,7 @@ interface RegistryDiscoveryOverrides {
   preserveCustomDestination?: boolean;
 }
 
-/** Temporarily override registry-owned discovery policy and always clear its cached catalog. */
+/** Temporarily override registry-owned discovery policy with a clean cache before and after. */
 export async function withRegistryDiscovery<T>(
   providerId: string,
   spec: ProviderModelDiscoverySpec,
@@ -16,6 +16,7 @@ export async function withRegistryDiscovery<T>(
   if (!entry) throw new Error(`missing ${providerId} registry entry`);
   const originalDiscovery = entry.modelDiscovery;
   const originalPreserveCustomDestination = entry.preserveCustomDestination;
+  clearModelCache(providerId);
   entry.modelDiscovery = spec;
   if (overrides.preserveCustomDestination !== undefined) {
     entry.preserveCustomDestination = overrides.preserveCustomDestination;

tests/provider-model-discovery-contract.test.ts

@@ -3,7 +3,7 @@ import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { gatherRoutedModels } from "../src/codex/catalog";
 import { catalogHintsFromModelsApiItem } from "../src/codex/catalog/provider-fetch";
-import { clearModelCache } from "../src/codex/model-cache";
+import { clearModelCache, getFreshCached, setCached } from "../src/codex/model-cache";
 import { buildModelsRequest } from "../src/oauth";
 import { KEY_LOGIN_PROVIDERS, validateApiKey } from "../src/oauth/key-providers";
 import { deriveKeyLoginMap, providerConfigSeed } from "../src/providers/derive";
@@ -67,10 +67,17 @@ describe("registry-owned provider model discovery", () => {
       .toContain("https");
     expect(providerModelDiscoverySpecError({ path: "models?unbounded=true" }))
       .toContain("query-free");
-    expect(providerModelDiscoverySpecError({ path: "../../internal/models" }))
-      .toContain("parent-directory");
-    expect(providerModelDiscoverySpecError({ path: "models/../internal" }))
-      .toContain("parent-directory");
+    for (const path of [
+      "../../internal/models",
+      "models/../internal",
+      "models/%2e%2e/internal",
+      "models/.%2E/internal",
+      "models/%2e./internal",
+    ]) {
+      expect(providerModelDiscoverySpecError({ path })).toContain("parent-directory");
+    }
+    expect(providerModelDiscoverySpecError({ path: String.raw`models\..\internal` }))
+      .toContain("forward slashes");
     expect(providerModelDiscoverySpecError({ path: "models/model..variant" })).toBeNull();
     expect(providerModelDiscoverySpecError({
       url: "https://api.example.test/models",
@@ -79,6 +86,15 @@ describe("registry-owned provider model discovery", () => {
     expect(providerModelDiscoverySpecError({ maxModels: 25 })).toBeNull();
   });
 
+  test("clears cached rows before applying a temporary registry discovery policy", async () => {
+    setCached("together", []);
+    expect(getFreshCached("together", 60_000)).toEqual([]);
+
+    await withTogetherDiscovery({ maxModels: 25 }, () => {
+      expect(getFreshCached("together", 60_000)).toBeNull();
+    });
+  });
+
   test("limits collision preservation to fixed API-key destinations", () => {
     for (const entry of PROVIDER_REGISTRY) {
       if (entry.preserveCustomDestination !== true) continue;