feat: route consultations by model

frontend/tests/model-catalog.test.ts

@@ -1,6 +1,9 @@
 import assert from "node:assert/strict";
 import test from "node:test";
-import { resolveLanguageModelCatalog } from "../src/mastra/model.ts";
+import {
+  resolveLanguageModelCatalog,
+  resolveLanguageModelFromCatalog,
+} from "../src/mastra/model.ts";
 
 const configuredModels = [
   {
@@ -125,3 +128,21 @@ test("reports an incomplete legacy provider without inventing a model", () => {
   assert.equal(catalog.defaultModelId, null);
   assert.equal(catalog.issues.includes("legacy_compatible_incomplete"), true);
 });
+
+test("resolves only model ids declared by the server catalog", () => {
+  // Given
+  const catalog = resolveLanguageModelCatalog({
+    LLM_DEFAULT_MODEL_ID: "deepseek-pro",
+    LLM_MODELS_JSON: JSON.stringify(configuredModels),
+    DEEPSEEK_API_KEY: "deepseek-secret",
+    OPENAI_API_KEY: "openai-secret",
+  });
+
+  // When
+  const selected = resolveLanguageModelFromCatalog(catalog, "gpt-mini");
+  const unknown = resolveLanguageModelFromCatalog(catalog, "attacker-model");
+
+  // Then
+  assert.equal(selected?.id, "gpt-mini");
+  assert.equal(unknown, null);
+});

frontend/tests/public-models.test.ts

@@ -0,0 +1,68 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { parsePublicModelCatalog } from "../src/lib/public-models.ts";
+
+const publicPayload = {
+  defaultModelId: "deepseek-pro",
+  models: [
+    {
+      id: "deepseek-pro",
+      label: "DeepSeek V4 Pro",
+      description: "复杂分析",
+      creditCost: 1,
+      isDefault: true,
+    },
+    {
+      id: "gpt-mini",
+      label: "ChatGPT Mini",
+      description: "均衡响应",
+      creditCost: 1,
+      isDefault: false,
+    },
+  ],
+} as const;
+
+test("parses a sanitized public model catalog", () => {
+  // Given
+  const payload: unknown = publicPayload;
+
+  // When
+  const catalog = parsePublicModelCatalog(payload);
+
+  // Then
+  assert.equal(catalog.defaultModelId, "deepseek-pro");
+  assert.equal(catalog.models.length, 2);
+  assert.equal(catalog.models[0]?.label, "DeepSeek V4 Pro");
+});
+
+test("rejects provider routing fields in a public model payload", () => {
+  // Given
+  const payload = {
+    ...publicPayload,
+    models: [{
+      ...publicPayload.models[0],
+      baseURL: "https://api.deepseek.com",
+      apiKeyEnv: "DEEPSEEK_API_KEY",
+    }],
+  };
+
+  // When
+  const parse = () => parsePublicModelCatalog(payload);
+
+  // Then
+  assert.throws(parse);
+});
+
+test("rejects a default model that is absent from the public list", () => {
+  // Given
+  const payload = {
+    ...publicPayload,
+    defaultModelId: "removed-model",
+  };
+
+  // When
+  const parse = () => parsePublicModelCatalog(payload);
+
+  // Then
+  assert.throws(parse);
+});