@agenthippo-ai/agenthippo 0.1.0 → 0.2.3-dataplane

package/out/test/idp-init.test.js

@@ -0,0 +1,151 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  IdP Init Test Suite (PLAN/deploy.md — "customer 0")
+ *
+ *  Verifies `agenthippo idp init` generates a self-contained stack: no repo dependency in the
+ *  auth-broker image, identity routes reused verbatim from renderIdentityLayer (no drift risk),
+ *  and valid YAML/bash throughout.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+const yaml = __importStar(require("js-yaml"));
+const idp_init_1 = require("../cli/idp-init");
+const idp_1 = require("../cli/commands/idp");
+suite('idp-init: renderIdpArtifacts', () => {
+    test('generates a self-contained stack — no monorepo build context', () => {
+        const files = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.corp.example' });
+        assert.ok(files['Dockerfile.auth-broker'].includes('FROM ghcr.io/agenthippoai/runtime'), 'auth-broker image must come from the published runtime image, not repo build artifacts');
+        assert.ok(!files['Dockerfile.auth-broker'].includes('extensions/agentide/dist'), 'must not reference this repo\'s local build output — a customer never has it');
+        assert.ok(files['docker-compose.yml'].includes('dockerfile: Dockerfile.auth-broker')
+            && files['docker-compose.yml'].includes('context: .'), 'auth-broker builds from the generated dir itself, not a monorepo path');
+    });
+    test('docker-compose.yml is valid YAML with the expected services and networks', () => {
+        const files = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.corp.example' });
+        const compose = yaml.load(files['docker-compose.yml']);
+        assert.deepStrictEqual(Object.keys(compose.services), ['oauth2-proxy', 'auth-broker', 'caddy', 'cloudflared']);
+        assert.ok(!('agent' in compose.services), 'the IdP runs no agent');
+        assert.deepStrictEqual(Object.keys(compose.networks), ['default', 'colocate']);
+        assert.ok(files['docker-compose.yml'].includes('name: agenthippo-idp-colocate'));
+    });
+    test('Caddyfile reuses renderIdentityLayer verbatim — self-issued, no agent backend', () => {
+        const files = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.corp.example' });
+        const caddy = files['Caddyfile'];
+        assert.ok(caddy.includes('import agents/*.caddy'), 'colocated agents import in');
+        assert.ok(caddy.includes('handle /oauth/authorize {') && caddy.includes('handle /oauth/browser-login {'));
+        assert.ok(caddy.includes('forward_auth oauth2-proxy:4180'), 'self-issued: gates via oauth2-proxy');
+        assert.ok(caddy.includes('reverse_proxy auth-broker:9780'), 'health checks the broker, not an agent');
+        assert.ok(caddy.includes('respond "not_found" 404'), 'no /v1/* API here — Bearer requests 404, not silently passed through');
+        assert.ok(caddy.includes('respond "AgentHippo IdP" 200'), 'browser catch-all, past the SSO gate');
+        assert.ok(caddy.includes('http://{$AGENTHIPPO_PUBLIC_HOSTNAME} {') && !caddy.includes('https://{$AGENTHIPPO_PUBLIC_HOSTNAME}'), 'plain HTTP — auto_https is off, TLS terminates in front');
+    });
+    test('.env.auth.example carries the shared JWT secret + Google OAuth client, no fed vars', () => {
+        const files = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.corp.example' });
+        const auth = files['.env.auth.example'];
+        assert.ok(auth.includes('AGENTHIPPO_AUTH_JWT_SECRET') && auth.includes('OAUTH2_PROXY_CLIENT_ID'));
+        assert.ok(!auth.includes('AGENTHIPPO_AUTH_IDP_URL'), 'the IdP is not itself federated against anything');
+    });
+    test('cookie domain defaults to the hostname\'s own parent domain when not given explicitly', () => {
+        const files = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.corp.example' });
+        assert.ok(files['.env.auth.example'].includes('AGENTHIPPO_AUTH_COOKIE_DOMAIN=.corp.example'));
+    });
+    test('explicit cookieDomain overrides the derived default', () => {
+        const files = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.eu.corp.example', cookieDomain: '.corp.example' });
+        assert.ok(files['.env.auth.example'].includes('AGENTHIPPO_AUTH_COOKIE_DOMAIN=.corp.example'));
+    });
+    test('run.sh is valid bash and reflects the hostname', () => {
+        const files = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.corp.example' });
+        assert.doesNotThrow(() => (0, child_process_1.execFileSync)('bash', ['-n', '-c', files['run.sh']]));
+        assert.ok(files['run.sh'].includes('auth.corp.example'));
+    });
+    // Bare metal / BYO nginx or ALB (e.g. Hetzner): run.sh must not hard-require a Cloudflare
+    // Tunnel, and Caddy's host port must be reconfigurable when 80/443 are already taken by the
+    // operator's own reverse proxy.
+    test('run.sh branches on an explicit tunnel-credentials path argument, not a fixed file location', () => {
+        const sh = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.corp.example' })['run.sh'];
+        assert.ok(sh.includes('if [[ $# -ge 1 ]]; then'), 'branches on whether an argument was passed');
+        assert.ok(!sh.includes('-f "$HOME/.agent-hippo/tunnel-credentials.json"'), 'must not infer tunnel mode from a fixed default file path');
+        assert.ok(sh.includes('AGENTHIPPO_TUNNEL_CREDENTIALS="$1"'), 'the argument becomes the credentials path');
+        assert.ok(sh.includes('docker compose --profile edge --profile tunnel up -d --build'));
+        assert.ok(sh.includes('docker compose --profile edge up -d --build'), 'no-argument branch: --profile edge only, no --profile tunnel');
+    });
+    test('run.sh fails loudly if a given tunnel-credentials path doesn\'t exist', () => {
+        const sh = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.corp.example' })['run.sh'];
+        assert.ok(sh.includes('[[ -f "$AGENTHIPPO_TUNNEL_CREDENTIALS" ]] || {'));
+        assert.ok(sh.includes('exit 1'));
+    });
+    test('docker-compose.yml wires the cloudflared credentials mount to AGENTHIPPO_TUNNEL_CREDENTIALS', () => {
+        const compose = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.corp.example' })['docker-compose.yml'];
+        assert.ok(compose.includes('${AGENTHIPPO_TUNNEL_CREDENTIALS:-${HOME}/.agent-hippo/tunnel-credentials.json}'));
+    });
+    test('Caddy host ports are configurable via AGENTHIPPO_CADDY_HTTP_PORT/_HTTPS_PORT (Hetzner: 80/443 may already be taken)', () => {
+        const compose = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.corp.example' })['docker-compose.yml'];
+        assert.ok(compose.includes('${AGENTHIPPO_CADDY_HTTP_PORT:-80}:80'));
+        assert.ok(compose.includes('${AGENTHIPPO_CADDY_HTTPS_PORT:-443}:443'));
+    });
+    test('README documents both the Cloudflare Tunnel path and the bare-metal/BYO-nginx path', () => {
+        const readme = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.corp.example' })['README.md'];
+        assert.ok(readme.includes('Cloudflare Tunnel'));
+        assert.ok(readme.includes('Bare metal') || readme.includes('BYO nginx'));
+    });
+});
+suite('idp-init: idpCommand writes files to disk', () => {
+    let outDir;
+    setup(() => {
+        outDir = fs.mkdtempSync(path.join(os.tmpdir(), 'ah-idp-'));
+    });
+    teardown(() => {
+        fs.rmSync(outDir, { recursive: true, force: true });
+    });
+    test('writes every generated file under --out', async () => {
+        await (0, idp_1.idpCommand)('init', { hostname: 'auth.corp.example', out: outDir });
+        for (const rel of ['docker-compose.yml', 'Dockerfile.auth-broker', 'Caddyfile', '.env.example', '.env.auth.example', 'run.sh', 'agents/README.md', 'README.md']) {
+            assert.ok(fs.existsSync(path.join(outDir, rel)), `${rel} should be written`);
+        }
+    });
+    test('refuses to overwrite existing files without --force', async () => {
+        await (0, idp_1.idpCommand)('init', { hostname: 'auth.corp.example', out: outDir });
+        fs.writeFileSync(path.join(outDir, 'README.md'), 'hand-edited\n');
+        await (0, idp_1.idpCommand)('init', { hostname: 'auth.corp.example', out: outDir });
+        assert.strictEqual(fs.readFileSync(path.join(outDir, 'README.md'), 'utf8'), 'hand-edited\n');
+        await (0, idp_1.idpCommand)('init', { hostname: 'auth.corp.example', out: outDir, force: true });
+        assert.notStrictEqual(fs.readFileSync(path.join(outDir, 'README.md'), 'utf8'), 'hand-edited\n');
+    });
+});

package/out/test/mcp-obo.test.js

@@ -34,49 +34,74 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 const assert = __importStar(require("assert"));
-const node_fs_1 = require("node:fs");
-const node_os_1 = require("node:os");
-const node_path_1 = require("node:path");
 const credential_context_1 = require("../cli/credential-context");
 const mcp_1 = require("../mcp");
-suite('mcp: OBO token in MCP env (Design B §11.1)', () => {
-    const orig = process.env.DATABRICKS_TOKEN;
-    let tokenDir;
+/**
+ * The per-turn OBO credential must never reach MCP child env implicitly: the supported
+ * transport is the loopback data-plane gateway + turn nonce (secure-obo-design §2/§3).
+ * Inline resolution exists only behind the explicit local-dev opt-in.
+ */
+suite('mcp: OBO token in MCP env (secure-obo-design §3.4 — inline is opt-in only)', () => {
+    const ENV_KEYS = ['DATABRICKS_TOKEN', 'AGENTHIPPO_DATA_TOKEN_ENV_VARS', mcp_1.ALLOW_INLINE_DATA_TOKEN_ENV];
+    const saved = {};
     setup(() => {
-        tokenDir = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'mcp-obo-'));
+        for (const k of ENV_KEYS) {
+            saved[k] = process.env[k];
+            delete process.env[k];
+        }
     });
     teardown(() => {
-        if (orig === undefined) {
-            delete process.env.DATABRICKS_TOKEN;
-        }
-        else {
-            process.env.DATABRICKS_TOKEN = orig;
+        for (const k of ENV_KEYS) {
+            if (saved[k] === undefined) {
+                delete process.env[k];
+            }
+            else {
+                process.env[k] = saved[k];
+            }
         }
-        (0, node_fs_1.rmSync)(tokenDir, { recursive: true, force: true });
     });
-    test('static PAT when no credential scope', () => {
+    test('static PAT resolves from plain env when no credential scope', () => {
         process.env.DATABRICKS_TOKEN = 'pat-static';
         assert.strictEqual((0, mcp_1.resolveMcpEnvVar)('DATABRICKS_TOKEN'), 'pat-static');
     });
-    test('OBO token overrides static PAT inside runWithCredential (inline fallback)', async () => {
-        process.env.DATABRICKS_TOKEN = 'pat-static';
+    test('WITHOUT the opt-in, a live OBO token never bakes into MCP child env', async () => {
+        process.env.AGENTHIPPO_DATA_TOKEN_ENV_VARS = 'DATABRICKS_TOKEN';
         await (0, credential_context_1.runWithCredential)({ userId: 'u@x.com', dataToken: 'obo-live' }, async () => {
-            assert.strictEqual((0, mcp_1.resolveMcpEnvVar)('DATABRICKS_TOKEN'), 'obo-live');
-        });
-    });
-    test('credential placeholder resolves to token file for stdio MCP', async () => {
-        await (0, credential_context_1.runWithCredential)({ userId: 'u@x.com', dataToken: 'obo-file-token' }, async () => {
+            // alias reference falls back to ambient env (unset here → empty), never the credential
+            assert.strictEqual((0, mcp_1.resolveMcpEnvVar)('DATABRICKS_TOKEN'), '');
+            // explicit placeholder resolves to nothing → the connector fails closed
+            assert.strictEqual((0, mcp_1.resolveMcpEnvVar)('dataToken'), '');
             const resolved = (0, mcp_1.resolveMcpServerEnv)({
                 DATABRICKS_HOST: 'dbc.example.com',
                 DATABRICKS_TOKEN: '${credential:dataToken}',
             });
             assert.ok(resolved);
             assert.strictEqual(resolved.DATABRICKS_HOST, 'dbc.example.com');
-            assert.strictEqual(resolved.DATABRICKS_TOKEN, undefined);
-            const file = resolved[mcp_1.AGENTHIPPO_DATA_TOKEN_FILE_ENV];
-            assert.ok(file);
-            assert.strictEqual((0, node_fs_1.readFileSync)(file, 'utf8'), 'obo-file-token');
-            assert.strictEqual((0, mcp_1.resolveMcpEnvVar)('DATABRICKS_TOKEN'), '');
-        }, { dataTokenDir: tokenDir });
+            assert.strictEqual(resolved.DATABRICKS_TOKEN, undefined, 'credential must not appear in spawn env without the opt-in');
+            assert.ok(!JSON.stringify(resolved).includes('obo-live'), 'the raw token must not leak anywhere in the resolved env');
+        });
+    });
+    test('WITH the explicit local-dev opt-in, inline resolution works (alias + placeholder)', async () => {
+        process.env[mcp_1.ALLOW_INLINE_DATA_TOKEN_ENV] = '1';
+        process.env.AGENTHIPPO_DATA_TOKEN_ENV_VARS = 'DATABRICKS_TOKEN';
+        process.env.DATABRICKS_TOKEN = 'pat-static';
+        await (0, credential_context_1.runWithCredential)({ userId: 'u@x.com', dataToken: 'obo-live' }, async () => {
+            assert.strictEqual((0, mcp_1.resolveMcpEnvVar)('DATABRICKS_TOKEN'), 'obo-live', 'OBO token overrides static PAT when opted in');
+            const resolved = (0, mcp_1.resolveMcpServerEnv)({ DATABRICKS_TOKEN: '${credential:dataToken}' });
+            assert.strictEqual(resolved.DATABRICKS_TOKEN, 'obo-live');
+        });
+    });
+    test('alias list is empty by default — DATABRICKS_TOKEN is no longer an implicit credential alias', async () => {
+        process.env[mcp_1.ALLOW_INLINE_DATA_TOKEN_ENV] = '1';
+        process.env.DATABRICKS_TOKEN = 'pat-static';
+        await (0, credential_context_1.runWithCredential)({ userId: 'u@x.com', dataToken: 'obo-live' }, async () => {
+            // No AGENTHIPPO_DATA_TOKEN_ENV_VARS declared → the plain env var wins even opted-in.
+            assert.strictEqual((0, mcp_1.resolveMcpEnvVar)('DATABRICKS_TOKEN'), 'pat-static');
+        });
+    });
+    test('no credential scope + placeholder → falls back to ambient env for local dev', () => {
+        process.env.DATABRICKS_TOKEN = 'pat-static';
+        const resolved = (0, mcp_1.resolveMcpServerEnv)({ DATABRICKS_TOKEN: '${credential:dataToken}' });
+        assert.strictEqual(resolved.DATABRICKS_TOKEN, 'pat-static');
     });
 });

package/out/test/mcp.test.js

@@ -43,6 +43,7 @@ const os = __importStar(require("os"));
 const fs_1 = require("fs");
 const mcp_1 = require("../mcp");
 const branding_1 = require("../branding");
+const credential_context_1 = require("../cli/credential-context");
 suite('MCP Server Loading', () => {
     let testDir;
     const getAgentMcpDir = (agentId) => path.join(testDir, branding_1.AGENTIDE_DIR_NAME, 'agents', agentId, 'mcp');
@@ -225,20 +226,39 @@ suite('MCP Server Loading', () => {
             assert.ok(result.includes('[mcp_servers.test-server]'));
             assert.ok(result.includes('command = "node"'));
             assert.ok(result.includes('args = ["/path/to/server.js"]'));
-            assert.ok(result.includes('API_KEY = "secret"'));
+            assert.ok(result.includes('"API_KEY" = "secret"'));
             // No approval line by default — interactive IDE keeps Codex's normal prompts.
             assert.ok(!result.includes('default_tools_approval_mode'));
         });
-        test('autoApprove emits default_tools_approval_mode = "auto" per server', () => {
+        test('env keys are quoted so names with dots/spaces stay valid TOML', () => {
+            const servers = [
+                {
+                    name: 'test-server',
+                    label: 'Test Server',
+                    command: 'node',
+                    args: ['s.js'],
+                    env: { 'my.token': 'a', 'NPM CONFIG': 'b' },
+                },
+            ];
+            const result = (0, mcp_1.generateCodexMcpConfig)(servers);
+            assert.ok(result.includes('"my.token" = "a"'));
+            assert.ok(result.includes('"NPM CONFIG" = "b"'));
+            // A bare (unquoted) dotted key would be misparsed as a nested table.
+            assert.ok(!result.includes('my.token = '));
+        });
+        test('autoApprove emits default_tools_approval_mode = "approve" per server', () => {
             const servers = [
                 { name: 'stdio-srv', label: 's', command: 'node', args: ['s.js'] },
                 { name: 'http-srv', label: 'h', command: '', args: [], url: 'https://mcp.example.com/sse' },
             ];
             const result = (0, mcp_1.generateCodexMcpConfig)(servers, { autoApprove: true });
-            assert.ok(result.includes('default_tools_approval_mode = "auto"'));
+            assert.ok(result.includes('default_tools_approval_mode = "approve"'));
             assert.ok(result.includes('url = "https://mcp.example.com/sse"'));
-            // Invalid legacy key/value must never be emitted.
+            // Invalid legacy key/value must never be emitted. "auto" is not a valid enum value
+            // either — Codex ≥0.131 ignores it, falls back to `prompt`, and headless exec then
+            // cancels every MCP tool call ("user cancelled MCP tool call").
             assert.ok(!result.includes('approval_mode = "never"'));
+            assert.ok(!result.includes('"auto"'));
         });
         test('generateCodexMcpConfig emits http_headers for URL servers', () => {
             const servers = [
@@ -255,6 +275,27 @@ suite('MCP Server Loading', () => {
             assert.ok(result.includes('url = "https://mcp.example.com/sse"'));
             assert.ok(result.includes('http_headers = { "Authorization" = "Bearer abc", "X-Custom" = "val" }'));
         });
+        test('bearerTokenEnv emits bearer_token_env_var and NEVER a per-turn value — config.toml stays turn-invariant (secure-obo-design §3.2)', async () => {
+            const servers = [
+                {
+                    name: 'data',
+                    label: 'data',
+                    command: '',
+                    args: [],
+                    url: 'http://127.0.0.1:39999/mcp',
+                    bearerTokenEnv: 'AGENTHIPPO_TURN_NONCE',
+                },
+            ];
+            const outsideScope = (0, mcp_1.generateCodexMcpConfig)(servers);
+            assert.ok(outsideScope.includes('bearer_token_env_var = "AGENTHIPPO_TURN_NONCE"'));
+            assert.ok(!outsideScope.includes('http_headers'), 'no resolved header may carry the nonce into the file');
+            // Byte-identical no matter which user's credential scope is ambient — this is the
+            // exact property that removes the cross-user config.toml race (defect 1).
+            const inAlice = await (0, credential_context_1.runWithCredential)({ userId: 'alice@corp.com', dataToken: 'tok-a' }, async () => (0, mcp_1.generateCodexMcpConfig)(servers));
+            const inBob = await (0, credential_context_1.runWithCredential)({ userId: 'bob@corp.com', dataToken: 'tok-b' }, async () => (0, mcp_1.generateCodexMcpConfig)(servers));
+            assert.strictEqual(inAlice, outsideScope);
+            assert.strictEqual(inBob, outsideScope);
+        });
     });
     suite('inline MCP helpers', () => {
         test('formatInlineMcpServers maps resolved servers by name', () => {
@@ -290,6 +331,21 @@ suite('MCP Server Loading', () => {
                 remote: { type: 'http', url: 'https://mcp.example.com/sse', headers: { Authorization: 'Bearer abc' } },
             });
         });
+        test('bearerTokenEnv resolves against the PER-TURN env into an Authorization header (claude/custom path)', () => {
+            const server = {
+                name: 'data', label: 'data', command: '', args: [],
+                url: 'http://127.0.0.1:39999/mcp', bearerTokenEnv: 'AGENTHIPPO_TURN_NONCE',
+            };
+            const inline = (0, mcp_1.formatInlineMcpServers)([server], { AGENTHIPPO_TURN_NONCE: 'nonce-123' });
+            assert.deepStrictEqual(inline, {
+                data: { type: 'http', url: 'http://127.0.0.1:39999/mcp', headers: { Authorization: 'Bearer nonce-123' } },
+            });
+            // No nonce in the turn env (e.g. IDE) → no Authorization header, entry still valid.
+            const withoutNonce = (0, mcp_1.formatInlineMcpServers)([server], {});
+            assert.deepStrictEqual(withoutNonce, {
+                data: { type: 'http', url: 'http://127.0.0.1:39999/mcp' },
+            });
+        });
         test('serialize and parse round-trip inline MCP', () => {
             const inline = (0, mcp_1.formatInlineMcpServers)([
                 { name: 'echo', label: 'echo', command: 'echo', args: ['hi'] },

package/out/test/model-routing.test.js

@@ -0,0 +1,133 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Model routing / credential selection tests.
+ *
+ *  Guards the fix that replaced the provider-blind precedence
+ *  (apiKey = litellm || anthropic || openai) with destination-based selection: the credential
+ *  is chosen by the endpoint the engine dials, so a codex turn never authenticates to OpenAI
+ *  with an Anthropic key (the Databricks 401), and a claude turn never uses the OpenAI key.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const utils_1 = require("../utils");
+const pack_loader_1 = require("../cli/pack-loader");
+const OPENAI = 'sk-openai-xxx';
+const ANTHROPIC = 'sk-ant-yyy';
+const LITELLM = 'sk-litellm-zzz';
+function opts(over = {}) {
+    return { workspaceRoot: '/ws', ...over };
+}
+suite('resolveApiRouting: direct path selects the ENGINE\'s provider key (no collapse)', () => {
+    // The exact Databricks scenario: both direct keys present, no proxy configured.
+    const bothKeys = { openaiApiKey: OPENAI, anthropicApiKey: ANTHROPIC };
+    test('codex (openai) picks the OpenAI key even when an Anthropic key is also present', () => {
+        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: false }), bothKeys, 'openai');
+        assert.strictEqual(r.apiKey, OPENAI);
+        assert.strictEqual(r.useLiteLLM, false);
+    });
+    test('claude (anthropic) picks the Anthropic key even when an OpenAI key is also present', () => {
+        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: false }), bothKeys, 'anthropic');
+        assert.strictEqual(r.apiKey, ANTHROPIC);
+    });
+    test('the codex→OpenAI-with-Anthropic-key 401 is impossible now', () => {
+        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: false }), bothKeys, 'openai');
+        assert.notStrictEqual(r.apiKey, ANTHROPIC, 'codex must never receive the Anthropic key');
+    });
+    test('missing provider key → empty (fail visibly), never the other provider\'s key', () => {
+        const onlyAnthropic = { anthropicApiKey: ANTHROPIC };
+        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: false }), onlyAnthropic, 'openai');
+        assert.strictEqual(r.apiKey, '', 'codex with only an Anthropic key gets no key, not the wrong one');
+    });
+});
+suite('resolveApiRouting: LiteLLM path uses the proxy key for every engine', () => {
+    const creds = { litellmApiKey: LITELLM, litellmBaseUrl: 'http://proxy:4000', openaiApiKey: OPENAI, anthropicApiKey: ANTHROPIC };
+    test('codex through the proxy uses the LiteLLM key + base URL', () => {
+        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: true }), creds, 'openai');
+        assert.strictEqual(r.apiKey, LITELLM);
+        assert.strictEqual(r.baseUrl, 'http://proxy:4000');
+        assert.strictEqual(r.useLiteLLM, true);
+    });
+    test('claude through the proxy also uses the LiteLLM key (one key routes all)', () => {
+        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: true }), creds, 'anthropic');
+        assert.strictEqual(r.apiKey, LITELLM);
+    });
+});
+suite('resolveApiRouting: explicit options.apiKey (IDE single key) still wins', () => {
+    test('IDE explicit key overrides the provider fallback on the direct path', () => {
+        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: false, apiKey: 'sk-ide-explicit' }), { openaiApiKey: OPENAI }, 'openai');
+        assert.strictEqual(r.apiKey, 'sk-ide-explicit');
+    });
+    test('IDE with only an explicit key and no creds still works (back-compat)', () => {
+        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: false, apiKey: 'sk-ide-explicit' }), {}, 'anthropic');
+        assert.strictEqual(r.apiKey, 'sk-ide-explicit');
+    });
+    test('proxy path keeps the sk-dummy fallback when nothing is configured', () => {
+        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: true }), {}, 'openai');
+        assert.strictEqual(r.apiKey, 'sk-dummy');
+    });
+});
+suite('inferModelProvider: custom engines pick provider from the model id', () => {
+    test('claude/anthropic model ids → anthropic', () => {
+        assert.strictEqual((0, utils_1.inferModelProvider)('claude-sonnet-4-5'), 'anthropic');
+        assert.strictEqual((0, utils_1.inferModelProvider)('litellm/claude-haiku-4-5'), 'anthropic');
+        assert.strictEqual((0, utils_1.inferModelProvider)('anthropic/claude-opus'), 'anthropic');
+    });
+    test('everything else → openai (the safe default for gpt/codex/unknown)', () => {
+        assert.strictEqual((0, utils_1.inferModelProvider)('gpt-5.5'), 'openai');
+        assert.strictEqual((0, utils_1.inferModelProvider)('litellm/gpt-5.4-nano'), 'openai');
+        assert.strictEqual((0, utils_1.inferModelProvider)(undefined), 'openai');
+    });
+});
+suite('hasCredentialForEngine: engine-aware boot check', () => {
+    const base = { apiKey: undefined, baseUrl: undefined, useLiteLLM: false, litellmApiKey: undefined, openaiApiKey: undefined, anthropicApiKey: undefined };
+    test('codex needs an OpenAI key; an Anthropic-only env fails the check', () => {
+        assert.strictEqual((0, pack_loader_1.hasCredentialForEngine)('codex', { ...base, anthropicApiKey: ANTHROPIC }), false);
+        assert.strictEqual((0, pack_loader_1.hasCredentialForEngine)('codex', { ...base, openaiApiKey: OPENAI }), true);
+    });
+    test('claude needs an Anthropic key; an OpenAI-only env fails the check', () => {
+        assert.strictEqual((0, pack_loader_1.hasCredentialForEngine)('claude', { ...base, openaiApiKey: OPENAI }), false);
+        assert.strictEqual((0, pack_loader_1.hasCredentialForEngine)('claude', { ...base, anthropicApiKey: ANTHROPIC }), true);
+    });
+    test('a configured LiteLLM proxy satisfies every engine', () => {
+        const proxy = { ...base, useLiteLLM: true, litellmApiKey: LITELLM, baseUrl: 'http://proxy:4000' };
+        assert.strictEqual((0, pack_loader_1.hasCredentialForEngine)('codex', proxy), true);
+        assert.strictEqual((0, pack_loader_1.hasCredentialForEngine)('claude', proxy), true);
+    });
+    test('custom engines are not gated here (they authenticate via their own manifest env var)', () => {
+        assert.strictEqual((0, pack_loader_1.hasCredentialForEngine)('openclaw', base), true);
+    });
+});