@agenthippo-ai/agenthippo 1.110.9 → 1.110.19

package/out/test/mcp.test.js

@@ -1,389 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-require("mocha");
-const assert = __importStar(require("assert"));
-const path = __importStar(require("path"));
-const os = __importStar(require("os"));
-const fs_1 = require("fs");
-const mcp_1 = require("../mcp");
-const branding_1 = require("../branding");
-const credential_context_1 = require("../cli/credential-context");
-suite('MCP Server Loading', () => {
-    let testDir;
-    const getAgentMcpDir = (agentId) => path.join(testDir, branding_1.AGENTIDE_DIR_NAME, 'agents', agentId, 'mcp');
-    setup(async () => {
-        testDir = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'mcp-test-'));
-    });
-    teardown(async () => {
-        await fs_1.promises.rm(testDir, { recursive: true, force: true, maxRetries: 5, retryDelay: 50 });
-    });
-    suite('loadMcpServers', () => {
-        test('should return empty array when agent mcp config does not exist', async () => {
-            const result = await (0, mcp_1.loadMcpServers)('nonexistent', testDir);
-            assert.deepStrictEqual(result, []);
-        });
-        test('should load servers from .mcp.json', async () => {
-            const mcpDir = getAgentMcpDir('pack-test');
-            await fs_1.promises.mkdir(mcpDir, { recursive: true });
-            await fs_1.promises.writeFile(path.join(mcpDir, '.env'), 'GITHUB_TOKEN=from_env_file\n');
-            const configJson = {
-                mcpServers: {
-                    github: {
-                        label: 'GitHub MCP',
-                        command: 'npx',
-                        args: ['-y', '@modelcontextprotocol/server-github'],
-                        env: { GITHUB_TOKEN: '${env:GITHUB_TOKEN}' },
-                    },
-                    filesystem: {
-                        command: 'npx',
-                        args: ['-y', '@modelcontextprotocol/server-filesystem'],
-                    },
-                },
-            };
-            await fs_1.promises.writeFile(path.join(mcpDir, '.mcp.json'), JSON.stringify(configJson, null, 2));
-            const result = await (0, mcp_1.loadMcpServers)('pack-test', testDir);
-            assert.strictEqual(result.length, 2);
-            assert.strictEqual(result[0].name, 'github');
-            assert.strictEqual(result[0].command, 'npx');
-            assert.deepStrictEqual(result[0].args, ['-y', '@modelcontextprotocol/server-github']);
-            assert.deepStrictEqual(result[0].env, { GITHUB_TOKEN: 'from_env_file' });
-            assert.strictEqual(result[1].name, 'filesystem');
-            assert.deepStrictEqual(result[1].args, ['-y', '@modelcontextprotocol/server-filesystem']);
-        });
-        test('should resolve relative args and ${serverDir}', async () => {
-            const mcpDir = getAgentMcpDir('pack-test');
-            await fs_1.promises.mkdir(mcpDir, { recursive: true });
-            const mcpJson = {
-                mcpServers: {
-                    'custom-server': {
-                        label: 'Custom Server',
-                        command: 'node',
-                        args: ['${serverDir}/dist/index.js', './relative.js'],
-                    },
-                },
-            };
-            await fs_1.promises.writeFile(path.join(mcpDir, '.mcp.json'), JSON.stringify(mcpJson, null, 2));
-            const result = await (0, mcp_1.loadMcpServers)('pack-test', testDir);
-            assert.strictEqual(result.length, 1);
-            assert.strictEqual(result[0].name, 'custom-server');
-            assert.strictEqual(result[0].command, 'node');
-            assert.deepStrictEqual(result[0].args, [
-                `${mcpDir}/dist/index.js`,
-                path.resolve(mcpDir, './relative.js'),
-            ]);
-        });
-    });
-    suite('loadMcpServers bundled resolution', () => {
-        test('should load bundled servers for default agent', async () => {
-            const result = await (0, mcp_1.loadMcpServers)('default', testDir);
-            assert.deepStrictEqual(result, []);
-        });
-        test('should resolve enable-bundled from bundled server mcp.json', async () => {
-            const defaultMcpDir = getAgentMcpDir('default');
-            await fs_1.promises.mkdir(defaultMcpDir, { recursive: true });
-            await fs_1.promises.writeFile(path.join(defaultMcpDir, '.mcp.json'), JSON.stringify({
-                mcpServers: {
-                    'langfuse-analytics': {
-                        command: 'enable-bundled',
-                        env: {
-                            SOURCE: 'workspace',
-                            LANGFUSE_PUBLIC_KEY: '${env:LANGFUSE_PUBLIC_KEY}',
-                        },
-                    },
-                },
-            }));
-            const bundledBasePromptsDir = path.join(testDir, 'base-prompts');
-            const bundledServerDir = path.join(bundledBasePromptsDir, 'mcp-servers', 'langfuse-analytics');
-            await fs_1.promises.mkdir(bundledServerDir, { recursive: true });
-            await fs_1.promises.writeFile(path.join(bundledServerDir, 'mcp.json'), JSON.stringify({
-                name: 'langfuse-analytics',
-                label: 'Langfuse Analytics',
-                command: 'node',
-                args: ['${serverDir}/dist/index.js', './bootstrap.js'],
-                env: {
-                    LANGFUSE_BASE_URL: '${env:LANGFUSE_BASE_URL}',
-                    SOURCE: 'bundled',
-                },
-            }));
-            await fs_1.promises.writeFile(path.join(testDir, '.env'), 'LANGFUSE_BASE_URL=https://cloud.langfuse.com\nLANGFUSE_PUBLIC_KEY=public-key\n');
-            const result = await (0, mcp_1.loadMcpServers)('default', testDir, bundledBasePromptsDir);
-            assert.strictEqual(result.length, 1);
-            assert.strictEqual(result[0].name, 'langfuse-analytics');
-            assert.strictEqual(result[0].command, 'node');
-            assert.deepStrictEqual(result[0].args, [
-                `${bundledServerDir}/dist/index.js`,
-                path.resolve(bundledServerDir, './bootstrap.js'),
-            ]);
-            assert.deepStrictEqual(result[0].env, {
-                LANGFUSE_BASE_URL: 'https://cloud.langfuse.com',
-                LANGFUSE_PUBLIC_KEY: process.env.LANGFUSE_PUBLIC_KEY ?? 'public-key',
-                SOURCE: 'workspace',
-            });
-        });
-        test('should skip bundled server when mcp.json is missing', async () => {
-            const defaultMcpDir = getAgentMcpDir('default');
-            await fs_1.promises.mkdir(defaultMcpDir, { recursive: true });
-            await fs_1.promises.writeFile(path.join(defaultMcpDir, '.mcp.json'), JSON.stringify({
-                mcpServers: {
-                    'missing-bundled': {
-                        command: 'enable-bundled',
-                    },
-                },
-            }));
-            const bundledBasePromptsDir = path.join(testDir, 'base-prompts');
-            await fs_1.promises.mkdir(path.join(bundledBasePromptsDir, 'mcp-servers'), { recursive: true });
-            const result = await (0, mcp_1.loadMcpServers)('default', testDir, bundledBasePromptsDir);
-            assert.deepStrictEqual(result, []);
-        });
-        test('should skip server when command is disable-bundled', async () => {
-            const defaultMcpDir = getAgentMcpDir('default');
-            await fs_1.promises.mkdir(defaultMcpDir, { recursive: true });
-            await fs_1.promises.writeFile(path.join(defaultMcpDir, '.mcp.json'), JSON.stringify({
-                mcpServers: {
-                    'langfuse-analytics': {
-                        command: 'disable-bundled',
-                    },
-                },
-            }));
-            const bundledBasePromptsDir = path.join(testDir, 'base-prompts');
-            const bundledServerDir = path.join(bundledBasePromptsDir, 'mcp-servers', 'langfuse-analytics');
-            await fs_1.promises.mkdir(bundledServerDir, { recursive: true });
-            await fs_1.promises.writeFile(path.join(bundledServerDir, 'mcp.json'), JSON.stringify({
-                command: 'node',
-                args: ['${serverDir}/dist/index.js'],
-            }));
-            const result = await (0, mcp_1.loadMcpServers)('default', testDir, bundledBasePromptsDir);
-            assert.deepStrictEqual(result, []);
-        });
-        test('should load pack servers for non-default agent', async () => {
-            const packMcpDir = getAgentMcpDir('test-pack');
-            await fs_1.promises.mkdir(packMcpDir, { recursive: true });
-            await fs_1.promises.writeFile(path.join(packMcpDir, '.mcp.json'), JSON.stringify({
-                mcpServers: {
-                    'pack-server': {
-                        command: 'echo',
-                        args: ['hello'],
-                    },
-                },
-            }));
-            const result = await (0, mcp_1.loadMcpServers)('test-pack', testDir);
-            assert.strictEqual(result.length, 1);
-            assert.strictEqual(result[0].name, 'pack-server');
-        });
-    });
-    suite('generateCodexMcpConfig', () => {
-        test('should generate empty string for no servers', () => {
-            const result = (0, mcp_1.generateCodexMcpConfig)([]);
-            assert.strictEqual(result, '');
-        });
-        test('should generate valid TOML config', () => {
-            const servers = [
-                {
-                    name: 'test-server',
-                    label: 'Test Server',
-                    command: 'node',
-                    args: ['/path/to/server.js'],
-                    env: { API_KEY: 'secret' },
-                },
-            ];
-            const result = (0, mcp_1.generateCodexMcpConfig)(servers);
-            assert.ok(result.includes('[mcp_servers.test-server]'));
-            assert.ok(result.includes('command = "node"'));
-            assert.ok(result.includes('args = ["/path/to/server.js"]'));
-            assert.ok(result.includes('"API_KEY" = "secret"'));
-            // No approval line by default — interactive IDE keeps Codex's normal prompts.
-            assert.ok(!result.includes('default_tools_approval_mode'));
-        });
-        test('env keys are quoted so names with dots/spaces stay valid TOML', () => {
-            const servers = [
-                {
-                    name: 'test-server',
-                    label: 'Test Server',
-                    command: 'node',
-                    args: ['s.js'],
-                    env: { 'my.token': 'a', 'NPM CONFIG': 'b' },
-                },
-            ];
-            const result = (0, mcp_1.generateCodexMcpConfig)(servers);
-            assert.ok(result.includes('"my.token" = "a"'));
-            assert.ok(result.includes('"NPM CONFIG" = "b"'));
-            // A bare (unquoted) dotted key would be misparsed as a nested table.
-            assert.ok(!result.includes('my.token = '));
-        });
-        test('autoApprove emits default_tools_approval_mode = "approve" per server', () => {
-            const servers = [
-                { name: 'stdio-srv', label: 's', command: 'node', args: ['s.js'] },
-                { name: 'http-srv', label: 'h', command: '', args: [], url: 'https://mcp.example.com/sse' },
-            ];
-            const result = (0, mcp_1.generateCodexMcpConfig)(servers, { autoApprove: true });
-            assert.ok(result.includes('default_tools_approval_mode = "approve"'));
-            assert.ok(result.includes('url = "https://mcp.example.com/sse"'));
-            // Invalid legacy key/value must never be emitted. "auto" is not a valid enum value
-            // either — Codex ≥0.131 ignores it, falls back to `prompt`, and headless exec then
-            // cancels every MCP tool call ("user cancelled MCP tool call").
-            assert.ok(!result.includes('approval_mode = "never"'));
-            assert.ok(!result.includes('"auto"'));
-        });
-        test('generateCodexMcpConfig emits http_headers for URL servers', () => {
-            const servers = [
-                {
-                    name: 'remote',
-                    label: 'r',
-                    command: '',
-                    args: [],
-                    url: 'https://mcp.example.com/sse',
-                    headers: { Authorization: 'Bearer abc', 'X-Custom': 'val' },
-                },
-            ];
-            const result = (0, mcp_1.generateCodexMcpConfig)(servers);
-            assert.ok(result.includes('url = "https://mcp.example.com/sse"'));
-            assert.ok(result.includes('http_headers = { "Authorization" = "Bearer abc", "X-Custom" = "val" }'));
-        });
-        test('bearerTokenEnv emits bearer_token_env_var and NEVER a per-turn value — config.toml stays turn-invariant (secure-obo-design §3.2)', async () => {
-            const servers = [
-                {
-                    name: 'data',
-                    label: 'data',
-                    command: '',
-                    args: [],
-                    url: 'http://127.0.0.1:39999/mcp',
-                    bearerTokenEnv: 'AGENTHIPPO_TURN_NONCE',
-                },
-            ];
-            const outsideScope = (0, mcp_1.generateCodexMcpConfig)(servers);
-            assert.ok(outsideScope.includes('bearer_token_env_var = "AGENTHIPPO_TURN_NONCE"'));
-            assert.ok(!outsideScope.includes('http_headers'), 'no resolved header may carry the nonce into the file');
-            // Byte-identical no matter which user's credential scope is ambient — this is the
-            // exact property that removes the cross-user config.toml race (defect 1).
-            const inAlice = await (0, credential_context_1.runWithCredential)({ userId: 'alice@corp.com', dataToken: 'tok-a' }, async () => (0, mcp_1.generateCodexMcpConfig)(servers));
-            const inBob = await (0, credential_context_1.runWithCredential)({ userId: 'bob@corp.com', dataToken: 'tok-b' }, async () => (0, mcp_1.generateCodexMcpConfig)(servers));
-            assert.strictEqual(inAlice, outsideScope);
-            assert.strictEqual(inBob, outsideScope);
-        });
-    });
-    suite('inline MCP helpers', () => {
-        test('formatInlineMcpServers maps resolved servers by name', () => {
-            const inline = (0, mcp_1.formatInlineMcpServers)([
-                { name: 'db', label: 'db', command: 'node', args: ['server.js'], env: { TOKEN: 'x' } },
-            ]);
-            assert.deepStrictEqual(inline, {
-                db: { command: 'node', args: ['server.js'], env: { TOKEN: 'x' } },
-            });
-        });
-        test('formatInlineMcpServers maps HTTP Streamable servers to cursor-sdk url form', () => {
-            const inline = (0, mcp_1.formatInlineMcpServers)([
-                { name: 'remote', label: 'remote', command: '', args: [], url: 'https://mcp.example.com/sse' },
-                { name: 'local', label: 'local', command: 'node', args: ['s.js'] },
-            ]);
-            assert.deepStrictEqual(inline, {
-                remote: { type: 'http', url: 'https://mcp.example.com/sse' },
-                local: { command: 'node', args: ['s.js'] },
-            });
-        });
-        test('formatInlineMcpServers threads headers into HTTP servers', () => {
-            const inline = (0, mcp_1.formatInlineMcpServers)([
-                {
-                    name: 'remote',
-                    label: 'remote',
-                    command: '',
-                    args: [],
-                    url: 'https://mcp.example.com/sse',
-                    headers: { Authorization: 'Bearer abc' },
-                },
-            ]);
-            assert.deepStrictEqual(inline, {
-                remote: { type: 'http', url: 'https://mcp.example.com/sse', headers: { Authorization: 'Bearer abc' } },
-            });
-        });
-        test('bearerTokenEnv resolves against the PER-TURN env into an Authorization header (cursor/custom path)', () => {
-            const server = {
-                name: 'data', label: 'data', command: '', args: [],
-                url: 'http://127.0.0.1:39999/mcp', bearerTokenEnv: 'AGENTHIPPO_TURN_NONCE',
-            };
-            const inline = (0, mcp_1.formatInlineMcpServers)([server], { AGENTHIPPO_TURN_NONCE: 'nonce-123' });
-            assert.deepStrictEqual(inline, {
-                data: { type: 'http', url: 'http://127.0.0.1:39999/mcp', headers: { Authorization: 'Bearer nonce-123' } },
-            });
-            // No nonce in the turn env (e.g. IDE) → no Authorization header, entry still valid.
-            const withoutNonce = (0, mcp_1.formatInlineMcpServers)([server], {});
-            assert.deepStrictEqual(withoutNonce, {
-                data: { type: 'http', url: 'http://127.0.0.1:39999/mcp' },
-            });
-        });
-        /**
-         * The claude path must ship a `${NAME}` REFERENCE, never the resolved secret: the Agent
-         * SDK serializes mcpServers into `--mcp-config <json>` argv, and /proc/<pid>/cmdline is
-         * world-readable — a resolved bearer there leaks the turn nonce to every uid on the host.
-         * The CLI expands the reference from its own env (verified live on 2.1.220).
-         */
-        test('referenceHttpMcpHeaders emits a ${NAME} reference, never the secret (claude path)', () => {
-            const headers = (0, mcp_1.referenceHttpMcpHeaders)({ bearerTokenEnv: 'AGENTHIPPO_TURN_NONCE', headers: { 'X-Static': 'kept' } }, { AGENTHIPPO_TURN_NONCE: 'nonce-123' });
-            assert.deepStrictEqual(headers, {
-                'X-Static': 'kept',
-                'Authorization': 'Bearer ${AGENTHIPPO_TURN_NONCE}',
-            });
-            // The reference is emitted even when the env has no value yet: expansion happens in
-            // the CLI at connect time, and an unset name passes through literally, which the data
-            // gateway rejects — fail closed, never a silently-authorized request.
-            const unresolved = (0, mcp_1.referenceHttpMcpHeaders)({ bearerTokenEnv: 'AGENTHIPPO_TURN_NONCE' }, {});
-            assert.deepStrictEqual(unresolved, { Authorization: 'Bearer ${AGENTHIPPO_TURN_NONCE}' });
-        });
-        test('referenceHttpMcpHeaders falls back to in-memory resolution for a non-expandable name', () => {
-            // A name outside the CLI's `${NAME}` grammar would be sent verbatim as garbage; the
-            // fallback resolves it here instead, accepting environ-level exposure over a broken header.
-            const headers = (0, mcp_1.referenceHttpMcpHeaders)({ bearerTokenEnv: 'weird-name.v2' }, { 'weird-name.v2': 'tok-1' });
-            assert.deepStrictEqual(headers, { Authorization: 'Bearer tok-1' });
-            // No bearerTokenEnv and no static headers → no headers object at all.
-            assert.strictEqual((0, mcp_1.referenceHttpMcpHeaders)({}, {}), undefined);
-        });
-        test('serialize and parse round-trip inline MCP', () => {
-            const inline = (0, mcp_1.formatInlineMcpServers)([
-                { name: 'echo', label: 'echo', command: 'echo', args: ['hi'] },
-            ]);
-            const json = (0, mcp_1.serializeInlineMcpServers)(inline);
-            assert.ok(json);
-            assert.deepStrictEqual((0, mcp_1.parseInlineMcpServers)(json), inline);
-        });
-        test('parseInlineMcpServers returns undefined for empty or invalid input', () => {
-            assert.strictEqual((0, mcp_1.parseInlineMcpServers)(undefined), undefined);
-            assert.strictEqual((0, mcp_1.parseInlineMcpServers)(''), undefined);
-            assert.strictEqual((0, mcp_1.parseInlineMcpServers)('not-json'), undefined);
-        });
-    });
-});

package/out/test/model-routing.test.js

@@ -1,133 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Model routing / credential selection tests.
- *
- *  Guards the fix that replaced the provider-blind precedence
- *  (apiKey = litellm || anthropic || openai) with destination-based selection: the credential
- *  is chosen by the endpoint the engine dials, so a codex turn never authenticates to OpenAI
- *  with an Anthropic key (the Databricks 401), and a claude turn never uses the OpenAI key.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-require("mocha");
-const assert = __importStar(require("assert"));
-const utils_1 = require("../utils");
-const pack_loader_1 = require("../cli/pack-loader");
-const OPENAI = 'sk-openai-xxx';
-const ANTHROPIC = 'sk-ant-yyy';
-const LITELLM = 'sk-litellm-zzz';
-function opts(over = {}) {
-    return { workspaceRoot: '/ws', ...over };
-}
-suite('resolveApiRouting: direct path selects the ENGINE\'s provider key (no collapse)', () => {
-    // The exact Databricks scenario: both direct keys present, no proxy configured.
-    const bothKeys = { openaiApiKey: OPENAI, anthropicApiKey: ANTHROPIC };
-    test('codex (openai) picks the OpenAI key even when an Anthropic key is also present', () => {
-        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: false }), bothKeys, 'openai');
-        assert.strictEqual(r.apiKey, OPENAI);
-        assert.strictEqual(r.useLiteLLM, false);
-    });
-    test('claude (anthropic) picks the Anthropic key even when an OpenAI key is also present', () => {
-        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: false }), bothKeys, 'anthropic');
-        assert.strictEqual(r.apiKey, ANTHROPIC);
-    });
-    test('the codex→OpenAI-with-Anthropic-key 401 is impossible now', () => {
-        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: false }), bothKeys, 'openai');
-        assert.notStrictEqual(r.apiKey, ANTHROPIC, 'codex must never receive the Anthropic key');
-    });
-    test('missing provider key → empty (fail visibly), never the other provider\'s key', () => {
-        const onlyAnthropic = { anthropicApiKey: ANTHROPIC };
-        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: false }), onlyAnthropic, 'openai');
-        assert.strictEqual(r.apiKey, '', 'codex with only an Anthropic key gets no key, not the wrong one');
-    });
-});
-suite('resolveApiRouting: LiteLLM path uses the proxy key for every engine', () => {
-    const creds = { litellmApiKey: LITELLM, litellmBaseUrl: 'http://proxy:4000', openaiApiKey: OPENAI, anthropicApiKey: ANTHROPIC };
-    test('codex through the proxy uses the LiteLLM key + base URL', () => {
-        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: true }), creds, 'openai');
-        assert.strictEqual(r.apiKey, LITELLM);
-        assert.strictEqual(r.baseUrl, 'http://proxy:4000');
-        assert.strictEqual(r.useLiteLLM, true);
-    });
-    test('claude through the proxy also uses the LiteLLM key (one key routes all)', () => {
-        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: true }), creds, 'anthropic');
-        assert.strictEqual(r.apiKey, LITELLM);
-    });
-});
-suite('resolveApiRouting: explicit options.apiKey (IDE single key) still wins', () => {
-    test('IDE explicit key overrides the provider fallback on the direct path', () => {
-        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: false, apiKey: 'sk-ide-explicit' }), { openaiApiKey: OPENAI }, 'openai');
-        assert.strictEqual(r.apiKey, 'sk-ide-explicit');
-    });
-    test('IDE with only an explicit key and no creds still works (back-compat)', () => {
-        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: false, apiKey: 'sk-ide-explicit' }), {}, 'anthropic');
-        assert.strictEqual(r.apiKey, 'sk-ide-explicit');
-    });
-    test('proxy path keeps the sk-dummy fallback when nothing is configured', () => {
-        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: true }), {}, 'openai');
-        assert.strictEqual(r.apiKey, 'sk-dummy');
-    });
-});
-suite('inferModelProvider: custom engines pick provider from the model id', () => {
-    test('claude/anthropic model ids → anthropic', () => {
-        assert.strictEqual((0, utils_1.inferModelProvider)('claude-sonnet-4-5'), 'anthropic');
-        assert.strictEqual((0, utils_1.inferModelProvider)('litellm/claude-haiku-4-5'), 'anthropic');
-        assert.strictEqual((0, utils_1.inferModelProvider)('anthropic/claude-opus'), 'anthropic');
-    });
-    test('everything else → openai (the safe default for gpt/codex/unknown)', () => {
-        assert.strictEqual((0, utils_1.inferModelProvider)('gpt-5.5'), 'openai');
-        assert.strictEqual((0, utils_1.inferModelProvider)('litellm/gpt-5.4-nano'), 'openai');
-        assert.strictEqual((0, utils_1.inferModelProvider)(undefined), 'openai');
-    });
-});
-suite('hasCredentialForEngine: engine-aware boot check', () => {
-    const base = { apiKey: undefined, baseUrl: undefined, useLiteLLM: false, litellmApiKey: undefined, openaiApiKey: undefined, anthropicApiKey: undefined };
-    test('codex needs an OpenAI key; an Anthropic-only env fails the check', () => {
-        assert.strictEqual((0, pack_loader_1.hasCredentialForEngine)('codex', { ...base, anthropicApiKey: ANTHROPIC }), false);
-        assert.strictEqual((0, pack_loader_1.hasCredentialForEngine)('codex', { ...base, openaiApiKey: OPENAI }), true);
-    });
-    test('claude needs an Anthropic key; an OpenAI-only env fails the check', () => {
-        assert.strictEqual((0, pack_loader_1.hasCredentialForEngine)('claude', { ...base, openaiApiKey: OPENAI }), false);
-        assert.strictEqual((0, pack_loader_1.hasCredentialForEngine)('claude', { ...base, anthropicApiKey: ANTHROPIC }), true);
-    });
-    test('a configured LiteLLM proxy satisfies every engine', () => {
-        const proxy = { ...base, useLiteLLM: true, litellmApiKey: LITELLM, baseUrl: 'http://proxy:4000' };
-        assert.strictEqual((0, pack_loader_1.hasCredentialForEngine)('codex', proxy), true);
-        assert.strictEqual((0, pack_loader_1.hasCredentialForEngine)('claude', proxy), true);
-    });
-    test('custom engines are not gated here (they authenticate via their own manifest env var)', () => {
-        assert.strictEqual((0, pack_loader_1.hasCredentialForEngine)('openclaw', base), true);
-    });
-});