@blackbelt-technology/pi-agent-dashboard 0.2.9 → 0.4.0

package/packages/server/src/__tests__/pi-version-skew.test.ts

@@ -0,0 +1,165 @@
+/**
+ * Unit tests for the pi version-skew detection module.
+ *
+ * See change: unified-bootstrap-install \u00a79.
+ */
+import { describe, it, expect, beforeEach } from "vitest";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import {
+  parseVersion,
+  compareVersions,
+  isBelow,
+  isAbove,
+  readPiCompatibility,
+  computeCompatibility,
+  _resetVersionSkewCache,
+} from "../pi-version-skew.js";
+
+describe("pi-version-skew", () => {
+  beforeEach(() => {
+    _resetVersionSkewCache();
+  });
+
+  describe("parseVersion", () => {
+    it("parses simple x.y.z", () => {
+      expect(parseVersion("1.2.3")).toEqual([1, 2, 3]);
+    });
+    it("parses with v prefix", () => {
+      expect(parseVersion("v0.6.7")).toEqual([0, 6, 7]);
+    });
+    it("ignores pre-release suffix", () => {
+      expect(parseVersion("0.6.7-beta.1")).toEqual([0, 6, 7]);
+    });
+    it("ignores build metadata", () => {
+      expect(parseVersion("0.6.7+abc")).toEqual([0, 6, 7]);
+    });
+    it("returns null for non-numeric", () => {
+      expect(parseVersion("latest")).toBeNull();
+      expect(parseVersion("")).toBeNull();
+    });
+  });
+
+  describe("compareVersions", () => {
+    it("equal versions", () => {
+      expect(compareVersions("0.6.7", "0.6.7")).toBe(0);
+    });
+    it("lower major", () => {
+      expect(compareVersions("0.9.9", "1.0.0")).toBe(-1);
+    });
+    it("higher major", () => {
+      expect(compareVersions("2.0.0", "1.9.9")).toBe(1);
+    });
+    it("lower minor", () => {
+      expect(compareVersions("0.5.7", "0.6.0")).toBe(-1);
+    });
+    it("lower patch", () => {
+      expect(compareVersions("0.6.6", "0.6.7")).toBe(-1);
+    });
+    it("unparseable sorts as equal (conservative)", () => {
+      expect(compareVersions("latest", "0.6.7")).toBe(0);
+    });
+  });
+
+  describe("isBelow / isAbove", () => {
+    it("isBelow", () => {
+      expect(isBelow("0.5.0", "0.6.7")).toBe(true);
+      expect(isBelow("0.6.7", "0.6.7")).toBe(false);
+      expect(isBelow("0.7.0", "0.6.7")).toBe(false);
+    });
+    it("isAbove with .x wildcard", () => {
+      expect(isAbove("0.10.0", "0.9.x")).toBe(true);
+      expect(isAbove("0.9.5", "0.9.x")).toBe(false);
+      expect(isAbove("0.9.99998", "0.9.x")).toBe(false);
+    });
+    it("isAbove with concrete version", () => {
+      expect(isAbove("1.0.1", "1.0.0")).toBe(true);
+      expect(isAbove("1.0.0", "1.0.0")).toBe(false);
+    });
+  });
+
+  describe("readPiCompatibility", () => {
+    let tmpDir: string;
+
+    beforeEach(() => {
+      tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "pi-skew-"));
+    });
+
+    it("reads the field from a well-formed package.json", () => {
+      const pkg = path.join(tmpDir, "package.json");
+      fs.writeFileSync(
+        pkg,
+        JSON.stringify({ piCompatibility: { minimum: "1.0.0", recommended: "1.2.0", maximum: "2.x" } }),
+      );
+      expect(readPiCompatibility(pkg)).toEqual({
+        minimum: "1.0.0",
+        recommended: "1.2.0",
+        maximum: "2.x",
+      });
+    });
+
+    it("tolerates null maximum", () => {
+      const pkg = path.join(tmpDir, "package.json");
+      fs.writeFileSync(
+        pkg,
+        JSON.stringify({ piCompatibility: { minimum: "1.0.0", recommended: "1.2.0", maximum: null } }),
+      );
+      expect(readPiCompatibility(pkg).maximum).toBeNull();
+    });
+
+    it("falls back to defaults when field is missing", () => {
+      const pkg = path.join(tmpDir, "package.json");
+      fs.writeFileSync(pkg, JSON.stringify({ name: "something" }));
+      expect(readPiCompatibility(pkg)).toEqual({
+        minimum: "0.6.7",
+        recommended: "0.6.7",
+        maximum: null,
+      });
+    });
+
+    it("falls back to defaults when file is unreadable", () => {
+      expect(readPiCompatibility("/does/not/exist")).toEqual({
+        minimum: "0.6.7",
+        recommended: "0.6.7",
+        maximum: null,
+      });
+    });
+  });
+
+  describe("computeCompatibility", () => {
+    const range = { minimum: "0.6.7", recommended: "0.6.7", maximum: null };
+
+    it("returns range unchanged when pi is not yet installed", () => {
+      expect(computeCompatibility(range, undefined)).toEqual({ ...range, current: undefined });
+    });
+
+    it("flags upgradeRecommended when below minimum", () => {
+      const out = computeCompatibility(range, "0.5.0");
+      expect(out.current).toBe("0.5.0");
+      expect(out.upgradeRecommended).toBe(true);
+    });
+
+    it("flags upgradeRecommended when below recommended (but >= minimum)", () => {
+      const out = computeCompatibility(
+        { minimum: "0.5.0", recommended: "0.6.7", maximum: null },
+        "0.6.0",
+      );
+      expect(out.upgradeRecommended).toBe(true);
+    });
+
+    it("no upgrade flag when at or above recommended", () => {
+      const out = computeCompatibility(range, "0.6.7");
+      expect(out.upgradeRecommended).toBeUndefined();
+      expect(out.upgradeDashboard).toBeUndefined();
+    });
+
+    it("flags upgradeDashboard when above maximum", () => {
+      const out = computeCompatibility(
+        { minimum: "0.6.7", recommended: "0.6.7", maximum: "0.9.x" },
+        "0.10.0",
+      );
+      expect(out.upgradeDashboard).toBe(true);
+    });
+  });
+});

package/packages/server/src/__tests__/preferences-store.test.ts

@@ -9,6 +9,14 @@ vi.mock("../resolve-path.js", () => ({
   safeRealpathSync: (p: string) => p,
 }));
 
+// Canonical host-platform absolute paths. Using raw POSIX strings like
+// `/a` would normalize to `B:\a` on Windows (path.win32.resolve prepends
+// the current drive), breaking assertions. These constants produce paths
+// that survive `normalizePath` unchanged on their host platform.
+const A_PATH = path.resolve(os.tmpdir(), "pref-a");
+const B_PATH = path.resolve(os.tmpdir(), "pref-b");
+const X_PATH = path.resolve(os.tmpdir(), "pref-x");
+
 describe("preferences-store", () => {
   let tmpDir: string;
   let filePath: string;
@@ -33,12 +41,12 @@ describe("preferences-store", () => {
 
   it("should load existing preferences", () => {
     fs.writeFileSync(filePath, JSON.stringify({
-      pinnedDirectories: ["/a", "/b"],
-      sessionOrder: { "/a": ["s1", "s2"] },
+      pinnedDirectories: [A_PATH, B_PATH],
+      sessionOrder: { [A_PATH]: ["s1", "s2"] },
     }));
     const store = createPreferencesStore(filePath);
-    expect(store.getPinnedDirectories()).toEqual(["/a", "/b"]);
-    expect(store.getSessionOrder()).toEqual({ "/a": ["s1", "s2"] });
+    expect(store.getPinnedDirectories()).toEqual([A_PATH, B_PATH]);
+    expect(store.getSessionOrder()).toEqual({ [A_PATH]: ["s1", "s2"] });
     store.dispose();
   });
 
@@ -97,6 +105,67 @@ describe("preferences-store", () => {
     store.dispose();
   });
 
+  // ── Normalize-on-load migration (platform-path-normalization) ───────────
+
+  it("normalizes drifty pinned paths on load", () => {
+    // Seed a file with the kinds of drift that existed pre-normalization:
+    // trailing separators, `.` / `..` segments, duplicate separators. The
+    // store should collapse them to canonical form on first read.
+    fs.writeFileSync(filePath, JSON.stringify({
+      pinnedDirectories: [
+        process.platform === "win32"
+          ? "C:\\Users\\me\\Dev\\"         // trailing separator
+          : "/Users/me/Dev/",
+        process.platform === "win32"
+          ? "C:\\Users\\me\\Dev\\.\\BB"    // `.` segment
+          : "/Users/me/Dev/./BB",
+      ],
+      sessionOrder: {},
+    }));
+    const store = createPreferencesStore(filePath);
+    const pinned = store.getPinnedDirectories();
+    expect(pinned).toHaveLength(2);
+    // Expect canonical forms (trailing separator stripped, `.` resolved).
+    if (process.platform === "win32") {
+      expect(pinned[0]).toBe("C:\\Users\\me\\Dev");
+      expect(pinned[1]).toBe("C:\\Users\\me\\Dev\\BB");
+    } else {
+      expect(pinned[0]).toBe("/Users/me/Dev");
+      expect(pinned[1]).toBe("/Users/me/Dev/BB");
+    }
+    store.dispose();
+  });
+
+  it("deduplicates entries that collapse to the same canonical form", () => {
+    // Two different-looking entries that normalize to the same path must
+    // become one stored entry.
+    const entries = process.platform === "win32"
+      ? ["C:\\Users\\me", "C:\\Users\\me\\", "C:/Users/me"]
+      : ["/Users/me", "/Users/me/", "/Users/./me"];
+    fs.writeFileSync(filePath, JSON.stringify({
+      pinnedDirectories: entries,
+      sessionOrder: {},
+    }));
+    const store = createPreferencesStore(filePath);
+    expect(store.getPinnedDirectories()).toHaveLength(1);
+    store.dispose();
+  });
+
+  it("persists the normalized form back to disk on first debounce", () => {
+    fs.writeFileSync(filePath, JSON.stringify({
+      pinnedDirectories: [
+        process.platform === "win32" ? "C:\\Users\\me\\" : "/Users/me/",
+      ],
+      sessionOrder: {},
+    }));
+    const store = createPreferencesStore(filePath);
+    vi.advanceTimersByTime(1000);
+    const data = JSON.parse(fs.readFileSync(filePath, "utf-8"));
+    const expected = process.platform === "win32" ? "C:\\Users\\me" : "/Users/me";
+    expect(data.pinnedDirectories).toEqual([expected]);
+    store.dispose();
+  });
+
   it("should not contain hiddenSessions in output", () => {
     const store = createPreferencesStore(filePath);
     store.pinDirectory("/a");

package/packages/server/src/__tests__/process-manager.test.ts

@@ -1,24 +1,12 @@
 import { describe, it, expect, vi } from "vitest";
-import { detectPlatform, buildTmuxCommand, buildHeadlessArgs, shellEscape, spawnPiSession, buildSpawnEnv, type SessionOptions } from "../process-manager.js";
+import { buildTmuxCommand, buildHeadlessArgs, shellEscape, spawnPiSession, buildSpawnEnv, type SessionOptions } from "../process-manager.js";
 
-describe("Process Manager", () => {
-  describe("detectPlatform", () => {
-    it("should detect macOS", () => {
-      const result = detectPlatform("darwin");
-      expect(result.strategy).toBe("tmux");
-    });
-
-    it("should detect Linux", () => {
-      const result = detectPlatform("linux");
-      expect(result.strategy).toBe("tmux");
-    });
-
-    it("should detect Windows with WSL fallback", () => {
-      const result = detectPlatform("win32");
-      expect(result.strategy).toBe("wsl");
-    });
-  });
+// Note: platform-dispatch tests live in packages/shared/src/__tests__/
+// spawn-mechanism.test.ts. `detectPlatform` was removed in change:
+// consolidate-windows-spawn-and-platform-handlers — its job is now
+// owned by platform/spawn-mechanism.ts `selectMechanism`.
 
+describe("Process Manager", () => {
   describe("buildTmuxCommand", () => {
     it("should create new session when no pi-dashboard session exists", () => {
       const cmd = buildTmuxCommand("/home/user/project", false);
@@ -184,4 +172,43 @@ describe("Process Manager", () => {
       expect(result.message).toContain("does not exist");
     });
   });
+
+  // ── Fork/continue option forwarding ──────────────────────────────────────
+  // Regression guard for B1/B2: Windows WSL/cmd fallback used to drop
+  // sessionFile + mode silently. buildTmuxCommand and buildHeadlessArgs
+  // both go through `sessionFlagsToArgv`; make sure neither drops.
+  describe("session-flag forwarding", () => {
+    it("buildHeadlessArgs includes --fork for fork mode", () => {
+      const args = buildHeadlessArgs({ sessionFile: "C:\\x\\session.jsonl", mode: "fork" });
+      expect(args).toEqual(["--mode", "rpc", "--fork", "C:\\x\\session.jsonl"]);
+    });
+
+    it("buildHeadlessArgs includes --session for continue mode", () => {
+      const args = buildHeadlessArgs({ sessionFile: "/s/abc.jsonl", mode: "continue" });
+      expect(args).toEqual(["--mode", "rpc", "--session", "/s/abc.jsonl"]);
+    });
+
+    it("buildHeadlessArgs omits session flags when absent", () => {
+      const args = buildHeadlessArgs({});
+      expect(args).toEqual(["--mode", "rpc"]);
+    });
+
+    it("buildTmuxCommand includes --fork in the pi command", () => {
+      const cmd = buildTmuxCommand("/project", false, { sessionFile: "/s/abc.jsonl", mode: "fork" });
+      expect(cmd).toContain("pi --fork /s/abc.jsonl");
+    });
+
+    it("buildTmuxCommand includes --session in the pi command", () => {
+      const cmd = buildTmuxCommand("/project", false, { sessionFile: "/s/abc.jsonl", mode: "continue" });
+      expect(cmd).toContain("pi --session /s/abc.jsonl");
+    });
+
+    it("buildTmuxCommand with special-character sessionFile still shell-escapes", () => {
+      const cmd = buildTmuxCommand("/project", false, {
+        sessionFile: "/s/with space.jsonl",
+        mode: "fork",
+      });
+      expect(cmd).toContain("--fork '/s/with space.jsonl'");
+    });
+  });
 });

package/packages/server/src/__tests__/provider-auth-routes.test.ts

@@ -44,14 +44,22 @@ function createMockPiGateway() {
   } as any;
 }
 
+function createMockBrowserGateway() {
+  return {
+    broadcastToAll: vi.fn(),
+  } as any;
+}
+
 describe("provider-auth-routes", () => {
   let app: ReturnType<typeof Fastify>;
   let piGateway: ReturnType<typeof createMockPiGateway>;
+  let browserGateway: ReturnType<typeof createMockBrowserGateway>;
 
   beforeEach(async () => {
     app = Fastify();
     piGateway = createMockPiGateway();
-    registerProviderAuthRoutes(app, { piGateway });
+    browserGateway = createMockBrowserGateway();
+    registerProviderAuthRoutes(app, { piGateway, browserGateway });
     await app.ready();
   });
 
@@ -106,7 +114,7 @@ describe("provider-auth-routes", () => {
 
   // /exchange endpoint removed — token exchange happens in the callback server's onCode
 
-  it("PUT /api/provider-auth/api-key saves and notifies", async () => {
+  it("PUT /api/provider-auth/api-key saves and notifies bridges and browsers", async () => {
     const { writeCredential } = await import("../provider-auth-storage.js");
     const res = await app.inject({
       method: "PUT",
@@ -117,9 +125,10 @@ describe("provider-auth-routes", () => {
     expect(JSON.parse(res.payload).ok).toBe(true);
     expect(writeCredential).toHaveBeenCalledWith("openai", { type: "api_key", key: "sk-test" });
     expect(piGateway.broadcast).toHaveBeenCalledWith({ type: "credentials_updated" });
+    expect(browserGateway.broadcastToAll).toHaveBeenCalledWith({ type: "models_refreshed" });
   });
 
-  it("DELETE /api/provider-auth/:provider removes and notifies", async () => {
+  it("DELETE /api/provider-auth/:provider removes and notifies bridges and browsers", async () => {
     const { removeCredential } = await import("../provider-auth-storage.js");
     const res = await app.inject({
       method: "DELETE",
@@ -128,6 +137,7 @@ describe("provider-auth-routes", () => {
     expect(res.statusCode).toBe(200);
     expect(removeCredential).toHaveBeenCalledWith("anthropic");
     expect(piGateway.broadcast).toHaveBeenCalledWith({ type: "credentials_updated" });
+    expect(browserGateway.broadcastToAll).toHaveBeenCalledWith({ type: "models_refreshed" });
   });
 
   // /callback/:provider route removed — temp callback server handles this directly

package/packages/server/src/__tests__/provider-probe.test.ts

@@ -0,0 +1,287 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import {
+  buildProbeRequest,
+  resolveProbeApiKey,
+  probeProvider,
+  type ProbeInput,
+} from "../provider-probe.js";
+
+describe("buildProbeRequest", () => {
+  it("openai-completions: GET {baseUrl}/models with Authorization: Bearer", () => {
+    const req = buildProbeRequest({
+      baseUrl: "https://api.example.com/v1",
+      apiKey: "sk-abc",
+      api: "openai-completions",
+    });
+    expect(req.url).toBe("https://api.example.com/v1/models");
+    expect(req.headers.Authorization).toBe("Bearer sk-abc");
+  });
+
+  it("openai-completions: handles trailing slash on baseUrl", () => {
+    const req = buildProbeRequest({
+      baseUrl: "https://api.example.com/v1/",
+      apiKey: "sk-abc",
+      api: "openai-completions",
+    });
+    expect(req.url).toBe("https://api.example.com/v1/models");
+  });
+
+  it("openai-responses: same shape as openai-completions", () => {
+    const req = buildProbeRequest({
+      baseUrl: "https://api.example.com/v1",
+      apiKey: "sk-abc",
+      api: "openai-responses",
+    });
+    expect(req.url).toBe("https://api.example.com/v1/models");
+    expect(req.headers.Authorization).toBe("Bearer sk-abc");
+  });
+
+  it("anthropic-messages: x-api-key + anthropic-version, no Authorization", () => {
+    const req = buildProbeRequest({
+      baseUrl: "https://api.anthropic.com",
+      apiKey: "sk-ant-123",
+      api: "anthropic-messages",
+    });
+    expect(req.url).toBe("https://api.anthropic.com/v1/models");
+    expect(req.headers["x-api-key"]).toBe("sk-ant-123");
+    expect(req.headers["anthropic-version"]).toBe("2023-06-01");
+    expect(req.headers.Authorization).toBeUndefined();
+  });
+
+  it("google-generative-ai: key query param, no Authorization", () => {
+    const req = buildProbeRequest({
+      baseUrl: "https://generativelanguage.googleapis.com/v1beta",
+      apiKey: "AIza abc+def",
+      api: "google-generative-ai",
+    });
+    // apiKey must be URL-encoded
+    expect(req.url).toBe(
+      "https://generativelanguage.googleapis.com/v1beta/models?key=AIza%20abc%2Bdef",
+    );
+    expect(req.headers.Authorization).toBeUndefined();
+  });
+
+  it("throws on unknown api type", () => {
+    expect(() =>
+      buildProbeRequest({
+        baseUrl: "https://x",
+        apiKey: "k",
+        api: "unknown-api" as any,
+      }),
+    ).toThrow(/unsupported api/i);
+  });
+});
+
+describe("resolveProbeApiKey", () => {
+  const ORIGINAL_ENV = { ...process.env };
+  beforeEach(() => {
+    process.env = { ...ORIGINAL_ENV };
+  });
+  afterEach(() => {
+    process.env = { ...ORIGINAL_ENV };
+  });
+
+  it("literal key passes through", () => {
+    const result = resolveProbeApiKey({ apiKey: "sk-abc", readProviders: () => ({}) });
+    expect(result).toEqual({ ok: true, key: "sk-abc" });
+  });
+
+  it("$ENV_VAR: reads from process.env when set", () => {
+    process.env.MY_LLM_KEY = "resolved-value";
+    const result = resolveProbeApiKey({ apiKey: "$MY_LLM_KEY", readProviders: () => ({}) });
+    expect(result).toEqual({ ok: true, key: "resolved-value" });
+  });
+
+  it("$ENV_VAR: returns error when env var is missing", () => {
+    delete process.env.NONEXISTENT_VAR;
+    const result = resolveProbeApiKey({ apiKey: "$NONEXISTENT_VAR", readProviders: () => ({}) });
+    expect(result.ok).toBe(false);
+    if (!result.ok) expect(result.error).toMatch(/NONEXISTENT_VAR/);
+  });
+
+  it("REDACTED (***): resolves via provider name from readProviders", () => {
+    const result = resolveProbeApiKey({
+      apiKey: "***",
+      name: "my-provider",
+      readProviders: () => ({
+        "my-provider": { baseUrl: "u", apiKey: "stored-key", api: "openai-completions" },
+      }),
+    });
+    expect(result).toEqual({ ok: true, key: "stored-key" });
+  });
+
+  it("REDACTED + stored key is $ENV_VAR: follows env-var resolution", () => {
+    process.env.STORED_ENV = "env-value";
+    const result = resolveProbeApiKey({
+      apiKey: "***",
+      name: "my-provider",
+      readProviders: () => ({
+        "my-provider": { baseUrl: "u", apiKey: "$STORED_ENV", api: "openai-completions" },
+      }),
+    });
+    expect(result).toEqual({ ok: true, key: "env-value" });
+  });
+
+  it("REDACTED without name: returns error", () => {
+    const result = resolveProbeApiKey({ apiKey: "***", readProviders: () => ({}) });
+    expect(result.ok).toBe(false);
+    if (!result.ok) expect(result.error).toMatch(/no.*provider/i);
+  });
+
+  it("REDACTED with unknown name: returns error", () => {
+    const result = resolveProbeApiKey({
+      apiKey: "***",
+      name: "missing",
+      readProviders: () => ({}),
+    });
+    expect(result.ok).toBe(false);
+    if (!result.ok) expect(result.error).toMatch(/missing/);
+  });
+
+  it("empty key: returns error", () => {
+    const result = resolveProbeApiKey({ apiKey: "", readProviders: () => ({}) });
+    expect(result.ok).toBe(false);
+  });
+});
+
+describe("probeProvider", () => {
+  const baseInput: ProbeInput = {
+    baseUrl: "https://api.example.com/v1",
+    apiKey: "sk-abc",
+    api: "openai-completions",
+  };
+
+  let originalFetch: typeof globalThis.fetch;
+  beforeEach(() => {
+    originalFetch = globalThis.fetch;
+  });
+  afterEach(() => {
+    globalThis.fetch = originalFetch;
+  });
+
+  function mockFetch(impl: (url: string, init: RequestInit) => Promise<Response>) {
+    globalThis.fetch = vi.fn(impl) as any;
+  }
+
+  it("2xx with data array returns ok + modelCount + sample (capped at 5)", async () => {
+    const ids = ["m1", "m2", "m3", "m4", "m5", "m6", "m7"];
+    mockFetch(async () =>
+      new Response(JSON.stringify({ data: ids.map((id) => ({ id })) }), { status: 200 }),
+    );
+    const result = await probeProvider(baseInput);
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.status).toBe(200);
+      expect(result.modelCount).toBe(7);
+      expect(result.sample).toEqual(["m1", "m2", "m3", "m4", "m5"]);
+    }
+  });
+
+  it("2xx with unexpected body shape: ok with modelCount=0", async () => {
+    mockFetch(async () => new Response(JSON.stringify({ weird: true }), { status: 200 }));
+    const result = await probeProvider(baseInput);
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.modelCount).toBe(0);
+      expect(result.sample).toEqual([]);
+    }
+  });
+
+  it("401 returns ok=false with status + error", async () => {
+    mockFetch(async () =>
+      new Response("Invalid API key", { status: 401, statusText: "Unauthorized" }),
+    );
+    const result = await probeProvider(baseInput);
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.status).toBe(401);
+      expect(result.error).toMatch(/Invalid API key|Unauthorized|401/);
+    }
+  });
+
+  it("500 returns ok=false with status", async () => {
+    mockFetch(async () => new Response("boom", { status: 500 }));
+    const result = await probeProvider(baseInput);
+    expect(result.ok).toBe(false);
+    if (!result.ok) expect(result.status).toBe(500);
+  });
+
+  it("body excerpt is truncated to 500 chars", async () => {
+    const long = "x".repeat(2000);
+    mockFetch(async () => new Response(long, { status: 400 }));
+    const result = await probeProvider(baseInput);
+    expect(result.ok).toBe(false);
+    if (!result.ok && result.error) expect(result.error.length).toBeLessThanOrEqual(500);
+  });
+
+  it("network error: ok=false with error, no status", async () => {
+    mockFetch(async () => {
+      throw new Error("ECONNREFUSED");
+    });
+    const result = await probeProvider(baseInput);
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.error).toMatch(/ECONNREFUSED/);
+      expect(result.status).toBeUndefined();
+    }
+  });
+
+  it("timeout aborts the request and returns error", async () => {
+    mockFetch(
+      (_url, init) =>
+        new Promise((_resolve, reject) => {
+          const signal = init.signal as AbortSignal;
+          signal.addEventListener("abort", () => reject(new Error("aborted")));
+        }),
+    );
+    const result = await probeProvider({ ...baseInput, timeoutMs: 20 });
+    expect(result.ok).toBe(false);
+    if (!result.ok) expect(result.error).toBeDefined();
+  });
+
+  it("response never echoes the apiKey", async () => {
+    mockFetch(async () =>
+      new Response(`echoed sk-abc in body`, { status: 401 }),
+    );
+    const result = await probeProvider({ ...baseInput, apiKey: "sk-abc" });
+    // even though upstream echoes the key, our result error should not leak it
+    if (!result.ok && result.error) {
+      expect(result.error).not.toContain("sk-abc");
+    }
+  });
+
+  it("anthropic-messages uses x-api-key header (not Authorization)", async () => {
+    let capturedInit: RequestInit | undefined;
+    mockFetch(async (_url, init) => {
+      capturedInit = init;
+      return new Response(JSON.stringify({ data: [] }), { status: 200 });
+    });
+    await probeProvider({
+      baseUrl: "https://api.anthropic.com",
+      apiKey: "sk-ant-x",
+      api: "anthropic-messages",
+    });
+    const headers = capturedInit!.headers as Record<string, string>;
+    expect(headers["x-api-key"]).toBe("sk-ant-x");
+    expect(headers["anthropic-version"]).toBe("2023-06-01");
+    expect(headers.Authorization).toBeUndefined();
+  });
+
+  it("google-generative-ai uses ?key= query param (no Authorization)", async () => {
+    let capturedUrl: string | undefined;
+    let capturedInit: RequestInit | undefined;
+    mockFetch(async (url, init) => {
+      capturedUrl = url;
+      capturedInit = init;
+      return new Response(JSON.stringify({ data: [] }), { status: 200 });
+    });
+    await probeProvider({
+      baseUrl: "https://generativelanguage.googleapis.com/v1beta",
+      apiKey: "AIzaTest",
+      api: "google-generative-ai",
+    });
+    expect(capturedUrl).toContain("?key=AIzaTest");
+    const headers = (capturedInit!.headers ?? {}) as Record<string, string>;
+    expect(headers.Authorization).toBeUndefined();
+  });
+});