@cohortapp/agent-sdk 2.16.0 → 2.18.4

package/lib/model-router/llm-task.test.mjs

@@ -1,392 +0,0 @@
-/**
- * lib/model-router/llm-task.test.mjs — the governed cheap one-shot path.
- *
- * Drives llmTask with an injected fetchImpl (no network) over a hermetic catalog,
- * asserting the component-brief contract:
- *   - routes to the CHEAPEST direct-harness model meeting minGrade;
- *   - writes ONE ledger row (real writeLedgerRow into a tmp dir);
- *   - tool-less by construction (no tools[] in the request body);
- *   - non-Anthropic payloads pass through the injected PII mask (§7.4);
- *   - HTTP/transport faults classify onto the taxonomy and fail-open (no throw);
- *   - the kill switch forces an Anthropic direct row;
- *   - missing credential / open breaker / grade floor are honored.
- *
- * House style: node:test, node:assert/strict, hermetic.
- */
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, rmSync, existsSync, readFileSync, mkdirSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-
-import { llmTask, pickDirectModel, _internals } from "./llm-task.mjs";
-import { loadCatalog } from "./catalog.mjs";
-import { sumLedgerToday } from "./ledger.mjs";
-
-// ---------------------------------------------------------------------------
-// A hermetic catalog: a cheap grade-B direct row, a cheaper grade-C row, and an
-// anthropic direct row. We inject raw YAML via catalogText so no FS is touched.
-// ---------------------------------------------------------------------------
-
-const CHEAP_YAML = `
-provider: cheapco
-auth_env: CHEAPCO_API_KEY
-endpoints:
-  openai: https://api.cheapco.test
-models:
-  - id: cheap-b
-    status: available
-    context_tokens: 200000
-    cost: { input: 0.20, output: 0.40 }
-    cost_provenance: { source: official, fetched: "2026-06-10", volatile: false }
-    compat: { cache_control: none, max_tokens_field: max_tokens }
-    tool_reliability: B
-    harness: { session: false, direct: true, batch: false }
-  - id: cheap-c
-    status: available
-    context_tokens: 100000
-    cost: { input: 0.05, output: 0.10 }
-    cost_provenance: { source: official, fetched: "2026-06-10", volatile: false }
-    compat: { cache_control: none, max_tokens_field: max_tokens }
-    tool_reliability: C
-    harness: { session: false, direct: true, batch: false }
-`;
-
-const ANTH_YAML = `
-provider: anthropic
-auth_env: ANTHROPIC_API_KEY
-endpoints:
-  anthropic: https://api.anthropic.com
-models:
-  - id: claude-haiku-4-5
-    status: available
-    context_tokens: 200000
-    cost: { input: 1.0, output: 5.0, cache_read: 0.1, cache_write: 1.25 }
-    cost_provenance: { source: official, fetched: "2026-06-10", volatile: false }
-    compat: { cache_control: anthropic }
-    tool_reliability: A
-    harness: { session: true, direct: true, batch: true }
-`;
-
-function hermeticCatalog() {
-  const res = loadCatalog("/tmp/nope", {
-    catalogText: { cheapco: CHEAP_YAML, anthropic: ANTH_YAML },
-  });
-  assert.ok(res.byRef.size >= 3, "catalog parsed three rows");
-  return res;
-}
-
-/** A config that permits cheapco for public data (otherwise deny-default). */
-function publicConfig() {
-  return {
-    schema_version: 2,
-    backends: {
-      anthropic: { allowed_data_classes: ["public", "internal", "sensitive"] },
-      cheapco: { allowed_data_classes: ["public"] },
-    },
-    defaults: { data_class: "public" },
-  };
-}
-
-/** A fake OpenAI-compatible response. */
-function openaiResponse(text, usage = {}) {
-  return {
-    ok: true,
-    status: 200,
-    async json() {
-      return {
-        choices: [{ message: { role: "assistant", content: text } }],
-        usage: { prompt_tokens: usage.in ?? 100, completion_tokens: usage.out ?? 20 },
-      };
-    },
-  };
-}
-
-/** A fake anthropic-messages response. */
-function anthropicResponse(text, usage = {}) {
-  return {
-    ok: true,
-    status: 200,
-    async json() {
-      return {
-        content: [{ type: "text", text }],
-        usage: { input_tokens: usage.in ?? 100, output_tokens: usage.out ?? 20 },
-      };
-    },
-  };
-}
-
-const baseDeps = (over = {}) => ({
-  catalog: hermeticCatalog(),
-  config: publicConfig(),
-  env: { CHEAPCO_API_KEY: "cheap-key", ANTHROPIC_API_KEY: "anth-key" },
-  now: () => 1_700_000_000_000,
-  isOpen: () => ({ open: false, until: 0, reason: null, strikes: 0 }),
-  ...over,
-});
-
-// ---------------------------------------------------------------------------
-// pickDirectModel
-// ---------------------------------------------------------------------------
-
-test("pickDirectModel returns the cheapest qualifying direct row for minGrade C", () => {
-  const catalog = hermeticCatalog();
-  const r = pickDirectModel(catalog, { data_class: "public" }, { ...baseDeps({ catalog }), minGrade: "C" });
-  assert.equal(r.row.ref, "cheapco/cheap-c", "cheapest (C) wins at minGrade C");
-});
-
-test("pickDirectModel skips below-grade rows for minGrade B", () => {
-  const catalog = hermeticCatalog();
-  const r = pickDirectModel(catalog, { data_class: "public" }, { ...baseDeps({ catalog }), minGrade: "B" });
-  assert.equal(r.row.ref, "cheapco/cheap-b", "cheap-c is grade C, excluded; cheap-b wins");
-});
-
-test("pickDirectModel denies cheapco for non-public data_class (deny-default)", () => {
-  const catalog = hermeticCatalog();
-  const r = pickDirectModel(
-    catalog,
-    { data_class: "sensitive" },
-    { ...baseDeps({ catalog }), minGrade: "C" }
-  );
-  // cheapco rows denied → anthropic haiku is the only allowed direct row.
-  assert.equal(r.row.ref, "anthropic/claude-haiku-4-5");
-});
-
-test("pickDirectModel skips a row whose credential is absent", () => {
-  const catalog = hermeticCatalog();
-  const r = pickDirectModel(
-    catalog,
-    { data_class: "public" },
-    { ...baseDeps({ catalog, env: { ANTHROPIC_API_KEY: "anth-key" } }), minGrade: "C" }
-  );
-  // No CHEAPCO_API_KEY → cheapco skipped → anthropic haiku.
-  assert.equal(r.row.ref, "anthropic/claude-haiku-4-5");
-});
-
-test("pickDirectModel skips a row with an open breaker", () => {
-  const catalog = hermeticCatalog();
-  const r = pickDirectModel(catalog, { data_class: "public" }, {
-    ...baseDeps({ catalog }),
-    minGrade: "C",
-    isOpen: (key) => ({ open: key.startsWith("cheapco"), until: 9e15, reason: "rate_limit", strikes: 1 }),
-  });
-  assert.equal(r.row.ref, "anthropic/claude-haiku-4-5", "cheapco breaker open → anthropic");
-});
-
-// ---------------------------------------------------------------------------
-// llmTask happy path
-// ---------------------------------------------------------------------------
-
-test("routes to the cheapest direct model, returns text + usage + estCostUSD, writes a ledger row", async () => {
-  const rows = [];
-  const out = await llmTask("classify this", {
-    ...baseDeps(),
-    minGrade: "C",
-    request: { task_class: "classify.inbox", data_class: "public", agent: "alex" },
-    fetchImpl: async (url, init) => {
-      // tool-less invariant: no tools[] ever sent.
-      const body = JSON.parse(init.body);
-      assert.equal(body.tools, undefined, "no tools[] in the request");
-      assert.match(url, /cheapco/, "cheapest cheapco model selected");
-      return openaiResponse("spam", { in: 80, out: 4 });
-    },
-    writeLedger: (catalog, entry) => rows.push(entry),
-  });
-
-  assert.equal(out.ok, true);
-  assert.equal(out.ref, "cheapco/cheap-c");
-  assert.equal(out.text, "spam");
-  assert.equal(out.usage.inputTokens, 80);
-  assert.equal(out.usage.outputTokens, 4);
-  assert.ok(out.estCostUSD != null);
-  // Exactly one ledger row, joined to the task + harness + exit reason.
-  assert.equal(rows.length, 1);
-  assert.equal(rows[0].ref, "cheapco/cheap-c");
-  assert.equal(rows[0].harness, "direct");
-  assert.equal(rows[0].task_class, "classify.inbox");
-  assert.equal(rows[0].exitReason, "ok");
-  assert.equal(rows[0].agent, "alex");
-});
-
-test("writes a REAL ledger row to state/cost-tracking via writeLedgerRow", async () => {
-  const root = mkdtempSync(join(tmpdir(), "maestro-llmtask-"));
-  mkdirSync(join(root, "state", "cost-tracking"), { recursive: true });
-  try {
-    const out = await llmTask("hi", {
-      ...baseDeps(),
-      minGrade: "C",
-      request: { task_class: "lookup.gmail", data_class: "public" },
-      ledgerDeps: { agentRoot: root, now: () => 1_700_000_000_000 },
-      fetchImpl: async () => openaiResponse("ok", { in: 50, out: 10 }),
-    });
-    assert.equal(out.ok, true);
-    const sum = sumLedgerToday({ agentRoot: root, now: () => 1_700_000_000_000 });
-    assert.equal(sum.sessions, 1, "one ledger row written to disk");
-    assert.ok(sum.spentUSD >= 0);
-  } finally {
-    rmSync(root, { recursive: true, force: true });
-  }
-});
-
-test("non-Anthropic payload passes through the injected PII mask (§7.4)", async () => {
-  let masked = false;
-  let sentBody = null;
-  const out = await llmTask("email me at a@b.com", {
-    ...baseDeps(),
-    minGrade: "C",
-    request: { data_class: "public" },
-    maskInput: (s) => {
-      masked = true;
-      return s.replace(/[\w.]+@[\w.]+/g, "***");
-    },
-    fetchImpl: async (url, init) => {
-      sentBody = JSON.parse(init.body);
-      return openaiResponse("done");
-    },
-    writeLedger: () => {},
-  });
-  assert.equal(out.ok, true);
-  assert.equal(masked, true, "mask invoked for the cheapco (non-anthropic) route");
-  assert.match(sentBody.messages.at(-1).content, /\*\*\*/, "PII masked in the sent prompt");
-  assert.ok(!/a@b\.com/.test(sentBody.messages.at(-1).content));
-});
-
-test("kill switch forces an Anthropic direct row (mask NOT applied)", async () => {
-  let masked = false;
-  let url = null;
-  const out = await llmTask("anything", {
-    ...baseDeps({ env: { CHEAPCO_API_KEY: "k", ANTHROPIC_API_KEY: "a", MAESTRO_ROUTER_FORCE_ANTHROPIC: "1" } }),
-    minGrade: "C",
-    request: { data_class: "public" },
-    maskInput: () => {
-      masked = true;
-      return "x";
-    },
-    fetchImpl: async (u) => {
-      url = u;
-      return anthropicResponse("hello");
-    },
-    writeLedger: () => {},
-  });
-  assert.equal(out.ok, true);
-  assert.equal(out.provider, "anthropic");
-  assert.match(url, /anthropic/);
-  assert.equal(masked, false, "anthropic route is not PII-masked");
-});
-
-// ---------------------------------------------------------------------------
-// fault classification (fail-open, never throws)
-// ---------------------------------------------------------------------------
-
-test("HTTP 429 → rate_limit reason, fail-open (no throw), ledger row written", async () => {
-  const rows = [];
-  const out = await llmTask("x", {
-    ...baseDeps(),
-    minGrade: "C",
-    request: { data_class: "public" },
-    fetchImpl: async () => ({
-      ok: false,
-      status: 429,
-      async json() {
-        return { error: { message: "rate limit exceeded" } };
-      },
-    }),
-    writeLedger: (c, e) => rows.push(e),
-  });
-  assert.equal(out.ok, false);
-  assert.equal(out.reason, "rate_limit");
-  assert.equal(rows.length, 1);
-  assert.equal(rows[0].exitReason, "rate_limit");
-});
-
-test("transport throw → classified network, fail-open", async () => {
-  const out = await llmTask("x", {
-    ...baseDeps(),
-    minGrade: "C",
-    request: { data_class: "public" },
-    fetchImpl: async () => {
-      const e = new Error("getaddrinfo ENOTFOUND api.cheapco.test");
-      e.code = "ENOTFOUND";
-      throw e;
-    },
-    writeLedger: () => {},
-  });
-  assert.equal(out.ok, false);
-  assert.equal(out.reason, "network");
-});
-
-test("2xx with empty content → empty_response soft-fail", async () => {
-  const out = await llmTask("x", {
-    ...baseDeps(),
-    minGrade: "C",
-    request: { data_class: "public" },
-    fetchImpl: async () => openaiResponse("   "),
-    writeLedger: () => {},
-  });
-  assert.equal(out.ok, false);
-  assert.equal(out.reason, "empty_response");
-});
-
-test("no fetchImpl → no_fetch_impl, does not throw", async () => {
-  const out = await llmTask("x", { ...baseDeps(), request: { data_class: "public" } });
-  assert.equal(out.ok, false);
-  assert.equal(out.reason, "no_fetch_impl");
-});
-
-test("no qualifying candidate (no creds anywhere) → no_direct_candidate", async () => {
-  const out = await llmTask("x", {
-    ...baseDeps({ env: {} }),
-    minGrade: "C",
-    request: { data_class: "public" },
-    fetchImpl: async () => openaiResponse("y"),
-  });
-  assert.equal(out.ok, false);
-  assert.ok(["missing_credential", "no_direct_candidate"].includes(out.reason));
-});
-
-test("opts.repair promotes a leaked tool call in the response text", async () => {
-  const out = await llmTask("call the tool", {
-    ...baseDeps(),
-    minGrade: "C",
-    request: { data_class: "public" },
-    repair: true,
-    repairOpts: { idFor: (n) => `id_${n}` },
-    fetchImpl: async () => openaiResponse('```json\n{"name":"do","input":{"k":1}}\n```'),
-    writeLedger: () => {},
-  });
-  assert.equal(out.ok, true);
-  assert.equal(out.repaired, true);
-  assert.equal(out.toolCalls[0].name, "do");
-  assert.deepEqual(out.toolCalls[0].input, { k: 1 });
-});
-
-test("anthropic wire sends x-api-key + anthropic-version, parses content[]", async () => {
-  let headers = null;
-  const out = await llmTask("x", {
-    ...baseDeps(),
-    minGrade: "A", // forces the anthropic grade-A row
-    request: { data_class: "public" },
-    fetchImpl: async (url, init) => {
-      headers = init.headers;
-      assert.match(url, /\/v1\/messages$/);
-      return anthropicResponse("hi", { in: 10, out: 2 });
-    },
-    writeLedger: () => {},
-  });
-  assert.equal(out.ok, true);
-  assert.equal(out.provider, "anthropic");
-  assert.equal(headers["x-api-key"], "anth-key");
-  assert.equal(headers["anthropic-version"], "2023-06-01");
-  assert.equal(out.text, "hi");
-});
-
-test("_internals.wireFor + endpointFor pick the right wire per provider", () => {
-  const catalog = hermeticCatalog();
-  const cheap = catalog.byRef.get("cheapco/cheap-c");
-  const anth = catalog.byRef.get("anthropic/claude-haiku-4-5");
-  assert.equal(_internals.wireFor(cheap), "openai-completions");
-  assert.equal(_internals.wireFor(anth), "anthropic-messages");
-  assert.match(_internals.endpointFor(cheap, "openai-completions"), /cheapco.*chat\/completions/);
-  assert.match(_internals.endpointFor(anth, "anthropic-messages"), /\/v1\/messages$/);
-});

package/lib/model-router/org-credentials.test.mjs

@@ -1,265 +0,0 @@
-/**
- * org-credentials.test.mjs — the router CONSUMES org credentials (single-SoT
- * payoff). Verifies resolveOrgCredentialEnv: leases a provider absent from local
- * env; local-set provider is NOT leased (local wins); cache avoids a second
- * lease within TTL; re-lease after TTL expiry; Cohort-down / disabled fails open
- * to local env; unconfigured-provider error is recorded, not thrown.
- *
- * Injected fetchImpl — no network. Run: node --test lib/model-router/org-credentials.test.mjs
- */
-"use strict";
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-
-import { resolveOrgCredentialEnv, clearOrgCredentialCache } from "./org-credentials.mjs";
-
-// Ambient COHORT_* tokens would leak into the client config; clear them so the
-// tests are deterministic regardless of the host env.
-delete process.env.COHORT_API_TOKEN;
-delete process.env.COHORT_TOKEN;
-
-const BASE = "https://org.cohortapp.com";
-
-/** Enabled org config pointing the client at BASE with a bearer token. */
-function orgCfg() {
-  return { org: { cohort: { enabled: true, base: BASE, token: "tok-abc" } } };
-}
-
-/** A catalog with a providers Map: anthropic (never brokered) + deepseek + moonshot. */
-function catalogWith(providers) {
-  const map = new Map();
-  for (const [provider, auth_env] of providers) map.set(provider, { auth_env });
-  return { providers: map, models: [] };
-}
-
-/**
- * A fake fetch that records calls and returns a lease frame per provider. The
- * `byProvider` map maps provider name → { value, ttlMs?, expiresAt? } | "error".
- */
-function fakeLeaseFetch(byProvider) {
-  const calls = [];
-  const impl = async (url, init) => {
-    const body = init && init.body ? JSON.parse(init.body) : {};
-    const provider = body.provider;
-    calls.push({ url, provider, headers: (init && init.headers) || {} });
-    const spec = byProvider[provider];
-    if (!spec || spec === "error") {
-      return {
-        ok: false,
-        status: 404,
-        headers: { get: () => undefined },
-        json: async () => ({ ok: false, error: { code: "NOT_FOUND", message: "no such credential" } }),
-      };
-    }
-    const result = { provider, value: spec.value };
-    if (spec.ttlMs != null) result.ttlMs = spec.ttlMs;
-    if (spec.expiresAt != null) result.expiresAt = spec.expiresAt;
-    return {
-      ok: true,
-      status: 200,
-      headers: { get: () => undefined },
-      json: async () => ({ ok: true, result }),
-    };
-  };
-  impl.calls = calls;
-  return impl;
-}
-
-// ---------------------------------------------------------------------------
-
-test("leases a provider absent from local env and returns the overlay", async () => {
-  const f = fakeLeaseFetch({ deepseek: { value: "sk-deepseek-leased", ttlMs: 600000 } });
-  const out = await resolveOrgCredentialEnv({
-    catalog: catalogWith([["anthropic", "ANTHROPIC_API_KEY"], ["deepseek", "DEEPSEEK_API_KEY"]]),
-    cfg: orgCfg(),
-    env: {}, // no local keys at all
-    fetchImpl: f,
-    cache: new Map(),
-    now: () => 1000,
-  });
-  assert.equal(out.envOverlay.DEEPSEEK_API_KEY, "sk-deepseek-leased");
-  assert.deepEqual(out.leased, ["deepseek"]);
-  assert.deepEqual(out.errors, []);
-  // anthropic is never brokered; only deepseek was leased.
-  assert.equal(f.calls.length, 1);
-  assert.equal(f.calls[0].provider, "deepseek");
-  // The lease POSTs to the credential.lease method over /v1 with Bearer + protocol.
-  assert.match(f.calls[0].url, /\/v1\/credential\.lease$/);
-  assert.equal(f.calls[0].headers.authorization, "Bearer tok-abc");
-  assert.equal(f.calls[0].headers["x-org-protocol"], "1");
-});
-
-test("a provider already in local env is NOT leased (local wins)", async () => {
-  const f = fakeLeaseFetch({ deepseek: { value: "sk-org" }, moonshot: { value: "sk-moon-org" } });
-  const out = await resolveOrgCredentialEnv({
-    catalog: catalogWith([["deepseek", "DEEPSEEK_API_KEY"], ["moonshot", "MOONSHOT_API_KEY"]]),
-    cfg: orgCfg(),
-    env: { DEEPSEEK_API_KEY: "sk-local-mine" }, // local deepseek key present
-    fetchImpl: f,
-    cache: new Map(),
-    now: () => 1000,
-  });
-  // deepseek is local-served (never leased, never in the overlay); moonshot is leased.
-  assert.equal(out.envOverlay.DEEPSEEK_API_KEY, undefined);
-  assert.equal(out.envOverlay.MOONSHOT_API_KEY, "sk-moon-org");
-  assert.deepEqual(out.leased, ["moonshot"]);
-  assert.deepEqual(f.calls.map((c) => c.provider), ["moonshot"]);
-});
-
-test("an empty-string local key does NOT count as set — provider is leased", async () => {
-  const f = fakeLeaseFetch({ deepseek: { value: "sk-org" } });
-  const out = await resolveOrgCredentialEnv({
-    catalog: catalogWith([["deepseek", "DEEPSEEK_API_KEY"]]),
-    cfg: orgCfg(),
-    env: { DEEPSEEK_API_KEY: "   " }, // whitespace == unset
-    fetchImpl: f,
-    cache: new Map(),
-    now: () => 1000,
-  });
-  assert.equal(out.envOverlay.DEEPSEEK_API_KEY, "sk-org");
-  assert.deepEqual(out.leased, ["deepseek"]);
-});
-
-test("cache avoids a second lease within TTL", async () => {
-  const f = fakeLeaseFetch({ deepseek: { value: "sk-cached", ttlMs: 600000 } });
-  const cache = new Map();
-  const catalog = catalogWith([["deepseek", "DEEPSEEK_API_KEY"]]);
-
-  const first = await resolveOrgCredentialEnv({ catalog, cfg: orgCfg(), env: {}, fetchImpl: f, cache, now: () => 1000 });
-  assert.equal(first.envOverlay.DEEPSEEK_API_KEY, "sk-cached");
-  assert.equal(f.calls.length, 1);
-
-  // Second resolve 5 minutes later — well within the 10-minute TTL → cache hit, no new lease.
-  const second = await resolveOrgCredentialEnv({ catalog, cfg: orgCfg(), env: {}, fetchImpl: f, cache, now: () => 1000 + 5 * 60 * 1000 });
-  assert.equal(second.envOverlay.DEEPSEEK_API_KEY, "sk-cached");
-  assert.deepEqual(second.leased, ["deepseek"]);
-  assert.equal(f.calls.length, 1, "no second lease within TTL");
-});
-
-test("re-leases after the cached lease TTL expires", async () => {
-  let nth = 0;
-  const f = fakeLeaseFetch({ deepseek: { value: "v", ttlMs: 600000 } });
-  // wrap to give distinct values per call so we can prove a fresh lease landed
-  const wrapped = async (url, init) => {
-    nth += 1;
-    const res = await f(url, init);
-    const body = await res.json();
-    body.result.value = `sk-rotated-${nth}`;
-    return { ...res, json: async () => body };
-  };
-  const cache = new Map();
-  const catalog = catalogWith([["deepseek", "DEEPSEEK_API_KEY"]]);
-
-  const first = await resolveOrgCredentialEnv({ catalog, cfg: orgCfg(), env: {}, fetchImpl: wrapped, cache, now: () => 1000 });
-  assert.equal(first.envOverlay.DEEPSEEK_API_KEY, "sk-rotated-1");
-
-  // Past expiry (now far beyond TTL) → cache invalidated, fresh lease taken.
-  const second = await resolveOrgCredentialEnv({ catalog, cfg: orgCfg(), env: {}, fetchImpl: wrapped, cache, now: () => 1000 + 999 * 60 * 1000 });
-  assert.equal(second.envOverlay.DEEPSEEK_API_KEY, "sk-rotated-2");
-  assert.equal(nth, 2, "expired cache forces a re-lease");
-});
-
-test("uses expiresAt when the server supplies it instead of ttlMs", async () => {
-  const expiresAt = new Date(1000 + 60000).toISOString();
-  const f = fakeLeaseFetch({ deepseek: { value: "sk-exp", expiresAt } });
-  const cache = new Map();
-  const catalog = catalogWith([["deepseek", "DEEPSEEK_API_KEY"]]);
-
-  // Just before expiry → cache hit, no second lease.
-  await resolveOrgCredentialEnv({ catalog, cfg: orgCfg(), env: {}, fetchImpl: f, cache, now: () => 1000 });
-  await resolveOrgCredentialEnv({ catalog, cfg: orgCfg(), env: {}, fetchImpl: f, cache, now: () => 1000 + 30000 });
-  assert.equal(f.calls.length, 1, "within expiresAt window → cached");
-
-  // After expiry → re-lease.
-  await resolveOrgCredentialEnv({ catalog, cfg: orgCfg(), env: {}, fetchImpl: f, cache, now: () => 1000 + 120000 });
-  assert.equal(f.calls.length, 2, "past expiresAt → re-leased");
-});
-
-test("Cohort down (transport throw) fails open to local env", async () => {
-  const thrower = async () => { throw new Error("ECONNREFUSED"); };
-  const out = await resolveOrgCredentialEnv({
-    catalog: catalogWith([["deepseek", "DEEPSEEK_API_KEY"]]),
-    cfg: orgCfg(),
-    env: { MOONSHOT_API_KEY: "sk-local-moon" }, // a local key the router will still see
-    fetchImpl: thrower,
-    cache: new Map(),
-    now: () => 1000,
-  });
-  // No overlay added (deepseek couldn't be leased); the error is recorded, not thrown.
-  assert.deepEqual(out.envOverlay, {});
-  assert.deepEqual(out.leased, []);
-  assert.equal(out.errors.length, 1);
-  assert.equal(out.errors[0].provider, "deepseek");
-});
-
-test("org plane disabled → empty overlay, no lease attempts (fail-open)", async () => {
-  const f = fakeLeaseFetch({ deepseek: { value: "x" } });
-  const out = await resolveOrgCredentialEnv({
-    catalog: catalogWith([["deepseek", "DEEPSEEK_API_KEY"]]),
-    cfg: { org: { cohort: { enabled: false, base: BASE } } },
-    env: {},
-    fetchImpl: f,
-    cache: new Map(),
-  });
-  assert.deepEqual(out.envOverlay, {});
-  assert.deepEqual(out.leased, []);
-  assert.deepEqual(out.errors, []);
-  assert.equal(f.calls.length, 0, "no lease attempted when org plane is off");
-});
-
-test("a provider the org hasn't configured records an error and is omitted (router sees missing_credential)", async () => {
-  // deepseek configured; moonshot not (lease → NOT_FOUND).
-  const f = fakeLeaseFetch({ deepseek: { value: "sk-ds" } });
-  const out = await resolveOrgCredentialEnv({
-    catalog: catalogWith([["deepseek", "DEEPSEEK_API_KEY"], ["moonshot", "MOONSHOT_API_KEY"]]),
-    cfg: orgCfg(),
-    env: {},
-    fetchImpl: f,
-    cache: new Map(),
-    now: () => 1000,
-  });
-  assert.equal(out.envOverlay.DEEPSEEK_API_KEY, "sk-ds");
-  assert.equal(out.envOverlay.MOONSHOT_API_KEY, undefined, "unconfigured provider omitted → router's missing_credential");
-  assert.deepEqual(out.leased, ["deepseek"]);
-  assert.equal(out.errors.length, 1);
-  assert.equal(out.errors[0].provider, "moonshot");
-  assert.equal(out.errors[0].reason, "NOT_FOUND");
-});
-
-test("reads providers from catalog model rows when no providers Map is present", async () => {
-  const f = fakeLeaseFetch({ deepseek: { value: "sk-rows" } });
-  const catalog = {
-    models: [
-      { provider: "anthropic", auth_env: "ANTHROPIC_API_KEY", id: "claude" },
-      { provider: "deepseek", auth_env: "DEEPSEEK_API_KEY", id: "deepseek-chat" },
-      { provider: "deepseek", auth_env: "DEEPSEEK_API_KEY", id: "deepseek-reasoner" }, // dup → one lease
-    ],
-  };
-  const out = await resolveOrgCredentialEnv({ catalog, cfg: orgCfg(), env: {}, fetchImpl: f, cache: new Map(), now: () => 1000 });
-  assert.equal(out.envOverlay.DEEPSEEK_API_KEY, "sk-rows");
-  assert.deepEqual(out.leased, ["deepseek"]);
-  assert.equal(f.calls.length, 1, "duplicate rows collapse to one lease");
-});
-
-test("accepts a loadCatalog-style result (catalog nested under .catalog)", async () => {
-  const f = fakeLeaseFetch({ deepseek: { value: "sk-nested" } });
-  const inner = catalogWith([["deepseek", "DEEPSEEK_API_KEY"]]);
-  const result = { catalog: inner, models: [], byRef: new Map() };
-  const out = await resolveOrgCredentialEnv({ catalog: result, cfg: orgCfg(), env: {}, fetchImpl: f, cache: new Map(), now: () => 1000 });
-  assert.equal(out.envOverlay.DEEPSEEK_API_KEY, "sk-nested");
-});
-
-test("clearOrgCredentialCache forces a re-lease against the module singleton", async () => {
-  const f = fakeLeaseFetch({ deepseek: { value: "sk-singleton", ttlMs: 600000 } });
-  const catalog = catalogWith([["deepseek", "DEEPSEEK_API_KEY"]]);
-  clearOrgCredentialCache();
-  // No injected cache → uses the module singleton.
-  await resolveOrgCredentialEnv({ catalog, cfg: orgCfg(), env: {}, fetchImpl: f, now: () => 1000 });
-  await resolveOrgCredentialEnv({ catalog, cfg: orgCfg(), env: {}, fetchImpl: f, now: () => 1000 });
-  assert.equal(f.calls.length, 1, "singleton cache hit on the second resolve");
-  clearOrgCredentialCache();
-  await resolveOrgCredentialEnv({ catalog, cfg: orgCfg(), env: {}, fetchImpl: f, now: () => 1000 });
-  assert.equal(f.calls.length, 2, "cache cleared → re-leased");
-  clearOrgCredentialCache();
-});