@cohortapp/agent-sdk 2.17.0 → 2.18.4

package/lib/secrets/broker.test.mjs

@@ -1,280 +0,0 @@
-/**
- * lib/secrets/broker.test.mjs — resolution chain, sync, rotate, names-only audit.
- *
- * Covers:
- *   • resolveSecret chain precedence: explicit > broker > file > env
- *   • resolveSecret fails open through a throwing provider
- *   • syncSecrets pulls a set from an INJECTED broker fetch into the local store
- *   • syncSecrets reports missing + write failures
- *   • rotateSecret writes to the authoritative provider (broker > local)
- *   • rotateSecret audits names-only (never the value), with identity + fingerprint
- *   • getAgentIdentity / getAgentToken resolution
- */
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { promises as fsp, readFileSync, existsSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-
-import {
-  resolveSecret,
-  syncSecrets,
-  rotateSecret,
-  getAgentIdentity,
-  getAgentToken,
-  makeBroker,
-  brokerIsAuthoritative,
-  auditLogPath,
-} from "./broker.mjs";
-import { FileProvider, nameFingerprint } from "./providers.mjs";
-
-async function tmpRoot(prefix = "secrets-broker") {
-  const path = join(tmpdir(), `${prefix}-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`);
-  await fsp.mkdir(path, { recursive: true });
-  return path;
-}
-async function rmRoot(p) { try { await fsp.rm(p, { recursive: true, force: true }); } catch { /* */ } }
-
-/** A fetch stub backed by an in-memory secrets object (offline). */
-function brokerFetchStub(secrets) {
-  return async (url, opts = {}) => {
-    const u = new URL(url);
-    const m = u.pathname.match(/\/secrets\/(.+)$/);
-    if (opts.method === "GET" && u.pathname === "/secrets") {
-      return { ok: true, status: 200, json: async () => ({ secrets: Object.keys(secrets).map((name) => ({ name })) }) };
-    }
-    if (opts.method === "GET" && m) {
-      const name = decodeURIComponent(m[1]);
-      if (!(name in secrets)) return { ok: false, status: 404, json: async () => ({}) };
-      return { ok: true, status: 200, json: async () => ({ value: secrets[name] }) };
-    }
-    if (opts.method === "PUT" && m) {
-      secrets[decodeURIComponent(m[1])] = JSON.parse(opts.body).value;
-      return { ok: true, status: 200, json: async () => ({}) };
-    }
-    return { ok: false, status: 400, json: async () => ({}) };
-  };
-}
-
-const BROKER_CFG = { provider: "file", broker: { base_url: "https://broker.example", token_env: "MAESTRO_AGENT_TOKEN" } };
-
-// ---------------------------------------------------------------------------
-// identity + token
-// ---------------------------------------------------------------------------
-
-test("getAgentIdentity / getAgentToken resolve from ctx then env then cfg", () => {
-  assert.equal(getAgentIdentity({}, { identity: "explicit" }), "explicit");
-  assert.equal(getAgentIdentity({}, { env: { MAESTRO_AGENT_ID: "robin" } }), "robin");
-  assert.equal(getAgentIdentity({ broker: { identity: "cfg-id" } }, { env: {} }), "cfg-id");
-  assert.equal(getAgentIdentity({}, { env: {} }), "agent");
-
-  assert.equal(getAgentToken({}, { token: "tok" }), "tok");
-  assert.equal(getAgentToken(BROKER_CFG, { env: { MAESTRO_AGENT_TOKEN: "from-env" } }), "from-env");
-  assert.equal(getAgentToken({}, { env: {} }), "");
-});
-
-test("makeBroker / brokerIsAuthoritative require config + an injected fetch", () => {
-  assert.equal(makeBroker({}, {}), null, "no broker block → null");
-  assert.equal(makeBroker(BROKER_CFG, {}), null, "no fetch → null (stay offline)");
-  const b = makeBroker(BROKER_CFG, { fetch: async () => ({ ok: true, status: 200, json: async () => ({}) }), token: "t" });
-  assert.ok(b && b.name === "broker");
-  assert.equal(brokerIsAuthoritative(BROKER_CFG, { fetch: b._fetch }), true);
-  assert.equal(brokerIsAuthoritative({}, {}), false);
-});
-
-// ---------------------------------------------------------------------------
-// resolveSecret — chain precedence
-// ---------------------------------------------------------------------------
-
-test("resolveSecret precedence: explicit > broker > file > env", async () => {
-  const root = await tmpRoot();
-  try {
-    // Seed the file store with FILE_KEY; broker has BROKER_KEY + a shadowed key.
-    const file = new FileProvider({ agentRoot: root });
-    file.set("FILE_KEY", "from-file");
-    file.set("SHADOW", "file-shadow");
-    const secrets = { BROKER_KEY: "from-broker", SHADOW: "broker-shadow" };
-    const fetch = brokerFetchStub(secrets);
-    const env = { ENV_KEY: "from-env", SHADOW: "env-shadow" };
-
-    const base = { cfg: BROKER_CFG, agentRoot: root, env, fetch, token: "t" };
-
-    // explicit wins over everything
-    const explicit = { get: () => "from-explicit" };
-    assert.equal(await resolveSecret("SHADOW", { ...base, explicit }), "from-explicit");
-
-    // broker beats file beats env on the same name
-    assert.equal(await resolveSecret("SHADOW", base), "broker-shadow");
-
-    // broker-only key resolves from the broker
-    assert.equal(await resolveSecret("BROKER_KEY", base), "from-broker");
-    // file-only key resolves from the file store
-    assert.equal(await resolveSecret("FILE_KEY", base), "from-file");
-    // env-only key resolves from env (final fallback)
-    assert.equal(await resolveSecret("ENV_KEY", base), "from-env");
-    // nothing has it
-    assert.equal(await resolveSecret("ABSENT", base), null);
-  } finally { await rmRoot(root); }
-});
-
-test("resolveSecret fails open through a throwing provider in the chain", async () => {
-  const root = await tmpRoot();
-  try {
-    const file = new FileProvider({ agentRoot: root });
-    file.set("K", "from-file");
-    const explicit = { get: () => { throw new Error("boom"); } };
-    // Explicit throws → chain continues to the file store.
-    assert.equal(await resolveSecret("K", { cfg: { provider: "file" }, agentRoot: root, env: {}, explicit }), "from-file");
-  } finally { await rmRoot(root); }
-});
-
-test("resolveSecret with no broker config still reads file then env", async () => {
-  const root = await tmpRoot();
-  try {
-    const file = new FileProvider({ agentRoot: root });
-    file.set("ONLY_FILE", "f");
-    const args = { cfg: { provider: "file" }, agentRoot: root, env: { ONLY_ENV: "e" } };
-    assert.equal(await resolveSecret("ONLY_FILE", args), "f");
-    assert.equal(await resolveSecret("ONLY_ENV", args), "e");
-  } finally { await rmRoot(root); }
-});
-
-// ---------------------------------------------------------------------------
-// syncSecrets — pull from injected broker into local store
-// ---------------------------------------------------------------------------
-
-test("syncSecrets pulls a set from the broker into the local file store", async () => {
-  const root = await tmpRoot();
-  try {
-    const secrets = { A: "alpha", B: "bravo", C: "charlie" };
-    const fetch = brokerFetchStub(secrets);
-    const res = await syncSecrets({
-      cfg: BROKER_CFG, agentRoot: root, env: {}, fetch, token: "t",
-      names: ["A", "B", "MISSING"],
-    });
-    assert.deepEqual(res.synced.sort(), ["A", "B"]);
-    assert.deepEqual(res.missing, ["MISSING"]);
-    assert.deepEqual(res.failed, []);
-
-    // The local store now holds the pulled values, sealed.
-    const file = new FileProvider({ agentRoot: root });
-    assert.equal(file.get("A"), "alpha");
-    assert.equal(file.get("B"), "bravo");
-    assert.equal(file.get("MISSING"), null);
-
-    // And the value never appears in plaintext on disk.
-    const raw = readFileSync(join(root, "state/secrets/.secrets.json"), "utf-8");
-    assert.ok(!raw.includes("alpha") && !raw.includes("bravo"), "sealed at rest");
-  } finally { await rmRoot(root); }
-});
-
-test("syncSecrets throws when no broker is configured", async () => {
-  const root = await tmpRoot();
-  try {
-    await assert.rejects(
-      () => syncSecrets({ cfg: { provider: "file" }, agentRoot: root, names: ["A"] }),
-      /no broker configured/
-    );
-  } finally { await rmRoot(root); }
-});
-
-test("syncSecrets requires names array", async () => {
-  await assert.rejects(() => syncSecrets({ cfg: BROKER_CFG }), /names: string\[\] \} is required/);
-});
-
-// ---------------------------------------------------------------------------
-// rotateSecret — authoritative write + names-only audit
-// ---------------------------------------------------------------------------
-
-test("rotateSecret writes to the local provider and audits names-only", async () => {
-  const root = await tmpRoot();
-  try {
-    const res = await rotateSecret("DB_PASSWORD", "p@ss-NEW", {
-      cfg: { provider: "file" }, agentRoot: root, env: { MAESTRO_AGENT_ID: "alex" },
-    });
-    assert.equal(res.provider, "file");
-    assert.equal(res.identity, "alex");
-    assert.match(res.at, /^\d{4}-\d{2}-\d{2}T/);
-
-    // The new value is readable.
-    const file = new FileProvider({ agentRoot: root });
-    assert.equal(file.get("DB_PASSWORD"), "p@ss-NEW");
-
-    // Audit line: names + identity + fingerprint, NEVER the value.
-    const logPath = auditLogPath(root);
-    assert.ok(existsSync(logPath), "audit log written");
-    const raw = readFileSync(logPath, "utf-8").trim();
-    assert.ok(!raw.includes("p@ss-NEW"), "audit must never contain the secret value");
-    const rec = JSON.parse(raw.split("\n").pop());
-    assert.equal(rec.event, "secret-rotated");
-    assert.equal(rec.name, "DB_PASSWORD");
-    assert.equal(rec.identity, "alex");
-    assert.equal(rec.provider, "file");
-    assert.equal(rec.name_fingerprint, nameFingerprint("DB_PASSWORD"));
-  } finally { await rmRoot(root); }
-});
-
-test("rotateSecret writes to the broker (authoritative) and mirrors locally", async () => {
-  const root = await tmpRoot();
-  try {
-    const secrets = {};
-    const fetch = brokerFetchStub(secrets);
-    const res = await rotateSecret("API_TOKEN", "tok-rotated", {
-      cfg: BROKER_CFG, agentRoot: root, env: {}, fetch, token: "agent-tok", identity: "robin",
-    });
-    assert.equal(res.provider, "broker", "broker is authoritative when configured");
-    assert.equal(res.mirrored, true, "local mirror written for offline reads");
-    assert.equal(secrets.API_TOKEN, "tok-rotated", "broker received the rotation");
-    // Local mirror holds it too.
-    assert.equal(new FileProvider({ agentRoot: root }).get("API_TOKEN"), "tok-rotated");
-  } finally { await rmRoot(root); }
-});
-
-test("rotateSecret fails closed on an empty value or missing name", async () => {
-  const root = await tmpRoot();
-  try {
-    await assert.rejects(() => rotateSecret("", "v", { cfg: { provider: "file" }, agentRoot: root }), /name is required/);
-    await assert.rejects(() => rotateSecret("K", "", { cfg: { provider: "file" }, agentRoot: root }), /non-empty value/);
-  } finally { await rmRoot(root); }
-});
-
-test("rotateSecret fails closed when the broker write rejects", async () => {
-  const root = await tmpRoot();
-  try {
-    const fetch = async (url, opts) => {
-      if (opts.method === "PUT") return { ok: false, status: 503, json: async () => ({}) };
-      return { ok: false, status: 404, json: async () => ({}) };
-    };
-    await assert.rejects(
-      () => rotateSecret("K", "v", { cfg: BROKER_CFG, agentRoot: root, env: {}, fetch, token: "t" }),
-      /failed \(status 503\)/
-    );
-    // No audit line on a failed rotation.
-    assert.ok(!existsSync(auditLogPath(root)), "no audit on failed authoritative write");
-  } finally { await rmRoot(root); }
-});
-
-test("rotateSecret fails closed when the local provider is read-only (env) and no broker", async () => {
-  const root = await tmpRoot();
-  try {
-    await assert.rejects(
-      () => rotateSecret("K", "v", { cfg: { provider: "env" }, agentRoot: root, env: {} }),
-      /no writable authoritative provider/
-    );
-  } finally { await rmRoot(root); }
-});
-
-test("rotateSecret uses an injected audit sink when provided", async () => {
-  const root = await tmpRoot();
-  try {
-    const lines = [];
-    await rotateSecret("K", "v", {
-      cfg: { provider: "file" }, agentRoot: root, env: {},
-      appendAudit: (p, rec) => { lines.push({ p, rec }); return true; },
-    });
-    assert.equal(lines.length, 1);
-    assert.equal(lines[0].rec.name, "K");
-    assert.ok(lines[0].p.endsWith("logs/audit/secrets.jsonl"));
-  } finally { await rmRoot(root); }
-});

package/lib/secrets/providers.test.mjs

@@ -1,274 +0,0 @@
-/**
- * lib/secrets/providers.test.mjs — provider interface + sealed store + selection.
- *
- * Covers:
- *   • file provider seals + round-trips (ciphertext on disk != plaintext)
- *   • env provider reads; writes fail closed
- *   • keychain provider via an injected exec stub (no real `security`)
- *   • broker provider get/set/list over an injected fetch (offline)
- *   • broker reads fail open; writes fail closed
- *   • selectProvider by config (file | env | keychain | unknown→file)
- */
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { promises as fsp, readFileSync, existsSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-
-import {
-  EnvProvider,
-  FileProvider,
-  KeychainProvider,
-  BrokerProvider,
-  selectProvider,
-  seal,
-  open,
-  loadOrCreateMasterKey,
-  nameFingerprint,
-} from "./providers.mjs";
-
-async function tmpRoot(prefix = "secrets-prov") {
-  const path = join(tmpdir(), `${prefix}-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`);
-  await fsp.mkdir(path, { recursive: true });
-  return path;
-}
-async function rmRoot(p) { try { await fsp.rm(p, { recursive: true, force: true }); } catch { /* */ } }
-
-// ---------------------------------------------------------------------------
-// crypto primitives
-// ---------------------------------------------------------------------------
-
-test("seal/open round-trips and the sealed envelope is not the plaintext", () => {
-  const k = Buffer.alloc(32, 7);
-  const env = seal(k, "super-secret-value");
-  assert.ok(env.iv && env.tag && env.ct, "envelope has iv/tag/ct");
-  assert.ok(!env.ct.includes("super-secret"), "ciphertext does not contain plaintext");
-  assert.equal(open(k, env), "super-secret-value");
-});
-
-test("loadOrCreateMasterKey creates a stable 32-byte key", async () => {
-  const root = await tmpRoot();
-  try {
-    const k1 = loadOrCreateMasterKey(root);
-    assert.equal(k1.length, 32);
-    const k2 = loadOrCreateMasterKey(root); // second load returns the same key
-    assert.deepEqual([...k1], [...k2]);
-  } finally { await rmRoot(root); }
-});
-
-test("seal uses a fresh IV per call (same plaintext → different ciphertext)", () => {
-  const k = Buffer.alloc(32, 3);
-  const a = seal(k, "same");
-  const b = seal(k, "same");
-  assert.notEqual(a.ct + a.iv, b.ct + b.iv, "two seals of the same value must differ");
-  assert.equal(open(k, a), "same");
-  assert.equal(open(k, b), "same");
-});
-
-// ---------------------------------------------------------------------------
-// FileProvider
-// ---------------------------------------------------------------------------
-
-test("file provider seals + round-trips; on-disk ciphertext != plaintext", async () => {
-  const root = await tmpRoot();
-  try {
-    const p = new FileProvider({ agentRoot: root });
-    assert.equal(p.get("API_KEY"), null, "missing secret reads null");
-    assert.equal(p.set("API_KEY", "sk-live-123"), true);
-    assert.equal(p.get("API_KEY"), "sk-live-123", "round-trips");
-
-    const storeFile = join(root, "state/secrets/.secrets.json");
-    assert.ok(existsSync(storeFile), "store written");
-    const raw = readFileSync(storeFile, "utf-8");
-    assert.ok(!raw.includes("sk-live-123"), "plaintext must never appear on disk");
-
-    // Key file is 0600.
-    const keyFile = join(root, "state/secrets/.secrets.key");
-    assert.ok(existsSync(keyFile));
-    if (typeof process.getuid === "function") {
-      const st = await fsp.stat(keyFile);
-      assert.equal(st.mode & 0o777, 0o600, "key file must be 0600");
-    }
-  } finally { await rmRoot(root); }
-});
-
-test("file provider lists names sorted and persists across instances", async () => {
-  const root = await tmpRoot();
-  try {
-    const a = new FileProvider({ agentRoot: root });
-    a.set("ZED", "1");
-    a.set("ALPHA", "2");
-    assert.deepEqual(a.list(), ["ALPHA", "ZED"]);
-    // A fresh instance reads the same store + key.
-    const b = new FileProvider({ agentRoot: root });
-    assert.equal(b.get("ALPHA"), "2");
-    assert.deepEqual(b.list(), ["ALPHA", "ZED"]);
-  } finally { await rmRoot(root); }
-});
-
-test("file provider get fails open (null) on a corrupt store", async () => {
-  const root = await tmpRoot();
-  try {
-    await fsp.mkdir(join(root, "state/secrets"), { recursive: true });
-    await fsp.writeFile(join(root, "state/secrets/.secrets.json"), "{ not json");
-    const p = new FileProvider({ agentRoot: root });
-    assert.equal(p.get("X"), null, "corrupt store reads null, not throw");
-    assert.deepEqual(p.list(), []);
-  } finally { await rmRoot(root); }
-});
-
-test("file provider set fails closed on a bad name", async () => {
-  const root = await tmpRoot();
-  try {
-    const p = new FileProvider({ agentRoot: root });
-    assert.throws(() => p.set("", "v"), /name is required/);
-  } finally { await rmRoot(root); }
-});
-
-// ---------------------------------------------------------------------------
-// EnvProvider
-// ---------------------------------------------------------------------------
-
-test("env provider reads from the injected env; writes fail closed", () => {
-  const p = new EnvProvider({ env: { FOO: "bar", lowercase: "x" } });
-  assert.equal(p.get("FOO"), "bar");
-  assert.equal(p.get("MISSING"), null);
-  assert.deepEqual(p.list(), ["FOO"], "only UPPER_SNAKE names surface");
-  assert.throws(() => p.set("FOO", "new"), /read-only/, "env writes fail closed");
-});
-
-// ---------------------------------------------------------------------------
-// KeychainProvider (injected exec — no real `security`)
-// ---------------------------------------------------------------------------
-
-test("keychain provider round-trips via an injected exec and tracks names", async () => {
-  const root = await tmpRoot();
-  try {
-    const store = new Map();
-    const exec = (file, argv) => {
-      assert.equal(file, "security");
-      const cmd = argv[0];
-      if (cmd === "add-generic-password") {
-        const s = argv[argv.indexOf("-s") + 1];
-        const w = argv[argv.indexOf("-w") + 1];
-        store.set(s, w);
-        return "";
-      }
-      if (cmd === "find-generic-password") {
-        const s = argv[argv.indexOf("-s") + 1];
-        if (!store.has(s)) { const e = new Error("not found"); throw e; }
-        return store.get(s) + "\n";
-      }
-      throw new Error("unexpected security subcommand " + cmd);
-    };
-    const p = new KeychainProvider({ agentRoot: root, exec, service: "maestro", account: "a" });
-    assert.equal(p.get("TOK"), null, "absent item fails open to null");
-    assert.equal(p.set("TOK", "value-1"), true);
-    assert.equal(p.get("TOK"), "value-1");
-    assert.deepEqual(p.list(), ["TOK"], "name index tracks written names");
-  } finally { await rmRoot(root); }
-});
-
-test("keychain provider get fails open when exec throws (non-mac host)", async () => {
-  const root = await tmpRoot();
-  try {
-    const exec = () => { throw new Error("security: command not found"); };
-    const p = new KeychainProvider({ agentRoot: root, exec });
-    assert.equal(p.get("ANY"), null);
-    assert.deepEqual(p.list(), []);
-  } finally { await rmRoot(root); }
-});
-
-// ---------------------------------------------------------------------------
-// BrokerProvider (injected fetch — offline)
-// ---------------------------------------------------------------------------
-
-function brokerFetchStub(secrets) {
-  return async (url, opts = {}) => {
-    const u = new URL(url);
-    const m = u.pathname.match(/\/secrets\/(.+)$/);
-    if (opts.method === "GET" && u.pathname === "/secrets") {
-      return { ok: true, status: 200, json: async () => ({ secrets: Object.keys(secrets).map((name) => ({ name })) }) };
-    }
-    if (opts.method === "GET" && m) {
-      const name = decodeURIComponent(m[1]);
-      if (!(name in secrets)) return { ok: false, status: 404, json: async () => ({}) };
-      return { ok: true, status: 200, json: async () => ({ value: secrets[name] }) };
-    }
-    if (opts.method === "PUT" && m) {
-      const name = decodeURIComponent(m[1]);
-      secrets[name] = JSON.parse(opts.body).value;
-      return { ok: true, status: 200, json: async () => ({}) };
-    }
-    return { ok: false, status: 400, json: async () => ({}) };
-  };
-}
-
-test("broker provider get/set/list over an injected fetch (no live call)", async () => {
-  const secrets = { EXISTING: "remote-value" };
-  const p = new BrokerProvider({ baseUrl: "https://broker.example/", token: "t", fetch: brokerFetchStub(secrets) });
-  assert.equal(await p.get("EXISTING"), "remote-value");
-  assert.equal(await p.get("NOPE"), null, "404 reads null (fail open)");
-  assert.equal(await p.set("NEW", "v2"), true);
-  assert.equal(secrets.NEW, "v2", "PUT reached the store");
-  assert.deepEqual(await p.list(), ["EXISTING", "NEW"]);
-});
-
-test("broker provider sends a Bearer token and json content-type", async () => {
-  let seenHeaders = null;
-  const fetch = async (url, opts) => { seenHeaders = opts.headers; return { ok: true, status: 200, json: async () => ({ value: "x" }) }; };
-  const p = new BrokerProvider({ baseUrl: "https://b", token: "agent-token-abc", fetch });
-  await p.get("A");
-  assert.equal(seenHeaders.authorization, "Bearer agent-token-abc");
-  assert.match(seenHeaders["content-type"], /json/);
-});
-
-test("broker provider read fails open, write fails closed", async () => {
-  const throwing = async () => { throw new Error("network down"); };
-  const p = new BrokerProvider({ baseUrl: "https://b", token: "t", fetch: throwing });
-  assert.equal(await p.get("A"), null, "read fails open");
-  assert.deepEqual(await p.list(), [], "list fails open");
-  await assert.rejects(() => p.set("A", "v"), /network down|failed/, "write fails closed");
-});
-
-test("broker provider with no fetch: read null, write throws", async () => {
-  const p = new BrokerProvider({ baseUrl: "https://b", token: "t" });
-  assert.equal(await p.get("A"), null);
-  await assert.rejects(() => p.set("A", "v"), /cannot write/);
-});
-
-// ---------------------------------------------------------------------------
-// selectProvider
-// ---------------------------------------------------------------------------
-
-test("selectProvider picks by config", async () => {
-  const root = await tmpRoot();
-  try {
-    assert.equal(selectProvider({ provider: "file" }, { agentRoot: root }).name, "file");
-    assert.equal(selectProvider({ provider: "env" }, { agentRoot: root, env: {} }).name, "env");
-    assert.equal(selectProvider({ provider: "keychain" }, { agentRoot: root }).name, "keychain");
-    // Default when unspecified → file (the encrypted-at-rest safe default).
-    assert.equal(selectProvider(null, { agentRoot: root }).name, "file");
-    assert.equal(selectProvider({}, { agentRoot: root }).name, "file");
-    // Unknown provider falls back to file rather than throwing.
-    assert.equal(selectProvider({ provider: "bogus" }, { agentRoot: root }).name, "file");
-  } finally { await rmRoot(root); }
-});
-
-test("selectProvider(keychain) passes through service/account from config", async () => {
-  const root = await tmpRoot();
-  try {
-    const p = selectProvider({ provider: "keychain", keychain: { service: "svc", account: "acct" } }, { agentRoot: root });
-    assert.equal(p.service, "svc");
-    assert.equal(p.account, "acct");
-  } finally { await rmRoot(root); }
-});
-
-test("nameFingerprint is a stable 16-hex prefix and value-free", () => {
-  const a = nameFingerprint("ANTHROPIC_API_KEY");
-  const b = nameFingerprint("ANTHROPIC_API_KEY");
-  assert.equal(a, b);
-  assert.match(a, /^[0-9a-f]{16}$/);
-  assert.notEqual(a, nameFingerprint("OTHER"));
-});