@cohortapp/agent-sdk 2.17.0 → 2.18.5

package/lib/model-router/auth-profiles.test.mjs

@@ -1,580 +0,0 @@
-/**
- * auth-profiles.test.mjs — the OpenClaw auth-profile rotation store.
- *
- * Verifies: loadAuthProfiles pools keys from config + env lists; nextCredential
- * round-robins over a multi-key pool; markCredentialCoolingDown cools ONE key
- * (the others still serve); a single-key config is unchanged (no rotation, no
- * ledger write); available() counts non-cooling keys; the O_EXCL ledger survives
- * concurrent marks with monotonic strikes (longer cooldown wins).
- *
- * Hermetic: injected clock + a per-test temp stateDir; no real network/clock.
- * Run: node --test lib/model-router/auth-profiles.test.mjs
- */
-"use strict";
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, rmSync, existsSync, readFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-
-import {
-  loadAuthProfiles,
-  nextCredential,
-  markCredentialCoolingDown,
-  markCredentialHealthy,
-  available,
-  fingerprint,
-  authEnvMapFromCatalog,
-  _internals,
-} from "./auth-profiles.mjs";
-import { loadCatalog } from "./catalog.mjs";
-import { resolveChain, _internals as resolveInternals } from "./resolve.mjs";
-import { spawnRouted, _internals as spawnInternals } from "./spawn.mjs";
-
-function tmpStateDir() {
-  return mkdtempSync(join(tmpdir(), "authprof-"));
-}
-
-function clockFrom(start) {
-  let t = start;
-  const now = () => t;
-  now.advance = (ms) => { t += ms; };
-  now.set = (v) => { t = v; };
-  return now;
-}
-
-// ---------------------------------------------------------------------------
-// loadAuthProfiles
-// ---------------------------------------------------------------------------
-
-test("loadAuthProfiles pools keys from a config doc (keys + env lists)", () => {
-  const env = { DEEPSEEK_API_KEY: "sk-env-1", DEEPSEEK_API_KEY_2: "sk-env-2" };
-  const configDoc = {
-    providers: {
-      deepseek: { keys: ["sk-cfg-a", "sk-cfg-b"], env: ["DEEPSEEK_API_KEY"] },
-      moonshot: ["sk-moon"],
-    },
-  };
-  const ap = loadAuthProfiles(null, { env, configDoc });
-  // config keys first (sk-cfg-a, sk-cfg-b), then the env var named in `env`, then
-  // env-list siblings are NOT pulled here (no authEnvByProvider passed).
-  assert.deepEqual(ap.keysFor("deepseek"), ["sk-cfg-a", "sk-cfg-b", "sk-env-1"]);
-  assert.deepEqual(ap.keysFor("moonshot"), ["sk-moon"]);
-  assert.equal(ap.isPooled("deepseek"), true);
-  assert.equal(ap.isPooled("moonshot"), false);
-});
-
-test("loadAuthProfiles pools numbered env-var siblings via authEnvByProvider", () => {
-  const env = {
-    ANTHROPIC_API_KEY: "sk-1",
-    ANTHROPIC_API_KEY_2: "sk-2",
-    ANTHROPIC_API_KEY_3: "sk-3",
-    // gap at _4 stops the scan; _5 must be ignored
-    ANTHROPIC_API_KEY_5: "sk-5",
-  };
-  const ap = loadAuthProfiles(null, {
-    env,
-    configDoc: null,
-    authEnvByProvider: { anthropic: "ANTHROPIC_API_KEY" },
-  });
-  assert.deepEqual(ap.keysFor("anthropic"), ["sk-1", "sk-2", "sk-3"]);
-});
-
-test("loadAuthProfiles supports the <BASE>S comma-list env form", () => {
-  const env = { DEEPSEEK_API_KEYS: "k1, k2 ,k3" };
-  const ap = loadAuthProfiles(null, {
-    env,
-    configDoc: null,
-    authEnvByProvider: { deepseek: "DEEPSEEK_API_KEY" },
-  });
-  assert.deepEqual(ap.keysFor("deepseek"), ["k1", "k2", "k3"]);
-});
-
-test("loadAuthProfiles is empty + never throws with no config and no env", () => {
-  const ap = loadAuthProfiles(null, { env: {}, configDoc: null });
-  assert.deepEqual(ap.providers, []);
-  assert.deepEqual(ap.keysFor("deepseek"), []);
-  assert.equal(ap.isPooled("deepseek"), false);
-});
-
-test("authEnvMapFromCatalog reads provider->auth_env from a catalog", () => {
-  const catalog = {
-    providers: new Map([
-      ["anthropic", { auth_env: null }],
-      ["deepseek", { auth_env: "DEEPSEEK_API_KEY" }],
-    ]),
-    models: [{ provider: "moonshot", auth_env: "MOONSHOT_API_KEY" }],
-  };
-  const m = authEnvMapFromCatalog(catalog);
-  assert.equal(m.get("deepseek"), "DEEPSEEK_API_KEY");
-  assert.equal(m.get("moonshot"), "MOONSHOT_API_KEY");
-  assert.equal(m.has("anthropic"), false); // null auth_env dropped
-});
-
-// ---------------------------------------------------------------------------
-// nextCredential — round-robin
-// ---------------------------------------------------------------------------
-
-test("nextCredential round-robins over a multi-key pool", () => {
-  const dir = tmpStateDir();
-  try {
-    const keys = ["sk-a", "sk-b", "sk-c"];
-    const now = clockFrom(1_000_000);
-    const deps = { stateDir: dir, now };
-    const got = [];
-    for (let i = 0; i < 6; i++) {
-      got.push(nextCredential("deepseek", { keys, deps }).key);
-    }
-    // Cursor starts at 0, advances by one each pick → a, b, c, a, b, c.
-    assert.deepEqual(got, ["sk-a", "sk-b", "sk-c", "sk-a", "sk-b", "sk-c"]);
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-test("nextCredential is unchanged for a single-key config (no ledger write)", () => {
-  const dir = tmpStateDir();
-  try {
-    const now = clockFrom(2_000_000);
-    const deps = { stateDir: dir, now };
-    const r1 = nextCredential("moonshot", { keys: ["sk-only"], deps });
-    const r2 = nextCredential("moonshot", { keys: ["sk-only"], deps });
-    assert.equal(r1.key, "sk-only");
-    assert.equal(r2.key, "sk-only");
-    assert.equal(r1.poolSize, 1);
-    // Single-key path takes no lock + writes no ledger file.
-    assert.equal(existsSync(_internals.ledgerPath(deps)), false);
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-test("nextCredential returns null for an empty pool", () => {
-  const dir = tmpStateDir();
-  try {
-    const r = nextCredential("nobody", { keys: [], deps: { stateDir: dir } });
-    assert.equal(r.key, null);
-    assert.equal(r.poolSize, 0);
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-// ---------------------------------------------------------------------------
-// markCredentialCoolingDown — cools ONE key, others serve
-// ---------------------------------------------------------------------------
-
-test("cooling one key removes it from rotation; the others still serve", () => {
-  const dir = tmpStateDir();
-  try {
-    const keys = ["sk-a", "sk-b", "sk-c"];
-    const now = clockFrom(5_000_000);
-    const deps = { stateDir: dir, now };
-
-    // Cool sk-b for the default ladder (30s). It must be skipped.
-    const mark = markCredentialCoolingDown("deepseek", "sk-b", "rate_limit", null, { deps, now: now() });
-    assert.equal(mark.fingerprint, fingerprint("sk-b"));
-    assert.equal(mark.strikes, 1);
-    assert.equal(mark.coolUntil, now() + 30_000);
-
-    // available() should report 2 of 3.
-    const av = available("deepseek", { keys, deps, now: now() });
-    assert.equal(av.count, 2);
-    assert.equal(av.poolSize, 3);
-
-    // nextCredential must never hand out sk-b while it cools.
-    const handed = new Set();
-    for (let i = 0; i < 6; i++) handed.add(nextCredential("deepseek", { keys, deps, now: now() }).key);
-    assert.equal(handed.has("sk-b"), false);
-    assert.equal(handed.has("sk-a"), true);
-    assert.equal(handed.has("sk-c"), true);
-
-    // After the cooldown expires, sk-b is back in rotation.
-    now.advance(30_001);
-    const av2 = available("deepseek", { keys, deps, now: now() });
-    assert.equal(av2.count, 3);
-    const handed2 = new Set();
-    for (let i = 0; i < 6; i++) handed2.add(nextCredential("deepseek", { keys, deps, now: now() }).key);
-    assert.equal(handed2.has("sk-b"), true);
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-test("when every key cools, nextCredential reports allCooling + a wake time", () => {
-  const dir = tmpStateDir();
-  try {
-    const keys = ["sk-a", "sk-b"];
-    const now = clockFrom(7_000_000);
-    const deps = { stateDir: dir, now };
-    markCredentialCoolingDown("deepseek", "sk-a", "rate_limit", null, { deps, now: now() });
-    markCredentialCoolingDown("deepseek", "sk-b", "auth", null, { deps, now: now() });
-    const r = nextCredential("deepseek", { keys, deps, now: now() });
-    assert.equal(r.key, null);
-    assert.equal(r.allCooling, true);
-    assert.equal(r.available, 0);
-    assert.ok(r.soonestCoolUntil > now());
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-test("the cooldown ladder steps 30s → 1m → 5m on repeated strikes", () => {
-  const dir = tmpStateDir();
-  try {
-    const now = clockFrom(9_000_000);
-    const deps = { stateDir: dir, now };
-    const m1 = markCredentialCoolingDown("deepseek", "sk-x", "rate_limit", null, { deps, now: now() });
-    const m2 = markCredentialCoolingDown("deepseek", "sk-x", "rate_limit", null, { deps, now: now() });
-    const m3 = markCredentialCoolingDown("deepseek", "sk-x", "rate_limit", null, { deps, now: now() });
-    const m4 = markCredentialCoolingDown("deepseek", "sk-x", "rate_limit", null, { deps, now: now() });
-    assert.equal(m1.coolUntil - now(), 30_000);
-    assert.equal(m2.coolUntil - now(), 60_000);
-    assert.equal(m3.coolUntil - now(), 300_000);
-    assert.equal(m4.coolUntil - now(), 300_000); // sticks at 5m
-    assert.deepEqual([m1.strikes, m2.strikes, m3.strikes, m4.strikes], [1, 2, 3, 4]);
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-test("markCredentialHealthy clears a cooled key", () => {
-  const dir = tmpStateDir();
-  try {
-    const now = clockFrom(11_000_000);
-    const deps = { stateDir: dir, now };
-    const keys = ["sk-a", "sk-b"];
-    markCredentialCoolingDown("deepseek", "sk-a", "rate_limit", null, { deps, now: now() });
-    assert.equal(available("deepseek", { keys, deps, now: now() }).count, 1);
-    markCredentialHealthy("deepseek", "sk-a", { deps });
-    assert.equal(available("deepseek", { keys, deps, now: now() }).count, 2);
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-// ---------------------------------------------------------------------------
-// O_EXCL: concurrent marks converge (monotonic strikes, longer cooldown wins)
-// ---------------------------------------------------------------------------
-
-test("concurrent marks on one key converge under the O_EXCL lock", async () => {
-  const dir = tmpStateDir();
-  try {
-    const now = clockFrom(13_000_000);
-    const deps = { stateDir: dir, now };
-    // Fire 8 concurrent cooldown marks on the SAME key.
-    await Promise.all(
-      Array.from({ length: 8 }, () =>
-        Promise.resolve().then(() =>
-          markCredentialCoolingDown("deepseek", "sk-hot", "rate_limit", null, { deps, now: now() })
-        )
-      )
-    );
-    // The ledger must show exactly 8 strikes (monotonic — no lost updates).
-    const led = _internals.readLedgerSafe(deps);
-    const entry = _internals.providerEntry(led, "deepseek");
-    const cs = _internals.credState(entry, fingerprint("sk-hot"));
-    assert.equal(cs.strikes, 8);
-    // The persisted file is valid JSON (atomic writes, no torn file).
-    const raw = readFileSync(_internals.ledgerPath(deps), "utf-8");
-    assert.doesNotThrow(() => JSON.parse(raw));
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-test("a racing shorter cooldown never shortens a longer one", () => {
-  const dir = tmpStateDir();
-  try {
-    const now = clockFrom(15_000_000);
-    const deps = { stateDir: dir, now };
-    // Explicit long cooldown first, then a short ladder hit — coolUntil must not regress.
-    const long = markCredentialCoolingDown("deepseek", "sk-y", "billing", 600_000, { deps, now: now() });
-    const short = markCredentialCoolingDown("deepseek", "sk-y", "rate_limit", null, { deps, now: now() });
-    assert.equal(long.coolUntil, now() + 600_000);
-    assert.equal(short.coolUntil, now() + 600_000); // not shortened to ~1m
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-test("fingerprint is deterministic and never the plaintext", () => {
-  const fp = fingerprint("super-secret-key");
-  assert.equal(fp, fingerprint("super-secret-key"));
-  assert.notEqual(fp, "super-secret-key");
-  assert.match(fp, /^[0-9a-f]{16}$/);
-  assert.equal(fingerprint(""), "");
-});
-
-test("the cooldown ledger never stores plaintext credentials", () => {
-  const dir = tmpStateDir();
-  try {
-    const now = clockFrom(17_000_000);
-    const deps = { stateDir: dir, now };
-    markCredentialCoolingDown("deepseek", "sk-PLAINTEXT-SECRET", "rate_limit", null, { deps, now: now() });
-    const raw = readFileSync(_internals.ledgerPath(deps), "utf-8");
-    assert.equal(raw.includes("sk-PLAINTEXT-SECRET"), false);
-    assert.equal(raw.includes(fingerprint("sk-PLAINTEXT-SECRET")), true);
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-// ---------------------------------------------------------------------------
-// Wiring: resolve.mjs picks a pooled credential + skips a cooled one;
-// a single-key config is unchanged. spawn.mjs cools the credential on failover.
-// ---------------------------------------------------------------------------
-
-// A catalog with a session-capable DeepSeek row (grade A so a tool-use session
-// can pick it) reachable on the anthropic wire (endpoints.anthropic).
-function pooledCatalog() {
-  const catalogText = {
-    deepseek: [
-      "provider: deepseek",
-      "auth_env: DEEPSEEK_API_KEY",
-      "endpoints: { anthropic: https://api.deepseek.com/anthropic }",
-      "models:",
-      "  - id: deepseek-chat",
-      "    status: available",
-      "    tool_reliability: A",
-      "    context_window: 64000",
-      "    context_tokens: 60000",
-      "    harness: { session: true, direct: true }",
-      "    cost: { input: 0.14, output: 0.28 }",
-    ].join("\n"),
-    anthropic: [
-      "provider: anthropic",
-      "endpoints: {}",
-      "models:",
-      "  - id: claude-sonnet-4-6",
-      "    status: available",
-      "    tool_reliability: A",
-      "    context_window: 200000",
-      "    context_tokens: 180000",
-      "    harness: { session: true, direct: true }",
-      "    cost: { input: 3, output: 15 }",
-    ].join("\n"),
-  };
-  return loadCatalog(undefined, { catalogText, agentRoot: tmpdir() });
-}
-
-// A v2 routing config: deepseek-first chain, anthropic fallback, deepseek allowed
-// for public data so the data-class gate passes.
-function pooledConfig() {
-  return {
-    schema_version: 2,
-    defaults: { data_class: "public" },
-    backends: { deepseek: { allowed_data_classes: ["public", "internal", "sensitive"] } },
-    aliases: {
-      cheap: "deepseek/deepseek-chat",
-      default: "anthropic/claude-sonnet-4-6",
-    },
-    routing_policy: [
-      { match: { task_class: "lookup" }, harness: "session", needs_tool_use: false, chain: ["cheap", "default"] },
-      { default: true, chain: ["default"] },
-    ],
-    fallback_to_anthropic: true,
-  };
-}
-
-test("resolve picks a pooled credential into the session-retarget env", () => {
-  const dir = tmpStateDir();
-  try {
-    const catalog = pooledCatalog();
-    const profiles = loadAuthProfiles(null, {
-      env: {},
-      configDoc: { providers: { deepseek: { keys: ["sk-a", "sk-b", "sk-c"] } } },
-    });
-    const now = clockFrom(20_000_000);
-    const dec = resolveChain(
-      { task_class: "lookup", data_class: "public", needs_tool_use: false },
-      {
-        config: pooledConfig(),
-        catalog,
-        env: {}, // NO single DEEPSEEK_API_KEY — the pool supplies the credential
-        authProfiles: profiles,
-        authProfileDeps: { stateDir: dir, now },
-        now, // resolveChain wants a clock FUNCTION (so ctx.now matches the ledger clock)
-      }
-    );
-    assert.equal(dec.chosen.provider, "deepseek");
-    // The retarget env carries a pooled key (not undefined despite empty env).
-    assert.equal(dec.envForSpawn.ANTHROPIC_BASE_URL, "https://api.deepseek.com/anthropic");
-    assert.ok(["sk-a", "sk-b", "sk-c"].includes(dec.envForSpawn.ANTHROPIC_AUTH_TOKEN));
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-test("resolve skips a backend whose entire credential pool is cooled", () => {
-  const dir = tmpStateDir();
-  try {
-    const catalog = pooledCatalog();
-    const profiles = loadAuthProfiles(null, {
-      env: {},
-      configDoc: { providers: { deepseek: { keys: ["sk-a", "sk-b"] } } },
-    });
-    const now = clockFrom(22_000_000);
-    const deps = { stateDir: dir, now };
-    // Cool BOTH deepseek keys → the pool is dry; resolve must fall to anthropic.
-    markCredentialCoolingDown("deepseek", "sk-a", "rate_limit", null, { deps, now: now() });
-    markCredentialCoolingDown("deepseek", "sk-b", "rate_limit", null, { deps, now: now() });
-
-    const dec = resolveChain(
-      { task_class: "lookup", data_class: "public", needs_tool_use: false },
-      {
-        config: pooledConfig(),
-        catalog,
-        env: {},
-        authProfiles: profiles,
-        authProfileDeps: deps,
-        now, // clock FUNCTION
-      }
-    );
-    assert.equal(dec.chosen.provider, "anthropic");
-    // deepseek was tried and skipped for missing_credential (pool exhausted).
-    assert.ok(dec.tried.some((t) => t.ref === "deepseek/deepseek-chat" && t.reason === "missing_credential"));
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-test("a single-key config is unchanged (no pool, no rotation, env var wins)", () => {
-  const dir = tmpStateDir();
-  try {
-    const catalog = pooledCatalog();
-    // Single key in the pool ⇒ NOT pooled ⇒ resolve falls through to env[auth_env]
-    // exactly as before. We give a single-key profile AND the env var; both point
-    // at the same single-key behavior.
-    const profiles = loadAuthProfiles(null, {
-      env: {},
-      configDoc: { providers: { deepseek: { keys: ["sk-solo"] } } },
-    });
-    const now = clockFrom(24_000_000);
-    const dec = resolveChain(
-      { task_class: "lookup", data_class: "public", needs_tool_use: false },
-      {
-        config: pooledConfig(),
-        catalog,
-        env: { DEEPSEEK_API_KEY: "sk-env-solo" },
-        authProfiles: profiles,
-        authProfileDeps: { stateDir: dir, now },
-        now, // clock FUNCTION
-      }
-    );
-    assert.equal(dec.chosen.provider, "deepseek");
-    // Single-key pool is not "pooled", so the env var supplies the token verbatim.
-    assert.equal(dec.envForSpawn.ANTHROPIC_AUTH_TOKEN, "sk-env-solo");
-    // No ledger file written for the single-key path.
-    assert.equal(existsSync(_internals.ledgerPath({ stateDir: dir })), false);
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-test("resolve with NO authProfiles wired behaves exactly as today (env var only)", () => {
-  const catalog = pooledCatalog();
-  const now = clockFrom(26_000_000);
-  const dec = resolveChain(
-    { task_class: "lookup", data_class: "public", needs_tool_use: false },
-    {
-      config: pooledConfig(),
-      catalog,
-      env: { DEEPSEEK_API_KEY: "sk-classic" },
-      now, // clock FUNCTION
-      // no authProfiles, no authProfileDeps
-    }
-  );
-  assert.equal(dec.chosen.provider, "deepseek");
-  assert.equal(dec.envForSpawn.ANTHROPIC_AUTH_TOKEN, "sk-classic");
-});
-
-test("resolveRowCredential helper: pooled vs single-key", () => {
-  const dir = tmpStateDir();
-  try {
-    const now = clockFrom(28_000_000);
-    const profiles = loadAuthProfiles(null, {
-      env: {},
-      configDoc: { providers: { deepseek: { keys: ["sk-a", "sk-b"] } } },
-    });
-    const row = { provider: "deepseek", auth_env: "DEEPSEEK_API_KEY" };
-    const pooledCtx = { env: {}, authProfiles: profiles, authProfileDeps: { stateDir: dir, now }, now: now() };
-    const p = resolveInternals.resolveRowCredential(row, pooledCtx);
-    assert.equal(p.pooled, true);
-    assert.ok(["sk-a", "sk-b"].includes(p.token));
-
-    // Single env var, no pool ⇒ not pooled, env token verbatim.
-    const single = resolveInternals.resolveRowCredential(row, {
-      env: { DEEPSEEK_API_KEY: "sk-env" },
-      authProfiles: null,
-      now: now(),
-    });
-    assert.equal(single.pooled, false);
-    assert.equal(single.token, "sk-env");
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-test("spawnRouted cools the active credential on a rate_limit failover", async () => {
-  const dir = tmpStateDir();
-  try {
-    const catalog = pooledCatalog();
-    const profiles = loadAuthProfiles(null, {
-      env: {},
-      configDoc: { providers: { deepseek: { keys: ["sk-a", "sk-b"] } } },
-    });
-    const now = clockFrom(30_000_000);
-    const deps = { stateDir: dir, now };
-
-    // First attempt (deepseek) rate-limits; the failover should advance to
-    // anthropic AND cool the deepseek credential the first attempt used.
-    let calls = 0;
-    const result = await spawnRouted(
-      { task_class: "lookup", data_class: "public", needs_tool_use: false },
-      {
-        config: pooledConfig(),
-        catalog,
-        env: {},
-        authProfiles: profiles,
-        authProfileDeps: deps,
-        now,
-        // a no-op breaker so failover walks deterministically
-        breaker: { isOpen: () => ({ open: false }), open: () => {}, close: () => {} },
-        spawnImpl: async (candidate) => {
-          calls++;
-          if (candidate.ref === "deepseek/deepseek-chat") {
-            return { ok: false, reason: "rate_limit" };
-          }
-          return { ok: true, result: "ok" };
-        },
-      }
-    );
-
-    assert.equal(result.ok, true);
-    assert.equal(result.chosen.provider, "anthropic"); // failed over
-    // Exactly one deepseek credential is now cooling (the one the attempt used).
-    const av = available("deepseek", { profiles, deps, now: now() });
-    assert.equal(av.count, 1, "one of the two pooled keys should be cooling");
-    assert.equal(av.poolSize, 2);
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-test("buildChildEnv never leaks the internal __credFingerprint marker", () => {
-  // The retarget set may carry a private __credFingerprint; only RETARGET_KEYS
-  // reach the child env, so the marker is always scrubbed.
-  const child = spawnInternals.buildChildEnv(
-    { PATH: "/usr/bin" },
-    {
-      ANTHROPIC_BASE_URL: "https://api.deepseek.com/anthropic",
-      ANTHROPIC_AUTH_TOKEN: "sk-a",
-      __credFingerprint: "deadbeefdeadbeef",
-    }
-  );
-  assert.equal(child.ANTHROPIC_AUTH_TOKEN, "sk-a");
-  assert.equal(child.__credFingerprint, undefined);
-  assert.equal(child.PATH, "/usr/bin");
-});