@desplega.ai/agent-swarm 1.149.0 → 1.150.0

package/src/tests/memory-edges.test.ts

@@ -32,7 +32,7 @@ import { getFreePort, SERVER_BOOT_HOOK_TIMEOUT_MS, waitForServer } from "./test-
 let TEST_PORT = 0;
 const TEST_DB_PATH = `/tmp/test-memory-edges-${Date.now()}.sqlite`;
 let BASE = "";
-const API_KEY = "test-key";
+const API_KEY = "example-test-key";
 
 let serverProc: Subprocess;
 const agentA = randomUUID();

package/src/tests/memory-rate-endpoint.test.ts

@@ -20,7 +20,7 @@ import { getFreePort, SERVER_BOOT_HOOK_TIMEOUT_MS, waitForServer } from "./test-
 let TEST_PORT = 0;
 const TEST_DB_PATH = `/tmp/test-memory-rate-${Date.now()}.sqlite`;
 let BASE = "";
-const API_KEY = "test-key";
+const API_KEY = "example-test-key";
 
 let serverProc: Subprocess;
 const agentA = randomUUID();

package/src/tests/memory-rate-tool.test.ts

@@ -64,7 +64,7 @@ const memoryId = "22222222-2222-4222-8222-222222222222";
 describe("memory_rate MCP tool", () => {
   beforeEach(() => {
     process.env.MCP_BASE_URL = "http://test-host:9999";
-    process.env.API_KEY = "test-key";
+    process.env.API_KEY = "example-test-key";
   });
 
   afterEach(() => {
@@ -89,7 +89,7 @@ describe("memory_rate MCP tool", () => {
     expect(calls[0]!.init?.method).toBe("POST");
     const headers = calls[0]!.init?.headers as Record<string, string>;
     expect(headers["X-Agent-ID"]).toBe("agent-abc");
-    expect(headers.Authorization).toBe("Bearer test-key");
+    expect(headers.Authorization).toBe("Bearer example-test-key");
     const body = JSON.parse(calls[0]!.init?.body as string);
     expect(body).toEqual({
       events: [

package/src/tests/memory-rater-e2e.test.ts

@@ -49,7 +49,7 @@ import { getFreePort, SERVER_BOOT_HOOK_TIMEOUT_MS, waitForServer } from "./test-
 let TEST_PORT = 0;
 const TEST_DB_PATH = `/tmp/test-memory-rater-e2e-${Date.now()}.sqlite`;
 let BASE = "";
-const API_KEY = "test-key";
+const API_KEY = "example-test-key";
 
 let serverProc: Subprocess;
 let store: SqliteMemoryStore;

package/src/tests/memory-rater-llm-summarizer.test.ts

@@ -113,7 +113,7 @@ describe("runMemoryRater — request shape", () => {
 
     const result = await runMemoryRater({
       prompt: "test prompt",
-      apiKey: "test-api-key-123",
+      apiKey: "example-test-api-key-123",
       fetchImpl: fakeFetch,
     });
 
@@ -125,7 +125,7 @@ describe("runMemoryRater — request shape", () => {
 
     const headers = capturedInit?.headers as Record<string, string>;
     expect(headers["Content-Type"]).toBe("application/json");
-    expect(headers.Authorization).toBe("Bearer test-api-key-123");
+    expect(headers.Authorization).toBe("Bearer example-test-api-key-123");
 
     const body = JSON.parse(String(capturedInit?.body));
     expect(body.model).toBe(DEFAULT_MEMORY_RATER_MODEL);
@@ -151,7 +151,7 @@ describe("runMemoryRater — request shape", () => {
 
       const result = await runMemoryRater({
         prompt: "test prompt",
-        apiKey: "test-api-key-123",
+        apiKey: "example-test-api-key-123",
         fetchImpl: fakeFetch,
       });
 

package/src/tests/memory-rater-llm.test.ts

@@ -520,7 +520,7 @@ describe("LlmRater.rate(ctx) — per-memory path with MockLlmRaterClient", () =>
 let TEST_PORT = 0;
 const TEST_DB_PATH = `/tmp/test-memory-rater-llm-${Date.now()}.sqlite`;
 let BASE = "";
-const API_KEY = "test-key";
+const API_KEY = "example-test-key";
 
 let serverProc: Subprocess;
 const agentA = randomUUID();

package/src/tests/model-control.test.ts

@@ -560,6 +560,7 @@ describe("Model Control - Zod Validation Schema", () => {
       sendTaskInputSchema.parse({
         agentId: crypto.randomUUID(),
         routingReason: "human_pinned",
+        routingNote: "This test explicitly selects the target worker",
         task: "x",
         model: "gpt-5.5",
       }).model,
@@ -583,6 +584,7 @@ describe("Model Control - Zod Validation Schema", () => {
       sendTaskInputSchema.parse({
         agentId: crypto.randomUUID(),
         routingReason: "human_pinned",
+        routingNote: "This test explicitly selects the target worker",
         task: "x",
         effort: "xhigh",
       }).effort,
@@ -591,6 +593,7 @@ describe("Model Control - Zod Validation Schema", () => {
       sendTaskInputSchema.parse({
         agentId: crypto.randomUUID(),
         routingReason: "human_pinned",
+        routingNote: "This test explicitly selects the target worker",
         task: "x",
         effort: "max",
       }).effort,

package/src/tests/multi-runtime-registration.test.ts

@@ -3,7 +3,7 @@
  * handlers on both sides of MULTI_RUNTIME_ENABLED.
  */
 
-import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { afterAll, beforeAll, beforeEach, describe, expect, spyOn, test } from "bun:test";
 import { unlink } from "node:fs/promises";
 import { createServer as createHttpServer, type Server } from "node:http";
 import {
@@ -15,6 +15,7 @@ import {
   getActiveTaskCount,
   getAgentById,
   getDbClient,
+  getIdleWorkersWithCapacity,
   getSwarmConfigs,
   getTaskById,
   hasCapacity,
@@ -22,6 +23,7 @@ import {
   releaseStaleOfferedTasksForOfflineAgents,
   startTask,
   updateAgentStatus,
+  updateAgentStatusFromCapacity,
   upsertSwarmConfig,
 } from "../be/db";
 import {
@@ -32,8 +34,16 @@ import {
   getRuntimeInstanceById,
   hasReadyLiveRuntime,
 } from "../be/multi-runtime";
+import {
+  CREDENTIAL_RETRY_INTERVAL_MS,
+  type CredentialRefreshState,
+  refreshCredentialStatus,
+} from "../commands/credential-refresh";
 import { retryBootStep } from "../commands/credential-wait";
-import { sendCredStatusReport } from "../commands/provider-credentials";
+import {
+  CREDENTIAL_PROVIDER_CHECKERS,
+  sendCredStatusReport,
+} from "../commands/provider-credentials";
 import { runHeartbeatSweep } from "../heartbeat/heartbeat";
 import { handleActiveSessions } from "../http/active-sessions";
 import { handleAgentRegister, handleAgentsRest } from "../http/agents";
@@ -49,7 +59,7 @@ import { listenOnFreePort } from "./test-net";
 
 const TEST_DB_PATH = "./test-multi-runtime-registration.sqlite";
 let baseUrl = "";
-const API_KEY = "test-multi-runtime-key";
+const API_KEY = "example-test-multi-runtime-key";
 
 const LEAD_ID = "44444444-4444-4444-4444-444444444444";
 
@@ -2840,3 +2850,87 @@ describe("MCP task-action accept requires a live runtime", () => {
     expect((await getTaskById(task.id))?.agentId).toBe(id);
   });
 });
+
+describe("post-task credential recovery without a restart", () => {
+  for (const multiRuntime of [false, true]) {
+    test(`parked worker recovers with multi-runtime ${multiRuntime ? "on" : "off"}`, async () => {
+      process.env.MULTI_RUNTIME_ENABLED = String(multiRuntime);
+      const id = await makeAgent(1);
+      const runtimeInstanceId = crypto.randomUUID();
+      await register(id, { maxTasks: 1, runtimeInstanceId });
+      const api = { apiUrl: baseUrl, apiKey: API_KEY, agentId: id, runtimeInstanceId };
+      const refresh: CredentialRefreshState = {
+        harnessProvider: "acp",
+        ready: true,
+        lastRefreshAt: 0,
+        inFlight: false,
+      };
+      const check = spyOn(CREDENTIAL_PROVIDER_CHECKERS, "claude");
+      const originalOAuth = process.env.CLAUDE_CODE_OAUTH_TOKEN;
+      // The real Claude checker and live-test use OAuth presence, no upstream I/O.
+      process.env.CLAUDE_CODE_OAUTH_TOKEN = "test-credential-recovery";
+      try {
+        // A live provider swap produces a real not-ready post-task snapshot.
+        await refreshCredentialStatus(api, refresh, "claude", {}, 1);
+        expect((await getAgentById(id))?.status).toBe("waiting_for_credentials");
+        expect((await getAgentById(id))?.credStatus?.reportKind).toBe("post_task");
+        expect((await getIdleWorkersWithCapacity()).some((agent) => agent.id === id)).toBe(false);
+        if (multiRuntime) {
+          expect((await getRuntimeInstanceById(runtimeInstanceId))?.credentialReady).toBe(false);
+        }
+
+        // Ping and completion/capacity reconciliation cannot recover it.
+        await pingAgent(id, runtimeInstanceId);
+        await updateAgentStatusFromCapacity(id);
+        expect((await getAgentById(id))?.status).toBe("waiting_for_credentials");
+        await refreshCredentialStatus(api, refresh, "claude", {}, CREDENTIAL_RETRY_INTERVAL_MS);
+        expect(check).toHaveBeenCalledTimes(1);
+
+        // A still-missing snapshot stays parked, and starts a new throttle window.
+        await refreshCredentialStatus(api, refresh, "claude", {}, CREDENTIAL_RETRY_INTERVAL_MS + 1);
+        expect(check).toHaveBeenCalledTimes(2);
+        expect((await getAgentById(id))?.status).toBe("waiting_for_credentials");
+        const env = { CLAUDE_CODE_OAUTH_TOKEN: "test-credential-recovery" };
+        await refreshCredentialStatus(
+          api,
+          refresh,
+          "claude",
+          env,
+          2 * CREDENTIAL_RETRY_INTERVAL_MS,
+        );
+        expect(check).toHaveBeenCalledTimes(2);
+        expect((await getAgentById(id))?.status).toBe("waiting_for_credentials");
+
+        // Credentials resolve. Same runner state, provider, and runtime identity.
+        await refreshCredentialStatus(
+          api,
+          refresh,
+          "claude",
+          env,
+          2 * CREDENTIAL_RETRY_INTERVAL_MS + 1,
+        );
+        expect(check).toHaveBeenCalledTimes(3);
+        expect((await getAgentById(id))?.status).toBe("idle");
+        expect((await getAgentById(id))?.credStatus?.ready).toBe(true);
+        expect((await getAgentById(id))?.credentialMissing).toBeNull();
+        expect((await getIdleWorkersWithCapacity()).some((agent) => agent.id === id)).toBe(true);
+        if (multiRuntime) {
+          expect((await getRuntimeInstanceById(runtimeInstanceId))?.credentialReady).toBe(true);
+          expect(await countActiveRuntimeInstancesForAgent(id)).toBe(1);
+        }
+        await refreshCredentialStatus(
+          api,
+          refresh,
+          "claude",
+          env,
+          10 * CREDENTIAL_RETRY_INTERVAL_MS,
+        );
+        expect(check).toHaveBeenCalledTimes(3);
+      } finally {
+        check.mockRestore();
+        if (originalOAuth === undefined) delete process.env.CLAUDE_CODE_OAUTH_TOKEN;
+        else process.env.CLAUDE_CODE_OAUTH_TOKEN = originalOAuth;
+      }
+    });
+  }
+});

package/src/tests/oauth-access-token-tool.test.ts

@@ -23,7 +23,7 @@ const originalFetch = globalThis.fetch;
 
 const testApp = {
   clientId: "client-id",
-  clientSecret: "client-secret",
+  clientSecret: "example-client-secret",
   authorizeUrl: "https://example.com/oauth/authorize",
   tokenUrl: "https://example.com/oauth/token",
   redirectUri: "http://localhost:3013/callback",
@@ -69,8 +69,8 @@ afterAll(async () => {
 describe("resolveOAuthAccessToken", () => {
   test("registered MCP tool returns a seeded provider token", async () => {
     await storeOAuthTokens("custom-provider", {
-      accessToken: "mcp-tool-access-token-plain-value",
-      refreshToken: "mcp-tool-refresh-token",
+      accessToken: "example-mcp-tool-access-token-plain-value",
+      refreshToken: "example-mcp-tool-refresh-token",
       expiresAt: new Date(Date.now() + 3600_000).toISOString(),
     });
     const server = new McpServer({ name: "oauth-access-token-test", version: "1.0.0" });
@@ -112,7 +112,7 @@ describe("resolveOAuthAccessToken", () => {
     expect(result.structuredContent).toMatchObject({
       success: true,
       provider: "custom-provider",
-      accessToken: "mcp-tool-access-token-plain-value",
+      accessToken: "example-mcp-tool-access-token-plain-value",
       expiresAt: expect.any(String),
       tokenType: "Bearer",
     });
@@ -123,7 +123,7 @@ describe("resolveOAuthAccessToken", () => {
     // details carries the actual token payload (allowSecretEgress: true means
     // the central scrubber does not redact it, since the tool's whole purpose
     // is handing over the plaintext token).
-    expect(result.structuredContent.details).toBe("mcp-tool-access-token-plain-value");
+    expect(result.structuredContent.details).toBe("example-mcp-tool-access-token-plain-value");
 
     // content[0].text is composed as message + "\n\n" + details, so both
     // channels (text for pi/opencode/claude-managed, structuredContent for
@@ -132,7 +132,7 @@ describe("resolveOAuthAccessToken", () => {
     expect(result.content).toHaveLength(1);
     expect(result.content[0].type).toBe("text");
     expect(result.content[0].text).toBe(
-      `custom-provider OAuth access token resolved; expires at ${expiresAt}.\n\nmcp-tool-access-token-plain-value`,
+      `custom-provider OAuth access token resolved; expires at ${expiresAt}.\n\nexample-mcp-tool-access-token-plain-value`,
     );
   });
 
@@ -170,10 +170,10 @@ describe("resolveOAuthAccessToken", () => {
   });
 
   test("returns a fresh access token and registers it for scrubber redaction", async () => {
-    const accessToken = "linear-access-token-plain-value-1234567890";
+    const accessToken = "example-linear-access-token-plain-value-1234567890";
     await storeOAuthTokens("linear", {
       accessToken,
-      refreshToken: "linear-refresh-token",
+      refreshToken: "example-linear-refresh-token",
       expiresAt: new Date(Date.now() + 3600_000).toISOString(),
     });
 
@@ -192,21 +192,21 @@ describe("resolveOAuthAccessToken", () => {
 
   test("supports any configured OAuth provider slug", async () => {
     await storeOAuthTokens("custom-provider", {
-      accessToken: "custom-provider-access-token-plain-value",
-      refreshToken: "custom-provider-refresh-token",
+      accessToken: "example-custom-provider-access-token-plain-value",
+      refreshToken: "example-custom-provider-refresh-token",
       expiresAt: new Date(Date.now() + 3600_000).toISOString(),
     });
 
     const result = await resolveOAuthAccessToken("custom-provider");
 
     expect(result.provider).toBe("custom-provider");
-    expect(result.accessToken).toBe("custom-provider-access-token-plain-value");
+    expect(result.accessToken).toBe("example-custom-provider-access-token-plain-value");
   });
 
   test("refreshes Jira before returning a near-expiry token", async () => {
     await storeOAuthTokens("jira", {
-      accessToken: "old-jira-access-token",
-      refreshToken: "old-jira-refresh-token",
+      accessToken: "example-old-jira-access-token",
+      refreshToken: "example-old-jira-refresh-token",
       expiresAt: new Date(Date.now() + 60_000).toISOString(),
     });
 
@@ -214,10 +214,10 @@ describe("resolveOAuthAccessToken", () => {
       Promise.resolve(
         new Response(
           JSON.stringify({
-            access_token: "new-jira-access-token-plain-value",
+            access_token: "example-new-jira-access-token-plain-value",
             token_type: "Bearer",
             expires_in: 3600,
-            refresh_token: "new-jira-refresh-token",
+            refresh_token: "example-new-jira-refresh-token",
           }),
           { status: 200, headers: { "Content-Type": "application/json" } },
         ),
@@ -228,13 +228,13 @@ describe("resolveOAuthAccessToken", () => {
     const result = await resolveOAuthAccessToken("jira");
 
     expect(fetchSpy).toHaveBeenCalledTimes(1);
-    expect(result.accessToken).toBe("new-jira-access-token-plain-value");
-    expect((await getOAuthTokens("jira"))?.refreshToken).toBe("new-jira-refresh-token");
+    expect(result.accessToken).toBe("example-new-jira-access-token-plain-value");
+    expect((await getOAuthTokens("jira"))?.refreshToken).toBe("example-new-jira-refresh-token");
   });
 
   test("rejects a near-expiry token when no refresh token is available", async () => {
     await storeOAuthTokens("jira", {
-      accessToken: "stale-jira-access-token",
+      accessToken: "example-stale-jira-access-token",
       refreshToken: null,
       expiresAt: new Date(Date.now() + 60_000).toISOString(),
     });

package/src/tests/oauth-callback-flow.test.ts

@@ -85,10 +85,10 @@ beforeAll(async () => {
       if (url.pathname === "/token") {
         lastTokenBody = await req.text();
         return Response.json({
-          access_token: "mock-access-token",
+          access_token: "example-mock-access-token",
           token_type: "Bearer",
           expires_in: 3600,
-          refresh_token: "mock-refresh-token",
+          refresh_token: "example-mock-refresh-token",
           scope: "read write",
         });
       }
@@ -98,7 +98,7 @@ beforeAll(async () => {
         // fabricated one.
         lastTokenBody = await req.text();
         return Response.json({
-          access_token: "mock-access-token",
+          access_token: "example-mock-access-token",
           token_type: "bearer",
           scope: "read",
         });
@@ -183,8 +183,8 @@ describe("static OAuth callback + multi-authorization flow", () => {
     expect(supportAuth.accountEmail).toBe("connected@example.test");
     // Tokens are encrypted at rest but decrypt to the mock values on read.
     expect(supportAuth.tokensEncrypted).toBe(true);
-    expect(supportAuth.accessToken).toBe("mock-access-token");
-    expect(supportAuth.refreshToken).toBe("mock-refresh-token");
+    expect(supportAuth.accessToken).toBe("example-mock-access-token");
+    expect(supportAuth.refreshToken).toBe("example-mock-refresh-token");
 
     // Second label: "sales" — first authorization must be untouched.
     const sales = await buildAuthorizationUrl(config, { appId, label: "sales", flow: "generic" });
@@ -383,7 +383,7 @@ describe("static OAuth callback + multi-authorization flow", () => {
       tokenUrl: `${providerBase}/token`,
       scopes: "read",
       dcrClientId: "mcp-client",
-      dcrClientSecret: "mcp-secret",
+      dcrClientSecret: "example-mcp-secret",
       redirectUri: `${appBase}/api/oauth/callback`,
     });
 
@@ -464,7 +464,7 @@ describe("step-4 security hardening", () => {
     try {
       const identity = await captureIdentity({
         userinfoUrl: "http://127.0.0.1/userinfo",
-        accessToken: "live-bearer",
+        accessToken: "example-live-bearer",
       });
       expect(identity).toBeNull();
     } finally {
@@ -476,7 +476,7 @@ describe("step-4 security hardening", () => {
   test("captureIdentity does not follow a redirect to a private host", async () => {
     const identity = await captureIdentity({
       userinfoUrl: `${providerBase}/userinfo-redirect`,
-      accessToken: "live-bearer",
+      accessToken: "example-live-bearer",
     });
     // The 302 is not followed (redirect: manual → not .ok), so no identity.
     expect(identity).toBeNull();

package/src/tests/oauth-credential-bindings.test.ts

@@ -144,7 +144,7 @@ describe("OAuth credential bindings", () => {
 
     await upsertOAuthApp("phase2-roundtrip", testApp("phase2-roundtrip"));
     await storeOAuthTokens("phase2-roundtrip", {
-      accessToken: "roundtrip-access",
+      accessToken: "example-roundtrip-access",
       expiresAt: new Date(Date.now() + 60 * 60 * 1000).toISOString(),
     });
     const authorizationId = (await getOAuthTokens("phase2-roundtrip"))!.id;
@@ -170,8 +170,8 @@ describe("OAuth credential bindings", () => {
   test("OAuth binding resolves through the stored access token", async () => {
     await upsertOAuthApp("phase2-resolve", testApp("phase2-resolve"));
     await storeOAuthTokens("phase2-resolve", {
-      accessToken: "stored-oauth-access",
-      refreshToken: "stored-oauth-refresh",
+      accessToken: "example-stored-oauth-access",
+      refreshToken: "example-stored-oauth-refresh",
       expiresAt: new Date(Date.now() + 60 * 60 * 1000).toISOString(),
     });
     await upsertCredentialBinding({
@@ -188,7 +188,7 @@ describe("OAuth credential bindings", () => {
     expect(bindings).toContainEqual(
       expect.objectContaining({
         configKey: "PHASE2_RESOLVE_OAUTH",
-        value: "stored-oauth-access",
+        value: "example-stored-oauth-access",
       }),
     );
   });
@@ -196,8 +196,8 @@ describe("OAuth credential bindings", () => {
   test("expiring OAuth binding token is refreshed before resolution", async () => {
     await upsertOAuthApp("phase2-refresh", testApp("phase2-refresh"));
     await storeOAuthTokens("phase2-refresh", {
-      accessToken: "old-access-token",
-      refreshToken: "old-refresh-token",
+      accessToken: "example-old-access-token",
+      refreshToken: "example-old-refresh-token",
       expiresAt: new Date(Date.now() + 60 * 1000).toISOString(),
     });
     await upsertCredentialBinding({
@@ -215,13 +215,13 @@ describe("OAuth credential bindings", () => {
       }
       expect(init?.method).toBe("POST");
       expect(String(init?.body)).toContain("grant_type=refresh_token");
-      expect(String(init?.body)).toContain("refresh_token=old-refresh-token");
+      expect(String(init?.body)).toContain("refresh_token=example-old-refresh-token");
       return Promise.resolve(
         Response.json({
-          access_token: "new-access-token",
+          access_token: "example-new-access-token",
           token_type: "Bearer",
           expires_in: 3600,
-          refresh_token: "new-refresh-token",
+          refresh_token: "example-new-refresh-token",
         }),
       );
     });
@@ -233,10 +233,12 @@ describe("OAuth credential bindings", () => {
     expect(bindings).toContainEqual(
       expect.objectContaining({
         configKey: "PHASE2_REFRESH_OAUTH",
-        value: "new-access-token",
+        value: "example-new-access-token",
       }),
     );
-    expect((await getOAuthTokens("phase2-refresh"))?.refreshToken).toBe("new-refresh-token");
+    expect((await getOAuthTokens("phase2-refresh"))?.refreshToken).toBe(
+      "example-new-refresh-token",
+    );
   });
 
   test("basic tokenAuthStyle + json tokenBodyFormat reach the token endpoint (Notion-style)", async () => {
@@ -245,8 +247,8 @@ describe("OAuth credential bindings", () => {
       metadata: JSON.stringify({ tokenAuthStyle: "basic", tokenBodyFormat: "json" }),
     });
     await storeOAuthTokens("phase2-basic", {
-      accessToken: "old-basic-access",
-      refreshToken: "old-basic-refresh",
+      accessToken: "example-old-basic-access",
+      refreshToken: "example-old-basic-refresh",
       expiresAt: new Date(Date.now() + 60 * 1000).toISOString(),
     });
     await upsertCredentialBinding({
@@ -272,16 +274,16 @@ describe("OAuth credential bindings", () => {
       expect(headers.get("content-type")).toBe("application/json");
       const body = JSON.parse(String(init?.body)) as Record<string, string>;
       expect(body.grant_type).toBe("refresh_token");
-      expect(body.refresh_token).toBe("old-basic-refresh");
+      expect(body.refresh_token).toBe("example-old-basic-refresh");
       // Basic auth carries the client credentials — they must NOT be in the body
       expect(body.client_id).toBeUndefined();
       expect(body.client_secret).toBeUndefined();
       return Promise.resolve(
         Response.json({
-          access_token: "new-basic-access",
+          access_token: "example-new-basic-access",
           token_type: "Bearer",
           expires_in: 3600,
-          refresh_token: "new-basic-refresh",
+          refresh_token: "example-new-basic-refresh",
         }),
       );
     });
@@ -293,7 +295,7 @@ describe("OAuth credential bindings", () => {
     expect(bindings).toContainEqual(
       expect.objectContaining({
         configKey: "PHASE2_BASIC_OAUTH",
-        value: "new-basic-access",
+        value: "example-new-basic-access",
       }),
     );
   });
@@ -323,7 +325,7 @@ describe("OAuth credential bindings", () => {
         action: "oauth-app-upsert",
         provider: "jira",
         clientId: "jira-client",
-        clientSecret: "jira-secret",
+        clientSecret: "example-jira-secret",
         authorizeUrl: "https://oauth.example.test/authorize",
         tokenUrl: "https://oauth.example.test/token",
         scopes: [],
@@ -345,7 +347,7 @@ describe("OAuth credential bindings", () => {
         action: "oauth-app-upsert",
         provider: "phase2-tool-unsafe",
         clientId: "unsafe-client",
-        clientSecret: "unsafe-secret",
+        clientSecret: "example-unsafe-secret",
         authorizeUrl: "https://oauth.example.test/authorize",
         tokenUrl: "http://127.0.0.1/token",
         scopes: [],
@@ -362,7 +364,7 @@ describe("OAuth credential bindings", () => {
         action: "oauth-app-upsert",
         provider: "phase2-tool-safe",
         clientId: "safe-client",
-        clientSecret: "safe-secret",
+        clientSecret: "example-safe-secret",
         authorizeUrl: "https://oauth.example.test/authorize",
         tokenUrl: "https://oauth.example.test/token",
         scopes: ["read"],
@@ -377,8 +379,8 @@ describe("OAuth credential bindings", () => {
   test("failed OAuth token refresh skips only that binding, others still resolve", async () => {
     await upsertOAuthApp("phase2-broken", testApp("phase2-broken"));
     await storeOAuthTokens("phase2-broken", {
-      accessToken: "stale-access-token",
-      refreshToken: "stale-refresh-token",
+      accessToken: "example-stale-access-token",
+      refreshToken: "example-stale-refresh-token",
       expiresAt: new Date(Date.now() + 60 * 1000).toISOString(),
     });
     await upsertCredentialBinding({
@@ -419,7 +421,7 @@ describe("OAuth credential bindings", () => {
   test("revoked OAuth token skips binding resolution and list reports revoked", async () => {
     await upsertOAuthApp("phase2-missing", testApp("phase2-missing"));
     await storeOAuthTokens("phase2-missing", {
-      accessToken: "soon-deleted",
+      accessToken: "example-soon-deleted",
       expiresAt: new Date(Date.now() + 60 * 60 * 1000).toISOString(),
     });
     const authorizationId = (await getOAuthTokens("phase2-missing"))!.id;
@@ -465,10 +467,10 @@ describe("OAuth credential bindings", () => {
       expect(String(init?.body)).toContain("grant_type=authorization_code");
       expect(String(init?.body)).toContain("code=callback-code");
       return Response.json({
-        access_token: "callback-access-token",
+        access_token: "example-callback-access-token",
         token_type: "Bearer",
         expires_in: 3600,
-        refresh_token: "callback-refresh-token",
+        refresh_token: "example-callback-refresh-token",
         scope: "read write",
       });
     }) as typeof fetch;
@@ -483,8 +485,8 @@ describe("OAuth credential bindings", () => {
       expect(res.status).toBe(200);
       expect(await res.text()).toContain("You can close this tab.");
       const tokens = await getOAuthTokens(provider);
-      expect(tokens?.accessToken).toBe("callback-access-token");
-      expect(tokens?.refreshToken).toBe("callback-refresh-token");
+      expect(tokens?.accessToken).toBe("example-callback-access-token");
+      expect(tokens?.refreshToken).toBe("example-callback-refresh-token");
     } finally {
       server.close();
     }

package/src/tests/oauth-keepalive.test.ts

@@ -22,7 +22,7 @@ function restoreSlackAlertsChannel(): void {
 
 const testApp = {
   clientId: "test-client-id",
-  clientSecret: "test-client-secret",
+  clientSecret: "example-test-client-secret",
   authorizeUrl: "https://example.com/oauth/authorize",
   tokenUrl: "https://example.com/oauth/token",
   redirectUri: "http://localhost:3013/callback",
@@ -78,13 +78,13 @@ describe("OAuth keepalive", () => {
 
   test("stopOAuthKeepalive waits for in-flight Jira refresh persistence", async () => {
     await storeOAuthTokens("linear", {
-      accessToken: "linear-access",
-      refreshToken: "linear-refresh",
+      accessToken: "example-linear-access",
+      refreshToken: "example-linear-refresh",
       expiresAt: new Date(Date.now() + 60 * 60 * 1000).toISOString(),
     });
     await storeOAuthTokens("jira", {
-      accessToken: "old-jira-access",
-      refreshToken: "old-jira-refresh",
+      accessToken: "example-old-jira-access",
+      refreshToken: "example-old-jira-refresh",
       expiresAt: new Date(Date.now() + 60 * 1000).toISOString(),
     });
 
@@ -102,10 +102,10 @@ describe("OAuth keepalive", () => {
       await tokenResponseReady;
       return new Response(
         JSON.stringify({
-          access_token: "new-jira-access",
+          access_token: "example-new-jira-access",
           token_type: "Bearer",
           expires_in: 3600,
-          refresh_token: "new-jira-refresh",
+          refresh_token: "example-new-jira-refresh",
         }),
         { status: 200, headers: { "Content-Type": "application/json" } },
       );
@@ -121,7 +121,7 @@ describe("OAuth keepalive", () => {
 
     await Promise.resolve();
     expect(stopResolved).toBe(false);
-    expect((await getOAuthTokens("jira"))?.refreshToken).toBe("old-jira-refresh");
+    expect((await getOAuthTokens("jira"))?.refreshToken).toBe("example-old-jira-refresh");
 
     releaseTokenResponse();
     await stopPromise;
@@ -129,7 +129,7 @@ describe("OAuth keepalive", () => {
 
     expect(stopResolved).toBe(true);
     const tokens = await getOAuthTokens("jira");
-    expect(tokens?.accessToken).toBe("new-jira-access");
-    expect(tokens?.refreshToken).toBe("new-jira-refresh");
+    expect(tokens?.accessToken).toBe("example-new-jira-access");
+    expect(tokens?.refreshToken).toBe("example-new-jira-refresh");
   });
 });