@desplega.ai/agent-swarm 1.149.1 → 1.151.0

package/src/tests/claude-adapter-binary.test.ts

@@ -17,8 +17,8 @@
  *      `projects[cwd].hasTrustDialogAccepted: true` to `$HOME/.claude.json`
  *      before spawning. Idempotent. No-op for "claude".
  *
- * `Bun.spawn` and the synchronous binary-version probe are stubbed so the
- * tests don't actually exec anything; we read the argv off the call args.
+ * `Bun.spawn` is stubbed so the tests don't actually exec anything; we read
+ * the session argv off the call args and ignore the binary-version probe.
  * `Bun.which` is stubbed for the tmux gate so the tests don't depend on the
  * host having tmux installed. `$HOME` is redirected to a tmp dir so the
  * trust-preseed never touches the real `~/.claude.json`.
@@ -76,17 +76,6 @@ function makeFakeProc(): ReturnType<typeof Bun.spawn> {
   } as unknown as ReturnType<typeof Bun.spawn>;
 }
 
-/**
- * The adapter probes `<binary> --version` synchronously before it spawns the
- * session. Keep integration tests hermetic: a `bunx <package>` probe can do
- * package resolution and outlive Bun's per-test timeout under CI load.
- */
-function mockClaudeVersionProbe(): ReturnType<typeof spyOn> {
-  return spyOn(Bun, "spawnSync").mockImplementation((() => ({
-    success: false,
-  })) as typeof Bun.spawnSync);
-}
-
 async function createCompletedSession(adapter: ClaudeAdapter, config: ProviderSessionConfig) {
   const session = await adapter.createSession(config);
   await session.waitForCompletion();
@@ -238,7 +227,7 @@ describe("SWARM_USE_CLAUDE_BRIDGE boolean parsing", () => {
 describe("resolveClaudeBinaryArgv — claude-bridge requires an OAuth token", () => {
   test("bridge requested + OAuth token present → routes to claude-bridge", () => {
     const r = resolveClaudeBinaryArgv(
-      { SWARM_USE_CLAUDE_BRIDGE: "true", CLAUDE_CODE_OAUTH_TOKEN: "sk-ant-oat01-x" },
+      { SWARM_USE_CLAUDE_BRIDGE: "true", CLAUDE_CODE_OAUTH_TOKEN: "example-sk-ant-oat01-x" },
       {},
     );
     expect(r.useClaudeBridge).toBe(true);
@@ -248,7 +237,7 @@ describe("resolveClaudeBinaryArgv — claude-bridge requires an OAuth token", ()
 
   test("bridge requested + no OAuth (only API key) → falls back to stock claude", () => {
     const r = resolveClaudeBinaryArgv(
-      { SWARM_USE_CLAUDE_BRIDGE: "true", ANTHROPIC_API_KEY: "sk-ant-api" },
+      { SWARM_USE_CLAUDE_BRIDGE: "true", ANTHROPIC_API_KEY: "example-sk-ant-api" },
       {},
     );
     expect(r.useClaudeBridge).toBe(false);
@@ -265,7 +254,7 @@ describe("resolveClaudeBinaryArgv — claude-bridge requires an OAuth token", ()
   test("OAuth token from fallbackEnv (container env) also enables the bridge", () => {
     const r = resolveClaudeBinaryArgv(
       { SWARM_USE_CLAUDE_BRIDGE: "true" },
-      { CLAUDE_CODE_OAUTH_TOKEN: "sk-ant-oat01-fallback" },
+      { CLAUDE_CODE_OAUTH_TOKEN: "example-sk-ant-oat01-fallback" },
     );
     expect(r.useClaudeBridge).toBe(true);
     expect(r.bridgeRequestedWithoutOAuth).toBe(false);
@@ -281,7 +270,7 @@ describe("resolveClaudeBinaryArgv — claude-bridge requires an OAuth token", ()
   });
 
   test("bridge not requested → never flagged, stock claude", () => {
-    const r = resolveClaudeBinaryArgv({ CLAUDE_CODE_OAUTH_TOKEN: "sk-ant-oat01-x" }, {});
+    const r = resolveClaudeBinaryArgv({ CLAUDE_CODE_OAUTH_TOKEN: "example-sk-ant-oat01-x" }, {});
     expect(r.useClaudeBridge).toBe(false);
     expect(r.bridgeRequestedWithoutOAuth).toBe(false);
     expect(r.argv).toEqual(["claude"]);
@@ -384,7 +373,6 @@ describe("CLAUDE_BINARY env override", () => {
   let originalHome: string | undefined;
   let homeDir: string;
   let spawnSpy: ReturnType<typeof spyOn>;
-  let spawnSyncSpy: ReturnType<typeof spyOn>;
   let whichSpy: ReturnType<typeof spyOn>;
   let spawnedArgs: Array<readonly string[]>;
   let spawnedEnvs: Array<Record<string, string> | undefined>;
@@ -400,16 +388,17 @@ describe("CLAUDE_BINARY env override", () => {
     delete process.env.SWARM_USE_CLAUDE_BRIDGE;
     delete process.env.CLAUDE_QUEUE_STEERING;
     // Credential check runs before binary resolution; satisfy it.
-    process.env.CLAUDE_CODE_OAUTH_TOKEN = "test-token";
+    process.env.CLAUDE_CODE_OAUTH_TOKEN = "example-test-token";
 
     spawnedArgs = [];
     spawnedEnvs = [];
     spawnSpy = spyOn(Bun, "spawn").mockImplementation(((cmd: readonly string[], opts?: unknown) => {
-      spawnedArgs.push(cmd);
-      spawnedEnvs.push((opts as { env?: Record<string, string> } | undefined)?.env);
+      if (cmd.at(-1) !== "--version") {
+        spawnedArgs.push(cmd);
+        spawnedEnvs.push((opts as { env?: Record<string, string> } | undefined)?.env);
+      }
       return makeFakeProc();
     }) as typeof Bun.spawn);
-    spawnSyncSpy = mockClaudeVersionProbe();
 
     // Default: pretend tmux IS on PATH so non-tmux-gate tests don't trip.
     whichSpy = spyOn(Bun, "which").mockImplementation((name: string) => {
@@ -420,7 +409,6 @@ describe("CLAUDE_BINARY env override", () => {
 
   afterEach(async () => {
     spawnSpy.mockRestore();
-    spawnSyncSpy.mockRestore();
     whichSpy.mockRestore();
     await rm(homeDir, { recursive: true, force: true });
     if (originalHome === undefined) {
@@ -542,7 +530,7 @@ describe("CLAUDE_BINARY env override", () => {
       makeConfig({
         env: {
           CLAUDE_BINARY: LEGACY_BRIDGE_COMPAT_BINARY,
-          CLAUDE_CODE_OAUTH_TOKEN: "test-token",
+          CLAUDE_CODE_OAUTH_TOKEN: "example-test-token",
         } as Record<string, string>,
       }),
     );
@@ -559,7 +547,7 @@ describe("CLAUDE_BINARY env override", () => {
       makeConfig({
         env: {
           CLAUDE_BINARY: LEGACY_BRIDGE_COMPAT_COMMAND,
-          CLAUDE_CODE_OAUTH_TOKEN: "test-token",
+          CLAUDE_CODE_OAUTH_TOKEN: "example-test-token",
         } as Record<string, string>,
       }),
     );
@@ -576,7 +564,7 @@ describe("CLAUDE_BINARY env override", () => {
       adapter,
       makeConfig({
         // env has CLAUDE_CODE_OAUTH_TOKEN but no CLAUDE_BINARY → process.env wins.
-        env: { CLAUDE_CODE_OAUTH_TOKEN: "test-token" } as Record<string, string>,
+        env: { CLAUDE_CODE_OAUTH_TOKEN: "example-test-token" } as Record<string, string>,
       }),
     );
 
@@ -602,7 +590,7 @@ describe("CLAUDE_BINARY env override", () => {
     await createCompletedSession(adapter, makeConfig());
 
     expect(spawnedArgs[0][0]).toBe("claude-bridge");
-    expect(spawnedEnvs[0]?.CLAUDE_CODE_OAUTH_TOKEN).toBe("test-token");
+    expect(spawnedEnvs[0]?.CLAUDE_CODE_OAUTH_TOKEN).toBe("example-test-token");
   });
 
   test("SWARM_USE_CLAUDE_BRIDGE=true forwards Anthropic local auth through bridge flag", async () => {
@@ -612,14 +600,14 @@ describe("CLAUDE_BINARY env override", () => {
       makeConfig({
         env: {
           SWARM_USE_CLAUDE_BRIDGE: "true",
-          ANTHROPIC_API_KEY: "sk-ant-test",
+          ANTHROPIC_API_KEY: "example-sk-ant-test",
         } as Record<string, string>,
       }),
     );
 
     expect(spawnedArgs[0][0]).toBe("claude-bridge");
     expect(spawnedArgs[0]).toContain("--desplega-local-auth");
-    expect(spawnedEnvs[0]?.ANTHROPIC_API_KEY).toBe("sk-ant-test");
+    expect(spawnedEnvs[0]?.ANTHROPIC_API_KEY).toBe("example-sk-ant-test");
     expect(spawnedEnvs[0]?.CLAUDE_CODE_OAUTH_TOKEN).toBeUndefined();
   });
 
@@ -642,7 +630,7 @@ describe("CLAUDE_BINARY env override", () => {
       makeConfig({
         env: {
           SWARM_USE_CLAUDE_BRIDGE: "true",
-          CLAUDE_CODE_OAUTH_TOKEN: "test-token",
+          CLAUDE_CODE_OAUTH_TOKEN: "example-test-token",
         } as Record<string, string>,
       }),
     );
@@ -659,7 +647,7 @@ describe("CLAUDE_BINARY env override", () => {
       makeConfig({
         env: {
           SWARM_USE_CLAUDE_BRIDGE: "false",
-          CLAUDE_CODE_OAUTH_TOKEN: "test-token",
+          CLAUDE_CODE_OAUTH_TOKEN: "example-test-token",
         } as Record<string, string>,
       }),
     );
@@ -670,7 +658,7 @@ describe("CLAUDE_BINARY env override", () => {
   test("SWARM_USE_CLAUDE_BRIDGE=true without OAuth token falls back to stock claude", async () => {
     const origApiKey = process.env.ANTHROPIC_API_KEY;
     delete process.env.CLAUDE_CODE_OAUTH_TOKEN;
-    process.env.ANTHROPIC_API_KEY = "sk-ant-test";
+    process.env.ANTHROPIC_API_KEY = "example-sk-ant-test";
     process.env.SWARM_USE_CLAUDE_BRIDGE = "true";
     try {
       const adapter = new ClaudeAdapter();
@@ -695,7 +683,6 @@ describe("Claude Bridge tmux fail-fast gate", () => {
   let originalHome: string | undefined;
   let homeDir: string;
   let spawnSpy: ReturnType<typeof spyOn>;
-  let spawnSyncSpy: ReturnType<typeof spyOn>;
   let whichSpy: ReturnType<typeof spyOn>;
 
   beforeEach(async () => {
@@ -707,15 +694,13 @@ describe("Claude Bridge tmux fail-fast gate", () => {
     process.env.HOME = homeDir;
     delete process.env.CLAUDE_BINARY;
     delete process.env.SWARM_USE_CLAUDE_BRIDGE;
-    process.env.CLAUDE_CODE_OAUTH_TOKEN = "test-token";
+    process.env.CLAUDE_CODE_OAUTH_TOKEN = "example-test-token";
     spawnSpy = spyOn(Bun, "spawn").mockImplementation((() => makeFakeProc()) as typeof Bun.spawn);
-    spawnSyncSpy = mockClaudeVersionProbe();
     whichSpy = spyOn(Bun, "which");
   });
 
   afterEach(async () => {
     spawnSpy.mockRestore();
-    spawnSyncSpy.mockRestore();
     whichSpy.mockRestore();
     await rm(homeDir, { recursive: true, force: true });
     if (originalHome === undefined) {
@@ -815,7 +800,6 @@ describe("Trust pre-seed via ClaudeAdapter.createSession", () => {
   let originalHome: string | undefined;
   let homeDir: string;
   let spawnSpy: ReturnType<typeof spyOn>;
-  let spawnSyncSpy: ReturnType<typeof spyOn>;
   let whichSpy: ReturnType<typeof spyOn>;
 
   beforeEach(async () => {
@@ -827,9 +811,8 @@ describe("Trust pre-seed via ClaudeAdapter.createSession", () => {
     process.env.HOME = homeDir;
     delete process.env.CLAUDE_BINARY;
     delete process.env.SWARM_USE_CLAUDE_BRIDGE;
-    process.env.CLAUDE_CODE_OAUTH_TOKEN = "test-token";
+    process.env.CLAUDE_CODE_OAUTH_TOKEN = "example-test-token";
     spawnSpy = spyOn(Bun, "spawn").mockImplementation((() => makeFakeProc()) as typeof Bun.spawn);
-    spawnSyncSpy = mockClaudeVersionProbe();
     whichSpy = spyOn(Bun, "which").mockImplementation((name: string) => {
       if (name === "tmux") return "/usr/bin/tmux";
       return null;
@@ -838,7 +821,6 @@ describe("Trust pre-seed via ClaudeAdapter.createSession", () => {
 
   afterEach(async () => {
     spawnSpy.mockRestore();
-    spawnSyncSpy.mockRestore();
     whichSpy.mockRestore();
     await rm(homeDir, { recursive: true, force: true });
     if (originalHome === undefined) {

package/src/tests/claude-adapter-otel.test.ts

@@ -228,10 +228,12 @@ describe("ClaudeSession spawn env — SWARM_ENABLE_CLAUDE_CODE_OTEL", () => {
   beforeEach(() => {
     spawnedEnvs = [];
     spawnSpy = spyOn(Bun, "spawn").mockImplementation(((
-      _cmd: readonly string[],
+      cmd: readonly string[],
       opts?: { env?: Record<string, string> },
     ) => {
-      spawnedEnvs.push(opts?.env);
+      if (cmd.at(-1) !== "--version") {
+        spawnedEnvs.push(opts?.env);
+      }
       return makeFakeProc();
     }) as typeof Bun.spawn);
     getActiveSpanSpy = spyOn(trace, "getActiveSpan").mockReturnValue(makeSpan());
@@ -246,7 +248,7 @@ describe("ClaudeSession spawn env — SWARM_ENABLE_CLAUDE_CODE_OTEL", () => {
     const adapter = new ClaudeAdapter();
     await adapter.createSession(
       makeConfig({
-        env: { SWARM_ENABLE_CLAUDE_CODE_OTEL: "1", CLAUDE_CODE_OAUTH_TOKEN: "test-token" },
+        env: { SWARM_ENABLE_CLAUDE_CODE_OTEL: "1", CLAUDE_CODE_OAUTH_TOKEN: "example-test-token" },
       }),
     );
 
@@ -261,7 +263,9 @@ describe("ClaudeSession spawn env — SWARM_ENABLE_CLAUDE_CODE_OTEL", () => {
 
   test("gate unset → spawn env carries NO TRACEPARENT (behavior unchanged)", async () => {
     const adapter = new ClaudeAdapter();
-    await adapter.createSession(makeConfig({ env: { CLAUDE_CODE_OAUTH_TOKEN: "test-token" } }));
+    await adapter.createSession(
+      makeConfig({ env: { CLAUDE_CODE_OAUTH_TOKEN: "example-test-token" } }),
+    );
 
     expect(spawnedEnvs).toHaveLength(1);
     const env = spawnedEnvs[0];
@@ -269,12 +273,14 @@ describe("ClaudeSession spawn env — SWARM_ENABLE_CLAUDE_CODE_OTEL", () => {
     expect(env?.OTEL_LOG_USER_PROMPTS).toBeUndefined();
     // Existing env wiring is untouched.
     expect(env?.ENABLE_PROMPT_CACHING_1H).toBe("1");
-    expect(env?.CLAUDE_CODE_OAUTH_TOKEN).toBe("test-token");
+    expect(env?.CLAUDE_CODE_OAUTH_TOKEN).toBe("example-test-token");
   });
 
   test("spawn env carries Claude Code runtime guardrails", async () => {
     const adapter = new ClaudeAdapter();
-    await adapter.createSession(makeConfig({ env: { CLAUDE_CODE_OAUTH_TOKEN: "test-token" } }));
+    await adapter.createSession(
+      makeConfig({ env: { CLAUDE_CODE_OAUTH_TOKEN: "example-test-token" } }),
+    );
 
     expect(spawnedEnvs).toHaveLength(1);
     const env = spawnedEnvs[0];
@@ -294,7 +300,7 @@ describe("ClaudeSession spawn env — SWARM_ENABLE_CLAUDE_CODE_OTEL", () => {
     await adapter.createSession(
       makeConfig({
         env: {
-          CLAUDE_CODE_OAUTH_TOKEN: "test-token",
+          CLAUDE_CODE_OAUTH_TOKEN: "example-test-token",
           CLAUDE_CODE_ENABLE_TELEMETRY: "1",
           OTEL_EXPORTER_OTLP_ENDPOINT: "https://otel.example.test",
         },

package/src/tests/claude-adapter.test.ts

@@ -16,7 +16,7 @@ function makeConfig(overrides: Partial<ProviderSessionConfig> = {}): ProviderSes
     agentId: "test-agent-id",
     taskId: "test-task-id",
     apiUrl: "http://localhost:3013",
-    apiKey: "test-key",
+    apiKey: "example-test-key",
     cwd: "/tmp",
     logFile: "/tmp/test-claude-adapter.jsonl",
     ...overrides,
@@ -95,15 +95,17 @@ describe("ClaudeSession spawn env — reasoning_effort", () => {
   // MAX_THINKING_TOKENS) would leak through and pollute the `toBeUndefined()`
   // assertions. Passing an explicit, minimal `env` sidesteps both — deterministic
   // regardless of the ambient process env the test happens to run in.
-  const CLEAN_ENV: Record<string, string> = { CLAUDE_CODE_OAUTH_TOKEN: "test-oauth-token" };
+  const CLEAN_ENV: Record<string, string> = { CLAUDE_CODE_OAUTH_TOKEN: "example-test-oauth-token" };
 
   beforeEach(() => {
     spawnedEnvs = [];
     spawnSpy = spyOn(Bun, "spawn").mockImplementation(((
-      _cmd: readonly string[],
+      cmd: readonly string[],
       opts?: { env?: Record<string, string> },
     ) => {
-      spawnedEnvs.push(opts?.env);
+      if (cmd.at(-1) !== "--version") {
+        spawnedEnvs.push(opts?.env);
+      }
       return makeFakeProc();
     }) as typeof Bun.spawn);
   });
@@ -195,7 +197,7 @@ describe("Claude stream-json event parsing", () => {
 // regression here is caught instead of silently shipping the wrong text.
 describe("ClaudeSession processStreams — ProviderResult.output capture", () => {
   let spawnSpy: ReturnType<typeof spyOn>;
-  const CLEAN_ENV: Record<string, string> = { CLAUDE_CODE_OAUTH_TOKEN: "test-oauth-token" };
+  const CLEAN_ENV: Record<string, string> = { CLAUDE_CODE_OAUTH_TOKEN: "example-test-oauth-token" };
 
   /** Fake Bun.Subprocess whose stdout streams the given NDJSON lines, then closes. */
   function makeStreamingFakeProc(lines: string[]): ReturnType<typeof Bun.spawn> {
@@ -285,7 +287,7 @@ describe("ClaudeSession processStreams — ProviderResult.output capture", () =>
     expect(summaryOpts!.transcript).toContain('Tool[Read] started: {"file_path":"/tmp/source.ts"}');
     expect(summaryOpts!.transcript).toContain("Tool result: export const value = 1");
     expect(summaryOpts!.transcriptPath).toBeUndefined();
-    expect(summaryOpts!.env?.CLAUDE_CODE_OAUTH_TOKEN).toBe("test-oauth-token");
+    expect(summaryOpts!.env?.CLAUDE_CODE_OAUTH_TOKEN).toBe("example-test-oauth-token");
     expect(summaryOpts!.env?.AGENT_SWARM_TASK_ID).toBe("test-task-id");
   });
 

package/src/tests/claude-hook-credentials.test.ts

@@ -60,9 +60,9 @@ for (const transport of ["cli", "sdk"] as const) {
             CLAUDECODE: "",
             CONTEXT_MODE_DISABLED: "true",
             // Synthetic values ensure this probe cannot authenticate or incur model charges.
-            CLAUDE_CODE_OAUTH_TOKEN: "synthetic-not-an-oauth-token",
-            ANTHROPIC_API_KEY: "synthetic-not-an-api-key",
-            AGENT_SWARM_CLAUDE_OAUTH_TOKEN: "synthetic-legacy-mirror",
+            CLAUDE_CODE_OAUTH_TOKEN: "example-synthetic-not-an-oauth-token",
+            ANTHROPIC_API_KEY: "example-synthetic-not-an-api-key",
+            AGENT_SWARM_CLAUDE_OAUTH_TOKEN: "example-synthetic-legacy-mirror",
           },
         });
         abortTimer = setTimeout(() => void session?.abort("hook probe timeout"), 20_000);

package/src/tests/claude-managed-adapter.test.ts

@@ -733,7 +733,7 @@ describe("ClaudeManagedAdapter (Phase 4) — repo provisioning + cost data", ()
   });
 
   test("createSession includes resources[github_repository] when config.vcsRepo is set", async () => {
-    process.env.MANAGED_GITHUB_TOKEN = "ghp_test_pat";
+    process.env.MANAGED_GITHUB_TOKEN = "example-ghp_test_pat";
     const events: Array<Record<string, unknown>> = [
       {
         type: "session.status_idle",
@@ -764,7 +764,7 @@ describe("ClaudeManagedAdapter (Phase 4) — repo provisioning + cost data", ()
     const repo = resources![0]!;
     expect(repo.type).toBe("github_repository");
     expect(repo.url).toBe("https://github.com/desplega-ai/agent-swarm");
-    expect(repo.authorization_token).toBe("ghp_test_pat");
+    expect(repo.authorization_token).toBe("example-ghp_test_pat");
     const checkout = repo.checkout as Record<string, unknown> | undefined;
     expect(checkout?.type).toBe("branch");
     expect(checkout?.name).toBe("main");
@@ -1126,7 +1126,7 @@ describe("ClaudeManagedAdapter (Phase 5) — cancellation + tool-loop detection"
         logFile: join(tmpLogDir, "cancel-poll.log"),
         // Provide the API context so the swarm-event handler attaches.
         apiUrl: "http://test-api",
-        apiKey: "test-key",
+        apiKey: "example-test-key",
         taskId,
       }),
     );
@@ -1224,7 +1224,7 @@ describe("ClaudeManagedAdapter (Phase 5) — cancellation + tool-loop detection"
         tConfig({
           logFile: join(tmpLogDir, "tool-loop.log"),
           apiUrl: "http://test-api",
-          apiKey: "test-key",
+          apiKey: "example-test-key",
           taskId,
         }),
       );

package/src/tests/claude-managed-setup.test.ts

@@ -295,7 +295,7 @@ describe("resolveClaudeManagedSetupConfig", () => {
   test("rejects http:// MCP_BASE_URL fail-fast", async () => {
     await expect(
       resolveClaudeManagedSetupConfig([], {
-        env: { ANTHROPIC_API_KEY: "sk-ant-x", MCP_BASE_URL: "http://insecure.local" },
+        env: { ANTHROPIC_API_KEY: "example-sk-ant-x", MCP_BASE_URL: "http://insecure.local" },
         isInteractive: false,
       }),
     ).rejects.toThrow(/must start with https/);
@@ -304,7 +304,7 @@ describe("resolveClaudeManagedSetupConfig", () => {
   test("rejects missing MCP_BASE_URL", async () => {
     await expect(
       resolveClaudeManagedSetupConfig([], {
-        env: { ANTHROPIC_API_KEY: "sk-ant-x" },
+        env: { ANTHROPIC_API_KEY: "example-sk-ant-x" },
         isInteractive: false,
       }),
     ).rejects.toThrow(/MCP_BASE_URL is not set/);
@@ -313,7 +313,7 @@ describe("resolveClaudeManagedSetupConfig", () => {
   test("--force flag is parsed", async () => {
     const result = await resolveClaudeManagedSetupConfig(["--force"], {
       env: {
-        ANTHROPIC_API_KEY: "sk-ant-x",
+        ANTHROPIC_API_KEY: "example-sk-ant-x",
         MCP_BASE_URL: "https://example.com",
       },
       isInteractive: false,

package/src/tests/claude-sdk-lifecycle.test.ts

@@ -33,7 +33,7 @@ function config(
     logFile: join(directory, `${mode}.jsonl`),
     env: {
       PATH: process.env.PATH ?? "/usr/bin:/bin",
-      CLAUDE_CODE_OAUTH_TOKEN: "fixture-oauth-token",
+      CLAUDE_CODE_OAUTH_TOKEN: "example-fixture-oauth-token",
       CLAUDE_TRANSPORT: "sdk",
       CLAUDE_QUEUE_STEERING: "1",
       CLAUDE_BINARY: `${process.execPath} ${fixturePath}`,

package/src/tests/claude-sdk-transport.test.ts

@@ -24,16 +24,16 @@ describe("Claude hook credential boundary", () => {
     for (const transport of ["cli", "sdk"]) {
       const sourceEnv = {
         CLAUDE_TRANSPORT: transport,
-        CLAUDE_CODE_OAUTH_TOKEN: "fixture-selected-oauth",
-        ANTHROPIC_API_KEY: "fixture-selected-api",
-        AGENT_SWARM_CLAUDE_OAUTH_TOKEN: "fixture-stale-mirror",
+        CLAUDE_CODE_OAUTH_TOKEN: "example-fixture-selected-oauth",
+        ANTHROPIC_API_KEY: "example-fixture-selected-api",
+        AGENT_SWARM_CLAUDE_OAUTH_TOKEN: "example-fixture-stale-mirror",
       };
       const config = {
         taskId: crypto.randomUUID(),
         agentId: crypto.randomUUID(),
         env: sourceEnv,
         apiUrl: "http://fixture.invalid",
-        apiKey: "fixture-swarm-key",
+        apiKey: "example-fixture-swarm-key",
       } as ProviderSessionConfig;
       const { env } = buildClaudeSessionEnvironment(
         config,
@@ -43,7 +43,7 @@ describe("Claude hook credential boundary", () => {
       expect(env.AGENT_SWARM_CLAUDE_OAUTH_TOKEN).toBeUndefined();
       expect(env.CLAUDE_CODE_OAUTH_TOKEN).toBe(sourceEnv.CLAUDE_CODE_OAUTH_TOKEN);
       expect(env.ANTHROPIC_API_KEY).toBe(sourceEnv.ANTHROPIC_API_KEY);
-      expect(sourceEnv.AGENT_SWARM_CLAUDE_OAUTH_TOKEN).toBe("fixture-stale-mirror");
+      expect(sourceEnv.AGENT_SWARM_CLAUDE_OAUTH_TOKEN).toBe("example-fixture-stale-mirror");
       let summaryEnv: NodeJS.ProcessEnv | undefined;
       await runClaudeSessionSummary(
         config,
@@ -91,7 +91,7 @@ describe("Claude transport resolution", () => {
     expect(
       isClaudeBridgeEffective(
         { SWARM_USE_CLAUDE_BRIDGE: "true", CLAUDE_CODE_OAUTH_TOKEN: "" },
-        { CLAUDE_CODE_OAUTH_TOKEN: "fallback" },
+        { CLAUDE_CODE_OAUTH_TOKEN: "example-fallback" },
       ),
     ).toBeFalse();
   });

package/src/tests/claude-stop-hook.test.ts

@@ -104,7 +104,7 @@ function makeEnv(extra: NodeJS.ProcessEnv = {}): NodeJS.ProcessEnv {
   // selectively via `extra`.
   return {
     MCP_BASE_URL: "http://localhost:3013",
-    API_KEY: "test-key",
+    API_KEY: "example-test-key",
     AGENT_SWARM_TASK_ID: "task-stop-1",
     ...extra,
   };
@@ -129,8 +129,8 @@ describe("runStopHookSessionSummary", () => {
       } as unknown as ReturnType<typeof Bun.spawn>;
     }) as typeof Bun.spawn;
     const env = makeEnv({
-      CLAUDE_CODE_OAUTH_TOKEN: "test-oauth-token",
-      AGENT_SWARM_CLAUDE_OAUTH_TOKEN: "test-oauth-token",
+      CLAUDE_CODE_OAUTH_TOKEN: "example-test-oauth-token",
+      AGENT_SWARM_CLAUDE_OAUTH_TOKEN: "example-test-oauth-token",
     });
 
     await runStopHookSessionSummarySubprocess(
@@ -152,10 +152,10 @@ describe("runStopHookSessionSummary", () => {
       "session-summary-stdin",
     ]);
     expect((spawnOptions as { env?: NodeJS.ProcessEnv }).env?.CLAUDE_CODE_OAUTH_TOKEN).toBe(
-      "test-oauth-token",
+      "example-test-oauth-token",
     );
     expect((spawnOptions as { env?: NodeJS.ProcessEnv }).env?.AGENT_SWARM_CLAUDE_OAUTH_TOKEN).toBe(
-      "test-oauth-token",
+      "example-test-oauth-token",
     );
     expect(JSON.parse(stdinPayload)).toEqual({
       agentId: "agent-claude-memory",
@@ -232,7 +232,7 @@ describe("runStopHookSessionSummary", () => {
     expect(lastRunSummarizeArgs!.taskContext.sourceTaskId).toBe("task-stop-1");
     expect(lastRunSummarizeArgs!.taskContext.agentId).toBe("agent-claude-1");
     expect(lastRunSummarizeArgs!.apiUrl).toBe("http://localhost:3013");
-    expect(lastRunSummarizeArgs!.apiKey).toBe("test-key");
+    expect(lastRunSummarizeArgs!.apiKey).toBe("example-test-key");
 
     const indexCalls = fetchCalls.filter((c) => c.url.endsWith("/api/memory/index"));
     expect(indexCalls.length).toBe(1);
@@ -248,7 +248,7 @@ describe("runStopHookSessionSummary", () => {
     // Headers match the old runMemoryRater POST: Bearer + X-Agent-ID.
     const headers = indexCalls[0]!.init?.headers as Record<string, string>;
     expect(headers["Content-Type"]).toBe("application/json");
-    expect(headers.Authorization).toBe("Bearer test-key");
+    expect(headers.Authorization).toBe("Bearer example-test-key");
     expect(headers["X-Agent-ID"]).toBe("agent-claude-1");
 
     expect(consoleErrors.length).toBe(0);
@@ -320,7 +320,7 @@ describe("runStopHookSessionSummary", () => {
           transcriptPath,
           env: makeEnv({
             // Mirror the process env into the SUT-scoped env for SKIP / MCP_BASE_URL plumbing.
-            CLAUDE_CODE_OAUTH_TOKEN: "sk-test-oauth-stop-hook",
+            CLAUDE_CODE_OAUTH_TOKEN: "example-sk-test-oauth-stop-hook",
           }),
         },
         deps,

package/src/tests/claude-worker-parity.test.ts

@@ -19,7 +19,7 @@ const ROTATION_AGENT_ID = "1a444444-4444-4444-8444-444444444444";
 const FIXTURE_SUMMARY =
   "The worker fixture completed a transport parity task with durable evidence.";
 const FIXTURE_OAUTH = "synthetic-fixture-oauth-token";
-const FIXTURE_API_KEY = "synthetic-fixture-anthropic-api-key";
+const FIXTURE_API_KEY = "example-synthetic-fixture-anthropic-api-key";
 const ROTATION_OAUTH_POOL = ["synthetic-rotation-oauth-oa001", "synthetic-rotation-oauth-oa002"];
 const ROTATION_API_POOL = ["synthetic-rotation-api-ap001", "synthetic-rotation-api-ap002"];
 
@@ -260,7 +260,7 @@ async function runTransport(transport: "cli" | "sdk", agentId: string): Promise<
     CLAUDE_BINARY: fixturePath,
     CLAUDE_CODE_OAUTH_TOKEN: FIXTURE_OAUTH,
     ANTHROPIC_API_KEY: FIXTURE_API_KEY,
-    OPENROUTER_API_KEY: "synthetic-fixture-openrouter-key",
+    OPENROUTER_API_KEY: "example-synthetic-fixture-openrouter-key",
     OPENROUTER_BASE_URL: `http://127.0.0.1:${openRouterMock.port}`,
     CRED_CHECK_DISABLE: "1",
     CLAUDE_QUEUE_STEERING: "0",
@@ -401,7 +401,7 @@ async function runCredentialRotation(): Promise<void> {
     CLAUDE_FIXTURE_OBSERVATION_FILE: observationFile,
     CLAUDE_CODE_OAUTH_TOKEN: ROTATION_OAUTH_POOL.join(","),
     ANTHROPIC_API_KEY: ROTATION_API_POOL.join(","),
-    OPENROUTER_API_KEY: "synthetic-fixture-openrouter-key",
+    OPENROUTER_API_KEY: "example-synthetic-fixture-openrouter-key",
     OPENROUTER_BASE_URL: `http://127.0.0.1:${openRouterMock.port}`,
     CRED_CHECK_DISABLE: "1",
     CLAUDE_QUEUE_STEERING: "0",

package/src/tests/codex-adapter-pool-auth-revalidate.test.ts

@@ -43,7 +43,7 @@ import type { ProviderEvent, ProviderSessionConfig } from "../providers/types.js
 
 const TEST_DB_PATH = "./test-codex-adapter-pool-auth-revalidate.sqlite";
 const MOCK_API_URL = "http://localhost:3013";
-const MOCK_API_KEY = "test-api-key";
+const MOCK_API_KEY = "example-test-api-key";
 const FAKE_HOME = "/home/fake-pool-worker";
 
 process.env.SECRETS_ENCRYPTION_KEY = Buffer.alloc(32, 4).toString("base64");
@@ -385,9 +385,9 @@ describe("resolveCodexAuthMode — pool path revalidates through the lock", () =
       auth_mode: "chatgpt",
       OPENAI_API_KEY: null,
       tokens: {
-        id_token: "at_local",
-        access_token: "at_local",
-        refresh_token: "rt_local",
+        id_token: "example-at_local",
+        access_token: "example-at_local",
+        refresh_token: "example-rt_local",
         account_id: "acc-local",
       },
       last_refresh: new Date().toISOString(),
@@ -487,7 +487,7 @@ describe("resolveCodexAuthMode — pool path revalidates through the lock", () =
 
     const existingAuthJson = JSON.stringify({
       auth_mode: "api-key",
-      OPENAI_API_KEY: "sk-local",
+      OPENAI_API_KEY: "example-sk-local",
     });
     const { fs, homedir, readCurrent } = fakeAuthJsonFs(existingAuthJson);
     const events: ProviderEvent[] = [];

package/src/tests/codex-adapter.test.ts

@@ -448,7 +448,7 @@ describe("Codex app-server session", () => {
             item: {
               type: "agentMessage",
               id: "secret-message",
-              text: "Authorization: Bearer sk-proj-abcdefghijklmnopqrstuvwxyz012345",
+              text: "Authorization: Bearer example-sk-proj-abcdefghijklmnopqrstuvwxyz012345",
             },
           });
         });
@@ -478,7 +478,9 @@ describe("Codex app-server session", () => {
 
     expect(requests).toContain("turn/interrupt");
     expect(result).toMatchObject({ exitCode: 130, failureReason: "operator cancelled" });
-    expect(JSON.stringify(emitted)).not.toContain("sk-proj-abcdefghijklmnopqrstuvwxyz012345");
+    expect(JSON.stringify(emitted)).not.toContain(
+      "example-sk-proj-abcdefghijklmnopqrstuvwxyz012345",
+    );
   });
 
   test("closes queue delivery before the final result event", async () => {
@@ -1434,7 +1436,7 @@ describe("buildCodexConfig", () => {
       agentId: "agent-mcp-test",
       taskId: "task-mcp-test",
       apiUrl: "http://test.invalid",
-      apiKey: "test-key",
+      apiKey: "example-test-key",
       cwd: "",
       logFile: `/tmp/codex-mcp-test-${Date.now()}-${Math.random().toString(36).slice(2)}.log`,
       ...overrides,
@@ -1463,7 +1465,7 @@ describe("buildCodexConfig", () => {
     expect(Object.keys(mcp)).toEqual(["agent-swarm"]);
     expect(mcp["agent-swarm"]?.url).toBe("http://test.invalid/mcp");
     const headers = mcp["agent-swarm"]?.http_headers as Record<string, string>;
-    expect(headers.Authorization).toBe("Bearer test-key");
+    expect(headers.Authorization).toBe("Bearer example-test-key");
     expect(headers["X-Agent-ID"]).toBe("agent-mcp-test");
     expect(headers["X-Source-Task-Id"]).toBe("task-mcp-test");
     expect(mcp["agent-swarm"]?.enabled).toBe(true);
@@ -1748,7 +1750,7 @@ describe("buildCodexConfig — context-mode + features", () => {
       agentId: "agent-mcp-test",
       taskId: "task-mcp-test",
       apiUrl: "http://test.invalid",
-      apiKey: "test-key",
+      apiKey: "example-test-key",
       cwd: "",
       logFile: `/tmp/codex-ctx-test-${Date.now()}-${Math.random().toString(36).slice(2)}.log`,
       ...overrides,

package/src/tests/codex-app-server.test.ts

@@ -152,7 +152,7 @@ describe("CodexAppServer", () => {
   test(
     "scrubs stderr before callbacks and process-exit errors",
     async () => {
-      const secret = "sk-abcdefghijklmnopqrstuvwx";
+      const secret = "example-sk-abcdefghijklmnopqrstuvwx";
       const stderr: string[] = [];
       const server = new CodexAppServer({
         codexPath: FIXTURE,
@@ -163,7 +163,7 @@ describe("CodexAppServer", () => {
       const error = await server.request("exit").catch((caught) => caught as Error);
       expect(error.message).toContain("exited with code 7");
       expect(error.message).not.toContain(secret);
-      expect(stderr).toEqual(["[REDACTED:sk_key]"]);
+      expect(stderr).toEqual(["example-[REDACTED:sk_key]"]);
       await server.close();
     },
     CHILD_PROCESS_TEST_BUDGET_MS,