@desplega.ai/agent-swarm 1.149.1 → 1.151.0

package/src/tests/codex-login.test.ts

@@ -28,7 +28,7 @@ describe("resolveCodexLoginConfig", () => {
 
   it("prompts for api url and api key in interactive mode", async () => {
     const promptText = mock(async () => "https://swarm.example.com");
-    const promptSecret = mock(async () => "super-secret");
+    const promptSecret = mock(async () => "example-super-secret");
 
     const result = await resolveCodexLoginConfig([], {
       env: {},
@@ -39,7 +39,7 @@ describe("resolveCodexLoginConfig", () => {
 
     expect(result).toEqual({
       apiUrl: "https://swarm.example.com",
-      apiKey: "super-secret",
+      apiKey: "example-super-secret",
     });
     expect(promptText).toHaveBeenCalledWith("Swarm API URL", "http://localhost:3013");
     expect(promptSecret).toHaveBeenCalledWith(
@@ -56,7 +56,7 @@ describe("resolveCodexLoginConfig", () => {
     const result = await resolveCodexLoginConfig([], {
       env: {
         MCP_BASE_URL: "https://env.example.com",
-        API_KEY: "env-secret",
+        API_KEY: "example-env-secret",
       },
       isInteractive: true,
       promptText,
@@ -65,11 +65,11 @@ describe("resolveCodexLoginConfig", () => {
 
     expect(result).toEqual({
       apiUrl: "https://env.example.com",
-      apiKey: "env-secret",
+      apiKey: "example-env-secret",
     });
     expect(promptSecret).toHaveBeenCalledWith(
       "Swarm API key",
-      "env-secret",
+      "example-env-secret",
       "Press Enter to use AGENT_SWARM_API_KEY/API_KEY from the environment",
     );
   });
@@ -83,11 +83,11 @@ describe("resolveCodexLoginConfig", () => {
     });
 
     const result = await resolveCodexLoginConfig(
-      ["--api-url", "https://flag.example.com", "--api-key", "flag-secret"],
+      ["--api-url", "https://flag.example.com", "--api-key", "example-flag-secret"],
       {
         env: {
           MCP_BASE_URL: "https://env.example.com",
-          API_KEY: "env-secret",
+          API_KEY: "example-env-secret",
         },
         isInteractive: true,
         promptText,
@@ -97,7 +97,7 @@ describe("resolveCodexLoginConfig", () => {
 
     expect(result).toEqual({
       apiUrl: "https://flag.example.com",
-      apiKey: "flag-secret",
+      apiKey: "example-flag-secret",
     });
     expect(promptText).not.toHaveBeenCalled();
     expect(promptSecret).not.toHaveBeenCalled();
@@ -107,7 +107,7 @@ describe("resolveCodexLoginConfig", () => {
     const promptText = mock(async () => {
       throw new Error("should not prompt for api url");
     });
-    const promptSecret = mock(async () => "prompted-secret");
+    const promptSecret = mock(async () => "example-prompted-secret");
 
     const result = await resolveCodexLoginConfig(["--api-url", "https://flag.example.com"], {
       env: {},
@@ -118,7 +118,7 @@ describe("resolveCodexLoginConfig", () => {
 
     expect(result).toEqual({
       apiUrl: "https://flag.example.com",
-      apiKey: "prompted-secret",
+      apiKey: "example-prompted-secret",
     });
     expect(promptText).not.toHaveBeenCalled();
     expect(promptSecret).toHaveBeenCalledTimes(1);
@@ -186,7 +186,7 @@ describe("runCodexLogin", () => {
     await runCodexLogin([], {
       resolveConfig: async () => ({
         apiUrl: "http://localhost:3013",
-        apiKey: "test-key",
+        apiKey: "example-test-key",
         slot: 3,
       }),
       login: mock(async () => ({
@@ -214,7 +214,7 @@ describe("runCodexLogin", () => {
     await runCodexLogin([], {
       resolveConfig: async () => ({
         apiUrl: "http://localhost:3013",
-        apiKey: "test-key",
+        apiKey: "example-test-key",
         slot: undefined,
       }),
       login: mock(async () => ({
@@ -245,7 +245,7 @@ describe("runCodexLogin", () => {
     await runCodexLogin([], {
       resolveConfig: async () => ({
         apiUrl: "http://localhost:3013",
-        apiKey: "test-key",
+        apiKey: "example-test-key",
         slot: 101,
       }),
       login: mock(async () => {
@@ -274,7 +274,7 @@ describe("runCodexLogin", () => {
     await runCodexLogin([], {
       resolveConfig: async () => ({
         apiUrl: "http://localhost:3013",
-        apiKey: "test-key",
+        apiKey: "example-test-key",
         slot: 10,
       }),
       login: mock(async () => ({
@@ -306,7 +306,7 @@ describe("runCodexLogin", () => {
     await runCodexLogin([], {
       resolveConfig: async () => ({
         apiUrl: "http://localhost:3013",
-        apiKey: "test-key",
+        apiKey: "example-test-key",
         slot: undefined,
       }),
       login: mock(async () => {

package/src/tests/codex-oauth-credential-info.test.ts

@@ -31,7 +31,7 @@ import { join } from "node:path";
 import { resolveCodexOAuthCredentialInfo } from "../commands/runner";
 
 const MOCK_API_URL = "http://localhost:3013";
-const MOCK_API_KEY = "test-api-key";
+const MOCK_API_KEY = "example-test-api-key";
 
 const originalFetch = globalThis.fetch;
 const originalHome = process.env.HOME;
@@ -65,9 +65,9 @@ async function writeStandaloneAuthJson(): Promise<void> {
       auth_mode: "chatgpt",
       OPENAI_API_KEY: null,
       tokens: {
-        id_token: "id-standalone",
-        access_token: "access-standalone",
-        refresh_token: "refresh-standalone",
+        id_token: "example-id-standalone",
+        access_token: "example-access-standalone",
+        refresh_token: "example-refresh-standalone",
         account_id: "acct-standalone",
       },
       last_refresh: new Date().toISOString(),

package/src/tests/codex-oauth-keep-warm.test.ts

@@ -24,7 +24,7 @@ const originalApiKey = process.env.AGENT_SWARM_API_KEY;
 
 beforeAll(async () => {
   initDb(TEST_DB_PATH);
-  process.env.AGENT_SWARM_API_KEY = "test-api-key";
+  process.env.AGENT_SWARM_API_KEY = "example-test-api-key";
 
   lockServer = createServer((req, res) => {
     const url = new URL(req.url ?? "/", "http://internal");
@@ -159,8 +159,8 @@ describe("POST /api/oauth/keep-warm/codex", () => {
     setFetchForTesting(async () => {
       return new Response(
         JSON.stringify({
-          access_token: "at_keepwarm",
-          refresh_token: "rt_keepwarm",
+          access_token: "example-at_keepwarm",
+          refresh_token: "example-rt_keepwarm",
           expires_in: 864000,
         }),
         { status: 200, headers: { "Content-Type": "application/json" } },
@@ -173,7 +173,7 @@ describe("POST /api/oauth/keep-warm/codex", () => {
     const body = JSON.parse(captured.body) as { results: Array<Record<string, unknown>> };
     expect(body.results).toHaveLength(1);
     expect(body.results[0]).toMatchObject({ slot: 1, outcome: "refreshed" });
-    expect(slots.get(1)?.access).toBe("at_keepwarm");
+    expect(slots.get(1)?.access).toBe("example-at_keepwarm");
   });
 
   it("skips a slot with an active codex-auth-watch bench marker", async () => {

package/src/tests/codex-oauth-refresh-lock.test.ts

@@ -31,7 +31,7 @@ import type { CodexOAuthCredentials } from "../providers/codex-oauth/types.js";
 
 const TEST_DB_PATH = "./test-codex-oauth-refresh-lock.sqlite";
 const MOCK_API_URL = "http://localhost:3013";
-const MOCK_API_KEY = "test-api-key";
+const MOCK_API_KEY = "example-test-api-key";
 
 process.env.SECRETS_ENCRYPTION_KEY = Buffer.alloc(32, 3).toString("base64");
 

package/src/tests/codex-oauth-storage.test.ts

@@ -12,7 +12,7 @@ import {
 import type { CodexOAuthCredentials } from "../providers/codex-oauth/types.js";
 
 const MOCK_API_URL = "http://localhost:3013";
-const MOCK_API_KEY = "test-api-key";
+const MOCK_API_KEY = "example-test-api-key";
 
 const mockCreds: CodexOAuthCredentials = {
   access: "at_test123",
@@ -500,8 +500,8 @@ describe("getValidCodexOAuth", () => {
       async () =>
         new Response(
           JSON.stringify({
-            access_token: "at_refreshed",
-            refresh_token: "rt_refreshed",
+            access_token: "example-at_refreshed",
+            refresh_token: "example-rt_refreshed",
             expires_in: 3600,
           }),
           { status: 200 },
@@ -509,7 +509,7 @@ describe("getValidCodexOAuth", () => {
     );
 
     const result = await getValidCodexOAuth(MOCK_API_URL, MOCK_API_KEY, 0);
-    expect(result?.access).toBe("at_refreshed");
+    expect(result?.access).toBe("example-at_refreshed");
     expect(putCapturedKey).toBe("codex_oauth_0");
   });
 
@@ -601,8 +601,8 @@ describe("getValidCodexOAuth", () => {
       async () =>
         new Response(
           JSON.stringify({
-            access_token: "at_keepwarm_refreshed",
-            refresh_token: "rt_keepwarm_refreshed",
+            access_token: "example-at_keepwarm_refreshed",
+            refresh_token: "example-rt_keepwarm_refreshed",
             expires_in: 3600,
           }),
           { status: 200 },
@@ -612,7 +612,7 @@ describe("getValidCodexOAuth", () => {
     const result = await getValidCodexOAuth(MOCK_API_URL, MOCK_API_KEY, 0, {
       maxAgeMs: 7 * 24 * 60 * 60 * 1000,
     });
-    expect(result?.access).toBe("at_keepwarm_refreshed");
+    expect(result?.access).toBe("example-at_keepwarm_refreshed");
     expect(putCapturedKey).toBe("codex_oauth_0");
   });
 

package/src/tests/codex-pool.test.ts

@@ -30,7 +30,7 @@ import type { CodexOAuthCredentials } from "../providers/codex-oauth/types.js";
 // ─── Fixtures ────────────────────────────────────────────────────────────────
 
 const MOCK_API_URL = "http://localhost:3013";
-const MOCK_API_KEY = "test-api-key";
+const MOCK_API_KEY = "example-test-api-key";
 const FUTURE = Date.now() + 3_600_000;
 
 function makeJwt(userId: string, accountId: string): string {

package/src/tests/codex-steering-hook.test.ts

@@ -9,7 +9,7 @@ import { CHILD_PROCESS_TEST_BUDGET_MS, expectChildOk, runChild } from "./test-pr
 
 const config: CodexHookConfig = {
   apiUrl: "http://steering.test",
-  apiKey: "test-key",
+  apiKey: "example-test-key",
   agentId: "11111111-1111-4111-8111-111111111111",
 };
 

package/src/tests/codex-swarm-events.test.ts

@@ -19,7 +19,7 @@ const originalFetch = globalThis.fetch;
 function buildOpts(override: Partial<CodexSwarmEventHandlerOpts> = {}): CodexSwarmEventHandlerOpts {
   return {
     apiUrl: "http://test-api",
-    apiKey: "test-key",
+    apiKey: "example-test-key",
     agentId: "agent-1",
     taskId: "task-1",
     abortRef: { current: null },

package/src/tests/config-api-only-keys.test.ts

@@ -18,7 +18,7 @@ import { listenOnFreePort } from "./test-net";
 // WITHOUT agentId — so the bootstrap admin key reached every worker.
 
 const TEST_DB_PATH = "./test-config-api-only-keys.sqlite";
-const API_KEY = "test-config-key";
+const API_KEY = "example-test-config-key";
 const BOOTSTRAP_KEY = "API_AGENT_FS_API_KEY";
 const BOOTSTRAP_VALUE = "af_bootstrap_secret_should_never_leak";
 

package/src/tests/config-session-auth.test.ts

@@ -7,8 +7,8 @@ import { handleSessions } from "../http/sessions";
 import { getPathSegments, parseQueryParams } from "../http/utils";
 import { listenOnFreePort } from "./test-net";
 
-const API_KEY = "config-session-test-operator";
-const SECRET = "config-session-test-secret-value";
+const API_KEY = "example-config-session-test-operator";
+const SECRET = "example-config-session-test-secret-value";
 let server: Server;
 let baseUrl: string;
 let workerId: string;

package/src/tests/connection-embedded-auth.test.ts

@@ -55,7 +55,7 @@ const savedEnv = { ...process.env };
 
 beforeEach(() => {
   clearVolatileSecretsForTesting();
-  process.env.AGENT_SWARM_API_KEY = "embedded-auth-test-key";
+  process.env.AGENT_SWARM_API_KEY = "example-embedded-auth-test-key";
   delete process.env.API_KEY;
   process.env.MCP_BASE_URL = "http://localhost:3013";
 });
@@ -101,7 +101,7 @@ describe("embedded connection auth", () => {
       kind: "graphql",
       baseUrl: "https://api.vendor.test/graphql",
       allowedHosts: ["api.vendor.test"],
-      auth: { type: "bearer", secret: "test-tok-123" },
+      auth: { type: "bearer", secret: "example-test-tok-123" },
     });
     createdConnectionIds.push(connection.id);
 
@@ -124,16 +124,16 @@ describe("embedded connection auth", () => {
     );
     expect(raw?.isSecret).toBe(1);
     expect(raw?.encrypted).toBe(1);
-    expect(raw?.value).not.toBe("test-tok-123");
+    expect(raw?.value).not.toBe("example-test-tok-123");
     // Decrypts back to plaintext on read.
     expect((await getSwarmConfigs({ key: "connection.bearerVendor.secret" }))[0]?.value).toBe(
-      "test-tok-123",
+      "example-test-tok-123",
     );
 
     // The broker registers the resolved secret with the scrubber so logs/output
     // only ever show the placeholder — never the raw value.
     await buildScriptCredentialBindings({});
-    expect(scrubSecrets("token=test-tok-123")).toContain(
+    expect(scrubSecrets("token=example-test-tok-123")).toContain(
       "[REDACTED:connection.bearerVendor.secret]",
     );
   });
@@ -202,7 +202,7 @@ describe("embedded connection auth", () => {
     if (!app) throw new Error("app not created");
     const authorization = await upsertAuthorization({
       appId: app.id,
-      accessToken: "oauth-access-token",
+      accessToken: "example-oauth-access-token",
       status: "active",
     });
 
@@ -313,7 +313,7 @@ describe("embedded connection auth", () => {
       kind: "graphql",
       baseUrl: "https://api.vendor.test/graphql",
       allowedHosts: ["api.vendor.test"],
-      auth: { type: "bearer", secret: "slug-secret-1" },
+      auth: { type: "bearer", secret: "example-slug-secret-1" },
     });
     createdConnectionIds.push(connection.id);
     expect(await getSwarmConfigs({ key: "connection.slugOne.secret" })).toHaveLength(1);
@@ -324,17 +324,19 @@ describe("embedded connection auth", () => {
       kind: "graphql",
       baseUrl: "https://api.vendor.test/graphql",
       allowedHosts: ["api.vendor.test"],
-      auth: { type: "bearer", secret: "slug-secret-2" },
+      auth: { type: "bearer", secret: "example-slug-secret-2" },
     });
     expect(renamed.authConfigKey).toBe("connection.slugTwo.secret");
     // Old derived secret is gone; the new one holds the new value.
     expect(await getSwarmConfigs({ key: "connection.slugOne.secret" })).toHaveLength(0);
     expect((await getSwarmConfigs({ key: "connection.slugTwo.secret" }))[0]?.value).toBe(
-      "slug-secret-2",
+      "example-slug-secret-2",
     );
     // Stale key no longer scrubbed; new key is.
     await buildScriptCredentialBindings({});
-    expect(scrubSecrets("v=slug-secret-2")).toContain("[REDACTED:connection.slugTwo.secret]");
+    expect(scrubSecrets("v=example-slug-secret-2")).toContain(
+      "[REDACTED:connection.slugTwo.secret]",
+    );
   });
 
   test("switching an inline-secret connection to oauth deletes the derived inline secret", async () => {
@@ -351,7 +353,7 @@ describe("embedded connection auth", () => {
     if (!app) throw new Error("app not created");
     const authorization = await upsertAuthorization({
       appId: app.id,
-      accessToken: "oauth-access-token",
+      accessToken: "example-oauth-access-token",
       status: "active",
     });
 
@@ -360,7 +362,7 @@ describe("embedded connection auth", () => {
       kind: "graphql",
       baseUrl: "https://api.vendor.test/graphql",
       allowedHosts: ["api.vendor.test"],
-      auth: { type: "bearer", secret: "switch-secret" },
+      auth: { type: "bearer", secret: "example-switch-secret" },
     });
     createdConnectionIds.push(connection.id);
     expect(await getSwarmConfigs({ key: "connection.switchVendor.secret" })).toHaveLength(1);
@@ -387,7 +389,7 @@ describe("embedded connection auth", () => {
       kind: "graphql",
       baseUrl: "https://api.vendor.test/graphql",
       allowedHosts: ["api.vendor.test"],
-      auth: { type: "bearer", secret: "keep-secret" },
+      auth: { type: "bearer", secret: "example-keep-secret" },
     });
     createdConnectionIds.push(connection.id);
 
@@ -402,7 +404,7 @@ describe("embedded connection auth", () => {
     });
     expect(updated.authConfigKey).toBe("connection.keepVendor.secret");
     expect((await getSwarmConfigs({ key: "connection.keepVendor.secret" }))[0]?.value).toBe(
-      "keep-secret",
+      "example-keep-secret",
     );
   });
 
@@ -413,7 +415,7 @@ describe("embedded connection auth", () => {
       kind: "graphql",
       baseUrl: "https://api.vendor.test/graphql",
       allowedHosts: ["api.vendor.test"],
-      auth: { type: "bearer", secret: "rename-secret" },
+      auth: { type: "bearer", secret: "example-rename-secret" },
     });
     createdConnectionIds.push(connection.id);
     expect(await getSwarmConfigs({ key: "connection.renameOne.secret" })).toHaveLength(1);
@@ -689,7 +691,7 @@ describe("embedded connection auth", () => {
         kind: "openapi",
         baseUrl: `http://127.0.0.1:${server.port}`,
         openapiSpecJson: openapiSpec(server.port),
-        auth: { type: "bearer", secret: "e2e-secret-xyz" },
+        auth: { type: "bearer", secret: "example-e2e-secret-xyz" },
       });
       createdConnectionIds.push(connection.id);
       expect(connection.generationError).toBeNull();
@@ -708,9 +710,9 @@ describe("embedded connection auth", () => {
 
       expect(output.error).toBeUndefined();
       expect(output.result).toEqual({ ok: true });
-      expect(observedAuth).toBe("Bearer e2e-secret-xyz");
+      expect(observedAuth).toBe("Bearer example-e2e-secret-xyz");
       // The raw secret never appears in script output/logs — only the placeholder.
-      expect(JSON.stringify(output)).not.toContain("e2e-secret-xyz");
+      expect(JSON.stringify(output)).not.toContain("example-e2e-secret-xyz");
     } finally {
       server.stop(true);
     }

package/src/tests/core-auth.test.ts

@@ -15,7 +15,7 @@ import "../http/trackers/linear";
 import "../http/workflows";
 import { listenOnFreePort } from "./test-net";
 
-const API_KEY = "test-secret-key";
+const API_KEY = "example-test-secret-key";
 
 function createTestServer(apiKey: string): Server {
   return createHttpServer(async (req: IncomingMessage, res: ServerResponse) => {

package/src/tests/create-page-tool.test.ts

@@ -184,14 +184,14 @@ describe("create_page MCP tool", () => {
         body: "secret",
         contentType: "text/html",
         authMode: "password",
-        password: "open-sesame",
+        password: "example-open-sesame",
       },
       fakeMeta,
     );
     const row = await getPageBySlug(agentId, "pw-tool");
     expect(row?.passwordHash).toBeDefined();
-    expect(row?.passwordHash).not.toBe("open-sesame");
-    expect(await Bun.password.verify("open-sesame", row!.passwordHash!)).toBe(true);
+    expect(row?.passwordHash).not.toBe("example-open-sesame");
+    expect(await Bun.password.verify("example-open-sesame", row!.passwordHash!)).toBe(true);
   });
 });
 

package/src/tests/credential-refresh.test.ts

@@ -0,0 +1,115 @@
+import { afterEach, beforeEach, describe, expect, mock, spyOn, test } from "bun:test";
+import {
+  CREDENTIAL_RETRY_INTERVAL_MS,
+  type CredentialRefreshState,
+  refreshCredentialStatus,
+} from "../commands/credential-refresh";
+import * as credentials from "../commands/provider-credentials";
+import type { AgentCredStatus } from "../types";
+
+const api = { apiUrl: "http://unused.test", apiKey: "test", agentId: crypto.randomUUID() };
+const ready: AgentCredStatus = {
+  ready: true,
+  missing: [],
+  satisfiedBy: "test",
+  hint: null,
+  liveTest: null,
+  latestModel: null,
+  reportedAt: 1,
+  reportKind: "post_task",
+  bedrock: null,
+  acp: null,
+};
+
+describe("runner credential refresh", () => {
+  let state: CredentialRefreshState;
+  let build: ReturnType<typeof spyOn<typeof credentials, "buildCredStatusReport">>;
+  let send: ReturnType<typeof spyOn<typeof credentials, "sendCredStatusReport">>;
+
+  beforeEach(() => {
+    state = { harnessProvider: "claude", ready: true, lastRefreshAt: 0, inFlight: false };
+    build = spyOn(credentials, "buildCredStatusReport").mockResolvedValue(ready);
+    send = spyOn(credentials, "sendCredStatusReport").mockResolvedValue(undefined);
+  });
+
+  afterEach(() => mock.restore());
+
+  test("a negative boot snapshot recovers on the retry interval", async () => {
+    state.ready = false;
+    await refreshCredentialStatus(api, state, "claude", {}, CREDENTIAL_RETRY_INTERVAL_MS - 1);
+    expect(build).not.toHaveBeenCalled();
+    await refreshCredentialStatus(api, state, "claude", {}, CREDENTIAL_RETRY_INTERVAL_MS);
+    expect(send).toHaveBeenCalledTimes(1);
+    expect(state.ready).toBe(true);
+  });
+
+  test("a failed readiness write is throttled and retried even when the snapshot is ready", async () => {
+    send.mockRejectedValueOnce(new Error("HTTP 503"));
+    await expect(refreshCredentialStatus(api, state, "pi", {}, 1)).rejects.toThrow("HTTP 503");
+    await refreshCredentialStatus(api, state, "pi", {}, CREDENTIAL_RETRY_INTERVAL_MS);
+    expect(send).toHaveBeenCalledTimes(1);
+    await refreshCredentialStatus(api, state, "pi", {}, CREDENTIAL_RETRY_INTERVAL_MS + 1);
+    expect(send).toHaveBeenCalledTimes(2);
+    expect(state.ready).toBe(true);
+    await refreshCredentialStatus(api, state, "pi", {}, 10 * CREDENTIAL_RETRY_INTERVAL_MS);
+    expect(build).toHaveBeenCalledTimes(2);
+  });
+
+  test("a failed snapshot build is retried without another provider change", async () => {
+    build.mockRejectedValueOnce(new Error("probe failed"));
+    await expect(refreshCredentialStatus(api, state, "pi", {}, 1)).rejects.toThrow("probe failed");
+    expect(send).not.toHaveBeenCalled();
+    await refreshCredentialStatus(api, state, "pi", {}, CREDENTIAL_RETRY_INTERVAL_MS);
+    expect(build).toHaveBeenCalledTimes(1);
+    await refreshCredentialStatus(api, state, "pi", {}, CREDENTIAL_RETRY_INTERVAL_MS + 1);
+    expect(send).toHaveBeenCalledTimes(1);
+    expect(state.ready).toBe(true);
+  });
+
+  test("CRED_CHECK_DISABLE suppresses provider changes, recovery, and Bedrock refresh", async () => {
+    state.ready = false;
+    await refreshCredentialStatus(
+      api,
+      state,
+      "pi",
+      { CRED_CHECK_DISABLE: "1", BEDROCK_AUTH_MODE: "sdk" },
+      600_000,
+    );
+    expect(build).not.toHaveBeenCalled();
+    expect(send).not.toHaveBeenCalled();
+  });
+
+  test("slow reports cannot overlap or apply an invalidated provider snapshot", async () => {
+    let finishBuild!: (snapshot: AgentCredStatus) => void;
+    build.mockImplementationOnce(
+      () =>
+        new Promise((resolve) => {
+          finishBuild = resolve;
+        }),
+    );
+    const pending = refreshCredentialStatus(api, state, "pi", {}, 1);
+    await refreshCredentialStatus(api, state, "pi", {}, 600_000);
+    expect(build).toHaveBeenCalledTimes(1);
+    // Same invalidation the runner performs when it swaps adapters mid-check.
+    state.harnessProvider = null;
+    await refreshCredentialStatus(api, state, "acp", {}, 600_001);
+    expect(build).toHaveBeenCalledTimes(1);
+    finishBuild(ready);
+    await pending;
+    expect(send).not.toHaveBeenCalled();
+    await refreshCredentialStatus(api, state, "acp", {}, 600_002);
+    expect(build).toHaveBeenCalledTimes(2);
+    expect(send).toHaveBeenCalledTimes(1);
+  });
+
+  test("Bedrock enumeration retains its five-minute refresh when ready", async () => {
+    state.harnessProvider = "pi";
+    const env = { BEDROCK_AUTH_MODE: "sdk" };
+    await refreshCredentialStatus(api, state, "pi", env, 300_000);
+    expect(build).not.toHaveBeenCalled();
+    await refreshCredentialStatus(api, state, "pi", env, 300_001);
+    expect(build).toHaveBeenCalledTimes(1);
+    await refreshCredentialStatus(api, state, "pi", env, 300_002);
+    expect(build).toHaveBeenCalledTimes(1);
+  });
+});

package/src/tests/credential-wait.test.ts

@@ -221,7 +221,7 @@ describe("awaitCredentials", () => {
     const status = await awaitCredentials({
       provider: "claude",
       initialEnv: {},
-      refreshEnv: async () => ({ CLAUDE_CODE_OAUTH_TOKEN: "fresh-tok" }),
+      refreshEnv: async () => ({ CLAUDE_CODE_OAUTH_TOKEN: "example-fresh-tok" }),
       sleep: async () => {},
       log: log.fn,
       backoff: { initialMs: 1, maxMs: 1, maxWaitSeconds: 0 },
@@ -229,7 +229,7 @@ describe("awaitCredentials", () => {
 
     expect(status.ready).toBe(true);
     // After the loop returns ready, process.env reflects the fresh value.
-    expect(process.env.CLAUDE_CODE_OAUTH_TOKEN).toBe("fresh-tok");
+    expect(process.env.CLAUDE_CODE_OAUTH_TOKEN).toBe("example-fresh-tok");
   });
 
   test("backoff config falls back to env-var defaults when override absent", async () => {

package/src/tests/credentials.test.ts

@@ -12,7 +12,7 @@ describe("validateClaudeCredentials", () => {
   });
 
   test("returns 'api_key' when only ANTHROPIC_API_KEY is set", () => {
-    expect(validateClaudeCredentials({ ANTHROPIC_API_KEY: "sk-ant-123" })).toBe("api_key");
+    expect(validateClaudeCredentials({ ANTHROPIC_API_KEY: "example-sk-ant-123" })).toBe("api_key");
   });
 
   test("prefers oauth over api_key when both are set", () => {
@@ -52,19 +52,21 @@ describe("validateOpencodeCredentials", () => {
   });
 
   test("returns 'openrouter_api_key' when OPENROUTER_API_KEY is set", () => {
-    expect(validateOpencodeCredentials({ OPENROUTER_API_KEY: "sk-or-123" })).toBe(
+    expect(validateOpencodeCredentials({ OPENROUTER_API_KEY: "example-sk-or-123" })).toBe(
       "openrouter_api_key",
     );
   });
 
   test("returns 'anthropic_api_key' when only ANTHROPIC_API_KEY is set", () => {
-    expect(validateOpencodeCredentials({ ANTHROPIC_API_KEY: "sk-ant-123" })).toBe(
+    expect(validateOpencodeCredentials({ ANTHROPIC_API_KEY: "example-sk-ant-123" })).toBe(
       "anthropic_api_key",
     );
   });
 
   test("returns 'openai_api_key' when only OPENAI_API_KEY is set", () => {
-    expect(validateOpencodeCredentials({ OPENAI_API_KEY: "sk-openai-123" })).toBe("openai_api_key");
+    expect(validateOpencodeCredentials({ OPENAI_API_KEY: "example-sk-openai-123" })).toBe(
+      "openai_api_key",
+    );
   });
 
   test("returns 'auth_file' when auth.json exists and no env vars are set", () => {