@desplega.ai/agent-swarm 1.149.1 → 1.151.0

package/src/tests/internal-ai/complete-structured.test.ts

@@ -349,7 +349,7 @@ describe("completeStructured", () => {
   test("claude-cli exhaustion logs one scrubbed line", async () => {
     const original = console.error;
     const errors: unknown[][] = [];
-    const secret = "sk-proj-abcdefghijklmnopqrstuvwxyz012345";
+    const secret = "example-sk-proj-abcdefghijklmnopqrstuvwxyz012345";
     console.error = (...args: unknown[]) => {
       errors.push(args);
     };
@@ -374,7 +374,7 @@ describe("completeStructured", () => {
       expect(errors[0]).toHaveLength(1);
       expect(errors[0]?.[0]).toBeString();
       expect(errors[0]?.[0]).toContain("callerTag=session-summary:test kind=claude-cli");
-      expect(errors[0]?.[0]).toContain("provider failed with [REDACTED:");
+      expect(errors[0]?.[0]).toContain("provider failed with example-[REDACTED:");
       expect(errors[0]?.[0]).not.toContain(secret);
     } finally {
       console.error = original;

package/src/tests/internal-ai/credentials.test.ts

@@ -35,10 +35,12 @@ describe("resolveCredential", () => {
   });
 
   test("ANTHROPIC_API_KEY when no openrouter", async () => {
-    const cred = await resolveCredential(makeOpts({ env: { ANTHROPIC_API_KEY: "sk-ant-1" } }));
+    const cred = await resolveCredential(
+      makeOpts({ env: { ANTHROPIC_API_KEY: "example-sk-ant-1" } }),
+    );
     expect(cred?.kind).toBe("anthropic");
     if (cred?.kind === "anthropic") {
-      expect(cred.apiKey).toBe("sk-ant-1");
+      expect(cred.apiKey).toBe("example-sk-ant-1");
       expect(cred.modelDefault).toBe("anthropic/claude-haiku-4-5");
     }
   });
@@ -57,7 +59,7 @@ describe("resolveCredential", () => {
       makeOpts({
         env: {},
         apiUrl: "http://localhost:3013",
-        apiKey: "test-api-key",
+        apiKey: "example-test-api-key",
         _getValidCodexOAuth: async () => ({
           access: "at_codex",
           refresh: "rt_codex",
@@ -70,13 +72,13 @@ describe("resolveCredential", () => {
             refresh: "rt_codex_refreshed",
             expires: Date.now() + 3600_000,
           },
-          apiKey: "codex-api-key-derived",
+          apiKey: "example-codex-api-key-derived",
         }),
       }),
     );
     expect(cred?.kind).toBe("openai-codex");
     if (cred?.kind === "openai-codex") {
-      expect(cred.apiKey).toBe("codex-api-key-derived");
+      expect(cred.apiKey).toBe("example-codex-api-key-derived");
       expect(cred.modelDefault).toBe("openai-codex/gpt-5.4-mini");
     }
   });
@@ -85,10 +87,10 @@ describe("resolveCredential", () => {
     const cred = await resolveCredential({
       env: {},
       apiUrl: "http://localhost:3013",
-      apiKey: "test-api-key",
+      apiKey: "example-test-api-key",
       _getEnvApiKey: () => undefined,
       _getValidCodexOAuth: async () => ({
-        access: "at_provider_runtime",
+        access: "example-at_provider_runtime",
         refresh: "rt_provider_runtime",
         expires: Date.now() + 3600_000,
         accountId: "acc-runtime",
@@ -98,7 +100,7 @@ describe("resolveCredential", () => {
 
     expect(cred).toEqual({
       kind: "openai-codex",
-      apiKey: "at_provider_runtime",
+      apiKey: "example-at_provider_runtime",
       modelDefault: "openai-codex/gpt-5.4-mini",
     });
   });
@@ -110,7 +112,7 @@ describe("resolveCredential", () => {
       makeOpts({
         env: {},
         apiUrl: "http://localhost:3013",
-        apiKey: "test-api-key",
+        apiKey: "example-test-api-key",
         _getValidCodexOAuth: async () => ({
           access: "at_codex",
           refresh: "rt_codex",
@@ -123,7 +125,7 @@ describe("resolveCredential", () => {
             refresh: "rt_rotated",
             expires: 999_999,
           },
-          apiKey: "codex-derived",
+          apiKey: "example-codex-derived",
         }),
         _persistCodexOAuth: async (_url, _key, creds) => {
           persisted = creds;
@@ -142,7 +144,7 @@ describe("resolveCredential", () => {
       makeOpts({
         env: {},
         apiUrl: "http://localhost:3013",
-        apiKey: "test-api-key",
+        apiKey: "example-test-api-key",
         _getValidCodexOAuth: async () => ({
           access: "at_codex",
           refresh: "rt_codex",
@@ -151,7 +153,7 @@ describe("resolveCredential", () => {
         }),
         _getOAuthApiKey: async () => ({
           newCredentials: { access: "a", refresh: "r", expires: 1 },
-          apiKey: "still-usable",
+          apiKey: "example-still-usable",
         }),
         _persistCodexOAuth: async () => {
           throw new Error("write failed");
@@ -171,7 +173,7 @@ describe("resolveCredential", () => {
 
   test("CLAUDE_CODE_OAUTH_TOKEN fallback", async () => {
     const cred = await resolveCredential(
-      makeOpts({ env: { CLAUDE_CODE_OAUTH_TOKEN: "claude-oauth" } }),
+      makeOpts({ env: { CLAUDE_CODE_OAUTH_TOKEN: "example-claude-oauth" } }),
     );
     expect(cred?.kind).toBe("claude-cli");
     if (cred?.kind === "claude-cli") {
@@ -184,7 +186,7 @@ describe("resolveCredential", () => {
     // claude-adapter.ts sets AGENT_SWARM_CLAUDE_OAUTH_TOKEN as a mirror so
     // the hook can still resolve the claude-cli fallback.
     const cred = await resolveCredential(
-      makeOpts({ env: { AGENT_SWARM_CLAUDE_OAUTH_TOKEN: "mirror-oauth" } }),
+      makeOpts({ env: { AGENT_SWARM_CLAUDE_OAUTH_TOKEN: "example-mirror-oauth" } }),
     );
     expect(cred?.kind).toBe("claude-cli");
     if (cred?.kind === "claude-cli") {
@@ -248,7 +250,7 @@ describe("resolveCredential", () => {
     let probed = false;
     const cred = await resolveCredential(
       makeOpts({
-        env: { CLAUDE_CODE_OAUTH_TOKEN: "claude-token" },
+        env: { CLAUDE_CODE_OAUTH_TOKEN: "example-claude-token" },
         _getValidCodexOAuth: async () => {
           probed = true;
           return null;
@@ -262,7 +264,7 @@ describe("resolveCredential", () => {
   test("with apiUrl/apiKey but codex OAuth not configured → falls through to CLAUDE_CODE_OAUTH_TOKEN", async () => {
     const cred = await resolveCredential(
       makeOpts({
-        env: { CLAUDE_CODE_OAUTH_TOKEN: "claude-token" },
+        env: { CLAUDE_CODE_OAUTH_TOKEN: "example-claude-token" },
         apiUrl: "http://localhost:3013",
         apiKey: "k",
         _getValidCodexOAuth: async () => null,
@@ -274,7 +276,7 @@ describe("resolveCredential", () => {
   test("CLAUDE_CODE_OAUTH_TOKEN-only env → claude-cli kind (Phase 4 fallback)", async () => {
     const cred = await resolveCredential(
       makeOpts({
-        env: { CLAUDE_CODE_OAUTH_TOKEN: "sk-test-oauth" },
+        env: { CLAUDE_CODE_OAUTH_TOKEN: "example-sk-test-oauth" },
         callerTag: "claude-stop-hook",
       }),
     );

package/src/tests/jira-metadata.test.ts

@@ -22,7 +22,7 @@ beforeEach(async () => {
   await getDbClient().run("DELETE FROM oauth_apps WHERE provider = 'jira'");
   await upsertOAuthApp("jira", {
     clientId: "client-id",
-    clientSecret: "client-secret",
+    clientSecret: "example-client-secret",
     authorizeUrl: "https://auth.atlassian.com/authorize",
     tokenUrl: "https://auth.atlassian.com/oauth/token",
     redirectUri: "http://localhost:3013/api/trackers/jira/callback",

package/src/tests/jira-oauth.test.ts

@@ -31,7 +31,7 @@ beforeAll(async () => {
   initDb(TEST_DB_PATH);
   await upsertOAuthApp("jira", {
     clientId: "client-id",
-    clientSecret: "client-secret",
+    clientSecret: "example-client-secret",
     authorizeUrl: "https://auth.atlassian.com/authorize",
     tokenUrl: "https://auth.atlassian.com/oauth/token",
     redirectUri: "http://localhost:3013/api/trackers/jira/callback",
@@ -54,8 +54,8 @@ beforeEach(async () => {
   exchangeCodeSpy.mockClear();
   exchangeCodeSpy.mockImplementation(() =>
     Promise.resolve({
-      accessToken: "access-1",
-      refreshToken: "refresh-1",
+      accessToken: "example-access-1",
+      refreshToken: "example-refresh-1",
       expiresIn: 3600,
       scope: "read:jira-work",
     }),
@@ -94,13 +94,13 @@ describe("handleJiraCallback", () => {
 
     // exchangeCode invoked with our config + code/state
     expect(exchangeCodeSpy).toHaveBeenCalledTimes(1);
-    expect(result.accessToken).toBe("access-1");
+    expect(result.accessToken).toBe("example-access-1");
     expect(result.cloudId).toBe("cloud-abc");
     expect(result.siteUrl).toBe("https://example.atlassian.net");
 
     // accessible-resources URL hit with the right Authorization
     expect(fetchedUrl).toBe("https://api.atlassian.com/oauth/token/accessible-resources");
-    expect(fetchedHeaders?.Authorization).toBe("Bearer access-1");
+    expect(fetchedHeaders?.Authorization).toBe("Bearer example-access-1");
 
     // Metadata persisted via updateJiraMetadata
     const meta = await getJiraMetadata();

package/src/tests/jira-sync.test.ts

@@ -29,7 +29,7 @@ beforeAll(async () => {
   // Seed an oauth_apps row + cloudId/siteUrl so URL helpers don't blow up
   await upsertOAuthApp("jira", {
     clientId: "client-id",
-    clientSecret: "client-secret",
+    clientSecret: "example-client-secret",
     authorizeUrl: "https://auth.atlassian.com/authorize",
     tokenUrl: "https://auth.atlassian.com/oauth/token",
     redirectUri: "http://localhost:3013/api/trackers/jira/callback",

package/src/tests/jira-webhook-lifecycle.test.ts

@@ -31,13 +31,13 @@ mock.module("../jira/client", () => ({
 
 beforeAll(async () => {
   initDb(TEST_DB_PATH);
-  process.env.JIRA_WEBHOOK_TOKEN = "test-token-32-chars-deadbeef-cafe-99";
+  process.env.JIRA_WEBHOOK_TOKEN = "example-test-token-32-chars-deadbeef-cafe-99";
   delete process.env.PUBLIC_MCP_BASE_URL;
   process.env.MCP_BASE_URL = "https://test.example.com";
 
   await upsertOAuthApp("jira", {
     clientId: "client-id",
-    clientSecret: "client-secret",
+    clientSecret: "example-client-secret",
     authorizeUrl: "https://auth.atlassian.com/authorize",
     tokenUrl: "https://auth.atlassian.com/oauth/token",
     redirectUri: "http://localhost:3013/api/trackers/jira/callback",
@@ -118,7 +118,7 @@ describe("registerJiraWebhook", () => {
       webhooks: { events: string[]; jqlFilter: string; fieldIdsFilter: string[] }[];
     };
     expect(parsed.url).toBe(
-      "https://test.example.com/api/trackers/jira/webhook/test-token-32-chars-deadbeef-cafe-99",
+      "https://test.example.com/api/trackers/jira/webhook/example-test-token-32-chars-deadbeef-cafe-99",
     );
     expect(parsed.webhooks[0]?.jqlFilter).toBe("project = KAN");
     expect(parsed.webhooks[0]?.events).toEqual([

package/src/tests/jira-webhook.test.ts

@@ -20,7 +20,7 @@ import {
 import * as syncModule from "../jira/sync";
 
 const TEST_DB_PATH = "./test-jira-webhook.sqlite";
-const TEST_TOKEN = "test-jira-webhook-token-deadbeefcafe1234";
+const TEST_TOKEN = "example-test-jira-webhook-token-deadbeefcafe1234";
 
 // Spy on the sync handlers — using mock.module here would leak globally
 // because bun's mock.module has no documented restore. spyOn is restored by
@@ -39,7 +39,7 @@ beforeAll(async () => {
   // Seed an oauth app so any nested calls don't blow up.
   await upsertOAuthApp("jira", {
     clientId: "client-id",
-    clientSecret: "client-secret",
+    clientSecret: "example-client-secret",
     authorizeUrl: "https://auth.atlassian.com/authorize",
     tokenUrl: "https://auth.atlassian.com/oauth/token",
     redirectUri: "http://localhost:3013/api/trackers/jira/callback",

package/src/tests/kapso-inbound.test.ts

@@ -8,7 +8,7 @@ import { putKapsoNumberMapping } from "../integrations/kapso/config";
 import { routeKapsoInbound } from "../integrations/kapso/inbound";
 
 const TEST_DB_PATH = "./test-kapso-inbound.sqlite";
-const HMAC_SECRET = "kapso-test-hmac-secret";
+const HMAC_SECRET = "example-kapso-test-hmac-secret";
 
 let agentId: string;
 const originalFetch = globalThis.fetch;
@@ -85,7 +85,7 @@ beforeAll(async () => {
   }
   initDb(TEST_DB_PATH);
   process.env.KAPSO_WEBHOOK_HMAC_SECRET = HMAC_SECRET;
-  process.env.KAPSO_API_KEY = "kapso-test-api-key";
+  process.env.KAPSO_API_KEY = "example-kapso-test-api-key";
   process.env.KAPSO_API_BASE_URL = "https://kapso.test";
   const agent = await createAgent({ name: "KapsoWorker", isLead: false, status: "idle" });
   agentId = agent.id;

package/src/tests/kv-http.test.ts

@@ -19,7 +19,7 @@ import { slackContextKey as buildSlackContextKey } from "../tasks/context-key";
 import { listenOnFreePort } from "./test-net";
 
 const TEST_DB_PATH = "./test-kv-http.sqlite";
-const API_KEY = "test-kv-key";
+const API_KEY = "example-test-kv-key";
 
 async function removeDbFiles(path: string): Promise<void> {
   for (const suffix of ["", "-wal", "-shm"]) {

package/src/tests/kv-namespace-resolution.test.ts

@@ -17,7 +17,7 @@ import { githubContextKey, linearContextKey, slackContextKey } from "../tasks/co
 import { listenOnFreePort } from "./test-net";
 
 const TEST_DB_PATH = "./test-kv-ns-resolution.sqlite";
-const API_KEY = "test-kv-ns-key";
+const API_KEY = "example-test-kv-ns-key";
 
 async function removeDbFiles(path: string): Promise<void> {
   for (const suffix of ["", "-wal", "-shm"]) {

package/src/tests/kv-page-proxy.test.ts

@@ -21,8 +21,8 @@ import { getFreePort, SERVER_BOOT_HOOK_TIMEOUT_MS, waitForServer } from "./test-
 let TEST_PORT = 0;
 const TEST_DB_PATH = `/tmp/test-kv-page-proxy-${Date.now()}.sqlite`;
 let BASE = "";
-const API_KEY = "test-kv-page-proxy-key";
-const PAGE_SECRET = "test-kv-page-proxy-secret";
+const API_KEY = "example-test-kv-page-proxy-key";
+const PAGE_SECRET = "example-test-kv-page-proxy-secret";
 
 let serverProc: Subprocess;
 const agentId = randomUUID();

package/src/tests/launch-password-rejection.test.ts

@@ -43,7 +43,7 @@ describe("POST /api/pages/:id/launch — password mode rejection (step-4)", () =
   const headers = { "Content-Type": "application/json", "X-Agent-ID": agentId };
 
   beforeAll(async () => {
-    process.env.PAGE_SESSION_SECRET = "test-launch-password-rejection-secret";
+    process.env.PAGE_SESSION_SECRET = "example-test-launch-password-rejection-secret";
     for (const suffix of ["", "-wal", "-shm"]) {
       try {
         await unlink(`${TEST_DB_PATH}${suffix}`);
@@ -74,7 +74,7 @@ describe("POST /api/pages/:id/launch — password mode rejection (step-4)", () =
         title: "Password",
         contentType: "text/html",
         authMode: "password",
-        password: "swordfish",
+        password: "example-swordfish",
         body: "<h1>locked</h1>",
       }),
     });

package/src/tests/linear-webhook.test.ts

@@ -26,7 +26,7 @@ import { getTemplateDefinition } from "../prompts/registry";
 import { linearContextKey } from "../tasks/context-key";
 
 const TEST_DB_PATH = "./test-linear-webhook.sqlite";
-const TEST_SECRET = "test-webhook-secret-123";
+const TEST_SECRET = "example-test-webhook-secret-123";
 
 function signPayload(payload: string, secret: string): string {
   return createHmac("sha256", secret).update(payload).digest("hex");

package/src/tests/mcp-oauth-dcr-reuse.test.ts

@@ -12,7 +12,7 @@ import { getPathSegments, parseQueryParams } from "../http/utils";
 // DCR registration on every call" defect. Uses the same dispatch() harness
 // as mcp-oauth-manual-client.test.ts.
 
-const API_KEY = "test-secret-key";
+const API_KEY = "example-test-secret-key";
 const TEST_DB_PATH = "./test-mcp-oauth-dcr-reuse.sqlite";
 
 async function removeDbFiles(): Promise<void> {
@@ -146,7 +146,7 @@ describe("MCP OAuth DCR client reuse", () => {
         return Response.json(
           {
             client_id: `client-${issuerHost}-${dcrCallCount}`,
-            client_secret: `secret-${issuerHost}-${dcrCallCount}`,
+            client_secret: `example-secret-${issuerHost}-${dcrCallCount}`,
           },
           { status: 201 },
         );
@@ -161,10 +161,10 @@ describe("MCP OAuth DCR client reuse", () => {
           );
         }
         return Response.json({
-          access_token: "mock-access-token",
+          access_token: "example-mock-access-token",
           token_type: "Bearer",
           expires_in: 3600,
-          refresh_token: "mock-refresh-token",
+          refresh_token: "example-mock-refresh-token",
           scope: "read",
         });
       }
@@ -660,7 +660,7 @@ describe("MCP OAuth DCR client reuse", () => {
     // The provider echoes every credential the exchange transmitted. Both
     // callback sinks (console.error and error_description on the redirect)
     // receive the thrown message verbatim, so none of these may survive.
-    const clientSecret = "secret-as-1.example.test-1";
+    const clientSecret = "example-secret-as-1.example.test-1";
     const encodedSecret = new URLSearchParams({ v: clientSecret }).toString().slice(2);
     const basicBlob = Buffer.from(
       `${new URLSearchParams({ v: "client-as-1.example.test-1" }).toString().slice(2)}:${encodedSecret}`,
@@ -730,7 +730,7 @@ describe("MCP OAuth DCR client reuse", () => {
     const body = new URLSearchParams(capturedTokenBody);
     expect(capturedTokenHeaders.Authorization).toBeUndefined();
     expect(body.get("client_id")).toBe("client-as-1.example.test-1");
-    expect(body.get("client_secret")).toBe("secret-as-1.example.test-1");
+    expect(body.get("client_secret")).toBe("example-secret-as-1.example.test-1");
 
     // And the resolution is persisted, so later refreshes stay consistent.
     expect((await getMcpOAuthToken(server.id))?.tokenEndpointAuthMethod).toBe("client_secret_post");

package/src/tests/mcp-oauth-ensure-token.test.ts

@@ -40,8 +40,8 @@ async function makeToken(
   });
   return {
     mcpServerId: server.id,
-    accessToken: "fresh-access",
-    refreshToken: "refresh-ok",
+    accessToken: "example-fresh-access",
+    refreshToken: "example-refresh-ok",
     tokenType: "Bearer",
     expiresAt: new Date(Date.now() + 3600_000).toISOString(), // not expiring
     scope: "read",
@@ -50,7 +50,7 @@ async function makeToken(
     authorizeUrl: "https://as.example.com/authorize",
     tokenUrl: "https://as.example.com/token",
     dcrClientId: "client-abc",
-    dcrClientSecret: "secret-xyz",
+    dcrClientSecret: "example-secret-xyz",
     clientSource: "dcr",
     status: "connected",
     ...overrides,
@@ -81,7 +81,7 @@ describe("ensureMcpToken", () => {
 
     const token = await ensureMcpToken(input.mcpServerId);
     expect(token).not.toBeNull();
-    expect(token!.accessToken).toBe("fresh-access");
+    expect(token!.accessToken).toBe("example-fresh-access");
     expect(fetchCalled).toBe(false);
   });
 
@@ -128,12 +128,12 @@ describe("ensureMcpToken", () => {
       calls += 1;
       const params = new URLSearchParams((init?.body as string) ?? "");
       expect(params.get("grant_type")).toBe("refresh_token");
-      expect(params.get("refresh_token")).toBe("refresh-ok");
+      expect(params.get("refresh_token")).toBe("example-refresh-ok");
       return new Response(
         JSON.stringify({
-          access_token: "refreshed-access",
+          access_token: "example-refreshed-access",
           expires_in: 3600,
-          refresh_token: "refresh-next",
+          refresh_token: "example-refresh-next",
         }),
         { status: 200, headers: { "Content-Type": "application/json" } },
       );
@@ -141,8 +141,8 @@ describe("ensureMcpToken", () => {
 
     const token = await ensureMcpToken(input.mcpServerId);
     expect(token).not.toBeNull();
-    expect(token!.accessToken).toBe("refreshed-access");
-    expect(token!.refreshToken).toBe("refresh-next");
+    expect(token!.accessToken).toBe("example-refreshed-access");
+    expect(token!.refreshToken).toBe("example-refresh-next");
     expect(token!.status).toBe("connected");
     expect(calls).toBe(1);
   });
@@ -159,15 +159,18 @@ describe("ensureMcpToken", () => {
       const params = new URLSearchParams((init?.body as string) ?? "");
       expect(headers.Authorization).toBeUndefined();
       expect(params.get("client_id")).toBe("client-abc");
-      expect(params.get("client_secret")).toBe("secret-xyz");
-      return new Response(JSON.stringify({ access_token: "refreshed-access", expires_in: 3600 }), {
-        status: 200,
-        headers: { "Content-Type": "application/json" },
-      });
+      expect(params.get("client_secret")).toBe("example-secret-xyz");
+      return new Response(
+        JSON.stringify({ access_token: "example-refreshed-access", expires_in: 3600 }),
+        {
+          status: 200,
+          headers: { "Content-Type": "application/json" },
+        },
+      );
     };
 
     const token = await ensureMcpToken(input.mcpServerId);
-    expect(token!.accessToken).toBe("refreshed-access");
+    expect(token!.accessToken).toBe("example-refreshed-access");
   });
 
   test("flips status to 'error' on refresh failure", async () => {
@@ -218,10 +221,13 @@ describe("ensureMcpToken", () => {
       calls += 1;
       // small delay so second caller piggy-backs on inflight
       await new Promise((r) => setTimeout(r, 25));
-      return new Response(JSON.stringify({ access_token: "shared-refreshed", expires_in: 3600 }), {
-        status: 200,
-        headers: { "Content-Type": "application/json" },
-      });
+      return new Response(
+        JSON.stringify({ access_token: "example-shared-refreshed", expires_in: 3600 }),
+        {
+          status: 200,
+          headers: { "Content-Type": "application/json" },
+        },
+      );
     };
 
     const [a, b, c] = await Promise.all([
@@ -230,8 +236,8 @@ describe("ensureMcpToken", () => {
       ensureMcpToken(input.mcpServerId),
     ]);
     expect(calls).toBe(1);
-    expect(a!.accessToken).toBe("shared-refreshed");
-    expect(b!.accessToken).toBe("shared-refreshed");
-    expect(c!.accessToken).toBe("shared-refreshed");
+    expect(a!.accessToken).toBe("example-shared-refreshed");
+    expect(b!.accessToken).toBe("example-shared-refreshed");
+    expect(c!.accessToken).toBe("example-shared-refreshed");
   });
 });

package/src/tests/mcp-oauth-manual-client.test.ts

@@ -8,7 +8,7 @@ import { handleCore } from "../http/core";
 import { handleMcpOAuth } from "../http/mcp-oauth";
 import { getPathSegments, parseQueryParams } from "../http/utils";
 
-const API_KEY = "test-secret-key";
+const API_KEY = "example-test-secret-key";
 const TEST_DB_PATH = "./test-mcp-oauth-manual-client.sqlite";
 
 async function removeDbFiles(): Promise<void> {
@@ -137,10 +137,10 @@ describe("MCP OAuth manual client flow", () => {
         capturedTokenHeaders = (init?.headers as Record<string, string> | undefined) ?? null;
         return new Response(
           JSON.stringify({
-            access_token: "sf-access-token",
+            access_token: "example-sf-access-token",
             token_type: "Bearer",
             expires_in: 3600,
-            ...(includeRefreshToken ? { refresh_token: "sf-refresh-token" } : {}),
+            ...(includeRefreshToken ? { refresh_token: "example-sf-refresh-token" } : {}),
             scope: "mcp_api refresh_token",
           }),
           { status: 200, headers: { "Content-Type": "application/json" } },
@@ -173,7 +173,11 @@ describe("MCP OAuth manual client flow", () => {
     const res = await dispatch(`/api/mcp-oauth/${mcpServer.id}/manual-client`, {
       method: "POST",
       headers: { Authorization: `Bearer ${API_KEY}` },
-      body: JSON.stringify({ clientId: "disc-client", clientSecret: "disc-secret", ...body }),
+      body: JSON.stringify({
+        clientId: "disc-client",
+        clientSecret: "example-disc-secret",
+        ...body,
+      }),
     });
     expect(res.status).toBe(200);
     return mcpServer;
@@ -234,7 +238,7 @@ describe("MCP OAuth manual client flow", () => {
       headers: { Authorization: `Bearer ${API_KEY}` },
       body: JSON.stringify({
         clientId: "manual-client-id",
-        clientSecret: "manual-client-secret",
+        clientSecret: "example-manual-client-secret",
         authorizationServerIssuer: "https://as.example.com",
         authorizeUrl: "https://as.example.com/authorize",
         tokenUrl: "https://as.example.com/token",
@@ -260,7 +264,7 @@ describe("MCP OAuth manual client flow", () => {
       headers: { Authorization: `Bearer ${API_KEY}` },
       body: JSON.stringify({
         clientId: "manual-client-id",
-        clientSecret: "manual-client-secret",
+        clientSecret: "example-manual-client-secret",
         authorizationServerIssuer: "https://as.example.com",
         authorizeUrl: "https://as.example.com/authorize",
         tokenUrl: "https://as.example.com/token",
@@ -289,7 +293,7 @@ describe("MCP OAuth manual client flow", () => {
       },
       body: JSON.stringify({
         clientId: "sf-client-id",
-        clientSecret: "sf-client-secret",
+        clientSecret: "example-sf-client-secret",
         authorizationServerIssuer: "https://login.salesforce.com",
         authorizeUrl: "https://login.salesforce.com/services/oauth2/authorize",
         tokenUrl: "https://login.salesforce.com/services/oauth2/token",
@@ -341,7 +345,7 @@ describe("MCP OAuth manual client flow", () => {
     // the body-post behavior that worked before the auth-method field existed.
     const tokenRequest = new URLSearchParams(capturedTokenBody ?? "");
     expect(tokenRequest.get("client_id")).toBe("sf-client-id");
-    expect(tokenRequest.get("client_secret")).toBe("sf-client-secret");
+    expect(tokenRequest.get("client_secret")).toBe("example-sf-client-secret");
     expect(tokenRequest.get("resource")).toBe(mcpServer.url);
     expect(tokenRequest.get("redirect_uri")).toBe(
       "https://swarm.example.test/api/mcp-oauth/callback",
@@ -351,10 +355,10 @@ describe("MCP OAuth manual client flow", () => {
     const connectedToken = await getMcpOAuthToken(mcpServer.id);
     expect(connectedToken?.clientSource).toBe("manual");
     expect(connectedToken?.status).toBe("connected");
-    expect(connectedToken?.accessToken).toBe("sf-access-token");
-    expect(connectedToken?.refreshToken).toBe("sf-refresh-token");
+    expect(connectedToken?.accessToken).toBe("example-sf-access-token");
+    expect(connectedToken?.refreshToken).toBe("example-sf-refresh-token");
     expect(connectedToken?.dcrClientId).toBe("sf-client-id");
-    expect(connectedToken?.dcrClientSecret).toBe("sf-client-secret");
+    expect(connectedToken?.dcrClientSecret).toBe("example-sf-client-secret");
 
     includeRefreshToken = false;
     const reconnectAuthorizeRes = await dispatch(`/api/mcp-oauth/${mcpServer.id}/authorize-url`, {
@@ -371,6 +375,6 @@ describe("MCP OAuth manual client flow", () => {
       `/api/mcp-oauth/callback?state=${encodeURIComponent(reconnectState!)}&code=sf-reconnect-code`,
     );
     expect(reconnectCallbackRes.status).toBe(302);
-    expect((await getMcpOAuthToken(mcpServer.id))?.refreshToken).toBe("sf-refresh-token");
+    expect((await getMcpOAuthToken(mcpServer.id))?.refreshToken).toBe("example-sf-refresh-token");
   });
 });