@desplega.ai/agent-swarm 1.149.1 → 1.151.0

package/src/tests/multi-runtime-registration.test.ts

@@ -3,7 +3,7 @@
  * handlers on both sides of MULTI_RUNTIME_ENABLED.
  */
 
-import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { afterAll, beforeAll, beforeEach, describe, expect, spyOn, test } from "bun:test";
 import { unlink } from "node:fs/promises";
 import { createServer as createHttpServer, type Server } from "node:http";
 import {
@@ -15,6 +15,7 @@ import {
   getActiveTaskCount,
   getAgentById,
   getDbClient,
+  getIdleWorkersWithCapacity,
   getSwarmConfigs,
   getTaskById,
   hasCapacity,
@@ -22,6 +23,7 @@ import {
   releaseStaleOfferedTasksForOfflineAgents,
   startTask,
   updateAgentStatus,
+  updateAgentStatusFromCapacity,
   upsertSwarmConfig,
 } from "../be/db";
 import {
@@ -32,8 +34,16 @@ import {
   getRuntimeInstanceById,
   hasReadyLiveRuntime,
 } from "../be/multi-runtime";
+import {
+  CREDENTIAL_RETRY_INTERVAL_MS,
+  type CredentialRefreshState,
+  refreshCredentialStatus,
+} from "../commands/credential-refresh";
 import { retryBootStep } from "../commands/credential-wait";
-import { sendCredStatusReport } from "../commands/provider-credentials";
+import {
+  CREDENTIAL_PROVIDER_CHECKERS,
+  sendCredStatusReport,
+} from "../commands/provider-credentials";
 import { runHeartbeatSweep } from "../heartbeat/heartbeat";
 import { handleActiveSessions } from "../http/active-sessions";
 import { handleAgentRegister, handleAgentsRest } from "../http/agents";
@@ -49,7 +59,7 @@ import { listenOnFreePort } from "./test-net";
 
 const TEST_DB_PATH = "./test-multi-runtime-registration.sqlite";
 let baseUrl = "";
-const API_KEY = "test-multi-runtime-key";
+const API_KEY = "example-test-multi-runtime-key";
 
 const LEAD_ID = "44444444-4444-4444-4444-444444444444";
 
@@ -295,7 +305,7 @@ afterAll(async () => {
 });
 
 beforeEach(async () => {
-  delete process.env.MULTI_RUNTIME_ENABLED;
+  process.env.MULTI_RUNTIME_ENABLED = "false";
   await getDbClient().run("DELETE FROM runtime_instances");
   await getDbClient().run("DELETE FROM active_sessions");
   // Pool sweeps cap how many tasks they assign per tick, so leftovers from an
@@ -532,7 +542,7 @@ describe("disable / legacy restoration", () => {
     expect((await getAgentById(id))?.maxTasks).toBe(3);
     expect((await getAgentMaxTasksConfig(id))?.value).toBe("3");
 
-    delete process.env.MULTI_RUNTIME_ENABLED;
+    process.env.MULTI_RUNTIME_ENABLED = "false";
     const { status } = await register(id, { maxTasks: 8 });
     expect(status).toBe(200);
     expect((await getAgentById(id))?.maxTasks).toBe(8);
@@ -794,7 +804,7 @@ describe("GET /api/agents/{id}/runtime-instances", () => {
 
     await listRuntimes(id);
     // Rows written while the flag was on stay readable after a rollback.
-    delete process.env.MULTI_RUNTIME_ENABLED;
+    process.env.MULTI_RUNTIME_ENABLED = "false";
     const { status, body } = await listRuntimes(id);
     expect(status).toBe(200);
     expect(body.runtimeInstances).toHaveLength(1);
@@ -859,7 +869,7 @@ describe("runtime-aware close", () => {
     const rA = crypto.randomUUID();
     await register(id, { maxTasks: 1, runtimeInstanceId: rA });
 
-    delete process.env.MULTI_RUNTIME_ENABLED;
+    process.env.MULTI_RUNTIME_ENABLED = "false";
     expect(await closeRuntime(id, rA)).toBe(204);
     // Runtime rows stay inert while the flag is off.
     expect((await getAgentById(id))?.status).toBe("offline");
@@ -980,7 +990,7 @@ describe("runtime liveness via ping", () => {
     await register(id, { maxTasks: 1, runtimeInstanceId: rA });
     const before = await getRuntimeInstanceById(rA);
 
-    delete process.env.MULTI_RUNTIME_ENABLED;
+    process.env.MULTI_RUNTIME_ENABLED = "false";
     await Bun.sleep(10);
     expect(await pingAgent(id, rA)).toBe(204);
     expect((await getRuntimeInstanceById(rA))?.lastSeenAt).toBe(before?.lastSeenAt ?? "");
@@ -1181,7 +1191,7 @@ describe("stale runtime liveness", () => {
     await register(id, { maxTasks: 1, runtimeInstanceId: rA });
 
     // Flag off: close takes the legacy path and leaves the row active.
-    delete process.env.MULTI_RUNTIME_ENABLED;
+    process.env.MULTI_RUNTIME_ENABLED = "false";
     await closeRuntime(id, rA);
     expect((await getRuntimeInstanceById(rA))?.status).toBe("active");
     expect((await getAgentById(id))?.status).toBe("offline");
@@ -1376,7 +1386,7 @@ describe("rollback to legacy mode", () => {
     await register(id, { maxTasks: 1, runtimeInstanceId: rA });
 
     // Operator rolls back; workers stop refreshing their rows.
-    delete process.env.MULTI_RUNTIME_ENABLED;
+    process.env.MULTI_RUNTIME_ENABLED = "false";
     await makeRuntimeStale(rA);
 
     const result = await expireStaleRuntimeInstances();
@@ -1392,7 +1402,7 @@ describe("rollback to legacy mode", () => {
     const rA = crypto.randomUUID();
     await register(id, { maxTasks: 1, runtimeInstanceId: rA });
 
-    delete process.env.MULTI_RUNTIME_ENABLED;
+    process.env.MULTI_RUNTIME_ENABLED = "false";
     await makeRuntimeStale(rA);
     await expireStaleRuntimeInstances();
     expect((await getAgentById(id))?.status).toBe("idle");
@@ -1459,7 +1469,7 @@ describe("flag re-enable cycle preserves live sessions", () => {
 
     // Operator disables the flag: nothing refreshes runtime rows, but the
     // worker keeps executing and heartbeating its session.
-    delete process.env.MULTI_RUNTIME_ENABLED;
+    process.env.MULTI_RUNTIME_ENABLED = "false";
     await makeRuntimeStale(rt);
 
     // Re-enable past the stale window; the first sweep runs expiry.
@@ -1487,7 +1497,7 @@ describe("flag re-enable cycle preserves live sessions", () => {
     await startTask(task.id);
     await startSessionFor(id, task.id, rt);
 
-    delete process.env.MULTI_RUNTIME_ENABLED;
+    process.env.MULTI_RUNTIME_ENABLED = "false";
     await makeRuntimeStale(rt);
     // Sessions heartbeat on tool activity only: a long model call or shell
     // command can be quiet past the runtime cutoff while the worker is fine.
@@ -1516,7 +1526,7 @@ describe("flag re-enable cycle preserves live sessions", () => {
     await startTask(task.id);
     await startSessionFor(id, task.id, rt);
 
-    delete process.env.MULTI_RUNTIME_ENABLED;
+    process.env.MULTI_RUNTIME_ENABLED = "false";
     await makeRuntimeStale(rt);
     await makeSessionStale(task.id, 20);
     // The task itself progressed recently (store-progress traffic).
@@ -1541,7 +1551,7 @@ describe("flag re-enable cycle preserves live sessions", () => {
     await startTask(task.id);
     await startSessionFor(id, task.id, rt);
 
-    delete process.env.MULTI_RUNTIME_ENABLED;
+    process.env.MULTI_RUNTIME_ENABLED = "false";
     await makeRuntimeStale(rt);
     // The process died: session heartbeat AND task progress both went stale.
     await makeSessionStale(task.id, 30);
@@ -1568,7 +1578,7 @@ describe("flag re-enable cycle preserves live sessions", () => {
     await startTask(task.id);
     await startSessionFor(id, task.id, rt);
 
-    delete process.env.MULTI_RUNTIME_ENABLED;
+    process.env.MULTI_RUNTIME_ENABLED = "false";
     await makeRuntimeStale(rt);
 
     const result = await expireStaleRuntimeInstances();
@@ -1762,7 +1772,7 @@ describe("sweep coverage and rollback inertness", () => {
     await register(id, { maxTasks: 1, runtimeInstanceId: rt });
 
     // Rolled back; the legacy worker stops refreshing its retained row.
-    delete process.env.MULTI_RUNTIME_ENABLED;
+    process.env.MULTI_RUNTIME_ENABLED = "false";
     await makeRuntimeStale(rt);
     const task = await createTaskExtended("pool-work-legacy");
 
@@ -2840,3 +2850,87 @@ describe("MCP task-action accept requires a live runtime", () => {
     expect((await getTaskById(task.id))?.agentId).toBe(id);
   });
 });
+
+describe("post-task credential recovery without a restart", () => {
+  for (const multiRuntime of [false, true]) {
+    test(`parked worker recovers with multi-runtime ${multiRuntime ? "on" : "off"}`, async () => {
+      process.env.MULTI_RUNTIME_ENABLED = String(multiRuntime);
+      const id = await makeAgent(1);
+      const runtimeInstanceId = crypto.randomUUID();
+      await register(id, { maxTasks: 1, runtimeInstanceId });
+      const api = { apiUrl: baseUrl, apiKey: API_KEY, agentId: id, runtimeInstanceId };
+      const refresh: CredentialRefreshState = {
+        harnessProvider: "acp",
+        ready: true,
+        lastRefreshAt: 0,
+        inFlight: false,
+      };
+      const check = spyOn(CREDENTIAL_PROVIDER_CHECKERS, "claude");
+      const originalOAuth = process.env.CLAUDE_CODE_OAUTH_TOKEN;
+      // The real Claude checker and live-test use OAuth presence, no upstream I/O.
+      process.env.CLAUDE_CODE_OAUTH_TOKEN = "test-credential-recovery";
+      try {
+        // A live provider swap produces a real not-ready post-task snapshot.
+        await refreshCredentialStatus(api, refresh, "claude", {}, 1);
+        expect((await getAgentById(id))?.status).toBe("waiting_for_credentials");
+        expect((await getAgentById(id))?.credStatus?.reportKind).toBe("post_task");
+        expect((await getIdleWorkersWithCapacity()).some((agent) => agent.id === id)).toBe(false);
+        if (multiRuntime) {
+          expect((await getRuntimeInstanceById(runtimeInstanceId))?.credentialReady).toBe(false);
+        }
+
+        // Ping and completion/capacity reconciliation cannot recover it.
+        await pingAgent(id, runtimeInstanceId);
+        await updateAgentStatusFromCapacity(id);
+        expect((await getAgentById(id))?.status).toBe("waiting_for_credentials");
+        await refreshCredentialStatus(api, refresh, "claude", {}, CREDENTIAL_RETRY_INTERVAL_MS);
+        expect(check).toHaveBeenCalledTimes(1);
+
+        // A still-missing snapshot stays parked, and starts a new throttle window.
+        await refreshCredentialStatus(api, refresh, "claude", {}, CREDENTIAL_RETRY_INTERVAL_MS + 1);
+        expect(check).toHaveBeenCalledTimes(2);
+        expect((await getAgentById(id))?.status).toBe("waiting_for_credentials");
+        const env = { CLAUDE_CODE_OAUTH_TOKEN: "test-credential-recovery" };
+        await refreshCredentialStatus(
+          api,
+          refresh,
+          "claude",
+          env,
+          2 * CREDENTIAL_RETRY_INTERVAL_MS,
+        );
+        expect(check).toHaveBeenCalledTimes(2);
+        expect((await getAgentById(id))?.status).toBe("waiting_for_credentials");
+
+        // Credentials resolve. Same runner state, provider, and runtime identity.
+        await refreshCredentialStatus(
+          api,
+          refresh,
+          "claude",
+          env,
+          2 * CREDENTIAL_RETRY_INTERVAL_MS + 1,
+        );
+        expect(check).toHaveBeenCalledTimes(3);
+        expect((await getAgentById(id))?.status).toBe("idle");
+        expect((await getAgentById(id))?.credStatus?.ready).toBe(true);
+        expect((await getAgentById(id))?.credentialMissing).toBeNull();
+        expect((await getIdleWorkersWithCapacity()).some((agent) => agent.id === id)).toBe(true);
+        if (multiRuntime) {
+          expect((await getRuntimeInstanceById(runtimeInstanceId))?.credentialReady).toBe(true);
+          expect(await countActiveRuntimeInstancesForAgent(id)).toBe(1);
+        }
+        await refreshCredentialStatus(
+          api,
+          refresh,
+          "claude",
+          env,
+          10 * CREDENTIAL_RETRY_INTERVAL_MS,
+        );
+        expect(check).toHaveBeenCalledTimes(3);
+      } finally {
+        check.mockRestore();
+        if (originalOAuth === undefined) delete process.env.CLAUDE_CODE_OAUTH_TOKEN;
+        else process.env.CLAUDE_CODE_OAUTH_TOKEN = originalOAuth;
+      }
+    });
+  }
+});

package/src/tests/oauth-access-token-tool.test.ts

@@ -23,7 +23,7 @@ const originalFetch = globalThis.fetch;
 
 const testApp = {
   clientId: "client-id",
-  clientSecret: "client-secret",
+  clientSecret: "example-client-secret",
   authorizeUrl: "https://example.com/oauth/authorize",
   tokenUrl: "https://example.com/oauth/token",
   redirectUri: "http://localhost:3013/callback",
@@ -69,8 +69,8 @@ afterAll(async () => {
 describe("resolveOAuthAccessToken", () => {
   test("registered MCP tool returns a seeded provider token", async () => {
     await storeOAuthTokens("custom-provider", {
-      accessToken: "mcp-tool-access-token-plain-value",
-      refreshToken: "mcp-tool-refresh-token",
+      accessToken: "example-mcp-tool-access-token-plain-value",
+      refreshToken: "example-mcp-tool-refresh-token",
       expiresAt: new Date(Date.now() + 3600_000).toISOString(),
     });
     const server = new McpServer({ name: "oauth-access-token-test", version: "1.0.0" });
@@ -112,7 +112,7 @@ describe("resolveOAuthAccessToken", () => {
     expect(result.structuredContent).toMatchObject({
       success: true,
       provider: "custom-provider",
-      accessToken: "mcp-tool-access-token-plain-value",
+      accessToken: "example-mcp-tool-access-token-plain-value",
       expiresAt: expect.any(String),
       tokenType: "Bearer",
     });
@@ -123,7 +123,7 @@ describe("resolveOAuthAccessToken", () => {
     // details carries the actual token payload (allowSecretEgress: true means
     // the central scrubber does not redact it, since the tool's whole purpose
     // is handing over the plaintext token).
-    expect(result.structuredContent.details).toBe("mcp-tool-access-token-plain-value");
+    expect(result.structuredContent.details).toBe("example-mcp-tool-access-token-plain-value");
 
     // content[0].text is composed as message + "\n\n" + details, so both
     // channels (text for pi/opencode/claude-managed, structuredContent for
@@ -132,7 +132,7 @@ describe("resolveOAuthAccessToken", () => {
     expect(result.content).toHaveLength(1);
     expect(result.content[0].type).toBe("text");
     expect(result.content[0].text).toBe(
-      `custom-provider OAuth access token resolved; expires at ${expiresAt}.\n\nmcp-tool-access-token-plain-value`,
+      `custom-provider OAuth access token resolved; expires at ${expiresAt}.\n\nexample-mcp-tool-access-token-plain-value`,
     );
   });
 
@@ -170,10 +170,10 @@ describe("resolveOAuthAccessToken", () => {
   });
 
   test("returns a fresh access token and registers it for scrubber redaction", async () => {
-    const accessToken = "linear-access-token-plain-value-1234567890";
+    const accessToken = "example-linear-access-token-plain-value-1234567890";
     await storeOAuthTokens("linear", {
       accessToken,
-      refreshToken: "linear-refresh-token",
+      refreshToken: "example-linear-refresh-token",
       expiresAt: new Date(Date.now() + 3600_000).toISOString(),
     });
 
@@ -192,21 +192,21 @@ describe("resolveOAuthAccessToken", () => {
 
   test("supports any configured OAuth provider slug", async () => {
     await storeOAuthTokens("custom-provider", {
-      accessToken: "custom-provider-access-token-plain-value",
-      refreshToken: "custom-provider-refresh-token",
+      accessToken: "example-custom-provider-access-token-plain-value",
+      refreshToken: "example-custom-provider-refresh-token",
       expiresAt: new Date(Date.now() + 3600_000).toISOString(),
     });
 
     const result = await resolveOAuthAccessToken("custom-provider");
 
     expect(result.provider).toBe("custom-provider");
-    expect(result.accessToken).toBe("custom-provider-access-token-plain-value");
+    expect(result.accessToken).toBe("example-custom-provider-access-token-plain-value");
   });
 
   test("refreshes Jira before returning a near-expiry token", async () => {
     await storeOAuthTokens("jira", {
-      accessToken: "old-jira-access-token",
-      refreshToken: "old-jira-refresh-token",
+      accessToken: "example-old-jira-access-token",
+      refreshToken: "example-old-jira-refresh-token",
       expiresAt: new Date(Date.now() + 60_000).toISOString(),
     });
 
@@ -214,10 +214,10 @@ describe("resolveOAuthAccessToken", () => {
       Promise.resolve(
         new Response(
           JSON.stringify({
-            access_token: "new-jira-access-token-plain-value",
+            access_token: "example-new-jira-access-token-plain-value",
             token_type: "Bearer",
             expires_in: 3600,
-            refresh_token: "new-jira-refresh-token",
+            refresh_token: "example-new-jira-refresh-token",
           }),
           { status: 200, headers: { "Content-Type": "application/json" } },
         ),
@@ -228,13 +228,13 @@ describe("resolveOAuthAccessToken", () => {
     const result = await resolveOAuthAccessToken("jira");
 
     expect(fetchSpy).toHaveBeenCalledTimes(1);
-    expect(result.accessToken).toBe("new-jira-access-token-plain-value");
-    expect((await getOAuthTokens("jira"))?.refreshToken).toBe("new-jira-refresh-token");
+    expect(result.accessToken).toBe("example-new-jira-access-token-plain-value");
+    expect((await getOAuthTokens("jira"))?.refreshToken).toBe("example-new-jira-refresh-token");
   });
 
   test("rejects a near-expiry token when no refresh token is available", async () => {
     await storeOAuthTokens("jira", {
-      accessToken: "stale-jira-access-token",
+      accessToken: "example-stale-jira-access-token",
       refreshToken: null,
       expiresAt: new Date(Date.now() + 60_000).toISOString(),
     });

package/src/tests/oauth-callback-flow.test.ts

@@ -85,10 +85,10 @@ beforeAll(async () => {
       if (url.pathname === "/token") {
         lastTokenBody = await req.text();
         return Response.json({
-          access_token: "mock-access-token",
+          access_token: "example-mock-access-token",
           token_type: "Bearer",
           expires_in: 3600,
-          refresh_token: "mock-refresh-token",
+          refresh_token: "example-mock-refresh-token",
           scope: "read write",
         });
       }
@@ -98,7 +98,7 @@ beforeAll(async () => {
         // fabricated one.
         lastTokenBody = await req.text();
         return Response.json({
-          access_token: "mock-access-token",
+          access_token: "example-mock-access-token",
           token_type: "bearer",
           scope: "read",
         });
@@ -183,8 +183,8 @@ describe("static OAuth callback + multi-authorization flow", () => {
     expect(supportAuth.accountEmail).toBe("connected@example.test");
     // Tokens are encrypted at rest but decrypt to the mock values on read.
     expect(supportAuth.tokensEncrypted).toBe(true);
-    expect(supportAuth.accessToken).toBe("mock-access-token");
-    expect(supportAuth.refreshToken).toBe("mock-refresh-token");
+    expect(supportAuth.accessToken).toBe("example-mock-access-token");
+    expect(supportAuth.refreshToken).toBe("example-mock-refresh-token");
 
     // Second label: "sales" — first authorization must be untouched.
     const sales = await buildAuthorizationUrl(config, { appId, label: "sales", flow: "generic" });
@@ -383,7 +383,7 @@ describe("static OAuth callback + multi-authorization flow", () => {
       tokenUrl: `${providerBase}/token`,
       scopes: "read",
       dcrClientId: "mcp-client",
-      dcrClientSecret: "mcp-secret",
+      dcrClientSecret: "example-mcp-secret",
       redirectUri: `${appBase}/api/oauth/callback`,
     });
 
@@ -464,7 +464,7 @@ describe("step-4 security hardening", () => {
     try {
       const identity = await captureIdentity({
         userinfoUrl: "http://127.0.0.1/userinfo",
-        accessToken: "live-bearer",
+        accessToken: "example-live-bearer",
       });
       expect(identity).toBeNull();
     } finally {
@@ -476,7 +476,7 @@ describe("step-4 security hardening", () => {
   test("captureIdentity does not follow a redirect to a private host", async () => {
     const identity = await captureIdentity({
       userinfoUrl: `${providerBase}/userinfo-redirect`,
-      accessToken: "live-bearer",
+      accessToken: "example-live-bearer",
     });
     // The 302 is not followed (redirect: manual → not .ok), so no identity.
     expect(identity).toBeNull();

package/src/tests/oauth-credential-bindings.test.ts

@@ -144,7 +144,7 @@ describe("OAuth credential bindings", () => {
 
     await upsertOAuthApp("phase2-roundtrip", testApp("phase2-roundtrip"));
     await storeOAuthTokens("phase2-roundtrip", {
-      accessToken: "roundtrip-access",
+      accessToken: "example-roundtrip-access",
       expiresAt: new Date(Date.now() + 60 * 60 * 1000).toISOString(),
     });
     const authorizationId = (await getOAuthTokens("phase2-roundtrip"))!.id;
@@ -170,8 +170,8 @@ describe("OAuth credential bindings", () => {
   test("OAuth binding resolves through the stored access token", async () => {
     await upsertOAuthApp("phase2-resolve", testApp("phase2-resolve"));
     await storeOAuthTokens("phase2-resolve", {
-      accessToken: "stored-oauth-access",
-      refreshToken: "stored-oauth-refresh",
+      accessToken: "example-stored-oauth-access",
+      refreshToken: "example-stored-oauth-refresh",
       expiresAt: new Date(Date.now() + 60 * 60 * 1000).toISOString(),
     });
     await upsertCredentialBinding({
@@ -188,7 +188,7 @@ describe("OAuth credential bindings", () => {
     expect(bindings).toContainEqual(
       expect.objectContaining({
         configKey: "PHASE2_RESOLVE_OAUTH",
-        value: "stored-oauth-access",
+        value: "example-stored-oauth-access",
       }),
     );
   });
@@ -196,8 +196,8 @@ describe("OAuth credential bindings", () => {
   test("expiring OAuth binding token is refreshed before resolution", async () => {
     await upsertOAuthApp("phase2-refresh", testApp("phase2-refresh"));
     await storeOAuthTokens("phase2-refresh", {
-      accessToken: "old-access-token",
-      refreshToken: "old-refresh-token",
+      accessToken: "example-old-access-token",
+      refreshToken: "example-old-refresh-token",
       expiresAt: new Date(Date.now() + 60 * 1000).toISOString(),
     });
     await upsertCredentialBinding({
@@ -215,13 +215,13 @@ describe("OAuth credential bindings", () => {
       }
       expect(init?.method).toBe("POST");
       expect(String(init?.body)).toContain("grant_type=refresh_token");
-      expect(String(init?.body)).toContain("refresh_token=old-refresh-token");
+      expect(String(init?.body)).toContain("refresh_token=example-old-refresh-token");
       return Promise.resolve(
         Response.json({
-          access_token: "new-access-token",
+          access_token: "example-new-access-token",
           token_type: "Bearer",
           expires_in: 3600,
-          refresh_token: "new-refresh-token",
+          refresh_token: "example-new-refresh-token",
         }),
       );
     });
@@ -233,10 +233,12 @@ describe("OAuth credential bindings", () => {
     expect(bindings).toContainEqual(
       expect.objectContaining({
         configKey: "PHASE2_REFRESH_OAUTH",
-        value: "new-access-token",
+        value: "example-new-access-token",
       }),
     );
-    expect((await getOAuthTokens("phase2-refresh"))?.refreshToken).toBe("new-refresh-token");
+    expect((await getOAuthTokens("phase2-refresh"))?.refreshToken).toBe(
+      "example-new-refresh-token",
+    );
   });
 
   test("basic tokenAuthStyle + json tokenBodyFormat reach the token endpoint (Notion-style)", async () => {
@@ -245,8 +247,8 @@ describe("OAuth credential bindings", () => {
       metadata: JSON.stringify({ tokenAuthStyle: "basic", tokenBodyFormat: "json" }),
     });
     await storeOAuthTokens("phase2-basic", {
-      accessToken: "old-basic-access",
-      refreshToken: "old-basic-refresh",
+      accessToken: "example-old-basic-access",
+      refreshToken: "example-old-basic-refresh",
       expiresAt: new Date(Date.now() + 60 * 1000).toISOString(),
     });
     await upsertCredentialBinding({
@@ -272,16 +274,16 @@ describe("OAuth credential bindings", () => {
       expect(headers.get("content-type")).toBe("application/json");
       const body = JSON.parse(String(init?.body)) as Record<string, string>;
       expect(body.grant_type).toBe("refresh_token");
-      expect(body.refresh_token).toBe("old-basic-refresh");
+      expect(body.refresh_token).toBe("example-old-basic-refresh");
       // Basic auth carries the client credentials — they must NOT be in the body
       expect(body.client_id).toBeUndefined();
       expect(body.client_secret).toBeUndefined();
       return Promise.resolve(
         Response.json({
-          access_token: "new-basic-access",
+          access_token: "example-new-basic-access",
           token_type: "Bearer",
           expires_in: 3600,
-          refresh_token: "new-basic-refresh",
+          refresh_token: "example-new-basic-refresh",
         }),
       );
     });
@@ -293,7 +295,7 @@ describe("OAuth credential bindings", () => {
     expect(bindings).toContainEqual(
       expect.objectContaining({
         configKey: "PHASE2_BASIC_OAUTH",
-        value: "new-basic-access",
+        value: "example-new-basic-access",
       }),
     );
   });
@@ -323,7 +325,7 @@ describe("OAuth credential bindings", () => {
         action: "oauth-app-upsert",
         provider: "jira",
         clientId: "jira-client",
-        clientSecret: "jira-secret",
+        clientSecret: "example-jira-secret",
         authorizeUrl: "https://oauth.example.test/authorize",
         tokenUrl: "https://oauth.example.test/token",
         scopes: [],
@@ -345,7 +347,7 @@ describe("OAuth credential bindings", () => {
         action: "oauth-app-upsert",
         provider: "phase2-tool-unsafe",
         clientId: "unsafe-client",
-        clientSecret: "unsafe-secret",
+        clientSecret: "example-unsafe-secret",
         authorizeUrl: "https://oauth.example.test/authorize",
         tokenUrl: "http://127.0.0.1/token",
         scopes: [],
@@ -362,7 +364,7 @@ describe("OAuth credential bindings", () => {
         action: "oauth-app-upsert",
         provider: "phase2-tool-safe",
         clientId: "safe-client",
-        clientSecret: "safe-secret",
+        clientSecret: "example-safe-secret",
         authorizeUrl: "https://oauth.example.test/authorize",
         tokenUrl: "https://oauth.example.test/token",
         scopes: ["read"],
@@ -377,8 +379,8 @@ describe("OAuth credential bindings", () => {
   test("failed OAuth token refresh skips only that binding, others still resolve", async () => {
     await upsertOAuthApp("phase2-broken", testApp("phase2-broken"));
     await storeOAuthTokens("phase2-broken", {
-      accessToken: "stale-access-token",
-      refreshToken: "stale-refresh-token",
+      accessToken: "example-stale-access-token",
+      refreshToken: "example-stale-refresh-token",
       expiresAt: new Date(Date.now() + 60 * 1000).toISOString(),
     });
     await upsertCredentialBinding({
@@ -419,7 +421,7 @@ describe("OAuth credential bindings", () => {
   test("revoked OAuth token skips binding resolution and list reports revoked", async () => {
     await upsertOAuthApp("phase2-missing", testApp("phase2-missing"));
     await storeOAuthTokens("phase2-missing", {
-      accessToken: "soon-deleted",
+      accessToken: "example-soon-deleted",
       expiresAt: new Date(Date.now() + 60 * 60 * 1000).toISOString(),
     });
     const authorizationId = (await getOAuthTokens("phase2-missing"))!.id;
@@ -465,10 +467,10 @@ describe("OAuth credential bindings", () => {
       expect(String(init?.body)).toContain("grant_type=authorization_code");
       expect(String(init?.body)).toContain("code=callback-code");
       return Response.json({
-        access_token: "callback-access-token",
+        access_token: "example-callback-access-token",
         token_type: "Bearer",
         expires_in: 3600,
-        refresh_token: "callback-refresh-token",
+        refresh_token: "example-callback-refresh-token",
         scope: "read write",
       });
     }) as typeof fetch;
@@ -483,8 +485,8 @@ describe("OAuth credential bindings", () => {
       expect(res.status).toBe(200);
       expect(await res.text()).toContain("You can close this tab.");
       const tokens = await getOAuthTokens(provider);
-      expect(tokens?.accessToken).toBe("callback-access-token");
-      expect(tokens?.refreshToken).toBe("callback-refresh-token");
+      expect(tokens?.accessToken).toBe("example-callback-access-token");
+      expect(tokens?.refreshToken).toBe("example-callback-refresh-token");
     } finally {
       server.close();
     }

package/src/tests/oauth-keepalive.test.ts

@@ -22,7 +22,7 @@ function restoreSlackAlertsChannel(): void {
 
 const testApp = {
   clientId: "test-client-id",
-  clientSecret: "test-client-secret",
+  clientSecret: "example-test-client-secret",
   authorizeUrl: "https://example.com/oauth/authorize",
   tokenUrl: "https://example.com/oauth/token",
   redirectUri: "http://localhost:3013/callback",
@@ -78,13 +78,13 @@ describe("OAuth keepalive", () => {
 
   test("stopOAuthKeepalive waits for in-flight Jira refresh persistence", async () => {
     await storeOAuthTokens("linear", {
-      accessToken: "linear-access",
-      refreshToken: "linear-refresh",
+      accessToken: "example-linear-access",
+      refreshToken: "example-linear-refresh",
       expiresAt: new Date(Date.now() + 60 * 60 * 1000).toISOString(),
     });
     await storeOAuthTokens("jira", {
-      accessToken: "old-jira-access",
-      refreshToken: "old-jira-refresh",
+      accessToken: "example-old-jira-access",
+      refreshToken: "example-old-jira-refresh",
       expiresAt: new Date(Date.now() + 60 * 1000).toISOString(),
     });
 
@@ -102,10 +102,10 @@ describe("OAuth keepalive", () => {
       await tokenResponseReady;
       return new Response(
         JSON.stringify({
-          access_token: "new-jira-access",
+          access_token: "example-new-jira-access",
           token_type: "Bearer",
           expires_in: 3600,
-          refresh_token: "new-jira-refresh",
+          refresh_token: "example-new-jira-refresh",
         }),
         { status: 200, headers: { "Content-Type": "application/json" } },
       );
@@ -121,7 +121,7 @@ describe("OAuth keepalive", () => {
 
     await Promise.resolve();
     expect(stopResolved).toBe(false);
-    expect((await getOAuthTokens("jira"))?.refreshToken).toBe("old-jira-refresh");
+    expect((await getOAuthTokens("jira"))?.refreshToken).toBe("example-old-jira-refresh");
 
     releaseTokenResponse();
     await stopPromise;
@@ -129,7 +129,7 @@ describe("OAuth keepalive", () => {
 
     expect(stopResolved).toBe(true);
     const tokens = await getOAuthTokens("jira");
-    expect(tokens?.accessToken).toBe("new-jira-access");
-    expect(tokens?.refreshToken).toBe("new-jira-refresh");
+    expect(tokens?.accessToken).toBe("example-new-jira-access");
+    expect(tokens?.refreshToken).toBe("example-new-jira-refresh");
   });
 });