@desplega.ai/agent-swarm 1.166.0 → 1.168.0

package/src/tests/codex-adapter.test.ts

@@ -167,6 +167,66 @@ function makeFakeAppServer(
   };
 }
 
+// Cost JSON (minus durationMs) the pre-split adapter (origin/main 97deb6c6)
+// produced for the notification sequence in the "unchanged by the context
+// split" test.
+const PRE_SPLIT_COST_JSON =
+  '{"sessionId":"","taskId":"","agentId":"agent-test","totalCostUsd":0.3675,"inputTokens":390000,"outputTokens":7500,"reasoningOutputTokens":1900,"cacheReadTokens":320000,"cacheWriteTokens":3000,"numTurns":2,"model":"gpt-5.4","isError":false,"provider":"codex"}';
+
+type AppServerTokenUsage = {
+  total: Record<string, number>;
+  last?: Record<string, number>;
+  modelContextWindow?: number | null;
+};
+
+function breakdown(input: number, cached: number, output: number, reasoning = 0, cacheWrite = 0) {
+  return {
+    inputTokens: input,
+    cachedInputTokens: cached,
+    cacheWriteInputTokens: cacheWrite,
+    outputTokens: output,
+    reasoningOutputTokens: reasoning,
+    totalTokens: input + output,
+  };
+}
+
+/**
+ * Run an app-server session where each turn sends one
+ * `thread/tokenUsage/updated` notification per model request. The first turn
+ * is the initial prompt; later turns are queued follow-ups.
+ */
+async function runAppServerTurns(
+  turns: AppServerTokenUsage[][],
+): Promise<{ emitted: ProviderEvent[]; result: ProviderResult }> {
+  const threadId = "thread-token-usage";
+  let turnNumber = 0;
+  const fake = makeFakeAppServer((method, _params, emit) => {
+    if (method === "thread/start") return { thread: { id: threadId } };
+    if (method !== "turn/start") throw new Error(`Unexpected method: ${method}`);
+    const turnId = `turn-${++turnNumber}`;
+    const updates = turns[turnNumber - 1] ?? [];
+    queueMicrotask(() => {
+      emit("turn/started", { threadId, turn: { id: turnId, status: "inProgress" } });
+      for (const tokenUsage of updates) {
+        emit("thread/tokenUsage/updated", { threadId, turnId, tokenUsage });
+      }
+      emit("turn/completed", { threadId, turn: { id: turnId, status: "completed", error: null } });
+    });
+    return { turn: { id: turnId } };
+  });
+  const session = await new CodexAdapter({
+    bypassSubprocess: true,
+    appServerFactory: () => fake.client as never,
+  }).createSession(testConfig({ taskId: "", apiUrl: "", apiKey: "" }));
+  const emitted: ProviderEvent[] = [];
+  session.onEvent((event) => emitted.push(event));
+  for (let i = 1; i < turns.length; i++) {
+    await session.deliverSteering?.({ mode: "queue", text: `follow-up ${i}` });
+  }
+  const result = await session.waitForCompletion();
+  return { emitted, result };
+}
+
 /**
  * Because `CodexSession` is not exported, we load the module source and
  * instantiate it via `eval` of a small helper module. This is brittle but
@@ -431,6 +491,88 @@ describe("Codex app-server session", () => {
     ).toMatchObject({ toolName: "Write" });
   });
 
+  test("context follows the latest request, not the turn's summed usage", async () => {
+    // Two requests in one turn. The cumulative total (1.3M input) exceeds the
+    // 1.05M gpt-5.4 window; neither single request does.
+    const { emitted } = await runAppServerTurns([
+      [
+        {
+          total: breakdown(600_000, 500_000, 1_000),
+          last: breakdown(600_000, 500_000, 1_000),
+        },
+        {
+          total: breakdown(1_300_000, 1_100_000, 3_000),
+          last: breakdown(700_000, 600_000, 2_000),
+        },
+      ],
+    ]);
+
+    const snapshots = emitted.filter((event) => event.type === "context_usage");
+    expect(snapshots.map((event) => event.contextUsedTokens)).toEqual([601_000, 702_000]);
+    for (const snapshot of snapshots) {
+      expect(snapshot.contextUsedTokens).toBeLessThanOrEqual(702_000);
+      expect(snapshot.contextTotalTokens).toBe(1_050_000);
+      expect(snapshot.contextPercent).toBeLessThan(100);
+      expect(snapshot.contextFormula).toBe("input-cache-output");
+    }
+    expect(snapshots.at(-1)?.contextPercent).toBeCloseTo((702_000 / 1_050_000) * 100, 6);
+  });
+
+  test("per-turn cost and usage totals are unchanged by the context split", async () => {
+    // `last` and `modelContextWindow` must not move cost or usage totals.
+    const { result } = await runAppServerTurns([
+      [
+        {
+          total: breakdown(120_000, 90_000, 2_000, 500, 1_000),
+          last: breakdown(120_000, 90_000, 2_000, 500, 1_000),
+          modelContextWindow: 258_400,
+        },
+        {
+          total: breakdown(250_000, 200_000, 5_000, 1_200, 2_500),
+          last: breakdown(130_000, 110_000, 3_000, 700, 1_500),
+          modelContextWindow: 258_400,
+        },
+      ],
+      [
+        {
+          total: breakdown(390_000, 320_000, 7_500, 1_900, 3_000),
+          last: breakdown(140_000, 120_000, 2_500, 700, 500),
+          modelContextWindow: 258_400,
+        },
+      ],
+    ]);
+
+    const { durationMs: _durationMs, ...cost } = result.cost ?? ({} as Record<string, unknown>);
+    expect(JSON.stringify(cost)).toBe(PRE_SPLIT_COST_JSON);
+  });
+
+  test("modelContextWindow from the app-server wins over the models.dev fallback", async () => {
+    const { emitted } = await runAppServerTurns([
+      [
+        {
+          total: breakdown(50_000, 40_000, 1_000),
+          last: breakdown(50_000, 40_000, 1_000),
+          modelContextWindow: 258_400,
+        },
+        {
+          total: breakdown(110_000, 90_000, 2_000),
+          last: breakdown(60_000, 50_000, 1_000),
+          modelContextWindow: null,
+        },
+      ],
+    ]);
+
+    const snapshots = emitted.filter((event) => event.type === "context_usage");
+    expect(snapshots).toHaveLength(2);
+    expect(snapshots[0]).toMatchObject({ contextUsedTokens: 51_000, contextTotalTokens: 258_400 });
+    expect(snapshots[0]?.contextPercent).toBeCloseTo((51_000 / 258_400) * 100, 6);
+    // A null window falls back to the models.dev window for the model.
+    expect(snapshots[1]).toMatchObject({
+      contextUsedTokens: 61_000,
+      contextTotalTokens: 1_050_000,
+    });
+  });
+
   test("abort uses turn/interrupt and scrubs complete provider events", async () => {
     const requests: string[] = [];
     const fake = makeFakeAppServer((method, _params, emit) => {
@@ -550,6 +692,13 @@ describe("Codex app-server session", () => {
               outputTokens: 9,
               reasoningOutputTokens: 6,
             },
+            last: {
+              inputTokens: 30,
+              cachedInputTokens: 11,
+              cacheWriteInputTokens: 4,
+              outputTokens: 4,
+              reasoningOutputTokens: 2,
+            },
           },
         });
         emit("turn/completed", {
@@ -581,9 +730,10 @@ describe("Codex app-server session", () => {
     expect(
       emitted.find((event) => event.type === "custom" && event.name === "codex.reasoning"),
     ).toMatchObject({ data: { text: "First thought\nSecond thought" } });
-    expect(emitted.find((event) => event.type === "context_usage")).toMatchObject({
-      contextUsedTokens: 53,
-    });
+    // Context comes from `last` (30 + 4), not the turn total (44 + 9).
+    expect(emitted.filter((event) => event.type === "context_usage")).toEqual([
+      expect.objectContaining({ contextUsedTokens: 34 }),
+    ]);
   });
 
   test("keeps failed-turn usage and treats retrying errors as diagnostics", async () => {
@@ -701,6 +851,10 @@ describe("CodexSession event mapping", () => {
       { type: "thread.started", thread_id: "thread-abc" },
       { type: "turn.started" },
       { type: "item.completed", item: agentMsg as ThreadItem },
+      {
+        type: "context.updated",
+        usage: { input_tokens: 100, cached_input_tokens: 25, output_tokens: 50 },
+      },
       {
         type: "turn.completed",
         usage: { input_tokens: 100, cached_input_tokens: 25, output_tokens: 50 },
@@ -808,15 +962,9 @@ describe("CodexSession event mapping", () => {
     }
   });
 
-  test("Phase 9: chatty turn uses the models.dev context window under the unified formula", async () => {
-    // Phase 9 deliberately swapped Codex's per-adapter peak-proxy formula
-    // (`(input - cached) + output`) for the unified `input + output` formula
-    // shared with every other provider. The trade-off: a chatty Codex turn
-    // — where `input_tokens` is the SUM across every model call in the turn
-    // — over-reports compared to the peak-proxy variant. The clamp at 100%
-    // keeps the gauge sensible; downstream consumers reading the new
-    // `contextFormula='input-cache-output'` tag know it's apples-to-apples
-    // across providers. Numbers below are from the verify-plan transcript.
+  test("a chatty turn's summed usage is billed but never reported as context", async () => {
+    // A turn's usage sums every model request in it, so it can exceed the
+    // window. Only `context.updated` (one request) may become context_usage.
     const agentMsg: AgentMessageItem = {
       id: "msg-1",
       type: "agent_message",
@@ -829,9 +977,9 @@ describe("CodexSession event mapping", () => {
       {
         type: "turn.completed",
         usage: {
-          input_tokens: 357142, // total exceeded the old hardcoded 200k window
-          cached_input_tokens: 278912, // most of input is cache reuse
-          output_tokens: 2156,
+          input_tokens: 4_850_000, // summed across the turn, above the 1.05M window
+          cached_input_tokens: 4_700_000,
+          output_tokens: 54_343,
         },
       },
     ];
@@ -843,22 +991,14 @@ describe("CodexSession event mapping", () => {
 
     const { emitted } = await runSessionWithFakeThread(events, config);
 
-    const contextUsage = emitted.find((e) => e.type === "context_usage");
-    expect(contextUsage).toBeDefined();
-    if (contextUsage && contextUsage.type === "context_usage") {
-      // Phase 9 unified: input + output = 357142 + 2156 = 359298.
-      expect(contextUsage.contextUsedTokens).toBe(359298);
-      expect(contextUsage.contextTotalTokens).toBe(1_050_000);
-      expect(contextUsage.contextPercent).toBeCloseTo((359298 / 1_050_000) * 100, 6);
-      expect(contextUsage.contextFormula).toBe("input-cache-output");
-    }
+    expect(emitted.some((e) => e.type === "context_usage")).toBe(false);
 
     // Cost still uses the full input_tokens — billing semantics are
     // preserved (cached portion gets the cached rate, uncached gets full).
     const resultEvent = emitted.findLast((e) => e.type === "result");
     if (resultEvent && resultEvent.type === "result") {
-      expect(resultEvent.cost.inputTokens).toBe(357142);
-      expect(resultEvent.cost.cacheReadTokens).toBe(278912);
+      expect(resultEvent.cost.inputTokens).toBe(4_850_000);
+      expect(resultEvent.cost.cacheReadTokens).toBe(4_700_000);
       expect(resultEvent.cost.totalCostUsd).toBeGreaterThan(0);
     }
   });

package/src/tests/codex-oauth-auth-timestamps.test.ts

@@ -0,0 +1,76 @@
+import { describe, expect, test } from "bun:test";
+import { codexOAuthAuthJson } from "../../scripts/e2e/harness";
+import { authJsonToCredentials, credentialsToAuthJson } from "../providers/codex-oauth/auth-json";
+import type { CodexOAuthCredentials } from "../providers/codex-oauth/types";
+
+const credentials: CodexOAuthCredentials = {
+  access: "example-access-token",
+  refresh: "example-refresh-token",
+  accountId: "example-account",
+  expires: Date.UTC(2099, 0, 1),
+};
+
+describe("Codex auth.json timestamps", () => {
+  test("records the write time separately from the access-token expiry", () => {
+    const before = Date.now();
+    const auth = credentialsToAuthJson(credentials);
+    const after = Date.now();
+
+    expect(Date.parse(auth.last_refresh)).toBeGreaterThanOrEqual(before);
+    expect(Date.parse(auth.last_refresh)).toBeLessThanOrEqual(after);
+    expect(authJsonToCredentials(auth).expires).toBe(credentials.expires);
+  });
+
+  test("reads expiry from a native CLI JWT instead of last_refresh", () => {
+    const expiresSeconds = 1_800_000_000;
+    const access = `header.${btoa(JSON.stringify({ exp: expiresSeconds }))}.signature`;
+    const auth = {
+      auth_mode: "chatgpt" as const,
+      OPENAI_API_KEY: null,
+      tokens: {
+        id_token: access,
+        access_token: access,
+        refresh_token: credentials.refresh,
+        account_id: credentials.accountId,
+      },
+      last_refresh: "2026-10-01T00:00:00.000Z",
+    };
+
+    expect(authJsonToCredentials(auth).expires).toBe(expiresSeconds * 1000);
+  });
+
+  test("prefers the current JWT over metadata left from an older token", () => {
+    const auth = credentialsToAuthJson(credentials);
+    auth.tokens.access_token = `header.${btoa(JSON.stringify({ exp: 1_800_000_000 }))}.signature`;
+    expect(authJsonToCredentials(auth).expires).toBe(1_800_000_000_000);
+  });
+
+  test("retains the explicit expiry when a JWT has no usable exp claim", () => {
+    for (const exp of [undefined, "1800000000", null, -1]) {
+      const access = `header.${btoa(JSON.stringify({ exp }))}.signature`;
+      const auth = credentialsToAuthJson({ ...credentials, access });
+      expect(authJsonToCredentials(auth).expires).toBe(credentials.expires);
+    }
+  });
+
+  test("keeps the legacy expiry-in-last_refresh fallback for opaque tokens", () => {
+    const auth = credentialsToAuthJson(credentials);
+    delete auth.expires;
+    auth.last_refresh = new Date(credentials.expires).toISOString();
+    expect(authJsonToCredentials(auth).expires).toBe(credentials.expires);
+  });
+
+  test("preserves expiry without exposing a pool refresh token", () => {
+    const auth = credentialsToAuthJson(credentials, { includeRefreshToken: false });
+    expect(auth.tokens.refresh_token).toBe("");
+    expect(authJsonToCredentials(auth).expires).toBe(credentials.expires);
+  });
+
+  test("seeds the black-box harness with separate refresh and expiry timestamps", () => {
+    const before = Date.now();
+    const auth = JSON.parse(codexOAuthAuthJson(JSON.stringify(credentials)));
+    expect(Date.parse(auth.last_refresh)).toBeGreaterThanOrEqual(before);
+    expect(Date.parse(auth.last_refresh)).toBeLessThanOrEqual(Date.now());
+    expect(authJsonToCredentials(auth)).toEqual(credentials);
+  });
+});

package/src/tests/codex-oauth.test.ts

@@ -355,6 +355,7 @@ describe("credentialsToAuthJson", () => {
       accountId: "c724a178-abc",
     };
 
+    const before = Date.now();
     const authJson = credentialsToAuthJson(creds);
     expect(authJson.auth_mode).toBe("chatgpt");
     expect(authJson.OPENAI_API_KEY).toBeNull();
@@ -362,7 +363,9 @@ describe("credentialsToAuthJson", () => {
     expect(authJson.tokens.refresh_token).toBe(creds.refresh);
     expect(authJson.tokens.account_id).toBe(creds.accountId);
     expect(authJson.tokens.id_token).toBe(creds.access);
-    expect(authJson.last_refresh).toBe(new Date(creds.expires).toISOString());
+    expect(Date.parse(authJson.last_refresh)).toBeGreaterThanOrEqual(before);
+    expect(Date.parse(authJson.last_refresh)).toBeLessThanOrEqual(Date.now());
+    expect(authJson.expires).toBe(creds.expires);
   });
 });
 

package/src/tests/connection-embedded-auth.test.ts

@@ -9,6 +9,7 @@ import {
 } from "../be/db";
 import { getOAuthApp, upsertAuthorization, upsertOAuthApp } from "../be/db-queries/oauth";
 import {
+  deleteScriptConnection,
   getScriptApiConnectionDescriptors,
   getScriptConnectionById,
   listRelationalCredentialBindings,
@@ -718,3 +719,53 @@ describe("embedded connection auth", () => {
     }
   });
 });
+
+describe("deleteScriptConnection", () => {
+  test("removes the connection, its managed binding, and its derived inline secret", async () => {
+    createdConfigKeys.push("connection.deleteVendor.secret");
+    const connection = await upsertScriptConnection({
+      slug: "deleteVendor",
+      kind: "graphql",
+      baseUrl: "https://api.vendor.test/graphql",
+      allowedHosts: ["api.vendor.test"],
+      auth: { type: "bearer", secret: "example-delete-tok-123" },
+    });
+    createdConnectionIds.push(connection.id);
+    expect(await managedBindingFor(connection.id)).not.toBeNull();
+    expect(await getSwarmConfigs({ key: "connection.deleteVendor.secret" })).toHaveLength(1);
+
+    const deleted = await deleteScriptConnection(connection.id);
+
+    expect(deleted?.id).toBe(connection.id);
+    expect(await getScriptConnectionById(connection.id)).toBeNull();
+    expect(await managedBindingFor(connection.id)).toBeNull();
+    expect(await getSwarmConfigs({ key: "connection.deleteVendor.secret" })).toHaveLength(0);
+  });
+
+  test("keeps a shared configKey secret the connection does not own", async () => {
+    createdConfigKeys.push("SHARED_DELETE_VENDOR_KEY");
+    await upsertSwarmConfig({
+      scope: "global",
+      key: "SHARED_DELETE_VENDOR_KEY",
+      value: "example-shared-tok",
+      isSecret: true,
+    });
+    const connection = await upsertScriptConnection({
+      slug: "sharedDeleteVendor",
+      kind: "graphql",
+      baseUrl: "https://api.vendor.test/graphql",
+      allowedHosts: ["api.vendor.test"],
+      auth: { type: "bearer", configKey: "SHARED_DELETE_VENDOR_KEY" },
+    });
+    createdConnectionIds.push(connection.id);
+
+    expect((await deleteScriptConnection(connection.id))?.id).toBe(connection.id);
+
+    expect(await managedBindingFor(connection.id)).toBeNull();
+    expect(await getSwarmConfigs({ key: "SHARED_DELETE_VENDOR_KEY" })).toHaveLength(1);
+  });
+
+  test("returns null for an unknown id", async () => {
+    expect(await deleteScriptConnection("00000000-0000-4000-8000-000000000000")).toBeNull();
+  });
+});

package/src/tests/context-window.test.ts

@@ -32,9 +32,9 @@ describe("getContextWindowSize", () => {
     expect(getContextWindowSize("sonnet")).toBe(1_000_000);
   });
 
-  test("returns 200K for haiku models", () => {
+  test("returns 200K for Haiku 4.5 and 1M for the haiku shortname (Haiku 5.5)", () => {
     expect(getContextWindowSize("claude-haiku-4-5")).toBe(200_000);
-    expect(getContextWindowSize("haiku")).toBe(200_000);
+    expect(getContextWindowSize("haiku")).toBe(1_000_000);
   });
 
   test("reads OpenAI windows from the catalog", () => {

package/src/tests/credential-check.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, mock, test } from "bun:test";
 import {
   buildCredStatusReport,
+  CREDENTIAL_PROVIDER_CHECKERS,
   checkProviderCredentials,
   isBedrockMode,
   isCredCheckDisabled,
@@ -8,6 +9,7 @@ import {
   shouldRefreshBedrockStatus,
   validateProviderCredentials,
 } from "../commands/provider-credentials";
+import { ACP_TARGET_IDS } from "../providers/acp-target-catalog";
 import { checkClaudeCredentials } from "../providers/claude-adapter";
 import { checkClaudeManagedCredentials } from "../providers/claude-managed-adapter";
 import { checkCodexCredentials } from "../providers/codex-adapter";
@@ -660,6 +662,54 @@ describe("checkOpencodeCredentials", () => {
   });
 });
 
+describe("ACP readiness", () => {
+  test.each(["typo", "", " \t "])("rejects unsupported target %j", async (target) => {
+    const status = await checkProviderCredentials("acp", {
+      ACP_TARGET: target,
+      ACP_TARGET_COMMAND: "custom-acp --stdio",
+    });
+    expect(status.ready).toBe(false);
+    expect(status.missing).toEqual(["ACP_TARGET"]);
+    expect(status.hint).toContain("ACP_TARGET");
+    for (const supported of ACP_TARGET_IDS) expect(status.hint).toContain(supported);
+  });
+
+  test.each([undefined, "custom"])("requires a command for target %s", async (target) => {
+    const status = await CREDENTIAL_PROVIDER_CHECKERS.acp({ ACP_TARGET: target });
+    expect(status.ready).toBe(false);
+    expect(status.missing).toEqual(["ACP_TARGET_COMMAND"]);
+    expect(status.hint).toContain("ACP_TARGET_COMMAND");
+    expect(status.hint).toContain("ACP_COMMAND");
+  });
+
+  test.each(["", " \t "])("rejects a blank custom command %j", async (command) => {
+    const status = await checkProviderCredentials("acp", {
+      ACP_TARGET: "custom",
+      ACP_TARGET_COMMAND: command,
+      ACP_COMMAND: "legacy-acp",
+    });
+    expect(status.ready).toBe(false);
+    expect(status.missing).toEqual(["ACP_TARGET_COMMAND"]);
+  });
+
+  test.each(["ACP_TARGET_COMMAND", "ACP_COMMAND"])("accepts a command from %s", async (key) => {
+    for (const target of [undefined, "custom"]) {
+      const status = await checkProviderCredentials("acp", {
+        ACP_TARGET: target,
+        [key]: "custom-acp --stdio",
+      });
+      expect(status).toEqual({ ready: true, missing: [], satisfiedBy: "sdk-delegated" });
+    }
+  });
+
+  test.each(
+    ACP_TARGET_IDS.filter((target) => target !== "custom"),
+  )("keeps preset %s ready without a custom command", async (target) => {
+    const status = await checkProviderCredentials("acp", { ACP_TARGET: target });
+    expect(status).toEqual({ ready: true, missing: [], satisfiedBy: "sdk-delegated" });
+  });
+});
+
 // ─── dispatcher ──────────────────────────────────────────────────────────────
 
 describe("checkProviderCredentials dispatcher", () => {
@@ -720,7 +770,7 @@ describe("checkProviderCredentials dispatcher", () => {
       ).ready,
     ).toBe(true);
 
-    const acpStatus = await checkProviderCredentials("acp", {});
+    const acpStatus = await checkProviderCredentials("acp", { ACP_TARGET: "opencode" });
     expect(acpStatus.ready).toBe(true);
     expect(acpStatus.satisfiedBy).toBe("sdk-delegated");
   });

package/src/tests/docs-index-footprint.test.js

@@ -78,7 +78,7 @@ describe("docs API index footprint", () => {
     expect(tasks).toContain('"path":"/api/task-templates","method":"get"');
   });
 
-  test("OpenAPI and generated pages keep all 399 operations", async () => {
+  test("OpenAPI and generated pages keep all 400 operations", async () => {
     const spec = await Bun.file(resolve(repoRoot, "openapi.json")).json();
     const operationKeys = [];
     const tags = new Set();
@@ -103,8 +103,8 @@ describe("docs API index footprint", () => {
     expect(spec.paths["/api/agents/{id}/runtime"]?.get).toBeDefined();
 
     const generatedKeys = await generatedOperationKeys();
-    expect(operationKeys).toHaveLength(399);
-    expect(generatedKeys).toHaveLength(399);
+    expect(operationKeys).toHaveLength(400);
+    expect(generatedKeys).toHaveLength(400);
     expect(new Set(generatedKeys)).toEqual(new Set(operationKeys));
   });
 

package/src/tests/dsh-adapter.test.ts

@@ -9,7 +9,10 @@ import type { ProviderEvent, ProviderSessionConfig } from "../providers/types";
 import { DEFAULT_MODEL_TIER_MAP } from "../types";
 import { getModelAwareCredentialVars } from "../utils/credentials";
 import { resolveHarnessProvider } from "../utils/harness-provider";
-import { DEFAULT_OPENROUTER_BASE_URL } from "../utils/openrouter-base-url";
+import {
+  DEFAULT_OPENROUTER_BASE_URL,
+  OPENROUTER_APP_ATTRIBUTION_HEADERS,
+} from "../utils/openrouter-base-url";
 
 const directories: string[] = [];
 afterEach(async () => {
@@ -166,6 +169,7 @@ describe("dsh harness", () => {
             openrouter: {
               apiKeyEnv: "OPENROUTER_API_KEY",
               baseURL: DEFAULT_OPENROUTER_BASE_URL,
+              headers: OPENROUTER_APP_ATTRIBUTION_HEADERS,
               api: "openai-completions",
               models: [{ id: modelId }],
             },
@@ -316,6 +320,24 @@ describe("dsh harness", () => {
       model: "deepseek/deepseek-v4.1-flash",
     });
     expect(patch[2].config.providers.openrouter.baseURL).toBe("https://gateway.example/proxy/v1");
+    // A gateway gets no OpenRouter app attribution.
+    expect(patch[2].config.providers.openrouter).not.toHaveProperty("headers");
+  });
+
+  test("OPENROUTER_APP_ATTRIBUTION=false drops the attribution headers", async () => {
+    const config = await fixture();
+    config.model = "openrouter/vendor/new-model";
+    config.env = {
+      ...config.env,
+      DEEPSEEK_API_KEY: "",
+      OPENROUTER_API_KEY: "openrouter-test-key",
+      OPENROUTER_APP_ATTRIBUTION: "false",
+    };
+    const session = await new DshAdapter().createSession(config);
+    expect((await session.waitForCompletion()).isError).toBe(false);
+    const { patch } = await Bun.file(join(config.cwd, "invocation.json")).json();
+    expect(patch[2].config.providers.openrouter.baseURL).toBe(DEFAULT_OPENROUTER_BASE_URL);
+    expect(patch[2].config.providers.openrouter).not.toHaveProperty("headers");
   });
 
   test("bare models keep direct DeepSeek when both keys exist", async () => {
@@ -354,7 +376,7 @@ describe("dsh harness", () => {
     await rename(join(config.cwd, "dsh"), join(config.cwd, "npx"));
     config.env = { ...config.env, DSH_BINARY: "", PATH: config.cwd };
     await expect(new DshAdapter().createSession(config)).rejects.toThrow(
-      "dsh CLI not found. Install @deepseek-ai/dsh@0.2.1-alpha.1",
+      "dsh CLI not found. Install @deepseek-ai/dsh@0.2.1-alpha.2",
     );
     expect(await Bun.file(join(config.cwd, "invocation.json")).exists()).toBe(false);
   });