@desplega.ai/agent-swarm 1.172.0 → 2.0.0

package/src/tests/opencode-adapter.test.ts

@@ -7,18 +7,20 @@
  * config wiring, steering, abort, and stream-death handling.
  */
 
-import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
+import { afterAll, afterEach, beforeAll, describe, expect, spyOn, test } from "bun:test";
 import type { OpenCodeEvent } from "@opencode/sdk";
 import { normalizeSessionLogs, type SessionLogRecord } from "../../apps/ui/src/logs-parser";
 import {
   _setOpencodeSdkLoaderForTests,
   _setOpencodeSessionHooksForTests,
   applyOpenRouterBaseUrlOverride,
+  applyProviderKeySplice,
   OpencodeAdapter,
   type OpencodeSession,
   resolveOpencodeSdkSpecifier,
 } from "../providers/opencode-adapter";
 import type { ProviderEvent, ProviderSessionConfig } from "../providers/types";
+import { clearVolatileSecretsForTesting } from "../utils/secret-scrubber";
 
 const SESSION_ID = "ses_test";
 
@@ -63,6 +65,8 @@ type FakeHostOptions = {
   mcpStatuses?: Array<McpStatus | null>;
   /** Registered tool ids the plugin's tool lister returns. */
   tools?: string[];
+  /** Model responses handed to the plugin's `http.response` hook at startup. */
+  responses?: Response[];
 };
 
 /**
@@ -83,6 +87,11 @@ function makeFakeHost(events: OpenCodeEvent[], opts: FakeHostOptions = {}) {
     interrupts: [] as unknown[],
     closeCalls: 0,
     mcpListCalls: 0,
+    /** Session hooks the plugins registered, with their options. */
+    sessionHooks: {} as Record<
+      string,
+      { fn: (event: any) => unknown; options?: { providerID?: string } }
+    >,
     mcp: {
       list: async () => {
         const status = statuses[Math.min(host.mcpListCalls, statuses.length - 1)];
@@ -91,6 +100,7 @@ function makeFakeHost(events: OpenCodeEvent[], opts: FakeHostOptions = {}) {
       },
     },
     tools: opts.tools ?? ["read", "swarm_store-progress"],
+    responses: opts.responses ?? [],
     sessions: {
       create: async (input: unknown) => {
         host.created.push(input);
@@ -120,13 +130,14 @@ function makeFakeHost(events: OpenCodeEvent[], opts: FakeHostOptions = {}) {
   return host;
 }
 
-function installHost(host: FakeHost) {
+function installHost(host: FakeHost, onCreate?: (options: Record<string, unknown>) => void) {
   _setOpencodeSdkLoaderForTests(async () => ({
     version: "2.0.28",
     sdk: {
       OpenCode: {
         create: async (options: Record<string, unknown>) => {
           host.createOptions = options;
+          onCreate?.(options);
           // Set the plugins up the way OpenCode does, with a stub context.
           const plugins = options.plugins as Array<{ setup: (ctx: unknown) => Promise<void> }>;
           for (const plugin of plugins) {
@@ -135,9 +146,22 @@ function installHost(host: FakeHost) {
                 hook: async () => {},
                 list: async () => host.tools.map((id) => ({ id })),
               },
-              session: { hook: async () => {} },
+              // Registered when the session config carries a per-task env.
+              shell: { hook: async () => {} },
+              session: {
+                hook: async (
+                  name: string,
+                  fn: (event: unknown) => unknown,
+                  options?: { providerID?: string },
+                ) => {
+                  host.sessionHooks[name] = { fn, options };
+                },
+              },
             });
           }
+          for (const response of host.responses) {
+            await host.sessionHooks["http.response"]?.fn({ response });
+          }
           return host;
         },
       },
@@ -445,6 +469,118 @@ describe("OpencodeSession — event mapping", () => {
   });
 });
 
+describe("OpencodeSession — cost of an OpenRouter session", () => {
+  // Task 06c031dd (opencode 2.0.28, openrouter/deepseek/deepseek-v4.1-flash),
+  // verbatim from session_logs: a title call, then three agent steps.
+  // `session.usage.updated` is cumulative; `output` excludes reasoning.
+  const deepseek = testConfig({ model: "openrouter/deepseek/deepseek-v4.1-flash" });
+  const usage = (cost: number, input: number, output: number, reasoning: number, read: number) =>
+    ev("session.usage.updated", {
+      sessionID: SESSION_ID,
+      cost,
+      tokens: { input, output, reasoning, cache: { read, write: 0 } },
+    });
+  const step = (cost: number, input: number, output: number, reasoning: number, read: number) =>
+    ev("session.step.ended", {
+      sessionID: SESSION_ID,
+      finish: "tool-calls",
+      cost,
+      tokens: { input, output, reasoning, cache: { read, write: 0 } },
+    });
+  const v2Events = [
+    usage(0.00010640000000000001, 1019, 9, 0, 0),
+    step(0.00023894900000000002, 51770, 53, 26, 0),
+    usage(0.000345349, 52789, 62, 26, 0),
+    step(0.0005280831000000001, 12963, 102, 7, 51840),
+    usage(0.0008734321000000001, 65752, 164, 33, 51840),
+    step(0.0005287785, 165, 15, 0, 64896),
+    usage(0.0014022106, 65917, 179, 33, 116736),
+    succeeded,
+  ];
+
+  // OpenRouter's final SSE chunk for deepseek/deepseek-v4.1-flash, served by
+  // Together (live probe, 2026-10-14): `usage.cost` is the billed USD.
+  const openRouterSse = (cost: number, cached: number) =>
+    new Response(
+      [
+        ": OPENROUTER PROCESSING",
+        "",
+        `data: ${JSON.stringify({ id: "gen-1", choices: [{ index: 0, delta: { content: "pong" } }] })}`,
+        "",
+        `data: ${JSON.stringify({
+          id: "gen-1",
+          provider: "Together",
+          model: "deepseek/deepseek-v4.1-flash",
+          choices: [{ index: 0, delta: {}, finish_reason: "stop" }],
+          usage: {
+            prompt_tokens: 26545,
+            completion_tokens: 15,
+            total_tokens: 26560,
+            cost,
+            is_byok: false,
+            prompt_tokens_details: { cached_tokens: cached, cache_write_tokens: 0 },
+            completion_tokens_details: { reasoning_tokens: 11 },
+          },
+        })}`,
+        "",
+        "data: [DONE]",
+        "",
+      ].join("\n"),
+      { headers: { "content-type": "text/event-stream" } },
+    );
+
+  test("reports v2 tokens with reasoning billed as output", async () => {
+    const { result } = await runSession(v2Events, deepseek);
+    expect(result.cost).toMatchObject({
+      totalCostUsd: 0.0014022106,
+      inputTokens: 65917,
+      outputTokens: 212,
+      reasoningOutputTokens: 33,
+      cacheReadTokens: 116736,
+      cacheWriteTokens: 0,
+      numTurns: 3,
+    });
+    expect(result.cost?.harnessCostBilled).toBeUndefined();
+  });
+
+  test("reports OpenRouter's billed cost when every response carried one", async () => {
+    const { result } = await runSession(v2Events, deepseek, {
+      responses: [
+        openRouterSse(0.0079815, 0),
+        openRouterSse(0.000191676, 26496),
+        new Response('{"error":{"message":"rate limited"}}', { status: 429 }),
+      ],
+    });
+    expect(result.cost?.harnessCostBilled).toBe(true);
+    expect(result.cost?.totalCostUsd).toBeCloseTo(0.0079815 + 0.000191676, 12);
+    expect(result.cost?.inputTokens).toBe(65917);
+  });
+
+  test("falls back to OpenCode's estimate when a response has no billed cost", async () => {
+    const { result } = await runSession(v2Events, deepseek, {
+      responses: [openRouterSse(0.0079815, 0), new Response("data: [DONE]\n\n")],
+    });
+    expect(result.cost?.harnessCostBilled).toBeUndefined();
+    expect(result.cost?.totalCostUsd).toBe(0.0014022106);
+  });
+
+  test("hooks only OpenRouter responses, and only for an OpenRouter model", async () => {
+    const openrouter = await runSession([succeeded], deepseek);
+    expect(openrouter.host.sessionHooks["http.response"]?.options).toEqual({
+      providerID: "openrouter",
+    });
+    const direct = await runSession([succeeded], testConfig({ model: "anthropic/claude-haiku" }));
+    expect(direct.host.sessionHooks["http.response"]).toBeUndefined();
+  });
+
+  test("skips title generation", async () => {
+    const { host } = await runSession([succeeded]);
+    const event: { result?: string } = {};
+    await host.sessionHooks.title?.fn(event);
+    expect(event.result).toBe("swarm task task-1");
+  });
+});
+
 describe("OpencodeSession — persisted rows render in the dashboard", () => {
   test("text, tools and errors render once each, in order", async () => {
     const text = (ordinal: number, value: string, messageID = "msg_1") => [
@@ -710,3 +846,212 @@ describe("OpenRouter attribution config", () => {
     expect(config).toEqual({});
   });
 });
+
+describe("provider key splice (one picked key per task)", () => {
+  const PICKED = "sk-picked-member-0123456789";
+  const POOL = "sk-pool-member-aaaaaaaaaa,sk-pool-member-bbbbbbbbbb";
+  const SPLICE_VARS = [
+    "NAN_API_KEY",
+    "HELMCODE_API_NAN",
+    "HELMCODE_API_KEY",
+    "OPENROUTER_API_KEY",
+    "OPENROUTER_BASE_URL",
+  ];
+  const saved: Record<string, string | undefined> = {};
+  beforeAll(() => {
+    for (const key of SPLICE_VARS) saved[key] = process.env[key];
+  });
+  afterEach(() => {
+    for (const key of SPLICE_VARS) {
+      if (saved[key] === undefined) delete process.env[key];
+      else process.env[key] = saved[key];
+    }
+    clearVolatileSecretsForTesting();
+  });
+
+  test("nan: env [] and the per-task key, even with a pool in process.env", async () => {
+    process.env.NAN_API_KEY = POOL;
+    const { host } = await runSession(
+      [succeeded],
+      testConfig({ model: "nan/glm5.3-flash", env: { NAN_API_KEY: PICKED } }),
+    );
+    const nan = configOf(host).provider.nan;
+    expect(nan.env).toEqual([]);
+    expect(nan.options.apiKey).toBe(PICKED);
+  });
+
+  test("nan: the HELMCODE_API_NAN alias is read when NAN_API_KEY is empty", () => {
+    const config = {};
+    const picked = applyProviderKeySplice(config, "nan/qwen3.6", { HELMCODE_API_NAN: PICKED });
+    expect(picked).toEqual({ key: PICKED, name: "HELMCODE_API_NAN" });
+    expect(config).toEqual({ provider: { nan: { env: [], options: { apiKey: PICKED } } } });
+  });
+
+  test("a pool that reaches the splice unpicked yields its first member", () => {
+    const config = {};
+    applyProviderKeySplice(config, "nan/qwen3.6", {
+      NAN_API_KEY: ` ${PICKED} , sk-other-0000000000`,
+    });
+    expect(config).toEqual({ provider: { nan: { env: [], options: { apiKey: PICKED } } } });
+  });
+
+  test("helmcode: full custom block with limits, reasoning options merged in", async () => {
+    const { host } = await runSession(
+      [succeeded],
+      testConfig({
+        model: "helmcode/glm5.3",
+        reasoningEffort: "high",
+        env: { HELMCODE_API_KEY: PICKED },
+      }),
+    );
+    const helmcode = configOf(host).provider.helmcode;
+    expect(helmcode).toMatchObject({
+      npm: "@ai-sdk/openai-compatible",
+      name: "Helmcode",
+      env: [],
+      options: { baseURL: "https://api.helmcode.com/v1", apiKey: PICKED },
+    });
+    expect(helmcode.models["glm5.3"]).toEqual({
+      name: "GLM-5.3",
+      tool_call: true,
+      reasoning: true,
+      limit: { context: 1048576, output: 32768 },
+      options: { reasoningEffort: "high" },
+    });
+    expect(Object.keys(helmcode.models)).toEqual([
+      "deepseek-v4-flash",
+      "glm5.3",
+      "glm5.3-flash",
+      "qwen3.6",
+      "gemma4",
+    ]);
+  });
+
+  test("helmcode: a model missing from the table still gets an entry", () => {
+    const config: Record<string, any> = {};
+    applyProviderKeySplice(config, "helmcode/brand-new", { HELMCODE_API_KEY: PICKED });
+    expect(config.provider.helmcode.models["brand-new"]).toEqual({
+      name: "brand-new",
+      tool_call: true,
+    });
+  });
+
+  test("openrouter gateway: baseURL kept next to env [] and the picked key", async () => {
+    process.env.OPENROUTER_API_KEY = POOL;
+    const { host } = await runSession(
+      [succeeded],
+      testConfig({
+        model: "openrouter/deepseek/deepseek-v4-flash",
+        env: { OPENROUTER_API_KEY: PICKED, OPENROUTER_BASE_URL: "http://127.0.0.1:1234/v1" },
+      }),
+    );
+    expect(configOf(host).provider.openrouter).toEqual({
+      env: [],
+      options: { apiKey: PICKED, baseURL: "http://127.0.0.1:1234/v1" },
+    });
+  });
+
+  test("openrouter host: attribution headers kept next to env [] and the picked key", async () => {
+    const { host } = await runSession(
+      [succeeded],
+      testConfig({
+        model: "openrouter/deepseek/deepseek-v4-flash",
+        env: { OPENROUTER_API_KEY: PICKED },
+      }),
+    );
+    const openrouter = configOf(host).provider.openrouter;
+    expect(openrouter.env).toEqual([]);
+    expect(openrouter.options.apiKey).toBe(PICKED);
+    expect(openrouter.options.headers).toMatchObject({ "X-Title": "Agent Swarm" });
+  });
+
+  test("no splice without a key, or for providers outside the splice", () => {
+    for (const model of ["nan/qwen3.6", "helmcode/glm5.3", "openrouter/x/y"]) {
+      const config = {};
+      expect(applyProviderKeySplice(config, model, {})).toBeUndefined();
+      expect(config).toEqual({});
+    }
+    for (const model of ["anthropic/claude-sonnet-4-5", "openai/gpt-5", "glm5.3", "", undefined]) {
+      const config = {};
+      applyProviderKeySplice(config, model, {
+        ANTHROPIC_API_KEY: PICKED,
+        OPENAI_API_KEY: PICKED,
+        NAN_API_KEY: PICKED,
+      });
+      expect(config).toEqual({});
+    }
+  });
+});
+
+describe("spliced key never reaches logs, events, or errors", () => {
+  // Not in process.env: the key a dashboard save delivers to the per-task env only.
+  const SENTINEL = "sk-nan-sentinel-do-not-log-4f9c2e";
+  let captured: string[] = [];
+  let spies: Array<ReturnType<typeof spyOn>> = [];
+  beforeAll(() => {
+    delete process.env.NAN_API_KEY;
+  });
+  afterEach(() => {
+    for (const spy of spies) spy.mockRestore();
+    spies = [];
+    captured = [];
+    clearVolatileSecretsForTesting();
+  });
+  function captureConsole() {
+    for (const method of ["log", "info", "warn", "error", "debug"] as const) {
+      spies.push(
+        spyOn(console, method).mockImplementation((...args: unknown[]) => {
+          captured.push(args.map((a) => (typeof a === "string" ? a : JSON.stringify(a))).join(" "));
+        }),
+      );
+    }
+  }
+
+  test("SDK log lines and a provider failure that echo the config are scrubbed", async () => {
+    captureConsole();
+    const host = makeFakeHost([
+      ev("session.execution.failed", {
+        sessionID: SESSION_ID,
+        error: { message: `401 Invalid API key ${SENTINEL}` },
+      }),
+    ]);
+    installHost(host, (options) => {
+      const content = (options.config as { content: string }).content;
+      const log = options.log as { emit: (entry: { message: string }) => void };
+      log.emit({ message: `config: ${content}` });
+    });
+    const session = (await new OpencodeAdapter().createSession(
+      testConfig({ model: "nan/glm5.3-flash", env: { NAN_API_KEY: SENTINEL } }),
+    )) as OpencodeSession;
+    const emitted: ProviderEvent[] = [];
+    session.onEvent((e) => emitted.push(e));
+    const result = await session.waitForCompletion();
+
+    // Positive control: the key did reach the SDK config.
+    expect(configOf(host).provider.nan.options.apiKey).toBe(SENTINEL);
+    expect(captured.some((line) => line.includes("[opencode] config:"))).toBe(true);
+    expect(result.isError).toBe(true);
+
+    for (const line of captured) expect(line).not.toContain(SENTINEL);
+    expect(JSON.stringify(emitted)).not.toContain(SENTINEL);
+    expect(result.failureReason ?? "").not.toContain(SENTINEL);
+  });
+
+  test("a host start failure that echoes the config is scrubbed before it propagates", async () => {
+    captureConsole();
+    const host = makeFakeHost([]);
+    installHost(host, (options) => {
+      const content = (options.config as { content: string }).content;
+      throw new Error(`invalid config ${content}`);
+    });
+    const error = await new OpencodeAdapter()
+      .createSession(testConfig({ model: "nan/glm5.3-flash", env: { NAN_API_KEY: SENTINEL } }))
+      .then(
+        () => undefined,
+        (err: unknown) => err as Error,
+      );
+    expect(error?.message).toStartWith("opencode host failed to start: invalid config");
+    expect(error?.message).not.toContain(SENTINEL);
+    for (const line of captured) expect(line).not.toContain(SENTINEL);
+  });
+});

package/src/tests/opencode-billing.test.ts

@@ -0,0 +1,28 @@
+import { describe, expect, test } from "bun:test";
+import { OpenRouterBilling, parseOpenRouterBilledCost } from "../providers/opencode-billing";
+
+describe("parseOpenRouterBilledCost", () => {
+  test("reads usage.cost from a non-streamed JSON body", () => {
+    expect(parseOpenRouterBilledCost('{"id":"gen-1","usage":{"cost":0.0042}}')).toBe(0.0042);
+  });
+
+  test("a BYOK cost is only OpenRouter's fee, so it is not the bill", () => {
+    expect(parseOpenRouterBilledCost('{"usage":{"cost":0.0001,"is_byok":true}}')).toBeNull();
+  });
+
+  test("a stream without usage has no billed cost", () => {
+    expect(parseOpenRouterBilledCost('data: {"choices":[]}\n\ndata: [DONE]\n\n')).toBeNull();
+  });
+});
+
+describe("OpenRouterBilling", () => {
+  test("no observed request reports nothing", async () => {
+    expect(await new OpenRouterBilling().settle(10)).toBeNull();
+  });
+
+  test("a body still streaming at the deadline leaves the bill incomplete", async () => {
+    const billing = new OpenRouterBilling();
+    billing.observe(new Response(new ReadableStream({ start() {} })));
+    expect(await billing.settle(10)).toEqual({ costUsd: 0, complete: false });
+  });
+});

package/src/tests/opencode-helmcode-sdk.test.ts

@@ -0,0 +1,201 @@
+/**
+ * The provider key splice and the `helmcode` block, run through the real
+ * `@opencode/sdk` embedded host against a fake OpenAI-compatible server.
+ *
+ * `applyProviderKeySplice` builds the provider entry; the test only repoints
+ * `options.baseURL` at a local `Bun.serve({ port: 0 })` that answers
+ * `/v1/chat/completions`, then checks the request OpenCode sent: the picked
+ * pool member as the bearer (not the comma pool sitting in `process.env`) and
+ * the bare model id. The model catalog is bundled in the SDK, and no request
+ * leaves the machine. The control test pins why `env: []` is needed: without
+ * it, the pool in `process.env` beats `options.apiKey`.
+ */
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { OpenCode, type OpenCodeEvent } from "@opencode/sdk";
+import { applyProviderKeySplice, type OpencodeConfig } from "../providers/opencode-adapter";
+
+const TEST_TIMEOUT_MS = 60_000;
+
+const PICKED = "sk-helmcode-picked-live-0123456789";
+const POOL_IN_PROCESS_ENV = "sk-helmcode-wrong-aaaaaaaaaa,sk-helmcode-wrong-bbbbbbbbbb";
+
+type SeenRequest = { path: string; authorization: string | null; model?: string };
+
+let server: ReturnType<typeof Bun.serve>;
+let directory: string;
+const seen: SeenRequest[] = [];
+let prevHelmcodeKey: string | undefined;
+
+/** One streamed (or plain) assistant turn that says "pong". */
+function completion(model: string, stream: boolean): Response {
+  const base = { id: "chatcmpl-test", created: 0, model };
+  const usage = { prompt_tokens: 5, completion_tokens: 1, total_tokens: 6 };
+  if (!stream) {
+    return Response.json({
+      ...base,
+      object: "chat.completion",
+      choices: [
+        {
+          index: 0,
+          message: { role: "assistant", content: "pong" },
+          finish_reason: "stop",
+        },
+      ],
+      usage,
+    });
+  }
+  const chunk = (body: Record<string, unknown>) =>
+    `data: ${JSON.stringify({ ...base, object: "chat.completion.chunk", ...body })}\n\n`;
+  const sse =
+    chunk({
+      choices: [{ index: 0, delta: { role: "assistant", content: "pong" }, finish_reason: null }],
+    }) +
+    chunk({ choices: [{ index: 0, delta: {}, finish_reason: "stop" }], usage }) +
+    "data: [DONE]\n\n";
+  return new Response(sse, { headers: { "content-type": "text/event-stream" } });
+}
+
+beforeAll(() => {
+  directory = mkdtempSync(join(tmpdir(), "opencode-helmcode-sdk-"));
+  server = Bun.serve({
+    port: 0,
+    async fetch(req) {
+      const url = new URL(req.url);
+      const body = req.method === "POST" ? ((await req.json().catch(() => ({}))) as any) : {};
+      seen.push({
+        path: url.pathname,
+        authorization: req.headers.get("authorization"),
+        model: body?.model,
+      });
+      if (url.pathname.endsWith("/chat/completions")) {
+        return completion(String(body?.model ?? ""), body?.stream === true);
+      }
+      return new Response("not found", { status: 404 });
+    },
+  });
+  // The pool a production entrypoint exports raw; the splice must beat it.
+  prevHelmcodeKey = process.env.HELMCODE_API_KEY;
+  process.env.HELMCODE_API_KEY = POOL_IN_PROCESS_ENV;
+});
+
+afterAll(() => {
+  server.stop(true);
+  rmSync(directory, { recursive: true, force: true });
+  if (prevHelmcodeKey === undefined) delete process.env.HELMCODE_API_KEY;
+  else process.env.HELMCODE_API_KEY = prevHelmcodeKey;
+});
+
+async function runOnePrompt(config: OpencodeConfig): Promise<string> {
+  const host = await OpenCode.create({
+    config: { content: JSON.stringify(config) },
+    plugins: [],
+    log: { level: "error", emit: () => {} },
+  });
+  try {
+    const session = await host.sessions.create({ location: { directory } });
+    const done = (async () => {
+      for await (const event of host.events.subscribe() as AsyncIterable<OpenCodeEvent>) {
+        const data = (event as { data?: { sessionID?: string; error?: unknown } }).data;
+        if (data?.sessionID !== session.id) continue;
+        if (event.type === "session.execution.succeeded") return "succeeded";
+        if (event.type === "session.execution.failed") {
+          return `failed: ${JSON.stringify(data.error)}`;
+        }
+      }
+      return "stream ended";
+    })();
+    await host.sessions.prompt({ sessionID: session.id, text: "say pong", delivery: "queue" });
+    return await done;
+  } finally {
+    await host.close();
+  }
+}
+
+describe("provider key splice through the real OpenCode host", () => {
+  test(
+    "sends the picked key and the bare model id to the provider's baseURL",
+    async () => {
+      seen.length = 0;
+      const model = "helmcode/glm5.3";
+      const config: OpencodeConfig = { model };
+      const spliced = applyProviderKeySplice(config, model, { HELMCODE_API_KEY: PICKED });
+      expect(spliced?.name).toBe("HELMCODE_API_KEY");
+      const helmcode = config.provider?.helmcode;
+      if (!helmcode?.options) throw new Error("helmcode block missing");
+      helmcode.options.baseURL = `http://127.0.0.1:${server.port}/v1`;
+
+      const outcome = await runOnePrompt(config);
+
+      const chats = seen.filter((r) => r.path === "/v1/chat/completions");
+      expect(chats.length).toBeGreaterThan(0);
+      for (const chat of chats) {
+        expect(chat.authorization).toBe(`Bearer ${PICKED}`);
+        expect(chat.model).toBe("glm5.3");
+      }
+      expect(outcome).toBe("succeeded");
+    },
+    TEST_TIMEOUT_MS,
+  );
+
+  test(
+    "nan (built-in provider): env [] plus the picked key beats a pool in process.env",
+    async () => {
+      const prevNan = process.env.NAN_API_KEY;
+      process.env.NAN_API_KEY = POOL_IN_PROCESS_ENV;
+      seen.length = 0;
+      try {
+        const model = "nan/glm5.3-flash";
+        const config: OpencodeConfig = { model };
+        const spliced = applyProviderKeySplice(config, model, { NAN_API_KEY: PICKED });
+        expect(spliced?.name).toBe("NAN_API_KEY");
+        const nan = config.provider?.nan;
+        if (!nan?.options) throw new Error("nan block missing");
+        nan.options.baseURL = `http://127.0.0.1:${server.port}/v1`;
+
+        const outcome = await runOnePrompt(config);
+
+        const chats = seen.filter((r) => r.path === "/v1/chat/completions");
+        expect(chats.length).toBeGreaterThan(0);
+        for (const chat of chats) {
+          expect(chat.authorization).toBe(`Bearer ${PICKED}`);
+          expect(chat.model).toBe("glm5.3-flash");
+        }
+        expect(outcome).toBe("succeeded");
+      } finally {
+        if (prevNan === undefined) delete process.env.NAN_API_KEY;
+        else process.env.NAN_API_KEY = prevNan;
+      }
+    },
+    TEST_TIMEOUT_MS,
+  );
+
+  test(
+    "nan control: without the splice the pool in process.env reaches the provider",
+    async () => {
+      const prevNan = process.env.NAN_API_KEY;
+      process.env.NAN_API_KEY = POOL_IN_PROCESS_ENV;
+      seen.length = 0;
+      try {
+        const model = "nan/glm5.3-flash";
+        const config: OpencodeConfig = {
+          model,
+          provider: {
+            nan: { options: { apiKey: PICKED, baseURL: `http://127.0.0.1:${server.port}/v1` } },
+          },
+        };
+        await runOnePrompt(config);
+        const chats = seen.filter((r) => r.path === "/v1/chat/completions");
+        expect(chats.length).toBeGreaterThan(0);
+        expect(chats[0]?.authorization).not.toBe(`Bearer ${PICKED}`);
+      } finally {
+        if (prevNan === undefined) delete process.env.NAN_API_KEY;
+        else process.env.NAN_API_KEY = prevNan;
+      }
+    },
+    TEST_TIMEOUT_MS,
+  );
+});