@desplega.ai/agent-swarm 1.173.0 → 2.1.0

package/src/tests/model-tier-resolution.test.ts

@@ -267,6 +267,99 @@ describe("claim-time resolution via /api/poll", () => {
   });
 });
 
+// A row that already ran carries that run's model: the session report wrote it
+// into `model`, and the claim wrote `resolvedModel`/`modelSource`. Re-claiming
+// it must resolve from the config in force NOW, not replay the previous run.
+describe("re-claim after a previous run", () => {
+  async function markRan(
+    taskId: string,
+    fields: { model: string; resolvedModel?: string; modelSource?: string },
+  ): Promise<void> {
+    await getDbClient().run(
+      `UPDATE agent_tasks SET model = ?, resolvedModel = ?, modelSource = ?,
+         claudeSessionId = 'previous-session', status = 'pending' WHERE id = ?`,
+      [fields.model, fields.resolvedModel ?? null, fields.modelSource ?? null, taskId],
+    );
+  }
+
+  test("an unpinned task drops the previous run's model, so the agent's current config applies", async () => {
+    const worker = await createAgent({
+      name: "rerun-unpinned",
+      isLead: false,
+      status: "idle",
+      maxTasks: 1,
+      harnessProvider: "claude",
+    });
+    const task = await createTaskExtended("plain work", { agentId: worker.id });
+    // First run: no pin, MODEL_OVERRIDE was opus, the session reported it.
+    await markRan(task.id, { model: "claude-opus-5-5" });
+
+    const trigger = await callPoll(worker.id);
+
+    expect(trigger?.type).toBe("task_assigned");
+    // No `model` in the trigger: the worker falls through to MODEL_OVERRIDE.
+    expect(trigger?.task.model).toBeUndefined();
+    expect(trigger?.task.resolvedModel).toBeUndefined();
+    expect(await taskRow(task.id)).toEqual({
+      resolvedModel: null,
+      modelSource: null,
+      modelAlias: null,
+    });
+  });
+
+  test("a tier task re-resolves the tier after the tier config changed", async () => {
+    const worker = await createAgent({
+      name: "rerun-tier",
+      isLead: false,
+      status: "idle",
+      maxTasks: 1,
+      harnessProvider: "claude",
+    });
+    const task = await createTaskExtended("smart work", { agentId: worker.id, modelTier: "smart" });
+    await markRan(task.id, {
+      model: "claude-opus-5-5",
+      resolvedModel: "claude-opus-5-5",
+      modelSource: "tier-config",
+    });
+    process.env.MODEL_TIER_CLAUDE_SMART = "claude-sonnet-5-5";
+
+    const trigger = await callPoll(worker.id, header({}));
+
+    expect(trigger?.task.model).toBeUndefined();
+    expect(trigger?.task.resolvedModel).toBe("claude-sonnet-5-5");
+    expect(await taskRow(task.id)).toEqual({
+      resolvedModel: "claude-sonnet-5-5",
+      modelSource: "tier-config",
+      modelAlias: null,
+    });
+  });
+
+  test("a task-pinned model stays pinned on re-claim", async () => {
+    const worker = await createAgent({
+      name: "rerun-pinned",
+      isLead: false,
+      status: "idle",
+      maxTasks: 1,
+      harnessProvider: "claude",
+    });
+    const task = await createTaskExtended("pinned work", {
+      agentId: worker.id,
+      model: "claude-sonnet-5-5",
+    });
+    await markRan(task.id, {
+      model: "claude-sonnet-5-5",
+      resolvedModel: "claude-sonnet-5-5",
+      modelSource: "model",
+    });
+
+    const trigger = await callPoll(worker.id);
+
+    expect(trigger?.task.model).toBe("claude-sonnet-5-5");
+    expect(trigger?.task.resolvedModel).toBe("claude-sonnet-5-5");
+    expect((await taskRow(task.id))?.modelSource).toBe("model");
+  });
+});
+
 describe("claim-time harness guard", () => {
   test("a directed task pinning an Anthropic model on a Codex worker fails fast with a tagged reason", async () => {
     const worker = await createAgent({

package/src/tests/models-catalog.test.ts

@@ -11,14 +11,17 @@
  */
 
 import { afterEach, describe, expect, test } from "bun:test";
+import { reasoningLevelsForModel } from "@desplega/model-catalog";
 import {
   buildModelsCatalog,
+  type CatalogProviderId,
   getModelsCatalog,
   PINNED_MODELSDEV_ENTRIES,
   resetModelsCatalogForTests,
   updateLiveModelsCatalog,
 } from "../be/models-catalog";
 import type { ModelsDevCache } from "../be/modelsdev-cache";
+import { getContextWindowSize } from "../utils/context-window";
 
 afterEach(() => {
   resetModelsCatalogForTests();
@@ -82,6 +85,14 @@ describe("getModelsCatalog", () => {
     expect(Object.keys(result.providers.openrouter?.models ?? {}).length).toBeGreaterThan(0);
     expect(Object.keys(result.providers.anthropic?.models ?? {}).length).toBeGreaterThan(0);
     expect(Object.keys(result.providers.opencode?.models ?? {}).length).toBeGreaterThan(0);
+    expect(result.providers.nan?.models["glm5.3-flash"]).toBeDefined();
+    expect(Object.keys(result.providers.helmcode?.models ?? {}).sort()).toEqual([
+      "deepseek-v4-flash",
+      "gemma4",
+      "glm5.3",
+      "glm5.3-flash",
+      "qwen3.6",
+    ]);
   });
 
   test("prefers live data after an update", () => {
@@ -99,7 +110,7 @@ describe("getModelsCatalog", () => {
     const result = getModelsCatalog();
     for (const entryPath of PINNED_MODELSDEV_ENTRIES) {
       const slashIndex = entryPath.indexOf("/");
-      const providerId = entryPath.slice(0, slashIndex) as "anthropic" | "amazon-bedrock";
+      const providerId = entryPath.slice(0, slashIndex) as CatalogProviderId;
       const modelId = entryPath.slice(slashIndex + 1);
       expect(result.providers[providerId]?.models[modelId]).toBeDefined();
     }
@@ -118,3 +129,33 @@ describe("getModelsCatalog", () => {
     expect(result.providers.anthropic?.models["claude-mythos-5"]?.name).toBe("Live Mythos");
   });
 });
+
+describe("nan and helmcode sections", () => {
+  test("the registry-synthesized helmcode section survives a live payload that lacks it", () => {
+    // LIVE_CACHE has no helmcode provider: the registry section is refilled.
+    updateLiveModelsCatalog(LIVE_CACHE);
+    const helmcode = getModelsCatalog().providers.helmcode;
+    expect(helmcode?.id).toBe("helmcode");
+    expect(helmcode?.name).toBe("Helmcode");
+    expect(helmcode?.models["glm5.3"]?.limit?.context).toBe(1_048_576);
+    expect(helmcode?.models["qwen3.6"]?.limit?.context).toBe(262_144);
+  });
+
+  test("reasoning levels resolve for helmcode and nan ids on pi and opencode", () => {
+    const catalog = getModelsCatalog().providers;
+    for (const harness of ["pi", "opencode"]) {
+      expect(
+        reasoningLevelsForModel(harness, "helmcode/glm5.3-flash", catalog).length,
+      ).toBeGreaterThan(0);
+      expect(reasoningLevelsForModel(harness, "nan/glm5.3-flash", catalog).length).toBeGreaterThan(
+        0,
+      );
+    }
+  });
+
+  test("context windows come from the catalog sections", () => {
+    expect(getContextWindowSize("helmcode/glm5.3")).toBe(1_048_576);
+    expect(getContextWindowSize("helmcode/gemma4")).toBe(262_144);
+    expect(getContextWindowSize("nan/qwen3.6")).toBe(262_144);
+  });
+});

package/src/tests/openai-compatible-providers.test.ts

@@ -0,0 +1,134 @@
+import { describe, expect, test } from "bun:test";
+import {
+  baseUrlEnvVar,
+  OPENAI_COMPATIBLE_PROVIDERS,
+  openAICompatibleProviderIds,
+  providerBaseUrl,
+  providerForKeyVar,
+  providerForModel,
+  providerKeyFromEnv,
+  withRegistryCatalogSections,
+} from "@desplega/model-catalog";
+import { loadModelsDevCache } from "../be/modelsdev-cache";
+import snapshot from "../be/modelsdev-cache.json";
+import { normalizeProviderKeyAliases } from "../utils/credentials";
+
+type SnapshotModel = {
+  name: string;
+  reasoning?: boolean;
+  tool_call?: boolean;
+  modalities?: { input?: string[] };
+  limit?: { context?: number; output?: number };
+};
+type SnapshotProvider = {
+  api?: string;
+  env?: string[];
+  npm?: string;
+  models: Record<string, SnapshotModel>;
+};
+
+describe("openai-compatible provider table", () => {
+  test("providerForModel routes by exact prefix only", () => {
+    expect(providerForModel("nan/glm5.3-flash")?.id).toBe("nan");
+    expect(providerForModel("helmcode/gemma4")?.id).toBe("helmcode");
+    expect(providerForModel("openrouter/nan/glm5.3")).toBeUndefined();
+    expect(providerForModel("glm5.3")).toBeUndefined();
+    expect(providerForModel("nanx/glm5.3")).toBeUndefined();
+    expect(providerForModel("toString/x")).toBeUndefined();
+    expect(providerForModel(undefined)).toBeUndefined();
+  });
+
+  test("providerForKeyVar finds canonical and alias key vars", () => {
+    expect(providerForKeyVar("NAN_API_KEY")?.id).toBe("nan");
+    expect(providerForKeyVar("HELMCODE_API_NAN")?.id).toBe("nan");
+    expect(providerForKeyVar("HELMCODE_API_KEY")?.id).toBe("helmcode");
+    expect(providerForKeyVar("OPENROUTER_API_KEY")).toBeUndefined();
+  });
+
+  test("<ID>_BASE_URL overrides the default base URL", () => {
+    const nan = OPENAI_COMPATIBLE_PROVIDERS.nan;
+    const helmcode = OPENAI_COMPATIBLE_PROVIDERS.helmcode;
+    expect(baseUrlEnvVar(nan)).toBe("NAN_BASE_URL");
+    expect(baseUrlEnvVar(helmcode)).toBe("HELMCODE_BASE_URL");
+    expect(providerBaseUrl(nan, {})).toBe("https://api.nan.builders/v1");
+    expect(providerBaseUrl(nan, { NAN_BASE_URL: "  " })).toBe("https://api.nan.builders/v1");
+    expect(providerBaseUrl(helmcode, { HELMCODE_BASE_URL: "http://127.0.0.1:9/v1/" })).toBe(
+      "http://127.0.0.1:9/v1",
+    );
+  });
+
+  test("providerKeyFromEnv prefers the canonical var, then the alias", () => {
+    const nan = OPENAI_COMPATIBLE_PROVIDERS.nan;
+    expect(providerKeyFromEnv(nan, { HELMCODE_API_NAN: "alias" })).toBe("alias");
+    expect(providerKeyFromEnv(nan, { NAN_API_KEY: "canon", HELMCODE_API_NAN: "alias" })).toBe(
+      "canon",
+    );
+    expect(providerKeyFromEnv(nan, { NAN_API_KEY: "  " })).toBeUndefined();
+    expect(providerKeyFromEnv(OPENAI_COMPATIBLE_PROVIDERS.helmcode, { NAN_API_KEY: "k" })).toBe(
+      undefined,
+    );
+  });
+
+  test("normalizeProviderKeyAliases copies an alias only into an empty canonical var", () => {
+    const aliasOnly: Record<string, string | undefined> = { HELMCODE_API_NAN: "alias" };
+    normalizeProviderKeyAliases(aliasOnly);
+    expect(aliasOnly.NAN_API_KEY).toBe("alias");
+    const both: Record<string, string | undefined> = {
+      NAN_API_KEY: "canon",
+      HELMCODE_API_NAN: "alias",
+    };
+    normalizeProviderKeyAliases(both);
+    expect(both.NAN_API_KEY).toBe("canon");
+  });
+
+  test("registry-sourced sections are synthesized, never hand-written in the snapshot", () => {
+    const raw = snapshot as unknown as Record<string, unknown>;
+    for (const id of openAICompatibleProviderIds()) {
+      const entry = OPENAI_COMPATIBLE_PROVIDERS[id];
+      if (entry.catalog === "registry") expect(raw[id]).toBeUndefined();
+      else expect(raw[id]).toBeDefined();
+    }
+    // The server loader carries the synthesized sections.
+    expect(loadModelsDevCache()?.helmcode?.models?.["glm5.3"]?.limit?.context).toBe(1048576);
+  });
+
+  // The registry duplicates the models.dev sections of `catalog: "models.dev"`
+  // entries (the pi/opencode blocks need limits the worker cannot read from
+  // the catalog store); keep the two from drifting. Registry-sourced sections
+  // are built from the registry, so they agree by construction.
+  const merged = withRegistryCatalogSections(
+    snapshot as unknown as Record<string, SnapshotProvider | undefined>,
+  );
+  for (const id of openAICompatibleProviderIds()) {
+    test(`${id} matches its catalog section`, () => {
+      const entry = OPENAI_COMPATIBLE_PROVIDERS[id];
+      const section = merged[id];
+      expect(section).toBeDefined();
+      if (!section) return;
+      // OpenCode's built-in AI Gateway SDK has no OpenAI-compatible `api` URL.
+      if (entry.npm === "@ai-sdk/gateway") expect(section.api).toBeUndefined();
+      else expect(section.api).toBe(entry.baseUrl);
+      expect(section.env).toEqual([entry.envVar]);
+      expect(section.npm).toBe(entry.npm);
+      for (const model of entry.models) {
+        const snap = section.models[model.id];
+        expect(snap, `${id}/${model.id} missing from snapshot`).toBeDefined();
+        if (!snap) continue;
+        expect({
+          name: model.name,
+          contextWindow: model.contextWindow,
+          maxOutputTokens: model.maxOutputTokens,
+          reasoning: model.reasoning,
+          input: [...model.input],
+        }).toEqual({
+          name: snap.name,
+          contextWindow: snap.limit?.context,
+          maxOutputTokens: snap.limit?.output,
+          reasoning: snap.reasoning,
+          input: (snap.modalities?.input ?? []).filter((m) => m === "text" || m === "image"),
+        });
+        expect(snap.tool_call).toBe(true);
+      }
+    });
+  }
+});

package/src/tests/openai-compatible-registry-extension.test.ts

@@ -0,0 +1,42 @@
+/**
+ * Proof that adding an OpenAI-compatible provider takes one registry entry:
+ * a fake `testgw` entry must reach every derived surface
+ * (`fixtures/openai-compatible-registry-extension.child.ts`).
+ *
+ * The proof mocks the registry module, and its consumers cache derivations of
+ * the table at import (integration cards, picker constants) that no mock
+ * restore can undo. It runs in its own `bun test` child so this process, and
+ * every file sharing it in a single-process run, keeps the real table.
+ */
+import { expect, test } from "bun:test";
+import { join } from "node:path";
+import { modelGroupsForHarness } from "../../apps/ui/src/lib/agent-runtime-models";
+import { INTEGRATIONS } from "../../apps/ui/src/lib/integrations-catalog";
+import { CHILD_PROCESS_TEST_BUDGET_MS, expectChildOk, runChild } from "./test-proc";
+
+const REPO_ROOT = join(import.meta.dir, "../..");
+const CHILD = "./src/tests/fixtures/openai-compatible-registry-extension.child.ts";
+
+test(
+  "a testgw registry entry reaches every derived surface (child process)",
+  async () => {
+    const result = expectChildOk(
+      await runChild([process.execPath, "test", CHILD], {
+        cwd: REPO_ROOT,
+        env: { ...process.env },
+      }),
+      "registry extension proof",
+    );
+    // bun test reports to stderr; 0 fail and every case ran.
+    const report = `${result.stdout}\n${result.stderr}`;
+    expect(report).toMatch(/\b6 pass\b/);
+    expect(report).toMatch(/\b0 fail\b/);
+  },
+  CHILD_PROCESS_TEST_BUDGET_MS,
+);
+
+test("this process still sees the real registry only", () => {
+  expect(INTEGRATIONS.some((def) => def.id === "testgw")).toBe(false);
+  const providers = modelGroupsForHarness("pi", [], {}).map((g) => g.provider);
+  expect(providers).not.toContain("TestGW");
+});

package/src/tests/opencode-adapter.test.ts

@@ -7,18 +7,20 @@
  * config wiring, steering, abort, and stream-death handling.
  */
 
-import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
+import { afterAll, afterEach, beforeAll, describe, expect, spyOn, test } from "bun:test";
 import type { OpenCodeEvent } from "@opencode/sdk";
 import { normalizeSessionLogs, type SessionLogRecord } from "../../apps/ui/src/logs-parser";
 import {
   _setOpencodeSdkLoaderForTests,
   _setOpencodeSessionHooksForTests,
   applyOpenRouterBaseUrlOverride,
+  applyProviderKeySplice,
   OpencodeAdapter,
   type OpencodeSession,
   resolveOpencodeSdkSpecifier,
 } from "../providers/opencode-adapter";
 import type { ProviderEvent, ProviderSessionConfig } from "../providers/types";
+import { clearVolatileSecretsForTesting } from "../utils/secret-scrubber";
 
 const SESSION_ID = "ses_test";
 
@@ -128,13 +130,14 @@ function makeFakeHost(events: OpenCodeEvent[], opts: FakeHostOptions = {}) {
   return host;
 }
 
-function installHost(host: FakeHost) {
+function installHost(host: FakeHost, onCreate?: (options: Record<string, unknown>) => void) {
   _setOpencodeSdkLoaderForTests(async () => ({
     version: "2.0.28",
     sdk: {
       OpenCode: {
         create: async (options: Record<string, unknown>) => {
           host.createOptions = options;
+          onCreate?.(options);
           // Set the plugins up the way OpenCode does, with a stub context.
           const plugins = options.plugins as Array<{ setup: (ctx: unknown) => Promise<void> }>;
           for (const plugin of plugins) {
@@ -143,6 +146,8 @@ function installHost(host: FakeHost) {
                 hook: async () => {},
                 list: async () => host.tools.map((id) => ({ id })),
               },
+              // Registered when the session config carries a per-task env.
+              shell: { hook: async () => {} },
               session: {
                 hook: async (
                   name: string,
@@ -841,3 +846,212 @@ describe("OpenRouter attribution config", () => {
     expect(config).toEqual({});
   });
 });
+
+describe("provider key splice (one picked key per task)", () => {
+  const PICKED = "sk-picked-member-0123456789";
+  const POOL = "sk-pool-member-aaaaaaaaaa,sk-pool-member-bbbbbbbbbb";
+  const SPLICE_VARS = [
+    "NAN_API_KEY",
+    "HELMCODE_API_NAN",
+    "HELMCODE_API_KEY",
+    "OPENROUTER_API_KEY",
+    "OPENROUTER_BASE_URL",
+  ];
+  const saved: Record<string, string | undefined> = {};
+  beforeAll(() => {
+    for (const key of SPLICE_VARS) saved[key] = process.env[key];
+  });
+  afterEach(() => {
+    for (const key of SPLICE_VARS) {
+      if (saved[key] === undefined) delete process.env[key];
+      else process.env[key] = saved[key];
+    }
+    clearVolatileSecretsForTesting();
+  });
+
+  test("nan: env [] and the per-task key, even with a pool in process.env", async () => {
+    process.env.NAN_API_KEY = POOL;
+    const { host } = await runSession(
+      [succeeded],
+      testConfig({ model: "nan/glm5.3-flash", env: { NAN_API_KEY: PICKED } }),
+    );
+    const nan = configOf(host).provider.nan;
+    expect(nan.env).toEqual([]);
+    expect(nan.options.apiKey).toBe(PICKED);
+  });
+
+  test("nan: the HELMCODE_API_NAN alias is read when NAN_API_KEY is empty", () => {
+    const config = {};
+    const picked = applyProviderKeySplice(config, "nan/qwen3.6", { HELMCODE_API_NAN: PICKED });
+    expect(picked).toEqual({ key: PICKED, name: "HELMCODE_API_NAN" });
+    expect(config).toEqual({ provider: { nan: { env: [], options: { apiKey: PICKED } } } });
+  });
+
+  test("a pool that reaches the splice unpicked yields its first member", () => {
+    const config = {};
+    applyProviderKeySplice(config, "nan/qwen3.6", {
+      NAN_API_KEY: ` ${PICKED} , sk-other-0000000000`,
+    });
+    expect(config).toEqual({ provider: { nan: { env: [], options: { apiKey: PICKED } } } });
+  });
+
+  test("helmcode: full custom block with limits, reasoning options merged in", async () => {
+    const { host } = await runSession(
+      [succeeded],
+      testConfig({
+        model: "helmcode/glm5.3",
+        reasoningEffort: "high",
+        env: { HELMCODE_API_KEY: PICKED },
+      }),
+    );
+    const helmcode = configOf(host).provider.helmcode;
+    expect(helmcode).toMatchObject({
+      npm: "@ai-sdk/openai-compatible",
+      name: "Helmcode",
+      env: [],
+      options: { baseURL: "https://api.helmcode.com/v1", apiKey: PICKED },
+    });
+    expect(helmcode.models["glm5.3"]).toEqual({
+      name: "GLM-5.3",
+      tool_call: true,
+      reasoning: true,
+      limit: { context: 1048576, output: 32768 },
+      options: { reasoningEffort: "high" },
+    });
+    expect(Object.keys(helmcode.models)).toEqual([
+      "deepseek-v4-flash",
+      "glm5.3",
+      "glm5.3-flash",
+      "qwen3.6",
+      "gemma4",
+    ]);
+  });
+
+  test("helmcode: a model missing from the table still gets an entry", () => {
+    const config: Record<string, any> = {};
+    applyProviderKeySplice(config, "helmcode/brand-new", { HELMCODE_API_KEY: PICKED });
+    expect(config.provider.helmcode.models["brand-new"]).toEqual({
+      name: "brand-new",
+      tool_call: true,
+    });
+  });
+
+  test("openrouter gateway: baseURL kept next to env [] and the picked key", async () => {
+    process.env.OPENROUTER_API_KEY = POOL;
+    const { host } = await runSession(
+      [succeeded],
+      testConfig({
+        model: "openrouter/deepseek/deepseek-v4-flash",
+        env: { OPENROUTER_API_KEY: PICKED, OPENROUTER_BASE_URL: "http://127.0.0.1:1234/v1" },
+      }),
+    );
+    expect(configOf(host).provider.openrouter).toEqual({
+      env: [],
+      options: { apiKey: PICKED, baseURL: "http://127.0.0.1:1234/v1" },
+    });
+  });
+
+  test("openrouter host: attribution headers kept next to env [] and the picked key", async () => {
+    const { host } = await runSession(
+      [succeeded],
+      testConfig({
+        model: "openrouter/deepseek/deepseek-v4-flash",
+        env: { OPENROUTER_API_KEY: PICKED },
+      }),
+    );
+    const openrouter = configOf(host).provider.openrouter;
+    expect(openrouter.env).toEqual([]);
+    expect(openrouter.options.apiKey).toBe(PICKED);
+    expect(openrouter.options.headers).toMatchObject({ "X-Title": "Agent Swarm" });
+  });
+
+  test("no splice without a key, or for providers outside the splice", () => {
+    for (const model of ["nan/qwen3.6", "helmcode/glm5.3", "openrouter/x/y"]) {
+      const config = {};
+      expect(applyProviderKeySplice(config, model, {})).toBeUndefined();
+      expect(config).toEqual({});
+    }
+    for (const model of ["anthropic/claude-sonnet-4-5", "openai/gpt-5", "glm5.3", "", undefined]) {
+      const config = {};
+      applyProviderKeySplice(config, model, {
+        ANTHROPIC_API_KEY: PICKED,
+        OPENAI_API_KEY: PICKED,
+        NAN_API_KEY: PICKED,
+      });
+      expect(config).toEqual({});
+    }
+  });
+});
+
+describe("spliced key never reaches logs, events, or errors", () => {
+  // Not in process.env: the key a dashboard save delivers to the per-task env only.
+  const SENTINEL = "sk-nan-sentinel-do-not-log-4f9c2e";
+  let captured: string[] = [];
+  let spies: Array<ReturnType<typeof spyOn>> = [];
+  beforeAll(() => {
+    delete process.env.NAN_API_KEY;
+  });
+  afterEach(() => {
+    for (const spy of spies) spy.mockRestore();
+    spies = [];
+    captured = [];
+    clearVolatileSecretsForTesting();
+  });
+  function captureConsole() {
+    for (const method of ["log", "info", "warn", "error", "debug"] as const) {
+      spies.push(
+        spyOn(console, method).mockImplementation((...args: unknown[]) => {
+          captured.push(args.map((a) => (typeof a === "string" ? a : JSON.stringify(a))).join(" "));
+        }),
+      );
+    }
+  }
+
+  test("SDK log lines and a provider failure that echo the config are scrubbed", async () => {
+    captureConsole();
+    const host = makeFakeHost([
+      ev("session.execution.failed", {
+        sessionID: SESSION_ID,
+        error: { message: `401 Invalid API key ${SENTINEL}` },
+      }),
+    ]);
+    installHost(host, (options) => {
+      const content = (options.config as { content: string }).content;
+      const log = options.log as { emit: (entry: { message: string }) => void };
+      log.emit({ message: `config: ${content}` });
+    });
+    const session = (await new OpencodeAdapter().createSession(
+      testConfig({ model: "nan/glm5.3-flash", env: { NAN_API_KEY: SENTINEL } }),
+    )) as OpencodeSession;
+    const emitted: ProviderEvent[] = [];
+    session.onEvent((e) => emitted.push(e));
+    const result = await session.waitForCompletion();
+
+    // Positive control: the key did reach the SDK config.
+    expect(configOf(host).provider.nan.options.apiKey).toBe(SENTINEL);
+    expect(captured.some((line) => line.includes("[opencode] config:"))).toBe(true);
+    expect(result.isError).toBe(true);
+
+    for (const line of captured) expect(line).not.toContain(SENTINEL);
+    expect(JSON.stringify(emitted)).not.toContain(SENTINEL);
+    expect(result.failureReason ?? "").not.toContain(SENTINEL);
+  });
+
+  test("a host start failure that echoes the config is scrubbed before it propagates", async () => {
+    captureConsole();
+    const host = makeFakeHost([]);
+    installHost(host, (options) => {
+      const content = (options.config as { content: string }).content;
+      throw new Error(`invalid config ${content}`);
+    });
+    const error = await new OpencodeAdapter()
+      .createSession(testConfig({ model: "nan/glm5.3-flash", env: { NAN_API_KEY: SENTINEL } }))
+      .then(
+        () => undefined,
+        (err: unknown) => err as Error,
+      );
+    expect(error?.message).toStartWith("opencode host failed to start: invalid config");
+    expect(error?.message).not.toContain(SENTINEL);
+    for (const line of captured) expect(line).not.toContain(SENTINEL);
+  });
+});