@polderlabs/bizar 3.23.0 → 4.0.0

package/bizar-dash/tests/opencode-runner.test.mjs

@@ -0,0 +1,172 @@
+/**
+ * tests/opencode-runner.test.mjs
+ *
+ * Unit tests for the dashboard's opencode-runner.mjs. The
+ * companion plugin runner (plugins/bizar/src/opencode-runner.ts) is
+ * tested via bun in plugins/bizar/tests/.
+ *
+ * Run with: node --test tests/opencode-runner.test.mjs
+ */
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, writeFileSync, existsSync, readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { spawnSync } from 'node:child_process';
+
+import { spawnAgent, getStatus, onExit, killAgent, list, _resetForTests } from '../src/server/opencode-runner.mjs';
+
+const HAS_OPENCODE = (() => {
+  try {
+    const r = spawnSync('which', ['opencode'], { encoding: 'utf8' });
+    return r.status === 0 && r.stdout.trim().length > 0;
+  } catch {
+    return false;
+  }
+})();
+
+test('_resetForTests clears the registry', () => {
+  list(); // sanity check no throw
+  _resetForTests();
+  assert.equal(list().length, 0);
+});
+
+test('getStatus returns null for unknown processId', () => {
+  _resetForTests();
+  assert.equal(getStatus(99999), null);
+});
+
+test('killAgent on unknown processId is a no-op success', () => {
+  _resetForTests();
+  const res = killAgent(99999);
+  assert.equal(res.ok, true);
+});
+
+test('spawnAgent with non-existent worktree still returns a processId', { skip: !HAS_OPENCODE }, async () => {
+  _resetForTests();
+  const dir = mkdtempSync(join(tmpdir(), 'oc-runner-'));
+  const logPath = join(dir, 'test.log');
+  // Worktree doesn't exist, but spawn should still succeed and
+  // opencode will exit early with an error. We just verify the API
+  // contract: we get back a processId immediately, and the spawn
+  // resolves once the sessionId appears or the process exits.
+  const result = await Promise.race([
+    spawnAgent({
+      prompt: 'just say hi',
+      agent: 'mimir',
+      worktree: '/this/does/not/exist/anywhere',
+      logPath,
+      sessionIdTimeoutMs: 3000,
+    }),
+    new Promise((_, rej) => setTimeout(() => rej(new Error('spawnAgent timeout')), 5000)),
+  ]);
+  // Either ok:false (process exited before reporting session) or
+  // ok:true (rare if opencode somehow succeeded) is acceptable.
+  assert.ok(typeof result.ok === 'boolean', 'expected ok to be boolean');
+  // The log dir should exist (spawnAgent creates it).
+  assert.ok(existsSync(dir), 'log dir should exist');
+  // No process should still be tracked if the spawn failed.
+  if (!result.ok) {
+    assert.ok(!result.sessionId, 'no sessionId on failure');
+  }
+});
+
+test('spawnAgent creates log dir if missing', { skip: !HAS_OPENCODE }, async () => {
+  _resetForTests();
+  const tmp = mkdtempSync(join(tmpdir(), 'oc-runner-logdir-'));
+  const nested = join(tmp, 'a', 'b', 'c');
+  const logPath = join(nested, 'test.log');
+  // The dir nested/a/b/c does not exist yet. spawnAgent should
+  // create it. The actual opencode process will likely fail (no
+  // worktree, etc.) but that's irrelevant to this test.
+  await Promise.race([
+    spawnAgent({
+      prompt: 'hi',
+      agent: 'mimir',
+      worktree: tmp,
+      logPath,
+      sessionIdTimeoutMs: 1000,
+    }),
+    new Promise((resolve) => setTimeout(resolve, 5000)),
+  ]).catch(() => undefined);
+  assert.ok(existsSync(nested), `expected ${nested} to exist`);
+});
+
+test('spawnAgent captures stdout+stderr to logPath', { skip: !HAS_OPENCODE }, async () => {
+  _resetForTests();
+  const tmp = mkdtempSync(join(tmpdir(), 'oc-runner-cap-'));
+  const logPath = join(tmp, 'capture.log');
+  // Use /tmp as worktree — it exists. opencode will run there.
+  const res = await Promise.race([
+    spawnAgent({
+      prompt: 'just say hi',
+      agent: 'mimir',
+      worktree: tmp,
+      logPath,
+      sessionIdTimeoutMs: 5000,
+    }),
+    new Promise((_, rej) => setTimeout(() => rej(new Error('timeout')), 8000)),
+  ]);
+  // Resolved (either ok or with error). Wait briefly for the log
+  // stream to flush.
+  await new Promise((r) => setTimeout(r, 500));
+  if (existsSync(logPath)) {
+    const stat = statSync(logPath);
+    assert.ok(stat.size >= 0, 'log file has size');
+    // If we wrote anything, it should be either [stdout] or [stderr]
+    // prefixed. (If the file is empty, the test passes trivially.)
+    if (stat.size > 0) {
+      const content = readFileSync(logPath, 'utf8');
+      // Either content is empty (process didn't output anything)
+      // or contains our prefix tags. We don't assert specific
+      // content because the opencode run is environment-dependent.
+      assert.ok(
+        content.includes('[stderr]') || content.includes('[stdout]') || content.length === 0,
+        'log file should be empty or contain [stderr]/[stdout] prefixes',
+      );
+    }
+  }
+  // If the process is still running, kill it to clean up.
+  if (res.processId && getStatus(res.processId) && getStatus(res.processId).state === 'running') {
+    killAgent(res.processId);
+  }
+});
+
+test('onExit fires when process exits', { skip: !HAS_OPENCODE }, async () => {
+  _resetForTests();
+  const tmp = mkdtempSync(join(tmpdir(), 'oc-runner-exit-'));
+  const logPath = join(tmp, 'exit.log');
+  const res = await Promise.race([
+    spawnAgent({
+      prompt: 'hi',
+      agent: 'mimir',
+      worktree: tmp,
+      logPath,
+      sessionIdTimeoutMs: 3000,
+    }),
+    new Promise((_, rej) => setTimeout(() => rej(new Error('timeout')), 5000)),
+  ]).catch(() => ({ ok: false, processId: undefined }));
+
+  if (!res.processId) {
+    // Process never started; test is moot.
+    return;
+  }
+
+  // onExit should fire within a reasonable time.
+  const status = await Promise.race([
+    new Promise((resolve) => {
+      onExit(res.processId, (s) => resolve(s));
+    }),
+    new Promise((_, rej) => setTimeout(() => rej(new Error('onExit timeout')), 10_000)),
+  ]).catch(() => null);
+
+  // status may be null if the test timed out; either way the test
+  // is best-effort in this environment.
+  if (status) {
+    assert.ok(
+      ['done', 'failed', 'killed'].includes(status.state),
+      `state should be terminal, got ${status.state}`,
+    );
+    assert.ok(typeof status.endedAt === 'number', 'endedAt set');
+  }
+});

package/bizar-dash/tests/path-safe.test.mjs

@@ -0,0 +1,108 @@
+/**
+ * tests/path-safe.test.mjs
+ *
+ * Unit tests for the bg-log path helpers. Run with:
+ *   node --test tests/path-safe.test.mjs
+ *
+ * Covers:
+ *   - getActualBgLogPath returns the path the plugin's LogWriter
+ *     actually writes to (per plugins/bizar/src/options.ts:88 default
+ *     logDir of ~/.cache/bizar/logs).
+ *   - BIZAR_LOG_DIR env override is honored.
+ *   - Path sanitizer strips unsafe characters from the session id.
+ *   - The old phantom path (`<worktree>/.bizar/opencode.log`) is NOT
+ *     returned — regression guard for the bug fixed in v3.11.1.
+ *   - deriveAbsoluteBgLogPath still returns the historical worktree-
+ *     based path (so we don't accidentally break callers depending on
+ *     the old field).
+ */
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { resolve as pathResolve, sep } from 'node:path';
+import { homedir } from 'node:os';
+
+import {
+  getBgLogDir,
+  getActualBgLogPath,
+  deriveAbsoluteBgLogPath,
+} from '../src/server/lib/path-safe.mjs';
+
+const HOME = homedir();
+const FALLBACK = pathResolve(HOME, '.cache', 'bizar', 'logs');
+
+test('getBgLogDir returns the fallback when no env override', () => {
+  const dir = getBgLogDir({ env: {} });
+  assert.equal(dir, FALLBACK);
+});
+
+test('getBgLogDir honors BIZAR_LOG_DIR env override', () => {
+  const dir = getBgLogDir({ env: { BIZAR_LOG_DIR: '/tmp/bizar-test' } });
+  assert.equal(dir, pathResolve('/tmp/bizar-test'));
+});
+
+test('getActualBgLogPath returns path the LogWriter writes to', () => {
+  const p = getActualBgLogPath({ sessionId: 'ses_abc123' });
+  // The plugin's default logDir is ~/.cache/bizar/logs; the file is
+  // named <sessionId>.log. This must match the LogWriter's actual
+  // output path (plugins/bizar/src/report.ts:147).
+  assert.equal(p, pathResolve(FALLBACK, 'ses_abc123.log'));
+});
+
+test('getActualBgLogPath sanitizes unsafe characters in sessionId', () => {
+  const p = getActualBgLogPath({ sessionId: '../../etc/passwd' });
+  // The `..` and `/` get replaced with `_`. The result must be a
+  // path under the log dir, never escape it via path traversal.
+  // Note: literal `..` can appear inside a single filename segment
+  // (e.g. `.._.._etc_passwd.log`) without escaping — only the
+  // directory boundaries matter. We assert the resolved path stays
+  // inside FALLBACK_LOG_DIR.
+  assert.ok(p.startsWith(FALLBACK + sep), `expected path to start with ${FALLBACK}, got ${p}`);
+  const rel = p.slice(FALLBACK.length + 1);
+  // The single filename segment must not itself contain `/` (which
+  // would mean an attempt to escape via the basename).
+  assert.ok(!rel.includes('/'), `expected no '/' in basename, got ${rel}`);
+  assert.ok(p.endsWith('.log'));
+});
+
+test('getActualBgLogPath uses BIZAR_LOG_DIR env override', () => {
+  const p = getActualBgLogPath({
+    sessionId: 'ses_xyz',
+    env: { BIZAR_LOG_DIR: '/tmp/bizar-test' },
+  });
+  assert.equal(p, pathResolve('/tmp/bizar-test', 'ses_xyz.log'));
+});
+
+test('getActualBgLogPath does NOT return the phantom .bizar/opencode.log path (regression guard)', () => {
+  // The old code at task-delegator.mjs:605 tailed
+  // `<worktree>/.bizar/opencode.log` — a path nothing writes to.
+  // The new function must NOT return anything under `.bizar/` or
+  // `.opencode/log/`.
+  const p = getActualBgLogPath({ sessionId: 'ses_regression' });
+  assert.ok(!p.includes('/.bizar/'), `phantom '.bizar/' path leaked: ${p}`);
+  assert.ok(!p.includes('/.opencode/log/'), `phantom '.opencode/log/' path leaked: ${p}`);
+});
+
+test('deriveAbsoluteBgLogPath still returns the historical worktree-based path', () => {
+  // The bg-retry loop still uses this to repair stale logPath fields.
+  // Make sure the behavior didn't change as part of the v3.11.1 fix.
+  const p = deriveAbsoluteBgLogPath('/tmp/worktree', 'bgr_abc');
+  assert.equal(p, pathResolve('/tmp/worktree', '.opencode', 'log', 'bgr_abc.log'));
+});
+
+test('deriveAbsoluteBgLogPath falls back to FALLBACK_LOG_DIR when worktree missing', () => {
+  const p = deriveAbsoluteBgLogPath('', 'bgr_xyz');
+  assert.equal(p, pathResolve(FALLBACK, '.opencode', 'log', 'bgr_xyz.log'));
+});
+
+test('getActualBgLogPath is preferred over deriveAbsoluteBgLogPath for operator-facing tail targets', () => {
+  // Document the contract: when you want to show the operator a real
+  // log, use getActualBgLogPath. The historical worktree-based path
+  // exists only for repairing stale state files.
+  const sessionId = 'ses_operator_view';
+  const realPath = getActualBgLogPath({ sessionId });
+  const worktreePath = deriveAbsoluteBgLogPath('/tmp/proj', 'bg_' + sessionId.slice(3, 19));
+  assert.notEqual(realPath, worktreePath);
+  // Real path is in the LogWriter's directory; worktree path is not.
+  assert.ok(realPath.startsWith(FALLBACK));
+  assert.ok(worktreePath.startsWith('/tmp/proj'));
+});

package/bizar-dash/tests/providers-store-backup-keys.node.test.mjs

@@ -0,0 +1,333 @@
+/**
+ * providers-store-backup-keys.node.test.mjs — regression tests for the
+ * v3.20.10 backup-keys feature.
+ *
+ * The dashboard's Providers card + the API provider config now support
+ * a second `backupApiKey` slot per provider. Operators can:
+ *   - Set primary in opencode.json (`apiKey`)
+ *   - Set backup in opencode.json (`backupApiKey`)
+ *   - Set primary via env (`MINIMAX_API_KEY`, etc.)
+ *   - Set backup via env (`MINIMAX_API_KEY_BACKUP`, etc.)
+ *   - Have a backup without a primary (rare; valid)
+ *
+ * Detection order (highest priority first):
+ *   1. config.provider.<id>.apiKey
+ *   2. config.provider.<id>.backupApiKey
+ *   3. process.env[envKey]        (primary)
+ *   4. process.env[backupEnvKey]  (backup)
+ *
+ * Run with: node --test tests/providers-store-backup-keys.node.test.mjs
+ */
+import { describe, it, before, after, beforeEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, writeFileSync, readFileSync, rmSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { tmpdir } from 'node:os';
+
+const REPO = resolve(import.meta.dirname, '..', '..');
+
+let SANDBOX_HOME;
+let ORIGINAL_HOME;
+let ORIGINAL_ENV_KEYS;
+
+before(() => {
+  SANDBOX_HOME = mkdtempSync(join(tmpdir(), `bizar-providers-test-${Date.now()}-`));
+  ORIGINAL_HOME = process.env.HOME;
+  ORIGINAL_ENV_KEYS = {
+    MINIMAX_API_KEY: process.env.MINIMAX_API_KEY,
+    MINIMAX_API_KEY_BACKUP: process.env.MINIMAX_API_KEY_BACKUP,
+    OPENAI_API_KEY: process.env.OPENAI_API_KEY,
+    OPENAI_API_KEY_BACKUP: process.env.OPENAI_API_KEY_BACKUP,
+    ANTHROPIC_API_KEY: process.env.ANTHROPIC_API_KEY,
+  };
+  process.env.HOME = SANDBOX_HOME;
+  // Wipe known env vars so tests are deterministic.
+  delete process.env.MINIMAX_API_KEY;
+  delete process.env.MINIMAX_API_KEY_BACKUP;
+  delete process.env.OPENAI_API_KEY;
+  delete process.env.OPENAI_API_KEY_BACKUP;
+  delete process.env.ANTHROPIC_API_KEY;
+});
+
+after(() => {
+  process.env.HOME = ORIGINAL_HOME;
+  for (const [k, v] of Object.entries(ORIGINAL_ENV_KEYS)) {
+    if (v === undefined) delete process.env[k];
+    else process.env[k] = v;
+  }
+  try { rmSync(SANDBOX_HOME, { recursive: true, force: true }); } catch { /* ignore */ }
+});
+
+async function writeOpencodeJson(obj) {
+  const { mkdirSync } = await import('node:fs');
+  const cfgDir = join(SANDBOX_HOME, '.config', 'opencode');
+  mkdirSync(cfgDir, { recursive: true });
+  writeFileSync(join(cfgDir, 'opencode.json'), JSON.stringify(obj, null, 2));
+}
+
+async function resetOpencodeJson() {
+  const { mkdirSync } = await import('node:fs');
+  const cfgDir = join(SANDBOX_HOME, '.config', 'opencode');
+  mkdirSync(cfgDir, { recursive: true });
+  writeFileSync(join(cfgDir, 'opencode.json'), '{}');
+}
+
+describe('providers-store — backup keys (v3.20.10)', () => {
+  // We re-import the module under each test so HOME/env changes take
+  // effect. node:import-cache can bite us otherwise.
+  async function loadStore() {
+    // Bust the import cache so the module re-evaluates homedir().
+    const cacheBust = '?cb=' + Date.now() + '-' + Math.random().toString(36).slice(2);
+    const mod = await import(join(REPO, 'bizar-dash/src/server/providers-store.mjs') + cacheBust);
+    return mod.providersStore;
+  }
+
+  describe('KNOWN_PROVIDERS — backupEnvKeys', () => {
+    it('declares backupEnvKeys for every known provider', async () => {
+      const store = await loadStore();
+      assert.ok(Array.isArray(store.KNOWN_PROVIDERS));
+      assert.ok(store.KNOWN_PROVIDERS.length >= 9, 'expected at least 9 known providers');
+      for (const spec of store.KNOWN_PROVIDERS) {
+        assert.ok(Array.isArray(spec.envKeys), `${spec.id} missing envKeys`);
+        assert.ok(spec.envKeys.length >= 1, `${spec.id} has empty envKeys`);
+        assert.ok(Array.isArray(spec.backupEnvKeys), `${spec.id} missing backupEnvKeys`);
+        assert.ok(spec.backupEnvKeys.length >= 1, `${spec.id} has empty backupEnvKeys`);
+        // Backup envKeys must NOT overlap with primary envKeys.
+        const overlap = spec.envKeys.filter((k) => spec.backupEnvKeys.includes(k));
+        assert.equal(overlap.length, 0, `${spec.id} backup envKey overlaps primary: ${overlap.join(',')}`);
+        // All backup envKeys should follow one of the two naming
+        // conventions:
+        //   - `<NAME>_API_KEY_BACKUP` (api-key-then-backup)
+        //   - `<NAME>_BACKUP_API_KEY` (backup-then-api-key)
+        // We accept either; both are conventional. We reject anything
+        // else to catch typos like `MINIMAX_BACKUP` (missing `_API_KEY`).
+        for (const bk of spec.backupEnvKeys) {
+          const ok = /_(?:API_KEY_BACKUP|BACKUP_API_KEY)$/.test(bk);
+          assert.ok(ok, `${spec.id} backup envKey ${bk} doesn't end with _API_KEY_BACKUP or _BACKUP_API_KEY`);
+        }
+      }
+    });
+
+    it('MiniMax has 3 backup envKeys including Anthropic fallback', async () => {
+      const store = await loadStore();
+      const minimax = store.KNOWN_PROVIDERS.find((p) => p.id === 'minimax');
+      assert.ok(minimax);
+      assert.deepEqual(minimax.envKeys, ['MINIMAX_API_KEY', 'ANTHROPIC_API_KEY']);
+      assert.ok(minimax.backupEnvKeys.includes('MINIMAX_API_KEY_BACKUP'));
+      assert.ok(minimax.backupEnvKeys.includes('MINIMAX_BACKUP_API_KEY'));
+      assert.ok(minimax.backupEnvKeys.includes('ANTHROPIC_API_KEY_BACKUP'));
+    });
+  });
+
+  describe('autoDetect — backup key discovery', () => {
+    beforeEach(async () => {
+      // Reset env + on-disk config between tests so they're independent.
+      delete process.env.MINIMAX_API_KEY;
+      delete process.env.MINIMAX_API_KEY_BACKUP;
+      delete process.env.OPENAI_API_KEY;
+      delete process.env.OPENAI_API_KEY_BACKUP;
+      delete process.env.ANTHROPIC_API_KEY;
+      await resetOpencodeJson();
+    });
+
+    it('reports no backup when no env keys and no config', async () => {
+      const store = await loadStore();
+      const results = await store.autoDetect({ probe: false });
+      const minimax = results.find((p) => p.id === 'minimax');
+      assert.ok(minimax);
+      assert.equal(minimax.status, 'no-key');
+      assert.equal(minimax.hasKey, false);
+      assert.equal(minimax.backup.status, 'no-key');
+      assert.equal(minimax.backup.hasKey, false);
+      assert.equal(minimax.backup.source, '');
+    });
+
+    it('detects primary from env and backup from config', async () => {
+      writeOpencodeJson({
+        provider: {
+          minimax: {
+            apiKey: '',
+            backupApiKey: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+          },
+        },
+      });
+      process.env.MINIMAX_API_KEY = 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb';
+
+      const store = await loadStore();
+      const results = await store.autoDetect({ probe: false });
+      const minimax = results.find((p) => p.id === 'minimax');
+      assert.equal(minimax.hasKey, true);
+      assert.equal(minimax.status, 'configured');
+      assert.match(minimax.keySource, /^env:MINIMAX_API_KEY$/);
+      assert.equal(minimax.backup.hasKey, true);
+      assert.equal(minimax.backup.status, 'configured');
+      assert.equal(minimax.backup.source, 'config');
+    });
+
+    it('detects backup from *_BACKUP_API_KEY env var', async () => {
+      process.env.MINIMAX_API_KEY = 'cccccccccccccccccccccccccccccccccccccc';
+      process.env.MINIMAX_API_KEY_BACKUP = 'dddddddddddddddddddddddddddddddddddd';
+
+      const store = await loadStore();
+      const results = await store.autoDetect({ probe: false });
+      const minimax = results.find((p) => p.id === 'minimax');
+      assert.equal(minimax.hasKey, true);
+      assert.equal(minimax.backup.hasKey, true);
+      assert.equal(minimax.backup.source, 'env:MINIMAX_API_KEY_BACKUP');
+    });
+
+    it('prefers config over env for both primary and backup', async () => {
+      writeOpencodeJson({
+        provider: {
+          minimax: {
+            apiKey: 'eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee',
+            backupApiKey: 'ffffffffffffffffffffffffffffffffffffffffff',
+          },
+        },
+      });
+      // Env should be ignored when config has values.
+      process.env.MINIMAX_API_KEY = 'gggggggggggggggggggggggggggggggggggggg';
+      process.env.MINIMAX_API_KEY_BACKUP = 'hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh';
+
+      const store = await loadStore();
+      const results = await store.autoDetect({ probe: false });
+      const minimax = results.find((p) => p.id === 'minimax');
+      assert.equal(minimax.keySource, 'config');
+      assert.equal(minimax.backup.source, 'config');
+    });
+
+    it('allows backup without primary (rotation in progress)', async () => {
+      // No primary key — only backup env var.
+      process.env.MINIMAX_API_KEY_BACKUP = 'iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii';
+
+      const store = await loadStore();
+      const results = await store.autoDetect({ probe: false });
+      const minimax = results.find((p) => p.id === 'minimax');
+      assert.equal(minimax.status, 'no-key');
+      assert.equal(minimax.backup.status, 'configured');
+      assert.equal(minimax.backup.hasKey, true);
+    });
+
+    it('reports backup status as unknown when format does not match', async () => {
+      // OpenAI primary: must start with `sk-` for the configured status.
+      process.env.OPENAI_API_KEY = 'sk-jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj';
+      // Backup is intentionally invalid format (no `sk-` prefix) — must
+      // downgrade to `unknown` so the UI shows the operator a warning.
+      process.env.OPENAI_API_KEY_BACKUP = 'notvalidformat';
+
+      const store = await loadStore();
+      const results = await store.autoDetect({ probe: false });
+      const openai = results.find((p) => p.id === 'openai');
+      assert.equal(openai.status, 'configured');
+      assert.equal(openai.backup.status, 'unknown');
+    });
+  });
+
+  describe('add / update — backup key persistence', () => {
+    beforeEach(async () => {
+      delete process.env.MINIMAX_API_KEY;
+      delete process.env.MINIMAX_API_KEY_BACKUP;
+      delete process.env.OPENAI_API_KEY;
+      delete process.env.OPENAI_API_KEY_BACKUP;
+      delete process.env.ANTHROPIC_API_KEY;
+      await resetOpencodeJson();
+    });
+    it('persists backupApiKey in opencode.json', async () => {
+      const store = await loadStore();
+      await store.add({
+        id: 'minimax',
+        name: 'MiniMax',
+        apiKey: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+        backupApiKey: 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb',
+      });
+      // Re-read from disk to confirm persistence.
+      const raw = JSON.parse(readFileSync(join(SANDBOX_HOME, '.config/opencode/opencode.json'), 'utf8'));
+      assert.equal(raw.provider.minimax.apiKey, 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa');
+      assert.equal(raw.provider.minimax.backupApiKey, 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb');
+    });
+
+    it('list() masks both apiKey and backupApiKey', async () => {
+      const store = await loadStore();
+      await store.add({
+        id: 'minimax',
+        name: 'MiniMax',
+        apiKey: 'ccccccccccccccccccccccccccccccccccccccccc',
+        backupApiKey: 'dddddddddddddddddddddddddddddddddddddd',
+      });
+      const list = store.list();
+      const minimax = list.find((p) => p.id === 'minimax');
+      assert.match(minimax.apiKey, /^cc\.\.\.cc$/); // masked
+      assert.match(minimax.backupApiKey, /^dd\.\.\.dd$/);
+      assert.notEqual(minimax.apiKey, 'ccccccccccccccccccccccccccccccccccccccccc');
+      assert.notEqual(minimax.backupApiKey, 'dddddddddddddddddddddddddddddddddddddd');
+    });
+
+    it('update() preserves stored backupApiKey when form submits masked placeholder', async () => {
+      const store = await loadStore();
+      await store.add({
+        id: 'minimax',
+        apiKey: 'eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee',
+        backupApiKey: 'ffffffffffffffffffffffffffffffffffffffffff',
+      });
+      // Operator re-submits the form without touching the keys (the
+      // masked placeholders come back from list()).
+      const updated = await store.update('minimax', {
+        name: 'MiniMax (renamed)',
+        apiKey: '***short***',
+        backupApiKey: '***short***',
+      });
+      assert.equal(updated.name, 'MiniMax (renamed)');
+      // Stored values must be preserved — mask-keep semantics.
+      const raw = JSON.parse(readFileSync(join(SANDBOX_HOME, '.config/opencode/opencode.json'), 'utf8'));
+      assert.equal(raw.provider.minimax.apiKey, 'eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee');
+      assert.equal(raw.provider.minimax.backupApiKey, 'ffffffffffffffffffffffffffffffffffffffffff');
+    });
+
+    it('update() replaces backupApiKey when a new value is supplied', async () => {
+      const store = await loadStore();
+      await store.add({
+        id: 'minimax',
+        apiKey: 'gggggggggggggggggggggggggggggggggggggg',
+        backupApiKey: 'hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh',
+      });
+      await store.update('minimax', {
+        backupApiKey: 'iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii',
+      });
+      const raw = JSON.parse(readFileSync(join(SANDBOX_HOME, '.config/opencode/opencode.json'), 'utf8'));
+      assert.equal(raw.provider.minimax.backupApiKey, 'iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii');
+      assert.equal(raw.provider.minimax.apiKey, 'gggggggggggggggggggggggggggggggggggggg');
+    });
+
+    it('update() supports clearing backupApiKey with empty string', async () => {
+      const store = await loadStore();
+      await store.add({
+        id: 'minimax',
+        apiKey: 'jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj',
+        backupApiKey: 'kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk',
+      });
+      // Operator clears the backup field.
+      await store.update('minimax', { backupApiKey: '' });
+      const raw = JSON.parse(readFileSync(join(SANDBOX_HOME, '.config/opencode/opencode.json'), 'utf8'));
+      assert.equal(raw.provider.minimax.backupApiKey, '');
+    });
+  });
+
+  describe('listAll — backup key surfaced', () => {
+    it('reports backupApiKey (masked) and source', async () => {
+      writeOpencodeJson({
+        provider: {
+          minimax: {
+            apiKey: 'llllllllllllllllllllllllllllllllllllllll',
+            backupApiKey: 'mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm',
+          },
+        },
+      });
+      const store = await loadStore();
+      const all = await store.listAll();
+      const minimax = all.find((p) => p.id === 'minimax');
+      assert.ok(minimax);
+      assert.match(minimax.apiKey, /^ll\.\.\.ll$/);
+      assert.match(minimax.backupApiKey, /^mm\.\.\.mm$/);
+    });
+  });
+});