auto-model-router 0.36.0 → 0.37.0

package/test/benchmark-feeds.test.ts

@@ -5,15 +5,21 @@ import {
 	applyFeedScores,
 	fetchBenchlmScores,
 	invalidateFeedCache,
+	MAX_EXTRA_SCORES,
+	loadLocalScores,
 	normalizeModelKey,
 	parseAaModels,
 	parseBenchlmModels,
 	refreshFeedScores,
+	saveLocalScores,
+	suppliedScores,
 	type FeedScore,
 	type FetchLike,
 } from "../src/catalog/benchmark-feeds.ts";
+import { DEFAULT_CONFIG } from "../src/config/defaults.ts";
 import { loadConfig } from "../src/config/load.ts";
 import type { RouterConfig } from "../src/config/types.ts";
+import type { Logger } from "../src/util/log.ts";
 import { openDb } from "../src/util/sqlite.ts";
 
 /** A bare OpenRouter `/models` record, optionally pre-scored. */
@@ -38,6 +44,17 @@ function aaScore(over: Partial<FeedScore> & { key: string }): FeedScore {
 function blScore(over: Partial<FeedScore> & { key: string }): FeedScore {
 	return { creator: "", source: "benchlm", ...over };
 }
+function localScore(over: Partial<FeedScore> & { key: string }): FeedScore {
+	return { creator: "", source: "local", ...over };
+}
+/** A row as the front door supplies it: a neutral leaderboard number. */
+function neutralScore(over: Partial<FeedScore> & { key: string }): FeedScore {
+	return { creator: "", source: "neutral", ...over };
+}
+/** A row as the front door supplies it: a self-reported model-card number. */
+function vendorScore(over: Partial<FeedScore> & { key: string }): FeedScore {
+	return { creator: "", source: "vendor", ...over };
+}
 
 describe("normalizeModelKey", () => {
 	test("strips provider, tilde, and release words but keeps the parameter size", async () => {
@@ -255,3 +272,180 @@ test("fetchBenchlmScores parses a keyless leaderboard response", async () => {
 	const scores = await fetchBenchlmScores({ fetchImpl: fake });
 	expect(scores).toEqual([{ key: "glm-5-3-flash", creator: "z-ai", coding: 61, intelligence: 58, source: "benchlm" }]);
 });
+
+/**
+ * `benchmarks.extraScores`: scores the FRONT DOOR supplies for axes the feeds
+ * leave empty. The case it was built for is real — `deepseek/deepseek-v4.1-flash`
+ * carries intelligence 39.5 and nothing else, so no tier floor above the cheapest
+ * can admit it, and it took 1 dispatch in 30 days against its sibling's 1,455.
+ * A model OpenRouter serves is defined by OpenRouter's catalog, which the front
+ * door can only read; this is the one seam through which it can say more.
+ */
+describe("benchmarks.extraScores", () => {
+	function cfgWith(extraScores?: FeedScore[]): RouterConfig {
+		const base = structuredClone(DEFAULT_CONFIG);
+		return {
+			...base,
+			logLevel: "silent",
+			benchmarks: { ...base.benchmarks, ...(extraScores === undefined ? {} : { extraScores }) },
+		};
+	}
+
+	/** Captures whatever the sanitiser decided to say out loud. */
+	function recorder(): { log: Logger; warns: { msg: string; fields?: Record<string, unknown> }[] } {
+		const warns: { msg: string; fields?: Record<string, unknown> }[] = [];
+		const noop = (): void => {};
+		const log: Logger = {
+			error: noop,
+			info: noop,
+			debug: noop,
+			warn: (msg, fields) => {
+				warns.push(fields === undefined ? { msg } : { msg, fields });
+			},
+		};
+		return { log, warns };
+	}
+
+	test("fills the axes the feeds left empty, and says where each came from", async () => {
+		// Exactly the live shape: intelligence published, the other two absent.
+		const catalog = [raw("deepseek/deepseek-v4.1-flash", { artificial_analysis: { intelligence_index: 39.5 } })];
+		const cfg = cfgWith([
+			vendorScore({ key: "deepseek-v4-1-flash", creator: "deepseek", coding: 55.2 }),
+			neutralScore({ key: "deepseek-v4-1-flash", creator: "deepseek", agentic: 31.8 }),
+		]);
+
+		const result = applyFeedScores(catalog, suppliedScores(cfg));
+
+		expect(normalizeCatalogModel(catalog[0])?.quality).toEqual({ intelligence: 39.5, coding: 55.2, agentic: 31.8 });
+		// Provenance survives per axis, and the two kinds stay distinguishable.
+		expect(catalog[0]?.benchmarks).toMatchObject({ fill_sources: { coding: "vendor", agentic: "neutral" } });
+		expect(result.sources.vendor).toBe(1);
+		expect(result.sources.neutral).toBe(1);
+	});
+
+	test("never moves a score a published source measured", async () => {
+		const catalog = [raw("google/gemini-3.7-flash", { artificial_analysis: { coding_index: 76.1 } })];
+		const cfg = cfgWith([neutralScore({ key: "gemini-3-7-flash", creator: "google", coding: 10, agentic: 40 })]);
+		const result = applyFeedScores(catalog, suppliedScores(cfg));
+		expect(normalizeCatalogModel(catalog[0])?.quality).toEqual({ coding: 76.1, agentic: 40 });
+		expect(result.axes.coding).toBe(0);
+	});
+
+	test("loses to Artificial Analysis and BenchLM, beats local, and neutral leads vendor", async () => {
+		const catalog = [raw("z-ai/glm-5.3-flash"), raw("meta/muse-glimmer-30b")];
+		const cfg = cfgWith([
+			// Every one of these is outranked on glm's coding and intelligence.
+			neutralScore({ key: "glm-5-3-flash", creator: "z-ai", coding: 10, agentic: 50 }),
+			vendorScore({ key: "glm-5-3-flash", creator: "z-ai", intelligence: 9, agentic: 40 }),
+			// ...but both outrank local, and on agentic neutral outranks vendor.
+			vendorScore({ key: "muse-glimmer-30b", creator: "meta", agentic: 44 }),
+		]);
+		const feeds: FeedScore[] = [
+			aaScore({ key: "glm-5-3-flash", creator: "z-ai", coding: 61 }),
+			blScore({ key: "glm-5-3-flash", creator: "z-ai", intelligence: 58 }),
+			localScore({ key: "glm-5-3-flash", creator: "z-ai", agentic: 1 }),
+			localScore({ key: "muse-glimmer-30b", creator: "meta", agentic: 33 }),
+		];
+
+		applyFeedScores(catalog, [...feeds, ...suppliedScores(cfg)]);
+
+		expect(normalizeCatalogModel(catalog[0])?.quality).toEqual({ coding: 61, intelligence: 58, agentic: 50 });
+		expect(catalog[0]?.benchmarks).toMatchObject({
+			fill_sources: { coding: "artificial_analysis", intelligence: "benchlm", agentic: "neutral" },
+		});
+		expect(normalizeCatalogModel(catalog[1])?.quality).toEqual({ agentic: 44 });
+		expect(catalog[1]?.benchmarks).toMatchObject({ fill_sources: { agentic: "vendor" } });
+	});
+
+	test("a malformed entry is dropped loudly, and can neither zero a score nor stop the rest", async () => {
+		const { log, warns } = recorder();
+		const cfg = cfgWith([
+			42 as unknown as FeedScore, // not an object
+			{ creator: "x", source: "neutral", coding: 70 } as unknown as FeedScore, // no key
+			// Config may not claim a fetched feed, nor the lane `useLocalScores` gates.
+			aaScore({ key: "glm-5-3-flash", creator: "z-ai", coding: 99 }),
+			localScore({ key: "glm-5-3-flash", creator: "z-ai", coding: 98 }),
+			// Well-formed row, unusable axes: a string and an out-of-range number.
+			{ key: "glm-5-3-flash", creator: "z-ai", coding: "61", agentic: -3, source: "neutral" } as unknown as FeedScore,
+			neutralScore({ key: "muse-glimmer-30b", creator: "meta", coding: 55 }),
+		]);
+
+		const kept = suppliedScores(cfg, log);
+
+		// Four entries thrown away whole; the fifth survives with both axes gone.
+		expect(kept).toHaveLength(2);
+		expect(kept[0]).toEqual({ key: "glm-5-3-flash", creator: "z-ai", source: "neutral" });
+		expect(warns).toHaveLength(1);
+		expect(warns[0]?.fields).toMatchObject({ kept: 2, droppedEntries: 4, droppedAxes: 2 });
+
+		// The unusable axes stay ABSENT, not 0 — an unscored model must satisfy no
+		// floor, and a supplied 0 would satisfy `trivial` and bid for every turn.
+		const catalog = [raw("z-ai/glm-5.3-flash"), raw("meta/muse-glimmer-30b")];
+		applyFeedScores(catalog, kept);
+		expect(normalizeCatalogModel(catalog[0])?.quality).toEqual({});
+		expect(normalizeCatalogModel(catalog[1])?.quality).toEqual({ coding: 55 });
+	});
+
+	test("a supplied entry cannot claim a feed's rank by claiming its label", async () => {
+		const catalog = [raw("z-ai/glm-5.3-flash")];
+		// Sent as `artificial_analysis`, which would outrank BenchLM if it survived.
+		const cfg = cfgWith([aaScore({ key: "glm-5-3-flash", creator: "z-ai", coding: 99 })]);
+		applyFeedScores(catalog, [blScore({ key: "glm-5-3-flash", creator: "z-ai", coding: 58 }), ...suppliedScores(cfg)]);
+		expect(normalizeCatalogModel(catalog[0])?.quality.coding).toBe(58);
+	});
+
+	test("nor by being written into a table that does not produce it", async () => {
+		const db = openDb(":memory:");
+		// Each stored blob only yields the sources that actually write it, so neither
+		// lane is a side door into a rank. `local_scores` in particular stays the
+		// local lane — the one `benchmarks.useLocalScores` gates.
+		saveLocalScores(db, [
+			localScore({ key: "muse-glimmer-30b", creator: "meta", coding: 42 }),
+			neutralScore({ key: "muse-glimmer-30b", creator: "meta", agentic: 39 }),
+		]);
+		expect(loadLocalScores(db)).toEqual([{ key: "muse-glimmer-30b", creator: "meta", coding: 42, source: "local" }]);
+
+		const cached = [neutralScore({ key: "minimax-m3", coding: 70 }), blScore({ key: "minimax-m3", coding: 58 })];
+		db.query("INSERT INTO benchmark_cache (id, payload, fetched_at_ms) VALUES (1, ?, ?)").run(JSON.stringify(cached), 1000);
+		const feeds = await refreshFeedScores(cfgWith(), db, { fetchImpl: async () => Response.json({ models: [] }), now: 1500 });
+		expect(feeds).toEqual([{ key: "minimax-m3", creator: "", coding: 58, source: "benchlm" }]);
+		db.close();
+	});
+
+	test("the key may be the OpenRouter slug; the front door need not reimplement the match", async () => {
+		const catalog = [raw("deepseek/deepseek-v4.1-flash")];
+		const cfg = cfgWith([{ key: "deepseek/deepseek-v4.1-flash", creator: "DeepSeek", coding: 55.2, source: "vendor" }]);
+		expect(suppliedScores(cfg)[0]).toMatchObject({ key: "deepseek-v4-1-flash", creator: "deepseek" });
+		applyFeedScores(catalog, suppliedScores(cfg));
+		expect(normalizeCatalogModel(catalog[0])?.quality.coding).toBe(55.2);
+	});
+
+	test("past the cap the excess is dropped, loudly, and the rest still apply", async () => {
+		const { log, warns } = recorder();
+		const many: FeedScore[] = [];
+		for (let i = 0; i < MAX_EXTRA_SCORES + 5; i += 1) many.push(neutralScore({ key: `model-${i}`, coding: 50 }));
+		const kept = suppliedScores(cfgWith(many), log);
+		expect(kept).toHaveLength(MAX_EXTRA_SCORES);
+		expect(warns[0]?.fields).toMatchObject({ droppedEntries: 5, overCap: MAX_EXTRA_SCORES });
+	});
+
+	test("an older front door sends no such field and nothing changes", async () => {
+		const cfg = cfgWith();
+		expect(cfg.benchmarks.extraScores).toBeUndefined();
+		expect(suppliedScores(cfg)).toEqual([]);
+
+		// Byte for byte the same catalog, with the field absent and with it empty.
+		const feeds: FeedScore[] = [
+			aaScore({ key: "glm-5-3-flash", creator: "z-ai", coding: 61 }),
+			blScore({ key: "muse-glimmer-30b", creator: "meta", agentic: 48 }),
+		];
+		const withoutField = [raw("z-ai/glm-5.3-flash"), raw("meta/muse-glimmer-30b")];
+		const withEmpty = [raw("z-ai/glm-5.3-flash"), raw("meta/muse-glimmer-30b")];
+		const a = applyFeedScores(withoutField, [...feeds, ...suppliedScores(cfg)]);
+		const b = applyFeedScores(withEmpty, [...feeds, ...suppliedScores(cfgWith([]))]);
+		expect(JSON.stringify(withoutField)).toBe(JSON.stringify(withEmpty));
+		expect(a).toEqual(b);
+		expect(a.sources.neutral).toBe(0);
+		expect(a.sources.vendor).toBe(0);
+	});
+});

package/test/config.test.ts

@@ -118,4 +118,30 @@ describe("loadConfig", () => {
 		const cfg = loadConfig({ path });
 		expect(cfg.server.port).toBe(DEFAULT_CONFIG.server.port);
 	});
+
+	test("a config file may carry supplied benchmark scores, and a bad row is named", async () => {
+		const path = writeConfig(
+			"benchmarks:\n  extraScores:\n    - key: deepseek/deepseek-v4.1-flash\n      coding: 55.2\n      source: vendor\n",
+		);
+		const cfg = loadConfig({ path });
+		// `creator` defaults rather than going absent: it is only ever a tie-break.
+		expect(cfg.benchmarks.extraScores).toEqual([
+			{ key: "deepseek/deepseek-v4.1-flash", creator: "", coding: 55.2, source: "vendor" },
+		]);
+		// Absent by default, so a deployment that sets nothing is untouched.
+		expect(DEFAULT_CONFIG.benchmarks.extraScores).toBeUndefined();
+
+		// A FILE is strict, like every other key in it: a source config may not claim
+		// is an error the operator wants told, not a row silently dropped. A patch
+		// from a front door is the lenient path instead — see `suppliedScores`.
+		const bad = writeConfig("benchmarks:\n  extraScores:\n    - key: x\n      source: artificial_analysis\n");
+		let message = "";
+		try {
+			loadConfig({ path: bad });
+		} catch (err) {
+			message = err instanceof Error ? err.message : String(err);
+		}
+		expect(message).toContain("extraScores");
+		expect(message).toContain("source");
+	});
 });

package/test/context-token.test.ts

@@ -0,0 +1,301 @@
+import { describe, expect, test } from "bun:test";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { connectRemote, MCP_SERVER_NAME } from "../src/cli/connect.ts";
+import { refreshAndRewrite } from "../src/cli/refresh.ts";
+import { CONTEXT_TOKEN_RENEW_AHEAD_MS, dueForRenewal, ensureContextToken, mintContextToken, storedContextToken } from "../src/cli/context-token.ts";
+import { contextAccountOf, loadContextToken, loadRefreshToken, saveContextToken, saveRefreshToken } from "../src/cli/credential-store.ts";
+import { parseRemoteRouter } from "../omp-extension/remote-logic.ts";
+
+const NL = String.fromCharCode(10);
+const DAY = 24 * 3_600_000;
+const read = (p: string): Record<string, unknown> => JSON.parse(readFileSync(p, "utf8")) as Record<string, unknown>;
+const servers = (p: string): Record<string, unknown> => (read(p).mcpServers as Record<string, unknown>) ?? {};
+const auth = (p: string): string | undefined => (servers(p)[MCP_SERVER_NAME] as { headers?: { Authorization?: string } } | undefined)?.headers?.Authorization;
+
+/** An omp+router home wired the way `connect` expects to find one. */
+function fixture(prefix: string): { home: string; agent: string; rh: string; env: Record<string, string> } {
+	const home = mkdtempSync(join(tmpdir(), prefix));
+	const agent = join(home, ".omp", "agent");
+	mkdirSync(agent, { recursive: true });
+	writeFileSync(join(agent, "config.yml"), `extensions: []${NL}`, "utf8");
+	const rh = join(home, ".auto-model-router");
+	return { home, agent, rh, env: { HOME: home, PI_CODING_AGENT_DIR: agent, AUTO_MODEL_ROUTER_HOME: rh, HERMES_HOME: join(home, "no-hermes") } };
+}
+
+/** A fake OS credential store; one map, keyed by account, so both slots land in it. */
+function vault(): { map: Map<string, string>; backend: { save(a: string, s: string): void; load(a: string): string | null; remove(a: string): void } } {
+	const map = new Map<string, string>();
+	return { map, backend: { save: (a, s) => void map.set(a, s), load: (a) => map.get(a) ?? null, remove: (a) => void map.delete(a) } };
+}
+
+describe("when a context token is due for renewal", () => {
+	test("none, an unknown expiry, or inside the 30-day window; a year out is left alone", async () => {
+		const now = Date.now();
+		expect(CONTEXT_TOKEN_RENEW_AHEAD_MS).toBe(30 * DAY);
+		expect(dueForRenewal(null, now)).toBe(true);
+		expect(dueForRenewal({ value: "" }, now)).toBe(true);
+		// An expiry nobody recorded cannot be trusted; minting records one, so this converges.
+		expect(dueForRenewal({ value: "amrctx_x" }, now)).toBe(true);
+		expect(dueForRenewal({ value: "amrctx_x", expiresAtMs: now + 10 * DAY }, now)).toBe(true);
+		expect(dueForRenewal({ value: "amrctx_x", expiresAtMs: now - DAY }, now)).toBe(true);
+		expect(dueForRenewal({ value: "amrctx_x", expiresAtMs: now + 31 * DAY }, now)).toBe(false);
+		expect(dueForRenewal({ value: "amrctx_x", expiresAtMs: now + 365 * DAY }, now)).toBe(false);
+	});
+});
+
+describe("minting a context token", () => {
+	test("posts the device name with the member key and reads the token back", async () => {
+		const seen: { url: string; auth: string | null; body: string }[] = [];
+		const fetchImpl = (async (input: string | URL | Request, init?: RequestInit) => {
+			seen.push({ url: String(input), auth: (init?.headers as Record<string, string>).authorization ?? null, body: String(init?.body) });
+			return Response.json({ token: "amrctx_new", id: "ctx_1", expiresAtMs: 99, deviceId: "dev_1" }, { status: 201 });
+		}) as unknown as typeof fetch;
+		expect(await mintContextToken("https://team.example", "amrt_key", "laptop", fetchImpl)).toEqual({ value: "amrctx_new", expiresAtMs: 99, id: "ctx_1" });
+		expect(seen[0]).toEqual({ url: "https://team.example/me/context-tokens", auth: "Bearer amrt_key", body: JSON.stringify({ name: "laptop" }) });
+	});
+
+	test("an older team (404), a deployment that issues none (503), a junk body or a dead remote all answer null", async () => {
+		const status = (code: number): typeof fetch => (async () => new Response("", { status: code })) as unknown as typeof fetch;
+		expect(await mintContextToken("https://t", "k", "n", status(404))).toBeNull();
+		expect(await mintContextToken("https://t", "k", "n", status(503))).toBeNull();
+		expect(await mintContextToken("https://t", "k", "n", (async () => Response.json({ token: 7 })) as unknown as typeof fetch)).toBeNull();
+		expect(await mintContextToken("https://t", "k", "n", (async () => new Response("<html>")) as unknown as typeof fetch)).toBeNull();
+		expect(
+			await mintContextToken("https://t", "k", "n", (async () => {
+				throw new Error("down");
+			}) as unknown as typeof fetch),
+		).toBeNull();
+	});
+});
+
+describe("ensureContextToken", () => {
+	const never = (async () => {
+		throw new Error("should not have been called");
+	}) as unknown as typeof fetch;
+	const mints = (value: string): typeof fetch => (async () => Response.json({ token: value, id: `id_${value}`, expiresAtMs: Date.now() + 365 * DAY })) as unknown as typeof fetch;
+
+	test("an older team edition (member-key) mints nothing and keeps the access key", async () => {
+		expect(await ensureContextToken({ url: "https://t", key: "amrt_k", mcpAuth: "member-key", routerHome: "/nowhere", name: "laptop", fetchImpl: never })).toBeNull();
+	});
+
+	test("a token the exchange already handed over wins, with no second round trip", async () => {
+		const issued = { value: "amrctx_exchange", expiresAtMs: 1, id: "ctx_e" };
+		expect(await ensureContextToken({ url: "https://t", key: "amrt_k", mcpAuth: "context-token", routerHome: "/nowhere", name: "laptop", issued, fetchImpl: never })).toEqual(issued);
+	});
+
+	test("a held token far from expiry is reused untouched; one inside the window is renewed", async () => {
+		const { backend, map } = vault();
+		const rh = "/nowhere";
+		const remote = parseRemoteRouter(
+			JSON.stringify({ url: "https://t", key: "amrt_k", userId: "u_ada", refreshTokenStore: "keychain", refreshAccount: "u_ada@t", contextTokenStore: "keychain", contextAccount: "u_ada@t#context", contextTokenExpiresAtMs: Date.now() + 200 * DAY, contextTokenId: "ctx_old" }),
+		)!;
+		map.set("u_ada@t#context", "amrctx_held");
+		const opts = { url: "https://t", key: "amrt_k", mcpAuth: "context-token" as const, routerHome: rh, remote, name: "laptop", storeDeps: { backend } };
+		expect(await ensureContextToken({ ...opts, fetchImpl: never })).toEqual({ value: "amrctx_held", expiresAtMs: remote.contextTokenExpiresAtMs!, id: "ctx_old" });
+		// Move the expiry inside the renewal window and the same call mints instead.
+		const soon = { ...remote, contextTokenExpiresAtMs: Date.now() + 10 * DAY };
+		const renewed = await ensureContextToken({ ...opts, remote: soon, fetchImpl: mints("amrctx_fresh") });
+		expect(renewed?.value).toBe("amrctx_fresh");
+	});
+
+	test("a mint that fails leaves the held token in place rather than breaking the tools", async () => {
+		const { backend, map } = vault();
+		map.set("u_ada@t#context", "amrctx_held");
+		const remote = parseRemoteRouter(JSON.stringify({ url: "https://t", key: "amrt_k", userId: "u_ada", contextTokenStore: "keychain", contextAccount: "u_ada@t#context", contextTokenExpiresAtMs: Date.now() + DAY }))!;
+		const dead = (async () => new Response("", { status: 503 })) as unknown as typeof fetch;
+		expect((await ensureContextToken({ url: "https://t", key: "k", mcpAuth: "context-token", routerHome: "/nowhere", remote, name: "laptop", storeDeps: { backend }, fetchImpl: dead }))?.value).toBe("amrctx_held");
+		// And with nothing held there is nothing to fall back to: the caller keeps the access key.
+		map.clear();
+		expect(await ensureContextToken({ url: "https://t", key: "k", mcpAuth: "context-token", routerHome: "/nowhere", remote, name: "laptop", storeDeps: { backend }, fetchImpl: dead })).toBeNull();
+	});
+});
+
+describe("the context token lives beside the refresh token, never in a plain file when a store works", () => {
+	test("its own slot: two secrets, two accounts, two fallback files, neither clobbering the other", async () => {
+		const home = mkdtempSync(join(tmpdir(), "amr-ctx-store-"));
+		const { backend } = vault();
+		try {
+			expect(contextAccountOf("u_ada@team.example")).toBe("u_ada@team.example#context");
+			expect(saveRefreshToken(home, "u@t", "amrr_x", "keychain", { backend })).toBe("keychain");
+			expect(saveContextToken(home, "u@t#context", "amrctx_x", "keychain", { backend })).toBe("keychain");
+			expect(loadRefreshToken(home, "u@t", "keychain", { backend })).toBe("amrr_x");
+			expect(loadContextToken(home, "u@t#context", "keychain", { backend })).toBe("amrctx_x");
+			// Nothing on disk while a store takes them.
+			expect(existsSync(join(home, "refresh.token"))).toBe(false);
+			expect(existsSync(join(home, "context.token"))).toBe(false);
+			// The file fallback keeps them apart.
+			expect(saveRefreshToken(home, "u@t", "amrr_f", "file")).toBe("file");
+			expect(saveContextToken(home, "u@t#context", "amrctx_f", "file")).toBe("file");
+			expect(readFileSync(join(home, "refresh.token"), "utf8").trim()).toBe("amrr_f");
+			expect(readFileSync(join(home, "context.token"), "utf8").trim()).toBe("amrctx_f");
+			expect(loadRefreshToken(home, "u@t", "file")).toBe("amrr_f");
+			expect(loadContextToken(home, "u@t#context", "file")).toBe("amrctx_f");
+		} finally {
+			rmSync(home, { recursive: true, force: true });
+		}
+	});
+
+	test("connect files it in the store the refresh token uses; remote.json only names it", async () => {
+		const { home, agent, rh, env } = fixture("amr-ctx-connect-");
+		const { backend, map } = vault();
+		try {
+			connectRemote({
+				url: "https://team.example",
+				key: "amrt_k1",
+				userId: "u_ada",
+				name: "Ada",
+				refreshToken: "amrr_r1",
+				keyExpiresAtMs: 1,
+				refreshExpiresAtMs: 2,
+				device: "laptop",
+				store: "keychain",
+				storeDeps: { backend },
+				profile: false,
+				dryRun: false,
+				only: ["omp"],
+				env,
+				home,
+				packageDir: process.cwd(),
+				mcp: { url: "https://team.example/mcp", token: "amrctx_t1", tokenExpiresAtMs: 4_000, tokenId: "ctx_1" },
+				platform: "darwin",
+				pathHas: () => false,
+			});
+			const written = readFileSync(join(rh, "remote.json"), "utf8");
+			expect(written).not.toContain("amrctx_t1");
+			expect(existsSync(join(rh, "context.token"))).toBe(false);
+			const remote = parseRemoteRouter(written)!;
+			expect(remote).toMatchObject({ contextTokenStore: "keychain", contextAccount: "u_ada@team.example#context", contextTokenExpiresAtMs: 4_000, contextTokenId: "ctx_1" });
+			expect(map.get("u_ada@team.example#context")).toBe("amrctx_t1");
+			expect(map.get("u_ada@team.example")).toBe("amrr_r1");
+			expect(storedContextToken(remote, rh, { backend })).toEqual({ value: "amrctx_t1", expiresAtMs: 4_000, id: "ctx_1" });
+			// The MCP entry carries the context token, NOT the 72-hour access key.
+			expect(auth(join(agent, "mcp.json"))).toBe("Bearer amrctx_t1");
+		} finally {
+			rmSync(home, { recursive: true, force: true });
+		}
+	});
+});
+
+describe("a key refresh leaves the MCP entry alone", () => {
+	/** A team edition that mints context tokens; `mcpAuth` is what tells connect so. */
+	function teamFetch(opts: { key: string; mint?: { token: string; id: string; expiresAtMs: number } }): { fetchImpl: typeof fetch; seen: string[] } {
+		const seen: string[] = [];
+		const fetchImpl = (async (input: string | URL | Request) => {
+			const url = String(input);
+			seen.push(url);
+			if (url.endsWith("/setup/info")) return Response.json({ version: "0.39.0", mcp: true, mcpAuth: "context-token" });
+			if (url.endsWith("/setup/skills")) return new Response("", { status: 404 });
+			if (url.endsWith("/me/context-tokens")) return opts.mint === undefined ? new Response("", { status: 503 }) : Response.json(opts.mint, { status: 201 });
+			return Response.json({ key: opts.key, keyExpiresAtMs: 50, refreshToken: "amrr_r2", refreshExpiresAtMs: 90 });
+		}) as unknown as typeof fetch;
+		return { fetchImpl, seen };
+	}
+
+	function connected(env: Record<string, string>, home: string, backend: { save(a: string, s: string): void; load(a: string): string | null; remove(a: string): void }, expiresAtMs: number): void {
+		connectRemote({
+			url: "https://team.example",
+			key: "amrt_old",
+			userId: "u_ada",
+			name: "Ada",
+			refreshToken: "amrr_r1",
+			keyExpiresAtMs: 1,
+			refreshExpiresAtMs: 2,
+			device: "laptop",
+			store: "keychain",
+			storeDeps: { backend },
+			profile: false,
+			dryRun: false,
+			only: ["omp"],
+			env,
+			home,
+			packageDir: process.cwd(),
+			mcp: { url: "https://team.example/mcp", token: "amrctx_t1", tokenExpiresAtMs: expiresAtMs, tokenId: "ctx_1" },
+			platform: "darwin",
+			pathHas: () => false,
+		});
+	}
+
+	test("the new access key goes everywhere but the team-context server, which keeps its token", async () => {
+		const { home, agent, rh, env } = fixture("amr-ctx-refresh-");
+		const { backend, map } = vault();
+		try {
+			connected(env, home, backend, Date.now() + 300 * DAY);
+			expect(auth(join(agent, "mcp.json"))).toBe("Bearer amrctx_t1");
+			const { fetchImpl, seen } = teamFetch({ key: "amrt_new" });
+			const remote = parseRemoteRouter(readFileSync(join(rh, "remote.json"), "utf8"))!;
+			await refreshAndRewrite({ remote, fetchImpl, home, packageDir: process.cwd(), env, platform: "darwin", pathHas: () => false, routerHome: rh, storeDeps: { backend } });
+			// Nothing was minted: the held token is nowhere near expiry.
+			expect(seen.some((u) => u.endsWith("/me/context-tokens"))).toBe(false);
+			expect(auth(join(agent, "mcp.json"))).toBe("Bearer amrctx_t1");
+			expect(map.get("u_ada@team.example#context")).toBe("amrctx_t1");
+			// ... while the access key really did rotate everywhere else.
+			const after = parseRemoteRouter(readFileSync(join(rh, "remote.json"), "utf8"))!;
+			expect(after.key).toBe("amrt_new");
+			expect(after.contextTokenId).toBe("ctx_1");
+			expect(readFileSync(join(env.PI_CODING_AGENT_DIR!, "models.yml"), "utf8")).toContain("amrt_new");
+		} finally {
+			rmSync(home, { recursive: true, force: true });
+		}
+	});
+
+	test("a token inside the renewal window is re-minted with the freshly refreshed key and re-filed", async () => {
+		const { home, agent, rh, env } = fixture("amr-ctx-renew-");
+		const { backend, map } = vault();
+		try {
+			connected(env, home, backend, Date.now() + 10 * DAY);
+			const expiresAtMs = Date.now() + 365 * DAY;
+			const { fetchImpl, seen } = teamFetch({ key: "amrt_new", mint: { token: "amrctx_t2", id: "ctx_2", expiresAtMs } });
+			const remote = parseRemoteRouter(readFileSync(join(rh, "remote.json"), "utf8"))!;
+			await refreshAndRewrite({ remote, fetchImpl, home, packageDir: process.cwd(), env, platform: "darwin", pathHas: () => false, routerHome: rh, storeDeps: { backend } });
+			expect(seen.filter((u) => u.endsWith("/me/context-tokens")).length).toBe(1);
+			expect(auth(join(agent, "mcp.json"))).toBe("Bearer amrctx_t2");
+			expect(map.get("u_ada@team.example#context")).toBe("amrctx_t2");
+			const after = parseRemoteRouter(readFileSync(join(rh, "remote.json"), "utf8"))!;
+			expect(after).toMatchObject({ contextTokenId: "ctx_2", contextTokenExpiresAtMs: expiresAtMs, contextTokenStore: "keychain" });
+			expect(readFileSync(join(rh, "remote.json"), "utf8")).not.toContain("amrctx_t2");
+		} finally {
+			rmSync(home, { recursive: true, force: true });
+		}
+	});
+
+	test("an older team edition is untouched: no mcpAuth, no mint, and the entry takes the new access key", async () => {
+		const { home, agent, rh, env } = fixture("amr-ctx-legacy-");
+		const { backend } = vault();
+		try {
+			// No token at connect time — the team never offered one.
+			connectRemote({ url: "https://team.example", key: "amrt_old", userId: "u_ada", name: "Ada", refreshToken: "amrr_r1", keyExpiresAtMs: 1, refreshExpiresAtMs: 2, store: "keychain", storeDeps: { backend }, profile: false, dryRun: false, only: ["omp"], env, home, packageDir: process.cwd(), mcp: { url: "https://team.example/mcp" }, platform: "darwin", pathHas: () => false });
+			expect(auth(join(agent, "mcp.json"))).toBe("Bearer amrt_old");
+			expect(parseRemoteRouter(readFileSync(join(rh, "remote.json"), "utf8"))!.contextTokenStore).toBeUndefined();
+			const seen: string[] = [];
+			const fetchImpl = (async (input: string | URL | Request) => {
+				const url = String(input);
+				seen.push(url);
+				if (url.endsWith("/setup/info")) return Response.json({ version: "0.18.0", mcp: true }); // no mcpAuth
+				if (url.endsWith("/setup/skills")) return new Response("", { status: 404 });
+				return Response.json({ key: "amrt_new", keyExpiresAtMs: 50, refreshToken: "amrr_r2", refreshExpiresAtMs: 90 });
+			}) as unknown as typeof fetch;
+			const remote = parseRemoteRouter(readFileSync(join(rh, "remote.json"), "utf8"))!;
+			await refreshAndRewrite({ remote, fetchImpl, home, packageDir: process.cwd(), env, platform: "darwin", pathHas: () => false, routerHome: rh, storeDeps: { backend } });
+			expect(seen.some((u) => u.endsWith("/me/context-tokens"))).toBe(false);
+			expect(auth(join(agent, "mcp.json"))).toBe("Bearer amrt_new");
+		} finally {
+			rmSync(home, { recursive: true, force: true });
+		}
+	});
+
+	test("a connect that learns nothing about context tokens keeps what remote.json already recorded", async () => {
+		const { home, rh, env } = fixture("amr-ctx-carry-");
+		const { backend } = vault();
+		try {
+			connected(env, home, backend, 4_000);
+			// A later connect with no mcp token at all (a /setup/info that did not answer) must not
+			// orphan the token the credential store is still holding for another year.
+			connectRemote({ url: "https://team.example", key: "amrt_k2", userId: "u_ada", name: "Ada", refreshToken: "amrr_r1", store: "keychain", storeDeps: { backend }, profile: false, dryRun: false, only: ["omp"], env, home, packageDir: process.cwd(), platform: "darwin", pathHas: () => false });
+			expect(parseRemoteRouter(readFileSync(join(rh, "remote.json"), "utf8"))!).toMatchObject({ contextTokenStore: "keychain", contextAccount: "u_ada@team.example#context", contextTokenId: "ctx_1" });
+		} finally {
+			rmSync(home, { recursive: true, force: true });
+		}
+	});
+});

package/test/ledger-sql.test.ts

@@ -41,7 +41,7 @@ function entry(over: Partial<LedgerEntry> & { id: string; slug: string }): Ledge
 		conversationKey: `conv-${over.id}`,
 		// `LedgerEntry.sessionId` is a string and the column is NOT NULL: a null
 		// here only ever passed because the second bootstrap declared the column
-		// laxer than the nineteen shipped migrations do.
+		// laxer than the twenty shipped migrations do.
 		sessionId: `sess-${over.id}`,
 		turn: 1,
 		requestedModel: "auto",

package/test/mcp-entry.test.ts

@@ -144,14 +144,23 @@ describe("connect writes the team MCP endpoint", () => {
 
 describe("fetchSetupInfo", () => {
 	test("reads mcp from a team, and answers false for a plain router, a bad body or a dead remote", async () => {
-		expect(await fetchSetupInfo("https://t", (async () => Response.json({ mcp: true })) as unknown as typeof fetch)).toEqual({ mcp: true });
-		expect(await fetchSetupInfo("https://t", (async () => Response.json({ mcp: "yes" })) as unknown as typeof fetch)).toEqual({ mcp: false });
-		expect(await fetchSetupInfo("https://t", (async () => new Response("", { status: 404 })) as unknown as typeof fetch)).toEqual({ mcp: false });
-		expect(await fetchSetupInfo("https://t", (async () => new Response("<html>", { status: 200 })) as unknown as typeof fetch)).toEqual({ mcp: false });
+		expect(await fetchSetupInfo("https://t", (async () => Response.json({ mcp: true })) as unknown as typeof fetch)).toEqual({ mcp: true, mcpAuth: "member-key" });
+		expect(await fetchSetupInfo("https://t", (async () => Response.json({ mcp: "yes" })) as unknown as typeof fetch)).toEqual({ mcp: false, mcpAuth: "member-key" });
+		expect(await fetchSetupInfo("https://t", (async () => new Response("", { status: 404 })) as unknown as typeof fetch)).toEqual({ mcp: false, mcpAuth: "member-key" });
+		expect(await fetchSetupInfo("https://t", (async () => new Response("<html>", { status: 200 })) as unknown as typeof fetch)).toEqual({ mcp: false, mcpAuth: "member-key" });
 		expect(
 			await fetchSetupInfo("https://t", (async () => {
 				throw new Error("down");
 			}) as unknown as typeof fetch),
-		).toEqual({ mcp: false });
+		).toEqual({ mcp: false, mcpAuth: "member-key" });
+	});
+
+	test("mcpAuth says which credential the MCP entry carries; anything but context-token is the member key", async () => {
+		const info = async (body: Record<string, unknown>): Promise<{ mcp: boolean; mcpAuth: string }> => fetchSetupInfo("https://t", (async () => Response.json(body)) as unknown as typeof fetch);
+		expect(await info({ mcp: true, mcpAuth: "context-token" })).toEqual({ mcp: true, mcpAuth: "context-token" });
+		expect(await info({ mcp: true, mcpAuth: "member-key" })).toEqual({ mcp: true, mcpAuth: "member-key" });
+		// An older team edition says nothing at all; it must read as the member key.
+		expect(await info({ mcp: true })).toEqual({ mcp: true, mcpAuth: "member-key" });
+		expect(await info({ mcp: true, mcpAuth: 1 })).toEqual({ mcp: true, mcpAuth: "member-key" });
 	});
 });

package/test/migrations.test.ts

@@ -11,7 +11,7 @@ import { createFeedbackStore } from "../src/cost/feedback.ts";
 import { createSqlLedger } from "../src/cost/ledger-sql.ts";
 import { buildUsageReport } from "../src/cost/report.ts";
 import { buildDailySummary, createKv } from "../src/cost/summary.ts";
-import { exportRows, spendUsdSince } from "../src/cost/views.ts";
+import { decisionEntries, exportRows, spendUsdSince } from "../src/cost/views.ts";
 import { createConversationStore } from "../src/router/state.ts";
 
 /**
@@ -26,7 +26,7 @@ import { createConversationStore } from "../src/router/state.ts";
 
 const FIXTURES = join(import.meta.dir, "fixtures", "migrations");
 const files = readdirSync(FIXTURES).filter((f) => /^router-v\d+\.db$/.test(f)).sort((a, b) => Number(/\d+/.exec(a)![0]) - Number(/\d+/.exec(b)![0]));
-const CURRENT_VERSION = 19;
+const CURRENT_VERSION = 20;
 
 describe("schema migrations from every shipped version", () => {
 	test("fixtures exist for the versions that shipped", async () => {
@@ -42,14 +42,14 @@ describe("schema migrations from every shipped version", () => {
 			const cfg = structuredClone(DEFAULT_CONFIG);
 			cfg.ledger.path = path;
 			// `openDb` is the migration path for a SQLite file: it applies the
-			// nineteen versions in order. The shim handle then reads the result.
+			// twenty versions in order. The shim handle then reads the result.
 			const db = openDb(path);
 			const sdb = openSqlDb(path);
 			try {
 				expect((db.query("PRAGMA user_version").get() as { user_version: number }).user_version).toBe(CURRENT_VERSION);
 				// Every column the current code writes exists after migration.
 				const ledgerCols = new Set((db.query("PRAGMA table_info(ledger)").all() as { name: string }[]).map((c) => c.name));
-				for (const c of ["harness_id", "error_kind", "omp_session_id", "features", "explored_from", "hold_arm", "prompt_tokens_saved", "scope", "redactions"]) expect(ledgerCols.has(c)).toBe(true);
+				for (const c of ["harness_id", "error_kind", "omp_session_id", "features", "explored_from", "hold_arm", "prompt_tokens_saved", "scope", "redactions", "request_id"]) expect(ledgerCols.has(c)).toBe(true);
 				const convCols = new Set((db.query("PRAGMA table_info(conversations)").all() as { name: string }[]).map((c) => c.name));
 				for (const c of ["context_version", "compaction_plan", "compaction_plan_tokens", "upgrade_deferred_tier"]) expect(convCols.has(c)).toBe(true);
 				// The fixture's ledger row survived the ALTERs with its values.
@@ -76,6 +76,13 @@ describe("schema migrations from every shipped version", () => {
 				// v19: the fixture's row predates `redactions`, so nothing claims a
 				// redaction happened on it and the report totals it as zero.
 				expect((await buildUsageReport(sdb, { windowDays: 3650 })).totals.redactions).toBe(0);
+				// v20: the fixture's row predates `request_id`, so it reads as ABSENT
+				// rather than as an error or an empty string — an old turn genuinely
+				// has no request id, and the decision trail says so by omission. The
+				// column is there and queryable, so a lookup by id simply finds nothing.
+				expect((await ledger.recentEntries(5))[0]?.requestId).toBeUndefined();
+				expect(await decisionEntries(sdb, { sinceMs: 0, harness: null, requestId: "anything-at-all" })).toEqual([]);
+				expect((await decisionEntries(sdb, { sinceMs: 0, harness: null }))[0]?.requestId).toBeUndefined();
 			} finally {
 				await sdb.close();
 				db.close();