llm-switcher 1.1.0

package/tests/mcp.test.mjs

@@ -0,0 +1,91 @@
+// MCP server and process audit tests (audit F39, F40, N-7, F46). mcp.mjs runs as a stdio child.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import net from 'node:net';
+import os from 'node:os';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { routeEvidence } from '../shim.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+const freePort = () => new Promise(r => {
+  const s = net.createServer().listen(0, '127.0.0.1', () => { const { port } = s.address(); s.close(() => r(port)); });
+});
+
+async function mcpCall(t, env, calls) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'llmsw-mcp-'));
+  t.after(() => fs.rmSync(dir, { recursive: true, force: true }));
+  const cfgPath = path.join(dir, 'config.json');
+  fs.writeFileSync(cfgPath, JSON.stringify({ port: await freePort(), activeProfiles: {}, profiles: {} }), { mode: 0o600 });
+  const claudeDir = path.join(dir, 'claude');
+  fs.mkdirSync(claudeDir);
+  if (env.SETTINGS !== undefined) fs.writeFileSync(path.join(claudeDir, 'settings.json'), env.SETTINGS);
+  const child = spawn(process.execPath, [path.join(ROOT, 'mcp.mjs')], {
+    env: { ...process.env, LLM_SWITCHER_CONFIG: cfgPath, LLM_SWITCHER_STATE_DIR: dir, CLAUDE_CONFIG_DIR: claudeDir, LLM_SWITCHER_PORT: '', ANTHROPIC_BASE_URL: '', ...env.vars }
+  });
+  let out = '';
+  child.stdout.on('data', d => { out += d; });
+  const requests = calls.map((c, i) => JSON.stringify({ jsonrpc: '2.0', id: i + 1, ...c })).join('\n') + '\n';
+  child.stdin.write(requests);
+  for (let i = 0; i < 100 && out.split('\n').filter(Boolean).length < calls.length; i++) await new Promise(r => setTimeout(r, 50));
+  child.kill();
+  return out.split('\n').filter(Boolean).map(l => JSON.parse(l));
+}
+
+const tool = (name, args = {}) => ({ method: 'tools/call', params: { name, arguments: args } });
+const text = (reply) => reply.result.content[0].text;
+
+test('MCP initialize reports the package version', async (t) => {
+  const [init] = await mcpCall(t, {}, [{ method: 'initialize', params: { protocolVersion: '2025-06-18' } }]);
+  const pkg = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8'));
+  assert.equal(init.result.serverInfo.version, pkg.version);
+});
+
+test('MCP recent logs says the gateway is unreachable instead of "no requests"', async (t) => {
+  const [r] = await mcpCall(t, {}, [tool('switcher_recent_logs')]);
+  assert.match(text(r), /unreachable/i);
+  assert.equal(r.result.isError, true);
+});
+
+test('MCP audit checks the host, not a substring, and reports an unreadable settings.json', async (t) => {
+  const [evil] = await mcpCall(t, { vars: { ANTHROPIC_BASE_URL: 'https://localhost.evil.test/v1' } }, [tool('switcher_audit')]);
+  assert.match(text(evil), /\[ALERT\] ANTHROPIC_BASE_URL/);
+  const [openai] = await mcpCall(t, { vars: { OPENAI_BASE_URL: 'https://api.example.test/v1' } }, [tool('switcher_audit')]);
+  assert.match(text(openai), /\[ALERT\] OPENAI_BASE_URL/);
+  const [broken] = await mcpCall(t, { SETTINGS: '{ not json' }, [tool('switcher_audit')]);
+  assert.match(text(broken), /ACTION NEEDED/);
+  assert.match(text(broken), /settings\.json .*does not parse/);
+  const [verbose] = await mcpCall(t, { vars: { ANTHROPIC_BASE_URL: 'http://127.0.0.1:3456' } }, [tool('switcher_audit', { verbose: true })]);
+  assert.match(text(verbose), /ANTHROPIC_BASE_URL=http:\/\/127\.0\.0\.1:3456/);
+});
+
+test('routeEvidence reads the right evidence for each CLI and says when it cannot read the environment', () => {
+  assert.equal(routeEvidence('claude', 'claude --resume HOME=/h ANTHROPIC_BASE_URL=http://127.0.0.1:3456'), true);
+  assert.equal(routeEvidence('claude', 'claude HOME=/h PATH=/bin'), false);
+  // Codex through the gateway, through the blindfold interceptor, or through the shim's override.
+  assert.equal(routeEvidence('codex', 'codex HOME=/h LLM_SWITCHER_CODEX_BASE_URL=http://127.0.0.1:3456/v1'), true);
+  assert.equal(routeEvidence('codex', 'codex HOME=/h HTTPS_PROXY=http://127.0.0.1:3457'), true);
+  assert.equal(routeEvidence('codex', 'codex --config openai_base_url=http://127.0.0.1:3456/v1 HOME=/h'), true);
+  assert.equal(routeEvidence('codex', 'codex HOME=/h ANTHROPIC_BASE_URL=http://127.0.0.1:3456'), false);
+  // macOS ps prints no environment for most processes: that is unknown, not a bypass.
+  assert.equal(routeEvidence('claude', 'claude --resume'), null);
+});
+
+// A proxy URL often carries a user and a password. The audit output goes into the agent's context.
+test('MCP audit never prints the credentials inside a URL', async (t) => {
+  const [r] = await mcpCall(t, { vars: { HTTPS_PROXY: 'http://u:s3cret@127.0.0.1:1', ANTHROPIC_BASE_URL: 'https://user:pw-secret@evil.example/v1' } }, [tool('switcher_audit', { verbose: true })]);
+  const out = text(r);
+  assert.ok(!out.includes('s3cret') && !out.includes('pw-secret'), out);
+  assert.match(out, /HTTPS_PROXY=http:\/\/127\.0\.0\.1:1/);
+  assert.match(out, /\[ALERT\] ANTHROPIC_BASE_URL="https:\/\/evil\.example\/v1"/);
+});
+
+test('routeEvidence does not take the shim --config arguments for an environment', () => {
+  assert.equal(routeEvidence('codex', '/usr/local/bin/codex --config model_catalog_json=/s/model-catalog.json --config model="gpt-5.5"'), null);
+  assert.equal(routeEvidence('codex', '/usr/local/bin/codex -c model="gpt-5.5" exec'), null);
+  // The override on the command line is proof enough, with or without a readable environment.
+  assert.equal(routeEvidence('codex', '/usr/local/bin/codex --config openai_base_url=http://127.0.0.1:3456/v1 exec'), true);
+});

package/tests/service.test.mjs

@@ -0,0 +1,69 @@
+// Unit tests for service.mjs: the text of each OS service definition, and how the CLI reads the
+// port back (audit N-5, LC-2, LC-3). Windows itself is not available here; these tests pin what
+// the XML says, not how Task Scheduler runs it.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import {
+  systemdUnit, launchdPlist, scheduledTaskXml, portFromServiceText, decodeConsoleText, serviceEnv, writeServiceFile
+} from '../service.mjs';
+
+const HAS_XMLLINT = (() => { try { execFileSync('xmllint', ['--version'], { stdio: 'ignore' }); return true; } catch { return false; } })();
+
+test('serviceEnv passes only the variables that change where the gateway reads and writes', () => {
+  const env = serviceEnv({ CLAUDE_CONFIG_DIR: '/c', LLM_SWITCHER_CONFIG: '/cfg.json', LLM_SWITCHER_BLINDFOLD_CERTS: '', HOME: '/h', PATH: '/bin' });
+  assert.deepEqual(env, [['CLAUDE_CONFIG_DIR', '/c'], ['LLM_SWITCHER_CONFIG', '/cfg.json']]);
+});
+
+test('systemd unit quotes the command and carries the environment', () => {
+  const text = systemdUnit({ nodeBin: '/opt/node dir/node', script: '/srv/llm switcher/proxy.mjs', port: 4000, env: [['CLAUDE_CONFIG_DIR', '/home/a b/.claude']] });
+  assert.match(text, /^ExecStart="\/opt\/node dir\/node" "\/srv\/llm switcher\/proxy.mjs" --port 4000$/m);
+  assert.match(text, /^Environment="CLAUDE_CONFIG_DIR=\/home\/a b\/.claude"$/m);
+  assert.equal(portFromServiceText(text), 4000);
+});
+
+const plist = () => launchdPlist({ nodeBin: '/n', script: '/a&b/proxy.mjs', port: 4001, logPath: '/l<og>', env: [['CLAUDE_CONFIG_DIR', '/x&y']] });
+const taskXml = () => scheduledTaskXml({ nodeBin: 'C:\\Program Files\\nodejs\\node.exe', script: 'C:\\Users\\A & B\\llm-switcher\\proxy.mjs', port: 4002, userId: 'PC\\a&b' });
+
+test('the plist and the task XML are well-formed', { skip: !HAS_XMLLINT && 'needs xmllint' }, () => {
+  execFileSync('xmllint', ['--noout', '-'], { input: plist() });
+  execFileSync('xmllint', ['--noout', '-'], { input: taskXml().replace('encoding="UTF-16"', 'encoding="UTF-8"') });
+});
+
+test('launchd plist escapes values and carries the environment', () => {
+  const text = plist();
+  assert.match(text, /<key>EnvironmentVariables<\/key>\s*<dict>\s*<key>CLAUDE_CONFIG_DIR<\/key>\s*<string>\/x&amp;y<\/string>/);
+  assert.equal(portFromServiceText(text), 4001);
+});
+
+test('Windows task XML keeps the command and its arguments apart and has no run-time limit', () => {
+  const xml = taskXml();
+  assert.match(xml, /<Command>C:\\Program Files\\nodejs\\node.exe<\/Command>/);
+  assert.match(xml, /<Arguments>&quot;C:\\Users\\A &amp; B\\llm-switcher\\proxy.mjs&quot; --port 4002<\/Arguments>/);
+  assert.match(xml, /<ExecutionTimeLimit>PT0S<\/ExecutionTimeLimit>/);
+  assert.match(xml, /<LogonTrigger>\s*<Enabled>true<\/Enabled>\s*<UserId>PC\\a&amp;b<\/UserId>/);
+  assert.equal(portFromServiceText(xml), 4002);
+});
+
+test('the port is read back from UTF-16 console output, as schtasks /Query /XML prints it', () => {
+  const xml = scheduledTaskXml({ nodeBin: 'node.exe', script: 'proxy.mjs', port: 4567, userId: 'u' });
+  assert.equal(portFromServiceText(decodeConsoleText(Buffer.concat([Buffer.from([0xff, 0xfe]), Buffer.from(xml, 'utf16le')]))), 4567);
+  assert.equal(portFromServiceText(decodeConsoleText(Buffer.from(xml, 'utf16le'))), 4567);
+  assert.equal(portFromServiceText(decodeConsoleText(Buffer.from(xml, 'utf8'))), 4567);
+  assert.equal(portFromServiceText('no port here'), null);
+});
+
+test('writeServiceFile keeps a hand-edited definition as .bak before it replaces it', (t) => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'llmsw-svc-'));
+  t.after(() => fs.rmSync(dir, { recursive: true, force: true }));
+  const file = path.join(dir, 'sub', 'llm-switcher.service');
+  assert.equal(writeServiceFile(file, 'one'), null, 'a new file needs no backup');
+  assert.equal(writeServiceFile(file, 'one'), null, 'the same content needs no backup');
+  fs.writeFileSync(file, 'hand edit');
+  assert.equal(writeServiceFile(file, 'two'), `${file}.bak`);
+  assert.equal(fs.readFileSync(`${file}.bak`, 'utf8'), 'hand edit');
+  assert.equal(fs.readFileSync(file, 'utf8'), 'two');
+});

package/tests/shim.test.mjs

@@ -0,0 +1,228 @@
+// Tests for shim.mjs — auto-inject env mechanism for resume sessions.
+//
+// Real-world failure (2026-09-18): a `claude` session launched from a shell
+// that never sourced env.sh had no ANTHROPIC_BASE_URL, so it called api.anthropic.com directly,
+// bypassing the gateway. The shim must plug exactly that hole without breaking the normal case.
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const ROOT = path.resolve(__dirname, '..');
+
+// The shims read the launch files from the state dir. A private one keeps the checkout's files untouched.
+const STATE = fs.mkdtempSync(path.join(os.tmpdir(), 'shimstate-'));
+process.env.LLM_SWITCHER_STATE_DIR = STATE;
+
+const { SHIM_DIR, SHIMMED, pathExportLine, suggestedRcFiles, shimStatus, renderShim } =
+  await import(pathToFileURL(path.join(ROOT, 'shim.mjs')).href);
+
+// The behavioural tests run the CURRENT template, rendered into a temp dir. Running the copy
+// installed in SHIM_DIR tested whatever an earlier release wrote there, or skipped.
+const RENDER_DIR = fs.mkdtempSync(path.join(os.tmpdir(), 'shimrender-'));
+if (process.platform !== 'win32') {
+  for (const name of SHIMMED) {
+    fs.writeFileSync(path.join(RENDER_DIR, name), renderShim(name, 'linux'));
+    fs.chmodSync(path.join(RENDER_DIR, name), 0o755);
+  }
+}
+test.after(() => {
+  fs.rmSync(RENDER_DIR, { recursive: true, force: true });
+  fs.rmSync(STATE, { recursive: true, force: true });
+});
+
+// Run the shim with a fake PATH: fakeDir holds a mocked "real" binary. `files` are launch files to
+// write into the state dir first; every other launch file is removed.
+function runShim(name, args, { active, fakeDir, extraPath = '', env = {}, files = {} }) {
+  for (const f of fs.readdirSync(STATE)) fs.rmSync(path.join(STATE, f), { force: true });
+  if (active) {
+    fs.writeFileSync(path.join(STATE, 'active.flag'), 'active');
+    fs.writeFileSync(path.join(STATE, 'env.sh'), "export ANTHROPIC_BASE_URL='http://127.0.0.1:3456'\n");
+  }
+  for (const [f, content] of Object.entries(files)) fs.writeFileSync(path.join(STATE, f), content);
+  const PATH_ = [RENDER_DIR, fakeDir, extraPath || '/usr/bin:/bin'].filter(Boolean).join(':');
+  return execFileSync(path.join(RENDER_DIR, name), args, {
+    encoding: 'utf8', env: { ...process.env, ...env, PATH: PATH_ }, timeout: 15000
+  }).trim();
+}
+
+// A fake binary that prints every argument on its own line, so the test sees argument boundaries.
+function makeArgvBin(name) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'shimargv-'));
+  fs.writeFileSync(path.join(dir, name), '#!/usr/bin/env bash\necho "HTTPS_PROXY=${HTTPS_PROXY:-NONE}"\nprintf \'%s\\n\' "$@"\n');
+  fs.chmodSync(path.join(dir, name), 0o755);
+  return dir;
+}
+
+function makeFakeBin(name) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'shimtest-'));
+  fs.writeFileSync(path.join(dir, name),
+    '#!/usr/bin/env bash\necho "BASE=${ANTHROPIC_BASE_URL:-NONE} ARGS=$*"\n');
+  fs.chmodSync(path.join(dir, name), 0o755);
+  return dir;
+}
+
+test('shim injects gateway env when the gateway is ON (the --resume fix)', (t) => {
+  if (process.platform === 'win32') return t.skip('posix only');
+  const fake = makeFakeBin('claude');
+  const out = runShim('claude', ['--resume', 'abc'], { active: true, fakeDir: fake });
+  assert.match(out, /BASE=http:\/\/127\.0\.0\.1:3456/, 'env must be injected');
+  assert.match(out, /ARGS=--resume abc/, 'arguments must be preserved');
+});
+
+test('shim stays transparent when the gateway is OFF', (t) => {
+  if (process.platform === 'win32') return t.skip('posix only');
+  const fake = makeFakeBin('claude');
+  const out = runShim('claude', ['--resume'], { active: false, fakeDir: fake });
+  assert.match(out, /BASE=NONE/, 'gateway off must not force route');
+  assert.match(out, /ARGS=--resume/);
+});
+
+test('shim never recurses into itself', (t) => {
+  if (process.platform === 'win32') return t.skip('posix only');
+  const fake = makeFakeBin('claude');
+  // If the shim called itself, the command would hang until timeout and throw.
+  const out = runShim('claude', ['x'], { active: true, fakeDir: fake });
+  assert.match(out, /ARGS=x/);
+});
+
+test('shim fails loudly (127) when the real binary is missing', (t) => {
+  if (process.platform === 'win32') return t.skip('posix only');
+  const empty = fs.mkdtempSync(path.join(os.tmpdir(), 'shimempty-'));
+  assert.throws(
+    () => runShim('claude', [], { active: true, fakeDir: empty }),
+    (err) => err.status === 127,
+    'missing real binary must report clear error, not fail silently'
+  );
+});
+
+test('helpers report PATH guidance and shim wiring', () => {
+  assert.ok(pathExportLine().includes(SHIM_DIR));
+  assert.ok(suggestedRcFiles('linux').length > 0);
+  const st = shimStatus();
+  assert.equal(st.dir, SHIM_DIR);
+  assert.deepEqual(st.shims.map(s => s.name), SHIMMED);
+});
+
+// Behaviour on POSIX: the shim, run against the launch files, hands Codex exactly these arguments.
+test('Codex shim passes the gateway, the catalog and quoted role names from the launch files', (t) => {
+  if (process.platform === 'win32') return t.skip('posix only');
+  const env = [
+    "export LLM_SWITCHER_CODEX_BASE_URL='http://127.0.0.1:3456/v1'",
+    "export LLM_SWITCHER_CODEX_MAIN_MODEL='gpt-5.6-sol'",
+    "export LLM_SWITCHER_CODEX_REVIEW_MODEL='gpt-5.2'",
+    "export LLM_SWITCHER_CODEX_SUBAGENT_MODEL='gpt-5.6-luna'",
+    "export LLM_SWITCHER_CODEX_CONTEXT_WINDOW='1000000'",
+    "export LLM_SWITCHER_CODEX_AUTO_COMPACT_LIMIT='900000'"
+  ].join('\n') + '\n';
+  const out = runShim('codex', ['exec', 'hi'], {
+    fakeDir: makeArgvBin('codex'),
+    files: { 'active.flag': 'active', 'env.sh': env, 'env-codex.sh': "export HTTPS_PROXY='http://127.0.0.1:3457'\n", 'model-catalog.json': '{}' }
+  }).split('\n');
+  assert.equal(out[0], 'HTTPS_PROXY=http://127.0.0.1:3457');
+  assert.deepEqual(out.slice(1), [
+    '--config', 'openai_base_url=http://127.0.0.1:3456/v1',
+    '--config', `model_catalog_json=${path.join(STATE, 'model-catalog.json')}`,
+    '--config', 'model="gpt-5.6-sol"',
+    '--config', 'review_model="gpt-5.2"',
+    '--config', 'agents.default_subagent_model="gpt-5.6-luna"',
+    '--config', 'model_context_window=1000000',
+    '--config', 'model_auto_compact_token_limit=900000',
+    'exec', 'hi'
+  ]);
+  // With the gateway off, Codex gets its own arguments only and no proxy.
+  const off = runShim('codex', ['exec'], { fakeDir: makeArgvBin('codex'), files: { 'env.sh': env, 'env-codex.sh': "export HTTPS_PROXY='http://127.0.0.1:3457'\n" } }).split('\n');
+  assert.deepEqual(off, ['HTTPS_PROXY=NONE', 'exec']);
+});
+
+test('Claude shim never loads the Codex-only file or passes Codex overrides', (t) => {
+  if (process.platform === 'win32') return t.skip('posix only');
+  const out = runShim('claude', ['--resume'], {
+    fakeDir: makeArgvBin('claude'),
+    files: { 'active.flag': 'active', 'env.sh': "export LLM_SWITCHER_CODEX_MAIN_MODEL='gpt-x'\n", 'env-codex.sh': "export HTTPS_PROXY='http://127.0.0.1:3457'\n" }
+  }).split('\n');
+  assert.deepEqual(out, ['HTTPS_PROXY=NONE', '--resume']);
+});
+
+// Windows cannot run here, so the Windows template is checked as text.
+test('Windows Codex shim names every documented config override', () => {
+  for (const platform of ['win32']) {
+    const body = renderShim('codex', platform);
+    assert.match(body, /openai_base_url/);
+    // The main model stays official (from the user's config.toml): forcing the
+    // internal "main" alias here used to make first-party IDs bypass the proxy.
+    assert.doesNotMatch(body, /--config model=main/);
+    assert.match(body, /review_model/);
+    assert.match(body, /agents\.default_subagent_model/);
+    assert.match(body, /model_context_window/);
+    assert.match(body, /model_auto_compact_token_limit/);
+    assert.match(body, /model_catalog_json/);
+  }
+});
+
+// The /model picker reads the local catalog file and the --config values, never
+// /v1/models. A literal `review_model=review` therefore printed the switcher's
+// own slot names straight into the Codex UI (found 2026-09-20).
+test('Windows Codex shim passes official role names through, never a hard-coded slot alias', () => {
+  for (const platform of ['win32']) {
+    const body = renderShim('codex', platform);
+    assert.doesNotMatch(body, /review_model=["']?review["']?\s/, 'slot alias must not be hard-coded');
+    assert.doesNotMatch(body, /default_subagent_model=["']?subagent["']?\s/, 'slot alias must not be hard-coded');
+    assert.match(body, /review_model=.*LLM_SWITCHER_CODEX_REVIEW_MODEL/);
+    assert.match(body, /default_subagent_model=.*LLM_SWITCHER_CODEX_SUBAGENT_MODEL/);
+  }
+});
+
+// Blindfold's HTTPS_PROXY belongs to Codex alone. The claude shim sources the shared
+// env file, so the proxy variables live in a Codex-only file that only this shim reads.
+test('only the Windows Codex shim loads the Codex-only environment file', () => {
+  for (const platform of ['win32']) {
+    assert.match(renderShim('codex', platform), /env-codex\.(cmd|sh)/);
+    assert.doesNotMatch(renderShim('claude', platform), /env-codex/);
+  }
+});
+
+test('Windows Claude shim does not receive Codex config overrides', () => {
+  assert.doesNotMatch(renderShim('claude', 'win32'), /CODEX_SWITCHER_ARGS/);
+  assert.doesNotMatch(renderShim('claude', 'win32'), /model_catalog_json/);
+});
+
+// README promises that the main role reaches Codex as the `model` override.
+test('Windows Codex shim passes the main model as --config model', () => {
+  assert.match(renderShim('codex', 'win32'), /if defined LLM_SWITCHER_CODEX_MAIN_MODEL set "CODEX_SWITCHER_ARGS=%CODEX_SWITCHER_ARGS% --config model=/);
+});
+
+// setx truncates at 1024 characters and writes the merged system+user PATH into the user key;
+// in PowerShell %PATH% is not expanded at all. The Windows advice must use neither.
+test('Windows PATH advice never uses setx or %PATH%, and names no POSIX rc file', () => {
+  const line = pathExportLine('win32');
+  assert.ok(!/setx/i.test(line), line);
+  assert.ok(!line.includes('%PATH%'), line);
+  assert.match(line, /SetEnvironmentVariable\('Path'/);
+  assert.match(line, /'User'\)/, 'only the User-scope Path changes');
+  assert.ok(line.includes(SHIM_DIR));
+  assert.deepEqual(suggestedRcFiles('win32'), []);
+});
+
+// cmd.exe `if exist` is only sure to work with the native backslash path; the TOML value keeps '/'.
+test('the Windows shim tests the catalog with a native path', () => {
+  const body = renderShim('codex', 'win32');
+  assert.match(body, /if exist "%SWITCHER_DIR%\\model-catalog\.json"/);
+  assert.match(body, /--config model_catalog_json=[^\r\n]*\/model-catalog\.json/);
+});
+
+// The shim runs whatever env.sh says. It must not source a file, or a directory, that another account owns.
+test('the POSIX shims source launch files only when this account owns them', () => {
+  for (const name of SHIMMED) {
+    const body = renderShim(name, 'linux');
+    for (const line of body.split('\n').filter(l => /^\s*\. "\$SWITCHER_DIR\//.test(l))) {
+      const file = line.trim().slice(3, -1);
+      assert.match(body, new RegExp(`\\[ -O "\\$SWITCHER_DIR" \\] && \\[ -O "${file.replace(/[$/.]/g, (c) => `\\${c}`)}" \\]`), `${name}: ${file}`);
+    }
+  }
+});