From 4c8d4148cade83ef9816b00a8a6ecb932acf4cb1 Mon Sep 17 00:00:00 2001 From: kshitijk4poor <82637225+kshitijk4poor@users.noreply.github.com> Date: Tue, 6 Oct 2026 10:21:37 +0530 Subject: [PATCH] test(aux): pin that a scoped runtime's key rotation stays out of the legacy mirrors e9a77f4188's `_RUNTIME_MAIN_API_KEY == old` guard had no test: reverting it left every kept test green, though rotating under scoped_runtime_main then raises KeyError 'base_url' (or, with the .get() default, overwrites the turn's mirrors with the scoped copy). Extend the existing aux-route test with the scoped rotate step; red with the guard removed (mirror model becomes 'm') and red on the pre-guard code (KeyError), green on HEAD. Fold finding C15 #2 (gate 2ab toothless guard). --- tests/agent/test_anthropic_third_party_oauth_guard.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/tests/agent/test_anthropic_third_party_oauth_guard.py b/tests/agent/test_anthropic_third_party_oauth_guard.py index 84b48cf056..3ad5a078c0 100644 --- a/tests/agent/test_anthropic_third_party_oauth_guard.py +++ b/tests/agent/test_anthropic_third_party_oauth_guard.py @@ -164,6 +164,7 @@ class TestOAuthFlagOnRefresh: """Production order: the turn publishes its aux runtime BEFORE the first request triggers the silent refresh, so same-turn `auto` aux calls must still pick up the new token.""" from agent import auxiliary_client as aux + from agent.auxiliary_key_rotation import rotate_runtime_main_api_key from agent.chat_completion_helpers import _context_thread_target from agent.turn_context import _publish_runtime_main @@ -202,6 +203,11 @@ class TestOAuthFlagOnRefresh: "anthropic", agent.model, runtime.get("base_url", ""), runtime.get("api_key"), "anthropic_messages", ) assert seen["api_key"] == new + # A scoped runtime (normalized copy) rotates in place but never reaches the legacy mirrors. + with aux.scoped_runtime_main({"provider": "anthropic", "api_key": old, "model": "m"}): + rotate_runtime_main_api_key(old, new) + assert aux._RUNTIME_MAIN_CONTEXT.get()["api_key"] == new + assert (aux._RUNTIME_MAIN_MODEL, aux._RUNTIME_MAIN_API_KEY) == (agent.model, new) finally: aux.clear_runtime_main()