expect((caught as Error).message).toMatch(/channels\.feishu\.appSecret: unresolved SecretRef/i);

});

it("does not throw when account name is non-string", () => {

expect(() =>

it("ignores non-string account names", () => {

expect(

resolveFeishuAccount({

cfg: {

channels: {

} as never,

accountId: "main",

}),

).not.toThrow();

).toMatchObject({

accountId: "main",

appId: "cli_123",

appSecret: "secret_456",

name: undefined,

});

});

});

});

it("blocks private and non-http scrape targets before Firecrawl requests", () => {

expect(() =>

expect(

firecrawlClientTesting.assertFirecrawlScrapeTargetAllowed("https://example.com/page"),

).not.toThrow();

).toBeUndefined();

for (const blockedUrl of [

"http://localhost/admin",

if (!bridge) {

throw new Error("expected Google realtime bridge");

}

expect(() => bridge.sendAudio(Buffer.alloc(160))).not.toThrow();

expect(() => bridge.setMediaTimestamp(20)).not.toThrow();

expect(() => bridge.sendUserMessage?.("hello")).not.toThrow();

expect(bridge.sendAudio(Buffer.alloc(160))).toBeUndefined();

expect(bridge.setMediaTimestamp(20)).toBeUndefined();

expect(bridge.sendUserMessage?.("hello")).toBeUndefined();

});

});

).toThrow(/not allowlisted in secrets\.providers\.matrix-env\.allowlist/i);

});

it("does not throw when accessToken uses a non-env SecretRef", () => {

it("leaves non-env SecretRef access tokens unresolved", () => {

const cfg = {

channels: {

matrix: {

persistedStores.clear();

});

it("does not throw when token profile only has tokenRef", () => {

it("labels token profiles that only have tokenRef", () => {

const overview = resolveProviderAuthOverview({

provider: "github-copilot",

cfg: {},