Auth labels: handle token refs and share Pi credential conversion

src/agents/model-auth-label.test.ts

@@ -0,0 +1,50 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const ensureAuthProfileStoreMock = vi.hoisted(() => vi.fn());
+const resolveAuthProfileOrderMock = vi.hoisted(() => vi.fn());
+const resolveAuthProfileDisplayLabelMock = vi.hoisted(() => vi.fn());
+
+vi.mock("./auth-profiles.js", () => ({
+  ensureAuthProfileStore: (...args: unknown[]) => ensureAuthProfileStoreMock(...args),
+  resolveAuthProfileOrder: (...args: unknown[]) => resolveAuthProfileOrderMock(...args),
+  resolveAuthProfileDisplayLabel: (...args: unknown[]) =>
+    resolveAuthProfileDisplayLabelMock(...args),
+}));
+
+vi.mock("./model-auth.js", () => ({
+  getCustomProviderApiKey: () => undefined,
+  resolveEnvApiKey: () => null,
+}));
+
+const { resolveModelAuthLabel } = await import("./model-auth-label.js");
+
+describe("resolveModelAuthLabel", () => {
+  beforeEach(() => {
+    ensureAuthProfileStoreMock.mockReset();
+    resolveAuthProfileOrderMock.mockReset();
+    resolveAuthProfileDisplayLabelMock.mockReset();
+  });
+
+  it("does not throw when token profile only has tokenRef", () => {
+    ensureAuthProfileStoreMock.mockReturnValue({
+      version: 1,
+      profiles: {
+        "github-copilot:default": {
+          type: "token",
+          provider: "github-copilot",
+          tokenRef: { source: "env", id: "GITHUB_TOKEN" },
+        },
+      },
+    } as never);
+    resolveAuthProfileOrderMock.mockReturnValue(["github-copilot:default"]);
+    resolveAuthProfileDisplayLabelMock.mockReturnValue("github-copilot:default");
+
+    const label = resolveModelAuthLabel({
+      provider: "github-copilot",
+      cfg: {},
+      sessionEntry: { authProfileOverride: "github-copilot:default" } as never,
+    });
+
+    expect(label).toContain("token ref(env:GITHUB_TOKEN)");
+  });
+});