test_cli.py

"""Tests for CLI exit codes, durable output, and HTTP-client lifecycle wiring.

These exercise ``conclave.cli.ask`` through Typer's ``CliRunner`` (no real keys,
no network). Three concerns are pinned here:

* **Exit-code contract (#17).** A run that produces zero *usable* member answers,
  or an Elite run whose ``decision_readiness`` is not ``ready``, exits non-zero
  (code 1) on both the human and ``--json`` paths. Under ``--json`` the full JSON
  payload is still emitted to stdout so a script can parse the result *and*
  detect the failure via the exit code. Other runs with a usable answer exit 0.
* **Durable result output (#58).** Buffered runs can atomically persist the same
  complete JSON payload with user-private permissions, including before a failure exit.
  Invalid destinations and streaming combinations fail before council construction.
* **Pooled-client lifecycle (#20).** The synchronous council wrappers close the
  shared httpx client when the run completes, so ``transport.aclose()`` is
  actually invoked and no client leaks past the CLI command.
"""

from __future__ import annotations

import json
import stat

import pytest
from typer.testing import CliRunner

from conclave import cli
from conclave.config import ConclaveConfig
from conclave.models import CouncilResult, EliteResult, ModelAnswer
from conclave.verdict import CouncilVerdict

runner = CliRunner()


def _config() -> ConclaveConfig:
    """A deterministic config independent of any on-disk ~/.conclave file."""
    return ConclaveConfig(
        models={
            "grok": "xai/grok-4.3",
            "gemini": "gemini/gemini-2.5-pro",
            "claude": "anthropic/claude-sonnet-4-6",
            "perplexity": "perplexity/sonar-pro",
        },
        councils={"default": ["grok", "gemini", "claude", "perplexity"]},
        synthesizer="claude",
    )


@pytest.fixture
def patch_cli_config(monkeypatch):
    """Make ``conclave.cli.load_config`` return the deterministic test config."""
    monkeypatch.setattr(cli, "load_config", _config)


def test_no_members_human_exits_one(clear_keys, patch_cli_config):
    """Plain (human) path: zero usable answers -> exit code 1."""
    result = runner.invoke(cli.app, ["ask", "hello"])
    assert result.exit_code == 1
    assert "No usable council answers" in result.output


def test_no_members_json_exits_one_but_emits_json(clear_keys, patch_cli_config):
    """JSON path: zero usable answers -> exit 1, yet valid JSON still on stdout."""
    result = runner.invoke(cli.app, ["ask", "hello", "--json"])
    assert result.exit_code == 1
    payload = json.loads(result.stdout)
    assert payload["answers"] == []
    assert payload["prompt"] == "hello"


def test_all_members_failed_exits_one(monkeypatch, patch_cli_config, patch_call_model):
    """Keys present but every member errors -> zero usable answers -> exit 1."""
    for var in ("XAI_API_KEY", "GEMINI_API_KEY", "ANTHROPIC_API_KEY", "PERPLEXITY_API_KEY"):
        monkeypatch.setenv(var, "dummy-key")

    def handler(model, messages, **kwargs):
        raise RuntimeError("provider down")

    patch_call_model(handler)
    result = runner.invoke(cli.app, ["ask", "hello", "--council", "grok,gemini", "--mode", "raw"])
    assert result.exit_code == 1


def test_successful_run_exits_zero(monkeypatch, patch_cli_config, patch_call_model):
    """At least one usable answer -> exit 0, JSON payload carries the answers."""
    for var in ("XAI_API_KEY", "GEMINI_API_KEY", "ANTHROPIC_API_KEY", "PERPLEXITY_API_KEY"):
        monkeypatch.setenv(var, "dummy-key")

    def handler(model, messages, **kwargs):
        from tests.conftest import make_response

        return make_response(f"answer from {model}")

    patch_call_model(handler)
    result = runner.invoke(
        cli.app,
        ["ask", "hello", "--council", "grok,gemini", "--mode", "raw", "--json"],
    )
    assert result.exit_code == 0
    payload = json.loads(result.stdout)
    assert len(payload["answers"]) == 2
    assert all(a["answer"].startswith("answer from") for a in payload["answers"])


def test_json_output_persists_same_payload_owner_only(
    monkeypatch, patch_cli_config, patch_call_model, tmp_path
):
    """A detached caller can recover the complete JSON from an owner-only file."""
    for var in ("XAI_API_KEY", "GEMINI_API_KEY", "ANTHROPIC_API_KEY", "PERPLEXITY_API_KEY"):
        monkeypatch.setenv(var, "dummy-key")

    def handler(model, messages, **kwargs):
        from tests.conftest import make_response

        return make_response(f"answer from {model}")

    patch_call_model(handler)
    output_path = tmp_path / "result.json"
    result = runner.invoke(
        cli.app,
        [
            "ask",
            "hello",
            "--council",
            "grok,gemini",
            "--mode",
            "raw",
            "--json",
            "--json-output",
            str(output_path),
        ],
    )

    assert result.exit_code == 0
    assert json.loads(output_path.read_text(encoding="utf-8")) == json.loads(result.stdout)
    assert stat.S_IMODE(output_path.stat().st_mode) == 0o600


def test_json_output_with_stream_is_rejected_before_council_creation(
    monkeypatch, patch_cli_config, tmp_path
):
    """Durable buffered output cannot silently take the streaming branch."""
    created = False

    class ForbiddenCouncil:
        def __init__(self, **kwargs):
            nonlocal created
            created = True

    monkeypatch.setattr(cli, "Council", ForbiddenCouncil)
    result = runner.invoke(
        cli.app,
        ["ask", "hello", "--stream", "--json-output", str(tmp_path / "result.json")],
    )

    assert result.exit_code == 2
    assert created is False
    assert "--json-output" in result.output
    assert "--stream" in result.output


def test_json_output_persists_failure_payload_before_exit(clear_keys, patch_cli_config, tmp_path):
    """The durable payload is complete even when the existing exit contract returns 1."""
    output_path = tmp_path / "result.json"
    result = runner.invoke(
        cli.app,
        ["ask", "hello", "--json", "--json-output", str(output_path)],
    )

    assert result.exit_code == 1
    assert json.loads(output_path.read_text(encoding="utf-8")) == json.loads(result.stdout)
    assert json.loads(result.stdout)["answers"] == []


def test_json_output_rejects_missing_parent_before_council_creation(
    monkeypatch, patch_cli_config, tmp_path
):
    """A bad destination fails before any provider-capable Council is created."""
    created = False

    class ForbiddenCouncil:
        def __init__(self, **kwargs):
            nonlocal created
            created = True

    monkeypatch.setattr(cli, "Council", ForbiddenCouncil)
    output_path = tmp_path / "missing" / "result.json"
    result = runner.invoke(
        cli.app,
        ["ask", "hello", "--json-output", str(output_path)],
    )

    assert result.exit_code == 2
    assert created is False
    assert "existing parent directory" in result.output


def test_json_output_write_failure_preserves_stdout(
    monkeypatch, patch_cli_config, patch_call_model, tmp_path
):
    """Persistence failure changes the exit code, not the completed stdout payload."""
    for var in ("XAI_API_KEY", "GEMINI_API_KEY"):
        monkeypatch.setenv(var, "dummy-key")

    def handler(model, messages, **kwargs):
        from tests.conftest import make_response

        return make_response(f"answer from {model}")

    def fail_write(path, payload):
        raise OSError("simulated disk failure")

    patch_call_model(handler)
    monkeypatch.setattr(cli, "_write_json_output", fail_write)
    result = runner.invoke(
        cli.app,
        [
            "ask",
            "hello",
            "--council",
            "grok,gemini",
            "--mode",
            "raw",
            "--json",
            "--json-output",
            str(tmp_path / "result.json"),
        ],
    )

    assert result.exit_code == 1
    assert len(json.loads(result.stdout)["answers"]) == 2
    assert "Could not write --json-output" in result.output


def test_json_output_does_not_require_posix_fchmod(
    monkeypatch, patch_cli_config, patch_call_model, tmp_path
):
    """Secure temporary-file persistence works when POSIX-only fchmod is unavailable."""
    for var in ("XAI_API_KEY", "GEMINI_API_KEY"):
        monkeypatch.setenv(var, "dummy-key")

    def handler(model, messages, **kwargs):
        from tests.conftest import make_response

        return make_response(f"answer from {model}")

    patch_call_model(handler)
    monkeypatch.delattr(cli.os, "fchmod")
    output_path = tmp_path / "result.json"
    result = runner.invoke(
        cli.app,
        [
            "ask",
            "hello",
            "--council",
            "grok,gemini",
            "--mode",
            "raw",
            "--json-output",
            str(output_path),
        ],
    )

    assert result.exit_code == 0
    assert json.loads(output_path.read_text(encoding="utf-8"))["prompt"] == "hello"


def test_json_output_cleans_partial_temp_on_serialization_failure(monkeypatch, tmp_path):
    """Sensitive partial JSON is removed when serialization fails mid-write."""

    def fail_dump(payload, handle):
        handle.write('{"partial":')
        raise ValueError("simulated serialization failure")

    monkeypatch.setattr(cli.json, "dump", fail_dump)
    with pytest.raises(ValueError, match="simulated serialization failure"):
        cli._write_json_output(tmp_path / "result.json", {"prompt": "sensitive"})

    assert list(tmp_path.iterdir()) == []


def test_unknown_mode_exits_two(patch_cli_config):
    """Usage error (bad mode) keeps its distinct exit code 2."""
    result = runner.invoke(cli.app, ["ask", "hello", "--mode", "bogus"])
    assert result.exit_code == 2


def _elite_cli_result(
    *,
    completed: bool = True,
    failure_reason: str | None = None,
    decision_readiness: str = "ready",
    readiness_reasons: list[str] | None = None,
):
    """Build a compact elite result for CLI-only behavior tests."""
    initials = [
        ModelAnswer(name=f"member-{i}", model_id=f"provider/model-{i}", answer=f"initial-{i}")
        for i in range(1, 4)
    ]
    critiques = [
        ModelAnswer(name=f"member-{i}", model_id=f"provider/model-{i}", answer=f"critique-{i}")
        for i in range(1, 4)
    ]
    revisions = [
        ModelAnswer(name=f"member-{i}", model_id=f"provider/model-{i}", answer=f"revision-{i}")
        for i in range(1, 4)
    ]
    return CouncilResult(
        prompt="Should we ship?",
        mode="elite",
        answers=revisions if completed else [],
        synthesis="Ship with safeguards." if completed else None,
        elite=EliteResult(
            completed=completed,
            failure_reason=failure_reason,
            decision_readiness=decision_readiness,
            readiness_reasons=readiness_reasons or [],
            initial_answers=initials,
            critiques=critiques if completed else [],
            revisions=revisions if completed else [],
        ),
        verdict=(
            CouncilVerdict(
                verdict_type="decision",
                headline="Ship deliberately.",
                recommendation="Ship with safeguards.",
                consensus_score=1.0,
                consensus_label="unanimous",
            )
            if completed
            else None
        ),
    )


def test_elite_mode_dispatches_and_renders_protocol_summary(monkeypatch, patch_cli_config):
    """Elite dispatch uses elite_sync and renders the protocol plus verdict."""
    calls: list[str] = []

    class FakeCouncil:
        def __init__(self, **kwargs):
            pass

        def elite_sync(self, prompt: str) -> CouncilResult:
            calls.append(prompt)
            return _elite_cli_result()

    monkeypatch.setattr(cli, "Council", FakeCouncil)

    result = runner.invoke(cli.app, ["ask", "Should we ship?", "--mode", "elite"])

    assert result.exit_code == 0
    assert calls == ["Should we ship?"]
    assert "ELITE DECISION PROTOCOL" in result.output
    assert "elite_v1" in result.output
    assert "Initial 3/3" in result.output
    assert "Critiques 3/3" in result.output
    assert "Revisions 3/3" in result.output
    assert "Decision readiness: READY" in result.output
    assert "VERDICT" in result.output
    assert "Ship deliberately." in result.output


def test_elite_json_emits_full_council_result(monkeypatch, patch_cli_config):
    """Elite JSON includes every protocol phase artifact."""

    class FakeCouncil:
        def __init__(self, **kwargs):
            pass

        def elite_sync(self, prompt: str) -> CouncilResult:
            return _elite_cli_result()

    monkeypatch.setattr(cli, "Council", FakeCouncil)

    result = runner.invoke(cli.app, ["ask", "Should we ship?", "--mode", "elite", "--json"])

    assert result.exit_code == 0
    payload = json.loads(result.stdout)
    assert payload["mode"] == "elite"
    assert payload["elite"]["completed"] is True
    assert payload["elite"]["decision_readiness"] == "ready"
    assert payload["elite"]["readiness_reasons"] == []
    assert len(payload["elite"]["initial_answers"]) == 3
    assert len(payload["elite"]["critiques"]) == 3
    assert len(payload["elite"]["revisions"]) == 3
    assert payload["verdict"]["headline"] == "Ship deliberately."


def test_incomplete_elite_exits_one_with_reason(monkeypatch, patch_cli_config):
    """An incomplete protocol is a failed CLI run even with prior phase answers."""

    class FakeCouncil:
        def __init__(self, **kwargs):
            pass

        def elite_sync(self, prompt: str) -> CouncilResult:
            return _elite_cli_result(
                completed=False,
                failure_reason="critique phase requires at least 3 successful responders; got 2",
                decision_readiness="not_ready",
                readiness_reasons=["protocol.critique_responder_gate_failed"],
            )

    monkeypatch.setattr(cli, "Council", FakeCouncil)

    result = runner.invoke(cli.app, ["ask", "Should we ship?", "--mode", "elite"])

    assert result.exit_code == 1
    assert "Elite protocol incomplete" in result.output
    assert "critique phase requires at least 3 successful" in result.output
    assert "responders; got 2" in result.output


@pytest.mark.parametrize("as_json", [False, True])
@pytest.mark.parametrize(
    ("decision_readiness", "reason"),
    [
        ("indeterminate", "adjudication.disabled"),
        ("not_ready", "synthesis.failed"),
    ],
)
def test_elite_non_ready_state_exits_one_with_machine_reason(
    monkeypatch, patch_cli_config, as_json, decision_readiness, reason
):
    """Protocol completion cannot produce CLI success without adjudicated readiness."""

    class FakeCouncil:
        def __init__(self, **kwargs):
            pass

        def elite_sync(self, prompt: str) -> CouncilResult:
            return _elite_cli_result(
                decision_readiness=decision_readiness,
                readiness_reasons=[reason],
            )

    monkeypatch.setattr(cli, "Council", FakeCouncil)
    args = ["ask", "Should we ship?", "--mode", "elite"]
    if as_json:
        args.append("--json")

    result = runner.invoke(cli.app, args)

    assert result.exit_code == 1
    if as_json:
        payload = json.loads(result.stdout)
        assert payload["elite"]["completed"] is True
        assert payload["elite"]["decision_readiness"] == decision_readiness
        assert payload["elite"]["readiness_reasons"] == [reason]
    else:
        assert f"Decision readiness: {decision_readiness.upper()}" in result.output
        assert reason in result.output


def test_elite_stream_is_rejected_before_council_creation(monkeypatch, patch_cli_config):
    """Elite streaming fails as usage before a provider-capable Council exists."""
    created = False

    class ForbiddenCouncil:
        def __init__(self, **kwargs):
            nonlocal created
            created = True

    monkeypatch.setattr(cli, "Council", ForbiddenCouncil)

    result = runner.invoke(cli.app, ["ask", "Should we ship?", "--mode", "elite", "--stream"])

    assert result.exit_code == 2
    assert created is False
    assert "--stream" in result.output
    assert "elite" in result.output


def test_ask_help_lists_elite_mode():
    """CLI help advertises elite as a supported mode."""
    result = runner.invoke(cli.app, ["ask", "--help"])
    assert result.exit_code == 0
    assert "elite" in result.output


def test_ask_help_describes_all_six_modes():
    """The command summary must not describe only the original mode subset."""
    result = runner.invoke(cli.app, ["ask", "--help"])
    assert result.exit_code == 0
    assert "Run one of six council modes" in result.output


def test_unresolved_council_exits_two(patch_cli_config):
    """Usage error (empty council selector resolves to zero members) -> exit 2."""
    result = runner.invoke(cli.app, ["ask", "hello", "--council", " , "])
    assert result.exit_code == 2
    assert "No council members resolved" in result.output


def test_sync_run_closes_pooled_client(monkeypatch, patch_call_model):
    """The sync wrapper invokes transport.aclose() so the client never leaks."""
    import conclave.council as council_mod
    from conclave import Council

    for var in ("XAI_API_KEY", "GEMINI_API_KEY", "ANTHROPIC_API_KEY", "PERPLEXITY_API_KEY"):
        monkeypatch.setenv(var, "dummy-key")

    calls = {"aclose": 0}

    async def fake_aclose():
        calls["aclose"] += 1

    monkeypatch.setattr(council_mod.transport, "aclose", fake_aclose)

    def handler(model, messages, **kwargs):
        from tests.conftest import make_response

        return make_response("ok")

    patch_call_model(handler)
    Council(models=["grok"], synthesizer="grok", config=_config()).ask_sync(
        "hello", synthesize=False
    )
    assert calls["aclose"] == 1


def test_close_sync_invokes_aclose(monkeypatch):
    """Council.close_sync drives transport.aclose without re-closing recursively."""
    import conclave.council as council_mod
    from conclave import Council

    calls = {"aclose": 0}

    async def fake_aclose():
        calls["aclose"] += 1

    monkeypatch.setattr(council_mod.transport, "aclose", fake_aclose)
    Council(models=["grok"], config=_config()).close_sync()
    # close_sync passes close_client=False, so aclose fires exactly once (the body),
    # not twice (body + finally).
    assert calls["aclose"] == 1


async def test_aclose_really_closes_real_client():
    """End-to-end: a real pooled client gets created then closed by aclose()."""
    from conclave import transport

    client = transport._get_client()
    assert not client.is_closed
    await transport.aclose()
    assert client.is_closed


# --------------------------------------------------------------------------- #
# Human (rich) renderers + the providers command. These cover the panel/table
# rendering paths that the JSON exit-code tests bypass via model_dump.
# --------------------------------------------------------------------------- #


def _all_keys(monkeypatch) -> None:
    for var in ("XAI_API_KEY", "GEMINI_API_KEY", "ANTHROPIC_API_KEY", "PERPLEXITY_API_KEY"):
        monkeypatch.setenv(var, "dummy-key")


def test_synthesize_human_render_prints_synthesis(monkeypatch, patch_cli_config, patch_call_model):
    """The default synthesize mode renders member panels and a SYNTHESIS panel."""
    _all_keys(monkeypatch)

    def handler(model, messages, **kwargs):
        from tests.conftest import make_response

        # Every call (members and the synthesizer) returns a usable answer, so the
        # synthesis runs and its panel is rendered.
        return make_response(f"ans-{model}")

    patch_call_model(handler)
    result = runner.invoke(cli.app, ["ask", "hello", "--council", "grok,gemini"])
    assert result.exit_code == 0
    # Member panel titles and the synthesis header are present in the rendered output.
    assert "grok" in result.output
    assert "SYNTHESIS" in result.output


def test_raw_human_render_prints_member_panels(monkeypatch, patch_cli_config, patch_call_model):
    """Raw mode renders each member's answer panel and no synthesis header."""
    _all_keys(monkeypatch)

    def handler(model, messages, **kwargs):
        from tests.conftest import make_response

        return make_response(f"raw-{model}")

    patch_call_model(handler)
    result = runner.invoke(cli.app, ["ask", "hello", "--council", "grok,gemini", "--mode", "raw"])
    assert result.exit_code == 0
    assert "grok" in result.output
    assert "gemini" in result.output


def test_debate_human_render_prints_rounds(monkeypatch, patch_cli_config, patch_call_model):
    """Debate mode renders a Round rule per round plus the FINAL SYNTHESIS panel."""
    _all_keys(monkeypatch)

    def handler(model, messages, **kwargs):
        from tests.conftest import make_response

        return make_response(f"debate-{model}")

    patch_call_model(handler)
    result = runner.invoke(
        cli.app,
        ["ask", "hello", "--council", "grok,gemini", "--mode", "debate", "--rounds", "2"],
    )
    assert result.exit_code == 0
    assert "Round" in result.output
    assert "SYNTHESIS" in result.output


def test_adversarial_human_render_prints_proposal_and_verdict(
    monkeypatch, patch_cli_config, patch_call_model
):
    """Adversarial mode renders the proposal, critiques, and a VERDICT panel."""
    _all_keys(monkeypatch)

    def handler(model, messages, **kwargs):
        from tests.conftest import make_response

        return make_response(f"adv-{model}")

    patch_call_model(handler)
    result = runner.invoke(
        cli.app,
        ["ask", "hello", "--council", "grok,gemini", "--mode", "adversarial"],
    )
    assert result.exit_code == 0
    assert "Proposal" in result.output
    assert "VERDICT" in result.output


def test_skipped_members_warning_is_printed(monkeypatch, patch_cli_config, patch_call_model):
    """A member with no key is skipped and surfaced via the yellow warning line."""
    # Only grok has a key; gemini will be skipped for lack of GEMINI_API_KEY.
    monkeypatch.delenv("GEMINI_API_KEY", raising=False)
    monkeypatch.setenv("XAI_API_KEY", "dummy-key")

    def handler(model, messages, **kwargs):
        from tests.conftest import make_response

        return make_response(f"ans-{model}")

    patch_call_model(handler)
    result = runner.invoke(cli.app, ["ask", "hello", "--council", "grok,gemini", "--mode", "raw"])
    assert result.exit_code == 0
    assert "Skipped (no key)" in result.output
    assert "gemini" in result.output


def test_cache_flag_serves_second_run_from_cache(monkeypatch, patch_cli_config, tmp_path):
    """`--cache` makes a second identical CLI run a hit (providers not re-called)."""
    import conclave.council as council_mod
    from conclave.models import ModelAnswer

    monkeypatch.setenv("XDG_CACHE_HOME", str(tmp_path))
    _all_keys(monkeypatch)

    counter = {"n": 0}

    async def fake_call_model(
        name, model_id, messages, *, temperature=0.7, timeout=120.0, config=None
    ):
        counter["n"] += 1
        return ModelAnswer(name=name, model_id=model_id, answer=f"ans-{model_id}")

    monkeypatch.setattr(council_mod, "call_model", fake_call_model)

    args = ["ask", "what is 2+2?", "--council", "grok", "--mode", "raw", "--cache", "--json"]
    first = runner.invoke(cli.app, args)
    assert first.exit_code == 0
    n_after_first = counter["n"]
    assert n_after_first > 0
    assert json.loads(first.stdout)["cached"] is False

    second = runner.invoke(cli.app, args)
    assert second.exit_code == 0
    assert counter["n"] == n_after_first  # no new provider calls -> served from cache
    assert json.loads(second.stdout)["cached"] is True


def test_no_cache_flag_runs_live_each_time(monkeypatch, patch_cli_config, tmp_path):
    """`--no-cache` forces a live run even if config enabled caching."""
    import conclave.council as council_mod
    from conclave.models import ModelAnswer

    monkeypatch.setenv("XDG_CACHE_HOME", str(tmp_path))
    _all_keys(monkeypatch)

    counter = {"n": 0}

    async def fake_call_model(name, model_id, messages, *, temperature=0.7, timeout=120.0):
        counter["n"] += 1
        return ModelAnswer(name=name, model_id=model_id, answer="ans")

    monkeypatch.setattr(council_mod, "call_model", fake_call_model)

    args = ["ask", "p", "--council", "grok", "--mode", "raw", "--no-cache", "--json"]
    runner.invoke(cli.app, args)
    n = counter["n"]
    runner.invoke(cli.app, args)
    assert counter["n"] == n * 2  # ran live both times


def test_providers_command_lists_keys_without_values(monkeypatch, patch_cli_config):
    """`conclave providers` prints a table marking present/absent keys, no values."""
    monkeypatch.setenv("XAI_API_KEY", "super-secret-value")
    monkeypatch.delenv("GEMINI_API_KEY", raising=False)

    result = runner.invoke(cli.app, ["providers"])
    assert result.exit_code == 0
    assert "conclave providers" in result.output
    # Provider names and the env-var column appear; the secret VALUE never does.
    assert "grok" in result.output
    assert "XAI_API_KEY" in result.output
    assert "super-secret-value" not in result.output


def test_providers_command_lists_new_first_class_providers(monkeypatch, tmp_path):
    """`conclave providers` includes the issue-#5 direct-key providers + env vars.

    Uses the real default config (no patched cli.load_config) so the registry's
    DEFAULT_MODELS drive the table; an empty CONCLAVE_CONFIG path means the
    built-in defaults are what appear.
    """
    monkeypatch.setenv("CONCLAVE_CONFIG", str(tmp_path / "missing.yml"))
    # The env-var column only renders a NAME when a key is present (otherwise it
    # shows '-'), so set each new provider's key. The values are obvious fakes and
    # must never appear in the output (BYO-keys name-only posture).
    secrets = {
        "GROQ_API_KEY": "groq-secret-value",
        "DEEPSEEK_API_KEY": "deepseek-secret-value",
        "MISTRAL_API_KEY": "mistral-secret-value",
        "TOGETHER_API_KEY": "together-secret-value",
    }
    for var, val in secrets.items():
        monkeypatch.setenv(var, val)
    # Force a wide console so Rich does not ellipsize the (long) env-var / model
    # columns; the module-level console fixes its width at import time, so swap in
    # a wide one. Otherwise the assertions would test rendering width, not content.
    from rich.console import Console

    monkeypatch.setattr(cli, "console", Console(width=200))
    from conclave.config import clear_config_cache

    clear_config_cache()

    result = runner.invoke(cli.app, ["providers"])
    assert result.exit_code == 0
    for name, env_var in (
        ("groq", "GROQ_API_KEY"),
        ("deepseek", "DEEPSEEK_API_KEY"),
        ("mistral", "MISTRAL_API_KEY"),
        ("together", "TOGETHER_API_KEY"),
    ):
        assert name in result.output
        assert env_var in result.output
    # No secret VALUE ever appears (only the env-var NAME does).
    for val in secrets.values():
        assert val not in result.output