From 831b485e0894064bf0d805eb6be32b18328f3676 Mon Sep 17 00:00:00 2001
From: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com>
Date: Tue, 15 Sep 2026 12:28:29 -0300
Subject: [PATCH] test(batches): rename the two seeded-batch labels that
 gitleaks reported as secrets (#13729)

The labels wvxc-route-401/wvxc-route-500 sat right after a key*.id argument and cleared the gitleaks generic-api-key length and entropy floors; renamed to route401/route500 with a docblock stating the measured rule. Test-only; .gitleaks.toml untouched. Reviewed by 3 rounds of /omni-code-review (37 agents).
---
 .../13729-rename-wvxc-route-test-labels.md        |  2 ++
 .../batches-delete-completed-route-scope.test.ts  | 15 ++++++++++++---
 2 files changed, 14 insertions(+), 3 deletions(-)
 create mode 100644 changelog.d/maintenance/13729-rename-wvxc-route-test-labels.md

diff --git a/changelog.d/maintenance/13729-rename-wvxc-route-test-labels.md b/changelog.d/maintenance/13729-rename-wvxc-route-test-labels.md
new file mode 100644
index 0000000000..8bf8330e4b
--- /dev/null
+++ b/changelog.d/maintenance/13729-rename-wvxc-route-test-labels.md
@@ -0,0 +1,2 @@
+- **test(batches):** the two seeded-batch labels of the delete-completed route-scope suite that sat right after a `key*.id` argument are renamed to short literals (`route401`/`route500`), so a gitleaks scan that reads those lines (full-tree, or git-mode on a branch that adds them) no longer reports them as `generic-api-key` hits ([#13729](https://github.com/diegosouzapw/OmniRoute/pull/13729))
+  — no gate changes: the CI secret ratchet scans `src`/`open-sse`/`bin`/`electron`/`scripts`, never `tests/`
diff --git a/tests/unit/batches-delete-completed-route-scope.test.ts b/tests/unit/batches-delete-completed-route-scope.test.ts
index 6e36914e94..76233cac5c 100644
--- a/tests/unit/batches-delete-completed-route-scope.test.ts
+++ b/tests/unit/batches-delete-completed-route-scope.test.ts
@@ -62,6 +62,13 @@ async function sessionCookie(): Promise<string> {
   return `auth_token=${jwt}`;
 }
 
+/**
+ * `label` names the seeded batch's `.jsonl` file. Keep it word-shaped or under 10 chars: the
+ * gitleaks generic-api-key rule reports a literal of 10+ chars with Shannon entropy >= 3.5 that
+ * sits right after a `key*.id` argument (the argument supplies the rule's "key" keyword).
+ * `wvxc-route-401` did (entropy 3.66) and became `route401` in #13729; the word-shaped
+ * `wvxc-route-<scenario>` siblings stay under the entropy floor and are clean.
+ */
 function seedCompletedBatch(apiKeyId: string | null, label: string) {
   const file = createFile({
     bytes: 8,
@@ -277,7 +284,8 @@ describe("DELETE /api/v1/batches/delete-completed — caller scope (GHSA-wvxc-jp
 
   it("rejects an unauthenticated request with 401 and deletes nothing", async () => {
     const keyB = await createApiKey("wvxc-route-401-b", "machine-wvxc-401", []);
-    const seeded = seedCompletedBatch(keyB.id, "wvxc-route-401");
+    // short label: see the seedCompletedBatch docblock (#13729)
+    const seeded = seedCompletedBatch(keyB.id, "route401");
 
     const { res, body } = await callDelete({});
 
@@ -290,7 +298,8 @@ describe("DELETE /api/v1/batches/delete-completed — caller scope (GHSA-wvxc-jp
 
   it("returns a sanitized 500 (no stack trace, no raw SQLite message) when the sweep throws, and deletes nothing", async () => {
     const keyA = await createApiKey("wvxc-route-500-a", "machine-wvxc-500", []);
-    const own = seedCompletedBatch(keyA.id, "wvxc-route-500");
+    // short label: see the seedCompletedBatch docblock (#13729)
+    const own = seedCompletedBatch(keyA.id, "route500");
     const db = getDbInstance();
 
     db.exec(
@@ -312,7 +321,7 @@ describe("DELETE /api/v1/batches/delete-completed — caller scope (GHSA-wvxc-jp
     assert.ok(getBatch(own.batch.id), "a failed sweep leaves the batch row in place");
     assert.strictEqual(
       getFileContent(own.file.id)?.toString(),
-      "wvxc-route-500",
+      "route500",
       "a failed sweep rolls the file content back"
     );
   });