test: hermetic auth context for 2 re-wired suites + real headroom on the breaker reset-timeout flake

CI shards exposed what the dev DATA_DIR was masking locally: detect.test.ts
and managementCliToken.test.ts asserted 401/403/reject outcomes that only
exist when login protection is configured — on a fresh CI DB isAuthRequired()
is false and the policy anonymous-allows. Both now create an isolated
DATA_DIR with requireLogin+password (the established pattern).

observability-fase04: the breaker reset-timeout test ran with a 5ms margin
(resetTimeout 10 / sleep 15) — lazy HALF_OPEN refresh under shard contention
flipped the first OPEN assert. Now 250/300ms.

tests/unit/api/cli-tools/detect.test.ts

@@ -1,9 +1,38 @@
 import { describe, it, before, after } from "node:test";
 import assert from "node:assert";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
 import { NextRequest } from "next/server";
-import { GET } from "../../../../src/app/api/cli-tools/detect/route.ts";
+
+// Hermetic auth context (6A re-wire fix): without a configured password,
+// isAuthRequired() is false on a fresh DB (CI) and the route answers 200 —
+// these 401/403 assertions only held locally because the dev DATA_DIR had a
+// real password. Create an isolated DATA_DIR with login protection enabled.
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-cli-detect-"));
+const originalDataDir = process.env.DATA_DIR;
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../../../src/lib/db/core.ts");
+const settingsDb = await import("../../../../src/lib/db/settings.ts");
+const { GET } = await import("../../../../src/app/api/cli-tools/detect/route.ts");
 
 describe("GET /api/cli-tools/detect", () => {
+  before(async () => {
+    await settingsDb.updateSettings({
+      requireLogin: true,
+      setupComplete: true,
+      password: "test-password-hash",
+    });
+  });
+
+  after(() => {
+    core.resetDbInstance();
+    fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+    if (originalDataDir === undefined) delete process.env.DATA_DIR;
+    else process.env.DATA_DIR = originalDataDir;
+  });
+
   it("returns 401 without authorization", async () => {
     // @ts-ignore - we can call the handler directly
     const req = new NextRequest("http://localhost:3000/api/cli-tools/detect");

tests/unit/lib/managementCliToken.test.ts

@@ -1,8 +1,37 @@
 import { test, mock } from "node:test";
 import assert from "node:assert/strict";
-import { getLegacyCliTokenSync, getMachineTokenSync } from "../../../src/lib/machineToken.ts";
-import { managementPolicy } from "../../../src/server/authz/policies/management.ts";
-import { CLI_TOKEN_HEADER } from "../../../src/server/authz/headers.ts";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+// Hermetic auth context (6A re-wire fix): the "rejects ..." assertions assume
+// login protection is ON — on a fresh DB (CI) isAuthRequired() is false and the
+// policy anonymous-allows before any token check. Locally this only passed
+// because the dev DATA_DIR had a real password. Isolate + enable protection.
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-mgmt-cli-token-"));
+const originalDataDir = process.env.DATA_DIR;
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../../src/lib/db/core.ts");
+const settingsDb = await import("../../../src/lib/db/settings.ts");
+await settingsDb.updateSettings({
+  requireLogin: true,
+  setupComplete: true,
+  password: "test-password-hash",
+});
+
+const { getLegacyCliTokenSync, getMachineTokenSync } = await import(
+  "../../../src/lib/machineToken.ts"
+);
+const { managementPolicy } = await import("../../../src/server/authz/policies/management.ts");
+const { CLI_TOKEN_HEADER } = await import("../../../src/server/authz/headers.ts");
+
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  if (originalDataDir === undefined) delete process.env.DATA_DIR;
+  else process.env.DATA_DIR = originalDataDir;
+});
 
 function makeCtx(headers: Record<string, string>, requestExtras: Record<string, unknown> = {}) {
   return {

tests/unit/observability-fase04.test.ts

@@ -85,9 +85,12 @@ test("CircuitBreaker: transitions to HALF_OPEN after reset timeout", async () =>
 });
 
 test("CircuitBreaker: status reads refresh OPEN providers after reset timeout", async () => {
+  // resetTimeout must leave real headroom: with 10ms, any event-loop contention
+  // between execute() and the first getStatus() already lazily refreshes the
+  // state to HALF_OPEN and the OPEN assert flakes (seen on CI shard runners).
   const cb = new CircuitBreaker(`test-status-refresh${cbSuffix}`, {
     failureThreshold: 1,
-    resetTimeout: 10,
+    resetTimeout: 250,
   });
 
   try {
@@ -98,7 +101,7 @@ test("CircuitBreaker: status reads refresh OPEN providers after reset timeout",
 
   assert.equal(cb.getStatus().state, STATE.OPEN);
 
-  await new Promise((r) => setTimeout(r, 15));
+  await new Promise((r) => setTimeout(r, 300));
 
   assert.equal(cb.getStatus().state, STATE.HALF_OPEN);
   assert.equal(cb.canExecute(), true);