Clarify credential-model migration and clear credential cell in tests

Author: TheGreatAxios

docs/VENDORING.md

@@ -108,8 +108,10 @@ a ledger entry), and the second re-applies each `PATCHES.md` entry with an
 as-is / adapt / subsumed triage recorded in the ledgers. No entry was
 subsumed upstream. Upstream replaced inline provider `apiKey` plumbing
 with a `credentialId` + credential-cell model; no ledger entry touches
-auth and no first-party caller passes provider credentials into the
-vendored trees, so no migration was needed.
+auth so the vendored trees needed no migration, but first-party callers
+were migrated to the new model (each built source registers its secret
+in `src/config/source-credentials.ts`, handed to the vendored trees as
+their resolver).
 
 `vendor/intx-workflow-host/workflow-definition-loader.ts` is new in this
 sync: a second partial-tree path alongside `adapters/`, carrying

src/config.test.ts

@@ -23,7 +23,7 @@ import {
   SOURCE_MAX_TOKENS,
 } from "./config/index.js";
 import { DIRECTOR_IDS } from "./agent/directors/types.js";
-import { peekSourceCredentialSecret } from "./config/source-credentials.js";
+import { clearSourceCredentials, peekSourceCredentialSecret } from "./config/source-credentials.js";
 import type { Config, UnconfiguredConfig } from "./config/index.js";
 import {
   mergeProviderIntoSettings,
@@ -70,6 +70,7 @@ afterEach(() => {
   resetGoModelDiscoveryForTests();
   resetZenModelDiscoveryForTests();
   setProviderContextWindowOverrides(undefined);
+  clearSourceCredentials();
 });
 
 function assertConfigured(

src/config/inference-sources.test.ts

@@ -13,6 +13,7 @@ import {
 } from "../provider/context-window.js";
 import { createOpenAICompatibleAdapter } from "../provider/openai-compatible-adapter.js";
 import { createInferenceDependencies } from "../provider/inference-dependencies.js";
+import { clearSourceCredentials } from "./source-credentials.js";
 import { OPENAI_RESPONSES_PROVIDER } from "../provider/openai-responses.js";
 import { ZEN_MESSAGES_PROVIDER } from "../provider/zen-anthropic-adapter.js";
 import { firstClassProviderById } from "../../packages/first-class-providers/src/index.js";
@@ -81,6 +82,7 @@ function settingsWithWindow(): Settings {
 afterEach(() => {
   setProviderContextWindowOverrides(undefined);
   globalThis.fetch = originalFetch;
+  clearSourceCredentials();
 });
 
 describe("contextWindow / maxTokens split (CL-7784)", () => {

src/subagent/refresh-inference-source.test.ts

@@ -3,7 +3,10 @@ import * as codexSession from "../auth/codex/session.js";
 import * as xaiSession from "../auth/xai/session.js";
 
 import type { InferenceSource } from "@intx/types/runtime";
-import { peekSourceCredentialSecret } from "../config/source-credentials.js";
+import {
+  clearSourceCredentials,
+  peekSourceCredentialSecret,
+} from "../config/source-credentials.js";
 
 const baseSource = (id: string): InferenceSource => ({
   id,
@@ -15,6 +18,7 @@ const baseSource = (id: string): InferenceSource => ({
 
 describe("refresh-inference-source", () => {
   afterEach(() => {
+    clearSourceCredentials();
     spyOn(codexSession, "getValidCodexToken").mockRestore();
     spyOn(xaiSession, "getValidXaiToken").mockRestore();
   });

src/subagent/run-source.test.ts

@@ -1,9 +1,16 @@
-import { describe, expect, test } from "bun:test";
+import { describe, expect, test, afterEach } from "bun:test";
 
-import { peekSourceCredentialSecret } from "../config/source-credentials.js";
+import {
+  clearSourceCredentials,
+  peekSourceCredentialSecret,
+} from "../config/source-credentials.js";
 import { OPENCODE_GO_BASE_URL } from "../../packages/opencode-go/src/index.js";
 import { buildSubAgentPrimarySource } from "./run.js";
 
+afterEach(() => {
+  clearSourceCredentials();
+});
+
 describe("buildSubAgentPrimarySource", () => {
   test("projects an Ollama root into the subagent OpenAI-compatible source", () => {
     const bundle = buildSubAgentPrimarySource({

vendor/intx-inference/PATCHES.md

@@ -78,10 +78,11 @@ new upstream moved under the patch:
   `packages/inference/src/providers/google-genai.test.ts`; no ledger
   entry lived in either file, so nothing was triaged out with them.
 - Upstream replaced inline `apiKey` with a `credentialId` + credential-cell
-  auth model. No entry touches auth, and first-party callers needed no
-  migration: provider auth resolves inside the vendored trees
-  (`createDefaultDependencies`), and no `src/` caller passes provider
-  credentials into them.
+  auth model. No entry touches auth, so the vendored trees needed no
+  migration; first-party callers were migrated to the new model instead
+  (each built source registers its secret in
+  `src/config/source-credentials.ts`, handed to the vendored trees as
+  their resolver).
 
 ## adapter-ts-stream-terminal-detector