fix(test): hermetically exercise auth workflows

backend/src/pi/enabled-models.ts

@@ -1,6 +1,6 @@
 import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 
 export interface PiEnabledModelsResult {
   ids: string[];
@@ -43,7 +43,8 @@ function isExactCompositeId(value: unknown): value is string {
 export function loadPiEnabledModels(opts: LoadOptions): PiEnabledModelsResult {
   const warnings: string[] = [];
   const read = opts.read ?? ((path: string) => readFileSync(path, "utf8"));
-  const agentDir = opts.agentDir ?? join(homedir(), ".pi", "agent");
+  const agentDir = opts.agentDir
+    ?? resolve(process.env.PI_CODING_AGENT_DIR ?? join(homedir(), ".pi", "agent"));
   const globalPath = join(agentDir, "settings.json");
   const projectPath = join(opts.harnessDir, ".pi", "settings.json");
   const globalSettings = readSettings(globalPath, false, read, warnings);

backend/test/enabled-models.test.ts

@@ -1,4 +1,4 @@
-import { expect, test } from "vitest";
+import { expect, test, vi } from "vitest";
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -35,6 +35,20 @@ test("loads exact global enabledModels in configured order", () => {
   } finally { rmSync(f.root, { recursive: true, force: true }); }
 });
 
+test("uses the configured Pi agent directory when no explicit directory is passed", () => {
+  const f = fixture({ enabledModels: ["zai/glm-5.2"] });
+  vi.stubEnv("PI_CODING_AGENT_DIR", f.agentDir);
+  try {
+    expect(loadPiEnabledModels({ harnessDir: f.harnessDir })).toMatchObject({
+      ids: ["zai/glm-5.2"],
+      warnings: [],
+    });
+  } finally {
+    vi.unstubAllEnvs();
+    rmSync(f.root, { recursive: true, force: true });
+  }
+});
+
 test("project enabledModels overrides global enabledModels", () => {
   const f = fixture(
     { enabledModels: ["zai/glm-5.2", "zai/glm-5v-turbo"] },

backend/test/windows-auth-storage.test.ts

@@ -46,9 +46,9 @@ function realChildBridge(
     bridge: factory({
       thtExecutable: pathStyle === "windows" ? "C:\\tht.exe" : launcher,
       spawnChild: (_executable, args, options) => spawn(launcher, [...args], options),
-      // Leave enough startup headroom for a real child under a busy CI host while retaining a
-      // sub-1.5-second bound from request start through final settlement.
-      deadlinesForTest: { timeoutMs: 750, terminationGraceMs: 50, finalSettlementMs: 500 },
+      // Keep this stricter than the five-second production timeout without assuming that a
+      // real Node child can always start within 750 ms on a busy shared runner.
+      deadlinesForTest: { timeoutMs: 2_000, terminationGraceMs: 50, finalSettlementMs: 500 },
       ...(mode === "stdin" ? {
         beforeInputForTest: async () => {
           await waitForMarker(marker, "stdin-closed");
@@ -585,6 +585,6 @@ describe("Windows auth-storage bridge", () => {
 
     await expect(outcome).resolves.toMatchObject({ message: "auth_session_store_invalid" });
     await waitForMarker(marker, "terminated");
-    expect(Date.now() - startedAt).toBeLessThan(1_500);
+    expect(Date.now() - startedAt).toBeLessThan(3_000);
   }, 5_000);
 });