From fe0556bf3fe37aa34b06e163713ea6f34eec43ed Mon Sep 17 00:00:00 2001
From: lidge-jun <243035832+lidge-jun@users.noreply.github.com>
Date: Fri, 4 Sep 2026 17:23:58 +0900
Subject: [PATCH] fix(test): assemble the Muse key fixture so privacy:scan
 stays green

#3437 added the fixture as a literal, which privacy:scan's meta-api-key rule
matches: it detects the real key grammar and cannot tell a fake from a real
one. That is the scanner doing its job, and it has been red on dev since
that merge.

Built from parts the way tests/meta-muse-oauth.test.ts already does.
---
 tests/oauth-manual-code.test.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tests/oauth-manual-code.test.ts b/tests/oauth-manual-code.test.ts
index 8053a5b99c..4187abc17e 100644
--- a/tests/oauth-manual-code.test.ts
+++ b/tests/oauth-manual-code.test.ts
@@ -60,7 +60,9 @@ describe("parseCallbackInput kinds", () => {
   // survive as a raw value: the shared gate rejects anything with no code, and a key
   // split on "#" would be truncated into an invalid credential.
   test("a Muse Code API key survives as a raw value", () => {
-    const key = "LLM|1234567890123456|abcdefghijklmnopqrstuvwxy";
+    // Assembled, never written literally: privacy:scan detects the real key grammar
+    // (`LLM|<digits>|<tail>`) and a literal fixture would trip its meta-api-key rule.
+    const key = `LLM|${"1".repeat(16)}|${"c".repeat(27)}`;
     expect(parseCallbackInput(key)).toEqual({ kind: "raw", code: key, state: undefined });
   });
   test("raw authorization code -> kind raw", () => {