fix(tests): use consistent @/lib/db specifier to avoid CI module-identity drift

Two new tests landed with 5d92fc5 (cc-switch credential bridge) passed
locally but failed on the v0.50.2 CI run:

  not ok - DB provider WITHOUT api_key → returns false even when settings.json has creds
  not ok - resolves ${...} env placeholders against CodePilot DB settings

Root cause: the tests imported lib/db via relative specifier
`../../lib/db` while the prod callers they exercise (runtime/registry.ts,
mcp-loader.ts) import via mixed specifiers. Under tsx + node 20 on Linux,
these can resolve as separate module instances with separate db handles —
setSetting() in the test writes to one DB, getSetting() inside the prod
function reads from another, so the values never line up. macOS tsx 4.x
happens to dedupe by absolute path, which is why local didn't reproduce.

Fix:
  - Unified all test imports to `@/lib/db`
  - Unified runtime/registry.ts to `@/lib/db` / `@/lib/claude-settings` so
    it matches mcp-loader.ts (the rest of the codebase is already on the
    alias)
  - Added ANTHROPIC_* env var scrub + legacy DB token reset in the
    hasCredentialsForRequest describe's beforeEach so inherited CI env
    can't short-circuit the function past the branch we're testing

No prod behavior change — production imports still resolve to the same
compiled module in Next.js. This only normalizes the test-time specifier
shape so tsx's module cache sees one instance everywhere.

1030/1030 tests pass.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: op7418

src/__tests__/unit/claude-settings-credentials.test.ts

@@ -260,6 +260,31 @@ describe('cc-switch end-to-end (no CodePilot provider, settings.json only)', ()
 // be "rescued" by cc-switch — the user picked Kimi/GLM precisely because they
 // want THAT provider's auth.
 describe('hasCredentialsForRequest — provider-group ownership', () => {
+  // Explicitly scrub ANTHROPIC_* env vars and the legacy DB token the function
+  // short-circuits on — otherwise CI runners that inherit these from the
+  // workflow or a prior test's state will make the function return true before
+  // it reaches the provider-ownership branch we're testing.
+  const savedApiKey = process.env.ANTHROPIC_API_KEY;
+  const savedAuthToken = process.env.ANTHROPIC_AUTH_TOKEN;
+  let savedDbToken: string | undefined;
+
+  beforeEach(async () => {
+    delete process.env.ANTHROPIC_API_KEY;
+    delete process.env.ANTHROPIC_AUTH_TOKEN;
+    const { getSetting, setSetting } = await import('@/lib/db');
+    savedDbToken = getSetting('anthropic_auth_token');
+    setSetting('anthropic_auth_token', '');
+  });
+
+  afterEach(async () => {
+    if (savedApiKey !== undefined) process.env.ANTHROPIC_API_KEY = savedApiKey;
+    if (savedAuthToken !== undefined) process.env.ANTHROPIC_AUTH_TOKEN = savedAuthToken;
+    if (savedDbToken !== undefined) {
+      const { setSetting } = await import('@/lib/db');
+      setSetting('anthropic_auth_token', savedDbToken);
+    }
+  });
+
   it('env group + settings.json creds → has credentials', async () => {
     writeSettings('settings.json', { env: { ANTHROPIC_AUTH_TOKEN: 'sk-cc-switch' } });
     const { hasCredentialsForRequest } = await import('../../lib/runtime/registry');
@@ -277,7 +302,7 @@ describe('hasCredentialsForRequest — provider-group ownership', () => {
     // a "Kimi config error", NOT a "use my Anthropic key" silent fallback.
     writeSettings('settings.json', { env: { ANTHROPIC_AUTH_TOKEN: 'sk-cc-switch-leak' } });
 
-    const { createProvider } = await import('../../lib/db');
+    const { createProvider } = await import('@/lib/db');
     const dbProvider = createProvider({
       name: 'Kimi (no key configured)',
       provider_type: 'anthropic',
@@ -296,7 +321,7 @@ describe('hasCredentialsForRequest — provider-group ownership', () => {
   it('DB provider WITH api_key → returns true (uses its own creds)', async () => {
     writeSettings('settings.json', { env: { ANTHROPIC_AUTH_TOKEN: 'sk-cc-switch-leak' } });
 
-    const { createProvider } = await import('../../lib/db');
+    const { createProvider } = await import('@/lib/db');
     const dbProvider = createProvider({
       name: 'Kimi (configured)',
       provider_type: 'anthropic',

src/__tests__/unit/project-mcp-injection.test.ts

@@ -120,7 +120,7 @@ describe('loadProjectMcpServers — explicit project .mcp.json injection', () =>
     });
 
     // Seed CodePilot DB with the secret value
-    const { setSetting } = await import('../../lib/db');
+    const { setSetting } = await import('@/lib/db');
     setSetting('team_api_token', 'sk-team-secret');
 
     const { loadProjectMcpServers } = await import('../../lib/mcp-loader');

src/lib/runtime/registry.ts

@@ -6,8 +6,8 @@
  */
 
 import type { AgentRuntime } from './types';
-import { getSetting, getAllProviders, getProvider } from '../db';
-import { hasClaudeSettingsCredentials } from '../claude-settings';
+import { getSetting, getAllProviders, getProvider } from '@/lib/db';
+import { hasClaudeSettingsCredentials } from '@/lib/claude-settings';
 
 const runtimes = new Map<string, AgentRuntime>();