update rotator and startup files

Dockerfile

@@ -72,8 +72,8 @@ COPY --chown=1000:1000 wa-guardian.js /home/node/app/wa-guardian.js
 COPY --chown=1000:1000 cloudflare-keepalive-setup.py /home/node/app/cloudflare-keepalive-setup.py
 COPY --chown=1000:1000 openclaw-sync.py /home/node/app/openclaw-sync.py
 RUN chmod +x /home/node/app/start.sh /home/node/app/cloudflare-proxy-setup.py /home/node/app/cloudflare-keepalive-setup.py /home/node/app/openclaw-sync.py
-COPY --chown=1000:1000 nvidia-key-rotator.cjs /home/node/app/nvidia-key-rotator.cjs
-RUN chmod +x /home/node/app/start.sh /home/node/app/cloudflare-proxy-setup.py /home/node/app/cloudflare-keepalive-setup.py /home/node/app/openclaw-sync.py /home/node/app/nvidia-key-rotator.cjs
+COPY --chown=1000:1000 multi-provider-key-rotator.cjs /home/node/app/multi-provider-key-rotator.cjs
+RUN chmod +x /home/node/app/start.sh /home/node/app/cloudflare-proxy-setup.py /home/node/app/cloudflare-keepalive-setup.py /home/node/app/openclaw-sync.py /home/node/app/multi-provider-key-rotator.cjs
 
 USER node
 

multi-provider-key-rotator.cjs

@@ -0,0 +1,318 @@
+'use strict';
+
+/**
+ * Multi-provider API key rotator for OpenClaw/HuggingClaw
+ * --------------------------------------------------------
+ * Works exactly like nvidia-key-rotator.cjs but covers every
+ * provider that HuggingClaw supports.
+ *
+ * For each provider you can supply a comma-separated pool:
+ *   ANTHROPIC_API_KEYS=key1,key2,key3
+ * Falls back to the singular env var, then to LLM_API_KEY.
+ *
+ * Keys are rotated round-robin per provider independently.
+ *
+ * Patches globalThis.fetch + node:http + node:https so that
+ * virtually every caller is covered without code changes.
+ */
+
+const http  = require('node:http');
+const https = require('node:https');
+
+// ─── Provider definitions ────────────────────────────────────────────────────
+//
+// hostname  – regex tested against the request hostname (case-insensitive)
+// envPlural – env var that holds a comma-separated key pool  (preferred)
+// envSingular – env var that holds a single key              (fallback)
+//
+// LLM_API_KEY is the final fallback for every provider.
+//
+const PROVIDERS = [
+  {
+    name:       'anthropic',
+    hostname:   /(?:^|\.)api\.anthropic\.com$/i,
+    envPlural:  'ANTHROPIC_API_KEYS',
+    envSingular:'ANTHROPIC_API_KEY',
+  },
+  {
+    name:       'openai',
+    hostname:   /(?:^|\.)api\.openai\.com$/i,
+    envPlural:  'OPENAI_API_KEYS',
+    envSingular:'OPENAI_API_KEY',
+  },
+  {
+    name:       'gemini',
+    // Gemini uses generativelanguage API; also covers aiplatform
+    hostname:   /(?:^|\.)(?:generativelanguage\.googleapis\.com|aiplatform\.googleapis\.com)$/i,
+    envPlural:  'GEMINI_API_KEYS',
+    envSingular:'GEMINI_API_KEY',
+  },
+  {
+    name:       'deepseek',
+    hostname:   /(?:^|\.)api\.deepseek\.com$/i,
+    envPlural:  'DEEPSEEK_API_KEYS',
+    envSingular:'DEEPSEEK_API_KEY',
+  },
+  {
+    name:       'openrouter',
+    hostname:   /(?:^|\.)openrouter\.ai$/i,
+    envPlural:  'OPENROUTER_API_KEYS',
+    envSingular:'OPENROUTER_API_KEY',
+  },
+  {
+    name:       'kilocode',
+    hostname:   /(?:^|\.)kilocode\.ai$/i,
+    envPlural:  'KILOCODE_API_KEYS',
+    envSingular:'KILOCODE_API_KEY',
+  },
+  {
+    name:       'opencode',
+    hostname:   /(?:^|\.)opencode\.ai$/i,
+    envPlural:  'OPENCODE_API_KEYS',
+    envSingular:'OPENCODE_API_KEY',
+  },
+  {
+    name:       'zai',
+    // Z.ai / GLM — both domains normalised to "zai" in OpenClaw
+    hostname:   /(?:^|\.)(?:z\.ai|open\.bigmodel\.cn)$/i,
+    envPlural:  'ZAI_API_KEYS',
+    envSingular:'ZAI_API_KEY',
+  },
+  {
+    name:       'moonshot',
+    hostname:   /(?:^|\.)api\.moonshot\.cn$/i,
+    envPlural:  'MOONSHOT_API_KEYS',
+    envSingular:'MOONSHOT_API_KEY',
+  },
+  {
+    name:       'minimax',
+    hostname:   /(?:^|\.)api\.minimax\.chat$/i,
+    envPlural:  'MINIMAX_API_KEYS',
+    envSingular:'MINIMAX_API_KEY',
+  },
+  {
+    name:       'xiaomi',
+    // MiMo — update hostname if Xiaomi publishes an official domain
+    hostname:   /(?:^|\.)api\.xiaomi\.com$/i,
+    envPlural:  'XIAOMI_API_KEYS',
+    envSingular:'XIAOMI_API_KEY',
+  },
+  {
+    name:       'volcengine',
+    // Volcengine / Doubao
+    hostname:   /(?:^|\.)(?:ark\.cn-beijing\.volces\.com|volcengineapi\.com)$/i,
+    envPlural:  'VOLCANO_ENGINE_API_KEYS',
+    envSingular:'VOLCANO_ENGINE_API_KEY',
+  },
+  {
+    name:       'byteplus',
+    hostname:   /(?:^|\.)maas-api\.ml-platform-cn-beijing\.byteplus\.com$/i,
+    envPlural:  'BYTEPLUS_API_KEYS',
+    envSingular:'BYTEPLUS_API_KEY',
+  },
+  {
+    name:       'mistral',
+    hostname:   /(?:^|\.)api\.mistral\.ai$/i,
+    envPlural:  'MISTRAL_API_KEYS',
+    envSingular:'MISTRAL_API_KEY',
+  },
+  {
+    name:       'xai',
+    hostname:   /(?:^|\.)api\.x\.ai$/i,
+    envPlural:  'XAI_API_KEYS',
+    envSingular:'XAI_API_KEY',
+  },
+  {
+    name:       'nvidia',
+    hostname:   /(?:^|\.)(?:integrate\.api\.nvidia\.com|api\.nvidia\.com)$/i,
+    envPlural:  'NVIDIA_API_KEYS',
+    envSingular:'NVIDIA_API_KEY',
+  },
+  {
+    name:       'groq',
+    hostname:   /(?:^|\.)api\.groq\.com$/i,
+    envPlural:  'GROQ_API_KEYS',
+    envSingular:'GROQ_API_KEY',
+  },
+  {
+    name:       'cohere',
+    hostname:   /(?:^|\.)api\.cohere\.(?:ai|com)$/i,
+    envPlural:  'COHERE_API_KEYS',
+    envSingular:'COHERE_API_KEY',
+  },
+  {
+    name:       'together',
+    hostname:   /(?:^|\.)api\.together\.(?:xyz|ai)$/i,
+    envPlural:  'TOGETHER_API_KEYS',
+    envSingular:'TOGETHER_API_KEY',
+  },
+  {
+    name:       'cerebras',
+    hostname:   /(?:^|\.)api\.cerebras\.ai$/i,
+    envPlural:  'CEREBRAS_API_KEYS',
+    envSingular:'CEREBRAS_API_KEY',
+  },
+  {
+    name:       'huggingface',
+    hostname:   /(?:^|\.)(?:api-inference\.huggingface\.co|router\.huggingface\.co|huggingface\.co)$/i,
+    envPlural:  'HUGGINGFACE_HUB_TOKENS',       // plural variant
+    envSingular:'HUGGINGFACE_HUB_TOKEN',
+  },
+];
+
+// ─── Key loading ───────��─────────────────────────────────────────────────────
+
+function normalizeKeys(...inputs) {
+  const seen = new Set();
+  const out   = [];
+  for (const input of inputs) {
+    for (const k of String(input || '').split(',').map(s => s.trim()).filter(Boolean)) {
+      if (!seen.has(k)) { seen.add(k); out.push(k); }
+    }
+  }
+  return out;
+}
+
+// Build per-provider key pools + rotation indices
+const providerState = PROVIDERS.map(p => {
+  const keys = normalizeKeys(
+    process.env[p.envPlural]  || '',
+    process.env[p.envSingular] || '',
+    process.env.LLM_API_KEY   || '',
+  );
+  if (!keys.length) {
+    console.warn(`[key-rotator] No keys for provider "${p.name}"`);
+  } else {
+    console.log(`[key-rotator] ${p.name}: ${keys.length} key${keys.length === 1 ? '' : 's'}`);
+  }
+  return { ...p, keys, idx: 0 };
+});
+
+// ─── Runtime helpers ─────────────────────────────────────────────────────────
+
+function resolveHostname(urlLike) {
+  try {
+    const u =
+      typeof urlLike === 'string'                              ? new URL(urlLike)
+      : urlLike instanceof URL                                 ? urlLike
+      : urlLike && typeof urlLike.url === 'string'             ? new URL(urlLike.url)
+      : urlLike && typeof urlLike.href === 'string'            ? new URL(urlLike.href)
+      : urlLike && typeof urlLike.hostname === 'string'        ? urlLike
+      : null;
+    return u ? u.hostname : null;
+  } catch {
+    return null;
+  }
+}
+
+function matchProvider(hostname) {
+  if (!hostname) return null;
+  return providerState.find(p => p.hostname.test(hostname)) || null;
+}
+
+function nextKey(provider) {
+  if (!provider || !provider.keys.length) return null;
+  const key = provider.keys[provider.idx % provider.keys.length];
+  provider.idx = (provider.idx + 1) % provider.keys.length;
+  return key;
+}
+
+function setAuthHeader(headers, key) {
+  if (!key) return headers;
+  const authValue = `Bearer ${key}`;
+
+  if (typeof Headers !== 'undefined' && headers instanceof Headers) {
+    headers.set('authorization', authValue);
+    return headers;
+  }
+  if (Array.isArray(headers)) {
+    const out = headers.filter(([k]) => String(k).toLowerCase() !== 'authorization');
+    out.push(['authorization', authValue]);
+    return out;
+  }
+  if (headers && typeof headers === 'object') {
+    return { ...headers, authorization: authValue };
+  }
+  return { authorization: authValue };
+}
+
+// ─── Patch globalThis.fetch ───────────────────────────────────────────────────
+
+function patchFetch() {
+  if (typeof globalThis.fetch !== 'function') return;
+
+  const originalFetch = globalThis.fetch.bind(globalThis);
+
+  globalThis.fetch = async function patchedFetch(input, init = {}) {
+    try {
+      const urlLike =
+        typeof input === 'string' || input instanceof URL
+          ? input
+          : input && typeof input.url === 'string' ? input.url : null;
+
+      const hostname = resolveHostname(urlLike);
+      const provider = matchProvider(hostname);
+
+      if (provider) {
+        const key = nextKey(provider);
+        if (key) {
+          const headers        = init.headers || (input && input.headers) || undefined;
+          const patchedHeaders = setAuthHeader(headers, key);
+          init = { ...init, headers: patchedHeaders };
+
+          if (input && typeof input === 'object' && !(input instanceof URL) && input.headers) {
+            try { input = new Request(input, { headers: patchedHeaders }); } catch { /* noop */ }
+          }
+        }
+      }
+    } catch (err) {
+      console.warn('[key-rotator] fetch patch error:', err?.message || err);
+    }
+
+    return originalFetch(input, init);
+  };
+}
+
+// ─── Patch node:http / node:https ────────────────────────────────────────────
+
+function patchHttpModule(mod) {
+  const originalRequest = mod.request;
+
+  mod.request = function patchedRequest(...args) {
+    try {
+      const options  = args[0];
+      const hostname = resolveHostname(options);
+      const provider = matchProvider(hostname);
+
+      if (provider) {
+        const key = nextKey(provider);
+        if (key) {
+          if (typeof options === 'string' || options instanceof URL) {
+            const u = new URL(String(options));
+            args[0] = {
+              protocol: u.protocol,
+              hostname: u.hostname,
+              port:     u.port,
+              path:     `${u.pathname}${u.search}`,
+              headers:  { authorization: `Bearer ${key}` },
+            };
+          } else if (options && typeof options === 'object') {
+            args[0] = { ...options, headers: setAuthHeader(options.headers, key) };
+          }
+        }
+      }
+    } catch (err) {
+      console.warn('[key-rotator] http patch error:', err?.message || err);
+    }
+
+    return originalRequest.apply(mod, args);
+  };
+}
+
+// ─── Apply patches ────────────────────────────────────────────────────────────
+
+patchFetch();
+patchHttpModule(http);
+patchHttpModule(https);
+
+console.log('[key-rotator] loaded — all providers active');

nvidia-key-rotator.cjs

@@ -1,185 +0,0 @@
-'use strict';
-
-/**
- * NVIDIA API key rotator for OpenClaw/HuggingClaw
- * ------------------------------------------------
- * - Supports comma-separated keys in NVIDIA_API_KEYS
- * - Falls back to NVIDIA_API_KEY, then LLM_API_KEY
- * - Rotates keys on every NVIDIA request
- * - Patches fetch + http/https request so most callers are covered
- */
-
-const http = require('node:http');
-const https = require('node:https');
-
-const NVIDIA_HOST_RE = /(^|\.)((integrate\.api\.nvidia\.com)|(api\.nvidia\.com))$/i;
-
-function normalizeKeys(input) {
-  return String(input || '')
-    .split(',')
-    .map((s) => s.trim())
-    .filter(Boolean);
-}
-
-const keys = Array.from(
-  new Set(
-    normalizeKeys(process.env.NVIDIA_API_KEYS)
-      .concat(normalizeKeys(process.env.NVIDIA_API_KEY))
-      .concat(normalizeKeys(process.env.LLM_API_KEY))
-  )
-);
-
-if (!keys.length) {
-  console.warn('[nvidia-key-rotator] No NVIDIA keys found');
-}
-
-let idx = 0;
-
-function nextKey() {
-  if (!keys.length) return null;
-  const key = keys[idx % keys.length];
-  idx = (idx + 1) % keys.length;
-  return key;
-}
-
-function isNvidiaUrl(urlLike) {
-  try {
-    const u = typeof urlLike === 'string'
-      ? new URL(urlLike)
-      : urlLike instanceof URL
-        ? urlLike
-        : urlLike && typeof urlLike.url === 'string'
-          ? new URL(urlLike.url)
-          : null;
-
-    if (!u) return false;
-    return NVIDIA_HOST_RE.test(u.hostname);
-  } catch {
-    return false;
-  }
-}
-
-function setAuthHeader(headers, key) {
-  if (!key) return headers;
-
-  const authValue = `Bearer ${key}`;
-
-  // Headers instance
-  if (typeof Headers !== 'undefined' && headers instanceof Headers) {
-    headers.set('authorization', authValue);
-    return headers;
-  }
-
-  // Array of tuples
-  if (Array.isArray(headers)) {
-    const out = headers.filter(([k]) => String(k).toLowerCase() !== 'authorization');
-    out.push(['authorization', authValue]);
-    return out;
-  }
-
-  // Plain object
-  if (headers && typeof headers === 'object') {
-    return {
-      ...headers,
-      authorization: authValue,
-    };
-  }
-
-  return { authorization: authValue };
-}
-
-function patchFetch() {
-  if (typeof globalThis.fetch !== 'function') return;
-
-  const originalFetch = globalThis.fetch.bind(globalThis);
-
-  globalThis.fetch = async function patchedFetch(input, init = {}) {
-    try {
-      const urlLike =
-        typeof input === 'string' || input instanceof URL
-          ? input
-          : input && typeof input.url === 'string'
-            ? input.url
-            : null;
-
-      if (urlLike && isNvidiaUrl(urlLike)) {
-        const key = nextKey();
-        if (key) {
-          const headers = init.headers || (input && input.headers) || undefined;
-          const patchedHeaders = setAuthHeader(headers, key);
-
-          if (init && typeof init === 'object') {
-            init = { ...init, headers: patchedHeaders };
-          } else {
-            init = { headers: patchedHeaders };
-          }
-
-          if (input && typeof input === 'object' && !(input instanceof URL) && input.headers) {
-            try {
-              input = new Request(input, { headers: patchedHeaders });
-            } catch {
-              // ignore and let fetch handle original input
-            }
-          }
-        }
-      }
-    } catch (err) {
-      console.warn('[nvidia-key-rotator] fetch patch error:', err?.message || err);
-    }
-
-    return originalFetch(input, init);
-  };
-}
-
-function patchHttpModule(mod) {
-  const originalRequest = mod.request;
-
-  mod.request = function patchedRequest(...args) {
-    try {
-      let options = args[0];
-
-      const urlLike =
-        typeof options === 'string' || options instanceof URL
-          ? options
-          : options && typeof options === 'object' && typeof options.href === 'string'
-            ? options.href
-            : null;
-
-      if (urlLike && isNvidiaUrl(urlLike)) {
-        const key = nextKey();
-        if (key) {
-          if (typeof options === 'string' || options instanceof URL) {
-            const u = new URL(String(options));
-            u.username = '';
-            u.password = '';
-            args[0] = {
-              protocol: u.protocol,
-              hostname: u.hostname,
-              port: u.port,
-              path: `${u.pathname}${u.search}`,
-              headers: { authorization: `Bearer ${key}` },
-            };
-          } else if (options && typeof options === 'object') {
-            const headers = setAuthHeader(options.headers, key);
-            args[0] = {
-              ...options,
-              headers,
-            };
-          }
-        }
-      }
-    } catch (err) {
-      console.warn('[nvidia-key-rotator] http patch error:', err?.message || err);
-    }
-
-    return originalRequest.apply(mod, args);
-  };
-}
-
-patchFetch();
-patchHttpModule(http);
-patchHttpModule(https);
-
-console.log(
-  `[nvidia-key-rotator] loaded (${keys.length} key${keys.length === 1 ? '' : 's'})`
-);

start.sh

@@ -426,7 +426,7 @@ chmod 600 /home/node/.openclaw/openclaw.json
 
 # ── Enable Gateway Preload Fixes ──
 # This preload script keeps iframe embedding working on HF Spaces.
-export NODE_OPTIONS="${NODE_OPTIONS:+$NODE_OPTIONS }--require /home/node/app/iframe-fix.cjs --require /home/node/app/nvidia-key-rotator.cjs"
+export NODE_OPTIONS="${NODE_OPTIONS:+$NODE_OPTIONS }--require /home/node/app/iframe-fix.cjs --require /home/node/app/multi-provider-key-rotator.cjs"
 
 # ── Startup Summary ──
 echo ""

test-rotator.mjs

@@ -0,0 +1,124 @@
+import { createRequire } from 'module';
+import path from 'path';
+import { fileURLToPath } from 'url';
+const require = createRequire(import.meta.url);
+const G = s => `\x1b[32m${s}\x1b[0m`;
+const R = s => `\x1b[31m${s}\x1b[0m`;
+const Y = s => `\x1b[33m${s}\x1b[0m`;
+const B = s => `\x1b[1m${s}\x1b[0m`;
+
+Object.assign(process.env, {
+  ANTHROPIC_API_KEYS:'ant-k1,ant-k2,ant-k3', OPENAI_API_KEYS:'oai-k1,oai-k2,oai-k3',
+  GEMINI_API_KEYS:'gem-k1,gem-k2,gem-k3', DEEPSEEK_API_KEYS:'dsk-k1,dsk-k2,dsk-k3',
+  OPENROUTER_API_KEYS:'ort-k1,ort-k2,ort-k3', KILOCODE_API_KEYS:'kil-k1,kil-k2,kil-k3',
+  OPENCODE_API_KEYS:'ocd-k1,ocd-k2,ocd-k3', ZAI_API_KEYS:'zai-k1,zai-k2,zai-k3',
+  MOONSHOT_API_KEYS:'msn-k1,msn-k2,msn-k3', MINIMAX_API_KEYS:'mmx-k1,mmx-k2,mmx-k3',
+  XIAOMI_API_KEYS:'xmi-k1,xmi-k2,xmi-k3', VOLCANO_ENGINE_API_KEYS:'vlc-k1,vlc-k2,vlc-k3',
+  BYTEPLUS_API_KEYS:'btp-k1,btp-k2,btp-k3', MISTRAL_API_KEYS:'mst-k1,mst-k2,mst-k3',
+  XAI_API_KEYS:'xai-k1,xai-k2,xai-k3', NVIDIA_API_KEYS:'nv-k1,nv-k2,nv-k3',
+  GROQ_API_KEYS:'grq-k1,grq-k2,grq-k3', COHERE_API_KEYS:'coh-k1,coh-k2,coh-k3',
+  TOGETHER_API_KEYS:'tgt-k1,tgt-k2,tgt-k3', CEREBRAS_API_KEYS:'crb-k1,crb-k2,crb-k3',
+  HUGGINGFACE_HUB_TOKENS:'hf-k1,hf-k2,hf-k3',
+});
+
+// Mock fetch BEFORE loading rotator (rotator captures this as "originalFetch")
+const fetchLog = [];
+globalThis.fetch = async function mockFetch(input, init = {}) {
+  const url = typeof input === 'string' ? input : input?.url ?? '?';
+  const h = init?.headers ?? {};
+  const auth = typeof h.get === 'function' ? h.get('authorization') : (h.authorization ?? null);
+  fetchLog.push({ url, auth });
+  return new Response('{}', { status: 200 });
+};
+
+// Mock http/https BEFORE loading rotator
+const http = require('http');
+const https = require('https');
+const httpLog = [];
+for (const mod of [http, https]) {
+  mod.request = function mockReq(...args) {
+    const opts = args[0];
+    const hostname = typeof opts === 'string' ? new URL(opts).hostname : opts?.hostname ?? '?';
+    const auth = opts?.headers?.authorization ?? null;
+    httpLog.push({ hostname, auth });
+    return { on() { return this; }, end() {}, write() {} };
+  };
+}
+
+// Load rotator
+console.log(B('\n── Loading rotator ─────────────────────────────────────\n'));
+const origLog = console.log; const ll = [];
+console.log = (...a) => ll.push(a.join(' '));
+require('./multi-provider-key-rotator.cjs');
+console.log = origLog;
+ll.forEach(l => console.log('  ' + l));
+
+const TESTS = [
+  ['api.anthropic.com','ant-','Anthropic'],
+  ['api.openai.com','oai-','OpenAI'],
+  ['generativelanguage.googleapis.com','gem-','Gemini'],
+  ['api.deepseek.com','dsk-','DeepSeek'],
+  ['openrouter.ai','ort-','OpenRouter'],
+  ['kilocode.ai','kil-','KiloCode'],
+  ['opencode.ai','ocd-','OpenCode'],
+  ['open.bigmodel.cn','zai-','Z.ai / GLM'],
+  ['api.moonshot.cn','msn-','Moonshot'],
+  ['api.minimax.chat','mmx-','MiniMax'],
+  ['api.xiaomi.com','xmi-','Xiaomi'],
+  ['ark.cn-beijing.volces.com','vlc-','Volcengine'],
+  ['maas-api.ml-platform-cn-beijing.byteplus.com','btp-','BytePlus'],
+  ['api.mistral.ai','mst-','Mistral'],
+  ['api.x.ai','xai-','xAI / Grok'],
+  ['integrate.api.nvidia.com','nv-','NVIDIA (integrate)'],
+  ['api.nvidia.com','nv-','NVIDIA (api)'],
+  ['api.groq.com','grq-','Groq'],
+  ['api.cohere.com','coh-','Cohere'],
+  ['api.cohere.ai','coh-','Cohere (alt)'],
+  ['api.together.xyz','tgt-','Together'],
+  ['api.cerebras.ai','crb-','Cerebras'],
+  ['api-inference.huggingface.co','hf-','HuggingFace'],
+];
+
+console.log(B('\n── fetch() — 3 requests each (rotation check) ─────────\n'));
+let passed = 0, failed = 0;
+
+for (const [hostname, prefix, label] of TESTS) {
+  fetchLog.length = 0;
+  for (let i = 0; i < 3; i++) await globalThis.fetch(`https://${hostname}/v1/messages`, {});
+  const keys = fetchLog.map(f => f.auth?.replace('Bearer ', '') ?? null);
+  const ok = keys.every(k => k?.startsWith(prefix)) && keys[0] !== keys[1] && keys[1] !== keys[2];
+  if (ok) { passed++; console.log(` ${G('✓')} ${label.padEnd(24)} ${keys.join(' → ')}`); }
+  else    { failed++; console.log(` ${R('✗')} ${label.padEnd(24)} got: ${JSON.stringify(keys)}`); }
+}
+
+// Unknown host — no header
+fetchLog.length = 0;
+await globalThis.fetch('https://example.com/test', {});
+const unk = fetchLog[0]?.auth ?? null;
+if (!unk) { passed++; console.log(`\n ${G('✓')} ${'Unknown host'.padEnd(24)} correctly skipped`); }
+else       { failed++; console.log(`\n ${R('✗')} ${'Unknown host'.padEnd(24)} wrongly injected: ${unk}`); }
+
+console.log(B('\n── http.request() — direct options object ──────────────\n'));
+const HTTP_TESTS = [
+  ['api.anthropic.com','ant-','Anthropic'],
+  ['api.openai.com','oai-','OpenAI'],
+  ['api.mistral.ai','mst-','Mistral'],
+  ['integrate.api.nvidia.com','nv-','NVIDIA'],
+  ['api.groq.com','grq-','Groq'],
+  ['api.x.ai','xai-','xAI'],
+];
+for (const [hostname, prefix, label] of HTTP_TESTS) {
+  httpLog.length = 0;
+  http.request({ hostname, path: '/v1', headers: {} });
+  http.request({ hostname, path: '/v1', headers: {} });
+  const keys = httpLog.map(e => e.auth?.replace('Bearer ', '') ?? null);
+  const ok = keys.every(k => k?.startsWith(prefix)) && keys[0] !== keys[1];
+  if (ok) { passed++; console.log(` ${G('✓')} ${label.padEnd(24)} ${keys.join(' → ')}`); }
+  else    { failed++; console.log(` ${R('✗')} ${label.padEnd(24)} got: ${JSON.stringify(keys)}`); }
+}
+
+console.log(B('\n────────────────────────────────────────────────────────'));
+const total = passed + failed;
+console.log(` ${G(passed+'/'+total+' passed')}  ${failed ? R(failed+' failed') : ''}`);
+if (failed === 0) console.log(` ${G('✓ Rotator sahi kaam kar raha hai — deploy karo!')}\n`);
+else              console.log(` ${R('✗ Issues hain — upar dekho.')}\n`);