[cte13]

Summary

swift test can call Anthropic, Google, and Cursor with the contributor's real login.

UsageStore.init defaults every limits provider to the real one, so any test that doesn't inject a stub runs it. The automatic path reads no Keychain item, which makes this look harmless, but credentials are also plain files:

• ~/.claude/.credentials.json
• the Antigravity token file
• Cursor's login in state.vscdb

On a machine that has any of them, the no-prompt path succeeds. The suite then makes live requests with that account. This uses up the account's rate limit, so the real app running alongside hits 429 and backs off. For Antigravity, it also spends the user's refresh token. On my machine, the new Claude and Antigravity checks below reached the gate instead of skipping. So both credentials are reachable from swift test, and before this change those tests could make real calls.

This adds one gate, AppEnv.allowsLiveLimitsFetch, and checks it at every limits network boundary:

Provider	Boundary
OAuthLimitsProvider	usage call, and the profile identity call
AntigravityRateLimitsProvider	quota call, and the Google token refresh
URLSessionSessionKeyClient	the real claude.ai client (tests inject their own)
CursorRateLimitsProvider	perform, used by both the usage call and the token refresh

The gate is open in the app bundle (AppEnv.isBundledApp, the same check that already guards notifications and Keychain reads), with PTB_PARITY=1 (already used by the parity smoke tests), or when a test explicitly opts in to drive real network code against a stubbed transport. It sits at the network boundary, not before the credential read, so KeychainAutoPathTests still sees real reads.

Trade-offs

• Raw dev binaries: running .build/debug/PokeTokenBar directly now shows no live limits unless you run it with PTB_PARITY=1. Bundles built by scripts/build-app.sh are unaffected. This matches how the app already disables other side effects outside a bundle.
• Stubbed-network tests opt in: tests that exercise a provider's real network code against URLProtocol or an injected session set AppEnv.allowLiveFetchForTesting and reset it in defer. Only the 3 such tests in CredentialSwitchCacheTests need it.
• The source scan is a heuristic: it checks every *LimitsProvider.swift that uses URLSession for the gate, ignoring commented-out lines. It exists so the next provider can't ship without the gate. I'm happy to drop it if you'd rather not have a source-scanning test.

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Documentation
• Other:

Checklist

• swift build and swift test pass locally (1273 tests, 0 failures)
• PR title and description are written in English
• No copyrighted assets, secrets, or private tooling references are committed (see CONTRIBUTING)
• Tests were added or updated for this change: LiveCredentialCallGateTests
  • testGateIsClosedUnderSwiftTest runs on every machine, including CI.
  • The Claude and Antigravity fetches must stop at the gate. They skip when the machine has no credential, rather than counting as a pass.
  • testEveryNetworkingLimitsProviderIsGated is the source scan.
  • Fault injection: commenting out the Cursor gate fails the scan, and forcing the gate open fails testGateIsClosedUnderSwiftTest. I did not test by removing the Claude or Antigravity gates, because that would make the very live calls this PR prevents.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PNenigaFnwvcTs2kDND16Z

[chattymin]

Thank you for your contribution!