[eric] update cross-module + test refs to promoted main/auth symbols (TOKEN/ws_auth_ok/etc.)

backend/apps/outputs/executor.py

@@ -181,7 +181,7 @@ async def execute_backend_code(
     Security boundaries (defense in depth; none alone is sufficient):
       1. AST allowlist on imports + blocked-builtin call list.
       2. Subprocess cwd = fresh temp dir (not the OpenSwarm process cwd).
-      3. Subprocess env strips PATH, all *_TOKEN / *_API_KEY inheritance.
+      3. Subprocess env strips PATH, all *TOKEN / *_API_KEY inheritance.
       4. Preamble scrubs dangerous attrs off `builtins` inside the subprocess
          to catch AST-bypass tricks (e.g. metaclass shenanigans).
       5. 30s wall-clock timeout, killed on overrun.

backend/tests/test_auth_router.py

@@ -19,13 +19,13 @@ def client():
     """Returns a TestClient pre-loaded with the local backend's auth token
     so the LocalAuthMiddleware doesn't reject our requests with 401."""
     import backend.auth as auth_mod
-    if not auth_mod._TOKEN:
+    if not auth_mod.TOKEN:
         # Tests sometimes run without backend.main's startup hook firing.
         # Generate a token directly so request_matches_token has something
         # to compare against.
         import secrets
-        auth_mod._TOKEN = secrets.token_urlsafe(32)
-    return TestClient(app, headers={"Authorization": f"Bearer {auth_mod._TOKEN}"})
+        auth_mod.TOKEN = secrets.token_urlsafe(32)
+    return TestClient(app, headers={"Authorization": f"Bearer {auth_mod.TOKEN}"})
 
 
 @pytest.fixture
@@ -200,7 +200,7 @@ def test_dev_token_is_dev_only():
     os.environ.pop("OPENSWARM_PACKAGED", None)
     r = noauth.get("/api/dev/token")
     assert r.status_code == 200
-    assert r.json()["token"] == auth_mod._TOKEN
+    assert r.json()["token"] == auth_mod.TOKEN
 
     os.environ["OPENSWARM_PACKAGED"] = "1"
     try:

backend/tests/test_disconnect_resilience.py

@@ -449,7 +449,7 @@ def test_concurrent_broadcast_preserves_order(trial, _patch_persist_dir):
 
 # ---------------------------------------------------------------------------
 # Auth/security smoke: the WS endpoint here is unauth'd by design (test
-# scaffolding), but main.py's _ws_auth_ok must remain in place. This
+# scaffolding), but main.py's p_ws_auth_ok must remain in place. This
 # test pins that contract so a future refactor can't accidentally
 # strip it.
 # ---------------------------------------------------------------------------
@@ -532,8 +532,8 @@ def test_disconnect_does_not_touch_agent_task(_patch_persist_dir):
 
 def test_main_ws_endpoints_still_gated_by_auth(_patch_persist_dir):
     src = open(os.path.join(os.path.dirname(__file__), "..", "main.py")).read()
-    assert "_ws_auth_ok(websocket)" in src, (
-        "main.py WS endpoints must still call _ws_auth_ok before accepting "
+    assert "p_ws_auth_ok(websocket)" in src, (
+        "main.py WS endpoints must still call p_ws_auth_ok before accepting "
         "the connection, otherwise any local web page can read agent traffic."
     )
     # And the disconnect handler must NOT call any task-cancel helper

backend/tests/test_settings_meta_concurrency.py

@@ -21,10 +21,10 @@ from backend.main import app
 
 def _auth_headers():
     import backend.auth as auth_mod
-    if not auth_mod._TOKEN:
+    if not auth_mod.TOKEN:
         import secrets
-        auth_mod._TOKEN = secrets.token_urlsafe(32)
-    return {"Authorization": f"Bearer {auth_mod._TOKEN}"}
+        auth_mod.TOKEN = secrets.token_urlsafe(32)
+    return {"Authorization": f"Bearer {auth_mod.TOKEN}"}
 
 
 @pytest.fixture

backend/tests/test_settings_meta_endpoint.py

@@ -47,10 +47,10 @@ async def test_second_wall_restores_protected_credential_even_if_body_blanks_it(
 @pytest.fixture
 def client():
     import backend.auth as auth_mod
-    if not auth_mod._TOKEN:
+    if not auth_mod.TOKEN:
         import secrets
-        auth_mod._TOKEN = secrets.token_urlsafe(32)
-    return TestClient(app, headers={"Authorization": f"Bearer {auth_mod._TOKEN}"})
+        auth_mod.TOKEN = secrets.token_urlsafe(32)
+    return TestClient(app, headers={"Authorization": f"Bearer {auth_mod.TOKEN}"})
 
 
 @pytest.fixture

backend/tests/test_settings_meta_stdio_live.py

@@ -40,8 +40,8 @@ def _free_port() -> int:
 @pytest.fixture
 def live_backend():
     import backend.auth as auth_mod
-    if not auth_mod._TOKEN:
-        auth_mod._TOKEN = secrets.token_urlsafe(32)
+    if not auth_mod.TOKEN:
+        auth_mod.TOKEN = secrets.token_urlsafe(32)
     port = _free_port()
     server = uvicorn.Server(uvicorn.Config(app, host="127.0.0.1", port=port, log_level="error"))
     thread = threading.Thread(target=server.run, daemon=True)
@@ -51,7 +51,7 @@ def live_backend():
             break
         time.sleep(0.05)
     assert getattr(server, "started", False), "uvicorn did not start"
-    yield port, auth_mod._TOKEN
+    yield port, auth_mod.TOKEN
     server.should_exit = True
     thread.join(timeout=5)
 

backend/tests/test_settings_patch.py

@@ -17,10 +17,10 @@ from backend.main import app
 
 def _auth_headers():
     import backend.auth as auth_mod
-    if not auth_mod._TOKEN:
+    if not auth_mod.TOKEN:
         import secrets
-        auth_mod._TOKEN = secrets.token_urlsafe(32)
-    return {"Authorization": f"Bearer {auth_mod._TOKEN}"}
+        auth_mod.TOKEN = secrets.token_urlsafe(32)
+    return {"Authorization": f"Bearer {auth_mod.TOKEN}"}
 
 
 @pytest.fixture

backend/tests/test_settings_select_and_send.py

@@ -19,9 +19,9 @@ from backend.main import app
 @pytest.fixture
 def client():
     import backend.auth as auth_mod
-    if not auth_mod._TOKEN:
-        auth_mod._TOKEN = secrets.token_urlsafe(32)
-    return TestClient(app, headers={"Authorization": f"Bearer {auth_mod._TOKEN}"})
+    if not auth_mod.TOKEN:
+        auth_mod.TOKEN = secrets.token_urlsafe(32)
+    return TestClient(app, headers={"Authorization": f"Bearer {auth_mod.TOKEN}"})
 
 
 def test_message_endpoint_threads_selected_setting_ids(client, monkeypatch):

backend/tests/test_settings_server_owned.py

@@ -20,10 +20,10 @@ from backend.main import app
 @pytest.fixture
 def client():
     import backend.auth as auth_mod
-    if not auth_mod._TOKEN:
+    if not auth_mod.TOKEN:
         import secrets
-        auth_mod._TOKEN = secrets.token_urlsafe(32)
-    return TestClient(app, headers={"Authorization": f"Bearer {auth_mod._TOKEN}"})
+        auth_mod.TOKEN = secrets.token_urlsafe(32)
+    return TestClient(app, headers={"Authorization": f"Bearer {auth_mod.TOKEN}"})
 
 
 @pytest.fixture

backend/tests/test_skill_registry_community.py

@@ -150,9 +150,9 @@ def test_confirm_install_writes_folder_lists_and_injects(skills_dir, monkeypatch
     from backend.main import app
     from backend.apps.agents.manager.prompt.prompt_context import resolve_attached_skills
     import backend.auth as auth_mod
-    if not auth_mod._TOKEN:
-        auth_mod._TOKEN = p_secrets.token_urlsafe(32)
-    client = TestClient(app, headers={"Authorization": f"Bearer {auth_mod._TOKEN}"})
+    if not auth_mod.TOKEN:
+        auth_mod.TOKEN = p_secrets.token_urlsafe(32)
+    client = TestClient(app, headers={"Authorization": f"Bearer {auth_mod.TOKEN}"})
 
     async def fake_resolve(source, skill_id):
         return {

backend/tests/test_ws_integration.py

@@ -31,7 +31,7 @@ def _result():
 
 
 def test_ws_endpoint_streams_a_full_turn_end_to_end(monkeypatch):
-    monkeypatch.setattr(main_mod, "_ws_auth_ok", lambda ws: True, raising=True)
+    monkeypatch.setattr(main_mod, "p_ws_auth_ok", lambda ws: True, raising=True)
 
     async def fake_query(*args, **kwargs):
         yield _assistant()