test(coverage): batch 9–10 — browser_open, update_memory_md, credentials profiles, cost tracker (tinyhumansai#530)

Add 53 new tests across 4 more modules:
- browser_open: IPv4/IPv6 private ranges, host matching, normalize_domain edges
- update_memory_md: empty file, section creation, unknown action, param validation
- credentials/profiles: token expiry, CRUD operations, active profile management
- cost/tracker: budget warnings, monthly exceeded, model stats aggregation

All 4027 tests pass.

Author: CodeGhost21

src/openhuman/cost/tracker.rs

@@ -533,4 +533,133 @@ mod tests {
             .to_string()
             .contains("Estimated cost must be a finite, non-negative value"));
     }
+
+    #[test]
+    fn invalid_budget_negative_is_rejected() {
+        let tmp = TempDir::new().unwrap();
+        let tracker = CostTracker::new(enabled_config(), tmp.path()).unwrap();
+        assert!(tracker.check_budget(-1.0).is_err());
+    }
+
+    #[test]
+    fn invalid_budget_infinity_is_rejected() {
+        let tmp = TempDir::new().unwrap();
+        let tracker = CostTracker::new(enabled_config(), tmp.path()).unwrap();
+        assert!(tracker.check_budget(f64::INFINITY).is_err());
+    }
+
+    #[test]
+    fn record_usage_when_disabled_is_noop() {
+        let tmp = TempDir::new().unwrap();
+        let config = CostConfig {
+            enabled: false,
+            ..Default::default()
+        };
+        let tracker = CostTracker::new(config, tmp.path()).unwrap();
+        let usage = TokenUsage::new("test/model", 1000, 500, 1.0, 2.0);
+        tracker.record_usage(usage).unwrap();
+        let summary = tracker.get_summary().unwrap();
+        assert_eq!(summary.request_count, 0);
+    }
+
+    #[test]
+    fn record_usage_rejects_negative_cost() {
+        let tmp = TempDir::new().unwrap();
+        let tracker = CostTracker::new(enabled_config(), tmp.path()).unwrap();
+        let mut usage = TokenUsage::new("test/model", 1000, 500, 1.0, 2.0);
+        usage.cost_usd = -1.0;
+        assert!(tracker.record_usage(usage).is_err());
+    }
+
+    #[test]
+    fn record_usage_rejects_nan_cost() {
+        let tmp = TempDir::new().unwrap();
+        let tracker = CostTracker::new(enabled_config(), tmp.path()).unwrap();
+        let mut usage = TokenUsage::new("test/model", 1000, 500, 1.0, 2.0);
+        usage.cost_usd = f64::NAN;
+        assert!(tracker.record_usage(usage).is_err());
+    }
+
+    #[test]
+    fn budget_warning_threshold() {
+        let tmp = TempDir::new().unwrap();
+        let config = CostConfig {
+            enabled: true,
+            daily_limit_usd: 10.0,
+            warn_at_percent: 80,
+            monthly_limit_usd: 1000.0,
+            ..Default::default()
+        };
+        let tracker = CostTracker::new(config, tmp.path()).unwrap();
+
+        // Record usage just under warning threshold (80% of 10 = 8.0)
+        let usage = TokenUsage::new("test/model", 100000, 50000, 1.0, 2.0);
+        // This has a cost, so let's just check the budget with a projected amount
+        let check = tracker.check_budget(8.5).unwrap();
+        assert!(
+            matches!(check, BudgetCheck::Warning { .. }),
+            "expected warning, got {check:?}"
+        );
+    }
+
+    #[test]
+    fn budget_monthly_exceeded() {
+        let tmp = TempDir::new().unwrap();
+        let config = CostConfig {
+            enabled: true,
+            daily_limit_usd: 1000.0,
+            monthly_limit_usd: 0.01,
+            ..Default::default()
+        };
+        let tracker = CostTracker::new(config, tmp.path()).unwrap();
+
+        let usage = TokenUsage::new("test/model", 10000, 5000, 1.0, 2.0);
+        tracker.record_usage(usage).unwrap();
+
+        let check = tracker.check_budget(0.01).unwrap();
+        assert!(matches!(
+            check,
+            BudgetCheck::Exceeded {
+                period: UsagePeriod::Month,
+                ..
+            }
+        ));
+    }
+
+    #[test]
+    fn get_daily_cost_for_today() {
+        let tmp = TempDir::new().unwrap();
+        let tracker = CostTracker::new(enabled_config(), tmp.path()).unwrap();
+        let usage = TokenUsage::new("test/model", 1000, 500, 1.0, 2.0);
+        tracker.record_usage(usage.clone()).unwrap();
+
+        let today_cost = tracker.get_daily_cost(Utc::now().date_naive()).unwrap();
+        assert!((today_cost - usage.cost_usd).abs() < 0.001);
+    }
+
+    #[test]
+    fn get_monthly_cost_for_current_month() {
+        let tmp = TempDir::new().unwrap();
+        let tracker = CostTracker::new(enabled_config(), tmp.path()).unwrap();
+        let usage = TokenUsage::new("test/model", 1000, 500, 1.0, 2.0);
+        tracker.record_usage(usage.clone()).unwrap();
+
+        let now = Utc::now();
+        let monthly_cost = tracker.get_monthly_cost(now.year(), now.month()).unwrap();
+        assert!((monthly_cost - usage.cost_usd).abs() < 0.001);
+    }
+
+    #[test]
+    fn build_session_model_stats_aggregates_correctly() {
+        let records = vec![
+            CostRecord::new("s1", TokenUsage::new("model-a", 100, 50, 1.0, 1.0)),
+            CostRecord::new("s1", TokenUsage::new("model-a", 200, 100, 1.0, 1.0)),
+            CostRecord::new("s1", TokenUsage::new("model-b", 300, 150, 1.0, 1.0)),
+        ];
+        let stats = build_session_model_stats(&records);
+        assert_eq!(stats.len(), 2);
+        assert_eq!(stats["model-a"].request_count, 2);
+        assert_eq!(stats["model-a"].total_tokens, 450);
+        assert_eq!(stats["model-b"].request_count, 1);
+    }
 }

src/openhuman/credentials/profiles.rs

@@ -681,4 +681,167 @@ mod tests {
         let contents = tokio::fs::read_to_string(path).await.unwrap();
         assert!(contents.contains("\"schema_version\": 1"));
     }
+
+    #[test]
+    fn token_set_not_expiring_when_no_expiry() {
+        let token_set = TokenSet {
+            access_token: "token".into(),
+            refresh_token: None,
+            id_token: None,
+            expires_at: None,
+            token_type: None,
+            scope: None,
+        };
+        assert!(!token_set.is_expiring_within(Duration::from_secs(3600)));
+    }
+
+    #[test]
+    fn auth_profile_new_token() {
+        let profile = AuthProfile::new_token("anthropic", "default", "sk-abc".into());
+        assert_eq!(profile.provider, "anthropic");
+        assert_eq!(profile.profile_name, "default");
+        assert_eq!(profile.kind, AuthProfileKind::Token);
+        assert_eq!(profile.token.as_deref(), Some("sk-abc"));
+        assert!(profile.token_set.is_none());
+    }
+
+    #[test]
+    fn auth_profile_new_oauth() {
+        let ts = TokenSet {
+            access_token: "access".into(),
+            refresh_token: Some("refresh".into()),
+            id_token: None,
+            expires_at: None,
+            token_type: None,
+            scope: None,
+        };
+        let profile = AuthProfile::new_oauth("openai", "work", ts);
+        assert_eq!(profile.kind, AuthProfileKind::OAuth);
+        assert!(profile.token_set.is_some());
+        assert!(profile.token.is_none());
+    }
+
+    #[test]
+    fn auth_profiles_data_default() {
+        let data = AuthProfilesData::default();
+        assert_eq!(data.schema_version, CURRENT_SCHEMA_VERSION);
+        assert!(data.profiles.is_empty());
+        assert!(data.active_profiles.is_empty());
+    }
+
+    #[test]
+    fn remove_nonexistent_profile_returns_false() {
+        let tmp = TempDir::new().unwrap();
+        let store = AuthProfilesStore::new(tmp.path(), false);
+        let result = store.remove_profile("nonexistent:id").unwrap();
+        assert!(!result);
+    }
+
+    #[test]
+    fn remove_existing_profile_returns_true() {
+        let tmp = TempDir::new().unwrap();
+        let store = AuthProfilesStore::new(tmp.path(), false);
+        let profile = AuthProfile::new_token("test", "default", "tok".into());
+        let id = profile.id.clone();
+        store.upsert_profile(profile, true).unwrap();
+
+        let removed = store.remove_profile(&id).unwrap();
+        assert!(removed);
+
+        let data = store.load().unwrap();
+        assert!(!data.profiles.contains_key(&id));
+        assert!(!data.active_profiles.values().any(|v| v == &id));
+    }
+
+    #[test]
+    fn set_active_profile_errors_for_missing_profile() {
+        let tmp = TempDir::new().unwrap();
+        let store = AuthProfilesStore::new(tmp.path(), false);
+        let err = store
+            .set_active_profile("openai", "missing:id")
+            .unwrap_err();
+        assert!(err.to_string().contains("not found"));
+    }
+
+    #[test]
+    fn set_active_profile_succeeds_for_existing_profile() {
+        let tmp = TempDir::new().unwrap();
+        let store = AuthProfilesStore::new(tmp.path(), false);
+        let profile = AuthProfile::new_token("openai", "prod", "tok".into());
+        let id = profile.id.clone();
+        store.upsert_profile(profile, false).unwrap();
+
+        store.set_active_profile("openai", &id).unwrap();
+        let data = store.load().unwrap();
+        assert_eq!(data.active_profiles.get("openai"), Some(&id));
+    }
+
+    #[test]
+    fn clear_active_profile() {
+        let tmp = TempDir::new().unwrap();
+        let store = AuthProfilesStore::new(tmp.path(), false);
+        let profile = AuthProfile::new_token("openai", "prod", "tok".into());
+        store.upsert_profile(profile, true).unwrap();
+
+        store.clear_active_profile("openai").unwrap();
+        let data = store.load().unwrap();
+        assert!(data.active_profiles.get("openai").is_none());
+    }
+
+    #[test]
+    fn update_profile_modifies_in_place() {
+        let tmp = TempDir::new().unwrap();
+        let store = AuthProfilesStore::new(tmp.path(), false);
+        let profile = AuthProfile::new_token("openai", "prod", "tok".into());
+        let id = profile.id.clone();
+        store.upsert_profile(profile, false).unwrap();
+
+        let updated = store
+            .update_profile(&id, |p| {
+                p.metadata.insert("env".into(), "staging".into());
+                Ok(())
+            })
+            .unwrap();
+        assert_eq!(
+            updated.metadata.get("env").map(|s| s.as_str()),
+            Some("staging")
+        );
+    }
+
+    #[test]
+    fn update_profile_errors_for_missing_id() {
+        let tmp = TempDir::new().unwrap();
+        let store = AuthProfilesStore::new(tmp.path(), false);
+        let err = store.update_profile("missing:id", |_| Ok(())).unwrap_err();
+        assert!(err.to_string().contains("not found"));
+    }
+
+    #[test]
+    fn upsert_preserves_created_at_on_update() {
+        let tmp = TempDir::new().unwrap();
+        let store = AuthProfilesStore::new(tmp.path(), false);
+        let profile = AuthProfile::new_token("openai", "prod", "tok1".into());
+        let id = profile.id.clone();
+        let created = profile.created_at;
+        store.upsert_profile(profile, false).unwrap();
+
+        std::thread::sleep(Duration::from_millis(10));
+        let updated = AuthProfile::new_token("openai", "prod", "tok2".into());
+        store.upsert_profile(updated, false).unwrap();
+
+        let data = store.load().unwrap();
+        let loaded = data.profiles.get(&id).unwrap();
+        assert_eq!(loaded.created_at, created);
+    }
+
+    #[test]
+    fn auth_profile_kind_serde_roundtrip() {
+        let json = serde_json::to_string(&AuthProfileKind::OAuth).unwrap();
+        assert_eq!(json, "\"o-auth\""); // kebab-case
+        let back: AuthProfileKind = serde_json::from_str(&json).unwrap();
+        assert_eq!(back, AuthProfileKind::OAuth);
+
+        let json = serde_json::to_string(&AuthProfileKind::Token).unwrap();
+        assert_eq!(json, "\"token\"");
+    }
 }