feat: add kiro.rs connection preflight test

tests/background-account-history-settings.test.js

@@ -278,7 +278,7 @@ return {
   assert.equal(api.normalizePersistentSettingValue('activeFlowId', 'kiro'), 'kiro');
   assert.equal(api.normalizePersistentSettingValue('kiroTargetId', 'unknown'), 'kiro-rs');
   assert.equal(api.normalizePersistentSettingValue('kiroRsUrl', ''), 'https://kiro.leftcode.xyz/admin');
-  assert.equal(api.normalizePersistentSettingValue('kiroRsKey', ' key-1 '), ' key-1 ');
+  assert.equal(api.normalizePersistentSettingValue('kiroRsKey', ' key-1 '), 'key-1');
   assert.equal(api.normalizePersistentSettingValue('phoneSmsProvider', '5SIM'), '5sim');
   assert.equal(api.normalizePersistentSettingValue('phoneSmsProvider', 'NEXSMS'), 'nexsms');
   assert.equal(api.normalizePersistentSettingValue('phoneSmsProvider', 'unknown'), 'hero-sms');

tests/background-kiro-publisher-kiro-rs-module.test.js

@@ -112,6 +112,7 @@ test('kiro publisher reads latest kiro.rs key from background state instead of s
         url,
         method: options.method || 'GET',
         apiKey: options.headers?.['x-api-key'],
+        authorization: options.headers?.Authorization,
       });
       if ((options.method || 'GET') === 'GET') {
         return {
@@ -158,7 +159,45 @@ test('kiro publisher reads latest kiro.rs key from background state instead of s
 
   assert.equal(requests.length, 2);
   assert.equal(requests[0].apiKey, 'live-key');
+  assert.equal(requests[0].authorization, 'Bearer live-key');
   assert.equal(requests[1].apiKey, 'live-key');
+  assert.equal(requests[1].authorization, 'Bearer live-key');
   assert.equal(completed.length, 1);
   assert.equal(completed[0].nodeId, 'kiro-upload-credential');
 });
+
+test('kiro publisher trims api key and includes fallback Authorization header during connection check', async () => {
+  const api = loadPublisherApi();
+  const requests = [];
+
+  const result = await api.checkKiroRsConnection(
+    'https://kiro.example.com/admin',
+    ' live-key ',
+    async (url, options = {}) => {
+      requests.push({
+        url,
+        method: options.method || 'GET',
+        apiKey: options.headers?.['x-api-key'],
+        authorization: options.headers?.Authorization,
+      });
+      return {
+        ok: false,
+        status: 401,
+        statusText: 'Unauthorized',
+        text: async () => JSON.stringify({
+          error: {
+            message: 'Invalid or missing admin API key',
+          },
+        }),
+      };
+    }
+  );
+
+  assert.equal(requests.length, 1);
+  assert.equal(requests[0].method, 'GET');
+  assert.equal(requests[0].apiKey, 'live-key');
+  assert.equal(requests[0].authorization, 'Bearer live-key');
+  assert.equal(result.ok, false);
+  assert.equal(result.status, 401);
+  assert.equal(result.message, 'kiro.rs API Key 被拒绝（HTTP 401：Invalid or missing admin API key）');
+});

tests/background-message-router-module.test.js

@@ -449,6 +449,63 @@ test('SAVE_SETTING syncs canonical kiro settingsState back into session state',
   assert.equal(state.settingsState.flows.kiro.targets['kiro-rs'].apiKey, 'live-key');
 });
 
+test('CHECK_KIRO_RS_CONNECTION prefers current sidepanel payload over stale saved kiro.rs config', async () => {
+  const source = fs.readFileSync('background/message-router.js', 'utf8');
+  const globalScope = { console };
+  const api = new Function('self', `${source}; return self.MultiPageBackgroundMessageRouter;`)(globalScope);
+  const calls = [];
+  const router = api.createMessageRouter({
+    getState: async () => ({
+      activeFlowId: 'kiro',
+      flowId: 'kiro',
+      kiroTargetId: 'kiro-rs',
+      kiroRsUrl: 'https://old.example.com/admin',
+      kiroRsKey: 'old-key',
+      settingsState: {
+        flows: {
+          kiro: {
+            targetId: 'kiro-rs',
+            targets: {
+              'kiro-rs': {
+                baseUrl: 'https://old.example.com/admin',
+                apiKey: 'old-key',
+              },
+            },
+          },
+        },
+      },
+    }),
+    testKiroRsConnection: async (baseUrl, apiKey) => {
+      calls.push({ baseUrl, apiKey });
+      return {
+        ok: false,
+        status: 401,
+        message: 'kiro.rs API Key 被拒绝（HTTP 401：Invalid or missing admin API key）',
+      };
+    },
+  });
+
+  const response = await router.handleMessage({
+    type: 'CHECK_KIRO_RS_CONNECTION',
+    payload: {
+      activeFlowId: 'kiro',
+      targetId: 'kiro-rs',
+      baseUrl: ' https://new.example.com/admin/ ',
+      apiKey: ' new-key ',
+    },
+  });
+
+  assert.equal(response.ok, false);
+  assert.equal(response.status, 401);
+  assert.equal(response.message, 'kiro.rs API Key 被拒绝（HTTP 401：Invalid or missing admin API key）');
+  assert.deepStrictEqual(calls, [
+    {
+      baseUrl: 'https://new.example.com/admin/',
+      apiKey: ' new-key ',
+    },
+  ]);
+});
+
 test('AUTO_RUN applies current flow selection from payload before starting loop', async () => {
   const source = fs.readFileSync('background/message-router.js', 'utf8');
   const globalScope = { console };

tests/sidepanel-flow-source-registry.test.js

@@ -40,6 +40,8 @@ test('sidepanel html exposes flow selector and kiro source fields', () => {
     'id="row-step6-cookie-settings"',
     'id="row-kiro-rs-url"',
     'id="row-kiro-rs-key"',
+    'id="btn-test-kiro-rs"',
+    'id="row-kiro-rs-test-status"',
     'id="row-kiro-device-code"',
     'id="row-kiro-login-url"',
     'id="row-kiro-upload-status"',