from data_query_agent.codex_worker import _provider_config


def test_codex_can_read_skills_but_not_project_credentials() -> None:
    provider, config = _provider_config(
        {"provider": "openrouter", "base_url": "https://openrouter.ai/api/v1"}
    )

    assert provider == "openrouter"
    assert config is not None
    assert config["features"]["shell_tool"] is True
    assert config["features"]["unified_exec"] is True
    filesystem = config["permissions"]["skill-reader"]["filesystem"]
    assert filesystem[":workspace_roots"]["."] == "read"
    assert filesystem[":workspace_roots"][".env"] == "deny"
    assert config["permissions"]["skill-reader"]["network"]["enabled"] is False