fix(ci): resolve 3 remaining scheduler/dolt test failures

Fix #1 — TestBuildDoltSQLCmd_LocalIgnoresInheritedCredentials
  buildDoltSQLCmd was appending "DOLT_CLI_PASSWORD=" onto os.Environ(),
  leaving an inherited shell value already in the slice. Strip the key from
  os.Environ() first via a new filterEnvKey helper so the single canonical
  entry we append is the only one in cmd.Env.

Fix #2 — TestSchedulerAutoConvoyCreation
  Two bugs:
   - Test setup didn't register the literal "hq-cv-" route, so bd show from
     hq couldn't resolve convoy IDs. Add the route in setupSchedulerIntegrationTown
     and setupMultiRigSchedulerTown, matching what gt install does.
   - Test passed --allow-stale as a subcommand flag; it's a global flag.
     Use beads.MaybePrependAllowStale so it lands before the subcommand.

Fix #3 — TestSchedulerSlingContextIdempotency
  listAllSlingContexts iterated every dir from beadsSearchDirs without
  deduping. In the test fixture, testrig/.beads is a redirect file
  pointing to testrig/mayor/rig/.beads, so both paths yielded the same
  underlying beads DB and the same context was counted twice. Dedupe by
  context ID so redirects (and any future aliasing) can't inflate counts.

Author: steveyegge

internal/cmd/capacity_dispatch.go

@@ -489,15 +489,26 @@ func recordDispatchFailure(townBeads *beads.Beads, b capacity.PendingBead, dispa
 // (GH#3468), so we scan HQ plus all rig dirs.
 // Used by scheduler list/status/clear, cleanupStaleContexts, and areScheduled.
 // Does NOT filter by readiness or circuit breaker.
+//
+// Deduplicates by context ID: different search dirs can resolve to the same
+// underlying beads DB (e.g., when a rig's top-level .beads is a redirect to
+// mayor/rig/.beads), and both paths would otherwise return the same contexts.
 func listAllSlingContexts(townRoot string) []*beads.Issue {
 	var all []*beads.Issue
+	seen := make(map[string]bool)
 	for _, dir := range beadsSearchDirs(townRoot) {
 		b := beads.NewWithBeadsDir(dir, beads.ResolveBeadsDir(dir))
 		contexts, err := b.ListOpenSlingContexts()
 		if err != nil {
 			continue // Partial failure is acceptable — skip unavailable dirs
 		}
-		all = append(all, contexts...)
+		for _, ctx := range contexts {
+			if seen[ctx.ID] {
+				continue
+			}
+			seen[ctx.ID] = true
+			all = append(all, ctx)
+		}
 	}
 	return all
 }

internal/cmd/scheduler_integration_test.go

@@ -140,6 +140,10 @@ func setupSchedulerIntegrationTown(t *testing.T) (hqPath, rigPath, gtBinary stri
 	routes := []beads.Route{
 		{Prefix: hqPrefix + "-", Path: "."},
 		{Prefix: rigPrefix + "-", Path: "testrig/mayor/rig"},
+		// Convoy beads use a literal "hq-cv-" prefix (see install.go — registered
+		// on real towns during `gt install`). Route them to HQ so tests that
+		// look up auto-convoys via `bd show` resolve correctly.
+		{Prefix: "hq-cv-", Path: "."},
 	}
 	if err := beads.WriteRoutes(townBeadsDir, routes); err != nil {
 		t.Fatalf("write routes: %v", err)
@@ -298,12 +302,14 @@ func TestSchedulerAutoConvoyCreation(t *testing.T) {
 		t.Fatalf("convoy ID not stored in sling context")
 	}
 
-	// Verify: convoy is resolvable via bd show from hq
-	cmd := exec.Command("bd", "show", fields.Convoy, "--json", "--allow-stale")
+	// Verify: convoy is resolvable via bd show from hq.
+	// --allow-stale is a global flag: must come before the subcommand.
+	showArgs := beads.MaybePrependAllowStale([]string{"show", fields.Convoy, "--json"})
+	cmd := exec.Command("bd", showArgs...)
 	cmd.Dir = hqPath
-	out, err := cmd.Output()
+	out, err := cmd.CombinedOutput()
 	if err != nil {
-		t.Fatalf("bd show convoy %s failed: %v", fields.Convoy, err)
+		t.Fatalf("bd show convoy %s failed: %v\noutput: %s", fields.Convoy, err, out)
 	}
 	var convoys []struct {
 		ID        string `json:"id"`
@@ -579,6 +585,8 @@ func setupMultiRigSchedulerTown(t *testing.T) (hqPath, rig1Path, rig2Path, gtBin
 		{Prefix: hqPrefix + "-", Path: "."},
 		{Prefix: rig1Prefix + "-", Path: "rig1/mayor/rig"},
 		{Prefix: rig2Prefix + "-", Path: "rig2/mayor/rig"},
+		// Convoy beads use a literal "hq-cv-" prefix (see install.go).
+		{Prefix: "hq-cv-", Path: "."},
 	}
 	if err := beads.WriteRoutes(townBeadsDir, routes); err != nil {
 		t.Fatalf("write routes: %v", err)

internal/daemon/dolt.go

@@ -274,21 +274,37 @@ func (m *DoltServerManager) buildDoltSQLCmd(ctx context.Context, args ...string)
 	// For remote checks, preserve inherited credentials if config omits a
 	// password. For local checks, keep forcing the empty-password path so
 	// inherited shell credentials cannot make a healthy local server look broken.
+	// Strip any inherited DOLT_CLI_PASSWORD from os.Environ() first so the
+	// single canonical value we append wins unambiguously — duplicate keys in
+	// cmd.Env leak credentials into local checks (tests grep cmd.Env directly).
+	env := filterEnvKey(os.Environ(), "DOLT_CLI_PASSWORD")
 	if m.config.Password != "" {
-		cmd.Env = append(os.Environ(), "DOLT_CLI_PASSWORD="+m.config.Password)
+		cmd.Env = append(env, "DOLT_CLI_PASSWORD="+m.config.Password)
 	} else if m.isRemote() {
 		if inherited, ok := os.LookupEnv("DOLT_CLI_PASSWORD"); ok {
-			cmd.Env = append(os.Environ(), "DOLT_CLI_PASSWORD="+inherited)
+			cmd.Env = append(env, "DOLT_CLI_PASSWORD="+inherited)
 		} else {
-			cmd.Env = append(os.Environ(), "DOLT_CLI_PASSWORD=")
+			cmd.Env = append(env, "DOLT_CLI_PASSWORD=")
 		}
 	} else {
-		cmd.Env = append(os.Environ(), "DOLT_CLI_PASSWORD=")
+		cmd.Env = append(env, "DOLT_CLI_PASSWORD=")
 	}
 
 	return cmd
 }
 
+// filterEnvKey returns env with all entries matching "<key>=..." removed.
+func filterEnvKey(env []string, key string) []string {
+	prefix := key + "="
+	out := make([]string, 0, len(env))
+	for _, e := range env {
+		if !strings.HasPrefix(e, prefix) {
+			out = append(out, e)
+		}
+	}
+	return out
+}
+
 // HealthCheckInterval returns the configured health check interval,
 // falling back to DefaultDoltHealthCheckInterval if not explicitly set.
 func (m *DoltServerManager) HealthCheckInterval() time.Duration {