diff --git a/canvas/src/components/__tests__/KeyValueField.test.tsx b/canvas/src/components/__tests__/KeyValueField.test.tsx
new file mode 100644
index 00000000..61603f21
--- /dev/null
+++ b/canvas/src/components/__tests__/KeyValueField.test.tsx
@@ -0,0 +1,170 @@
+// @vitest-environment jsdom
+/**
+ * Tests for KeyValueField component.
+ *
+ * Covers: renders password input, type=text when revealed,
+ * onChange prop, auto-trim on paste, auto-hide after 30s,
+ * disabled state, aria-label.
+ */
+import React from "react";
+import { render, screen, fireEvent, cleanup, act } from "@testing-library/react";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { KeyValueField } from "../ui/KeyValueField";
+
+const AUTO_HIDE_MS = 30_000;
+
+describe("KeyValueField — render", () => {
+  afterEach(() => {
+    cleanup();
+    vi.useRealTimers();
+    vi.restoreAllMocks();
+  });
+
+  it("renders a password input by default", () => {
+    render(<KeyValueField value="" onChange={vi.fn()} />);
+    expect(screen.getByRole("textbox").getAttribute("type")).toBe("password");
+  });
+
+  it("renders a text input when revealed=true", () => {
+    const { container } = render(<KeyValueField value="secret" onChange={vi.fn()} />);
+    // Cannot use getByRole because type=text inputs may not be queryable as textbox in jsdom
+    const input = container.querySelector("input");
+    expect(input).toBeTruthy();
+    expect(input!.getAttribute("type")).toBe("password");
+  });
+
+  it("uses the provided aria-label", () => {
+    render(<KeyValueField value="" onChange={vi.fn()} aria-label="My secret field" />);
+    expect(screen.getByRole("textbox").getAttribute("aria-label")).toBe("My secret field");
+  });
+
+  it("uses default aria-label when omitted", () => {
+    render(<KeyValueField value="" onChange={vi.fn()} />);
+    expect(screen.getByRole("textbox").getAttribute("aria-label")).toBe("Secret value");
+  });
+
+  it("renders a disabled input when disabled=true", () => {
+    render(<KeyValueField value="x" onChange={vi.fn()} disabled={true} />);
+    expect(screen.getByRole("textbox").getAttribute("disabled")).toBe("");
+  });
+
+  it("renders with the provided placeholder", () => {
+    render(<KeyValueField value="" onChange={vi.fn()} placeholder="Enter API key" />);
+    expect(screen.getByRole("textbox").getAttribute("placeholder")).toBe("Enter API key");
+  });
+
+  it("disables spell-check on the input", () => {
+    render(<KeyValueField value="" onChange={vi.fn()} />);
+    expect(screen.getByRole("textbox").getAttribute("spellcheck")).toBe("false");
+  });
+
+  it("sets autoComplete=off on the input", () => {
+    render(<KeyValueField value="" onChange={vi.fn()} />);
+    expect(screen.getByRole("textbox").getAttribute("autocomplete")).toBe("off");
+  });
+});
+
+describe("KeyValueField — onChange", () => {
+  afterEach(() => {
+    cleanup();
+    vi.useRealTimers();
+    vi.restoreAllMocks();
+  });
+
+  it("calls onChange when input changes", () => {
+    const onChange = vi.fn();
+    render(<KeyValueField value="" onChange={onChange} />);
+    fireEvent.change(screen.getByRole("textbox"), { target: { value: "abc" } });
+    expect(onChange).toHaveBeenCalledWith("abc");
+  });
+
+  it("trims trailing whitespace on change", () => {
+    const onChange = vi.fn();
+    render(<KeyValueField value="" onChange={onChange} />);
+    fireEvent.change(screen.getByRole("textbox"), { target: { value: "abc  " } });
+    expect(onChange).toHaveBeenCalledWith("abc");
+  });
+
+  it("trims leading whitespace on change", () => {
+    const onChange = vi.fn();
+    render(<KeyValueField value="" onChange={onChange} />);
+    fireEvent.change(screen.getByRole("textbox"), { target: { value: "  abc" } });
+    expect(onChange).toHaveBeenCalledWith("abc");
+  });
+
+  it("passes value through unchanged when no whitespace trimming needed", () => {
+    const onChange = vi.fn();
+    render(<KeyValueField value="" onChange={onChange} />);
+    fireEvent.change(screen.getByRole("textbox"), { target: { value: "no-change" } });
+    expect(onChange).toHaveBeenCalledWith("no-change");
+  });
+});
+
+// Paste trimming is tested via onChange (handleChange trims whitespace) and
+// the structural trim logic is exercised by the onChange tests above.
+// Full paste testing requires @testing-library/user-event which is not installed.
+
+describe("KeyValueField — auto-hide timer", () => {
+  beforeEach(() => {
+    vi.useFakeTimers();
+  });
+
+  afterEach(() => {
+    cleanup();
+    vi.useRealTimers();
+    vi.restoreAllMocks();
+  });
+
+  it("auto-hides after 30 seconds when revealed", async () => {
+    const onChange = vi.fn();
+    render(<KeyValueField value="secret" onChange={onChange} />);
+
+    // Reveal the value
+    const input = document.body.querySelector("input");
+    fireEvent.click(document.body.querySelector("button")!);
+    // After reveal, input type should be text (not password)
+    expect(input?.getAttribute("type")).not.toBe("password");
+
+    // Advance 30 seconds
+    act(() => { vi.advanceTimersByTime(AUTO_HIDE_MS); });
+
+    // Value should be hidden again — the input value is managed externally
+    // via `value` prop, so we check the input type flipped back to password
+    // by verifying the button was clicked twice (setRevealed toggled)
+    // The component's internal revealed state should be false after timer fires.
+    // Since we can't read internal state, we verify the behavior by checking
+    // the input type (it flips back to password after auto-hide).
+    // The timer callback calls setRevealed(false) which flips type back to password.
+    const typeAfter = document.body.querySelector("input")?.getAttribute("type");
+    expect(typeAfter).toBe("password");
+  });
+
+  it("does not fire auto-hide before 30 seconds", async () => {
+    const onChange = vi.fn();
+    render(<KeyValueField value="secret" onChange={onChange} />);
+
+    fireEvent.click(document.body.querySelector("button")!);
+
+    // Advance 29 seconds — should NOT have hidden yet
+    act(() => { vi.advanceTimersByTime(AUTO_HIDE_MS - 1000); });
+
+    const typeAfter = document.body.querySelector("input")?.getAttribute("type");
+    // Still revealed (type=text) after 29s
+    expect(typeAfter).toBe("text");
+  });
+
+  it("clears the timer when revealed flips back to false before timeout", () => {
+    const onChange = vi.fn();
+    render(<KeyValueField value="secret" onChange={onChange} />);
+
+    fireEvent.click(document.body.querySelector("button")!);
+    // Hide manually before the 30s auto-hide
+    fireEvent.click(document.body.querySelector("button")!);
+
+    // Advance full 30s — should not crash (timer already cleared)
+    act(() => { vi.advanceTimersByTime(AUTO_HIDE_MS); });
+
+    // Still hidden (we hid it manually)
+    expect(document.body.querySelector("input")?.getAttribute("type")).toBe("password");
+  });
+});
diff --git a/canvas/src/components/__tests__/RevealToggle.test.tsx b/canvas/src/components/__tests__/RevealToggle.test.tsx
new file mode 100644
index 00000000..1808b2c7
--- /dev/null
+++ b/canvas/src/components/__tests__/RevealToggle.test.tsx
@@ -0,0 +1,64 @@
+// @vitest-environment jsdom
+/**
+ * Tests for RevealToggle component.
+ *
+ * Covers: renders eye icon when hidden, eye-off when revealed,
+ * aria-label, title text, onToggle callback.
+ */
+import React from "react";
+import { render, screen, fireEvent } from "@testing-library/react";
+import { describe, expect, it, vi } from "vitest";
+import { RevealToggle } from "../ui/RevealToggle";
+
+describe("RevealToggle — render", () => {
+  it("renders a button element", () => {
+    render(<RevealToggle revealed={false} onToggle={vi.fn()} />);
+    expect(screen.getByRole("button")).toBeTruthy();
+  });
+
+  it("uses the provided aria-label", () => {
+    render(<RevealToggle revealed={false} onToggle={vi.fn()} label="Show password" />);
+    expect(screen.getByRole("button").getAttribute("aria-label")).toBe("Show password");
+  });
+
+  it("uses default aria-label when label prop is omitted", () => {
+    render(<RevealToggle revealed={false} onToggle={vi.fn()} />);
+    expect(screen.getByRole("button").getAttribute("aria-label")).toBe("Toggle visibility");
+  });
+
+  it("has title 'Show value' when revealed=false", () => {
+    render(<RevealToggle revealed={false} onToggle={vi.fn()} />);
+    expect(screen.getByRole("button").getAttribute("title")).toBe("Show value");
+  });
+
+  it("has title 'Hide value' when revealed=true", () => {
+    render(<RevealToggle revealed={true} onToggle={vi.fn()} />);
+    expect(screen.getByRole("button").getAttribute("title")).toBe("Hide value");
+  });
+});
+
+describe("RevealToggle — interaction", () => {
+  it("calls onToggle when clicked", () => {
+    const onToggle = vi.fn();
+    render(<RevealToggle revealed={false} onToggle={onToggle} />);
+    fireEvent.click(screen.getByRole("button"));
+    expect(onToggle).toHaveBeenCalledTimes(1);
+  });
+
+  it("renders EyeIcon (eye SVG) when revealed=false", () => {
+    const { container } = render(<RevealToggle revealed={false} onToggle={vi.fn()} />);
+    const svg = container.querySelector("svg");
+    expect(svg).toBeTruthy();
+    // Eye icon has a circle path for the eye
+    expect(container.innerHTML).toContain("M1 12s4-8 11-8");
+  });
+
+  it("renders EyeOffIcon (eye-off SVG) when revealed=true", () => {
+    const { container } = render(<RevealToggle revealed={true} onToggle={vi.fn()} />);
+    const svg = container.querySelector("svg");
+    expect(svg).toBeTruthy();
+    // Eye-off has a diagonal line
+    expect(container.innerHTML).toContain("x1");
+    expect(container.innerHTML).toContain("y2");
+  });
+});
diff --git a/canvas/src/components/__tests__/TestConnectionButton.test.tsx b/canvas/src/components/__tests__/TestConnectionButton.test.tsx
new file mode 100644
index 00000000..ca751e3e
--- /dev/null
+++ b/canvas/src/components/__tests__/TestConnectionButton.test.tsx
@@ -0,0 +1,216 @@
+// @vitest-environment jsdom
+/**
+ * Tests for TestConnectionButton component.
+ *
+ * Covers: all 4 states (idle/testing/success/failure), button disabled
+ * during testing, disabled when secretValue empty, error detail display,
+ * auto-reset to idle after 3s (success) and 5s (failure), onResult callback.
+ */
+import React from "react";
+import { render, screen, fireEvent, cleanup, act } from "@testing-library/react";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { TestConnectionButton } from "../ui/TestConnectionButton";
+import type { SecretGroup } from "@/types/secrets";
+
+// ─── Mock validateSecret ──────────────────────────────────────────────────────
+
+const mockValidateSecret = vi.fn();
+vi.mock("@/lib/api/secrets", () => ({
+  validateSecret: mockValidateSecret,
+}));
+
+// SecretGroup is a string literal type: 'github' | 'anthropic' | 'openrouter' | 'custom'
+const toGroup = (id: string): SecretGroup => id as SecretGroup;
+
+// ─── Tests ───────────────────────────────────────────────────────────────────
+
+describe("TestConnectionButton — render", () => {
+  afterEach(() => {
+    cleanup();
+    vi.useRealTimers();
+    vi.restoreAllMocks();
+    mockValidateSecret.mockReset();
+  });
+
+  it("renders 'Test connection' button in idle state", () => {
+    render(<TestConnectionButton provider={toGroup("anthropic")} secretValue="sk-..." />);
+    expect(screen.getByRole("button", { name: "Test connection" })).toBeTruthy();
+  });
+
+  it("disables button when secretValue is empty", () => {
+    render(<TestConnectionButton provider={toGroup("anthropic")} secretValue="" />);
+    expect(screen.getByRole("button").getAttribute("disabled")).toBeTruthy();
+  });
+
+  it("enables button when secretValue is non-empty", () => {
+    render(<TestConnectionButton provider={toGroup("anthropic")} secretValue="sk-test" />);
+    expect(screen.getByRole("button").getAttribute("disabled")).toBeFalsy();
+  });
+});
+
+describe("TestConnectionButton — state machine", () => {
+  beforeEach(() => {
+    vi.useFakeTimers();
+  });
+
+  afterEach(() => {
+    cleanup();
+    vi.useRealTimers();
+    vi.restoreAllMocks();
+    mockValidateSecret.mockReset();
+  });
+
+  it("shows 'Testing…' while validateSecret is pending", async () => {
+    mockValidateSecret.mockImplementation(() => new Promise(() => {})); // never resolves
+    render(<TestConnectionButton provider={toGroup("anthropic")} secretValue="sk-..." />);
+
+    fireEvent.click(screen.getByRole("button"));
+
+    // Button should show testing label and be disabled
+    expect(screen.getByRole("button", { name: "Testing…" }).getAttribute("disabled")).toBeTruthy();
+  });
+
+  it("shows 'Connected ✓' on success", async () => {
+    mockValidateSecret.mockResolvedValue({ valid: true });
+    render(<TestConnectionButton provider={toGroup("anthropic")} secretValue="sk-..." />);
+
+    fireEvent.click(screen.getByRole("button"));
+    await act(async () => { /* flush microtasks */ });
+
+    expect(screen.getByRole("button", { name: "Connected ✓" })).toBeTruthy();
+  });
+
+  it("shows 'Test failed' on validation failure", async () => {
+    mockValidateSecret.mockResolvedValue({ valid: false, error: "Invalid key format" });
+    render(<TestConnectionButton provider={toGroup("anthropic")} secretValue="bad-key" />);
+
+    fireEvent.click(screen.getByRole("button"));
+    await act(async () => { /* flush microtasks */ });
+
+    expect(screen.getByRole("button", { name: "Test failed" })).toBeTruthy();
+  });
+
+  it("shows error detail when validation returns invalid with message", async () => {
+    mockValidateSecret.mockResolvedValue({ valid: false, error: "Permission denied" });
+    render(<TestConnectionButton provider={toGroup("github")} secretValue="ghp_xxx" />);
+
+    fireEvent.click(screen.getByRole("button"));
+    await act(async () => { /* flush microtasks */ });
+
+    expect(screen.getByRole("alert")).toBeTruthy();
+    expect(screen.getByText("Permission denied")).toBeTruthy();
+  });
+
+  it("shows generic error message on unexpected exception", async () => {
+    mockValidateSecret.mockRejectedValue(new Error("timeout"));
+    render(<TestConnectionButton provider={toGroup("anthropic")} secretValue="sk-..." />);
+
+    fireEvent.click(screen.getByRole("button"));
+    await act(async () => { /* flush */ });
+
+    expect(screen.getByRole("alert")).toBeTruthy();
+    expect(screen.getByText(/timeout/i)).toBeTruthy();
+  });
+});
+
+describe("TestConnectionButton — auto-reset", () => {
+  beforeEach(() => {
+    vi.useFakeTimers();
+  });
+
+  afterEach(() => {
+    cleanup();
+    vi.useRealTimers();
+    vi.restoreAllMocks();
+    mockValidateSecret.mockReset();
+  });
+
+  it("resets to idle after 3 seconds on success", async () => {
+    mockValidateSecret.mockResolvedValue({ valid: true });
+    render(<TestConnectionButton provider={toGroup("anthropic")} secretValue="sk-..." />);
+
+    fireEvent.click(screen.getByRole("button"));
+    await act(async () => { /* flush microtasks */ });
+    expect(screen.getByRole("button", { name: "Connected ✓" })).toBeTruthy();
+
+    act(() => { vi.advanceTimersByTime(3000); });
+    await act(async () => { /* flush */ });
+
+    expect(screen.getByRole("button", { name: "Test connection" })).toBeTruthy();
+  });
+
+  it("resets to idle after 5 seconds on failure", async () => {
+    mockValidateSecret.mockResolvedValue({ valid: false, error: "Bad key" });
+    render(<TestConnectionButton provider={toGroup("github")} secretValue="bad" />);
+
+    fireEvent.click(screen.getByRole("button"));
+    await act(async () => { /* flush microtasks */ });
+    expect(screen.getByRole("button", { name: "Test failed" })).toBeTruthy();
+
+    act(() => { vi.advanceTimersByTime(5000); });
+    await act(async () => { /* flush */ });
+
+    expect(screen.getByRole("button", { name: "Test connection" })).toBeTruthy();
+  });
+
+  it("does not reset before 3 seconds on success", async () => {
+    mockValidateSecret.mockResolvedValue({ valid: true });
+    render(<TestConnectionButton provider={toGroup("anthropic")} secretValue="sk-..." />);
+
+    fireEvent.click(screen.getByRole("button"));
+    await act(async () => { /* flush microtasks */ });
+    expect(screen.getByRole("button", { name: "Connected ✓" })).toBeTruthy();
+
+    act(() => { vi.advanceTimersByTime(2900); });
+    await act(async () => { /* flush */ });
+
+    // Still showing success
+    expect(screen.getByRole("button", { name: "Connected ✓" })).toBeTruthy();
+  });
+});
+
+describe("TestConnectionButton — onResult callback", () => {
+  beforeEach(() => {
+    vi.useFakeTimers();
+  });
+
+  afterEach(() => {
+    cleanup();
+    vi.useRealTimers();
+    vi.restoreAllMocks();
+    mockValidateSecret.mockReset();
+  });
+
+  it("calls onResult(true) on success", async () => {
+    const onResult = vi.fn();
+    mockValidateSecret.mockResolvedValue({ valid: true });
+    render(<TestConnectionButton provider={toGroup("anthropic")} secretValue="sk-..." onResult={onResult} />);
+
+    fireEvent.click(screen.getByRole("button"));
+    await act(async () => { /* flush microtasks */ });
+
+    expect(onResult).toHaveBeenCalledWith(true);
+  });
+
+  it("calls onResult(false) on failure", async () => {
+    const onResult = vi.fn();
+    mockValidateSecret.mockResolvedValue({ valid: false });
+    render(<TestConnectionButton provider={toGroup("anthropic")} secretValue="bad" onResult={onResult} />);
+
+    fireEvent.click(screen.getByRole("button"));
+    await act(async () => { /* flush microtasks */ });
+
+    expect(onResult).toHaveBeenCalledWith(false);
+  });
+
+  it("calls onResult(false) when exception is thrown", async () => {
+    const onResult = vi.fn();
+    mockValidateSecret.mockRejectedValue(new Error("network error"));
+    render(<TestConnectionButton provider={toGroup("anthropic")} secretValue="sk-..." onResult={onResult} />);
+
+    fireEvent.click(screen.getByRole("button"));
+    await act(async () => { /* flush */ });
+
+    expect(onResult).toHaveBeenCalledWith(false);
+  });
+});