@agenthippo-ai/agenthippo 0.1.0 → 0.1.1

package/out/test/analytics.test.js

@@ -43,6 +43,7 @@ const os = __importStar(require("os"));
 const fs_1 = require("fs");
 const base_1 = require("../engines/base");
 const sessionEvents_1 = require("../analytics/sessionEvents");
+const credential_context_1 = require("../cli/credential-context");
 async function createUniqueTempDir(prefix) {
     return fs_1.promises.mkdtemp(path.join(os.tmpdir(), prefix));
 }
@@ -522,3 +523,70 @@ suite('Analytics - ObservableStreamEmitter', () => {
         assert.notStrictEqual(reqId1, reqId2, 'Request IDs should be different');
     });
 });
+// =============================================================================
+// ObservableStreamEmitter + credential context (the "warrant" audit trail)
+// =============================================================================
+suite('Analytics - ObservableStreamEmitter records the acting user (the warrant)', () => {
+    let testDir;
+    let writer;
+    let innerEmitter;
+    setup(async () => {
+        testDir = await createUniqueTempDir('agentide-warrant-test-');
+        writer = new sessionEvents_1.SessionEventWriter(testDir);
+        innerEmitter = {
+            async thinking() { },
+            async text() { },
+            async toolStart() { },
+            async toolEnd() { },
+            async progress() { },
+            async question() { return { selected: [], freeText: null }; },
+            async error() { },
+            async done() { },
+        };
+    });
+    teardown(async () => {
+        try {
+            await removeDirWithRetries(testDir);
+        }
+        catch {
+            // ignore
+        }
+    });
+    async function readEvents(sessionId) {
+        const content = await fs_1.promises.readFile(path.join(testDir, `${sessionId}.jsonl`), 'utf8');
+        return content.trim().split('\n').map((l) => JSON.parse(l));
+    }
+    test('toolStart/toolEnd record userId when inside a runWithCredential scope', async () => {
+        const emitter = (0, sessionEvents_1.wrapEmitterWithObservability)(innerEmitter, writer, 'sess-warrant-1', 'req-1');
+        await (0, credential_context_1.runWithCredential)({ userId: 'priya@meridian.com' }, async () => {
+            await emitter.toolStart('Bash', 'echo hi', 'c1');
+            await emitter.toolEnd('Bash', 'c1', 'hi', false);
+        });
+        const events = await readEvents('sess-warrant-1');
+        assert.strictEqual(events.length, 2);
+        assert.strictEqual(events[0].payload.userId, 'priya@meridian.com');
+        assert.strictEqual(events[1].payload.userId, 'priya@meridian.com');
+    });
+    test('toolStart records no userId outside any credential scope (IDE-local usage)', async () => {
+        const emitter = (0, sessionEvents_1.wrapEmitterWithObservability)(innerEmitter, writer, 'sess-warrant-2', 'req-1');
+        await emitter.toolStart('Bash', 'echo hi', 'c1');
+        const events = await readEvents('sess-warrant-2');
+        assert.strictEqual(events[0].payload.userId, undefined);
+    });
+    test('two interleaved turns never attribute a tool call to the wrong user', async () => {
+        const emitter = (0, sessionEvents_1.wrapEmitterWithObservability)(innerEmitter, writer, 'sess-warrant-3', 'req-1');
+        await Promise.all([
+            (0, credential_context_1.runWithCredential)({ userId: 'alice@acme.com' }, async () => {
+                await new Promise((r) => setTimeout(r, 5));
+                await emitter.toolStart('Bash', 'a', 'a1');
+            }),
+            (0, credential_context_1.runWithCredential)({ userId: 'bob@acme.com' }, async () => {
+                await emitter.toolStart('Bash', 'b', 'b1');
+            }),
+        ]);
+        const events = await readEvents('sess-warrant-3');
+        const byCallId = Object.fromEntries(events.map((e) => [e.payload.callId, e.payload.userId]));
+        assert.strictEqual(byCallId['a1'], 'alice@acme.com');
+        assert.strictEqual(byCallId['b1'], 'bob@acme.com');
+    });
+});

package/out/test/auth-broker.test.js

@@ -154,7 +154,10 @@ suite('AuthBroker', () => {
                     code_challenge: (0, pkce_js_1.codeChallengeFromVerifier)((0, pkce_js_1.generateCodeVerifier)()),
                 }),
             });
-            assert.strictEqual(res.status, 500);
+            assert.strictEqual(res.status, 403);
+            const body = await res.json();
+            assert.strictEqual(body.error, 'forbidden');
+            assert.ok(body.error_description?.includes('domain'));
         }
         finally {
             await broker.close();
@@ -198,7 +201,8 @@ suite('AuthBroker', () => {
             assert.strictEqual(refreshRes.status, 200);
             const body = await refreshRes.json();
             assert.strictEqual(body.routing.litellmApiKey, 'ahk_test_key');
-            assert.ok(body.routing.litellmApiKeyExpiresAt);
+            // Static team key — the broker must not fabricate an expiry it can't enforce.
+            assert.strictEqual(body.routing.litellmApiKeyExpiresAt, undefined);
         }
         finally {
             await broker.close();

package/out/test/credential-context.test.js

@@ -41,6 +41,9 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 require("mocha");
 const assert = __importStar(require("assert"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
 const credential_context_1 = require("../cli/credential-context");
 const serve_hardening_1 = require("../cli/serve-hardening");
 suite('credential-context: presence + fail-closed', () => {
@@ -74,6 +77,63 @@ suite('credential-context: presence + fail-closed', () => {
         });
     });
 });
+suite('credential-context: unresolved identity (userId is optional, never a placeholder)', () => {
+    test('no userId, no data token: runs fine, requireUserId throws inside the scope', async () => {
+        const seen = await (0, credential_context_1.runWithCredential)({ userId: undefined }, async () => {
+            assert.throws(() => (0, credential_context_1.requireUserId)(), /fail-closed/);
+            return 'ran';
+        });
+        assert.strictEqual(seen, 'ran');
+    });
+    test('a data token without a verified userId fails closed before the turn runs', async () => {
+        let ran = false;
+        await assert.rejects(() => (0, credential_context_1.runWithCredential)({ userId: undefined, dataToken: 'obo-secret' }, async () => {
+            ran = true;
+        }), /OBO data token present without a verified user/);
+        assert.strictEqual(ran, false, 'fn must never run when the credential fails closed');
+    });
+    test('a data token without userId fails closed even when dataTokenDir would write a file', async () => {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ah-cred-'));
+        try {
+            await assert.rejects(() => (0, credential_context_1.runWithCredential)({ userId: undefined, dataToken: 'obo-secret' }, async () => 'ran', { dataTokenDir: dir }), /fail-closed/);
+            assert.deepStrictEqual(fs.readdirSync(dir), [], 'no token file must be written when fail-closed');
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+    test('onDenied fires with the stable reason code exactly when the credential fails closed', async () => {
+        const denials = [];
+        await assert.rejects(() => (0, credential_context_1.runWithCredential)({ userId: undefined, dataToken: 'obo-secret' }, async () => 'ran', { onDenied: (reason) => { denials.push(reason); } }));
+        assert.deepStrictEqual(denials, [credential_context_1.WARRANT_DENIED_REASON]);
+    });
+    test('onDenied does not fire on any success path (verified user, or no token at all)', async () => {
+        const denials = [];
+        const onDenied = (reason) => { denials.push(reason); };
+        await (0, credential_context_1.runWithCredential)({ userId: 'priya@meridian.com', dataToken: 'tok' }, async () => 'ran', { onDenied });
+        await (0, credential_context_1.runWithCredential)({ userId: undefined }, async () => 'ran', { onDenied });
+        assert.deepStrictEqual(denials, []);
+    });
+    test('a throwing onDenied callback is swallowed — the fail-closed rejection still wins', async () => {
+        await assert.rejects(() => (0, credential_context_1.runWithCredential)({ userId: undefined, dataToken: 'obo-secret' }, async () => 'ran', { onDenied: () => { throw new Error('logging backend is down'); } }), /fail-closed/);
+    });
+    test('a verified userId with a data token still writes the per-turn token file normally', async () => {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ah-cred-'));
+        try {
+            let fileDuringRun;
+            await (0, credential_context_1.runWithCredential)({ userId: 'priya@meridian.com', dataToken: 'obo-secret' }, async () => {
+                fileDuringRun = (0, credential_context_1.currentCredential)()?.dataTokenFile;
+                assert.ok(fileDuringRun, 'dataTokenFile must be set inside the scope');
+                assert.strictEqual(fs.readFileSync(fileDuringRun, 'utf8'), 'obo-secret');
+            }, { dataTokenDir: dir });
+            assert.ok(fileDuringRun);
+            assert.strictEqual(fs.existsSync(fileDuringRun), false, 'token file must be cleaned up after the turn');
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    });
+});
 suite('credential-context: concurrent isolation (the load-bearing property)', () => {
     test('two interleaved turns never see each other\'s user', async () => {
         // Interleave alice and bob with deliberate awaits; each must keep its own identity.

package/out/test/deploy-init.test.js

@@ -115,6 +115,7 @@ suite('deploy-init: renderEnvExample', () => {
         assert.ok(out.includes('OAUTH2_PROXY_REDIRECT_URL='));
         assert.ok(out.includes('OAUTH2_PROXY_REVERSE_PROXY=true'));
         assert.ok(out.includes('AGENTHIPPO_AUTH_JWT_SECRET='));
+        assert.ok(out.includes('AGENTHIPPO_AUTH_DEV=0'), 'AUTH_DEV must default off in generated auth env');
     });
     test('renderAuthEnvExample honors custom hostname', () => {
         const out = (0, deploy_init_1.renderAuthEnvExample)({ hostname: 'agents.example.com' });
@@ -220,7 +221,7 @@ suite('deploy-init: renderTarget produces well-formed artifacts', () => {
         assert.deepStrictEqual(app.user_authorization?.scopes, ['sql']);
         const pkg = JSON.parse(files['package.json']);
         assert.ok(pkg.dependencies['@anthropic-ai/claude-code']);
-        assert.ok(pkg.dependencies['@agenthippo-ai/cli']);
+        assert.ok(pkg.dependencies['@agenthippo-ai/agenthippo']);
     });
     test('YAML artifacts parse', () => {
         assert.doesNotThrow(() => yaml.load((0, deploy_init_1.renderTarget)('vm', CTX)['docker-compose.yml']));
@@ -286,6 +287,11 @@ suite('deploy-init: renderTarget produces well-formed artifacts', () => {
         assert.ok(!caddy.includes('oauth2-proxy:4180') && !caddy.includes('auth-broker:9780') && !caddy.includes('agent:8080'), 'edge Caddyfile must use localhost upstreams, not docker-DNS names');
         assert.ok(caddy.includes('localhost:4180') && caddy.includes('localhost:9780') && caddy.includes('localhost:8090'), 'edge Caddyfile routes to oauth2-proxy / auth-broker / agent on localhost');
         assert.ok(caddy.includes(':{$PORT}') && caddy.includes('auto_https off'), 'Caddy listens on HTTP :$PORT (Cloud Run terminates TLS)');
+        // IDE PKCE authorize must be SSO-gated before the catch-all /oauth/* → broker route.
+        assert.ok(caddy.includes('handle /oauth/authorize {'), 'edge Caddyfile gates /oauth/authorize');
+        assert.ok(/handle \/oauth\/authorize \{[\s\S]*?forward_auth localhost:4180[\s\S]*?copy_headers X-Auth-Request-Email/.test(caddy), '/oauth/authorize forward_auth copies X-Auth-Request-Email via localhost oauth2-proxy');
+        assert.ok(caddy.indexOf('handle /oauth/authorize {') < caddy.indexOf('handle /oauth/* {'), '/oauth/authorize must precede the catch-all /oauth/* handle');
+        assert.ok(caddy.includes('handle /oauth/browser-login {'), 'edge Caddyfile gates /oauth/browser-login');
         // Caddyfile is mounted from a Secret (the deploy script upserts it).
         assert.ok(svc.includes('${SERVICE}-caddyfile'), 'Caddyfile mounted from a secret');
         // auth-broker reuses the agent image (CLI ships `auth-broker`).
@@ -393,6 +399,24 @@ suite('deploy-init: renderTarget produces well-formed artifacts', () => {
         const env = (0, deploy_init_1.renderTarget)('cloudrun', ctx)['.env.example'];
         assert.ok(env.includes('CURSOR_API_KEY='));
     });
+    test('cloudrun IAP paths pin AGENTHIPPO_IDENTITY_HEADER so X-Agent-User cannot spoof identity', () => {
+        // Claude/codex → Spotlight multi-container path (renderCloudrunServiceYaml).
+        const spotlight = (0, deploy_init_1.renderTarget)('cloudrun', CTX);
+        assert.ok(spotlight['service.yaml'].includes('AGENTHIPPO_IDENTITY_HEADER'), 'Spotlight service.yaml must declare AGENTHIPPO_IDENTITY_HEADER');
+        assert.ok(spotlight['cloudrun-deploy.sh'].includes('x-goog-authenticated-user-email'), 'Spotlight deploy script must fill the pin with the IAP header when ENABLE_IAP=1');
+        // Cursor → T1-generic single-container path.
+        const cursorCtx = { ...CTX, engine: 'cursor', model: 'auto', image: 'ghcr.io/agenthippo/runtime:latest-cursor' };
+        const generic = (0, deploy_init_1.renderTarget)('cloudrun', cursorCtx);
+        assert.ok(generic['cloudrun-deploy.sh'].includes('AGENTHIPPO_IDENTITY_HEADER=x-goog-authenticated-user-email'), 'T1-generic deploy script must pin AGENTHIPPO_IDENTITY_HEADER to the IAP header');
+        // Both must skip the pin when ENABLE_IAP=0 (IAP never sets the header then — pinning
+        // unconditionally would make every request resolve to anonymous during bootstrap).
+        assert.ok(spotlight['cloudrun-deploy.sh'].includes('ENABLE_IAP'), 'Spotlight pin must be ENABLE_IAP-conditional');
+        assert.ok(generic['cloudrun-deploy.sh'].includes('IDENTITY_ENV='), 'T1-generic pin must be ENABLE_IAP-conditional');
+    });
+    test('databricks-app pins AGENTHIPPO_IDENTITY_HEADER to x-forwarded-email', () => {
+        const start = (0, deploy_init_1.renderTarget)('databricks-app', CTX)['start.js'];
+        assert.ok(start.includes("AGENTHIPPO_IDENTITY_HEADER: 'x-forwarded-email'"), 'Databricks App start.js must pin identity to the workspace SSO header');
+    });
     test('spcs egress is limited to the model API via one EAI', () => {
         const sql = (0, deploy_init_1.renderTarget)('spcs', CTX)['deploy.sql'];
         assert.ok(sql.includes('api.anthropic.com:443'));
@@ -411,10 +435,17 @@ suite('deploy-init: renderTarget produces well-formed artifacts', () => {
         assert.ok(compose.includes('./www:/srv/www'));
         assert.ok(files['run.sh'].includes('127.0.0.1:8080'));
         assert.ok(files['run-edge-tunnel.sh'].includes('--profile edge --profile tunnel'));
+        assert.ok(files['Caddyfile'].includes('lb_policy header X-Agent-User'));
         assert.ok(files['Caddyfile'].includes('reverse_proxy agent:8080'));
         assert.ok(files['Caddyfile'].includes('{$AGENTHIPPO_PUBLIC_HOSTNAME}'));
         assert.ok(files['Caddyfile'].includes('@health path /health /ready'));
         assert.ok(!files['Caddyfile'].includes('@api path /v1/* /health /ready'));
+        // IDE PKCE authorize must be SSO-gated (oauth2-proxy → X-Auth-Request-Email), not dumped via /oauth/*.
+        const caddy = files['Caddyfile'];
+        assert.ok(caddy.includes('handle /oauth/authorize {'), 'Caddyfile gates /oauth/authorize');
+        assert.ok(/handle \/oauth\/authorize \{[\s\S]*?forward_auth oauth2-proxy:4180[\s\S]*?copy_headers X-Auth-Request-Email/.test(caddy), '/oauth/authorize forward_auth copies X-Auth-Request-Email');
+        assert.ok(caddy.indexOf('handle /oauth/authorize {') < caddy.indexOf('handle /oauth/* {'), '/oauth/authorize must precede the catch-all /oauth/* handle');
+        assert.ok(caddy.includes('handle /oauth/browser-login {'), 'Caddyfile gates /oauth/browser-login');
         assert.ok(files['www/index.html'].includes('<form id="chat">'));
         // In-compose config-file tunnel (the proven-live path): cloudflared container → caddy:80.
         assert.ok(files['cloudflared.yml'].includes('http://caddy:80'), 'in-compose cloudflared reaches Caddy on the docker network');

package/out/test/mcp.test.js

@@ -225,10 +225,26 @@ suite('MCP Server Loading', () => {
             assert.ok(result.includes('[mcp_servers.test-server]'));
             assert.ok(result.includes('command = "node"'));
             assert.ok(result.includes('args = ["/path/to/server.js"]'));
-            assert.ok(result.includes('API_KEY = "secret"'));
+            assert.ok(result.includes('"API_KEY" = "secret"'));
             // No approval line by default — interactive IDE keeps Codex's normal prompts.
             assert.ok(!result.includes('default_tools_approval_mode'));
         });
+        test('env keys are quoted so names with dots/spaces stay valid TOML', () => {
+            const servers = [
+                {
+                    name: 'test-server',
+                    label: 'Test Server',
+                    command: 'node',
+                    args: ['s.js'],
+                    env: { 'my.token': 'a', 'NPM CONFIG': 'b' },
+                },
+            ];
+            const result = (0, mcp_1.generateCodexMcpConfig)(servers);
+            assert.ok(result.includes('"my.token" = "a"'));
+            assert.ok(result.includes('"NPM CONFIG" = "b"'));
+            // A bare (unquoted) dotted key would be misparsed as a nested table.
+            assert.ok(!result.includes('my.token = '));
+        });
         test('autoApprove emits default_tools_approval_mode = "auto" per server', () => {
             const servers = [
                 { name: 'stdio-srv', label: 's', command: 'node', args: ['s.js'] },

package/out/test/serve-hardening.test.js

@@ -83,6 +83,18 @@ suite('serve-hardening: clientIp', () => {
     test('uses the right-most XFF entry (the IP the trusted proxy observed)', () => {
         assert.strictEqual((0, serve_hardening_1.clientIp)(reqWith({ 'x-forwarded-for': 'evil-spoof, 198.51.100.7' })), '198.51.100.7');
     });
+    test('AGENTHIPPO_XFF_TRUSTED_HOPS=2 skips the tunnel hop (cloudflared → Caddy)', () => {
+        const req = reqWith({ 'x-forwarded-for': '198.51.100.7, 172.18.0.5' });
+        assert.strictEqual((0, serve_hardening_1.clientIp)(req, { AGENTHIPPO_XFF_TRUSTED_HOPS: '2' }), '198.51.100.7');
+    });
+    test('trusted hops beyond the XFF length clamps to the left-most entry', () => {
+        const req = reqWith({ 'x-forwarded-for': '198.51.100.7' });
+        assert.strictEqual((0, serve_hardening_1.clientIp)(req, { AGENTHIPPO_XFF_TRUSTED_HOPS: '5' }), '198.51.100.7');
+    });
+    test('invalid trusted hops falls back to 1', () => {
+        const req = reqWith({ 'x-forwarded-for': 'evil-spoof, 198.51.100.7' });
+        assert.strictEqual((0, serve_hardening_1.clientIp)(req, { AGENTHIPPO_XFF_TRUSTED_HOPS: 'nope' }), '198.51.100.7');
+    });
 });
 suite('serve-hardening: RateLimiter', () => {
     test('allows up to the cap within a window then rejects', () => {
@@ -133,6 +145,16 @@ suite('serve-hardening: resolveUserId', () => {
         assert.strictEqual((0, serve_hardening_1.resolveUserId)({}, undefined), undefined);
         assert.strictEqual((0, serve_hardening_1.resolveUserId)({}, { user_id: '   ' }), undefined);
     });
+    test('AGENTHIPPO_IDENTITY_HEADER pins trust to one header — spoofed aliases are ignored', () => {
+        const env = { AGENTHIPPO_IDENTITY_HEADER: 'x-goog-authenticated-user-email' };
+        // IAP strips X-Goog-* but forwards x-agent-user; pinning must ignore the spoof.
+        const id = (0, serve_hardening_1.resolveUserId)({ 'x-agent-user': 'spoofed@evil.com', 'x-goog-authenticated-user-email': 'accounts.google.com:marco@meridian.com' }, undefined, env);
+        assert.strictEqual(id, 'marco@meridian.com');
+    });
+    test('pinned header absent → fails closed (never the alias list, never the body)', () => {
+        const env = { AGENTHIPPO_IDENTITY_HEADER: 'x-goog-authenticated-user-email' };
+        assert.strictEqual((0, serve_hardening_1.resolveUserId)({ 'x-agent-user': 'spoofed@evil.com' }, { user_id: 'bob' }, env), undefined);
+    });
 });
 suite('serve-hardening: corsHeaders', () => {
     test('always wide-open (serve is always behind a proxy)', () => {
@@ -169,6 +191,91 @@ suite('serve-hardening: TurnLimiter', () => {
         assert.strictEqual(lim.tryConsume('s1'), true);
     });
 });
+suite('serve-hardening: TurnGate', () => {
+    test('runs immediately under the inflight cap', async () => {
+        const gate = new serve_hardening_1.TurnGate(2, 4, 1_000);
+        const a = await gate.acquire();
+        const b = await gate.acquire();
+        assert.ok(a);
+        assert.ok(b);
+        assert.strictEqual(gate.inflight, 2);
+        assert.strictEqual(gate.queued, 0);
+        a();
+        b();
+        assert.strictEqual(gate.inflight, 0);
+    });
+    test('queues when at capacity and wakes FIFO on release', async () => {
+        const gate = new serve_hardening_1.TurnGate(1, 4, 5_000);
+        const first = await gate.acquire();
+        assert.ok(first);
+        assert.strictEqual(gate.inflight, 1);
+        let secondResolved = false;
+        const secondPromise = gate.acquire().then((release) => {
+            secondResolved = true;
+            return release;
+        });
+        // Let the microtask queue settle so the waiter is enqueued.
+        await new Promise((r) => setImmediate(r));
+        assert.strictEqual(secondResolved, false);
+        assert.strictEqual(gate.queued, 1);
+        first();
+        const second = await secondPromise;
+        assert.strictEqual(secondResolved, true);
+        assert.ok(second);
+        assert.strictEqual(gate.inflight, 1);
+        assert.strictEqual(gate.queued, 0);
+        second();
+        assert.strictEqual(gate.inflight, 0);
+    });
+    test('rejects immediately when the queue is full', async () => {
+        const gate = new serve_hardening_1.TurnGate(1, 1, 5_000);
+        const held = await gate.acquire();
+        assert.ok(held);
+        const waiting = gate.acquire(); // fills the single queue slot
+        await new Promise((r) => setImmediate(r));
+        assert.strictEqual(gate.queued, 1);
+        const rejected = await gate.acquire();
+        assert.strictEqual(rejected, null);
+        held();
+        const released = await waiting;
+        assert.ok(released);
+        released();
+    });
+    test('times out a waiter and returns null', async () => {
+        const gate = new serve_hardening_1.TurnGate(1, 4, 30);
+        const held = await gate.acquire();
+        assert.ok(held);
+        const timedOut = await gate.acquire();
+        assert.strictEqual(timedOut, null);
+        assert.strictEqual(gate.queued, 0);
+        held();
+        assert.strictEqual(gate.inflight, 0);
+    });
+    test('zero maxInflight disables the gate', async () => {
+        const gate = new serve_hardening_1.TurnGate(0, 0, 1_000);
+        const releases = [];
+        for (let i = 0; i < 50; i++) {
+            const r = await gate.acquire();
+            assert.ok(r);
+            releases.push(r);
+        }
+        assert.strictEqual(gate.inflight, 0);
+        for (const r of releases) {
+            r();
+        }
+    });
+    test('createTurnGateFromEnv honors env defaults and overrides', () => {
+        const def = (0, serve_hardening_1.createTurnGateFromEnv)({});
+        assert.strictEqual(def.max, 10);
+        const custom = (0, serve_hardening_1.createTurnGateFromEnv)({ AGENTHIPPO_MAX_CONCURRENT_TURNS: '3', AGENTHIPPO_TURN_QUEUE: '7' });
+        assert.strictEqual(custom.max, 3);
+        const disabled = (0, serve_hardening_1.createTurnGateFromEnv)({ AGENTHIPPO_MAX_CONCURRENT_TURNS: '0' });
+        assert.strictEqual(disabled.max, 0);
+    });
+    test('Retry-After constant matches the default queue timeout', () => {
+        assert.strictEqual(serve_hardening_1.TURN_GATE_RETRY_AFTER_SECONDS, 15);
+    });
+});
 function fakeReq(body) {
     const stream = new stream_1.PassThrough();
     stream.end(Buffer.from(body, 'utf8'));

package/out/test/serveClient.test.js

@@ -131,13 +131,14 @@ suite('ServeClient', () => {
         ]);
         try {
             const emitter = createCaptureEmitter();
-            await (0, serveClient_js_1.streamRemoteServeChat)({
+            const result = await (0, serveClient_js_1.streamRemoteServeChat)({
                 baseUrl: mock.url,
                 message: 'ping',
                 sessionId: 'sess-1',
             }, emitter);
             assert.deepStrictEqual(emitter.events.map((e) => e.type), ['thinking', 'text', 'toolStart', 'toolEnd', 'done']);
             assert.strictEqual(emitter.events[1].payload, 'hello');
+            assert.deepStrictEqual(result, { ok: true });
         }
         finally {
             await mock.close();
@@ -156,9 +157,11 @@ suite('ServeClient', () => {
                         throw new Error('bad address');
                     }
                     const emitter = createCaptureEmitter();
-                    await (0, serveClient_js_1.streamRemoteServeChat)({ baseUrl: `http://127.0.0.1:${address.port}`, message: 'ping' }, emitter);
+                    const result = await (0, serveClient_js_1.streamRemoteServeChat)({ baseUrl: `http://127.0.0.1:${address.port}`, message: 'ping' }, emitter);
                     assert.deepStrictEqual(emitter.events.map((e) => e.type), ['error', 'done']);
                     assert.strictEqual(emitter.events[0].payload, 'Unauthorized');
+                    // The turn failed: the caller must be able to see it (not record success).
+                    assert.deepStrictEqual(result, { ok: false, error: 'Unauthorized' });
                     resolve();
                 }
                 catch (err) {

package/out/test/state-sync-peer.test.js

@@ -1,6 +1,6 @@
 "use strict";
 /*---------------------------------------------------------------------------------------------
- *  Tests for serve-v3 #2 (S3 state config) and #4 (PeerInfo → user_id).
+ *  Tests for serve-v3 #2 (S3 state config), #4 (PeerInfo → user_id), and serve-v4 P1.2.
  *--------------------------------------------------------------------------------------------*/
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -38,6 +38,9 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 require("mocha");
 const assert = __importStar(require("assert"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
 const state_sync_1 = require("../cli/state-sync");
 const serve_hardening_1 = require("../cli/serve-hardening");
 suite('state-sync: resolveS3StateConfig', () => {
@@ -53,6 +56,72 @@ suite('state-sync: resolveS3StateConfig', () => {
         assert.strictEqual(c?.endpoint, 'http://minio:9000');
     });
 });
+suite('state-sync: restore boot mode', () => {
+    test('defaults to all', () => {
+        assert.strictEqual((0, state_sync_1.resolveRestoreBootMode)({}), 'all');
+    });
+    test('none when set', () => {
+        assert.strictEqual((0, state_sync_1.resolveRestoreBootMode)({ AGENTHIPPO_STATE_RESTORE_BOOT: 'none' }), 'none');
+    });
+});
+suite('state-sync: session id helpers', () => {
+    test('safeSessionId strips path chars', () => {
+        assert.strictEqual((0, state_sync_1.safeSessionId)('a/b:c'), 'a_b_c');
+        assert.strictEqual((0, state_sync_1.safeSessionId)(''), 'session');
+    });
+    test('sessionRemoteUri nests under sessions/', () => {
+        assert.strictEqual((0, state_sync_1.sessionRemoteUri)({ uri: 's3://bkt/p' }, 's1'), 's3://bkt/p/sessions/s1');
+    });
+    test('shardBelongsToSession matches key and value', () => {
+        assert.ok((0, state_sync_1.shardBelongsToSession)('claude:s1:pack:abc', 's1'));
+        assert.ok((0, state_sync_1.shardBelongsToSession)('x:other:pack:abc', 's1', { chatSessionId: 's1' }));
+        assert.ok(!(0, state_sync_1.shardBelongsToSession)('claude:s2:pack:abc', 's1'));
+    });
+});
+suite('state-sync: stage + merge session dirs', () => {
+    let tmp;
+    setup(() => {
+        tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'state-sync-'));
+        (0, state_sync_1.clearRestoreAttemptCache)();
+    });
+    teardown(() => {
+        fs.rmSync(tmp, { recursive: true, force: true });
+        (0, state_sync_1.clearRestoreAttemptCache)();
+    });
+    test('stages only matching provider-session shards + agents', async () => {
+        const ps = path.join(tmp, 'provider-sessions');
+        fs.mkdirSync(ps, { recursive: true });
+        const key1 = 'claude:sess-a:pack:sig';
+        const key2 = 'claude:sess-b:pack:sig';
+        const f1 = (0, state_sync_1.providerSessionShardName)(key1);
+        const f2 = (0, state_sync_1.providerSessionShardName)(key2);
+        fs.writeFileSync(path.join(ps, f1), JSON.stringify({ key: key1, value: { chatSessionId: 'sess-a', id: 'n1' } }));
+        fs.writeFileSync(path.join(ps, f2), JSON.stringify({ key: key2, value: { chatSessionId: 'sess-b', id: 'n2' } }));
+        fs.mkdirSync(path.join(tmp, 'agents', 'pack', 'claude'), { recursive: true });
+        fs.writeFileSync(path.join(tmp, 'agents', 'pack', 'claude', 'marker'), 'x');
+        const staging = path.join(tmp, 'staging');
+        const ok = await (0, state_sync_1.stageSessionPushDir)(tmp, 'sess-a', staging);
+        assert.strictEqual(ok, true);
+        assert.ok(fs.existsSync(path.join(staging, 'provider-sessions', f1)));
+        assert.ok(!fs.existsSync(path.join(staging, 'provider-sessions', f2)));
+        assert.ok(fs.existsSync(path.join(staging, 'agents', 'pack', 'claude', 'marker')));
+        const shards = await (0, state_sync_1.listSessionShardFiles)(tmp, 'sess-a');
+        assert.deepStrictEqual(shards, [f1]);
+        assert.strictEqual(await (0, state_sync_1.hasLocalSessionState)(tmp, 'sess-a'), true);
+        assert.strictEqual(await (0, state_sync_1.hasLocalSessionState)(tmp, 'sess-missing'), false);
+    });
+    test('mergeSessionStagingIntoState copies shards and agents', async () => {
+        const staging = path.join(tmp, 'from');
+        const dest = path.join(tmp, 'to');
+        fs.mkdirSync(path.join(staging, 'provider-sessions'), { recursive: true });
+        fs.writeFileSync(path.join(staging, 'provider-sessions', 'abc.json'), JSON.stringify({ key: 'claude:s1:p:s', value: { chatSessionId: 's1' } }));
+        fs.mkdirSync(path.join(staging, 'agents', 'p'), { recursive: true });
+        fs.writeFileSync(path.join(staging, 'agents', 'p', 'f'), '1');
+        await (0, state_sync_1.mergeSessionStagingIntoState)(staging, dest);
+        assert.ok(fs.existsSync(path.join(dest, 'provider-sessions', 'abc.json')));
+        assert.ok(fs.existsSync(path.join(dest, 'agents', 'p', 'f')));
+    });
+});
 suite('peerToUserId (#4 — channel sender → per-user id)', () => {
     test('undefined for no peer', () => {
         assert.strictEqual((0, serve_hardening_1.peerToUserId)(undefined), undefined);

package/package.json

@@ -1,16 +1,15 @@
 {
   "name": "@agenthippo-ai/agenthippo",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "AgentHippo CLI — serve, chat, and deploy agent packs",
   "author": "AgentHippo <dev@agenthippo.ai>",
   "license": "SEE LICENSE IN LICENSE",
   "repository": {
     "type": "git",
-    "url": "https://github.com/agenthippoai/agenthippo-vscode.git",
-    "directory": "extensions/agentide"
+    "url": "https://github.com/agenthippoai/agenthippo-store.git"
   },
   "homepage": "https://agenthippo.ai",
-  "bugs": "https://github.com/agenthippoai/agenthippo-vscode/issues",
+  "bugs": "https://github.com/agenthippoai/agenthippo-store/issues",
   "engines": {
     "node": ">=20"
   },