@agenthippo-ai/agenthippo 0.1.0 → 0.2.3-dataplane

package/out/test/analytics.test.js

@@ -522,3 +522,96 @@ suite('Analytics - ObservableStreamEmitter', () => {
         assert.notStrictEqual(reqId1, reqId2, 'Request IDs should be different');
     });
 });
+// =============================================================================
+// ObservableStreamEmitter warrant audit trail (constructor-captured userId)
+// =============================================================================
+suite('Analytics - ObservableStreamEmitter records the acting user (the warrant)', () => {
+    let testDir;
+    let writer;
+    let innerEmitter;
+    setup(async () => {
+        testDir = await createUniqueTempDir('agentide-warrant-test-');
+        writer = new sessionEvents_1.SessionEventWriter(testDir);
+        innerEmitter = {
+            async thinking() { },
+            async text() { },
+            async toolStart() { },
+            async toolEnd() { },
+            async progress() { },
+            async question() { return { selected: [], freeText: null }; },
+            async error() { },
+            async done() { },
+        };
+    });
+    teardown(async () => {
+        try {
+            await removeDirWithRetries(testDir);
+        }
+        catch {
+            // ignore
+        }
+    });
+    async function readEvents(sessionId) {
+        const content = await fs_1.promises.readFile(path.join(testDir, `${sessionId}.jsonl`), 'utf8');
+        return content.trim().split('\n').map((l) => JSON.parse(l));
+    }
+    test('toolStart/toolEnd record the userId passed at wrap', async () => {
+        const emitter = (0, sessionEvents_1.wrapEmitterWithObservability)(innerEmitter, writer, 'sess-warrant-1', 'req-1', 'priya@meridian.com');
+        await emitter.toolStart('Bash', 'echo hi', 'c1');
+        await emitter.toolEnd('Bash', 'c1', 'hi', false);
+        const events = await readEvents('sess-warrant-1');
+        assert.strictEqual(events.length, 2);
+        assert.strictEqual(events[0].payload.userId, 'priya@meridian.com');
+        assert.strictEqual(events[1].payload.userId, 'priya@meridian.com');
+    });
+    test('toolStart records no userId when wrap omitted it (IDE-local usage)', async () => {
+        const emitter = (0, sessionEvents_1.wrapEmitterWithObservability)(innerEmitter, writer, 'sess-warrant-2', 'req-1');
+        await emitter.toolStart('Bash', 'echo hi', 'c1');
+        const events = await readEvents('sess-warrant-2');
+        assert.strictEqual(events[0].payload.userId, undefined);
+    });
+    test('two emitters never attribute a tool call to the wrong user', async () => {
+        const alice = (0, sessionEvents_1.wrapEmitterWithObservability)(innerEmitter, writer, 'sess-warrant-3', 'req-a', 'alice@acme.com');
+        const bob = (0, sessionEvents_1.wrapEmitterWithObservability)(innerEmitter, writer, 'sess-warrant-3', 'req-b', 'bob@acme.com');
+        await Promise.all([
+            (async () => {
+                await new Promise((r) => setTimeout(r, 5));
+                await alice.toolStart('Bash', 'a', 'a1');
+            })(),
+            bob.toolStart('Bash', 'b', 'b1'),
+        ]);
+        const events = await readEvents('sess-warrant-3');
+        const byCallId = Object.fromEntries(events.map((e) => [e.payload.callId, e.payload.userId]));
+        assert.strictEqual(byCallId['a1'], 'alice@acme.com');
+        assert.strictEqual(byCallId['b1'], 'bob@acme.com');
+    });
+    test('toolStart/toolEnd keep wrap-time userId even when called outside any credential scope', async () => {
+        // Simulates the custom-engine persistent-worker path: wrap captures identity on the
+        // request continuation, then tool events fire later on a detached IPC callback with
+        // no ambient runWithCredential (or a sticky wrong one). Attribution must not depend
+        // on ambient AsyncLocalStorage at emit time.
+        const emitter = (0, sessionEvents_1.wrapEmitterWithObservability)(innerEmitter, writer, 'sess-warrant-4', 'req-1', 'alice@acme.com');
+        await emitter.toolStart('Bash', 'echo hi', 'c1');
+        await emitter.toolEnd('Bash', 'c1', 'hi', false);
+        const events = await readEvents('sess-warrant-4');
+        assert.strictEqual(events[0].payload.userId, 'alice@acme.com');
+        assert.strictEqual(events[1].payload.userId, 'alice@acme.com');
+    });
+    test('error/turn_start/turn_end also carry the wrap-time userId, not just tool events', async () => {
+        // A turn that errors before any tool call (or has no tool calls at all) must still
+        // carry identity attribution — the mechanism was already on the instance, it just
+        // wasn't threaded into these three payloads.
+        const emitter = (0, sessionEvents_1.wrapEmitterWithObservability)(innerEmitter, writer, 'sess-warrant-5', 'req-1', 'bob@acme.com');
+        await emitter.emitTurnStart();
+        await emitter.error('boom');
+        await emitter.emitTurnEnd(false);
+        const events = await readEvents('sess-warrant-5');
+        assert.strictEqual(events.length, 3);
+        assert.strictEqual(events[0].event_type, 'turn_start');
+        assert.strictEqual(events[0].payload.userId, 'bob@acme.com');
+        assert.strictEqual(events[1].event_type, 'error');
+        assert.strictEqual(events[1].payload.userId, 'bob@acme.com');
+        assert.strictEqual(events[2].event_type, 'turn_end');
+        assert.strictEqual(events[2].payload.userId, 'bob@acme.com');
+    });
+});

package/out/test/auth-broker.test.js

@@ -154,7 +154,10 @@ suite('AuthBroker', () => {
                     code_challenge: (0, pkce_js_1.codeChallengeFromVerifier)((0, pkce_js_1.generateCodeVerifier)()),
                 }),
             });
-            assert.strictEqual(res.status, 500);
+            assert.strictEqual(res.status, 403);
+            const body = await res.json();
+            assert.strictEqual(body.error, 'forbidden');
+            assert.ok(body.error_description?.includes('domain'));
         }
         finally {
             await broker.close();
@@ -198,7 +201,8 @@ suite('AuthBroker', () => {
             assert.strictEqual(refreshRes.status, 200);
             const body = await refreshRes.json();
             assert.strictEqual(body.routing.litellmApiKey, 'ahk_test_key');
-            assert.ok(body.routing.litellmApiKeyExpiresAt);
+            // Static team key — the broker must not fabricate an expiry it can't enforce.
+            assert.strictEqual(body.routing.litellmApiKeyExpiresAt, undefined);
         }
         finally {
             await broker.close();
@@ -431,4 +435,57 @@ suite('AuthBroker', () => {
             await broker.close();
         }
     });
+    test('authorize rejects a redirect_uri outside the loopback/IDE-callback allow-list', async () => {
+        const broker = (0, server_js_1.createAuthBrokerServer)(testConfig(0));
+        await new Promise((resolve) => broker.server.listen(0, '127.0.0.1', resolve));
+        const address = broker.server.address();
+        if (!address || typeof address === 'string') {
+            throw new Error('bad listen address');
+        }
+        const baseUrl = `http://127.0.0.1:${address.port}`;
+        try {
+            const challenge = (0, pkce_js_1.codeChallengeFromVerifier)((0, pkce_js_1.generateCodeVerifier)());
+            // An attacker-controlled destination — must never receive an auth code (open-redirect /
+            // code-theft guard). Real clients only ever send the loopback or IDE-scheme callback.
+            const url = `${baseUrl}/oauth/authorize?client_id=${types_js_1.AUTH_CLIENT_ID}`
+                + `&redirect_uri=${encodeURIComponent('https://attacker.example/collect')}`
+                + `&code_challenge=${challenge}&code_challenge_method=S256&state=x&login_hint=dev@agenthippo.ai`;
+            const res = await fetch(url, { redirect: 'manual' });
+            assert.strictEqual(res.status, 400);
+            const body = await res.json();
+            assert.strictEqual(body.error, 'invalid_request');
+        }
+        finally {
+            await broker.close();
+        }
+    });
+    test('authorize accepts the loopback and IDE-scheme redirect_uri shapes real clients send', async () => {
+        const broker = (0, server_js_1.createAuthBrokerServer)(testConfig(0));
+        await new Promise((resolve) => broker.server.listen(0, '127.0.0.1', resolve));
+        const address = broker.server.address();
+        if (!address || typeof address === 'string') {
+            throw new Error('bad listen address');
+        }
+        const baseUrl = `http://127.0.0.1:${address.port}`;
+        try {
+            const redirectUris = [
+                'http://127.0.0.1:54123/callback', // CLI/IDE loopback callback (any OS-assigned port)
+                'vscode://agenthippo.agenthippo/auth/callback', // IDE URI-scheme callback
+            ];
+            for (const redirectUri of redirectUris) {
+                const challenge = (0, pkce_js_1.codeChallengeFromVerifier)((0, pkce_js_1.generateCodeVerifier)());
+                const url = `${baseUrl}/oauth/authorize?client_id=${types_js_1.AUTH_CLIENT_ID}`
+                    + `&redirect_uri=${encodeURIComponent(redirectUri)}`
+                    + `&code_challenge=${challenge}&code_challenge_method=S256&state=x&login_hint=dev@agenthippo.ai`;
+                const res = await fetch(url, { redirect: 'manual' });
+                assert.strictEqual(res.status, 302, `expected redirect for ${redirectUri}`);
+                const location = res.headers.get('location') || '';
+                assert.ok(location.startsWith(redirectUri), `location "${location}" should start with "${redirectUri}"`);
+                assert.ok(new URL(location).searchParams.get('code'), 'redirect carries an auth code');
+            }
+        }
+        finally {
+            await broker.close();
+        }
+    });
 });

package/out/test/blueprint-registry.test.js

@@ -0,0 +1,105 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Blueprint Registry Test Suite (PLAN/deploy.md §3, §7 d7-blueprint-registry)
+ *
+ *  Pure resolver tests: a blueprint (+ optional platform) must resolve to exactly the
+ *  --target/--ingress pair deploy-init.ts already renders correctly — these tests never
+ *  call deployCommand, so they can assert on the error paths too without a process.exit risk.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const registry_1 = require("../cli/deploy/blueprints/registry");
+suite('blueprint registry: isBlueprintId', () => {
+    test('recognizes every declared blueprint id', () => {
+        for (const id of registry_1.BLUEPRINT_IDS) {
+            assert.ok((0, registry_1.isBlueprintId)(id));
+        }
+    });
+    test('rejects unknown ids', () => {
+        assert.ok(!(0, registry_1.isBlueprintId)('enterprise'));
+        assert.ok(!(0, registry_1.isBlueprintId)(''));
+    });
+});
+suite('blueprint registry: resolveBlueprint', () => {
+    test('sandbox resolves to vm with no ingress', () => {
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('sandbox'), { target: 'vm' });
+    });
+    test('regulated-air-gapped resolves to vm with no ingress', () => {
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('regulated-air-gapped'), { target: 'vm' });
+    });
+    test('prospect-demo defaults to vm with edge ingress; compose is also supported', () => {
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('prospect-demo'), { target: 'vm', ingress: 'edge' });
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('prospect-demo', 'compose'), { target: 'compose', ingress: 'edge' });
+    });
+    test('enterprise-fleet always resolves to edge-fed, on any of its supported platforms', () => {
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('enterprise-fleet'), { target: 'cloudrun', ingress: 'edge-fed' });
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('enterprise-fleet', 'vm'), { target: 'vm', ingress: 'edge-fed' });
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('enterprise-fleet', 'compose'), { target: 'compose', ingress: 'edge-fed' });
+    });
+    test('team-pilot rides platform-native identity where one exists', () => {
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('team-pilot', 'cloudrun'), { target: 'cloudrun', ingress: 'iap' });
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('team-pilot', 'databricks-app'), { target: 'databricks-app' });
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('team-pilot', 'spcs'), { target: 'spcs' });
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('team-pilot', 'cloudflare'), { target: 'cloudflare' });
+    });
+    test('team-pilot falls back to a self-issued edge on vm/compose/aws-ecs/azure-container-apps (no platform-native option there)', () => {
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('team-pilot', 'vm'), { target: 'vm', ingress: 'edge' });
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('team-pilot', 'compose'), { target: 'compose', ingress: 'edge' });
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('team-pilot', 'aws-ecs'), { target: 'aws-ecs', ingress: 'edge' });
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('team-pilot', 'azure-container-apps'), { target: 'azure-container-apps', ingress: 'edge' });
+    });
+    test('enterprise-fleet supports aws-ecs/azure-container-apps too', () => {
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('enterprise-fleet', 'aws-ecs'), { target: 'aws-ecs', ingress: 'edge-fed' });
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('enterprise-fleet', 'azure-container-apps'), { target: 'azure-container-apps', ingress: 'edge-fed' });
+    });
+    test('team-pilot with no --platform defaults to its first supported target (cloudrun, iap)', () => {
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('team-pilot'), { target: 'cloudrun', ingress: 'iap' });
+    });
+    test('throws when --platform is outside the blueprint\'s supported set', () => {
+        assert.throws(() => (0, registry_1.resolveBlueprint)('sandbox', 'cloudrun'), /does not support --platform cloudrun/);
+        assert.throws(() => (0, registry_1.resolveBlueprint)('regulated-air-gapped', 'databricks-app'), /Supported: vm/);
+    });
+});
+suite('blueprint registry: BLUEPRINTS catalog', () => {
+    test('every blueprint declares at least one supported target and a description', () => {
+        for (const id of registry_1.BLUEPRINT_IDS) {
+            const def = registry_1.BLUEPRINTS[id];
+            assert.ok(def.targets.length > 0, `${id} must support at least one platform`);
+            assert.ok(def.description.trim().length > 0, `${id} must have a description`);
+        }
+    });
+});

package/out/test/credential-context.test.js

@@ -74,6 +74,61 @@ suite('credential-context: presence + fail-closed', () => {
         });
     });
 });
+suite('credential-context: unresolved identity (userId is optional, never a placeholder)', () => {
+    test('no userId, no data token: runs fine, requireUserId throws inside the scope', async () => {
+        const seen = await (0, credential_context_1.runWithCredential)({ userId: undefined }, async () => {
+            assert.throws(() => (0, credential_context_1.requireUserId)(), /fail-closed/);
+            return 'ran';
+        });
+        assert.strictEqual(seen, 'ran');
+    });
+    test('a data token without a verified userId fails closed before the turn runs', async () => {
+        let ran = false;
+        await assert.rejects(() => (0, credential_context_1.runWithCredential)({ userId: undefined, dataToken: 'obo-secret' }, async () => {
+            ran = true;
+        }), /OBO data token present without a verified user/);
+        assert.strictEqual(ran, false, 'fn must never run when the credential fails closed');
+    });
+    test('onDenied fires with the stable reason code exactly when the credential fails closed', async () => {
+        const denials = [];
+        await assert.rejects(() => (0, credential_context_1.runWithCredential)({ userId: undefined, dataToken: 'obo-secret' }, async () => 'ran', { onDenied: (reason) => { denials.push(reason); } }));
+        assert.deepStrictEqual(denials, [credential_context_1.WARRANT_DENIED_REASON]);
+    });
+    test('onDenied does not fire on any success path (verified user, or no token at all)', async () => {
+        const denials = [];
+        const onDenied = (reason) => { denials.push(reason); };
+        await (0, credential_context_1.runWithCredential)({ userId: 'priya@meridian.com', dataToken: 'tok' }, async () => 'ran', { onDenied });
+        await (0, credential_context_1.runWithCredential)({ userId: undefined }, async () => 'ran', { onDenied });
+        assert.deepStrictEqual(denials, []);
+    });
+    test('a throwing onDenied callback is swallowed — the fail-closed rejection still wins', async () => {
+        await assert.rejects(() => (0, credential_context_1.runWithCredential)({ userId: undefined, dataToken: 'obo-secret' }, async () => 'ran', { onDenied: () => { throw new Error('logging backend is down'); } }), /fail-closed/);
+    });
+    test('a hung onDenied callback cannot stall fail-closed forever', async () => {
+        const started = Date.now();
+        let resolved = false;
+        await assert.rejects(() => (0, credential_context_1.runWithCredential)({ userId: undefined, dataToken: 'obo-secret' }, async () => 'ran', {
+            onDeniedTimeoutMs: 50,
+            onDenied: () => new Promise(() => {
+                /* never settles */
+            }),
+        }), /fail-closed/);
+        resolved = true;
+        const elapsed = Date.now() - started;
+        assert.ok(resolved);
+        assert.ok(elapsed < 500, `fail-closed should win after onDenied timeout (elapsed=${elapsed}ms)`);
+    });
+    test('the credential never touches disk — it exists only in the async scope (secure-obo-design §2)', async () => {
+        await (0, credential_context_1.runWithCredential)({ userId: 'priya@meridian.com', dataToken: 'obo-secret' }, async () => {
+            const cred = (0, credential_context_1.currentCredential)();
+            assert.strictEqual(cred?.dataToken, 'obo-secret');
+            // The RequestCredential shape has no file-based transport anymore: the token
+            // reaches tools only via the loopback data-plane gateway + turn nonce.
+            assert.ok(!('dataTokenFile' in cred), 'no dataTokenFile surface may exist');
+        });
+        assert.strictEqual((0, credential_context_1.currentCredential)(), undefined);
+    });
+});
 suite('credential-context: concurrent isolation (the load-bearing property)', () => {
     test('two interleaved turns never see each other\'s user', async () => {
         // Interleave alice and bob with deliberate awaits; each must keep its own identity.

package/out/test/custom-env-layering.test.js

@@ -0,0 +1,151 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Custom-engine env layering tests.
+ *
+ *  Pins the deliberate precedence contract that replaced two accidents:
+ *   1. buildRunnerChildEnv: PER-TURN values win over the host's ambient env (the old
+ *      `{...turn.env, ...process.env}` order silently reverted per-turn state — including,
+ *      latently, manifest-delivered credentials and any same-named ambient var).
+ *   2. deliverModelRoutingEnv: manifest `model.*EnvVar` delivery is NON-CLOBBERING — a var the
+ *      operator already set in the host env is never overwritten. This is what keeps a STALE
+ *      cursor manifest (one that still declares apiKeyEnvVar: CURSOR_API_KEY) from stomping the
+ *      operator's real crsr_ key now that per-turn values win (the version-pairing case).
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const custom_1 = require("../engines/custom");
+function fakeManifest(model) {
+    return {
+        id: 'fake-engine',
+        entryPath: '/tmp/fake/engine.mjs',
+        manifestDir: '/tmp/fake',
+        model: model ? { defaultModel: 'auto', ...model } : undefined,
+    };
+}
+function fakeTurn(env) {
+    return {
+        message: 'hi',
+        modelId: 'auto',
+        workspaceRoot: '/tmp/ws',
+        env,
+        session: { key: 'k', chatSessionId: 'c', isEphemeral: false },
+    };
+}
+/** Run fn with process.env temporarily patched; always restores. */
+function withProcessEnv(patch, fn) {
+    const saved = new Map();
+    for (const [k, v] of Object.entries(patch)) {
+        saved.set(k, process.env[k]);
+        if (v === undefined) {
+            delete process.env[k];
+        }
+        else {
+            process.env[k] = v;
+        }
+    }
+    try {
+        fn();
+    }
+    finally {
+        for (const [k, v] of saved) {
+            if (v === undefined) {
+                delete process.env[k];
+            }
+            else {
+                process.env[k] = v;
+            }
+        }
+    }
+}
+suite('buildRunnerChildEnv: per-turn values win over the host ambient env', () => {
+    test('a per-turn var beats the same-named ambient var (nonce/session-path class)', () => {
+        withProcessEnv({ TEST_LAYERING_VAR: 'ambient-stale' }, () => {
+            const child = (0, custom_1.buildRunnerChildEnv)(fakeManifest(), fakeTurn({ TEST_LAYERING_VAR: 'per-turn-fresh' }), false);
+            assert.strictEqual(child.TEST_LAYERING_VAR, 'per-turn-fresh');
+        });
+    });
+    test('ambient vars absent from turn.env still flow through (plain inheritance)', () => {
+        withProcessEnv({ TEST_AMBIENT_ONLY: 'inherited' }, () => {
+            const child = (0, custom_1.buildRunnerChildEnv)(fakeManifest(), fakeTurn({}), false);
+            assert.strictEqual(child.TEST_AMBIENT_ONLY, 'inherited');
+        });
+    });
+    test('AGENTHIPPO control vars come from the turn, never ambient', () => {
+        withProcessEnv({ AGENTHIPPO_MODEL_ID: 'ambient-wrong' }, () => {
+            const child = (0, custom_1.buildRunnerChildEnv)(fakeManifest(), fakeTurn({}), false);
+            assert.strictEqual(child.AGENTHIPPO_MODEL_ID, 'auto', 'explicit per-turn block must win');
+        });
+    });
+});
+suite('deliverModelRoutingEnv: non-clobbering manifest credential delivery', () => {
+    test('delivers the routing key when the declared var is NOT in the ambient env (openclaw case)', () => {
+        const env = {};
+        (0, custom_1.deliverModelRoutingEnv)(env, fakeManifest({ apiKeyEnvVar: 'LITELLM_API_KEY' }), { apiKey: 'sk-proxy-key' }, {});
+        assert.strictEqual(env.LITELLM_API_KEY, 'sk-proxy-key');
+    });
+    test('SKIPS delivery when the operator already set the var — ambient wins (stale-cursor-manifest case)', () => {
+        // Version-pairing regression: old manifest still declares apiKeyEnvVar: CURSOR_API_KEY,
+        // operator has the real crsr_ key ambient. With per-turn-wins layering, only this
+        // non-clobber rule keeps the real key from being stomped by a model key.
+        const env = { CURSOR_API_KEY: 'crsr_real_operator_key' };
+        (0, custom_1.deliverModelRoutingEnv)(env, fakeManifest({ apiKeyEnvVar: 'CURSOR_API_KEY' }), { apiKey: 'sk-model-routing-key' }, { CURSOR_API_KEY: 'crsr_real_operator_key' });
+        assert.strictEqual(env.CURSOR_API_KEY, 'crsr_real_operator_key', 'operator credential must never be overwritten');
+    });
+    test('stale-manifest end to end: child env keeps the operator key after the spread flip', () => {
+        withProcessEnv({ CURSOR_API_KEY: 'crsr_real_operator_key' }, () => {
+            // Simulate the turn-env build with an OLD manifest: ambient spread + (non-clobbered) delivery.
+            const turnEnv = { ...process.env };
+            (0, custom_1.deliverModelRoutingEnv)(turnEnv, fakeManifest({ apiKeyEnvVar: 'CURSOR_API_KEY' }), { apiKey: 'sk-model-key' }, process.env);
+            const child = (0, custom_1.buildRunnerChildEnv)(fakeManifest({ apiKeyEnvVar: 'CURSOR_API_KEY' }), fakeTurn(turnEnv), false);
+            assert.strictEqual(child.CURSOR_API_KEY, 'crsr_real_operator_key');
+        });
+    });
+    test('base URL vars follow the same rule (deliver when absent, keep ambient when present)', () => {
+        const env = {};
+        (0, custom_1.deliverModelRoutingEnv)(env, fakeManifest({ baseUrlEnvVar: 'ENGINE_BASE_URL' }), { baseUrl: 'http://proxy:4000' }, {});
+        assert.strictEqual(env.ENGINE_BASE_URL, 'http://proxy:4000');
+        const env2 = { ENGINE_BASE_URL: 'http://operator-choice' };
+        (0, custom_1.deliverModelRoutingEnv)(env2, fakeManifest({ baseUrlEnvVar: 'ENGINE_BASE_URL' }), { baseUrl: 'http://proxy:4000' }, { ENGINE_BASE_URL: 'http://operator-choice' });
+        assert.strictEqual(env2.ENGINE_BASE_URL, 'http://operator-choice');
+    });
+    test('no declaration → no delivery, whatever the routing key is (the fixed cursor manifest)', () => {
+        const env = { CURSOR_API_KEY: 'crsr_real_operator_key' };
+        (0, custom_1.deliverModelRoutingEnv)(env, fakeManifest(), { apiKey: 'sk-model-key' }, {});
+        assert.strictEqual(env.CURSOR_API_KEY, 'crsr_real_operator_key');
+        assert.strictEqual(Object.keys(env).length, 1, 'nothing else may be written');
+    });
+});