@agenthippo-ai/agenthippo 0.1.0 → 0.2.3-dataplane

package/out/test/data-plane-engine-wiring.test.js

@@ -0,0 +1,250 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Data-plane engine wiring tests (secure-obo-design §3.2, §6) — NO API KEY NEEDED.
+ *
+ *  These exercise the *real* engine config paths (not just the pure helpers): given a pack
+ *  that declares the loopback gateway MCP entry + skills, does each engine actually
+ *    (a) put the turn-invariant gateway entry into its config, with the nonce sourced from
+ *        the PROCESS env (never a per-turn value written to the file), and
+ *    (b) sync the pack's skills into the engine's home so the agent can see them,
+ *  and does the per-user CODEX_HOME derivation keep concurrent users' state apart while
+ *  keeping the written config byte-identical (the property that kills defect 1)?
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const codex_1 = require("../engines/codex");
+const mcp_1 = require("../mcp");
+const paths_1 = require("../agentpack/paths");
+const credential_context_1 = require("../cli/credential-context");
+const GATEWAY_MCP_JSON = JSON.stringify({
+    mcpServers: {
+        data: {
+            url: '${env:AGENTHIPPO_DATA_MCP_URL}',
+            bearerTokenEnv: 'AGENTHIPPO_TURN_NONCE',
+        },
+    },
+});
+function silentLogger() {
+    const lines = [];
+    const push = (m) => { lines.push(m); };
+    return { lines, info: push, warn: push, error: push, debug: push };
+}
+/** Build a pack on disk with the gateway MCP entry + N skills, return workspace + agentId. */
+function makePack(skillNames) {
+    const workspace = fs.mkdtempSync(path.join(os.tmpdir(), 'ah-wire-'));
+    const agentId = 'wire-agent';
+    const mcpDir = (0, paths_1.getAgentMcpDir)(workspace, agentId);
+    fs.mkdirSync(mcpDir, { recursive: true });
+    fs.writeFileSync(path.join(mcpDir, '.mcp.json'), GATEWAY_MCP_JSON, 'utf8');
+    const agentRoot = path.dirname(mcpDir);
+    fs.writeFileSync(path.join(agentRoot, 'AGENTS.md'), '# Wire Agent\n\nAnswer questions.\n', 'utf8');
+    const skillsDir = (0, paths_1.getAgentSkillsDir)(workspace, agentId);
+    for (const name of skillNames) {
+        const dir = path.join(skillsDir, name);
+        fs.mkdirSync(dir, { recursive: true });
+        fs.writeFileSync(path.join(dir, 'SKILL.md'), `---\nname: ${name}\ndescription: test skill ${name}\n---\n\nDo ${name} things.\n`, 'utf8');
+        // a bundled resource, to prove the whole skill dir is copied, not just SKILL.md
+        fs.mkdirSync(path.join(dir, 'scripts'), { recursive: true });
+        fs.writeFileSync(path.join(dir, 'scripts', 'run.sh'), `echo ${name}\n`, 'utf8');
+    }
+    return { workspace, agentId };
+}
+async function writeCodexConfig(workspace, agentId, codexHome) {
+    const logger = silentLogger();
+    // getSkillsSignature must return undefined so the sync is not skipped by the signature cache.
+    const engine = new codex_1.CodexEngine({ storagePath: workspace, codexHome: undefined, claudeConfigDir: undefined, litellmApiKey: 'k', litellmBaseUrl: 'http://litellm.local' }, () => undefined, () => undefined);
+    await engine.ensureCodexConfig(true, // useLiteLLM
+    'http://litellm.local', // customBaseUrl
+    'gpt-5.5', // modelId
+    workspace, // workspaceRoot
+    [], // additionalDirectories
+    logger, // logger
+    codexHome, // explicit codexHome
+    agentId, // agentId
+    true);
+    return fs.readFileSync(path.join(codexHome, 'config.toml'), 'utf8');
+}
+/** The `[mcp_servers.data]` block only — the part that must be turn- AND user-invariant. */
+function mcpDataBlock(toml) {
+    const start = toml.indexOf('[mcp_servers.data]');
+    assert.ok(start >= 0, `config.toml missing [mcp_servers.data]:\n${toml}`);
+    const rest = toml.slice(start + '[mcp_servers.data]'.length);
+    const next = rest.search(/\n\[/);
+    return (next >= 0 ? rest.slice(0, next) : rest).trim();
+}
+suite('data-plane engine wiring: codex config + skills sync (no API key)', function () {
+    this.timeout(30_000);
+    test('config.toml carries the turn-invariant gateway entry; no per-turn value in the file', async () => {
+        const { workspace, agentId } = makePack(['alpha', 'beta']);
+        try {
+            process.env.AGENTHIPPO_DATA_MCP_URL = 'http://127.0.0.1:45999/mcp';
+            const codexHome = path.join(workspace, 'home');
+            fs.mkdirSync(codexHome, { recursive: true });
+            const toml = await writeCodexConfig(workspace, agentId, codexHome);
+            const block = mcpDataBlock(toml);
+            assert.ok(block.includes('url = "http://127.0.0.1:45999/mcp"'), 'gateway URL must resolve from process env');
+            assert.ok(block.includes('bearer_token_env_var = "AGENTHIPPO_TURN_NONCE"'), 'nonce must be read from the codex process env, not the file');
+            // The MCP entry must NOT contain any resolved nonce/header — that is what makes it turn-invariant.
+            // (The unrelated LiteLLM analytics block legitimately has an env_http_headers line of env-var NAMES.)
+            assert.ok(!/http_headers/.test(block), `no resolved auth header may be written into the MCP entry:\n${block}`);
+            assert.ok(!/Authorization/i.test(block), block);
+        }
+        finally {
+            delete process.env.AGENTHIPPO_DATA_MCP_URL;
+            fs.rmSync(workspace, { recursive: true, force: true });
+        }
+    });
+    test('the agent sees its skills: each SKILL.md (and its resources) is synced into $CODEX_HOME/skills', async () => {
+        const { workspace, agentId } = makePack(['alpha', 'beta']);
+        try {
+            process.env.AGENTHIPPO_DATA_MCP_URL = 'http://127.0.0.1:45999/mcp';
+            const codexHome = path.join(workspace, 'home');
+            fs.mkdirSync(codexHome, { recursive: true });
+            await writeCodexConfig(workspace, agentId, codexHome);
+            for (const name of ['alpha', 'beta']) {
+                const skillMd = path.join(codexHome, 'skills', name, 'SKILL.md');
+                assert.ok(fs.existsSync(skillMd), `skill ${name} must be visible in $CODEX_HOME/skills: ${skillMd}`);
+                assert.ok(fs.readFileSync(skillMd, 'utf8').includes(`description: test skill ${name}`));
+                // bundled resources come along, not just the SKILL.md
+                assert.ok(fs.existsSync(path.join(codexHome, 'skills', name, 'scripts', 'run.sh')), 'skill resource files must be copied too');
+            }
+        }
+        finally {
+            delete process.env.AGENTHIPPO_DATA_MCP_URL;
+            fs.rmSync(workspace, { recursive: true, force: true });
+        }
+    });
+    test('per-user CODEX_HOME: isolated homes+skills; the gateway entry is identical across users (only per-user paths differ)', async () => {
+        const { workspace, agentId } = makePack(['alpha']);
+        try {
+            process.env.AGENTHIPPO_DATA_MCP_URL = 'http://127.0.0.1:45999/mcp';
+            const base = path.join(workspace, 'home');
+            const aliceHome = (0, paths_1.userScopedEngineHome)(base, 'alice@corp.com');
+            const bobHome = (0, paths_1.userScopedEngineHome)(base, 'bob@corp.com');
+            assert.notStrictEqual(aliceHome, bobHome, 'distinct users must get distinct homes');
+            assert.ok(!aliceHome.includes('alice@corp.com'), 'user id must be hashed, never a raw path segment');
+            fs.mkdirSync(aliceHome, { recursive: true });
+            fs.mkdirSync(bobHome, { recursive: true });
+            const aliceToml = await (0, credential_context_1.runWithCredential)({ userId: 'alice@corp.com' }, () => writeCodexConfig(workspace, agentId, aliceHome));
+            const bobToml = await (0, credential_context_1.runWithCredential)({ userId: 'bob@corp.com' }, () => writeCodexConfig(workspace, agentId, bobHome));
+            // The MCP gateway entry carries NO per-user/per-turn value → identical across users.
+            // (The instructions-file path legitimately differs because it lives inside each user's
+            // own home — a per-user path, not a shared file, so it is not a cross-user race.)
+            assert.strictEqual(mcpDataBlock(aliceToml), mcpDataBlock(bobToml), 'the gateway MCP entry must be user-invariant');
+            assert.ok(fs.existsSync(path.join(aliceHome, 'skills', 'alpha', 'SKILL.md')));
+            assert.ok(fs.existsSync(path.join(bobHome, 'skills', 'alpha', 'SKILL.md')));
+            assert.ok(aliceHome.startsWith(path.join(base, 'users')) && bobHome.startsWith(path.join(base, 'users')));
+        }
+        finally {
+            delete process.env.AGENTHIPPO_DATA_MCP_URL;
+            fs.rmSync(workspace, { recursive: true, force: true });
+        }
+    });
+    test('defect-1 fix: two concurrent turns of the SAME user (same home) write byte-identical config.toml', async () => {
+        const { workspace, agentId } = makePack(['alpha']);
+        try {
+            process.env.AGENTHIPPO_DATA_MCP_URL = 'http://127.0.0.1:45999/mcp';
+            const base = path.join(workspace, 'home');
+            const home = (0, paths_1.userScopedEngineHome)(base, 'alice@corp.com');
+            fs.mkdirSync(home, { recursive: true });
+            // Two turns, same user, same home — historically the racing writers of defect 1.
+            const first = await (0, credential_context_1.runWithCredential)({ userId: 'alice@corp.com', dataToken: 'obo-turn-1' }, () => writeCodexConfig(workspace, agentId, home));
+            const second = await (0, credential_context_1.runWithCredential)({ userId: 'alice@corp.com', dataToken: 'obo-turn-2' }, () => writeCodexConfig(workspace, agentId, home));
+            assert.strictEqual(first, second, 'same-home concurrent turns must write identical bytes — the race is gone by construction');
+        }
+        finally {
+            delete process.env.AGENTHIPPO_DATA_MCP_URL;
+            fs.rmSync(workspace, { recursive: true, force: true });
+        }
+    });
+    test('no verified user (IDE path) → home is the un-derived base, unchanged', () => {
+        const base = '/tmp/some/codex/home';
+        assert.strictEqual((0, paths_1.userScopedEngineHome)(base, undefined), base);
+        assert.strictEqual((0, paths_1.userScopedEngineHome)(base, '   '), base);
+    });
+});
+suite('data-plane engine wiring: loadMcpServers + claude/custom shape (no API key)', function () {
+    this.timeout(30_000);
+    test('loadMcpServers reads a gateway .mcp.json into a url entry with bearerTokenEnv (URL resolved from env)', async () => {
+        const { workspace, agentId } = makePack([]);
+        try {
+            process.env.AGENTHIPPO_DATA_MCP_URL = 'http://127.0.0.1:47000/mcp';
+            const servers = await (0, mcp_1.loadMcpServers)(agentId, workspace);
+            assert.strictEqual(servers.length, 1);
+            assert.strictEqual(servers[0].name, 'data');
+            assert.strictEqual(servers[0].url, 'http://127.0.0.1:47000/mcp');
+            assert.strictEqual(servers[0].bearerTokenEnv, 'AGENTHIPPO_TURN_NONCE');
+            assert.strictEqual(servers[0].headers, undefined, 'no static header — the nonce is resolved per turn against the engine env');
+        }
+        finally {
+            delete process.env.AGENTHIPPO_DATA_MCP_URL;
+            fs.rmSync(workspace, { recursive: true, force: true });
+        }
+    });
+    test('a gateway entry whose URL placeholder does not resolve is dropped (never a broken empty-url entry)', async () => {
+        const { workspace, agentId } = makePack([]);
+        try {
+            delete process.env.AGENTHIPPO_DATA_MCP_URL; // e.g. loaded outside serve
+            const servers = await (0, mcp_1.loadMcpServers)(agentId, workspace);
+            assert.strictEqual(servers.length, 0, 'unresolved gateway URL → drop the server rather than hand engines an empty URL');
+        }
+        finally {
+            fs.rmSync(workspace, { recursive: true, force: true });
+        }
+    });
+    test('custom-engine transport: serialize→parse round-trips the http entry with the per-turn nonce header', async () => {
+        const { workspace, agentId } = makePack([]);
+        try {
+            process.env.AGENTHIPPO_DATA_MCP_URL = 'http://127.0.0.1:47000/mcp';
+            const servers = await (0, mcp_1.loadMcpServers)(agentId, workspace);
+            // This is exactly what custom.ts does: resolve against the per-turn child env, then
+            // serialize into AGENTHIPPO_MCP_SERVERS for the runner to parse back.
+            const inline = (0, mcp_1.formatInlineMcpServers)(servers, { AGENTHIPPO_TURN_NONCE: 'nonce-xyz' });
+            const roundTripped = (0, mcp_1.parseInlineMcpServers)((0, mcp_1.serializeInlineMcpServers)(inline));
+            assert.deepStrictEqual(roundTripped, {
+                data: { type: 'http', url: 'http://127.0.0.1:47000/mcp', headers: { Authorization: 'Bearer nonce-xyz' } },
+            });
+        }
+        finally {
+            delete process.env.AGENTHIPPO_DATA_MCP_URL;
+            fs.rmSync(workspace, { recursive: true, force: true });
+        }
+    });
+});

package/out/test/data-plane.test.js

@@ -0,0 +1,244 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Data-plane gateway integration tests (secure-obo-design §3, §5, §9)
+ *
+ *  Boots the real thing end to end: TurnRegistry + CredentialBroker + a real connector
+ *  subprocess (stdio MCP over a private pipe) + the loopback streamable-HTTP gateway —
+ *  then drives it with the MCP SDK client exactly like an engine would.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const index_js_1 = require("@modelcontextprotocol/sdk/client/index.js");
+const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/client/streamableHttp.js");
+const data_plane_1 = require("../cli/data-plane");
+// The fixture connector must live INSIDE the extension tree so its `import` of
+// @modelcontextprotocol/sdk resolves by walking up to extensions/agentide/node_modules.
+const FIXTURE_DIR = path.join(__dirname, 'data-plane-fixture');
+const CONNECTOR_PATH = path.join(FIXTURE_DIR, 'connector.mjs');
+const CONNECTOR_SOURCE = `
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+
+const server = new Server({ name: 'test-connector', version: '0.0.1' }, { capabilities: { tools: {} } });
+server.setRequestHandler(ListToolsRequestSchema, async () => ({
+	tools: [{
+		name: 'whoami',
+		description: 'echo the broker-supplied turn context',
+		inputSchema: { type: 'object', properties: { probe: { type: 'string' } } },
+	}],
+}));
+server.setRequestHandler(CallToolRequestSchema, async (req) => {
+	const turn = (req.params._meta ?? {})['ai.agenthippo/turn'] ?? null;
+	const probe = (req.params.arguments ?? {}).probe ?? '';
+	return {
+		content: [{ type: 'text', text: JSON.stringify({
+			userId: turn ? turn.userId : null,
+			credential: turn ? turn.credential : null,
+			envContainsProbe: probe ? JSON.stringify(process.env).includes(probe) : false,
+		}) }],
+	};
+});
+await server.connect(new StdioServerTransport());
+`;
+function mcpClient(url, nonce) {
+    const transport = new streamableHttp_js_1.StreamableHTTPClientTransport(new URL(url), {
+        requestInit: { headers: { Authorization: `Bearer ${nonce}` } },
+    });
+    const client = new index_js_1.Client({ name: 'test-engine', version: '0.0.1' });
+    return { client, transport };
+}
+async function callWhoami(url, nonce, probe) {
+    const { client, transport } = mcpClient(url, nonce);
+    try {
+        await client.connect(transport);
+        const res = await client.callTool({ name: 'whoami', arguments: probe ? { probe } : {} });
+        const content = res.content[0];
+        return JSON.parse(content.text);
+    }
+    finally {
+        await client.close().catch(() => undefined);
+    }
+}
+suite('data-plane: gateway + registry + broker end to end', function () {
+    this.timeout(30_000);
+    let plane;
+    suiteSetup(async () => {
+        fs.mkdirSync(FIXTURE_DIR, { recursive: true });
+        fs.writeFileSync(CONNECTOR_PATH, CONNECTOR_SOURCE, 'utf8');
+        plane = await data_plane_1.DataPlane.start({ connectorPath: CONNECTOR_PATH, provider: 'passthrough' });
+    });
+    suiteTeardown(async () => {
+        await plane?.close();
+        fs.rmSync(FIXTURE_DIR, { recursive: true, force: true });
+    });
+    test('gateway binds loopback only', () => {
+        assert.ok(plane.url.startsWith('http://127.0.0.1:'), plane.url);
+    });
+    test('a live nonce lists and calls tools as the registered user, credential selected server-side', async () => {
+        const turn = plane.registerTurn({ userId: 'alice@corp.com', sessionKey: 's1', inboundToken: 'alice-obo-token' });
+        try {
+            const { client, transport } = mcpClient(plane.url, turn.nonce);
+            await client.connect(transport);
+            const tools = await client.listTools();
+            assert.deepStrictEqual(tools.tools.map((t) => t.name), ['whoami']);
+            await client.close();
+            const who = await callWhoami(plane.url, turn.nonce);
+            assert.strictEqual(who.userId, 'alice@corp.com');
+            assert.strictEqual(who.credential, 'alice-obo-token', 'the broker must hand the connector the turn user\'s credential');
+        }
+        finally {
+            turn.release();
+        }
+    });
+    test('the credential never enters the connector process env — it rides only the per-call pipe', async () => {
+        const turn = plane.registerTurn({ userId: 'alice@corp.com', sessionKey: 's1', inboundToken: 'alice-obo-token' });
+        try {
+            const who = await callWhoami(plane.url, turn.nonce, 'alice-obo-token');
+            assert.strictEqual(who.envContainsProbe, false, 'raw credential must not appear anywhere in the connector env');
+        }
+        finally {
+            turn.release();
+        }
+    });
+    test('two concurrent turns each resolve their OWN user + credential (the §9.1 concurrency property)', async () => {
+        const alice = plane.registerTurn({ userId: 'alice@corp.com', sessionKey: 'sa', inboundToken: 'tok-alice' });
+        const bob = plane.registerTurn({ userId: 'bob@corp.com', sessionKey: 'sb', inboundToken: 'tok-bob' });
+        try {
+            const [a, b] = await Promise.all([
+                callWhoami(plane.url, alice.nonce),
+                callWhoami(plane.url, bob.nonce),
+            ]);
+            assert.strictEqual(a.userId, 'alice@corp.com');
+            assert.strictEqual(a.credential, 'tok-alice');
+            assert.strictEqual(b.userId, 'bob@corp.com');
+            assert.strictEqual(b.credential, 'tok-bob');
+        }
+        finally {
+            alice.release();
+            bob.release();
+        }
+    });
+    test('missing / unknown nonce → 401, fail closed', async () => {
+        await assert.rejects(() => callWhoami(plane.url, 'not-a-real-nonce'), /401|Unauthorized/i);
+    });
+    test('a released (turn-ended) nonce → 401 — a stale engine fails closed (§3.2)', async () => {
+        const turn = plane.registerTurn({ userId: 'alice@corp.com', sessionKey: 's1', inboundToken: 't' });
+        const nonce = turn.nonce;
+        const who = await callWhoami(plane.url, nonce);
+        assert.strictEqual(who.userId, 'alice@corp.com');
+        turn.release();
+        await assert.rejects(() => callWhoami(plane.url, nonce), /401|Unauthorized/i);
+    });
+    test('an expired deadline → 401 even if release() was never called (stranded-nonce backstop)', async () => {
+        const { nonce } = plane.registry.register({
+            userId: 'alice@corp.com',
+            sessionKey: 's1',
+            inboundToken: 't',
+            deadline: Date.now() - 1,
+        });
+        await assert.rejects(() => callWhoami(plane.url, nonce), /401|Unauthorized/i);
+    });
+    test('passthrough provider with no inbound token → the TOOL CALL errors, fail closed, turn itself unaffected', async () => {
+        const turn = plane.registerTurn({ userId: 'peer:telegram:123', sessionKey: 's2' });
+        try {
+            const { client, transport } = mcpClient(plane.url, turn.nonce);
+            await client.connect(transport);
+            const res = await client.callTool({ name: 'whoami', arguments: {} });
+            assert.strictEqual(res.isError, true, 'no inbound credential must fail the call closed');
+            const text = res.content[0].text;
+            assert.match(text, /fail-closed/);
+            await client.close();
+        }
+        finally {
+            turn.release();
+        }
+    });
+    test('a token-less turn fails closed even RIGHT AFTER the same user ran a turn WITH a token (no cache bridging)', async () => {
+        // Passthrough gets the platform token on every legitimate request; a broker cache
+        // that outlives the turn would let broken forwarding silently reuse the previous
+        // token for the cache TTL — the exact silent-fallback failure the provider forbids.
+        const withToken = plane.registerTurn({ userId: 'u@corp.com', sessionKey: 's3', inboundToken: 'tok-1' });
+        try {
+            const ok = await callWhoami(plane.url, withToken.nonce);
+            assert.strictEqual(ok.credential, 'tok-1');
+        }
+        finally {
+            withToken.release();
+        }
+        const withoutToken = plane.registerTurn({ userId: 'u@corp.com', sessionKey: 's3' });
+        try {
+            const { client, transport } = mcpClient(plane.url, withoutToken.nonce);
+            await client.connect(transport);
+            const res = await client.callTool({ name: 'whoami', arguments: {} });
+            assert.strictEqual(res.isError, true, 'the cached tok-1 must not serve a token-less turn');
+            await client.close();
+        }
+        finally {
+            withoutToken.release();
+        }
+    });
+});
+suite('data-plane: TurnRegistry unit properties', () => {
+    test('raw nonces are never map keys — lookups go through sha256', () => {
+        const reg = new data_plane_1.TurnRegistry();
+        const { nonce } = reg.register({ userId: 'u', sessionKey: 's' });
+        assert.ok(reg.resolve(nonce));
+        // resolve by the HASH must fail — only the raw nonce authenticates.
+        assert.strictEqual(reg.resolve((0, data_plane_1.hashNonce)(nonce)), undefined);
+    });
+    test('release is idempotent and deletes exactly its own entry', () => {
+        const reg = new data_plane_1.TurnRegistry();
+        const a = reg.register({ userId: 'a', sessionKey: 's' });
+        const b = reg.register({ userId: 'b', sessionKey: 's' });
+        a.release();
+        a.release();
+        assert.strictEqual(reg.resolve(a.nonce), undefined);
+        assert.strictEqual(reg.resolve(b.nonce)?.userId, 'b');
+        b.release();
+        assert.strictEqual(reg.size, 0);
+    });
+    test('expired entries are pruned on register', () => {
+        const reg = new data_plane_1.TurnRegistry();
+        reg.register({ userId: 'a', sessionKey: 's', deadline: Date.now() - 1 });
+        assert.strictEqual(reg.size, 1);
+        reg.register({ userId: 'b', sessionKey: 's' });
+        assert.strictEqual(reg.size, 1, 'the expired entry must have been pruned');
+    });
+});