@agenthippo-ai/agenthippo 0.1.0 → 0.2.3-dataplane

package/out/test/deploy-init.test.js

@@ -49,8 +49,10 @@ const child_process_1 = require("child_process");
 const yaml = __importStar(require("js-yaml"));
 const deploy_init_1 = require("../cli/deploy-init");
 const deploy_1 = require("../cli/commands/deploy");
+const idp_init_1 = require("../cli/idp-init");
 const CTX = {
     packName: 'databricks-analyst',
+    packVersion: '0.1.0',
     image: 'ghcr.io/agenthippo/runtime:2026.06',
     port: 8080,
     engine: 'claude',
@@ -115,6 +117,7 @@ suite('deploy-init: renderEnvExample', () => {
         assert.ok(out.includes('OAUTH2_PROXY_REDIRECT_URL='));
         assert.ok(out.includes('OAUTH2_PROXY_REVERSE_PROXY=true'));
         assert.ok(out.includes('AGENTHIPPO_AUTH_JWT_SECRET='));
+        assert.ok(out.includes('AGENTHIPPO_AUTH_DEV=0'), 'AUTH_DEV must default off in generated auth env');
     });
     test('renderAuthEnvExample honors custom hostname', () => {
         const out = (0, deploy_init_1.renderAuthEnvExample)({ hostname: 'agents.example.com' });
@@ -159,6 +162,43 @@ suite('deploy-init: renderTarget produces well-formed artifacts', () => {
             assert.ok(files['README.md'], `${t} missing README.md`);
         }
     });
+    test('every target ships a DATA-ACCESS.md summary (governance layer)', () => {
+        for (const t of deploy_init_1.DEPLOY_TARGETS) {
+            const files = (0, deploy_init_1.renderTarget)(t, CTX);
+            const doc = files['DATA-ACCESS.md'];
+            assert.ok(doc, `${t} missing DATA-ACCESS.md`);
+            assert.ok(doc.includes('## Secrets') && doc.includes('## Egress') && doc.includes('## Blast radius per component'), `${t} DATA-ACCESS.md missing a required section`);
+            assert.ok(doc.includes('api.anthropic.com:443'), `${t} DATA-ACCESS.md must name the model API host`);
+        }
+    });
+    test('DATA-ACCESS.md lists auth secrets + oauth2-proxy blast radius only for self-issued edge targets', () => {
+        const selfIssued = (0, deploy_init_1.renderTarget)('vm', CTX)['DATA-ACCESS.md'];
+        assert.ok(selfIssued.includes('AGENTHIPPO_AUTH_JWT_SECRET'));
+        assert.ok(selfIssued.includes('OAUTH2_PROXY_CLIENT_SECRET'));
+        assert.ok(selfIssued.includes('**oauth2-proxy**'));
+        const federated = (0, deploy_init_1.renderTarget)('vm', { ...CTX, ingress: 'edge-fed', idpUrl: 'https://auth.corp.example' })['DATA-ACCESS.md'];
+        assert.ok(federated.includes('AGENTHIPPO_AUTH_JWT_SECRET'));
+        assert.ok(!federated.includes('OAUTH2_PROXY_CLIENT_SECRET'), 'federated deployments mint no Google OAuth client');
+        assert.ok(!federated.includes('**oauth2-proxy**'), 'federated deployments run no oauth2-proxy');
+        const noEdge = (0, deploy_init_1.renderTarget)('databricks-app', CTX)['DATA-ACCESS.md'];
+        assert.ok(!noEdge.includes('AGENTHIPPO_AUTH_JWT_SECRET'), 'platform-native targets mint no JWT secret');
+    });
+    test('image-based targets emit pack provenance header and OCI labels', () => {
+        const marker = 'Generated from Agent Pack databricks-analyst@0.1.0 — packs.agenthippo.ai';
+        for (const t of ['vm', 'compose', 'cloudrun', 'spcs', 'cloudflare']) {
+            const files = (0, deploy_init_1.renderTarget)(t, CTX);
+            const df = files['Dockerfile'];
+            assert.ok(df.includes(marker), `${t} Dockerfile missing attribution`);
+            assert.ok(df.includes('LABEL ai.agenthippo.pack.name="databricks-analyst"'), `${t} missing pack.name label`);
+            assert.ok(df.includes('LABEL ai.agenthippo.pack.version="0.1.0"'), `${t} missing pack.version label`);
+            assert.ok(df.includes('LABEL ai.agenthippo.pack.engine="claude"'), `${t} missing pack.engine label`);
+            assert.ok(files['.env.example'].includes(marker), `${t} .env.example missing attribution`);
+            assert.ok(files['README.md'].includes(marker), `${t} README missing attribution`);
+        }
+        const vmRun = (0, deploy_init_1.renderTarget)('vm', CTX)['run.sh'];
+        assert.ok(vmRun.startsWith('#!'), 'run.sh keeps shebang first');
+        assert.ok(vmRun.includes(`# ${marker}`), 'run.sh attributes after shebang');
+    });
     test('image-based targets emit a valid 5-line-style Dockerfile referencing the runtime image', () => {
         for (const t of ['vm', 'compose', 'cloudrun', 'spcs', 'cloudflare']) {
             const df = (0, deploy_init_1.renderTarget)(t, CTX)['Dockerfile'];
@@ -181,9 +221,13 @@ suite('deploy-init: renderTarget produces well-formed artifacts', () => {
             // Ship only deploy/www/ from deploy/ (drops deploy/.env, credentials, build artifacts).
             assert.ok(di.includes('deploy/*'), `${t} should exclude deploy/*`);
             assert.ok(di.includes('!deploy/www/**'), `${t} should re-include deploy/www/**`);
-            // Defensive secret ignores.
+            // Defensive secret ignores — any-extension credentials + common private-key formats,
+            // not just *credentials*.json (see isSecretLikeBasename in deploy-init.ts).
             assert.ok(di.includes('**/.env'), `${t} should ignore **/.env`);
-            assert.ok(di.includes('**/*credentials*.json'), `${t} should ignore credentials json`);
+            assert.ok(di.includes('**/*credentials*'), `${t} should ignore credentials of any extension`);
+            assert.ok(di.includes('**/*.pem'), `${t} should ignore .pem files`);
+            assert.ok(di.includes('**/*.key'), `${t} should ignore .key files`);
+            assert.ok(di.includes('**/id_rsa'), `${t} should ignore id_rsa`);
             // skills/, scripts/, references/ must NOT be ignored lines.
             const ignored = di.split('\n').map((l) => l.trim()).filter((l) => l && !l.startsWith('#'));
             for (const keep of ['skills/', 'scripts/', 'references/', 'skills', 'scripts', 'references']) {
@@ -220,7 +264,7 @@ suite('deploy-init: renderTarget produces well-formed artifacts', () => {
         assert.deepStrictEqual(app.user_authorization?.scopes, ['sql']);
         const pkg = JSON.parse(files['package.json']);
         assert.ok(pkg.dependencies['@anthropic-ai/claude-code']);
-        assert.ok(pkg.dependencies['@agenthippo-ai/cli']);
+        assert.ok(pkg.dependencies['@agenthippo-ai/agenthippo']);
     });
     test('YAML artifacts parse', () => {
         assert.doesNotThrow(() => yaml.load((0, deploy_init_1.renderTarget)('vm', CTX)['docker-compose.yml']));
@@ -286,6 +330,11 @@ suite('deploy-init: renderTarget produces well-formed artifacts', () => {
         assert.ok(!caddy.includes('oauth2-proxy:4180') && !caddy.includes('auth-broker:9780') && !caddy.includes('agent:8080'), 'edge Caddyfile must use localhost upstreams, not docker-DNS names');
         assert.ok(caddy.includes('localhost:4180') && caddy.includes('localhost:9780') && caddy.includes('localhost:8090'), 'edge Caddyfile routes to oauth2-proxy / auth-broker / agent on localhost');
         assert.ok(caddy.includes(':{$PORT}') && caddy.includes('auto_https off'), 'Caddy listens on HTTP :$PORT (Cloud Run terminates TLS)');
+        // IDE PKCE authorize must be SSO-gated before the catch-all /oauth/* → broker route.
+        assert.ok(caddy.includes('handle /oauth/authorize {'), 'edge Caddyfile gates /oauth/authorize');
+        assert.ok(/handle \/oauth\/authorize \{[\s\S]*?forward_auth localhost:4180[\s\S]*?copy_headers X-Auth-Request-Email/.test(caddy), '/oauth/authorize forward_auth copies X-Auth-Request-Email via localhost oauth2-proxy');
+        assert.ok(caddy.indexOf('handle /oauth/authorize {') < caddy.indexOf('handle /oauth/* {'), '/oauth/authorize must precede the catch-all /oauth/* handle');
+        assert.ok(caddy.includes('handle /oauth/browser-login {'), 'edge Caddyfile gates /oauth/browser-login');
         // Caddyfile is mounted from a Secret (the deploy script upserts it).
         assert.ok(svc.includes('${SERVICE}-caddyfile'), 'Caddyfile mounted from a secret');
         // auth-broker reuses the agent image (CLI ships `auth-broker`).
@@ -304,6 +353,30 @@ suite('deploy-init: renderTarget produces well-formed artifacts', () => {
         assert.ok(files['.env.auth.example'].includes('OAUTH2_PROXY_CLIENT_ID') && files['.env.auth.example'].includes('AGENTHIPPO_AUTH_JWT_SECRET'));
         // Note: service.yaml is a sed-template (${SERVICE}/${IMAGE}/${PUBLIC_HOSTNAME}/…), so it is
         // only valid YAML after the deploy script substitutes placeholders — same as the IAP template.
+        assert.ok(files['README.md'].includes('**Egress:**'), 'edge README documents the egress allowlist');
+    });
+    test('cloudrun --ingress edge-fed --model-routing gateway drops LiteLLM/OTEL — agent calls gateway.agenthippo.ai', () => {
+        const files = (0, deploy_init_1.renderTarget)('cloudrun', {
+            ...CTX, ingress: 'edge-fed', modelRouting: 'gateway', model: 'ah-auto',
+            idpUrl: 'https://auth.agenthippo.ai', cookieDomain: '.agenthippo.ai',
+        });
+        const svc = files['service.yaml'];
+        const sh = files['cloudrun-deploy.sh'];
+        assert.ok(svc.includes('name: caddy') && svc.includes('name: auth-broker') && svc.includes('name: agent'));
+        assert.ok(!svc.includes('name: litellm') && !svc.includes('name: otel-collector'), 'no Spotlight sidecars');
+        assert.ok(svc.includes('https://gateway.agenthippo.ai/v1'), 'agent points at org gateway');
+        assert.ok(!svc.includes('http://localhost:4443'), 'agent must not route through in-pod LiteLLM');
+        assert.ok(!files['otel-collector.yaml'], 'no otel config artifact');
+        assert.ok(!sh.includes('LITELLM_KEY') && !sh.includes('otel-config'), 'deploy skips litellm/otel secrets');
+        assert.ok(sh.includes('${SERVICE}-provider-key'), 'gateway key stored as provider-key secret');
+        assert.ok(files['.env.example'].includes('AGENTHIPPO_LITELLM_BASE_URL=https://gateway.agenthippo.ai/v1'));
+        assert.doesNotThrow(() => (0, child_process_1.execFileSync)('bash', ['-n', '-c', sh]));
+        const rendered = svc
+            .replace(/\$\{SERVICE\}/g, 'emoji-gateway')
+            .replace(/\$\{IMAGE\}/g, 'us-docker.pkg.dev/x/y/z:latest')
+            .replace(/\$\{PUBLIC_HOSTNAME\}/g, 'emoji.agenthippo.ai')
+            .replace(/\$\{ALLOWED_DOMAINS\}/g, 'agenthippo.ai');
+        assert.doesNotThrow(() => yaml.load(rendered), 'rendered gateway-direct service.yaml is valid YAML');
     });
     test('cloudrun --ingress edge-fed (A′) verifies the shared JWT — no oauth2-proxy, no per-service OAuth', () => {
         const files = (0, deploy_init_1.renderTarget)('cloudrun', {
@@ -355,6 +428,7 @@ suite('deploy-init: renderTarget produces well-formed artifacts', () => {
             .replace(/\$\{PUBLIC_HOSTNAME\}/g, 'cs.agenthippo.ai')
             .replace(/\$\{ALLOWED_DOMAINS\}/g, 'agenthippo.ai');
         assert.doesNotThrow(() => yaml.load(rendered), 'rendered service.yaml is valid YAML');
+        assert.ok(files['README.md'].includes('**Egress:**'), 'edge-fed README documents the egress allowlist');
     });
     test('renderAuthEnvExample fed variant has no Google OAuth client', () => {
         const out = (0, deploy_init_1.renderAuthEnvExample)({ hostname: 'cs.agenthippo.ai', fed: true, idpUrl: 'https://auth.agenthippo.ai', cookieDomain: '.agenthippo.ai' });
@@ -393,11 +467,115 @@ suite('deploy-init: renderTarget produces well-formed artifacts', () => {
         const env = (0, deploy_init_1.renderTarget)('cloudrun', ctx)['.env.example'];
         assert.ok(env.includes('CURSOR_API_KEY='));
     });
+    test('cloudrun IAP paths pin AGENTHIPPO_IDENTITY_HEADER so X-Agent-User cannot spoof identity', () => {
+        // Claude/codex → Spotlight multi-container path (renderCloudrunServiceYaml).
+        const spotlight = (0, deploy_init_1.renderTarget)('cloudrun', CTX);
+        assert.ok(spotlight['service.yaml'].includes('AGENTHIPPO_IDENTITY_HEADER'), 'Spotlight service.yaml must declare AGENTHIPPO_IDENTITY_HEADER');
+        assert.ok(spotlight['cloudrun-deploy.sh'].includes('x-goog-authenticated-user-email'), 'Spotlight deploy script must fill the pin with the IAP header when ENABLE_IAP=1');
+        // Cursor → T1-generic single-container path.
+        const cursorCtx = { ...CTX, engine: 'cursor', model: 'auto', image: 'ghcr.io/agenthippo/runtime:latest-cursor' };
+        const generic = (0, deploy_init_1.renderTarget)('cloudrun', cursorCtx);
+        assert.ok(generic['cloudrun-deploy.sh'].includes('AGENTHIPPO_IDENTITY_HEADER=x-goog-authenticated-user-email'), 'T1-generic deploy script must pin AGENTHIPPO_IDENTITY_HEADER to the IAP header');
+        // Both must skip the pin when ENABLE_IAP=0 (IAP never sets the header then — pinning
+        // unconditionally would make every request resolve to anonymous during bootstrap).
+        assert.ok(spotlight['cloudrun-deploy.sh'].includes('ENABLE_IAP'), 'Spotlight pin must be ENABLE_IAP-conditional');
+        assert.ok(generic['cloudrun-deploy.sh'].includes('IDENTITY_ENV='), 'T1-generic pin must be ENABLE_IAP-conditional');
+    });
+    test('databricks-app pins AGENTHIPPO_IDENTITY_HEADER to x-forwarded-email', () => {
+        const start = (0, deploy_init_1.renderTarget)('databricks-app', CTX)['start.js'];
+        assert.ok(start.includes("AGENTHIPPO_IDENTITY_HEADER: 'x-forwarded-email'"), 'Databricks App start.js must pin identity to the workspace SSO header');
+        // Bootstrap escape hatch (analogous to Cloud Run ENABLE_IAP=0).
+        assert.ok(start.includes("AGENTHIPPO_PIN_IDENTITY === '0'"), 'Databricks pin must be skippable via AGENTHIPPO_PIN_IDENTITY=0');
+    });
     test('spcs egress is limited to the model API via one EAI', () => {
         const sql = (0, deploy_init_1.renderTarget)('spcs', CTX)['deploy.sql'];
         assert.ok(sql.includes('api.anthropic.com:443'));
         assert.ok(/EXTERNAL ACCESS INTEGRATION/.test(sql));
     });
+    test('aws-ecs bare (no ingress) is a single-container task with no edge opinion', () => {
+        const files = (0, deploy_init_1.renderTarget)('aws-ecs', CTX);
+        assert.ok(!files['Caddyfile'], 'bare aws-ecs ships no Caddy');
+        assert.ok(!files['.env.auth.example'], 'bare aws-ecs has no local auth secrets');
+        const task = JSON.parse(files['task-definition.json']);
+        assert.strictEqual(task.networkMode, 'awsvpc');
+        assert.deepStrictEqual(task.requiresCompatibilities, ['FARGATE']);
+        assert.strictEqual(task.containerDefinitions.length, 1, 'exactly one container: the agent');
+        assert.strictEqual(task.containerDefinitions[0].name, 'agent');
+        assert.doesNotThrow(() => (0, child_process_1.execFileSync)('bash', ['-n', '-c', files['deploy.sh']]));
+    });
+    test('aws-ecs --ingress edge reuses the Cloud Run edge Caddyfile verbatim (shared sidecar identity layer)', () => {
+        const files = (0, deploy_init_1.renderTarget)('aws-ecs', { ...CTX, ingress: 'edge' });
+        const task = JSON.parse(files['task-definition.json']);
+        const names = task.containerDefinitions.map((c) => c.name);
+        assert.deepStrictEqual(names, ['caddy', 'oauth2-proxy', 'auth-broker', 'agent']);
+        assert.strictEqual(task.networkMode, 'awsvpc', 'one task, containers share localhost — same shape as Cloud Run sidecars');
+        assert.ok(files['Caddyfile'].includes('localhost:4180') && files['Caddyfile'].includes('localhost:9780'), 'localhost addressing (awsvpc shared network), not docker-DNS names');
+        assert.ok(files['.env.auth.example'].includes('OAUTH2_PROXY_CLIENT_ID'));
+        assert.doesNotThrow(() => (0, child_process_1.execFileSync)('bash', ['-n', '-c', files['deploy.sh']]));
+    });
+    test('aws-ecs --ingress edge-fed drops oauth2-proxy from the task and Caddyfile', () => {
+        const files = (0, deploy_init_1.renderTarget)('aws-ecs', { ...CTX, ingress: 'edge-fed', idpUrl: 'https://auth.corp.example' });
+        const task = JSON.parse(files['task-definition.json']);
+        const names = task.containerDefinitions.map((c) => c.name);
+        assert.deepStrictEqual(names, ['caddy', 'auth-broker', 'agent']);
+        assert.ok(!files['Caddyfile'].includes('localhost:4180'), 'no oauth2-proxy upstream in a federated Caddyfile');
+        assert.ok(files['Caddyfile'].includes('forward_auth localhost:9780'), 'verifies via auth-broker');
+        assert.ok(files['Caddyfile'].includes('https://auth.corp.example/oauth/browser-login'));
+        assert.ok(!files['.env.auth.example'].includes('OAUTH2_PROXY_CLIENT_ID'));
+        assert.doesNotThrow(() => (0, child_process_1.execFileSync)('bash', ['-n', '-c', files['deploy.sh']]));
+    });
+    test('azure-container-apps bare (no ingress) is a single-container app with no edge opinion', () => {
+        const files = (0, deploy_init_1.renderTarget)('azure-container-apps', CTX);
+        assert.ok(!files['Caddyfile'], 'bare azure-container-apps ships no Caddy');
+        assert.ok(!files['.env.auth.example'], 'bare azure-container-apps has no local auth secrets');
+        const spec = JSON.parse(files['containerapp.json']);
+        assert.strictEqual(spec.properties.template.containers.length, 1, 'exactly one container: the agent');
+        assert.strictEqual(spec.properties.template.containers[0].name, 'agent');
+        assert.strictEqual(spec.properties.configuration.ingress.external, true);
+        assert.doesNotThrow(() => (0, child_process_1.execFileSync)('bash', ['-n', '-c', files['deploy.sh']]));
+    });
+    test('azure-container-apps --ingress edge reuses the Cloud Run edge Caddyfile verbatim (shared sidecar identity layer)', () => {
+        const files = (0, deploy_init_1.renderTarget)('azure-container-apps', { ...CTX, ingress: 'edge' });
+        const spec = JSON.parse(files['containerapp.json']);
+        const names = spec.properties.template.containers.map((c) => c.name);
+        assert.deepStrictEqual(names, ['caddy', 'oauth2-proxy', 'auth-broker', 'agent']);
+        assert.ok(files['Caddyfile'].includes('localhost:4180') && files['Caddyfile'].includes('localhost:9780'), 'localhost addressing (containers in one replica share it), not docker-DNS names');
+        assert.ok(files['.env.auth.example'].includes('OAUTH2_PROXY_CLIENT_ID'));
+        assert.doesNotThrow(() => (0, child_process_1.execFileSync)('bash', ['-n', '-c', files['deploy.sh']]));
+    });
+    test('azure-container-apps --ingress edge-fed drops oauth2-proxy from the spec and Caddyfile', () => {
+        const files = (0, deploy_init_1.renderTarget)('azure-container-apps', { ...CTX, ingress: 'edge-fed', idpUrl: 'https://auth.corp.example' });
+        const spec = JSON.parse(files['containerapp.json']);
+        const names = spec.properties.template.containers.map((c) => c.name);
+        assert.deepStrictEqual(names, ['caddy', 'auth-broker', 'agent']);
+        assert.ok(!files['Caddyfile'].includes('localhost:4180'), 'no oauth2-proxy upstream in a federated Caddyfile');
+        assert.ok(files['Caddyfile'].includes('forward_auth localhost:9780'), 'verifies via auth-broker');
+        assert.ok(files['Caddyfile'].includes('https://auth.corp.example/oauth/browser-login'));
+        assert.ok(!files['.env.auth.example'].includes('OAUTH2_PROXY_CLIENT_ID'));
+        assert.doesNotThrow(() => (0, child_process_1.execFileSync)('bash', ['-n', '-c', files['deploy.sh']]));
+    });
+    // Governance (PLAN/deploy.md §6): every target must document what it can reach outbound —
+    // spcs enforces it via a network rule (tested above); every other target must at least name
+    // the host in its README so a security review doesn't have to reverse-engineer it.
+    test('every non-spcs target documents its egress allowlist in README', () => {
+        for (const target of deploy_init_1.DEPLOY_TARGETS) {
+            if (target === 'spcs') {
+                continue;
+            }
+            const readme = (0, deploy_init_1.renderTarget)(target, CTX)['README.md'];
+            assert.ok(readme?.includes('**Egress:**'), `${target} README must document its egress allowlist`);
+            assert.ok(readme.includes('api.anthropic.com:443'), `${target} README must name the model API host`);
+        }
+    });
+    // Governance (PLAN/deploy.md §6): a container that might ever be reached directly (bypassing
+    // its fronting proxy/Worker) must pin AGENTHIPPO_IDENTITY_HEADER so it can't be spoofed by an
+    // unauthenticated caller naming themselves via the same header name serve otherwise trusts as
+    // an unpinned alias. iap/databricks-app are covered by their own tests above; cloudflare here.
+    test('cloudflare pins AGENTHIPPO_IDENTITY_HEADER so a directly-reached container cannot be spoofed', () => {
+        const files = (0, deploy_init_1.renderTarget)('cloudflare', CTX);
+        assert.ok(files['Dockerfile'].includes('ENV AGENTHIPPO_IDENTITY_HEADER=x-agent-user'), 'cloudflare Dockerfile must pin identity to the header its own Worker sets');
+        assert.ok(files['README.md'].includes('Identity pin'), 'README must document the pin for whoever wires the Worker');
+    });
     test('vm target includes edge compose profile; agent has no SSO-bypass host port', () => {
         const files = (0, deploy_init_1.renderTarget)('vm', CTX);
         const compose = files['docker-compose.yml'];
@@ -411,10 +589,17 @@ suite('deploy-init: renderTarget produces well-formed artifacts', () => {
         assert.ok(compose.includes('./www:/srv/www'));
         assert.ok(files['run.sh'].includes('127.0.0.1:8080'));
         assert.ok(files['run-edge-tunnel.sh'].includes('--profile edge --profile tunnel'));
+        assert.ok(files['Caddyfile'].includes('lb_policy header X-Agent-User'));
         assert.ok(files['Caddyfile'].includes('reverse_proxy agent:8080'));
         assert.ok(files['Caddyfile'].includes('{$AGENTHIPPO_PUBLIC_HOSTNAME}'));
         assert.ok(files['Caddyfile'].includes('@health path /health /ready'));
         assert.ok(!files['Caddyfile'].includes('@api path /v1/* /health /ready'));
+        // IDE PKCE authorize must be SSO-gated (oauth2-proxy → X-Auth-Request-Email), not dumped via /oauth/*.
+        const caddy = files['Caddyfile'];
+        assert.ok(caddy.includes('handle /oauth/authorize {'), 'Caddyfile gates /oauth/authorize');
+        assert.ok(/handle \/oauth\/authorize \{[\s\S]*?forward_auth oauth2-proxy:4180[\s\S]*?copy_headers X-Auth-Request-Email/.test(caddy), '/oauth/authorize forward_auth copies X-Auth-Request-Email');
+        assert.ok(caddy.indexOf('handle /oauth/authorize {') < caddy.indexOf('handle /oauth/* {'), '/oauth/authorize must precede the catch-all /oauth/* handle');
+        assert.ok(caddy.includes('handle /oauth/browser-login {'), 'Caddyfile gates /oauth/browser-login');
         assert.ok(files['www/index.html'].includes('<form id="chat">'));
         // In-compose config-file tunnel (the proven-live path): cloudflared container → caddy:80.
         assert.ok(files['cloudflared.yml'].includes('http://caddy:80'), 'in-compose cloudflared reaches Caddy on the docker network');
@@ -437,6 +622,65 @@ suite('deploy-init: renderTarget produces well-formed artifacts', () => {
         assert.ok(files['Caddyfile']);
         assert.ok(files['.env.auth.example'].includes('OAUTH2_PROXY_PROVIDER'));
     });
+    for (const target of ['vm', 'compose']) {
+        test(`${target} --ingress edge-fed verifies the shared JWT — no oauth2-proxy, no per-agent OAuth`, () => {
+            const fedCtx = {
+                ...CTX, ingress: 'edge-fed', idpUrl: 'https://auth.corp.example', cookieDomain: '.corp.example',
+            };
+            const files = (0, deploy_init_1.renderTarget)(target, fedCtx);
+            const compose = files['docker-compose.yml'];
+            const caddy = files['Caddyfile'];
+            const auth = files['.env.auth.example'];
+            assert.ok(!/^\s*oauth2-proxy:/m.test(compose), `${target} edge-fed must not ship an oauth2-proxy container`);
+            assert.ok(compose.includes('depends_on: [agent, auth-broker]'), 'caddy no longer depends on oauth2-proxy');
+            assert.ok(!caddy.includes('oauth2-proxy:4180') && !caddy.includes('/oauth2/*'), 'no oauth2-proxy routes in a federated Caddyfile');
+            assert.ok(caddy.includes('forward_auth auth-broker:9780'), 'Caddy verifies via auth-broker');
+            assert.ok(caddy.includes('https://auth.corp.example/oauth/browser-login'), 'browser 401 redirects to the central IdP browser-login endpoint');
+            assert.ok(caddy.includes('return_to='), 'redirect carries a return_to for the round trip');
+            // Target-specific behavior (sticky lb / static file split) must survive federation —
+            // identity mode and deployment shape are independent axes.
+            assert.ok(caddy.includes('lb_policy header X-Agent-User'), 'sticky agent proxy unaffected by identity mode');
+            assert.ok(caddy.includes('root * /srv/www'), 'static file serving unaffected by identity mode');
+            assert.ok(auth.includes('AGENTHIPPO_AUTH_JWT_SECRET') && auth.includes('AGENTHIPPO_AUTH_IDP_URL'));
+            assert.ok(!auth.includes('OAUTH2_PROXY_CLIENT_ID'), 'federated auth env has no Google OAuth client');
+        });
+    }
+    for (const target of ['vm', 'compose']) {
+        test(`${target} --ingress edge-fed --colocate ships only the agent — no Caddy/oauth2-proxy/auth-broker`, () => {
+            const colocateCtx = {
+                ...CTX, ingress: 'edge-fed', idpUrl: 'https://auth.corp.example', colocate: true,
+            };
+            const files = (0, deploy_init_1.renderTarget)(target, colocateCtx);
+            const compose = files['docker-compose.yml'];
+            const snippet = files['agent-route.caddy'];
+            assert.ok(!files['Caddyfile'], `${target} colocate must not ship its own Caddyfile`);
+            assert.ok(!files['.env.auth.example'], `${target} colocate must not ship any local auth secrets`);
+            assert.ok(!/^\s*(caddy|oauth2-proxy|auth-broker):/m.test(compose), `${target} colocate compose must contain only the agent service`);
+            assert.ok(compose.includes('container_name: databricks-analyst-agent'), 'fixed, predictable container name');
+            assert.ok(compose.includes('networks: [colocate]') && compose.includes('external: true'), 'agent joins the IdP\'s external colocate network');
+            assert.ok(!compose.includes('ports:'), 'no host port — reached only via the IdP\'s Caddy, over the shared network');
+            assert.ok(snippet, 'route snippet generated for the operator to drop onto the IdP host');
+            // http:// (not https://) — must match the IdP Caddyfile's TLS model: auto_https is
+            // off there and TLS terminates in front, so an imported https:// block wouldn't
+            // match plaintext traffic forwarded from the front proxy.
+            assert.ok(snippet.includes(`http://${CTX.publicHostname} {`), 'snippet is a plain-HTTP site block, matching the IdP\'s own');
+            assert.ok(!snippet.includes(`https://${CTX.publicHostname}`), 'must not use https:// — the IdP Caddyfile has auto_https off');
+            assert.ok(snippet.includes('reverse_proxy databricks-analyst-agent:8080'), 'snippet proxies to the fixed container name');
+            assert.ok(snippet.includes('forward_auth auth-broker:9780'), 'identity is verified via the IdP\'s own auth-broker');
+            assert.ok(!snippet.includes('oauth2-proxy'), 'no oauth2-proxy — federated identity only');
+            assert.ok(snippet.includes('https://auth.corp.example/oauth/browser-login'), 'unauthenticated browsers redirect to the IdP');
+            const dataAccess = files['DATA-ACCESS.md'];
+            assert.ok(!dataAccess.includes('AGENTHIPPO_AUTH_JWT_SECRET'), 'colocated agent holds no JWT secret of its own');
+            assert.ok(!dataAccess.includes('**oauth2-proxy**'), 'colocated agent runs no oauth2-proxy');
+            assert.ok(files['www/index.html'], 'colocated agent ships browser landing page at GET /');
+            assert.ok(files['Dockerfile'].includes('--www-dir'), 'serve enables static chat UI after SSO');
+        });
+    }
+    test('--colocate is a no-op without --ingress edge-fed (still ships the normal self-issued edge)', () => {
+        const files = (0, deploy_init_1.renderTarget)('vm', { ...CTX, colocate: true });
+        assert.ok(files['Caddyfile'], 'no ingress edge-fed → colocate does not apply, normal vm artifacts render');
+        assert.ok(!files['agent-route.caddy']);
+    });
     test('agent service does not load .env.auth; broker + oauth2-proxy do', () => {
         const compose = (0, deploy_init_1.renderTarget)('compose', CTX)['docker-compose.yml'];
         // The agent runs model-driven tool calls — it must never receive the token-signing key.
@@ -452,7 +696,7 @@ suite('deploy-init: deployCommand stages a self-contained pack', () => {
     setup(() => {
         pack = fs.mkdtempSync(path.join(os.tmpdir(), 'ah-pack-'));
         staging = fs.mkdtempSync(path.join(os.tmpdir(), 'ah-stage-'));
-        fs.writeFileSync(path.join(pack, 'agent.yaml'), 'apiVersion: agenthippo.ai/v1\nkind: Agent\nmetadata:\n  name: cs-test\nspec:\n  engine: claude\n  model: litellm/gpt-5.5\n');
+        fs.writeFileSync(path.join(pack, 'agent.yaml'), 'apiVersion: agenthippo.ai/v1\nkind: Agent\nmetadata:\n  name: cs-test\n  version: 0.1.0\nspec:\n  engine: claude\n  model: litellm/gpt-5.5\n');
         fs.writeFileSync(path.join(pack, 'AGENTS.md'), '# cs-test\n');
         fs.mkdirSync(path.join(pack, 'skills', 'demo', 'scripts'), { recursive: true });
         fs.writeFileSync(path.join(pack, 'skills', 'demo', 'scripts', 'run.sh'), 'echo hi\n');
@@ -462,6 +706,8 @@ suite('deploy-init: deployCommand stages a self-contained pack', () => {
         fs.writeFileSync(path.join(pack, 'node_modules', 'foo', 'index.js'), 'x');
         fs.writeFileSync(path.join(pack, '.env'), 'SECRET=1\n');
         fs.writeFileSync(path.join(pack, 'my-credentials.json'), '{}\n');
+        fs.writeFileSync(path.join(pack, 'service-account.pem'), 'FAKE PEM\n');
+        fs.writeFileSync(path.join(pack, 'id_rsa'), 'FAKE PRIVATE KEY\n');
         fs.mkdirSync(path.join(pack, 'deploy'), { recursive: true });
         fs.writeFileSync(path.join(pack, 'deploy', 'leftover.yaml'), 'stale\n');
     });
@@ -479,6 +725,8 @@ suite('deploy-init: deployCommand stages a self-contained pack', () => {
         assert.ok(!fs.existsSync(path.join(staging, 'node_modules')), 'node_modules must not be copied into staging');
         assert.ok(!fs.existsSync(path.join(staging, '.env')), '.env must not be copied into staging');
         assert.ok(!fs.existsSync(path.join(staging, 'my-credentials.json')), 'credentials json must not be copied');
+        assert.ok(!fs.existsSync(path.join(staging, 'service-account.pem')), '.pem key must not be copied');
+        assert.ok(!fs.existsSync(path.join(staging, 'id_rsa')), 'id_rsa key must not be copied');
         // The source pack's own deploy/ is not copied (the generator owns staging/deploy/).
         assert.ok(!fs.existsSync(path.join(staging, 'deploy', 'leftover.yaml')), 'source deploy/ must not be copied');
         // Generated artifacts under staging/deploy/.
@@ -498,6 +746,25 @@ suite('deploy-init: deployCommand stages a self-contained pack', () => {
         assert.ok(fs.existsSync(path.join(staging, 'agent.yaml')), 'packdir flag resolved the pack');
         assert.ok(fs.existsSync(path.join(staging, 'deploy', 'Dockerfile')), 'artifacts generated from packdir pack');
     });
+    test('--blueprint team-pilot --platform cloudrun resolves to IAP (no Caddyfile, no oauth2-proxy)', async () => {
+        await (0, deploy_1.deployCommand)('init', pack, {
+            target: 'vm', blueprint: 'team-pilot', platform: 'cloudrun', out: staging, port: 8080, force: true,
+        });
+        assert.ok(fs.existsSync(path.join(staging, 'deploy', 'cloudrun-deploy.sh')), 'cloudrun artifacts generated');
+        assert.ok(!fs.existsSync(path.join(staging, 'deploy', 'Caddyfile')), 'team-pilot on cloudrun is IAP — no Caddy edge');
+        const sh = fs.readFileSync(path.join(staging, 'deploy', 'cloudrun-deploy.sh'), 'utf8');
+        assert.ok(sh.includes('--iap'), 'blueprint-resolved --ingress iap reaches the actual IAP deploy path');
+    });
+    test('--blueprint enterprise-fleet --platform vm resolves to a federated (no oauth2-proxy) edge', async () => {
+        await (0, deploy_1.deployCommand)('init', pack, {
+            target: 'cloudrun', blueprint: 'enterprise-fleet', platform: 'vm', out: staging, port: 8080, force: true,
+            idpUrl: 'https://auth.corp.example',
+        });
+        const caddy = fs.readFileSync(path.join(staging, 'deploy', 'Caddyfile'), 'utf8');
+        const compose = fs.readFileSync(path.join(staging, 'deploy', 'docker-compose.yml'), 'utf8');
+        assert.ok(!caddy.includes('oauth2-proxy:4180'), 'enterprise-fleet federates — no oauth2-proxy in the Caddyfile');
+        assert.ok(!/^\s*oauth2-proxy:/m.test(compose), 'enterprise-fleet federates — no oauth2-proxy container');
+    });
 });
 suite('deploy-init: copyPackToStaging dereferences symlinks + skips broken ones', () => {
     let pack;
@@ -505,7 +772,7 @@ suite('deploy-init: copyPackToStaging dereferences symlinks + skips broken ones'
     setup(() => {
         pack = fs.mkdtempSync(path.join(os.tmpdir(), 'ah-pack-'));
         staging = fs.mkdtempSync(path.join(os.tmpdir(), 'ah-stage-'));
-        fs.writeFileSync(path.join(pack, 'agent.yaml'), 'apiVersion: agenthippo.ai/v1\nkind: Agent\nmetadata:\n  name: link-test\nspec:\n  engine: claude\n');
+        fs.writeFileSync(path.join(pack, 'agent.yaml'), 'apiVersion: agenthippo.ai/v1\nkind: Agent\nmetadata:\n  name: link-test\n  version: 0.1.0\nspec:\n  engine: claude\n');
         // Real skill content + a shared file the skill links to (relative symlink → resolved on copy).
         fs.mkdirSync(path.join(pack, 'skills', 'demo'), { recursive: true });
         fs.writeFileSync(path.join(pack, 'skills', 'demo', 'REAL.md'), '# real content\n');
@@ -530,3 +797,18 @@ suite('deploy-init: copyPackToStaging dereferences symlinks + skips broken ones'
         assert.ok(broken.includes('skills/broken/SKILL.md'), 'broken symlink reported in returned list');
     });
 });
+suite('deploy-init: enterprise-deploy/idp/ (customer 0) stays in sync with `agenthippo idp init`', () => {
+    // PLAN/deploy.md — AgentHippo's own auth.agenthippo.ai instance is "customer 0": it must be
+    // stood up with the exact same `agenthippo idp init` a real enterprise customer would use,
+    // not a bespoke hand-maintained copy. This fails loudly if the checked-in files drift from
+    // what the generator produces for the same hostname (regenerate with:
+    // `agenthippo idp init --hostname auth.agenthippo.ai --out enterprise-deploy/idp --force`).
+    test('checked-in files are byte-identical to renderIdpArtifacts({ hostname: "auth.agenthippo.ai" })', () => {
+        const idpDir = path.join(__dirname, '..', '..', '..', '..', 'enterprise-deploy', 'idp');
+        const files = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.agenthippo.ai' });
+        for (const [rel, expected] of Object.entries(files)) {
+            const actual = fs.readFileSync(path.join(idpDir, rel), 'utf8');
+            assert.strictEqual(actual, expected, `enterprise-deploy/idp/${rel} is stale — regenerate with: agenthippo idp init --hostname auth.agenthippo.ai --out enterprise-deploy/idp --force`);
+        }
+    });
+});

package/out/test/egress-broker.test.js

@@ -0,0 +1,172 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Egress broker tests (secure-obo-design §7.6)
+ *
+ *  Boots the real broker (loopback HTTP + shared TurnRegistry) against a temp workspace whose
+ *  gateway-outbound handle store is seeded like the bridge would seed it, then drives it exactly
+ *  as the agent-facing `gateway send` broker mode does: bearer nonce, `{message, to?}` body.
+ *
+ *  The `send` function is a spy — no live OpenClaw gateway — so we assert on WHAT the broker
+ *  resolved and WHETHER it delivered, not on the platform call itself.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const data_plane_1 = require("../cli/data-plane");
+const outboundPaths_1 = require("../gateway/outboundPaths");
+const AGENT_ID = 'demo-agent';
+/** Seed a handle store the way the bridge's upsertGatewayOutboundHandle would. */
+function seedStore(workspaceRoot, storeKey, handle) {
+    const p = (0, outboundPaths_1.getGatewayOutboundFilePath)(workspaceRoot, (0, outboundPaths_1.safeGatewaySessionDirId)(storeKey));
+    fs.mkdirSync(path.dirname(p), { recursive: true });
+    fs.writeFileSync(p, JSON.stringify({
+        version: 1,
+        lastByAgent: { [AGENT_ID]: handle },
+        targetsByAgent: { [AGENT_ID]: { [handle.target]: handle } },
+    }), 'utf8');
+}
+function handle(target, overrides = {}) {
+    return {
+        agentId: AGENT_ID, channel: 'telegram', target,
+        firstSeenAt: 1, lastSeenAt: 2, inboundCount: 1, ...overrides,
+    };
+}
+async function post(url, nonce, body) {
+    const res = await fetch(url, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...(nonce !== undefined ? { Authorization: `Bearer ${nonce}` } : {}) },
+        body: JSON.stringify(body),
+    });
+    return { status: res.status, json: await res.json().catch(() => ({})) };
+}
+suite('egress broker: server-side resolution + fail-closed (§7.6)', function () {
+    this.timeout(15_000);
+    let workspaceRoot;
+    let registry;
+    let broker;
+    let sends;
+    suiteSetup(async () => {
+        workspaceRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'egress-ws-'));
+        registry = new data_plane_1.TurnRegistry();
+        sends = [];
+        broker = await (0, data_plane_1.startEgressBroker)({
+            registry,
+            workspaceRoot,
+            agentId: AGENT_ID,
+            send: async (h, message, media) => {
+                sends.push({ handle: h, message, media });
+                return { ok: true, via: 'spy' };
+            },
+        });
+    });
+    suiteTeardown(async () => {
+        await broker?.close();
+        fs.rmSync(workspaceRoot, { recursive: true, force: true });
+    });
+    test('binds loopback only', () => {
+        assert.ok(broker.url.startsWith('http://127.0.0.1:'), broker.url);
+    });
+    test('reply-to-sender: a live nonce delivers to the session\'s bound handle', async () => {
+        seedStore(workspaceRoot, 'chat-1', handle('telegram:dm:100'));
+        const turn = registry.register({ userId: 'u@corp.com', sessionKey: 's', egressStoreKey: 'chat-1' });
+        try {
+            const { status, json } = await post(broker.url, turn.nonce, { message: 'hello' });
+            assert.strictEqual(status, 200);
+            assert.strictEqual(json.ok, true);
+            assert.strictEqual(sends.at(-1)?.handle.target, 'telegram:dm:100');
+            assert.strictEqual(sends.at(-1)?.message, 'hello');
+        }
+        finally {
+            turn.release();
+        }
+    });
+    test('`to` may only SELECT among bound handles — a new destination is refused, no send', async () => {
+        seedStore(workspaceRoot, 'chat-2', handle('telegram:dm:200'));
+        const turn = registry.register({ userId: 'u@corp.com', sessionKey: 's', egressStoreKey: 'chat-2' });
+        const before = sends.length;
+        try {
+            const { status, json } = await post(broker.url, turn.nonce, { message: 'exfil', to: 'telegram:dm:ATTACKER' });
+            assert.strictEqual(status, 404, 'a target not bound to this session must not resolve');
+            assert.strictEqual(json.ok, false);
+            assert.strictEqual(sends.length, before, 'nothing may be delivered when resolution fails');
+        }
+        finally {
+            turn.release();
+        }
+    });
+    test('off-turn / released nonce → 401, fail closed, no send', async () => {
+        seedStore(workspaceRoot, 'chat-3', handle('telegram:dm:300'));
+        const turn = registry.register({ userId: 'u@corp.com', sessionKey: 's', egressStoreKey: 'chat-3' });
+        const nonce = turn.nonce;
+        turn.release();
+        const before = sends.length;
+        const { status, json } = await post(broker.url, nonce, { message: 'stale' });
+        assert.strictEqual(status, 401);
+        assert.strictEqual(json.ok, false);
+        assert.strictEqual(sends.length, before);
+    });
+    test('unknown / missing nonce → 401', async () => {
+        assert.strictEqual((await post(broker.url, 'never-issued-nonce', { message: 'x' })).status, 401);
+        assert.strictEqual((await post(broker.url, undefined, { message: 'x' })).status, 401);
+    });
+    test('a turn with no egress store key (bare HTTP data turn) cannot send → 403', async () => {
+        const turn = registry.register({ userId: 'u@corp.com', sessionKey: 's' }); // no egressStoreKey
+        try {
+            const { status } = await post(broker.url, turn.nonce, { message: 'x' });
+            assert.strictEqual(status, 403);
+        }
+        finally {
+            turn.release();
+        }
+    });
+    test('one user cannot address another session\'s bound handle (server-side scoping)', async () => {
+        // Alice's session is bound to her peer; Bob's turn (his own store key) must not reach it.
+        seedStore(workspaceRoot, 'alice-chat', handle('telegram:dm:ALICE'));
+        const bob = registry.register({ userId: 'bob@corp.com', sessionKey: 'sb', egressStoreKey: 'bob-chat' }); // no store seeded
+        const before = sends.length;
+        try {
+            const { status } = await post(broker.url, bob.nonce, { message: 'to alice?', to: 'telegram:dm:ALICE' });
+            assert.strictEqual(status, 404, 'Bob\'s turn resolves only against Bob\'s own session store');
+            assert.strictEqual(sends.length, before);
+        }
+        finally {
+            bob.release();
+        }
+    });
+});

package/out/test/fleetDisplayUtils.test.js

@@ -45,6 +45,10 @@ suite('fleetDisplayUtils', () => {
         assert.strictEqual((0, fleetDisplayUtils_1.inferFleetEngineId)('agentide-cursor::auto'), 'cursor');
         assert.strictEqual((0, fleetDisplayUtils_1.formatFleetEngineLabel)('agentide-cursor::auto'), 'Cursor');
     });
+    test('formats agenthippo auto model label', () => {
+        assert.strictEqual((0, fleetDisplayUtils_1.formatFleetModelLabel)('ah-auto', ''), 'Auto');
+        assert.strictEqual((0, fleetDisplayUtils_1.formatFleetModelLabel)('agenthippo::ah-auto', ''), 'Auto');
+    });
     test('enriches in_progress row from schedule hint', () => {
         const hints = (0, fleetDisplayUtils_1.buildScheduleHintsByChatSessionId)([{
                 id: 'sched-1',