@agenthippo-ai/agenthippo 0.1.0 → 0.2.3-dataplane

package/out/test/serve-gateway-turn.test.js

@@ -0,0 +1,267 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * runGatewayTurn Test Suite
+ *
+ * Gateway/channel-originated turns (Slack, etc.) previously bypassed both the
+ * identity-keyed RateLimiter and the per-session TurnLimiter entirely — only the
+ * capacity gate (TurnGate) was ever checked. This suite exercises the extracted
+ * admission sequence directly, without a live gateway connection.
+ */
+require("mocha");
+const assert = __importStar(require("assert"));
+const serve_1 = require("../cli/commands/serve");
+const serve_hardening_1 = require("../cli/serve-hardening");
+function fakeEmitter() {
+    const texts = [];
+    return {
+        texts,
+        doneCalled: false,
+        async thinking() { },
+        async text(delta) { texts.push(delta); },
+        async toolStart() { },
+        async toolEnd() { },
+        async progress() { },
+        async question() { return { selected: [], freeText: null }; },
+        async error() { },
+        async done() { this.doneCalled = true; },
+    };
+}
+function baseParams(overrides = {}) {
+    const noop = () => { };
+    return {
+        rateLimiter: new serve_hardening_1.RateLimiter(0), // disabled unless overridden
+        turnLimiter: new serve_hardening_1.TurnLimiter(0), // disabled unless overridden
+        turnGate: new serve_hardening_1.TurnGate(10, 10),
+        warnGateReject: noop,
+        rlKey: 'user-1',
+        sessionKey: 'session-1',
+        emitter: undefined,
+        run: async () => ({ success: true, error: undefined }),
+        ...overrides,
+    };
+}
+suite('runGatewayTurn: admission order and rejection messaging', () => {
+    test('rate limiter rejects: run() never called, channel gets RATE_LIMIT_BUSY_MESSAGE', async () => {
+        const rl = new serve_hardening_1.RateLimiter(1);
+        rl.tryConsume('user-1'); // pre-exhaust the one slot for this key
+        let ran = false;
+        const emitter = fakeEmitter();
+        const result = await (0, serve_1.runGatewayTurn)(baseParams({
+            rateLimiter: rl,
+            emitter,
+            run: async () => { ran = true; return { success: true }; },
+        }));
+        assert.strictEqual(result.success, false);
+        assert.strictEqual(result.error, 'rate_limited');
+        assert.strictEqual(ran, false, 'run() must not be called when the rate limiter rejects');
+        assert.deepStrictEqual(emitter.texts, [serve_hardening_1.RATE_LIMIT_BUSY_MESSAGE]);
+        assert.strictEqual(emitter.doneCalled, true);
+    });
+    test('rate limiter allows a fresh key through to run()', async () => {
+        let ran = false;
+        const result = await (0, serve_1.runGatewayTurn)(baseParams({
+            rateLimiter: new serve_hardening_1.RateLimiter(1),
+            run: async () => { ran = true; return { success: true }; },
+        }));
+        assert.strictEqual(result.success, true);
+        assert.strictEqual(ran, true);
+    });
+    test('turn gate at capacity rejects: run() never called, channel gets TURN_GATE_BUSY_MESSAGE', async () => {
+        const gate = new serve_hardening_1.TurnGate(1, 0); // one slot, no queue room
+        const held = await gate.acquire();
+        assert.ok(held, 'setup: hold the only slot');
+        let ran = false;
+        const emitter = fakeEmitter();
+        const result = await (0, serve_1.runGatewayTurn)(baseParams({
+            turnGate: gate,
+            emitter,
+            run: async () => { ran = true; return { success: true }; },
+        }));
+        assert.strictEqual(result.success, false);
+        assert.strictEqual(result.error, 'busy');
+        assert.strictEqual(ran, false);
+        assert.deepStrictEqual(emitter.texts, [serve_hardening_1.TURN_GATE_BUSY_MESSAGE]);
+        held();
+    });
+    test('per-session turn limiter rejects: run() never called, but the turn-gate slot is released', async () => {
+        const limiter = new serve_hardening_1.TurnLimiter(1);
+        limiter.tryConsume('session-1'); // exhaust the one slot for this session
+        const gate = new serve_hardening_1.TurnGate(1, 1);
+        let ran = false;
+        const emitter = fakeEmitter();
+        const result = await (0, serve_1.runGatewayTurn)(baseParams({
+            turnLimiter: limiter,
+            turnGate: gate,
+            emitter,
+            run: async () => { ran = true; return { success: true }; },
+        }));
+        assert.strictEqual(result.success, false);
+        assert.strictEqual(result.error, 'turn_limit');
+        assert.strictEqual(ran, false);
+        assert.deepStrictEqual(emitter.texts, [serve_hardening_1.TURN_LIMIT_BUSY_MESSAGE]);
+        // The turn-gate slot must be released even though the turn never ran.
+        assert.strictEqual(gate.inflight, 0);
+    });
+    test('all checks pass: run() executes and its result is returned; the gate slot releases after', async () => {
+        const gate = new serve_hardening_1.TurnGate(1, 1);
+        const result = await (0, serve_1.runGatewayTurn)(baseParams({
+            rateLimiter: new serve_hardening_1.RateLimiter(5),
+            turnLimiter: new serve_hardening_1.TurnLimiter(5),
+            turnGate: gate,
+            run: async () => ({ success: true, error: undefined }),
+        }));
+        assert.strictEqual(result.success, true);
+        assert.strictEqual(gate.inflight, 0, 'slot must be released after a successful turn');
+    });
+    test('run() throwing still releases the turn-gate slot', async () => {
+        const gate = new serve_hardening_1.TurnGate(1, 1);
+        await assert.rejects(() => (0, serve_1.runGatewayTurn)(baseParams({
+            rateLimiter: new serve_hardening_1.RateLimiter(5),
+            turnLimiter: new serve_hardening_1.TurnLimiter(5),
+            turnGate: gate,
+            run: async () => { throw new Error('boom'); },
+        })));
+        assert.strictEqual(gate.inflight, 0);
+    });
+    test('rate limit key and turn-limiter session key are independent buckets', async () => {
+        const rateLimiter = new serve_hardening_1.RateLimiter(1);
+        const turnLimiter = new serve_hardening_1.TurnLimiter(5);
+        // Exhaust the rate limiter for 'user-A' only.
+        rateLimiter.tryConsume('user-A');
+        const rejectedForA = await (0, serve_1.runGatewayTurn)(baseParams({
+            rateLimiter, turnLimiter, rlKey: 'user-A', sessionKey: 'sess-A',
+            run: async () => ({ success: true }),
+        }));
+        const okForB = await (0, serve_1.runGatewayTurn)(baseParams({
+            rateLimiter, turnLimiter, rlKey: 'user-B', sessionKey: 'sess-B',
+            run: async () => ({ success: true }),
+        }));
+        assert.strictEqual(rejectedForA.error, 'rate_limited', 'user-A already consumed its one slot in setup');
+        assert.strictEqual(okForB.success, true, 'user-B has an independent rate-limit bucket');
+    });
+    test('a missing emitter does not throw on rejection (channel-less callers are safe)', async () => {
+        const rl = new serve_hardening_1.RateLimiter(1);
+        rl.tryConsume('user-1');
+        const rejected = await (0, serve_1.runGatewayTurn)(baseParams({ rateLimiter: rl, emitter: undefined }));
+        assert.strictEqual(rejected.success, false);
+        assert.strictEqual(rejected.error, 'rate_limited');
+    });
+});
+suite('resolveGatewaySessionKey: never collapses two unidentified senders onto one key', () => {
+    test('prefers an explicit sessionId over everything else — durable, user-namespaced', () => {
+        const r = (0, serve_1.resolveGatewaySessionKey)({ sessionId: 'chat-42', gatewaySessionKey: 'gw-1' }, 'alice');
+        assert.strictEqual(r.sessionKey, `u${(0, serve_hardening_1.userNamespaceHash)('alice')}--chat-42`);
+        assert.strictEqual(r.outboundKey, 'chat-42', 'reply-handle routing must keep the raw gateway key');
+        assert.strictEqual(r.durable, true);
+    });
+    test('falls back to gatewaySessionKey when sessionId is absent — durable, user-namespaced', () => {
+        const r = (0, serve_1.resolveGatewaySessionKey)({ gatewaySessionKey: 'gw-1' }, 'alice');
+        assert.strictEqual(r.sessionKey, `u${(0, serve_hardening_1.userNamespaceHash)('alice')}--gw-1`);
+        assert.strictEqual(r.outboundKey, 'gw-1');
+        assert.strictEqual(r.durable, true);
+    });
+    test('the same explicit session id from two different senders never attaches to one engine session', () => {
+        const alice = (0, serve_1.resolveGatewaySessionKey)({ sessionId: 'chat-42' }, 'alice');
+        const bob = (0, serve_1.resolveGatewaySessionKey)({ sessionId: 'chat-42' }, 'bob');
+        assert.notStrictEqual(alice.sessionKey, bob.sessionKey);
+    });
+    test('an explicit session id with no resolved identity stays raw (dev/unidentified path)', () => {
+        const r = (0, serve_1.resolveGatewaySessionKey)({ sessionId: 'chat-42' }, undefined);
+        assert.strictEqual(r.sessionKey, 'chat-42');
+        assert.strictEqual(r.outboundKey, 'chat-42');
+        assert.strictEqual(r.durable, true);
+    });
+    test('with a resolved identity but no session id, keys off that identity — stable, durable, no collision risk', () => {
+        const r1 = (0, serve_1.resolveGatewaySessionKey)({}, 'slack:U0B6');
+        const r2 = (0, serve_1.resolveGatewaySessionKey)({}, 'slack:U0B6');
+        assert.strictEqual(r1.sessionKey, 'gateway-slack:U0B6');
+        assert.strictEqual(r1.sessionKey, r2.sessionKey, 'the same identified sender must get the same key across messages');
+        assert.strictEqual(r1.durable, true);
+    });
+    test('two different identified senders with no session id never collide', () => {
+        const alice = (0, serve_1.resolveGatewaySessionKey)({}, 'slack:alice');
+        const bob = (0, serve_1.resolveGatewaySessionKey)({}, 'slack:bob');
+        assert.notStrictEqual(alice.sessionKey, bob.sessionKey);
+    });
+    test('two genuinely unidentified senders (no userId, no session id) never collide — no shared "gateway-anon" bucket, and both flagged non-durable', () => {
+        const first = (0, serve_1.resolveGatewaySessionKey)({}, undefined);
+        const second = (0, serve_1.resolveGatewaySessionKey)({}, undefined);
+        assert.notStrictEqual(first.sessionKey, second.sessionKey, 'each unidentified message must get its own key, not a shared bucket');
+        assert.ok(first.sessionKey.startsWith('gateway-anon-'));
+        assert.ok(second.sessionKey.startsWith('gateway-anon-'));
+        assert.strictEqual(first.durable, false);
+        assert.strictEqual(second.durable, false);
+    });
+    test('whitespace-only sessionId/gatewaySessionKey are treated as absent', () => {
+        const r = (0, serve_1.resolveGatewaySessionKey)({ sessionId: '   ', gatewaySessionKey: '  ' }, 'alice');
+        assert.strictEqual(r.sessionKey, 'gateway-alice');
+        assert.strictEqual(r.durable, true);
+    });
+});
+suite('runGatewayTurn: trackSession=false skips the TurnLimiter for one-off keys', () => {
+    test('a never-repeated key would never hit its own cap anyway — trackSession:false just skips the dead-weight tracking', async () => {
+        const limiter = new serve_hardening_1.TurnLimiter(1);
+        let ran = false;
+        const result = await (0, serve_1.runGatewayTurn)(baseParams({
+            turnLimiter: limiter,
+            sessionKey: 'gateway-anon-unique-1',
+            trackSession: false,
+            run: async () => { ran = true; return { success: true }; },
+        }));
+        assert.strictEqual(result.success, true);
+        assert.strictEqual(ran, true);
+        assert.strictEqual(limiter.tryConsume('gateway-anon-unique-1'), true, 'trackSession:false must never call tryConsume — the key should still have its full budget');
+    });
+    test('trackSession:true (default) still enforces the cap as before', async () => {
+        const limiter = new serve_hardening_1.TurnLimiter(1);
+        limiter.tryConsume('sess-durable'); // exhaust the one slot
+        let ran = false;
+        const emitter = fakeEmitter();
+        const result = await (0, serve_1.runGatewayTurn)(baseParams({
+            turnLimiter: limiter,
+            sessionKey: 'sess-durable',
+            emitter,
+            run: async () => { ran = true; return { success: true }; },
+        }));
+        assert.strictEqual(result.success, false);
+        assert.strictEqual(result.error, 'turn_limit');
+        assert.strictEqual(ran, false);
+    });
+});

package/out/test/serve-hardening.test.js

@@ -63,6 +63,49 @@ suite('serve-hardening: resolveStateDir', () => {
         assert.ok(r.dir.startsWith(os.tmpdir()));
     });
 });
+suite('serve-hardening: resolveAnalyticsSessionsDir', () => {
+    // getAgentideHome() reads process.env directly (not injectable), so tests that need it to
+    // resolve deterministically save/restore the real env vars around themselves.
+    const saved = {};
+    setup(() => {
+        saved.AGENT_HOME_DIR = process.env.AGENT_HOME_DIR;
+        saved.AGENTHIPPO_HOME = process.env.AGENTHIPPO_HOME;
+        delete process.env.AGENT_HOME_DIR;
+        delete process.env.AGENTHIPPO_HOME;
+    });
+    teardown(() => {
+        if (saved.AGENT_HOME_DIR === undefined) {
+            delete process.env.AGENT_HOME_DIR;
+        }
+        else {
+            process.env.AGENT_HOME_DIR = saved.AGENT_HOME_DIR;
+        }
+        if (saved.AGENTHIPPO_HOME === undefined) {
+            delete process.env.AGENTHIPPO_HOME;
+        }
+        else {
+            process.env.AGENTHIPPO_HOME = saved.AGENTHIPPO_HOME;
+        }
+    });
+    test('AGENTHIPPO_HOME set → uses getAgentideHome(), not stateDir (stays discoverable to Spotlight/DuckDB)', () => {
+        process.env.AGENTHIPPO_HOME = '/data/.agent-hippo';
+        const dir = (0, serve_hardening_1.resolveAnalyticsSessionsDir)('/data/.agent-hippo/serve-state', false, { AGENTHIPPO_HOME: '/data/.agent-hippo' });
+        assert.strictEqual(dir, path.join('/data/.agent-hippo', 'analytics', 'sessions'));
+    });
+    test('AGENT_HOME_DIR set → same precedence as AGENTHIPPO_HOME', () => {
+        process.env.AGENT_HOME_DIR = '/data/.agent-hippo';
+        const dir = (0, serve_hardening_1.resolveAnalyticsSessionsDir)('/data/.agent-hippo/serve-state', false, { AGENT_HOME_DIR: '/data/.agent-hippo' });
+        assert.strictEqual(dir, path.join('/data/.agent-hippo', 'analytics', 'sessions'));
+    });
+    test('no home-dir env var, explicit non-ephemeral --state-dir → uses stateDir (never regress durability for discoverability)', () => {
+        const dir = (0, serve_hardening_1.resolveAnalyticsSessionsDir)('/mnt/durable-vol', false, {});
+        assert.strictEqual(dir, path.join('/mnt/durable-vol', 'analytics', 'sessions'));
+    });
+    test('no home-dir env var, ephemeral state (nothing durable configured) → falls back to getAgentideHome() default', () => {
+        const dir = (0, serve_hardening_1.resolveAnalyticsSessionsDir)(path.join(os.tmpdir(), 'agenthippo-server'), true, {});
+        assert.strictEqual(dir, path.join(os.homedir(), '.agent-hippo', 'analytics', 'sessions'));
+    });
+});
 suite('serve-hardening: resolveBindHost', () => {
     test('defaults to loopback', () => {
         assert.strictEqual((0, serve_hardening_1.resolveBindHost)(undefined, {}), serve_hardening_1.DEFAULT_BIND_HOST);
@@ -83,6 +126,18 @@ suite('serve-hardening: clientIp', () => {
     test('uses the right-most XFF entry (the IP the trusted proxy observed)', () => {
         assert.strictEqual((0, serve_hardening_1.clientIp)(reqWith({ 'x-forwarded-for': 'evil-spoof, 198.51.100.7' })), '198.51.100.7');
     });
+    test('AGENTHIPPO_XFF_TRUSTED_HOPS=2 skips the tunnel hop (cloudflared → Caddy)', () => {
+        const req = reqWith({ 'x-forwarded-for': '198.51.100.7, 172.18.0.5' });
+        assert.strictEqual((0, serve_hardening_1.clientIp)(req, { AGENTHIPPO_XFF_TRUSTED_HOPS: '2' }), '198.51.100.7');
+    });
+    test('trusted hops beyond the XFF length clamps to the left-most entry', () => {
+        const req = reqWith({ 'x-forwarded-for': '198.51.100.7' });
+        assert.strictEqual((0, serve_hardening_1.clientIp)(req, { AGENTHIPPO_XFF_TRUSTED_HOPS: '5' }), '198.51.100.7');
+    });
+    test('invalid trusted hops falls back to 1', () => {
+        const req = reqWith({ 'x-forwarded-for': 'evil-spoof, 198.51.100.7' });
+        assert.strictEqual((0, serve_hardening_1.clientIp)(req, { AGENTHIPPO_XFF_TRUSTED_HOPS: 'nope' }), '198.51.100.7');
+    });
 });
 suite('serve-hardening: RateLimiter', () => {
     test('allows up to the cap within a window then rejects', () => {
@@ -133,6 +188,16 @@ suite('serve-hardening: resolveUserId', () => {
         assert.strictEqual((0, serve_hardening_1.resolveUserId)({}, undefined), undefined);
         assert.strictEqual((0, serve_hardening_1.resolveUserId)({}, { user_id: '   ' }), undefined);
     });
+    test('AGENTHIPPO_IDENTITY_HEADER pins trust to one header — spoofed aliases are ignored', () => {
+        const env = { AGENTHIPPO_IDENTITY_HEADER: 'x-goog-authenticated-user-email' };
+        // IAP strips X-Goog-* but forwards x-agent-user; pinning must ignore the spoof.
+        const id = (0, serve_hardening_1.resolveUserId)({ 'x-agent-user': 'spoofed@evil.com', 'x-goog-authenticated-user-email': 'accounts.google.com:marco@meridian.com' }, undefined, env);
+        assert.strictEqual(id, 'marco@meridian.com');
+    });
+    test('pinned header absent → fails closed (never the alias list, never the body)', () => {
+        const env = { AGENTHIPPO_IDENTITY_HEADER: 'x-goog-authenticated-user-email' };
+        assert.strictEqual((0, serve_hardening_1.resolveUserId)({ 'x-agent-user': 'spoofed@evil.com' }, { user_id: 'bob' }, env), undefined);
+    });
 });
 suite('serve-hardening: corsHeaders', () => {
     test('always wide-open (serve is always behind a proxy)', () => {
@@ -169,6 +234,91 @@ suite('serve-hardening: TurnLimiter', () => {
         assert.strictEqual(lim.tryConsume('s1'), true);
     });
 });
+suite('serve-hardening: TurnGate', () => {
+    test('runs immediately under the inflight cap', async () => {
+        const gate = new serve_hardening_1.TurnGate(2, 4, 1_000);
+        const a = await gate.acquire();
+        const b = await gate.acquire();
+        assert.ok(a);
+        assert.ok(b);
+        assert.strictEqual(gate.inflight, 2);
+        assert.strictEqual(gate.queued, 0);
+        a();
+        b();
+        assert.strictEqual(gate.inflight, 0);
+    });
+    test('queues when at capacity and wakes FIFO on release', async () => {
+        const gate = new serve_hardening_1.TurnGate(1, 4, 5_000);
+        const first = await gate.acquire();
+        assert.ok(first);
+        assert.strictEqual(gate.inflight, 1);
+        let secondResolved = false;
+        const secondPromise = gate.acquire().then((release) => {
+            secondResolved = true;
+            return release;
+        });
+        // Let the microtask queue settle so the waiter is enqueued.
+        await new Promise((r) => setImmediate(r));
+        assert.strictEqual(secondResolved, false);
+        assert.strictEqual(gate.queued, 1);
+        first();
+        const second = await secondPromise;
+        assert.strictEqual(secondResolved, true);
+        assert.ok(second);
+        assert.strictEqual(gate.inflight, 1);
+        assert.strictEqual(gate.queued, 0);
+        second();
+        assert.strictEqual(gate.inflight, 0);
+    });
+    test('rejects immediately when the queue is full', async () => {
+        const gate = new serve_hardening_1.TurnGate(1, 1, 5_000);
+        const held = await gate.acquire();
+        assert.ok(held);
+        const waiting = gate.acquire(); // fills the single queue slot
+        await new Promise((r) => setImmediate(r));
+        assert.strictEqual(gate.queued, 1);
+        const rejected = await gate.acquire();
+        assert.strictEqual(rejected, null);
+        held();
+        const released = await waiting;
+        assert.ok(released);
+        released();
+    });
+    test('times out a waiter and returns null', async () => {
+        const gate = new serve_hardening_1.TurnGate(1, 4, 30);
+        const held = await gate.acquire();
+        assert.ok(held);
+        const timedOut = await gate.acquire();
+        assert.strictEqual(timedOut, null);
+        assert.strictEqual(gate.queued, 0);
+        held();
+        assert.strictEqual(gate.inflight, 0);
+    });
+    test('zero maxInflight disables the gate', async () => {
+        const gate = new serve_hardening_1.TurnGate(0, 0, 1_000);
+        const releases = [];
+        for (let i = 0; i < 50; i++) {
+            const r = await gate.acquire();
+            assert.ok(r);
+            releases.push(r);
+        }
+        assert.strictEqual(gate.inflight, 0);
+        for (const r of releases) {
+            r();
+        }
+    });
+    test('createTurnGateFromEnv honors env defaults and overrides', () => {
+        const def = (0, serve_hardening_1.createTurnGateFromEnv)({});
+        assert.strictEqual(def.max, 10);
+        const custom = (0, serve_hardening_1.createTurnGateFromEnv)({ AGENTHIPPO_MAX_CONCURRENT_TURNS: '3', AGENTHIPPO_TURN_QUEUE: '7' });
+        assert.strictEqual(custom.max, 3);
+        const disabled = (0, serve_hardening_1.createTurnGateFromEnv)({ AGENTHIPPO_MAX_CONCURRENT_TURNS: '0' });
+        assert.strictEqual(disabled.max, 0);
+    });
+    test('Retry-After constant matches the default queue timeout', () => {
+        assert.strictEqual(serve_hardening_1.TURN_GATE_RETRY_AFTER_SECONDS, 15);
+    });
+});
 function fakeReq(body) {
     const stream = new stream_1.PassThrough();
     stream.end(Buffer.from(body, 'utf8'));
@@ -190,3 +340,40 @@ suite('serve-hardening: readBodyWithCap', () => {
         assert.strictEqual(serve_hardening_1.DEFAULT_MAX_BODY_BYTES, 1024 * 1024);
     });
 });
+suite('serve-hardening: resolveServeSessionKey (secure-obo-design §3.4 Phase 0)', () => {
+    const PINNED = { AGENTHIPPO_IDENTITY_HEADER: 'x-forwarded-email' };
+    test('verified user + session_id → user-namespaced key', () => {
+        const r = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', 'alice@corp.com', PINNED);
+        assert.strictEqual(r.sessionKey, `u${(0, serve_hardening_1.userNamespaceHash)('alice@corp.com')}--chat-1`);
+        assert.strictEqual(r.rejected, undefined);
+    });
+    test('two users presenting the SAME session_id can never share a key (the defect this closes)', () => {
+        const a = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', 'alice@corp.com', PINNED);
+        const b = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', 'bob@corp.com', PINNED);
+        assert.notStrictEqual(a.sessionKey, b.sessionKey);
+    });
+    test('verified user without session_id → stable per-user default key', () => {
+        const r1 = (0, serve_hardening_1.resolveServeSessionKey)(undefined, 'alice@corp.com', PINNED);
+        const r2 = (0, serve_hardening_1.resolveServeSessionKey)('', 'alice@corp.com', PINNED);
+        assert.strictEqual(r1.sessionKey, r2.sessionKey);
+        assert.strictEqual(r1.sessionKey, `u${(0, serve_hardening_1.userNamespaceHash)('alice@corp.com')}--default`);
+    });
+    test('pinned identity + session_id but NO verified user → fail closed', () => {
+        const r = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', undefined, PINNED);
+        assert.strictEqual(r.rejected, serve_hardening_1.SESSION_WITHOUT_USER_REASON);
+    });
+    test('unpinned (local dev) keeps raw session_id behavior', () => {
+        const r = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', undefined, {});
+        assert.strictEqual(r.sessionKey, 'chat-1');
+        assert.strictEqual(r.rejected, undefined);
+    });
+    test('unpinned, no user, no session_id → legacy anon bucket', () => {
+        const r = (0, serve_hardening_1.resolveServeSessionKey)(undefined, undefined, {});
+        assert.strictEqual(r.sessionKey, 'anon-unknown');
+    });
+    test('the key never embeds the raw user id (emails are not path segments)', () => {
+        const r = (0, serve_hardening_1.resolveServeSessionKey)('s', 'alice@corp.com', PINNED);
+        assert.ok(!r.sessionKey.includes('alice@corp.com'));
+        assert.ok(!r.sessionKey.includes('@'));
+    });
+});

package/out/test/serveClient.test.js

@@ -131,13 +131,14 @@ suite('ServeClient', () => {
         ]);
         try {
             const emitter = createCaptureEmitter();
-            await (0, serveClient_js_1.streamRemoteServeChat)({
+            const result = await (0, serveClient_js_1.streamRemoteServeChat)({
                 baseUrl: mock.url,
                 message: 'ping',
                 sessionId: 'sess-1',
             }, emitter);
             assert.deepStrictEqual(emitter.events.map((e) => e.type), ['thinking', 'text', 'toolStart', 'toolEnd', 'done']);
             assert.strictEqual(emitter.events[1].payload, 'hello');
+            assert.deepStrictEqual(result, { ok: true });
         }
         finally {
             await mock.close();
@@ -156,9 +157,43 @@ suite('ServeClient', () => {
                         throw new Error('bad address');
                     }
                     const emitter = createCaptureEmitter();
-                    await (0, serveClient_js_1.streamRemoteServeChat)({ baseUrl: `http://127.0.0.1:${address.port}`, message: 'ping' }, emitter);
+                    const result = await (0, serveClient_js_1.streamRemoteServeChat)({ baseUrl: `http://127.0.0.1:${address.port}`, message: 'ping' }, emitter);
                     assert.deepStrictEqual(emitter.events.map((e) => e.type), ['error', 'done']);
                     assert.strictEqual(emitter.events[0].payload, 'Unauthorized');
+                    // The turn failed: the caller must be able to see it (not record success).
+                    assert.deepStrictEqual(result, { ok: false, error: 'Unauthorized' });
+                    resolve();
+                }
+                catch (err) {
+                    reject(err);
+                }
+                finally {
+                    server.close();
+                }
+            });
+        });
+    });
+    test('streamRemoteServeChat surfaces fail-closed credential rejection as HTTP error (not silent success)', async () => {
+        // Mirrors serve.ts after the fix: warrant denial happens BEFORE SSE writeHead(200),
+        // so the client sees a real non-2xx JSON error instead of 200 + raw body fallthrough.
+        const server = http.createServer((_req, res) => {
+            res.writeHead(500, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                error: 'OBO data token present without a verified user in request scope (fail-closed: token_without_verified_user)',
+            }));
+        });
+        await new Promise((resolve, reject) => {
+            server.listen(0, '127.0.0.1', async () => {
+                try {
+                    const address = server.address();
+                    if (!address || typeof address === 'string') {
+                        throw new Error('bad address');
+                    }
+                    const emitter = createCaptureEmitter();
+                    const result = await (0, serveClient_js_1.streamRemoteServeChat)({ baseUrl: `http://127.0.0.1:${address.port}`, message: 'ping' }, emitter);
+                    assert.strictEqual(result.ok, false);
+                    assert.match(result.error ?? '', /token_without_verified_user/);
+                    assert.deepStrictEqual(emitter.events.map((e) => e.type), ['error', 'done']);
                     resolve();
                 }
                 catch (err) {

package/out/test/state-sync-peer.test.js

@@ -1,6 +1,6 @@
 "use strict";
 /*---------------------------------------------------------------------------------------------
- *  Tests for serve-v3 #2 (S3 state config) and #4 (PeerInfo → user_id).
+ *  Tests for serve-v3 #2 (S3 state config), #4 (PeerInfo → user_id), and serve-v4 P1.2.
  *--------------------------------------------------------------------------------------------*/
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -38,6 +38,9 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 require("mocha");
 const assert = __importStar(require("assert"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
 const state_sync_1 = require("../cli/state-sync");
 const serve_hardening_1 = require("../cli/serve-hardening");
 suite('state-sync: resolveS3StateConfig', () => {
@@ -53,6 +56,85 @@ suite('state-sync: resolveS3StateConfig', () => {
         assert.strictEqual(c?.endpoint, 'http://minio:9000');
     });
 });
+suite('state-sync: restore boot mode', () => {
+    test('defaults to all', () => {
+        assert.strictEqual((0, state_sync_1.resolveRestoreBootMode)({}), 'all');
+    });
+    test('none when set', () => {
+        assert.strictEqual((0, state_sync_1.resolveRestoreBootMode)({ AGENTHIPPO_STATE_RESTORE_BOOT: 'none' }), 'none');
+    });
+});
+suite('state-sync: session id helpers', () => {
+    test('safeSessionId strips path chars', () => {
+        assert.strictEqual((0, state_sync_1.safeSessionId)('a/b:c'), 'a_b_c');
+        assert.strictEqual((0, state_sync_1.safeSessionId)(''), 'session');
+    });
+    test('sessionRemoteUri nests under sessions/', () => {
+        assert.strictEqual((0, state_sync_1.sessionRemoteUri)({ uri: 's3://bkt/p' }, 's1'), 's3://bkt/p/sessions/s1');
+    });
+    test('shardBelongsToSession matches key and value', () => {
+        assert.ok((0, state_sync_1.shardBelongsToSession)('claude:s1:pack:abc', 's1'));
+        assert.ok((0, state_sync_1.shardBelongsToSession)('x:other:pack:abc', 's1', { chatSessionId: 's1' }));
+        assert.ok(!(0, state_sync_1.shardBelongsToSession)('claude:s2:pack:abc', 's1'));
+    });
+});
+suite('state-sync: stage + merge session dirs', () => {
+    let tmp;
+    setup(() => {
+        tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'state-sync-'));
+        (0, state_sync_1.clearRestoreAttemptCache)();
+    });
+    teardown(() => {
+        fs.rmSync(tmp, { recursive: true, force: true });
+        (0, state_sync_1.clearRestoreAttemptCache)();
+    });
+    test('stages only matching provider-session shards; the shared agents/ SDK cache is never staged', async () => {
+        const ps = path.join(tmp, 'provider-sessions');
+        fs.mkdirSync(ps, { recursive: true });
+        const key1 = 'claude:sess-a:pack:sig';
+        const key2 = 'claude:sess-b:pack:sig';
+        const f1 = (0, state_sync_1.providerSessionShardName)(key1);
+        const f2 = (0, state_sync_1.providerSessionShardName)(key2);
+        fs.writeFileSync(path.join(ps, f1), JSON.stringify({ key: key1, value: { chatSessionId: 'sess-a', id: 'n1' } }));
+        fs.writeFileSync(path.join(ps, f2), JSON.stringify({ key: key2, value: { chatSessionId: 'sess-b', id: 'n2' } }));
+        // agents/ holds the SDK's own cache, shared across every session/user of this pack
+        // on the replica — must never be swept into a single session's staging tree.
+        fs.mkdirSync(path.join(tmp, 'agents', 'pack', 'claude'), { recursive: true });
+        fs.writeFileSync(path.join(tmp, 'agents', 'pack', 'claude', 'marker'), 'x');
+        const staging = path.join(tmp, 'staging');
+        const ok = await (0, state_sync_1.stageSessionPushDir)(tmp, 'sess-a', staging);
+        assert.strictEqual(ok, true);
+        assert.ok(fs.existsSync(path.join(staging, 'provider-sessions', f1)));
+        assert.ok(!fs.existsSync(path.join(staging, 'provider-sessions', f2)));
+        assert.ok(!fs.existsSync(path.join(staging, 'agents')), 'agents/ must not be staged into a per-session push');
+        const shards = await (0, state_sync_1.listSessionShardFiles)(tmp, 'sess-a');
+        assert.deepStrictEqual(shards, [f1]);
+        assert.strictEqual(await (0, state_sync_1.hasLocalSessionState)(tmp, 'sess-a'), true);
+        assert.strictEqual(await (0, state_sync_1.hasLocalSessionState)(tmp, 'sess-missing'), false);
+    });
+    test('a session with no shards but a live agents/ dir has nothing to push', async () => {
+        fs.mkdirSync(path.join(tmp, 'agents', 'pack', 'claude'), { recursive: true });
+        fs.writeFileSync(path.join(tmp, 'agents', 'pack', 'claude', 'marker'), 'x');
+        const staging = path.join(tmp, 'staging');
+        const ok = await (0, state_sync_1.stageSessionPushDir)(tmp, 'sess-none', staging);
+        assert.strictEqual(ok, false, 'agents/ content alone must not count as this session having content to push');
+    });
+    test('mergeSessionStagingIntoState copies shards only; never touches the destination agents/ dir', async () => {
+        const staging = path.join(tmp, 'from');
+        const dest = path.join(tmp, 'to');
+        fs.mkdirSync(path.join(staging, 'provider-sessions'), { recursive: true });
+        fs.writeFileSync(path.join(staging, 'provider-sessions', 'abc.json'), JSON.stringify({ key: 'claude:s1:p:s', value: { chatSessionId: 's1' } }));
+        // Simulate a stale staging tree that (pre-fix) would have carried an old agents/
+        // snapshot — restoring it must not force-overwrite another session's live SDK cache.
+        fs.mkdirSync(path.join(staging, 'agents', 'p'), { recursive: true });
+        fs.writeFileSync(path.join(staging, 'agents', 'p', 'f'), 'stale');
+        fs.mkdirSync(path.join(dest, 'agents', 'p'), { recursive: true });
+        fs.writeFileSync(path.join(dest, 'agents', 'p', 'f'), 'live-for-another-session');
+        await (0, state_sync_1.mergeSessionStagingIntoState)(staging, dest);
+        assert.ok(fs.existsSync(path.join(dest, 'provider-sessions', 'abc.json')));
+        assert.strictEqual(fs.readFileSync(path.join(dest, 'agents', 'p', 'f'), 'utf8'), 'live-for-another-session', 'the live agents/ dir must survive a restore of an unrelated staging tree untouched');
+    });
+});
 suite('peerToUserId (#4 — channel sender → per-user id)', () => {
     test('undefined for no peer', () => {
         assert.strictEqual((0, serve_hardening_1.peerToUserId)(undefined), undefined);