@agenthippo-ai/agenthippo 0.1.0

package/out/test/deploy-init.test.js

@@ -0,0 +1,532 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Deploy Init Test Suite (serve-v3 §A4)
+ *
+ *  Verifies the generator emits well-formed artifacts for every target:
+ *  YAML/JSON parse, Dockerfile shape, shell scripts pass `bash -n`, and the
+ *  .env.example scan reflects the pack's ${env:...} references.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+const yaml = __importStar(require("js-yaml"));
+const deploy_init_1 = require("../cli/deploy-init");
+const deploy_1 = require("../cli/commands/deploy");
+const CTX = {
+    packName: 'databricks-analyst',
+    image: 'ghcr.io/agenthippo/runtime:2026.06',
+    port: 8080,
+    engine: 'claude',
+    envVars: ['DATABRICKS_HOST', 'DATABRICKS_HTTP_PATH'],
+    publicHostname: deploy_init_1.DEPLOY_PUBLIC_HOSTNAME,
+};
+suite('deploy-init: target registry', () => {
+    test('isDeployTarget recognizes known and rejects unknown', () => {
+        for (const t of deploy_init_1.DEPLOY_TARGETS) {
+            assert.ok((0, deploy_init_1.isDeployTarget)(t));
+        }
+        assert.strictEqual((0, deploy_init_1.isDeployTarget)('heroku'), false);
+        assert.strictEqual((0, deploy_init_1.isDeployTarget)('all'), false); // handled separately by the command
+    });
+});
+suite('deploy-init: scanEnvRefs', () => {
+    let dir;
+    setup(() => {
+        dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ah-scan-'));
+    });
+    teardown(() => {
+        fs.rmSync(dir, { recursive: true, force: true });
+    });
+    test('collects ${env:VAR} across files, de-dupes and sorts', () => {
+        fs.mkdirSync(path.join(dir, 'mcp'), { recursive: true });
+        fs.writeFileSync(path.join(dir, 'mcp', 'databricks.mcp.json'), JSON.stringify({ env: { H: '${env:DATABRICKS_HOST}', T: '${env:DATABRICKS_TOKEN}' } }));
+        fs.writeFileSync(path.join(dir, 'agent.yaml'), 'x: ${env:DATABRICKS_HOST}\n'); // dup
+        assert.deepStrictEqual((0, deploy_init_1.scanEnvRefs)(dir), ['DATABRICKS_HOST', 'DATABRICKS_TOKEN']);
+    });
+    test('skips node_modules / deploy / .git', () => {
+        fs.mkdirSync(path.join(dir, 'node_modules'), { recursive: true });
+        fs.writeFileSync(path.join(dir, 'node_modules', 'x.json'), '${env:SHOULD_NOT_APPEAR}');
+        fs.mkdirSync(path.join(dir, 'deploy'), { recursive: true });
+        fs.writeFileSync(path.join(dir, 'deploy', 'y.json'), '${env:ALSO_NOT}');
+        fs.writeFileSync(path.join(dir, 'agent.yaml'), 'name: ${env:REAL_ONE}');
+        assert.deepStrictEqual((0, deploy_init_1.scanEnvRefs)(dir), ['REAL_ONE']);
+    });
+    test('empty pack → no vars', () => {
+        fs.writeFileSync(path.join(dir, 'agent.yaml'), 'metadata:\n  name: x\n');
+        assert.deepStrictEqual((0, deploy_init_1.scanEnvRefs)(dir), []);
+    });
+});
+suite('deploy-init: renderEnvExample', () => {
+    test('lists scanned vars and model credential', () => {
+        const out = (0, deploy_init_1.renderEnvExample)(['FOO', 'BAR']);
+        assert.ok(!out.includes('AGENTHIPPO_SERVE_API_KEY='), 'serve bearer key must not appear — auth is the deploy layer');
+        assert.ok(out.includes('ANTHROPIC_API_KEY='));
+        assert.ok(out.includes('FOO='));
+        assert.ok(out.includes('BAR='));
+    });
+    test('edge .env keeps only the public hostname; auth secrets live in .env.auth', () => {
+        const out = (0, deploy_init_1.renderEnvExample)([], { edge: true });
+        assert.ok(out.includes(`AGENTHIPPO_PUBLIC_HOSTNAME=${deploy_init_1.DEPLOY_PUBLIC_HOSTNAME}`));
+        // The agent loads .env — the token-signing key and OAuth secrets must not be here.
+        assert.ok(!out.includes('AGENTHIPPO_AUTH_JWT_SECRET'), 'JWT secret must not be in the agent-shared .env');
+        assert.ok(!out.includes('OAUTH2_PROXY_CLIENT_SECRET'), 'OAuth secret must not be in the agent-shared .env');
+        assert.ok(out.includes('.env.auth'), 'edge .env should point operators at .env.auth');
+    });
+    test('renderAuthEnvExample carries the oauth2-proxy + JWT secrets', () => {
+        const out = (0, deploy_init_1.renderAuthEnvExample)();
+        assert.ok(out.includes('OAUTH2_PROXY_CLIENT_ID='));
+        assert.ok(out.includes('OAUTH2_PROXY_REDIRECT_URL='));
+        assert.ok(out.includes('OAUTH2_PROXY_REVERSE_PROXY=true'));
+        assert.ok(out.includes('AGENTHIPPO_AUTH_JWT_SECRET='));
+    });
+    test('renderAuthEnvExample honors custom hostname', () => {
+        const out = (0, deploy_init_1.renderAuthEnvExample)({ hostname: 'agents.example.com' });
+        assert.ok(out.includes('https://agents.example.com/oauth2/callback'));
+        assert.ok(!out.includes('auth.agenthippo.ai'));
+    });
+    test('vm target embeds custom hostname in cloudflared and README', () => {
+        const files = (0, deploy_init_1.renderTarget)('vm', { ...CTX, publicHostname: 'agents.example.com' });
+        assert.ok(files['cloudflared.yml'].includes('agents.example.com'));
+        assert.ok(files['README.md'].includes('https://agents.example.com'));
+        assert.ok(files['run-edge-tunnel.sh'].includes('https://agents.example.com'));
+    });
+    test('cursor engine seeds CURSOR_API_KEY instead of ANTHROPIC', () => {
+        const out = (0, deploy_init_1.renderEnvExample)([], { engine: 'cursor' });
+        assert.ok(out.includes('CURSOR_API_KEY='));
+        assert.ok(!out.includes('ANTHROPIC_API_KEY='));
+    });
+    test('serveCmdArgs includes custom engine and model', () => {
+        const args = (0, deploy_init_1.serveCmdArgs)({ ...CTX, engine: 'cursor', model: 'auto', image: 'x', envVars: [] });
+        assert.ok(args.includes('--engine'));
+        assert.ok(args.includes('cursor'));
+        assert.ok(args.includes('--model'));
+        assert.ok(args.includes('auto'));
+        assert.ok(!args.includes('--host'), 'bind address is set via AGENTHIPPO_SERVE_HOST in Dockerfile, not --host');
+    });
+    test('serveCmdArgs can include www-dir for cloudrun browser UI', () => {
+        const args = (0, deploy_init_1.serveCmdArgs)({ ...CTX, image: 'x', envVars: [] }, { wwwDir: '/app/pack/deploy/www' });
+        assert.ok(args.includes('--www-dir'));
+        assert.ok(args.includes('/app/pack/deploy/www'));
+    });
+    test('defaultRuntimeImage picks cursor layer for cursor engine', () => {
+        assert.ok((0, deploy_init_1.defaultRuntimeImage)('cursor').includes('cursor'));
+        assert.ok(!(0, deploy_init_1.defaultRuntimeImage)('claude').includes('cursor'));
+    });
+});
+suite('deploy-init: renderTarget produces well-formed artifacts', () => {
+    test('every target includes a scanned .env.example with the pack vars', () => {
+        for (const t of deploy_init_1.DEPLOY_TARGETS) {
+            const files = (0, deploy_init_1.renderTarget)(t, CTX);
+            assert.ok(files['.env.example'], `${t} missing .env.example`);
+            assert.ok(files['.env.example'].includes('DATABRICKS_HOST'), `${t} .env.example missing scanned var`);
+            assert.ok(files['README.md'], `${t} missing README.md`);
+        }
+    });
+    test('image-based targets emit a valid 5-line-style Dockerfile referencing the runtime image', () => {
+        for (const t of ['vm', 'compose', 'cloudrun', 'spcs', 'cloudflare']) {
+            const df = (0, deploy_init_1.renderTarget)(t, CTX)['Dockerfile'];
+            assert.ok(df, `${t} missing Dockerfile`);
+            assert.ok(df.includes('FROM ghcr.io/agenthippo/runtime:2026.06'), `${t} Dockerfile missing FROM`);
+            assert.ok(df.includes('COPY . /app/pack/'), `${t} Dockerfile missing COPY`);
+            assert.ok(/EXPOSE 8080/.test(df), `${t} Dockerfile missing EXPOSE`);
+            assert.ok(df.includes('CMD ["serve"'), `${t} Dockerfile CMD must append to runtime ENTRYPOINT`);
+            assert.ok(!df.includes('CMD ["agenthippo"'), `${t} Dockerfile must not duplicate agenthippo in CMD`);
+            assert.ok(df.includes('ENV AGENTHIPPO_SERVE_HOST=0.0.0.0'), `${t} Dockerfile must bind on all interfaces in-container`);
+            assert.ok(!df.includes('"--host"'), `${t} Dockerfile must not pass unsupported --host to older runtimes`);
+        }
+    });
+    test('image-based targets ship a .dockerignore that keeps skills and drops node_modules', () => {
+        for (const t of ['vm', 'compose', 'cloudrun', 'spcs', 'cloudflare']) {
+            const di = (0, deploy_init_1.renderTarget)(t, CTX)['.dockerignore'];
+            assert.ok(di, `${t} missing .dockerignore`);
+            assert.ok(di.includes('**/node_modules'), `${t} .dockerignore should exclude node_modules`);
+            assert.ok(di.includes('.git'), `${t} .dockerignore should exclude .git`);
+            // Ship only deploy/www/ from deploy/ (drops deploy/.env, credentials, build artifacts).
+            assert.ok(di.includes('deploy/*'), `${t} should exclude deploy/*`);
+            assert.ok(di.includes('!deploy/www/**'), `${t} should re-include deploy/www/**`);
+            // Defensive secret ignores.
+            assert.ok(di.includes('**/.env'), `${t} should ignore **/.env`);
+            assert.ok(di.includes('**/*credentials*.json'), `${t} should ignore credentials json`);
+            // skills/, scripts/, references/ must NOT be ignored lines.
+            const ignored = di.split('\n').map((l) => l.trim()).filter((l) => l && !l.startsWith('#'));
+            for (const keep of ['skills/', 'scripts/', 'references/', 'skills', 'scripts', 'references']) {
+                assert.ok(!ignored.includes(keep), `${t} .dockerignore must not ignore ${keep}`);
+            }
+        }
+        // Source-based target ships no Dockerfile and no .dockerignore.
+        assert.strictEqual((0, deploy_init_1.renderTarget)('databricks-app', CTX)['.dockerignore'], undefined);
+        assert.strictEqual((0, deploy_init_1.renderTarget)('databricks-app', CTX)['Dockerfile'], undefined);
+    });
+    test('build scripts anchor to the staging root so they run from any cwd', () => {
+        // cloudrun + vm run.sh use `docker build -f deploy/Dockerfile .` → must cd to staging root.
+        assert.ok((0, deploy_init_1.renderTarget)('cloudrun', CTX)['cloudrun-deploy.sh'].includes('cd "$(dirname "$0")/.."'), 'cloudrun-deploy.sh must anchor to staging root');
+        assert.ok((0, deploy_init_1.renderTarget)('vm', CTX)['run.sh'].includes('cd "$(dirname "$0")/.."'), 'vm run.sh must anchor to staging root');
+        // edge tunnel uses docker compose (paths resolve relative to the compose file), so it
+        // anchors to deploy/ itself, not the staging root.
+        assert.ok((0, deploy_init_1.renderTarget)('vm', CTX)['run-edge-tunnel.sh'].includes('cd "$(dirname "$0")"'));
+        assert.ok(!(0, deploy_init_1.renderTarget)('vm', CTX)['run-edge-tunnel.sh'].includes('cd "$(dirname "$0")/.."'));
+    });
+    test('image-based Dockerfiles install skill requirements.txt/package.json deps at build time', () => {
+        for (const t of ['vm', 'compose', 'cloudrun', 'spcs', 'cloudflare']) {
+            const df = (0, deploy_init_1.renderTarget)(t, CTX)['Dockerfile'];
+            assert.ok(df.includes('requirements.txt'), `${t} Dockerfile should install python skill deps`);
+            assert.ok(df.includes('package.json'), `${t} Dockerfile should install node skill deps`);
+            assert.ok(df.includes('USER root') && df.includes('USER agent'), `${t} skill-deps step must run as root then drop back to agent`);
+            // Must not clobber the runtime ENTRYPOINT/CMD.
+            assert.ok(df.includes('CMD ["serve"'), `${t} CMD still present after skill-deps step`);
+        }
+    });
+    test('databricks-app is source-based (no Dockerfile) with OBO scopes', () => {
+        const files = (0, deploy_init_1.renderTarget)('databricks-app', CTX);
+        assert.strictEqual(files['Dockerfile'], undefined);
+        const app = yaml.load(files['app.yaml']);
+        assert.deepStrictEqual(app.user_authorization?.scopes, ['sql']);
+        const pkg = JSON.parse(files['package.json']);
+        assert.ok(pkg.dependencies['@anthropic-ai/claude-code']);
+        assert.ok(pkg.dependencies['@agenthippo-ai/cli']);
+    });
+    test('YAML artifacts parse', () => {
+        assert.doesNotThrow(() => yaml.load((0, deploy_init_1.renderTarget)('vm', CTX)['docker-compose.yml']));
+        assert.doesNotThrow(() => yaml.load((0, deploy_init_1.renderTarget)('compose', CTX)['docker-compose.yml']));
+        assert.doesNotThrow(() => yaml.load((0, deploy_init_1.renderTarget)('spcs', CTX)['spec.yaml']));
+        assert.doesNotThrow(() => yaml.load((0, deploy_init_1.renderTarget)('databricks-app', CTX)['app.yaml']));
+    });
+    test('JSON artifacts parse (wrangler, package.json)', () => {
+        assert.doesNotThrow(() => JSON.parse((0, deploy_init_1.renderTarget)('cloudflare', CTX)['wrangler.jsonc']));
+        assert.doesNotThrow(() => JSON.parse((0, deploy_init_1.renderTarget)('databricks-app', CTX)['package.json']));
+    });
+    test('shell scripts are syntactically valid (bash -n)', () => {
+        const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'ah-sh-'));
+        try {
+            const scripts = [
+                ['run.sh', (0, deploy_init_1.renderTarget)('vm', CTX)['run.sh']],
+                ['run-edge-tunnel.sh', (0, deploy_init_1.renderTarget)('vm', CTX)['run-edge-tunnel.sh']],
+                ['cloudrun-deploy.sh', (0, deploy_init_1.renderTarget)('cloudrun', CTX)['cloudrun-deploy.sh']],
+                ['cloudrun-edge-deploy.sh', (0, deploy_init_1.renderTarget)('cloudrun', { ...CTX, ingress: 'edge' })['cloudrun-deploy.sh']],
+            ];
+            for (const [name, content] of scripts) {
+                const p = path.join(tmp, name);
+                fs.writeFileSync(p, content);
+                assert.doesNotThrow(() => (0, child_process_1.execFileSync)('bash', ['-n', p]), `${name} failed bash -n`);
+            }
+        }
+        finally {
+            fs.rmSync(tmp, { recursive: true, force: true });
+        }
+    });
+    test('cloudrun IAP is applied on the beta track with IAM bindings (no GA --iap on deploy)', () => {
+        const sh = (0, deploy_init_1.renderTarget)('cloudrun', CTX)['cloudrun-deploy.sh'];
+        assert.ok(sh.includes('--iap'), 'IAP enablement still referenced');
+        // Beta track: gcloud beta run services update --iap (GA `gcloud run ... --iap` is unsupported).
+        assert.ok(sh.includes('gcloud beta run services update'), 'IAP must be enabled on the beta track');
+        // Public access is governed by the run.invoker binding, stripped here; IAP role granted per IAP_MEMBERS.
+        assert.ok(sh.includes('remove-iam-policy-binding'), 'must strip allUsers invoker binding to keep service private');
+        assert.ok(sh.includes('roles/iap.httpsResourceAccessor'), 'must grant IAP-secured Web User role');
+        assert.ok(sh.includes('IAP_MEMBERS'), 'must surface IAP_MEMBERS for per-principal grants');
+        // The old GA `services update --no-allow-unauthenticated` (not a real flag) and inline IAP_FLAG are gone.
+        assert.ok(!sh.includes('IAP_FLAG'), 'IAP_FLAG array removed in favor of the beta-track block');
+        assert.ok(!sh.includes('--no-allow-unauthenticated "${IAP_FLAG[@]}"'), 'old GA IAP update line removed');
+        assert.ok(!sh.includes('AGENTHIPPO_SERVE_API_KEY'), 'serve bearer key must not appear — auth is IAP');
+        assert.ok(sh.includes('docker build'));
+        assert.ok(sh.includes('deploy/Dockerfile'));
+    });
+    test('cloudrun --ingress edge (Option B) fronts the agent with the AgentHippo edge, no IAP', () => {
+        const files = (0, deploy_init_1.renderTarget)('cloudrun', { ...CTX, ingress: 'edge' });
+        const svc = files['service.yaml'];
+        const caddy = files['Caddyfile'];
+        const sh = files['cloudrun-deploy.sh'];
+        // Edge artifacts present; IAP artifacts absent.
+        assert.ok(caddy, 'Caddyfile present');
+        assert.ok(svc.includes('name: caddy') && svc.includes('name: auth-broker') && svc.includes('name: oauth2-proxy'));
+        assert.ok(svc.includes('name: agent') && svc.includes('name: litellm') && svc.includes('name: otel-collector'), 'Spotlight sidecars still present behind the edge');
+        // Caddy is the ONLY ingress (one port); the agent is no longer ingress.
+        assert.strictEqual((svc.match(/containerPort:/g) || []).length, 1);
+        assert.ok(/- name: caddy\n          image: caddy:/.test(svc), 'caddy is the first/ingress container');
+        // Agent listens on the internal edge port (not $PORT), so it doesn't clash with Caddy.
+        assert.ok(svc.includes('"--port", "8090"'), 'agent args override the port to the internal edge port');
+        assert.ok(svc.includes('"--www-dir", "/app/pack/deploy/www"'), 'agent still serves the www landing page');
+        // Sidecars share the pod's localhost (Cloud Run multi-container), not docker-DNS names.
+        assert.ok(!caddy.includes('oauth2-proxy:4180') && !caddy.includes('auth-broker:9780') && !caddy.includes('agent:8080'), 'edge Caddyfile must use localhost upstreams, not docker-DNS names');
+        assert.ok(caddy.includes('localhost:4180') && caddy.includes('localhost:9780') && caddy.includes('localhost:8090'), 'edge Caddyfile routes to oauth2-proxy / auth-broker / agent on localhost');
+        assert.ok(caddy.includes(':{$PORT}') && caddy.includes('auto_https off'), 'Caddy listens on HTTP :$PORT (Cloud Run terminates TLS)');
+        // Caddyfile is mounted from a Secret (the deploy script upserts it).
+        assert.ok(svc.includes('${SERVICE}-caddyfile'), 'Caddyfile mounted from a secret');
+        // auth-broker reuses the agent image (CLI ships `auth-broker`).
+        assert.ok(/- name: auth-broker\n          image: \$\{IMAGE\}/.test(svc) && svc.includes('args: ["auth-broker"]'), 'auth-broker reuses the agent image with `auth-broker` args');
+        // No IAP anywhere in the edge path.
+        assert.ok(!sh.includes('--iap') && !sh.includes('iap.httpsResourceAccessor') && !sh.includes('IAP_MEMBERS'), 'edge deploy must not enable IAP');
+        // Cloud Run is public (allUsers invoker) so traffic can reach Caddy to be authed.
+        assert.ok(sh.includes('add-iam-policy-binding') && sh.includes('allUsers') && sh.includes('roles/run.invoker'), 'edge deploy grants allUsers invoker (Caddy is the gate, not Cloud Run)');
+        // Edge secrets upserted.
+        assert.ok(sh.includes('${SERVICE}-caddyfile') && sh.includes('${SERVICE}-auth-jwt-secret')
+            && sh.includes('${SERVICE}-oauth-client-id') && sh.includes('${SERVICE}-oauth-cookie-secret'), 'edge deploy upserts Caddyfile + JWT + OAuth secrets');
+        // Render includes the edge placeholders.
+        assert.ok(sh.includes('${PUBLIC_HOSTNAME}') && sh.includes('${ALLOWED_DOMAINS}'), 'deploy renders edge hostname/domain placeholders');
+        // The edge split auth env is shipped (so the agent container never loads the JWT/OAuth secrets).
+        assert.ok(files['.env.auth.example'], 'edge ships .env.auth.example (split auth secrets)');
+        assert.ok(files['.env.auth.example'].includes('OAUTH2_PROXY_CLIENT_ID') && files['.env.auth.example'].includes('AGENTHIPPO_AUTH_JWT_SECRET'));
+        // Note: service.yaml is a sed-template (${SERVICE}/${IMAGE}/${PUBLIC_HOSTNAME}/…), so it is
+        // only valid YAML after the deploy script substitutes placeholders — same as the IAP template.
+    });
+    test('cloudrun --ingress edge-fed (A′) verifies the shared JWT — no oauth2-proxy, no per-service OAuth', () => {
+        const files = (0, deploy_init_1.renderTarget)('cloudrun', {
+            ...CTX, ingress: 'edge-fed', idpUrl: 'https://auth.agenthippo.ai', cookieDomain: '.agenthippo.ai',
+        });
+        const svc = files['service.yaml'];
+        const caddy = files['Caddyfile'];
+        const sh = files['cloudrun-deploy.sh'];
+        // Federated artifacts present.
+        assert.ok(caddy && svc && sh);
+        // Caddy + auth-broker + agent + Spotlight sidecars, but NO oauth2-proxy container.
+        assert.ok(svc.includes('name: caddy') && svc.includes('name: auth-broker') && svc.includes('name: agent'));
+        assert.ok(svc.includes('name: litellm') && svc.includes('name: otel-collector'), 'Spotlight sidecars present');
+        assert.ok(!svc.includes('name: oauth2-proxy'), 'edge-fed must NOT ship an oauth2-proxy container');
+        assert.strictEqual((svc.match(/containerPort:/g) || []).length, 1, 'Caddy is the only ingress port');
+        // auth-broker carries the federated cookie/IdP config + the shared JWT secret.
+        assert.ok(svc.includes('AGENTHIPPO_AUTH_COOKIE_DOMAIN') && svc.includes('AGENTHIPPO_AUTH_IDP_URL'), 'auth-broker gets the federated cookie domain + IdP URL');
+        assert.ok(svc.includes('${SERVICE}-auth-jwt-secret'), 'shared JWT secret mounted from a secret');
+        assert.ok(svc.includes('AGENTHIPPO_AUTH_COOKIE_NAME'), 'cookie name configured');
+        // In-memory state (no GCS bucket → no STATE_BUCKET requirement, no gcsfuse).
+        assert.ok(svc.includes('emptyDir') && svc.includes('medium: Memory'), 'state is in-memory emptyDir');
+        assert.ok(!svc.includes('gcsfuse') && !svc.includes('${STATE_BUCKET}'), 'no GCS state volume');
+        // Caddyfile: forward_auth to auth-broker only; no oauth2-proxy routes; IdP browser-login redirect.
+        assert.ok(caddy.includes('forward_auth localhost:9780'), 'Caddy verifies via auth-broker');
+        assert.ok(!caddy.includes('localhost:4180') && !caddy.includes('/oauth2/'), 'no oauth2-proxy routes in Caddyfile');
+        assert.ok(caddy.includes('https://auth.agenthippo.ai/oauth/browser-login'), 'browser 401 redirects to the central IdP browser-login endpoint');
+        assert.ok(caddy.includes('return_to='), 'redirect carries a return_to for the round trip');
+        // Deploy script: NO OAuth client/cookie secrets; upserts caddyfile + JWT + provider/litellm;
+        // allUsers invoker; domain-mappings create; no IAP; no STATE_BUCKET.
+        assert.ok(!sh.includes('OAUTH_CLIENT_ID') && !sh.includes('OAUTH_CLIENT_SECRET') && !sh.includes('OAUTH_COOKIE_SECRET'), 'edge-fed deploy must not reference any Google OAuth client');
+        assert.ok(sh.includes('${SERVICE}-caddyfile') && sh.includes('${SERVICE}-auth-jwt-secret')
+            && sh.includes('${SERVICE}-provider-key') && sh.includes('${SERVICE}-litellm-key'), 'edge-fed deploy upserts caddyfile + shared JWT + provider/litellm secrets');
+        assert.ok(!sh.includes('STATE_BUCKET'), 'edge-fed has no STATE_BUCKET (in-memory state)');
+        assert.ok(sh.includes('allUsers') && sh.includes('roles/run.invoker'), 'allUsers invoker (Caddy is the gate)');
+        assert.ok(sh.includes('domain-mappings create'), 'maps the *.agenthippo.ai subdomain');
+        assert.ok(!sh.includes('--iap') && !sh.includes('iap.httpsResourceAccessor'), 'no IAP');
+        // Split auth env is federated: shared JWT secret + cookie domain + IdP URL, NO Google OAuth client.
+        const auth = files['.env.auth.example'];
+        assert.ok(auth, 'edge-fed ships .env.auth.example');
+        assert.ok(auth.includes('AGENTHIPPO_AUTH_JWT_SECRET') && auth.includes('AGENTHIPPO_AUTH_COOKIE_DOMAIN')
+            && auth.includes('AGENTHIPPO_AUTH_IDP_URL'), 'federated auth env carries the shared JWT + cookie/IdP config');
+        assert.ok(!auth.includes('OAUTH2_PROXY_CLIENT_ID'), 'federated auth env has no Google OAuth client');
+        // Shell + rendered YAML are well-formed.
+        assert.doesNotThrow(() => (0, child_process_1.execFileSync)('bash', ['-n', '-c', sh]));
+        const rendered = svc
+            .replace(/\$\{SERVICE\}/g, 'customer-service-edge')
+            .replace(/\$\{IMAGE\}/g, 'us-docker.pkg.dev/x/y/z:latest')
+            .replace(/\$\{LITELLM_IMAGE\}/g, 'ghcr.io/agenthippo/litellm-gateway:2026.06')
+            .replace(/\$\{PUBLIC_HOSTNAME\}/g, 'cs.agenthippo.ai')
+            .replace(/\$\{ALLOWED_DOMAINS\}/g, 'agenthippo.ai');
+        assert.doesNotThrow(() => yaml.load(rendered), 'rendered service.yaml is valid YAML');
+    });
+    test('renderAuthEnvExample fed variant has no Google OAuth client', () => {
+        const out = (0, deploy_init_1.renderAuthEnvExample)({ hostname: 'cs.agenthippo.ai', fed: true, idpUrl: 'https://auth.agenthippo.ai', cookieDomain: '.agenthippo.ai' });
+        assert.ok(out.includes('AGENTHIPPO_AUTH_JWT_SECRET'));
+        assert.ok(out.includes('AGENTHIPPO_AUTH_COOKIE_DOMAIN=.agenthippo.ai'));
+        assert.ok(out.includes('AGENTHIPPO_AUTH_IDP_URL=https://auth.agenthippo.ai'));
+        assert.ok(!out.includes('OAUTH2_PROXY_CLIENT_ID'));
+    });
+    test('cloudrun claude pack ships the Spotlight multi-container stack (litellm + otel sidecars)', () => {
+        const files = (0, deploy_init_1.renderTarget)('cloudrun', CTX); // CTX engine = claude → model-routed → Spotlight
+        const svc = files['service.yaml'];
+        assert.ok(svc, 'service.yaml present');
+        assert.ok(svc.includes('name: agent') && svc.includes('name: litellm') && svc.includes('name: otel-collector'));
+        // Agent routes through the in-pod LiteLLM; LiteLLM exports to the in-pod collector.
+        assert.ok(svc.includes('http://localhost:4443'), 'agent → litellm on localhost');
+        assert.ok(svc.includes('http://localhost:4318'), 'litellm → collector on localhost');
+        assert.ok(svc.includes('gcsfuse.run.googleapis.com'), 'GCS-backed /state volume');
+        assert.ok(files['otel-collector.yaml'].includes('file/jsonl'), 'collector writes JSONL traces');
+        // Exactly one container exposes a port (Cloud Run ingress requirement).
+        assert.strictEqual((svc.match(/containerPort:/g) || []).length, 1);
+        // The CLAUDE_CODE_USE_VERTEX-vs-LiteLLM contradiction is gone from the active deploy.
+        assert.ok(!svc.includes('CLAUDE_CODE_USE_VERTEX'));
+        assert.ok(!files['cloudrun-deploy.sh'].includes('CLAUDE_CODE_USE_VERTEX'));
+    });
+    test('cloudrun cursor pack wires CURSOR_API_KEY secret and engine flags', () => {
+        const ctx = { ...CTX, packName: 'customer-service', engine: 'cursor', model: 'auto', image: 'ghcr.io/agenthippo/runtime:latest-cursor' };
+        const sh = (0, deploy_init_1.renderTarget)('cloudrun', ctx)['cloudrun-deploy.sh'];
+        const df = (0, deploy_init_1.renderTarget)('cloudrun', ctx)['Dockerfile'];
+        assert.ok(sh.includes('CURSOR_API_KEY=agenthippo-cursor-key:latest'));
+        assert.ok(sh.includes('AGENTHIPPO_CUSTOM_ENGINES_DIR=/engines'));
+        assert.ok(df.includes('"--engine","cursor"'));
+        assert.ok(df.includes('"--model","auto"'));
+        assert.ok(df.includes('runtime:latest-cursor'));
+        assert.ok(df.includes('"--www-dir","/app/pack/deploy/www"'));
+        assert.ok((0, deploy_init_1.renderTarget)('cloudrun', ctx)['www/index.html'].includes('<h1>customer-service</h1>'));
+        const env = (0, deploy_init_1.renderTarget)('cloudrun', ctx)['.env.example'];
+        assert.ok(env.includes('CURSOR_API_KEY='));
+    });
+    test('spcs egress is limited to the model API via one EAI', () => {
+        const sql = (0, deploy_init_1.renderTarget)('spcs', CTX)['deploy.sql'];
+        assert.ok(sql.includes('api.anthropic.com:443'));
+        assert.ok(/EXTERNAL ACCESS INTEGRATION/.test(sql));
+    });
+    test('vm target includes edge compose profile; agent has no SSO-bypass host port', () => {
+        const files = (0, deploy_init_1.renderTarget)('vm', CTX);
+        const compose = files['docker-compose.yml'];
+        assert.ok(compose.includes('profiles: ["edge"]'));
+        assert.ok(compose.includes('profiles: ["tunnel"]'));
+        assert.ok(compose.includes('cloudflared:'));
+        assert.ok(compose.includes('oauth2-proxy'));
+        assert.ok(compose.includes('caddy:'));
+        assert.ok(!compose.includes('127.0.0.1:8080:8080'), 'agent must not publish host port in compose (SSO bypass)');
+        assert.ok(compose.includes('OAUTH2_PROXY_REVERSE_PROXY'));
+        assert.ok(compose.includes('./www:/srv/www'));
+        assert.ok(files['run.sh'].includes('127.0.0.1:8080'));
+        assert.ok(files['run-edge-tunnel.sh'].includes('--profile edge --profile tunnel'));
+        assert.ok(files['Caddyfile'].includes('reverse_proxy agent:8080'));
+        assert.ok(files['Caddyfile'].includes('{$AGENTHIPPO_PUBLIC_HOSTNAME}'));
+        assert.ok(files['Caddyfile'].includes('@health path /health /ready'));
+        assert.ok(!files['Caddyfile'].includes('@api path /v1/* /health /ready'));
+        assert.ok(files['www/index.html'].includes('<form id="chat">'));
+        // In-compose config-file tunnel (the proven-live path): cloudflared container → caddy:80.
+        assert.ok(files['cloudflared.yml'].includes('http://caddy:80'), 'in-compose cloudflared reaches Caddy on the docker network');
+        assert.ok(!files['cloudflared.yml'].includes('http://127.0.0.1:80'), 'a container cannot reach Caddy via 127.0.0.1');
+        assert.ok(!files['cloudflared.yml'].includes('localhost:8080'));
+        assert.ok(compose.includes('tunnel --config /etc/cloudflared/config.yml run'), 'config-file mode');
+        assert.ok(compose.includes('./cloudflared.yml:/etc/cloudflared/config.yml'), 'mounts the routing config');
+        assert.ok(compose.includes('./tunnel-credentials.json:/etc/cloudflared/credentials.json'), 'mounts the creds');
+        assert.ok(!compose.includes('TUNNEL_TOKEN'), 'config-file mode does not use a token');
+        assert.ok(files['agenthippo-edge.service'].includes('--profile tunnel'));
+        assert.ok(files['.env.auth.example'].includes('OAUTH2_PROXY_CLIENT_ID'));
+        assert.ok(!files['.env.example'].includes('OAUTH2_PROXY_CLIENT_SECRET'), 'OAuth secret lives in .env.auth, not the agent-shared .env');
+        assert.ok(files['.env.example'].includes('tunnel-credentials.json'), 'edge env documents the creds file, not a token');
+        assert.ok(!files['.env.example'].includes('CLOUDFLARE_TUNNEL_TOKEN'), 'token mode removed');
+        assert.ok(files['.env.example'].includes(`AGENTHIPPO_PUBLIC_HOSTNAME=${deploy_init_1.DEPLOY_PUBLIC_HOSTNAME}`));
+    });
+    test('compose target includes edge profile and Caddyfile', () => {
+        const files = (0, deploy_init_1.renderTarget)('compose', CTX);
+        assert.ok(files['docker-compose.yml'].includes('profiles: ["edge"]'));
+        assert.ok(files['Caddyfile']);
+        assert.ok(files['.env.auth.example'].includes('OAUTH2_PROXY_PROVIDER'));
+    });
+    test('agent service does not load .env.auth; broker + oauth2-proxy do', () => {
+        const compose = (0, deploy_init_1.renderTarget)('compose', CTX)['docker-compose.yml'];
+        // The agent runs model-driven tool calls — it must never receive the token-signing key.
+        const agentBlock = compose.slice(compose.indexOf('  agent:'), compose.indexOf('  oauth2-proxy:'));
+        assert.ok(agentBlock.includes('env_file:'), 'sanity: located the agent service block');
+        assert.ok(!agentBlock.includes('.env.auth'), 'agent must not load .env.auth (JWT signing key + OAuth secrets)');
+        assert.ok(compose.includes('.env.auth'), 'broker/oauth2-proxy must load .env.auth');
+    });
+});
+suite('deploy-init: deployCommand stages a self-contained pack', () => {
+    let pack;
+    let staging;
+    setup(() => {
+        pack = fs.mkdtempSync(path.join(os.tmpdir(), 'ah-pack-'));
+        staging = fs.mkdtempSync(path.join(os.tmpdir(), 'ah-stage-'));
+        fs.writeFileSync(path.join(pack, 'agent.yaml'), 'apiVersion: agenthippo.ai/v1\nkind: Agent\nmetadata:\n  name: cs-test\nspec:\n  engine: claude\n  model: litellm/gpt-5.5\n');
+        fs.writeFileSync(path.join(pack, 'AGENTS.md'), '# cs-test\n');
+        fs.mkdirSync(path.join(pack, 'skills', 'demo', 'scripts'), { recursive: true });
+        fs.writeFileSync(path.join(pack, 'skills', 'demo', 'scripts', 'run.sh'), 'echo hi\n');
+        fs.writeFileSync(path.join(pack, 'skills', 'demo', 'scripts', 'requirements.txt'), 'requests\n');
+        // Ignored by the copy filter: dev cache, secrets, source deploy/.
+        fs.mkdirSync(path.join(pack, 'node_modules', 'foo'), { recursive: true });
+        fs.writeFileSync(path.join(pack, 'node_modules', 'foo', 'index.js'), 'x');
+        fs.writeFileSync(path.join(pack, '.env'), 'SECRET=1\n');
+        fs.writeFileSync(path.join(pack, 'my-credentials.json'), '{}\n');
+        fs.mkdirSync(path.join(pack, 'deploy'), { recursive: true });
+        fs.writeFileSync(path.join(pack, 'deploy', 'leftover.yaml'), 'stale\n');
+    });
+    teardown(() => {
+        fs.rmSync(pack, { recursive: true, force: true });
+        fs.rmSync(staging, { recursive: true, force: true });
+    });
+    test('copies pack into staging root, drops node_modules/.env/credentials, writes deploy/ + root .dockerignore', async () => {
+        await (0, deploy_1.deployCommand)('init', pack, { target: 'cloudrun', out: staging, port: 8080, force: true });
+        // Pack content at the staging root.
+        assert.ok(fs.existsSync(path.join(staging, 'agent.yaml')), 'agent.yaml copied to staging root');
+        assert.ok(fs.existsSync(path.join(staging, 'AGENTS.md')), 'AGENTS.md copied to staging root');
+        assert.ok(fs.existsSync(path.join(staging, 'skills', 'demo', 'scripts', 'requirements.txt')), 'skill requirements.txt copied (needed by the build-time install step)');
+        // Filtered out (mirrors .dockerignore): no dev caches, no secrets.
+        assert.ok(!fs.existsSync(path.join(staging, 'node_modules')), 'node_modules must not be copied into staging');
+        assert.ok(!fs.existsSync(path.join(staging, '.env')), '.env must not be copied into staging');
+        assert.ok(!fs.existsSync(path.join(staging, 'my-credentials.json')), 'credentials json must not be copied');
+        // The source pack's own deploy/ is not copied (the generator owns staging/deploy/).
+        assert.ok(!fs.existsSync(path.join(staging, 'deploy', 'leftover.yaml')), 'source deploy/ must not be copied');
+        // Generated artifacts under staging/deploy/.
+        assert.ok(fs.existsSync(path.join(staging, 'deploy', 'Dockerfile')), 'Dockerfile at staging/deploy/Dockerfile');
+        assert.ok(fs.existsSync(path.join(staging, 'deploy', 'service.yaml')), 'service.yaml at staging/deploy/');
+        assert.ok(fs.existsSync(path.join(staging, 'deploy', 'cloudrun-deploy.sh')), 'cloudrun-deploy.sh at staging/deploy/');
+        // .dockerignore at the staging root (build-context root), NOT under deploy/.
+        assert.ok(fs.existsSync(path.join(staging, '.dockerignore')), '.dockerignore at staging root (context root)');
+        assert.ok(!fs.existsSync(path.join(staging, 'deploy', '.dockerignore')), '.dockerignore must not be under deploy/ (Docker would ignore it)');
+        // The generated build script self-anchors to the staging root.
+        const sh = fs.readFileSync(path.join(staging, 'deploy', 'cloudrun-deploy.sh'), 'utf8');
+        assert.ok(sh.includes('cd "$(dirname "$0")/.."'), 'cloudrun-deploy.sh anchors to staging root');
+        assert.ok(sh.includes('docker build') && sh.includes('deploy/Dockerfile') && sh.includes('-t "$IMAGE"'), 'build sources deploy/Dockerfile (sed-rewritten to AR base) with the staging root as context');
+    });
+    test('--packdir flag is honored as an alternative to the positional arg', async () => {
+        await (0, deploy_1.deployCommand)('init', undefined, { target: 'cloudrun', out: staging, port: 8080, force: true, packdir: pack });
+        assert.ok(fs.existsSync(path.join(staging, 'agent.yaml')), 'packdir flag resolved the pack');
+        assert.ok(fs.existsSync(path.join(staging, 'deploy', 'Dockerfile')), 'artifacts generated from packdir pack');
+    });
+});
+suite('deploy-init: copyPackToStaging dereferences symlinks + skips broken ones', () => {
+    let pack;
+    let staging;
+    setup(() => {
+        pack = fs.mkdtempSync(path.join(os.tmpdir(), 'ah-pack-'));
+        staging = fs.mkdtempSync(path.join(os.tmpdir(), 'ah-stage-'));
+        fs.writeFileSync(path.join(pack, 'agent.yaml'), 'apiVersion: agenthippo.ai/v1\nkind: Agent\nmetadata:\n  name: link-test\nspec:\n  engine: claude\n');
+        // Real skill content + a shared file the skill links to (relative symlink → resolved on copy).
+        fs.mkdirSync(path.join(pack, 'skills', 'demo'), { recursive: true });
+        fs.writeFileSync(path.join(pack, 'skills', 'demo', 'REAL.md'), '# real content\n');
+        fs.symlinkSync('REAL.md', path.join(pack, 'skills', 'demo', 'SKILL.md')); // valid relative symlink
+        // Broken symlink: target does not exist (the data-analyst hydration bug pattern).
+        fs.mkdirSync(path.join(pack, 'skills', 'broken'), { recursive: true });
+        fs.symlinkSync('/nonexistent/abs/path/SKILL.md', path.join(pack, 'skills', 'broken', 'SKILL.md'));
+    });
+    teardown(() => {
+        fs.rmSync(pack, { recursive: true, force: true });
+        fs.rmSync(staging, { recursive: true, force: true });
+    });
+    test('valid symlinks are dereferenced to real files; broken symlinks are skipped + reported', () => {
+        const broken = (0, deploy_1.copyPackToStaging)(pack, staging);
+        // Valid symlink → real file content in staging (not a symlink). Docker-safe.
+        const staged = path.join(staging, 'skills', 'demo', 'SKILL.md');
+        assert.ok(fs.existsSync(staged), 'valid symlink content copied to staging');
+        assert.ok(!fs.lstatSync(staged).isSymbolicLink(), 'staged entry is a real file, not a symlink');
+        assert.strictEqual(fs.readFileSync(staged, 'utf8'), '# real content\n');
+        // Broken symlink → not staged, and reported in the broken list.
+        assert.ok(!fs.existsSync(path.join(staging, 'skills', 'broken', 'SKILL.md')), 'broken symlink must not be staged');
+        assert.ok(broken.includes('skills/broken/SKILL.md'), 'broken symlink reported in returned list');
+    });
+});

package/out/test/deps-auto-install.test.js

@@ -0,0 +1,81 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Deps auto-install flag (serve-v3 A2 — self-contained image)
+ *
+ *  Verifies AGENTHIPPO_NO_AUTO_INSTALL is actually honored (the runtime-install bug).
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const deps_1 = require("../cli/deps");
+suite('deps: isAutoInstallDisabled', () => {
+    const KEYS = ['AGENTHIPPO_NO_AUTO_INSTALL', 'AGENTIDE_NO_AUTO_INSTALL'];
+    let saved;
+    setup(() => {
+        saved = {};
+        for (const k of KEYS) {
+            saved[k] = process.env[k];
+            delete process.env[k];
+        }
+    });
+    teardown(() => {
+        for (const k of KEYS) {
+            if (saved[k] === undefined)
+                delete process.env[k];
+            else
+                process.env[k] = saved[k];
+        }
+    });
+    test('unset → auto-install enabled (false)', () => {
+        assert.strictEqual((0, deps_1.isAutoInstallDisabled)(), false);
+    });
+    test('truthy values disable install', () => {
+        for (const v of ['1', 'true', 'TRUE', 'yes', 'on', '  1  ']) {
+            process.env.AGENTHIPPO_NO_AUTO_INSTALL = v;
+            assert.strictEqual((0, deps_1.isAutoInstallDisabled)(), true, `value ${JSON.stringify(v)}`);
+        }
+    });
+    test('falsey / empty values keep install enabled', () => {
+        for (const v of ['', '0', 'false', 'no']) {
+            process.env.AGENTHIPPO_NO_AUTO_INSTALL = v;
+            assert.strictEqual((0, deps_1.isAutoInstallDisabled)(), false, `value ${JSON.stringify(v)}`);
+        }
+    });
+    test('legacy AGENTIDE_NO_AUTO_INSTALL is honored', () => {
+        process.env.AGENTIDE_NO_AUTO_INSTALL = '1';
+        assert.strictEqual((0, deps_1.isAutoInstallDisabled)(), true);
+    });
+});