@agenthippo-ai/agenthippo 0.1.0

package/out/test/mcp.test.js

@@ -0,0 +1,307 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const fs_1 = require("fs");
+const mcp_1 = require("../mcp");
+const branding_1 = require("../branding");
+suite('MCP Server Loading', () => {
+    let testDir;
+    const getAgentMcpDir = (agentId) => path.join(testDir, branding_1.AGENTIDE_DIR_NAME, 'agents', agentId, 'mcp');
+    setup(async () => {
+        testDir = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'mcp-test-'));
+    });
+    teardown(async () => {
+        await fs_1.promises.rm(testDir, { recursive: true, force: true, maxRetries: 5, retryDelay: 50 });
+    });
+    suite('loadMcpServers', () => {
+        test('should return empty array when agent mcp config does not exist', async () => {
+            const result = await (0, mcp_1.loadMcpServers)('nonexistent', testDir);
+            assert.deepStrictEqual(result, []);
+        });
+        test('should load servers from .mcp.json', async () => {
+            const mcpDir = getAgentMcpDir('pack-test');
+            await fs_1.promises.mkdir(mcpDir, { recursive: true });
+            await fs_1.promises.writeFile(path.join(mcpDir, '.env'), 'GITHUB_TOKEN=from_env_file\n');
+            const configJson = {
+                mcpServers: {
+                    github: {
+                        label: 'GitHub MCP',
+                        command: 'npx',
+                        args: ['-y', '@modelcontextprotocol/server-github'],
+                        env: { GITHUB_TOKEN: '${env:GITHUB_TOKEN}' },
+                    },
+                    filesystem: {
+                        command: 'npx',
+                        args: ['-y', '@modelcontextprotocol/server-filesystem'],
+                    },
+                },
+            };
+            await fs_1.promises.writeFile(path.join(mcpDir, '.mcp.json'), JSON.stringify(configJson, null, 2));
+            const result = await (0, mcp_1.loadMcpServers)('pack-test', testDir);
+            assert.strictEqual(result.length, 2);
+            assert.strictEqual(result[0].name, 'github');
+            assert.strictEqual(result[0].command, 'npx');
+            assert.deepStrictEqual(result[0].args, ['-y', '@modelcontextprotocol/server-github']);
+            assert.deepStrictEqual(result[0].env, { GITHUB_TOKEN: 'from_env_file' });
+            assert.strictEqual(result[1].name, 'filesystem');
+            assert.deepStrictEqual(result[1].args, ['-y', '@modelcontextprotocol/server-filesystem']);
+        });
+        test('should resolve relative args and ${serverDir}', async () => {
+            const mcpDir = getAgentMcpDir('pack-test');
+            await fs_1.promises.mkdir(mcpDir, { recursive: true });
+            const mcpJson = {
+                mcpServers: {
+                    'custom-server': {
+                        label: 'Custom Server',
+                        command: 'node',
+                        args: ['${serverDir}/dist/index.js', './relative.js'],
+                    },
+                },
+            };
+            await fs_1.promises.writeFile(path.join(mcpDir, '.mcp.json'), JSON.stringify(mcpJson, null, 2));
+            const result = await (0, mcp_1.loadMcpServers)('pack-test', testDir);
+            assert.strictEqual(result.length, 1);
+            assert.strictEqual(result[0].name, 'custom-server');
+            assert.strictEqual(result[0].command, 'node');
+            assert.deepStrictEqual(result[0].args, [
+                `${mcpDir}/dist/index.js`,
+                path.resolve(mcpDir, './relative.js'),
+            ]);
+        });
+    });
+    suite('loadMcpServers bundled resolution', () => {
+        test('should load bundled servers for default agent', async () => {
+            const result = await (0, mcp_1.loadMcpServers)('default', testDir);
+            assert.deepStrictEqual(result, []);
+        });
+        test('should resolve enable-bundled from bundled server mcp.json', async () => {
+            const defaultMcpDir = getAgentMcpDir('default');
+            await fs_1.promises.mkdir(defaultMcpDir, { recursive: true });
+            await fs_1.promises.writeFile(path.join(defaultMcpDir, '.mcp.json'), JSON.stringify({
+                mcpServers: {
+                    'langfuse-analytics': {
+                        command: 'enable-bundled',
+                        env: {
+                            SOURCE: 'workspace',
+                            LANGFUSE_PUBLIC_KEY: '${env:LANGFUSE_PUBLIC_KEY}',
+                        },
+                    },
+                },
+            }));
+            const bundledBasePromptsDir = path.join(testDir, 'base-prompts');
+            const bundledServerDir = path.join(bundledBasePromptsDir, 'mcp-servers', 'langfuse-analytics');
+            await fs_1.promises.mkdir(bundledServerDir, { recursive: true });
+            await fs_1.promises.writeFile(path.join(bundledServerDir, 'mcp.json'), JSON.stringify({
+                name: 'langfuse-analytics',
+                label: 'Langfuse Analytics',
+                command: 'node',
+                args: ['${serverDir}/dist/index.js', './bootstrap.js'],
+                env: {
+                    LANGFUSE_BASE_URL: '${env:LANGFUSE_BASE_URL}',
+                    SOURCE: 'bundled',
+                },
+            }));
+            await fs_1.promises.writeFile(path.join(testDir, '.env'), 'LANGFUSE_BASE_URL=https://cloud.langfuse.com\nLANGFUSE_PUBLIC_KEY=public-key\n');
+            const result = await (0, mcp_1.loadMcpServers)('default', testDir, bundledBasePromptsDir);
+            assert.strictEqual(result.length, 1);
+            assert.strictEqual(result[0].name, 'langfuse-analytics');
+            assert.strictEqual(result[0].command, 'node');
+            assert.deepStrictEqual(result[0].args, [
+                `${bundledServerDir}/dist/index.js`,
+                path.resolve(bundledServerDir, './bootstrap.js'),
+            ]);
+            assert.deepStrictEqual(result[0].env, {
+                LANGFUSE_BASE_URL: 'https://cloud.langfuse.com',
+                LANGFUSE_PUBLIC_KEY: process.env.LANGFUSE_PUBLIC_KEY ?? 'public-key',
+                SOURCE: 'workspace',
+            });
+        });
+        test('should skip bundled server when mcp.json is missing', async () => {
+            const defaultMcpDir = getAgentMcpDir('default');
+            await fs_1.promises.mkdir(defaultMcpDir, { recursive: true });
+            await fs_1.promises.writeFile(path.join(defaultMcpDir, '.mcp.json'), JSON.stringify({
+                mcpServers: {
+                    'missing-bundled': {
+                        command: 'enable-bundled',
+                    },
+                },
+            }));
+            const bundledBasePromptsDir = path.join(testDir, 'base-prompts');
+            await fs_1.promises.mkdir(path.join(bundledBasePromptsDir, 'mcp-servers'), { recursive: true });
+            const result = await (0, mcp_1.loadMcpServers)('default', testDir, bundledBasePromptsDir);
+            assert.deepStrictEqual(result, []);
+        });
+        test('should skip server when command is disable-bundled', async () => {
+            const defaultMcpDir = getAgentMcpDir('default');
+            await fs_1.promises.mkdir(defaultMcpDir, { recursive: true });
+            await fs_1.promises.writeFile(path.join(defaultMcpDir, '.mcp.json'), JSON.stringify({
+                mcpServers: {
+                    'langfuse-analytics': {
+                        command: 'disable-bundled',
+                    },
+                },
+            }));
+            const bundledBasePromptsDir = path.join(testDir, 'base-prompts');
+            const bundledServerDir = path.join(bundledBasePromptsDir, 'mcp-servers', 'langfuse-analytics');
+            await fs_1.promises.mkdir(bundledServerDir, { recursive: true });
+            await fs_1.promises.writeFile(path.join(bundledServerDir, 'mcp.json'), JSON.stringify({
+                command: 'node',
+                args: ['${serverDir}/dist/index.js'],
+            }));
+            const result = await (0, mcp_1.loadMcpServers)('default', testDir, bundledBasePromptsDir);
+            assert.deepStrictEqual(result, []);
+        });
+        test('should load pack servers for non-default agent', async () => {
+            const packMcpDir = getAgentMcpDir('test-pack');
+            await fs_1.promises.mkdir(packMcpDir, { recursive: true });
+            await fs_1.promises.writeFile(path.join(packMcpDir, '.mcp.json'), JSON.stringify({
+                mcpServers: {
+                    'pack-server': {
+                        command: 'echo',
+                        args: ['hello'],
+                    },
+                },
+            }));
+            const result = await (0, mcp_1.loadMcpServers)('test-pack', testDir);
+            assert.strictEqual(result.length, 1);
+            assert.strictEqual(result[0].name, 'pack-server');
+        });
+    });
+    suite('generateCodexMcpConfig', () => {
+        test('should generate empty string for no servers', () => {
+            const result = (0, mcp_1.generateCodexMcpConfig)([]);
+            assert.strictEqual(result, '');
+        });
+        test('should generate valid TOML config', () => {
+            const servers = [
+                {
+                    name: 'test-server',
+                    label: 'Test Server',
+                    command: 'node',
+                    args: ['/path/to/server.js'],
+                    env: { API_KEY: 'secret' },
+                },
+            ];
+            const result = (0, mcp_1.generateCodexMcpConfig)(servers);
+            assert.ok(result.includes('[mcp_servers.test-server]'));
+            assert.ok(result.includes('command = "node"'));
+            assert.ok(result.includes('args = ["/path/to/server.js"]'));
+            assert.ok(result.includes('API_KEY = "secret"'));
+            // No approval line by default — interactive IDE keeps Codex's normal prompts.
+            assert.ok(!result.includes('default_tools_approval_mode'));
+        });
+        test('autoApprove emits default_tools_approval_mode = "auto" per server', () => {
+            const servers = [
+                { name: 'stdio-srv', label: 's', command: 'node', args: ['s.js'] },
+                { name: 'http-srv', label: 'h', command: '', args: [], url: 'https://mcp.example.com/sse' },
+            ];
+            const result = (0, mcp_1.generateCodexMcpConfig)(servers, { autoApprove: true });
+            assert.ok(result.includes('default_tools_approval_mode = "auto"'));
+            assert.ok(result.includes('url = "https://mcp.example.com/sse"'));
+            // Invalid legacy key/value must never be emitted.
+            assert.ok(!result.includes('approval_mode = "never"'));
+        });
+        test('generateCodexMcpConfig emits http_headers for URL servers', () => {
+            const servers = [
+                {
+                    name: 'remote',
+                    label: 'r',
+                    command: '',
+                    args: [],
+                    url: 'https://mcp.example.com/sse',
+                    headers: { Authorization: 'Bearer abc', 'X-Custom': 'val' },
+                },
+            ];
+            const result = (0, mcp_1.generateCodexMcpConfig)(servers);
+            assert.ok(result.includes('url = "https://mcp.example.com/sse"'));
+            assert.ok(result.includes('http_headers = { "Authorization" = "Bearer abc", "X-Custom" = "val" }'));
+        });
+    });
+    suite('inline MCP helpers', () => {
+        test('formatInlineMcpServers maps resolved servers by name', () => {
+            const inline = (0, mcp_1.formatInlineMcpServers)([
+                { name: 'db', label: 'db', command: 'node', args: ['server.js'], env: { TOKEN: 'x' } },
+            ]);
+            assert.deepStrictEqual(inline, {
+                db: { command: 'node', args: ['server.js'], env: { TOKEN: 'x' } },
+            });
+        });
+        test('formatInlineMcpServers maps HTTP Streamable servers to cursor-sdk url form', () => {
+            const inline = (0, mcp_1.formatInlineMcpServers)([
+                { name: 'remote', label: 'remote', command: '', args: [], url: 'https://mcp.example.com/sse' },
+                { name: 'local', label: 'local', command: 'node', args: ['s.js'] },
+            ]);
+            assert.deepStrictEqual(inline, {
+                remote: { type: 'http', url: 'https://mcp.example.com/sse' },
+                local: { command: 'node', args: ['s.js'] },
+            });
+        });
+        test('formatInlineMcpServers threads headers into HTTP servers', () => {
+            const inline = (0, mcp_1.formatInlineMcpServers)([
+                {
+                    name: 'remote',
+                    label: 'remote',
+                    command: '',
+                    args: [],
+                    url: 'https://mcp.example.com/sse',
+                    headers: { Authorization: 'Bearer abc' },
+                },
+            ]);
+            assert.deepStrictEqual(inline, {
+                remote: { type: 'http', url: 'https://mcp.example.com/sse', headers: { Authorization: 'Bearer abc' } },
+            });
+        });
+        test('serialize and parse round-trip inline MCP', () => {
+            const inline = (0, mcp_1.formatInlineMcpServers)([
+                { name: 'echo', label: 'echo', command: 'echo', args: ['hi'] },
+            ]);
+            const json = (0, mcp_1.serializeInlineMcpServers)(inline);
+            assert.ok(json);
+            assert.deepStrictEqual((0, mcp_1.parseInlineMcpServers)(json), inline);
+        });
+        test('parseInlineMcpServers returns undefined for empty or invalid input', () => {
+            assert.strictEqual((0, mcp_1.parseInlineMcpServers)(undefined), undefined);
+            assert.strictEqual((0, mcp_1.parseInlineMcpServers)(''), undefined);
+            assert.strictEqual((0, mcp_1.parseInlineMcpServers)('not-json'), undefined);
+        });
+    });
+});

package/out/test/openclaw-channel-routing.test.js

@@ -0,0 +1,191 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const assert = __importStar(require("assert"));
+const openclaw_channel_routing_js_1 = require("../gateway/openclaw-channel-routing.js");
+suite('resolvePublishedGatewayChannelIds', () => {
+    const rows = [
+        { id: 'slack', label: 'Slack', connected: true, enabled: true, accounts: ['default'] },
+        // Configured but momentarily offline (e.g. Telegram polling stalled) — still bindable.
+        { id: 'telegram', label: 'Telegram', connected: false, enabled: true, accounts: ['default'] },
+        { id: 'whatsapp', label: 'WhatsApp', connected: false, enabled: false, accounts: ['default'] },
+    ];
+    test('default publish binds all enabled channels, including ones offline at publish time', () => {
+        const selected = (0, openclaw_channel_routing_js_1.resolvePublishedGatewayChannelIds)(rows, undefined);
+        assert.deepStrictEqual(selected, ['slack', 'telegram']);
+    });
+    test('peer publish binds only the preferred channel', () => {
+        const selected = (0, openclaw_channel_routing_js_1.resolvePublishedGatewayChannelIds)(rows, 'telegram');
+        assert.deepStrictEqual(selected, ['telegram']);
+    });
+});
+suite('mapChannelsStatusToMeetAgentRows', () => {
+    test('derives enabled/connected from running/configured (no `connected` field)', () => {
+        const rows = (0, openclaw_channel_routing_js_1.mapChannelsStatusToMeetAgentRows)({
+            channelOrder: ['telegram', 'slack'],
+            channelLabels: { telegram: 'Telegram', slack: 'Slack' },
+            channels: {
+                telegram: { configured: true, running: false },
+                slack: { configured: true, running: true },
+            },
+            channelAccounts: {
+                telegram: [{ accountId: 'default', enabled: true, configured: true, running: false }],
+                slack: [{ accountId: 'default', enabled: true, configured: true, running: true }],
+            },
+        });
+        const telegram = rows.find((r) => r.id === 'telegram');
+        const slack = rows.find((r) => r.id === 'slack');
+        // Telegram is configured but its poller is down: bindable, not live.
+        assert.strictEqual(telegram?.enabled, true);
+        assert.strictEqual(telegram?.connected, false);
+        assert.strictEqual(slack?.enabled, true);
+        assert.strictEqual(slack?.connected, true);
+    });
+    test('honors legacy `connected` field when present', () => {
+        const rows = (0, openclaw_channel_routing_js_1.mapChannelsStatusToMeetAgentRows)({
+            channelOrder: ['slack'],
+            channels: { slack: { connected: true } },
+        });
+        assert.strictEqual(rows[0]?.connected, true);
+        assert.strictEqual(rows[0]?.enabled, true);
+    });
+});
+suite('waitForChannelsLive', () => {
+    /** Build a `channels.status` payload from an id → connected map. */
+    function statusPayload(connected) {
+        const channels = {};
+        const channelAccounts = {};
+        for (const [id, isConn] of Object.entries(connected)) {
+            channels[id] = { configured: true, running: isConn };
+            channelAccounts[id] = [{ accountId: 'default', enabled: true, configured: true, running: isConn }];
+        }
+        return { channelOrder: Object.keys(connected), channels, channelAccounts };
+    }
+    /** Request stub that returns one scripted payload per call (last entry repeats); `'throw'` rejects. */
+    function seqRequest(seq) {
+        let i = 0;
+        const request = async (_method, _params) => {
+            const item = seq[Math.min(i, seq.length - 1)];
+            i++;
+            if (item === 'throw') {
+                throw new Error('channels.status failed');
+            }
+            return item;
+        };
+        return { request, calls: () => i };
+    }
+    /** Deterministic clock: each `sleep` advances `now` by the requested amount. */
+    function fakeClock() {
+        let t = 0;
+        return {
+            now: () => t,
+            sleep: async (ms) => {
+                t += ms;
+            },
+        };
+    }
+    test('returns ready immediately with no polls when no channels requested', async () => {
+        const { request, calls } = seqRequest([statusPayload({ slack: true })]);
+        const result = await (0, openclaw_channel_routing_js_1.waitForChannelsLive)(request, []);
+        assert.strictEqual(result.ready, true);
+        assert.strictEqual(result.polls, 0);
+        assert.strictEqual(calls(), 0);
+    });
+    test('resolves on the first poll when the channel is already live', async () => {
+        const { request, calls } = seqRequest([statusPayload({ slack: true })]);
+        const clock = fakeClock();
+        const result = await (0, openclaw_channel_routing_js_1.waitForChannelsLive)(request, ['slack'], { ...clock });
+        assert.strictEqual(result.ready, true);
+        assert.strictEqual(result.timedOut, false);
+        assert.deepStrictEqual(result.live, ['slack']);
+        assert.strictEqual(result.polls, 1);
+        assert.strictEqual(calls(), 1);
+    });
+    test('waits across the restart window, then resolves when the channel comes back', async () => {
+        // Slack is bouncing: down for two polls (mid-restart), then live.
+        const { request } = seqRequest([
+            statusPayload({ slack: false }),
+            statusPayload({ slack: false }),
+            statusPayload({ slack: true }),
+        ]);
+        const clock = fakeClock();
+        const result = await (0, openclaw_channel_routing_js_1.waitForChannelsLive)(request, ['slack'], { intervalMs: 100, timeoutMs: 5000, ...clock });
+        assert.strictEqual(result.ready, true);
+        assert.strictEqual(result.timedOut, false);
+        assert.strictEqual(result.polls, 3);
+    });
+    test('times out (best-effort) when the channel never returns', async () => {
+        const { request } = seqRequest([statusPayload({ slack: false })]);
+        const clock = fakeClock();
+        const result = await (0, openclaw_channel_routing_js_1.waitForChannelsLive)(request, ['slack'], { intervalMs: 400, timeoutMs: 1000, ...clock });
+        assert.strictEqual(result.ready, false);
+        assert.strictEqual(result.timedOut, true);
+        assert.deepStrictEqual(result.pending, ['slack']);
+    });
+    test('treats a failed channels.status poll as not-yet-live and keeps retrying', async () => {
+        const { request } = seqRequest(['throw', statusPayload({ slack: true })]);
+        const clock = fakeClock();
+        const result = await (0, openclaw_channel_routing_js_1.waitForChannelsLive)(request, ['slack'], { intervalMs: 100, timeoutMs: 5000, ...clock });
+        assert.strictEqual(result.ready, true);
+        assert.strictEqual(result.polls, 2);
+    });
+    test('only blocks on requested channels, ignoring other offline channels', async () => {
+        // telegram stays offline forever but is not requested, so it must not block on slack.
+        const { request } = seqRequest([statusPayload({ slack: true, telegram: false })]);
+        const clock = fakeClock();
+        const result = await (0, openclaw_channel_routing_js_1.waitForChannelsLive)(request, ['slack'], { ...clock });
+        assert.strictEqual(result.ready, true);
+        assert.deepStrictEqual(result.live, ['slack']);
+        assert.deepStrictEqual(result.pending, []);
+    });
+    test('requires all requested channels before reporting ready', async () => {
+        const { request } = seqRequest([
+            statusPayload({ slack: true, telegram: false }),
+            statusPayload({ slack: true, telegram: true }),
+        ]);
+        const clock = fakeClock();
+        const result = await (0, openclaw_channel_routing_js_1.waitForChannelsLive)(request, ['slack', 'telegram'], {
+            intervalMs: 100,
+            timeoutMs: 5000,
+            ...clock,
+        });
+        assert.strictEqual(result.ready, true);
+        assert.strictEqual(result.polls, 2);
+        assert.deepStrictEqual(result.live.sort(), ['slack', 'telegram']);
+    });
+});

package/out/test/pathSafety.test.js

@@ -0,0 +1,63 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const path = __importStar(require("path"));
+const pathSafety_1 = require("../utils/pathSafety");
+suite('pathSafety', () => {
+    const root = path.resolve('/tmp/agentide-analytics');
+    test('isPathUnderRoot allows paths under root', () => {
+        assert.strictEqual((0, pathSafety_1.isPathUnderRoot)(root, path.join(root, 'views', 'cost-ops', 'view.yaml')), true);
+        assert.strictEqual((0, pathSafety_1.isPathUnderRoot)(root, root), true);
+    });
+    test('isPathUnderRoot rejects parent escape via ..', () => {
+        assert.strictEqual((0, pathSafety_1.isPathUnderRoot)(root, path.join(root, '..', 'secret.txt')), false);
+        assert.strictEqual((0, pathSafety_1.isPathUnderRoot)(root, '/tmp/secret.txt'), false);
+    });
+    test('isPathUnderRoot rejects prefix-only matches', () => {
+        const sibling = `${root}-other`;
+        assert.strictEqual((0, pathSafety_1.isPathUnderRoot)(root, path.join(sibling, 'views', 'x.yaml')), false);
+    });
+    test('isPathUnderAnyRoot checks multiple roots', () => {
+        const other = path.resolve('/tmp/other-analytics');
+        const candidate = path.join(other, 'panel', 'views.yaml');
+        assert.strictEqual((0, pathSafety_1.isPathUnderAnyRoot)([root, other], candidate), true);
+        assert.strictEqual((0, pathSafety_1.isPathUnderAnyRoot)([root], candidate), false);
+    });
+});