@agenthippo-ai/agenthippo 0.1.0

package/out/test/runtime.test.js

@@ -0,0 +1,349 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const fs_1 = require("fs");
+const interfaces_1 = require("../runtime/interfaces");
+// =============================================================================
+// Logger Tests
+// =============================================================================
+suite('Runtime Interfaces - Logger', () => {
+    test('ConsoleLogger has all required methods', () => {
+        const logger = new interfaces_1.ConsoleLogger('[Test]');
+        assert.strictEqual(typeof logger.debug, 'function');
+        assert.strictEqual(typeof logger.info, 'function');
+        assert.strictEqual(typeof logger.warn, 'function');
+        assert.strictEqual(typeof logger.error, 'function');
+    });
+    test('NoOpLogger has all required methods', () => {
+        const logger = new interfaces_1.NoOpLogger();
+        // Should not throw
+        logger.debug('test');
+        logger.info('test');
+        logger.warn('test');
+        logger.error('test');
+        logger.error('test', new Error('test'));
+    });
+});
+// =============================================================================
+// Permission Handler Tests
+// =============================================================================
+suite('Runtime Interfaces - PermissionHandler', () => {
+    test('AutoApprovePermissionHandler always allows', async () => {
+        const handler = new interfaces_1.AutoApprovePermissionHandler();
+        const result = await handler.requestPermission({
+            toolName: 'Bash',
+            toolInput: { command: 'ls' },
+        });
+        assert.deepStrictEqual(result, { behavior: 'allow' });
+    });
+    test('AutoDenyPermissionHandler always denies', async () => {
+        const handler = new interfaces_1.AutoDenyPermissionHandler();
+        const result = await handler.requestPermission({
+            toolName: 'Bash',
+            toolInput: { command: 'rm -rf /' },
+        });
+        assert.strictEqual(result.behavior, 'deny');
+    });
+    test('AutoDenyPermissionHandler uses custom message', async () => {
+        const handler = new interfaces_1.AutoDenyPermissionHandler('Custom deny message');
+        const result = await handler.requestPermission({ toolName: 'Write' });
+        assert.strictEqual(result.behavior, 'deny');
+        if (result.behavior === 'deny') {
+            assert.strictEqual(result.message, 'Custom deny message');
+        }
+    });
+});
+// =============================================================================
+// Edit Tracker Tests
+// =============================================================================
+suite('Runtime Interfaces - EditTracker', () => {
+    test('NoOpEditTracker startTracking returns undefined', async () => {
+        const tracker = new interfaces_1.NoOpEditTracker();
+        const result = await tracker.startTracking('session-1', ['/path/to/file.ts']);
+        assert.strictEqual(result, undefined);
+    });
+    test('NoOpEditTracker stopTracking does not throw', async () => {
+        const tracker = new interfaces_1.NoOpEditTracker();
+        // Should not throw
+        await tracker.stopTracking('session-1', 123);
+    });
+    test('NoOpEditTracker applyEdit does not throw', async () => {
+        const tracker = new interfaces_1.NoOpEditTracker();
+        // Should not throw
+        await tracker.applyEdit('session-1', '/path/to/file.ts', 'content', true);
+    });
+});
+// =============================================================================
+// Session Store Tests
+// =============================================================================
+suite('Runtime Interfaces - SessionStore', () => {
+    test('MemorySessionStore get/set works', async () => {
+        const store = new interfaces_1.MemorySessionStore();
+        // Initially undefined
+        assert.strictEqual(store.get('key1'), undefined);
+        // Set and get
+        await store.set('key1', { foo: 'bar' });
+        assert.deepStrictEqual(store.get('key1'), { foo: 'bar' });
+        // Overwrite
+        await store.set('key1', { foo: 'baz' });
+        assert.deepStrictEqual(store.get('key1'), { foo: 'baz' });
+    });
+    test('MemorySessionStore clear removes all values', async () => {
+        const store = new interfaces_1.MemorySessionStore();
+        await store.set('key1', 'value1');
+        await store.set('key2', 'value2');
+        assert.strictEqual(store.get('key1'), 'value1');
+        assert.strictEqual(store.get('key2'), 'value2');
+        store.clear();
+        assert.strictEqual(store.get('key1'), undefined);
+        assert.strictEqual(store.get('key2'), undefined);
+    });
+    test('MemorySessionStore supports different value types', async () => {
+        const store = new interfaces_1.MemorySessionStore();
+        await store.set('string', 'hello');
+        await store.set('number', 42);
+        await store.set('boolean', true);
+        await store.set('object', { nested: { value: 123 } });
+        await store.set('array', [1, 2, 3]);
+        assert.strictEqual(store.get('string'), 'hello');
+        assert.strictEqual(store.get('number'), 42);
+        assert.strictEqual(store.get('boolean'), true);
+        assert.deepStrictEqual(store.get('object'), { nested: { value: 123 } });
+        assert.deepStrictEqual(store.get('array'), [1, 2, 3]);
+    });
+});
+// =============================================================================
+// FileSessionStore Tests
+// =============================================================================
+suite('Runtime Interfaces - FileSessionStore', () => {
+    let tempDir;
+    let testFilePath;
+    setup(async () => {
+        tempDir = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'agentide-test-'));
+        testFilePath = path.join(tempDir, 'sessions.json');
+    });
+    teardown(async () => {
+        try {
+            await fs_1.promises.rm(tempDir, { recursive: true, force: true });
+        }
+        catch {
+            // Ignore cleanup errors
+        }
+    });
+    test('FileSessionStore get/set works', async () => {
+        const store = new interfaces_1.FileSessionStore(testFilePath);
+        await store.load();
+        // Initially undefined
+        assert.strictEqual(store.get('key1'), undefined);
+        // Set and get
+        await store.set('key1', { foo: 'bar' });
+        assert.deepStrictEqual(store.get('key1'), { foo: 'bar' });
+        // Overwrite
+        await store.set('key1', { foo: 'baz' });
+        assert.deepStrictEqual(store.get('key1'), { foo: 'baz' });
+    });
+    test('FileSessionStore persists to disk', async () => {
+        // Write with first store instance
+        const store1 = new interfaces_1.FileSessionStore(testFilePath);
+        await store1.load();
+        await store1.set('persistent', { data: 'survives' });
+        // Read with new store instance
+        const store2 = new interfaces_1.FileSessionStore(testFilePath);
+        await store2.load();
+        assert.deepStrictEqual(store2.get('persistent'), { data: 'survives' });
+    });
+    test('FileSessionStore handles missing file gracefully', async () => {
+        const nonExistentPath = path.join(tempDir, 'does-not-exist.json');
+        const store = new interfaces_1.FileSessionStore(nonExistentPath);
+        await store.load(); // Should not throw
+        assert.strictEqual(store.get('anything'), undefined);
+    });
+    test('FileSessionStore clear removes all values', async () => {
+        const store = new interfaces_1.FileSessionStore(testFilePath);
+        await store.load();
+        await store.set('key1', 'value1');
+        await store.set('key2', 'value2');
+        assert.strictEqual(store.get('key1'), 'value1');
+        assert.strictEqual(store.get('key2'), 'value2');
+        await store.clear();
+        assert.strictEqual(store.get('key1'), undefined);
+        assert.strictEqual(store.get('key2'), undefined);
+        // Verify cleared state persists
+        const store2 = new interfaces_1.FileSessionStore(testFilePath);
+        await store2.load();
+        assert.strictEqual(store2.get('key1'), undefined);
+    });
+    test('FileSessionStore load is idempotent', async () => {
+        const store = new interfaces_1.FileSessionStore(testFilePath);
+        await store.load();
+        await store.set('key', 'original');
+        // Calling load again should not reset state
+        await store.load();
+        assert.strictEqual(store.get('key'), 'original');
+    });
+});
+// =============================================================================
+// DirectorySessionStore Tests (one file per session entry)
+// =============================================================================
+suite('Runtime Interfaces - DirectorySessionStore', () => {
+    // session.ts persists the whole map under a single record-valued logical key.
+    const KEY = 'agentide.providerSessions.v1';
+    let tempDir;
+    let dir;
+    setup(async () => {
+        tempDir = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'agentide-dirstore-'));
+        dir = path.join(tempDir, 'provider-sessions');
+    });
+    teardown(async () => {
+        try {
+            await fs_1.promises.rm(tempDir, { recursive: true, force: true });
+        }
+        catch {
+            // Ignore cleanup errors
+        }
+    });
+    const jsonFiles = async () => (await fs_1.promises.readdir(dir)).filter((f) => f.endsWith('.json'));
+    test('stores each entry in its own file and round-trips the merged map', async () => {
+        const store = new interfaces_1.DirectorySessionStore(dir);
+        await store.set(KEY, { a: { id: 1 }, b: { id: 2 } });
+        assert.strictEqual((await jsonFiles()).length, 2);
+        // A fresh instance loads the sharded files back into the merged map.
+        const store2 = new interfaces_1.DirectorySessionStore(dir);
+        assert.deepStrictEqual(store2.get(KEY), { a: { id: 1 }, b: { id: 2 } });
+    });
+    test('writes only changed entries and deletes removed ones', async () => {
+        const store = new interfaces_1.DirectorySessionStore(dir);
+        await store.set(KEY, { a: { id: 1 }, b: { id: 2 } });
+        // Drop b (as a prune would), keep a.
+        await store.set(KEY, { a: { id: 1 } });
+        assert.strictEqual((await jsonFiles()).length, 1);
+        const store2 = new interfaces_1.DirectorySessionStore(dir);
+        assert.deepStrictEqual(store2.get(KEY), { a: { id: 1 } });
+    });
+    test('migrates a legacy single-file store on first load', async () => {
+        // Legacy FileSessionStore layout: { <logicalKey>: { <entryKey>: value } }
+        await fs_1.promises.mkdir(tempDir, { recursive: true });
+        await fs_1.promises.writeFile(`${dir}.json`, JSON.stringify({ [KEY]: { old: { id: 9 } } }), 'utf-8');
+        const store = new interfaces_1.DirectorySessionStore(dir);
+        assert.deepStrictEqual(store.get(KEY), { old: { id: 9 } });
+        // A subsequent set persists the imported entries as shard files.
+        await store.set(KEY, { old: { id: 9 }, fresh: { id: 10 } });
+        assert.strictEqual((await jsonFiles()).length, 2);
+    });
+});
+// =============================================================================
+// Config Provider Tests
+// =============================================================================
+suite('Runtime Interfaces - ConfigProvider', () => {
+    test('StaticConfigProvider get returns configured values', () => {
+        const provider = new interfaces_1.StaticConfigProvider({
+            'agentide.claude.maxThinkingTokens': 2048,
+            'agentide.permissions.fileAccess': 'workspace-write',
+        });
+        assert.strictEqual(provider.get('agentide', 'claude.maxThinkingTokens'), 2048);
+        assert.strictEqual(provider.get('agentide', 'permissions.fileAccess'), 'workspace-write');
+    });
+    test('StaticConfigProvider get returns default for missing key', () => {
+        const provider = new interfaces_1.StaticConfigProvider({});
+        assert.strictEqual(provider.get('agentide', 'missing.key'), undefined);
+        assert.strictEqual(provider.get('agentide', 'missing.key', 'default'), 'default');
+    });
+    test('StaticConfigProvider getCustomProviders returns configured providers', () => {
+        const customProviders = {
+            'openrouter': {
+                baseUrl: 'https://openrouter.ai/api/v1',
+                overrideOpenAIBaseUrl: 'https://openrouter.ai/api/v1',
+            },
+        };
+        const provider = new interfaces_1.StaticConfigProvider({}, customProviders);
+        const result = provider.getCustomProviders();
+        assert.deepStrictEqual(result, customProviders);
+    });
+    test('StaticConfigProvider getEngineSettings returns configured settings', () => {
+        const engineSettings = {
+            claudeMaxThinkingTokens: 4096,
+            claudeCheapModel: 'claude-haiku-4-5-20251001',
+        };
+        const provider = new interfaces_1.StaticConfigProvider({}, {}, engineSettings);
+        const result = provider.getEngineSettings();
+        assert.deepStrictEqual(result, engineSettings);
+    });
+    test('StaticConfigProvider returns empty defaults', () => {
+        const provider = new interfaces_1.StaticConfigProvider();
+        assert.deepStrictEqual(provider.getCustomProviders(), {});
+        assert.deepStrictEqual(provider.getEngineSettings(), {});
+    });
+});
+// =============================================================================
+// Integration Tests
+// =============================================================================
+suite('Runtime Interfaces - Integration', () => {
+    test('MemorySessionStore can be used for eval mode (fresh state)', async () => {
+        const store = new interfaces_1.MemorySessionStore();
+        // Simulate session 1
+        await store.set('session-1', { threadId: 'abc123' });
+        // Clear for fresh state (eval mode)
+        store.clear();
+        // Session should be gone
+        assert.strictEqual(store.get('session-1'), undefined);
+    });
+    test('AutoApprovePermissionHandler is suitable for eval mode', async () => {
+        const handler = new interfaces_1.AutoApprovePermissionHandler();
+        // All permissions should be auto-approved
+        const dangerous = await handler.requestPermission({ toolName: 'Bash', toolInput: { command: 'rm -rf /' } });
+        assert.strictEqual(dangerous.behavior, 'allow');
+        const write = await handler.requestPermission({ toolName: 'Write', toolInput: { path: '/etc/passwd' } });
+        assert.strictEqual(write.behavior, 'allow');
+    });
+    test('StaticConfigProvider can override VS Code settings', () => {
+        // This simulates eval mode where we might want different settings
+        const evalConfig = new interfaces_1.StaticConfigProvider({
+            'agentide.permissions.fileAccess': 'full',
+        }, {}, {
+            claudeMaxThinkingTokens: 8192,
+            claudeCheapModel: 'claude-haiku-4-5-20251001',
+        });
+        assert.strictEqual(evalConfig.get('agentide', 'permissions.fileAccess'), 'full');
+        assert.strictEqual(evalConfig.getEngineSettings().claudeMaxThinkingTokens, 8192);
+        assert.strictEqual(evalConfig.getEngineSettings().claudeCheapModel, 'claude-haiku-4-5-20251001');
+    });
+});

package/out/test/scheduledFleetStorage.test.js

@@ -0,0 +1,72 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const assert = __importStar(require("assert"));
+const scheduledFleetStorage_1 = require("../analytics/dashboard/scheduledFleetStorage");
+suite('scheduledFleetStorage', () => {
+    test('parses vscode-chat-session local resource', () => {
+        const sessionId = (0, scheduledFleetStorage_1.parseSessionIdFromChatResource)('vscode-chat-session://local/MzY3MThiMzgtZjY1ZC00OWEyLTkzYjUtYTNmYWNhZDgyNmZm');
+        assert.strictEqual(sessionId, '36718b38-f65d-49a2-93b5-a3facad826ff');
+    });
+    test('buildChatSessionResourceFromSessionId round-trips with parse', () => {
+        const id = '36718b38-f65d-49a2-93b5-a3facad826ff';
+        const resource = (0, scheduledFleetStorage_1.buildChatSessionResourceFromSessionId)(id);
+        assert.strictEqual((0, scheduledFleetStorage_1.parseSessionIdFromChatResource)(resource), id);
+    });
+    test('merges enrichment hints preferring newest runAt per session', () => {
+        const merged = (0, scheduledFleetStorage_1.mergeScheduledSnapshots)([{
+                id: 'live-1',
+                sessionId: 'fb53245a-7ce9-4131-b240-cac895c32c38',
+                sessionResource: 'vscode-chat-session://local/x',
+                messageText: 'live',
+                runAt: 100,
+                model: 'agentide-litellm::litellm/claude-opus-4-7',
+            }], [{
+                id: 'db-1',
+                sessionId: 'fb53245a-7ce9-4131-b240-cac895c32c38',
+                sessionResource: 'vscode-chat-session://local/x',
+                messageText: 'fired one-shot',
+                runAt: 200,
+                model: 'agentide-cursor::auto',
+                engine: 'cursor',
+            }]);
+        assert.strictEqual(merged.length, 1);
+        assert.strictEqual(merged[0].model, 'agentide-cursor::auto');
+        assert.strictEqual(merged[0].engine, 'cursor');
+    });
+});

package/out/test/serve-hardening.test.js

@@ -0,0 +1,192 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Serve Hardening Test Suite
+ *
+ *  Pure-helper tests: state-dir resolution, identity headers, CORS, turn limiting, body cap.
+ *  Auth and credential checking are the deploy layer's responsibility — not tested here.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const stream_1 = require("stream");
+const serve_hardening_1 = require("../cli/serve-hardening");
+suite('serve-hardening: resolveStateDir', () => {
+    test('explicit --state-dir wins and is absolute and non-ephemeral', () => {
+        const r = (0, serve_hardening_1.resolveStateDir)('./state', {});
+        assert.strictEqual(r.ephemeral, false);
+        assert.ok(path.isAbsolute(r.dir));
+        assert.ok(r.dir.endsWith(`${path.sep}state`));
+    });
+    test('AGENTHIPPO_HOME is used when no --state-dir', () => {
+        const r = (0, serve_hardening_1.resolveStateDir)(undefined, { AGENTHIPPO_HOME: '/data/.agent-hippo' });
+        assert.strictEqual(r.ephemeral, false);
+        assert.strictEqual(r.dir, path.join('/data/.agent-hippo', 'serve-state'));
+    });
+    test('falls back to tmpdir and flags ephemeral', () => {
+        const r = (0, serve_hardening_1.resolveStateDir)(undefined, {});
+        assert.strictEqual(r.ephemeral, true);
+        assert.ok(r.dir.startsWith(os.tmpdir()));
+    });
+});
+suite('serve-hardening: resolveBindHost', () => {
+    test('defaults to loopback', () => {
+        assert.strictEqual((0, serve_hardening_1.resolveBindHost)(undefined, {}), serve_hardening_1.DEFAULT_BIND_HOST);
+        assert.strictEqual(serve_hardening_1.DEFAULT_BIND_HOST, '127.0.0.1');
+    });
+    test('explicit --host wins over env', () => {
+        assert.strictEqual((0, serve_hardening_1.resolveBindHost)('0.0.0.0', { AGENTHIPPO_SERVE_HOST: '10.0.0.1' }), '0.0.0.0');
+    });
+    test('AGENTHIPPO_SERVE_HOST used when no flag', () => {
+        assert.strictEqual((0, serve_hardening_1.resolveBindHost)(undefined, { AGENTHIPPO_SERVE_HOST: '0.0.0.0' }), '0.0.0.0');
+    });
+});
+suite('serve-hardening: clientIp', () => {
+    const reqWith = (headers, remote = '203.0.113.9') => ({ headers, socket: { remoteAddress: remote } });
+    test('falls back to socket address with no XFF', () => {
+        assert.strictEqual((0, serve_hardening_1.clientIp)(reqWith({})), '203.0.113.9');
+    });
+    test('uses the right-most XFF entry (the IP the trusted proxy observed)', () => {
+        assert.strictEqual((0, serve_hardening_1.clientIp)(reqWith({ 'x-forwarded-for': 'evil-spoof, 198.51.100.7' })), '198.51.100.7');
+    });
+});
+suite('serve-hardening: RateLimiter', () => {
+    test('allows up to the cap within a window then rejects', () => {
+        const lim = new serve_hardening_1.RateLimiter(2, 60_000);
+        const t0 = 1_000;
+        assert.strictEqual(lim.tryConsume('k', t0), true);
+        assert.strictEqual(lim.tryConsume('k', t0), true);
+        assert.strictEqual(lim.tryConsume('k', t0), false);
+    });
+    test('window resets after it elapses', () => {
+        const lim = new serve_hardening_1.RateLimiter(1, 1_000);
+        assert.strictEqual(lim.tryConsume('k', 0), true);
+        assert.strictEqual(lim.tryConsume('k', 500), false);
+        assert.strictEqual(lim.tryConsume('k', 1_001), true);
+    });
+    test('separate keys have separate budgets', () => {
+        const lim = new serve_hardening_1.RateLimiter(1);
+        assert.strictEqual(lim.tryConsume('a'), true);
+        assert.strictEqual(lim.tryConsume('b'), true);
+        assert.strictEqual(lim.tryConsume('a'), false);
+    });
+    test('zero / negative disables the limiter', () => {
+        const lim = new serve_hardening_1.RateLimiter(0);
+        for (let i = 0; i < 100; i++) {
+            assert.strictEqual(lim.tryConsume('k'), true);
+        }
+    });
+});
+suite('serve-hardening: resolveUserId', () => {
+    test('X-Agent-User header wins over body', () => {
+        const id = (0, serve_hardening_1.resolveUserId)({ 'x-agent-user': 'alice' }, { user_id: 'bob' });
+        assert.strictEqual(id, 'alice');
+    });
+    test('Databricks X-Forwarded-Email', () => {
+        assert.strictEqual((0, serve_hardening_1.resolveUserId)({ 'x-forwarded-email': 'priya@meridian.com' }, undefined), 'priya@meridian.com');
+    });
+    test('Cloud Run IAP prefixed value is stripped to the email', () => {
+        const id = (0, serve_hardening_1.resolveUserId)({ 'x-goog-authenticated-user-email': 'accounts.google.com:marco@meridian.com' }, undefined);
+        assert.strictEqual(id, 'marco@meridian.com');
+    });
+    test('Cloudflare Access header', () => {
+        assert.strictEqual((0, serve_hardening_1.resolveUserId)({ 'cf-access-authenticated-user-email': 'susan@meridian.com' }, undefined), 'susan@meridian.com');
+    });
+    test('falls back to body.user_id when no header', () => {
+        assert.strictEqual((0, serve_hardening_1.resolveUserId)({}, { user_id: 'bob' }), 'bob');
+    });
+    test('undefined when nothing present', () => {
+        assert.strictEqual((0, serve_hardening_1.resolveUserId)({}, undefined), undefined);
+        assert.strictEqual((0, serve_hardening_1.resolveUserId)({}, { user_id: '   ' }), undefined);
+    });
+});
+suite('serve-hardening: corsHeaders', () => {
+    test('always wide-open (serve is always behind a proxy)', () => {
+        const h = (0, serve_hardening_1.corsHeaders)();
+        assert.strictEqual(h['Access-Control-Allow-Origin'], '*');
+        assert.ok(h['Access-Control-Allow-Methods']);
+        assert.ok(h['Access-Control-Allow-Headers']);
+    });
+});
+suite('serve-hardening: TurnLimiter', () => {
+    test('allows up to the cap then rejects', () => {
+        const lim = new serve_hardening_1.TurnLimiter(2);
+        assert.strictEqual(lim.tryConsume('s1'), true);
+        assert.strictEqual(lim.tryConsume('s1'), true);
+        assert.strictEqual(lim.tryConsume('s1'), false);
+    });
+    test('separate sessions have separate budgets', () => {
+        const lim = new serve_hardening_1.TurnLimiter(1);
+        assert.strictEqual(lim.tryConsume('s1'), true);
+        assert.strictEqual(lim.tryConsume('s2'), true);
+        assert.strictEqual(lim.tryConsume('s1'), false);
+    });
+    test('zero / negative cap disables the limiter', () => {
+        const lim = new serve_hardening_1.TurnLimiter(0);
+        for (let i = 0; i < 100; i++) {
+            assert.strictEqual(lim.tryConsume('s'), true);
+        }
+    });
+    test('reset clears a session', () => {
+        const lim = new serve_hardening_1.TurnLimiter(1);
+        assert.strictEqual(lim.tryConsume('s1'), true);
+        assert.strictEqual(lim.tryConsume('s1'), false);
+        lim.reset('s1');
+        assert.strictEqual(lim.tryConsume('s1'), true);
+    });
+});
+function fakeReq(body) {
+    const stream = new stream_1.PassThrough();
+    stream.end(Buffer.from(body, 'utf8'));
+    return stream;
+}
+suite('serve-hardening: readBodyWithCap', () => {
+    test('reads a small body', async () => {
+        const text = await (0, serve_hardening_1.readBodyWithCap)(fakeReq('{"message":"hi"}'), 1024);
+        assert.strictEqual(text, '{"message":"hi"}');
+    });
+    test('rejects an oversized body with tooLarge flag', async () => {
+        const big = 'x'.repeat(50);
+        await assert.rejects(() => (0, serve_hardening_1.readBodyWithCap)(fakeReq(big), 10), (err) => {
+            assert.strictEqual(err.tooLarge, true);
+            return true;
+        });
+    });
+    test('default cap is 1 MiB', () => {
+        assert.strictEqual(serve_hardening_1.DEFAULT_MAX_BODY_BYTES, 1024 * 1024);
+    });
+});