@agenthippo-ai/agenthippo 0.1.1 → 0.2.3-dataplane

package/out/test/credential-context.test.js

@@ -41,9 +41,6 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 require("mocha");
 const assert = __importStar(require("assert"));
-const fs = __importStar(require("fs"));
-const os = __importStar(require("os"));
-const path = __importStar(require("path"));
 const credential_context_1 = require("../cli/credential-context");
 const serve_hardening_1 = require("../cli/serve-hardening");
 suite('credential-context: presence + fail-closed', () => {
@@ -92,16 +89,6 @@ suite('credential-context: unresolved identity (userId is optional, never a plac
         }), /OBO data token present without a verified user/);
         assert.strictEqual(ran, false, 'fn must never run when the credential fails closed');
     });
-    test('a data token without userId fails closed even when dataTokenDir would write a file', async () => {
-        const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ah-cred-'));
-        try {
-            await assert.rejects(() => (0, credential_context_1.runWithCredential)({ userId: undefined, dataToken: 'obo-secret' }, async () => 'ran', { dataTokenDir: dir }), /fail-closed/);
-            assert.deepStrictEqual(fs.readdirSync(dir), [], 'no token file must be written when fail-closed');
-        }
-        finally {
-            fs.rmSync(dir, { recursive: true, force: true });
-        }
-    });
     test('onDenied fires with the stable reason code exactly when the credential fails closed', async () => {
         const denials = [];
         await assert.rejects(() => (0, credential_context_1.runWithCredential)({ userId: undefined, dataToken: 'obo-secret' }, async () => 'ran', { onDenied: (reason) => { denials.push(reason); } }));
@@ -117,21 +104,29 @@ suite('credential-context: unresolved identity (userId is optional, never a plac
     test('a throwing onDenied callback is swallowed — the fail-closed rejection still wins', async () => {
         await assert.rejects(() => (0, credential_context_1.runWithCredential)({ userId: undefined, dataToken: 'obo-secret' }, async () => 'ran', { onDenied: () => { throw new Error('logging backend is down'); } }), /fail-closed/);
     });
-    test('a verified userId with a data token still writes the per-turn token file normally', async () => {
-        const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ah-cred-'));
-        try {
-            let fileDuringRun;
-            await (0, credential_context_1.runWithCredential)({ userId: 'priya@meridian.com', dataToken: 'obo-secret' }, async () => {
-                fileDuringRun = (0, credential_context_1.currentCredential)()?.dataTokenFile;
-                assert.ok(fileDuringRun, 'dataTokenFile must be set inside the scope');
-                assert.strictEqual(fs.readFileSync(fileDuringRun, 'utf8'), 'obo-secret');
-            }, { dataTokenDir: dir });
-            assert.ok(fileDuringRun);
-            assert.strictEqual(fs.existsSync(fileDuringRun), false, 'token file must be cleaned up after the turn');
-        }
-        finally {
-            fs.rmSync(dir, { recursive: true, force: true });
-        }
+    test('a hung onDenied callback cannot stall fail-closed forever', async () => {
+        const started = Date.now();
+        let resolved = false;
+        await assert.rejects(() => (0, credential_context_1.runWithCredential)({ userId: undefined, dataToken: 'obo-secret' }, async () => 'ran', {
+            onDeniedTimeoutMs: 50,
+            onDenied: () => new Promise(() => {
+                /* never settles */
+            }),
+        }), /fail-closed/);
+        resolved = true;
+        const elapsed = Date.now() - started;
+        assert.ok(resolved);
+        assert.ok(elapsed < 500, `fail-closed should win after onDenied timeout (elapsed=${elapsed}ms)`);
+    });
+    test('the credential never touches disk — it exists only in the async scope (secure-obo-design §2)', async () => {
+        await (0, credential_context_1.runWithCredential)({ userId: 'priya@meridian.com', dataToken: 'obo-secret' }, async () => {
+            const cred = (0, credential_context_1.currentCredential)();
+            assert.strictEqual(cred?.dataToken, 'obo-secret');
+            // The RequestCredential shape has no file-based transport anymore: the token
+            // reaches tools only via the loopback data-plane gateway + turn nonce.
+            assert.ok(!('dataTokenFile' in cred), 'no dataTokenFile surface may exist');
+        });
+        assert.strictEqual((0, credential_context_1.currentCredential)(), undefined);
     });
 });
 suite('credential-context: concurrent isolation (the load-bearing property)', () => {

package/out/test/custom-env-layering.test.js

@@ -0,0 +1,151 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Custom-engine env layering tests.
+ *
+ *  Pins the deliberate precedence contract that replaced two accidents:
+ *   1. buildRunnerChildEnv: PER-TURN values win over the host's ambient env (the old
+ *      `{...turn.env, ...process.env}` order silently reverted per-turn state — including,
+ *      latently, manifest-delivered credentials and any same-named ambient var).
+ *   2. deliverModelRoutingEnv: manifest `model.*EnvVar` delivery is NON-CLOBBERING — a var the
+ *      operator already set in the host env is never overwritten. This is what keeps a STALE
+ *      cursor manifest (one that still declares apiKeyEnvVar: CURSOR_API_KEY) from stomping the
+ *      operator's real crsr_ key now that per-turn values win (the version-pairing case).
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const custom_1 = require("../engines/custom");
+function fakeManifest(model) {
+    return {
+        id: 'fake-engine',
+        entryPath: '/tmp/fake/engine.mjs',
+        manifestDir: '/tmp/fake',
+        model: model ? { defaultModel: 'auto', ...model } : undefined,
+    };
+}
+function fakeTurn(env) {
+    return {
+        message: 'hi',
+        modelId: 'auto',
+        workspaceRoot: '/tmp/ws',
+        env,
+        session: { key: 'k', chatSessionId: 'c', isEphemeral: false },
+    };
+}
+/** Run fn with process.env temporarily patched; always restores. */
+function withProcessEnv(patch, fn) {
+    const saved = new Map();
+    for (const [k, v] of Object.entries(patch)) {
+        saved.set(k, process.env[k]);
+        if (v === undefined) {
+            delete process.env[k];
+        }
+        else {
+            process.env[k] = v;
+        }
+    }
+    try {
+        fn();
+    }
+    finally {
+        for (const [k, v] of saved) {
+            if (v === undefined) {
+                delete process.env[k];
+            }
+            else {
+                process.env[k] = v;
+            }
+        }
+    }
+}
+suite('buildRunnerChildEnv: per-turn values win over the host ambient env', () => {
+    test('a per-turn var beats the same-named ambient var (nonce/session-path class)', () => {
+        withProcessEnv({ TEST_LAYERING_VAR: 'ambient-stale' }, () => {
+            const child = (0, custom_1.buildRunnerChildEnv)(fakeManifest(), fakeTurn({ TEST_LAYERING_VAR: 'per-turn-fresh' }), false);
+            assert.strictEqual(child.TEST_LAYERING_VAR, 'per-turn-fresh');
+        });
+    });
+    test('ambient vars absent from turn.env still flow through (plain inheritance)', () => {
+        withProcessEnv({ TEST_AMBIENT_ONLY: 'inherited' }, () => {
+            const child = (0, custom_1.buildRunnerChildEnv)(fakeManifest(), fakeTurn({}), false);
+            assert.strictEqual(child.TEST_AMBIENT_ONLY, 'inherited');
+        });
+    });
+    test('AGENTHIPPO control vars come from the turn, never ambient', () => {
+        withProcessEnv({ AGENTHIPPO_MODEL_ID: 'ambient-wrong' }, () => {
+            const child = (0, custom_1.buildRunnerChildEnv)(fakeManifest(), fakeTurn({}), false);
+            assert.strictEqual(child.AGENTHIPPO_MODEL_ID, 'auto', 'explicit per-turn block must win');
+        });
+    });
+});
+suite('deliverModelRoutingEnv: non-clobbering manifest credential delivery', () => {
+    test('delivers the routing key when the declared var is NOT in the ambient env (openclaw case)', () => {
+        const env = {};
+        (0, custom_1.deliverModelRoutingEnv)(env, fakeManifest({ apiKeyEnvVar: 'LITELLM_API_KEY' }), { apiKey: 'sk-proxy-key' }, {});
+        assert.strictEqual(env.LITELLM_API_KEY, 'sk-proxy-key');
+    });
+    test('SKIPS delivery when the operator already set the var — ambient wins (stale-cursor-manifest case)', () => {
+        // Version-pairing regression: old manifest still declares apiKeyEnvVar: CURSOR_API_KEY,
+        // operator has the real crsr_ key ambient. With per-turn-wins layering, only this
+        // non-clobber rule keeps the real key from being stomped by a model key.
+        const env = { CURSOR_API_KEY: 'crsr_real_operator_key' };
+        (0, custom_1.deliverModelRoutingEnv)(env, fakeManifest({ apiKeyEnvVar: 'CURSOR_API_KEY' }), { apiKey: 'sk-model-routing-key' }, { CURSOR_API_KEY: 'crsr_real_operator_key' });
+        assert.strictEqual(env.CURSOR_API_KEY, 'crsr_real_operator_key', 'operator credential must never be overwritten');
+    });
+    test('stale-manifest end to end: child env keeps the operator key after the spread flip', () => {
+        withProcessEnv({ CURSOR_API_KEY: 'crsr_real_operator_key' }, () => {
+            // Simulate the turn-env build with an OLD manifest: ambient spread + (non-clobbered) delivery.
+            const turnEnv = { ...process.env };
+            (0, custom_1.deliverModelRoutingEnv)(turnEnv, fakeManifest({ apiKeyEnvVar: 'CURSOR_API_KEY' }), { apiKey: 'sk-model-key' }, process.env);
+            const child = (0, custom_1.buildRunnerChildEnv)(fakeManifest({ apiKeyEnvVar: 'CURSOR_API_KEY' }), fakeTurn(turnEnv), false);
+            assert.strictEqual(child.CURSOR_API_KEY, 'crsr_real_operator_key');
+        });
+    });
+    test('base URL vars follow the same rule (deliver when absent, keep ambient when present)', () => {
+        const env = {};
+        (0, custom_1.deliverModelRoutingEnv)(env, fakeManifest({ baseUrlEnvVar: 'ENGINE_BASE_URL' }), { baseUrl: 'http://proxy:4000' }, {});
+        assert.strictEqual(env.ENGINE_BASE_URL, 'http://proxy:4000');
+        const env2 = { ENGINE_BASE_URL: 'http://operator-choice' };
+        (0, custom_1.deliverModelRoutingEnv)(env2, fakeManifest({ baseUrlEnvVar: 'ENGINE_BASE_URL' }), { baseUrl: 'http://proxy:4000' }, { ENGINE_BASE_URL: 'http://operator-choice' });
+        assert.strictEqual(env2.ENGINE_BASE_URL, 'http://operator-choice');
+    });
+    test('no declaration → no delivery, whatever the routing key is (the fixed cursor manifest)', () => {
+        const env = { CURSOR_API_KEY: 'crsr_real_operator_key' };
+        (0, custom_1.deliverModelRoutingEnv)(env, fakeManifest(), { apiKey: 'sk-model-key' }, {});
+        assert.strictEqual(env.CURSOR_API_KEY, 'crsr_real_operator_key');
+        assert.strictEqual(Object.keys(env).length, 1, 'nothing else may be written');
+    });
+});

package/out/test/data-plane-engine-wiring.test.js

@@ -0,0 +1,250 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Data-plane engine wiring tests (secure-obo-design §3.2, §6) — NO API KEY NEEDED.
+ *
+ *  These exercise the *real* engine config paths (not just the pure helpers): given a pack
+ *  that declares the loopback gateway MCP entry + skills, does each engine actually
+ *    (a) put the turn-invariant gateway entry into its config, with the nonce sourced from
+ *        the PROCESS env (never a per-turn value written to the file), and
+ *    (b) sync the pack's skills into the engine's home so the agent can see them,
+ *  and does the per-user CODEX_HOME derivation keep concurrent users' state apart while
+ *  keeping the written config byte-identical (the property that kills defect 1)?
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const codex_1 = require("../engines/codex");
+const mcp_1 = require("../mcp");
+const paths_1 = require("../agentpack/paths");
+const credential_context_1 = require("../cli/credential-context");
+const GATEWAY_MCP_JSON = JSON.stringify({
+    mcpServers: {
+        data: {
+            url: '${env:AGENTHIPPO_DATA_MCP_URL}',
+            bearerTokenEnv: 'AGENTHIPPO_TURN_NONCE',
+        },
+    },
+});
+function silentLogger() {
+    const lines = [];
+    const push = (m) => { lines.push(m); };
+    return { lines, info: push, warn: push, error: push, debug: push };
+}
+/** Build a pack on disk with the gateway MCP entry + N skills, return workspace + agentId. */
+function makePack(skillNames) {
+    const workspace = fs.mkdtempSync(path.join(os.tmpdir(), 'ah-wire-'));
+    const agentId = 'wire-agent';
+    const mcpDir = (0, paths_1.getAgentMcpDir)(workspace, agentId);
+    fs.mkdirSync(mcpDir, { recursive: true });
+    fs.writeFileSync(path.join(mcpDir, '.mcp.json'), GATEWAY_MCP_JSON, 'utf8');
+    const agentRoot = path.dirname(mcpDir);
+    fs.writeFileSync(path.join(agentRoot, 'AGENTS.md'), '# Wire Agent\n\nAnswer questions.\n', 'utf8');
+    const skillsDir = (0, paths_1.getAgentSkillsDir)(workspace, agentId);
+    for (const name of skillNames) {
+        const dir = path.join(skillsDir, name);
+        fs.mkdirSync(dir, { recursive: true });
+        fs.writeFileSync(path.join(dir, 'SKILL.md'), `---\nname: ${name}\ndescription: test skill ${name}\n---\n\nDo ${name} things.\n`, 'utf8');
+        // a bundled resource, to prove the whole skill dir is copied, not just SKILL.md
+        fs.mkdirSync(path.join(dir, 'scripts'), { recursive: true });
+        fs.writeFileSync(path.join(dir, 'scripts', 'run.sh'), `echo ${name}\n`, 'utf8');
+    }
+    return { workspace, agentId };
+}
+async function writeCodexConfig(workspace, agentId, codexHome) {
+    const logger = silentLogger();
+    // getSkillsSignature must return undefined so the sync is not skipped by the signature cache.
+    const engine = new codex_1.CodexEngine({ storagePath: workspace, codexHome: undefined, claudeConfigDir: undefined, litellmApiKey: 'k', litellmBaseUrl: 'http://litellm.local' }, () => undefined, () => undefined);
+    await engine.ensureCodexConfig(true, // useLiteLLM
+    'http://litellm.local', // customBaseUrl
+    'gpt-5.5', // modelId
+    workspace, // workspaceRoot
+    [], // additionalDirectories
+    logger, // logger
+    codexHome, // explicit codexHome
+    agentId, // agentId
+    true);
+    return fs.readFileSync(path.join(codexHome, 'config.toml'), 'utf8');
+}
+/** The `[mcp_servers.data]` block only — the part that must be turn- AND user-invariant. */
+function mcpDataBlock(toml) {
+    const start = toml.indexOf('[mcp_servers.data]');
+    assert.ok(start >= 0, `config.toml missing [mcp_servers.data]:\n${toml}`);
+    const rest = toml.slice(start + '[mcp_servers.data]'.length);
+    const next = rest.search(/\n\[/);
+    return (next >= 0 ? rest.slice(0, next) : rest).trim();
+}
+suite('data-plane engine wiring: codex config + skills sync (no API key)', function () {
+    this.timeout(30_000);
+    test('config.toml carries the turn-invariant gateway entry; no per-turn value in the file', async () => {
+        const { workspace, agentId } = makePack(['alpha', 'beta']);
+        try {
+            process.env.AGENTHIPPO_DATA_MCP_URL = 'http://127.0.0.1:45999/mcp';
+            const codexHome = path.join(workspace, 'home');
+            fs.mkdirSync(codexHome, { recursive: true });
+            const toml = await writeCodexConfig(workspace, agentId, codexHome);
+            const block = mcpDataBlock(toml);
+            assert.ok(block.includes('url = "http://127.0.0.1:45999/mcp"'), 'gateway URL must resolve from process env');
+            assert.ok(block.includes('bearer_token_env_var = "AGENTHIPPO_TURN_NONCE"'), 'nonce must be read from the codex process env, not the file');
+            // The MCP entry must NOT contain any resolved nonce/header — that is what makes it turn-invariant.
+            // (The unrelated LiteLLM analytics block legitimately has an env_http_headers line of env-var NAMES.)
+            assert.ok(!/http_headers/.test(block), `no resolved auth header may be written into the MCP entry:\n${block}`);
+            assert.ok(!/Authorization/i.test(block), block);
+        }
+        finally {
+            delete process.env.AGENTHIPPO_DATA_MCP_URL;
+            fs.rmSync(workspace, { recursive: true, force: true });
+        }
+    });
+    test('the agent sees its skills: each SKILL.md (and its resources) is synced into $CODEX_HOME/skills', async () => {
+        const { workspace, agentId } = makePack(['alpha', 'beta']);
+        try {
+            process.env.AGENTHIPPO_DATA_MCP_URL = 'http://127.0.0.1:45999/mcp';
+            const codexHome = path.join(workspace, 'home');
+            fs.mkdirSync(codexHome, { recursive: true });
+            await writeCodexConfig(workspace, agentId, codexHome);
+            for (const name of ['alpha', 'beta']) {
+                const skillMd = path.join(codexHome, 'skills', name, 'SKILL.md');
+                assert.ok(fs.existsSync(skillMd), `skill ${name} must be visible in $CODEX_HOME/skills: ${skillMd}`);
+                assert.ok(fs.readFileSync(skillMd, 'utf8').includes(`description: test skill ${name}`));
+                // bundled resources come along, not just the SKILL.md
+                assert.ok(fs.existsSync(path.join(codexHome, 'skills', name, 'scripts', 'run.sh')), 'skill resource files must be copied too');
+            }
+        }
+        finally {
+            delete process.env.AGENTHIPPO_DATA_MCP_URL;
+            fs.rmSync(workspace, { recursive: true, force: true });
+        }
+    });
+    test('per-user CODEX_HOME: isolated homes+skills; the gateway entry is identical across users (only per-user paths differ)', async () => {
+        const { workspace, agentId } = makePack(['alpha']);
+        try {
+            process.env.AGENTHIPPO_DATA_MCP_URL = 'http://127.0.0.1:45999/mcp';
+            const base = path.join(workspace, 'home');
+            const aliceHome = (0, paths_1.userScopedEngineHome)(base, 'alice@corp.com');
+            const bobHome = (0, paths_1.userScopedEngineHome)(base, 'bob@corp.com');
+            assert.notStrictEqual(aliceHome, bobHome, 'distinct users must get distinct homes');
+            assert.ok(!aliceHome.includes('alice@corp.com'), 'user id must be hashed, never a raw path segment');
+            fs.mkdirSync(aliceHome, { recursive: true });
+            fs.mkdirSync(bobHome, { recursive: true });
+            const aliceToml = await (0, credential_context_1.runWithCredential)({ userId: 'alice@corp.com' }, () => writeCodexConfig(workspace, agentId, aliceHome));
+            const bobToml = await (0, credential_context_1.runWithCredential)({ userId: 'bob@corp.com' }, () => writeCodexConfig(workspace, agentId, bobHome));
+            // The MCP gateway entry carries NO per-user/per-turn value → identical across users.
+            // (The instructions-file path legitimately differs because it lives inside each user's
+            // own home — a per-user path, not a shared file, so it is not a cross-user race.)
+            assert.strictEqual(mcpDataBlock(aliceToml), mcpDataBlock(bobToml), 'the gateway MCP entry must be user-invariant');
+            assert.ok(fs.existsSync(path.join(aliceHome, 'skills', 'alpha', 'SKILL.md')));
+            assert.ok(fs.existsSync(path.join(bobHome, 'skills', 'alpha', 'SKILL.md')));
+            assert.ok(aliceHome.startsWith(path.join(base, 'users')) && bobHome.startsWith(path.join(base, 'users')));
+        }
+        finally {
+            delete process.env.AGENTHIPPO_DATA_MCP_URL;
+            fs.rmSync(workspace, { recursive: true, force: true });
+        }
+    });
+    test('defect-1 fix: two concurrent turns of the SAME user (same home) write byte-identical config.toml', async () => {
+        const { workspace, agentId } = makePack(['alpha']);
+        try {
+            process.env.AGENTHIPPO_DATA_MCP_URL = 'http://127.0.0.1:45999/mcp';
+            const base = path.join(workspace, 'home');
+            const home = (0, paths_1.userScopedEngineHome)(base, 'alice@corp.com');
+            fs.mkdirSync(home, { recursive: true });
+            // Two turns, same user, same home — historically the racing writers of defect 1.
+            const first = await (0, credential_context_1.runWithCredential)({ userId: 'alice@corp.com', dataToken: 'obo-turn-1' }, () => writeCodexConfig(workspace, agentId, home));
+            const second = await (0, credential_context_1.runWithCredential)({ userId: 'alice@corp.com', dataToken: 'obo-turn-2' }, () => writeCodexConfig(workspace, agentId, home));
+            assert.strictEqual(first, second, 'same-home concurrent turns must write identical bytes — the race is gone by construction');
+        }
+        finally {
+            delete process.env.AGENTHIPPO_DATA_MCP_URL;
+            fs.rmSync(workspace, { recursive: true, force: true });
+        }
+    });
+    test('no verified user (IDE path) → home is the un-derived base, unchanged', () => {
+        const base = '/tmp/some/codex/home';
+        assert.strictEqual((0, paths_1.userScopedEngineHome)(base, undefined), base);
+        assert.strictEqual((0, paths_1.userScopedEngineHome)(base, '   '), base);
+    });
+});
+suite('data-plane engine wiring: loadMcpServers + claude/custom shape (no API key)', function () {
+    this.timeout(30_000);
+    test('loadMcpServers reads a gateway .mcp.json into a url entry with bearerTokenEnv (URL resolved from env)', async () => {
+        const { workspace, agentId } = makePack([]);
+        try {
+            process.env.AGENTHIPPO_DATA_MCP_URL = 'http://127.0.0.1:47000/mcp';
+            const servers = await (0, mcp_1.loadMcpServers)(agentId, workspace);
+            assert.strictEqual(servers.length, 1);
+            assert.strictEqual(servers[0].name, 'data');
+            assert.strictEqual(servers[0].url, 'http://127.0.0.1:47000/mcp');
+            assert.strictEqual(servers[0].bearerTokenEnv, 'AGENTHIPPO_TURN_NONCE');
+            assert.strictEqual(servers[0].headers, undefined, 'no static header — the nonce is resolved per turn against the engine env');
+        }
+        finally {
+            delete process.env.AGENTHIPPO_DATA_MCP_URL;
+            fs.rmSync(workspace, { recursive: true, force: true });
+        }
+    });
+    test('a gateway entry whose URL placeholder does not resolve is dropped (never a broken empty-url entry)', async () => {
+        const { workspace, agentId } = makePack([]);
+        try {
+            delete process.env.AGENTHIPPO_DATA_MCP_URL; // e.g. loaded outside serve
+            const servers = await (0, mcp_1.loadMcpServers)(agentId, workspace);
+            assert.strictEqual(servers.length, 0, 'unresolved gateway URL → drop the server rather than hand engines an empty URL');
+        }
+        finally {
+            fs.rmSync(workspace, { recursive: true, force: true });
+        }
+    });
+    test('custom-engine transport: serialize→parse round-trips the http entry with the per-turn nonce header', async () => {
+        const { workspace, agentId } = makePack([]);
+        try {
+            process.env.AGENTHIPPO_DATA_MCP_URL = 'http://127.0.0.1:47000/mcp';
+            const servers = await (0, mcp_1.loadMcpServers)(agentId, workspace);
+            // This is exactly what custom.ts does: resolve against the per-turn child env, then
+            // serialize into AGENTHIPPO_MCP_SERVERS for the runner to parse back.
+            const inline = (0, mcp_1.formatInlineMcpServers)(servers, { AGENTHIPPO_TURN_NONCE: 'nonce-xyz' });
+            const roundTripped = (0, mcp_1.parseInlineMcpServers)((0, mcp_1.serializeInlineMcpServers)(inline));
+            assert.deepStrictEqual(roundTripped, {
+                data: { type: 'http', url: 'http://127.0.0.1:47000/mcp', headers: { Authorization: 'Bearer nonce-xyz' } },
+            });
+        }
+        finally {
+            delete process.env.AGENTHIPPO_DATA_MCP_URL;
+            fs.rmSync(workspace, { recursive: true, force: true });
+        }
+    });
+});