@agenthippo-ai/agenthippo 0.1.1 → 0.2.3-dataplane

package/out/test/data-plane.test.js

@@ -0,0 +1,244 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Data-plane gateway integration tests (secure-obo-design §3, §5, §9)
+ *
+ *  Boots the real thing end to end: TurnRegistry + CredentialBroker + a real connector
+ *  subprocess (stdio MCP over a private pipe) + the loopback streamable-HTTP gateway —
+ *  then drives it with the MCP SDK client exactly like an engine would.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const index_js_1 = require("@modelcontextprotocol/sdk/client/index.js");
+const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/client/streamableHttp.js");
+const data_plane_1 = require("../cli/data-plane");
+// The fixture connector must live INSIDE the extension tree so its `import` of
+// @modelcontextprotocol/sdk resolves by walking up to extensions/agentide/node_modules.
+const FIXTURE_DIR = path.join(__dirname, 'data-plane-fixture');
+const CONNECTOR_PATH = path.join(FIXTURE_DIR, 'connector.mjs');
+const CONNECTOR_SOURCE = `
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+
+const server = new Server({ name: 'test-connector', version: '0.0.1' }, { capabilities: { tools: {} } });
+server.setRequestHandler(ListToolsRequestSchema, async () => ({
+	tools: [{
+		name: 'whoami',
+		description: 'echo the broker-supplied turn context',
+		inputSchema: { type: 'object', properties: { probe: { type: 'string' } } },
+	}],
+}));
+server.setRequestHandler(CallToolRequestSchema, async (req) => {
+	const turn = (req.params._meta ?? {})['ai.agenthippo/turn'] ?? null;
+	const probe = (req.params.arguments ?? {}).probe ?? '';
+	return {
+		content: [{ type: 'text', text: JSON.stringify({
+			userId: turn ? turn.userId : null,
+			credential: turn ? turn.credential : null,
+			envContainsProbe: probe ? JSON.stringify(process.env).includes(probe) : false,
+		}) }],
+	};
+});
+await server.connect(new StdioServerTransport());
+`;
+function mcpClient(url, nonce) {
+    const transport = new streamableHttp_js_1.StreamableHTTPClientTransport(new URL(url), {
+        requestInit: { headers: { Authorization: `Bearer ${nonce}` } },
+    });
+    const client = new index_js_1.Client({ name: 'test-engine', version: '0.0.1' });
+    return { client, transport };
+}
+async function callWhoami(url, nonce, probe) {
+    const { client, transport } = mcpClient(url, nonce);
+    try {
+        await client.connect(transport);
+        const res = await client.callTool({ name: 'whoami', arguments: probe ? { probe } : {} });
+        const content = res.content[0];
+        return JSON.parse(content.text);
+    }
+    finally {
+        await client.close().catch(() => undefined);
+    }
+}
+suite('data-plane: gateway + registry + broker end to end', function () {
+    this.timeout(30_000);
+    let plane;
+    suiteSetup(async () => {
+        fs.mkdirSync(FIXTURE_DIR, { recursive: true });
+        fs.writeFileSync(CONNECTOR_PATH, CONNECTOR_SOURCE, 'utf8');
+        plane = await data_plane_1.DataPlane.start({ connectorPath: CONNECTOR_PATH, provider: 'passthrough' });
+    });
+    suiteTeardown(async () => {
+        await plane?.close();
+        fs.rmSync(FIXTURE_DIR, { recursive: true, force: true });
+    });
+    test('gateway binds loopback only', () => {
+        assert.ok(plane.url.startsWith('http://127.0.0.1:'), plane.url);
+    });
+    test('a live nonce lists and calls tools as the registered user, credential selected server-side', async () => {
+        const turn = plane.registerTurn({ userId: 'alice@corp.com', sessionKey: 's1', inboundToken: 'alice-obo-token' });
+        try {
+            const { client, transport } = mcpClient(plane.url, turn.nonce);
+            await client.connect(transport);
+            const tools = await client.listTools();
+            assert.deepStrictEqual(tools.tools.map((t) => t.name), ['whoami']);
+            await client.close();
+            const who = await callWhoami(plane.url, turn.nonce);
+            assert.strictEqual(who.userId, 'alice@corp.com');
+            assert.strictEqual(who.credential, 'alice-obo-token', 'the broker must hand the connector the turn user\'s credential');
+        }
+        finally {
+            turn.release();
+        }
+    });
+    test('the credential never enters the connector process env — it rides only the per-call pipe', async () => {
+        const turn = plane.registerTurn({ userId: 'alice@corp.com', sessionKey: 's1', inboundToken: 'alice-obo-token' });
+        try {
+            const who = await callWhoami(plane.url, turn.nonce, 'alice-obo-token');
+            assert.strictEqual(who.envContainsProbe, false, 'raw credential must not appear anywhere in the connector env');
+        }
+        finally {
+            turn.release();
+        }
+    });
+    test('two concurrent turns each resolve their OWN user + credential (the §9.1 concurrency property)', async () => {
+        const alice = plane.registerTurn({ userId: 'alice@corp.com', sessionKey: 'sa', inboundToken: 'tok-alice' });
+        const bob = plane.registerTurn({ userId: 'bob@corp.com', sessionKey: 'sb', inboundToken: 'tok-bob' });
+        try {
+            const [a, b] = await Promise.all([
+                callWhoami(plane.url, alice.nonce),
+                callWhoami(plane.url, bob.nonce),
+            ]);
+            assert.strictEqual(a.userId, 'alice@corp.com');
+            assert.strictEqual(a.credential, 'tok-alice');
+            assert.strictEqual(b.userId, 'bob@corp.com');
+            assert.strictEqual(b.credential, 'tok-bob');
+        }
+        finally {
+            alice.release();
+            bob.release();
+        }
+    });
+    test('missing / unknown nonce → 401, fail closed', async () => {
+        await assert.rejects(() => callWhoami(plane.url, 'not-a-real-nonce'), /401|Unauthorized/i);
+    });
+    test('a released (turn-ended) nonce → 401 — a stale engine fails closed (§3.2)', async () => {
+        const turn = plane.registerTurn({ userId: 'alice@corp.com', sessionKey: 's1', inboundToken: 't' });
+        const nonce = turn.nonce;
+        const who = await callWhoami(plane.url, nonce);
+        assert.strictEqual(who.userId, 'alice@corp.com');
+        turn.release();
+        await assert.rejects(() => callWhoami(plane.url, nonce), /401|Unauthorized/i);
+    });
+    test('an expired deadline → 401 even if release() was never called (stranded-nonce backstop)', async () => {
+        const { nonce } = plane.registry.register({
+            userId: 'alice@corp.com',
+            sessionKey: 's1',
+            inboundToken: 't',
+            deadline: Date.now() - 1,
+        });
+        await assert.rejects(() => callWhoami(plane.url, nonce), /401|Unauthorized/i);
+    });
+    test('passthrough provider with no inbound token → the TOOL CALL errors, fail closed, turn itself unaffected', async () => {
+        const turn = plane.registerTurn({ userId: 'peer:telegram:123', sessionKey: 's2' });
+        try {
+            const { client, transport } = mcpClient(plane.url, turn.nonce);
+            await client.connect(transport);
+            const res = await client.callTool({ name: 'whoami', arguments: {} });
+            assert.strictEqual(res.isError, true, 'no inbound credential must fail the call closed');
+            const text = res.content[0].text;
+            assert.match(text, /fail-closed/);
+            await client.close();
+        }
+        finally {
+            turn.release();
+        }
+    });
+    test('a token-less turn fails closed even RIGHT AFTER the same user ran a turn WITH a token (no cache bridging)', async () => {
+        // Passthrough gets the platform token on every legitimate request; a broker cache
+        // that outlives the turn would let broken forwarding silently reuse the previous
+        // token for the cache TTL — the exact silent-fallback failure the provider forbids.
+        const withToken = plane.registerTurn({ userId: 'u@corp.com', sessionKey: 's3', inboundToken: 'tok-1' });
+        try {
+            const ok = await callWhoami(plane.url, withToken.nonce);
+            assert.strictEqual(ok.credential, 'tok-1');
+        }
+        finally {
+            withToken.release();
+        }
+        const withoutToken = plane.registerTurn({ userId: 'u@corp.com', sessionKey: 's3' });
+        try {
+            const { client, transport } = mcpClient(plane.url, withoutToken.nonce);
+            await client.connect(transport);
+            const res = await client.callTool({ name: 'whoami', arguments: {} });
+            assert.strictEqual(res.isError, true, 'the cached tok-1 must not serve a token-less turn');
+            await client.close();
+        }
+        finally {
+            withoutToken.release();
+        }
+    });
+});
+suite('data-plane: TurnRegistry unit properties', () => {
+    test('raw nonces are never map keys — lookups go through sha256', () => {
+        const reg = new data_plane_1.TurnRegistry();
+        const { nonce } = reg.register({ userId: 'u', sessionKey: 's' });
+        assert.ok(reg.resolve(nonce));
+        // resolve by the HASH must fail — only the raw nonce authenticates.
+        assert.strictEqual(reg.resolve((0, data_plane_1.hashNonce)(nonce)), undefined);
+    });
+    test('release is idempotent and deletes exactly its own entry', () => {
+        const reg = new data_plane_1.TurnRegistry();
+        const a = reg.register({ userId: 'a', sessionKey: 's' });
+        const b = reg.register({ userId: 'b', sessionKey: 's' });
+        a.release();
+        a.release();
+        assert.strictEqual(reg.resolve(a.nonce), undefined);
+        assert.strictEqual(reg.resolve(b.nonce)?.userId, 'b');
+        b.release();
+        assert.strictEqual(reg.size, 0);
+    });
+    test('expired entries are pruned on register', () => {
+        const reg = new data_plane_1.TurnRegistry();
+        reg.register({ userId: 'a', sessionKey: 's', deadline: Date.now() - 1 });
+        assert.strictEqual(reg.size, 1);
+        reg.register({ userId: 'b', sessionKey: 's' });
+        assert.strictEqual(reg.size, 1, 'the expired entry must have been pruned');
+    });
+});

package/out/test/deploy-init.test.js

@@ -49,8 +49,10 @@ const child_process_1 = require("child_process");
 const yaml = __importStar(require("js-yaml"));
 const deploy_init_1 = require("../cli/deploy-init");
 const deploy_1 = require("../cli/commands/deploy");
+const idp_init_1 = require("../cli/idp-init");
 const CTX = {
     packName: 'databricks-analyst',
+    packVersion: '0.1.0',
     image: 'ghcr.io/agenthippo/runtime:2026.06',
     port: 8080,
     engine: 'claude',
@@ -160,6 +162,43 @@ suite('deploy-init: renderTarget produces well-formed artifacts', () => {
             assert.ok(files['README.md'], `${t} missing README.md`);
         }
     });
+    test('every target ships a DATA-ACCESS.md summary (governance layer)', () => {
+        for (const t of deploy_init_1.DEPLOY_TARGETS) {
+            const files = (0, deploy_init_1.renderTarget)(t, CTX);
+            const doc = files['DATA-ACCESS.md'];
+            assert.ok(doc, `${t} missing DATA-ACCESS.md`);
+            assert.ok(doc.includes('## Secrets') && doc.includes('## Egress') && doc.includes('## Blast radius per component'), `${t} DATA-ACCESS.md missing a required section`);
+            assert.ok(doc.includes('api.anthropic.com:443'), `${t} DATA-ACCESS.md must name the model API host`);
+        }
+    });
+    test('DATA-ACCESS.md lists auth secrets + oauth2-proxy blast radius only for self-issued edge targets', () => {
+        const selfIssued = (0, deploy_init_1.renderTarget)('vm', CTX)['DATA-ACCESS.md'];
+        assert.ok(selfIssued.includes('AGENTHIPPO_AUTH_JWT_SECRET'));
+        assert.ok(selfIssued.includes('OAUTH2_PROXY_CLIENT_SECRET'));
+        assert.ok(selfIssued.includes('**oauth2-proxy**'));
+        const federated = (0, deploy_init_1.renderTarget)('vm', { ...CTX, ingress: 'edge-fed', idpUrl: 'https://auth.corp.example' })['DATA-ACCESS.md'];
+        assert.ok(federated.includes('AGENTHIPPO_AUTH_JWT_SECRET'));
+        assert.ok(!federated.includes('OAUTH2_PROXY_CLIENT_SECRET'), 'federated deployments mint no Google OAuth client');
+        assert.ok(!federated.includes('**oauth2-proxy**'), 'federated deployments run no oauth2-proxy');
+        const noEdge = (0, deploy_init_1.renderTarget)('databricks-app', CTX)['DATA-ACCESS.md'];
+        assert.ok(!noEdge.includes('AGENTHIPPO_AUTH_JWT_SECRET'), 'platform-native targets mint no JWT secret');
+    });
+    test('image-based targets emit pack provenance header and OCI labels', () => {
+        const marker = 'Generated from Agent Pack databricks-analyst@0.1.0 — packs.agenthippo.ai';
+        for (const t of ['vm', 'compose', 'cloudrun', 'spcs', 'cloudflare']) {
+            const files = (0, deploy_init_1.renderTarget)(t, CTX);
+            const df = files['Dockerfile'];
+            assert.ok(df.includes(marker), `${t} Dockerfile missing attribution`);
+            assert.ok(df.includes('LABEL ai.agenthippo.pack.name="databricks-analyst"'), `${t} missing pack.name label`);
+            assert.ok(df.includes('LABEL ai.agenthippo.pack.version="0.1.0"'), `${t} missing pack.version label`);
+            assert.ok(df.includes('LABEL ai.agenthippo.pack.engine="claude"'), `${t} missing pack.engine label`);
+            assert.ok(files['.env.example'].includes(marker), `${t} .env.example missing attribution`);
+            assert.ok(files['README.md'].includes(marker), `${t} README missing attribution`);
+        }
+        const vmRun = (0, deploy_init_1.renderTarget)('vm', CTX)['run.sh'];
+        assert.ok(vmRun.startsWith('#!'), 'run.sh keeps shebang first');
+        assert.ok(vmRun.includes(`# ${marker}`), 'run.sh attributes after shebang');
+    });
     test('image-based targets emit a valid 5-line-style Dockerfile referencing the runtime image', () => {
         for (const t of ['vm', 'compose', 'cloudrun', 'spcs', 'cloudflare']) {
             const df = (0, deploy_init_1.renderTarget)(t, CTX)['Dockerfile'];
@@ -182,9 +221,13 @@ suite('deploy-init: renderTarget produces well-formed artifacts', () => {
             // Ship only deploy/www/ from deploy/ (drops deploy/.env, credentials, build artifacts).
             assert.ok(di.includes('deploy/*'), `${t} should exclude deploy/*`);
             assert.ok(di.includes('!deploy/www/**'), `${t} should re-include deploy/www/**`);
-            // Defensive secret ignores.
+            // Defensive secret ignores — any-extension credentials + common private-key formats,
+            // not just *credentials*.json (see isSecretLikeBasename in deploy-init.ts).
             assert.ok(di.includes('**/.env'), `${t} should ignore **/.env`);
-            assert.ok(di.includes('**/*credentials*.json'), `${t} should ignore credentials json`);
+            assert.ok(di.includes('**/*credentials*'), `${t} should ignore credentials of any extension`);
+            assert.ok(di.includes('**/*.pem'), `${t} should ignore .pem files`);
+            assert.ok(di.includes('**/*.key'), `${t} should ignore .key files`);
+            assert.ok(di.includes('**/id_rsa'), `${t} should ignore id_rsa`);
             // skills/, scripts/, references/ must NOT be ignored lines.
             const ignored = di.split('\n').map((l) => l.trim()).filter((l) => l && !l.startsWith('#'));
             for (const keep of ['skills/', 'scripts/', 'references/', 'skills', 'scripts', 'references']) {
@@ -310,6 +353,30 @@ suite('deploy-init: renderTarget produces well-formed artifacts', () => {
         assert.ok(files['.env.auth.example'].includes('OAUTH2_PROXY_CLIENT_ID') && files['.env.auth.example'].includes('AGENTHIPPO_AUTH_JWT_SECRET'));
         // Note: service.yaml is a sed-template (${SERVICE}/${IMAGE}/${PUBLIC_HOSTNAME}/…), so it is
         // only valid YAML after the deploy script substitutes placeholders — same as the IAP template.
+        assert.ok(files['README.md'].includes('**Egress:**'), 'edge README documents the egress allowlist');
+    });
+    test('cloudrun --ingress edge-fed --model-routing gateway drops LiteLLM/OTEL — agent calls gateway.agenthippo.ai', () => {
+        const files = (0, deploy_init_1.renderTarget)('cloudrun', {
+            ...CTX, ingress: 'edge-fed', modelRouting: 'gateway', model: 'ah-auto',
+            idpUrl: 'https://auth.agenthippo.ai', cookieDomain: '.agenthippo.ai',
+        });
+        const svc = files['service.yaml'];
+        const sh = files['cloudrun-deploy.sh'];
+        assert.ok(svc.includes('name: caddy') && svc.includes('name: auth-broker') && svc.includes('name: agent'));
+        assert.ok(!svc.includes('name: litellm') && !svc.includes('name: otel-collector'), 'no Spotlight sidecars');
+        assert.ok(svc.includes('https://gateway.agenthippo.ai/v1'), 'agent points at org gateway');
+        assert.ok(!svc.includes('http://localhost:4443'), 'agent must not route through in-pod LiteLLM');
+        assert.ok(!files['otel-collector.yaml'], 'no otel config artifact');
+        assert.ok(!sh.includes('LITELLM_KEY') && !sh.includes('otel-config'), 'deploy skips litellm/otel secrets');
+        assert.ok(sh.includes('${SERVICE}-provider-key'), 'gateway key stored as provider-key secret');
+        assert.ok(files['.env.example'].includes('AGENTHIPPO_LITELLM_BASE_URL=https://gateway.agenthippo.ai/v1'));
+        assert.doesNotThrow(() => (0, child_process_1.execFileSync)('bash', ['-n', '-c', sh]));
+        const rendered = svc
+            .replace(/\$\{SERVICE\}/g, 'emoji-gateway')
+            .replace(/\$\{IMAGE\}/g, 'us-docker.pkg.dev/x/y/z:latest')
+            .replace(/\$\{PUBLIC_HOSTNAME\}/g, 'emoji.agenthippo.ai')
+            .replace(/\$\{ALLOWED_DOMAINS\}/g, 'agenthippo.ai');
+        assert.doesNotThrow(() => yaml.load(rendered), 'rendered gateway-direct service.yaml is valid YAML');
     });
     test('cloudrun --ingress edge-fed (A′) verifies the shared JWT — no oauth2-proxy, no per-service OAuth', () => {
         const files = (0, deploy_init_1.renderTarget)('cloudrun', {
@@ -361,6 +428,7 @@ suite('deploy-init: renderTarget produces well-formed artifacts', () => {
             .replace(/\$\{PUBLIC_HOSTNAME\}/g, 'cs.agenthippo.ai')
             .replace(/\$\{ALLOWED_DOMAINS\}/g, 'agenthippo.ai');
         assert.doesNotThrow(() => yaml.load(rendered), 'rendered service.yaml is valid YAML');
+        assert.ok(files['README.md'].includes('**Egress:**'), 'edge-fed README documents the egress allowlist');
     });
     test('renderAuthEnvExample fed variant has no Google OAuth client', () => {
         const out = (0, deploy_init_1.renderAuthEnvExample)({ hostname: 'cs.agenthippo.ai', fed: true, idpUrl: 'https://auth.agenthippo.ai', cookieDomain: '.agenthippo.ai' });
@@ -416,12 +484,98 @@ suite('deploy-init: renderTarget produces well-formed artifacts', () => {
     test('databricks-app pins AGENTHIPPO_IDENTITY_HEADER to x-forwarded-email', () => {
         const start = (0, deploy_init_1.renderTarget)('databricks-app', CTX)['start.js'];
         assert.ok(start.includes("AGENTHIPPO_IDENTITY_HEADER: 'x-forwarded-email'"), 'Databricks App start.js must pin identity to the workspace SSO header');
+        // Bootstrap escape hatch (analogous to Cloud Run ENABLE_IAP=0).
+        assert.ok(start.includes("AGENTHIPPO_PIN_IDENTITY === '0'"), 'Databricks pin must be skippable via AGENTHIPPO_PIN_IDENTITY=0');
     });
     test('spcs egress is limited to the model API via one EAI', () => {
         const sql = (0, deploy_init_1.renderTarget)('spcs', CTX)['deploy.sql'];
         assert.ok(sql.includes('api.anthropic.com:443'));
         assert.ok(/EXTERNAL ACCESS INTEGRATION/.test(sql));
     });
+    test('aws-ecs bare (no ingress) is a single-container task with no edge opinion', () => {
+        const files = (0, deploy_init_1.renderTarget)('aws-ecs', CTX);
+        assert.ok(!files['Caddyfile'], 'bare aws-ecs ships no Caddy');
+        assert.ok(!files['.env.auth.example'], 'bare aws-ecs has no local auth secrets');
+        const task = JSON.parse(files['task-definition.json']);
+        assert.strictEqual(task.networkMode, 'awsvpc');
+        assert.deepStrictEqual(task.requiresCompatibilities, ['FARGATE']);
+        assert.strictEqual(task.containerDefinitions.length, 1, 'exactly one container: the agent');
+        assert.strictEqual(task.containerDefinitions[0].name, 'agent');
+        assert.doesNotThrow(() => (0, child_process_1.execFileSync)('bash', ['-n', '-c', files['deploy.sh']]));
+    });
+    test('aws-ecs --ingress edge reuses the Cloud Run edge Caddyfile verbatim (shared sidecar identity layer)', () => {
+        const files = (0, deploy_init_1.renderTarget)('aws-ecs', { ...CTX, ingress: 'edge' });
+        const task = JSON.parse(files['task-definition.json']);
+        const names = task.containerDefinitions.map((c) => c.name);
+        assert.deepStrictEqual(names, ['caddy', 'oauth2-proxy', 'auth-broker', 'agent']);
+        assert.strictEqual(task.networkMode, 'awsvpc', 'one task, containers share localhost — same shape as Cloud Run sidecars');
+        assert.ok(files['Caddyfile'].includes('localhost:4180') && files['Caddyfile'].includes('localhost:9780'), 'localhost addressing (awsvpc shared network), not docker-DNS names');
+        assert.ok(files['.env.auth.example'].includes('OAUTH2_PROXY_CLIENT_ID'));
+        assert.doesNotThrow(() => (0, child_process_1.execFileSync)('bash', ['-n', '-c', files['deploy.sh']]));
+    });
+    test('aws-ecs --ingress edge-fed drops oauth2-proxy from the task and Caddyfile', () => {
+        const files = (0, deploy_init_1.renderTarget)('aws-ecs', { ...CTX, ingress: 'edge-fed', idpUrl: 'https://auth.corp.example' });
+        const task = JSON.parse(files['task-definition.json']);
+        const names = task.containerDefinitions.map((c) => c.name);
+        assert.deepStrictEqual(names, ['caddy', 'auth-broker', 'agent']);
+        assert.ok(!files['Caddyfile'].includes('localhost:4180'), 'no oauth2-proxy upstream in a federated Caddyfile');
+        assert.ok(files['Caddyfile'].includes('forward_auth localhost:9780'), 'verifies via auth-broker');
+        assert.ok(files['Caddyfile'].includes('https://auth.corp.example/oauth/browser-login'));
+        assert.ok(!files['.env.auth.example'].includes('OAUTH2_PROXY_CLIENT_ID'));
+        assert.doesNotThrow(() => (0, child_process_1.execFileSync)('bash', ['-n', '-c', files['deploy.sh']]));
+    });
+    test('azure-container-apps bare (no ingress) is a single-container app with no edge opinion', () => {
+        const files = (0, deploy_init_1.renderTarget)('azure-container-apps', CTX);
+        assert.ok(!files['Caddyfile'], 'bare azure-container-apps ships no Caddy');
+        assert.ok(!files['.env.auth.example'], 'bare azure-container-apps has no local auth secrets');
+        const spec = JSON.parse(files['containerapp.json']);
+        assert.strictEqual(spec.properties.template.containers.length, 1, 'exactly one container: the agent');
+        assert.strictEqual(spec.properties.template.containers[0].name, 'agent');
+        assert.strictEqual(spec.properties.configuration.ingress.external, true);
+        assert.doesNotThrow(() => (0, child_process_1.execFileSync)('bash', ['-n', '-c', files['deploy.sh']]));
+    });
+    test('azure-container-apps --ingress edge reuses the Cloud Run edge Caddyfile verbatim (shared sidecar identity layer)', () => {
+        const files = (0, deploy_init_1.renderTarget)('azure-container-apps', { ...CTX, ingress: 'edge' });
+        const spec = JSON.parse(files['containerapp.json']);
+        const names = spec.properties.template.containers.map((c) => c.name);
+        assert.deepStrictEqual(names, ['caddy', 'oauth2-proxy', 'auth-broker', 'agent']);
+        assert.ok(files['Caddyfile'].includes('localhost:4180') && files['Caddyfile'].includes('localhost:9780'), 'localhost addressing (containers in one replica share it), not docker-DNS names');
+        assert.ok(files['.env.auth.example'].includes('OAUTH2_PROXY_CLIENT_ID'));
+        assert.doesNotThrow(() => (0, child_process_1.execFileSync)('bash', ['-n', '-c', files['deploy.sh']]));
+    });
+    test('azure-container-apps --ingress edge-fed drops oauth2-proxy from the spec and Caddyfile', () => {
+        const files = (0, deploy_init_1.renderTarget)('azure-container-apps', { ...CTX, ingress: 'edge-fed', idpUrl: 'https://auth.corp.example' });
+        const spec = JSON.parse(files['containerapp.json']);
+        const names = spec.properties.template.containers.map((c) => c.name);
+        assert.deepStrictEqual(names, ['caddy', 'auth-broker', 'agent']);
+        assert.ok(!files['Caddyfile'].includes('localhost:4180'), 'no oauth2-proxy upstream in a federated Caddyfile');
+        assert.ok(files['Caddyfile'].includes('forward_auth localhost:9780'), 'verifies via auth-broker');
+        assert.ok(files['Caddyfile'].includes('https://auth.corp.example/oauth/browser-login'));
+        assert.ok(!files['.env.auth.example'].includes('OAUTH2_PROXY_CLIENT_ID'));
+        assert.doesNotThrow(() => (0, child_process_1.execFileSync)('bash', ['-n', '-c', files['deploy.sh']]));
+    });
+    // Governance (PLAN/deploy.md §6): every target must document what it can reach outbound —
+    // spcs enforces it via a network rule (tested above); every other target must at least name
+    // the host in its README so a security review doesn't have to reverse-engineer it.
+    test('every non-spcs target documents its egress allowlist in README', () => {
+        for (const target of deploy_init_1.DEPLOY_TARGETS) {
+            if (target === 'spcs') {
+                continue;
+            }
+            const readme = (0, deploy_init_1.renderTarget)(target, CTX)['README.md'];
+            assert.ok(readme?.includes('**Egress:**'), `${target} README must document its egress allowlist`);
+            assert.ok(readme.includes('api.anthropic.com:443'), `${target} README must name the model API host`);
+        }
+    });
+    // Governance (PLAN/deploy.md §6): a container that might ever be reached directly (bypassing
+    // its fronting proxy/Worker) must pin AGENTHIPPO_IDENTITY_HEADER so it can't be spoofed by an
+    // unauthenticated caller naming themselves via the same header name serve otherwise trusts as
+    // an unpinned alias. iap/databricks-app are covered by their own tests above; cloudflare here.
+    test('cloudflare pins AGENTHIPPO_IDENTITY_HEADER so a directly-reached container cannot be spoofed', () => {
+        const files = (0, deploy_init_1.renderTarget)('cloudflare', CTX);
+        assert.ok(files['Dockerfile'].includes('ENV AGENTHIPPO_IDENTITY_HEADER=x-agent-user'), 'cloudflare Dockerfile must pin identity to the header its own Worker sets');
+        assert.ok(files['README.md'].includes('Identity pin'), 'README must document the pin for whoever wires the Worker');
+    });
     test('vm target includes edge compose profile; agent has no SSO-bypass host port', () => {
         const files = (0, deploy_init_1.renderTarget)('vm', CTX);
         const compose = files['docker-compose.yml'];
@@ -468,6 +622,65 @@ suite('deploy-init: renderTarget produces well-formed artifacts', () => {
         assert.ok(files['Caddyfile']);
         assert.ok(files['.env.auth.example'].includes('OAUTH2_PROXY_PROVIDER'));
     });
+    for (const target of ['vm', 'compose']) {
+        test(`${target} --ingress edge-fed verifies the shared JWT — no oauth2-proxy, no per-agent OAuth`, () => {
+            const fedCtx = {
+                ...CTX, ingress: 'edge-fed', idpUrl: 'https://auth.corp.example', cookieDomain: '.corp.example',
+            };
+            const files = (0, deploy_init_1.renderTarget)(target, fedCtx);
+            const compose = files['docker-compose.yml'];
+            const caddy = files['Caddyfile'];
+            const auth = files['.env.auth.example'];
+            assert.ok(!/^\s*oauth2-proxy:/m.test(compose), `${target} edge-fed must not ship an oauth2-proxy container`);
+            assert.ok(compose.includes('depends_on: [agent, auth-broker]'), 'caddy no longer depends on oauth2-proxy');
+            assert.ok(!caddy.includes('oauth2-proxy:4180') && !caddy.includes('/oauth2/*'), 'no oauth2-proxy routes in a federated Caddyfile');
+            assert.ok(caddy.includes('forward_auth auth-broker:9780'), 'Caddy verifies via auth-broker');
+            assert.ok(caddy.includes('https://auth.corp.example/oauth/browser-login'), 'browser 401 redirects to the central IdP browser-login endpoint');
+            assert.ok(caddy.includes('return_to='), 'redirect carries a return_to for the round trip');
+            // Target-specific behavior (sticky lb / static file split) must survive federation —
+            // identity mode and deployment shape are independent axes.
+            assert.ok(caddy.includes('lb_policy header X-Agent-User'), 'sticky agent proxy unaffected by identity mode');
+            assert.ok(caddy.includes('root * /srv/www'), 'static file serving unaffected by identity mode');
+            assert.ok(auth.includes('AGENTHIPPO_AUTH_JWT_SECRET') && auth.includes('AGENTHIPPO_AUTH_IDP_URL'));
+            assert.ok(!auth.includes('OAUTH2_PROXY_CLIENT_ID'), 'federated auth env has no Google OAuth client');
+        });
+    }
+    for (const target of ['vm', 'compose']) {
+        test(`${target} --ingress edge-fed --colocate ships only the agent — no Caddy/oauth2-proxy/auth-broker`, () => {
+            const colocateCtx = {
+                ...CTX, ingress: 'edge-fed', idpUrl: 'https://auth.corp.example', colocate: true,
+            };
+            const files = (0, deploy_init_1.renderTarget)(target, colocateCtx);
+            const compose = files['docker-compose.yml'];
+            const snippet = files['agent-route.caddy'];
+            assert.ok(!files['Caddyfile'], `${target} colocate must not ship its own Caddyfile`);
+            assert.ok(!files['.env.auth.example'], `${target} colocate must not ship any local auth secrets`);
+            assert.ok(!/^\s*(caddy|oauth2-proxy|auth-broker):/m.test(compose), `${target} colocate compose must contain only the agent service`);
+            assert.ok(compose.includes('container_name: databricks-analyst-agent'), 'fixed, predictable container name');
+            assert.ok(compose.includes('networks: [colocate]') && compose.includes('external: true'), 'agent joins the IdP\'s external colocate network');
+            assert.ok(!compose.includes('ports:'), 'no host port — reached only via the IdP\'s Caddy, over the shared network');
+            assert.ok(snippet, 'route snippet generated for the operator to drop onto the IdP host');
+            // http:// (not https://) — must match the IdP Caddyfile's TLS model: auto_https is
+            // off there and TLS terminates in front, so an imported https:// block wouldn't
+            // match plaintext traffic forwarded from the front proxy.
+            assert.ok(snippet.includes(`http://${CTX.publicHostname} {`), 'snippet is a plain-HTTP site block, matching the IdP\'s own');
+            assert.ok(!snippet.includes(`https://${CTX.publicHostname}`), 'must not use https:// — the IdP Caddyfile has auto_https off');
+            assert.ok(snippet.includes('reverse_proxy databricks-analyst-agent:8080'), 'snippet proxies to the fixed container name');
+            assert.ok(snippet.includes('forward_auth auth-broker:9780'), 'identity is verified via the IdP\'s own auth-broker');
+            assert.ok(!snippet.includes('oauth2-proxy'), 'no oauth2-proxy — federated identity only');
+            assert.ok(snippet.includes('https://auth.corp.example/oauth/browser-login'), 'unauthenticated browsers redirect to the IdP');
+            const dataAccess = files['DATA-ACCESS.md'];
+            assert.ok(!dataAccess.includes('AGENTHIPPO_AUTH_JWT_SECRET'), 'colocated agent holds no JWT secret of its own');
+            assert.ok(!dataAccess.includes('**oauth2-proxy**'), 'colocated agent runs no oauth2-proxy');
+            assert.ok(files['www/index.html'], 'colocated agent ships browser landing page at GET /');
+            assert.ok(files['Dockerfile'].includes('--www-dir'), 'serve enables static chat UI after SSO');
+        });
+    }
+    test('--colocate is a no-op without --ingress edge-fed (still ships the normal self-issued edge)', () => {
+        const files = (0, deploy_init_1.renderTarget)('vm', { ...CTX, colocate: true });
+        assert.ok(files['Caddyfile'], 'no ingress edge-fed → colocate does not apply, normal vm artifacts render');
+        assert.ok(!files['agent-route.caddy']);
+    });
     test('agent service does not load .env.auth; broker + oauth2-proxy do', () => {
         const compose = (0, deploy_init_1.renderTarget)('compose', CTX)['docker-compose.yml'];
         // The agent runs model-driven tool calls — it must never receive the token-signing key.
@@ -483,7 +696,7 @@ suite('deploy-init: deployCommand stages a self-contained pack', () => {
     setup(() => {
         pack = fs.mkdtempSync(path.join(os.tmpdir(), 'ah-pack-'));
         staging = fs.mkdtempSync(path.join(os.tmpdir(), 'ah-stage-'));
-        fs.writeFileSync(path.join(pack, 'agent.yaml'), 'apiVersion: agenthippo.ai/v1\nkind: Agent\nmetadata:\n  name: cs-test\nspec:\n  engine: claude\n  model: litellm/gpt-5.5\n');
+        fs.writeFileSync(path.join(pack, 'agent.yaml'), 'apiVersion: agenthippo.ai/v1\nkind: Agent\nmetadata:\n  name: cs-test\n  version: 0.1.0\nspec:\n  engine: claude\n  model: litellm/gpt-5.5\n');
         fs.writeFileSync(path.join(pack, 'AGENTS.md'), '# cs-test\n');
         fs.mkdirSync(path.join(pack, 'skills', 'demo', 'scripts'), { recursive: true });
         fs.writeFileSync(path.join(pack, 'skills', 'demo', 'scripts', 'run.sh'), 'echo hi\n');
@@ -493,6 +706,8 @@ suite('deploy-init: deployCommand stages a self-contained pack', () => {
         fs.writeFileSync(path.join(pack, 'node_modules', 'foo', 'index.js'), 'x');
         fs.writeFileSync(path.join(pack, '.env'), 'SECRET=1\n');
         fs.writeFileSync(path.join(pack, 'my-credentials.json'), '{}\n');
+        fs.writeFileSync(path.join(pack, 'service-account.pem'), 'FAKE PEM\n');
+        fs.writeFileSync(path.join(pack, 'id_rsa'), 'FAKE PRIVATE KEY\n');
         fs.mkdirSync(path.join(pack, 'deploy'), { recursive: true });
         fs.writeFileSync(path.join(pack, 'deploy', 'leftover.yaml'), 'stale\n');
     });
@@ -510,6 +725,8 @@ suite('deploy-init: deployCommand stages a self-contained pack', () => {
         assert.ok(!fs.existsSync(path.join(staging, 'node_modules')), 'node_modules must not be copied into staging');
         assert.ok(!fs.existsSync(path.join(staging, '.env')), '.env must not be copied into staging');
         assert.ok(!fs.existsSync(path.join(staging, 'my-credentials.json')), 'credentials json must not be copied');
+        assert.ok(!fs.existsSync(path.join(staging, 'service-account.pem')), '.pem key must not be copied');
+        assert.ok(!fs.existsSync(path.join(staging, 'id_rsa')), 'id_rsa key must not be copied');
         // The source pack's own deploy/ is not copied (the generator owns staging/deploy/).
         assert.ok(!fs.existsSync(path.join(staging, 'deploy', 'leftover.yaml')), 'source deploy/ must not be copied');
         // Generated artifacts under staging/deploy/.
@@ -529,6 +746,25 @@ suite('deploy-init: deployCommand stages a self-contained pack', () => {
         assert.ok(fs.existsSync(path.join(staging, 'agent.yaml')), 'packdir flag resolved the pack');
         assert.ok(fs.existsSync(path.join(staging, 'deploy', 'Dockerfile')), 'artifacts generated from packdir pack');
     });
+    test('--blueprint team-pilot --platform cloudrun resolves to IAP (no Caddyfile, no oauth2-proxy)', async () => {
+        await (0, deploy_1.deployCommand)('init', pack, {
+            target: 'vm', blueprint: 'team-pilot', platform: 'cloudrun', out: staging, port: 8080, force: true,
+        });
+        assert.ok(fs.existsSync(path.join(staging, 'deploy', 'cloudrun-deploy.sh')), 'cloudrun artifacts generated');
+        assert.ok(!fs.existsSync(path.join(staging, 'deploy', 'Caddyfile')), 'team-pilot on cloudrun is IAP — no Caddy edge');
+        const sh = fs.readFileSync(path.join(staging, 'deploy', 'cloudrun-deploy.sh'), 'utf8');
+        assert.ok(sh.includes('--iap'), 'blueprint-resolved --ingress iap reaches the actual IAP deploy path');
+    });
+    test('--blueprint enterprise-fleet --platform vm resolves to a federated (no oauth2-proxy) edge', async () => {
+        await (0, deploy_1.deployCommand)('init', pack, {
+            target: 'cloudrun', blueprint: 'enterprise-fleet', platform: 'vm', out: staging, port: 8080, force: true,
+            idpUrl: 'https://auth.corp.example',
+        });
+        const caddy = fs.readFileSync(path.join(staging, 'deploy', 'Caddyfile'), 'utf8');
+        const compose = fs.readFileSync(path.join(staging, 'deploy', 'docker-compose.yml'), 'utf8');
+        assert.ok(!caddy.includes('oauth2-proxy:4180'), 'enterprise-fleet federates — no oauth2-proxy in the Caddyfile');
+        assert.ok(!/^\s*oauth2-proxy:/m.test(compose), 'enterprise-fleet federates — no oauth2-proxy container');
+    });
 });
 suite('deploy-init: copyPackToStaging dereferences symlinks + skips broken ones', () => {
     let pack;
@@ -536,7 +772,7 @@ suite('deploy-init: copyPackToStaging dereferences symlinks + skips broken ones'
     setup(() => {
         pack = fs.mkdtempSync(path.join(os.tmpdir(), 'ah-pack-'));
         staging = fs.mkdtempSync(path.join(os.tmpdir(), 'ah-stage-'));
-        fs.writeFileSync(path.join(pack, 'agent.yaml'), 'apiVersion: agenthippo.ai/v1\nkind: Agent\nmetadata:\n  name: link-test\nspec:\n  engine: claude\n');
+        fs.writeFileSync(path.join(pack, 'agent.yaml'), 'apiVersion: agenthippo.ai/v1\nkind: Agent\nmetadata:\n  name: link-test\n  version: 0.1.0\nspec:\n  engine: claude\n');
         // Real skill content + a shared file the skill links to (relative symlink → resolved on copy).
         fs.mkdirSync(path.join(pack, 'skills', 'demo'), { recursive: true });
         fs.writeFileSync(path.join(pack, 'skills', 'demo', 'REAL.md'), '# real content\n');
@@ -561,3 +797,18 @@ suite('deploy-init: copyPackToStaging dereferences symlinks + skips broken ones'
         assert.ok(broken.includes('skills/broken/SKILL.md'), 'broken symlink reported in returned list');
     });
 });
+suite('deploy-init: enterprise-deploy/idp/ (customer 0) stays in sync with `agenthippo idp init`', () => {
+    // PLAN/deploy.md — AgentHippo's own auth.agenthippo.ai instance is "customer 0": it must be
+    // stood up with the exact same `agenthippo idp init` a real enterprise customer would use,
+    // not a bespoke hand-maintained copy. This fails loudly if the checked-in files drift from
+    // what the generator produces for the same hostname (regenerate with:
+    // `agenthippo idp init --hostname auth.agenthippo.ai --out enterprise-deploy/idp --force`).
+    test('checked-in files are byte-identical to renderIdpArtifacts({ hostname: "auth.agenthippo.ai" })', () => {
+        const idpDir = path.join(__dirname, '..', '..', '..', '..', 'enterprise-deploy', 'idp');
+        const files = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.agenthippo.ai' });
+        for (const [rel, expected] of Object.entries(files)) {
+            const actual = fs.readFileSync(path.join(idpDir, rel), 'utf8');
+            assert.strictEqual(actual, expected, `enterprise-deploy/idp/${rel} is stale — regenerate with: agenthippo idp init --hostname auth.agenthippo.ai --out enterprise-deploy/idp --force`);
+        }
+    });
+});