@agenthippo-ai/agenthippo 0.1.1 → 0.2.3-dataplane

package/out/test/egress-broker.test.js

@@ -0,0 +1,172 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Egress broker tests (secure-obo-design §7.6)
+ *
+ *  Boots the real broker (loopback HTTP + shared TurnRegistry) against a temp workspace whose
+ *  gateway-outbound handle store is seeded like the bridge would seed it, then drives it exactly
+ *  as the agent-facing `gateway send` broker mode does: bearer nonce, `{message, to?}` body.
+ *
+ *  The `send` function is a spy — no live OpenClaw gateway — so we assert on WHAT the broker
+ *  resolved and WHETHER it delivered, not on the platform call itself.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const data_plane_1 = require("../cli/data-plane");
+const outboundPaths_1 = require("../gateway/outboundPaths");
+const AGENT_ID = 'demo-agent';
+/** Seed a handle store the way the bridge's upsertGatewayOutboundHandle would. */
+function seedStore(workspaceRoot, storeKey, handle) {
+    const p = (0, outboundPaths_1.getGatewayOutboundFilePath)(workspaceRoot, (0, outboundPaths_1.safeGatewaySessionDirId)(storeKey));
+    fs.mkdirSync(path.dirname(p), { recursive: true });
+    fs.writeFileSync(p, JSON.stringify({
+        version: 1,
+        lastByAgent: { [AGENT_ID]: handle },
+        targetsByAgent: { [AGENT_ID]: { [handle.target]: handle } },
+    }), 'utf8');
+}
+function handle(target, overrides = {}) {
+    return {
+        agentId: AGENT_ID, channel: 'telegram', target,
+        firstSeenAt: 1, lastSeenAt: 2, inboundCount: 1, ...overrides,
+    };
+}
+async function post(url, nonce, body) {
+    const res = await fetch(url, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', ...(nonce !== undefined ? { Authorization: `Bearer ${nonce}` } : {}) },
+        body: JSON.stringify(body),
+    });
+    return { status: res.status, json: await res.json().catch(() => ({})) };
+}
+suite('egress broker: server-side resolution + fail-closed (§7.6)', function () {
+    this.timeout(15_000);
+    let workspaceRoot;
+    let registry;
+    let broker;
+    let sends;
+    suiteSetup(async () => {
+        workspaceRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'egress-ws-'));
+        registry = new data_plane_1.TurnRegistry();
+        sends = [];
+        broker = await (0, data_plane_1.startEgressBroker)({
+            registry,
+            workspaceRoot,
+            agentId: AGENT_ID,
+            send: async (h, message, media) => {
+                sends.push({ handle: h, message, media });
+                return { ok: true, via: 'spy' };
+            },
+        });
+    });
+    suiteTeardown(async () => {
+        await broker?.close();
+        fs.rmSync(workspaceRoot, { recursive: true, force: true });
+    });
+    test('binds loopback only', () => {
+        assert.ok(broker.url.startsWith('http://127.0.0.1:'), broker.url);
+    });
+    test('reply-to-sender: a live nonce delivers to the session\'s bound handle', async () => {
+        seedStore(workspaceRoot, 'chat-1', handle('telegram:dm:100'));
+        const turn = registry.register({ userId: 'u@corp.com', sessionKey: 's', egressStoreKey: 'chat-1' });
+        try {
+            const { status, json } = await post(broker.url, turn.nonce, { message: 'hello' });
+            assert.strictEqual(status, 200);
+            assert.strictEqual(json.ok, true);
+            assert.strictEqual(sends.at(-1)?.handle.target, 'telegram:dm:100');
+            assert.strictEqual(sends.at(-1)?.message, 'hello');
+        }
+        finally {
+            turn.release();
+        }
+    });
+    test('`to` may only SELECT among bound handles — a new destination is refused, no send', async () => {
+        seedStore(workspaceRoot, 'chat-2', handle('telegram:dm:200'));
+        const turn = registry.register({ userId: 'u@corp.com', sessionKey: 's', egressStoreKey: 'chat-2' });
+        const before = sends.length;
+        try {
+            const { status, json } = await post(broker.url, turn.nonce, { message: 'exfil', to: 'telegram:dm:ATTACKER' });
+            assert.strictEqual(status, 404, 'a target not bound to this session must not resolve');
+            assert.strictEqual(json.ok, false);
+            assert.strictEqual(sends.length, before, 'nothing may be delivered when resolution fails');
+        }
+        finally {
+            turn.release();
+        }
+    });
+    test('off-turn / released nonce → 401, fail closed, no send', async () => {
+        seedStore(workspaceRoot, 'chat-3', handle('telegram:dm:300'));
+        const turn = registry.register({ userId: 'u@corp.com', sessionKey: 's', egressStoreKey: 'chat-3' });
+        const nonce = turn.nonce;
+        turn.release();
+        const before = sends.length;
+        const { status, json } = await post(broker.url, nonce, { message: 'stale' });
+        assert.strictEqual(status, 401);
+        assert.strictEqual(json.ok, false);
+        assert.strictEqual(sends.length, before);
+    });
+    test('unknown / missing nonce → 401', async () => {
+        assert.strictEqual((await post(broker.url, 'never-issued-nonce', { message: 'x' })).status, 401);
+        assert.strictEqual((await post(broker.url, undefined, { message: 'x' })).status, 401);
+    });
+    test('a turn with no egress store key (bare HTTP data turn) cannot send → 403', async () => {
+        const turn = registry.register({ userId: 'u@corp.com', sessionKey: 's' }); // no egressStoreKey
+        try {
+            const { status } = await post(broker.url, turn.nonce, { message: 'x' });
+            assert.strictEqual(status, 403);
+        }
+        finally {
+            turn.release();
+        }
+    });
+    test('one user cannot address another session\'s bound handle (server-side scoping)', async () => {
+        // Alice's session is bound to her peer; Bob's turn (his own store key) must not reach it.
+        seedStore(workspaceRoot, 'alice-chat', handle('telegram:dm:ALICE'));
+        const bob = registry.register({ userId: 'bob@corp.com', sessionKey: 'sb', egressStoreKey: 'bob-chat' }); // no store seeded
+        const before = sends.length;
+        try {
+            const { status } = await post(broker.url, bob.nonce, { message: 'to alice?', to: 'telegram:dm:ALICE' });
+            assert.strictEqual(status, 404, 'Bob\'s turn resolves only against Bob\'s own session store');
+            assert.strictEqual(sends.length, before);
+        }
+        finally {
+            bob.release();
+        }
+    });
+});

package/out/test/fleetDisplayUtils.test.js

@@ -45,6 +45,10 @@ suite('fleetDisplayUtils', () => {
         assert.strictEqual((0, fleetDisplayUtils_1.inferFleetEngineId)('agentide-cursor::auto'), 'cursor');
         assert.strictEqual((0, fleetDisplayUtils_1.formatFleetEngineLabel)('agentide-cursor::auto'), 'Cursor');
     });
+    test('formats agenthippo auto model label', () => {
+        assert.strictEqual((0, fleetDisplayUtils_1.formatFleetModelLabel)('ah-auto', ''), 'Auto');
+        assert.strictEqual((0, fleetDisplayUtils_1.formatFleetModelLabel)('agenthippo::ah-auto', ''), 'Auto');
+    });
     test('enriches in_progress row from schedule hint', () => {
         const hints = (0, fleetDisplayUtils_1.buildScheduleHintsByChatSessionId)([{
                 id: 'sched-1',

package/out/test/idp-init.test.js

@@ -0,0 +1,151 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  IdP Init Test Suite (PLAN/deploy.md — "customer 0")
+ *
+ *  Verifies `agenthippo idp init` generates a self-contained stack: no repo dependency in the
+ *  auth-broker image, identity routes reused verbatim from renderIdentityLayer (no drift risk),
+ *  and valid YAML/bash throughout.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+const yaml = __importStar(require("js-yaml"));
+const idp_init_1 = require("../cli/idp-init");
+const idp_1 = require("../cli/commands/idp");
+suite('idp-init: renderIdpArtifacts', () => {
+    test('generates a self-contained stack — no monorepo build context', () => {
+        const files = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.corp.example' });
+        assert.ok(files['Dockerfile.auth-broker'].includes('FROM ghcr.io/agenthippoai/runtime'), 'auth-broker image must come from the published runtime image, not repo build artifacts');
+        assert.ok(!files['Dockerfile.auth-broker'].includes('extensions/agentide/dist'), 'must not reference this repo\'s local build output — a customer never has it');
+        assert.ok(files['docker-compose.yml'].includes('dockerfile: Dockerfile.auth-broker')
+            && files['docker-compose.yml'].includes('context: .'), 'auth-broker builds from the generated dir itself, not a monorepo path');
+    });
+    test('docker-compose.yml is valid YAML with the expected services and networks', () => {
+        const files = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.corp.example' });
+        const compose = yaml.load(files['docker-compose.yml']);
+        assert.deepStrictEqual(Object.keys(compose.services), ['oauth2-proxy', 'auth-broker', 'caddy', 'cloudflared']);
+        assert.ok(!('agent' in compose.services), 'the IdP runs no agent');
+        assert.deepStrictEqual(Object.keys(compose.networks), ['default', 'colocate']);
+        assert.ok(files['docker-compose.yml'].includes('name: agenthippo-idp-colocate'));
+    });
+    test('Caddyfile reuses renderIdentityLayer verbatim — self-issued, no agent backend', () => {
+        const files = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.corp.example' });
+        const caddy = files['Caddyfile'];
+        assert.ok(caddy.includes('import agents/*.caddy'), 'colocated agents import in');
+        assert.ok(caddy.includes('handle /oauth/authorize {') && caddy.includes('handle /oauth/browser-login {'));
+        assert.ok(caddy.includes('forward_auth oauth2-proxy:4180'), 'self-issued: gates via oauth2-proxy');
+        assert.ok(caddy.includes('reverse_proxy auth-broker:9780'), 'health checks the broker, not an agent');
+        assert.ok(caddy.includes('respond "not_found" 404'), 'no /v1/* API here — Bearer requests 404, not silently passed through');
+        assert.ok(caddy.includes('respond "AgentHippo IdP" 200'), 'browser catch-all, past the SSO gate');
+        assert.ok(caddy.includes('http://{$AGENTHIPPO_PUBLIC_HOSTNAME} {') && !caddy.includes('https://{$AGENTHIPPO_PUBLIC_HOSTNAME}'), 'plain HTTP — auto_https is off, TLS terminates in front');
+    });
+    test('.env.auth.example carries the shared JWT secret + Google OAuth client, no fed vars', () => {
+        const files = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.corp.example' });
+        const auth = files['.env.auth.example'];
+        assert.ok(auth.includes('AGENTHIPPO_AUTH_JWT_SECRET') && auth.includes('OAUTH2_PROXY_CLIENT_ID'));
+        assert.ok(!auth.includes('AGENTHIPPO_AUTH_IDP_URL'), 'the IdP is not itself federated against anything');
+    });
+    test('cookie domain defaults to the hostname\'s own parent domain when not given explicitly', () => {
+        const files = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.corp.example' });
+        assert.ok(files['.env.auth.example'].includes('AGENTHIPPO_AUTH_COOKIE_DOMAIN=.corp.example'));
+    });
+    test('explicit cookieDomain overrides the derived default', () => {
+        const files = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.eu.corp.example', cookieDomain: '.corp.example' });
+        assert.ok(files['.env.auth.example'].includes('AGENTHIPPO_AUTH_COOKIE_DOMAIN=.corp.example'));
+    });
+    test('run.sh is valid bash and reflects the hostname', () => {
+        const files = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.corp.example' });
+        assert.doesNotThrow(() => (0, child_process_1.execFileSync)('bash', ['-n', '-c', files['run.sh']]));
+        assert.ok(files['run.sh'].includes('auth.corp.example'));
+    });
+    // Bare metal / BYO nginx or ALB (e.g. Hetzner): run.sh must not hard-require a Cloudflare
+    // Tunnel, and Caddy's host port must be reconfigurable when 80/443 are already taken by the
+    // operator's own reverse proxy.
+    test('run.sh branches on an explicit tunnel-credentials path argument, not a fixed file location', () => {
+        const sh = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.corp.example' })['run.sh'];
+        assert.ok(sh.includes('if [[ $# -ge 1 ]]; then'), 'branches on whether an argument was passed');
+        assert.ok(!sh.includes('-f "$HOME/.agent-hippo/tunnel-credentials.json"'), 'must not infer tunnel mode from a fixed default file path');
+        assert.ok(sh.includes('AGENTHIPPO_TUNNEL_CREDENTIALS="$1"'), 'the argument becomes the credentials path');
+        assert.ok(sh.includes('docker compose --profile edge --profile tunnel up -d --build'));
+        assert.ok(sh.includes('docker compose --profile edge up -d --build'), 'no-argument branch: --profile edge only, no --profile tunnel');
+    });
+    test('run.sh fails loudly if a given tunnel-credentials path doesn\'t exist', () => {
+        const sh = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.corp.example' })['run.sh'];
+        assert.ok(sh.includes('[[ -f "$AGENTHIPPO_TUNNEL_CREDENTIALS" ]] || {'));
+        assert.ok(sh.includes('exit 1'));
+    });
+    test('docker-compose.yml wires the cloudflared credentials mount to AGENTHIPPO_TUNNEL_CREDENTIALS', () => {
+        const compose = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.corp.example' })['docker-compose.yml'];
+        assert.ok(compose.includes('${AGENTHIPPO_TUNNEL_CREDENTIALS:-${HOME}/.agent-hippo/tunnel-credentials.json}'));
+    });
+    test('Caddy host ports are configurable via AGENTHIPPO_CADDY_HTTP_PORT/_HTTPS_PORT (Hetzner: 80/443 may already be taken)', () => {
+        const compose = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.corp.example' })['docker-compose.yml'];
+        assert.ok(compose.includes('${AGENTHIPPO_CADDY_HTTP_PORT:-80}:80'));
+        assert.ok(compose.includes('${AGENTHIPPO_CADDY_HTTPS_PORT:-443}:443'));
+    });
+    test('README documents both the Cloudflare Tunnel path and the bare-metal/BYO-nginx path', () => {
+        const readme = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.corp.example' })['README.md'];
+        assert.ok(readme.includes('Cloudflare Tunnel'));
+        assert.ok(readme.includes('Bare metal') || readme.includes('BYO nginx'));
+    });
+});
+suite('idp-init: idpCommand writes files to disk', () => {
+    let outDir;
+    setup(() => {
+        outDir = fs.mkdtempSync(path.join(os.tmpdir(), 'ah-idp-'));
+    });
+    teardown(() => {
+        fs.rmSync(outDir, { recursive: true, force: true });
+    });
+    test('writes every generated file under --out', async () => {
+        await (0, idp_1.idpCommand)('init', { hostname: 'auth.corp.example', out: outDir });
+        for (const rel of ['docker-compose.yml', 'Dockerfile.auth-broker', 'Caddyfile', '.env.example', '.env.auth.example', 'run.sh', 'agents/README.md', 'README.md']) {
+            assert.ok(fs.existsSync(path.join(outDir, rel)), `${rel} should be written`);
+        }
+    });
+    test('refuses to overwrite existing files without --force', async () => {
+        await (0, idp_1.idpCommand)('init', { hostname: 'auth.corp.example', out: outDir });
+        fs.writeFileSync(path.join(outDir, 'README.md'), 'hand-edited\n');
+        await (0, idp_1.idpCommand)('init', { hostname: 'auth.corp.example', out: outDir });
+        assert.strictEqual(fs.readFileSync(path.join(outDir, 'README.md'), 'utf8'), 'hand-edited\n');
+        await (0, idp_1.idpCommand)('init', { hostname: 'auth.corp.example', out: outDir, force: true });
+        assert.notStrictEqual(fs.readFileSync(path.join(outDir, 'README.md'), 'utf8'), 'hand-edited\n');
+    });
+});

package/out/test/mcp-obo.test.js

@@ -34,49 +34,74 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 const assert = __importStar(require("assert"));
-const node_fs_1 = require("node:fs");
-const node_os_1 = require("node:os");
-const node_path_1 = require("node:path");
 const credential_context_1 = require("../cli/credential-context");
 const mcp_1 = require("../mcp");
-suite('mcp: OBO token in MCP env (Design B §11.1)', () => {
-    const orig = process.env.DATABRICKS_TOKEN;
-    let tokenDir;
+/**
+ * The per-turn OBO credential must never reach MCP child env implicitly: the supported
+ * transport is the loopback data-plane gateway + turn nonce (secure-obo-design §2/§3).
+ * Inline resolution exists only behind the explicit local-dev opt-in.
+ */
+suite('mcp: OBO token in MCP env (secure-obo-design §3.4 — inline is opt-in only)', () => {
+    const ENV_KEYS = ['DATABRICKS_TOKEN', 'AGENTHIPPO_DATA_TOKEN_ENV_VARS', mcp_1.ALLOW_INLINE_DATA_TOKEN_ENV];
+    const saved = {};
     setup(() => {
-        tokenDir = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'mcp-obo-'));
+        for (const k of ENV_KEYS) {
+            saved[k] = process.env[k];
+            delete process.env[k];
+        }
     });
     teardown(() => {
-        if (orig === undefined) {
-            delete process.env.DATABRICKS_TOKEN;
-        }
-        else {
-            process.env.DATABRICKS_TOKEN = orig;
+        for (const k of ENV_KEYS) {
+            if (saved[k] === undefined) {
+                delete process.env[k];
+            }
+            else {
+                process.env[k] = saved[k];
+            }
         }
-        (0, node_fs_1.rmSync)(tokenDir, { recursive: true, force: true });
     });
-    test('static PAT when no credential scope', () => {
+    test('static PAT resolves from plain env when no credential scope', () => {
         process.env.DATABRICKS_TOKEN = 'pat-static';
         assert.strictEqual((0, mcp_1.resolveMcpEnvVar)('DATABRICKS_TOKEN'), 'pat-static');
     });
-    test('OBO token overrides static PAT inside runWithCredential (inline fallback)', async () => {
-        process.env.DATABRICKS_TOKEN = 'pat-static';
+    test('WITHOUT the opt-in, a live OBO token never bakes into MCP child env', async () => {
+        process.env.AGENTHIPPO_DATA_TOKEN_ENV_VARS = 'DATABRICKS_TOKEN';
         await (0, credential_context_1.runWithCredential)({ userId: 'u@x.com', dataToken: 'obo-live' }, async () => {
-            assert.strictEqual((0, mcp_1.resolveMcpEnvVar)('DATABRICKS_TOKEN'), 'obo-live');
-        });
-    });
-    test('credential placeholder resolves to token file for stdio MCP', async () => {
-        await (0, credential_context_1.runWithCredential)({ userId: 'u@x.com', dataToken: 'obo-file-token' }, async () => {
+            // alias reference falls back to ambient env (unset here → empty), never the credential
+            assert.strictEqual((0, mcp_1.resolveMcpEnvVar)('DATABRICKS_TOKEN'), '');
+            // explicit placeholder resolves to nothing → the connector fails closed
+            assert.strictEqual((0, mcp_1.resolveMcpEnvVar)('dataToken'), '');
             const resolved = (0, mcp_1.resolveMcpServerEnv)({
                 DATABRICKS_HOST: 'dbc.example.com',
                 DATABRICKS_TOKEN: '${credential:dataToken}',
             });
             assert.ok(resolved);
             assert.strictEqual(resolved.DATABRICKS_HOST, 'dbc.example.com');
-            assert.strictEqual(resolved.DATABRICKS_TOKEN, undefined);
-            const file = resolved[mcp_1.AGENTHIPPO_DATA_TOKEN_FILE_ENV];
-            assert.ok(file);
-            assert.strictEqual((0, node_fs_1.readFileSync)(file, 'utf8'), 'obo-file-token');
-            assert.strictEqual((0, mcp_1.resolveMcpEnvVar)('DATABRICKS_TOKEN'), '');
-        }, { dataTokenDir: tokenDir });
+            assert.strictEqual(resolved.DATABRICKS_TOKEN, undefined, 'credential must not appear in spawn env without the opt-in');
+            assert.ok(!JSON.stringify(resolved).includes('obo-live'), 'the raw token must not leak anywhere in the resolved env');
+        });
+    });
+    test('WITH the explicit local-dev opt-in, inline resolution works (alias + placeholder)', async () => {
+        process.env[mcp_1.ALLOW_INLINE_DATA_TOKEN_ENV] = '1';
+        process.env.AGENTHIPPO_DATA_TOKEN_ENV_VARS = 'DATABRICKS_TOKEN';
+        process.env.DATABRICKS_TOKEN = 'pat-static';
+        await (0, credential_context_1.runWithCredential)({ userId: 'u@x.com', dataToken: 'obo-live' }, async () => {
+            assert.strictEqual((0, mcp_1.resolveMcpEnvVar)('DATABRICKS_TOKEN'), 'obo-live', 'OBO token overrides static PAT when opted in');
+            const resolved = (0, mcp_1.resolveMcpServerEnv)({ DATABRICKS_TOKEN: '${credential:dataToken}' });
+            assert.strictEqual(resolved.DATABRICKS_TOKEN, 'obo-live');
+        });
+    });
+    test('alias list is empty by default — DATABRICKS_TOKEN is no longer an implicit credential alias', async () => {
+        process.env[mcp_1.ALLOW_INLINE_DATA_TOKEN_ENV] = '1';
+        process.env.DATABRICKS_TOKEN = 'pat-static';
+        await (0, credential_context_1.runWithCredential)({ userId: 'u@x.com', dataToken: 'obo-live' }, async () => {
+            // No AGENTHIPPO_DATA_TOKEN_ENV_VARS declared → the plain env var wins even opted-in.
+            assert.strictEqual((0, mcp_1.resolveMcpEnvVar)('DATABRICKS_TOKEN'), 'pat-static');
+        });
+    });
+    test('no credential scope + placeholder → falls back to ambient env for local dev', () => {
+        process.env.DATABRICKS_TOKEN = 'pat-static';
+        const resolved = (0, mcp_1.resolveMcpServerEnv)({ DATABRICKS_TOKEN: '${credential:dataToken}' });
+        assert.strictEqual(resolved.DATABRICKS_TOKEN, 'pat-static');
     });
 });

package/out/test/mcp.test.js

@@ -43,6 +43,7 @@ const os = __importStar(require("os"));
 const fs_1 = require("fs");
 const mcp_1 = require("../mcp");
 const branding_1 = require("../branding");
+const credential_context_1 = require("../cli/credential-context");
 suite('MCP Server Loading', () => {
     let testDir;
     const getAgentMcpDir = (agentId) => path.join(testDir, branding_1.AGENTIDE_DIR_NAME, 'agents', agentId, 'mcp');
@@ -245,16 +246,19 @@ suite('MCP Server Loading', () => {
             // A bare (unquoted) dotted key would be misparsed as a nested table.
             assert.ok(!result.includes('my.token = '));
         });
-        test('autoApprove emits default_tools_approval_mode = "auto" per server', () => {
+        test('autoApprove emits default_tools_approval_mode = "approve" per server', () => {
             const servers = [
                 { name: 'stdio-srv', label: 's', command: 'node', args: ['s.js'] },
                 { name: 'http-srv', label: 'h', command: '', args: [], url: 'https://mcp.example.com/sse' },
             ];
             const result = (0, mcp_1.generateCodexMcpConfig)(servers, { autoApprove: true });
-            assert.ok(result.includes('default_tools_approval_mode = "auto"'));
+            assert.ok(result.includes('default_tools_approval_mode = "approve"'));
             assert.ok(result.includes('url = "https://mcp.example.com/sse"'));
-            // Invalid legacy key/value must never be emitted.
+            // Invalid legacy key/value must never be emitted. "auto" is not a valid enum value
+            // either — Codex ≥0.131 ignores it, falls back to `prompt`, and headless exec then
+            // cancels every MCP tool call ("user cancelled MCP tool call").
             assert.ok(!result.includes('approval_mode = "never"'));
+            assert.ok(!result.includes('"auto"'));
         });
         test('generateCodexMcpConfig emits http_headers for URL servers', () => {
             const servers = [
@@ -271,6 +275,27 @@ suite('MCP Server Loading', () => {
             assert.ok(result.includes('url = "https://mcp.example.com/sse"'));
             assert.ok(result.includes('http_headers = { "Authorization" = "Bearer abc", "X-Custom" = "val" }'));
         });
+        test('bearerTokenEnv emits bearer_token_env_var and NEVER a per-turn value — config.toml stays turn-invariant (secure-obo-design §3.2)', async () => {
+            const servers = [
+                {
+                    name: 'data',
+                    label: 'data',
+                    command: '',
+                    args: [],
+                    url: 'http://127.0.0.1:39999/mcp',
+                    bearerTokenEnv: 'AGENTHIPPO_TURN_NONCE',
+                },
+            ];
+            const outsideScope = (0, mcp_1.generateCodexMcpConfig)(servers);
+            assert.ok(outsideScope.includes('bearer_token_env_var = "AGENTHIPPO_TURN_NONCE"'));
+            assert.ok(!outsideScope.includes('http_headers'), 'no resolved header may carry the nonce into the file');
+            // Byte-identical no matter which user's credential scope is ambient — this is the
+            // exact property that removes the cross-user config.toml race (defect 1).
+            const inAlice = await (0, credential_context_1.runWithCredential)({ userId: 'alice@corp.com', dataToken: 'tok-a' }, async () => (0, mcp_1.generateCodexMcpConfig)(servers));
+            const inBob = await (0, credential_context_1.runWithCredential)({ userId: 'bob@corp.com', dataToken: 'tok-b' }, async () => (0, mcp_1.generateCodexMcpConfig)(servers));
+            assert.strictEqual(inAlice, outsideScope);
+            assert.strictEqual(inBob, outsideScope);
+        });
     });
     suite('inline MCP helpers', () => {
         test('formatInlineMcpServers maps resolved servers by name', () => {
@@ -306,6 +331,21 @@ suite('MCP Server Loading', () => {
                 remote: { type: 'http', url: 'https://mcp.example.com/sse', headers: { Authorization: 'Bearer abc' } },
             });
         });
+        test('bearerTokenEnv resolves against the PER-TURN env into an Authorization header (claude/custom path)', () => {
+            const server = {
+                name: 'data', label: 'data', command: '', args: [],
+                url: 'http://127.0.0.1:39999/mcp', bearerTokenEnv: 'AGENTHIPPO_TURN_NONCE',
+            };
+            const inline = (0, mcp_1.formatInlineMcpServers)([server], { AGENTHIPPO_TURN_NONCE: 'nonce-123' });
+            assert.deepStrictEqual(inline, {
+                data: { type: 'http', url: 'http://127.0.0.1:39999/mcp', headers: { Authorization: 'Bearer nonce-123' } },
+            });
+            // No nonce in the turn env (e.g. IDE) → no Authorization header, entry still valid.
+            const withoutNonce = (0, mcp_1.formatInlineMcpServers)([server], {});
+            assert.deepStrictEqual(withoutNonce, {
+                data: { type: 'http', url: 'http://127.0.0.1:39999/mcp' },
+            });
+        });
         test('serialize and parse round-trip inline MCP', () => {
             const inline = (0, mcp_1.formatInlineMcpServers)([
                 { name: 'echo', label: 'echo', command: 'echo', args: ['hi'] },