@agenthippo-ai/agenthippo 0.1.1 → 0.2.3-dataplane

package/out/test/model-routing.test.js

@@ -0,0 +1,133 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Model routing / credential selection tests.
+ *
+ *  Guards the fix that replaced the provider-blind precedence
+ *  (apiKey = litellm || anthropic || openai) with destination-based selection: the credential
+ *  is chosen by the endpoint the engine dials, so a codex turn never authenticates to OpenAI
+ *  with an Anthropic key (the Databricks 401), and a claude turn never uses the OpenAI key.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const utils_1 = require("../utils");
+const pack_loader_1 = require("../cli/pack-loader");
+const OPENAI = 'sk-openai-xxx';
+const ANTHROPIC = 'sk-ant-yyy';
+const LITELLM = 'sk-litellm-zzz';
+function opts(over = {}) {
+    return { workspaceRoot: '/ws', ...over };
+}
+suite('resolveApiRouting: direct path selects the ENGINE\'s provider key (no collapse)', () => {
+    // The exact Databricks scenario: both direct keys present, no proxy configured.
+    const bothKeys = { openaiApiKey: OPENAI, anthropicApiKey: ANTHROPIC };
+    test('codex (openai) picks the OpenAI key even when an Anthropic key is also present', () => {
+        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: false }), bothKeys, 'openai');
+        assert.strictEqual(r.apiKey, OPENAI);
+        assert.strictEqual(r.useLiteLLM, false);
+    });
+    test('claude (anthropic) picks the Anthropic key even when an OpenAI key is also present', () => {
+        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: false }), bothKeys, 'anthropic');
+        assert.strictEqual(r.apiKey, ANTHROPIC);
+    });
+    test('the codex→OpenAI-with-Anthropic-key 401 is impossible now', () => {
+        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: false }), bothKeys, 'openai');
+        assert.notStrictEqual(r.apiKey, ANTHROPIC, 'codex must never receive the Anthropic key');
+    });
+    test('missing provider key → empty (fail visibly), never the other provider\'s key', () => {
+        const onlyAnthropic = { anthropicApiKey: ANTHROPIC };
+        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: false }), onlyAnthropic, 'openai');
+        assert.strictEqual(r.apiKey, '', 'codex with only an Anthropic key gets no key, not the wrong one');
+    });
+});
+suite('resolveApiRouting: LiteLLM path uses the proxy key for every engine', () => {
+    const creds = { litellmApiKey: LITELLM, litellmBaseUrl: 'http://proxy:4000', openaiApiKey: OPENAI, anthropicApiKey: ANTHROPIC };
+    test('codex through the proxy uses the LiteLLM key + base URL', () => {
+        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: true }), creds, 'openai');
+        assert.strictEqual(r.apiKey, LITELLM);
+        assert.strictEqual(r.baseUrl, 'http://proxy:4000');
+        assert.strictEqual(r.useLiteLLM, true);
+    });
+    test('claude through the proxy also uses the LiteLLM key (one key routes all)', () => {
+        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: true }), creds, 'anthropic');
+        assert.strictEqual(r.apiKey, LITELLM);
+    });
+});
+suite('resolveApiRouting: explicit options.apiKey (IDE single key) still wins', () => {
+    test('IDE explicit key overrides the provider fallback on the direct path', () => {
+        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: false, apiKey: 'sk-ide-explicit' }), { openaiApiKey: OPENAI }, 'openai');
+        assert.strictEqual(r.apiKey, 'sk-ide-explicit');
+    });
+    test('IDE with only an explicit key and no creds still works (back-compat)', () => {
+        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: false, apiKey: 'sk-ide-explicit' }), {}, 'anthropic');
+        assert.strictEqual(r.apiKey, 'sk-ide-explicit');
+    });
+    test('proxy path keeps the sk-dummy fallback when nothing is configured', () => {
+        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: true }), {}, 'openai');
+        assert.strictEqual(r.apiKey, 'sk-dummy');
+    });
+});
+suite('inferModelProvider: custom engines pick provider from the model id', () => {
+    test('claude/anthropic model ids → anthropic', () => {
+        assert.strictEqual((0, utils_1.inferModelProvider)('claude-sonnet-4-5'), 'anthropic');
+        assert.strictEqual((0, utils_1.inferModelProvider)('litellm/claude-haiku-4-5'), 'anthropic');
+        assert.strictEqual((0, utils_1.inferModelProvider)('anthropic/claude-opus'), 'anthropic');
+    });
+    test('everything else → openai (the safe default for gpt/codex/unknown)', () => {
+        assert.strictEqual((0, utils_1.inferModelProvider)('gpt-5.5'), 'openai');
+        assert.strictEqual((0, utils_1.inferModelProvider)('litellm/gpt-5.4-nano'), 'openai');
+        assert.strictEqual((0, utils_1.inferModelProvider)(undefined), 'openai');
+    });
+});
+suite('hasCredentialForEngine: engine-aware boot check', () => {
+    const base = { apiKey: undefined, baseUrl: undefined, useLiteLLM: false, litellmApiKey: undefined, openaiApiKey: undefined, anthropicApiKey: undefined };
+    test('codex needs an OpenAI key; an Anthropic-only env fails the check', () => {
+        assert.strictEqual((0, pack_loader_1.hasCredentialForEngine)('codex', { ...base, anthropicApiKey: ANTHROPIC }), false);
+        assert.strictEqual((0, pack_loader_1.hasCredentialForEngine)('codex', { ...base, openaiApiKey: OPENAI }), true);
+    });
+    test('claude needs an Anthropic key; an OpenAI-only env fails the check', () => {
+        assert.strictEqual((0, pack_loader_1.hasCredentialForEngine)('claude', { ...base, openaiApiKey: OPENAI }), false);
+        assert.strictEqual((0, pack_loader_1.hasCredentialForEngine)('claude', { ...base, anthropicApiKey: ANTHROPIC }), true);
+    });
+    test('a configured LiteLLM proxy satisfies every engine', () => {
+        const proxy = { ...base, useLiteLLM: true, litellmApiKey: LITELLM, baseUrl: 'http://proxy:4000' };
+        assert.strictEqual((0, pack_loader_1.hasCredentialForEngine)('codex', proxy), true);
+        assert.strictEqual((0, pack_loader_1.hasCredentialForEngine)('claude', proxy), true);
+    });
+    test('custom engines are not gated here (they authenticate via their own manifest env var)', () => {
+        assert.strictEqual((0, pack_loader_1.hasCredentialForEngine)('openclaw', base), true);
+    });
+});

package/out/test/serve-gateway-turn.test.js

@@ -0,0 +1,267 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * runGatewayTurn Test Suite
+ *
+ * Gateway/channel-originated turns (Slack, etc.) previously bypassed both the
+ * identity-keyed RateLimiter and the per-session TurnLimiter entirely — only the
+ * capacity gate (TurnGate) was ever checked. This suite exercises the extracted
+ * admission sequence directly, without a live gateway connection.
+ */
+require("mocha");
+const assert = __importStar(require("assert"));
+const serve_1 = require("../cli/commands/serve");
+const serve_hardening_1 = require("../cli/serve-hardening");
+function fakeEmitter() {
+    const texts = [];
+    return {
+        texts,
+        doneCalled: false,
+        async thinking() { },
+        async text(delta) { texts.push(delta); },
+        async toolStart() { },
+        async toolEnd() { },
+        async progress() { },
+        async question() { return { selected: [], freeText: null }; },
+        async error() { },
+        async done() { this.doneCalled = true; },
+    };
+}
+function baseParams(overrides = {}) {
+    const noop = () => { };
+    return {
+        rateLimiter: new serve_hardening_1.RateLimiter(0), // disabled unless overridden
+        turnLimiter: new serve_hardening_1.TurnLimiter(0), // disabled unless overridden
+        turnGate: new serve_hardening_1.TurnGate(10, 10),
+        warnGateReject: noop,
+        rlKey: 'user-1',
+        sessionKey: 'session-1',
+        emitter: undefined,
+        run: async () => ({ success: true, error: undefined }),
+        ...overrides,
+    };
+}
+suite('runGatewayTurn: admission order and rejection messaging', () => {
+    test('rate limiter rejects: run() never called, channel gets RATE_LIMIT_BUSY_MESSAGE', async () => {
+        const rl = new serve_hardening_1.RateLimiter(1);
+        rl.tryConsume('user-1'); // pre-exhaust the one slot for this key
+        let ran = false;
+        const emitter = fakeEmitter();
+        const result = await (0, serve_1.runGatewayTurn)(baseParams({
+            rateLimiter: rl,
+            emitter,
+            run: async () => { ran = true; return { success: true }; },
+        }));
+        assert.strictEqual(result.success, false);
+        assert.strictEqual(result.error, 'rate_limited');
+        assert.strictEqual(ran, false, 'run() must not be called when the rate limiter rejects');
+        assert.deepStrictEqual(emitter.texts, [serve_hardening_1.RATE_LIMIT_BUSY_MESSAGE]);
+        assert.strictEqual(emitter.doneCalled, true);
+    });
+    test('rate limiter allows a fresh key through to run()', async () => {
+        let ran = false;
+        const result = await (0, serve_1.runGatewayTurn)(baseParams({
+            rateLimiter: new serve_hardening_1.RateLimiter(1),
+            run: async () => { ran = true; return { success: true }; },
+        }));
+        assert.strictEqual(result.success, true);
+        assert.strictEqual(ran, true);
+    });
+    test('turn gate at capacity rejects: run() never called, channel gets TURN_GATE_BUSY_MESSAGE', async () => {
+        const gate = new serve_hardening_1.TurnGate(1, 0); // one slot, no queue room
+        const held = await gate.acquire();
+        assert.ok(held, 'setup: hold the only slot');
+        let ran = false;
+        const emitter = fakeEmitter();
+        const result = await (0, serve_1.runGatewayTurn)(baseParams({
+            turnGate: gate,
+            emitter,
+            run: async () => { ran = true; return { success: true }; },
+        }));
+        assert.strictEqual(result.success, false);
+        assert.strictEqual(result.error, 'busy');
+        assert.strictEqual(ran, false);
+        assert.deepStrictEqual(emitter.texts, [serve_hardening_1.TURN_GATE_BUSY_MESSAGE]);
+        held();
+    });
+    test('per-session turn limiter rejects: run() never called, but the turn-gate slot is released', async () => {
+        const limiter = new serve_hardening_1.TurnLimiter(1);
+        limiter.tryConsume('session-1'); // exhaust the one slot for this session
+        const gate = new serve_hardening_1.TurnGate(1, 1);
+        let ran = false;
+        const emitter = fakeEmitter();
+        const result = await (0, serve_1.runGatewayTurn)(baseParams({
+            turnLimiter: limiter,
+            turnGate: gate,
+            emitter,
+            run: async () => { ran = true; return { success: true }; },
+        }));
+        assert.strictEqual(result.success, false);
+        assert.strictEqual(result.error, 'turn_limit');
+        assert.strictEqual(ran, false);
+        assert.deepStrictEqual(emitter.texts, [serve_hardening_1.TURN_LIMIT_BUSY_MESSAGE]);
+        // The turn-gate slot must be released even though the turn never ran.
+        assert.strictEqual(gate.inflight, 0);
+    });
+    test('all checks pass: run() executes and its result is returned; the gate slot releases after', async () => {
+        const gate = new serve_hardening_1.TurnGate(1, 1);
+        const result = await (0, serve_1.runGatewayTurn)(baseParams({
+            rateLimiter: new serve_hardening_1.RateLimiter(5),
+            turnLimiter: new serve_hardening_1.TurnLimiter(5),
+            turnGate: gate,
+            run: async () => ({ success: true, error: undefined }),
+        }));
+        assert.strictEqual(result.success, true);
+        assert.strictEqual(gate.inflight, 0, 'slot must be released after a successful turn');
+    });
+    test('run() throwing still releases the turn-gate slot', async () => {
+        const gate = new serve_hardening_1.TurnGate(1, 1);
+        await assert.rejects(() => (0, serve_1.runGatewayTurn)(baseParams({
+            rateLimiter: new serve_hardening_1.RateLimiter(5),
+            turnLimiter: new serve_hardening_1.TurnLimiter(5),
+            turnGate: gate,
+            run: async () => { throw new Error('boom'); },
+        })));
+        assert.strictEqual(gate.inflight, 0);
+    });
+    test('rate limit key and turn-limiter session key are independent buckets', async () => {
+        const rateLimiter = new serve_hardening_1.RateLimiter(1);
+        const turnLimiter = new serve_hardening_1.TurnLimiter(5);
+        // Exhaust the rate limiter for 'user-A' only.
+        rateLimiter.tryConsume('user-A');
+        const rejectedForA = await (0, serve_1.runGatewayTurn)(baseParams({
+            rateLimiter, turnLimiter, rlKey: 'user-A', sessionKey: 'sess-A',
+            run: async () => ({ success: true }),
+        }));
+        const okForB = await (0, serve_1.runGatewayTurn)(baseParams({
+            rateLimiter, turnLimiter, rlKey: 'user-B', sessionKey: 'sess-B',
+            run: async () => ({ success: true }),
+        }));
+        assert.strictEqual(rejectedForA.error, 'rate_limited', 'user-A already consumed its one slot in setup');
+        assert.strictEqual(okForB.success, true, 'user-B has an independent rate-limit bucket');
+    });
+    test('a missing emitter does not throw on rejection (channel-less callers are safe)', async () => {
+        const rl = new serve_hardening_1.RateLimiter(1);
+        rl.tryConsume('user-1');
+        const rejected = await (0, serve_1.runGatewayTurn)(baseParams({ rateLimiter: rl, emitter: undefined }));
+        assert.strictEqual(rejected.success, false);
+        assert.strictEqual(rejected.error, 'rate_limited');
+    });
+});
+suite('resolveGatewaySessionKey: never collapses two unidentified senders onto one key', () => {
+    test('prefers an explicit sessionId over everything else — durable, user-namespaced', () => {
+        const r = (0, serve_1.resolveGatewaySessionKey)({ sessionId: 'chat-42', gatewaySessionKey: 'gw-1' }, 'alice');
+        assert.strictEqual(r.sessionKey, `u${(0, serve_hardening_1.userNamespaceHash)('alice')}--chat-42`);
+        assert.strictEqual(r.outboundKey, 'chat-42', 'reply-handle routing must keep the raw gateway key');
+        assert.strictEqual(r.durable, true);
+    });
+    test('falls back to gatewaySessionKey when sessionId is absent — durable, user-namespaced', () => {
+        const r = (0, serve_1.resolveGatewaySessionKey)({ gatewaySessionKey: 'gw-1' }, 'alice');
+        assert.strictEqual(r.sessionKey, `u${(0, serve_hardening_1.userNamespaceHash)('alice')}--gw-1`);
+        assert.strictEqual(r.outboundKey, 'gw-1');
+        assert.strictEqual(r.durable, true);
+    });
+    test('the same explicit session id from two different senders never attaches to one engine session', () => {
+        const alice = (0, serve_1.resolveGatewaySessionKey)({ sessionId: 'chat-42' }, 'alice');
+        const bob = (0, serve_1.resolveGatewaySessionKey)({ sessionId: 'chat-42' }, 'bob');
+        assert.notStrictEqual(alice.sessionKey, bob.sessionKey);
+    });
+    test('an explicit session id with no resolved identity stays raw (dev/unidentified path)', () => {
+        const r = (0, serve_1.resolveGatewaySessionKey)({ sessionId: 'chat-42' }, undefined);
+        assert.strictEqual(r.sessionKey, 'chat-42');
+        assert.strictEqual(r.outboundKey, 'chat-42');
+        assert.strictEqual(r.durable, true);
+    });
+    test('with a resolved identity but no session id, keys off that identity — stable, durable, no collision risk', () => {
+        const r1 = (0, serve_1.resolveGatewaySessionKey)({}, 'slack:U0B6');
+        const r2 = (0, serve_1.resolveGatewaySessionKey)({}, 'slack:U0B6');
+        assert.strictEqual(r1.sessionKey, 'gateway-slack:U0B6');
+        assert.strictEqual(r1.sessionKey, r2.sessionKey, 'the same identified sender must get the same key across messages');
+        assert.strictEqual(r1.durable, true);
+    });
+    test('two different identified senders with no session id never collide', () => {
+        const alice = (0, serve_1.resolveGatewaySessionKey)({}, 'slack:alice');
+        const bob = (0, serve_1.resolveGatewaySessionKey)({}, 'slack:bob');
+        assert.notStrictEqual(alice.sessionKey, bob.sessionKey);
+    });
+    test('two genuinely unidentified senders (no userId, no session id) never collide — no shared "gateway-anon" bucket, and both flagged non-durable', () => {
+        const first = (0, serve_1.resolveGatewaySessionKey)({}, undefined);
+        const second = (0, serve_1.resolveGatewaySessionKey)({}, undefined);
+        assert.notStrictEqual(first.sessionKey, second.sessionKey, 'each unidentified message must get its own key, not a shared bucket');
+        assert.ok(first.sessionKey.startsWith('gateway-anon-'));
+        assert.ok(second.sessionKey.startsWith('gateway-anon-'));
+        assert.strictEqual(first.durable, false);
+        assert.strictEqual(second.durable, false);
+    });
+    test('whitespace-only sessionId/gatewaySessionKey are treated as absent', () => {
+        const r = (0, serve_1.resolveGatewaySessionKey)({ sessionId: '   ', gatewaySessionKey: '  ' }, 'alice');
+        assert.strictEqual(r.sessionKey, 'gateway-alice');
+        assert.strictEqual(r.durable, true);
+    });
+});
+suite('runGatewayTurn: trackSession=false skips the TurnLimiter for one-off keys', () => {
+    test('a never-repeated key would never hit its own cap anyway — trackSession:false just skips the dead-weight tracking', async () => {
+        const limiter = new serve_hardening_1.TurnLimiter(1);
+        let ran = false;
+        const result = await (0, serve_1.runGatewayTurn)(baseParams({
+            turnLimiter: limiter,
+            sessionKey: 'gateway-anon-unique-1',
+            trackSession: false,
+            run: async () => { ran = true; return { success: true }; },
+        }));
+        assert.strictEqual(result.success, true);
+        assert.strictEqual(ran, true);
+        assert.strictEqual(limiter.tryConsume('gateway-anon-unique-1'), true, 'trackSession:false must never call tryConsume — the key should still have its full budget');
+    });
+    test('trackSession:true (default) still enforces the cap as before', async () => {
+        const limiter = new serve_hardening_1.TurnLimiter(1);
+        limiter.tryConsume('sess-durable'); // exhaust the one slot
+        let ran = false;
+        const emitter = fakeEmitter();
+        const result = await (0, serve_1.runGatewayTurn)(baseParams({
+            turnLimiter: limiter,
+            sessionKey: 'sess-durable',
+            emitter,
+            run: async () => { ran = true; return { success: true }; },
+        }));
+        assert.strictEqual(result.success, false);
+        assert.strictEqual(result.error, 'turn_limit');
+        assert.strictEqual(ran, false);
+    });
+});

package/out/test/serve-hardening.test.js

@@ -63,6 +63,49 @@ suite('serve-hardening: resolveStateDir', () => {
         assert.ok(r.dir.startsWith(os.tmpdir()));
     });
 });
+suite('serve-hardening: resolveAnalyticsSessionsDir', () => {
+    // getAgentideHome() reads process.env directly (not injectable), so tests that need it to
+    // resolve deterministically save/restore the real env vars around themselves.
+    const saved = {};
+    setup(() => {
+        saved.AGENT_HOME_DIR = process.env.AGENT_HOME_DIR;
+        saved.AGENTHIPPO_HOME = process.env.AGENTHIPPO_HOME;
+        delete process.env.AGENT_HOME_DIR;
+        delete process.env.AGENTHIPPO_HOME;
+    });
+    teardown(() => {
+        if (saved.AGENT_HOME_DIR === undefined) {
+            delete process.env.AGENT_HOME_DIR;
+        }
+        else {
+            process.env.AGENT_HOME_DIR = saved.AGENT_HOME_DIR;
+        }
+        if (saved.AGENTHIPPO_HOME === undefined) {
+            delete process.env.AGENTHIPPO_HOME;
+        }
+        else {
+            process.env.AGENTHIPPO_HOME = saved.AGENTHIPPO_HOME;
+        }
+    });
+    test('AGENTHIPPO_HOME set → uses getAgentideHome(), not stateDir (stays discoverable to Spotlight/DuckDB)', () => {
+        process.env.AGENTHIPPO_HOME = '/data/.agent-hippo';
+        const dir = (0, serve_hardening_1.resolveAnalyticsSessionsDir)('/data/.agent-hippo/serve-state', false, { AGENTHIPPO_HOME: '/data/.agent-hippo' });
+        assert.strictEqual(dir, path.join('/data/.agent-hippo', 'analytics', 'sessions'));
+    });
+    test('AGENT_HOME_DIR set → same precedence as AGENTHIPPO_HOME', () => {
+        process.env.AGENT_HOME_DIR = '/data/.agent-hippo';
+        const dir = (0, serve_hardening_1.resolveAnalyticsSessionsDir)('/data/.agent-hippo/serve-state', false, { AGENT_HOME_DIR: '/data/.agent-hippo' });
+        assert.strictEqual(dir, path.join('/data/.agent-hippo', 'analytics', 'sessions'));
+    });
+    test('no home-dir env var, explicit non-ephemeral --state-dir → uses stateDir (never regress durability for discoverability)', () => {
+        const dir = (0, serve_hardening_1.resolveAnalyticsSessionsDir)('/mnt/durable-vol', false, {});
+        assert.strictEqual(dir, path.join('/mnt/durable-vol', 'analytics', 'sessions'));
+    });
+    test('no home-dir env var, ephemeral state (nothing durable configured) → falls back to getAgentideHome() default', () => {
+        const dir = (0, serve_hardening_1.resolveAnalyticsSessionsDir)(path.join(os.tmpdir(), 'agenthippo-server'), true, {});
+        assert.strictEqual(dir, path.join(os.homedir(), '.agent-hippo', 'analytics', 'sessions'));
+    });
+});
 suite('serve-hardening: resolveBindHost', () => {
     test('defaults to loopback', () => {
         assert.strictEqual((0, serve_hardening_1.resolveBindHost)(undefined, {}), serve_hardening_1.DEFAULT_BIND_HOST);
@@ -297,3 +340,40 @@ suite('serve-hardening: readBodyWithCap', () => {
         assert.strictEqual(serve_hardening_1.DEFAULT_MAX_BODY_BYTES, 1024 * 1024);
     });
 });
+suite('serve-hardening: resolveServeSessionKey (secure-obo-design §3.4 Phase 0)', () => {
+    const PINNED = { AGENTHIPPO_IDENTITY_HEADER: 'x-forwarded-email' };
+    test('verified user + session_id → user-namespaced key', () => {
+        const r = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', 'alice@corp.com', PINNED);
+        assert.strictEqual(r.sessionKey, `u${(0, serve_hardening_1.userNamespaceHash)('alice@corp.com')}--chat-1`);
+        assert.strictEqual(r.rejected, undefined);
+    });
+    test('two users presenting the SAME session_id can never share a key (the defect this closes)', () => {
+        const a = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', 'alice@corp.com', PINNED);
+        const b = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', 'bob@corp.com', PINNED);
+        assert.notStrictEqual(a.sessionKey, b.sessionKey);
+    });
+    test('verified user without session_id → stable per-user default key', () => {
+        const r1 = (0, serve_hardening_1.resolveServeSessionKey)(undefined, 'alice@corp.com', PINNED);
+        const r2 = (0, serve_hardening_1.resolveServeSessionKey)('', 'alice@corp.com', PINNED);
+        assert.strictEqual(r1.sessionKey, r2.sessionKey);
+        assert.strictEqual(r1.sessionKey, `u${(0, serve_hardening_1.userNamespaceHash)('alice@corp.com')}--default`);
+    });
+    test('pinned identity + session_id but NO verified user → fail closed', () => {
+        const r = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', undefined, PINNED);
+        assert.strictEqual(r.rejected, serve_hardening_1.SESSION_WITHOUT_USER_REASON);
+    });
+    test('unpinned (local dev) keeps raw session_id behavior', () => {
+        const r = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', undefined, {});
+        assert.strictEqual(r.sessionKey, 'chat-1');
+        assert.strictEqual(r.rejected, undefined);
+    });
+    test('unpinned, no user, no session_id → legacy anon bucket', () => {
+        const r = (0, serve_hardening_1.resolveServeSessionKey)(undefined, undefined, {});
+        assert.strictEqual(r.sessionKey, 'anon-unknown');
+    });
+    test('the key never embeds the raw user id (emails are not path segments)', () => {
+        const r = (0, serve_hardening_1.resolveServeSessionKey)('s', 'alice@corp.com', PINNED);
+        assert.ok(!r.sessionKey.includes('alice@corp.com'));
+        assert.ok(!r.sessionKey.includes('@'));
+    });
+});

package/out/test/serveClient.test.js

@@ -173,4 +173,36 @@ suite('ServeClient', () => {
             });
         });
     });
+    test('streamRemoteServeChat surfaces fail-closed credential rejection as HTTP error (not silent success)', async () => {
+        // Mirrors serve.ts after the fix: warrant denial happens BEFORE SSE writeHead(200),
+        // so the client sees a real non-2xx JSON error instead of 200 + raw body fallthrough.
+        const server = http.createServer((_req, res) => {
+            res.writeHead(500, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({
+                error: 'OBO data token present without a verified user in request scope (fail-closed: token_without_verified_user)',
+            }));
+        });
+        await new Promise((resolve, reject) => {
+            server.listen(0, '127.0.0.1', async () => {
+                try {
+                    const address = server.address();
+                    if (!address || typeof address === 'string') {
+                        throw new Error('bad address');
+                    }
+                    const emitter = createCaptureEmitter();
+                    const result = await (0, serveClient_js_1.streamRemoteServeChat)({ baseUrl: `http://127.0.0.1:${address.port}`, message: 'ping' }, emitter);
+                    assert.strictEqual(result.ok, false);
+                    assert.match(result.error ?? '', /token_without_verified_user/);
+                    assert.deepStrictEqual(emitter.events.map((e) => e.type), ['error', 'done']);
+                    resolve();
+                }
+                catch (err) {
+                    reject(err);
+                }
+                finally {
+                    server.close();
+                }
+            });
+        });
+    });
 });

package/out/test/state-sync-peer.test.js

@@ -88,7 +88,7 @@ suite('state-sync: stage + merge session dirs', () => {
         fs.rmSync(tmp, { recursive: true, force: true });
         (0, state_sync_1.clearRestoreAttemptCache)();
     });
-    test('stages only matching provider-session shards + agents', async () => {
+    test('stages only matching provider-session shards; the shared agents/ SDK cache is never staged', async () => {
         const ps = path.join(tmp, 'provider-sessions');
         fs.mkdirSync(ps, { recursive: true });
         const key1 = 'claude:sess-a:pack:sig';
@@ -97,6 +97,8 @@ suite('state-sync: stage + merge session dirs', () => {
         const f2 = (0, state_sync_1.providerSessionShardName)(key2);
         fs.writeFileSync(path.join(ps, f1), JSON.stringify({ key: key1, value: { chatSessionId: 'sess-a', id: 'n1' } }));
         fs.writeFileSync(path.join(ps, f2), JSON.stringify({ key: key2, value: { chatSessionId: 'sess-b', id: 'n2' } }));
+        // agents/ holds the SDK's own cache, shared across every session/user of this pack
+        // on the replica — must never be swept into a single session's staging tree.
         fs.mkdirSync(path.join(tmp, 'agents', 'pack', 'claude'), { recursive: true });
         fs.writeFileSync(path.join(tmp, 'agents', 'pack', 'claude', 'marker'), 'x');
         const staging = path.join(tmp, 'staging');
@@ -104,22 +106,33 @@ suite('state-sync: stage + merge session dirs', () => {
         assert.strictEqual(ok, true);
         assert.ok(fs.existsSync(path.join(staging, 'provider-sessions', f1)));
         assert.ok(!fs.existsSync(path.join(staging, 'provider-sessions', f2)));
-        assert.ok(fs.existsSync(path.join(staging, 'agents', 'pack', 'claude', 'marker')));
+        assert.ok(!fs.existsSync(path.join(staging, 'agents')), 'agents/ must not be staged into a per-session push');
         const shards = await (0, state_sync_1.listSessionShardFiles)(tmp, 'sess-a');
         assert.deepStrictEqual(shards, [f1]);
         assert.strictEqual(await (0, state_sync_1.hasLocalSessionState)(tmp, 'sess-a'), true);
         assert.strictEqual(await (0, state_sync_1.hasLocalSessionState)(tmp, 'sess-missing'), false);
     });
-    test('mergeSessionStagingIntoState copies shards and agents', async () => {
+    test('a session with no shards but a live agents/ dir has nothing to push', async () => {
+        fs.mkdirSync(path.join(tmp, 'agents', 'pack', 'claude'), { recursive: true });
+        fs.writeFileSync(path.join(tmp, 'agents', 'pack', 'claude', 'marker'), 'x');
+        const staging = path.join(tmp, 'staging');
+        const ok = await (0, state_sync_1.stageSessionPushDir)(tmp, 'sess-none', staging);
+        assert.strictEqual(ok, false, 'agents/ content alone must not count as this session having content to push');
+    });
+    test('mergeSessionStagingIntoState copies shards only; never touches the destination agents/ dir', async () => {
         const staging = path.join(tmp, 'from');
         const dest = path.join(tmp, 'to');
         fs.mkdirSync(path.join(staging, 'provider-sessions'), { recursive: true });
         fs.writeFileSync(path.join(staging, 'provider-sessions', 'abc.json'), JSON.stringify({ key: 'claude:s1:p:s', value: { chatSessionId: 's1' } }));
+        // Simulate a stale staging tree that (pre-fix) would have carried an old agents/
+        // snapshot — restoring it must not force-overwrite another session's live SDK cache.
         fs.mkdirSync(path.join(staging, 'agents', 'p'), { recursive: true });
-        fs.writeFileSync(path.join(staging, 'agents', 'p', 'f'), '1');
+        fs.writeFileSync(path.join(staging, 'agents', 'p', 'f'), 'stale');
+        fs.mkdirSync(path.join(dest, 'agents', 'p'), { recursive: true });
+        fs.writeFileSync(path.join(dest, 'agents', 'p', 'f'), 'live-for-another-session');
         await (0, state_sync_1.mergeSessionStagingIntoState)(staging, dest);
         assert.ok(fs.existsSync(path.join(dest, 'provider-sessions', 'abc.json')));
-        assert.ok(fs.existsSync(path.join(dest, 'agents', 'p', 'f')));
+        assert.strictEqual(fs.readFileSync(path.join(dest, 'agents', 'p', 'f'), 'utf8'), 'live-for-another-session', 'the live agents/ dir must survive a restore of an unrelated staging tree untouched');
     });
 });
 suite('peerToUserId (#4 — channel sender → per-user id)', () => {

package/out/utils.js

@@ -55,6 +55,7 @@ exports.shortSig = shortSig;
 exports.isLocalHttps = isLocalHttps;
 exports.applyLocalTlsBypass = applyLocalTlsBypass;
 exports.getOverrideOpenAIBaseUrl = getOverrideOpenAIBaseUrl;
+exports.inferModelProvider = inferModelProvider;
 exports.resolveApiRouting = resolveApiRouting;
 exports.getExplicitConfigValue = getExplicitConfigValue;
 exports.getAgentideEngineSettings = getAgentideEngineSettings;
@@ -651,20 +652,35 @@ function getOverrideOpenAIBaseUrl(baseUrl, configProvider) {
     }
     return undefined;
 }
+/** Infer the direct provider from a model id — used by engines (e.g. custom) that aren't pinned to one vendor. */
+function inferModelProvider(modelId) {
+    return modelId && /claude|anthropic/i.test(modelId) ? 'anthropic' : 'openai';
+}
 /**
- * Resolve API key and base URL based on LiteLLM routing configuration.
- * Handles fallback to global litellm* settings when useLiteLLM is true.
- * Returns both baseUrl (for Claude/Anthropic) and openaiBaseUrl (with overrideOpenAIBaseUrl applied for Codex).
+ * Resolve the API key + base URL for a turn by the DESTINATION it dials, not a global
+ * precedence over provider keys.
+ *
+ *   - LiteLLM proxy selected (`useLiteLLM`)  → the LiteLLM key.
+ *   - direct                                 → the key for THIS engine's provider
+ *                                              (codex→openai, claude→anthropic; custom infers
+ *                                              from its model). Never the "other" provider's key.
+ *
+ * An explicit per-request `options.apiKey` (the IDE's single configured key) still wins — the
+ * per-provider `creds` are the headless/serve fallback that replaces the old
+ * `anthropic || openai` collapse (which sent, e.g., a codex turn to OpenAI with an Anthropic key).
  *
- * @param options - Agent request options
- * @param litellmApiKey - Fallback LiteLLM API key
- * @param litellmBaseUrl - Fallback LiteLLM base URL
- * @param configProvider - Optional config provider for resolving overrides
+ * @param options - Agent request options (carries an optional explicit apiKey / baseUrl / useLiteLLM)
+ * @param creds - Per-destination credentials (EngineConfig satisfies this)
+ * @param provider - The engine's direct provider, used only when NOT routing through LiteLLM
+ * @param configProvider - Optional config provider for resolving overrideOpenAIBaseUrl
  */
-function resolveApiRouting(options, litellmApiKey, litellmBaseUrl, configProvider) {
+function resolveApiRouting(options, creds, provider, configProvider) {
     const useLiteLLM = options.useLiteLLM === true;
-    const baseUrl = options.baseUrl || (useLiteLLM ? litellmBaseUrl : undefined);
-    const liteLLMResolvedApiKey = options.apiKey || litellmApiKey || 'sk-dummy';
+    const baseUrl = options.baseUrl || (useLiteLLM ? creds.litellmBaseUrl : undefined);
+    const directKey = provider === 'anthropic' ? creds.anthropicApiKey : creds.openaiApiKey;
+    const resolvedApiKey = useLiteLLM
+        ? (options.apiKey || creds.litellmApiKey || 'sk-dummy')
+        : (options.apiKey || directKey || '');
     // For OpenAI-compatible endpoints, check for per-provider overrideOpenAIBaseUrl
     let openaiBaseUrl = baseUrl;
     if (baseUrl) {
@@ -674,7 +690,7 @@ function resolveApiRouting(options, litellmApiKey, litellmBaseUrl, configProvide
         }
     }
     return {
-        apiKey: useLiteLLM ? liteLLMResolvedApiKey : (options.apiKey || ''),
+        apiKey: resolvedApiKey,
         baseUrl,
         openaiBaseUrl,
         useLiteLLM,