@agenthippo-ai/agenthippo 0.1.1 → 0.2.3-dataplane

package/out/mcp.js

@@ -36,14 +36,14 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AGENTHIPPO_MCP_SERVERS_ENV = exports.AGENTHIPPO_DATA_TOKEN_FILE_ENV = void 0;
+exports.AGENTHIPPO_MCP_SERVERS_ENV = exports.ALLOW_INLINE_DATA_TOKEN_ENV = void 0;
 exports.loadMcpServers = loadMcpServers;
 exports.resolveMcpEnvVar = resolveMcpEnvVar;
-exports.mcpConfigCacheSignatureSuffix = mcpConfigCacheSignatureSuffix;
 exports.resolveMcpServerEnv = resolveMcpServerEnv;
 exports.generateCodexMcpConfig = generateCodexMcpConfig;
 exports.getDefaultMcpConfig = getDefaultMcpConfig;
 exports.loadBundledMcpServers = loadBundledMcpServers;
+exports.resolveHttpMcpHeaders = resolveHttpMcpHeaders;
 exports.formatInlineMcpServers = formatInlineMcpServers;
 exports.serializeInlineMcpServers = serializeInlineMcpServers;
 exports.parseInlineMcpServers = parseInlineMcpServers;
@@ -64,11 +64,16 @@ const MCP_CONFIG_FILE = '.mcp.json';
 /** MCP servers subdirectory in base-prompts */
 const MCP_SERVERS_DIR = 'mcp-servers';
 /**
- * Env var passed to stdio MCP child processes: path to the per-turn data credential
- * file (OBO token, etc.). MCP servers read this file on each tool call — spawn env
- * is fixed at process start and cannot use AsyncLocalStorage.
+ * Explicit local-dev opt-in: allow the per-turn data credential to be resolved INLINE into
+ * MCP child env / `${credential:dataToken}` placeholders. Off by default — in any real
+ * deployment the credential must stay in the broker and reach tools only via the loopback
+ * data-plane gateway + turn nonce (secure-obo-design §2). Without this flag, a credential-
+ * backed value resolves to nothing and the pack's connector fails closed with its own error.
  */
-exports.AGENTHIPPO_DATA_TOKEN_FILE_ENV = 'AGENTHIPPO_DATA_TOKEN_FILE';
+exports.ALLOW_INLINE_DATA_TOKEN_ENV = 'AGENTHIPPO_ALLOW_INLINE_DATA_TOKEN';
+function inlineDataTokenAllowed() {
+    return /^(1|true)$/i.test(process.env[exports.ALLOW_INLINE_DATA_TOKEN_ENV]?.trim() ?? '');
+}
 const ENV_PLACEHOLDER = /\$\{env:(\w+)\}/g;
 const CREDENTIAL_PLACEHOLDER = /\$\{credential:(\w+)\}/g;
 // -----------------------------------------------------------------------------
@@ -146,14 +151,23 @@ async function resolveServerEntry(name, entry, mcpDir, bundledMcpDir, envSources
     }
     // HTTP Streamable MCP server — no subprocess needed
     if (entry.url) {
+        // `${env:VAR}` in the URL resolves against the serve process env (e.g. the
+        // boot-stable AGENTHIPPO_DATA_MCP_URL of the loopback data-plane gateway).
+        const url = entry.url.replace(ENV_PLACEHOLDER, (_, varName) => resolvePlainEnvVar(varName, envSources)).trim();
+        if (!url) {
+            // Placeholder didn't resolve (e.g. gateway-backed entry loaded outside serve):
+            // drop the server rather than hand engines a broken empty-URL entry.
+            return null;
+        }
         return {
             name,
             label: entry.label ?? name,
             description: entry.description,
             command: '',
             args: [],
-            url: entry.url,
+            url,
             headers: resolveHeaders(entry.headers, envSources),
+            bearerTokenEnv: entry.bearerTokenEnv?.trim() || undefined,
         };
     }
     // Custom stdio server - resolve relative paths from mcpDir
@@ -255,89 +269,63 @@ function resolveArgs(args, serverDir) {
 /**
  * Resolve a single ${env:VAR} reference for MCP child processes.
  *
- * The turn's OBO data token is exposed two ways:
+ * The turn's OBO data token is exposed two ways, BOTH gated behind the explicit
+ * local-dev opt-in {@link ALLOW_INLINE_DATA_TOKEN_ENV}:
  *   - `${credential:dataToken}` placeholder (pack-author-facing; handled in resolveEnv).
- *   - A configurable set of env-var aliases (default `DATABRICKS_TOKEN`) for packs that
- *     reference the token via `${env:VAR}` directly. Override the alias list with the
- *     `AGENTHIPPO_DATA_TOKEN_ENV_VARS` env var (comma-separated) — keeps this helper
- *     vendor-neutral instead of hardcoding one provider's token name.
+ *   - A configurable set of env-var aliases for packs that reference the token via
+ *     `${env:VAR}` directly (`AGENTHIPPO_DATA_TOKEN_ENV_VARS`, comma-separated; empty
+ *     by default — inline aliasing must be declared, never ambient).
  *
- * When a turn-scoped data token file exists, the token is NOT baked into spawn env —
- * MCP servers read it from AGENTHIPPO_DATA_TOKEN_FILE on each tool call instead.
+ * In a real deployment neither fires: the credential stays in the broker and tools reach
+ * it via the loopback data-plane gateway + turn nonce (secure-obo-design §3).
  */
 function resolveMcpEnvVar(varName, envSources = {}) {
-    const cred = (0, credential_context_1.currentCredential)();
-    const tokenFile = cred?.dataTokenFile;
     const aliases = getDataTokenEnvAliases();
-    const isDataTokenVar = varName === 'dataToken' || aliases.includes(varName);
-    if (tokenFile && isDataTokenVar) {
-        // Token lives in the per-turn file (AGENTHIPPO_DATA_TOKEN_FILE); never bake the OBO token
-        // into spawn env. The explicit ${credential:dataToken} placeholder resolves to empty
-        // (AgentHippo-aware servers read the file). A plain ${env:ALIAS} reference falls through to
-        // any operator-provided ambient value so a stock server that reads the var directly still
-        // works, instead of being clobbered to an empty string.
-        if (varName === 'dataToken') {
-            return '';
-        }
-        return process.env[varName] ?? envSources[varName] ?? '';
-    }
     if (varName === 'dataToken') {
-        return cred?.dataToken?.trim() ?? '';
+        const tok = (0, credential_context_1.currentCredential)()?.dataToken?.trim();
+        return tok && inlineDataTokenAllowed() ? tok : '';
     }
-    if (cred?.dataToken?.trim() && aliases.includes(varName)) {
-        return cred.dataToken.trim();
+    if (aliases.includes(varName)) {
+        const tok = (0, credential_context_1.currentCredential)()?.dataToken?.trim();
+        if (tok && inlineDataTokenAllowed()) {
+            return tok;
+        }
     }
     return process.env[varName] ?? envSources[varName] ?? '';
 }
 /**
  * Env-var names that resolve to the turn's OBO data token when a pack references
- * `${env:VAR}` directly. Defaults to `DATABRICKS_TOKEN`; override at deploy time via
- * `AGENTHIPPO_DATA_TOKEN_ENV_VARS=VAR1,VAR2` (empty value → no aliases).
+ * `${env:VAR}` directly. Empty by default — set `AGENTHIPPO_DATA_TOKEN_ENV_VARS=VAR1,VAR2`
+ * (together with the inline opt-in) to enable. The old implicit `DATABRICKS_TOKEN` default
+ * was removed with the disk token path: inline credential exposure is now always explicit.
  */
 function getDataTokenEnvAliases() {
     const raw = process.env.AGENTHIPPO_DATA_TOKEN_ENV_VARS;
     if (raw !== undefined) {
         return raw.split(',').map((v) => v.trim()).filter(Boolean);
     }
-    return ['DATABRICKS_TOKEN'];
+    return [];
 }
 function envValueUsesCredentialDataToken(value) {
     return /\$\{credential:dataToken\}/.test(value);
 }
-/** Suffix for Codex config.toml cache invalidation when MCP credential scope changes. */
-function mcpConfigCacheSignatureSuffix() {
-    const cred = (0, credential_context_1.currentCredential)();
-    const aliases = getDataTokenEnvAliases();
-    if (cred?.dataTokenFile) {
-        return `file:${cred.dataTokenFile}:aliases=${aliases.join(',')}`;
-    }
-    if (cred?.dataToken?.trim()) {
-        return `inline-token:aliases=${aliases.join(',')}`;
-    }
-    return `no-token:aliases=${aliases.join(',')}`;
-}
 function resolveEnv(env, envSources = {}) {
     if (!env) {
         return undefined;
     }
     const resolved = {};
-    const tokenFile = (0, credential_context_1.currentCredential)()?.dataTokenFile;
-    if (tokenFile) {
-        resolved[exports.AGENTHIPPO_DATA_TOKEN_FILE_ENV] = tokenFile;
-    }
     for (const [key, value] of Object.entries(env)) {
         CREDENTIAL_PLACEHOLDER.lastIndex = 0;
         if (envValueUsesCredentialDataToken(value)) {
-            // Credential-backed secret. When a per-turn token file exists, the key is intentionally
-            // NOT set here: the MCP server reads the token from AGENTHIPPO_DATA_TOKEN_FILE
-            // (injected above) on each tool call, so baking it into spawn env would be redundant
-            // and would leak the turn-scoped token into the long-lived child process env.
-            // Prefer the OBO token file, then inline token, then env fallback.
-            if (tokenFile) {
-                // AGENTHIPPO_DATA_TOKEN_FILE already injected above; don't bake the token here.
-            }
-            else if ((0, credential_context_1.currentCredential)()?.dataToken?.trim()) {
-                resolved[key] = (0, credential_context_1.currentCredential)().dataToken.trim();
+            // Credential-backed secret. Baked into spawn env ONLY behind the explicit
+            // local-dev opt-in — the supported transport is the data-plane gateway, where
+            // the credential never leaves the broker process (secure-obo-design §2).
+            const tok = (0, credential_context_1.currentCredential)()?.dataToken?.trim();
+            if (tok) {
+                if (inlineDataTokenAllowed()) {
+                    resolved[key] = tok;
+                }
+                // else: intentionally unset — the connector fails closed with its own error.
             }
             else {
                 // No OBO credential (local dev / non-serve context): fall back to env var.
@@ -436,12 +424,14 @@ function generateCodexMcpConfig(servers, options) {
     if (servers.length === 0) {
         return '';
     }
-    // `default_tools_approval_mode = "auto"` is the documented Codex 0.122+ per-server key
-    // (values: auto/prompt/approve) that lets MCP tools run without an interactive prompt.
+    // `default_tools_approval_mode = "approve"` is the Codex per-server key that lets MCP
+    // tools run without an interactive prompt. The value enum is prompt|approve — "auto" is
+    // NOT valid: Codex ≥0.131 silently ignores it, defaults the server to `prompt`, and a
+    // headless `codex exec` turn then auto-Cancels the approval elicitation, surfacing as
+    // "user cancelled MCP tool call" on every tool call (verified live against 0.131.0).
     // Only emit it in headless/serve auto-approve contexts — the interactive IDE path leaves
-    // it unset so users get Codex's normal approval prompts. The previous `approval_mode =
-    // "never"` was an invalid key/value and was silently ignored by the Codex CLI.
-    const approvalLine = options?.autoApprove ? 'default_tools_approval_mode = "auto"' : undefined;
+    // it unset so users get Codex's normal approval prompts.
+    const approvalLine = options?.autoApprove ? 'default_tools_approval_mode = "approve"' : undefined;
     const sections = servers.map(s => {
         // HTTP Streamable MCP server — codex connects via URL, no subprocess
         if (s.url) {
@@ -449,6 +439,13 @@ function generateCodexMcpConfig(servers, options) {
                 `[mcp_servers.${s.name}]`,
                 `url = ${JSON.stringify(s.url)}`,
             ];
+            if (s.bearerTokenEnv) {
+                // The auth token is read from the codex PROCESS env at request time
+                // (per-spawn codexEnv carries the turn nonce) — the config file itself
+                // stays byte-identical across turns, which is what removes the
+                // cross-user config.toml race (secure-obo-design §3.2).
+                urlLines.push(`bearer_token_env_var = ${JSON.stringify(s.bearerTokenEnv)}`);
+            }
             if (s.headers && Object.keys(s.headers).length > 0) {
                 const headerEntries = Object.entries(s.headers)
                     .map(([k, v]) => `${JSON.stringify(k)} = ${JSON.stringify(v)}`)
@@ -541,6 +538,23 @@ async function loadBundledMcpServers(basePromptsDir) {
 }
 /** Env var carrying JSON-serialized {@link InlineMcpServers} into custom engine workers. */
 exports.AGENTHIPPO_MCP_SERVERS_ENV = 'AGENTHIPPO_MCP_SERVERS';
+/**
+ * Resolve the final HTTP headers for a URL-based MCP server, applying `bearerTokenEnv`
+ * against the ENGINE'S per-turn env (process.env + per-spawn patch). Engines that build
+ * their MCP config in memory per turn (claude, custom) call this with the same env they
+ * hand the engine subprocess, so the turn nonce lands in the request header without ever
+ * touching a shared file.
+ */
+function resolveHttpMcpHeaders(server, turnEnv) {
+    const headers = { ...(server.headers ?? {}) };
+    if (server.bearerTokenEnv) {
+        const token = turnEnv[server.bearerTokenEnv]?.trim();
+        if (token) {
+            headers['Authorization'] = `Bearer ${token}`;
+        }
+    }
+    return Object.keys(headers).length > 0 ? headers : undefined;
+}
 /**
  * Convert resolved pack MCP servers to the inline record shape engines consume.
  *
@@ -548,15 +562,19 @@ exports.AGENTHIPPO_MCP_SERVERS_ENV = 'AGENTHIPPO_MCP_SERVERS';
  * `{ type: 'http', url, headers? }` — the Cursor SDK (`@cursor/sdk` McpServerConfig) accepts
  * this shape inline, so remote MCP servers are available to cursor/custom engines, not just
  * to the Codex engine (which gets them via config.toml).
+ *
+ * `turnEnv` (when provided) resolves each URL server's `bearerTokenEnv` into a concrete
+ * Authorization header — pass the same env the engine subprocess will receive.
  */
-function formatInlineMcpServers(servers) {
+function formatInlineMcpServers(servers, turnEnv) {
     const mcpServers = {};
     for (const server of servers) {
         if (server.url) {
+            const headers = resolveHttpMcpHeaders(server, turnEnv ?? process.env);
             mcpServers[server.name] = {
                 type: 'http',
                 url: server.url,
-                ...(server.headers && Object.keys(server.headers).length > 0 ? { headers: server.headers } : {}),
+                ...(headers ? { headers } : {}),
             };
             continue;
         }

package/out/scripts/analytics/agentide-litellm-otel.config.yaml

@@ -158,3 +158,17 @@ model_list:
       api_base: https://api.openai.com/v1
     model_info:
       upstream_provider: "openai"
+
+  # Fleet / Cloud Run: ah-auto resolves via the central AgentHippo model gateway (same as
+  # colocated agents with AGENTHIPPO_LITELLM_BASE_URL=https://gateway.agenthippo.ai/v1).
+  # Set AGENTHIPPO_GATEWAY_KEY to an ahgw_… service key (create-gateway-key on the gateway host).
+  - model_name: ah-auto
+    litellm_params:
+      # openai/ prefix required — bare `ah-auto` fails LiteLLM router deployment (no provider).
+      model: openai/ah-auto
+      api_base: https://gateway.agenthippo.ai/v1
+      api_key: os.environ/AGENTHIPPO_GATEWAY_KEY
+      drop_params: true
+      additional_drop_params: ["user", "max_output_tokens", "reasoning.effort", "reasoning_effort"]
+    model_info:
+      upstream_provider: "agenthippo-gateway"

package/out/shared/models.js

@@ -25,7 +25,7 @@ exports.BUILTIN_MODELS = [
     // ===========================================
     {
         id: 'ah-auto',
-        name: 'AH-Auto',
+        name: 'Auto',
         provider: 'agenthippo',
         contextWindow: 200000,
         maxOutputTokens: 8192,

package/out/shared/providers.js

@@ -73,7 +73,7 @@ exports.PROVIDERS = {
     },
     litellm: {
         id: 'litellm',
-        displayName: 'LiteLLM (Recommended)',
+        displayName: 'LiteLLM',
         endpointSettingKey: 'agentide.providers.litellm.baseUrl',
         requiresApiKey: true,
         description: 'local adapter for agents to work with Spotlight and all models from OpenAI, Anthropic, Ollama etc.',
@@ -96,7 +96,7 @@ exports.PROVIDERS = {
     agenthippo: {
         id: 'agenthippo',
         displayName: 'AgentHippo Gateway',
-        defaultEndpoint: 'https://api.agenthippo.ai/v1',
+        defaultEndpoint: 'https://gateway.agenthippo.ai/v1',
         endpointSettingKey: 'agentide.AgentHippoModelGateway.url',
         requiresApiKey: true,
         description: 'AgentHippo managed gateway — uses account JWT, picks model automatically',

package/out/test/analytics.test.js

@@ -43,7 +43,6 @@ const os = __importStar(require("os"));
 const fs_1 = require("fs");
 const base_1 = require("../engines/base");
 const sessionEvents_1 = require("../analytics/sessionEvents");
-const credential_context_1 = require("../cli/credential-context");
 async function createUniqueTempDir(prefix) {
     return fs_1.promises.mkdtemp(path.join(os.tmpdir(), prefix));
 }
@@ -524,7 +523,7 @@ suite('Analytics - ObservableStreamEmitter', () => {
     });
 });
 // =============================================================================
-// ObservableStreamEmitter + credential context (the "warrant" audit trail)
+// ObservableStreamEmitter warrant audit trail (constructor-captured userId)
 // =============================================================================
 suite('Analytics - ObservableStreamEmitter records the acting user (the warrant)', () => {
     let testDir;
@@ -556,37 +555,63 @@ suite('Analytics - ObservableStreamEmitter records the acting user (the warrant)
         const content = await fs_1.promises.readFile(path.join(testDir, `${sessionId}.jsonl`), 'utf8');
         return content.trim().split('\n').map((l) => JSON.parse(l));
     }
-    test('toolStart/toolEnd record userId when inside a runWithCredential scope', async () => {
-        const emitter = (0, sessionEvents_1.wrapEmitterWithObservability)(innerEmitter, writer, 'sess-warrant-1', 'req-1');
-        await (0, credential_context_1.runWithCredential)({ userId: 'priya@meridian.com' }, async () => {
-            await emitter.toolStart('Bash', 'echo hi', 'c1');
-            await emitter.toolEnd('Bash', 'c1', 'hi', false);
-        });
+    test('toolStart/toolEnd record the userId passed at wrap', async () => {
+        const emitter = (0, sessionEvents_1.wrapEmitterWithObservability)(innerEmitter, writer, 'sess-warrant-1', 'req-1', 'priya@meridian.com');
+        await emitter.toolStart('Bash', 'echo hi', 'c1');
+        await emitter.toolEnd('Bash', 'c1', 'hi', false);
         const events = await readEvents('sess-warrant-1');
         assert.strictEqual(events.length, 2);
         assert.strictEqual(events[0].payload.userId, 'priya@meridian.com');
         assert.strictEqual(events[1].payload.userId, 'priya@meridian.com');
     });
-    test('toolStart records no userId outside any credential scope (IDE-local usage)', async () => {
+    test('toolStart records no userId when wrap omitted it (IDE-local usage)', async () => {
         const emitter = (0, sessionEvents_1.wrapEmitterWithObservability)(innerEmitter, writer, 'sess-warrant-2', 'req-1');
         await emitter.toolStart('Bash', 'echo hi', 'c1');
         const events = await readEvents('sess-warrant-2');
         assert.strictEqual(events[0].payload.userId, undefined);
     });
-    test('two interleaved turns never attribute a tool call to the wrong user', async () => {
-        const emitter = (0, sessionEvents_1.wrapEmitterWithObservability)(innerEmitter, writer, 'sess-warrant-3', 'req-1');
+    test('two emitters never attribute a tool call to the wrong user', async () => {
+        const alice = (0, sessionEvents_1.wrapEmitterWithObservability)(innerEmitter, writer, 'sess-warrant-3', 'req-a', 'alice@acme.com');
+        const bob = (0, sessionEvents_1.wrapEmitterWithObservability)(innerEmitter, writer, 'sess-warrant-3', 'req-b', 'bob@acme.com');
         await Promise.all([
-            (0, credential_context_1.runWithCredential)({ userId: 'alice@acme.com' }, async () => {
+            (async () => {
                 await new Promise((r) => setTimeout(r, 5));
-                await emitter.toolStart('Bash', 'a', 'a1');
-            }),
-            (0, credential_context_1.runWithCredential)({ userId: 'bob@acme.com' }, async () => {
-                await emitter.toolStart('Bash', 'b', 'b1');
-            }),
+                await alice.toolStart('Bash', 'a', 'a1');
+            })(),
+            bob.toolStart('Bash', 'b', 'b1'),
         ]);
         const events = await readEvents('sess-warrant-3');
         const byCallId = Object.fromEntries(events.map((e) => [e.payload.callId, e.payload.userId]));
         assert.strictEqual(byCallId['a1'], 'alice@acme.com');
         assert.strictEqual(byCallId['b1'], 'bob@acme.com');
     });
+    test('toolStart/toolEnd keep wrap-time userId even when called outside any credential scope', async () => {
+        // Simulates the custom-engine persistent-worker path: wrap captures identity on the
+        // request continuation, then tool events fire later on a detached IPC callback with
+        // no ambient runWithCredential (or a sticky wrong one). Attribution must not depend
+        // on ambient AsyncLocalStorage at emit time.
+        const emitter = (0, sessionEvents_1.wrapEmitterWithObservability)(innerEmitter, writer, 'sess-warrant-4', 'req-1', 'alice@acme.com');
+        await emitter.toolStart('Bash', 'echo hi', 'c1');
+        await emitter.toolEnd('Bash', 'c1', 'hi', false);
+        const events = await readEvents('sess-warrant-4');
+        assert.strictEqual(events[0].payload.userId, 'alice@acme.com');
+        assert.strictEqual(events[1].payload.userId, 'alice@acme.com');
+    });
+    test('error/turn_start/turn_end also carry the wrap-time userId, not just tool events', async () => {
+        // A turn that errors before any tool call (or has no tool calls at all) must still
+        // carry identity attribution — the mechanism was already on the instance, it just
+        // wasn't threaded into these three payloads.
+        const emitter = (0, sessionEvents_1.wrapEmitterWithObservability)(innerEmitter, writer, 'sess-warrant-5', 'req-1', 'bob@acme.com');
+        await emitter.emitTurnStart();
+        await emitter.error('boom');
+        await emitter.emitTurnEnd(false);
+        const events = await readEvents('sess-warrant-5');
+        assert.strictEqual(events.length, 3);
+        assert.strictEqual(events[0].event_type, 'turn_start');
+        assert.strictEqual(events[0].payload.userId, 'bob@acme.com');
+        assert.strictEqual(events[1].event_type, 'error');
+        assert.strictEqual(events[1].payload.userId, 'bob@acme.com');
+        assert.strictEqual(events[2].event_type, 'turn_end');
+        assert.strictEqual(events[2].payload.userId, 'bob@acme.com');
+    });
 });

package/out/test/auth-broker.test.js

@@ -435,4 +435,57 @@ suite('AuthBroker', () => {
             await broker.close();
         }
     });
+    test('authorize rejects a redirect_uri outside the loopback/IDE-callback allow-list', async () => {
+        const broker = (0, server_js_1.createAuthBrokerServer)(testConfig(0));
+        await new Promise((resolve) => broker.server.listen(0, '127.0.0.1', resolve));
+        const address = broker.server.address();
+        if (!address || typeof address === 'string') {
+            throw new Error('bad listen address');
+        }
+        const baseUrl = `http://127.0.0.1:${address.port}`;
+        try {
+            const challenge = (0, pkce_js_1.codeChallengeFromVerifier)((0, pkce_js_1.generateCodeVerifier)());
+            // An attacker-controlled destination — must never receive an auth code (open-redirect /
+            // code-theft guard). Real clients only ever send the loopback or IDE-scheme callback.
+            const url = `${baseUrl}/oauth/authorize?client_id=${types_js_1.AUTH_CLIENT_ID}`
+                + `&redirect_uri=${encodeURIComponent('https://attacker.example/collect')}`
+                + `&code_challenge=${challenge}&code_challenge_method=S256&state=x&login_hint=dev@agenthippo.ai`;
+            const res = await fetch(url, { redirect: 'manual' });
+            assert.strictEqual(res.status, 400);
+            const body = await res.json();
+            assert.strictEqual(body.error, 'invalid_request');
+        }
+        finally {
+            await broker.close();
+        }
+    });
+    test('authorize accepts the loopback and IDE-scheme redirect_uri shapes real clients send', async () => {
+        const broker = (0, server_js_1.createAuthBrokerServer)(testConfig(0));
+        await new Promise((resolve) => broker.server.listen(0, '127.0.0.1', resolve));
+        const address = broker.server.address();
+        if (!address || typeof address === 'string') {
+            throw new Error('bad listen address');
+        }
+        const baseUrl = `http://127.0.0.1:${address.port}`;
+        try {
+            const redirectUris = [
+                'http://127.0.0.1:54123/callback', // CLI/IDE loopback callback (any OS-assigned port)
+                'vscode://agenthippo.agenthippo/auth/callback', // IDE URI-scheme callback
+            ];
+            for (const redirectUri of redirectUris) {
+                const challenge = (0, pkce_js_1.codeChallengeFromVerifier)((0, pkce_js_1.generateCodeVerifier)());
+                const url = `${baseUrl}/oauth/authorize?client_id=${types_js_1.AUTH_CLIENT_ID}`
+                    + `&redirect_uri=${encodeURIComponent(redirectUri)}`
+                    + `&code_challenge=${challenge}&code_challenge_method=S256&state=x&login_hint=dev@agenthippo.ai`;
+                const res = await fetch(url, { redirect: 'manual' });
+                assert.strictEqual(res.status, 302, `expected redirect for ${redirectUri}`);
+                const location = res.headers.get('location') || '';
+                assert.ok(location.startsWith(redirectUri), `location "${location}" should start with "${redirectUri}"`);
+                assert.ok(new URL(location).searchParams.get('code'), 'redirect carries an auth code');
+            }
+        }
+        finally {
+            await broker.close();
+        }
+    });
 });

package/out/test/blueprint-registry.test.js

@@ -0,0 +1,105 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Blueprint Registry Test Suite (PLAN/deploy.md §3, §7 d7-blueprint-registry)
+ *
+ *  Pure resolver tests: a blueprint (+ optional platform) must resolve to exactly the
+ *  --target/--ingress pair deploy-init.ts already renders correctly — these tests never
+ *  call deployCommand, so they can assert on the error paths too without a process.exit risk.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const registry_1 = require("../cli/deploy/blueprints/registry");
+suite('blueprint registry: isBlueprintId', () => {
+    test('recognizes every declared blueprint id', () => {
+        for (const id of registry_1.BLUEPRINT_IDS) {
+            assert.ok((0, registry_1.isBlueprintId)(id));
+        }
+    });
+    test('rejects unknown ids', () => {
+        assert.ok(!(0, registry_1.isBlueprintId)('enterprise'));
+        assert.ok(!(0, registry_1.isBlueprintId)(''));
+    });
+});
+suite('blueprint registry: resolveBlueprint', () => {
+    test('sandbox resolves to vm with no ingress', () => {
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('sandbox'), { target: 'vm' });
+    });
+    test('regulated-air-gapped resolves to vm with no ingress', () => {
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('regulated-air-gapped'), { target: 'vm' });
+    });
+    test('prospect-demo defaults to vm with edge ingress; compose is also supported', () => {
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('prospect-demo'), { target: 'vm', ingress: 'edge' });
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('prospect-demo', 'compose'), { target: 'compose', ingress: 'edge' });
+    });
+    test('enterprise-fleet always resolves to edge-fed, on any of its supported platforms', () => {
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('enterprise-fleet'), { target: 'cloudrun', ingress: 'edge-fed' });
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('enterprise-fleet', 'vm'), { target: 'vm', ingress: 'edge-fed' });
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('enterprise-fleet', 'compose'), { target: 'compose', ingress: 'edge-fed' });
+    });
+    test('team-pilot rides platform-native identity where one exists', () => {
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('team-pilot', 'cloudrun'), { target: 'cloudrun', ingress: 'iap' });
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('team-pilot', 'databricks-app'), { target: 'databricks-app' });
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('team-pilot', 'spcs'), { target: 'spcs' });
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('team-pilot', 'cloudflare'), { target: 'cloudflare' });
+    });
+    test('team-pilot falls back to a self-issued edge on vm/compose/aws-ecs/azure-container-apps (no platform-native option there)', () => {
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('team-pilot', 'vm'), { target: 'vm', ingress: 'edge' });
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('team-pilot', 'compose'), { target: 'compose', ingress: 'edge' });
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('team-pilot', 'aws-ecs'), { target: 'aws-ecs', ingress: 'edge' });
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('team-pilot', 'azure-container-apps'), { target: 'azure-container-apps', ingress: 'edge' });
+    });
+    test('enterprise-fleet supports aws-ecs/azure-container-apps too', () => {
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('enterprise-fleet', 'aws-ecs'), { target: 'aws-ecs', ingress: 'edge-fed' });
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('enterprise-fleet', 'azure-container-apps'), { target: 'azure-container-apps', ingress: 'edge-fed' });
+    });
+    test('team-pilot with no --platform defaults to its first supported target (cloudrun, iap)', () => {
+        assert.deepStrictEqual((0, registry_1.resolveBlueprint)('team-pilot'), { target: 'cloudrun', ingress: 'iap' });
+    });
+    test('throws when --platform is outside the blueprint\'s supported set', () => {
+        assert.throws(() => (0, registry_1.resolveBlueprint)('sandbox', 'cloudrun'), /does not support --platform cloudrun/);
+        assert.throws(() => (0, registry_1.resolveBlueprint)('regulated-air-gapped', 'databricks-app'), /Supported: vm/);
+    });
+});
+suite('blueprint registry: BLUEPRINTS catalog', () => {
+    test('every blueprint declares at least one supported target and a description', () => {
+        for (const id of registry_1.BLUEPRINT_IDS) {
+            const def = registry_1.BLUEPRINTS[id];
+            assert.ok(def.targets.length > 0, `${id} must support at least one platform`);
+            assert.ok(def.description.trim().length > 0, `${id} must have a description`);
+        }
+    });
+});