@agenthippo-ai/agenthippo 0.1.1 → 1.110.9

package/out/shared/providers.js

@@ -73,7 +73,7 @@ exports.PROVIDERS = {
     },
     litellm: {
         id: 'litellm',
-        displayName: 'LiteLLM (Recommended)',
+        displayName: 'LiteLLM',
         endpointSettingKey: 'agentide.providers.litellm.baseUrl',
         requiresApiKey: true,
         description: 'local adapter for agents to work with Spotlight and all models from OpenAI, Anthropic, Ollama etc.',
@@ -96,7 +96,7 @@ exports.PROVIDERS = {
     agenthippo: {
         id: 'agenthippo',
         displayName: 'AgentHippo Gateway',
-        defaultEndpoint: 'https://api.agenthippo.ai/v1',
+        defaultEndpoint: 'https://gateway.agenthippo.ai/v1',
         endpointSettingKey: 'agentide.AgentHippoModelGateway.url',
         requiresApiKey: true,
         description: 'AgentHippo managed gateway — uses account JWT, picks model automatically',

package/out/spotlight/install.js

@@ -194,7 +194,13 @@ async function installSpotlightViewFromFiles(files, options) {
         if (!INSTALLABLE_ROOT_FILES.has(relPath) && !INSTALLABLE_PREFIXES.some(prefix => relPath.startsWith(prefix))) {
             continue;
         }
-        const destination = path.join(installDir, relPath);
+        // The prefix check above is on the raw string — "scripts/../../x" passes it. Resolve and
+        // require containment so a store bundle can never write outside its own install dir.
+        const resolvedInstallDir = path.resolve(installDir);
+        const destination = path.resolve(resolvedInstallDir, relPath);
+        if (!destination.startsWith(resolvedInstallDir + path.sep)) {
+            throw new Error(`Store bundle entry "${relPath}" escapes the install directory`);
+        }
         await fs_1.promises.mkdir(path.dirname(destination), { recursive: true });
         await fs_1.promises.writeFile(destination, content);
     }

package/out/store/index.js

@@ -25,6 +25,7 @@ exports.detectArtifactType = detectArtifactType;
 exports.isStoreUrl = isStoreUrl;
 exports.listStoreIndex = listStoreIndex;
 const utils_1 = require("../utils");
+const branding_1 = require("../branding");
 const github_1 = require("../agentpack/github");
 // Import shared types and utilities for local use
 const shared_1 = require("./shared");
@@ -158,28 +159,58 @@ async function getLatestStoreVersion(type, slug, includePrerelease = false) {
 const zlib_1 = require("zlib");
 /**
  * Parse a tar archive into a map of path → content.
+ *
+ * Long paths are the whole difficulty here. The ustar `name` field is 100 bytes, and anything
+ * longer is carried one of two other ways:
+ *
+ *   - ustar `prefix` (offset 345, 155 bytes): the real path is `prefix + "/" + name`.
+ *   - PAX extended header (typeflag 'x') or GNU LongName ('L'): a pseudo-entry whose BODY holds
+ *     the path for the entry that follows.
+ *
+ * Reading only the `name` field silently DROPPED every such file — a store install of a pack with
+ * deep skill directories quietly produced an incomplete pack, which is worse than failing, because
+ * nothing anywhere reported a problem. Found when a signed pack verified cryptographically but its
+ * digest did not match: the download was missing two files the signature covered.
  */
 function parseTar(data) {
     const files = new Map();
     let offset = 0;
+    /** Set by a PAX/GNU pseudo-entry, consumed by the next real entry. */
+    let pendingLongName;
+    const str = (buf) => buf.toString('utf-8').replace(/\0/g, '').trim();
     while (offset < data.length - 512) {
         const header = data.subarray(offset, offset + 512);
         if (header.every(b => b === 0)) {
             break;
         }
-        const name = header.subarray(0, 100).toString('utf-8').replace(/\0/g, '').trim();
-        const sizeOctal = header.subarray(124, 136).toString('utf-8').replace(/\0/g, '').trim();
+        const name = str(header.subarray(0, 100));
+        const prefix = str(header.subarray(345, 500));
+        const sizeOctal = str(header.subarray(124, 136));
         const typeFlag = header[156];
-        if (!name) {
-            offset += 512;
+        const size = parseInt(sizeOctal, 8) || 0;
+        const body = data.subarray(offset + 512, offset + 512 + size);
+        const advance = 512 + Math.ceil(size / 512) * 512;
+        // 'x' (120) PAX extended header, 'L' (76) GNU LongName: the path for the NEXT entry.
+        if (typeFlag === 120 || typeFlag === 103) {
+            // PAX records are "<len> <key>=<value>\n"; we only care about path.
+            const match = body.toString('utf-8').match(/\d+ path=([^\n]+)\n/);
+            if (match) {
+                pendingLongName = match[1];
+            }
+            offset += advance;
             continue;
         }
-        const size = parseInt(sizeOctal, 8) || 0;
-        offset += 512;
-        if (typeFlag === 0 || typeFlag === 48) {
-            files.set(name, Buffer.from(data.subarray(offset, offset + size)));
+        if (typeFlag === 76) {
+            pendingLongName = str(body);
+            offset += advance;
+            continue;
+        }
+        const fullName = pendingLongName ?? (prefix ? `${prefix}/${name}` : name);
+        pendingLongName = undefined;
+        if (fullName && (typeFlag === 0 || typeFlag === 48)) {
+            files.set(fullName, Buffer.from(body));
         }
-        offset += Math.ceil(size / 512) * 512;
+        offset += advance;
     }
     return files;
 }
@@ -422,7 +453,7 @@ async function ensureFork() {
     if (!sourceRepo) {
         throw new Error(`Store repo not found: ${exports.STORE_CONFIG.owner}/${exports.STORE_CONFIG.repo}\n\n` +
             `If using a custom store, ensure the repo exists and is accessible.\n` +
-            `Setting: agentide.storeRepo`);
+            `Setting: ${(0, branding_1.toSettingsDisplayKey)('agentide.storeRepo')}`);
     }
     // Create fork
     const response = await fetch(`https://api.github.com/repos/${exports.STORE_CONFIG.owner}/${exports.STORE_CONFIG.repo}/forks`, {

package/out/sync.js

@@ -962,7 +962,9 @@ class SyncService {
         const roots = Array.from(new Set([workspaceRoot, ...additionalWorkspaceRoots].map(r => r.trim()).filter(Boolean))).filter(r => r !== os.homedir());
         for (const root of roots) {
             // Ensure git is initialized and root .gitignore has AgentIDE entries
-            await (0, utils_1.ensureWorkspaceGitAndGitignore)(root, outputChannel);
+            await (0, utils_1.ensureWorkspaceGitAndGitignore)(root, outputChannel, {
+                extraSearchPath: getConfiguredAdditionalEngineDir(),
+            });
             const agentideDir = this.getAgentideProjectDir(root);
             await fs_1.promises.mkdir(agentideDir, { recursive: true });
             await this.ensureAgentideGitignore(root, outputChannel);

package/out/test/analytics.test.js

@@ -1,6 +1,7 @@
 "use strict";
 /*---------------------------------------------------------------------------------------------
  *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *  Licensed under the MIT License. See LICENSE.txt in the project root for license information.
  *--------------------------------------------------------------------------------------------*/
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -43,7 +44,28 @@ const os = __importStar(require("os"));
 const fs_1 = require("fs");
 const base_1 = require("../engines/base");
 const sessionEvents_1 = require("../analytics/sessionEvents");
-const credential_context_1 = require("../cli/credential-context");
+const identity_1 = require("../analytics/identity");
+/**
+ * Run `fn` with prompt/tool content capture opted in.
+ *
+ * Content capture is off by default now (PLAN/compliance-req.md §6), so the tests that assert on
+ * previews have to say out loud that they are testing the opt-in path.
+ */
+async function withContentCapture(fn) {
+    const previous = process.env[identity_1.CONTENT_CAPTURE_ENV];
+    process.env[identity_1.CONTENT_CAPTURE_ENV] = '1';
+    try {
+        return await fn();
+    }
+    finally {
+        if (previous === undefined) {
+            delete process.env[identity_1.CONTENT_CAPTURE_ENV];
+        }
+        else {
+            process.env[identity_1.CONTENT_CAPTURE_ENV] = previous;
+        }
+    }
+}
 async function createUniqueTempDir(prefix) {
     return fs_1.promises.mkdtemp(path.join(os.tmpdir(), prefix));
 }
@@ -97,9 +119,17 @@ suite('Analytics - buildLiteLLMMetadataHeaders', () => {
         const headers = (0, base_1.buildLiteLLMMetadataHeaders)(true, { sessionId: 'sess-123' });
         assert.ok(headers.some(h => h === 'x-litellm-metadata-session-id: sess-123'), `Missing session_id header. Headers: ${JSON.stringify(headers)}`);
     });
-    test('includes user_id header', () => {
+    test('includes user_id header, hashed', () => {
         const headers = (0, base_1.buildLiteLLMMetadataHeaders)(true, { analyticsUserId: 'user-42' });
-        assert.ok(headers.some(h => h === 'x-litellm-metadata-user-id: user-42'), `Missing user_id header. Headers: ${JSON.stringify(headers)}`);
+        assert.ok(headers.some(h => h === `x-litellm-metadata-user-id: ${(0, identity_1.hashIdentity)('user-42')}`), `Missing user_id header. Headers: ${JSON.stringify(headers)}`);
+    });
+    test('the raw user id never leaves the process on a header', () => {
+        // The proxy logs every request and may forward to a third-party observability backend, so
+        // a raw address here is a directory of who works at the customer.
+        const headers = (0, base_1.buildLiteLLMMetadataHeaders)(true, { analyticsUserId: 'priya@meridian.com' });
+        assert.ok(!headers.some(h => h.includes('priya@meridian.com')), JSON.stringify(headers));
+        assert.ok(headers.some(h => h.startsWith('x-litellm-metadata-user-id: anon_')));
+        assert.ok(headers.some(h => h.startsWith('langfuse_trace_user_id: anon_')));
     });
     test('includes project_id header', () => {
         const headers = (0, base_1.buildLiteLLMMetadataHeaders)(true, { analyticsProjectId: 'agentide-vscode' });
@@ -131,7 +161,7 @@ suite('Analytics - buildLiteLLMMetadataHeaders', () => {
             analyticsUserId: 'user-1',
         });
         assert.ok(headers.some(h => h === 'langfuse_session_id: sess-1'), 'Should include langfuse_session_id for Langfuse callback compatibility');
-        assert.ok(headers.some(h => h === 'langfuse_trace_user_id: user-1'), 'Should include langfuse_trace_user_id for Langfuse callback compatibility');
+        assert.ok(headers.some(h => h === `langfuse_trace_user_id: ${(0, identity_1.hashIdentity)('user-1')}`), 'Should include langfuse_trace_user_id for Langfuse callback compatibility');
     });
     // --- Use Case: AgentHippo pack (Mode A) — fully automatic ---
     test('Mode A: AgentHippo pack produces all 10 headers (8 analytics + 2 langfuse)', () => {
@@ -377,8 +407,31 @@ suite('Analytics - ObservableStreamEmitter', () => {
         assert.strictEqual(event.event_type, 'tool_start');
         assert.strictEqual(event.payload.toolName, 'Bash');
         assert.strictEqual(event.payload.callId, 'call-1');
-        assert.strictEqual(event.payload.inputPreview, 'ls -la');
         assert.strictEqual(event.request_id, 'req-1');
+        // Tool arguments are content: digest by default, no preview.
+        assert.strictEqual(event.payload.inputPreview, undefined);
+        assert.strictEqual(event.payload.input_length, 6);
+        assert.strictEqual(typeof event.payload.input_sha256, 'string');
+    });
+    test('tool input preview appears only under the content-capture opt-in', async () => {
+        await withContentCapture(async () => {
+            const emitter = (0, sessionEvents_1.wrapEmitterWithObservability)(innerEmitter, writer, 'sess-optin', 'req-1');
+            await emitter.toolStart('Bash', 'ls -la', 'call-1');
+        });
+        const content = await fs_1.promises.readFile(path.join(testDir, 'sess-optin.jsonl'), 'utf8');
+        const event = JSON.parse(content.trim());
+        assert.strictEqual(event.payload.inputPreview, 'ls -la');
+        // The digest is present in both modes, so a query written against it never breaks.
+        assert.strictEqual(typeof event.payload.input_sha256, 'string');
+    });
+    test('tool result content is a digest, not a preview, by default', async () => {
+        const emitter = (0, sessionEvents_1.wrapEmitterWithObservability)(innerEmitter, writer, 'sess-nores', 'req-1');
+        await emitter.toolEnd('Read', 'call-1', 'CUSTOMER SECRET', false);
+        const content = await fs_1.promises.readFile(path.join(testDir, 'sess-nores.jsonl'), 'utf8');
+        assert.ok(!content.includes('CUSTOMER SECRET'), 'raw tool output must not reach the JSONL');
+        const event = JSON.parse(content.trim());
+        assert.strictEqual(event.payload.resultPreview, undefined);
+        assert.strictEqual(event.payload.result_length, 15);
     });
     test('toolEnd writes session event AND passes through', async () => {
         const emitter = (0, sessionEvents_1.wrapEmitterWithObservability)(innerEmitter, writer, 'sess-1', 'req-1');
@@ -427,21 +480,28 @@ suite('Analytics - ObservableStreamEmitter', () => {
         assert.strictEqual(event.event_type, 'turn_end');
         assert.strictEqual(event.payload.success, true);
     });
-    test('truncates long tool input to 500 chars', async () => {
-        const emitter = (0, sessionEvents_1.wrapEmitterWithObservability)(innerEmitter, writer, 'sess-1', 'req-1');
-        const longInput = 'x'.repeat(1000);
-        await emitter.toolStart('Read', longInput, 'call-1');
+    test('truncates long tool input to 500 chars (content-capture opt-in)', async () => {
+        await withContentCapture(async () => {
+            const emitter = (0, sessionEvents_1.wrapEmitterWithObservability)(innerEmitter, writer, 'sess-1', 'req-1');
+            const longInput = 'x'.repeat(1000);
+            await emitter.toolStart('Read', longInput, 'call-1');
+        });
         const content = await fs_1.promises.readFile(path.join(testDir, 'sess-1.jsonl'), 'utf8');
         const event = JSON.parse(content.trim());
         assert.strictEqual(event.payload.inputPreview.length, 500);
-    });
-    test('truncates long tool result to 500 chars', async () => {
-        const emitter = (0, sessionEvents_1.wrapEmitterWithObservability)(innerEmitter, writer, 'sess-1', 'req-1');
-        const longResult = 'y'.repeat(1000);
-        await emitter.toolEnd('Read', 'call-1', longResult, false);
+        // The digest covers the WHOLE input, not the truncated preview.
+        assert.strictEqual(event.payload.input_length, 1000);
+    });
+    test('truncates long tool result to 500 chars (content-capture opt-in)', async () => {
+        await withContentCapture(async () => {
+            const emitter = (0, sessionEvents_1.wrapEmitterWithObservability)(innerEmitter, writer, 'sess-1', 'req-1');
+            const longResult = 'y'.repeat(1000);
+            await emitter.toolEnd('Read', 'call-1', longResult, false);
+        });
         const content = await fs_1.promises.readFile(path.join(testDir, 'sess-1.jsonl'), 'utf8');
         const event = JSON.parse(content.trim());
         assert.strictEqual(event.payload.resultPreview.length, 500);
+        assert.strictEqual(event.payload.result_length, 1000);
     });
     // --- Use Case: Full agent request lifecycle ---
     test('Use Case: full request lifecycle produces correct event sequence', async () => {
@@ -524,7 +584,7 @@ suite('Analytics - ObservableStreamEmitter', () => {
     });
 });
 // =============================================================================
-// ObservableStreamEmitter + credential context (the "warrant" audit trail)
+// ObservableStreamEmitter warrant audit trail (constructor-captured userId)
 // =============================================================================
 suite('Analytics - ObservableStreamEmitter records the acting user (the warrant)', () => {
     let testDir;
@@ -556,37 +616,141 @@ suite('Analytics - ObservableStreamEmitter records the acting user (the warrant)
         const content = await fs_1.promises.readFile(path.join(testDir, `${sessionId}.jsonl`), 'utf8');
         return content.trim().split('\n').map((l) => JSON.parse(l));
     }
-    test('toolStart/toolEnd record userId when inside a runWithCredential scope', async () => {
-        const emitter = (0, sessionEvents_1.wrapEmitterWithObservability)(innerEmitter, writer, 'sess-warrant-1', 'req-1');
-        await (0, credential_context_1.runWithCredential)({ userId: 'priya@meridian.com' }, async () => {
-            await emitter.toolStart('Bash', 'echo hi', 'c1');
-            await emitter.toolEnd('Bash', 'c1', 'hi', false);
-        });
+    test('toolStart/toolEnd record the userId passed at wrap, as a salted hash', async () => {
+        const emitter = (0, sessionEvents_1.wrapEmitterWithObservability)(innerEmitter, writer, 'sess-warrant-1', 'req-1', 'priya@meridian.com');
+        await emitter.toolStart('Bash', 'echo hi', 'c1');
+        await emitter.toolEnd('Bash', 'c1', 'hi', false);
         const events = await readEvents('sess-warrant-1');
         assert.strictEqual(events.length, 2);
-        assert.strictEqual(events[0].payload.userId, 'priya@meridian.com');
-        assert.strictEqual(events[1].payload.userId, 'priya@meridian.com');
+        const expected = (0, identity_1.hashIdentity)('priya@meridian.com');
+        assert.strictEqual(events[0].payload.userId, expected);
+        assert.strictEqual(events[1].payload.userId, expected);
+        // Attribution is preserved; the address itself is not.
+        assert.ok(String(expected).startsWith('anon_'));
+    });
+    test('the raw address never reaches the evidence file', async () => {
+        const emitter = (0, sessionEvents_1.wrapEmitterWithObservability)(innerEmitter, writer, 'sess-warrant-raw', 'req-1', 'priya@meridian.com');
+        await emitter.emitTurnStart();
+        const raw = await fs_1.promises.readFile(path.join(testDir, 'sess-warrant-raw.jsonl'), 'utf8');
+        assert.ok(!raw.includes('priya@meridian.com'), 'raw user id must not be written to evidence');
+        assert.ok(!raw.includes('meridian.com'), 'not even the domain');
     });
-    test('toolStart records no userId outside any credential scope (IDE-local usage)', async () => {
+    test('toolStart records no userId when wrap omitted it (IDE-local usage)', async () => {
         const emitter = (0, sessionEvents_1.wrapEmitterWithObservability)(innerEmitter, writer, 'sess-warrant-2', 'req-1');
         await emitter.toolStart('Bash', 'echo hi', 'c1');
         const events = await readEvents('sess-warrant-2');
         assert.strictEqual(events[0].payload.userId, undefined);
     });
-    test('two interleaved turns never attribute a tool call to the wrong user', async () => {
-        const emitter = (0, sessionEvents_1.wrapEmitterWithObservability)(innerEmitter, writer, 'sess-warrant-3', 'req-1');
+    test('two emitters never attribute a tool call to the wrong user', async () => {
+        const alice = (0, sessionEvents_1.wrapEmitterWithObservability)(innerEmitter, writer, 'sess-warrant-3', 'req-a', 'alice@acme.com');
+        const bob = (0, sessionEvents_1.wrapEmitterWithObservability)(innerEmitter, writer, 'sess-warrant-3', 'req-b', 'bob@acme.com');
         await Promise.all([
-            (0, credential_context_1.runWithCredential)({ userId: 'alice@acme.com' }, async () => {
+            (async () => {
                 await new Promise((r) => setTimeout(r, 5));
-                await emitter.toolStart('Bash', 'a', 'a1');
-            }),
-            (0, credential_context_1.runWithCredential)({ userId: 'bob@acme.com' }, async () => {
-                await emitter.toolStart('Bash', 'b', 'b1');
-            }),
+                await alice.toolStart('Bash', 'a', 'a1');
+            })(),
+            bob.toolStart('Bash', 'b', 'b1'),
         ]);
         const events = await readEvents('sess-warrant-3');
         const byCallId = Object.fromEntries(events.map((e) => [e.payload.callId, e.payload.userId]));
-        assert.strictEqual(byCallId['a1'], 'alice@acme.com');
-        assert.strictEqual(byCallId['b1'], 'bob@acme.com');
+        assert.strictEqual(byCallId['a1'], (0, identity_1.hashIdentity)('alice@acme.com'));
+        assert.strictEqual(byCallId['b1'], (0, identity_1.hashIdentity)('bob@acme.com'));
+        assert.notStrictEqual(byCallId['a1'], byCallId['b1'], 'distinct users must stay distinguishable');
+    });
+    test('toolStart/toolEnd keep wrap-time userId even when called outside any credential scope', async () => {
+        // Simulates the custom-engine persistent-worker path: wrap captures identity on the
+        // request continuation, then tool events fire later on a detached IPC callback with
+        // no ambient runWithCredential (or a sticky wrong one). Attribution must not depend
+        // on ambient AsyncLocalStorage at emit time.
+        const emitter = (0, sessionEvents_1.wrapEmitterWithObservability)(innerEmitter, writer, 'sess-warrant-4', 'req-1', 'alice@acme.com');
+        await emitter.toolStart('Bash', 'echo hi', 'c1');
+        await emitter.toolEnd('Bash', 'c1', 'hi', false);
+        const events = await readEvents('sess-warrant-4');
+        assert.strictEqual(events[0].payload.userId, (0, identity_1.hashIdentity)('alice@acme.com'));
+        assert.strictEqual(events[1].payload.userId, (0, identity_1.hashIdentity)('alice@acme.com'));
+    });
+    test('error/turn_start/turn_end also carry the wrap-time userId, not just tool events', async () => {
+        // A turn that errors before any tool call (or has no tool calls at all) must still
+        // carry identity attribution — the mechanism was already on the instance, it just
+        // wasn't threaded into these three payloads.
+        const emitter = (0, sessionEvents_1.wrapEmitterWithObservability)(innerEmitter, writer, 'sess-warrant-5', 'req-1', 'bob@acme.com');
+        await emitter.emitTurnStart();
+        await emitter.error('boom');
+        await emitter.emitTurnEnd(false);
+        const events = await readEvents('sess-warrant-5');
+        assert.strictEqual(events.length, 3);
+        const bob = (0, identity_1.hashIdentity)('bob@acme.com');
+        assert.strictEqual(events[0].event_type, 'turn_start');
+        assert.strictEqual(events[0].payload.userId, bob);
+        assert.strictEqual(events[1].event_type, 'error');
+        assert.strictEqual(events[1].payload.userId, bob);
+        assert.strictEqual(events[2].event_type, 'turn_end');
+        assert.strictEqual(events[2].payload.userId, bob);
+    });
+});
+// =============================================================================
+// Evidence-write failures must be LOUD (compliance fix 2a)
+//
+// `append()` used to swallow every error in an empty catch block. A full disk, a read-only
+// volume, a bad mount — all of them produced a turn that ran with no record of it, and nothing
+// anywhere said so. An absent record is the failure mode that matters (SOC 2 CC7.2 / R-13), so
+// these tests exist to keep the silence from coming back.
+// =============================================================================
+suite('Analytics - evidence write failures are surfaced, never swallowed', () => {
+    let blockedDir;
+    let errors;
+    let originalError;
+    setup(async () => {
+        (0, sessionEvents_1.resetSessionEventWriterStatsForTest)();
+        // A FILE where the writer expects a directory: mkdir fails, so every append fails.
+        const root = await createUniqueTempDir('agentide-evidence-fail-');
+        blockedDir = path.join(root, 'not-a-dir');
+        await fs_1.promises.writeFile(blockedDir, 'this is a file, not a directory');
+        errors = [];
+        originalError = console.error;
+        console.error = (msg) => { errors.push(String(msg)); };
+    });
+    teardown(() => {
+        console.error = originalError;
+        delete process.env.AGENTHIPPO_EVIDENCE_REQUIRED;
+        (0, sessionEvents_1.resetSessionEventWriterStatsForTest)();
+    });
+    test('a failed append logs at error level and counts the loss', async () => {
+        const writer = new sessionEvents_1.SessionEventWriter(blockedDir);
+        await writer.append('sess-x', 'req-1', 'tool_start', { toolName: 'Bash' });
+        assert.strictEqual(writer.getStats().failed, 1, 'per-writer counter');
+        assert.strictEqual(writer.getStats().written, 0);
+        assert.strictEqual((0, sessionEvents_1.getSessionEventWriterStats)().failed, 1, 'process-wide counter for /health');
+        assert.ok(errors.some((e) => e.includes('LOST session event')), `no error logged: ${JSON.stringify(errors)}`);
+        assert.ok(errors.some((e) => e.includes('tool_start')), 'the lost event type is named');
+    });
+    test('the last failure is retained for /health output', async () => {
+        const writer = new sessionEvents_1.SessionEventWriter(blockedDir);
+        await writer.append('sess-x', 'req-1', 'turn_end', { success: true });
+        const stats = (0, sessionEvents_1.getSessionEventWriterStats)();
+        assert.strictEqual(stats.lastError?.eventType, 'turn_end');
+        assert.ok((stats.lastError?.at ?? 0) > 0);
+        assert.ok((stats.lastError?.message ?? '').length > 0);
+    });
+    test('AGENTHIPPO_EVIDENCE_REQUIRED makes the turn fail rather than run unrecorded', async () => {
+        process.env.AGENTHIPPO_EVIDENCE_REQUIRED = '1';
+        const writer = new sessionEvents_1.SessionEventWriter(blockedDir);
+        await assert.rejects(() => writer.append('sess-x', 'req-1', 'tool_start', {}), /evidence write failed for tool_start/);
+        assert.strictEqual((0, sessionEvents_1.getSessionEventWriterStats)().failed, 1);
+    });
+    test('without the flag the agent keeps running, but the loss is still counted', async () => {
+        const writer = new sessionEvents_1.SessionEventWriter(blockedDir);
+        await writer.append('sess-x', 'req-1', 'tool_start', {});
+        await writer.append('sess-x', 'req-1', 'tool_end', {});
+        assert.strictEqual((0, sessionEvents_1.getSessionEventWriterStats)().failed, 2);
+    });
+    test('successful writes are counted too, so /health can show a ratio', async () => {
+        const dir = await createUniqueTempDir('agentide-evidence-ok-');
+        const writer = new sessionEvents_1.SessionEventWriter(dir);
+        await writer.append('sess-ok', 'req-1', 'turn_start', {});
+        assert.strictEqual(writer.getStats().written, 1);
+        assert.strictEqual(writer.getStats().failed, 0);
+        assert.strictEqual((0, sessionEvents_1.getSessionEventWriterStats)().written, 1);
+        await removeDirWithRetries(dir);
     });
 });

package/out/test/auth-baseurl.test.js

@@ -0,0 +1,132 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *
+ *  The auth base URL is the endpoint that receives the PKCE code, then the user's AgentHippo
+ *  access token, and whose bootstrap response is written into the user's model-routing settings.
+ *  These tests pin the two gates that keep a workspace from steering it.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const brokerClient_1 = require("../auth/brokerClient");
+const authBaseUrl_1 = require("../auth/authBaseUrl");
+suite('auth base URL — transport gate', () => {
+    test('accepts https and strips trailing slashes', () => {
+        assert.strictEqual((0, brokerClient_1.assertSafeAuthBaseUrl)('https://auth.agenthippo.ai/'), 'https://auth.agenthippo.ai');
+        assert.strictEqual((0, brokerClient_1.assertSafeAuthBaseUrl)('https://auth.example.com/base//'), 'https://auth.example.com/base');
+    });
+    test('accepts plain http only for loopback (local broker development)', () => {
+        assert.strictEqual((0, brokerClient_1.assertSafeAuthBaseUrl)('http://127.0.0.1:9780'), 'http://127.0.0.1:9780');
+        assert.strictEqual((0, brokerClient_1.assertSafeAuthBaseUrl)('http://localhost:9780'), 'http://localhost:9780');
+    });
+    test('refuses cleartext http to a remote host — the bearer token would be on the wire', () => {
+        assert.throws(() => (0, brokerClient_1.assertSafeAuthBaseUrl)('http://attacker.example'), /must be https/);
+    });
+    test('refuses a hostname that merely CONTAINS a loopback name', () => {
+        assert.throws(() => (0, brokerClient_1.assertSafeAuthBaseUrl)('http://localhost.attacker.tld'), /must be https/);
+    });
+    test('refuses a non-http scheme and a malformed URL', () => {
+        assert.throws(() => (0, brokerClient_1.assertSafeAuthBaseUrl)('file:///etc/passwd'), /must be https/);
+        assert.throws(() => (0, brokerClient_1.assertSafeAuthBaseUrl)('not a url'), /not a valid URL/);
+    });
+    test('falls back to the product default when nothing is configured', () => {
+        const previous = process.env.AGENTHIPPO_AUTH_BASE_URL;
+        delete process.env.AGENTHIPPO_AUTH_BASE_URL;
+        try {
+            assert.strictEqual((0, brokerClient_1.getAuthBrokerBaseUrl)(undefined), brokerClient_1.DEFAULT_AUTH_BROKER_BASE_URL);
+            assert.strictEqual((0, brokerClient_1.getAuthBrokerBaseUrl)('   '), brokerClient_1.DEFAULT_AUTH_BROKER_BASE_URL);
+        }
+        finally {
+            if (previous === undefined) {
+                delete process.env.AGENTHIPPO_AUTH_BASE_URL;
+            }
+            else {
+                process.env.AGENTHIPPO_AUTH_BASE_URL = previous;
+            }
+        }
+    });
+    test('a bad configured value throws rather than silently falling back', () => {
+        assert.throws(() => (0, brokerClient_1.getAuthBrokerBaseUrl)('http://evil.example'), /Refusing to use/);
+    });
+});
+suite('auth base URL — scope gate', () => {
+    test('a workspace value is ignored in favour of the user value', () => {
+        const picked = (0, authBaseUrl_1.pickTrustedAuthBaseUrl)({
+            defaultValue: 'https://auth.agenthippo.ai',
+            globalValue: 'https://auth.corp.example',
+            workspaceValue: 'https://attacker.example',
+        });
+        assert.strictEqual(picked.value, 'https://auth.corp.example');
+        assert.strictEqual(picked.ignoredWorkspaceValue, 'https://attacker.example');
+    });
+    test('a workspace-FOLDER value is ignored too', () => {
+        const picked = (0, authBaseUrl_1.pickTrustedAuthBaseUrl)({
+            defaultValue: 'https://auth.agenthippo.ai',
+            workspaceFolderValue: 'https://attacker.example',
+        });
+        assert.strictEqual(picked.value, 'https://auth.agenthippo.ai');
+        assert.strictEqual(picked.ignoredWorkspaceValue, 'https://attacker.example');
+    });
+    test('a remote user value wins over a local one (VS Code precedence)', () => {
+        const picked = (0, authBaseUrl_1.pickTrustedAuthBaseUrl)({
+            defaultValue: 'https://auth.agenthippo.ai',
+            globalValue: 'https://a.example',
+            globalLocalValue: 'https://b.example',
+            globalRemoteValue: 'https://c.example',
+        });
+        assert.strictEqual(picked.value, 'https://c.example');
+    });
+    test('a workspace value identical to the trusted value is not reported as an override', () => {
+        const picked = (0, authBaseUrl_1.pickTrustedAuthBaseUrl)({
+            defaultValue: 'https://auth.agenthippo.ai',
+            workspaceValue: 'https://auth.agenthippo.ai',
+        });
+        assert.strictEqual(picked.ignoredWorkspaceValue, undefined);
+    });
+    test('the attack end-to-end: a repo setting agentide.auth.baseUrl never reaches the network layer', () => {
+        const warnings = [];
+        const resolved = (0, authBaseUrl_1.resolveAuthBrokerBaseUrl)({
+            inspect: () => ({
+                defaultValue: 'https://auth.agenthippo.ai',
+                workspaceValue: 'https://attacker.example',
+            }),
+        }, (m) => warnings.push(m));
+        assert.strictEqual(resolved, 'https://auth.agenthippo.ai');
+        assert.strictEqual(warnings.length, 1);
+        assert.ok(warnings[0].includes('attacker.example'), 'the ignored value is named in the warning');
+    });
+});

package/out/test/auth-bootstrapApply.test.js

@@ -78,25 +78,46 @@ const sampleBootstrap = {
     user: { id: 'usr_1', email: 'you@acme.com', displayName: 'You' },
     team: { id: 'team_acme', name: 'Acme', role: 'member' },
     store: { repo: 'acme/store', indexUrl: 'https://acme.github.io/store', githubOrg: 'acme' },
-    routing: { litellmBaseUrl: 'http://llm.acme', litellmApiKey: 'ahk_123' },
-    policy: { byokAllowed: true, teamManagedSettings: ['store', 'routing'] },
+    routing: { inferenceGatewayUrl: 'https://gw.acme/v1' },
+    policy: { teamManagedSettings: ['store', 'routing'] },
+};
+const soloBootstrap = {
+    version: 1,
+    user: { id: 'usr_2', email: 'solo@example.com', displayName: 'Solo' },
+    store: { repo: 'acme/store', indexUrl: 'https://acme.github.io/store', githubOrg: 'acme' },
+    routing: { inferenceGatewayUrl: 'https://gw.acme/v1' },
+    policy: { teamManagedSettings: [] },
 };
 suite('BootstrapApply', () => {
-    test('applyIdeBootstrap writes store and routing settings', async () => {
+    test('applyIdeBootstrap writes store and gateway routing; the litellm slot stays untouched', async () => {
         const { target, settings, global, getApiKeyCalls } = createMockTarget();
+        settings.set('agentide.providers.litellm.baseUrl', 'http://127.0.0.1:4000');
         const result = await (0, bootstrapApply_js_1.applyIdeBootstrap)(sampleBootstrap, target);
         assert.deepStrictEqual(result.applied, ['store', 'routing']);
         assert.strictEqual(settings.get('agentide.storeRepo'), 'acme/store');
-        assert.strictEqual(settings.get('agentide.providers.litellm.baseUrl'), 'http://llm.acme');
-        assert.strictEqual(getApiKeyCalls(), 1);
+        assert.strictEqual(settings.get('agentide.AgentHippoModelGateway.url'), 'https://gw.acme/v1');
+        // Slot split: sign-in must not overwrite the user-owned litellm provider or install a key.
+        assert.strictEqual(settings.get('agentide.providers.litellm.baseUrl'), 'http://127.0.0.1:4000');
+        assert.strictEqual(getApiKeyCalls(), 0);
         assert.strictEqual(global.get('agentide.team.id'), 'team_acme');
     });
+    test('a solo bootstrap (no team) applies settings without locking them', async () => {
+        const { target, settings, global } = createMockTarget();
+        const result = await (0, bootstrapApply_js_1.applyIdeBootstrap)(soloBootstrap, target);
+        // Settings still apply as defaults…
+        assert.deepStrictEqual(result.applied, ['store', 'routing']);
+        assert.strictEqual(settings.get('agentide.AgentHippoModelGateway.url'), 'https://gw.acme/v1');
+        // …but nothing is marked team-managed and no team identity is recorded.
+        assert.strictEqual(global.get('agentide.teamManaged.store'), false);
+        assert.strictEqual(global.get('agentide.teamManaged.routing'), false);
+        assert.strictEqual(global.get('agentide.team.id'), undefined);
+    });
     test('revertTeamManagedBootstrap restores defaults', async () => {
         const { target, settings, global } = createMockTarget();
         await (0, bootstrapApply_js_1.applyIdeBootstrap)(sampleBootstrap, target);
         await (0, bootstrapApply_js_1.revertTeamManagedBootstrap)(target);
         assert.strictEqual(settings.get('agentide.storeRepo'), 'agenthippoai/agenthippo-store');
-        assert.strictEqual(settings.get('agentide.providers.litellm.baseUrl'), '');
+        assert.strictEqual(settings.get('agentide.AgentHippoModelGateway.url'), undefined);
         assert.strictEqual(global.get('agentide.team.id'), undefined);
     });
 });