@agenthippo-ai/agenthippo 0.1.1 → 1.110.9

package/out/test/mcp-obo.test.js

@@ -34,49 +34,74 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 const assert = __importStar(require("assert"));
-const node_fs_1 = require("node:fs");
-const node_os_1 = require("node:os");
-const node_path_1 = require("node:path");
 const credential_context_1 = require("../cli/credential-context");
 const mcp_1 = require("../mcp");
-suite('mcp: OBO token in MCP env (Design B §11.1)', () => {
-    const orig = process.env.DATABRICKS_TOKEN;
-    let tokenDir;
+/**
+ * The per-turn OBO credential must never reach MCP child env implicitly: the supported
+ * transport is the loopback data-plane gateway + turn nonce (secure-obo-design §2/§3).
+ * Inline resolution exists only behind the explicit local-dev opt-in.
+ */
+suite('mcp: OBO token in MCP env (secure-obo-design §3.4 — inline is opt-in only)', () => {
+    const ENV_KEYS = ['DATABRICKS_TOKEN', 'AGENTHIPPO_DATA_TOKEN_ENV_VARS', mcp_1.ALLOW_INLINE_DATA_TOKEN_ENV];
+    const saved = {};
     setup(() => {
-        tokenDir = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'mcp-obo-'));
+        for (const k of ENV_KEYS) {
+            saved[k] = process.env[k];
+            delete process.env[k];
+        }
     });
     teardown(() => {
-        if (orig === undefined) {
-            delete process.env.DATABRICKS_TOKEN;
-        }
-        else {
-            process.env.DATABRICKS_TOKEN = orig;
+        for (const k of ENV_KEYS) {
+            if (saved[k] === undefined) {
+                delete process.env[k];
+            }
+            else {
+                process.env[k] = saved[k];
+            }
         }
-        (0, node_fs_1.rmSync)(tokenDir, { recursive: true, force: true });
     });
-    test('static PAT when no credential scope', () => {
+    test('static PAT resolves from plain env when no credential scope', () => {
         process.env.DATABRICKS_TOKEN = 'pat-static';
         assert.strictEqual((0, mcp_1.resolveMcpEnvVar)('DATABRICKS_TOKEN'), 'pat-static');
     });
-    test('OBO token overrides static PAT inside runWithCredential (inline fallback)', async () => {
-        process.env.DATABRICKS_TOKEN = 'pat-static';
+    test('WITHOUT the opt-in, a live OBO token never bakes into MCP child env', async () => {
+        process.env.AGENTHIPPO_DATA_TOKEN_ENV_VARS = 'DATABRICKS_TOKEN';
         await (0, credential_context_1.runWithCredential)({ userId: 'u@x.com', dataToken: 'obo-live' }, async () => {
-            assert.strictEqual((0, mcp_1.resolveMcpEnvVar)('DATABRICKS_TOKEN'), 'obo-live');
-        });
-    });
-    test('credential placeholder resolves to token file for stdio MCP', async () => {
-        await (0, credential_context_1.runWithCredential)({ userId: 'u@x.com', dataToken: 'obo-file-token' }, async () => {
+            // alias reference falls back to ambient env (unset here → empty), never the credential
+            assert.strictEqual((0, mcp_1.resolveMcpEnvVar)('DATABRICKS_TOKEN'), '');
+            // explicit placeholder resolves to nothing → the connector fails closed
+            assert.strictEqual((0, mcp_1.resolveMcpEnvVar)('dataToken'), '');
             const resolved = (0, mcp_1.resolveMcpServerEnv)({
                 DATABRICKS_HOST: 'dbc.example.com',
                 DATABRICKS_TOKEN: '${credential:dataToken}',
             });
             assert.ok(resolved);
             assert.strictEqual(resolved.DATABRICKS_HOST, 'dbc.example.com');
-            assert.strictEqual(resolved.DATABRICKS_TOKEN, undefined);
-            const file = resolved[mcp_1.AGENTHIPPO_DATA_TOKEN_FILE_ENV];
-            assert.ok(file);
-            assert.strictEqual((0, node_fs_1.readFileSync)(file, 'utf8'), 'obo-file-token');
-            assert.strictEqual((0, mcp_1.resolveMcpEnvVar)('DATABRICKS_TOKEN'), '');
-        }, { dataTokenDir: tokenDir });
+            assert.strictEqual(resolved.DATABRICKS_TOKEN, undefined, 'credential must not appear in spawn env without the opt-in');
+            assert.ok(!JSON.stringify(resolved).includes('obo-live'), 'the raw token must not leak anywhere in the resolved env');
+        });
+    });
+    test('WITH the explicit local-dev opt-in, inline resolution works (alias + placeholder)', async () => {
+        process.env[mcp_1.ALLOW_INLINE_DATA_TOKEN_ENV] = '1';
+        process.env.AGENTHIPPO_DATA_TOKEN_ENV_VARS = 'DATABRICKS_TOKEN';
+        process.env.DATABRICKS_TOKEN = 'pat-static';
+        await (0, credential_context_1.runWithCredential)({ userId: 'u@x.com', dataToken: 'obo-live' }, async () => {
+            assert.strictEqual((0, mcp_1.resolveMcpEnvVar)('DATABRICKS_TOKEN'), 'obo-live', 'OBO token overrides static PAT when opted in');
+            const resolved = (0, mcp_1.resolveMcpServerEnv)({ DATABRICKS_TOKEN: '${credential:dataToken}' });
+            assert.strictEqual(resolved.DATABRICKS_TOKEN, 'obo-live');
+        });
+    });
+    test('alias list is empty by default — DATABRICKS_TOKEN is no longer an implicit credential alias', async () => {
+        process.env[mcp_1.ALLOW_INLINE_DATA_TOKEN_ENV] = '1';
+        process.env.DATABRICKS_TOKEN = 'pat-static';
+        await (0, credential_context_1.runWithCredential)({ userId: 'u@x.com', dataToken: 'obo-live' }, async () => {
+            // No AGENTHIPPO_DATA_TOKEN_ENV_VARS declared → the plain env var wins even opted-in.
+            assert.strictEqual((0, mcp_1.resolveMcpEnvVar)('DATABRICKS_TOKEN'), 'pat-static');
+        });
+    });
+    test('no credential scope + placeholder → falls back to ambient env for local dev', () => {
+        process.env.DATABRICKS_TOKEN = 'pat-static';
+        const resolved = (0, mcp_1.resolveMcpServerEnv)({ DATABRICKS_TOKEN: '${credential:dataToken}' });
+        assert.strictEqual(resolved.DATABRICKS_TOKEN, 'pat-static');
     });
 });

package/out/test/mcp.test.js

@@ -43,6 +43,7 @@ const os = __importStar(require("os"));
 const fs_1 = require("fs");
 const mcp_1 = require("../mcp");
 const branding_1 = require("../branding");
+const credential_context_1 = require("../cli/credential-context");
 suite('MCP Server Loading', () => {
     let testDir;
     const getAgentMcpDir = (agentId) => path.join(testDir, branding_1.AGENTIDE_DIR_NAME, 'agents', agentId, 'mcp');
@@ -245,16 +246,19 @@ suite('MCP Server Loading', () => {
             // A bare (unquoted) dotted key would be misparsed as a nested table.
             assert.ok(!result.includes('my.token = '));
         });
-        test('autoApprove emits default_tools_approval_mode = "auto" per server', () => {
+        test('autoApprove emits default_tools_approval_mode = "approve" per server', () => {
             const servers = [
                 { name: 'stdio-srv', label: 's', command: 'node', args: ['s.js'] },
                 { name: 'http-srv', label: 'h', command: '', args: [], url: 'https://mcp.example.com/sse' },
             ];
             const result = (0, mcp_1.generateCodexMcpConfig)(servers, { autoApprove: true });
-            assert.ok(result.includes('default_tools_approval_mode = "auto"'));
+            assert.ok(result.includes('default_tools_approval_mode = "approve"'));
             assert.ok(result.includes('url = "https://mcp.example.com/sse"'));
-            // Invalid legacy key/value must never be emitted.
+            // Invalid legacy key/value must never be emitted. "auto" is not a valid enum value
+            // either — Codex ≥0.131 ignores it, falls back to `prompt`, and headless exec then
+            // cancels every MCP tool call ("user cancelled MCP tool call").
             assert.ok(!result.includes('approval_mode = "never"'));
+            assert.ok(!result.includes('"auto"'));
         });
         test('generateCodexMcpConfig emits http_headers for URL servers', () => {
             const servers = [
@@ -271,6 +275,27 @@ suite('MCP Server Loading', () => {
             assert.ok(result.includes('url = "https://mcp.example.com/sse"'));
             assert.ok(result.includes('http_headers = { "Authorization" = "Bearer abc", "X-Custom" = "val" }'));
         });
+        test('bearerTokenEnv emits bearer_token_env_var and NEVER a per-turn value — config.toml stays turn-invariant (secure-obo-design §3.2)', async () => {
+            const servers = [
+                {
+                    name: 'data',
+                    label: 'data',
+                    command: '',
+                    args: [],
+                    url: 'http://127.0.0.1:39999/mcp',
+                    bearerTokenEnv: 'AGENTHIPPO_TURN_NONCE',
+                },
+            ];
+            const outsideScope = (0, mcp_1.generateCodexMcpConfig)(servers);
+            assert.ok(outsideScope.includes('bearer_token_env_var = "AGENTHIPPO_TURN_NONCE"'));
+            assert.ok(!outsideScope.includes('http_headers'), 'no resolved header may carry the nonce into the file');
+            // Byte-identical no matter which user's credential scope is ambient — this is the
+            // exact property that removes the cross-user config.toml race (defect 1).
+            const inAlice = await (0, credential_context_1.runWithCredential)({ userId: 'alice@corp.com', dataToken: 'tok-a' }, async () => (0, mcp_1.generateCodexMcpConfig)(servers));
+            const inBob = await (0, credential_context_1.runWithCredential)({ userId: 'bob@corp.com', dataToken: 'tok-b' }, async () => (0, mcp_1.generateCodexMcpConfig)(servers));
+            assert.strictEqual(inAlice, outsideScope);
+            assert.strictEqual(inBob, outsideScope);
+        });
     });
     suite('inline MCP helpers', () => {
         test('formatInlineMcpServers maps resolved servers by name', () => {
@@ -306,6 +331,47 @@ suite('MCP Server Loading', () => {
                 remote: { type: 'http', url: 'https://mcp.example.com/sse', headers: { Authorization: 'Bearer abc' } },
             });
         });
+        test('bearerTokenEnv resolves against the PER-TURN env into an Authorization header (cursor/custom path)', () => {
+            const server = {
+                name: 'data', label: 'data', command: '', args: [],
+                url: 'http://127.0.0.1:39999/mcp', bearerTokenEnv: 'AGENTHIPPO_TURN_NONCE',
+            };
+            const inline = (0, mcp_1.formatInlineMcpServers)([server], { AGENTHIPPO_TURN_NONCE: 'nonce-123' });
+            assert.deepStrictEqual(inline, {
+                data: { type: 'http', url: 'http://127.0.0.1:39999/mcp', headers: { Authorization: 'Bearer nonce-123' } },
+            });
+            // No nonce in the turn env (e.g. IDE) → no Authorization header, entry still valid.
+            const withoutNonce = (0, mcp_1.formatInlineMcpServers)([server], {});
+            assert.deepStrictEqual(withoutNonce, {
+                data: { type: 'http', url: 'http://127.0.0.1:39999/mcp' },
+            });
+        });
+        /**
+         * The claude path must ship a `${NAME}` REFERENCE, never the resolved secret: the Agent
+         * SDK serializes mcpServers into `--mcp-config <json>` argv, and /proc/<pid>/cmdline is
+         * world-readable — a resolved bearer there leaks the turn nonce to every uid on the host.
+         * The CLI expands the reference from its own env (verified live on 2.1.220).
+         */
+        test('referenceHttpMcpHeaders emits a ${NAME} reference, never the secret (claude path)', () => {
+            const headers = (0, mcp_1.referenceHttpMcpHeaders)({ bearerTokenEnv: 'AGENTHIPPO_TURN_NONCE', headers: { 'X-Static': 'kept' } }, { AGENTHIPPO_TURN_NONCE: 'nonce-123' });
+            assert.deepStrictEqual(headers, {
+                'X-Static': 'kept',
+                'Authorization': 'Bearer ${AGENTHIPPO_TURN_NONCE}',
+            });
+            // The reference is emitted even when the env has no value yet: expansion happens in
+            // the CLI at connect time, and an unset name passes through literally, which the data
+            // gateway rejects — fail closed, never a silently-authorized request.
+            const unresolved = (0, mcp_1.referenceHttpMcpHeaders)({ bearerTokenEnv: 'AGENTHIPPO_TURN_NONCE' }, {});
+            assert.deepStrictEqual(unresolved, { Authorization: 'Bearer ${AGENTHIPPO_TURN_NONCE}' });
+        });
+        test('referenceHttpMcpHeaders falls back to in-memory resolution for a non-expandable name', () => {
+            // A name outside the CLI's `${NAME}` grammar would be sent verbatim as garbage; the
+            // fallback resolves it here instead, accepting environ-level exposure over a broken header.
+            const headers = (0, mcp_1.referenceHttpMcpHeaders)({ bearerTokenEnv: 'weird-name.v2' }, { 'weird-name.v2': 'tok-1' });
+            assert.deepStrictEqual(headers, { Authorization: 'Bearer tok-1' });
+            // No bearerTokenEnv and no static headers → no headers object at all.
+            assert.strictEqual((0, mcp_1.referenceHttpMcpHeaders)({}, {}), undefined);
+        });
         test('serialize and parse round-trip inline MCP', () => {
             const inline = (0, mcp_1.formatInlineMcpServers)([
                 { name: 'echo', label: 'echo', command: 'echo', args: ['hi'] },

package/out/test/model-routing.test.js

@@ -0,0 +1,133 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Model routing / credential selection tests.
+ *
+ *  Guards the fix that replaced the provider-blind precedence
+ *  (apiKey = litellm || anthropic || openai) with destination-based selection: the credential
+ *  is chosen by the endpoint the engine dials, so a codex turn never authenticates to OpenAI
+ *  with an Anthropic key (the Databricks 401), and a claude turn never uses the OpenAI key.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const utils_1 = require("../utils");
+const pack_loader_1 = require("../cli/pack-loader");
+const OPENAI = 'sk-openai-xxx';
+const ANTHROPIC = 'sk-ant-yyy';
+const LITELLM = 'sk-litellm-zzz';
+function opts(over = {}) {
+    return { workspaceRoot: '/ws', ...over };
+}
+suite('resolveApiRouting: direct path selects the ENGINE\'s provider key (no collapse)', () => {
+    // The exact Databricks scenario: both direct keys present, no proxy configured.
+    const bothKeys = { openaiApiKey: OPENAI, anthropicApiKey: ANTHROPIC };
+    test('codex (openai) picks the OpenAI key even when an Anthropic key is also present', () => {
+        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: false }), bothKeys, 'openai');
+        assert.strictEqual(r.apiKey, OPENAI);
+        assert.strictEqual(r.useLiteLLM, false);
+    });
+    test('claude (anthropic) picks the Anthropic key even when an OpenAI key is also present', () => {
+        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: false }), bothKeys, 'anthropic');
+        assert.strictEqual(r.apiKey, ANTHROPIC);
+    });
+    test('the codex→OpenAI-with-Anthropic-key 401 is impossible now', () => {
+        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: false }), bothKeys, 'openai');
+        assert.notStrictEqual(r.apiKey, ANTHROPIC, 'codex must never receive the Anthropic key');
+    });
+    test('missing provider key → empty (fail visibly), never the other provider\'s key', () => {
+        const onlyAnthropic = { anthropicApiKey: ANTHROPIC };
+        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: false }), onlyAnthropic, 'openai');
+        assert.strictEqual(r.apiKey, '', 'codex with only an Anthropic key gets no key, not the wrong one');
+    });
+});
+suite('resolveApiRouting: LiteLLM path uses the proxy key for every engine', () => {
+    const creds = { litellmApiKey: LITELLM, litellmBaseUrl: 'http://proxy:4000', openaiApiKey: OPENAI, anthropicApiKey: ANTHROPIC };
+    test('codex through the proxy uses the LiteLLM key + base URL', () => {
+        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: true }), creds, 'openai');
+        assert.strictEqual(r.apiKey, LITELLM);
+        assert.strictEqual(r.baseUrl, 'http://proxy:4000');
+        assert.strictEqual(r.useLiteLLM, true);
+    });
+    test('claude through the proxy also uses the LiteLLM key (one key routes all)', () => {
+        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: true }), creds, 'anthropic');
+        assert.strictEqual(r.apiKey, LITELLM);
+    });
+});
+suite('resolveApiRouting: explicit options.apiKey (IDE single key) still wins', () => {
+    test('IDE explicit key overrides the provider fallback on the direct path', () => {
+        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: false, apiKey: 'sk-ide-explicit' }), { openaiApiKey: OPENAI }, 'openai');
+        assert.strictEqual(r.apiKey, 'sk-ide-explicit');
+    });
+    test('IDE with only an explicit key and no creds still works (back-compat)', () => {
+        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: false, apiKey: 'sk-ide-explicit' }), {}, 'anthropic');
+        assert.strictEqual(r.apiKey, 'sk-ide-explicit');
+    });
+    test('proxy path keeps the sk-dummy fallback when nothing is configured', () => {
+        const r = (0, utils_1.resolveApiRouting)(opts({ useLiteLLM: true }), {}, 'openai');
+        assert.strictEqual(r.apiKey, 'sk-dummy');
+    });
+});
+suite('inferModelProvider: custom engines pick provider from the model id', () => {
+    test('claude/anthropic model ids → anthropic', () => {
+        assert.strictEqual((0, utils_1.inferModelProvider)('claude-sonnet-4-5'), 'anthropic');
+        assert.strictEqual((0, utils_1.inferModelProvider)('litellm/claude-haiku-4-5'), 'anthropic');
+        assert.strictEqual((0, utils_1.inferModelProvider)('anthropic/claude-opus'), 'anthropic');
+    });
+    test('everything else → openai (the safe default for gpt/codex/unknown)', () => {
+        assert.strictEqual((0, utils_1.inferModelProvider)('gpt-5.5'), 'openai');
+        assert.strictEqual((0, utils_1.inferModelProvider)('litellm/gpt-5.4-nano'), 'openai');
+        assert.strictEqual((0, utils_1.inferModelProvider)(undefined), 'openai');
+    });
+});
+suite('hasCredentialForEngine: engine-aware boot check', () => {
+    const base = { apiKey: undefined, baseUrl: undefined, useLiteLLM: false, litellmApiKey: undefined, openaiApiKey: undefined, anthropicApiKey: undefined };
+    test('codex needs an OpenAI key; an Anthropic-only env fails the check', () => {
+        assert.strictEqual((0, pack_loader_1.hasCredentialForEngine)('codex', { ...base, anthropicApiKey: ANTHROPIC }), false);
+        assert.strictEqual((0, pack_loader_1.hasCredentialForEngine)('codex', { ...base, openaiApiKey: OPENAI }), true);
+    });
+    test('claude needs an Anthropic key; an OpenAI-only env fails the check', () => {
+        assert.strictEqual((0, pack_loader_1.hasCredentialForEngine)('claude', { ...base, openaiApiKey: OPENAI }), false);
+        assert.strictEqual((0, pack_loader_1.hasCredentialForEngine)('claude', { ...base, anthropicApiKey: ANTHROPIC }), true);
+    });
+    test('a configured LiteLLM proxy satisfies every engine', () => {
+        const proxy = { ...base, useLiteLLM: true, litellmApiKey: LITELLM, baseUrl: 'http://proxy:4000' };
+        assert.strictEqual((0, pack_loader_1.hasCredentialForEngine)('codex', proxy), true);
+        assert.strictEqual((0, pack_loader_1.hasCredentialForEngine)('claude', proxy), true);
+    });
+    test('custom engines are not gated here (they authenticate via their own manifest env var)', () => {
+        assert.strictEqual((0, pack_loader_1.hasCredentialForEngine)('openclaw', base), true);
+    });
+});

package/out/test/pack-admission.test.js

@@ -0,0 +1,216 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Pack admission: fail closed by default, re-verified per turn, and say WHY.
+ *
+ *  Three gaps, one suite:
+ *    - the default was warn-and-run, so "verify before run, fail closed" was not true of the
+ *      shipped shape;
+ *    - the verdict was computed once at boot and cached for the life of the process, while the
+ *      default deployment runs the engine in-process against a `fileAccess: full` pack directory;
+ *    - each distinct failure needs its own message, because each has a different remedy.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const warrant_1 = require("../authority/warrant");
+const signature_1 = require("../pack/signature");
+const key = (0, warrant_1.generateWarrantKeypair)('k1');
+const keys = { k1: key.publicKeyPem };
+function makePack(files = { 'agent.yaml': 'name: demo\n' }) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'pack-admission-'));
+    for (const [rel, body] of Object.entries(files)) {
+        const abs = path.join(dir, rel);
+        fs.mkdirSync(path.dirname(abs), { recursive: true });
+        fs.writeFileSync(abs, body);
+    }
+    return dir;
+}
+const sign = (dir) => (0, signature_1.signPack)({ packDir: dir, pack: 'demo', packVersion: '1.0.0', privateKeyPem: key.privateKeyPem, kid: 'k1' });
+suite('signing is required by DEFAULT', () => {
+    test('nothing configured ⇒ a signature is required', () => {
+        assert.strictEqual((0, signature_1.resolveRequireSignedPack)({}), true);
+    });
+    test('the escape hatch relaxes only this instance', () => {
+        assert.strictEqual((0, signature_1.resolveRequireSignedPack)({ localAllowUnsigned: true }), false);
+    });
+    test('a lease demand OVERRIDES the escape hatch — tighten-only survives the flip', () => {
+        assert.strictEqual((0, signature_1.resolveRequireSignedPack)({ lease: true, localAllowUnsigned: true }), true, 'an instance must never be able to waive what the control plane demanded');
+    });
+    test('--require-signed-pack still means something, and still cannot be waived', () => {
+        assert.strictEqual((0, signature_1.resolveRequireSignedPack)({ localRequire: true, localAllowUnsigned: true }), true);
+    });
+    test('the underlying tighten-only OR is unchanged', () => {
+        assert.strictEqual((0, signature_1.requireSignedPack)(undefined, undefined), false);
+        assert.strictEqual((0, signature_1.requireSignedPack)(true, undefined), true);
+        assert.strictEqual((0, signature_1.requireSignedPack)(undefined, true), true);
+        assert.strictEqual((0, signature_1.requireSignedPack)(true, true), true);
+    });
+    test('the escape hatch env var is explicit, not merely present', () => {
+        assert.strictEqual((0, signature_1.allowUnsignedPackFromEnv)({ [signature_1.ALLOW_UNSIGNED_PACK_ENV]: '1' }), true);
+        assert.strictEqual((0, signature_1.allowUnsignedPackFromEnv)({ [signature_1.ALLOW_UNSIGNED_PACK_ENV]: 'true' }), true);
+        assert.strictEqual((0, signature_1.allowUnsignedPackFromEnv)({ [signature_1.ALLOW_UNSIGNED_PACK_ENV]: '0' }), false);
+        assert.strictEqual((0, signature_1.allowUnsignedPackFromEnv)({}), false);
+    });
+});
+suite('each refusal names its own remedy', () => {
+    const cases = [
+        ['unsigned', /pack sign/],
+        ['no-trust-root', /AGENTHIPPO_PACK_JWKS_URL/],
+        ['trust-root-unavailable', /could not be loaded/],
+        ['unknown-key', /does not trust/],
+        ['digest-mismatch', /changed after signing/],
+        ['identity-mismatch', /different pack or version/],
+    ];
+    for (const [kind, expected] of cases) {
+        test(`${kind} produces its own actionable message`, () => {
+            const msg = (0, signature_1.describePackRefusal)({ kind, detail: 'detail here', pack: 'demo', packVersion: '1.0.0', packDir: '/p' });
+            assert.match(msg, /refusing to run demo@1\.0\.0/);
+            assert.match(msg, expected);
+            assert.match(msg, /AGENTHIPPO_ALLOW_UNSIGNED_PACK=1/, 'every refusal must state how to get moving again');
+            assert.match(msg, /cannot be waived locally/, 'and that the lease still wins');
+        });
+    }
+    test('"no trust root" and "unsigned" are different messages with different fixes', () => {
+        const unsigned = (0, signature_1.describePackRefusal)({ kind: 'unsigned', detail: 'x', pack: 'demo' });
+        const noRoot = (0, signature_1.describePackRefusal)({ kind: 'no-trust-root', detail: 'x', pack: 'demo' });
+        assert.notStrictEqual(unsigned, noRoot);
+        assert.ok(!/NOT a problem with the pack/.test(unsigned));
+        assert.match(noRoot, /NOT a problem with the pack/);
+    });
+});
+suite('the verifier refuses each distinct failure with its kind', () => {
+    test('unsigned', () => {
+        const v = (0, signature_1.createPackVerifier)();
+        const res = v.verify({ packDir: makePack(), pack: 'demo', packVersion: '1.0.0', keys });
+        assert.strictEqual(res.ok, false);
+        assert.strictEqual(res.kind, 'unsigned');
+    });
+    test('no trust root — distinguishable from unsigned', () => {
+        const dir = makePack();
+        sign(dir);
+        const res = (0, signature_1.createPackVerifier)().verify({ packDir: dir, pack: 'demo', packVersion: '1.0.0', keys: {} });
+        assert.strictEqual(res.ok, false);
+        assert.strictEqual(res.kind, 'no-trust-root');
+    });
+    test('unknown signing key', () => {
+        const dir = makePack();
+        sign(dir);
+        const stranger = (0, warrant_1.generateWarrantKeypair)('other');
+        const res = (0, signature_1.createPackVerifier)().verify({ packDir: dir, pack: 'demo', packVersion: '1.0.0', keys: { other: stranger.publicKeyPem } });
+        assert.strictEqual(res.ok, false);
+        assert.strictEqual(res.kind, 'unknown-key');
+    });
+    test('digest mismatch', () => {
+        const dir = makePack();
+        sign(dir);
+        fs.writeFileSync(path.join(dir, 'agent.yaml'), 'name: demo\nevil: true\n');
+        const res = (0, signature_1.createPackVerifier)().verify({ packDir: dir, pack: 'demo', packVersion: '1.0.0', keys });
+        assert.strictEqual(res.ok, false);
+        assert.strictEqual(res.kind, 'digest-mismatch');
+    });
+    test('identity mismatch — a valid signature for a different pack', () => {
+        const dir = makePack();
+        sign(dir);
+        const res = (0, signature_1.createPackVerifier)().verify({ packDir: dir, pack: 'payments', packVersion: '1.0.0', keys });
+        assert.strictEqual(res.ok, false);
+        assert.strictEqual(res.kind, 'identity-mismatch');
+    });
+});
+suite('re-verification on the turn path', () => {
+    /**
+     * The exact scenario: no --sandbox, so the engine runs in-process with `fileAccess: full`. The
+     * agent edits its own pack directory after boot. Under the old boot-once cache every subsequent
+     * turn passed on a stale `true`.
+     */
+    test('a pack edited AFTER the first verification is caught on the next turn', () => {
+        const dir = makePack();
+        sign(dir);
+        const v = (0, signature_1.createPackVerifier)({ probeIntervalMs: 0 });
+        const input = { packDir: dir, pack: 'demo', packVersion: '1.0.0', keys };
+        assert.ok(v.verify(input, 1_000).ok, 'clean at boot');
+        fs.writeFileSync(path.join(dir, '.claude', 'settings.json').replace('.claude/', ''), 'x');
+        fs.mkdirSync(path.join(dir, '.claude'), { recursive: true });
+        fs.writeFileSync(path.join(dir, '.claude', 'settings.json'), '{"hooks":{"PreToolUse":[{"command":"sh"}]}}');
+        const after = v.verify(input, 2_000);
+        assert.strictEqual(after.ok, false, 'the injected hook must be caught on a later turn');
+        assert.strictEqual(after.kind, 'digest-mismatch');
+    });
+    test('an unchanged pack is NOT re-hashed on every turn — the probe is what makes this affordable', () => {
+        const dir = makePack();
+        sign(dir);
+        const v = (0, signature_1.createPackVerifier)({ probeIntervalMs: 0, fullReverifyIntervalMs: 1_000_000 });
+        const input = { packDir: dir, pack: 'demo', packVersion: '1.0.0', keys };
+        v.verify(input, 1_000);
+        const afterFirst = v.fullVerifications();
+        for (let i = 0; i < 50; i++) {
+            assert.ok(v.verify(input, 1_000 + i).ok);
+        }
+        assert.strictEqual(v.fullVerifications(), afterFirst, '50 turns, one digest');
+    });
+    test('a full re-verify happens on an interval regardless of how clean the probe looks', () => {
+        const dir = makePack();
+        sign(dir);
+        const v = (0, signature_1.createPackVerifier)({ probeIntervalMs: 0, fullReverifyIntervalMs: 5_000 });
+        const input = { packDir: dir, pack: 'demo', packVersion: '1.0.0', keys };
+        v.verify(input, 0);
+        const before = v.fullVerifications();
+        v.verify(input, 1_000);
+        assert.strictEqual(v.fullVerifications(), before, 'within the interval, the probe decides');
+        v.verify(input, 6_000);
+        assert.strictEqual(v.fullVerifications(), before + 1, 'past it, we hash regardless — bounds the mtime-restoring attacker');
+    });
+    test('changing the keyring or the version invalidates the cached verdict outright', () => {
+        const dir = makePack();
+        sign(dir);
+        const v = (0, signature_1.createPackVerifier)({ fullReverifyIntervalMs: 1_000_000 });
+        assert.ok(v.verify({ packDir: dir, pack: 'demo', packVersion: '1.0.0', keys }, 0).ok);
+        const res = v.verify({ packDir: dir, pack: 'demo', packVersion: '2.0.0', keys }, 1);
+        assert.strictEqual(res.ok, false, 'a version change must not reuse the previous verdict');
+    });
+    test('a probe within the probe interval is not even taken', () => {
+        const dir = makePack();
+        sign(dir);
+        const v = (0, signature_1.createPackVerifier)({ probeIntervalMs: 10_000, fullReverifyIntervalMs: 1_000_000 });
+        const input = { packDir: dir, pack: 'demo', packVersion: '1.0.0', keys };
+        v.verify(input, 0);
+        fs.writeFileSync(path.join(dir, 'agent.yaml'), 'tampered');
+        assert.ok(v.verify(input, 5_000).ok, 'inside the probe interval the cached verdict stands (documented)');
+        assert.strictEqual(v.verify(input, 11_000).ok, false, 'and the very next probe catches it');
+    });
+});