@agenthippo-ai/agenthippo 0.2.3-dataplane → 1.110.11

package/out/test/caps-governor.test.js

@@ -0,0 +1,460 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Caps + kill switch — the enforcement half of the control plane.
+ *
+ *  These pin the properties an enterprise operator is actually buying:
+ *   - a cap is enforced at the boundary, not requested of the agent;
+ *   - a local flag may tighten the control plane's cap, never loosen it;
+ *   - "kill" ends RUNNING work, not just new work;
+ *   - a control-plane outage does not take the fleet down.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const caps_1 = require("../pack/caps");
+const governor_1 = require("../pack/governor");
+const lease_1 = require("../pack/lease");
+/** Records what the governor did to which session. */
+function fakeSandboxes(initial = []) {
+    const state = {
+        live: [...initial],
+        destroyed: [],
+        revoked: [],
+        failRevoke: false,
+        // Session scope: one sandbox per session, so its key IS the session key.
+        sandboxes() {
+            return state.live.map((sessionKey) => ({
+                sandboxKey: sessionKey, sandboxId: `sandbox-${sessionKey}`, sessionKeys: [sessionKey],
+            }));
+        },
+        async destroySession(sessionKey) {
+            state.destroyed.push(sessionKey);
+            state.live = state.live.filter((s) => s !== sessionKey);
+        },
+        async revokeRoute(sessionKey, what) {
+            if (state.failRevoke) {
+                throw new Error('tier 0 cannot revoke one route');
+            }
+            state.revoked.push({ sessionKey, what });
+        },
+    };
+    return state;
+}
+const liveLease = (over = {}) => ({
+    pack: 'joker1',
+    enabled: true,
+    expiresAt: Math.floor(Date.now() / 1000) + 3600,
+    ...over,
+});
+suite('caps policy', () => {
+    test('local flags may only TIGHTEN the control plane, never loosen', () => {
+        const merged = (0, caps_1.mergeCaps)({ maxTurnsPerSession: 10, maxSessionSeconds: 600 }, { maxTurnsPerSession: 3, maxSessionSeconds: 9999 });
+        assert.strictEqual(merged.maxTurnsPerSession, 3, 'a lower local bound wins');
+        assert.strictEqual(merged.maxSessionSeconds, 600, 'a higher local bound must NOT raise the ceiling');
+    });
+    test('either side may escalate the breach action, neither may soften it', () => {
+        assert.strictEqual((0, caps_1.mergeCaps)({ onBreach: 'revoke-inference' }, { onBreach: 'destroy-sandbox' }).onBreach, 'destroy-sandbox');
+        assert.strictEqual((0, caps_1.mergeCaps)({ onBreach: 'destroy-sandbox' }, { onBreach: 'revoke-inference' }).onBreach, 'destroy-sandbox');
+    });
+    test('no caps anywhere is unbounded — self-hosted and dev keep working', () => {
+        assert.ok((0, caps_1.capsAreUnbounded)((0, caps_1.mergeCaps)(undefined, undefined)));
+        assert.ok(!(0, caps_1.capsAreUnbounded)((0, caps_1.mergeCaps)(undefined, { maxTurnsPerSession: 1 })));
+    });
+    test('env parsing ignores blanks and nonsense rather than guessing', () => {
+        const caps = (0, caps_1.capsFromEnv)({
+            AGENTHIPPO_MAX_TURNS_PER_SESSION: '5',
+            AGENTHIPPO_MAX_SESSION_SECONDS: '',
+            AGENTHIPPO_MAX_CONCURRENT_SANDBOXES: 'lots',
+            AGENTHIPPO_CAP_ON_BREACH: 'destroy-sandbox',
+        });
+        assert.strictEqual(caps.maxTurnsPerSession, 5);
+        assert.strictEqual(caps.maxSessionSeconds, undefined);
+        assert.strictEqual(caps.maxConcurrentSandboxes, undefined);
+        assert.strictEqual(caps.onBreach, 'destroy-sandbox');
+    });
+});
+suite('cap meter', () => {
+    test('the turn cap is checked BEFORE the turn that would exceed it', () => {
+        const meter = new caps_1.CapMeter({ maxTurnsPerSession: 2 });
+        assert.ok(meter.check('s1', 0).allowed);
+        meter.record('s1');
+        assert.ok(meter.check('s1', 0).allowed);
+        meter.record('s1');
+        const third = meter.check('s1', 0);
+        assert.ok(!third.allowed, 'the third turn must be refused, not merely reported after');
+        assert.strictEqual(third.cap, 'turns');
+    });
+    test('the duration cap runs from the first turn', () => {
+        const meter = new caps_1.CapMeter({ maxSessionSeconds: 60 });
+        const t0 = 1_000_000;
+        meter.record('s1', t0);
+        assert.ok(meter.check('s1', 0, t0 + 59_000).allowed);
+        const late = meter.check('s1', 0, t0 + 60_000);
+        assert.ok(!late.allowed);
+        assert.strictEqual(late.cap, 'duration');
+    });
+    test('concurrency bounds NEW sessions but never strands an established one', () => {
+        const meter = new caps_1.CapMeter({ maxConcurrentSandboxes: 2 });
+        meter.record('existing');
+        assert.ok(!meter.check('brand-new', 2).allowed, 'a new session is refused at the cap');
+        assert.ok(meter.check('existing', 2).allowed, 'a session that already has a sandbox keeps going');
+    });
+    test('forgetting a session resets its meter', () => {
+        const meter = new caps_1.CapMeter({ maxTurnsPerSession: 1 });
+        meter.record('s1');
+        assert.ok(!meter.check('s1', 0).allowed);
+        meter.forget('s1');
+        assert.ok(meter.check('s1', 0).allowed);
+    });
+});
+suite('governor enforcement', () => {
+    test('a breach takes the model route away — it does not ask the agent to stop', async () => {
+        const sandboxes = fakeSandboxes(['s1']);
+        const gov = (0, governor_1.createGovernor)({ caps: { maxTurnsPerSession: 1, onBreach: 'revoke-inference' }, sandboxes });
+        assert.ok((await gov.admitTurn('s1')).allowed);
+        gov.recordTurn('s1');
+        const second = await gov.admitTurn('s1');
+        assert.ok(!second.allowed);
+        assert.deepStrictEqual(sandboxes.revoked, [{ sessionKey: 's1', what: 'inference' }]);
+    });
+    test('destroy-sandbox ends the session outright', async () => {
+        const sandboxes = fakeSandboxes(['s1']);
+        const gov = (0, governor_1.createGovernor)({ caps: { maxTurnsPerSession: 1, onBreach: 'destroy-sandbox' }, sandboxes });
+        await gov.admitTurn('s1');
+        gov.recordTurn('s1');
+        await gov.admitTurn('s1');
+        assert.deepStrictEqual(sandboxes.destroyed, ['s1']);
+    });
+    test('a tier that cannot revoke one route falls back to destroying the sandbox', async () => {
+        // Tier 0 throws RevocationUnsupportedError; the cap must still hold.
+        const sandboxes = fakeSandboxes(['s1']);
+        sandboxes.failRevoke = true;
+        const gov = (0, governor_1.createGovernor)({ caps: { maxTurnsPerSession: 1, onBreach: 'revoke-inference' }, sandboxes });
+        await gov.admitTurn('s1');
+        gov.recordTurn('s1');
+        await gov.admitTurn('s1');
+        assert.deepStrictEqual(sandboxes.destroyed, ['s1'], 'the session must not survive a failed revoke');
+    });
+    test('hitting the instance concurrency cap does not punish the caller', async () => {
+        const sandboxes = fakeSandboxes(['a', 'b']);
+        const gov = (0, governor_1.createGovernor)({ caps: { maxConcurrentSandboxes: 2, onBreach: 'destroy-sandbox' }, sandboxes });
+        const decision = await gov.admitTurn('c');
+        assert.ok(!decision.allowed);
+        assert.strictEqual(decision.cap, 'concurrency');
+        assert.deepStrictEqual(sandboxes.destroyed, [], 'nobody else’s sandbox may be destroyed to make room');
+    });
+    test('unbounded caps add no gate at all', async () => {
+        const sandboxes = fakeSandboxes(['s1']);
+        const gov = (0, governor_1.createGovernor)({ caps: {}, sandboxes });
+        for (let i = 0; i < 50; i++) {
+            assert.ok((await gov.admitTurn('s1')).allowed);
+            gov.recordTurn('s1');
+        }
+        assert.deepStrictEqual(sandboxes.destroyed, []);
+    });
+});
+suite('scoped stop orders (deny rules)', () => {
+    // Hash stand-in: the real one is userNamespaceHash, but the property under test is only that
+    // serve compares a HASHED user id, so the control plane can name a person by email.
+    const hash = (u) => `H${u}`;
+    test('a session-scoped kill refuses new turns and names the operator reason', () => {
+        const lease = liveLease({ deny: [{ scope: 'session', match: 's1', mode: 'kill', reason: 'runaway' }] });
+        const v = (0, lease_1.denyVerdict)(lease, { sessionKey: 's1', pack: 'joker1' });
+        assert.strictEqual(v.denied, true);
+        assert.strictEqual(v.mode, 'kill');
+        assert.match(v.reason ?? '', /runaway/);
+        assert.strictEqual((0, lease_1.denyVerdict)(lease, { sessionKey: 's2', pack: 'joker1' }).denied, false, 'other sessions untouched');
+    });
+    test('the bare session_id matches a user-namespaced key — the id an operator actually has', () => {
+        const lease = liveLease({ deny: [{ scope: 'session', match: 'ticket-42', mode: 'drain' }] });
+        assert.strictEqual((0, lease_1.denyVerdict)(lease, { sessionKey: 'uABC--ticket-42', pack: 'p' }).denied, true);
+    });
+    test('a user-scoped rule matches every session of that user, by hash', () => {
+        const lease = liveLease({ deny: [{ scope: 'user', match: 'evil@x.com', mode: 'kill' }] });
+        const req = { pack: 'p', userHash: hash };
+        assert.strictEqual((0, lease_1.denyVerdict)(lease, { ...req, sessionKey: 'uHevil@x.com--a' }).denied, true);
+        assert.strictEqual((0, lease_1.denyVerdict)(lease, { ...req, sessionKey: 'uHevil@x.com--b' }).denied, true);
+        assert.strictEqual((0, lease_1.denyVerdict)(lease, { ...req, sessionKey: 'uHok@x.com--a' }).denied, false);
+    });
+    test('kill outranks drain when both match — an emergency is never softened', () => {
+        const lease = liveLease({ deny: [
+                { scope: 'pack', match: 'p', mode: 'drain' },
+                { scope: 'session', match: 's1', mode: 'kill' },
+            ] });
+        assert.strictEqual((0, lease_1.denyVerdict)(lease, { sessionKey: 's1', pack: 'p' }).mode, 'kill');
+    });
+    test('a spent rule is ignored, so a bounded stop lifts itself', () => {
+        const past = Math.floor(Date.now() / 1000) - 1;
+        const lease = liveLease({ deny: [{ scope: 'session', match: 's1', mode: 'kill', until: past }] });
+        assert.strictEqual((0, lease_1.denyVerdict)(lease, { sessionKey: 's1', pack: 'p' }).denied, false);
+    });
+    test('admission refuses a sandbox for a denied session', () => {
+        const lease = liveLease({ deny: [{ scope: 'session', match: 's1', mode: 'drain', reason: 'scale-in' }] });
+        assert.throws(() => (0, lease_1.assertAdmitted)(lease, { pack: 'joker1', version: '1.0.0', sessionKey: 's1' }), /scale-in/);
+        // And leaves everyone else alone.
+        (0, lease_1.assertAdmitted)(lease, { pack: 'joker1', version: '1.0.0', sessionKey: 's2' });
+    });
+    test('kill ends a running sandbox on the next poll; drain leaves it to finish', async () => {
+        const killSandboxes = fakeSandboxes(['s1']);
+        const killGov = (0, governor_1.createGovernor)({
+            caps: {}, sandboxes: killSandboxes, pack: 'joker1',
+            getLease: async () => liveLease({ deny: [{ scope: 'session', match: 's1', mode: 'kill' }] }),
+        });
+        await killGov.refresh();
+        assert.deepStrictEqual(killSandboxes.destroyed, ['s1'], 'kill destroys the live sandbox');
+        assert.strictEqual((await killGov.admitTurn('s1')).allowed, false, 'and refuses the next turn');
+        const drainSandboxes = fakeSandboxes(['s1']);
+        const drainGov = (0, governor_1.createGovernor)({
+            caps: {}, sandboxes: drainSandboxes, pack: 'joker1',
+            getLease: async () => liveLease({ deny: [{ scope: 'session', match: 's1', mode: 'drain' }] }),
+        });
+        await drainGov.refresh();
+        assert.deepStrictEqual(drainSandboxes.destroyed, [], 'drain lets the in-flight turn finish');
+        assert.strictEqual((await drainGov.admitTurn('s1')).allowed, false, 'but admits no new turn');
+    });
+});
+suite('a cap is a ceiling, not a cycle', () => {
+    /**
+     * `enforce` used to call `meter.forget` on breach, handing the session a brand-new budget the
+     * instant it exceeded the old one. `maxTurnsPerSession: 10` then meant "one refused turn in
+     * every eleven, forever" — the session ran unbounded while the console showed a cap in force.
+     */
+    test('a breached session stays breached instead of getting a fresh budget', async () => {
+        const sandboxes = fakeSandboxes(['s1']);
+        const gov = (0, governor_1.createGovernor)({
+            caps: { maxTurnsPerSession: 2, onBreach: 'destroy-sandbox' },
+            sandboxes,
+        });
+        assert.strictEqual((await gov.admitTurn('s1')).allowed, true);
+        gov.recordTurn('s1');
+        assert.strictEqual((await gov.admitTurn('s1')).allowed, true);
+        gov.recordTurn('s1');
+        const breach = await gov.admitTurn('s1');
+        assert.strictEqual(breach.allowed, false, 'the cap bites on the turn past it');
+        assert.deepStrictEqual(sandboxes.destroyed, ['s1'], 'the sandbox is destroyed on breach');
+        // The turn AFTER the breach is the one that used to be admitted again.
+        const next = await gov.admitTurn('s1');
+        assert.strictEqual(next.allowed, false, 'still refused — the meter outlived the sandbox');
+        assert.match(next.reason ?? '', /turn cap reached/);
+    });
+    test('the revoke→destroy fallback does not hand the budget back either', async () => {
+        const sandboxes = fakeSandboxes(['s1']);
+        sandboxes.failRevoke = true; // tier 0: cannot revoke one route, falls back to destroy
+        const gov = (0, governor_1.createGovernor)({ caps: { maxTurnsPerSession: 1 }, sandboxes });
+        assert.strictEqual((await gov.admitTurn('s1')).allowed, true);
+        gov.recordTurn('s1');
+        assert.strictEqual((await gov.admitTurn('s1')).allowed, false);
+        assert.deepStrictEqual(sandboxes.destroyed, ['s1'], 'fell back to destroy');
+        assert.strictEqual((await gov.admitTurn('s1')).allowed, false, 'and the cap still holds');
+    });
+});
+suite('user-scoped stop orders reach gateway sessions', () => {
+    /**
+     * A gateway sender with no explicit session id gets the key `gateway-<userId>`, which carries
+     * no `u<hash>--` prefix — so matching a `user` rule by key prefix alone silently covered none
+     * of a Telegram/Slack user's conversations while the console reported the rule applied.
+     */
+    const stopUser = (match) => liveLease({ deny: [{ scope: 'user', match, mode: 'kill', reason: 'abuse' }] });
+    test('the resolved user id matches, whatever shape the session key has', () => {
+        const lease = stopUser('telegram:12345');
+        const v = (0, lease_1.denyVerdict)(lease, {
+            sessionKey: 'gateway-telegram:12345',
+            pack: 'joker1',
+            userId: 'telegram:12345',
+        });
+        assert.ok(v.denied);
+        assert.strictEqual(v.mode, 'kill');
+    });
+    test('the namespaced-key prefix still matches when no user id is supplied', () => {
+        const hash = (u) => `h(${u})`;
+        const v = (0, lease_1.denyVerdict)(stopUser('alice@corp.com'), {
+            sessionKey: `uh(alice@corp.com)--ticket-42`,
+            pack: 'joker1',
+            userHash: hash,
+        });
+        assert.ok(v.denied, 'the sandbox-sweep path, which holds only a session key, still works');
+    });
+    test('a different user is untouched', () => {
+        const v = (0, lease_1.denyVerdict)(stopUser('telegram:12345'), {
+            sessionKey: 'gateway-telegram:99999',
+            pack: 'joker1',
+            userId: 'telegram:99999',
+        });
+        assert.ok(!v.denied);
+    });
+    test('the governor remembers the user, so the watcher kills the running sandbox too', async () => {
+        const sandboxes = fakeSandboxes(['gateway-telegram:12345']);
+        let lease = liveLease();
+        const gov = (0, governor_1.createGovernor)({ caps: {}, sandboxes, getLease: async () => lease });
+        // A turn teaches the governor which user this session belongs to.
+        await gov.admitTurn('gateway-telegram:12345', 'telegram:12345');
+        lease = stopUser('telegram:12345');
+        await gov.refresh();
+        assert.deepStrictEqual(sandboxes.destroyed, ['gateway-telegram:12345'], 'the live sandbox is destroyed, not merely refused its next turn');
+    });
+});
+suite('pack admission on the no-sandbox path', () => {
+    /**
+     * The enterprise stack runs serve WITHOUT --sandbox, and signature/pin enforcement lived only
+     * in the sandbox `admit` hook. So an operator could set requireSignedPack (or pin a version) in
+     * the console, watch the API report success, and have every instance keep serving the unsigned
+     * or unpinned pack. A control that reports success and enforces nothing is the worst outcome
+     * available — worse than not shipping the control.
+     */
+    test('an unsigned pack is refused per turn when the lease requires signing', async () => {
+        const sandboxes = fakeSandboxes();
+        const lease = liveLease({ requireSignedPack: true });
+        const gov = (0, governor_1.createGovernor)({
+            caps: {}, sandboxes, getLease: async () => lease,
+            admitPack: (_s, l) => l?.requireSignedPack
+                ? { allowed: false, reason: 'refusing to run probe: probe is not signed' }
+                : { allowed: true },
+        });
+        await gov.refresh();
+        const decision = await gov.admitTurn('s1');
+        assert.strictEqual(decision.allowed, false, 'the turn is refused with no sandbox in play');
+        assert.match(decision.reason ?? '', /not signed/, 'the operator’s reason reaches the caller');
+    });
+    test('the pack gate sees the same lease the kill and deny checks used', async () => {
+        const sandboxes = fakeSandboxes();
+        let lease = liveLease();
+        const seen = [];
+        const gov = (0, governor_1.createGovernor)({
+            caps: {}, sandboxes, getLease: async () => lease,
+            admitPack: (_s, l) => { seen.push(l?.version); return { allowed: true }; },
+        });
+        await gov.refresh();
+        await gov.admitTurn('s1');
+        // A pin published between polls must not be read by one gate and missed by another.
+        lease = liveLease({ version: '2.0.0' });
+        await gov.refresh();
+        await gov.admitTurn('s1');
+        assert.deepStrictEqual(seen, [undefined, '2.0.0']);
+    });
+    test('without admitPack the governor is unchanged — sandbox mode keeps its drain semantics', async () => {
+        const sandboxes = fakeSandboxes();
+        const gov = (0, governor_1.createGovernor)({ caps: {}, sandboxes, getLease: async () => liveLease({ version: '1.0.0' }) });
+        await gov.refresh();
+        // A pinned version does NOT refuse turns here: with a sandbox, the pin gates a sandbox's
+        // birth and running ones drain on TTL.
+        assert.strictEqual((await gov.admitTurn('s1')).allowed, true);
+    });
+});
+suite('kill switch', () => {
+    test('caps pushed by the control plane take effect on the next poll, not the next restart', async () => {
+        // Caps were read from the lease exactly once, at construction, so tightening a cap in the
+        // console did nothing until every instance restarted — the fleet reported the new policy
+        // while enforcing the old one. Caught by the live control-plane acceptance test.
+        const sandboxes = fakeSandboxes();
+        let lease = liveLease({ caps: {} });
+        const gov = (0, governor_1.createGovernor)({ caps: {}, sandboxes, getLease: async () => lease });
+        assert.strictEqual((await gov.admitTurn('s1')).allowed, true, 'unbounded to begin with');
+        gov.recordTurn('s1');
+        lease = liveLease({ caps: { maxTurnsPerSession: 1 } });
+        await gov.refresh();
+        assert.strictEqual(gov.policy().maxTurnsPerSession, 1, 'the tightened cap is now in force');
+        const after = await gov.admitTurn('s1');
+        assert.strictEqual(after.allowed, false, 'the session already over the new cap is refused');
+        assert.match(after.reason ?? '', /turn cap reached/);
+    });
+    test('leaseIsDead recognises revoked and expired, and ignores unmanaged deployments', () => {
+        assert.ok(!(0, lease_1.leaseIsDead)(undefined).dead, 'no lease ⇒ unmanaged, nothing to kill');
+        assert.ok(!(0, lease_1.leaseIsDead)(liveLease()).dead);
+        assert.ok((0, lease_1.leaseIsDead)(liveLease({ enabled: false })).dead);
+        assert.ok((0, lease_1.leaseIsDead)(liveLease({ expiresAt: Math.floor(Date.now() / 1000) - 1 })).dead);
+    });
+    test('kill ends RUNNING sandboxes, not just new ones', async () => {
+        const sandboxes = fakeSandboxes(['s1', 's2', 's3']);
+        const gov = (0, governor_1.createGovernor)({ caps: {}, sandboxes });
+        const n = await gov.killAll('operator stop');
+        assert.strictEqual(n, 3);
+        assert.deepStrictEqual(sandboxes.destroyed.sort(), ['s1', 's2', 's3']);
+    });
+    test('once the lease is dead, no further turn is admitted', async () => {
+        const sandboxes = fakeSandboxes(['s1']);
+        let lease = liveLease();
+        const gov = (0, governor_1.createGovernor)({ caps: {}, sandboxes, getLease: async () => lease, pollSeconds: 5 });
+        assert.ok((await gov.admitTurn('s1')).allowed);
+        lease = liveLease({ enabled: false, reason: 'billing hold' });
+        gov.start();
+        await gov.refresh(); // an operator hitting stop must not wait for the next poll
+        gov.stop();
+        assert.deepStrictEqual(sandboxes.destroyed, ['s1'], 'the live sandbox is gone');
+        const after = await gov.admitTurn('s1');
+        assert.ok(!after.allowed);
+        assert.match(after.reason ?? '', /billing hold/, 'the operator’s reason reaches the caller');
+    });
+    test('a control-plane outage does not kill the fleet (fail open on transport)', async () => {
+        const sandboxes = fakeSandboxes(['s1']);
+        const gov = (0, governor_1.createGovernor)({
+            caps: {}, sandboxes,
+            getLease: async () => { throw new Error('control plane unreachable'); },
+            pollSeconds: 5,
+        });
+        gov.start();
+        await new Promise((r) => setTimeout(r, 30));
+        gov.stop();
+        assert.deepStrictEqual(sandboxes.destroyed, [], 'an unreachable control plane must not stop the customer');
+        assert.ok((await gov.admitTurn('s1')).allowed);
+    });
+    test('a restored lease lifts the kill without a restart', async () => {
+        const sandboxes = fakeSandboxes(['s1']);
+        let lease = liveLease({ enabled: false });
+        const gov = (0, governor_1.createGovernor)({ caps: {}, sandboxes, getLease: async () => lease, pollSeconds: 5 });
+        gov.start();
+        await new Promise((r) => setTimeout(r, 30));
+        assert.ok(!(await gov.admitTurn('s1')).allowed);
+        lease = liveLease();
+        await gov.refresh(); // what a control-plane webhook triggers — no waiting for the poll
+        gov.stop();
+        assert.ok((await gov.admitTurn('s1')).allowed, 'the fleet comes back without a restart');
+    });
+    test('every enforcement action is auditable', async () => {
+        const events = [];
+        const sandboxes = fakeSandboxes(['s1']);
+        const gov = (0, governor_1.createGovernor)({
+            caps: { maxTurnsPerSession: 1, onBreach: 'destroy-sandbox' },
+            sandboxes,
+            audit: (event) => events.push(event),
+        });
+        await gov.admitTurn('s1');
+        gov.recordTurn('s1');
+        await gov.admitTurn('s1');
+        await gov.killAll('drill');
+        assert.ok(events.includes('cap_breach'));
+        assert.ok(events.includes('kill_switch'));
+    });
+});

package/out/test/codex-new-file-survival.test.js

@@ -0,0 +1,119 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  The invariant that broke live: a file the agent creates still exists after the turn.
+ *
+ *  codex reports shell commands only AFTER they run, so to render a new file against an empty
+ *  original the engine did read → delete → applyEdit. Headless (`serve`/`ask`/`chat` and every
+ *  sandbox) gets NoOpEditTracker, whose applyEdit is a no-op — so the delete was permanent and every
+ *  new file codex created was silently destroyed. `printf > proof.txt` exited 0, the next
+ *  `cat proof.txt` exited 1, and the file existed nowhere on disk.
+ *
+ *  Nothing asserted file survival, which is why it shipped. These tests do.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const fs = __importStar(require("fs/promises"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const codex_1 = require("../engines/codex");
+const interfaces_1 = require("../runtime/interfaces");
+/** Stands in for the IDE tracker: records the call AND writes the file back, as VSCodeEditTracker does. */
+class ApplyingEditTracker {
+    appliesEdits = true;
+    applied = [];
+    async applyEdit(_sessionId, filePath, content, isNewFile) {
+        this.applied.push({ filePath, content, isNewFile });
+        await fs.writeFile(filePath, content, 'utf-8');
+    }
+}
+/** Claims it applies edits, then throws — the file must still survive. */
+class ThrowingEditTracker {
+    appliesEdits = true;
+    async applyEdit() {
+        throw new Error('IDE workspace edit failed');
+    }
+}
+suite('codex new-file survival', () => {
+    let dir;
+    setup(async () => {
+        dir = await fs.mkdtemp(path.join(os.tmpdir(), 'codex-newfile-'));
+    });
+    teardown(async () => {
+        await fs.rm(dir, { recursive: true, force: true });
+    });
+    const writeFixture = async (name, content) => {
+        const p = path.join(dir, name);
+        await fs.writeFile(p, content, 'utf-8');
+        return p;
+    };
+    test('a no-op tracker never destroys the file (the live data-loss bug)', async () => {
+        const file = await writeFixture('proof.txt', 'SANDBOXWRITE');
+        await (0, codex_1.registerNewFilesWithTracker)([file], new interfaces_1.NoOpEditTracker(), 'session-1');
+        assert.strictEqual(await fs.readFile(file, 'utf-8'), 'SANDBOXWRITE', 'headless runs must keep the agent\'s file byte-for-byte');
+    });
+    test('an applying tracker still gets its empty-original diff', async () => {
+        const file = await writeFixture('new.ts', 'export const x = 1;\n');
+        const tracker = new ApplyingEditTracker();
+        await (0, codex_1.registerNewFilesWithTracker)([file], tracker, 'session-1');
+        assert.strictEqual(tracker.applied.length, 1, 'the IDE path must still be told about the new file');
+        assert.strictEqual(tracker.applied[0].content, 'export const x = 1;\n');
+        assert.strictEqual(tracker.applied[0].isNewFile, true);
+        assert.strictEqual(await fs.readFile(file, 'utf-8'), 'export const x = 1;\n');
+    });
+    test('a tracker that throws mid-apply does not eat the file', async () => {
+        const file = await writeFixture('fragile.txt', 'IMPORTANT');
+        await (0, codex_1.registerNewFilesWithTracker)([file], new ThrowingEditTracker(), 'session-1');
+        assert.strictEqual(await fs.readFile(file, 'utf-8'), 'IMPORTANT', 'a failed workspace edit must not leave the file deleted');
+    });
+    test('binary files are skipped, not round-tripped through UTF-8', async () => {
+        const file = path.join(dir, 'logo.png');
+        const bytes = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0xff, 0xfe]);
+        await fs.writeFile(file, bytes);
+        const tracker = new ApplyingEditTracker();
+        await (0, codex_1.registerNewFilesWithTracker)([file], tracker, 'session-1');
+        assert.strictEqual(tracker.applied.length, 0, 'binary must not be handed to a text-based applyEdit');
+        assert.deepStrictEqual(await fs.readFile(file), bytes, 'and must be byte-identical afterwards');
+    });
+    test('every file in the batch survives, not just the first', async () => {
+        const a = await writeFixture('a.txt', 'AAA');
+        const b = await writeFixture('b.txt', 'BBB');
+        const missing = path.join(dir, 'never-created.txt');
+        await (0, codex_1.registerNewFilesWithTracker)([a, missing, b], new interfaces_1.NoOpEditTracker(), 'session-1');
+        assert.strictEqual(await fs.readFile(a, 'utf-8'), 'AAA');
+        assert.strictEqual(await fs.readFile(b, 'utf-8'), 'BBB');
+    });
+});