@agenthippo-ai/agenthippo 0.2.3-dataplane → 1.110.11

package/out/test/configuration-scopes.test.js

@@ -0,0 +1,131 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *
+ *  A VS Code setting with no `scope` defaults to `window`, which means a repository's
+ *  `.vscode/settings.json` can set it. For a setting that names an auth endpoint, an install
+ *  source, a credential or a spawned command, that is remote code execution or credential theft
+ *  by checkout. This test is the regression guard: adding a sensitive setting without a scope
+ *  fails here.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+function loadPackageJson() {
+    // out/test/<file>.js → out → extensions/agentide
+    const pkgPath = path.join(__dirname, '..', '..', 'package.json');
+    return JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+}
+/**
+ * Settings a workspace must never be able to set. Each entry says WHY, because the reason is the
+ * thing a future reviewer needs in order to decide whether a new setting belongs on this list.
+ */
+const MUST_NOT_BE_WORKSPACE_SETTABLE = {
+    'agentide.auth.baseUrl': 'receives the PKCE code and the AgentHippo access token',
+    'agentide.storeRepo': 'names where packs/skills/engines are installed from',
+    'agentide.store.indexUrl': 'names where the install index is fetched from',
+    'agentide.anywhere.installSource': 'names a globally installed package whose postinstall runs',
+    'agentide.anywhere.enabled': 'enables a gateway process',
+    'agentide.anywhere.autoStart': 'starts a gateway process',
+    'agentide.anywhere.autoConnect': 'connects a gateway process',
+    'agentide.anywhere.port': 'selects the local gateway port',
+    'agentide.anywhere.hidden': 'an enterprise admin control',
+    'agentide.cli.path': 'an executable path',
+    'agentide.cli.installSource': 'a download-and-execute source',
+    'agentide.additionalEngineDir': 'a directory scanned for engines that are then executed',
+    'agentide.fallbackDirectory': 'a filesystem location used as the working root',
+    'agentide.permissions.fileAccess': 'the agent filesystem permission policy',
+    'agentide.gateway.url': 'a network destination carrying agent traffic',
+    'agentide.gateway.token': 'a credential',
+    'agentide.gateway.autoConnect': 'connects to a gateway at startup',
+    'agentide.gateway.autoRegister': 'registers packs with a gateway',
+    'agentide.providers.litellm.baseUrl': 'receives every prompt and the routing API key',
+    'agentide.providers.anthropic.baseUrl': 'receives every prompt and the Anthropic key',
+    'agentide.AgentHippoModelGateway.url': 'receives every prompt and the sign-in JWT',
+    'agentide.skills.remote.enabled': 'enables fetching agent instructions from a registry',
+    'agentide.skills.remote.registryUrl': 'names an install source for agent instructions',
+    'agentide.skills.remote.syncOnStartup': 'triggers that fetch automatically',
+    'agentide.skills.remote.allowOverwriteLocal': 'lets fetched content replace local files',
+    'agentide.analytics.fleetScriptSources': 'every entry is a command line this extension spawns',
+    'agentide.analytics.fleetSources': 'selects which of those command lines run',
+    'agentide.analytics.defaultDashboardPrompt': 'a prompt fed to an agent that writes and runs scripts',
+    'agentide.analytics.duckdb.tempDirectory': 'a filesystem path written to by the extension',
+};
+const SAFE_SCOPES = new Set(['application', 'machine']);
+suite('configuration scopes', () => {
+    const pkg = loadPackageJson();
+    const properties = pkg.contributes.configuration.properties;
+    test('every security-sensitive setting is declared and application/machine scoped', () => {
+        const failures = [];
+        for (const [key, why] of Object.entries(MUST_NOT_BE_WORKSPACE_SETTABLE)) {
+            const prop = properties[key];
+            if (!prop) {
+                failures.push(`${key}: not declared in contributes.configuration (undeclared settings are workspace-settable) — ${why}`);
+                continue;
+            }
+            const scope = prop.scope ?? 'window';
+            if (!SAFE_SCOPES.has(scope)) {
+                failures.push(`${key}: scope "${scope}" lets a repository set it — ${why}`);
+            }
+        }
+        assert.deepStrictEqual(failures, [], `\n${failures.join('\n')}\n`);
+    });
+    test('the attack from the audit is closed: agentide.auth.baseUrl is application-scoped', () => {
+        assert.strictEqual(properties['agentide.auth.baseUrl'].scope, 'application');
+    });
+    test('the pinned gateway install default is preserved', () => {
+        const prop = properties['agentide.anywhere.installSource'];
+        assert.strictEqual(prop.default, '@agenthippo-ai/hippoclaw@2026.7.28', 'the deliberate version pin (and its rationale) must not be replaced by a floating tag');
+    });
+    test('the extension declares limited untrusted-workspace support', () => {
+        const caps = pkg.capabilities?.untrustedWorkspaces;
+        assert.ok(caps, 'capabilities.untrustedWorkspaces is declared');
+        assert.strictEqual(caps.supported, 'limited');
+        assert.ok((caps.description ?? '').length > 40, 'the description explains what is limited');
+    });
+    test('every sensitive setting is also listed as a restricted configuration', () => {
+        const restricted = new Set(pkg.capabilities?.untrustedWorkspaces?.restrictedConfigurations ?? []);
+        const missing = Object.keys(MUST_NOT_BE_WORKSPACE_SETTABLE).filter((k) => !restricted.has(k));
+        assert.deepStrictEqual(missing, [], `not listed in restrictedConfigurations: ${missing.join(', ')}`);
+    });
+    test('restrictedConfigurations names only settings that exist', () => {
+        const unknown = (pkg.capabilities?.untrustedWorkspaces?.restrictedConfigurations ?? [])
+            .filter((k) => !properties[k]);
+        assert.deepStrictEqual(unknown, [], `restrictedConfigurations references undeclared settings: ${unknown.join(', ')}`);
+    });
+});

package/out/test/data-plane-engine-wiring.test.js

@@ -247,4 +247,36 @@ suite('data-plane engine wiring: loadMcpServers + claude/custom shape (no API ke
             fs.rmSync(workspace, { recursive: true, force: true });
         }
     });
+    test('the engine-home key crosses a process boundary that the credential deliberately does not', async () => {
+        const base = path.join(os.tmpdir(), 'ah-home-base');
+        // In serve: the credential frame is authoritative and no wire value is needed.
+        const inServe = await (0, credential_context_1.runWithCredential)({ userId: 'alice@corp.com' }, () => (0, paths_1.userScopedEngineHomeFromKey)(base, (0, credential_context_1.resolveEngineHomeUserKey)()));
+        assert.strictEqual(inServe, (0, paths_1.userScopedEngineHome)(base, 'alice@corp.com'));
+        // In a sandbox child: NO credential frame — which is the whole reason this regressed. The
+        // key arrives on the run frame and must land on the identical path.
+        const key = (0, paths_1.engineHomeUserKey)('alice@corp.com');
+        const inSandbox = (0, paths_1.userScopedEngineHomeFromKey)(base, (0, credential_context_1.resolveEngineHomeUserKey)(key));
+        assert.strictEqual(inSandbox, inServe, 'a sandboxed turn must resolve the same home as an in-process one');
+        // Distinct users stay distinct across the boundary — the property that was silently absent.
+        const bob = (0, paths_1.userScopedEngineHomeFromKey)(base, (0, credential_context_1.resolveEngineHomeUserKey)((0, paths_1.engineHomeUserKey)('bob@corp.com')));
+        assert.notStrictEqual(inSandbox, bob);
+        assert.ok(!inSandbox.includes('alice@corp.com'), 'the key is a hash, never the raw identity');
+    });
+    test('a credential frame outranks the wire, and a malformed key is ignored rather than trusted', async () => {
+        const base = path.join(os.tmpdir(), 'ah-home-base');
+        // A child cannot widen its own scope by sending someone else's key: where a frame exists,
+        // it wins.
+        const spoofed = await (0, credential_context_1.runWithCredential)({ userId: 'alice@corp.com' }, () => (0, credential_context_1.resolveEngineHomeUserKey)((0, paths_1.engineHomeUserKey)('bob@corp.com')));
+        assert.strictEqual(spoofed, (0, paths_1.engineHomeUserKey)('alice@corp.com'));
+        // The key is a path segment taken off the wire, so anything but the hex this produces
+        // falls back to the base dir instead of aiming an engine home elsewhere on disk.
+        for (const bad of ['../../etc', 'alice@corp.com', 'ZZZZ', '', 'abc']) {
+            assert.strictEqual((0, paths_1.userScopedEngineHomeFromKey)(base, bad), base, `rejected: ${JSON.stringify(bad)}`);
+        }
+    });
+    test('no verified user anywhere leaves the path untouched, so the IDE and single-tenant CLI are unaffected', () => {
+        const base = path.join(os.tmpdir(), 'ah-home-base');
+        assert.strictEqual((0, credential_context_1.resolveEngineHomeUserKey)(), undefined);
+        assert.strictEqual((0, paths_1.userScopedEngineHomeFromKey)(base, (0, credential_context_1.resolveEngineHomeUserKey)()), base);
+    });
 });

package/out/test/data-plane.test.js

@@ -47,6 +47,8 @@ const path = __importStar(require("path"));
 const index_js_1 = require("@modelcontextprotocol/sdk/client/index.js");
 const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/client/streamableHttp.js");
 const data_plane_1 = require("../cli/data-plane");
+const data_plane_2 = require("../cli/commands/data-plane");
+const identity_1 = require("../analytics/identity");
 // The fixture connector must live INSIDE the extension tree so its `import` of
 // @modelcontextprotocol/sdk resolves by walking up to extensions/agentide/node_modules.
 const FIXTURE_DIR = path.join(__dirname, 'data-plane-fixture');
@@ -242,3 +244,381 @@ suite('data-plane: TurnRegistry unit properties', () => {
         assert.strictEqual(reg.size, 1, 'the expired entry must have been pruned');
     });
 });
+suite('data-plane: sidecar EDGE registration (P1 fix — no forging authority in the agent container)', function () {
+    this.timeout(30_000);
+    const EDGE_TOKEN = 'edge-only-secret';
+    let sidecar;
+    let controlBase;
+    suiteSetup(async () => {
+        fs.mkdirSync(FIXTURE_DIR, { recursive: true });
+        fs.writeFileSync(CONNECTOR_PATH, CONNECTOR_SOURCE, 'utf8');
+        sidecar = await (0, data_plane_1.startDataPlaneSidecar)({
+            config: { connectorPath: CONNECTOR_PATH, provider: 'identity' },
+            registerToken: EDGE_TOKEN,
+            gatewayPort: 0,
+            controlPort: 0,
+            bindHost: '127.0.0.1',
+        });
+        controlBase = `http://127.0.0.1:${sidecar.controlPort}`;
+    });
+    suiteTeardown(async () => {
+        await sidecar?.close();
+        fs.rmSync(FIXTURE_DIR, { recursive: true, force: true });
+    });
+    async function edgeRegister(user, token = EDGE_TOKEN) {
+        // Shaped like Caddy forward_auth: GET, no body, verified identity in X-Agent-User.
+        return fetch(`${controlBase}/edge/turn`, {
+            headers: { Authorization: `Bearer ${token}`, 'X-Agent-User': user },
+        });
+    }
+    test('the edge mints a nonce for the verified user; the nonce works at the gateway as that user', async () => {
+        const res = await edgeRegister('alice@corp.com');
+        assert.strictEqual(res.status, 200);
+        const nonce = res.headers.get(data_plane_1.TURN_NONCE_HEADER);
+        assert.ok(nonce, 'nonce must ride the response header for Caddy copy_headers');
+        const who = await callWhoami(sidecar.gatewayUrl, nonce);
+        assert.strictEqual(who.userId, 'alice@corp.com');
+    });
+    test('edge registration without the edge token → 401 (the engine can route here but cannot forge)', async () => {
+        const res = await edgeRegister('victim@corp.com', 'stolen-or-missing');
+        assert.strictEqual(res.status, 401);
+    });
+    test('edge registration without a verified identity header → 400, fail closed', async () => {
+        const res = await fetch(`${controlBase}/edge/turn`, { headers: { Authorization: `Bearer ${EDGE_TOKEN}` } });
+        assert.strictEqual(res.status, 400);
+    });
+    test('serve releases an adopted turn via the gateway using ONLY the nonce; the nonce then fails closed', async () => {
+        const res = await edgeRegister('bob@corp.com');
+        const nonce = res.headers.get(data_plane_1.TURN_NONCE_HEADER);
+        const edge = new data_plane_1.EdgeDataPlane({ gatewayUrl: sidecar.gatewayUrl });
+        const turn = edge.adoptTurn(nonce);
+        assert.strictEqual(turn.env.AGENTHIPPO_TURN_NONCE, nonce);
+        assert.strictEqual(turn.env.AGENTHIPPO_DATA_MCP_URL, sidecar.gatewayUrl);
+        const who = await callWhoami(sidecar.gatewayUrl, nonce);
+        assert.strictEqual(who.userId, 'bob@corp.com');
+        await turn.release();
+        await assert.rejects(() => callWhoami(sidecar.gatewayUrl, nonce), /401|Unauthorized/i);
+    });
+    /**
+     * PR-F1 / agent-identity.md §8.5 G1.
+     *
+     * The edge forwarded `X-Agent-User` and nothing else, and `/edge/turn` registered with no
+     * inboundToken — so edge mode silently supported the `identity` provider ALONE. A
+     * `passthrough` deployment (Databricks-style OBO) booted clean and then failed closed on
+     * every single tool call, and an RFC 8693 `exchange` provider had no subject_token at all.
+     */
+    test('release with a bogus nonce is a harmless no-op (204) and touches no other turn', async () => {
+        const res = await edgeRegister('carol@corp.com');
+        const nonce = res.headers.get(data_plane_1.TURN_NONCE_HEADER);
+        const del = await fetch(new URL('/turn', sidecar.gatewayUrl), {
+            method: 'DELETE',
+            headers: { Authorization: 'Bearer not-a-real-nonce' },
+        });
+        assert.strictEqual(del.status, 204);
+        const who = await callWhoami(sidecar.gatewayUrl, nonce);
+        assert.strictEqual(who.userId, 'carol@corp.com', 'an unrelated release must not end a live turn');
+    });
+});
+/**
+ * PLAN/agent-identity.md §8.5 G1 (build record §10.5).
+ *
+ * The edge forwarded `X-Agent-User` (an identifier) and nothing else, and `/edge/turn` registered
+ * with no inboundToken. So edge mode silently supported the `identity` provider ALONE: a
+ * `passthrough` deployment (Databricks-style OBO) booted clean and then failed closed on every
+ * single tool call, and an RFC 8693 `exchange` provider had no `subject_token` to exchange at all.
+ *
+ * This suite runs a PASSTHROUGH sidecar behind the edge — the combination that could not work.
+ */
+suite('data-plane: sidecar EDGE + passthrough (PR-F1 — the edge must forward the assertion)', function () {
+    this.timeout(30_000);
+    const EDGE_TOKEN = 'edge-assertion-token';
+    let sidecar;
+    let controlBase;
+    suiteSetup(async () => {
+        fs.mkdirSync(FIXTURE_DIR, { recursive: true });
+        fs.writeFileSync(CONNECTOR_PATH, CONNECTOR_SOURCE, 'utf8');
+        sidecar = await (0, data_plane_1.startDataPlaneSidecar)({
+            config: { connectorPath: CONNECTOR_PATH, provider: 'passthrough' },
+            registerToken: EDGE_TOKEN,
+            gatewayPort: 0,
+            controlPort: 0,
+            bindHost: '127.0.0.1',
+        });
+        controlBase = `http://127.0.0.1:${sidecar.controlPort}`;
+    });
+    suiteTeardown(async () => {
+        await sidecar?.close();
+        fs.rmSync(FIXTURE_DIR, { recursive: true, force: true });
+    });
+    const register = (user, assertion) => fetch(`${controlBase}/edge/turn`, {
+        headers: {
+            Authorization: `Bearer ${EDGE_TOKEN}`,
+            'X-Agent-User': user,
+            ...(assertion ? { [data_plane_1.ASSERTION_HEADER]: assertion } : {}),
+        },
+    });
+    test('with the assertion forwarded, a passthrough turn reaches the backend as that user', async () => {
+        const res = await register('alice@corp.com', 'Bearer alice-platform-token');
+        assert.strictEqual(res.status, 200);
+        const who = await callWhoami(sidecar.gatewayUrl, res.headers.get(data_plane_1.TURN_NONCE_HEADER));
+        assert.strictEqual(who.userId, 'alice@corp.com');
+        assert.strictEqual(who.credential, 'alice-platform-token', 'the assertion becomes the turn inboundToken, and passthrough hands it to the connector');
+    });
+    test('a bare "Bearer " prefix is stripped — the connector gets the token, not the scheme', async () => {
+        const res = await register('bob@corp.com', 'Bearer   bob-token');
+        const who = await callWhoami(sidecar.gatewayUrl, res.headers.get(data_plane_1.TURN_NONCE_HEADER));
+        assert.strictEqual(who.credential, 'bob-token');
+    });
+    test('an assertion sent WITHOUT the scheme prefix is taken verbatim', async () => {
+        const res = await register('carol@corp.com', 'carol-raw-token');
+        const who = await callWhoami(sidecar.gatewayUrl, res.headers.get(data_plane_1.TURN_NONCE_HEADER));
+        assert.strictEqual(who.credential, 'carol-raw-token');
+    });
+    test('WITHOUT the assertion the turn still registers, but every call fails closed — the pre-PR-F1 behaviour', async () => {
+        const res = await register('dave@corp.com');
+        assert.strictEqual(res.status, 200, 'registration itself must not depend on the assertion');
+        const { client, transport } = mcpClient(sidecar.gatewayUrl, res.headers.get(data_plane_1.TURN_NONCE_HEADER));
+        await client.connect(transport);
+        const out = await client.callTool({ name: 'whoami', arguments: {} });
+        await client.close();
+        assert.strictEqual(out.isError, true);
+        assert.match(out.content[0].text, /fail-closed/, 'no inbound credential must never fall back to a shared one');
+    });
+});
+/**
+ * PLAN/agent-identity.md §10.1 — the audit writer.
+ *
+ * The sidecar accepted an optional `audit` and `dataPlaneSidecarCommand` never passed one. Because
+ * every emit site is `opts.audit?.(…)`, the entire data-plane trust-boundary record was silently
+ * discarded in sidecar and edge mode — the two shapes the blueprints deploy. The compliance claim
+ * ("which user touched which rows") had no writer exactly where it was being made.
+ *
+ * These tests pin both halves: the sink the command builds actually writes, and the sidecar
+ * actually emits through it on the authorize / deny / reject paths.
+ */
+suite('data-plane: sidecar audit sink (PR-0 — the record must have a writer)', function () {
+    this.timeout(30_000);
+    const TOKEN = 'audit-suite-token';
+    const AUDIT_ROOT = path.join(FIXTURE_DIR, 'audit-state');
+    let sidecar;
+    let controlBase;
+    let auditDir;
+    const rows = () => {
+        if (!fs.existsSync(auditDir)) {
+            return [];
+        }
+        return fs.readdirSync(auditDir)
+            .filter((f) => f.endsWith('.jsonl'))
+            .flatMap((f) => fs.readFileSync(path.join(auditDir, f), 'utf8')
+            .split('\n').filter(Boolean).map((l) => JSON.parse(l)));
+    };
+    // The writer is fire-and-forget (`void writer.append(...)`) so the audit write must never
+    // delay a tool call. Poll briefly rather than sleeping a fixed amount.
+    const waitForEvent = async (eventType, 
+    // Without a predicate this matches the FIRST row of the type, which may be one an earlier
+    // test wrote — and then the row under test may not have landed yet. Pass a predicate
+    // whenever a specific row is meant.
+    where = () => true, timeoutMs = 5_000) => {
+        const deadline = Date.now() + timeoutMs;
+        for (;;) {
+            const hit = rows().find((r) => r.event_type === eventType && where(r.payload));
+            if (hit) {
+                return hit;
+            }
+            if (Date.now() > deadline) {
+                assert.fail(`no matching "${eventType}" event within ${timeoutMs}ms; saw: ${JSON.stringify(rows().map((r) => r.event_type))}`);
+            }
+            await new Promise((r) => setTimeout(r, 50));
+        }
+    };
+    suiteSetup(async () => {
+        fs.mkdirSync(FIXTURE_DIR, { recursive: true });
+        fs.writeFileSync(CONNECTOR_PATH, CONNECTOR_SOURCE, 'utf8');
+        const sink = await (0, data_plane_2.createDataPlaneAuditSink)(AUDIT_ROOT);
+        assert.strictEqual(sink.ok, true, sink.error);
+        assert.strictEqual(sink.ephemeral, false, 'an explicit state dir is durable');
+        auditDir = sink.auditDir;
+        sidecar = await (0, data_plane_1.startDataPlaneSidecar)({
+            config: { connectorPath: CONNECTOR_PATH, provider: 'identity' },
+            registerToken: TOKEN,
+            gatewayPort: 0,
+            controlPort: 0,
+            bindHost: '127.0.0.1',
+            audit: sink.audit,
+        });
+        controlBase = `http://127.0.0.1:${sidecar.controlPort}`;
+    });
+    suiteTeardown(async () => {
+        await sidecar?.close();
+        fs.rmSync(FIXTURE_DIR, { recursive: true, force: true });
+    });
+    test('an authorized tool call is recorded with the tool and the verified principal', async () => {
+        const res = await fetch(`${controlBase}/edge/turn`, {
+            headers: { Authorization: `Bearer ${TOKEN}`, 'X-Agent-User': 'dana@corp.com' },
+        });
+        const nonce = res.headers.get(data_plane_1.TURN_NONCE_HEADER);
+        const who = await callWhoami(sidecar.gatewayUrl, nonce);
+        assert.strictEqual(who.userId, 'dana@corp.com');
+        const ev = await waitForEvent('tool_authorize');
+        const payload = ev.payload;
+        assert.strictEqual(payload.tool, 'whoami');
+        assert.strictEqual(payload.userId, (0, identity_1.hashIdentity)('dana@corp.com'));
+        assert.strictEqual(payload.provider, 'identity');
+    });
+    test('an edge registration is recorded', async () => {
+        const ev = await waitForEvent('sidecar_edge_register');
+        assert.strictEqual(ev.payload.userId, (0, identity_1.hashIdentity)('dana@corp.com'));
+    });
+    /**
+     * These records ship wholesale to the evidence server, so whatever lands here leaves the
+     * machine. The tool-event lane already pseudonymises (ObservableStreamEmitter → hashIdentity);
+     * the data-plane lane must not be the one that exports raw addresses. In EDGE mode the sidecar
+     * registers with `sessionKey: userId`, so without this the evidence FILE is `alice@corp.com.jsonl`.
+     */
+    test('no raw address reaches the record — not in a payload, not in a filename', () => {
+        const files = fs.readdirSync(auditDir);
+        assert.ok(files.length > 0, 'the suite must have produced evidence by now');
+        for (const f of files) {
+            assert.ok(!f.includes('@'), `evidence filename must not carry an address: ${f}`);
+        }
+        const serialized = JSON.stringify(rows());
+        const anon = (0, identity_1.hashIdentity)('dana@corp.com');
+        assert.ok(anon, 'hashIdentity must yield a pseudonym for a non-empty address');
+        assert.ok(!serialized.includes('dana@corp.com'), 'a raw address must never reach the record');
+        assert.ok(serialized.includes(anon), 'the salted hash is the join key and must be present');
+    });
+    test('a rejected registration is recorded — the reject path is the one an auditor asks about', async () => {
+        const res = await fetch(`${controlBase}/edge/turn`, {
+            headers: { Authorization: 'Bearer wrong-token', 'X-Agent-User': 'mallory@corp.com' },
+        });
+        assert.strictEqual(res.status, 401);
+        const ev = await waitForEvent('sidecar_register_reject');
+        assert.strictEqual(ev.payload.reason, 'bad_token');
+    });
+    test('an unknown nonce at the gateway is recorded, and never logs the raw nonce', async () => {
+        await assert.rejects(() => callWhoami(sidecar.gatewayUrl, 'forged-nonce-value'), /401|Unauthorized/i);
+        const ev = await waitForEvent('nonce_reject');
+        const payload = ev.payload;
+        assert.strictEqual(payload.reason, 'unknown_or_expired');
+        assert.ok(payload.nonce_sha256_prefix, 'a hash prefix must be present');
+        const serialized = JSON.stringify(rows());
+        assert.ok(!serialized.includes('forged-nonce-value'), 'a raw nonce must never reach the audit record');
+    });
+    test('the assertion is fingerprinted in the record, never carried raw', async () => {
+        const secret = 'super-secret-user-assertion-value';
+        await fetch(`${controlBase}/edge/turn`, {
+            headers: { Authorization: `Bearer ${TOKEN}`, 'X-Agent-User': 'erin@corp.com', [data_plane_1.ASSERTION_HEADER]: `Bearer ${secret}` },
+        });
+        const ev = await waitForEvent('sidecar_edge_register', (p) => p.userId === (0, identity_1.hashIdentity)('erin@corp.com'));
+        assert.match(String(ev.payload.assertion), /^sha256:[0-9a-f]{12}$/, 'a hash prefix must prove which assertion the turn used');
+        assert.ok(!JSON.stringify(rows()).includes(secret), 'a user assertion is a bearer credential and must never reach the record');
+    });
+    test('an unwritable audit root reports ok:false rather than throwing, so the caller sets the policy', async () => {
+        // A path whose parent is a FILE — mkdir -p cannot succeed.
+        const blocker = path.join(FIXTURE_DIR, 'not-a-dir');
+        fs.writeFileSync(blocker, 'x', 'utf8');
+        const sink = await (0, data_plane_2.createDataPlaneAuditSink)(path.join(blocker, 'nested'));
+        assert.strictEqual(sink.ok, false);
+        assert.ok(sink.error, 'the failure reason must be reportable to the operator');
+    });
+});
+/**
+ * PLAN/agent-identity.md §10.6 — the audit stamp and the agent field.
+ *
+ * Design §1's third failure was "the auditor's second question is unanswerable" — *why could the
+ * invoice agent reach the HR schema at all*. PR-0 gave the record a writer, which made "which user
+ * touched which rows" answerable. It did not make "via which agent" answerable: rows carried
+ * `{tool, userId, provider}` and nothing about the pack. The agent was only ever IMPLIED, by which
+ * deployment happened to write the file — and that implication is exactly what breaks when two
+ * serves share one connector (§4.4).
+ */
+suite('data-plane: every audit row names the AGENT, not just the user', function () {
+    this.timeout(30_000);
+    const TOKEN = 'agent-stamp-token';
+    const AUDIT_ROOT = path.join(FIXTURE_DIR, 'agent-stamp-state');
+    const LOADED = { pack: 'invoice-agent', version: '1.4.0' };
+    let sidecar;
+    let controlBase;
+    let auditDir;
+    const rows = () => (fs.existsSync(auditDir) ? fs.readdirSync(auditDir) : [])
+        .filter((f) => f.endsWith('.jsonl'))
+        .flatMap((f) => fs.readFileSync(path.join(auditDir, f), 'utf8')
+        .split('\n').filter(Boolean).map((l) => JSON.parse(l)));
+    const waitFor = async (pred) => {
+        const deadline = Date.now() + 5_000;
+        for (;;) {
+            const hit = rows().find(pred);
+            if (hit) {
+                return hit;
+            }
+            if (Date.now() > deadline) {
+                assert.fail(`no matching row; saw ${JSON.stringify(rows().map((r) => r.event_type))}`);
+            }
+            await new Promise((r) => setTimeout(r, 50));
+        }
+    };
+    suiteSetup(async () => {
+        fs.mkdirSync(FIXTURE_DIR, { recursive: true });
+        fs.writeFileSync(CONNECTOR_PATH, CONNECTOR_SOURCE, 'utf8');
+        const sink = await (0, data_plane_2.createDataPlaneAuditSink)(AUDIT_ROOT, LOADED);
+        auditDir = sink.auditDir;
+        sidecar = await (0, data_plane_1.startDataPlaneSidecar)({
+            config: { connectorPath: CONNECTOR_PATH, provider: 'identity' },
+            registerToken: TOKEN, gatewayPort: 0, controlPort: 0, bindHost: '127.0.0.1',
+            audit: sink.audit, agent: LOADED,
+        });
+        controlBase = `http://127.0.0.1:${sidecar.controlPort}`;
+    });
+    suiteTeardown(async () => {
+        await sidecar?.close();
+        fs.rmSync(FIXTURE_DIR, { recursive: true, force: true });
+    });
+    test('a tool call records WHICH AGENT served it — the auditor\'s second question', async () => {
+        const res = await fetch(`${controlBase}/edge/turn`, {
+            headers: { Authorization: `Bearer ${TOKEN}`, 'X-Agent-User': 'alice@corp.com' },
+        });
+        await callWhoami(sidecar.gatewayUrl, res.headers.get(data_plane_1.TURN_NONCE_HEADER));
+        const ev = await waitFor((r) => r.event_type === 'tool_authorize');
+        assert.deepStrictEqual(ev.payload.agent, { ...LOADED, digest: null }, 'without this the row says which USER touched the rows and nothing about the agent');
+    });
+    test('the sidecar claims no digest it has not verified', async () => {
+        const ev = await waitFor((r) => r.event_type === 'tool_authorize');
+        assert.strictEqual(ev.payload.agent.digest, null, 'pack-loader does not verify signatures in the sidecar; a digest here would dress an '
+            + 'unverified read as an attestation');
+    });
+    test('PR-8: a registration records the agent it CLAIMS, marked as asserted', async () => {
+        await fetch(`${controlBase}/turns`, {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ userId: 'bob@corp.com', sessionKey: 's-claim', agent: { pack: 'invoice-agent' } }),
+        });
+        const ev = await waitFor((r) => r.event_type === 'sidecar_register' && r.payload.claimedAgent === 'invoice-agent');
+        assert.strictEqual(ev.payload.binding, 'asserted', 'the register token is shared, so the claim is only as good as whoever holds it — '
+            + 'evidence must never present it as verified');
+        assert.strictEqual(ev.payload.agentMismatch, undefined);
+    });
+    test('PR-8 / §4.4: a DIFFERENT agent on the same connector is flagged, not silently accepted', async () => {
+        // The invariant E2 rests on: one connector, one agent. It is unenforceable over a shared
+        // bearer, so the deliverable is that it becomes VISIBLE the moment it is violated.
+        const res = await fetch(`${controlBase}/turns`, {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ userId: 'mallory@corp.com', sessionKey: 's-other', agent: { pack: 'hr-agent' } }),
+        });
+        assert.strictEqual(res.status, 200, 'it must still register — refusing on an unverifiable claim would let anyone with the '
+            + 'token deny service by lying about the pack');
+        const ev = await waitFor((r) => r.event_type === 'sidecar_register' && r.payload.claimedAgent === 'hr-agent');
+        assert.strictEqual(ev.payload.agentMismatch, true);
+        assert.strictEqual(ev.payload.loadedAgent, 'invoice-agent');
+    });
+    test('a registration with no agent claim still works — the field is optional', async () => {
+        const res = await fetch(`${controlBase}/turns`, {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ userId: 'carol@corp.com', sessionKey: 's-none' }),
+        });
+        assert.strictEqual(res.status, 200);
+        const ev = await waitFor((r) => r.event_type === 'sidecar_register' && r.payload.claimedAgent === 'none');
+        assert.strictEqual(ev.payload.agentMismatch, undefined, 'absent is not a mismatch');
+    });
+});

package/out/test/deploy-init.test.js

@@ -424,7 +424,7 @@ suite('deploy-init: renderTarget produces well-formed artifacts', () => {
         const rendered = svc
             .replace(/\$\{SERVICE\}/g, 'customer-service-edge')
             .replace(/\$\{IMAGE\}/g, 'us-docker.pkg.dev/x/y/z:latest')
-            .replace(/\$\{LITELLM_IMAGE\}/g, 'ghcr.io/agenthippo/litellm-gateway:2026.06')
+            .replace(/\$\{LITELLM_IMAGE\}/g, 'ghcr.io/agenthippoai/agenthippo-litellm:2026.06')
             .replace(/\$\{PUBLIC_HOSTNAME\}/g, 'cs.agenthippo.ai')
             .replace(/\$\{ALLOWED_DOMAINS\}/g, 'agenthippo.ai');
         assert.doesNotThrow(() => yaml.load(rendered), 'rendered service.yaml is valid YAML');
@@ -676,6 +676,52 @@ suite('deploy-init: renderTarget produces well-formed artifacts', () => {
             assert.ok(files['Dockerfile'].includes('--www-dir'), 'serve enables static chat UI after SSO');
         });
     }
+    test('colocate + edgeTurnConnector emits the P1 edge turn-registration block (obo-inprogress §2)', () => {
+        const ctx = {
+            ...CTX, ingress: 'edge-fed', idpUrl: 'https://auth.corp.example', colocate: true,
+            edgeTurnConnector: 'databricks-analyst-connector:9091',
+        };
+        const snippet = (0, deploy_init_1.renderTarget)('vm', ctx)['agent-route.caddy'];
+        // Hygiene: a client-supplied nonce header must never pass through.
+        assert.ok(snippet.includes('request_header -X-Agent-Turn-Nonce'), 'inbound X-Agent-Turn-Nonce is stripped at the edge');
+        // PR-F1 (agent-identity.md §8.5 G1): the edge must forward the user ASSERTION, not just
+        // the identifier, or the turn carries no inboundToken — `passthrough` then fails closed on
+        // every call and an `exchange` provider has no subject_token. Forged copies are stripped
+        // for the same reason as the nonce: this one becomes the turn's inboundToken.
+        assert.ok(snippet.includes('request_header -X-Agent-User-Assertion'), 'inbound X-Agent-User-Assertion is stripped at the edge');
+        assert.ok(snippet.includes('copy_headers X-Agent-User X-Agent-User-Assertion'), 'the verified assertion is copied from /api/ide/me alongside the identity');
+        // Only POST chat turns register.
+        assert.ok(snippet.includes('@turnStart'), 'chat-turn matcher present');
+        assert.ok(/@turnStart\s*\{\s*\n\s*method POST\s*\n\s*path \/v1\/chat \/v1\/chat\/stream/m.test(snippet), '@turnStart matches POST /v1/chat and /v1/chat/stream only');
+        // The registration hop itself: forward_auth to the connector control API, nonce copied
+        // onto the proxied request, register token from the EDGE stack env (never the agent).
+        assert.ok(snippet.includes('forward_auth @turnStart databricks-analyst-connector:9091'), 'turn registration targets the connector control API');
+        assert.ok(snippet.includes('uri /edge/turn'), 'registration path is /edge/turn');
+        assert.ok(snippet.includes('copy_headers X-Agent-Turn-Nonce'), 'minted nonce copied onto the request');
+        assert.ok(snippet.includes('header_up Authorization "Bearer {$DATABRICKS_ANALYST_DATA_PLANE_TOKEN}"'), 'register token comes from the derived edge-stack env var');
+        // Ordering (the Caddy footgun the hand-built overlay documents): two forward_auth in one
+        // handle do NOT run in source order unless wrapped in route {} — identity must run first
+        // so X-Agent-User exists when the sidecar mints the nonce.
+        assert.ok(snippet.includes('route {'), 'gated sequence wrapped in route {} to force source order');
+        const apiBlock = snippet.slice(snippet.indexOf('handle @apiWithAuth'));
+        const identityIdx = apiBlock.indexOf('forward_auth auth-broker:9780');
+        const turnIdx = apiBlock.indexOf('forward_auth @turnStart');
+        const proxyIdx = apiBlock.indexOf('reverse_proxy databricks-analyst-agent:8080');
+        assert.ok(identityIdx >= 0 && turnIdx > identityIdx && proxyIdx > turnIdx, 'order inside route {}: identity → turn registration → proxy');
+        // Both gated paths carry the hop: Bearer API clients AND cookie-auth browser clients.
+        assert.strictEqual(snippet.split('uri /edge/turn').length - 1, 2, 'turn registration on both the @apiWithAuth and browser catch-all paths');
+        // The operator README says where the token goes (IdP stack env, never the agent).
+        const readme = (0, deploy_init_1.renderTarget)('vm', ctx)['README.md'];
+        assert.ok(readme.includes('DATABRICKS_ANALYST_DATA_PLANE_TOKEN'), 'README documents the edge-stack register token env var');
+    });
+    test('without edgeTurnConnector the route snippet is unchanged — no /edge/turn, no route {}', () => {
+        const ctx = {
+            ...CTX, ingress: 'edge-fed', idpUrl: 'https://auth.corp.example', colocate: true,
+        };
+        const snippet = (0, deploy_init_1.renderTarget)('vm', ctx)['agent-route.caddy'];
+        assert.ok(!snippet.includes('/edge/turn') && !snippet.includes('@turnStart')
+            && !snippet.includes('X-Agent-Turn-Nonce') && !snippet.includes('route {'), 'turn registration is strictly opt-in; default output must not change');
+    });
     test('--colocate is a no-op without --ingress edge-fed (still ships the normal self-issued edge)', () => {
         const files = (0, deploy_init_1.renderTarget)('vm', { ...CTX, colocate: true });
         assert.ok(files['Caddyfile'], 'no ingress edge-fed → colocate does not apply, normal vm artifacts render');