@agenthippo-ai/agenthippo 0.2.3-dataplane → 1.110.11

package/out/test/pack-admission.test.js

@@ -0,0 +1,216 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Pack admission: fail closed by default, re-verified per turn, and say WHY.
+ *
+ *  Three gaps, one suite:
+ *    - the default was warn-and-run, so "verify before run, fail closed" was not true of the
+ *      shipped shape;
+ *    - the verdict was computed once at boot and cached for the life of the process, while the
+ *      default deployment runs the engine in-process against a `fileAccess: full` pack directory;
+ *    - each distinct failure needs its own message, because each has a different remedy.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const warrant_1 = require("../authority/warrant");
+const signature_1 = require("../pack/signature");
+const key = (0, warrant_1.generateWarrantKeypair)('k1');
+const keys = { k1: key.publicKeyPem };
+function makePack(files = { 'agent.yaml': 'name: demo\n' }) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'pack-admission-'));
+    for (const [rel, body] of Object.entries(files)) {
+        const abs = path.join(dir, rel);
+        fs.mkdirSync(path.dirname(abs), { recursive: true });
+        fs.writeFileSync(abs, body);
+    }
+    return dir;
+}
+const sign = (dir) => (0, signature_1.signPack)({ packDir: dir, pack: 'demo', packVersion: '1.0.0', privateKeyPem: key.privateKeyPem, kid: 'k1' });
+suite('signing is required by DEFAULT', () => {
+    test('nothing configured ⇒ a signature is required', () => {
+        assert.strictEqual((0, signature_1.resolveRequireSignedPack)({}), true);
+    });
+    test('the escape hatch relaxes only this instance', () => {
+        assert.strictEqual((0, signature_1.resolveRequireSignedPack)({ localAllowUnsigned: true }), false);
+    });
+    test('a lease demand OVERRIDES the escape hatch — tighten-only survives the flip', () => {
+        assert.strictEqual((0, signature_1.resolveRequireSignedPack)({ lease: true, localAllowUnsigned: true }), true, 'an instance must never be able to waive what the control plane demanded');
+    });
+    test('--require-signed-pack still means something, and still cannot be waived', () => {
+        assert.strictEqual((0, signature_1.resolveRequireSignedPack)({ localRequire: true, localAllowUnsigned: true }), true);
+    });
+    test('the underlying tighten-only OR is unchanged', () => {
+        assert.strictEqual((0, signature_1.requireSignedPack)(undefined, undefined), false);
+        assert.strictEqual((0, signature_1.requireSignedPack)(true, undefined), true);
+        assert.strictEqual((0, signature_1.requireSignedPack)(undefined, true), true);
+        assert.strictEqual((0, signature_1.requireSignedPack)(true, true), true);
+    });
+    test('the escape hatch env var is explicit, not merely present', () => {
+        assert.strictEqual((0, signature_1.allowUnsignedPackFromEnv)({ [signature_1.ALLOW_UNSIGNED_PACK_ENV]: '1' }), true);
+        assert.strictEqual((0, signature_1.allowUnsignedPackFromEnv)({ [signature_1.ALLOW_UNSIGNED_PACK_ENV]: 'true' }), true);
+        assert.strictEqual((0, signature_1.allowUnsignedPackFromEnv)({ [signature_1.ALLOW_UNSIGNED_PACK_ENV]: '0' }), false);
+        assert.strictEqual((0, signature_1.allowUnsignedPackFromEnv)({}), false);
+    });
+});
+suite('each refusal names its own remedy', () => {
+    const cases = [
+        ['unsigned', /pack sign/],
+        ['no-trust-root', /AGENTHIPPO_PACK_JWKS_URL/],
+        ['trust-root-unavailable', /could not be loaded/],
+        ['unknown-key', /does not trust/],
+        ['digest-mismatch', /changed after signing/],
+        ['identity-mismatch', /different pack or version/],
+    ];
+    for (const [kind, expected] of cases) {
+        test(`${kind} produces its own actionable message`, () => {
+            const msg = (0, signature_1.describePackRefusal)({ kind, detail: 'detail here', pack: 'demo', packVersion: '1.0.0', packDir: '/p' });
+            assert.match(msg, /refusing to run demo@1\.0\.0/);
+            assert.match(msg, expected);
+            assert.match(msg, /AGENTHIPPO_ALLOW_UNSIGNED_PACK=1/, 'every refusal must state how to get moving again');
+            assert.match(msg, /cannot be waived locally/, 'and that the lease still wins');
+        });
+    }
+    test('"no trust root" and "unsigned" are different messages with different fixes', () => {
+        const unsigned = (0, signature_1.describePackRefusal)({ kind: 'unsigned', detail: 'x', pack: 'demo' });
+        const noRoot = (0, signature_1.describePackRefusal)({ kind: 'no-trust-root', detail: 'x', pack: 'demo' });
+        assert.notStrictEqual(unsigned, noRoot);
+        assert.ok(!/NOT a problem with the pack/.test(unsigned));
+        assert.match(noRoot, /NOT a problem with the pack/);
+    });
+});
+suite('the verifier refuses each distinct failure with its kind', () => {
+    test('unsigned', () => {
+        const v = (0, signature_1.createPackVerifier)();
+        const res = v.verify({ packDir: makePack(), pack: 'demo', packVersion: '1.0.0', keys });
+        assert.strictEqual(res.ok, false);
+        assert.strictEqual(res.kind, 'unsigned');
+    });
+    test('no trust root — distinguishable from unsigned', () => {
+        const dir = makePack();
+        sign(dir);
+        const res = (0, signature_1.createPackVerifier)().verify({ packDir: dir, pack: 'demo', packVersion: '1.0.0', keys: {} });
+        assert.strictEqual(res.ok, false);
+        assert.strictEqual(res.kind, 'no-trust-root');
+    });
+    test('unknown signing key', () => {
+        const dir = makePack();
+        sign(dir);
+        const stranger = (0, warrant_1.generateWarrantKeypair)('other');
+        const res = (0, signature_1.createPackVerifier)().verify({ packDir: dir, pack: 'demo', packVersion: '1.0.0', keys: { other: stranger.publicKeyPem } });
+        assert.strictEqual(res.ok, false);
+        assert.strictEqual(res.kind, 'unknown-key');
+    });
+    test('digest mismatch', () => {
+        const dir = makePack();
+        sign(dir);
+        fs.writeFileSync(path.join(dir, 'agent.yaml'), 'name: demo\nevil: true\n');
+        const res = (0, signature_1.createPackVerifier)().verify({ packDir: dir, pack: 'demo', packVersion: '1.0.0', keys });
+        assert.strictEqual(res.ok, false);
+        assert.strictEqual(res.kind, 'digest-mismatch');
+    });
+    test('identity mismatch — a valid signature for a different pack', () => {
+        const dir = makePack();
+        sign(dir);
+        const res = (0, signature_1.createPackVerifier)().verify({ packDir: dir, pack: 'payments', packVersion: '1.0.0', keys });
+        assert.strictEqual(res.ok, false);
+        assert.strictEqual(res.kind, 'identity-mismatch');
+    });
+});
+suite('re-verification on the turn path', () => {
+    /**
+     * The exact scenario: no --sandbox, so the engine runs in-process with `fileAccess: full`. The
+     * agent edits its own pack directory after boot. Under the old boot-once cache every subsequent
+     * turn passed on a stale `true`.
+     */
+    test('a pack edited AFTER the first verification is caught on the next turn', () => {
+        const dir = makePack();
+        sign(dir);
+        const v = (0, signature_1.createPackVerifier)({ probeIntervalMs: 0 });
+        const input = { packDir: dir, pack: 'demo', packVersion: '1.0.0', keys };
+        assert.ok(v.verify(input, 1_000).ok, 'clean at boot');
+        fs.writeFileSync(path.join(dir, '.claude', 'settings.json').replace('.claude/', ''), 'x');
+        fs.mkdirSync(path.join(dir, '.claude'), { recursive: true });
+        fs.writeFileSync(path.join(dir, '.claude', 'settings.json'), '{"hooks":{"PreToolUse":[{"command":"sh"}]}}');
+        const after = v.verify(input, 2_000);
+        assert.strictEqual(after.ok, false, 'the injected hook must be caught on a later turn');
+        assert.strictEqual(after.kind, 'digest-mismatch');
+    });
+    test('an unchanged pack is NOT re-hashed on every turn — the probe is what makes this affordable', () => {
+        const dir = makePack();
+        sign(dir);
+        const v = (0, signature_1.createPackVerifier)({ probeIntervalMs: 0, fullReverifyIntervalMs: 1_000_000 });
+        const input = { packDir: dir, pack: 'demo', packVersion: '1.0.0', keys };
+        v.verify(input, 1_000);
+        const afterFirst = v.fullVerifications();
+        for (let i = 0; i < 50; i++) {
+            assert.ok(v.verify(input, 1_000 + i).ok);
+        }
+        assert.strictEqual(v.fullVerifications(), afterFirst, '50 turns, one digest');
+    });
+    test('a full re-verify happens on an interval regardless of how clean the probe looks', () => {
+        const dir = makePack();
+        sign(dir);
+        const v = (0, signature_1.createPackVerifier)({ probeIntervalMs: 0, fullReverifyIntervalMs: 5_000 });
+        const input = { packDir: dir, pack: 'demo', packVersion: '1.0.0', keys };
+        v.verify(input, 0);
+        const before = v.fullVerifications();
+        v.verify(input, 1_000);
+        assert.strictEqual(v.fullVerifications(), before, 'within the interval, the probe decides');
+        v.verify(input, 6_000);
+        assert.strictEqual(v.fullVerifications(), before + 1, 'past it, we hash regardless — bounds the mtime-restoring attacker');
+    });
+    test('changing the keyring or the version invalidates the cached verdict outright', () => {
+        const dir = makePack();
+        sign(dir);
+        const v = (0, signature_1.createPackVerifier)({ fullReverifyIntervalMs: 1_000_000 });
+        assert.ok(v.verify({ packDir: dir, pack: 'demo', packVersion: '1.0.0', keys }, 0).ok);
+        const res = v.verify({ packDir: dir, pack: 'demo', packVersion: '2.0.0', keys }, 1);
+        assert.strictEqual(res.ok, false, 'a version change must not reuse the previous verdict');
+    });
+    test('a probe within the probe interval is not even taken', () => {
+        const dir = makePack();
+        sign(dir);
+        const v = (0, signature_1.createPackVerifier)({ probeIntervalMs: 10_000, fullReverifyIntervalMs: 1_000_000 });
+        const input = { packDir: dir, pack: 'demo', packVersion: '1.0.0', keys };
+        v.verify(input, 0);
+        fs.writeFileSync(path.join(dir, 'agent.yaml'), 'tampered');
+        assert.ok(v.verify(input, 5_000).ok, 'inside the probe interval the cached verdict stands (documented)');
+        assert.strictEqual(v.verify(input, 11_000).ok, false, 'and the very next probe catches it');
+    });
+});

package/out/test/pack-digest-parity.test.js

@@ -0,0 +1,140 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  The two digest paths must agree, or a locally-signed pack can never verify through the store.
+ *
+ *  `computePackDigest` (directory walk) excluded SEVEN names at every level;
+ *  `computePackDigestFromFiles` (fetched artifact) excluded ONE. Any pack containing `.claude/`,
+ *  `.codex/` or `.agent-hippo/` therefore produced two different digests depending on which path
+ *  looked at it — and the walk's exclusions were exactly where executable content lives.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const reconcile_1 = require("../pack/reconcile");
+const signature_1 = require("../pack/signature");
+function makeTree() {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'digest-parity-'));
+    const write = (rel, body) => {
+        const abs = path.join(dir, rel);
+        fs.mkdirSync(path.dirname(abs), { recursive: true });
+        fs.writeFileSync(abs, body);
+    };
+    write('agent.yaml', 'name: demo\n');
+    write('AGENTS.md', '# demo\n');
+    write('skills/a/SKILL.md', 'do a thing');
+    // Executable content that used to sit OUTSIDE the signature at every level.
+    write('.claude/settings.json', '{"hooks":{}}');
+    write('.codex/config.toml', 'model = "x"');
+    write('.agent-hippo/agents/x/AGENTS.md', 'nested');
+    write('nested/.claude/settings.json', '{"hooks":{"PreToolUse":[]}}');
+    // OS litter, now hashed like anything else.
+    write('.DS_Store', 'finder junk');
+    // Genuinely not pack content, excluded at every depth.
+    write('.git/HEAD', 'ref: refs/heads/main');
+    write('node_modules/dep/index.js', 'module.exports = 1');
+    write('skills/node_modules/nested-dep/index.js', 'module.exports = 2');
+    // The signature cannot cover itself.
+    write(signature_1.PACK_SIGNATURE_FILE, 'a.b.c');
+    fs.symlinkSync('agent.yaml', path.join(dir, 'link-to-agent'));
+    return dir;
+}
+suite('digest parity between the tree walk and the file list', () => {
+    test('identical trees hash identically through both paths', () => {
+        const dir = makeTree();
+        assert.strictEqual((0, signature_1.computePackDigestFromFiles)((0, reconcile_1.readDirAsFiles)(dir)), (0, signature_1.computePackDigest)(dir), 'a pack signed on disk must verify from its own file list');
+    });
+    test('a change under .claude moves BOTH digests, not just one', () => {
+        const dir = makeTree();
+        const beforeWalk = (0, signature_1.computePackDigest)(dir);
+        const beforeFiles = (0, signature_1.computePackDigestFromFiles)((0, reconcile_1.readDirAsFiles)(dir));
+        fs.writeFileSync(path.join(dir, '.claude', 'settings.json'), '{"hooks":{"PreToolUse":[{"command":"sh -c evil"}]}}');
+        assert.notStrictEqual((0, signature_1.computePackDigest)(dir), beforeWalk);
+        assert.notStrictEqual((0, signature_1.computePackDigestFromFiles)((0, reconcile_1.readDirAsFiles)(dir)), beforeFiles);
+        assert.strictEqual((0, signature_1.computePackDigestFromFiles)((0, reconcile_1.readDirAsFiles)(dir)), (0, signature_1.computePackDigest)(dir));
+    });
+    test('a change under node_modules or .git moves neither', () => {
+        const dir = makeTree();
+        const walk = (0, signature_1.computePackDigest)(dir);
+        const files = (0, signature_1.computePackDigestFromFiles)((0, reconcile_1.readDirAsFiles)(dir));
+        fs.writeFileSync(path.join(dir, 'node_modules', 'dep', 'index.js'), 'module.exports = 99');
+        fs.writeFileSync(path.join(dir, '.git', 'HEAD'), 'ref: refs/heads/other');
+        assert.strictEqual((0, signature_1.computePackDigest)(dir), walk);
+        assert.strictEqual((0, signature_1.computePackDigestFromFiles)((0, reconcile_1.readDirAsFiles)(dir)), files);
+    });
+    test('a symlink and a regular file with the same target string are distinguishable', () => {
+        const a = fs.mkdtempSync(path.join(os.tmpdir(), 'digest-link-a-'));
+        fs.symlinkSync('target.txt', path.join(a, 'x'));
+        const b = fs.mkdtempSync(path.join(os.tmpdir(), 'digest-link-b-'));
+        fs.writeFileSync(path.join(b, 'x'), 'target.txt');
+        assert.notStrictEqual((0, signature_1.computePackDigest)(a), (0, signature_1.computePackDigest)(b));
+    });
+    test('the exclusion predicate is one function, applied to relative paths', () => {
+        assert.ok((0, signature_1.isDigestExcluded)(signature_1.PACK_SIGNATURE_FILE));
+        assert.ok((0, signature_1.isDigestExcluded)('.git/HEAD'));
+        assert.ok((0, signature_1.isDigestExcluded)('a/node_modules/b'));
+        assert.ok(!(0, signature_1.isDigestExcluded)('.claude/settings.json'));
+        assert.ok(!(0, signature_1.isDigestExcluded)('.codex/config.toml'));
+        assert.ok(!(0, signature_1.isDigestExcluded)('.agent-hippo/x'));
+        assert.ok(!(0, signature_1.isDigestExcluded)('.DS_Store'));
+        // `pack.sig` is only special at the ROOT — a file of that name deeper in is content.
+        assert.ok(!(0, signature_1.isDigestExcluded)(`skills/${signature_1.PACK_SIGNATURE_FILE}`));
+    });
+});
+suite('the cheap integrity probe', () => {
+    test('it moves when content changes, and is stable when nothing does', () => {
+        const dir = makeTree();
+        const before = (0, signature_1.packTreeProbe)(dir);
+        assert.strictEqual((0, signature_1.packTreeProbe)(dir), before, 'a stat-only probe must be deterministic');
+        fs.writeFileSync(path.join(dir, 'agent.yaml'), 'name: demo\nchanged: true\n');
+        assert.notStrictEqual((0, signature_1.packTreeProbe)(dir), before);
+    });
+    test('it moves when a file is ADDED, which a per-file check would miss', () => {
+        const dir = makeTree();
+        const before = (0, signature_1.packTreeProbe)(dir);
+        fs.writeFileSync(path.join(dir, '.claude', 'hooks.json'), '{}');
+        assert.notStrictEqual((0, signature_1.packTreeProbe)(dir), before);
+    });
+    test('it ignores the same subtrees the digest does', () => {
+        const dir = makeTree();
+        const before = (0, signature_1.packTreeProbe)(dir);
+        fs.mkdirSync(path.join(dir, 'node_modules', 'new'), { recursive: true });
+        fs.writeFileSync(path.join(dir, 'node_modules', 'new', 'i.js'), 'x');
+        assert.strictEqual((0, signature_1.packTreeProbe)(dir), before);
+    });
+});

package/out/test/pack-reconcile.test.js

@@ -0,0 +1,183 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Converging on a pinned pack version. This is the path that fetches code over a network and then
+ * runs it, so every refusal below is load-bearing.
+ */
+require("mocha");
+const assert = __importStar(require("assert"));
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const warrant_1 = require("../authority/warrant");
+const signature_1 = require("../pack/signature");
+const reconcile_1 = require("../pack/reconcile");
+const key = (0, warrant_1.generateWarrantKeypair)('rel-1');
+const keys = { 'rel-1': key.publicKeyPem };
+/** Build the file list a store download would return, signed unless told otherwise. */
+function artifact(pack, version, opts = {}) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'artifact-'));
+    fs.writeFileSync(path.join(dir, 'agent.yaml'), `name: ${pack}\nversion: ${version}\n`);
+    for (const [rel, body] of Object.entries(opts.extra ?? {})) {
+        fs.mkdirSync(path.dirname(path.join(dir, rel)), { recursive: true });
+        fs.writeFileSync(path.join(dir, rel), body);
+    }
+    if (opts.sign !== false) {
+        (0, signature_1.signPack)({ packDir: dir, pack, packVersion: version, privateKeyPem: key.privateKeyPem, kid: key.kid });
+    }
+    const files = [];
+    const walk = (d, prefix) => {
+        for (const name of fs.readdirSync(d)) {
+            const abs = path.join(d, name);
+            const rel = prefix ? `${prefix}/${name}` : name;
+            if (fs.statSync(abs).isDirectory()) {
+                walk(abs, rel);
+            }
+            else {
+                files.push({ path: rel, content: fs.readFileSync(abs) });
+            }
+        }
+    };
+    walk(dir, '');
+    return files;
+}
+const packsRoot = () => path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'packsroot-')), 'packs');
+suite('pinned pack reconcile', () => {
+    test('fetches, verifies and promotes a signed version', async () => {
+        const root = packsRoot();
+        const res = await (0, reconcile_1.reconcilePinnedPack)({
+            pack: 'demo', currentVersion: '1.0.0', pinnedVersion: '2.0.0', packsRoot: root,
+            download: async () => artifact('demo', '2.0.0'), publicKeysByKid: keys,
+        });
+        assert.ok(res.ok, res.ok ? '' : res.reason);
+        assert.equal(fs.realpathSync(path.join(root, reconcile_1.CURRENT_LINK)), fs.realpathSync(path.join(root, '2.0.0')));
+        assert.ok(fs.existsSync(path.join(root, '2.0.0', signature_1.PACK_SIGNATURE_FILE)));
+    });
+    // Fetching implies verifying: this is the whole reason signing landed first.
+    test('refuses an unsigned artifact and promotes nothing', async () => {
+        const root = packsRoot();
+        const res = await (0, reconcile_1.reconcilePinnedPack)({
+            pack: 'demo', currentVersion: '1.0.0', pinnedVersion: '2.0.0', packsRoot: root,
+            download: async () => artifact('demo', '2.0.0', { sign: false }), publicKeysByKid: keys,
+        });
+        assert.equal(res.ok, false);
+        assert.match(res.reason, /not signed/);
+        assert.equal(fs.existsSync(path.join(root, reconcile_1.CURRENT_LINK)), false);
+        assert.equal(fs.existsSync(path.join(root, '2.0.0')), false);
+    });
+    test('refuses an artifact signed by an untrusted key', async () => {
+        const root = packsRoot();
+        const other = (0, warrant_1.generateWarrantKeypair)('attacker');
+        const res = await (0, reconcile_1.reconcilePinnedPack)({
+            pack: 'demo', currentVersion: '1.0.0', pinnedVersion: '2.0.0', packsRoot: root,
+            download: async () => {
+                const files = artifact('demo', '2.0.0');
+                // Re-sign the same content with a key nobody trusts.
+                const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'resign-'));
+                for (const f of files.filter((x) => x.path !== signature_1.PACK_SIGNATURE_FILE)) {
+                    fs.mkdirSync(path.dirname(path.join(dir, f.path)), { recursive: true });
+                    fs.writeFileSync(path.join(dir, f.path), f.content);
+                }
+                (0, signature_1.signPack)({ packDir: dir, pack: 'demo', packVersion: '2.0.0', privateKeyPem: other.privateKeyPem, kid: other.kid });
+                return files.filter((x) => x.path !== signature_1.PACK_SIGNATURE_FILE)
+                    .concat([{ path: signature_1.PACK_SIGNATURE_FILE, content: fs.readFileSync(path.join(dir, signature_1.PACK_SIGNATURE_FILE)) }]);
+            },
+            publicKeysByKid: keys,
+        });
+        assert.equal(res.ok, false);
+        assert.match(res.reason, /unknown signing key/);
+        assert.equal(fs.existsSync(path.join(root, reconcile_1.CURRENT_LINK)), false);
+    });
+    // An empty keyring must refuse, or "verification" would accept anything at all.
+    test('refuses when no trusted keys are configured', async () => {
+        const root = packsRoot();
+        const res = await (0, reconcile_1.reconcilePinnedPack)({
+            pack: 'demo', currentVersion: '1.0.0', pinnedVersion: '2.0.0', packsRoot: root,
+            download: async () => artifact('demo', '2.0.0'), publicKeysByKid: {},
+        });
+        assert.equal(res.ok, false);
+        assert.match(res.reason, /no trusted signing keys/);
+    });
+    // A tarball entry is untrusted input, and extraction happens BEFORE verification.
+    test('refuses an artifact whose entry escapes the pack root', async () => {
+        const root = packsRoot();
+        const res = await (0, reconcile_1.reconcilePinnedPack)({
+            pack: 'demo', currentVersion: '1.0.0', pinnedVersion: '2.0.0', packsRoot: root,
+            download: async () => [{ path: '../../escaped.txt', content: Buffer.from('pwned') }],
+            publicKeysByKid: keys,
+        });
+        assert.equal(res.ok, false);
+        assert.match(res.reason, /escapes the pack root/);
+        assert.equal(fs.existsSync(path.join(path.dirname(root), 'escaped.txt')), false);
+    });
+    test('a fetch failure leaves the fleet on what it already runs', async () => {
+        const root = packsRoot();
+        const res = await (0, reconcile_1.reconcilePinnedPack)({
+            pack: 'demo', currentVersion: '1.0.0', pinnedVersion: '2.0.0', packsRoot: root,
+            download: async () => { throw new Error('502 from the store'); }, publicKeysByKid: keys,
+        });
+        assert.equal(res.ok, false);
+        assert.match(res.reason, /502 from the store/);
+        assert.equal(fs.existsSync(path.join(root, reconcile_1.CURRENT_LINK)), false);
+    });
+    test('a cached version is reused without re-downloading, but is re-verified', async () => {
+        const root = packsRoot();
+        let downloads = 0;
+        const download = async () => { downloads++; return artifact('demo', '2.0.0'); };
+        await (0, reconcile_1.reconcilePinnedPack)({ pack: 'demo', currentVersion: '1.0.0', pinnedVersion: '2.0.0', packsRoot: root, download, publicKeysByKid: keys });
+        const second = await (0, reconcile_1.reconcilePinnedPack)({ pack: 'demo', currentVersion: '1.0.0', pinnedVersion: '2.0.0', packsRoot: root, download, publicKeysByKid: keys });
+        assert.ok(second.ok);
+        assert.equal(second.ok && second.alreadyPresent, true);
+        assert.equal(downloads, 1);
+        // Now tamper with the cached copy: local disk is exactly where something could edit it.
+        fs.appendFileSync(path.join(root, '2.0.0', 'agent.yaml'), '# edited\n');
+        const third = await (0, reconcile_1.reconcilePinnedPack)({ pack: 'demo', currentVersion: '1.0.0', pinnedVersion: '2.0.0', packsRoot: root, download, publicKeysByKid: keys });
+        assert.ok(third.ok, third.ok ? '' : third.reason);
+        assert.equal(downloads, 2, 'a tampered cache must be re-fetched, not trusted');
+    });
+    test('promotion swaps the symlink so new sandboxes see the new version', async () => {
+        const root = packsRoot();
+        await (0, reconcile_1.reconcilePinnedPack)({ pack: 'demo', currentVersion: '0', pinnedVersion: '1.0.0', packsRoot: root, download: async () => artifact('demo', '1.0.0'), publicKeysByKid: keys });
+        assert.equal(fs.realpathSync(path.join(root, reconcile_1.CURRENT_LINK)), fs.realpathSync(path.join(root, '1.0.0')));
+        await (0, reconcile_1.reconcilePinnedPack)({ pack: 'demo', currentVersion: '1.0.0', pinnedVersion: '2.0.0', packsRoot: root, download: async () => artifact('demo', '2.0.0'), publicKeysByKid: keys });
+        assert.equal(fs.realpathSync(path.join(root, reconcile_1.CURRENT_LINK)), fs.realpathSync(path.join(root, '2.0.0')));
+        // The old version stays on disk: a rollback to it must not need the network again.
+        assert.ok(fs.existsSync(path.join(root, '1.0.0')));
+    });
+});

package/out/test/pack-signature-artifact.test.js

@@ -0,0 +1,103 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const warrant_1 = require("../authority/warrant");
+const signature_1 = require("../pack/signature");
+const lease_1 = require("../pack/lease");
+const reconcile_1 = require("../pack/reconcile");
+suite('pack signature artifact verification', () => {
+    test('artifact digest changes when excluded-path content is in the fetch list', () => {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'pack-artifact-'));
+        fs.writeFileSync(path.join(dir, 'agent.yaml'), 'name: demo\n');
+        const signedDigest = (0, signature_1.computePackDigest)(dir);
+        const cleanFiles = [{ path: 'agent.yaml', content: Buffer.from('name: demo\n') }];
+        const tampered = [...cleanFiles, { path: '.claude/evil.sh', content: Buffer.from('#!/bin/sh\n') }];
+        assert.strictEqual((0, signature_1.computePackDigestFromFiles)(cleanFiles), signedDigest);
+        assert.notStrictEqual((0, signature_1.computePackDigestFromFiles)(tampered), signedDigest);
+    });
+    test('reconcile refuses artifact with tampered excluded-path content', async () => {
+        const key = (0, warrant_1.generateWarrantKeypair)('artifact-test');
+        const keys = { 'artifact-test': key.publicKeyPem };
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'signed-pack-'));
+        fs.writeFileSync(path.join(dir, 'agent.yaml'), 'name: demo\nversion: 2.0.0\n');
+        (0, signature_1.signPack)({ packDir: dir, pack: 'demo', packVersion: '2.0.0', privateKeyPem: key.privateKeyPem, kid: key.kid });
+        const files = [];
+        const walk = (d, prefix) => {
+            for (const name of fs.readdirSync(d)) {
+                const abs = path.join(d, name);
+                const rel = prefix ? `${prefix}/${name}` : name;
+                if (fs.statSync(abs).isDirectory()) {
+                    walk(abs, rel);
+                }
+                else {
+                    files.push({ path: rel, content: fs.readFileSync(abs) });
+                }
+            }
+        };
+        walk(dir, '');
+        files.push({ path: '.claude/evil.sh', content: Buffer.from('#!/bin/sh\necho pwned\n') });
+        const root = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'packsroot-')), 'packs');
+        const res = await (0, reconcile_1.reconcilePinnedPack)({
+            pack: 'demo',
+            currentVersion: '1.0.0',
+            pinnedVersion: '2.0.0',
+            packsRoot: root,
+            download: async () => files,
+            publicKeysByKid: keys,
+        });
+        assert.equal(res.ok, false);
+        assert.match(res.reason, /changed after signing/);
+        assert.equal(fs.existsSync(path.join(root, '2.0.0')), false);
+        assert.ok(!files.some((f) => f.path === signature_1.PACK_SIGNATURE_FILE) || true);
+    });
+});
+suite('serve admission active version', () => {
+    test('pinned lease admits activeVersion after converge, not boot version', () => {
+        const now = Math.floor(Date.now() / 1000);
+        const lease = { pack: 'demo', version: '2.0.0', expiresAt: now + 60, enabled: true };
+        const bootVersion = '1.0.0';
+        const activeVersion = '2.0.0';
+        assert.doesNotThrow(() => (0, lease_1.assertAdmitted)(lease, { pack: 'demo', version: activeVersion, nowSeconds: now }));
+        assert.throws(() => (0, lease_1.assertAdmitted)(lease, { pack: 'demo', version: bootVersion, nowSeconds: now }), /pinned to 2.0.0/);
+    });
+});