@agenthippo-ai/agenthippo 0.2.3-dataplane → 1.110.9

package/out/test/governor-hardening.test.js

@@ -0,0 +1,217 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Governor hardening: kill that means kill (or says it does not), budgets that survive a kill,
+ *  session stops that survive session_id rotation, and one constant for the poll interval.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const governor_1 = require("../pack/governor");
+const lease_1 = require("../pack/lease");
+function fakeSandboxes(initial = [], supportsInFlightTermination = true) {
+    const state = {
+        live: [...initial],
+        destroyed: [],
+        revoked: [],
+        supportsInFlightTermination,
+        sandboxes() { return state.live.map((sessionKey) => ({ sessionKey, sandboxId: `sandbox-${sessionKey}` })); },
+        async destroySession(sessionKey) {
+            state.destroyed.push(sessionKey);
+            state.live = state.live.filter((s) => s !== sessionKey);
+        },
+        async revokeRoute(sessionKey, what) {
+            state.revoked.push({ sessionKey, what });
+        },
+    };
+    return state;
+}
+const liveLease = (over = {}) => ({
+    pack: 'joker1',
+    enabled: true,
+    expiresAt: Math.floor(Date.now() / 1000) + 3600,
+    ...over,
+});
+suite('kill never silently degrades to drain', () => {
+    test('without a sandbox driver, kill is REPORTED as the drain it actually is', async () => {
+        const lines = [];
+        const events = [];
+        const sandboxes = fakeSandboxes([], false);
+        const gov = (0, governor_1.createGovernor)({
+            caps: {}, sandboxes, pack: 'joker1',
+            getLease: async () => liveLease({ deny: [{ scope: 'session', match: 's1', mode: 'kill' }] }),
+            logger: { info: (m) => lines.push(m), warn: (m) => lines.push(m) },
+            audit: (event, fields) => events.push({ event, fields }),
+        });
+        await gov.refresh();
+        assert.ok(lines.some((l) => /DEGRADED TO DRAIN/.test(l)), 'the console must not claim kill when it means drain');
+        assert.ok(events.some((e) => e.event === 'deny_kill_degraded' && e.fields.effectiveMode === 'drain'));
+        // The substance still holds: the NEXT turn is refused.
+        assert.strictEqual((await gov.admitTurn('s1')).allowed, false);
+    });
+    test('the warning is once per rule, not once per poll', async () => {
+        const lines = [];
+        const sandboxes = fakeSandboxes([], false);
+        const gov = (0, governor_1.createGovernor)({
+            caps: {}, sandboxes, pack: 'joker1',
+            getLease: async () => liveLease({ deny: [{ scope: 'session', match: 's1', mode: 'kill' }] }),
+            logger: { info: (m) => lines.push(m), warn: (m) => lines.push(m) },
+        });
+        await gov.refresh();
+        await gov.refresh();
+        await gov.refresh();
+        assert.strictEqual(lines.filter((l) => /DEGRADED TO DRAIN/.test(l)).length, 1);
+    });
+    test('with a driver, kill still ends running work', async () => {
+        const sandboxes = fakeSandboxes(['s1'], true);
+        const gov = (0, governor_1.createGovernor)({
+            caps: {}, sandboxes, pack: 'joker1',
+            getLease: async () => liveLease({ deny: [{ scope: 'session', match: 's1', mode: 'kill' }] }),
+        });
+        await gov.refresh();
+        assert.deepStrictEqual(sandboxes.destroyed, ['s1']);
+    });
+    test('the kill switch itself says so when it can only refuse new work', async () => {
+        const lines = [];
+        const gov = (0, governor_1.createGovernor)({
+            caps: {}, sandboxes: fakeSandboxes([], false),
+            logger: { info: (m) => lines.push(m), warn: (m) => lines.push(m) },
+        });
+        await gov.killAll('drill');
+        assert.ok(lines.some((l) => /nothing running can be stopped/.test(l)));
+    });
+    test('effectiveDenyMode is the one place that decides', () => {
+        assert.strictEqual((0, governor_1.effectiveDenyMode)('kill', true), 'kill');
+        assert.strictEqual((0, governor_1.effectiveDenyMode)('kill', false), 'drain');
+        assert.strictEqual((0, governor_1.effectiveDenyMode)('drain', false), 'drain');
+        assert.strictEqual((0, governor_1.effectiveDenyMode)(undefined, false), undefined);
+    });
+});
+suite('a kill does not hand back budgets', () => {
+    /**
+     * `killAll` called `meter.forget` on every session it killed, so a kill-then-restore (a billing
+     * hold lifted, a drill, an operator toggling the switch) gave every session a brand-new turn and
+     * duration budget. The cheapest way past a cap was to trip the kill switch. The cap-breach path
+     * deliberately did NOT do this, and explains why.
+     */
+    test('a session over its turn cap is still over it after a kill and a restore', async () => {
+        const sandboxes = fakeSandboxes(['s1']);
+        let lease = liveLease({ caps: { maxTurnsPerSession: 2 } });
+        const gov = (0, governor_1.createGovernor)({ caps: {}, sandboxes, getLease: async () => lease });
+        await gov.refresh();
+        assert.ok((await gov.admitTurn('s1')).allowed);
+        gov.recordTurn('s1');
+        assert.ok((await gov.admitTurn('s1')).allowed);
+        gov.recordTurn('s1');
+        lease = liveLease({ enabled: false, caps: { maxTurnsPerSession: 2 } });
+        await gov.refresh();
+        lease = liveLease({ caps: { maxTurnsPerSession: 2 } });
+        await gov.refresh();
+        const after = await gov.admitTurn('s1');
+        assert.strictEqual(after.allowed, false, 'the kill must not renew the budget');
+        assert.match(after.reason ?? '', /turn cap reached/);
+    });
+    test('a deny(kill) does not renew the budget either', async () => {
+        const sandboxes = fakeSandboxes(['s1']);
+        let lease = liveLease({ caps: { maxTurnsPerSession: 1 } });
+        const gov = (0, governor_1.createGovernor)({ caps: {}, sandboxes, pack: 'joker1', getLease: async () => lease });
+        await gov.refresh();
+        assert.ok((await gov.admitTurn('s1')).allowed);
+        gov.recordTurn('s1');
+        lease = liveLease({ caps: { maxTurnsPerSession: 1 }, deny: [{ scope: 'session', match: 's1', mode: 'kill' }] });
+        await gov.refresh();
+        lease = liveLease({ caps: { maxTurnsPerSession: 1 } });
+        await gov.refresh();
+        const after = await gov.admitTurn('s1');
+        assert.strictEqual(after.allowed, false);
+        assert.match(after.reason ?? '', /turn cap reached/);
+    });
+});
+suite('session-scoped stops and the client-supplied session_id', () => {
+    test('a session rule bound to a user does not match another account replaying the id', () => {
+        const lease = liveLease({ deny: [{ scope: 'session', match: 'ticket-42', mode: 'kill', user: 'alice@x.com' }] });
+        assert.ok((0, lease_1.denyVerdict)(lease, { sessionKey: 'uH--ticket-42', pack: 'joker1', userId: 'alice@x.com' }).denied);
+        assert.ok(!(0, lease_1.denyVerdict)(lease, { sessionKey: 'uH--ticket-42', pack: 'joker1', userId: 'mallory@x.com' }).denied);
+    });
+    test('rotating session_id does not escape a session stop once the user is known', async () => {
+        const sandboxes = fakeSandboxes();
+        let lease = liveLease();
+        const gov = (0, governor_1.createGovernor)({ caps: {}, sandboxes, pack: 'joker1', getLease: async () => lease });
+        // The turn path teaches the governor which user 'ticket-42' belongs to.
+        await gov.admitTurn('uH--ticket-42', 'alice@x.com');
+        lease = liveLease({ deny: [{ scope: 'session', match: 'ticket-42', mode: 'kill', reason: 'runaway' }] });
+        await gov.refresh();
+        assert.strictEqual((await gov.admitTurn('uH--ticket-42', 'alice@x.com')).allowed, false, 'the named session');
+        const rotated = await gov.admitTurn('uH--brand-new-id', 'alice@x.com');
+        assert.strictEqual(rotated.allowed, false, 'a fresh session_id from the same user must not escape');
+        assert.strictEqual((await gov.admitTurn('uH--someone-else', 'bob@x.com')).allowed, true, 'and nobody else is caught');
+    });
+    test('followUser: false keeps a genuinely id-only stop', async () => {
+        const sandboxes = fakeSandboxes();
+        let lease = liveLease();
+        const gov = (0, governor_1.createGovernor)({ caps: {}, sandboxes, pack: 'joker1', getLease: async () => lease });
+        await gov.admitTurn('uH--ticket-42', 'alice@x.com');
+        lease = liveLease({ deny: [{ scope: 'session', match: 'ticket-42', mode: 'drain', followUser: false }] });
+        await gov.refresh();
+        assert.strictEqual((await gov.admitTurn('uH--ticket-42', 'alice@x.com')).allowed, false);
+        assert.strictEqual((await gov.admitTurn('uH--another', 'alice@x.com')).allowed, true);
+    });
+    test('with no verified identity the stop is id-only — the documented limitation', () => {
+        const lease = liveLease({ deny: [{ scope: 'session', match: 'anon-1', mode: 'kill' }] });
+        assert.ok((0, lease_1.denyVerdict)(lease, { sessionKey: 'anon-1', pack: 'joker1' }).denied);
+        assert.ok(!(0, lease_1.denyVerdict)(lease, { sessionKey: 'anon-2', pack: 'joker1' }).denied);
+    });
+    test('resolveFollowedUsers ignores spent rules and respects explicit user binding', () => {
+        const past = Math.floor(Date.now() / 1000) - 1;
+        const sessions = new Map([['uH--t42', 'alice@x.com']]);
+        assert.strictEqual((0, lease_1.resolveFollowedUsers)(liveLease({ deny: [{ scope: 'session', match: 't42', mode: 'kill', until: past }] }), sessions).size, 0);
+        assert.strictEqual((0, lease_1.resolveFollowedUsers)(liveLease({ deny: [{ scope: 'session', match: 't42', mode: 'kill', user: 'bob@x.com' }] }), sessions).size, 0, 'a rule bound to bob must not widen itself to alice');
+    });
+});
+suite('poll interval and the advertised kill latency', () => {
+    test('one constant drives poll and cache — they can no longer disagree', () => {
+        assert.strictEqual((0, lease_1.resolveLeasePollSeconds)(undefined), lease_1.DEFAULT_LEASE_POLL_SECONDS);
+        assert.strictEqual((0, lease_1.leaseCacheSecondsFor)((0, lease_1.resolveLeasePollSeconds)(undefined)), lease_1.DEFAULT_LEASE_POLL_SECONDS);
+    });
+    test('the printed kill latency is the TRUE worst case (poll + cache), not the poll alone', () => {
+        assert.strictEqual((0, lease_1.effectiveKillLatencySeconds)(30), 60);
+        assert.strictEqual((0, lease_1.effectiveKillLatencySeconds)(10), 20);
+    });
+    test('a nonsense or tiny poll is floored, not honoured', () => {
+        assert.strictEqual((0, lease_1.resolveLeasePollSeconds)(0), 5);
+        assert.strictEqual((0, lease_1.resolveLeasePollSeconds)(-1), 5);
+        assert.strictEqual((0, lease_1.resolveLeasePollSeconds)(NaN), lease_1.DEFAULT_LEASE_POLL_SECONDS);
+    });
+});

package/out/test/headless-sync.test.js

@@ -51,6 +51,8 @@ const os = __importStar(require("os"));
 const sync_1 = require("../headless/sync");
 const shared_1 = require("../shared");
 const paths_1 = require("../agentpack/paths");
+const branding_1 = require("../branding");
+const utils_1 = require("../utils");
 // -------------------------------------------------------------------------
 // Test Helpers
 // -------------------------------------------------------------------------
@@ -175,6 +177,26 @@ suite('Headless Sync - syncPackToWorkspace', () => {
         assert.ok(content.includes('.claude'), '.gitignore should include .claude');
         assert.ok(content.includes('.codex'), '.gitignore should include .codex');
     });
+    test('creates .gitignore with custom engine workspace dirs', async () => {
+        const cursorEngineDir = path.join(workspaceRoot, branding_1.AGENTIDE_DIR_NAME, 'engines', 'cursor');
+        await fs_1.promises.mkdir(cursorEngineDir, { recursive: true });
+        await fs_1.promises.writeFile(path.join(cursorEngineDir, 'engine.manifest.json'), JSON.stringify({
+            version: 2,
+            id: 'cursor',
+            entry: './engine.mjs',
+            workspaceSync: {
+                enabled: true,
+                dir: '.cursor',
+                rulesFile: 'CURSOR.md',
+                includeSkills: true,
+                includeRules: true,
+            },
+            promptInjection: { mode: 'none' },
+        }));
+        await (0, utils_1.ensureWorkspaceGitAndGitignore)(workspaceRoot, logger);
+        const content = await fs_1.promises.readFile(path.join(workspaceRoot, '.gitignore'), 'utf8');
+        assert.ok(content.includes('.cursor'), '.gitignore should include custom engine workspace dir');
+    });
     test('handles empty pack (no AGENTS.md)', async () => {
         // Pack with no files should not throw
         await (0, sync_1.syncPackToWorkspace)(workspaceRoot, packPath, 'test-pack', 'claude', logger);

package/out/test/lease-signature.test.js

@@ -0,0 +1,357 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Signed leases, lease validation, and the staleness ceiling.
+ *
+ *  The whole governance story — kill switch, deny rules, caps, version pin, pack signing — was
+ *  rooted in an UNSIGNED document fetched over an unauthenticated channel and `JSON.parse`d
+ *  straight into policy. Anyone who could answer AGENTHIPPO_LEASE_URL could lift the kill switch;
+ *  anyone who could drop packets to it could keep a revoked fleet running indefinitely.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const warrant_1 = require("../authority/warrant");
+const lease_1 = require("../pack/lease");
+const key = (0, warrant_1.generateWarrantKeypair)('lease-k1');
+const keys = { 'lease-k1': key.publicKeyPem };
+const NOW = 1_800_000_000;
+const lease = { pack: 'analyst', expiresAt: NOW + 3600, enabled: true };
+const bodyResponse = (text) => ({
+    ok: true,
+    status: 200,
+    text: async () => text,
+    json: async () => JSON.parse(text),
+});
+const collectLogs = () => {
+    const lines = [];
+    return { lines, logger: { info: (m) => lines.push(m), warn: (m) => lines.push(m) } };
+};
+suite('signed lease — envelope verification', () => {
+    test('a lease signed by a trusted key verifies, and the policy survives intact', () => {
+        const token = (0, lease_1.signLease)(lease, key, { instanceId: 'inst-1', nowSeconds: NOW });
+        const res = (0, lease_1.verifySignedLease)(token, keys, { instanceId: 'inst-1', nowSeconds: NOW });
+        assert.ok(res.ok, res.ok ? '' : res.reason);
+        assert.deepStrictEqual(res.lease, lease);
+    });
+    test('an empty keyring never verifies — the same rule packs get', () => {
+        const token = (0, lease_1.signLease)(lease, key, { nowSeconds: NOW });
+        const res = (0, lease_1.verifySignedLease)(token, {}, { nowSeconds: NOW });
+        assert.strictEqual(res.ok, false);
+    });
+    test('a key we do not trust is refused, never trusted-on-first-use', () => {
+        const stranger = (0, warrant_1.generateWarrantKeypair)('evil');
+        const token = (0, lease_1.signLease)({ ...lease, enabled: true }, stranger, { nowSeconds: NOW });
+        const res = (0, lease_1.verifySignedLease)(token, keys, { nowSeconds: NOW });
+        assert.strictEqual(res.ok, false);
+        assert.match(res.reason, /unknown kid/);
+    });
+    test('a tampered payload breaks the signature', () => {
+        const token = (0, lease_1.signLease)({ ...lease, enabled: false }, key, { nowSeconds: NOW });
+        const [h, , s] = token.split('.');
+        const forged = Buffer.from(JSON.stringify({
+            lease: { ...lease, enabled: true }, aud: '*', sub: 'analyst', iat: NOW, exp: NOW + 300,
+        })).toString('base64url');
+        const res = (0, lease_1.verifySignedLease)(`${h}.${forged}.${s}`, keys, { nowSeconds: NOW });
+        assert.strictEqual(res.ok, false);
+        assert.match(res.reason, /bad signature/);
+    });
+    test('a lease for another instance does not verify here (audience binding)', () => {
+        const token = (0, lease_1.signLease)(lease, key, { instanceId: 'inst-other', nowSeconds: NOW });
+        const res = (0, lease_1.verifySignedLease)(token, keys, { instanceId: 'inst-1', nowSeconds: NOW });
+        assert.strictEqual(res.ok, false);
+        assert.match(res.reason, /for instance inst-other/);
+    });
+    test('a fleet-wide (*) lease is accepted by any instance', () => {
+        const token = (0, lease_1.signLease)(lease, key, { nowSeconds: NOW });
+        assert.ok((0, lease_1.verifySignedLease)(token, keys, { instanceId: 'inst-1', nowSeconds: NOW }).ok);
+    });
+    test('an expired envelope is refused even though the LEASE has not expired', () => {
+        const token = (0, lease_1.signLease)(lease, key, { nowSeconds: NOW, ttlSeconds: 60 });
+        const res = (0, lease_1.verifySignedLease)(token, keys, { nowSeconds: NOW + 3600 });
+        assert.strictEqual(res.ok, false);
+        assert.match(res.reason, /envelope expired/);
+    });
+    test('envelope TTL is capped — a lease refresh must not become a credential', () => {
+        const token = (0, lease_1.signLease)(lease, key, { nowSeconds: NOW, ttlSeconds: 99_999 });
+        // The cap is applied at signing; verification also refuses anything longer.
+        const res = (0, lease_1.verifySignedLease)(token, keys, { nowSeconds: NOW + lease_1.MAX_LEASE_ENVELOPE_TTL_SECONDS - 1 });
+        assert.ok(res.ok, 'inside the capped lifetime it is still valid');
+        assert.strictEqual((0, lease_1.verifySignedLease)(token, keys, { nowSeconds: NOW + lease_1.MAX_LEASE_ENVELOPE_TTL_SECONDS + 120 }).ok, false);
+    });
+    /**
+     * The binding that matters most. `governor.checkLease` treats a restored lease as "lease
+     * restored — accepting turns again", so replaying an older `enabled: true` envelope does not
+     * merely delay a kill: it LIFTS one that has already latched.
+     */
+    test('an older envelope is refused as a rollback replay', () => {
+        const older = (0, lease_1.signLease)(lease, key, { nowSeconds: NOW });
+        const newer = (0, lease_1.signLease)({ ...lease, enabled: false }, key, { nowSeconds: NOW + 100 });
+        assert.ok((0, lease_1.verifySignedLease)(newer, keys, { nowSeconds: NOW + 100 }).ok);
+        const replay = (0, lease_1.verifySignedLease)(older, keys, { nowSeconds: NOW + 120, minIat: NOW + 100 });
+        assert.strictEqual(replay.ok, false);
+        assert.match(replay.reason, /replay\/rollback/);
+    });
+    test('a pack signature cannot be replayed as a lease under the same key (typ binding)', () => {
+        // A JWT-typed token signed by the same key must not pass as a lease envelope.
+        const notALease = require('../authority/warrant').signCompactJws({ typ: 'JWT', kid: 'lease-k1' }, { lease, aud: '*', sub: 'analyst', iat: NOW, exp: NOW + 300 }, key.privateKeyPem);
+        const res = (0, lease_1.verifySignedLease)(notALease, keys, { nowSeconds: NOW });
+        assert.strictEqual(res.ok, false);
+        assert.match(res.reason, /unexpected token type/);
+    });
+    test('a signed lease carrying a malformed policy is refused, not half-adopted', () => {
+        const token = (0, lease_1.signLease)({ ...lease, caps: { maxTurnsPerSession: 'lots' } }, key, { nowSeconds: NOW });
+        const res = (0, lease_1.verifySignedLease)(token, keys, { nowSeconds: NOW });
+        assert.strictEqual(res.ok, false);
+        assert.match(res.reason, /malformed/);
+    });
+});
+suite('requireSignedLease is tighten-only', () => {
+    test('either side may demand it; neither may waive the other', () => {
+        assert.strictEqual((0, lease_1.requireSignedLease)(undefined, undefined), false);
+        assert.strictEqual((0, lease_1.requireSignedLease)(true, undefined), true);
+        assert.strictEqual((0, lease_1.requireSignedLease)(undefined, true), true);
+        assert.strictEqual((0, lease_1.requireSignedLease)(false, true), true);
+    });
+});
+suite('lease source — signature enforcement', () => {
+    test('a signed lease is accepted and reported as signed', async () => {
+        const token = (0, lease_1.signLease)(lease, key, { instanceId: 'inst-1', nowSeconds: NOW });
+        const src = (0, lease_1.createLeaseSource)({
+            url: 'https://plane.example/lease',
+            cacheSeconds: 0,
+            instanceId: 'inst-1',
+            signingKeys: () => keys,
+            fetchImpl: (async () => bodyResponse(JSON.stringify({ lease: token }))),
+        });
+        assert.deepStrictEqual(await src.get(NOW), lease);
+        assert.strictEqual(src.status(NOW).signed, true);
+    });
+    test('a bare compact-JWS body works too', async () => {
+        const token = (0, lease_1.signLease)(lease, key, { nowSeconds: NOW });
+        const src = (0, lease_1.createLeaseSource)({
+            url: 'https://plane.example/lease',
+            cacheSeconds: 0,
+            signingKeys: () => keys,
+            fetchImpl: (async () => bodyResponse(token)),
+        });
+        assert.deepStrictEqual(await src.get(NOW), lease);
+    });
+    test('an unsigned lease still works, and says so LOUDLY, when signing is not required', async () => {
+        const { lines, logger } = collectLogs();
+        const src = (0, lease_1.createLeaseSource)({
+            url: 'https://plane.example/lease',
+            cacheSeconds: 0,
+            logger,
+            fetchImpl: (async () => bodyResponse(JSON.stringify(lease))),
+        });
+        assert.deepStrictEqual(await src.get(NOW), lease);
+        assert.ok(lines.some((l) => /UNSIGNED lease/.test(l)), 'back-compat must not be silent');
+    });
+    test('an unsigned lease is REFUSED when signing is required — and the last good lease stands', async () => {
+        const token = (0, lease_1.signLease)(lease, key, { nowSeconds: NOW });
+        let signed = true;
+        const src = (0, lease_1.createLeaseSource)({
+            url: 'https://plane.example/lease',
+            cacheSeconds: 0,
+            requireSignedLease: true,
+            signingKeys: () => keys,
+            fetchImpl: (async () => bodyResponse(signed ? token : JSON.stringify({ ...lease, enabled: true }))),
+        });
+        assert.deepStrictEqual(await src.get(NOW), lease);
+        signed = false;
+        // A downgrade to unsigned must not install new policy.
+        const after = await src.get(NOW + 1);
+        assert.deepStrictEqual(after, lease, 'the verified lease is kept; the unsigned one is rejected');
+    });
+    test('lease.requireSignedLease LATCHES — a later unsigned response cannot undo it', async () => {
+        const demanding = (0, lease_1.signLease)({ ...lease, requireSignedLease: true }, key, { nowSeconds: NOW });
+        let phase = 'signed';
+        const { lines, logger } = collectLogs();
+        const src = (0, lease_1.createLeaseSource)({
+            url: 'https://plane.example/lease',
+            cacheSeconds: 0,
+            logger,
+            signingKeys: () => keys,
+            fetchImpl: (async () => bodyResponse(phase === 'signed' ? demanding : JSON.stringify({ ...lease, enabled: true, version: '9.9.9' }))),
+        });
+        const first = await src.get(NOW);
+        assert.strictEqual(first?.requireSignedLease, true);
+        phase = 'unsigned';
+        const second = await src.get(NOW + 1);
+        assert.strictEqual(second?.version, undefined, 'the unsigned downgrade must not take effect');
+        assert.ok(lines.some((l) => /signed lease is required/.test(l)));
+    });
+});
+/**
+ * The insecure-channel warning, which for one shape did not exist.
+ *
+ * `createLeaseSource` carried a `leaseUrlRefused` flag, declared and read but never assigned — its
+ * comment promised "we never poll it at all", a refusal the file elsewhere argues explicitly
+ * against (refusing to poll a plaintext lease URL disables the kill switch, which fails OPEN).
+ * Worse, the warning next to it was guarded by `else if (!signingRequired())`, so the one operator
+ * who most needed to hear it — one who has demanded signed leases and therefore believes the
+ * channel is accounted for — was the only one who heard nothing at all.
+ */
+suite('lease source — a plaintext lease URL warns, always, and never stops the poll', () => {
+    // An explicit empty env: the ambient ALLOW_INSECURE_TRUST_ROOT escape hatch must not decide
+    // what these tests observe.
+    const noEnv = {};
+    test('http + signing NOT required — warns, and keeps polling', async () => {
+        const { lines, logger } = collectLogs();
+        const src = (0, lease_1.createLeaseSource)({
+            url: 'http://plane.example/lease',
+            cacheSeconds: 0,
+            env: noEnv,
+            logger,
+            fetchImpl: (async () => bodyResponse(JSON.stringify(lease))),
+        });
+        assert.deepStrictEqual(await src.get(NOW), lease, 'refusing to poll would disable the kill switch');
+        assert.ok(lines.some((l) => /INSECURE LEASE CHANNEL/.test(l)));
+    });
+    test('http + signing REQUIRED — still warns; this was the silent case', async () => {
+        const token = (0, lease_1.signLease)(lease, key, { nowSeconds: NOW });
+        const { lines, logger } = collectLogs();
+        const src = (0, lease_1.createLeaseSource)({
+            url: 'http://plane.example/lease',
+            cacheSeconds: 0,
+            env: noEnv,
+            logger,
+            requireSignedLease: true,
+            signingKeys: () => keys,
+            fetchImpl: (async () => bodyResponse(token)),
+        });
+        assert.deepStrictEqual(await src.get(NOW), lease, 'a signed lease over http is still polled');
+        const warning = lines.find((l) => /INSECURE LEASE CHANNEL/.test(l));
+        assert.ok(warning, 'signing-required over plaintext must not be the quiet case');
+        // And it must say what signing does NOT buy, rather than repeating "set requireSignedLease"
+        // at an operator who already did.
+        assert.match(warning, /not a substitute for https/i);
+    });
+    test('https warns about nothing', async () => {
+        const { lines, logger } = collectLogs();
+        const src = (0, lease_1.createLeaseSource)({
+            url: 'https://plane.example/lease',
+            cacheSeconds: 0,
+            env: noEnv,
+            logger,
+            fetchImpl: (async () => bodyResponse(JSON.stringify(lease))),
+        });
+        assert.deepStrictEqual(await src.get(NOW), lease);
+        assert.ok(!lines.some((l) => /INSECURE LEASE CHANNEL/.test(l)));
+    });
+});
+suite('lease source — a garbled document is not policy', () => {
+    const badBodies = [
+        ['non-numeric cap', JSON.stringify({ ...lease, caps: { maxTurnsPerSession: 'lots' } })],
+        ['negative cap', JSON.stringify({ ...lease, caps: { maxSessionSeconds: -5 } })],
+        ['string enabled', JSON.stringify({ ...lease, enabled: 'false' })],
+        ['unknown deny scope', JSON.stringify({ ...lease, deny: [{ scope: 'tenant', match: 'x', mode: 'kill' }] })],
+        ['not an object', '"hello"'],
+        ['not JSON at all', '<html>502</html>'],
+    ];
+    for (const [name, body] of badBodies) {
+        test(`${name} is rejected and the previous lease is kept`, async () => {
+            let good = true;
+            const { lines, logger } = collectLogs();
+            const src = (0, lease_1.createLeaseSource)({
+                url: 'https://plane.example/lease',
+                cacheSeconds: 0,
+                logger,
+                fetchImpl: (async () => bodyResponse(good ? JSON.stringify(lease) : body)),
+            });
+            assert.deepStrictEqual(await src.get(NOW), lease);
+            good = false;
+            assert.deepStrictEqual(await src.get(NOW + 1), lease, 'junk must never replace a validated lease');
+            assert.ok(lines.some((l) => /fetch failed/.test(l)), 'and the rejection must be logged');
+        });
+    }
+    test('a NaN cap cannot reach the meter — where every comparison would be false', async () => {
+        const src = (0, lease_1.createLeaseSource)({
+            url: 'https://plane.example/lease',
+            cacheSeconds: 0,
+            fetchImpl: (async () => bodyResponse(JSON.stringify({ ...lease, caps: { maxTurnsPerSession: null } }))),
+        });
+        const got = await src.get(NOW);
+        assert.strictEqual(got?.caps?.maxTurnsPerSession, undefined, 'null is dropped, never carried through as a cap');
+    });
+});
+suite('lease source — staleness ceiling (kill switch under network denial)', () => {
+    test('past the ceiling, the instance fails CLOSED with an actionable reason', async () => {
+        let alive = true;
+        const { lines, logger } = collectLogs();
+        const src = (0, lease_1.createLeaseSource)({
+            url: 'https://plane.example/lease',
+            cacheSeconds: 0,
+            maxStalenessSeconds: 100,
+            logger,
+            fetchImpl: (async () => {
+                if (!alive) {
+                    throw new Error('control plane unreachable');
+                }
+                return bodyResponse(JSON.stringify(lease));
+            }),
+        });
+        assert.deepStrictEqual(await src.get(NOW), lease);
+        alive = false;
+        assert.strictEqual((await src.get(NOW + 50))?.enabled, true, 'inside the ceiling we still fail OPEN on transport');
+        const stale = await src.get(NOW + 200);
+        assert.strictEqual(stale?.enabled, false, 'past the ceiling the kill switch can no longer be starved out');
+        assert.match(stale?.reason ?? '', /staleness ceiling/);
+        assert.ok(lines.some((l) => /STALENESS CEILING PASSED/.test(l)));
+        assert.strictEqual(src.status(NOW + 200).failClosed, true);
+    });
+    test('0 disables the ceiling — an operator can explicitly accept unbounded staleness', async () => {
+        let alive = true;
+        const src = (0, lease_1.createLeaseSource)({
+            url: 'https://plane.example/lease',
+            cacheSeconds: 0,
+            maxStalenessSeconds: 0,
+            fetchImpl: (async () => {
+                if (!alive) {
+                    throw new Error('down');
+                }
+                return bodyResponse(JSON.stringify(lease));
+            }),
+        });
+        await src.get(NOW);
+        alive = false;
+        assert.strictEqual((await src.get(NOW + 10_000_000))?.enabled, true);
+    });
+    test('an unmanaged deployment (no lease URL) is untouched by any of this', async () => {
+        const src = (0, lease_1.createLeaseSource)({ maxStalenessSeconds: 1 });
+        assert.strictEqual(await src.get(NOW + 1_000_000), undefined);
+    });
+});