@agenthippo-ai/agenthippo 0.2.3-dataplane → 1.110.9

package/out/test/lease-trust-root.test.js

@@ -0,0 +1,273 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  The LEASE trust root — the keyring that decides which policy this instance obeys.
+ *
+ *  Signed leases were unreachable end to end. serve verified lease envelopes with
+ *  `signingKeys: () => packTrust.keys` — the PACK trust root — while the control plane publishes
+ *  the lease public key under purpose `lease-signing` and refuses to register one kid under two
+ *  purposes. So a correctly-configured plane and a correctly-configured serve could not name the
+ *  same key, and `requireSignedLease` (sticky, with no plane-side undo) would latch an instance
+ *  into refusing turns with no way back from the console.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const warrant_1 = require("../authority/warrant");
+const lease_1 = require("../pack/lease");
+const signature_1 = require("../pack/signature");
+const leaseKey = (0, warrant_1.generateWarrantKeypair)('lease-2026');
+const packKey = (0, warrant_1.generateWarrantKeypair)('pack-2026');
+const NOW = 1_800_000_000;
+const lease = { pack: 'analyst', expiresAt: NOW + 3600, enabled: true };
+const okResponse = (body) => ({
+    ok: true,
+    status: 200,
+    json: async () => body,
+});
+const fetchReturning = (body) => (async () => okResponse(body));
+const bodyResponse = (text) => ({
+    ok: true,
+    status: 200,
+    text: async () => text,
+    json: async () => JSON.parse(text),
+});
+const collectLogs = () => {
+    const lines = [];
+    return { lines, logger: { info: (m) => lines.push(m), warn: (m) => lines.push(m) } };
+};
+/** A trust root shaped like one nobody configured. */
+const unconfigured = { status: 'unconfigured', keys: {}, warnings: [] };
+suite('lease trust root — sources and precedence', () => {
+    test('an explicit lease JWKS URL is used, and is marked as named outright', async () => {
+        let asked = '';
+        const root = await (0, signature_1.loadLeaseTrustRoot)({
+            env: { [signature_1.LEASE_JWKS_URL_ENV]: 'https://plane.example/.well-known/lease-jwks.json' },
+            leaseUrl: 'https://elsewhere.example/lease',
+            fetchImpl: (async (u) => { asked = u; return okResponse({ pemsByKid: { 'lease-2026': leaseKey.publicKeyPem } }); }),
+        });
+        assert.strictEqual(asked, 'https://plane.example/.well-known/lease-jwks.json');
+        assert.strictEqual(root.status, 'configured');
+        assert.strictEqual(root.explicitlyConfigured, true);
+        assert.deepStrictEqual(Object.keys(root.keys), ['lease-2026']);
+    });
+    test('inline keys need no network at all (air-gapped), same as the pack root', async () => {
+        const root = await (0, signature_1.loadLeaseTrustRoot)({
+            env: { [signature_1.LEASE_SIGNING_KEYS_ENV]: JSON.stringify({ 'lease-2026': leaseKey.publicKeyPem }) },
+            fetchImpl: (async () => { throw new Error('must not be called'); }),
+        });
+        assert.strictEqual(root.status, 'configured');
+        assert.strictEqual(root.explicitlyConfigured, true);
+    });
+    test('the derived URL asks for the lease-signing purpose, not the plane\'s default document', async () => {
+        let asked = '';
+        const root = await (0, signature_1.loadLeaseTrustRoot)({
+            env: {},
+            leaseUrl: 'https://plane.example/lease',
+            fetchImpl: (async (u) => { asked = u; return okResponse({ pemsByKid: { 'lease-2026': leaseKey.publicKeyPem } }); }),
+        });
+        // The bare path serves PACK-signing keys on a plane that splits by purpose. Deriving without
+        // the query string would hand the lease verifier a keyring that can never verify a lease —
+        // and, worse, one that can authorise code execution.
+        assert.strictEqual(asked, 'https://plane.example/.well-known/jwks.json?purpose=lease-signing');
+        assert.strictEqual(root.status, 'configured');
+        assert.strictEqual(root.derivedFromLease, true);
+        assert.strictEqual(root.explicitlyConfigured, false, 'derived is not "named outright"');
+    });
+    test('nothing configured at all is UNCONFIGURED, not an error', async () => {
+        const root = await (0, signature_1.loadLeaseTrustRoot)({ env: {} });
+        assert.strictEqual(root.status, 'unconfigured');
+        assert.deepStrictEqual(root.keys, {});
+    });
+});
+suite('lease trust root — the pack root\'s properties, unchanged', () => {
+    test('http is refused unless the documented escape hatch is set, and the hatch is LOUD', async () => {
+        const env = { [signature_1.LEASE_JWKS_URL_ENV]: 'http://plane.example/lease-jwks.json' };
+        const refused = await (0, signature_1.loadLeaseTrustRoot)({ env, fetchImpl: fetchReturning({ pemsByKid: { 'lease-2026': leaseKey.publicKeyPem } }) });
+        assert.strictEqual(refused.status, 'unavailable');
+        assert.match(refused.reason ?? '', /must be https/);
+        const allowed = await (0, signature_1.loadLeaseTrustRoot)({
+            env: { ...env, [signature_1.ALLOW_INSECURE_TRUST_ROOT_ENV]: '1' },
+            fetchImpl: fetchReturning({ pemsByKid: { 'lease-2026': leaseKey.publicKeyPem } }),
+        });
+        assert.strictEqual(allowed.status, 'configured');
+        assert.ok(allowed.warnings.some((w) => /INSECURE/.test(w)));
+    });
+    test('a fetch failure is UNAVAILABLE, never an empty keyring (finding A4)', async () => {
+        const root = await (0, signature_1.loadLeaseTrustRoot)({
+            env: { [signature_1.LEASE_JWKS_URL_ENV]: 'https://plane.example/j' },
+            fetchImpl: (async () => { throw new Error('ECONNREFUSED'); }),
+        });
+        assert.strictEqual(root.status, 'unavailable');
+        assert.match(root.reason ?? '', /ECONNREFUSED/);
+        // Still "named outright", so serve must NOT quietly fall back to the pack keyring here.
+        assert.strictEqual(root.explicitlyConfigured, true);
+    });
+    test('a garbled inline keyring names the variable an operator has to fix', async () => {
+        const root = await (0, signature_1.loadLeaseTrustRoot)({ env: { [signature_1.LEASE_SIGNING_KEYS_ENV]: '{not json' } });
+        assert.strictEqual(root.status, 'unavailable');
+        assert.match(root.reason ?? '', new RegExp(`${signature_1.LEASE_SIGNING_KEYS_ENV} is set but is not valid JSON`));
+    });
+    test('thumbprint pins refuse a key the plane did not previously publish', async () => {
+        const tp = (0, signature_1.publicKeyThumbprints)(leaseKey.publicKeyPem);
+        const root = await (0, signature_1.loadLeaseTrustRoot)({
+            env: { [signature_1.LEASE_JWKS_URL_ENV]: 'https://plane.example/j', [signature_1.LEASE_JWKS_PINS_ENV]: tp.spki },
+            fetchImpl: fetchReturning({ pemsByKid: { 'lease-2026': leaseKey.publicKeyPem, 'stranger': packKey.publicKeyPem } }),
+        });
+        assert.strictEqual(root.status, 'configured');
+        assert.deepStrictEqual(Object.keys(root.keys), ['lease-2026']);
+        assert.ok(root.warnings.some((w) => /lease trust root: key stranger does not match any pin/.test(w)));
+    });
+    test('a standard JWKS document (what the plane publishes) is accepted', async () => {
+        const root = await (0, signature_1.loadLeaseTrustRoot)({
+            env: { [signature_1.LEASE_JWKS_URL_ENV]: 'https://plane.example/j' },
+            fetchImpl: fetchReturning((0, warrant_1.jwks)([leaseKey])),
+        });
+        assert.strictEqual(root.status, 'configured');
+        assert.deepStrictEqual(Object.keys(root.keys), ['lease-2026']);
+    });
+});
+suite('lease trust root — which keyring verifies a lease', () => {
+    test('a lease root named outright is the WHOLE answer: the pack keyring is not consulted', async () => {
+        const leaseTrust = await (0, signature_1.loadLeaseTrustRoot)({
+            env: { [signature_1.LEASE_SIGNING_KEYS_ENV]: JSON.stringify({ 'lease-2026': leaseKey.publicKeyPem }) },
+        });
+        const packTrust = await (0, signature_1.loadPackTrustRoot)({
+            env: { [signature_1.PACK_JWKS_URL_ENV]: 'https://plane.example/j' },
+            fetchImpl: fetchReturning({ pemsByKid: { 'pack-2026': packKey.publicKeyPem } }),
+        });
+        const selected = (0, signature_1.selectLeaseSigningKeys)(leaseTrust, packTrust);
+        assert.deepStrictEqual(Object.keys(selected.keys), ['lease-2026']);
+        assert.strictEqual(selected.packFallback, false);
+        // A key that can vouch for a lease must not thereby be able to vouch for CODE, and the
+        // converse matters just as much: the pack key must stop being a lease key.
+        assert.ok(!('pack-2026' in selected.keys));
+    });
+    test('with no lease root named, the pack keyring stays in play and the caller is told to warn', async () => {
+        const packTrust = await (0, signature_1.loadPackTrustRoot)({
+            env: { [signature_1.PACK_JWKS_URL_ENV]: 'https://plane.example/j' },
+            fetchImpl: fetchReturning({ pemsByKid: { 'pack-2026': packKey.publicKeyPem } }),
+        });
+        const selected = (0, signature_1.selectLeaseSigningKeys)(unconfigured, packTrust);
+        assert.strictEqual(selected.packFallback, true, 'the caller must warn, naming the new variable');
+        assert.deepStrictEqual(Object.keys(selected.keys), ['pack-2026']);
+    });
+    test('during a rollover both halves are live, and the lease key wins a kid collision', async () => {
+        const derived = { status: 'configured', keys: { shared: leaseKey.publicKeyPem }, warnings: [], derivedFromLease: true, explicitlyConfigured: false };
+        const packTrust = { status: 'configured', keys: { shared: packKey.publicKeyPem, 'pack-2026': packKey.publicKeyPem }, warnings: [] };
+        const selected = (0, signature_1.selectLeaseSigningKeys)(derived, packTrust);
+        assert.deepStrictEqual(Object.keys(selected.keys).sort(), ['pack-2026', 'shared']);
+        assert.strictEqual(selected.keys.shared, leaseKey.publicKeyPem);
+    });
+});
+suite('signed leases end to end through the lease trust root', () => {
+    /** Exactly what serve wires: the lease source reads its keys through the selection above. */
+    const sourceOver = (leaseTrust, packTrust, body, logger) => (0, lease_1.createLeaseSource)({
+        url: 'https://plane.example/lease',
+        cacheSeconds: 0,
+        env: {},
+        instanceId: 'inst-1',
+        ...(logger ? { logger } : {}),
+        signingKeys: () => (0, signature_1.selectLeaseSigningKeys)(leaseTrust, packTrust).keys,
+        fetchImpl: (async () => bodyResponse(body)),
+    });
+    test('a lease signed with the plane\'s lease-signing key verifies', async () => {
+        const leaseTrust = await (0, signature_1.loadLeaseTrustRoot)({
+            env: { [signature_1.LEASE_JWKS_URL_ENV]: 'https://plane.example/.well-known/lease-jwks.json' },
+            fetchImpl: fetchReturning((0, warrant_1.jwks)([leaseKey])),
+        });
+        const packTrust = await (0, signature_1.loadPackTrustRoot)({
+            env: { [signature_1.PACK_JWKS_URL_ENV]: 'https://plane.example/j' },
+            fetchImpl: fetchReturning({ pemsByKid: { 'pack-2026': packKey.publicKeyPem } }),
+        });
+        const token = (0, lease_1.signLease)(lease, leaseKey, { instanceId: 'inst-1', nowSeconds: NOW });
+        const src = sourceOver(leaseTrust, packTrust, JSON.stringify({ lease: token }));
+        assert.deepStrictEqual(await src.get(NOW), lease);
+        assert.strictEqual(src.status(NOW).signed, true);
+    });
+    test('the back-compat path still verifies: a lease signed with the PACK key, no lease root named', async () => {
+        const packTrust = await (0, signature_1.loadPackTrustRoot)({
+            env: { [signature_1.PACK_JWKS_URL_ENV]: 'https://plane.example/j' },
+            fetchImpl: fetchReturning({ pemsByKid: { 'pack-2026': packKey.publicKeyPem } }),
+        });
+        const token = (0, lease_1.signLease)(lease, packKey, { instanceId: 'inst-1', nowSeconds: NOW });
+        const selected = (0, signature_1.selectLeaseSigningKeys)(unconfigured, packTrust);
+        assert.strictEqual(selected.packFallback, true, 'and the operator is told, once');
+        const src = sourceOver(unconfigured, packTrust, JSON.stringify({ lease: token }));
+        assert.deepStrictEqual(await src.get(NOW), lease, 'a deployment that works today must keep working');
+    });
+    test('a lease signed by a kid nobody trusts is refused', async () => {
+        const leaseTrust = await (0, signature_1.loadLeaseTrustRoot)({
+            env: { [signature_1.LEASE_SIGNING_KEYS_ENV]: JSON.stringify({ 'lease-2026': leaseKey.publicKeyPem }) },
+        });
+        const stranger = (0, warrant_1.generateWarrantKeypair)('stranger');
+        const { lines, logger } = collectLogs();
+        const src = sourceOver(leaseTrust, unconfigured, JSON.stringify({ lease: (0, lease_1.signLease)(lease, stranger, { nowSeconds: NOW }) }), logger);
+        assert.strictEqual(await src.get(NOW), undefined, 'nothing unverifiable is installed as policy');
+        assert.ok(lines.some((l) => /unknown kid/.test(l)));
+    });
+    test('a pack-key-signed lease is refused once a lease root IS named — silently trusting it would undo the split', async () => {
+        const leaseTrust = await (0, signature_1.loadLeaseTrustRoot)({
+            env: { [signature_1.LEASE_SIGNING_KEYS_ENV]: JSON.stringify({ 'lease-2026': leaseKey.publicKeyPem }) },
+        });
+        const packTrust = { status: 'configured', keys: { 'pack-2026': packKey.publicKeyPem }, warnings: [] };
+        const src = sourceOver(leaseTrust, packTrust, JSON.stringify({ lease: (0, lease_1.signLease)(lease, packKey, { nowSeconds: NOW }) }));
+        assert.strictEqual(await src.get(NOW), undefined);
+    });
+    test('fail-open on a SIGNATURE failure survives: the last good lease stands', async () => {
+        const leaseTrust = await (0, signature_1.loadLeaseTrustRoot)({
+            env: { [signature_1.LEASE_SIGNING_KEYS_ENV]: JSON.stringify({ 'lease-2026': leaseKey.publicKeyPem }) },
+        });
+        const good = (0, lease_1.signLease)(lease, leaseKey, { instanceId: 'inst-1', nowSeconds: NOW });
+        const forged = (0, lease_1.signLease)({ ...lease, enabled: false, version: '9.9.9' }, (0, warrant_1.generateWarrantKeypair)('stranger'), { nowSeconds: NOW + 1 });
+        let phase = 'good';
+        const { lines, logger } = collectLogs();
+        const src = (0, lease_1.createLeaseSource)({
+            url: 'https://plane.example/lease',
+            cacheSeconds: 0,
+            env: {},
+            instanceId: 'inst-1',
+            logger,
+            signingKeys: () => (0, signature_1.selectLeaseSigningKeys)(leaseTrust, unconfigured).keys,
+            fetchImpl: (async () => bodyResponse(JSON.stringify({ lease: phase === 'good' ? good : forged }))),
+        });
+        assert.deepStrictEqual(await src.get(NOW), lease);
+        phase = 'forged';
+        // An unverifiable document is treated exactly like a transport failure — never installed as
+        // policy, and never allowed to take a fleet down by being publishable junk.
+        assert.deepStrictEqual(await src.get(NOW + 1), lease);
+        assert.ok(lines.some((l) => /fetch failed/.test(l)));
+    });
+});

package/out/test/lease-validation.test.js

@@ -0,0 +1,169 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  "Junk is dropped rather than trusted" — restored under the sandbox vocabulary.
+ *
+ *  `normalizeCaps` was the ONLY runtime validation a lease ever received, and it was deleted along
+ *  with the cell→sandbox back-compat it happened to also carry. What replaced it was
+ *  `cached = (await res.json()) as Lease` — a compile-time cast that checks nothing. These pin the
+ *  properties that were lost, plus the one that was always wrong: an unrecognised breach action
+ *  must fail closed to the STRICTER action, never silently to the weaker one.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const caps_1 = require("../pack/caps");
+const caps_2 = require("../pack/caps");
+const lease_schema_1 = require("../pack/lease-schema");
+const base = { pack: 'analyst', enabled: true, expiresAt: 1_800_003_600 };
+suite('lease validation — structural junk is refused, not trusted', () => {
+    const rejected = [
+        ['a string cap', { ...base, caps: { maxTurnsPerSession: 'lots' } }],
+        ['a negative cap', { ...base, caps: { maxSessionSeconds: -1 } }],
+        ['a zero cap', { ...base, caps: { maxConcurrentSandboxes: 0 } }],
+        ['a fractional cap', { ...base, caps: { maxTurnsPerSession: 1.5 } }],
+        ['an infinite cap', { ...base, caps: { maxTurnsPerSession: Number.POSITIVE_INFINITY } }],
+        ['a string enabled', { ...base, enabled: 'false' }],
+        ['a missing pack', { enabled: true, expiresAt: 1 }],
+        ['a string expiresAt', { ...base, expiresAt: '1800003600' }],
+        ['a non-object caps', { ...base, caps: 'none' }],
+        ['a non-array deny', { ...base, deny: { scope: 'pack' } }],
+        ['an unknown deny scope', { ...base, deny: [{ scope: 'tenant', match: 'x', mode: 'kill' }] }],
+        ['a deny rule with no match', { ...base, deny: [{ scope: 'pack', match: '', mode: 'kill' }] }],
+        ['a non-boolean requireSignedPack', { ...base, requireSignedPack: 'yes' }],
+        ['not an object at all', 'nope'],
+    ];
+    for (const [name, doc] of rejected) {
+        test(`${name} rejects the whole document`, () => {
+            const res = (0, lease_schema_1.parseLease)(doc);
+            assert.strictEqual(res.ok, false, `expected ${name} to be refused`);
+        });
+    }
+    test('NaN never reaches the meter, where every comparison against it is false', () => {
+        // The failure this prevents: `usage.turns >= NaN` is false for every value, so the cap is
+        // reported in the console and enforced nowhere.
+        assert.strictEqual((0, lease_schema_1.parseLease)({ ...base, caps: { maxTurnsPerSession: NaN } }).ok, false);
+        const meter = new caps_2.CapMeter({ maxTurnsPerSession: NaN });
+        meter.record('s1');
+        meter.record('s1');
+        meter.record('s1');
+        assert.strictEqual(meter.check('s1', 0).allowed, true, 'demonstrating why the validator has to catch it');
+    });
+    test('a well-formed lease survives intact', () => {
+        const res = (0, lease_schema_1.parseLease)({
+            ...base,
+            version: '1.4.1',
+            caps: { maxTurnsPerSession: 10, onBreach: 'destroy-sandbox' },
+            deny: [{ scope: 'session', match: 's1', mode: 'kill', reason: 'runaway', until: 1_800_004_000 }],
+            requireSignedPack: true,
+        });
+        assert.ok(res.ok);
+        assert.strictEqual(res.lease.caps?.maxTurnsPerSession, 10);
+        assert.strictEqual(res.lease.deny?.[0].mode, 'kill');
+        assert.strictEqual(res.lease.requireSignedPack, true);
+    });
+    test('an unknown cap field is tolerated but never silent', () => {
+        const res = (0, lease_schema_1.parseCapPolicy)({ maxSomethingNew: 5 });
+        assert.ok(res.ok);
+        assert.ok(res.warnings.some((w) => /NOT being enforced/.test(w)));
+    });
+});
+suite('unrecognised enums fail CLOSED to the stricter value', () => {
+    /**
+     * The concrete bug: an unrecognised `onBreach` fell through `mergeCaps`'s
+     * `=== 'destroy-sandbox'` test, so `governor.enforce` defaulted to `revoke-inference`. A typo
+     * in the control plane SOFTENED the breach action from "destroy the session" to "take away its
+     * model route", while the console displayed the stricter value the operator had entered.
+     */
+    test('an unknown lease onBreach clamps UP and warns', () => {
+        const res = (0, lease_schema_1.parseCapPolicy)({ onBreach: 'destroy_cell_typo' });
+        assert.ok(res.ok);
+        assert.strictEqual(res.caps.onBreach, lease_schema_1.STRICTEST_ON_BREACH);
+        assert.strictEqual(res.caps.onBreach, 'destroy-sandbox');
+        assert.ok(res.warnings.some((w) => /Failing CLOSED/.test(w)));
+    });
+    test('and the clamped value survives mergeCaps rather than being softened by it', () => {
+        const parsed = (0, lease_schema_1.parseCapPolicy)({ onBreach: 'nonsense' });
+        assert.ok(parsed.ok);
+        assert.strictEqual((0, caps_1.mergeCaps)(parsed.caps, { onBreach: 'revoke-inference' }).onBreach, 'destroy-sandbox');
+    });
+    test('an unknown deny mode clamps to kill rather than being dropped', () => {
+        const res = (0, lease_schema_1.parseLease)({ ...base, deny: [{ scope: 'pack', match: 'analyst', mode: 'pause' }] });
+        assert.ok(res.ok);
+        assert.strictEqual(res.lease.deny?.[0].mode, 'kill');
+        assert.ok(res.warnings.some((w) => /Failing CLOSED/.test(w)));
+    });
+    test('env: an unknown AGENTHIPPO_CAP_ON_BREACH fails closed instead of becoming undefined', () => {
+        const warnings = [];
+        const caps = (0, caps_1.capsFromEnv)({ AGENTHIPPO_CAP_ON_BREACH: 'destroy-everything' }, (m) => warnings.push(m));
+        assert.strictEqual(caps.onBreach, 'destroy-sandbox');
+        assert.ok(warnings.some((w) => /FAILING CLOSED/.test(w)));
+    });
+    test('CLI: the same resolver, so a flag and an env var cannot disagree', () => {
+        const r = (0, caps_1.resolveOnBreach)('destroy-everything', '--cap-on-breach');
+        assert.strictEqual(r.action, 'destroy-sandbox');
+        assert.ok(r.warnings.some((w) => /FAILING CLOSED/.test(w)));
+        assert.strictEqual((0, caps_1.resolveOnBreach)(undefined, '--cap-on-breach').action, undefined, 'unset stays unset');
+        assert.strictEqual((0, caps_1.resolveOnBreach)('revoke-inference', '--cap-on-breach').action, 'revoke-inference');
+    });
+});
+suite('deprecated cell vocabulary is aliased, loudly', () => {
+    test('destroy-cell maps to destroy-sandbox rather than softening enforcement', () => {
+        assert.strictEqual(lease_schema_1.ON_BREACH_ALIASES['destroy-cell'], 'destroy-sandbox');
+        const r = (0, caps_1.resolveOnBreach)('destroy-cell', 'AGENTHIPPO_CAP_ON_BREACH');
+        assert.strictEqual(r.action, 'destroy-sandbox');
+        assert.ok(r.warnings.some((w) => /DEPRECATED/.test(w)));
+    });
+    test('a lease using the old cap spelling is still enforced', () => {
+        assert.strictEqual(lease_schema_1.LEASE_CAP_ALIASES.maxConcurrentCells, 'maxConcurrentSandboxes');
+        const res = (0, lease_schema_1.parseCapPolicy)({ maxConcurrentCells: 4 });
+        assert.ok(res.ok);
+        assert.strictEqual(res.caps.maxConcurrentSandboxes, 4);
+    });
+    test('AGENTHIPPO_MAX_CONCURRENT_CELLS is honoured with a deprecation notice', () => {
+        const warnings = [];
+        const caps = (0, caps_1.capsFromEnv)({ AGENTHIPPO_MAX_CONCURRENT_CELLS: '3' }, (m) => warnings.push(m));
+        assert.strictEqual(caps.maxConcurrentSandboxes, 3);
+        assert.ok(warnings.some((w) => /DEPRECATED/.test(w)));
+        assert.strictEqual(caps_1.CAP_ENV_ALIASES.AGENTHIPPO_MAX_CONCURRENT_CELLS, 'AGENTHIPPO_MAX_CONCURRENT_SANDBOXES');
+    });
+    test('the current spelling wins when both are present', () => {
+        const caps = (0, caps_1.capsFromEnv)({
+            AGENTHIPPO_MAX_CONCURRENT_SANDBOXES: '7',
+            AGENTHIPPO_MAX_CONCURRENT_CELLS: '3',
+        }, () => undefined);
+        assert.strictEqual(caps.maxConcurrentSandboxes, 7);
+    });
+});

package/out/test/lease.test.js

@@ -0,0 +1,114 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Lease admission — kill switch + rollback (PLAN/serve-v4-clean.md §5).
+ *
+ *  One mechanism, two jobs. The tests pin the operational contract, especially the
+ *  fail-open-on-transport / fail-closed-on-content asymmetry, which is exactly the kind of
+ *  property that silently inverts during a refactor.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const lease_1 = require("../pack/lease");
+const NOW = 1_800_000_000;
+const valid = { pack: 'analyst', expiresAt: NOW + 3600, enabled: true };
+suite('lease admission — kill switch', () => {
+    test('an enabled, unexpired lease admits', () => {
+        assert.doesNotThrow(() => (0, lease_1.assertAdmitted)(valid, { pack: 'analyst', version: '1.4.2', nowSeconds: NOW }));
+    });
+    test('no lease configured admits — self-hosted dev and free tier keep working', () => {
+        assert.doesNotThrow(() => (0, lease_1.assertAdmitted)(undefined, { pack: 'analyst', version: '1.4.2', nowSeconds: NOW }));
+    });
+    test('the kill switch refuses new sandboxes immediately, with the operator reason', () => {
+        assert.throws(() => (0, lease_1.assertAdmitted)({ ...valid, enabled: false, reason: 'incident 4412' }, { pack: 'analyst', version: '1.4.2', nowSeconds: NOW }), (e) => e instanceof lease_1.LeaseDeniedError && /kill switch active/.test(e.message) && /incident 4412/.test(e.message));
+    });
+    test('an expired lease is refused — fail closed on content', () => {
+        assert.throws(() => (0, lease_1.assertAdmitted)({ ...valid, expiresAt: NOW - 1 }, { pack: 'analyst', version: '1.4.2', nowSeconds: NOW }), /expired/);
+    });
+    test("a lease for another pack does not admit this one", () => {
+        assert.throws(() => (0, lease_1.assertAdmitted)({ ...valid, pack: 'other' }, { pack: 'analyst', version: '1.4.2', nowSeconds: NOW }), /lease is for pack other/);
+    });
+});
+suite('lease admission — rollback', () => {
+    test('a pinned version refuses any other version (rollback in force)', () => {
+        const pinned = { ...valid, version: '1.4.1' };
+        assert.doesNotThrow(() => (0, lease_1.assertAdmitted)(pinned, { pack: 'analyst', version: '1.4.1', nowSeconds: NOW }));
+        assert.throws(() => (0, lease_1.assertAdmitted)(pinned, { pack: 'analyst', version: '1.4.2', nowSeconds: NOW }), /pinned to 1\.4\.1.*refusing to start 1\.4\.2/);
+    });
+    test('an image that does not match the leased digest is refused (supply-chain pin)', () => {
+        const pinned = { ...valid, imageDigest: 'sha256:' + 'a'.repeat(64) };
+        assert.doesNotThrow(() => (0, lease_1.assertAdmitted)(pinned, {
+            pack: 'analyst', version: '1.4.2', image: `ghcr.io/x/analyst@sha256:${'a'.repeat(64)}`, nowSeconds: NOW,
+        }));
+        assert.throws(() => (0, lease_1.assertAdmitted)(pinned, {
+            pack: 'analyst', version: '1.4.2', image: `ghcr.io/x/analyst@sha256:${'b'.repeat(64)}`, nowSeconds: NOW,
+        }), /does not match the leased digest/);
+    });
+});
+suite('lease source — fail-open transport, fail-closed content', () => {
+    test('a network failure keeps serving on the cached lease', async () => {
+        let calls = 0;
+        const src = (0, lease_1.createLeaseSource)({
+            url: 'http://control.invalid/lease',
+            cacheSeconds: 0,
+            fetchImpl: (async () => {
+                calls++;
+                if (calls === 1) {
+                    return { ok: true, json: async () => valid };
+                }
+                throw new Error('control plane unreachable');
+            }),
+        });
+        assert.deepStrictEqual(await src.get(NOW), valid, 'first fetch populates the cache');
+        const during = await src.get(NOW + 1);
+        assert.deepStrictEqual(during, valid, 'an outage must not take a customer fleet down');
+    });
+    test('an outage cannot extend an entitlement — the cached lease still expires', async () => {
+        const shortLease = { pack: 'analyst', expiresAt: NOW + 10, enabled: true };
+        const src = (0, lease_1.createLeaseSource)({
+            url: 'http://control.invalid/lease',
+            cacheSeconds: 0,
+            fetchImpl: (async () => ({ ok: true, json: async () => shortLease })),
+        });
+        const lease = await src.get(NOW);
+        // Later, past its own expiry, the cached lease must still be refused by admission.
+        assert.throws(() => (0, lease_1.assertAdmitted)(lease, { pack: 'analyst', version: '1.4.2', nowSeconds: NOW + 11 }), /expired/);
+    });
+    test('a static lease works with no control plane at all (air-gapped)', async () => {
+        const src = (0, lease_1.createLeaseSource)({ staticLease: valid });
+        assert.deepStrictEqual(await src.get(NOW), valid);
+    });
+});

package/out/test/mcp.test.js

@@ -331,7 +331,7 @@ suite('MCP Server Loading', () => {
                 remote: { type: 'http', url: 'https://mcp.example.com/sse', headers: { Authorization: 'Bearer abc' } },
             });
         });
-        test('bearerTokenEnv resolves against the PER-TURN env into an Authorization header (claude/custom path)', () => {
+        test('bearerTokenEnv resolves against the PER-TURN env into an Authorization header (cursor/custom path)', () => {
             const server = {
                 name: 'data', label: 'data', command: '', args: [],
                 url: 'http://127.0.0.1:39999/mcp', bearerTokenEnv: 'AGENTHIPPO_TURN_NONCE',
@@ -346,6 +346,32 @@ suite('MCP Server Loading', () => {
                 data: { type: 'http', url: 'http://127.0.0.1:39999/mcp' },
             });
         });
+        /**
+         * The claude path must ship a `${NAME}` REFERENCE, never the resolved secret: the Agent
+         * SDK serializes mcpServers into `--mcp-config <json>` argv, and /proc/<pid>/cmdline is
+         * world-readable — a resolved bearer there leaks the turn nonce to every uid on the host.
+         * The CLI expands the reference from its own env (verified live on 2.1.220).
+         */
+        test('referenceHttpMcpHeaders emits a ${NAME} reference, never the secret (claude path)', () => {
+            const headers = (0, mcp_1.referenceHttpMcpHeaders)({ bearerTokenEnv: 'AGENTHIPPO_TURN_NONCE', headers: { 'X-Static': 'kept' } }, { AGENTHIPPO_TURN_NONCE: 'nonce-123' });
+            assert.deepStrictEqual(headers, {
+                'X-Static': 'kept',
+                'Authorization': 'Bearer ${AGENTHIPPO_TURN_NONCE}',
+            });
+            // The reference is emitted even when the env has no value yet: expansion happens in
+            // the CLI at connect time, and an unset name passes through literally, which the data
+            // gateway rejects — fail closed, never a silently-authorized request.
+            const unresolved = (0, mcp_1.referenceHttpMcpHeaders)({ bearerTokenEnv: 'AGENTHIPPO_TURN_NONCE' }, {});
+            assert.deepStrictEqual(unresolved, { Authorization: 'Bearer ${AGENTHIPPO_TURN_NONCE}' });
+        });
+        test('referenceHttpMcpHeaders falls back to in-memory resolution for a non-expandable name', () => {
+            // A name outside the CLI's `${NAME}` grammar would be sent verbatim as garbage; the
+            // fallback resolves it here instead, accepting environ-level exposure over a broken header.
+            const headers = (0, mcp_1.referenceHttpMcpHeaders)({ bearerTokenEnv: 'weird-name.v2' }, { 'weird-name.v2': 'tok-1' });
+            assert.deepStrictEqual(headers, { Authorization: 'Bearer tok-1' });
+            // No bearerTokenEnv and no static headers → no headers object at all.
+            assert.strictEqual((0, mcp_1.referenceHttpMcpHeaders)({}, {}), undefined);
+        });
         test('serialize and parse round-trip inline MCP', () => {
             const inline = (0, mcp_1.formatInlineMcpServers)([
                 { name: 'echo', label: 'echo', command: 'echo', args: ['hi'] },