@agenthippo-ai/agenthippo 0.2.3-dataplane → 1.110.9

package/out/test/sessionShip.test.js

@@ -0,0 +1,560 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *  Licensed under the MIT License. See LICENSE.txt in the project root for license information.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const fs_1 = require("fs");
+const sessionShip_1 = require("../evidence/sessionShip");
+/** A stand-in evidence server that records what it was actually sent. */
+async function startFakeEvidenceServer() {
+    const http = await import('http');
+    const zlib = await import('zlib');
+    const ingests = [];
+    let failing = false;
+    const failingKinds = new Set();
+    const server = http.createServer((req, res) => {
+        if (req.method === 'POST' && req.url === '/ingest/batch') {
+            const chunks = [];
+            req.on('data', (c) => chunks.push(Buffer.from(c)));
+            req.on('end', () => {
+                let doc = {};
+                try {
+                    doc = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+                }
+                catch { /* malformed; treated as unknown kind */ }
+                if (failing || (doc.kind && failingKinds.has(doc.kind))) {
+                    res.writeHead(500, { 'content-type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'nope' }));
+                    return;
+                }
+                try {
+                    ingests.push({
+                        kind: doc.kind ?? '',
+                        name: doc.name ?? '',
+                        body: zlib.gunzipSync(Buffer.from(doc.content_gzip_b64 ?? '', 'base64')).toString('utf8'),
+                    });
+                }
+                catch { /* recorded as nothing */ }
+                res.writeHead(200, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({ batch_id: 'test', turns: 0 }));
+            });
+            return;
+        }
+        res.writeHead(404);
+        res.end();
+    });
+    await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+    const addr = server.address();
+    return {
+        port: typeof addr === 'object' && addr ? addr.port : 0,
+        ingests,
+        close: () => server.close(),
+        fail: (on) => { failing = on; },
+        failKind: (kind, on) => {
+            if (on) {
+                failingKinds.add(kind);
+            }
+            else {
+                failingKinds.delete(kind);
+            }
+        },
+    };
+}
+function sessionLine(overrides = {}) {
+    return JSON.stringify({
+        session_id: 's1',
+        request_id: 'r1',
+        timestamp: Date.now(),
+        event_type: 'tool_start',
+        payload: {},
+        ...overrides,
+    });
+}
+async function waitFor(predicate, timeoutMs = 8000) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        if (predicate()) {
+            return;
+        }
+        await new Promise((r) => setTimeout(r, 25));
+    }
+    throw new Error('timed out waiting for condition');
+}
+suite('Evidence - sessionShip config', () => {
+    test('resolveSessionShipConfig returns undefined when URL/token missing', () => {
+        assert.strictEqual((0, sessionShip_1.resolveSessionShipConfig)('inst-1', '/tmp/sessions', '/tmp/state', {}), undefined);
+    });
+    test('resolveSessionShipConfig returns undefined when AGENTHIPPO_EVIDENCE_SHIP=0', () => {
+        const cfg = (0, sessionShip_1.resolveSessionShipConfig)('inst-1', '/tmp/sessions', '/tmp/state', {
+            AGENTHIPPO_EVIDENCE_URL: 'https://evidence.example.com',
+            AGENTHIPPO_EVIDENCE_SHIP_TOKEN: 'tok',
+            AGENTHIPPO_EVIDENCE_SHIP: '0',
+        });
+        assert.strictEqual(cfg, undefined);
+    });
+    /**
+     * Fix 2f: disabling the compliance record was a single character in an env file that produced
+     * no output whatsoever. It stays possible, but it can no longer be accidental or unnoticed.
+     */
+    test('disabling shipping prints an unmissable banner and shows up in status', () => {
+        const warnings = [];
+        const original = console.warn;
+        console.warn = (m) => { warnings.push(String(m)); };
+        try {
+            (0, sessionShip_1.resolveSessionShipConfig)('inst-1', '/tmp/sessions', '/tmp/state', {
+                AGENTHIPPO_EVIDENCE_URL: 'https://evidence.example.com',
+                AGENTHIPPO_EVIDENCE_SHIP_TOKEN: 'tok',
+                AGENTHIPPO_EVIDENCE_SHIP: '0',
+            });
+        }
+        finally {
+            console.warn = original;
+        }
+        assert.ok(warnings.some((w) => w.includes('EVIDENCE SHIPPING IS DISABLED')), `no banner: ${JSON.stringify(warnings)}`);
+        const status = (0, sessionShip_1.getEvidenceShipStatus)();
+        assert.strictEqual(status.enabled, false);
+        assert.strictEqual(status.disabledReason, 'disabled-by-env');
+    });
+    test('resolveSessionShipConfig builds config from env', () => {
+        const cfg = (0, sessionShip_1.resolveSessionShipConfig)('my-instance', '/data/sessions', '/data/state', {
+            AGENTHIPPO_EVIDENCE_URL: 'https://evidence.example.com',
+            AGENTHIPPO_EVIDENCE_SHIP_TOKEN: 'serve-tok',
+            AGENTHIPPO_EVIDENCE_SHIP_INTERVAL_SEC: '120',
+        });
+        assert.ok(cfg);
+        assert.strictEqual(cfg.instanceId, 'my-instance');
+        assert.strictEqual(cfg.evidenceUrl, 'https://evidence.example.com');
+        assert.strictEqual(cfg.shipToken, 'serve-tok');
+        assert.strictEqual(cfg.intervalSec, 120);
+        assert.strictEqual(cfg.sessionsDir, '/data/sessions');
+    });
+    /**
+     * Fix 2b: the window was hard-coded to 7 days, so an outage longer than a week deleted the
+     * backlog rather than delaying it — and the week that broke is the week you need.
+     */
+    test('the ship window is configurable and defaults to more than a week', () => {
+        const defaulted = (0, sessionShip_1.resolveSessionShipConfig)('i', '/s', '/st', {
+            AGENTHIPPO_EVIDENCE_URL: 'https://evidence.example.com',
+            AGENTHIPPO_EVIDENCE_SHIP_TOKEN: 'tok',
+        });
+        assert.ok((defaulted.sinceDays ?? 0) > 7, `default window is ${defaulted.sinceDays}`);
+        const explicit = (0, sessionShip_1.resolveSessionShipConfig)('i', '/s', '/st', {
+            AGENTHIPPO_EVIDENCE_URL: 'https://evidence.example.com',
+            AGENTHIPPO_EVIDENCE_SHIP_TOKEN: 'tok',
+            AGENTHIPPO_EVIDENCE_SHIP_SINCE_DAYS: '400',
+        });
+        assert.strictEqual(explicit.sinceDays, 400);
+    });
+    /** Fix 2d: 5 seconds is shorter than one in-flight ship with its retries. */
+    test('the final-drain timeout is configurable and defaults above 5s', () => {
+        const defaulted = (0, sessionShip_1.resolveSessionShipConfig)('i', '/s', '/st', {
+            AGENTHIPPO_EVIDENCE_URL: 'https://evidence.example.com',
+            AGENTHIPPO_EVIDENCE_SHIP_TOKEN: 'tok',
+        });
+        assert.ok((defaulted.drainTimeoutSec ?? 0) > 5);
+        const explicit = (0, sessionShip_1.resolveSessionShipConfig)('i', '/s', '/st', {
+            AGENTHIPPO_EVIDENCE_URL: 'https://evidence.example.com',
+            AGENTHIPPO_EVIDENCE_SHIP_TOKEN: 'tok',
+            AGENTHIPPO_EVIDENCE_SHIP_DRAIN_TIMEOUT_SEC: '90',
+        });
+        assert.strictEqual(explicit.drainTimeoutSec, 90);
+    });
+    test('a half-configured shipper says so instead of looking disabled', () => {
+        const warnings = [];
+        const original = console.warn;
+        console.warn = (m) => { warnings.push(String(m)); };
+        try {
+            // URL without token: the operator meant to ship and will otherwise see only silence.
+            (0, sessionShip_1.resolveSessionShipConfig)('inst-1', '/tmp/sessions', '/tmp/state', {
+                AGENTHIPPO_EVIDENCE_URL: 'https://evidence.example.com',
+            });
+            assert.ok(warnings.some((w) => w.includes('AGENTHIPPO_EVIDENCE_SHIP_TOKEN')));
+            warnings.length = 0;
+            // Neither set is a deliberate opt-out, and must stay quiet.
+            (0, sessionShip_1.resolveSessionShipConfig)('inst-1', '/tmp/sessions', '/tmp/state', {});
+            assert.deepStrictEqual(warnings, []);
+        }
+        finally {
+            console.warn = original;
+        }
+    });
+});
+// -----------------------------------------------------------------------------
+// Fix 2g — the ingest URL is a bearer token plus an audit trail on the wire
+// -----------------------------------------------------------------------------
+suite('Evidence - sessionShip URL validation', () => {
+    test('https is accepted', () => {
+        assert.deepStrictEqual((0, sessionShip_1.validateEvidenceUrl)('https://evidence.example.com', {}), {
+            url: 'https://evidence.example.com',
+        });
+    });
+    test('loopback http is accepted for development', () => {
+        assert.ok('url' in (0, sessionShip_1.validateEvidenceUrl)('http://127.0.0.1:8787', {}));
+        assert.ok('url' in (0, sessionShip_1.validateEvidenceUrl)('http://localhost:8787', {}));
+    });
+    test('plaintext http to a remote host is refused', () => {
+        const result = (0, sessionShip_1.validateEvidenceUrl)('http://evidence:8787', {});
+        assert.ok('error' in result);
+        assert.ok(result.error.includes('https'));
+    });
+    test('plaintext http is recoverable with an explicit, documented opt-in', () => {
+        const warnings = [];
+        const original = console.warn;
+        console.warn = (m) => { warnings.push(String(m)); };
+        try {
+            const result = (0, sessionShip_1.validateEvidenceUrl)('http://evidence:8787', {
+                AGENTHIPPO_EVIDENCE_ALLOW_INSECURE_URL: '1',
+            });
+            assert.ok('url' in result);
+            assert.ok(warnings.some((w) => w.includes('INSECURE')));
+        }
+        finally {
+            console.warn = original;
+        }
+    });
+    test('junk and non-http schemes are refused', () => {
+        assert.ok('error' in (0, sessionShip_1.validateEvidenceUrl)('not a url', {}));
+        assert.ok('error' in (0, sessionShip_1.validateEvidenceUrl)('file:///etc/passwd', {}));
+        assert.ok('error' in (0, sessionShip_1.validateEvidenceUrl)('ftp://evidence.example.com', {}));
+    });
+    test('an invalid URL disables shipping loudly rather than half-working', () => {
+        const errors = [];
+        const original = console.error;
+        console.error = (m) => { errors.push(String(m)); };
+        try {
+            const cfg = (0, sessionShip_1.resolveSessionShipConfig)('i', '/s', '/st', {
+                AGENTHIPPO_EVIDENCE_URL: 'http://evidence:8787',
+                AGENTHIPPO_EVIDENCE_SHIP_TOKEN: 'tok',
+            });
+            assert.strictEqual(cfg, undefined);
+            assert.ok(errors.some((e) => e.includes('DISABLED')));
+        }
+        finally {
+            console.error = original;
+        }
+        assert.strictEqual((0, sessionShip_1.getEvidenceShipStatus)().disabledReason, 'invalid-url');
+    });
+});
+// -----------------------------------------------------------------------------
+// Fix 1 / fix 3 — redaction applies to EVERY lane, not just `seat`
+// -----------------------------------------------------------------------------
+suite('Evidence - sessionShip redaction', () => {
+    test('content payload fields become sha256 + length', () => {
+        const line = JSON.stringify({
+            session_id: 's', request_id: 'r', timestamp: 1, event_type: 'tool_end',
+            payload: { toolName: 'Read', resultPreview: 'CUSTOMER SECRET', isError: false },
+        });
+        const out = JSON.parse((0, sessionShip_1.redactSessionLine)(line, false));
+        assert.strictEqual(out.payload.resultPreview, undefined);
+        assert.strictEqual(out.payload.resultPreview_length, 15);
+        assert.strictEqual(out.payload.resultPreview_redacted, true);
+        assert.strictEqual(typeof out.payload.resultPreview_sha256, 'string');
+        // Metadata is untouched — redaction must not cost attribution.
+        assert.strictEqual(out.payload.toolName, 'Read');
+        assert.strictEqual(out.payload.isError, false);
+        assert.strictEqual(out.session_id, 's');
+    });
+    test('the opt-in leaves content alone', () => {
+        const line = JSON.stringify({ payload: { inputPreview: 'ls -la' } });
+        assert.strictEqual((0, sessionShip_1.redactSessionLine)(line, true), line);
+    });
+    test('an unparseable line is passed through, never dropped', () => {
+        // Dropping it would be exactly the silent loss this module exists to prevent.
+        assert.strictEqual((0, sessionShip_1.redactSessionLine)('{not json', false), '{not json');
+    });
+    test('already-digested fields are left alone (no double hashing)', () => {
+        const line = JSON.stringify({ payload: { input_sha256: 'abc', input_length: 3 } });
+        const out = JSON.parse((0, sessionShip_1.redactSessionLine)(line, false));
+        assert.strictEqual(out.payload.input_sha256, 'abc');
+        assert.strictEqual(out.payload.input_length, 3);
+    });
+});
+// -----------------------------------------------------------------------------
+// The shipper itself
+// -----------------------------------------------------------------------------
+suite('Evidence - sessionShip runtime', () => {
+    let root;
+    let stateDir;
+    let sessionsDir;
+    let server;
+    setup(async () => {
+        root = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'evidence-ship-test-'));
+        stateDir = path.join(root, 'state');
+        sessionsDir = path.join(stateDir, 'analytics', 'sessions');
+        await fs_1.promises.mkdir(sessionsDir, { recursive: true });
+        server = await startFakeEvidenceServer();
+    });
+    teardown(async () => {
+        server.close();
+        await fs_1.promises.rm(root, { recursive: true, force: true });
+    });
+    function start(overrides = {}) {
+        return (0, sessionShip_1.startSessionShipper)({
+            evidenceUrl: `http://127.0.0.1:${server.port}`,
+            shipToken: 'test-token',
+            instanceId: 'test-instance',
+            sessionsDir,
+            stateDir,
+            intervalSec: 3600,
+            sinceDays: 30,
+            ...overrides,
+        });
+    }
+    test('cursor files stay outside the sessions dir', async function () {
+        this.timeout(15000);
+        await fs_1.promises.writeFile(path.join(sessionsDir, 'sess.jsonl'), `${sessionLine()}\n`);
+        const handle = start();
+        await waitFor(() => server.ingests.length > 0);
+        handle.stop();
+        assert.ok(await fs_1.promises.stat(path.join(stateDir, '.evidence-ship-cursor.json')).then(() => true).catch(() => false));
+        assert.ok(await fs_1.promises.stat(path.join(stateDir, '.evidence-stage-cursor.json')).then(() => true).catch(() => false));
+        const inSessions = await fs_1.promises.readdir(sessionsDir);
+        assert.deepStrictEqual(inSessions, ['sess.jsonl'], 'nothing extra written into the evidence dir');
+    });
+    /** Fix 1/3: the upstream shipper redacts only `source: 'seat'`; serve shipped raw. */
+    test('session content is redacted before it reaches the shipper', async function () {
+        this.timeout(15000);
+        await fs_1.promises.writeFile(path.join(sessionsDir, 'sess.jsonl'), `${sessionLine({ payload: { toolName: 'Read', resultPreview: 'CUSTOMER SECRET' } })}\n`);
+        const handle = start();
+        await waitFor(() => server.ingests.some((i) => i.kind === 'sessions'));
+        handle.stop();
+        const shipped = server.ingests.filter((i) => i.kind === 'sessions');
+        assert.ok(shipped.length > 0);
+        for (const batch of shipped) {
+            assert.ok(!batch.body.includes('CUSTOMER SECRET'), `raw content shipped: ${batch.body}`);
+        }
+        assert.ok(shipped.some((b) => b.body.includes('resultPreview_sha256')));
+        // The local file keeps its detail — redaction is about what LEAVES the machine.
+        const local = await fs_1.promises.readFile(path.join(sessionsDir, 'sess.jsonl'), 'utf8');
+        assert.ok(local.includes('CUSTOMER SECRET'));
+    });
+    /**
+     * Fix 2c: the upstream cursor compares mtime for EQUALITY, so an edit that preserves mtime is
+     * never re-shipped. Ours compares content.
+     */
+    test('an edit that preserves mtime is still shipped', async function () {
+        this.timeout(20000);
+        const file = path.join(sessionsDir, 'sess.jsonl');
+        await fs_1.promises.writeFile(file, `${sessionLine({ request_id: 'first' })}\n`);
+        // A whole-second timestamp, so restoring it later reproduces mtimeMs EXACTLY rather than
+        // to within the sub-millisecond precision utimes() round-trips.
+        const pinned = Math.floor(Date.now() / 1000);
+        await fs_1.promises.utimes(file, pinned, pinned);
+        const original = await fs_1.promises.stat(file);
+        const handle = start();
+        await waitFor(() => server.ingests.some((i) => i.kind === 'sessions' && i.body.includes('first')));
+        // Rewrite the file and put the timestamp back exactly as it was — the classic way an
+        // after-the-fact edit hides from an mtime cursor.
+        await fs_1.promises.writeFile(file, `${sessionLine({ request_id: 'tampered' })}\n`);
+        await fs_1.promises.utimes(file, pinned, pinned);
+        const after = await fs_1.promises.stat(file);
+        assert.strictEqual(after.mtimeMs, original.mtimeMs, 'precondition: mtime was preserved');
+        await handle.flush();
+        assert.ok(server.ingests.some((i) => i.kind === 'sessions' && i.body.includes('tampered')), 'the mtime-preserving edit was never shipped');
+    });
+    /**
+     * Fix 2b: files past the window are skipped forever. The skip must become a RECORD — a gap the
+     * server can see beats a gap only the local disk knows about.
+     */
+    test('a file too old to ship produces a counted, shipped loss record', async function () {
+        this.timeout(20000);
+        const stale = path.join(sessionsDir, 'stale.jsonl');
+        await fs_1.promises.writeFile(stale, `${sessionLine()}\n${sessionLine()}\n`);
+        const longAgo = new Date(Date.now() - 40 * 86400_000);
+        await fs_1.promises.utimes(stale, longAgo, longAgo);
+        const warnings = [];
+        const handle = start({
+            sinceDays: 7,
+            logger: { info: () => undefined, warn: (m) => warnings.push(m) },
+        });
+        await waitFor(() => server.ingests.some((i) => i.body.includes('evidence_skipped')));
+        handle.stop();
+        assert.ok(warnings.some((w) => w.includes('EVIDENCE PERMANENTLY SKIPPED')), `no loud warning: ${JSON.stringify(warnings)}`);
+        const loss = server.ingests.find((i) => i.body.includes('evidence_skipped'));
+        const record = JSON.parse(loss.body.trim().split('\n')[0]);
+        assert.strictEqual(record.payload.reason, 'older_than_ship_window');
+        assert.strictEqual(record.payload.file, 'stale.jsonl');
+        assert.strictEqual(record.payload.records, 2);
+        assert.strictEqual(record.payload.permanent, true);
+        const status = handle.status();
+        assert.strictEqual(status.filesSkippedTooOld, 1);
+        assert.strictEqual(status.recordsSkippedTooOld, 2);
+    });
+    test('the same permanent loss is reported once, not every tick', async function () {
+        this.timeout(20000);
+        const stale = path.join(sessionsDir, 'stale.jsonl');
+        await fs_1.promises.writeFile(stale, `${sessionLine()}\n`);
+        const longAgo = new Date(Date.now() - 40 * 86400_000);
+        await fs_1.promises.utimes(stale, longAgo, longAgo);
+        const handle = start({ sinceDays: 7 });
+        await waitFor(() => server.ingests.some((i) => i.body.includes('evidence_skipped')));
+        await handle.flush();
+        const lossRecords = server.ingests
+            .filter((i) => i.kind === 'sessions')
+            .flatMap((i) => i.body.trim().split('\n'))
+            .filter((l) => l.includes('evidence_skipped'));
+        // The staged loss file is re-sent whole, but it must not GROW a duplicate per tick.
+        const unique = new Set(lossRecords.map((l) => JSON.parse(l).payload.file));
+        assert.strictEqual(unique.size, 1);
+        assert.strictEqual(handle.status().filesSkippedTooOld, 1, 'counted once');
+    });
+    /**
+     * Fix 2e: the heartbeat was the literal '{}'. That proves a process was alive and nothing
+     * about whether the record is complete — which is the whole of R-13 gap detection.
+     */
+    test('the heartbeat carries window bounds and counts, not {}', async function () {
+        this.timeout(15000);
+        await fs_1.promises.writeFile(path.join(sessionsDir, 'sess.jsonl'), `${sessionLine()}\n${sessionLine()}\n`);
+        const handle = start();
+        await waitFor(() => server.ingests.some((i) => i.kind === 'heartbeat'));
+        handle.stop();
+        const beat = server.ingests.find((i) => i.kind === 'heartbeat');
+        assert.notStrictEqual(beat.body, '{}');
+        const doc = JSON.parse(beat.body);
+        assert.strictEqual(doc.instance_id, 'test-instance');
+        assert.ok(typeof doc.window_from_ms === 'number');
+        assert.ok(typeof doc.window_to_ms === 'number');
+        assert.ok(doc.window_to_ms >= doc.window_from_ms);
+        assert.strictEqual(doc.records_staged, 2);
+        assert.strictEqual(doc.records_shipped, 2);
+        assert.strictEqual(doc.records_skipped_too_old, 0);
+        assert.strictEqual(typeof doc.evidence_write_failures, 'number');
+        assert.strictEqual(doc.since_days, 30);
+    });
+    test('consecutive heartbeat windows are contiguous, so a gap is detectable', async function () {
+        this.timeout(20000);
+        await fs_1.promises.writeFile(path.join(sessionsDir, 'sess.jsonl'), `${sessionLine()}\n`);
+        const handle = start();
+        await waitFor(() => server.ingests.filter((i) => i.kind === 'heartbeat').length >= 1);
+        await handle.flush();
+        await waitFor(() => server.ingests.filter((i) => i.kind === 'heartbeat').length >= 2);
+        const beats = server.ingests.filter((i) => i.kind === 'heartbeat').map((i) => JSON.parse(i.body));
+        assert.ok(beats.length >= 2);
+        assert.strictEqual(beats[1].window_from_ms, beats[0].window_to_ms, 'window 2 must begin exactly where window 1 ended, or a gap is invisible');
+    });
+    test('counts accumulate across a failed heartbeat instead of vanishing with it', async function () {
+        this.timeout(25000);
+        // Sessions ship fine; only the heartbeat fails. If the window were closed optimistically,
+        // the records covered by the lost heartbeat would never be reported to anyone — the
+        // server would see a smaller count and have no way to know it was short.
+        server.failKind('heartbeat', true);
+        await fs_1.promises.writeFile(path.join(sessionsDir, 'sess.jsonl'), `${sessionLine()}\n`);
+        const handle = start();
+        await waitFor(() => server.ingests.some((i) => i.kind === 'sessions'));
+        server.failKind('heartbeat', false);
+        await fs_1.promises.appendFile(path.join(sessionsDir, 'sess.jsonl'), `${sessionLine()}\n`);
+        await handle.flush();
+        const beats = server.ingests.filter((i) => i.kind === 'heartbeat').map((i) => JSON.parse(i.body));
+        assert.ok(beats.length >= 1, 'a heartbeat eventually landed');
+        // The first heartbeat to survive covers BOTH intervals: 1 record from the tick whose
+        // heartbeat was lost, plus 2 from the restaged file.
+        assert.ok(beats[0].records_staged >= 3, `staged=${beats[0].records_staged}`);
+    });
+    /**
+     * SIGTERM is how every serve container ends. Without a final drain, each redeploy silently
+     * dropped whatever was written since the last tick — and on an ephemeral state dir the cursor
+     * went with it, so the window was unrecoverable rather than merely late.
+     */
+    test('flush() ships the tail written after the last tick', async function () {
+        this.timeout(15000);
+        const handle = start();
+        await waitFor(() => server.ingests.length > 0);
+        const afterBoot = server.ingests.length;
+        await fs_1.promises.writeFile(path.join(sessionsDir, 'late.jsonl'), `${sessionLine({ request_id: 'r-late' })}\n`);
+        await handle.flush();
+        assert.ok(server.ingests.length > afterBoot, 'flush() shipped after the loop stopped');
+        assert.ok(server.ingests.some((i) => i.kind === 'sessions' && i.body.includes('r-late')), 'the tail turn reached the server');
+    });
+    /** Fix 2d: the abandoned-drain path must say how much it abandoned. */
+    test('an abandoned final drain reports what was lost', async function () {
+        this.timeout(15000);
+        const warnings = [];
+        // Point at a dead port so the boot tick stays in flight through the whole drain window.
+        const handle = (0, sessionShip_1.startSessionShipper)({
+            evidenceUrl: 'http://127.0.0.1:1',
+            shipToken: 'test-token',
+            instanceId: 'test-instance',
+            sessionsDir,
+            stateDir,
+            intervalSec: 3600,
+            sinceDays: 30,
+            drainTimeoutSec: 1,
+            logger: { info: () => undefined, warn: (m) => warnings.push(m) },
+        });
+        await fs_1.promises.writeFile(path.join(sessionsDir, 'sess.jsonl'), `${sessionLine()}\n`);
+        await handle.flush();
+        handle.stop();
+        const abandoned = warnings.find((w) => w.includes('FINAL DRAIN ABANDONED'));
+        if (abandoned) {
+            assert.ok(/record\(s\)/.test(abandoned), `no record count in: ${abandoned}`);
+            assert.ok(abandoned.includes('AGENTHIPPO_EVIDENCE_SHIP_DRAIN_TIMEOUT_SEC'), 'names the knob to raise');
+        }
+        else {
+            // The tick finished inside the window; the run must then report leftovers explicitly.
+            assert.ok(warnings.some((w) => w.includes('unshipped') || w.includes('drain failed')), `neither abandonment nor failure was reported: ${JSON.stringify(warnings)}`);
+        }
+    });
+    test('status() exposes the counters /health needs', async function () {
+        this.timeout(15000);
+        await fs_1.promises.writeFile(path.join(sessionsDir, 'sess.jsonl'), `${sessionLine()}\n`);
+        const handle = start();
+        await waitFor(() => handle.status().recordsShipped > 0);
+        handle.stop();
+        const status = handle.status();
+        assert.strictEqual(status.enabled, true);
+        assert.strictEqual(status.recordsStaged, 1);
+        assert.strictEqual(status.recordsShipped, 1);
+        assert.strictEqual(status.consecutiveFailures, 0);
+        assert.strictEqual(status.contentCapture, false, 'content capture is off by default');
+        assert.ok((status.lastOkAt ?? 0) > 0);
+    });
+    test('a failing server is counted, not smoothed over', async function () {
+        this.timeout(20000);
+        await fs_1.promises.writeFile(path.join(sessionsDir, 'sess.jsonl'), `${sessionLine()}\n`);
+        server.fail(true);
+        const handle = start();
+        await waitFor(() => handle.status().consecutiveFailures > 0, 15000);
+        handle.stop();
+        assert.ok(handle.status().consecutiveFailures > 0);
+        assert.strictEqual(handle.status().recordsShipped, 0, 'nothing may be marked shipped');
+        assert.strictEqual(handle.status().lastOkAt, undefined);
+    });
+});

package/out/test/spotlightPublish.test.js

@@ -296,4 +296,32 @@ suite('spotlightPublish', () => {
         assert.strictEqual(result.valid, false);
         assert.ok(result.errors.some(error => error.includes('no scripts')));
     });
+    test('installSpotlightViewFromFiles rejects bundle entries that escape the install dir', async () => {
+        const viewId = 'evil-view';
+        const targetRoot = path.join(tempDir, 'traversal-target');
+        await fs_1.promises.mkdir(targetRoot, { recursive: true });
+        const manifest = [
+            'version: 1.0.0',
+            `id: ${viewId}`,
+            'name: Evil',
+            'scope: workspace',
+            'scripts:',
+            '  - w.js',
+        ].join('\n');
+        const files = [
+            { path: 'view.yaml', content: manifest },
+            { path: 'panel-entry.yaml', content: manifest },
+            { path: 'scripts/w.js', content: 'console.log(1)' },
+            // Passes the raw "scripts/" prefix check but resolves outside the install dir.
+            { path: 'scripts/../../../escaped.txt', content: 'pwned' },
+        ];
+        await assert.rejects((0, install_1.installSpotlightViewFromFiles)(files, {
+            slug: viewId,
+            workspaceRoot: targetRoot,
+            overwrite: true,
+            activate: false,
+        }), /escapes the install directory/);
+        // The traversal target (analyticsRoot/escaped.txt) must not have been written.
+        await assert.rejects(fs_1.promises.access(path.join(targetRoot, '.agent-hippo', 'analytics', 'escaped.txt')));
+    });
 });

package/out/test/store-install-safe.test.js

@@ -0,0 +1,69 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const reconcile_1 = require("../pack/reconcile");
+suite('store install path containment', () => {
+    test('safeJoin refuses traversal paths', () => {
+        const root = path.join(os.tmpdir(), 'pack-install-root');
+        assert.strictEqual((0, reconcile_1.safeJoin)(root, '../../etc/passwd'), undefined);
+        assert.strictEqual((0, reconcile_1.safeJoin)(root, '/etc/passwd'), undefined);
+        const ok = (0, reconcile_1.safeJoin)(root, 'agent.yaml');
+        assert.ok(ok?.endsWith(`${path.sep}agent.yaml`));
+    });
+    test('install extract pattern refuses escape before write', async () => {
+        const installDir = fs.mkdtempSync(path.join(os.tmpdir(), 'store-install-'));
+        const files = [{ path: '../escaped.txt', content: Buffer.from('nope') }];
+        let refused = false;
+        for (const file of files) {
+            const filePath = (0, reconcile_1.safeJoin)(installDir, file.path);
+            if (!filePath) {
+                refused = true;
+                continue;
+            }
+            await fs.promises.mkdir(path.dirname(filePath), { recursive: true });
+            await fs.promises.writeFile(filePath, file.content);
+        }
+        assert.strictEqual(refused, true);
+        assert.equal(fs.existsSync(path.join(path.dirname(installDir), 'escaped.txt')), false);
+    });
+});