@agenthippo-ai/agenthippo 1.110.11 → 1.110.19

package/out/test/sessionShip.test.js

@@ -1,618 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *  Licensed under the MIT License. See LICENSE.txt in the project root for license information.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-require("mocha");
-const assert = __importStar(require("assert"));
-const path = __importStar(require("path"));
-const os = __importStar(require("os"));
-const fs_1 = require("fs");
-const sessionShip_1 = require("../evidence/sessionShip");
-/** A stand-in evidence server that records what it was actually sent. */
-async function startFakeEvidenceServer() {
-    const http = await import('http');
-    const zlib = await import('zlib');
-    const ingests = [];
-    let failing = false;
-    const failingKinds = new Set();
-    const server = http.createServer((req, res) => {
-        if (req.method === 'POST' && req.url === '/ingest/batch') {
-            const chunks = [];
-            req.on('data', (c) => chunks.push(Buffer.from(c)));
-            req.on('end', () => {
-                let doc = {};
-                try {
-                    doc = JSON.parse(Buffer.concat(chunks).toString('utf8'));
-                }
-                catch { /* malformed; treated as unknown kind */ }
-                if (failing || (doc.kind && failingKinds.has(doc.kind))) {
-                    res.writeHead(500, { 'content-type': 'application/json' });
-                    res.end(JSON.stringify({ error: 'nope' }));
-                    return;
-                }
-                try {
-                    ingests.push({
-                        kind: doc.kind ?? '',
-                        name: doc.name ?? '',
-                        body: zlib.gunzipSync(Buffer.from(doc.content_gzip_b64 ?? '', 'base64')).toString('utf8'),
-                    });
-                }
-                catch { /* recorded as nothing */ }
-                res.writeHead(200, { 'content-type': 'application/json' });
-                res.end(JSON.stringify({ batch_id: 'test', turns: 0 }));
-            });
-            return;
-        }
-        res.writeHead(404);
-        res.end();
-    });
-    await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
-    const addr = server.address();
-    return {
-        port: typeof addr === 'object' && addr ? addr.port : 0,
-        ingests,
-        close: () => server.close(),
-        fail: (on) => { failing = on; },
-        failKind: (kind, on) => {
-            if (on) {
-                failingKinds.add(kind);
-            }
-            else {
-                failingKinds.delete(kind);
-            }
-        },
-    };
-}
-function sessionLine(overrides = {}) {
-    return JSON.stringify({
-        session_id: 's1',
-        request_id: 'r1',
-        timestamp: Date.now(),
-        event_type: 'tool_start',
-        payload: {},
-        ...overrides,
-    });
-}
-async function waitFor(predicate, timeoutMs = 8000) {
-    const deadline = Date.now() + timeoutMs;
-    while (Date.now() < deadline) {
-        if (predicate()) {
-            return;
-        }
-        await new Promise((r) => setTimeout(r, 25));
-    }
-    throw new Error('timed out waiting for condition');
-}
-suite('Evidence - sessionShip config', () => {
-    test('resolveSessionShipConfig returns undefined when URL/token missing', () => {
-        assert.strictEqual((0, sessionShip_1.resolveSessionShipConfig)('inst-1', '/tmp/sessions', '/tmp/state', {}), undefined);
-    });
-    test('resolveSessionShipConfig returns undefined when AGENTHIPPO_EVIDENCE_SHIP=0', () => {
-        const cfg = (0, sessionShip_1.resolveSessionShipConfig)('inst-1', '/tmp/sessions', '/tmp/state', {
-            AGENTHIPPO_EVIDENCE_URL: 'https://evidence.example.com',
-            AGENTHIPPO_EVIDENCE_SHIP_TOKEN: 'tok',
-            AGENTHIPPO_EVIDENCE_SHIP: '0',
-        });
-        assert.strictEqual(cfg, undefined);
-    });
-    /**
-     * Fix 2f: disabling the compliance record was a single character in an env file that produced
-     * no output whatsoever. It stays possible, but it can no longer be accidental or unnoticed.
-     */
-    test('disabling shipping prints an unmissable banner and shows up in status', () => {
-        const warnings = [];
-        const original = console.warn;
-        console.warn = (m) => { warnings.push(String(m)); };
-        try {
-            (0, sessionShip_1.resolveSessionShipConfig)('inst-1', '/tmp/sessions', '/tmp/state', {
-                AGENTHIPPO_EVIDENCE_URL: 'https://evidence.example.com',
-                AGENTHIPPO_EVIDENCE_SHIP_TOKEN: 'tok',
-                AGENTHIPPO_EVIDENCE_SHIP: '0',
-            });
-        }
-        finally {
-            console.warn = original;
-        }
-        assert.ok(warnings.some((w) => w.includes('EVIDENCE SHIPPING IS DISABLED')), `no banner: ${JSON.stringify(warnings)}`);
-        const status = (0, sessionShip_1.getEvidenceShipStatus)();
-        assert.strictEqual(status.enabled, false);
-        assert.strictEqual(status.disabledReason, 'disabled-by-env');
-    });
-    test('resolveSessionShipConfig builds config from env', () => {
-        const cfg = (0, sessionShip_1.resolveSessionShipConfig)('my-instance', '/data/sessions', '/data/state', {
-            AGENTHIPPO_EVIDENCE_URL: 'https://evidence.example.com',
-            AGENTHIPPO_EVIDENCE_SHIP_TOKEN: 'serve-tok',
-            AGENTHIPPO_EVIDENCE_SHIP_INTERVAL_SEC: '120',
-        });
-        assert.ok(cfg);
-        assert.strictEqual(cfg.instanceId, 'my-instance');
-        assert.strictEqual(cfg.evidenceUrl, 'https://evidence.example.com');
-        assert.strictEqual(cfg.shipToken, 'serve-tok');
-        assert.strictEqual(cfg.intervalSec, 120);
-        assert.strictEqual(cfg.sessionsDir, '/data/sessions');
-    });
-    /**
-     * Fix 2b: the window was hard-coded to 7 days, so an outage longer than a week deleted the
-     * backlog rather than delaying it — and the week that broke is the week you need.
-     */
-    test('the ship window is configurable and defaults to more than a week', () => {
-        const defaulted = (0, sessionShip_1.resolveSessionShipConfig)('i', '/s', '/st', {
-            AGENTHIPPO_EVIDENCE_URL: 'https://evidence.example.com',
-            AGENTHIPPO_EVIDENCE_SHIP_TOKEN: 'tok',
-        });
-        assert.ok((defaulted.sinceDays ?? 0) > 7, `default window is ${defaulted.sinceDays}`);
-        const explicit = (0, sessionShip_1.resolveSessionShipConfig)('i', '/s', '/st', {
-            AGENTHIPPO_EVIDENCE_URL: 'https://evidence.example.com',
-            AGENTHIPPO_EVIDENCE_SHIP_TOKEN: 'tok',
-            AGENTHIPPO_EVIDENCE_SHIP_SINCE_DAYS: '400',
-        });
-        assert.strictEqual(explicit.sinceDays, 400);
-    });
-    /** Fix 2d: 5 seconds is shorter than one in-flight ship with its retries. */
-    test('the final-drain timeout is configurable and defaults above 5s', () => {
-        const defaulted = (0, sessionShip_1.resolveSessionShipConfig)('i', '/s', '/st', {
-            AGENTHIPPO_EVIDENCE_URL: 'https://evidence.example.com',
-            AGENTHIPPO_EVIDENCE_SHIP_TOKEN: 'tok',
-        });
-        assert.ok((defaulted.drainTimeoutSec ?? 0) > 5);
-        const explicit = (0, sessionShip_1.resolveSessionShipConfig)('i', '/s', '/st', {
-            AGENTHIPPO_EVIDENCE_URL: 'https://evidence.example.com',
-            AGENTHIPPO_EVIDENCE_SHIP_TOKEN: 'tok',
-            AGENTHIPPO_EVIDENCE_SHIP_DRAIN_TIMEOUT_SEC: '90',
-        });
-        assert.strictEqual(explicit.drainTimeoutSec, 90);
-    });
-    test('a half-configured shipper says so instead of looking disabled', () => {
-        const warnings = [];
-        const original = console.warn;
-        console.warn = (m) => { warnings.push(String(m)); };
-        try {
-            // URL without token: the operator meant to ship and will otherwise see only silence.
-            (0, sessionShip_1.resolveSessionShipConfig)('inst-1', '/tmp/sessions', '/tmp/state', {
-                AGENTHIPPO_EVIDENCE_URL: 'https://evidence.example.com',
-            });
-            assert.ok(warnings.some((w) => w.includes('AGENTHIPPO_EVIDENCE_SHIP_TOKEN')));
-            warnings.length = 0;
-            // Neither set is a deliberate opt-out, and must stay quiet.
-            (0, sessionShip_1.resolveSessionShipConfig)('inst-1', '/tmp/sessions', '/tmp/state', {});
-            assert.deepStrictEqual(warnings, []);
-        }
-        finally {
-            console.warn = original;
-        }
-    });
-});
-// -----------------------------------------------------------------------------
-// Fix 2g — the ingest URL is a bearer token plus an audit trail on the wire
-// -----------------------------------------------------------------------------
-suite('Evidence - sessionShip URL validation', () => {
-    test('https is accepted', () => {
-        assert.deepStrictEqual((0, sessionShip_1.validateEvidenceUrl)('https://evidence.example.com', {}), {
-            url: 'https://evidence.example.com',
-        });
-    });
-    test('loopback http is accepted for development', () => {
-        assert.ok('url' in (0, sessionShip_1.validateEvidenceUrl)('http://127.0.0.1:8787', {}));
-        assert.ok('url' in (0, sessionShip_1.validateEvidenceUrl)('http://localhost:8787', {}));
-    });
-    test('plaintext http to a remote host is refused', () => {
-        const result = (0, sessionShip_1.validateEvidenceUrl)('http://evidence:8787', {});
-        assert.ok('error' in result);
-        assert.ok(result.error.includes('https'));
-    });
-    test('plaintext http is recoverable with an explicit, documented opt-in', () => {
-        const warnings = [];
-        const original = console.warn;
-        console.warn = (m) => { warnings.push(String(m)); };
-        try {
-            const result = (0, sessionShip_1.validateEvidenceUrl)('http://evidence:8787', {
-                AGENTHIPPO_EVIDENCE_ALLOW_INSECURE_URL: '1',
-            });
-            assert.ok('url' in result);
-            assert.ok(warnings.some((w) => w.includes('INSECURE')));
-        }
-        finally {
-            console.warn = original;
-        }
-    });
-    test('junk and non-http schemes are refused', () => {
-        assert.ok('error' in (0, sessionShip_1.validateEvidenceUrl)('not a url', {}));
-        assert.ok('error' in (0, sessionShip_1.validateEvidenceUrl)('file:///etc/passwd', {}));
-        assert.ok('error' in (0, sessionShip_1.validateEvidenceUrl)('ftp://evidence.example.com', {}));
-    });
-    test('an invalid URL disables shipping loudly rather than half-working', () => {
-        const errors = [];
-        const original = console.error;
-        console.error = (m) => { errors.push(String(m)); };
-        try {
-            const cfg = (0, sessionShip_1.resolveSessionShipConfig)('i', '/s', '/st', {
-                AGENTHIPPO_EVIDENCE_URL: 'http://evidence:8787',
-                AGENTHIPPO_EVIDENCE_SHIP_TOKEN: 'tok',
-            });
-            assert.strictEqual(cfg, undefined);
-            assert.ok(errors.some((e) => e.includes('DISABLED')));
-        }
-        finally {
-            console.error = original;
-        }
-        assert.strictEqual((0, sessionShip_1.getEvidenceShipStatus)().disabledReason, 'invalid-url');
-    });
-    test('compose-internal http resolves when allow-insecure is opted in', () => {
-        const cfg = (0, sessionShip_1.resolveSessionShipConfig)('i', '/s', '/st', {
-            AGENTHIPPO_EVIDENCE_URL: 'http://evidence:8787',
-            AGENTHIPPO_EVIDENCE_SHIP_TOKEN: 'tok',
-            AGENTHIPPO_EVIDENCE_ALLOW_INSECURE_URL: '1',
-        });
-        assert.ok(cfg);
-        assert.strictEqual(cfg.evidenceUrl, 'http://evidence:8787');
-        assert.strictEqual(cfg.allowInsecure, true);
-    });
-    test('EVIDENCE_ALLOW_INSECURE_URL alone also enables compose-internal http', () => {
-        const cfg = (0, sessionShip_1.resolveSessionShipConfig)('i', '/s', '/st', {
-            AGENTHIPPO_EVIDENCE_URL: 'http://evidence:8787',
-            AGENTHIPPO_EVIDENCE_SHIP_TOKEN: 'tok',
-            EVIDENCE_ALLOW_INSECURE_URL: '1',
-        });
-        assert.ok(cfg);
-        assert.strictEqual(cfg.allowInsecure, true);
-    });
-});
-// -----------------------------------------------------------------------------
-// Fix 1 / fix 3 — redaction applies to EVERY lane, not just `seat`
-// -----------------------------------------------------------------------------
-suite('Evidence - sessionShip redaction', () => {
-    test('content payload fields become sha256 + length', () => {
-        const line = JSON.stringify({
-            session_id: 's', request_id: 'r', timestamp: 1, event_type: 'tool_end',
-            payload: { toolName: 'Read', resultPreview: 'CUSTOMER SECRET', isError: false },
-        });
-        const out = JSON.parse((0, sessionShip_1.redactSessionLine)(line, false));
-        assert.strictEqual(out.payload.resultPreview, undefined);
-        assert.strictEqual(out.payload.resultPreview_length, 15);
-        assert.strictEqual(out.payload.resultPreview_redacted, true);
-        assert.strictEqual(typeof out.payload.resultPreview_sha256, 'string');
-        // Metadata is untouched — redaction must not cost attribution.
-        assert.strictEqual(out.payload.toolName, 'Read');
-        assert.strictEqual(out.payload.isError, false);
-        assert.strictEqual(out.session_id, 's');
-    });
-    test('the opt-in leaves content alone', () => {
-        const line = JSON.stringify({ payload: { inputPreview: 'ls -la' } });
-        assert.strictEqual((0, sessionShip_1.redactSessionLine)(line, true), line);
-    });
-    test('an unparseable line is passed through, never dropped', () => {
-        // Dropping it would be exactly the silent loss this module exists to prevent.
-        assert.strictEqual((0, sessionShip_1.redactSessionLine)('{not json', false), '{not json');
-    });
-    test('already-digested fields are left alone (no double hashing)', () => {
-        const line = JSON.stringify({ payload: { input_sha256: 'abc', input_length: 3 } });
-        const out = JSON.parse((0, sessionShip_1.redactSessionLine)(line, false));
-        assert.strictEqual(out.payload.input_sha256, 'abc');
-        assert.strictEqual(out.payload.input_length, 3);
-    });
-});
-// -----------------------------------------------------------------------------
-// The shipper itself
-// -----------------------------------------------------------------------------
-suite('Evidence - sessionShip runtime', () => {
-    let root;
-    let stateDir;
-    let sessionsDir;
-    let server;
-    setup(async () => {
-        root = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'evidence-ship-test-'));
-        stateDir = path.join(root, 'state');
-        sessionsDir = path.join(stateDir, 'analytics', 'sessions');
-        await fs_1.promises.mkdir(sessionsDir, { recursive: true });
-        server = await startFakeEvidenceServer();
-    });
-    teardown(async () => {
-        server.close();
-        await fs_1.promises.rm(root, { recursive: true, force: true });
-    });
-    function start(overrides = {}) {
-        return (0, sessionShip_1.startSessionShipper)({
-            evidenceUrl: `http://127.0.0.1:${server.port}`,
-            shipToken: 'test-token',
-            instanceId: 'test-instance',
-            sessionsDir,
-            stateDir,
-            intervalSec: 3600,
-            sinceDays: 30,
-            ...overrides,
-        });
-    }
-    test('cursor files stay outside the sessions dir', async function () {
-        this.timeout(15000);
-        await fs_1.promises.writeFile(path.join(sessionsDir, 'sess.jsonl'), `${sessionLine()}\n`);
-        const handle = start();
-        await waitFor(() => server.ingests.length > 0);
-        handle.stop();
-        assert.ok(await fs_1.promises.stat(path.join(stateDir, '.evidence-ship-cursor.json')).then(() => true).catch(() => false));
-        assert.ok(await fs_1.promises.stat(path.join(stateDir, '.evidence-stage-cursor.json')).then(() => true).catch(() => false));
-        const inSessions = await fs_1.promises.readdir(sessionsDir);
-        assert.deepStrictEqual(inSessions, ['sess.jsonl'], 'nothing extra written into the evidence dir');
-    });
-    /** Fix 1/3: the upstream shipper redacts only `source: 'seat'`; serve shipped raw. */
-    test('session content is redacted before it reaches the shipper', async function () {
-        this.timeout(15000);
-        await fs_1.promises.writeFile(path.join(sessionsDir, 'sess.jsonl'), `${sessionLine({ payload: { toolName: 'Read', resultPreview: 'CUSTOMER SECRET' } })}\n`);
-        const handle = start();
-        await waitFor(() => server.ingests.some((i) => i.kind === 'sessions'));
-        handle.stop();
-        const shipped = server.ingests.filter((i) => i.kind === 'sessions');
-        assert.ok(shipped.length > 0);
-        for (const batch of shipped) {
-            assert.ok(!batch.body.includes('CUSTOMER SECRET'), `raw content shipped: ${batch.body}`);
-        }
-        assert.ok(shipped.some((b) => b.body.includes('resultPreview_sha256')));
-        // The local file keeps its detail — redaction is about what LEAVES the machine.
-        const local = await fs_1.promises.readFile(path.join(sessionsDir, 'sess.jsonl'), 'utf8');
-        assert.ok(local.includes('CUSTOMER SECRET'));
-    });
-    /**
-     * Fix 2c: the upstream cursor compares mtime for EQUALITY, so an edit that preserves mtime is
-     * never re-shipped. Ours compares content.
-     */
-    test('an edit that preserves mtime is still shipped', async function () {
-        this.timeout(20000);
-        const file = path.join(sessionsDir, 'sess.jsonl');
-        await fs_1.promises.writeFile(file, `${sessionLine({ request_id: 'first' })}\n`);
-        // A whole-second timestamp, so restoring it later reproduces mtimeMs EXACTLY rather than
-        // to within the sub-millisecond precision utimes() round-trips.
-        const pinned = Math.floor(Date.now() / 1000);
-        await fs_1.promises.utimes(file, pinned, pinned);
-        const original = await fs_1.promises.stat(file);
-        const handle = start();
-        await waitFor(() => server.ingests.some((i) => i.kind === 'sessions' && i.body.includes('first')));
-        // Rewrite the file and put the timestamp back exactly as it was — the classic way an
-        // after-the-fact edit hides from an mtime cursor.
-        await fs_1.promises.writeFile(file, `${sessionLine({ request_id: 'tampered' })}\n`);
-        await fs_1.promises.utimes(file, pinned, pinned);
-        const after = await fs_1.promises.stat(file);
-        assert.strictEqual(after.mtimeMs, original.mtimeMs, 'precondition: mtime was preserved');
-        await handle.flush();
-        assert.ok(server.ingests.some((i) => i.kind === 'sessions' && i.body.includes('tampered')), 'the mtime-preserving edit was never shipped');
-    });
-    /**
-     * Fix 2b: files past the window are skipped forever. The skip must become a RECORD — a gap the
-     * server can see beats a gap only the local disk knows about.
-     */
-    test('a file too old to ship produces a counted, shipped loss record', async function () {
-        this.timeout(20000);
-        const stale = path.join(sessionsDir, 'stale.jsonl');
-        await fs_1.promises.writeFile(stale, `${sessionLine()}\n${sessionLine()}\n`);
-        const longAgo = new Date(Date.now() - 40 * 86400_000);
-        await fs_1.promises.utimes(stale, longAgo, longAgo);
-        const warnings = [];
-        const handle = start({
-            sinceDays: 7,
-            logger: { info: () => undefined, warn: (m) => warnings.push(m) },
-        });
-        await waitFor(() => server.ingests.some((i) => i.body.includes('evidence_skipped')));
-        handle.stop();
-        assert.ok(warnings.some((w) => w.includes('EVIDENCE PERMANENTLY SKIPPED')), `no loud warning: ${JSON.stringify(warnings)}`);
-        const loss = server.ingests.find((i) => i.body.includes('evidence_skipped'));
-        const record = JSON.parse(loss.body.trim().split('\n')[0]);
-        assert.strictEqual(record.payload.reason, 'older_than_ship_window');
-        assert.strictEqual(record.payload.file, 'stale.jsonl');
-        assert.strictEqual(record.payload.records, 2);
-        assert.strictEqual(record.payload.permanent, true);
-        const status = handle.status();
-        assert.strictEqual(status.filesSkippedTooOld, 1);
-        assert.strictEqual(status.recordsSkippedTooOld, 2);
-    });
-    test('the same permanent loss is reported once, not every tick', async function () {
-        this.timeout(20000);
-        const stale = path.join(sessionsDir, 'stale.jsonl');
-        await fs_1.promises.writeFile(stale, `${sessionLine()}\n`);
-        const longAgo = new Date(Date.now() - 40 * 86400_000);
-        await fs_1.promises.utimes(stale, longAgo, longAgo);
-        const handle = start({ sinceDays: 7 });
-        await waitFor(() => server.ingests.some((i) => i.body.includes('evidence_skipped')));
-        await handle.flush();
-        const lossRecords = server.ingests
-            .filter((i) => i.kind === 'sessions')
-            .flatMap((i) => i.body.trim().split('\n'))
-            .filter((l) => l.includes('evidence_skipped'));
-        // The staged loss file is re-sent whole, but it must not GROW a duplicate per tick.
-        const unique = new Set(lossRecords.map((l) => JSON.parse(l).payload.file));
-        assert.strictEqual(unique.size, 1);
-        assert.strictEqual(handle.status().filesSkippedTooOld, 1, 'counted once');
-    });
-    /**
-     * Fix 2e: the heartbeat was the literal '{}'. That proves a process was alive and nothing
-     * about whether the record is complete — which is the whole of R-13 gap detection.
-     */
-    test('the heartbeat carries window bounds and counts, not {}', async function () {
-        this.timeout(15000);
-        await fs_1.promises.writeFile(path.join(sessionsDir, 'sess.jsonl'), `${sessionLine()}\n${sessionLine()}\n`);
-        const handle = start();
-        await waitFor(() => server.ingests.some((i) => i.kind === 'heartbeat'));
-        handle.stop();
-        const beat = server.ingests.find((i) => i.kind === 'heartbeat');
-        assert.notStrictEqual(beat.body, '{}');
-        const doc = JSON.parse(beat.body);
-        assert.strictEqual(doc.instance_id, 'test-instance');
-        assert.ok(typeof doc.window_from_ms === 'number');
-        assert.ok(typeof doc.window_to_ms === 'number');
-        assert.ok(doc.window_to_ms >= doc.window_from_ms);
-        assert.strictEqual(doc.records_staged, 2);
-        assert.strictEqual(doc.records_shipped, 2);
-        assert.strictEqual(doc.records_skipped_too_old, 0);
-        assert.strictEqual(typeof doc.evidence_write_failures, 'number');
-        assert.strictEqual(doc.since_days, 30);
-    });
-    test('consecutive heartbeat windows are contiguous, so a gap is detectable', async function () {
-        this.timeout(20000);
-        await fs_1.promises.writeFile(path.join(sessionsDir, 'sess.jsonl'), `${sessionLine()}\n`);
-        const handle = start();
-        await waitFor(() => server.ingests.filter((i) => i.kind === 'heartbeat').length >= 1);
-        await handle.flush();
-        await waitFor(() => server.ingests.filter((i) => i.kind === 'heartbeat').length >= 2);
-        const beats = server.ingests.filter((i) => i.kind === 'heartbeat').map((i) => JSON.parse(i.body));
-        assert.ok(beats.length >= 2);
-        assert.strictEqual(beats[1].window_from_ms, beats[0].window_to_ms, 'window 2 must begin exactly where window 1 ended, or a gap is invisible');
-    });
-    test('counts accumulate across a failed heartbeat instead of vanishing with it', async function () {
-        this.timeout(25000);
-        // Sessions ship fine; only the heartbeat fails. If the window were closed optimistically,
-        // the records covered by the lost heartbeat would never be reported to anyone — the
-        // server would see a smaller count and have no way to know it was short.
-        server.failKind('heartbeat', true);
-        await fs_1.promises.writeFile(path.join(sessionsDir, 'sess.jsonl'), `${sessionLine()}\n`);
-        const handle = start();
-        await waitFor(() => server.ingests.some((i) => i.kind === 'sessions'));
-        server.failKind('heartbeat', false);
-        await fs_1.promises.appendFile(path.join(sessionsDir, 'sess.jsonl'), `${sessionLine()}\n`);
-        await handle.flush();
-        const beats = server.ingests.filter((i) => i.kind === 'heartbeat').map((i) => JSON.parse(i.body));
-        assert.ok(beats.length >= 1, 'a heartbeat eventually landed');
-        // The first heartbeat to survive covers BOTH intervals: 1 record from the tick whose
-        // heartbeat was lost, plus 2 from the restaged file.
-        assert.ok(beats[0].records_staged >= 3, `staged=${beats[0].records_staged}`);
-    });
-    /**
-     * SIGTERM is how every serve container ends. Without a final drain, each redeploy silently
-     * dropped whatever was written since the last tick — and on an ephemeral state dir the cursor
-     * went with it, so the window was unrecoverable rather than merely late.
-     */
-    test('flush() ships the tail written after the last tick', async function () {
-        this.timeout(15000);
-        const handle = start();
-        await waitFor(() => server.ingests.length > 0);
-        const afterBoot = server.ingests.length;
-        await fs_1.promises.writeFile(path.join(sessionsDir, 'late.jsonl'), `${sessionLine({ request_id: 'r-late' })}\n`);
-        await handle.flush();
-        assert.ok(server.ingests.length > afterBoot, 'flush() shipped after the loop stopped');
-        assert.ok(server.ingests.some((i) => i.kind === 'sessions' && i.body.includes('r-late')), 'the tail turn reached the server');
-    });
-    /** Fix 2d: the abandoned-drain path must say how much it abandoned. */
-    test('an abandoned final drain reports what was lost', async function () {
-        this.timeout(15000);
-        const warnings = [];
-        // Point at a dead port so the boot tick stays in flight through the whole drain window.
-        const handle = (0, sessionShip_1.startSessionShipper)({
-            evidenceUrl: 'http://127.0.0.1:1',
-            shipToken: 'test-token',
-            instanceId: 'test-instance',
-            sessionsDir,
-            stateDir,
-            intervalSec: 3600,
-            sinceDays: 30,
-            drainTimeoutSec: 1,
-            logger: { info: () => undefined, warn: (m) => warnings.push(m) },
-        });
-        await fs_1.promises.writeFile(path.join(sessionsDir, 'sess.jsonl'), `${sessionLine()}\n`);
-        await handle.flush();
-        handle.stop();
-        const abandoned = warnings.find((w) => w.includes('FINAL DRAIN ABANDONED'));
-        if (abandoned) {
-            assert.ok(/record\(s\)/.test(abandoned), `no record count in: ${abandoned}`);
-            assert.ok(abandoned.includes('AGENTHIPPO_EVIDENCE_SHIP_DRAIN_TIMEOUT_SEC'), 'names the knob to raise');
-        }
-        else {
-            // The tick finished inside the window; the run must then report leftovers explicitly.
-            assert.ok(warnings.some((w) => w.includes('unshipped') || w.includes('drain failed')), `neither abandonment nor failure was reported: ${JSON.stringify(warnings)}`);
-        }
-    });
-    test('status() exposes the counters /health needs', async function () {
-        this.timeout(15000);
-        await fs_1.promises.writeFile(path.join(sessionsDir, 'sess.jsonl'), `${sessionLine()}\n`);
-        const handle = start();
-        await waitFor(() => handle.status().recordsShipped > 0);
-        handle.stop();
-        const status = handle.status();
-        assert.strictEqual(status.enabled, true);
-        assert.strictEqual(status.recordsStaged, 1);
-        assert.strictEqual(status.recordsShipped, 1);
-        assert.strictEqual(status.consecutiveFailures, 0);
-        assert.strictEqual(status.contentCapture, false, 'content capture is off by default');
-        assert.ok((status.lastOkAt ?? 0) > 0);
-    });
-    test('a failing server is counted, not smoothed over', async function () {
-        this.timeout(20000);
-        await fs_1.promises.writeFile(path.join(sessionsDir, 'sess.jsonl'), `${sessionLine()}\n`);
-        server.fail(true);
-        const handle = start();
-        await waitFor(() => handle.status().consecutiveFailures > 0, 15000);
-        handle.stop();
-        assert.ok(handle.status().consecutiveFailures > 0);
-        assert.strictEqual(handle.status().recordsShipped, 0, 'nothing may be marked shipped');
-        assert.strictEqual(handle.status().lastOkAt, undefined);
-    });
-    test('compose-internal http creates a shipper when allowInsecure is set', async function () {
-        this.timeout(15000);
-        await fs_1.promises.writeFile(path.join(sessionsDir, 'sess.jsonl'), `${sessionLine()}\n`);
-        const warnings = [];
-        const handle = (0, sessionShip_1.startSessionShipper)({
-            evidenceUrl: 'http://evidence:8787',
-            allowInsecure: true,
-            shipToken: 'test-token',
-            instanceId: 'test-instance',
-            sessionsDir,
-            stateDir,
-            intervalSec: 3600,
-            sinceDays: 30,
-            logger: { info: () => undefined, warn: (m) => warnings.push(m) },
-        });
-        await handle.flush();
-        handle.stop();
-        assert.ok(!warnings.some((w) => w.includes('must use https')), `shipper init rejected compose-internal http: ${JSON.stringify(warnings)}`);
-        assert.ok(handle.status().consecutiveFailures > 0, 'drain fails without a server, but shipper was created');
-    });
-    test('R-13 heartbeat is still attempted when shipper init fails', async function () {
-        this.timeout(15000);
-        await fs_1.promises.writeFile(path.join(sessionsDir, 'sess.jsonl'), `${sessionLine()}\n`);
-        const warnings = [];
-        const handle = (0, sessionShip_1.startSessionShipper)({
-            evidenceUrl: 'http://evidence:8787',
-            shipToken: 'test-token',
-            instanceId: 'test-instance',
-            sessionsDir,
-            stateDir,
-            intervalSec: 3600,
-            sinceDays: 30,
-            logger: { info: () => undefined, warn: (m) => warnings.push(m) },
-        });
-        await handle.flush();
-        handle.stop();
-        assert.ok(warnings.some((w) => w.includes('must use https') || w.includes('plaintext http')), `expected shipper URL rejection: ${JSON.stringify(warnings)}`);
-        assert.ok(warnings.some((w) => w.includes('heartbeat failed')), `heartbeat must still be attempted in finally: ${JSON.stringify(warnings)}`);
-    });
-});