@agenthippo-ai/agenthippo 1.110.9 → 1.110.11

package/out/test/data-plane.test.js

@@ -47,6 +47,8 @@ const path = __importStar(require("path"));
 const index_js_1 = require("@modelcontextprotocol/sdk/client/index.js");
 const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/client/streamableHttp.js");
 const data_plane_1 = require("../cli/data-plane");
+const data_plane_2 = require("../cli/commands/data-plane");
+const identity_1 = require("../analytics/identity");
 // The fixture connector must live INSIDE the extension tree so its `import` of
 // @modelcontextprotocol/sdk resolves by walking up to extensions/agentide/node_modules.
 const FIXTURE_DIR = path.join(__dirname, 'data-plane-fixture');
@@ -297,6 +299,14 @@ suite('data-plane: sidecar EDGE registration (P1 fix — no forging authority in
         await turn.release();
         await assert.rejects(() => callWhoami(sidecar.gatewayUrl, nonce), /401|Unauthorized/i);
     });
+    /**
+     * PR-F1 / agent-identity.md §8.5 G1.
+     *
+     * The edge forwarded `X-Agent-User` and nothing else, and `/edge/turn` registered with no
+     * inboundToken — so edge mode silently supported the `identity` provider ALONE. A
+     * `passthrough` deployment (Databricks-style OBO) booted clean and then failed closed on
+     * every single tool call, and an RFC 8693 `exchange` provider had no subject_token at all.
+     */
     test('release with a bogus nonce is a harmless no-op (204) and touches no other turn', async () => {
         const res = await edgeRegister('carol@corp.com');
         const nonce = res.headers.get(data_plane_1.TURN_NONCE_HEADER);
@@ -309,3 +319,306 @@ suite('data-plane: sidecar EDGE registration (P1 fix — no forging authority in
         assert.strictEqual(who.userId, 'carol@corp.com', 'an unrelated release must not end a live turn');
     });
 });
+/**
+ * PLAN/agent-identity.md §8.5 G1 (build record §10.5).
+ *
+ * The edge forwarded `X-Agent-User` (an identifier) and nothing else, and `/edge/turn` registered
+ * with no inboundToken. So edge mode silently supported the `identity` provider ALONE: a
+ * `passthrough` deployment (Databricks-style OBO) booted clean and then failed closed on every
+ * single tool call, and an RFC 8693 `exchange` provider had no `subject_token` to exchange at all.
+ *
+ * This suite runs a PASSTHROUGH sidecar behind the edge — the combination that could not work.
+ */
+suite('data-plane: sidecar EDGE + passthrough (PR-F1 — the edge must forward the assertion)', function () {
+    this.timeout(30_000);
+    const EDGE_TOKEN = 'edge-assertion-token';
+    let sidecar;
+    let controlBase;
+    suiteSetup(async () => {
+        fs.mkdirSync(FIXTURE_DIR, { recursive: true });
+        fs.writeFileSync(CONNECTOR_PATH, CONNECTOR_SOURCE, 'utf8');
+        sidecar = await (0, data_plane_1.startDataPlaneSidecar)({
+            config: { connectorPath: CONNECTOR_PATH, provider: 'passthrough' },
+            registerToken: EDGE_TOKEN,
+            gatewayPort: 0,
+            controlPort: 0,
+            bindHost: '127.0.0.1',
+        });
+        controlBase = `http://127.0.0.1:${sidecar.controlPort}`;
+    });
+    suiteTeardown(async () => {
+        await sidecar?.close();
+        fs.rmSync(FIXTURE_DIR, { recursive: true, force: true });
+    });
+    const register = (user, assertion) => fetch(`${controlBase}/edge/turn`, {
+        headers: {
+            Authorization: `Bearer ${EDGE_TOKEN}`,
+            'X-Agent-User': user,
+            ...(assertion ? { [data_plane_1.ASSERTION_HEADER]: assertion } : {}),
+        },
+    });
+    test('with the assertion forwarded, a passthrough turn reaches the backend as that user', async () => {
+        const res = await register('alice@corp.com', 'Bearer alice-platform-token');
+        assert.strictEqual(res.status, 200);
+        const who = await callWhoami(sidecar.gatewayUrl, res.headers.get(data_plane_1.TURN_NONCE_HEADER));
+        assert.strictEqual(who.userId, 'alice@corp.com');
+        assert.strictEqual(who.credential, 'alice-platform-token', 'the assertion becomes the turn inboundToken, and passthrough hands it to the connector');
+    });
+    test('a bare "Bearer " prefix is stripped — the connector gets the token, not the scheme', async () => {
+        const res = await register('bob@corp.com', 'Bearer   bob-token');
+        const who = await callWhoami(sidecar.gatewayUrl, res.headers.get(data_plane_1.TURN_NONCE_HEADER));
+        assert.strictEqual(who.credential, 'bob-token');
+    });
+    test('an assertion sent WITHOUT the scheme prefix is taken verbatim', async () => {
+        const res = await register('carol@corp.com', 'carol-raw-token');
+        const who = await callWhoami(sidecar.gatewayUrl, res.headers.get(data_plane_1.TURN_NONCE_HEADER));
+        assert.strictEqual(who.credential, 'carol-raw-token');
+    });
+    test('WITHOUT the assertion the turn still registers, but every call fails closed — the pre-PR-F1 behaviour', async () => {
+        const res = await register('dave@corp.com');
+        assert.strictEqual(res.status, 200, 'registration itself must not depend on the assertion');
+        const { client, transport } = mcpClient(sidecar.gatewayUrl, res.headers.get(data_plane_1.TURN_NONCE_HEADER));
+        await client.connect(transport);
+        const out = await client.callTool({ name: 'whoami', arguments: {} });
+        await client.close();
+        assert.strictEqual(out.isError, true);
+        assert.match(out.content[0].text, /fail-closed/, 'no inbound credential must never fall back to a shared one');
+    });
+});
+/**
+ * PLAN/agent-identity.md §10.1 — the audit writer.
+ *
+ * The sidecar accepted an optional `audit` and `dataPlaneSidecarCommand` never passed one. Because
+ * every emit site is `opts.audit?.(…)`, the entire data-plane trust-boundary record was silently
+ * discarded in sidecar and edge mode — the two shapes the blueprints deploy. The compliance claim
+ * ("which user touched which rows") had no writer exactly where it was being made.
+ *
+ * These tests pin both halves: the sink the command builds actually writes, and the sidecar
+ * actually emits through it on the authorize / deny / reject paths.
+ */
+suite('data-plane: sidecar audit sink (PR-0 — the record must have a writer)', function () {
+    this.timeout(30_000);
+    const TOKEN = 'audit-suite-token';
+    const AUDIT_ROOT = path.join(FIXTURE_DIR, 'audit-state');
+    let sidecar;
+    let controlBase;
+    let auditDir;
+    const rows = () => {
+        if (!fs.existsSync(auditDir)) {
+            return [];
+        }
+        return fs.readdirSync(auditDir)
+            .filter((f) => f.endsWith('.jsonl'))
+            .flatMap((f) => fs.readFileSync(path.join(auditDir, f), 'utf8')
+            .split('\n').filter(Boolean).map((l) => JSON.parse(l)));
+    };
+    // The writer is fire-and-forget (`void writer.append(...)`) so the audit write must never
+    // delay a tool call. Poll briefly rather than sleeping a fixed amount.
+    const waitForEvent = async (eventType, 
+    // Without a predicate this matches the FIRST row of the type, which may be one an earlier
+    // test wrote — and then the row under test may not have landed yet. Pass a predicate
+    // whenever a specific row is meant.
+    where = () => true, timeoutMs = 5_000) => {
+        const deadline = Date.now() + timeoutMs;
+        for (;;) {
+            const hit = rows().find((r) => r.event_type === eventType && where(r.payload));
+            if (hit) {
+                return hit;
+            }
+            if (Date.now() > deadline) {
+                assert.fail(`no matching "${eventType}" event within ${timeoutMs}ms; saw: ${JSON.stringify(rows().map((r) => r.event_type))}`);
+            }
+            await new Promise((r) => setTimeout(r, 50));
+        }
+    };
+    suiteSetup(async () => {
+        fs.mkdirSync(FIXTURE_DIR, { recursive: true });
+        fs.writeFileSync(CONNECTOR_PATH, CONNECTOR_SOURCE, 'utf8');
+        const sink = await (0, data_plane_2.createDataPlaneAuditSink)(AUDIT_ROOT);
+        assert.strictEqual(sink.ok, true, sink.error);
+        assert.strictEqual(sink.ephemeral, false, 'an explicit state dir is durable');
+        auditDir = sink.auditDir;
+        sidecar = await (0, data_plane_1.startDataPlaneSidecar)({
+            config: { connectorPath: CONNECTOR_PATH, provider: 'identity' },
+            registerToken: TOKEN,
+            gatewayPort: 0,
+            controlPort: 0,
+            bindHost: '127.0.0.1',
+            audit: sink.audit,
+        });
+        controlBase = `http://127.0.0.1:${sidecar.controlPort}`;
+    });
+    suiteTeardown(async () => {
+        await sidecar?.close();
+        fs.rmSync(FIXTURE_DIR, { recursive: true, force: true });
+    });
+    test('an authorized tool call is recorded with the tool and the verified principal', async () => {
+        const res = await fetch(`${controlBase}/edge/turn`, {
+            headers: { Authorization: `Bearer ${TOKEN}`, 'X-Agent-User': 'dana@corp.com' },
+        });
+        const nonce = res.headers.get(data_plane_1.TURN_NONCE_HEADER);
+        const who = await callWhoami(sidecar.gatewayUrl, nonce);
+        assert.strictEqual(who.userId, 'dana@corp.com');
+        const ev = await waitForEvent('tool_authorize');
+        const payload = ev.payload;
+        assert.strictEqual(payload.tool, 'whoami');
+        assert.strictEqual(payload.userId, (0, identity_1.hashIdentity)('dana@corp.com'));
+        assert.strictEqual(payload.provider, 'identity');
+    });
+    test('an edge registration is recorded', async () => {
+        const ev = await waitForEvent('sidecar_edge_register');
+        assert.strictEqual(ev.payload.userId, (0, identity_1.hashIdentity)('dana@corp.com'));
+    });
+    /**
+     * These records ship wholesale to the evidence server, so whatever lands here leaves the
+     * machine. The tool-event lane already pseudonymises (ObservableStreamEmitter → hashIdentity);
+     * the data-plane lane must not be the one that exports raw addresses. In EDGE mode the sidecar
+     * registers with `sessionKey: userId`, so without this the evidence FILE is `alice@corp.com.jsonl`.
+     */
+    test('no raw address reaches the record — not in a payload, not in a filename', () => {
+        const files = fs.readdirSync(auditDir);
+        assert.ok(files.length > 0, 'the suite must have produced evidence by now');
+        for (const f of files) {
+            assert.ok(!f.includes('@'), `evidence filename must not carry an address: ${f}`);
+        }
+        const serialized = JSON.stringify(rows());
+        const anon = (0, identity_1.hashIdentity)('dana@corp.com');
+        assert.ok(anon, 'hashIdentity must yield a pseudonym for a non-empty address');
+        assert.ok(!serialized.includes('dana@corp.com'), 'a raw address must never reach the record');
+        assert.ok(serialized.includes(anon), 'the salted hash is the join key and must be present');
+    });
+    test('a rejected registration is recorded — the reject path is the one an auditor asks about', async () => {
+        const res = await fetch(`${controlBase}/edge/turn`, {
+            headers: { Authorization: 'Bearer wrong-token', 'X-Agent-User': 'mallory@corp.com' },
+        });
+        assert.strictEqual(res.status, 401);
+        const ev = await waitForEvent('sidecar_register_reject');
+        assert.strictEqual(ev.payload.reason, 'bad_token');
+    });
+    test('an unknown nonce at the gateway is recorded, and never logs the raw nonce', async () => {
+        await assert.rejects(() => callWhoami(sidecar.gatewayUrl, 'forged-nonce-value'), /401|Unauthorized/i);
+        const ev = await waitForEvent('nonce_reject');
+        const payload = ev.payload;
+        assert.strictEqual(payload.reason, 'unknown_or_expired');
+        assert.ok(payload.nonce_sha256_prefix, 'a hash prefix must be present');
+        const serialized = JSON.stringify(rows());
+        assert.ok(!serialized.includes('forged-nonce-value'), 'a raw nonce must never reach the audit record');
+    });
+    test('the assertion is fingerprinted in the record, never carried raw', async () => {
+        const secret = 'super-secret-user-assertion-value';
+        await fetch(`${controlBase}/edge/turn`, {
+            headers: { Authorization: `Bearer ${TOKEN}`, 'X-Agent-User': 'erin@corp.com', [data_plane_1.ASSERTION_HEADER]: `Bearer ${secret}` },
+        });
+        const ev = await waitForEvent('sidecar_edge_register', (p) => p.userId === (0, identity_1.hashIdentity)('erin@corp.com'));
+        assert.match(String(ev.payload.assertion), /^sha256:[0-9a-f]{12}$/, 'a hash prefix must prove which assertion the turn used');
+        assert.ok(!JSON.stringify(rows()).includes(secret), 'a user assertion is a bearer credential and must never reach the record');
+    });
+    test('an unwritable audit root reports ok:false rather than throwing, so the caller sets the policy', async () => {
+        // A path whose parent is a FILE — mkdir -p cannot succeed.
+        const blocker = path.join(FIXTURE_DIR, 'not-a-dir');
+        fs.writeFileSync(blocker, 'x', 'utf8');
+        const sink = await (0, data_plane_2.createDataPlaneAuditSink)(path.join(blocker, 'nested'));
+        assert.strictEqual(sink.ok, false);
+        assert.ok(sink.error, 'the failure reason must be reportable to the operator');
+    });
+});
+/**
+ * PLAN/agent-identity.md §10.6 — the audit stamp and the agent field.
+ *
+ * Design §1's third failure was "the auditor's second question is unanswerable" — *why could the
+ * invoice agent reach the HR schema at all*. PR-0 gave the record a writer, which made "which user
+ * touched which rows" answerable. It did not make "via which agent" answerable: rows carried
+ * `{tool, userId, provider}` and nothing about the pack. The agent was only ever IMPLIED, by which
+ * deployment happened to write the file — and that implication is exactly what breaks when two
+ * serves share one connector (§4.4).
+ */
+suite('data-plane: every audit row names the AGENT, not just the user', function () {
+    this.timeout(30_000);
+    const TOKEN = 'agent-stamp-token';
+    const AUDIT_ROOT = path.join(FIXTURE_DIR, 'agent-stamp-state');
+    const LOADED = { pack: 'invoice-agent', version: '1.4.0' };
+    let sidecar;
+    let controlBase;
+    let auditDir;
+    const rows = () => (fs.existsSync(auditDir) ? fs.readdirSync(auditDir) : [])
+        .filter((f) => f.endsWith('.jsonl'))
+        .flatMap((f) => fs.readFileSync(path.join(auditDir, f), 'utf8')
+        .split('\n').filter(Boolean).map((l) => JSON.parse(l)));
+    const waitFor = async (pred) => {
+        const deadline = Date.now() + 5_000;
+        for (;;) {
+            const hit = rows().find(pred);
+            if (hit) {
+                return hit;
+            }
+            if (Date.now() > deadline) {
+                assert.fail(`no matching row; saw ${JSON.stringify(rows().map((r) => r.event_type))}`);
+            }
+            await new Promise((r) => setTimeout(r, 50));
+        }
+    };
+    suiteSetup(async () => {
+        fs.mkdirSync(FIXTURE_DIR, { recursive: true });
+        fs.writeFileSync(CONNECTOR_PATH, CONNECTOR_SOURCE, 'utf8');
+        const sink = await (0, data_plane_2.createDataPlaneAuditSink)(AUDIT_ROOT, LOADED);
+        auditDir = sink.auditDir;
+        sidecar = await (0, data_plane_1.startDataPlaneSidecar)({
+            config: { connectorPath: CONNECTOR_PATH, provider: 'identity' },
+            registerToken: TOKEN, gatewayPort: 0, controlPort: 0, bindHost: '127.0.0.1',
+            audit: sink.audit, agent: LOADED,
+        });
+        controlBase = `http://127.0.0.1:${sidecar.controlPort}`;
+    });
+    suiteTeardown(async () => {
+        await sidecar?.close();
+        fs.rmSync(FIXTURE_DIR, { recursive: true, force: true });
+    });
+    test('a tool call records WHICH AGENT served it — the auditor\'s second question', async () => {
+        const res = await fetch(`${controlBase}/edge/turn`, {
+            headers: { Authorization: `Bearer ${TOKEN}`, 'X-Agent-User': 'alice@corp.com' },
+        });
+        await callWhoami(sidecar.gatewayUrl, res.headers.get(data_plane_1.TURN_NONCE_HEADER));
+        const ev = await waitFor((r) => r.event_type === 'tool_authorize');
+        assert.deepStrictEqual(ev.payload.agent, { ...LOADED, digest: null }, 'without this the row says which USER touched the rows and nothing about the agent');
+    });
+    test('the sidecar claims no digest it has not verified', async () => {
+        const ev = await waitFor((r) => r.event_type === 'tool_authorize');
+        assert.strictEqual(ev.payload.agent.digest, null, 'pack-loader does not verify signatures in the sidecar; a digest here would dress an '
+            + 'unverified read as an attestation');
+    });
+    test('PR-8: a registration records the agent it CLAIMS, marked as asserted', async () => {
+        await fetch(`${controlBase}/turns`, {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ userId: 'bob@corp.com', sessionKey: 's-claim', agent: { pack: 'invoice-agent' } }),
+        });
+        const ev = await waitFor((r) => r.event_type === 'sidecar_register' && r.payload.claimedAgent === 'invoice-agent');
+        assert.strictEqual(ev.payload.binding, 'asserted', 'the register token is shared, so the claim is only as good as whoever holds it — '
+            + 'evidence must never present it as verified');
+        assert.strictEqual(ev.payload.agentMismatch, undefined);
+    });
+    test('PR-8 / §4.4: a DIFFERENT agent on the same connector is flagged, not silently accepted', async () => {
+        // The invariant E2 rests on: one connector, one agent. It is unenforceable over a shared
+        // bearer, so the deliverable is that it becomes VISIBLE the moment it is violated.
+        const res = await fetch(`${controlBase}/turns`, {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ userId: 'mallory@corp.com', sessionKey: 's-other', agent: { pack: 'hr-agent' } }),
+        });
+        assert.strictEqual(res.status, 200, 'it must still register — refusing on an unverifiable claim would let anyone with the '
+            + 'token deny service by lying about the pack');
+        const ev = await waitFor((r) => r.event_type === 'sidecar_register' && r.payload.claimedAgent === 'hr-agent');
+        assert.strictEqual(ev.payload.agentMismatch, true);
+        assert.strictEqual(ev.payload.loadedAgent, 'invoice-agent');
+    });
+    test('a registration with no agent claim still works — the field is optional', async () => {
+        const res = await fetch(`${controlBase}/turns`, {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify({ userId: 'carol@corp.com', sessionKey: 's-none' }),
+        });
+        assert.strictEqual(res.status, 200);
+        const ev = await waitFor((r) => r.event_type === 'sidecar_register' && r.payload.claimedAgent === 'none');
+        assert.strictEqual(ev.payload.agentMismatch, undefined, 'absent is not a mismatch');
+    });
+});

package/out/test/deploy-init.test.js

@@ -424,7 +424,7 @@ suite('deploy-init: renderTarget produces well-formed artifacts', () => {
         const rendered = svc
             .replace(/\$\{SERVICE\}/g, 'customer-service-edge')
             .replace(/\$\{IMAGE\}/g, 'us-docker.pkg.dev/x/y/z:latest')
-            .replace(/\$\{LITELLM_IMAGE\}/g, 'ghcr.io/agenthippo/litellm-gateway:2026.06')
+            .replace(/\$\{LITELLM_IMAGE\}/g, 'ghcr.io/agenthippoai/agenthippo-litellm:2026.06')
             .replace(/\$\{PUBLIC_HOSTNAME\}/g, 'cs.agenthippo.ai')
             .replace(/\$\{ALLOWED_DOMAINS\}/g, 'agenthippo.ai');
         assert.doesNotThrow(() => yaml.load(rendered), 'rendered service.yaml is valid YAML');
@@ -684,6 +684,12 @@ suite('deploy-init: renderTarget produces well-formed artifacts', () => {
         const snippet = (0, deploy_init_1.renderTarget)('vm', ctx)['agent-route.caddy'];
         // Hygiene: a client-supplied nonce header must never pass through.
         assert.ok(snippet.includes('request_header -X-Agent-Turn-Nonce'), 'inbound X-Agent-Turn-Nonce is stripped at the edge');
+        // PR-F1 (agent-identity.md §8.5 G1): the edge must forward the user ASSERTION, not just
+        // the identifier, or the turn carries no inboundToken — `passthrough` then fails closed on
+        // every call and an `exchange` provider has no subject_token. Forged copies are stripped
+        // for the same reason as the nonce: this one becomes the turn's inboundToken.
+        assert.ok(snippet.includes('request_header -X-Agent-User-Assertion'), 'inbound X-Agent-User-Assertion is stripped at the edge');
+        assert.ok(snippet.includes('copy_headers X-Agent-User X-Agent-User-Assertion'), 'the verified assertion is copied from /api/ide/me alongside the identity');
         // Only POST chat turns register.
         assert.ok(snippet.includes('@turnStart'), 'chat-turn matcher present');
         assert.ok(/@turnStart\s*\{\s*\n\s*method POST\s*\n\s*path \/v1\/chat \/v1\/chat\/stream/m.test(snippet), '@turnStart matches POST /v1/chat and /v1/chat/stream only');

package/out/test/governor-hardening.test.js

@@ -47,7 +47,12 @@ function fakeSandboxes(initial = [], supportsInFlightTermination = true) {
         destroyed: [],
         revoked: [],
         supportsInFlightTermination,
-        sandboxes() { return state.live.map((sessionKey) => ({ sessionKey, sandboxId: `sandbox-${sessionKey}` })); },
+        // Session scope: one sandbox per session, so its key IS the session key.
+        sandboxes() {
+            return state.live.map((sessionKey) => ({
+                sandboxKey: sessionKey, sandboxId: `sandbox-${sessionKey}`, sessionKeys: [sessionKey],
+            }));
+        },
         async destroySession(sessionKey) {
             state.destroyed.push(sessionKey);
             state.live = state.live.filter((s) => s !== sessionKey);

package/out/test/lease-validation.test.js

@@ -47,6 +47,7 @@ const assert = __importStar(require("assert"));
 const caps_1 = require("../pack/caps");
 const caps_2 = require("../pack/caps");
 const lease_schema_1 = require("../pack/lease-schema");
+const lease_1 = require("../pack/lease");
 const base = { pack: 'analyst', enabled: true, expiresAt: 1_800_003_600 };
 suite('lease validation — structural junk is refused, not trusted', () => {
     const rejected = [
@@ -63,6 +64,7 @@ suite('lease validation — structural junk is refused, not trusted', () => {
         ['an unknown deny scope', { ...base, deny: [{ scope: 'tenant', match: 'x', mode: 'kill' }] }],
         ['a deny rule with no match', { ...base, deny: [{ scope: 'pack', match: '', mode: 'kill' }] }],
         ['a non-boolean requireSignedPack', { ...base, requireSignedPack: 'yes' }],
+        ['a non-boolean allowServiceTurns', { ...base, allowServiceTurns: 'true' }],
         ['not an object at all', 'nope'],
     ];
     for (const [name, doc] of rejected) {
@@ -167,3 +169,56 @@ suite('deprecated cell vocabulary is aliased, loudly', () => {
         assert.strictEqual(caps.maxConcurrentSandboxes, 7);
     });
 });
+/**
+ * PLAN/agent-identity.md §10.3 — the lease flag that governs unattended runs.
+ *
+ * Its polarity is the INVERSE of every other flag on the lease. `requireSignedPack` is
+ * tighten-only, so absent safely means "nobody asked for the restriction". `allowServiceTurns`
+ * GRANTS a standing unattended identity, so absent has to mean deny — otherwise a control plane
+ * that has not been taught the field silently authorises unsupervised runs across a fleet.
+ */
+suite('lease: allowServiceTurns (PR-2 — a grant, so absent means deny)', () => {
+    test('parseLease carries a real boolean through', () => {
+        const res = (0, lease_schema_1.parseLease)({ ...base, allowServiceTurns: true });
+        assert.ok(res.ok);
+        assert.strictEqual(res.lease.allowServiceTurns, true);
+    });
+    test('the string "false" is refused, not coerced — it would flip deny into allow', () => {
+        // `Boolean("false") === true`. This is the single most dangerous coercion on the document,
+        // which is why the flag joined the existing strict-boolean loop rather than getting its own.
+        assert.strictEqual((0, lease_schema_1.parseLease)({ ...base, allowServiceTurns: 'false' }).ok, false);
+    });
+    test('an unknown field is ignored, so an OLDER serve simply never runs service turns', () => {
+        // Forward compatibility with no lockstep hazard: field-by-field parsing means a serve that
+        // predates the flag reads a lease containing it without erroring, and — because it never
+        // consults the flag — denies. Fail-safe in the skew direction that matters.
+        const res = (0, lease_schema_1.parseLease)({ ...base, someFutureField: { nested: true } });
+        assert.ok(res.ok);
+        assert.strictEqual(res.lease.someFutureField, undefined);
+    });
+    test('managed + lease says true ⇒ allowed', () => {
+        assert.deepStrictEqual((0, lease_1.resolveAllowServiceTurns)({ lease: true, managed: true }), { allowed: true, gate: 'lease_allows' });
+    });
+    test('managed + field absent ⇒ DENIED, and the reason distinguishes it from an explicit false', () => {
+        const absent = (0, lease_1.resolveAllowServiceTurns)({ lease: undefined, managed: true });
+        assert.strictEqual(absent.allowed, false);
+        assert.strictEqual(absent.gate, 'lease_absent_field');
+        const explicit = (0, lease_1.resolveAllowServiceTurns)({ lease: false, managed: true });
+        assert.strictEqual(explicit.allowed, false);
+        assert.strictEqual(explicit.gate, 'lease_denies');
+        // Same outcome, different explanation: an operator reading the audit row must be able to
+        // tell "nobody enabled it" from "somebody disabled it".
+        assert.notStrictEqual((0, lease_1.describeServiceTurnGate)(absent.gate), (0, lease_1.describeServiceTurnGate)(explicit.gate));
+    });
+    test('unmanaged (no control plane) ⇒ permitted, local env is the only gate', () => {
+        const r = (0, lease_1.resolveAllowServiceTurns)({ lease: undefined, managed: false });
+        assert.strictEqual(r.allowed, true);
+        assert.strictEqual(r.gate, 'unmanaged_no_lease');
+        assert.match((0, lease_1.describeServiceTurnGate)(r.gate), /AGENTHIPPO_SERVICE_USER/);
+    });
+    test('every gate has an operator-facing explanation naming what to change', () => {
+        for (const gate of ['lease_allows', 'unmanaged_no_lease', 'lease_absent_field', 'lease_denies']) {
+            assert.ok((0, lease_1.describeServiceTurnGate)(gate).length > 20, `${gate} needs a real explanation`);
+        }
+    });
+});

package/out/test/localFleetAdapter.test.js

@@ -0,0 +1,91 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const assert = __importStar(require("assert"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const fleetRowDefaults_1 = require("../analytics/dashboard/fleetRowDefaults");
+const localFleetAdapter_1 = require("../analytics/dashboard/localFleetAdapter");
+suite('localFleetAdapter', () => {
+    test('mergeSessionJsonlIntoFleetRows adds completed one-shot session to Done', () => {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'fleet-jsonl-merge-'));
+        const sessionId = '2e156640-96ed-4106-8e75-44018d221758';
+        const scheduleId = 'sched-then-why';
+        const started = Date.now() - 2 * 60 * 60_000;
+        const ended = started + 60_000;
+        fs.writeFileSync(path.join(dir, `${sessionId}.jsonl`), [
+            JSON.stringify({ session_id: sessionId, request_id: 'req-1', timestamp: started, event_type: 'turn_start', payload: {} }),
+            JSON.stringify({ session_id: sessionId, request_id: 'req-1', timestamp: ended, event_type: 'turn_end', payload: { success: true } }),
+        ].join('\n') + '\n', 'utf8');
+        fs.utimesSync(path.join(dir, `${sessionId}.jsonl`), ended / 1000, ended / 1000);
+        const sessionsById = new Map();
+        sessionsById.set(`schedule:${scheduleId}`, (0, fleetRowDefaults_1.buildFleetSessionRow)('local', {
+            sessionId: `schedule:${scheduleId}`,
+            status: 'scheduled',
+            startedAt: new Date(started - 60_000).toISOString(),
+            endedAt: '',
+            taskTitle: 'then why',
+            model: 'agentide-cursor::auto',
+            engine: 'cursor',
+            channelType: 'none',
+            channelTarget: sessionId,
+            turns: 0,
+            totalTokens: 0,
+            disconnectCapable: false,
+        }));
+        const scheduleByChatSessionId = new Map([
+            [sessionId, {
+                    id: scheduleId,
+                    sessionId,
+                    sessionResource: `vscode-chat-session://local/${sessionId}`,
+                    messageText: 'then why',
+                    runAt: started - 60_000,
+                    model: 'agentide-cursor::auto',
+                    engine: 'cursor',
+                }],
+        ]);
+        (0, localFleetAdapter_1.mergeSessionJsonlIntoFleetRows)(sessionsById, scheduleByChatSessionId, { scope: 'global' }, dir);
+        assert.strictEqual(sessionsById.has(`schedule:${scheduleId}`), false, 'schedule card should be replaced');
+        const row = sessionsById.get(sessionId);
+        assert.ok(row, 'expected chat session row');
+        assert.strictEqual(row.status, 'done');
+        assert.strictEqual(row.turns, 1);
+        assert.strictEqual(row.taskTitle, 'then why');
+    });
+});

package/out/test/sandbox-driver.test.js

@@ -62,7 +62,7 @@ const IMAGE = 'ghcr.io/agenthippoai/pack@sha256:' + 'a'.repeat(64);
 const TEST_SOCK_DIR = path.join(os.tmpdir(), 'ah-sandbox-tests');
 function spec(over = {}) {
     return {
-        sessionKey: 'sess-1',
+        sandboxKey: 'sess-1',
         image: IMAGE,
         tier: 2,
         routes: [
@@ -222,7 +222,7 @@ suite('container driver — the boundary it actually delivers', () => {
         const driver = new containerDriver_1.ContainerSandboxDriver({ exec, socketDir: TEST_SOCK_DIR, connectFn: () => stubChannel(), socketWaitMs: 0 });
         const h1 = await driver.create(spec());
         await driver.revoke(h1, 'all');
-        const h2 = await driver.create(spec({ sessionKey: 'sess-2' }));
+        const h2 = await driver.create(spec({ sandboxKey: 'sess-2' }));
         await driver.destroy(h2);
         assert.strictEqual(calls.filter((c) => c[0] === 'rm').length, 2);
     });

package/out/test/sandbox-hardening.test.js

@@ -56,7 +56,7 @@ function tmpdir() {
 }
 function spec(over = {}) {
     return {
-        sessionKey: 'sess-1',
+        sandboxKey: 'sess-1',
         image: IMAGE,
         tier: 2,
         routes: [{ kind: 'inference', target: 'litellm:4000' }],
@@ -297,6 +297,17 @@ suite('provider key passthrough into a sandbox', () => {
         });
         assert.deepStrictEqual(Object.keys(env).sort(), ['PATH']);
     });
+    test('boot-stable route URLs cross into a tier-0 sandbox (MCP + inference proxy)', () => {
+        const env = (0, processDriver_1.baseSandboxEnv)({}, {
+            PATH: '/usr/bin',
+            AGENTHIPPO_DATA_MCP_URL: 'http://connector:9090/mcp',
+            AGENTHIPPO_LITELLM_BASE_URL: 'http://gateway:3456/v1',
+            ANTHROPIC_API_KEY: 'sk-ant',
+        });
+        assert.strictEqual(env.AGENTHIPPO_DATA_MCP_URL, 'http://connector:9090/mcp');
+        assert.strictEqual(env.AGENTHIPPO_LITELLM_BASE_URL, 'http://gateway:3456/v1');
+        assert.strictEqual(env.ANTHROPIC_API_KEY, undefined);
+    });
     test('a sandbox holding a provider key is flagged in its own environment', async () => {
         const spawned = [];
         const driver = new processDriver_1.ProcessSandboxDriver({

package/out/test/sandbox-runner.test.js

@@ -65,7 +65,7 @@ function fakeDriver(engineFor) {
         kind: 'process', tier: 0,
         async create(spec) {
             const id = `sandbox-${++seq}`;
-            created.push(spec.sessionKey);
+            created.push(spec.sandboxKey);
             specs.push(spec);
             const toRunner = new node_stream_1.PassThrough();
             const toServe = new node_stream_1.PassThrough();