@agenthippo-ai/agenthippo 1.110.9 → 1.110.11

package/out/test/serve-hardening.test.js

@@ -45,6 +45,7 @@ const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const stream_1 = require("stream");
 const serve_hardening_1 = require("../cli/serve-hardening");
+const serve_hardening_2 = require("../cli/serve-hardening");
 suite('serve-hardening: resolveStateDir', () => {
     test('explicit --state-dir wins and is absolute and non-ephemeral', () => {
         const r = (0, serve_hardening_1.resolveStateDir)('./state', {});
@@ -202,6 +203,45 @@ suite('serve-hardening: resolveUserId', () => {
         const pinned = { AGENTHIPPO_IDENTITY_HEADER: 'x-goog-authenticated-user-email' };
         assert.deepStrictEqual((0, serve_hardening_1.identityHeaderAdvice)(pinned, '0.0.0.0'), []);
     });
+    test('a pinned multi-user serve on tier 0 is told its filesystem is shared', () => {
+        const env = { AGENTHIPPO_IDENTITY_HEADER: 'x-agent-user' };
+        const tier0 = (0, serve_hardening_1.tenantIsolationAdvice)({ sandbox: 'process', workspace: '/work', stateDir: '/state' }, env);
+        assert.strictEqual(tier0.level, 'warn');
+        assert.ok(tier0.lines.some((l) => /--sandbox=process/.test(l)));
+        assert.ok(tier0.lines.some((l) => /--sandbox=container/.test(l)), 'the advice must name the fix');
+        // No sandbox at all is the same shared filesystem, and is the DEFAULT deployment shape.
+        const none = (0, serve_hardening_1.tenantIsolationAdvice)({ workspace: '/work', stateDir: '/state' }, env);
+        assert.strictEqual(none.level, 'warn');
+        assert.ok(none.lines.some((l) => /no sandbox/.test(l)));
+    });
+    test('nesting the workspace inside the state dir is called out on top of the shared-fs warning', () => {
+        const env = { AGENTHIPPO_IDENTITY_HEADER: 'x-agent-user' };
+        const nested = (0, serve_hardening_1.tenantIsolationAdvice)({ sandbox: 'process', workspace: '/state/workspace', stateDir: '/state' }, env);
+        const separate = (0, serve_hardening_1.tenantIsolationAdvice)({ sandbox: 'process', workspace: '/work', stateDir: '/state' }, env);
+        assert.ok(nested.lines.length > separate.lines.length, 'the shipped-sample shape must say strictly more');
+        assert.ok(nested.lines.some((l) => /sits INSIDE --state-dir/.test(l)));
+        // The reverse nesting is the same exposure reached without any traversal at all.
+        const inverted = (0, serve_hardening_1.tenantIsolationAdvice)({ sandbox: 'process', workspace: '/state', stateDir: '/state/serve' }, env);
+        assert.ok(inverted.lines.some((l) => /sits INSIDE --workspace/.test(l)));
+    });
+    test('tenant-isolation advice is quiet where it has nothing to say', () => {
+        // Unpinned: identityHeaderAdvice owns that case, and two warnings bury the actionable one.
+        assert.deepStrictEqual((0, serve_hardening_1.tenantIsolationAdvice)({ sandbox: 'process', workspace: '/state/workspace', stateDir: '/state' }, {}), { level: 'ok', lines: [] });
+        // A container sandbox gets a per-session workspace and state dir — the nesting is then an
+        // implementation detail of paths the sandbox never sees whole.
+        const env = { AGENTHIPPO_IDENTITY_HEADER: 'x-agent-user' };
+        assert.strictEqual((0, serve_hardening_1.tenantIsolationAdvice)({ sandbox: 'container', workspace: '/state/workspace', stateDir: '/state' }, env).level, 'ok');
+        // …unless the operator opted back into one workspace for everyone.
+        assert.strictEqual((0, serve_hardening_1.tenantIsolationAdvice)({ sandbox: 'container', sharedWorkspace: true, workspace: '/work', stateDir: '/state' }, env).level, 'warn');
+    });
+    test('the refusal is opt-in, so an upgrade cannot brick a deployment that already shipped', () => {
+        const base = { sandbox: 'process', workspace: '/state/workspace', stateDir: '/state' };
+        const pinned = { AGENTHIPPO_IDENTITY_HEADER: 'x-agent-user' };
+        assert.strictEqual((0, serve_hardening_1.tenantIsolationAdvice)(base, pinned).level, 'warn');
+        assert.strictEqual((0, serve_hardening_1.tenantIsolationAdvice)(base, { ...pinned, [serve_hardening_1.REQUIRE_TENANT_ISOLATION_ENV]: '1' }).level, 'refuse');
+        // A deployment that fixed the isolation is not refused just for asking for the check.
+        assert.strictEqual((0, serve_hardening_1.tenantIsolationAdvice)({ sandbox: 'container', workspace: '/work', stateDir: '/state' }, { ...pinned, [serve_hardening_1.REQUIRE_TENANT_ISOLATION_ENV]: '1' }).level, 'ok');
+    });
     test('Databricks X-Forwarded-Email', () => {
         assert.strictEqual((0, serve_hardening_1.resolveUserId)({ 'x-forwarded-email': 'priya@meridian.com' }, undefined), 'priya@meridian.com');
     });
@@ -227,6 +267,39 @@ suite('serve-hardening: resolveUserId', () => {
         assert.strictEqual((0, serve_hardening_1.resolveUserId)({}, undefined), undefined);
         assert.strictEqual((0, serve_hardening_1.resolveUserId)({}, { user_id: '   ' }, { AGENTHIPPO_ALLOW_BODY_IDENTITY: '1' }), undefined);
     });
+    /**
+     * IDENTITY_PROXY_SECRET_ENV: pinning declares WHICH header carries identity, not WHO may
+     * assert it. On a shared network any container that can dial serve's port can send the
+     * pinned header; when the secret is configured, identity requires the request to also carry
+     * the proxy's proof header — the same contract the auth-broker enforces for
+     * X-Auth-Request-Email.
+     */
+    suite('identity proxy secret (AGENTHIPPO_IDENTITY_PROXY_SECRET)', () => {
+        const env = {
+            AGENTHIPPO_IDENTITY_HEADER: 'x-agent-user',
+            AGENTHIPPO_IDENTITY_PROXY_SECRET: 'shhh',
+        };
+        test('a pinned header WITHOUT proof runs anonymous — the network-neighbour spoof', () => {
+            assert.strictEqual((0, serve_hardening_1.resolveUserId)({ 'x-agent-user': 'victim@corp.com' }, undefined, env), undefined);
+        });
+        test('a wrong secret is a missing secret', () => {
+            assert.strictEqual((0, serve_hardening_1.resolveUserId)({ 'x-agent-user': 'victim@corp.com', 'x-agenthippo-proxy-secret': 'nope' }, undefined, env), undefined);
+        });
+        test('the trusted proxy (correct proof) resolves identity as before', () => {
+            assert.strictEqual((0, serve_hardening_1.resolveUserId)({ 'x-agent-user': 'alice@corp.com', 'x-agenthippo-proxy-secret': 'shhh' }, undefined, env), 'alice@corp.com');
+        });
+        test('proof gates the alias list and the body fallback too, not just the pin', () => {
+            const unpinned = { AGENTHIPPO_IDENTITY_PROXY_SECRET: 'shhh', AGENTHIPPO_ALLOW_BODY_IDENTITY: '1' };
+            assert.strictEqual((0, serve_hardening_1.resolveUserId)({ 'x-forwarded-email': 'a@b.com' }, undefined, unpinned), undefined);
+            // A deployment that configured the secret has declared a real proxy; a caller without
+            // proof must not be able to name a victim via the client-controlled body either.
+            assert.strictEqual((0, serve_hardening_1.resolveUserId)({}, { user_id: 'bob' }, unpinned), undefined);
+        });
+        test('unset secret keeps existing behaviour — the gate is opt-in', () => {
+            const pinnedOnly = { AGENTHIPPO_IDENTITY_HEADER: 'x-agent-user' };
+            assert.strictEqual((0, serve_hardening_1.resolveUserId)({ 'x-agent-user': 'alice@corp.com' }, undefined, pinnedOnly), 'alice@corp.com');
+        });
+    });
     test('AGENTHIPPO_IDENTITY_HEADER pins trust to one header — spoofed aliases are ignored', () => {
         const env = { AGENTHIPPO_IDENTITY_HEADER: 'x-goog-authenticated-user-email' };
         // IAP strips X-Goog-* but forwards x-agent-user; pinning must ignore the spoof.
@@ -382,37 +455,137 @@ suite('serve-hardening: readBodyWithCap', () => {
 suite('serve-hardening: resolveServeSessionKey (secure-obo-design §3.4 Phase 0)', () => {
     const PINNED = { AGENTHIPPO_IDENTITY_HEADER: 'x-forwarded-email' };
     test('verified user + session_id → user-namespaced key', () => {
-        const r = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', 'alice@corp.com', PINNED);
+        const r = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', 'alice@corp.com', 'session', PINNED);
         assert.strictEqual(r.sessionKey, `u${(0, serve_hardening_1.userNamespaceHash)('alice@corp.com')}--chat-1`);
         assert.strictEqual(r.rejected, undefined);
     });
     test('two users presenting the SAME session_id can never share a key (the defect this closes)', () => {
-        const a = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', 'alice@corp.com', PINNED);
-        const b = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', 'bob@corp.com', PINNED);
+        const a = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', 'alice@corp.com', 'session', PINNED);
+        const b = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', 'bob@corp.com', 'session', PINNED);
         assert.notStrictEqual(a.sessionKey, b.sessionKey);
     });
     test('verified user without session_id → stable per-user default key', () => {
-        const r1 = (0, serve_hardening_1.resolveServeSessionKey)(undefined, 'alice@corp.com', PINNED);
-        const r2 = (0, serve_hardening_1.resolveServeSessionKey)('', 'alice@corp.com', PINNED);
+        const r1 = (0, serve_hardening_1.resolveServeSessionKey)(undefined, 'alice@corp.com', 'session', PINNED);
+        const r2 = (0, serve_hardening_1.resolveServeSessionKey)('', 'alice@corp.com', 'session', PINNED);
         assert.strictEqual(r1.sessionKey, r2.sessionKey);
         assert.strictEqual(r1.sessionKey, `u${(0, serve_hardening_1.userNamespaceHash)('alice@corp.com')}--default`);
     });
     test('pinned identity + session_id but NO verified user → fail closed', () => {
-        const r = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', undefined, PINNED);
+        const r = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', undefined, 'session', PINNED);
         assert.strictEqual(r.rejected, serve_hardening_1.SESSION_WITHOUT_USER_REASON);
     });
+    test('pinned identity + NO session_id + no verified user → fail closed (no shared anon bucket)', () => {
+        const r = (0, serve_hardening_1.resolveServeSessionKey)(undefined, undefined, 'session', PINNED);
+        assert.strictEqual(r.rejected, serve_hardening_1.SESSION_WITHOUT_USER_REASON);
+        assert.strictEqual(r.sessionKey, '');
+    });
     test('unpinned (local dev) keeps raw session_id behavior', () => {
-        const r = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', undefined, {});
+        const r = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', undefined, 'session', {});
         assert.strictEqual(r.sessionKey, 'chat-1');
         assert.strictEqual(r.rejected, undefined);
     });
     test('unpinned, no user, no session_id → legacy anon bucket', () => {
-        const r = (0, serve_hardening_1.resolveServeSessionKey)(undefined, undefined, {});
+        const r = (0, serve_hardening_1.resolveServeSessionKey)(undefined, undefined, 'session', {});
         assert.strictEqual(r.sessionKey, 'anon-unknown');
     });
     test('the key never embeds the raw user id (emails are not path segments)', () => {
-        const r = (0, serve_hardening_1.resolveServeSessionKey)('s', 'alice@corp.com', PINNED);
+        const r = (0, serve_hardening_1.resolveServeSessionKey)('s', 'alice@corp.com', 'session', PINNED);
         assert.ok(!r.sessionKey.includes('alice@corp.com'));
         assert.ok(!r.sessionKey.includes('@'));
     });
 });
+suite('serve-hardening: sandbox scope (what one sandbox holds)', () => {
+    const PINNED = { AGENTHIPPO_IDENTITY_HEADER: 'x-forwarded-email' };
+    test('session scope: the sandbox key IS the session key — today\'s behaviour, unchanged', () => {
+        const r = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', 'alice@corp.com', 'session', PINNED);
+        assert.strictEqual(r.sandboxKey, r.sessionKey);
+    });
+    test('user scope: one user\'s sessions share a sandbox key but keep distinct session keys', () => {
+        const a = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', 'alice@corp.com', 'user', PINNED);
+        const b = (0, serve_hardening_1.resolveServeSessionKey)('chat-2', 'alice@corp.com', 'user', PINNED);
+        assert.strictEqual(a.sandboxKey, b.sandboxKey, 'one container for this user');
+        assert.notStrictEqual(a.sessionKey, b.sessionKey, 'but two conversations inside it');
+        assert.strictEqual(a.sandboxKey, `u${(0, serve_hardening_1.userNamespaceHash)('alice@corp.com')}`);
+    });
+    test('user scope never merges two DIFFERENT users', () => {
+        const alice = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', 'alice@corp.com', 'user', PINNED);
+        const bob = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', 'bob@corp.com', 'user', PINNED);
+        assert.notStrictEqual(alice.sandboxKey, bob.sandboxKey);
+    });
+    test('user scope does NOT apply without a verified user', () => {
+        // Merging unidentified callers would group strangers on a fact nobody established.
+        const a = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', undefined, 'user', {});
+        const b = (0, serve_hardening_1.resolveServeSessionKey)('chat-2', undefined, 'user', {});
+        assert.strictEqual(a.sandboxKey, a.sessionKey);
+        assert.notStrictEqual(a.sandboxKey, b.sandboxKey);
+    });
+    test('a rejected turn yields no sandbox key to create anything with', () => {
+        const r = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', undefined, 'user', PINNED);
+        assert.strictEqual(r.rejected, serve_hardening_1.SESSION_WITHOUT_USER_REASON);
+        assert.strictEqual(r.sandboxKey, '');
+    });
+    test('the sandbox key never embeds the raw user id either', () => {
+        const r = (0, serve_hardening_1.resolveServeSessionKey)('s', 'alice@corp.com', 'user', PINNED);
+        assert.ok(!r.sandboxKey.includes('alice@corp.com'));
+        assert.ok(!r.sandboxKey.includes('@'));
+    });
+});
+/**
+ * PLAN/agent-identity.md §5.2 (build record §10.4).
+ *
+ * Shape, not vocabulary. An earlier draft required `^svc:[a-z0-9-]+$` and would have refused to
+ * boot on the two handles an enterprise operator is most likely to bind — a SPIFFE ID and an Entra
+ * agent object id — which are precisely the federated principals §8 wants this to grow into.
+ */
+suite('resolveServiceIdentity: the unattended-run identity (PR-3)', () => {
+    const env = (v) => (v === undefined ? {} : { [serve_hardening_2.SERVICE_USER_ENV]: v });
+    test('unset is not an error — it just means unattended runs are off', () => {
+        const r = (0, serve_hardening_2.resolveServiceIdentity)({});
+        assert.strictEqual(r.identity, undefined);
+        assert.strictEqual(r.error, undefined);
+        assert.strictEqual(r.warning, undefined);
+    });
+    test('the local svc: convention is accepted silently', () => {
+        const r = (0, serve_hardening_2.resolveServiceIdentity)(env('svc:invoice-agent'));
+        assert.strictEqual(r.identity, 'svc:invoice-agent');
+        assert.strictEqual(r.warning, undefined);
+    });
+    test('a SPIFFE ID is accepted — the earlier ^svc: rule would have refused to boot on it', () => {
+        const r = (0, serve_hardening_2.resolveServiceIdentity)(env('spiffe://corp/ns/agents/invoice'));
+        assert.strictEqual(r.identity, 'spiffe://corp/ns/agents/invoice');
+        assert.strictEqual(r.error, undefined);
+        assert.strictEqual(r.warning, undefined);
+    });
+    test('an Entra agent object id (bare GUID) is accepted', () => {
+        const guid = '3f2504e0-4f89-11d3-9a0c-0305e82c3301';
+        const r = (0, serve_hardening_2.resolveServiceIdentity)(env(guid));
+        assert.strictEqual(r.identity, guid);
+        assert.strictEqual(r.warning, undefined);
+    });
+    test('an unnamespaced value still works, but warns about collision with a real user id', () => {
+        const r = (0, serve_hardening_2.resolveServiceIdentity)(env('invoicebot'));
+        assert.strictEqual(r.identity, 'invoicebot');
+        assert.strictEqual(r.error, undefined);
+        assert.match(r.warning ?? '', /namespace marker/);
+    });
+    test('set-but-empty is a boot REFUSAL, not a silently anonymous fleet', () => {
+        for (const v of ['', '   ']) {
+            const r = (0, serve_hardening_2.resolveServiceIdentity)(env(v));
+            assert.ok(r.error, `${JSON.stringify(v)} must be refused`);
+            assert.strictEqual(r.identity, undefined);
+        }
+    });
+    test('whitespace inside the value is refused rather than silently split or trimmed', () => {
+        const r = (0, serve_hardening_2.resolveServiceIdentity)(env('svc:invoice agent'));
+        assert.ok(r.error);
+        assert.match(r.error, /whitespace/);
+    });
+    test('an absurdly long value is refused — that is a pasted file, not an identity', () => {
+        const r = (0, serve_hardening_2.resolveServiceIdentity)(env(`svc:${'a'.repeat(300)}`));
+        assert.ok(r.error);
+        assert.match(r.error, /maximum/);
+    });
+    test('surrounding whitespace is trimmed rather than refused', () => {
+        assert.strictEqual((0, serve_hardening_2.resolveServiceIdentity)(env('  svc:nightly  ')).identity, 'svc:nightly');
+    });
+});

package/out/test/sessionShip.test.js

@@ -272,6 +272,25 @@ suite('Evidence - sessionShip URL validation', () => {
         }
         assert.strictEqual((0, sessionShip_1.getEvidenceShipStatus)().disabledReason, 'invalid-url');
     });
+    test('compose-internal http resolves when allow-insecure is opted in', () => {
+        const cfg = (0, sessionShip_1.resolveSessionShipConfig)('i', '/s', '/st', {
+            AGENTHIPPO_EVIDENCE_URL: 'http://evidence:8787',
+            AGENTHIPPO_EVIDENCE_SHIP_TOKEN: 'tok',
+            AGENTHIPPO_EVIDENCE_ALLOW_INSECURE_URL: '1',
+        });
+        assert.ok(cfg);
+        assert.strictEqual(cfg.evidenceUrl, 'http://evidence:8787');
+        assert.strictEqual(cfg.allowInsecure, true);
+    });
+    test('EVIDENCE_ALLOW_INSECURE_URL alone also enables compose-internal http', () => {
+        const cfg = (0, sessionShip_1.resolveSessionShipConfig)('i', '/s', '/st', {
+            AGENTHIPPO_EVIDENCE_URL: 'http://evidence:8787',
+            AGENTHIPPO_EVIDENCE_SHIP_TOKEN: 'tok',
+            EVIDENCE_ALLOW_INSECURE_URL: '1',
+        });
+        assert.ok(cfg);
+        assert.strictEqual(cfg.allowInsecure, true);
+    });
 });
 // -----------------------------------------------------------------------------
 // Fix 1 / fix 3 — redaction applies to EVERY lane, not just `seat`
@@ -557,4 +576,43 @@ suite('Evidence - sessionShip runtime', () => {
         assert.strictEqual(handle.status().recordsShipped, 0, 'nothing may be marked shipped');
         assert.strictEqual(handle.status().lastOkAt, undefined);
     });
+    test('compose-internal http creates a shipper when allowInsecure is set', async function () {
+        this.timeout(15000);
+        await fs_1.promises.writeFile(path.join(sessionsDir, 'sess.jsonl'), `${sessionLine()}\n`);
+        const warnings = [];
+        const handle = (0, sessionShip_1.startSessionShipper)({
+            evidenceUrl: 'http://evidence:8787',
+            allowInsecure: true,
+            shipToken: 'test-token',
+            instanceId: 'test-instance',
+            sessionsDir,
+            stateDir,
+            intervalSec: 3600,
+            sinceDays: 30,
+            logger: { info: () => undefined, warn: (m) => warnings.push(m) },
+        });
+        await handle.flush();
+        handle.stop();
+        assert.ok(!warnings.some((w) => w.includes('must use https')), `shipper init rejected compose-internal http: ${JSON.stringify(warnings)}`);
+        assert.ok(handle.status().consecutiveFailures > 0, 'drain fails without a server, but shipper was created');
+    });
+    test('R-13 heartbeat is still attempted when shipper init fails', async function () {
+        this.timeout(15000);
+        await fs_1.promises.writeFile(path.join(sessionsDir, 'sess.jsonl'), `${sessionLine()}\n`);
+        const warnings = [];
+        const handle = (0, sessionShip_1.startSessionShipper)({
+            evidenceUrl: 'http://evidence:8787',
+            shipToken: 'test-token',
+            instanceId: 'test-instance',
+            sessionsDir,
+            stateDir,
+            intervalSec: 3600,
+            sinceDays: 30,
+            logger: { info: () => undefined, warn: (m) => warnings.push(m) },
+        });
+        await handle.flush();
+        handle.stop();
+        assert.ok(warnings.some((w) => w.includes('must use https') || w.includes('plaintext http')), `expected shipper URL rejection: ${JSON.stringify(warnings)}`);
+        assert.ok(warnings.some((w) => w.includes('heartbeat failed')), `heartbeat must still be attempted in finally: ${JSON.stringify(warnings)}`);
+    });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenthippo-ai/agenthippo",
-  "version": "1.110.9",
+  "version": "1.110.11",
   "description": "AgentHippo CLI — serve, chat, and deploy agent packs",
   "author": "AgentHippo <dev@agenthippo.ai>",
   "license": "SEE LICENSE IN LICENSE",