@agenthippo-ai/agenthippo 1.110.9 → 1.110.19

package/out/test/caps-governor.test.js

@@ -1,455 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Caps + kill switch — the enforcement half of the control plane.
- *
- *  These pin the properties an enterprise operator is actually buying:
- *   - a cap is enforced at the boundary, not requested of the agent;
- *   - a local flag may tighten the control plane's cap, never loosen it;
- *   - "kill" ends RUNNING work, not just new work;
- *   - a control-plane outage does not take the fleet down.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-require("mocha");
-const assert = __importStar(require("assert"));
-const caps_1 = require("../pack/caps");
-const governor_1 = require("../pack/governor");
-const lease_1 = require("../pack/lease");
-/** Records what the governor did to which session. */
-function fakeSandboxes(initial = []) {
-    const state = {
-        live: [...initial],
-        destroyed: [],
-        revoked: [],
-        failRevoke: false,
-        sandboxes() { return state.live.map((sessionKey) => ({ sessionKey, sandboxId: `sandbox-${sessionKey}` })); },
-        async destroySession(sessionKey) {
-            state.destroyed.push(sessionKey);
-            state.live = state.live.filter((s) => s !== sessionKey);
-        },
-        async revokeRoute(sessionKey, what) {
-            if (state.failRevoke) {
-                throw new Error('tier 0 cannot revoke one route');
-            }
-            state.revoked.push({ sessionKey, what });
-        },
-    };
-    return state;
-}
-const liveLease = (over = {}) => ({
-    pack: 'joker1',
-    enabled: true,
-    expiresAt: Math.floor(Date.now() / 1000) + 3600,
-    ...over,
-});
-suite('caps policy', () => {
-    test('local flags may only TIGHTEN the control plane, never loosen', () => {
-        const merged = (0, caps_1.mergeCaps)({ maxTurnsPerSession: 10, maxSessionSeconds: 600 }, { maxTurnsPerSession: 3, maxSessionSeconds: 9999 });
-        assert.strictEqual(merged.maxTurnsPerSession, 3, 'a lower local bound wins');
-        assert.strictEqual(merged.maxSessionSeconds, 600, 'a higher local bound must NOT raise the ceiling');
-    });
-    test('either side may escalate the breach action, neither may soften it', () => {
-        assert.strictEqual((0, caps_1.mergeCaps)({ onBreach: 'revoke-inference' }, { onBreach: 'destroy-sandbox' }).onBreach, 'destroy-sandbox');
-        assert.strictEqual((0, caps_1.mergeCaps)({ onBreach: 'destroy-sandbox' }, { onBreach: 'revoke-inference' }).onBreach, 'destroy-sandbox');
-    });
-    test('no caps anywhere is unbounded — self-hosted and dev keep working', () => {
-        assert.ok((0, caps_1.capsAreUnbounded)((0, caps_1.mergeCaps)(undefined, undefined)));
-        assert.ok(!(0, caps_1.capsAreUnbounded)((0, caps_1.mergeCaps)(undefined, { maxTurnsPerSession: 1 })));
-    });
-    test('env parsing ignores blanks and nonsense rather than guessing', () => {
-        const caps = (0, caps_1.capsFromEnv)({
-            AGENTHIPPO_MAX_TURNS_PER_SESSION: '5',
-            AGENTHIPPO_MAX_SESSION_SECONDS: '',
-            AGENTHIPPO_MAX_CONCURRENT_SANDBOXES: 'lots',
-            AGENTHIPPO_CAP_ON_BREACH: 'destroy-sandbox',
-        });
-        assert.strictEqual(caps.maxTurnsPerSession, 5);
-        assert.strictEqual(caps.maxSessionSeconds, undefined);
-        assert.strictEqual(caps.maxConcurrentSandboxes, undefined);
-        assert.strictEqual(caps.onBreach, 'destroy-sandbox');
-    });
-});
-suite('cap meter', () => {
-    test('the turn cap is checked BEFORE the turn that would exceed it', () => {
-        const meter = new caps_1.CapMeter({ maxTurnsPerSession: 2 });
-        assert.ok(meter.check('s1', 0).allowed);
-        meter.record('s1');
-        assert.ok(meter.check('s1', 0).allowed);
-        meter.record('s1');
-        const third = meter.check('s1', 0);
-        assert.ok(!third.allowed, 'the third turn must be refused, not merely reported after');
-        assert.strictEqual(third.cap, 'turns');
-    });
-    test('the duration cap runs from the first turn', () => {
-        const meter = new caps_1.CapMeter({ maxSessionSeconds: 60 });
-        const t0 = 1_000_000;
-        meter.record('s1', t0);
-        assert.ok(meter.check('s1', 0, t0 + 59_000).allowed);
-        const late = meter.check('s1', 0, t0 + 60_000);
-        assert.ok(!late.allowed);
-        assert.strictEqual(late.cap, 'duration');
-    });
-    test('concurrency bounds NEW sessions but never strands an established one', () => {
-        const meter = new caps_1.CapMeter({ maxConcurrentSandboxes: 2 });
-        meter.record('existing');
-        assert.ok(!meter.check('brand-new', 2).allowed, 'a new session is refused at the cap');
-        assert.ok(meter.check('existing', 2).allowed, 'a session that already has a sandbox keeps going');
-    });
-    test('forgetting a session resets its meter', () => {
-        const meter = new caps_1.CapMeter({ maxTurnsPerSession: 1 });
-        meter.record('s1');
-        assert.ok(!meter.check('s1', 0).allowed);
-        meter.forget('s1');
-        assert.ok(meter.check('s1', 0).allowed);
-    });
-});
-suite('governor enforcement', () => {
-    test('a breach takes the model route away — it does not ask the agent to stop', async () => {
-        const sandboxes = fakeSandboxes(['s1']);
-        const gov = (0, governor_1.createGovernor)({ caps: { maxTurnsPerSession: 1, onBreach: 'revoke-inference' }, sandboxes });
-        assert.ok((await gov.admitTurn('s1')).allowed);
-        gov.recordTurn('s1');
-        const second = await gov.admitTurn('s1');
-        assert.ok(!second.allowed);
-        assert.deepStrictEqual(sandboxes.revoked, [{ sessionKey: 's1', what: 'inference' }]);
-    });
-    test('destroy-sandbox ends the session outright', async () => {
-        const sandboxes = fakeSandboxes(['s1']);
-        const gov = (0, governor_1.createGovernor)({ caps: { maxTurnsPerSession: 1, onBreach: 'destroy-sandbox' }, sandboxes });
-        await gov.admitTurn('s1');
-        gov.recordTurn('s1');
-        await gov.admitTurn('s1');
-        assert.deepStrictEqual(sandboxes.destroyed, ['s1']);
-    });
-    test('a tier that cannot revoke one route falls back to destroying the sandbox', async () => {
-        // Tier 0 throws RevocationUnsupportedError; the cap must still hold.
-        const sandboxes = fakeSandboxes(['s1']);
-        sandboxes.failRevoke = true;
-        const gov = (0, governor_1.createGovernor)({ caps: { maxTurnsPerSession: 1, onBreach: 'revoke-inference' }, sandboxes });
-        await gov.admitTurn('s1');
-        gov.recordTurn('s1');
-        await gov.admitTurn('s1');
-        assert.deepStrictEqual(sandboxes.destroyed, ['s1'], 'the session must not survive a failed revoke');
-    });
-    test('hitting the instance concurrency cap does not punish the caller', async () => {
-        const sandboxes = fakeSandboxes(['a', 'b']);
-        const gov = (0, governor_1.createGovernor)({ caps: { maxConcurrentSandboxes: 2, onBreach: 'destroy-sandbox' }, sandboxes });
-        const decision = await gov.admitTurn('c');
-        assert.ok(!decision.allowed);
-        assert.strictEqual(decision.cap, 'concurrency');
-        assert.deepStrictEqual(sandboxes.destroyed, [], 'nobody else’s sandbox may be destroyed to make room');
-    });
-    test('unbounded caps add no gate at all', async () => {
-        const sandboxes = fakeSandboxes(['s1']);
-        const gov = (0, governor_1.createGovernor)({ caps: {}, sandboxes });
-        for (let i = 0; i < 50; i++) {
-            assert.ok((await gov.admitTurn('s1')).allowed);
-            gov.recordTurn('s1');
-        }
-        assert.deepStrictEqual(sandboxes.destroyed, []);
-    });
-});
-suite('scoped stop orders (deny rules)', () => {
-    // Hash stand-in: the real one is userNamespaceHash, but the property under test is only that
-    // serve compares a HASHED user id, so the control plane can name a person by email.
-    const hash = (u) => `H${u}`;
-    test('a session-scoped kill refuses new turns and names the operator reason', () => {
-        const lease = liveLease({ deny: [{ scope: 'session', match: 's1', mode: 'kill', reason: 'runaway' }] });
-        const v = (0, lease_1.denyVerdict)(lease, { sessionKey: 's1', pack: 'joker1' });
-        assert.strictEqual(v.denied, true);
-        assert.strictEqual(v.mode, 'kill');
-        assert.match(v.reason ?? '', /runaway/);
-        assert.strictEqual((0, lease_1.denyVerdict)(lease, { sessionKey: 's2', pack: 'joker1' }).denied, false, 'other sessions untouched');
-    });
-    test('the bare session_id matches a user-namespaced key — the id an operator actually has', () => {
-        const lease = liveLease({ deny: [{ scope: 'session', match: 'ticket-42', mode: 'drain' }] });
-        assert.strictEqual((0, lease_1.denyVerdict)(lease, { sessionKey: 'uABC--ticket-42', pack: 'p' }).denied, true);
-    });
-    test('a user-scoped rule matches every session of that user, by hash', () => {
-        const lease = liveLease({ deny: [{ scope: 'user', match: 'evil@x.com', mode: 'kill' }] });
-        const req = { pack: 'p', userHash: hash };
-        assert.strictEqual((0, lease_1.denyVerdict)(lease, { ...req, sessionKey: 'uHevil@x.com--a' }).denied, true);
-        assert.strictEqual((0, lease_1.denyVerdict)(lease, { ...req, sessionKey: 'uHevil@x.com--b' }).denied, true);
-        assert.strictEqual((0, lease_1.denyVerdict)(lease, { ...req, sessionKey: 'uHok@x.com--a' }).denied, false);
-    });
-    test('kill outranks drain when both match — an emergency is never softened', () => {
-        const lease = liveLease({ deny: [
-                { scope: 'pack', match: 'p', mode: 'drain' },
-                { scope: 'session', match: 's1', mode: 'kill' },
-            ] });
-        assert.strictEqual((0, lease_1.denyVerdict)(lease, { sessionKey: 's1', pack: 'p' }).mode, 'kill');
-    });
-    test('a spent rule is ignored, so a bounded stop lifts itself', () => {
-        const past = Math.floor(Date.now() / 1000) - 1;
-        const lease = liveLease({ deny: [{ scope: 'session', match: 's1', mode: 'kill', until: past }] });
-        assert.strictEqual((0, lease_1.denyVerdict)(lease, { sessionKey: 's1', pack: 'p' }).denied, false);
-    });
-    test('admission refuses a sandbox for a denied session', () => {
-        const lease = liveLease({ deny: [{ scope: 'session', match: 's1', mode: 'drain', reason: 'scale-in' }] });
-        assert.throws(() => (0, lease_1.assertAdmitted)(lease, { pack: 'joker1', version: '1.0.0', sessionKey: 's1' }), /scale-in/);
-        // And leaves everyone else alone.
-        (0, lease_1.assertAdmitted)(lease, { pack: 'joker1', version: '1.0.0', sessionKey: 's2' });
-    });
-    test('kill ends a running sandbox on the next poll; drain leaves it to finish', async () => {
-        const killSandboxes = fakeSandboxes(['s1']);
-        const killGov = (0, governor_1.createGovernor)({
-            caps: {}, sandboxes: killSandboxes, pack: 'joker1',
-            getLease: async () => liveLease({ deny: [{ scope: 'session', match: 's1', mode: 'kill' }] }),
-        });
-        await killGov.refresh();
-        assert.deepStrictEqual(killSandboxes.destroyed, ['s1'], 'kill destroys the live sandbox');
-        assert.strictEqual((await killGov.admitTurn('s1')).allowed, false, 'and refuses the next turn');
-        const drainSandboxes = fakeSandboxes(['s1']);
-        const drainGov = (0, governor_1.createGovernor)({
-            caps: {}, sandboxes: drainSandboxes, pack: 'joker1',
-            getLease: async () => liveLease({ deny: [{ scope: 'session', match: 's1', mode: 'drain' }] }),
-        });
-        await drainGov.refresh();
-        assert.deepStrictEqual(drainSandboxes.destroyed, [], 'drain lets the in-flight turn finish');
-        assert.strictEqual((await drainGov.admitTurn('s1')).allowed, false, 'but admits no new turn');
-    });
-});
-suite('a cap is a ceiling, not a cycle', () => {
-    /**
-     * `enforce` used to call `meter.forget` on breach, handing the session a brand-new budget the
-     * instant it exceeded the old one. `maxTurnsPerSession: 10` then meant "one refused turn in
-     * every eleven, forever" — the session ran unbounded while the console showed a cap in force.
-     */
-    test('a breached session stays breached instead of getting a fresh budget', async () => {
-        const sandboxes = fakeSandboxes(['s1']);
-        const gov = (0, governor_1.createGovernor)({
-            caps: { maxTurnsPerSession: 2, onBreach: 'destroy-sandbox' },
-            sandboxes,
-        });
-        assert.strictEqual((await gov.admitTurn('s1')).allowed, true);
-        gov.recordTurn('s1');
-        assert.strictEqual((await gov.admitTurn('s1')).allowed, true);
-        gov.recordTurn('s1');
-        const breach = await gov.admitTurn('s1');
-        assert.strictEqual(breach.allowed, false, 'the cap bites on the turn past it');
-        assert.deepStrictEqual(sandboxes.destroyed, ['s1'], 'the sandbox is destroyed on breach');
-        // The turn AFTER the breach is the one that used to be admitted again.
-        const next = await gov.admitTurn('s1');
-        assert.strictEqual(next.allowed, false, 'still refused — the meter outlived the sandbox');
-        assert.match(next.reason ?? '', /turn cap reached/);
-    });
-    test('the revoke→destroy fallback does not hand the budget back either', async () => {
-        const sandboxes = fakeSandboxes(['s1']);
-        sandboxes.failRevoke = true; // tier 0: cannot revoke one route, falls back to destroy
-        const gov = (0, governor_1.createGovernor)({ caps: { maxTurnsPerSession: 1 }, sandboxes });
-        assert.strictEqual((await gov.admitTurn('s1')).allowed, true);
-        gov.recordTurn('s1');
-        assert.strictEqual((await gov.admitTurn('s1')).allowed, false);
-        assert.deepStrictEqual(sandboxes.destroyed, ['s1'], 'fell back to destroy');
-        assert.strictEqual((await gov.admitTurn('s1')).allowed, false, 'and the cap still holds');
-    });
-});
-suite('user-scoped stop orders reach gateway sessions', () => {
-    /**
-     * A gateway sender with no explicit session id gets the key `gateway-<userId>`, which carries
-     * no `u<hash>--` prefix — so matching a `user` rule by key prefix alone silently covered none
-     * of a Telegram/Slack user's conversations while the console reported the rule applied.
-     */
-    const stopUser = (match) => liveLease({ deny: [{ scope: 'user', match, mode: 'kill', reason: 'abuse' }] });
-    test('the resolved user id matches, whatever shape the session key has', () => {
-        const lease = stopUser('telegram:12345');
-        const v = (0, lease_1.denyVerdict)(lease, {
-            sessionKey: 'gateway-telegram:12345',
-            pack: 'joker1',
-            userId: 'telegram:12345',
-        });
-        assert.ok(v.denied);
-        assert.strictEqual(v.mode, 'kill');
-    });
-    test('the namespaced-key prefix still matches when no user id is supplied', () => {
-        const hash = (u) => `h(${u})`;
-        const v = (0, lease_1.denyVerdict)(stopUser('alice@corp.com'), {
-            sessionKey: `uh(alice@corp.com)--ticket-42`,
-            pack: 'joker1',
-            userHash: hash,
-        });
-        assert.ok(v.denied, 'the sandbox-sweep path, which holds only a session key, still works');
-    });
-    test('a different user is untouched', () => {
-        const v = (0, lease_1.denyVerdict)(stopUser('telegram:12345'), {
-            sessionKey: 'gateway-telegram:99999',
-            pack: 'joker1',
-            userId: 'telegram:99999',
-        });
-        assert.ok(!v.denied);
-    });
-    test('the governor remembers the user, so the watcher kills the running sandbox too', async () => {
-        const sandboxes = fakeSandboxes(['gateway-telegram:12345']);
-        let lease = liveLease();
-        const gov = (0, governor_1.createGovernor)({ caps: {}, sandboxes, getLease: async () => lease });
-        // A turn teaches the governor which user this session belongs to.
-        await gov.admitTurn('gateway-telegram:12345', 'telegram:12345');
-        lease = stopUser('telegram:12345');
-        await gov.refresh();
-        assert.deepStrictEqual(sandboxes.destroyed, ['gateway-telegram:12345'], 'the live sandbox is destroyed, not merely refused its next turn');
-    });
-});
-suite('pack admission on the no-sandbox path', () => {
-    /**
-     * The enterprise stack runs serve WITHOUT --sandbox, and signature/pin enforcement lived only
-     * in the sandbox `admit` hook. So an operator could set requireSignedPack (or pin a version) in
-     * the console, watch the API report success, and have every instance keep serving the unsigned
-     * or unpinned pack. A control that reports success and enforces nothing is the worst outcome
-     * available — worse than not shipping the control.
-     */
-    test('an unsigned pack is refused per turn when the lease requires signing', async () => {
-        const sandboxes = fakeSandboxes();
-        const lease = liveLease({ requireSignedPack: true });
-        const gov = (0, governor_1.createGovernor)({
-            caps: {}, sandboxes, getLease: async () => lease,
-            admitPack: (_s, l) => l?.requireSignedPack
-                ? { allowed: false, reason: 'refusing to run probe: probe is not signed' }
-                : { allowed: true },
-        });
-        await gov.refresh();
-        const decision = await gov.admitTurn('s1');
-        assert.strictEqual(decision.allowed, false, 'the turn is refused with no sandbox in play');
-        assert.match(decision.reason ?? '', /not signed/, 'the operator’s reason reaches the caller');
-    });
-    test('the pack gate sees the same lease the kill and deny checks used', async () => {
-        const sandboxes = fakeSandboxes();
-        let lease = liveLease();
-        const seen = [];
-        const gov = (0, governor_1.createGovernor)({
-            caps: {}, sandboxes, getLease: async () => lease,
-            admitPack: (_s, l) => { seen.push(l?.version); return { allowed: true }; },
-        });
-        await gov.refresh();
-        await gov.admitTurn('s1');
-        // A pin published between polls must not be read by one gate and missed by another.
-        lease = liveLease({ version: '2.0.0' });
-        await gov.refresh();
-        await gov.admitTurn('s1');
-        assert.deepStrictEqual(seen, [undefined, '2.0.0']);
-    });
-    test('without admitPack the governor is unchanged — sandbox mode keeps its drain semantics', async () => {
-        const sandboxes = fakeSandboxes();
-        const gov = (0, governor_1.createGovernor)({ caps: {}, sandboxes, getLease: async () => liveLease({ version: '1.0.0' }) });
-        await gov.refresh();
-        // A pinned version does NOT refuse turns here: with a sandbox, the pin gates a sandbox's
-        // birth and running ones drain on TTL.
-        assert.strictEqual((await gov.admitTurn('s1')).allowed, true);
-    });
-});
-suite('kill switch', () => {
-    test('caps pushed by the control plane take effect on the next poll, not the next restart', async () => {
-        // Caps were read from the lease exactly once, at construction, so tightening a cap in the
-        // console did nothing until every instance restarted — the fleet reported the new policy
-        // while enforcing the old one. Caught by the live control-plane acceptance test.
-        const sandboxes = fakeSandboxes();
-        let lease = liveLease({ caps: {} });
-        const gov = (0, governor_1.createGovernor)({ caps: {}, sandboxes, getLease: async () => lease });
-        assert.strictEqual((await gov.admitTurn('s1')).allowed, true, 'unbounded to begin with');
-        gov.recordTurn('s1');
-        lease = liveLease({ caps: { maxTurnsPerSession: 1 } });
-        await gov.refresh();
-        assert.strictEqual(gov.policy().maxTurnsPerSession, 1, 'the tightened cap is now in force');
-        const after = await gov.admitTurn('s1');
-        assert.strictEqual(after.allowed, false, 'the session already over the new cap is refused');
-        assert.match(after.reason ?? '', /turn cap reached/);
-    });
-    test('leaseIsDead recognises revoked and expired, and ignores unmanaged deployments', () => {
-        assert.ok(!(0, lease_1.leaseIsDead)(undefined).dead, 'no lease ⇒ unmanaged, nothing to kill');
-        assert.ok(!(0, lease_1.leaseIsDead)(liveLease()).dead);
-        assert.ok((0, lease_1.leaseIsDead)(liveLease({ enabled: false })).dead);
-        assert.ok((0, lease_1.leaseIsDead)(liveLease({ expiresAt: Math.floor(Date.now() / 1000) - 1 })).dead);
-    });
-    test('kill ends RUNNING sandboxes, not just new ones', async () => {
-        const sandboxes = fakeSandboxes(['s1', 's2', 's3']);
-        const gov = (0, governor_1.createGovernor)({ caps: {}, sandboxes });
-        const n = await gov.killAll('operator stop');
-        assert.strictEqual(n, 3);
-        assert.deepStrictEqual(sandboxes.destroyed.sort(), ['s1', 's2', 's3']);
-    });
-    test('once the lease is dead, no further turn is admitted', async () => {
-        const sandboxes = fakeSandboxes(['s1']);
-        let lease = liveLease();
-        const gov = (0, governor_1.createGovernor)({ caps: {}, sandboxes, getLease: async () => lease, pollSeconds: 5 });
-        assert.ok((await gov.admitTurn('s1')).allowed);
-        lease = liveLease({ enabled: false, reason: 'billing hold' });
-        gov.start();
-        await gov.refresh(); // an operator hitting stop must not wait for the next poll
-        gov.stop();
-        assert.deepStrictEqual(sandboxes.destroyed, ['s1'], 'the live sandbox is gone');
-        const after = await gov.admitTurn('s1');
-        assert.ok(!after.allowed);
-        assert.match(after.reason ?? '', /billing hold/, 'the operator’s reason reaches the caller');
-    });
-    test('a control-plane outage does not kill the fleet (fail open on transport)', async () => {
-        const sandboxes = fakeSandboxes(['s1']);
-        const gov = (0, governor_1.createGovernor)({
-            caps: {}, sandboxes,
-            getLease: async () => { throw new Error('control plane unreachable'); },
-            pollSeconds: 5,
-        });
-        gov.start();
-        await new Promise((r) => setTimeout(r, 30));
-        gov.stop();
-        assert.deepStrictEqual(sandboxes.destroyed, [], 'an unreachable control plane must not stop the customer');
-        assert.ok((await gov.admitTurn('s1')).allowed);
-    });
-    test('a restored lease lifts the kill without a restart', async () => {
-        const sandboxes = fakeSandboxes(['s1']);
-        let lease = liveLease({ enabled: false });
-        const gov = (0, governor_1.createGovernor)({ caps: {}, sandboxes, getLease: async () => lease, pollSeconds: 5 });
-        gov.start();
-        await new Promise((r) => setTimeout(r, 30));
-        assert.ok(!(await gov.admitTurn('s1')).allowed);
-        lease = liveLease();
-        await gov.refresh(); // what a control-plane webhook triggers — no waiting for the poll
-        gov.stop();
-        assert.ok((await gov.admitTurn('s1')).allowed, 'the fleet comes back without a restart');
-    });
-    test('every enforcement action is auditable', async () => {
-        const events = [];
-        const sandboxes = fakeSandboxes(['s1']);
-        const gov = (0, governor_1.createGovernor)({
-            caps: { maxTurnsPerSession: 1, onBreach: 'destroy-sandbox' },
-            sandboxes,
-            audit: (event) => events.push(event),
-        });
-        await gov.admitTurn('s1');
-        gov.recordTurn('s1');
-        await gov.admitTurn('s1');
-        await gov.killAll('drill');
-        assert.ok(events.includes('cap_breach'));
-        assert.ok(events.includes('kill_switch'));
-    });
-});

package/out/test/cli-agent-id.test.js

@@ -1,55 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-const assert = __importStar(require("node:assert/strict"));
-const node_test_1 = require("node:test");
-const cli_agent_id_js_1 = require("../gateway/cli-agent-id.js");
-(0, node_test_1.describe)('cli-agent-id', () => {
-    (0, node_test_1.test)('resolveCliGatewayAgentId uses agenthippo-cli for default pack', () => {
-        assert.strictEqual((0, cli_agent_id_js_1.resolveCliGatewayAgentId)('default'), cli_agent_id_js_1.CLI_GATEWAY_AGENT_PREFIX);
-        assert.strictEqual((0, cli_agent_id_js_1.resolveCliGatewayAgentId)('Default'), cli_agent_id_js_1.CLI_GATEWAY_AGENT_PREFIX);
-        assert.strictEqual((0, cli_agent_id_js_1.resolveCliGatewayAgentId)(''), cli_agent_id_js_1.CLI_GATEWAY_AGENT_PREFIX);
-    });
-    (0, node_test_1.test)('resolveCliGatewayAgentId suffixes named packs', () => {
-        assert.strictEqual((0, cli_agent_id_js_1.resolveCliGatewayAgentId)('data-analyst'), 'agenthippo-cli-data-analyst');
-        assert.strictEqual((0, cli_agent_id_js_1.resolveCliGatewayAgentId)('Data Analyst'), 'agenthippo-cli-data-analyst');
-    });
-    (0, node_test_1.test)('isCliGatewayAgentId recognizes CLI gateway ids', () => {
-        assert.strictEqual((0, cli_agent_id_js_1.isCliGatewayAgentId)('agenthippo-cli'), true);
-        assert.strictEqual((0, cli_agent_id_js_1.isCliGatewayAgentId)('agenthippo-cli-data-analyst'), true);
-        assert.strictEqual((0, cli_agent_id_js_1.isCliGatewayAgentId)('default'), false);
-        assert.strictEqual((0, cli_agent_id_js_1.isCliGatewayAgentId)('ide-agenthippo-vscode'), false);
-    });
-});

package/out/test/codex-new-file-survival.test.js

@@ -1,119 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  The invariant that broke live: a file the agent creates still exists after the turn.
- *
- *  codex reports shell commands only AFTER they run, so to render a new file against an empty
- *  original the engine did read → delete → applyEdit. Headless (`serve`/`ask`/`chat` and every
- *  sandbox) gets NoOpEditTracker, whose applyEdit is a no-op — so the delete was permanent and every
- *  new file codex created was silently destroyed. `printf > proof.txt` exited 0, the next
- *  `cat proof.txt` exited 1, and the file existed nowhere on disk.
- *
- *  Nothing asserted file survival, which is why it shipped. These tests do.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-require("mocha");
-const assert = __importStar(require("assert"));
-const fs = __importStar(require("fs/promises"));
-const os = __importStar(require("os"));
-const path = __importStar(require("path"));
-const codex_1 = require("../engines/codex");
-const interfaces_1 = require("../runtime/interfaces");
-/** Stands in for the IDE tracker: records the call AND writes the file back, as VSCodeEditTracker does. */
-class ApplyingEditTracker {
-    appliesEdits = true;
-    applied = [];
-    async applyEdit(_sessionId, filePath, content, isNewFile) {
-        this.applied.push({ filePath, content, isNewFile });
-        await fs.writeFile(filePath, content, 'utf-8');
-    }
-}
-/** Claims it applies edits, then throws — the file must still survive. */
-class ThrowingEditTracker {
-    appliesEdits = true;
-    async applyEdit() {
-        throw new Error('IDE workspace edit failed');
-    }
-}
-suite('codex new-file survival', () => {
-    let dir;
-    setup(async () => {
-        dir = await fs.mkdtemp(path.join(os.tmpdir(), 'codex-newfile-'));
-    });
-    teardown(async () => {
-        await fs.rm(dir, { recursive: true, force: true });
-    });
-    const writeFixture = async (name, content) => {
-        const p = path.join(dir, name);
-        await fs.writeFile(p, content, 'utf-8');
-        return p;
-    };
-    test('a no-op tracker never destroys the file (the live data-loss bug)', async () => {
-        const file = await writeFixture('proof.txt', 'SANDBOXWRITE');
-        await (0, codex_1.registerNewFilesWithTracker)([file], new interfaces_1.NoOpEditTracker(), 'session-1');
-        assert.strictEqual(await fs.readFile(file, 'utf-8'), 'SANDBOXWRITE', 'headless runs must keep the agent\'s file byte-for-byte');
-    });
-    test('an applying tracker still gets its empty-original diff', async () => {
-        const file = await writeFixture('new.ts', 'export const x = 1;\n');
-        const tracker = new ApplyingEditTracker();
-        await (0, codex_1.registerNewFilesWithTracker)([file], tracker, 'session-1');
-        assert.strictEqual(tracker.applied.length, 1, 'the IDE path must still be told about the new file');
-        assert.strictEqual(tracker.applied[0].content, 'export const x = 1;\n');
-        assert.strictEqual(tracker.applied[0].isNewFile, true);
-        assert.strictEqual(await fs.readFile(file, 'utf-8'), 'export const x = 1;\n');
-    });
-    test('a tracker that throws mid-apply does not eat the file', async () => {
-        const file = await writeFixture('fragile.txt', 'IMPORTANT');
-        await (0, codex_1.registerNewFilesWithTracker)([file], new ThrowingEditTracker(), 'session-1');
-        assert.strictEqual(await fs.readFile(file, 'utf-8'), 'IMPORTANT', 'a failed workspace edit must not leave the file deleted');
-    });
-    test('binary files are skipped, not round-tripped through UTF-8', async () => {
-        const file = path.join(dir, 'logo.png');
-        const bytes = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0xff, 0xfe]);
-        await fs.writeFile(file, bytes);
-        const tracker = new ApplyingEditTracker();
-        await (0, codex_1.registerNewFilesWithTracker)([file], tracker, 'session-1');
-        assert.strictEqual(tracker.applied.length, 0, 'binary must not be handed to a text-based applyEdit');
-        assert.deepStrictEqual(await fs.readFile(file), bytes, 'and must be byte-identical afterwards');
-    });
-    test('every file in the batch survives, not just the first', async () => {
-        const a = await writeFixture('a.txt', 'AAA');
-        const b = await writeFixture('b.txt', 'BBB');
-        const missing = path.join(dir, 'never-created.txt');
-        await (0, codex_1.registerNewFilesWithTracker)([a, missing, b], new interfaces_1.NoOpEditTracker(), 'session-1');
-        assert.strictEqual(await fs.readFile(a, 'utf-8'), 'AAA');
-        assert.strictEqual(await fs.readFile(b, 'utf-8'), 'BBB');
-    });
-});