@agenthippo-ai/agenthippo 1.110.9 → 1.110.19

package/out/test/configuration-scopes.test.js

@@ -1,131 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *
- *  A VS Code setting with no `scope` defaults to `window`, which means a repository's
- *  `.vscode/settings.json` can set it. For a setting that names an auth endpoint, an install
- *  source, a credential or a spawned command, that is remote code execution or credential theft
- *  by checkout. This test is the regression guard: adding a sensitive setting without a scope
- *  fails here.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-require("mocha");
-const assert = __importStar(require("assert"));
-const fs = __importStar(require("node:fs"));
-const path = __importStar(require("node:path"));
-function loadPackageJson() {
-    // out/test/<file>.js → out → extensions/agentide
-    const pkgPath = path.join(__dirname, '..', '..', 'package.json');
-    return JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
-}
-/**
- * Settings a workspace must never be able to set. Each entry says WHY, because the reason is the
- * thing a future reviewer needs in order to decide whether a new setting belongs on this list.
- */
-const MUST_NOT_BE_WORKSPACE_SETTABLE = {
-    'agentide.auth.baseUrl': 'receives the PKCE code and the AgentHippo access token',
-    'agentide.storeRepo': 'names where packs/skills/engines are installed from',
-    'agentide.store.indexUrl': 'names where the install index is fetched from',
-    'agentide.anywhere.installSource': 'names a globally installed package whose postinstall runs',
-    'agentide.anywhere.enabled': 'enables a gateway process',
-    'agentide.anywhere.autoStart': 'starts a gateway process',
-    'agentide.anywhere.autoConnect': 'connects a gateway process',
-    'agentide.anywhere.port': 'selects the local gateway port',
-    'agentide.anywhere.hidden': 'an enterprise admin control',
-    'agentide.cli.path': 'an executable path',
-    'agentide.cli.installSource': 'a download-and-execute source',
-    'agentide.additionalEngineDir': 'a directory scanned for engines that are then executed',
-    'agentide.fallbackDirectory': 'a filesystem location used as the working root',
-    'agentide.permissions.fileAccess': 'the agent filesystem permission policy',
-    'agentide.gateway.url': 'a network destination carrying agent traffic',
-    'agentide.gateway.token': 'a credential',
-    'agentide.gateway.autoConnect': 'connects to a gateway at startup',
-    'agentide.gateway.autoRegister': 'registers packs with a gateway',
-    'agentide.providers.litellm.baseUrl': 'receives every prompt and the routing API key',
-    'agentide.providers.anthropic.baseUrl': 'receives every prompt and the Anthropic key',
-    'agentide.AgentHippoModelGateway.url': 'receives every prompt and the sign-in JWT',
-    'agentide.skills.remote.enabled': 'enables fetching agent instructions from a registry',
-    'agentide.skills.remote.registryUrl': 'names an install source for agent instructions',
-    'agentide.skills.remote.syncOnStartup': 'triggers that fetch automatically',
-    'agentide.skills.remote.allowOverwriteLocal': 'lets fetched content replace local files',
-    'agentide.analytics.fleetScriptSources': 'every entry is a command line this extension spawns',
-    'agentide.analytics.fleetSources': 'selects which of those command lines run',
-    'agentide.analytics.defaultDashboardPrompt': 'a prompt fed to an agent that writes and runs scripts',
-    'agentide.analytics.duckdb.tempDirectory': 'a filesystem path written to by the extension',
-};
-const SAFE_SCOPES = new Set(['application', 'machine']);
-suite('configuration scopes', () => {
-    const pkg = loadPackageJson();
-    const properties = pkg.contributes.configuration.properties;
-    test('every security-sensitive setting is declared and application/machine scoped', () => {
-        const failures = [];
-        for (const [key, why] of Object.entries(MUST_NOT_BE_WORKSPACE_SETTABLE)) {
-            const prop = properties[key];
-            if (!prop) {
-                failures.push(`${key}: not declared in contributes.configuration (undeclared settings are workspace-settable) — ${why}`);
-                continue;
-            }
-            const scope = prop.scope ?? 'window';
-            if (!SAFE_SCOPES.has(scope)) {
-                failures.push(`${key}: scope "${scope}" lets a repository set it — ${why}`);
-            }
-        }
-        assert.deepStrictEqual(failures, [], `\n${failures.join('\n')}\n`);
-    });
-    test('the attack from the audit is closed: agentide.auth.baseUrl is application-scoped', () => {
-        assert.strictEqual(properties['agentide.auth.baseUrl'].scope, 'application');
-    });
-    test('the pinned gateway install default is preserved', () => {
-        const prop = properties['agentide.anywhere.installSource'];
-        assert.strictEqual(prop.default, '@agenthippo-ai/hippoclaw@2026.7.28', 'the deliberate version pin (and its rationale) must not be replaced by a floating tag');
-    });
-    test('the extension declares limited untrusted-workspace support', () => {
-        const caps = pkg.capabilities?.untrustedWorkspaces;
-        assert.ok(caps, 'capabilities.untrustedWorkspaces is declared');
-        assert.strictEqual(caps.supported, 'limited');
-        assert.ok((caps.description ?? '').length > 40, 'the description explains what is limited');
-    });
-    test('every sensitive setting is also listed as a restricted configuration', () => {
-        const restricted = new Set(pkg.capabilities?.untrustedWorkspaces?.restrictedConfigurations ?? []);
-        const missing = Object.keys(MUST_NOT_BE_WORKSPACE_SETTABLE).filter((k) => !restricted.has(k));
-        assert.deepStrictEqual(missing, [], `not listed in restrictedConfigurations: ${missing.join(', ')}`);
-    });
-    test('restrictedConfigurations names only settings that exist', () => {
-        const unknown = (pkg.capabilities?.untrustedWorkspaces?.restrictedConfigurations ?? [])
-            .filter((k) => !properties[k]);
-        assert.deepStrictEqual(unknown, [], `restrictedConfigurations references undeclared settings: ${unknown.join(', ')}`);
-    });
-});

package/out/test/credential-context.test.js

@@ -1,160 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Credential Context Test Suite (serve-v3 §11.1, Design B)
- *
- *  The request-scoped credential primitive: presence, fail-closed access, and
- *  — most important — isolation between concurrent async turns.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-require("mocha");
-const assert = __importStar(require("assert"));
-const credential_context_1 = require("../cli/credential-context");
-const serve_hardening_1 = require("../cli/serve-hardening");
-suite('credential-context: presence + fail-closed', () => {
-    test('no credential outside a run scope', () => {
-        assert.strictEqual((0, credential_context_1.currentCredential)(), undefined);
-        assert.throws(() => (0, credential_context_1.requireUserId)(), /fail-closed/);
-    });
-    test('credential visible inside the scope', async () => {
-        await (0, credential_context_1.runWithCredential)({ userId: 'alice@acme.com', dataToken: 'tok' }, async () => {
-            assert.strictEqual((0, credential_context_1.requireUserId)(), 'alice@acme.com');
-            assert.strictEqual((0, credential_context_1.currentCredential)()?.dataToken, 'tok');
-        });
-    });
-    test('scope is cleared after the run returns', async () => {
-        await (0, credential_context_1.runWithCredential)({ userId: 'alice@acme.com' }, async () => undefined);
-        assert.strictEqual((0, credential_context_1.currentCredential)(), undefined);
-    });
-    test('returns the callback value (sync and async)', async () => {
-        const sync = await (0, credential_context_1.runWithCredential)({ userId: 'a' }, () => 42);
-        assert.strictEqual(sync, 42);
-        const asyncVal = await (0, credential_context_1.runWithCredential)({ userId: 'a' }, async () => {
-            await Promise.resolve();
-            return (0, credential_context_1.requireUserId)();
-        });
-        assert.strictEqual(asyncVal, 'a');
-    });
-    test('credential survives across awaits within the same turn', async () => {
-        await (0, credential_context_1.runWithCredential)({ userId: 'priya@meridian.com' }, async () => {
-            await new Promise((r) => setTimeout(r, 5));
-            assert.strictEqual((0, credential_context_1.requireUserId)(), 'priya@meridian.com');
-        });
-    });
-});
-suite('credential-context: unresolved identity (userId is optional, never a placeholder)', () => {
-    test('no userId, no data token: runs fine, requireUserId throws inside the scope', async () => {
-        const seen = await (0, credential_context_1.runWithCredential)({ userId: undefined }, async () => {
-            assert.throws(() => (0, credential_context_1.requireUserId)(), /fail-closed/);
-            return 'ran';
-        });
-        assert.strictEqual(seen, 'ran');
-    });
-    test('a data token without a verified userId fails closed before the turn runs', async () => {
-        let ran = false;
-        await assert.rejects(() => (0, credential_context_1.runWithCredential)({ userId: undefined, dataToken: 'obo-secret' }, async () => {
-            ran = true;
-        }), /OBO data token present without a verified user/);
-        assert.strictEqual(ran, false, 'fn must never run when the credential fails closed');
-    });
-    test('onDenied fires with the stable reason code exactly when the credential fails closed', async () => {
-        const denials = [];
-        await assert.rejects(() => (0, credential_context_1.runWithCredential)({ userId: undefined, dataToken: 'obo-secret' }, async () => 'ran', { onDenied: (reason) => { denials.push(reason); } }));
-        assert.deepStrictEqual(denials, [credential_context_1.WARRANT_DENIED_REASON]);
-    });
-    test('onDenied does not fire on any success path (verified user, or no token at all)', async () => {
-        const denials = [];
-        const onDenied = (reason) => { denials.push(reason); };
-        await (0, credential_context_1.runWithCredential)({ userId: 'priya@meridian.com', dataToken: 'tok' }, async () => 'ran', { onDenied });
-        await (0, credential_context_1.runWithCredential)({ userId: undefined }, async () => 'ran', { onDenied });
-        assert.deepStrictEqual(denials, []);
-    });
-    test('a throwing onDenied callback is swallowed — the fail-closed rejection still wins', async () => {
-        await assert.rejects(() => (0, credential_context_1.runWithCredential)({ userId: undefined, dataToken: 'obo-secret' }, async () => 'ran', { onDenied: () => { throw new Error('logging backend is down'); } }), /fail-closed/);
-    });
-    test('a hung onDenied callback cannot stall fail-closed forever', async () => {
-        const started = Date.now();
-        let resolved = false;
-        await assert.rejects(() => (0, credential_context_1.runWithCredential)({ userId: undefined, dataToken: 'obo-secret' }, async () => 'ran', {
-            onDeniedTimeoutMs: 50,
-            onDenied: () => new Promise(() => {
-                /* never settles */
-            }),
-        }), /fail-closed/);
-        resolved = true;
-        const elapsed = Date.now() - started;
-        assert.ok(resolved);
-        assert.ok(elapsed < 500, `fail-closed should win after onDenied timeout (elapsed=${elapsed}ms)`);
-    });
-    test('the credential never touches disk — it exists only in the async scope (secure-obo-design §2)', async () => {
-        await (0, credential_context_1.runWithCredential)({ userId: 'priya@meridian.com', dataToken: 'obo-secret' }, async () => {
-            const cred = (0, credential_context_1.currentCredential)();
-            assert.strictEqual(cred?.dataToken, 'obo-secret');
-            // The RequestCredential shape has no file-based transport anymore: the token
-            // reaches tools only via the loopback data-plane gateway + turn nonce.
-            assert.ok(!('dataTokenFile' in cred), 'no dataTokenFile surface may exist');
-        });
-        assert.strictEqual((0, credential_context_1.currentCredential)(), undefined);
-    });
-});
-suite('credential-context: concurrent isolation (the load-bearing property)', () => {
-    test('two interleaved turns never see each other\'s user', async () => {
-        // Interleave alice and bob with deliberate awaits; each must keep its own identity.
-        const run = (user, delay) => (0, credential_context_1.runWithCredential)({ userId: user }, async () => {
-            await new Promise((r) => setTimeout(r, delay));
-            const seen1 = (0, credential_context_1.requireUserId)();
-            await new Promise((r) => setTimeout(r, delay));
-            const seen2 = (0, credential_context_1.requireUserId)();
-            return [seen1, seen2];
-        });
-        const [alice, bob] = await Promise.all([
-            run('alice@acme.com', 8),
-            run('bob@acme.com', 3),
-        ]);
-        assert.deepStrictEqual(alice, ['alice@acme.com', 'alice@acme.com']);
-        assert.deepStrictEqual(bob, ['bob@acme.com', 'bob@acme.com']);
-    });
-});
-suite('credential-context: resolveDataToken (the OBO token seam)', () => {
-    test('Databricks X-Forwarded-Access-Token', () => {
-        assert.strictEqual((0, serve_hardening_1.resolveDataToken)({ 'x-forwarded-access-token': 'obo-123' }), 'obo-123');
-    });
-    test('generic X-Agent-Data-Token', () => {
-        assert.strictEqual((0, serve_hardening_1.resolveDataToken)({ 'x-agent-data-token': 'tok-9' }), 'tok-9');
-    });
-    test('undefined when absent', () => {
-        assert.strictEqual((0, serve_hardening_1.resolveDataToken)({}), undefined);
-    });
-});

package/out/test/custom-env-layering.test.js

@@ -1,151 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Custom-engine env layering tests.
- *
- *  Pins the deliberate precedence contract that replaced two accidents:
- *   1. buildRunnerChildEnv: PER-TURN values win over the host's ambient env (the old
- *      `{...turn.env, ...process.env}` order silently reverted per-turn state — including,
- *      latently, manifest-delivered credentials and any same-named ambient var).
- *   2. deliverModelRoutingEnv: manifest `model.*EnvVar` delivery is NON-CLOBBERING — a var the
- *      operator already set in the host env is never overwritten. This is what keeps a STALE
- *      cursor manifest (one that still declares apiKeyEnvVar: CURSOR_API_KEY) from stomping the
- *      operator's real crsr_ key now that per-turn values win (the version-pairing case).
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-require("mocha");
-const assert = __importStar(require("assert"));
-const custom_1 = require("../engines/custom");
-function fakeManifest(model) {
-    return {
-        id: 'fake-engine',
-        entryPath: '/tmp/fake/engine.mjs',
-        manifestDir: '/tmp/fake',
-        model: model ? { defaultModel: 'auto', ...model } : undefined,
-    };
-}
-function fakeTurn(env) {
-    return {
-        message: 'hi',
-        modelId: 'auto',
-        workspaceRoot: '/tmp/ws',
-        env,
-        session: { key: 'k', chatSessionId: 'c', isEphemeral: false },
-    };
-}
-/** Run fn with process.env temporarily patched; always restores. */
-function withProcessEnv(patch, fn) {
-    const saved = new Map();
-    for (const [k, v] of Object.entries(patch)) {
-        saved.set(k, process.env[k]);
-        if (v === undefined) {
-            delete process.env[k];
-        }
-        else {
-            process.env[k] = v;
-        }
-    }
-    try {
-        fn();
-    }
-    finally {
-        for (const [k, v] of saved) {
-            if (v === undefined) {
-                delete process.env[k];
-            }
-            else {
-                process.env[k] = v;
-            }
-        }
-    }
-}
-suite('buildRunnerChildEnv: per-turn values win over the host ambient env', () => {
-    test('a per-turn var beats the same-named ambient var (nonce/session-path class)', () => {
-        withProcessEnv({ TEST_LAYERING_VAR: 'ambient-stale' }, () => {
-            const child = (0, custom_1.buildRunnerChildEnv)(fakeManifest(), fakeTurn({ TEST_LAYERING_VAR: 'per-turn-fresh' }), false);
-            assert.strictEqual(child.TEST_LAYERING_VAR, 'per-turn-fresh');
-        });
-    });
-    test('ambient vars absent from turn.env still flow through (plain inheritance)', () => {
-        withProcessEnv({ TEST_AMBIENT_ONLY: 'inherited' }, () => {
-            const child = (0, custom_1.buildRunnerChildEnv)(fakeManifest(), fakeTurn({}), false);
-            assert.strictEqual(child.TEST_AMBIENT_ONLY, 'inherited');
-        });
-    });
-    test('AGENTHIPPO control vars come from the turn, never ambient', () => {
-        withProcessEnv({ AGENTHIPPO_MODEL_ID: 'ambient-wrong' }, () => {
-            const child = (0, custom_1.buildRunnerChildEnv)(fakeManifest(), fakeTurn({}), false);
-            assert.strictEqual(child.AGENTHIPPO_MODEL_ID, 'auto', 'explicit per-turn block must win');
-        });
-    });
-});
-suite('deliverModelRoutingEnv: non-clobbering manifest credential delivery', () => {
-    test('delivers the routing key when the declared var is NOT in the ambient env (openclaw case)', () => {
-        const env = {};
-        (0, custom_1.deliverModelRoutingEnv)(env, fakeManifest({ apiKeyEnvVar: 'LITELLM_API_KEY' }), { apiKey: 'sk-proxy-key' }, {});
-        assert.strictEqual(env.LITELLM_API_KEY, 'sk-proxy-key');
-    });
-    test('SKIPS delivery when the operator already set the var — ambient wins (stale-cursor-manifest case)', () => {
-        // Version-pairing regression: old manifest still declares apiKeyEnvVar: CURSOR_API_KEY,
-        // operator has the real crsr_ key ambient. With per-turn-wins layering, only this
-        // non-clobber rule keeps the real key from being stomped by a model key.
-        const env = { CURSOR_API_KEY: 'crsr_real_operator_key' };
-        (0, custom_1.deliverModelRoutingEnv)(env, fakeManifest({ apiKeyEnvVar: 'CURSOR_API_KEY' }), { apiKey: 'sk-model-routing-key' }, { CURSOR_API_KEY: 'crsr_real_operator_key' });
-        assert.strictEqual(env.CURSOR_API_KEY, 'crsr_real_operator_key', 'operator credential must never be overwritten');
-    });
-    test('stale-manifest end to end: child env keeps the operator key after the spread flip', () => {
-        withProcessEnv({ CURSOR_API_KEY: 'crsr_real_operator_key' }, () => {
-            // Simulate the turn-env build with an OLD manifest: ambient spread + (non-clobbered) delivery.
-            const turnEnv = { ...process.env };
-            (0, custom_1.deliverModelRoutingEnv)(turnEnv, fakeManifest({ apiKeyEnvVar: 'CURSOR_API_KEY' }), { apiKey: 'sk-model-key' }, process.env);
-            const child = (0, custom_1.buildRunnerChildEnv)(fakeManifest({ apiKeyEnvVar: 'CURSOR_API_KEY' }), fakeTurn(turnEnv), false);
-            assert.strictEqual(child.CURSOR_API_KEY, 'crsr_real_operator_key');
-        });
-    });
-    test('base URL vars follow the same rule (deliver when absent, keep ambient when present)', () => {
-        const env = {};
-        (0, custom_1.deliverModelRoutingEnv)(env, fakeManifest({ baseUrlEnvVar: 'ENGINE_BASE_URL' }), { baseUrl: 'http://proxy:4000' }, {});
-        assert.strictEqual(env.ENGINE_BASE_URL, 'http://proxy:4000');
-        const env2 = { ENGINE_BASE_URL: 'http://operator-choice' };
-        (0, custom_1.deliverModelRoutingEnv)(env2, fakeManifest({ baseUrlEnvVar: 'ENGINE_BASE_URL' }), { baseUrl: 'http://proxy:4000' }, { ENGINE_BASE_URL: 'http://operator-choice' });
-        assert.strictEqual(env2.ENGINE_BASE_URL, 'http://operator-choice');
-    });
-    test('no declaration → no delivery, whatever the routing key is (the fixed cursor manifest)', () => {
-        const env = { CURSOR_API_KEY: 'crsr_real_operator_key' };
-        (0, custom_1.deliverModelRoutingEnv)(env, fakeManifest(), { apiKey: 'sk-model-key' }, {});
-        assert.strictEqual(env.CURSOR_API_KEY, 'crsr_real_operator_key');
-        assert.strictEqual(Object.keys(env).length, 1, 'nothing else may be written');
-    });
-});

package/out/test/customEngineInstall.test.js

@@ -1,100 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-require("mocha");
-const assert = __importStar(require("assert"));
-const fs = __importStar(require("fs"));
-const os = __importStar(require("os"));
-const path = __importStar(require("path"));
-const install_1 = require("../engines/install");
-suite('Custom engine install', () => {
-    let tempDir;
-    let originalAgentHomeDir;
-    let originalAgentHippoHome;
-    setup(() => {
-        tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'agentide-engine-install-'));
-        originalAgentHomeDir = process.env.AGENT_HOME_DIR;
-        originalAgentHippoHome = process.env.AGENTHIPPO_HOME;
-        delete process.env.AGENT_HOME_DIR;
-        process.env.AGENTHIPPO_HOME = path.join(tempDir, 'home');
-    });
-    teardown(() => {
-        fs.rmSync(tempDir, { recursive: true, force: true });
-        restoreEnv('AGENT_HOME_DIR', originalAgentHomeDir);
-        restoreEnv('AGENTHIPPO_HOME', originalAgentHippoHome);
-    });
-    test('installs, lists, and uninstalls an engine from the home root', async () => {
-        const result = await (0, install_1.installCustomEngineFromFiles)([
-            {
-                path: 'engine.manifest.json',
-                content: JSON.stringify({
-                    version: 2,
-                    id: 'test-engine',
-                    displayName: 'Test Engine',
-                    entry: 'engine.mjs',
-                    promptInjection: { mode: 'env-only' },
-                }),
-            },
-            {
-                path: 'engine.mjs',
-                content: 'export default { async run() {} };\n',
-            },
-        ], {
-            runNpmCi: false,
-        });
-        assert.strictEqual(result.id, 'test-engine');
-        assert.strictEqual(result.installDir, path.join((0, install_1.getDefaultCustomEnginesInstallRoot)(), 'test-engine'));
-        const installed = await (0, install_1.listInstalledCustomEngines)();
-        assert.deepStrictEqual(installed.map(engine => engine.id), ['test-engine']);
-        const removed = await (0, install_1.uninstallCustomEngine)('test-engine');
-        assert.strictEqual(removed.removed, true);
-        assert.strictEqual(fs.existsSync(result.installDir), false);
-        assert.deepStrictEqual(await (0, install_1.listInstalledCustomEngines)(), []);
-    });
-    test('rejects unsafe uninstall ids', async () => {
-        await assert.rejects(() => (0, install_1.uninstallCustomEngine)('../outside'), /Custom engine id must contain only lowercase letters/);
-    });
-});
-function restoreEnv(name, value) {
-    if (value === undefined) {
-        delete process.env[name];
-    }
-    else {
-        process.env[name] = value;
-    }
-}

package/out/test/customRegistry.test.js

@@ -1,122 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-require("mocha");
-const assert = __importStar(require("assert"));
-const fs = __importStar(require("fs"));
-const os = __importStar(require("os"));
-const path = __importStar(require("path"));
-const customRegistry_1 = require("../engines/customRegistry");
-suite('Custom engine registry', () => {
-    let tempDir;
-    let originalAgentHippoCustomEnginesDir;
-    let originalAgentideCustomEnginesDir;
-    let originalAgentHomeDir;
-    let originalAgentHippoHome;
-    setup(() => {
-        tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'agentide-custom-registry-'));
-        originalAgentHippoCustomEnginesDir = process.env.AGENTHIPPO_CUSTOM_ENGINES_DIR;
-        originalAgentideCustomEnginesDir = process.env.AGENTIDE_CUSTOM_ENGINES_DIR;
-        originalAgentHomeDir = process.env.AGENT_HOME_DIR;
-        originalAgentHippoHome = process.env.AGENTHIPPO_HOME;
-        delete process.env.AGENTHIPPO_CUSTOM_ENGINES_DIR;
-        delete process.env.AGENTIDE_CUSTOM_ENGINES_DIR;
-        delete process.env.AGENT_HOME_DIR;
-        delete process.env.AGENTHIPPO_HOME;
-    });
-    teardown(() => {
-        fs.rmSync(tempDir, { recursive: true, force: true });
-        restoreEnv('AGENTHIPPO_CUSTOM_ENGINES_DIR', originalAgentHippoCustomEnginesDir);
-        restoreEnv('AGENTIDE_CUSTOM_ENGINES_DIR', originalAgentideCustomEnginesDir);
-        restoreEnv('AGENT_HOME_DIR', originalAgentHomeDir);
-        restoreEnv('AGENTHIPPO_HOME', originalAgentHippoHome);
-    });
-    test('parses configured search path strings and arrays', () => {
-        const first = path.join(tempDir, 'first');
-        const second = path.join(tempDir, 'second');
-        const third = path.join(tempDir, 'third');
-        assert.deepStrictEqual((0, customRegistry_1.parseCustomEngineSearchPath)([first, `${second}${path.delimiter}${third}`]), [first, second, third]);
-    });
-    test('adds configured directories before environment and home roots', () => {
-        const configured = path.join(tempDir, 'configured');
-        const envRoot = path.join(tempDir, 'env');
-        process.env.AGENTHIPPO_CUSTOM_ENGINES_DIR = envRoot;
-        const roots = (0, customRegistry_1.getCustomEngineSearchRoots)(undefined, configured);
-        assert.strictEqual(roots[0], path.resolve(configured));
-        assert.strictEqual(roots[1], path.resolve(envRoot));
-    });
-    test('includes custom engine installer home root', () => {
-        const agentHome = path.join(tempDir, 'agent-home');
-        process.env.AGENTHIPPO_HOME = agentHome;
-        const roots = (0, customRegistry_1.getCustomEngineSearchRoots)(undefined, undefined);
-        assert.strictEqual(roots[0], path.join(agentHome, 'engines'));
-    });
-    test('discovers manifests from configured directories', () => {
-        const configured = path.join(tempDir, 'engines');
-        writeCustomEngineManifest(configured, 'external-test-engine');
-        const manifests = (0, customRegistry_1.discoverCustomEngineManifests)(undefined, configured);
-        const manifest = manifests.find(item => item.id === 'external-test-engine');
-        assert.ok(manifest);
-        assert.strictEqual(manifest.displayName, 'External Test Engine');
-        assert.strictEqual(manifest.searchRoot, path.resolve(configured));
-    });
-});
-function restoreEnv(name, value) {
-    if (value === undefined) {
-        delete process.env[name];
-    }
-    else {
-        process.env[name] = value;
-    }
-}
-function writeCustomEngineManifest(root, id) {
-    const engineDir = path.join(root, id);
-    fs.mkdirSync(engineDir, { recursive: true });
-    fs.writeFileSync(path.join(engineDir, 'engine.manifest.json'), JSON.stringify({
-        version: 2,
-        id,
-        displayName: 'External Test Engine',
-        entry: 'engine.mjs',
-        promptInjection: {
-            mode: 'env-only',
-        },
-        model: {
-            defaultModel: 'test-model',
-        },
-    }, null, 2), 'utf8');
-}