@agenthippo-ai/agenthippo 1.110.9 → 1.110.19

package/out/test/headless-sync.test.js

@@ -1,301 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-/**
- * Headless Sync Tests
- *
- * Tests for the syncPackToWorkspace function that syncs agent pack content
- * to workspace derived directories (.claude/, .codex/).
- */
-require("mocha");
-const assert = __importStar(require("assert"));
-const fs = __importStar(require("fs"));
-const fs_1 = require("fs");
-const path = __importStar(require("path"));
-const os = __importStar(require("os"));
-const sync_1 = require("../headless/sync");
-const shared_1 = require("../shared");
-const paths_1 = require("../agentpack/paths");
-const branding_1 = require("../branding");
-const utils_1 = require("../utils");
-// -------------------------------------------------------------------------
-// Test Helpers
-// -------------------------------------------------------------------------
-function makeTempDir(prefix) {
-    return fs.mkdtempSync(path.join(os.tmpdir(), prefix));
-}
-function createTestLogger() {
-    const messages = [];
-    return {
-        messages,
-        info: (msg) => messages.push(msg),
-        appendLine: (msg) => messages.push(msg),
-    };
-}
-async function cleanupDir(dir) {
-    try {
-        await fs_1.promises.rm(dir, { recursive: true, force: true });
-    }
-    catch {
-        // ignore
-    }
-}
-// -------------------------------------------------------------------------
-// Tests
-// -------------------------------------------------------------------------
-suite('Headless Sync - syncPackToWorkspace', () => {
-    let workspaceRoot;
-    let packPath;
-    let logger;
-    setup(async () => {
-        workspaceRoot = makeTempDir('headless-sync-workspace-');
-        packPath = makeTempDir('headless-sync-pack-');
-        logger = createTestLogger();
-    });
-    teardown(async () => {
-        await cleanupDir(workspaceRoot);
-        await cleanupDir(packPath);
-    });
-    test('creates derived directory for claude engine', async () => {
-        await fs_1.promises.writeFile(path.join(packPath, 'AGENTS.md'), '# Test Agent');
-        await (0, sync_1.syncPackToWorkspace)(workspaceRoot, packPath, 'test-pack', 'claude', logger);
-        const derivedDir = path.join(workspaceRoot, shared_1.AGENT_ENGINES.claude.workspaceDir);
-        assert.ok(fs.existsSync(derivedDir), 'Claude derived directory should exist');
-    });
-    test('creates derived directory for codex engine', async () => {
-        await fs_1.promises.writeFile(path.join(packPath, 'AGENTS.md'), '# Test Agent');
-        await (0, sync_1.syncPackToWorkspace)(workspaceRoot, packPath, 'test-pack', 'codex', logger);
-        const derivedDir = path.join(workspaceRoot, shared_1.AGENT_ENGINES.codex.workspaceDir);
-        assert.ok(fs.existsSync(derivedDir), 'Codex derived directory should exist');
-    });
-    test('syncs AGENTS.md to claude rules file (CLAUDE.md)', async () => {
-        const content = '# My Agent\n\nThis is a test agent.';
-        await fs_1.promises.writeFile(path.join(packPath, 'AGENTS.md'), content);
-        await (0, sync_1.syncPackToWorkspace)(workspaceRoot, packPath, 'test-pack', 'claude', logger);
-        const rulesFile = path.join(workspaceRoot, '.claude', 'CLAUDE.md');
-        assert.ok(fs.existsSync(rulesFile), 'CLAUDE.md should exist');
-        const actual = await fs_1.promises.readFile(rulesFile, 'utf8');
-        assert.strictEqual(actual, content);
-    });
-    test('syncs AGENTS.md to codex rules file (AGENTS.md)', async () => {
-        const content = '# My Codex Agent\n\nThis is a test agent.';
-        await fs_1.promises.writeFile(path.join(packPath, 'AGENTS.md'), content);
-        await (0, sync_1.syncPackToWorkspace)(workspaceRoot, packPath, 'test-pack', 'codex', logger);
-        const rulesFile = path.join(workspaceRoot, '.codex', 'AGENTS.md');
-        assert.ok(fs.existsSync(rulesFile), 'AGENTS.md should exist in .codex/');
-        const actual = await fs_1.promises.readFile(rulesFile, 'utf8');
-        assert.strictEqual(actual, content);
-    });
-    test('combines AGENTS.md with context.md', async () => {
-        await fs_1.promises.writeFile(path.join(packPath, 'AGENTS.md'), '# Agent Rules');
-        await fs_1.promises.writeFile(path.join(packPath, 'context.md'), '## Context Section');
-        await (0, sync_1.syncPackToWorkspace)(workspaceRoot, packPath, 'test-pack', 'claude', logger);
-        const rulesFile = path.join(workspaceRoot, '.claude', 'CLAUDE.md');
-        const content = await fs_1.promises.readFile(rulesFile, 'utf8');
-        assert.ok(content.includes('# Agent Rules'), 'Should include AGENTS.md content');
-        assert.ok(content.includes('---'), 'Should have separator');
-        assert.ok(content.includes('## Context Section'), 'Should include context.md content');
-    });
-    test('syncs skills directory via symlinks', async () => {
-        // Create pack with skills
-        const skillsDir = path.join(packPath, 'skills');
-        await fs_1.promises.mkdir(skillsDir, { recursive: true });
-        await fs_1.promises.writeFile(path.join(skillsDir, 'test-skill.md'), '# Test Skill');
-        await (0, sync_1.syncPackToWorkspace)(workspaceRoot, packPath, 'test-pack', 'claude', logger);
-        const derivedSkillsDir = path.join(workspaceRoot, '.claude', 'skills');
-        assert.ok(fs.existsSync(derivedSkillsDir), 'skills directory should exist');
-        const skillFile = path.join(derivedSkillsDir, 'test-skill.md');
-        assert.ok(fs.existsSync(skillFile), 'skill file should exist');
-        const content = await fs_1.promises.readFile(skillFile, 'utf8');
-        assert.strictEqual(content, '# Test Skill');
-    });
-    test('syncs rules fragments directory', async () => {
-        // Create pack with rule fragments
-        const rulesDir = path.join(packPath, 'rules');
-        await fs_1.promises.mkdir(rulesDir, { recursive: true });
-        await fs_1.promises.writeFile(path.join(rulesDir, 'coding-style.md'), '# Coding Style\n\nUse TypeScript.');
-        await fs_1.promises.writeFile(path.join(rulesDir, 'testing.md'), '# Testing\n\nWrite tests.');
-        await (0, sync_1.syncPackToWorkspace)(workspaceRoot, packPath, 'test-pack', 'claude', logger);
-        const derivedRulesDir = path.join(workspaceRoot, '.claude', 'rules');
-        assert.ok(fs.existsSync(derivedRulesDir), 'rules directory should exist');
-        assert.ok(fs.existsSync(path.join(derivedRulesDir, 'coding-style.md')));
-        assert.ok(fs.existsSync(path.join(derivedRulesDir, 'testing.md')));
-    });
-    test('ignores non-.md files in rules directory', async () => {
-        const rulesDir = path.join(packPath, 'rules');
-        await fs_1.promises.mkdir(rulesDir, { recursive: true });
-        await fs_1.promises.writeFile(path.join(rulesDir, 'valid.md'), '# Valid');
-        await fs_1.promises.writeFile(path.join(rulesDir, 'ignore.txt'), 'Should be ignored');
-        await fs_1.promises.writeFile(path.join(rulesDir, 'ignore.json'), '{}');
-        await (0, sync_1.syncPackToWorkspace)(workspaceRoot, packPath, 'test-pack', 'claude', logger);
-        const derivedRulesDir = path.join(workspaceRoot, '.claude', 'rules');
-        assert.ok(fs.existsSync(path.join(derivedRulesDir, 'valid.md')));
-        assert.ok(!fs.existsSync(path.join(derivedRulesDir, 'ignore.txt')), '.txt files should not be synced');
-        assert.ok(!fs.existsSync(path.join(derivedRulesDir, 'ignore.json')), '.json files should not be synced');
-    });
-    test('creates .gitignore with derived directories', async () => {
-        await fs_1.promises.writeFile(path.join(packPath, 'AGENTS.md'), '# Test');
-        await (0, sync_1.syncPackToWorkspace)(workspaceRoot, packPath, 'test-pack', 'claude', logger);
-        const gitignorePath = path.join(workspaceRoot, '.gitignore');
-        assert.ok(fs.existsSync(gitignorePath), '.gitignore should exist');
-        const content = await fs_1.promises.readFile(gitignorePath, 'utf8');
-        assert.ok(content.includes('.claude'), '.gitignore should include .claude');
-        assert.ok(content.includes('.codex'), '.gitignore should include .codex');
-    });
-    test('creates .gitignore with custom engine workspace dirs', async () => {
-        const cursorEngineDir = path.join(workspaceRoot, branding_1.AGENTIDE_DIR_NAME, 'engines', 'cursor');
-        await fs_1.promises.mkdir(cursorEngineDir, { recursive: true });
-        await fs_1.promises.writeFile(path.join(cursorEngineDir, 'engine.manifest.json'), JSON.stringify({
-            version: 2,
-            id: 'cursor',
-            entry: './engine.mjs',
-            workspaceSync: {
-                enabled: true,
-                dir: '.cursor',
-                rulesFile: 'CURSOR.md',
-                includeSkills: true,
-                includeRules: true,
-            },
-            promptInjection: { mode: 'none' },
-        }));
-        await (0, utils_1.ensureWorkspaceGitAndGitignore)(workspaceRoot, logger);
-        const content = await fs_1.promises.readFile(path.join(workspaceRoot, '.gitignore'), 'utf8');
-        assert.ok(content.includes('.cursor'), '.gitignore should include custom engine workspace dir');
-    });
-    test('handles empty pack (no AGENTS.md)', async () => {
-        // Pack with no files should not throw
-        await (0, sync_1.syncPackToWorkspace)(workspaceRoot, packPath, 'test-pack', 'claude', logger);
-        // Derived directory should still be created
-        const derivedDir = path.join(workspaceRoot, shared_1.AGENT_ENGINES.claude.workspaceDir);
-        assert.ok(fs.existsSync(derivedDir), 'Derived directory should still be created');
-    });
-    test('throws for unknown engine', async () => {
-        await assert.rejects(async () => (0, sync_1.syncPackToWorkspace)(workspaceRoot, packPath, 'test-pack', 'unknown', logger), /Unknown engine/);
-    });
-    test('logs sync operations', async () => {
-        await fs_1.promises.writeFile(path.join(packPath, 'AGENTS.md'), '# Test');
-        await (0, sync_1.syncPackToWorkspace)(workspaceRoot, packPath, 'test-pack', 'claude', logger);
-        assert.ok(logger.messages.length > 0, 'Should have logged messages');
-        assert.ok(logger.messages.some(m => m.includes('Synced rules')), 'Should log rules sync');
-        assert.ok(logger.messages.some(m => m.includes('synced to workspace')), 'Should log completion');
-    });
-    test('re-syncing updates content', async () => {
-        // Initial sync
-        await fs_1.promises.writeFile(path.join(packPath, 'AGENTS.md'), '# Version 1');
-        await (0, sync_1.syncPackToWorkspace)(workspaceRoot, packPath, 'test-pack', 'claude', logger);
-        const rulesFile = path.join(workspaceRoot, '.claude', 'CLAUDE.md');
-        let content = await fs_1.promises.readFile(rulesFile, 'utf8');
-        assert.ok(content.includes('Version 1'));
-        // Update and re-sync
-        await fs_1.promises.writeFile(path.join(packPath, 'AGENTS.md'), '# Version 2');
-        await (0, sync_1.syncPackToWorkspace)(workspaceRoot, packPath, 'test-pack', 'claude', logger);
-        content = await fs_1.promises.readFile(rulesFile, 'utf8');
-        assert.ok(content.includes('Version 2'), 'Content should be updated');
-    });
-    test('syncs pack MCP from agent.yaml spec.mcp to workspace .mcp.json', async () => {
-        await fs_1.promises.writeFile(path.join(packPath, 'AGENTS.md'), '# MCP pack');
-        await fs_1.promises.mkdir(path.join(packPath, 'mcp'), { recursive: true });
-        await fs_1.promises.writeFile(path.join(packPath, 'mcp', 'db.json'), JSON.stringify({ mcpServers: { db: { command: 'echo', args: ['db'] } } }, null, 2));
-        await fs_1.promises.writeFile(path.join(packPath, 'agent.yaml'), [
-            'apiVersion: agenthippo.ai/v1',
-            'kind: Agent',
-            'metadata:',
-            '  name: test-pack',
-            '  version: 0.1.0',
-            'spec:',
-            '  engine: cursor',
-            '  mcp:',
-            '    - name: db',
-            '      config: ./mcp/db.json',
-        ].join('\n'));
-        await (0, sync_1.syncPackToWorkspace)(workspaceRoot, packPath, 'test-pack', 'cursor', logger);
-        const mcpPath = path.join(workspaceRoot, paths_1.AGENT_CONSTANTS.AGENTIDE_DIR_NAME, paths_1.AGENT_CONSTANTS.AGENTS_DIR, 'test-pack', paths_1.AGENT_CONSTANTS.MCP_DIR, '.mcp.json');
-        assert.ok(fs.existsSync(mcpPath), '.mcp.json should exist');
-        const cfg = JSON.parse(await fs_1.promises.readFile(mcpPath, 'utf8'));
-        assert.ok(cfg.mcpServers?.db, 'should merge db server');
-    });
-    test('does not create self-referential skill symlinks when pack lives under agentide agents dir', async () => {
-        const inWorkspacePackPath = path.join(workspaceRoot, paths_1.AGENT_CONSTANTS.AGENTIDE_DIR_NAME, paths_1.AGENT_CONSTANTS.AGENTS_DIR, 'test-pack');
-        const skillDir = path.join(inWorkspacePackPath, paths_1.AGENT_CONSTANTS.SKILLS_DIR, 'demo-skill');
-        await fs_1.promises.mkdir(skillDir, { recursive: true });
-        await fs_1.promises.writeFile(path.join(inWorkspacePackPath, 'AGENTS.md'), '# In-workspace pack');
-        await fs_1.promises.writeFile(path.join(skillDir, 'SKILL.md'), '# Demo skill');
-        await (0, sync_1.syncPackToWorkspace)(workspaceRoot, inWorkspacePackPath, 'test-pack', 'codex', logger);
-        const skillMd = path.join(skillDir, 'SKILL.md');
-        const stat = await fs_1.promises.lstat(skillMd);
-        assert.ok(stat.isFile(), 'SKILL.md should remain a real file, not a symlink loop');
-        const content = await fs_1.promises.readFile(skillMd, 'utf8');
-        assert.strictEqual(content, '# Demo skill');
-    });
-});
-suite('Headless Sync - LoggerLike interface', () => {
-    test('works with appendLine (vscode.OutputChannel style)', async () => {
-        const workspaceRoot = makeTempDir('headless-sync-logger-');
-        const packPath = makeTempDir('headless-sync-logger-pack-');
-        try {
-            await fs_1.promises.writeFile(path.join(packPath, 'AGENTS.md'), '# Test');
-            const messages = [];
-            const outputChannelStyle = {
-                appendLine: (msg) => messages.push(msg),
-            };
-            await (0, sync_1.syncPackToWorkspace)(workspaceRoot, packPath, 'test-pack', 'claude', outputChannelStyle);
-            assert.ok(messages.length > 0, 'Should have logged via appendLine');
-        }
-        finally {
-            await cleanupDir(workspaceRoot);
-            await cleanupDir(packPath);
-        }
-    });
-    test('works with info (Logger interface style)', async () => {
-        const workspaceRoot = makeTempDir('headless-sync-logger-');
-        const packPath = makeTempDir('headless-sync-logger-pack-');
-        try {
-            await fs_1.promises.writeFile(path.join(packPath, 'AGENTS.md'), '# Test');
-            const messages = [];
-            const loggerStyle = {
-                info: (msg) => messages.push(msg),
-            };
-            await (0, sync_1.syncPackToWorkspace)(workspaceRoot, packPath, 'test-pack', 'claude', loggerStyle);
-            assert.ok(messages.length > 0, 'Should have logged via info');
-        }
-        finally {
-            await cleanupDir(workspaceRoot);
-            await cleanupDir(packPath);
-        }
-    });
-});

package/out/test/helpers/manifest-fixtures.js

@@ -1,27 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createTestAgentYaml = createTestAgentYaml;
-/**
- * Build a test-friendly Agent manifest YAML string.
- * Keeps repetitive manifest snippets centralized for tests.
- */
-function createTestAgentYaml({ name, version, engine, quoteVersion = false, description, model, includeSkills = false, fileAccess, visibility, }) {
-    const lines = [
-        'apiVersion: agenthippo.ai/v1',
-        'kind: Agent',
-        'metadata:',
-        `  name: ${name}`,
-        `  version: ${quoteVersion ? `"${version}"` : version}`,
-        ...(description ? [`  description: ${description}`] : []),
-        'spec:',
-        `  engine: ${engine}`,
-        ...(model ? [`  model: ${model}`] : []),
-        ...(includeSkills ? ['  skills: []'] : []),
-        ...(fileAccess ? ['  permissions:', `    fileAccess: ${fileAccess}`] : []),
-        ...(visibility ? [`  visibility: ${visibility}`] : []),
-    ];
-    return `${lines.join('\n')}\n`;
-}

package/out/test/idp-init.test.js

@@ -1,151 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  IdP Init Test Suite (PLAN/deploy.md — "customer 0")
- *
- *  Verifies `agenthippo idp init` generates a self-contained stack: no repo dependency in the
- *  auth-broker image, identity routes reused verbatim from renderIdentityLayer (no drift risk),
- *  and valid YAML/bash throughout.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-require("mocha");
-const assert = __importStar(require("assert"));
-const fs = __importStar(require("fs"));
-const os = __importStar(require("os"));
-const path = __importStar(require("path"));
-const child_process_1 = require("child_process");
-const yaml = __importStar(require("js-yaml"));
-const idp_init_1 = require("../cli/idp-init");
-const idp_1 = require("../cli/commands/idp");
-suite('idp-init: renderIdpArtifacts', () => {
-    test('generates a self-contained stack — no monorepo build context', () => {
-        const files = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.corp.example' });
-        assert.ok(files['Dockerfile.auth-broker'].includes('FROM ghcr.io/agenthippoai/runtime'), 'auth-broker image must come from the published runtime image, not repo build artifacts');
-        assert.ok(!files['Dockerfile.auth-broker'].includes('extensions/agentide/dist'), 'must not reference this repo\'s local build output — a customer never has it');
-        assert.ok(files['docker-compose.yml'].includes('dockerfile: Dockerfile.auth-broker')
-            && files['docker-compose.yml'].includes('context: .'), 'auth-broker builds from the generated dir itself, not a monorepo path');
-    });
-    test('docker-compose.yml is valid YAML with the expected services and networks', () => {
-        const files = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.corp.example' });
-        const compose = yaml.load(files['docker-compose.yml']);
-        assert.deepStrictEqual(Object.keys(compose.services), ['oauth2-proxy', 'auth-broker', 'caddy', 'cloudflared']);
-        assert.ok(!('agent' in compose.services), 'the IdP runs no agent');
-        assert.deepStrictEqual(Object.keys(compose.networks), ['default', 'colocate']);
-        assert.ok(files['docker-compose.yml'].includes('name: agenthippo-idp-colocate'));
-    });
-    test('Caddyfile reuses renderIdentityLayer verbatim — self-issued, no agent backend', () => {
-        const files = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.corp.example' });
-        const caddy = files['Caddyfile'];
-        assert.ok(caddy.includes('import agents/*.caddy'), 'colocated agents import in');
-        assert.ok(caddy.includes('handle /oauth/authorize {') && caddy.includes('handle /oauth/browser-login {'));
-        assert.ok(caddy.includes('forward_auth oauth2-proxy:4180'), 'self-issued: gates via oauth2-proxy');
-        assert.ok(caddy.includes('reverse_proxy auth-broker:9780'), 'health checks the broker, not an agent');
-        assert.ok(caddy.includes('respond "not_found" 404'), 'no /v1/* API here — Bearer requests 404, not silently passed through');
-        assert.ok(caddy.includes('respond "AgentHippo IdP" 200'), 'browser catch-all, past the SSO gate');
-        assert.ok(caddy.includes('http://{$AGENTHIPPO_PUBLIC_HOSTNAME} {') && !caddy.includes('https://{$AGENTHIPPO_PUBLIC_HOSTNAME}'), 'plain HTTP — auto_https is off, TLS terminates in front');
-    });
-    test('.env.auth.example carries the shared JWT secret + Google OAuth client, no fed vars', () => {
-        const files = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.corp.example' });
-        const auth = files['.env.auth.example'];
-        assert.ok(auth.includes('AGENTHIPPO_AUTH_JWT_SECRET') && auth.includes('OAUTH2_PROXY_CLIENT_ID'));
-        assert.ok(!auth.includes('AGENTHIPPO_AUTH_IDP_URL'), 'the IdP is not itself federated against anything');
-    });
-    test('cookie domain defaults to the hostname\'s own parent domain when not given explicitly', () => {
-        const files = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.corp.example' });
-        assert.ok(files['.env.auth.example'].includes('AGENTHIPPO_AUTH_COOKIE_DOMAIN=.corp.example'));
-    });
-    test('explicit cookieDomain overrides the derived default', () => {
-        const files = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.eu.corp.example', cookieDomain: '.corp.example' });
-        assert.ok(files['.env.auth.example'].includes('AGENTHIPPO_AUTH_COOKIE_DOMAIN=.corp.example'));
-    });
-    test('run.sh is valid bash and reflects the hostname', () => {
-        const files = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.corp.example' });
-        assert.doesNotThrow(() => (0, child_process_1.execFileSync)('bash', ['-n', '-c', files['run.sh']]));
-        assert.ok(files['run.sh'].includes('auth.corp.example'));
-    });
-    // Bare metal / BYO nginx or ALB (e.g. Hetzner): run.sh must not hard-require a Cloudflare
-    // Tunnel, and Caddy's host port must be reconfigurable when 80/443 are already taken by the
-    // operator's own reverse proxy.
-    test('run.sh branches on an explicit tunnel-credentials path argument, not a fixed file location', () => {
-        const sh = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.corp.example' })['run.sh'];
-        assert.ok(sh.includes('if [[ $# -ge 1 ]]; then'), 'branches on whether an argument was passed');
-        assert.ok(!sh.includes('-f "$HOME/.agent-hippo/tunnel-credentials.json"'), 'must not infer tunnel mode from a fixed default file path');
-        assert.ok(sh.includes('AGENTHIPPO_TUNNEL_CREDENTIALS="$1"'), 'the argument becomes the credentials path');
-        assert.ok(sh.includes('docker compose --profile edge --profile tunnel up -d --build'));
-        assert.ok(sh.includes('docker compose --profile edge up -d --build'), 'no-argument branch: --profile edge only, no --profile tunnel');
-    });
-    test('run.sh fails loudly if a given tunnel-credentials path doesn\'t exist', () => {
-        const sh = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.corp.example' })['run.sh'];
-        assert.ok(sh.includes('[[ -f "$AGENTHIPPO_TUNNEL_CREDENTIALS" ]] || {'));
-        assert.ok(sh.includes('exit 1'));
-    });
-    test('docker-compose.yml wires the cloudflared credentials mount to AGENTHIPPO_TUNNEL_CREDENTIALS', () => {
-        const compose = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.corp.example' })['docker-compose.yml'];
-        assert.ok(compose.includes('${AGENTHIPPO_TUNNEL_CREDENTIALS:-${HOME}/.agent-hippo/tunnel-credentials.json}'));
-    });
-    test('Caddy host ports are configurable via AGENTHIPPO_CADDY_HTTP_PORT/_HTTPS_PORT (Hetzner: 80/443 may already be taken)', () => {
-        const compose = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.corp.example' })['docker-compose.yml'];
-        assert.ok(compose.includes('${AGENTHIPPO_CADDY_HTTP_PORT:-80}:80'));
-        assert.ok(compose.includes('${AGENTHIPPO_CADDY_HTTPS_PORT:-443}:443'));
-    });
-    test('README documents both the Cloudflare Tunnel path and the bare-metal/BYO-nginx path', () => {
-        const readme = (0, idp_init_1.renderIdpArtifacts)({ hostname: 'auth.corp.example' })['README.md'];
-        assert.ok(readme.includes('Cloudflare Tunnel'));
-        assert.ok(readme.includes('Bare metal') || readme.includes('BYO nginx'));
-    });
-});
-suite('idp-init: idpCommand writes files to disk', () => {
-    let outDir;
-    setup(() => {
-        outDir = fs.mkdtempSync(path.join(os.tmpdir(), 'ah-idp-'));
-    });
-    teardown(() => {
-        fs.rmSync(outDir, { recursive: true, force: true });
-    });
-    test('writes every generated file under --out', async () => {
-        await (0, idp_1.idpCommand)('init', { hostname: 'auth.corp.example', out: outDir });
-        for (const rel of ['docker-compose.yml', 'Dockerfile.auth-broker', 'Caddyfile', '.env.example', '.env.auth.example', 'run.sh', 'agents/README.md', 'README.md']) {
-            assert.ok(fs.existsSync(path.join(outDir, rel)), `${rel} should be written`);
-        }
-    });
-    test('refuses to overwrite existing files without --force', async () => {
-        await (0, idp_1.idpCommand)('init', { hostname: 'auth.corp.example', out: outDir });
-        fs.writeFileSync(path.join(outDir, 'README.md'), 'hand-edited\n');
-        await (0, idp_1.idpCommand)('init', { hostname: 'auth.corp.example', out: outDir });
-        assert.strictEqual(fs.readFileSync(path.join(outDir, 'README.md'), 'utf8'), 'hand-edited\n');
-        await (0, idp_1.idpCommand)('init', { hostname: 'auth.corp.example', out: outDir, force: true });
-        assert.notStrictEqual(fs.readFileSync(path.join(outDir, 'README.md'), 'utf8'), 'hand-edited\n');
-    });
-});