@agenthippo-ai/agenthippo 1.110.9 → 1.110.19

package/out/test/serve-hardening.test.js

@@ -1,418 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Serve Hardening Test Suite
- *
- *  Pure-helper tests: state-dir resolution, identity headers, CORS, turn limiting, body cap.
- *  Auth and credential checking are the deploy layer's responsibility — not tested here.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-require("mocha");
-const assert = __importStar(require("assert"));
-const os = __importStar(require("os"));
-const path = __importStar(require("path"));
-const stream_1 = require("stream");
-const serve_hardening_1 = require("../cli/serve-hardening");
-suite('serve-hardening: resolveStateDir', () => {
-    test('explicit --state-dir wins and is absolute and non-ephemeral', () => {
-        const r = (0, serve_hardening_1.resolveStateDir)('./state', {});
-        assert.strictEqual(r.ephemeral, false);
-        assert.ok(path.isAbsolute(r.dir));
-        assert.ok(r.dir.endsWith(`${path.sep}state`));
-    });
-    test('AGENTHIPPO_HOME is used when no --state-dir', () => {
-        const r = (0, serve_hardening_1.resolveStateDir)(undefined, { AGENTHIPPO_HOME: '/data/.agent-hippo' });
-        assert.strictEqual(r.ephemeral, false);
-        assert.strictEqual(r.dir, path.join('/data/.agent-hippo', 'serve-state'));
-    });
-    test('falls back to tmpdir and flags ephemeral', () => {
-        const r = (0, serve_hardening_1.resolveStateDir)(undefined, {});
-        assert.strictEqual(r.ephemeral, true);
-        assert.ok(r.dir.startsWith(os.tmpdir()));
-    });
-});
-suite('serve-hardening: resolveAnalyticsSessionsDir', () => {
-    // getAgentideHome() reads process.env directly (not injectable), so tests that need it to
-    // resolve deterministically save/restore the real env vars around themselves.
-    const saved = {};
-    setup(() => {
-        saved.AGENT_HOME_DIR = process.env.AGENT_HOME_DIR;
-        saved.AGENTHIPPO_HOME = process.env.AGENTHIPPO_HOME;
-        delete process.env.AGENT_HOME_DIR;
-        delete process.env.AGENTHIPPO_HOME;
-    });
-    teardown(() => {
-        if (saved.AGENT_HOME_DIR === undefined) {
-            delete process.env.AGENT_HOME_DIR;
-        }
-        else {
-            process.env.AGENT_HOME_DIR = saved.AGENT_HOME_DIR;
-        }
-        if (saved.AGENTHIPPO_HOME === undefined) {
-            delete process.env.AGENTHIPPO_HOME;
-        }
-        else {
-            process.env.AGENTHIPPO_HOME = saved.AGENTHIPPO_HOME;
-        }
-    });
-    test('AGENTHIPPO_HOME set → uses getAgentideHome(), not stateDir (stays discoverable to Spotlight/DuckDB)', () => {
-        process.env.AGENTHIPPO_HOME = '/data/.agent-hippo';
-        const dir = (0, serve_hardening_1.resolveAnalyticsSessionsDir)('/data/.agent-hippo/serve-state', false, { AGENTHIPPO_HOME: '/data/.agent-hippo' });
-        assert.strictEqual(dir, path.join('/data/.agent-hippo', 'analytics', 'sessions'));
-    });
-    test('AGENT_HOME_DIR set → same precedence as AGENTHIPPO_HOME', () => {
-        process.env.AGENT_HOME_DIR = '/data/.agent-hippo';
-        const dir = (0, serve_hardening_1.resolveAnalyticsSessionsDir)('/data/.agent-hippo/serve-state', false, { AGENT_HOME_DIR: '/data/.agent-hippo' });
-        assert.strictEqual(dir, path.join('/data/.agent-hippo', 'analytics', 'sessions'));
-    });
-    test('no home-dir env var, explicit non-ephemeral --state-dir → uses stateDir (never regress durability for discoverability)', () => {
-        const dir = (0, serve_hardening_1.resolveAnalyticsSessionsDir)('/mnt/durable-vol', false, {});
-        assert.strictEqual(dir, path.join('/mnt/durable-vol', 'analytics', 'sessions'));
-    });
-    test('no home-dir env var, ephemeral state (nothing durable configured) → falls back to getAgentideHome() default', () => {
-        const dir = (0, serve_hardening_1.resolveAnalyticsSessionsDir)(path.join(os.tmpdir(), 'agenthippo-server'), true, {});
-        assert.strictEqual(dir, path.join(os.homedir(), '.agent-hippo', 'analytics', 'sessions'));
-    });
-});
-suite('serve-hardening: resolveBindHost', () => {
-    test('defaults to loopback', () => {
-        assert.strictEqual((0, serve_hardening_1.resolveBindHost)(undefined, {}), serve_hardening_1.DEFAULT_BIND_HOST);
-        assert.strictEqual(serve_hardening_1.DEFAULT_BIND_HOST, '127.0.0.1');
-    });
-    test('explicit --host wins over env', () => {
-        assert.strictEqual((0, serve_hardening_1.resolveBindHost)('0.0.0.0', { AGENTHIPPO_SERVE_HOST: '10.0.0.1' }), '0.0.0.0');
-    });
-    test('AGENTHIPPO_SERVE_HOST used when no flag', () => {
-        assert.strictEqual((0, serve_hardening_1.resolveBindHost)(undefined, { AGENTHIPPO_SERVE_HOST: '0.0.0.0' }), '0.0.0.0');
-    });
-});
-suite('serve-hardening: clientIp', () => {
-    const reqWith = (headers, remote = '203.0.113.9') => ({ headers, socket: { remoteAddress: remote } });
-    test('falls back to socket address with no XFF', () => {
-        assert.strictEqual((0, serve_hardening_1.clientIp)(reqWith({})), '203.0.113.9');
-    });
-    test('uses the right-most XFF entry (the IP the trusted proxy observed)', () => {
-        assert.strictEqual((0, serve_hardening_1.clientIp)(reqWith({ 'x-forwarded-for': 'evil-spoof, 198.51.100.7' })), '198.51.100.7');
-    });
-    test('AGENTHIPPO_XFF_TRUSTED_HOPS=2 skips the tunnel hop (cloudflared → Caddy)', () => {
-        const req = reqWith({ 'x-forwarded-for': '198.51.100.7, 172.18.0.5' });
-        assert.strictEqual((0, serve_hardening_1.clientIp)(req, { AGENTHIPPO_XFF_TRUSTED_HOPS: '2' }), '198.51.100.7');
-    });
-    test('trusted hops beyond the XFF length clamps to the left-most entry', () => {
-        const req = reqWith({ 'x-forwarded-for': '198.51.100.7' });
-        assert.strictEqual((0, serve_hardening_1.clientIp)(req, { AGENTHIPPO_XFF_TRUSTED_HOPS: '5' }), '198.51.100.7');
-    });
-    test('invalid trusted hops falls back to 1', () => {
-        const req = reqWith({ 'x-forwarded-for': 'evil-spoof, 198.51.100.7' });
-        assert.strictEqual((0, serve_hardening_1.clientIp)(req, { AGENTHIPPO_XFF_TRUSTED_HOPS: 'nope' }), '198.51.100.7');
-    });
-});
-suite('serve-hardening: RateLimiter', () => {
-    test('allows up to the cap within a window then rejects', () => {
-        const lim = new serve_hardening_1.RateLimiter(2, 60_000);
-        const t0 = 1_000;
-        assert.strictEqual(lim.tryConsume('k', t0), true);
-        assert.strictEqual(lim.tryConsume('k', t0), true);
-        assert.strictEqual(lim.tryConsume('k', t0), false);
-    });
-    test('window resets after it elapses', () => {
-        const lim = new serve_hardening_1.RateLimiter(1, 1_000);
-        assert.strictEqual(lim.tryConsume('k', 0), true);
-        assert.strictEqual(lim.tryConsume('k', 500), false);
-        assert.strictEqual(lim.tryConsume('k', 1_001), true);
-    });
-    test('separate keys have separate budgets', () => {
-        const lim = new serve_hardening_1.RateLimiter(1);
-        assert.strictEqual(lim.tryConsume('a'), true);
-        assert.strictEqual(lim.tryConsume('b'), true);
-        assert.strictEqual(lim.tryConsume('a'), false);
-    });
-    test('zero / negative disables the limiter', () => {
-        const lim = new serve_hardening_1.RateLimiter(0);
-        for (let i = 0; i < 100; i++) {
-            assert.strictEqual(lim.tryConsume('k'), true);
-        }
-    });
-});
-suite('serve-hardening: resolveUserId', () => {
-    /**
-     * BREAKING, and deliberately so. `x-agent-user` used to be the FIRST trusted alias, so on any
-     * deployment that had not pinned AGENTHIPPO_IDENTITY_HEADER, any HTTP client could send
-     * `x-agent-user: victim@example.com` and be namespaced into that user's session state, attach
-     * to their conversation, and be issued a data-plane turn nonce scoped to them. No platform
-     * strips it — Cloud Run IAP strips `X-Goog-*` and forwards this one untouched.
-     */
-    test('x-agent-user is NOT trusted by default — it is not stripped by any platform', () => {
-        assert.strictEqual((0, serve_hardening_1.resolveUserId)({ 'x-agent-user': 'victim@example.com' }, undefined, {}), undefined);
-    });
-    test('x-agent-user IS trusted when the deployment pins it (the Caddy forward_auth flow)', () => {
-        const env = { AGENTHIPPO_IDENTITY_HEADER: 'x-agent-user' };
-        assert.strictEqual((0, serve_hardening_1.resolveUserId)({ 'x-agent-user': 'alice@corp.com' }, { user_id: 'bob' }, env), 'alice@corp.com');
-    });
-    test('an unpinned deployment is told which env var to set, and why', () => {
-        const advice = (0, serve_hardening_1.identityHeaderAdvice)({});
-        assert.ok(advice.length > 0);
-        assert.ok(advice.every((l) => /AGENTHIPPO_IDENTITY_HEADER/.test(l)));
-        assert.ok(advice.some((l) => /x-agent-user/.test(l)), 'the removal must be explained, not silent');
-        assert.deepStrictEqual((0, serve_hardening_1.identityHeaderAdvice)({ AGENTHIPPO_IDENTITY_HEADER: 'x-agent-user' }), [], 'a pinned deployment is quiet');
-    });
-    test('advice severity follows reachability, so the loud case stays loud', () => {
-        const loopback = (0, serve_hardening_1.identityHeaderAdvice)({}, '127.0.0.1');
-        assert.strictEqual(loopback.length, 1, 'a local run gets one short note, not a lecture');
-        assert.ok(loopback.every((l) => /AGENTHIPPO_IDENTITY_HEADER/.test(l)));
-        assert.deepStrictEqual((0, serve_hardening_1.identityHeaderAdvice)({}, 'localhost').length, 1);
-        assert.deepStrictEqual((0, serve_hardening_1.identityHeaderAdvice)({}, '::1').length, 1);
-        const exposed = (0, serve_hardening_1.identityHeaderAdvice)({}, '0.0.0.0');
-        assert.ok(exposed.length > loopback.length, 'an exposed bind must say strictly more');
-        assert.ok(exposed.some((l) => /reachable beyond this machine/.test(l)));
-        assert.ok(exposed.every((l) => /AGENTHIPPO_IDENTITY_HEADER/.test(l)));
-        // Pinning silences both, exposed or not.
-        const pinned = { AGENTHIPPO_IDENTITY_HEADER: 'x-goog-authenticated-user-email' };
-        assert.deepStrictEqual((0, serve_hardening_1.identityHeaderAdvice)(pinned, '0.0.0.0'), []);
-    });
-    test('Databricks X-Forwarded-Email', () => {
-        assert.strictEqual((0, serve_hardening_1.resolveUserId)({ 'x-forwarded-email': 'priya@meridian.com' }, undefined), 'priya@meridian.com');
-    });
-    test('Cloud Run IAP prefixed value is stripped to the email', () => {
-        const id = (0, serve_hardening_1.resolveUserId)({ 'x-goog-authenticated-user-email': 'accounts.google.com:marco@meridian.com' }, undefined);
-        assert.strictEqual(id, 'marco@meridian.com');
-    });
-    test('Cloudflare Access header', () => {
-        assert.strictEqual((0, serve_hardening_1.resolveUserId)({ 'cf-access-authenticated-user-email': 'susan@meridian.com' }, undefined), 'susan@meridian.com');
-    });
-    test('body.user_id is ignored unless explicitly opted in (§10 hole 3)', () => {
-        // Safe-by-convention was the hole: any deployment that forgot to pin a header let
-        // every caller name an arbitrary victim via the client-controlled body.
-        assert.strictEqual((0, serve_hardening_1.resolveUserId)({}, { user_id: 'bob' }, {}), undefined);
-    });
-    test('AGENTHIPPO_ALLOW_BODY_IDENTITY=1 restores the dev-convenience body fallback', () => {
-        const env = { AGENTHIPPO_ALLOW_BODY_IDENTITY: '1' };
-        assert.strictEqual((0, serve_hardening_1.resolveUserId)({}, { user_id: 'bob' }, env), 'bob');
-        // A trusted platform header still wins over the body even when opted in.
-        assert.strictEqual((0, serve_hardening_1.resolveUserId)({ 'x-forwarded-email': 'alice@corp.com' }, { user_id: 'bob' }, env), 'alice@corp.com');
-    });
-    test('undefined when nothing present', () => {
-        assert.strictEqual((0, serve_hardening_1.resolveUserId)({}, undefined), undefined);
-        assert.strictEqual((0, serve_hardening_1.resolveUserId)({}, { user_id: '   ' }, { AGENTHIPPO_ALLOW_BODY_IDENTITY: '1' }), undefined);
-    });
-    test('AGENTHIPPO_IDENTITY_HEADER pins trust to one header — spoofed aliases are ignored', () => {
-        const env = { AGENTHIPPO_IDENTITY_HEADER: 'x-goog-authenticated-user-email' };
-        // IAP strips X-Goog-* but forwards x-agent-user; pinning must ignore the spoof.
-        const id = (0, serve_hardening_1.resolveUserId)({ 'x-agent-user': 'spoofed@evil.com', 'x-goog-authenticated-user-email': 'accounts.google.com:marco@meridian.com' }, undefined, env);
-        assert.strictEqual(id, 'marco@meridian.com');
-    });
-    test('pinned header absent → fails closed (never the alias list, never the body)', () => {
-        const env = { AGENTHIPPO_IDENTITY_HEADER: 'x-goog-authenticated-user-email' };
-        assert.strictEqual((0, serve_hardening_1.resolveUserId)({ 'x-agent-user': 'spoofed@evil.com' }, { user_id: 'bob' }, env), undefined);
-    });
-});
-suite('serve-hardening: corsHeaders', () => {
-    test('always wide-open (serve is always behind a proxy)', () => {
-        const h = (0, serve_hardening_1.corsHeaders)();
-        assert.strictEqual(h['Access-Control-Allow-Origin'], '*');
-        assert.ok(h['Access-Control-Allow-Methods']);
-        assert.ok(h['Access-Control-Allow-Headers']);
-    });
-});
-suite('serve-hardening: TurnLimiter', () => {
-    test('allows up to the cap then rejects', () => {
-        const lim = new serve_hardening_1.TurnLimiter(2);
-        assert.strictEqual(lim.tryConsume('s1'), true);
-        assert.strictEqual(lim.tryConsume('s1'), true);
-        assert.strictEqual(lim.tryConsume('s1'), false);
-    });
-    test('separate sessions have separate budgets', () => {
-        const lim = new serve_hardening_1.TurnLimiter(1);
-        assert.strictEqual(lim.tryConsume('s1'), true);
-        assert.strictEqual(lim.tryConsume('s2'), true);
-        assert.strictEqual(lim.tryConsume('s1'), false);
-    });
-    test('zero / negative cap disables the limiter', () => {
-        const lim = new serve_hardening_1.TurnLimiter(0);
-        for (let i = 0; i < 100; i++) {
-            assert.strictEqual(lim.tryConsume('s'), true);
-        }
-    });
-    test('reset clears a session', () => {
-        const lim = new serve_hardening_1.TurnLimiter(1);
-        assert.strictEqual(lim.tryConsume('s1'), true);
-        assert.strictEqual(lim.tryConsume('s1'), false);
-        lim.reset('s1');
-        assert.strictEqual(lim.tryConsume('s1'), true);
-    });
-});
-suite('serve-hardening: TurnGate', () => {
-    test('runs immediately under the inflight cap', async () => {
-        const gate = new serve_hardening_1.TurnGate(2, 4, 1_000);
-        const a = await gate.acquire();
-        const b = await gate.acquire();
-        assert.ok(a);
-        assert.ok(b);
-        assert.strictEqual(gate.inflight, 2);
-        assert.strictEqual(gate.queued, 0);
-        a();
-        b();
-        assert.strictEqual(gate.inflight, 0);
-    });
-    test('queues when at capacity and wakes FIFO on release', async () => {
-        const gate = new serve_hardening_1.TurnGate(1, 4, 5_000);
-        const first = await gate.acquire();
-        assert.ok(first);
-        assert.strictEqual(gate.inflight, 1);
-        let secondResolved = false;
-        const secondPromise = gate.acquire().then((release) => {
-            secondResolved = true;
-            return release;
-        });
-        // Let the microtask queue settle so the waiter is enqueued.
-        await new Promise((r) => setImmediate(r));
-        assert.strictEqual(secondResolved, false);
-        assert.strictEqual(gate.queued, 1);
-        first();
-        const second = await secondPromise;
-        assert.strictEqual(secondResolved, true);
-        assert.ok(second);
-        assert.strictEqual(gate.inflight, 1);
-        assert.strictEqual(gate.queued, 0);
-        second();
-        assert.strictEqual(gate.inflight, 0);
-    });
-    test('rejects immediately when the queue is full', async () => {
-        const gate = new serve_hardening_1.TurnGate(1, 1, 5_000);
-        const held = await gate.acquire();
-        assert.ok(held);
-        const waiting = gate.acquire(); // fills the single queue slot
-        await new Promise((r) => setImmediate(r));
-        assert.strictEqual(gate.queued, 1);
-        const rejected = await gate.acquire();
-        assert.strictEqual(rejected, null);
-        held();
-        const released = await waiting;
-        assert.ok(released);
-        released();
-    });
-    test('times out a waiter and returns null', async () => {
-        const gate = new serve_hardening_1.TurnGate(1, 4, 30);
-        const held = await gate.acquire();
-        assert.ok(held);
-        const timedOut = await gate.acquire();
-        assert.strictEqual(timedOut, null);
-        assert.strictEqual(gate.queued, 0);
-        held();
-        assert.strictEqual(gate.inflight, 0);
-    });
-    test('zero maxInflight disables the gate', async () => {
-        const gate = new serve_hardening_1.TurnGate(0, 0, 1_000);
-        const releases = [];
-        for (let i = 0; i < 50; i++) {
-            const r = await gate.acquire();
-            assert.ok(r);
-            releases.push(r);
-        }
-        assert.strictEqual(gate.inflight, 0);
-        for (const r of releases) {
-            r();
-        }
-    });
-    test('createTurnGateFromEnv honors env defaults and overrides', () => {
-        const def = (0, serve_hardening_1.createTurnGateFromEnv)({});
-        assert.strictEqual(def.max, 10);
-        const custom = (0, serve_hardening_1.createTurnGateFromEnv)({ AGENTHIPPO_MAX_CONCURRENT_TURNS: '3', AGENTHIPPO_TURN_QUEUE: '7' });
-        assert.strictEqual(custom.max, 3);
-        const disabled = (0, serve_hardening_1.createTurnGateFromEnv)({ AGENTHIPPO_MAX_CONCURRENT_TURNS: '0' });
-        assert.strictEqual(disabled.max, 0);
-    });
-    test('Retry-After constant matches the default queue timeout', () => {
-        assert.strictEqual(serve_hardening_1.TURN_GATE_RETRY_AFTER_SECONDS, 15);
-    });
-});
-function fakeReq(body) {
-    const stream = new stream_1.PassThrough();
-    stream.end(Buffer.from(body, 'utf8'));
-    return stream;
-}
-suite('serve-hardening: readBodyWithCap', () => {
-    test('reads a small body', async () => {
-        const text = await (0, serve_hardening_1.readBodyWithCap)(fakeReq('{"message":"hi"}'), 1024);
-        assert.strictEqual(text, '{"message":"hi"}');
-    });
-    test('rejects an oversized body with tooLarge flag', async () => {
-        const big = 'x'.repeat(50);
-        await assert.rejects(() => (0, serve_hardening_1.readBodyWithCap)(fakeReq(big), 10), (err) => {
-            assert.strictEqual(err.tooLarge, true);
-            return true;
-        });
-    });
-    test('default cap is 1 MiB', () => {
-        assert.strictEqual(serve_hardening_1.DEFAULT_MAX_BODY_BYTES, 1024 * 1024);
-    });
-});
-suite('serve-hardening: resolveServeSessionKey (secure-obo-design §3.4 Phase 0)', () => {
-    const PINNED = { AGENTHIPPO_IDENTITY_HEADER: 'x-forwarded-email' };
-    test('verified user + session_id → user-namespaced key', () => {
-        const r = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', 'alice@corp.com', PINNED);
-        assert.strictEqual(r.sessionKey, `u${(0, serve_hardening_1.userNamespaceHash)('alice@corp.com')}--chat-1`);
-        assert.strictEqual(r.rejected, undefined);
-    });
-    test('two users presenting the SAME session_id can never share a key (the defect this closes)', () => {
-        const a = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', 'alice@corp.com', PINNED);
-        const b = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', 'bob@corp.com', PINNED);
-        assert.notStrictEqual(a.sessionKey, b.sessionKey);
-    });
-    test('verified user without session_id → stable per-user default key', () => {
-        const r1 = (0, serve_hardening_1.resolveServeSessionKey)(undefined, 'alice@corp.com', PINNED);
-        const r2 = (0, serve_hardening_1.resolveServeSessionKey)('', 'alice@corp.com', PINNED);
-        assert.strictEqual(r1.sessionKey, r2.sessionKey);
-        assert.strictEqual(r1.sessionKey, `u${(0, serve_hardening_1.userNamespaceHash)('alice@corp.com')}--default`);
-    });
-    test('pinned identity + session_id but NO verified user → fail closed', () => {
-        const r = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', undefined, PINNED);
-        assert.strictEqual(r.rejected, serve_hardening_1.SESSION_WITHOUT_USER_REASON);
-    });
-    test('unpinned (local dev) keeps raw session_id behavior', () => {
-        const r = (0, serve_hardening_1.resolveServeSessionKey)('chat-1', undefined, {});
-        assert.strictEqual(r.sessionKey, 'chat-1');
-        assert.strictEqual(r.rejected, undefined);
-    });
-    test('unpinned, no user, no session_id → legacy anon bucket', () => {
-        const r = (0, serve_hardening_1.resolveServeSessionKey)(undefined, undefined, {});
-        assert.strictEqual(r.sessionKey, 'anon-unknown');
-    });
-    test('the key never embeds the raw user id (emails are not path segments)', () => {
-        const r = (0, serve_hardening_1.resolveServeSessionKey)('s', 'alice@corp.com', PINNED);
-        assert.ok(!r.sessionKey.includes('alice@corp.com'));
-        assert.ok(!r.sessionKey.includes('@'));
-    });
-});

package/out/test/serveClient.test.js

@@ -1,209 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-require("mocha");
-const assert = __importStar(require("assert"));
-const http = __importStar(require("http"));
-const serveClient_js_1 = require("../remote/serveClient.js");
-function createCaptureEmitter() {
-    const events = [];
-    return {
-        events,
-        async thinking(delta) { events.push({ type: 'thinking', payload: delta }); },
-        async text(delta) { events.push({ type: 'text', payload: delta }); },
-        async toolStart(toolName, input, toolCallId) {
-            events.push({ type: 'toolStart', payload: { toolName, input, toolCallId } });
-        },
-        async toolEnd(toolName, toolCallId, result, isError) {
-            events.push({ type: 'toolEnd', payload: { toolName, toolCallId, result, isError } });
-        },
-        async progress(message) { events.push({ type: 'progress', payload: message }); },
-        async question() { return { selected: [], freeText: null, declined: true }; },
-        async error(message) { events.push({ type: 'error', payload: message }); },
-        async done() { events.push({ type: 'done', payload: null }); },
-    };
-}
-function startMockServeServer(events) {
-    let lastAuth;
-    return new Promise((resolve, reject) => {
-        const server = http.createServer((req, res) => {
-            if (req.method === 'POST' && req.url === '/v1/chat/stream') {
-                lastAuth = req.headers.authorization;
-                res.writeHead(200, {
-                    'Content-Type': 'text/event-stream',
-                    'Cache-Control': 'no-cache',
-                    Connection: 'keep-alive',
-                });
-                for (const line of events) {
-                    res.write(`data: ${line}\n\n`);
-                }
-                res.end();
-                return;
-            }
-            res.writeHead(404);
-            res.end('not found');
-        });
-        server.listen(0, '127.0.0.1', () => {
-            const address = server.address();
-            if (!address || typeof address === 'string') {
-                reject(new Error('failed to bind mock serve server'));
-                return;
-            }
-            resolve({
-                url: `http://127.0.0.1:${address.port}`,
-                get lastAuth() { return lastAuth; },
-                close: () => new Promise((closeResolve, closeReject) => {
-                    server.close((err) => (err ? closeReject(err) : closeResolve()));
-                }),
-            });
-        });
-    });
-}
-suite('ServeClient', () => {
-    test('normalizeServeBaseUrl strips trailing slashes', () => {
-        assert.strictEqual((0, serveClient_js_1.normalizeServeBaseUrl)('http://127.0.0.1:8787/'), 'http://127.0.0.1:8787');
-    });
-    test('buildServeAuthHeaders sends the bearer token and NO self-asserted identity', () => {
-        // `X-Agent-User` used to ride along here, and the serve side trusts `x-agent-user` as its
-        // first identity alias. On a deployment that does not pin AGENTHIPPO_IDENTITY_HEADER, a
-        // client could name someone else and be namespaced into that user's session/state and
-        // handed a data-plane nonce scoped to them. The bearer already carries a verified identity.
-        assert.deepStrictEqual((0, serveClient_js_1.buildServeAuthHeaders)({ accessToken: 'tok', userEmail: 'you@acme.com' }), { Authorization: 'Bearer tok' });
-    });
-    test('streamRemoteServeChat sends Authorization when auth provided', async () => {
-        const mock = await startMockServeServer([
-            JSON.stringify({ type: 'done' }),
-        ]);
-        try {
-            const emitter = createCaptureEmitter();
-            await (0, serveClient_js_1.streamRemoteServeChat)({
-                baseUrl: mock.url,
-                message: 'ping',
-                auth: { accessToken: 'jwt-token', userEmail: 'dev@agenthippo.ai' },
-            }, emitter);
-            assert.strictEqual(mock.lastAuth, 'Bearer jwt-token');
-        }
-        finally {
-            await mock.close();
-        }
-    });
-    test('streamRemoteServeChat maps SSE events to StreamEmitter', async () => {
-        const mock = await startMockServeServer([
-            JSON.stringify({ type: 'thinking', delta: 'hmm' }),
-            JSON.stringify({ type: 'text', delta: 'hello' }),
-            JSON.stringify({ type: 'tool_start', name: 'Read', input: '{}', tool_call_id: 't1' }),
-            JSON.stringify({ type: 'tool_end', name: 'Read', tool_call_id: 't1', result: 'ok', is_error: false }),
-            JSON.stringify({ type: 'done' }),
-        ]);
-        try {
-            const emitter = createCaptureEmitter();
-            const result = await (0, serveClient_js_1.streamRemoteServeChat)({
-                baseUrl: mock.url,
-                message: 'ping',
-                sessionId: 'sess-1',
-            }, emitter);
-            assert.deepStrictEqual(emitter.events.map((e) => e.type), ['thinking', 'text', 'toolStart', 'toolEnd', 'done']);
-            assert.strictEqual(emitter.events[1].payload, 'hello');
-            assert.deepStrictEqual(result, { ok: true });
-        }
-        finally {
-            await mock.close();
-        }
-    });
-    test('streamRemoteServeChat surfaces HTTP errors', async () => {
-        const server = http.createServer((_req, res) => {
-            res.writeHead(401, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ error: 'Unauthorized' }));
-        });
-        await new Promise((resolve, reject) => {
-            server.listen(0, '127.0.0.1', async () => {
-                try {
-                    const address = server.address();
-                    if (!address || typeof address === 'string') {
-                        throw new Error('bad address');
-                    }
-                    const emitter = createCaptureEmitter();
-                    const result = await (0, serveClient_js_1.streamRemoteServeChat)({ baseUrl: `http://127.0.0.1:${address.port}`, message: 'ping' }, emitter);
-                    assert.deepStrictEqual(emitter.events.map((e) => e.type), ['error', 'done']);
-                    assert.strictEqual(emitter.events[0].payload, 'Unauthorized');
-                    // The turn failed: the caller must be able to see it (not record success).
-                    assert.deepStrictEqual(result, { ok: false, error: 'Unauthorized' });
-                    resolve();
-                }
-                catch (err) {
-                    reject(err);
-                }
-                finally {
-                    server.close();
-                }
-            });
-        });
-    });
-    test('streamRemoteServeChat surfaces fail-closed credential rejection as HTTP error (not silent success)', async () => {
-        // Mirrors serve.ts after the fix: warrant denial happens BEFORE SSE writeHead(200),
-        // so the client sees a real non-2xx JSON error instead of 200 + raw body fallthrough.
-        const server = http.createServer((_req, res) => {
-            res.writeHead(500, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({
-                error: 'OBO data token present without a verified user in request scope (fail-closed: token_without_verified_user)',
-            }));
-        });
-        await new Promise((resolve, reject) => {
-            server.listen(0, '127.0.0.1', async () => {
-                try {
-                    const address = server.address();
-                    if (!address || typeof address === 'string') {
-                        throw new Error('bad address');
-                    }
-                    const emitter = createCaptureEmitter();
-                    const result = await (0, serveClient_js_1.streamRemoteServeChat)({ baseUrl: `http://127.0.0.1:${address.port}`, message: 'ping' }, emitter);
-                    assert.strictEqual(result.ok, false);
-                    assert.match(result.error ?? '', /token_without_verified_user/);
-                    assert.deepStrictEqual(emitter.events.map((e) => e.type), ['error', 'done']);
-                    resolve();
-                }
-                catch (err) {
-                    reject(err);
-                }
-                finally {
-                    server.close();
-                }
-            });
-        });
-    });
-});