@agenthippo-ai/agenthippo 1.110.9 → 1.110.19

package/out/test/spotlightPublish.test.js

@@ -1,327 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-require("mocha");
-const assert = __importStar(require("assert"));
-const fs_1 = require("fs");
-const os = __importStar(require("os"));
-const path = __importStar(require("path"));
-const publish_1 = require("../spotlight/publish");
-const install_1 = require("../spotlight/install");
-const yaml_1 = require("../spotlight/yaml");
-suite('spotlightPublish', () => {
-    let tempDir;
-    suiteSetup(async () => {
-        tempDir = await fs_1.promises.mkdtemp(path.join(os.tmpdir(), 'agentide-spotlight-publish-'));
-    });
-    suiteTeardown(async () => {
-        await fs_1.promises.rm(tempDir, { recursive: true, force: true });
-    });
-    test('resolveViewPublishVersionFromParsed prefers version string over legacy semver', () => {
-        assert.strictEqual((0, publish_1.resolveViewPublishVersionFromParsed)({ version: '1.2.3', semver: '9.9.9' }), '1.2.3');
-        assert.strictEqual((0, publish_1.resolveViewPublishVersionFromParsed)({ semver: '2.0.0' }), '2.0.0');
-        assert.strictEqual((0, publish_1.resolveViewPublishVersionFromParsed)({ version: 1 }), undefined);
-    });
-    test('validateViewForPublish rejects reserved ids', async () => {
-        const summary = {
-            id: 'global',
-            name: 'Global',
-            scope: 'global',
-            scripts: [],
-            viewRoot: path.join(tempDir, 'global'),
-            viewsConfigPath: path.join(tempDir, 'panel', 'views.yaml'),
-            analyticsRoot: tempDir,
-            sourceLabel: 'workspace',
-        };
-        const result = await (0, publish_1.validateViewForPublish)(summary);
-        assert.strictEqual(result.valid, false);
-        assert.ok(result.errors.some(error => error.includes('reserved')));
-    });
-    test('validateViewForPublish accepts minimal view with scripts', async () => {
-        const viewId = 'cost-ops';
-        const analyticsRoot = path.join(tempDir, 'analytics-a');
-        const viewRoot = path.join(analyticsRoot, 'views', viewId);
-        const scriptsDir = path.join(viewRoot, 'scripts');
-        await fs_1.promises.mkdir(scriptsDir, { recursive: true });
-        await fs_1.promises.writeFile(path.join(viewRoot, 'view.yaml'), [
-            'version: 1.0.0',
-            `id: ${viewId}`,
-            'name: Cost Ops',
-            'description: Cost dashboard widgets',
-            'tags:',
-            '  - cost',
-            'scope: global',
-            'scripts:',
-            '  - cost-widget.js',
-        ].join('\n'), 'utf-8');
-        await fs_1.promises.writeFile(path.join(scriptsDir, 'cost-widget.js'), 'console.log("ok");\n', 'utf-8');
-        await fs_1.promises.mkdir(path.join(analyticsRoot, 'panel'), { recursive: true });
-        await fs_1.promises.writeFile(path.join(analyticsRoot, 'panel', 'views.yaml'), [
-            'version: 1',
-            'activeViewId: global',
-            'views:',
-            '  - id: global',
-            '    name: Global',
-            '    scope: global',
-            '    scripts: []',
-            '    system: true',
-            `  - id: ${viewId}`,
-            '    name: Cost Ops',
-            '    scope: global',
-            '    scripts:',
-            '      - cost-widget.js',
-        ].join('\n'), 'utf-8');
-        const summary = {
-            id: viewId,
-            name: 'Cost Ops',
-            scope: 'global',
-            scripts: ['cost-widget.js'],
-            viewRoot,
-            viewsConfigPath: path.join(analyticsRoot, 'panel', 'views.yaml'),
-            analyticsRoot,
-            sourceLabel: 'workspace',
-        };
-        const result = await (0, publish_1.validateViewForPublish)(summary);
-        assert.strictEqual(result.valid, true, result.errors.join('; '));
-        assert.strictEqual(result.metadata?.publishVersion, '1.0.0');
-        const files = await (0, publish_1.collectViewFiles)(summary, '1.0.0', result.metadata);
-        const viewYaml = files.find(file => file.path === 'view.yaml');
-        assert.ok(viewYaml);
-        assert.ok(viewYaml.content.includes('version: 1.0.0'));
-        assert.ok(!viewYaml.content.includes('semver:'));
-        assert.ok(files.some(file => file.path === 'view.yaml'));
-        assert.ok(files.some(file => file.path === 'panel-entry.yaml'));
-        assert.ok(files.some(file => file.path === 'scripts/cost-widget.js'));
-        assert.ok(!files.some(file => file.path.startsWith('assets/')));
-    });
-    test('full bundle includes charts, exports, and manifest.json', async () => {
-        const viewId = 'fleet-copy';
-        const analyticsRoot = path.join(tempDir, 'analytics-d');
-        const viewRoot = path.join(analyticsRoot, 'views', viewId);
-        const chartsDir = path.join(viewRoot, 'charts');
-        const exportsDir = path.join(viewRoot, 'exports');
-        await fs_1.promises.mkdir(chartsDir, { recursive: true });
-        await fs_1.promises.mkdir(exportsDir, { recursive: true });
-        await fs_1.promises.writeFile(path.join(viewRoot, 'view.yaml'), [
-            'version: 1.0.0',
-            `id: ${viewId}`,
-            'name: Fleet Copy',
-            'description: Fleet dashboard',
-            'tags:',
-            '  - fleet',
-            'scope: global',
-            'scripts: []',
-        ].join('\n'), 'utf-8');
-        await fs_1.promises.writeFile(path.join(chartsDir, 'agent-fleet.html'), '<html></html>\n', 'utf-8');
-        await fs_1.promises.writeFile(path.join(exportsDir, 'fleet.json'), '{"sessions":[]}\n', 'utf-8');
-        await fs_1.promises.writeFile(path.join(viewRoot, 'manifest.json'), '{"version":1,"artifacts":[{"filename":"agent-fleet.html"}]}\n', 'utf-8');
-        const summary = {
-            id: viewId,
-            name: 'Fleet Copy',
-            scope: 'global',
-            scripts: [],
-            viewRoot,
-            viewsConfigPath: path.join(analyticsRoot, 'panel', 'views.yaml'),
-            analyticsRoot,
-            sourceLabel: 'workspace',
-        };
-        const validation = await (0, publish_1.validateViewForPublish)(summary, { mode: 'full' });
-        assert.strictEqual(validation.valid, true, validation.errors.join('; '));
-        const files = await (0, publish_1.collectViewFiles)(summary, '1.0.0', validation.metadata, 'full');
-        assert.ok(files.some(file => file.path === 'charts/agent-fleet.html'));
-        assert.ok(files.some(file => file.path === 'exports/fleet.json'));
-        assert.ok(files.some(file => file.path === 'manifest.json'));
-    });
-    test('full bundle validates static-only view and encodes binary assets', async () => {
-        const viewId = 'brand-board';
-        const analyticsRoot = path.join(tempDir, 'analytics-b');
-        const viewRoot = path.join(analyticsRoot, 'views', viewId);
-        const imagesDir = path.join(viewRoot, 'images');
-        await fs_1.promises.mkdir(imagesDir, { recursive: true });
-        await fs_1.promises.writeFile(path.join(viewRoot, 'view.yaml'), [
-            'version: 1.0.0',
-            `id: ${viewId}`,
-            'name: Brand Board',
-            'description: Static logo board',
-            'tags:',
-            '  - brand',
-            'scope: global',
-            'scripts: []',
-        ].join('\n'), 'utf-8');
-        // Minimal PNG (1x1)
-        const pngBytes = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg==', 'base64');
-        await fs_1.promises.writeFile(path.join(imagesDir, 'logo.png'), pngBytes);
-        const summary = {
-            id: viewId,
-            name: 'Brand Board',
-            scope: 'global',
-            scripts: [],
-            viewRoot,
-            viewsConfigPath: path.join(analyticsRoot, 'panel', 'views.yaml'),
-            analyticsRoot,
-            sourceLabel: 'workspace',
-        };
-        const validation = await (0, publish_1.validateViewForPublish)(summary, { mode: 'full' });
-        assert.strictEqual(validation.valid, true, validation.errors.join('; '));
-        assert.strictEqual(validation.metadata?.publishBundle, 'full');
-        const files = await (0, publish_1.collectViewFiles)(summary, '1.0.0', validation.metadata, 'full');
-        const logo = files.find(file => file.path === 'images/logo.png');
-        assert.ok(logo, 'expected images/logo.png in bundle');
-        assert.strictEqual(logo.encoding, 'base64');
-        assert.strictEqual(Buffer.from(logo.content, 'base64').compare(pngBytes), 0);
-        const manifest = files.find(file => file.path === 'view.yaml');
-        assert.ok(manifest?.content.includes('publishBundle: full'));
-    });
-    test('publish bundle round-trips through workspace install', async () => {
-        const viewId = 'round-trip';
-        const sourceRoot = path.join(tempDir, 'source-ws');
-        const targetRoot = path.join(tempDir, 'target-ws');
-        const analyticsRoot = path.join(sourceRoot, '.agent-hippo', 'analytics');
-        const viewRoot = path.join(analyticsRoot, 'views', viewId);
-        const scriptsDir = path.join(viewRoot, 'scripts');
-        await fs_1.promises.mkdir(scriptsDir, { recursive: true });
-        await fs_1.promises.writeFile(path.join(viewRoot, 'view.yaml'), [
-            'version: 1.0.0',
-            `id: ${viewId}`,
-            'name: Round Trip',
-            'description: Publish then install smoke test',
-            'scope: workspace',
-            'scripts:',
-            '  - smoke-widget.js',
-        ].join('\n'), 'utf-8');
-        await fs_1.promises.writeFile(path.join(scriptsDir, 'smoke-widget.js'), 'export const ok = true;\n', 'utf-8');
-        await fs_1.promises.mkdir(path.join(analyticsRoot, 'panel'), { recursive: true });
-        await fs_1.promises.writeFile(path.join(analyticsRoot, 'panel', 'views.yaml'), [
-            'version: 1',
-            'activeViewId: workspace',
-            'views:',
-            '  - id: workspace',
-            '    name: Workspace',
-            '    scope: workspace',
-            '    scripts: []',
-            '    system: true',
-            `  - id: ${viewId}`,
-            '    name: Round Trip',
-            '    scope: workspace',
-            '    scripts:',
-            '      - smoke-widget.js',
-        ].join('\n'), 'utf-8');
-        const summary = {
-            id: viewId,
-            name: 'Round Trip',
-            scope: 'workspace',
-            scripts: ['smoke-widget.js'],
-            viewRoot,
-            viewsConfigPath: path.join(analyticsRoot, 'panel', 'views.yaml'),
-            analyticsRoot,
-            sourceLabel: 'workspace',
-        };
-        const validation = await (0, publish_1.validateViewForPublish)(summary);
-        assert.strictEqual(validation.valid, true, validation.errors.join('; '));
-        const bundle = await (0, publish_1.collectViewFiles)(summary, '1.0.0', validation.metadata);
-        const installFiles = bundle.map(file => ({
-            path: file.path,
-            content: file.encoding === 'base64'
-                ? Buffer.from(file.content, 'base64')
-                : file.content,
-        }));
-        const installed = await (0, install_1.installSpotlightViewFromFiles)(installFiles, {
-            slug: viewId,
-            workspaceRoot: targetRoot,
-            overwrite: true,
-            activate: true,
-        });
-        assert.strictEqual(installed.id, viewId);
-        assert.strictEqual(installed.scope, 'workspace');
-        assert.ok(installed.installDir.includes(targetRoot));
-        await fs_1.promises.access(path.join(installed.installDir, 'scripts', 'smoke-widget.js'));
-        const viewsConfig = (0, yaml_1.parseSpotlightYamlRecord)(await fs_1.promises.readFile(installed.viewsConfigPath, 'utf-8'));
-        assert.ok(viewsConfig);
-        assert.strictEqual(viewsConfig.activeViewId, viewId);
-        const views = viewsConfig.views;
-        assert.ok(views.some(entry => entry.id === viewId));
-        const runtimeYaml = await fs_1.promises.readFile(path.join(installed.installDir, 'view.yaml'), 'utf-8');
-        assert.ok(runtimeYaml.includes('storeVersion: 1.0.0') || runtimeYaml.includes('storeVersion: \'1.0.0\''));
-    });
-    test('scripts-only rejects view with no scripts', async () => {
-        const viewId = 'empty-view';
-        const viewRoot = path.join(tempDir, 'analytics-c', 'views', viewId);
-        await fs_1.promises.mkdir(viewRoot, { recursive: true });
-        const summary = {
-            id: viewId,
-            name: 'Empty',
-            scope: 'global',
-            scripts: [],
-            viewRoot,
-            viewsConfigPath: path.join(tempDir, 'panel', 'views.yaml'),
-            analyticsRoot: path.join(tempDir, 'analytics-c'),
-            sourceLabel: 'workspace',
-        };
-        const result = await (0, publish_1.validateViewForPublish)(summary, { mode: 'scripts-only' });
-        assert.strictEqual(result.valid, false);
-        assert.ok(result.errors.some(error => error.includes('no scripts')));
-    });
-    test('installSpotlightViewFromFiles rejects bundle entries that escape the install dir', async () => {
-        const viewId = 'evil-view';
-        const targetRoot = path.join(tempDir, 'traversal-target');
-        await fs_1.promises.mkdir(targetRoot, { recursive: true });
-        const manifest = [
-            'version: 1.0.0',
-            `id: ${viewId}`,
-            'name: Evil',
-            'scope: workspace',
-            'scripts:',
-            '  - w.js',
-        ].join('\n');
-        const files = [
-            { path: 'view.yaml', content: manifest },
-            { path: 'panel-entry.yaml', content: manifest },
-            { path: 'scripts/w.js', content: 'console.log(1)' },
-            // Passes the raw "scripts/" prefix check but resolves outside the install dir.
-            { path: 'scripts/../../../escaped.txt', content: 'pwned' },
-        ];
-        await assert.rejects((0, install_1.installSpotlightViewFromFiles)(files, {
-            slug: viewId,
-            workspaceRoot: targetRoot,
-            overwrite: true,
-            activate: false,
-        }), /escapes the install directory/);
-        // The traversal target (analyticsRoot/escaped.txt) must not have been written.
-        await assert.rejects(fs_1.promises.access(path.join(targetRoot, '.agent-hippo', 'analytics', 'escaped.txt')));
-    });
-});

package/out/test/spotlightYaml.test.js

@@ -1,58 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-require("mocha");
-const assert = __importStar(require("assert"));
-const yaml_1 = require("../spotlight/yaml");
-suite('spotlightYaml', () => {
-    test('parse and dump round-trip preserves object fields', () => {
-        const input = {
-            version: 1,
-            activeViewId: 'global',
-            views: [{ id: 'custom', name: 'Custom', scope: 'global', scripts: ['a.js'] }],
-        };
-        const parsed = (0, yaml_1.parseSpotlightYamlRecord)((0, yaml_1.dumpSpotlightYaml)(input));
-        assert.ok(parsed);
-        assert.strictEqual(parsed.activeViewId, 'global');
-        assert.strictEqual(parsed.views.length, 1);
-    });
-    test('normalizeSpotlightViewId matches dashboard normalizer', () => {
-        assert.strictEqual((0, yaml_1.normalizeSpotlightViewId)('Cost Ops'), 'cost-ops');
-        assert.strictEqual((0, yaml_1.normalizeSpotlightViewId)(undefined, 'fallback'), 'fallback');
-    });
-});

package/out/test/state-sync-peer.test.js

@@ -1,156 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Tests for serve-v3 #2 (S3 state config), #4 (PeerInfo → user_id), and serve-v4 P1.2.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-require("mocha");
-const assert = __importStar(require("assert"));
-const fs = __importStar(require("fs"));
-const os = __importStar(require("os"));
-const path = __importStar(require("path"));
-const state_sync_1 = require("../cli/state-sync");
-const serve_hardening_1 = require("../cli/serve-hardening");
-suite('state-sync: resolveS3StateConfig', () => {
-    test('disabled when no URI', () => {
-        assert.strictEqual((0, state_sync_1.resolveS3StateConfig)({}), null);
-    });
-    test('parses URI and trims trailing slashes', () => {
-        const c = (0, state_sync_1.resolveS3StateConfig)({ AGENTHIPPO_STATE_S3_URI: 's3://bkt/agent/' });
-        assert.deepStrictEqual(c, { uri: 's3://bkt/agent', endpoint: undefined });
-    });
-    test('carries a custom endpoint (MinIO/R2)', () => {
-        const c = (0, state_sync_1.resolveS3StateConfig)({ AGENTHIPPO_STATE_S3_URI: 's3://bkt', AGENTHIPPO_STATE_S3_ENDPOINT: 'http://minio:9000' });
-        assert.strictEqual(c?.endpoint, 'http://minio:9000');
-    });
-});
-suite('state-sync: restore boot mode', () => {
-    test('defaults to all', () => {
-        assert.strictEqual((0, state_sync_1.resolveRestoreBootMode)({}), 'all');
-    });
-    test('none when set', () => {
-        assert.strictEqual((0, state_sync_1.resolveRestoreBootMode)({ AGENTHIPPO_STATE_RESTORE_BOOT: 'none' }), 'none');
-    });
-});
-suite('state-sync: session id helpers', () => {
-    test('safeSessionId strips path chars', () => {
-        assert.strictEqual((0, state_sync_1.safeSessionId)('a/b:c'), 'a_b_c');
-        assert.strictEqual((0, state_sync_1.safeSessionId)(''), 'session');
-    });
-    test('sessionRemoteUri nests under sessions/', () => {
-        assert.strictEqual((0, state_sync_1.sessionRemoteUri)({ uri: 's3://bkt/p' }, 's1'), 's3://bkt/p/sessions/s1');
-    });
-    test('shardBelongsToSession matches key and value', () => {
-        assert.ok((0, state_sync_1.shardBelongsToSession)('claude:s1:pack:abc', 's1'));
-        assert.ok((0, state_sync_1.shardBelongsToSession)('x:other:pack:abc', 's1', { chatSessionId: 's1' }));
-        assert.ok(!(0, state_sync_1.shardBelongsToSession)('claude:s2:pack:abc', 's1'));
-    });
-});
-suite('state-sync: stage + merge session dirs', () => {
-    let tmp;
-    setup(() => {
-        tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'state-sync-'));
-        (0, state_sync_1.clearRestoreAttemptCache)();
-    });
-    teardown(() => {
-        fs.rmSync(tmp, { recursive: true, force: true });
-        (0, state_sync_1.clearRestoreAttemptCache)();
-    });
-    test('stages only matching provider-session shards; the shared agents/ SDK cache is never staged', async () => {
-        const ps = path.join(tmp, 'provider-sessions');
-        fs.mkdirSync(ps, { recursive: true });
-        const key1 = 'claude:sess-a:pack:sig';
-        const key2 = 'claude:sess-b:pack:sig';
-        const f1 = (0, state_sync_1.providerSessionShardName)(key1);
-        const f2 = (0, state_sync_1.providerSessionShardName)(key2);
-        fs.writeFileSync(path.join(ps, f1), JSON.stringify({ key: key1, value: { chatSessionId: 'sess-a', id: 'n1' } }));
-        fs.writeFileSync(path.join(ps, f2), JSON.stringify({ key: key2, value: { chatSessionId: 'sess-b', id: 'n2' } }));
-        // agents/ holds the SDK's own cache, shared across every session/user of this pack
-        // on the replica — must never be swept into a single session's staging tree.
-        fs.mkdirSync(path.join(tmp, 'agents', 'pack', 'claude'), { recursive: true });
-        fs.writeFileSync(path.join(tmp, 'agents', 'pack', 'claude', 'marker'), 'x');
-        const staging = path.join(tmp, 'staging');
-        const ok = await (0, state_sync_1.stageSessionPushDir)(tmp, 'sess-a', staging);
-        assert.strictEqual(ok, true);
-        assert.ok(fs.existsSync(path.join(staging, 'provider-sessions', f1)));
-        assert.ok(!fs.existsSync(path.join(staging, 'provider-sessions', f2)));
-        assert.ok(!fs.existsSync(path.join(staging, 'agents')), 'agents/ must not be staged into a per-session push');
-        const shards = await (0, state_sync_1.listSessionShardFiles)(tmp, 'sess-a');
-        assert.deepStrictEqual(shards, [f1]);
-        assert.strictEqual(await (0, state_sync_1.hasLocalSessionState)(tmp, 'sess-a'), true);
-        assert.strictEqual(await (0, state_sync_1.hasLocalSessionState)(tmp, 'sess-missing'), false);
-    });
-    test('a session with no shards but a live agents/ dir has nothing to push', async () => {
-        fs.mkdirSync(path.join(tmp, 'agents', 'pack', 'claude'), { recursive: true });
-        fs.writeFileSync(path.join(tmp, 'agents', 'pack', 'claude', 'marker'), 'x');
-        const staging = path.join(tmp, 'staging');
-        const ok = await (0, state_sync_1.stageSessionPushDir)(tmp, 'sess-none', staging);
-        assert.strictEqual(ok, false, 'agents/ content alone must not count as this session having content to push');
-    });
-    test('mergeSessionStagingIntoState copies shards only; never touches the destination agents/ dir', async () => {
-        const staging = path.join(tmp, 'from');
-        const dest = path.join(tmp, 'to');
-        fs.mkdirSync(path.join(staging, 'provider-sessions'), { recursive: true });
-        fs.writeFileSync(path.join(staging, 'provider-sessions', 'abc.json'), JSON.stringify({ key: 'claude:s1:p:s', value: { chatSessionId: 's1' } }));
-        // Simulate a stale staging tree that (pre-fix) would have carried an old agents/
-        // snapshot — restoring it must not force-overwrite another session's live SDK cache.
-        fs.mkdirSync(path.join(staging, 'agents', 'p'), { recursive: true });
-        fs.writeFileSync(path.join(staging, 'agents', 'p', 'f'), 'stale');
-        fs.mkdirSync(path.join(dest, 'agents', 'p'), { recursive: true });
-        fs.writeFileSync(path.join(dest, 'agents', 'p', 'f'), 'live-for-another-session');
-        await (0, state_sync_1.mergeSessionStagingIntoState)(staging, dest);
-        assert.ok(fs.existsSync(path.join(dest, 'provider-sessions', 'abc.json')));
-        assert.strictEqual(fs.readFileSync(path.join(dest, 'agents', 'p', 'f'), 'utf8'), 'live-for-another-session', 'the live agents/ dir must survive a restore of an unrelated staging tree untouched');
-    });
-});
-suite('peerToUserId (#4 — channel sender → per-user id)', () => {
-    test('undefined for no peer', () => {
-        assert.strictEqual((0, serve_hardening_1.peerToUserId)(undefined), undefined);
-        assert.strictEqual((0, serve_hardening_1.peerToUserId)({}), undefined);
-    });
-    test('prefers stable senderId, namespaced by channel', () => {
-        assert.strictEqual((0, serve_hardening_1.peerToUserId)({ senderId: 'U0B6', senderUsername: 'priya', channel: 'slack' }), 'slack:U0B6');
-    });
-    test('falls back to username then name', () => {
-        assert.strictEqual((0, serve_hardening_1.peerToUserId)({ senderUsername: 'priya', channel: 'slack' }), 'slack:priya');
-        assert.strictEqual((0, serve_hardening_1.peerToUserId)({ senderName: 'Priya', channel: 'telegram' }), 'telegram:Priya');
-    });
-    test('no channel → bare id', () => {
-        assert.strictEqual((0, serve_hardening_1.peerToUserId)({ senderId: 'U1' }), 'U1');
-    });
-    test('two Slack users get distinct ids (per-user scoping)', () => {
-        assert.notStrictEqual((0, serve_hardening_1.peerToUserId)({ senderId: 'U1', channel: 'slack' }), (0, serve_hardening_1.peerToUserId)({ senderId: 'U2', channel: 'slack' }));
-    });
-});

package/out/test/store-install-safe.test.js

@@ -1,69 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-require("mocha");
-const assert = __importStar(require("assert"));
-const fs = __importStar(require("node:fs"));
-const os = __importStar(require("node:os"));
-const path = __importStar(require("node:path"));
-const reconcile_1 = require("../pack/reconcile");
-suite('store install path containment', () => {
-    test('safeJoin refuses traversal paths', () => {
-        const root = path.join(os.tmpdir(), 'pack-install-root');
-        assert.strictEqual((0, reconcile_1.safeJoin)(root, '../../etc/passwd'), undefined);
-        assert.strictEqual((0, reconcile_1.safeJoin)(root, '/etc/passwd'), undefined);
-        const ok = (0, reconcile_1.safeJoin)(root, 'agent.yaml');
-        assert.ok(ok?.endsWith(`${path.sep}agent.yaml`));
-    });
-    test('install extract pattern refuses escape before write', async () => {
-        const installDir = fs.mkdtempSync(path.join(os.tmpdir(), 'store-install-'));
-        const files = [{ path: '../escaped.txt', content: Buffer.from('nope') }];
-        let refused = false;
-        for (const file of files) {
-            const filePath = (0, reconcile_1.safeJoin)(installDir, file.path);
-            if (!filePath) {
-                refused = true;
-                continue;
-            }
-            await fs.promises.mkdir(path.dirname(filePath), { recursive: true });
-            await fs.promises.writeFile(filePath, file.content);
-        }
-        assert.strictEqual(refused, true);
-        assert.equal(fs.existsSync(path.join(path.dirname(installDir), 'escaped.txt')), false);
-    });
-});