@aiden-ade/sandbox-agent 0.1.21 → 0.1.23

package/dist/__tests__/daemon.test.js

@@ -0,0 +1,1014 @@
+import { EventEmitter } from "node:events";
+import { chmodSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { createServer } from "node:http";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+const mocks = vi.hoisted(() => ({
+    spawnSync: vi.fn(),
+    io: vi.fn(),
+    coreAgentConstructor: vi.fn(),
+    agentRun: vi.fn(),
+    agentKill: vi.fn(),
+    sendToolResponse: vi.fn(),
+    sendUserMessage: vi.fn(),
+    collectLocalAgentProviderLimits: vi.fn(),
+}));
+vi.mock("node:child_process", async () => {
+    const actual = await vi.importActual("node:child_process");
+    return {
+        ...actual,
+        spawnSync: mocks.spawnSync,
+    };
+});
+vi.mock("socket.io-client", () => ({
+    io: mocks.io,
+}));
+vi.mock("../core-agent.js", () => ({
+    CoreAgent: mocks.coreAgentConstructor,
+}));
+vi.mock("@aiden/shared/node/provider-limits", () => ({
+    collectLocalAgentProviderLimits: mocks.collectLocalAgentProviderLimits,
+}));
+function seedCliBinaries(baseDir) {
+    const binDir = join(baseDir, "bin");
+    mkdirSync(binDir, { recursive: true });
+    for (const name of ["codex", "claude", "gemini", "git"]) {
+        const path = join(binDir, name);
+        writeFileSync(path, "#!/bin/sh\n");
+        chmodSync(path, 0o755);
+    }
+    return binDir;
+}
+class TestSocket extends EventEmitter {
+    connected = true;
+    outbound = [];
+    disconnected = false;
+    emit(event, payload) {
+        this.outbound.push({ event, payload });
+        return super.emit(event, payload);
+    }
+    disconnect() {
+        this.disconnected = true;
+    }
+}
+async function waitForOutbound(socket, event) {
+    for (let attempt = 0; attempt < 100; attempt += 1) {
+        const item = socket.outbound.find((entry) => entry.event === event);
+        if (item) {
+            return item;
+        }
+        await new Promise((resolve) => setTimeout(resolve, 50));
+    }
+    throw new Error(`Timed out waiting for outbound event ${event}`);
+}
+describe("aiden-agent daemon CLI helpers", () => {
+    let tempDir;
+    let configPath;
+    beforeEach(() => {
+        vi.resetModules();
+        vi.unstubAllGlobals();
+        vi.clearAllMocks();
+        tempDir = mkdtempSync(join(tmpdir(), "aiden-agent-test-"));
+        configPath = join(tempDir, "config.json");
+        process.env.AIDEN_AGENT_CONFIG_PATH = configPath;
+        mocks.collectLocalAgentProviderLimits.mockResolvedValue({});
+        mocks.agentRun.mockResolvedValue(undefined);
+        mocks.sendToolResponse.mockReturnValue(true);
+        mocks.sendUserMessage.mockReturnValue(true);
+        mocks.coreAgentConstructor.mockImplementation(function MockCoreAgent() {
+            return {
+                run: mocks.agentRun,
+                kill: mocks.agentKill,
+                sendToolResponse: mocks.sendToolResponse,
+                sendUserMessage: mocks.sendUserMessage,
+            };
+        });
+    });
+    afterEach(() => {
+        delete process.env.AIDEN_AGENT_CONFIG_PATH;
+        delete process.env.AIDEN_API_URL;
+        delete process.env.AIDEN_WS_URL;
+        delete process.env.AIDEN_AGENT_PROFILE;
+        delete process.env.AIDEN_AGENT_ENDPOINTS_PATH;
+        delete process.env.AIDEN_TEAM_ID;
+        delete process.env.AIDEN_SETUP_TOKEN;
+        delete process.env.AIDEN_CODEX_PATH;
+        delete process.env.AIDEN_CLAUDE_PATH;
+        delete process.env.AIDEN_GEMINI_PATH;
+        rmSync(tempDir, { recursive: true, force: true });
+        vi.unstubAllGlobals();
+        vi.unstubAllEnvs();
+    });
+    it("discovers sanitized local capabilities without exposing binary paths", async () => {
+        const binDir = seedCliBinaries(tempDir);
+        process.env.PATH = binDir;
+        vi.stubEnv("SHELL", join(tempDir, "missing-shell"));
+        const { discoverCapabilities } = await import("../daemon.js");
+        const capabilities = discoverCapabilities();
+        expect(capabilities.hasGit).toBe(true);
+        expect(capabilities.hasTerminal).toBe(true);
+        expect(capabilities.supportsFilesystem).toBe(true);
+        expect(capabilities.agents).toHaveLength(9);
+        expect(capabilities.agents).toEqual(expect.arrayContaining([
+            expect.objectContaining({
+                provider: "codex_app_server",
+                available: true,
+                models: [],
+            }),
+            expect.objectContaining({
+                provider: "claude_cli",
+                available: true,
+            }),
+        ]));
+        expect(capabilities.agents.every((agent) => agent.version === undefined)).toBe(true);
+        expect(mocks.spawnSync).not.toHaveBeenCalled();
+        expect(JSON.stringify(capabilities)).not.toContain("/Users/");
+    });
+    it("setup registers a daemon runtime and persists only runtime config locally", async () => {
+        mocks.spawnSync.mockReturnValue({ status: 1, stdout: "", stderr: "" });
+        const fetchMock = vi.fn().mockResolvedValue({
+            ok: true,
+            json: async () => ({
+                runtime: {
+                    id: "11111111-1111-4111-8111-111111111111",
+                    displayName: "CI Runtime",
+                },
+                runtimeToken: "aiden_runtime_secret",
+            }),
+        });
+        vi.stubGlobal("fetch", fetchMock);
+        const { setupDaemon } = await import("../daemon.js");
+        await setupDaemon([
+            "--api-url",
+            "http://api.test",
+            "--ws-url",
+            "ws://ws.test",
+            "--team",
+            "22222222-2222-4222-8222-222222222222",
+            "--token",
+            "aiden_pat_secret",
+            "--name",
+            "CI Runtime",
+            "--legacy-local-machine-id",
+            "33333333-3333-4333-8333-333333333333",
+        ]);
+        expect(fetchMock).toHaveBeenCalledWith("http://api.test/public/runtimes", expect.objectContaining({
+            method: "POST",
+            headers: expect.objectContaining({
+                authorization: "Bearer aiden_pat_secret",
+            }),
+        }));
+        const body = JSON.parse(fetchMock.mock.calls[0][1].body);
+        expect(body).toMatchObject({
+            teamId: "22222222-2222-4222-8222-222222222222",
+            displayName: "CI Runtime",
+            runtimeKind: "machine",
+            hostKind: "daemon",
+            lifecycle: "durable",
+            ownerType: "team",
+            visibility: "team",
+            legacyLocalMachineId: "33333333-3333-4333-8333-333333333333",
+        });
+        const saved = JSON.parse(readFileSync(configPath, "utf8"));
+        expect(saved).toEqual({
+            apiUrl: "http://api.test",
+            wsUrl: "ws://ws.test",
+            endpointProfile: "custom",
+            teamId: "22222222-2222-4222-8222-222222222222",
+            runtimeId: "11111111-1111-4111-8111-111111111111",
+            runtimeToken: "aiden_runtime_secret",
+            localApiPort: 47831,
+            localApiToken: expect.any(String),
+            displayName: "CI Runtime",
+        });
+        expect(readFileSync(configPath, "utf8")).not.toContain("aiden_pat_secret");
+    });
+    it("setup uses install-script endpoint defaults when endpoint flags are omitted", async () => {
+        mocks.spawnSync.mockReturnValue({ status: 1, stdout: "", stderr: "" });
+        const endpointsPath = join(tempDir, "endpoints.json");
+        process.env.AIDEN_AGENT_ENDPOINTS_PATH = endpointsPath;
+        writeFileSync(endpointsPath, JSON.stringify({
+            apiUrl: "https://preview-api.aiden-platform.com",
+            wsUrl: "wss://preview-ws.aiden-platform.com",
+            endpointProfile: "custom",
+        }));
+        const fetchMock = vi.fn().mockResolvedValue({
+            ok: true,
+            json: async () => ({
+                runtime: {
+                    id: "11111111-1111-4111-8111-111111111111",
+                    displayName: "Installed Runtime",
+                },
+                runtimeToken: "aiden_runtime_secret",
+            }),
+        });
+        vi.stubGlobal("fetch", fetchMock);
+        const { setupDaemon } = await import("../daemon.js");
+        await setupDaemon(["--setup-token", "aiden_setup_secret", "--name", "Installed Runtime"]);
+        expect(fetchMock).toHaveBeenCalledWith("https://preview-api.aiden-platform.com/public/runtimes/register-with-setup-token", expect.objectContaining({ method: "POST" }));
+        const saved = JSON.parse(readFileSync(configPath, "utf8"));
+        expect(saved).toMatchObject({
+            apiUrl: "https://preview-api.aiden-platform.com",
+            wsUrl: "wss://preview-ws.aiden-platform.com",
+            endpointProfile: "custom",
+            runtimeId: "11111111-1111-4111-8111-111111111111",
+            runtimeToken: "aiden_runtime_secret",
+        });
+    });
+    it("setup fails fast without team and setup token", async () => {
+        const { setupDaemon } = await import("../daemon.js");
+        await expect(setupDaemon(["--team", "22222222-2222-4222-8222-222222222222"])).rejects.toThrow("setup requires --setup-token <token>");
+    });
+    it("setup can register with a short-lived runtime setup token without storing a PAT", async () => {
+        mocks.spawnSync.mockReturnValue({ status: 1, stdout: "", stderr: "" });
+        const fetchMock = vi.fn().mockResolvedValue({
+            ok: true,
+            json: async () => ({
+                runtime: {
+                    id: "11111111-1111-4111-8111-111111111111",
+                    displayName: "Headless CI",
+                },
+                runtimeToken: "aiden_runtime_secret",
+            }),
+        });
+        vi.stubGlobal("fetch", fetchMock);
+        const { setupDaemon } = await import("../daemon.js");
+        await setupDaemon([
+            "--api-url",
+            "http://api.test",
+            "--ws-url",
+            "ws://ws.test",
+            "--setup-token",
+            "aiden_setup_secret",
+            "--name",
+            "Headless CI",
+        ]);
+        expect(fetchMock).toHaveBeenCalledWith("http://api.test/public/runtimes/register-with-setup-token", expect.objectContaining({
+            method: "POST",
+            headers: { "content-type": "application/json" },
+        }));
+        const body = JSON.parse(fetchMock.mock.calls[0][1].body);
+        expect(body).toMatchObject({
+            setupToken: "aiden_setup_secret",
+            displayName: "Headless CI",
+            runtimeKind: "machine",
+            hostKind: "daemon",
+            ownerType: "team",
+            visibility: "team",
+        });
+        expect(body).not.toHaveProperty("token");
+        const saved = JSON.parse(readFileSync(configPath, "utf8"));
+        expect(saved.runtimeToken).toBe("aiden_runtime_secret");
+        expect(readFileSync(configPath, "utf8")).not.toContain("aiden_setup_secret");
+    });
+    it("setup can register a personal runtime with a setup token", async () => {
+        mocks.spawnSync.mockReturnValue({ status: 1, stdout: "", stderr: "" });
+        const fetchMock = vi.fn().mockResolvedValue({
+            ok: true,
+            json: async () => ({
+                runtime: {
+                    id: "11111111-1111-4111-8111-111111111111",
+                    displayName: "Personal Laptop",
+                },
+                runtimeToken: "aiden_runtime_secret",
+            }),
+        });
+        vi.stubGlobal("fetch", fetchMock);
+        const { setupDaemon } = await import("../daemon.js");
+        await setupDaemon([
+            "--api-url",
+            "http://api.test",
+            "--ws-url",
+            "ws://ws.test",
+            "--setup-token",
+            "aiden_setup_secret",
+            "--scope",
+            "user",
+            "--name",
+            "Personal Laptop",
+        ]);
+        const body = JSON.parse(fetchMock.mock.calls[0][1].body);
+        expect(body).toMatchObject({
+            setupToken: "aiden_setup_secret",
+            displayName: "Personal Laptop",
+            ownerType: "user",
+            visibility: "user",
+        });
+    });
+    it("setup uses production endpoints by default for installable package users", async () => {
+        mocks.spawnSync.mockReturnValue({ status: 1, stdout: "", stderr: "" });
+        const fetchMock = vi.fn().mockResolvedValue({
+            ok: true,
+            json: async () => ({
+                runtime: {
+                    id: "11111111-1111-4111-8111-111111111111",
+                    displayName: "Prod Runtime",
+                },
+                runtimeToken: "aiden_runtime_secret",
+            }),
+        });
+        vi.stubGlobal("fetch", fetchMock);
+        const { setupDaemon } = await import("../daemon.js");
+        await setupDaemon(["--setup-token", "aiden_setup_secret"]);
+        expect(fetchMock).toHaveBeenCalledWith("https://api.aiden-platform.com/public/runtimes/register-with-setup-token", expect.objectContaining({ method: "POST" }));
+        const saved = JSON.parse(readFileSync(configPath, "utf8"));
+        expect(saved).toMatchObject({
+            apiUrl: "https://api.aiden-platform.com",
+            wsUrl: "wss://ws.aiden-platform.com",
+            endpointProfile: "production",
+        });
+    });
+    it("setup uses localhost only when explicitly requested with local profile", async () => {
+        mocks.spawnSync.mockReturnValue({ status: 1, stdout: "", stderr: "" });
+        const fetchMock = vi.fn().mockResolvedValue({
+            ok: true,
+            json: async () => ({
+                runtime: {
+                    id: "11111111-1111-4111-8111-111111111111",
+                    displayName: "Local Runtime",
+                },
+                runtimeToken: "aiden_runtime_secret",
+            }),
+        });
+        vi.stubGlobal("fetch", fetchMock);
+        const { setupDaemon } = await import("../daemon.js");
+        await setupDaemon(["--profile", "local", "--setup-token", "aiden_setup_secret"]);
+        expect(fetchMock).toHaveBeenCalledWith("http://localhost:8400/public/runtimes/register-with-setup-token", expect.objectContaining({ method: "POST" }));
+        const saved = JSON.parse(readFileSync(configPath, "utf8"));
+        expect(saved).toMatchObject({
+            apiUrl: "http://localhost:8400",
+            wsUrl: "ws://localhost:8401",
+            endpointProfile: "local",
+        });
+    });
+    it("rejects startDaemon when an aiden-agent daemon is already listening", async () => {
+        writeFileSync(configPath, JSON.stringify({
+            runtimeId: "11111111-1111-4111-8111-111111111111",
+            runtimeToken: "aiden_runtime_secret",
+            wsUrl: "ws://ws.test",
+            localApiToken: "local-secret",
+        }));
+        const existing = createServer((req, res) => {
+            if (req.method === "GET" && req.url === "/status") {
+                res.writeHead(200, { "content-type": "application/json" }).end(JSON.stringify({
+                    configured: true,
+                    runtimeId: "11111111-1111-4111-8111-111111111111",
+                    wsUrl: "ws://ws.test",
+                    connected: true,
+                    activeRunIds: [],
+                    localApiPort: 47831,
+                    version: "test",
+                }));
+                return;
+            }
+            res.writeHead(404).end();
+        });
+        await new Promise((resolve) => existing.listen(0, "127.0.0.1", resolve));
+        const address = existing.address();
+        const port = typeof address === "object" && address ? address.port : 47831;
+        const socket = new TestSocket();
+        mocks.io.mockReturnValue(socket);
+        const { startDaemon } = await import("../daemon.js");
+        await expect(startDaemon(["--local-api-port", String(port)])).rejects.toThrow("already in use");
+        expect(socket.disconnected).toBe(true);
+        await new Promise((resolve, reject) => {
+            existing.close((error) => (error ? reject(error) : resolve()));
+        });
+    });
+    it("runDaemon exits successfully when the local daemon is listening with a stale token", async () => {
+        writeFileSync(configPath, JSON.stringify({
+            runtimeId: "11111111-1111-4111-8111-111111111111",
+            runtimeToken: "aiden_runtime_secret",
+            wsUrl: "ws://ws.test",
+            localApiToken: "stale-token",
+        }));
+        const existing = createServer((req, res) => {
+            if (req.method === "GET" && req.url === "/status") {
+                res
+                    .writeHead(401, { "content-type": "application/json" })
+                    .end(JSON.stringify({ error: "Unauthorized" }));
+                return;
+            }
+            res.writeHead(404).end();
+        });
+        await new Promise((resolve) => existing.listen(0, "127.0.0.1", resolve));
+        const address = existing.address();
+        const port = typeof address === "object" && address ? address.port : 47831;
+        const info = vi.spyOn(console, "info").mockImplementation(() => { });
+        const { runDaemon } = await import("../daemon.js");
+        await runDaemon(["--local-api-port", String(port)]);
+        expect(mocks.io).not.toHaveBeenCalled();
+        expect(info).toHaveBeenCalledWith("[aiden-agent] Daemon already running", expect.objectContaining({ port }));
+        await new Promise((resolve, reject) => {
+            existing.close((error) => (error ? reject(error) : resolve()));
+        });
+    });
+    it("runDaemon exits successfully when the local daemon is already running", async () => {
+        writeFileSync(configPath, JSON.stringify({
+            runtimeId: "11111111-1111-4111-8111-111111111111",
+            runtimeToken: "aiden_runtime_secret",
+            wsUrl: "ws://ws.test",
+            localApiToken: "local-secret",
+        }));
+        const existing = createServer((req, res) => {
+            if (req.method === "GET" && req.url === "/status") {
+                res.writeHead(200, { "content-type": "application/json" }).end(JSON.stringify({
+                    configured: true,
+                    runtimeId: "11111111-1111-4111-8111-111111111111",
+                    wsUrl: "ws://ws.test",
+                    connected: true,
+                    activeRunIds: [],
+                    localApiPort: 47831,
+                    version: "test",
+                }));
+                return;
+            }
+            res.writeHead(404).end();
+        });
+        await new Promise((resolve) => existing.listen(0, "127.0.0.1", resolve));
+        const address = existing.address();
+        const port = typeof address === "object" && address ? address.port : 47831;
+        const info = vi.spyOn(console, "info").mockImplementation(() => { });
+        const { runDaemon } = await import("../daemon.js");
+        await runDaemon(["--local-api-port", String(port)]);
+        expect(mocks.io).not.toHaveBeenCalled();
+        expect(info).toHaveBeenCalledWith("[aiden-agent] Daemon already running", expect.objectContaining({
+            runtimeId: "11111111-1111-4111-8111-111111111111",
+        }));
+        await new Promise((resolve, reject) => {
+            existing.close((error) => (error ? reject(error) : resolve()));
+        });
+    });
+    it("explains when the local daemon API port is already in use", async () => {
+        writeFileSync(configPath, JSON.stringify({
+            runtimeId: "11111111-1111-4111-8111-111111111111",
+            runtimeToken: "aiden_runtime_secret",
+            wsUrl: "ws://ws.test",
+            localApiToken: "local-secret",
+        }));
+        const occupied = createServer();
+        await new Promise((resolve) => occupied.listen(0, "127.0.0.1", resolve));
+        const address = occupied.address();
+        const port = typeof address === "object" && address ? address.port : 47831;
+        const socket = new TestSocket();
+        mocks.io.mockReturnValue(socket);
+        const { startDaemon } = await import("../daemon.js");
+        await expect(startDaemon(["--local-api-port", String(port)])).rejects.toThrow("already in use by another process");
+        expect(socket.disconnected).toBe(true);
+        await new Promise((resolve, reject) => {
+            occupied.close((error) => (error ? reject(error) : resolve()));
+        });
+    });
+    it("login starts browser device authorization, polls, and stores runtime config", async () => {
+        mocks.spawnSync.mockReturnValue({ status: 1, stdout: "", stderr: "" });
+        const fetchMock = vi
+            .fn()
+            .mockResolvedValueOnce({
+            ok: true,
+            json: async () => ({
+                deviceCode: "aiden_device_secret",
+                userCode: "ABCD1234",
+                verificationUri: "http://app.test/runtime/device?code=ABCD1234",
+                expiresAt: new Date(Date.now() + 60_000).toISOString(),
+                intervalSeconds: 0,
+            }),
+        })
+            .mockResolvedValueOnce({
+            ok: false,
+            status: 428,
+            json: async () => ({ error: "authorization_pending" }),
+            text: async () => JSON.stringify({ error: "authorization_pending" }),
+        })
+            .mockResolvedValueOnce({
+            ok: true,
+            status: 201,
+            json: async () => ({
+                runtime: {
+                    id: "11111111-1111-4111-8111-111111111111",
+                    displayName: "Browser Login VM",
+                    teamId: "22222222-2222-4222-8222-222222222222",
+                },
+                runtimeToken: "aiden_runtime_browser_secret",
+            }),
+        });
+        vi.stubGlobal("fetch", fetchMock);
+        const info = vi.spyOn(console, "info").mockImplementation(() => { });
+        const { loginWithDeviceCode } = await import("../daemon.js");
+        await loginWithDeviceCode([
+            "--api-url",
+            "http://api.test",
+            "--ws-url",
+            "ws://ws.test",
+            "--name",
+            "Browser Login VM",
+            "--max-polls",
+            "3",
+        ]);
+        expect(fetchMock).toHaveBeenNthCalledWith(1, "http://api.test/public/runtimes/device-authorizations", expect.objectContaining({ method: "POST" }));
+        expect(fetchMock).toHaveBeenNthCalledWith(2, "http://api.test/public/runtimes/device-authorizations/token", expect.objectContaining({
+            method: "POST",
+            body: JSON.stringify({ deviceCode: "aiden_device_secret" }),
+        }));
+        expect(fetchMock).toHaveBeenCalledTimes(3);
+        expect(info.mock.calls.some((call) => String(call[0]).includes("ABCD1234"))).toBe(true);
+        const saved = JSON.parse(readFileSync(configPath, "utf8"));
+        expect(saved).toMatchObject({
+            apiUrl: "http://api.test",
+            wsUrl: "ws://ws.test",
+            endpointProfile: "custom",
+            teamId: "22222222-2222-4222-8222-222222222222",
+            runtimeId: "11111111-1111-4111-8111-111111111111",
+            runtimeToken: "aiden_runtime_browser_secret",
+            displayName: "Browser Login VM",
+        });
+        expect(readFileSync(configPath, "utf8")).not.toContain("aiden_device_secret");
+    });
+    it("login uses production endpoint defaults", async () => {
+        mocks.spawnSync.mockReturnValue({ status: 1, stdout: "", stderr: "" });
+        const fetchMock = vi
+            .fn()
+            .mockResolvedValueOnce({
+            ok: true,
+            json: async () => ({
+                deviceCode: "aiden_device_secret",
+                userCode: "ABCD1234",
+                verificationUri: "https://app.aiden-platform.com/runtime/device?code=ABCD1234",
+                expiresAt: new Date(Date.now() + 60_000).toISOString(),
+                intervalSeconds: 0,
+            }),
+        })
+            .mockResolvedValueOnce({
+            ok: true,
+            status: 201,
+            json: async () => ({
+                runtime: {
+                    id: "11111111-1111-4111-8111-111111111111",
+                    displayName: "Prod Login Runtime",
+                    teamId: "22222222-2222-4222-8222-222222222222",
+                },
+                runtimeToken: "aiden_runtime_browser_secret",
+            }),
+        });
+        vi.stubGlobal("fetch", fetchMock);
+        vi.spyOn(console, "info").mockImplementation(() => { });
+        const { loginWithDeviceCode } = await import("../daemon.js");
+        await loginWithDeviceCode(["--max-polls", "1"]);
+        expect(fetchMock).toHaveBeenNthCalledWith(1, "https://api.aiden-platform.com/public/runtimes/device-authorizations", expect.objectContaining({ method: "POST" }));
+        const saved = JSON.parse(readFileSync(configPath, "utf8"));
+        expect(saved).toMatchObject({
+            apiUrl: "https://api.aiden-platform.com",
+            wsUrl: "wss://ws.aiden-platform.com",
+            endpointProfile: "production",
+        });
+    });
+    it("setup preserves local config when runtime registration fails", async () => {
+        writeFileSync(configPath, JSON.stringify({
+            apiUrl: "http://existing.test",
+            runtimeId: "existing-runtime",
+            runtimeToken: "existing-token",
+        }));
+        vi.stubGlobal("fetch", vi.fn().mockResolvedValue({
+            ok: false,
+            status: 403,
+            text: async () => "forbidden",
+        }));
+        const { setupDaemon } = await import("../daemon.js");
+        await expect(setupDaemon([
+            "--api-url",
+            "http://api.test",
+            "--team",
+            "22222222-2222-4222-8222-222222222222",
+            "--token",
+            "aiden_pat_secret",
+        ])).rejects.toThrow("runtime registration failed: 403 forbidden");
+        expect(JSON.parse(readFileSync(configPath, "utf8"))).toMatchObject({
+            apiUrl: "http://existing.test",
+            runtimeId: "existing-runtime",
+            runtimeToken: "existing-token",
+        });
+    });
+    it("daemon refuses to start without runtime identity, token, and websocket URL", async () => {
+        const { startDaemon } = await import("../daemon.js");
+        await expect(startDaemon(["--runtime-id", "11111111-1111-4111-8111-111111111111"])).rejects.toThrow("daemon requires runtimeId, runtime token, and wsUrl");
+        expect(mocks.io).not.toHaveBeenCalled();
+    });
+    it("daemon connects as a runtime and hands accepted executions to CoreAgent", async () => {
+        const socket = new TestSocket();
+        mocks.io.mockReturnValue(socket);
+        const binDir = seedCliBinaries(tempDir);
+        const codexPath = join(binDir, "codex");
+        process.env.AIDEN_CODEX_PATH = codexPath;
+        mocks.spawnSync.mockReturnValue({ status: 1, stdout: "", stderr: "" });
+        mocks.agentRun.mockReturnValue(new Promise(() => { }));
+        const { startDaemon } = await import("../daemon.js");
+        const controller = await startDaemon([
+            "--runtime-id",
+            "11111111-1111-4111-8111-111111111111",
+            "--token",
+            "aiden_runtime_secret",
+            "--ws-url",
+            "ws://ws.test",
+            "--local-api-port",
+            "0",
+        ]);
+        expect(mocks.io).toHaveBeenCalledWith("ws://ws.test", expect.objectContaining({
+            query: expect.objectContaining({
+                type: "runtime",
+                runtimeId: "11111111-1111-4111-8111-111111111111",
+                hostKind: "daemon",
+            }),
+            auth: { token: "aiden_runtime_secret" },
+            transports: ["websocket"],
+        }));
+        socket.emit("connect");
+        await expect(waitForOutbound(socket, "runtime.hello")).resolves.toEqual(expect.objectContaining({
+            event: "runtime.hello",
+            payload: expect.objectContaining({
+                capabilities: expect.objectContaining({ supportsFilesystem: true }),
+                metadata: expect.objectContaining({
+                    platform: expect.any(String),
+                    arch: expect.any(String),
+                    agentVersion: expect.any(String),
+                    memoryBytes: expect.any(Number),
+                }),
+            }),
+        }));
+        socket.emit("agent.execute", {
+            conversationId: "conversation-1",
+            runId: "run-1",
+            content: "Ship the task",
+            backendKind: "codex",
+            teamId: "team-1",
+            projectPath: "/tmp/workspace",
+            maxIterations: 7,
+        });
+        expect(socket.outbound).toEqual(expect.arrayContaining([{ event: "agent.accepted", payload: { runId: "run-1" } }]));
+        expect(mocks.coreAgentConstructor).toHaveBeenCalledWith(expect.any(Object), {
+            backendKind: "codex_app_server",
+            runtimeCommand: codexPath,
+        });
+        expect(mocks.agentRun).toHaveBeenCalledWith(expect.objectContaining({
+            task: "Ship the task",
+            cwd: "/tmp/workspace",
+            teamPath: "/tmp/workspace",
+            backendKind: "codex_app_server",
+            runtimeCommand: codexPath,
+            conversationId: "conversation-1",
+            teamId: "team-1",
+            maxIterations: 7,
+        }));
+        socket.emit("agent.execute", {
+            conversationId: "conversation-1",
+            runId: "run-1",
+            content: "Duplicate",
+        });
+        expect(socket.outbound).toEqual(expect.arrayContaining([
+            { event: "agent.rejected", payload: { runId: "run-1", message: "Run is already active" } },
+        ]));
+        socket.emit("agent.abort", { runId: "run-1" });
+        expect(mocks.agentKill).toHaveBeenCalled();
+        expect(socket.outbound).toEqual(expect.arrayContaining([
+            {
+                event: "agent.event",
+                payload: expect.objectContaining({
+                    conversationId: "conversation-1",
+                    runId: "run-1",
+                    event: expect.objectContaining({
+                        type: "query_complete",
+                        result: expect.objectContaining({ error: "Interrupted by user", success: false }),
+                    }),
+                }),
+            },
+        ]));
+        expect(socket.disconnected).toBe(false);
+        await controller.stop();
+        expect(socket.disconnected).toBe(true);
+    });
+    it("local daemon API reports status, protects endpoints, streams logs, and stops active runs", async () => {
+        const socket = new TestSocket();
+        mocks.io.mockReturnValue(socket);
+        mocks.spawnSync.mockReturnValue({ status: 1, stdout: "", stderr: "" });
+        mocks.agentRun.mockReturnValue(new Promise(() => { }));
+        const { startDaemon } = await import("../daemon.js");
+        const controller = await startDaemon([
+            "--runtime-id",
+            "11111111-1111-4111-8111-111111111111",
+            "--token",
+            "aiden_runtime_secret",
+            "--ws-url",
+            "ws://ws.test",
+            "--local-api-port",
+            "0",
+        ]);
+        try {
+            const baseUrl = `http://127.0.0.1:${controller.localApiPort}`;
+            const unauthorized = await fetch(`${baseUrl}/status`);
+            expect(unauthorized.status).toBe(401);
+            const missing = await fetch(`${baseUrl}/missing`, {
+                headers: { authorization: `Bearer ${controller.localApiToken}` },
+            });
+            expect(missing.status).toBe(404);
+            socket.emit("connect");
+            socket.emit("agent.execute", {
+                conversationId: "conversation-1",
+                runId: "run-local-api",
+                content: "Keep running",
+            });
+            const headers = { authorization: `Bearer ${controller.localApiToken}` };
+            const status = await fetch(`${baseUrl}/status`, { headers }).then((res) => res.json());
+            expect(status).toMatchObject({
+                configured: true,
+                runtimeId: "11111111-1111-4111-8111-111111111111",
+                connected: true,
+                activeRunIds: ["run-local-api"],
+            });
+            const capabilities = await fetch(`${baseUrl}/capabilities`, { headers }).then((res) => res.json());
+            expect(capabilities).toMatchObject({ hasTerminal: true, supportsFilesystem: true });
+            const logs = await fetch(`${baseUrl}/logs`, { headers }).then((res) => res.json());
+            expect(logs.lines.some((line) => line.includes("accepted run=run-local-api"))).toBe(true);
+            const stopped = await fetch(`${baseUrl}/stop`, { method: "POST", headers }).then((res) => res.json());
+            expect(stopped).toEqual({ ok: true });
+            expect(mocks.agentKill).toHaveBeenCalled();
+            const afterStop = await fetch(`${baseUrl}/status`, { headers }).then((res) => res.json());
+            expect(afterStop.activeRunIds).toEqual([]);
+        }
+        finally {
+            await controller.stop();
+        }
+    });
+    it("POST /shutdown stops the daemon and notifies whenExternallyStopped", async () => {
+        const socket = new TestSocket();
+        mocks.io.mockReturnValue(socket);
+        mocks.spawnSync.mockReturnValue({ status: 1, stdout: "", stderr: "" });
+        const { startDaemon } = await import("../daemon.js");
+        const controller = await startDaemon([
+            "--runtime-id",
+            "11111111-1111-4111-8111-111111111111",
+            "--token",
+            "aiden_runtime_secret",
+            "--ws-url",
+            "ws://ws.test",
+            "--local-api-port",
+            "0",
+        ]);
+        const onStopped = vi.fn();
+        controller.whenExternallyStopped = onStopped;
+        const baseUrl = `http://127.0.0.1:${controller.localApiPort}`;
+        const headers = { authorization: `Bearer ${controller.localApiToken}` };
+        const shutdown = await fetch(`${baseUrl}/shutdown`, { method: "POST", headers }).then((res) => res.json());
+        expect(shutdown).toEqual({ ok: true });
+        await vi.waitFor(() => expect(onStopped).toHaveBeenCalled());
+        expect(socket.disconnected).toBe(true);
+    });
+    it("stopDaemon calls POST /shutdown on a running local daemon", async () => {
+        const socket = new TestSocket();
+        mocks.io.mockReturnValue(socket);
+        mocks.spawnSync.mockReturnValue({ status: 1, stdout: "", stderr: "" });
+        const { startDaemon, stopDaemon } = await import("../daemon.js");
+        const controller = await startDaemon([
+            "--runtime-id",
+            "11111111-1111-4111-8111-111111111111",
+            "--token",
+            "aiden_runtime_secret",
+            "--ws-url",
+            "ws://ws.test",
+            "--local-api-port",
+            "0",
+        ]);
+        writeFileSync(configPath, JSON.stringify({
+            runtimeId: controller.runtimeId,
+            runtimeToken: "aiden_runtime_secret",
+            wsUrl: "ws://ws.test",
+            localApiPort: controller.localApiPort,
+            localApiToken: controller.localApiToken,
+        }));
+        const info = vi.spyOn(console, "info").mockImplementation(() => { });
+        await stopDaemon([]);
+        expect(info).toHaveBeenCalledWith("[aiden-agent] Daemon stopped", expect.objectContaining({
+            port: controller.localApiPort,
+        }));
+        await vi.waitFor(() => expect(socket.disconnected).toBe(true));
+    });
+    it("stopDaemon reports when no daemon is listening", async () => {
+        const freePort = await new Promise((resolve, reject) => {
+            const server = createServer();
+            server.listen(0, "127.0.0.1", () => {
+                const address = server.address();
+                const port = typeof address === "object" && address ? address.port : 0;
+                server.close((error) => (error ? reject(error) : resolve(port)));
+            });
+        });
+        writeFileSync(configPath, JSON.stringify({
+            runtimeId: "11111111-1111-4111-8111-111111111111",
+            runtimeToken: "aiden_runtime_secret",
+            wsUrl: "ws://ws.test",
+            localApiPort: freePort,
+            localApiToken: "local-secret",
+        }));
+        const info = vi.spyOn(console, "info").mockImplementation(() => { });
+        const { stopDaemon } = await import("../daemon.js");
+        await stopDaemon(["--local-api-port", String(freePort)]);
+        expect(info).toHaveBeenCalledWith("[aiden-agent] No daemon listening", { port: freePort });
+    });
+    it("forwards browser tool responses and appended user messages to the active CoreAgent", async () => {
+        const socket = new TestSocket();
+        mocks.io.mockReturnValue(socket);
+        mocks.spawnSync.mockReturnValue({ status: 1, stdout: "", stderr: "" });
+        mocks.agentRun.mockReturnValue(new Promise(() => { }));
+        const { startDaemon } = await import("../daemon.js");
+        const controller = await startDaemon([
+            "--runtime-id",
+            "11111111-1111-4111-8111-111111111111",
+            "--token",
+            "aiden_runtime_secret",
+            "--ws-url",
+            "ws://ws.test",
+            "--local-api-port",
+            "0",
+        ]);
+        try {
+            socket.emit("agent.execute", {
+                conversationId: "conversation-1",
+                runId: "run-interactive",
+                content: "Wait for user input",
+            });
+            socket.emit("agent.tool_response", {
+                runId: "run-interactive",
+                toolId: "tool-1",
+                response: "Approved",
+            });
+            socket.emit("agent.append_message", {
+                runId: "run-interactive",
+                text: "Continue with the implementation",
+            });
+            expect(mocks.sendToolResponse).toHaveBeenCalledWith("tool-1", "Approved");
+            expect(mocks.sendUserMessage).toHaveBeenCalledWith("Continue with the implementation");
+            expect(socket.outbound).toEqual(expect.arrayContaining([{ event: "agent.accepted", payload: { runId: "run-interactive" } }]));
+            socket.emit("agent.append_message", {
+                runId: "missing-run",
+                text: "This should be rejected",
+            });
+            socket.emit("agent.tool_response", {
+                runId: "missing-run",
+                toolId: "missing-tool",
+                response: "Ignored",
+            });
+            expect(socket.outbound).toEqual(expect.arrayContaining([
+                {
+                    event: "agent.rejected",
+                    payload: {
+                        runId: "missing-run",
+                        message: "No active agent for appended message",
+                    },
+                },
+            ]));
+            const logs = await fetch(`http://127.0.0.1:${controller.localApiPort}/logs`, {
+                headers: { authorization: `Bearer ${controller.localApiToken}` },
+            }).then((res) => res.json());
+            expect(logs.lines.some((line) => line.includes("tool_response missed tool=missing-tool"))).toBe(true);
+        }
+        finally {
+            await controller.stop();
+        }
+    });
+    it("rotates runtime tokens and logout removes local config", async () => {
+        writeFileSync(configPath, JSON.stringify({
+            apiUrl: "http://api.test",
+            wsUrl: "ws://ws.test",
+            runtimeId: "11111111-1111-4111-8111-111111111111",
+            runtimeToken: "old_runtime_secret",
+        }));
+        const fetchMock = vi.fn().mockResolvedValue({
+            ok: true,
+            json: async () => ({ runtimeToken: "new_runtime_secret" }),
+        });
+        vi.stubGlobal("fetch", fetchMock);
+        const { rotateRuntimeToken, logoutDaemon } = await import("../daemon.js");
+        await rotateRuntimeToken(["--token", "aiden_pat_secret"]);
+        expect(fetchMock).toHaveBeenCalledWith("http://api.test/public/runtimes/11111111-1111-4111-8111-111111111111/tokens/rotate", expect.objectContaining({
+            method: "POST",
+            headers: { authorization: "Bearer aiden_pat_secret" },
+        }));
+        expect(JSON.parse(readFileSync(configPath, "utf8")).runtimeToken).toBe("new_runtime_secret");
+        logoutDaemon();
+        expect(() => readFileSync(configPath, "utf8")).toThrow();
+    });
+    it("doctor --sync pushes sanitized capabilities using the runtime token", async () => {
+        writeFileSync(configPath, JSON.stringify({
+            apiUrl: "http://api.test",
+            wsUrl: "ws://ws.test",
+            runtimeId: "11111111-1111-4111-8111-111111111111",
+            runtimeToken: "aiden_runtime_secret",
+        }));
+        const binDir = seedCliBinaries(tempDir);
+        process.env.PATH = binDir;
+        mocks.spawnSync.mockImplementation((command) => {
+            if (command.includes("codex"))
+                return { status: 0, stdout: "codex 1.2.3\n", stderr: "" };
+            if (command.includes("git"))
+                return { status: 0, stdout: "git version 2.50.0\n", stderr: "" };
+            return { status: 1, stdout: "", stderr: "not found" };
+        });
+        const fetchMock = vi.fn().mockResolvedValue({
+            ok: true,
+            json: async () => ({
+                capabilities: {
+                    agents: [{ provider: "codex", available: true, version: "codex 1.2.3" }],
+                    hasGit: true,
+                },
+            }),
+        });
+        vi.stubGlobal("fetch", fetchMock);
+        const info = vi.spyOn(console, "info").mockImplementation(() => { });
+        const { printDoctor } = await import("../daemon.js");
+        await printDoctor(["--sync"]);
+        expect(fetchMock).toHaveBeenCalledWith("http://api.test/public/runtimes/11111111-1111-4111-8111-111111111111/capabilities/self", expect.objectContaining({
+            method: "PATCH",
+            headers: {
+                authorization: "Bearer aiden_runtime_secret",
+                "content-type": "application/json",
+            },
+        }));
+        const body = JSON.parse(fetchMock.mock.calls[0][1].body);
+        expect(JSON.stringify(body.capabilities)).not.toContain("/Users/");
+        expect(body.metadata).toEqual(expect.objectContaining({
+            platform: expect.any(String),
+            arch: expect.any(String),
+            agentVersion: expect.any(String),
+            memoryBytes: expect.any(Number),
+        }));
+        expect(JSON.parse(info.mock.calls.at(-1)[0])).toMatchObject({ synced: true });
+    });
+    it("status explains durable runtime config separately from ephemeral sessions", async () => {
+        const info = vi.spyOn(console, "info").mockImplementation(() => { });
+        const { printStatus } = await import("../daemon.js");
+        await printStatus();
+        expect(JSON.parse(info.mock.calls.at(-1)[0])).toMatchObject({
+            mode: "runtime",
+            configured: false,
+            localDaemonRunning: false,
+            apiUrl: null,
+            wsUrl: null,
+            note: expect.stringContaining("Cloud sandbox sessions are launched by Aiden"),
+            warnings: [],
+        });
+    });
+    it("resolves the runtime config path at call time", async () => {
+        const { printStatus } = await import("../daemon.js");
+        const alternateConfigPath = join(tempDir, "alternate-config.json");
+        writeFileSync(alternateConfigPath, JSON.stringify({
+            apiUrl: "http://api.test",
+            wsUrl: "ws://ws.test",
+            endpointProfile: "custom",
+            runtimeId: "22222222-2222-4222-8222-222222222222",
+            runtimeToken: "aiden_runtime_secret",
+        }));
+        process.env.AIDEN_AGENT_CONFIG_PATH = alternateConfigPath;
+        const info = vi.spyOn(console, "info").mockImplementation(() => { });
+        await printStatus();
+        expect(JSON.parse(info.mock.calls.at(-1)[0])).toMatchObject({
+            configured: true,
+            runtimeId: "22222222-2222-4222-8222-222222222222",
+            configPath: alternateConfigPath,
+            localDaemonRunning: false,
+        });
+    });
+    it("token revoke revokes server-side tokens and removes local runtime config", async () => {
+        writeFileSync(configPath, JSON.stringify({
+            apiUrl: "http://api.test",
+            wsUrl: "ws://ws.test",
+            runtimeId: "11111111-1111-4111-8111-111111111111",
+            runtimeToken: "old_runtime_secret",
+        }));
+        const fetchMock = vi.fn().mockResolvedValue({
+            ok: true,
+            json: async () => ({ ok: true }),
+        });
+        vi.stubGlobal("fetch", fetchMock);
+        const { revokeRuntimeToken } = await import("../daemon.js");
+        await revokeRuntimeToken(["--token", "aiden_pat_secret"]);
+        expect(fetchMock).toHaveBeenCalledWith("http://api.test/public/runtimes/11111111-1111-4111-8111-111111111111/tokens/revoke", expect.objectContaining({
+            method: "POST",
+            headers: { authorization: "Bearer aiden_pat_secret" },
+        }));
+        expect(() => readFileSync(configPath, "utf8")).toThrow();
+    });
+    it("does not overwrite the runtime token when token rotation fails", async () => {
+        writeFileSync(configPath, JSON.stringify({
+            apiUrl: "http://api.test",
+            wsUrl: "ws://ws.test",
+            runtimeId: "11111111-1111-4111-8111-111111111111",
+            runtimeToken: "old_runtime_secret",
+        }));
+        vi.stubGlobal("fetch", vi.fn().mockResolvedValue({
+            ok: false,
+            status: 500,
+            text: async () => "boom",
+        }));
+        const { rotateRuntimeToken } = await import("../daemon.js");
+        await expect(rotateRuntimeToken(["--token", "aiden_pat_secret"])).rejects.toThrow("runtime token rotation failed: 500 boom");
+        expect(JSON.parse(readFileSync(configPath, "utf8")).runtimeToken).toBe("old_runtime_secret");
+    });
+});
+//# sourceMappingURL=daemon.test.js.map