@animalabs/connectome-host 0.7.4 → 0.8.0

package/test/identity-and-surfaces.test.ts

@@ -16,6 +16,7 @@ import { IdentityModule } from '../src/modules/identity-module.ts';
 import { McplAdminModule } from '../src/modules/mcpl-admin-module.ts';
 import { ObserversModule } from '../src/modules/observers-module.ts';
 
+const REQUEST_BODY_MAX_FOR_TEST = 256 * 1024;
 const call = (name: string, input: unknown) => ({ id: 't1', name, input });
 
 function fakeHome(routes: Record<string, (body: any) => { status: number; json: unknown }>): typeof fetch {
@@ -34,7 +35,7 @@ describe('identity module', () => {
     const dir = mkdtempSync(join(tmpdir(), 'ident-'));
     const mod = new IdentityModule({ keyPath: join(dir, 'identity-key.pem'), home: 'id.test' });
     expect(mod.getTools()).toEqual([]);
-    expect(mod.getUtilities().map((u) => u.name)).toEqual(['status', 'accept_invite']);
+    expect(mod.getUtilities().map((u) => u.name)).toEqual(['status', 'request', 'accept_invite']);
     // Framing check: no crypto/credential vocabulary in agent-visible text.
     const visible = JSON.stringify(mod.getUtilities()).toLowerCase();
     for (const scary of ['token', 'key', 'sign', 'proof', 'ed25519', 'mint', 'bearer']) {
@@ -86,6 +87,216 @@ describe('identity module', () => {
     expect(again.error).toContain('Already registered');
   });
 
+
+  it('request: allowlisted service, host-attached access, no credential in result', async () => {
+    const dir = mkdtempSync(join(tmpdir(), 'ident-'));
+    let authSeen = '';
+    const mod = new IdentityModule({
+      keyPath: join(dir, 'k.pem'),
+      home: 'id.test',
+      services: { orrery: 'https://orrery.test' },
+      fetchImpl: (async (url: any, init?: any) => {
+        const u = String(url);
+        if (u.includes('/enroll')) return new Response(JSON.stringify({ sub: 'agent:a@guest', token: 't0' }), { status: 200 });
+        if (u.includes('/token')) return new Response(JSON.stringify({ token: 'aid1.fresh.secret' }), { status: 200 });
+        if (u === 'https://orrery.test/api/ops') {
+          authSeen = String(init?.headers?.authorization ?? '');
+          return new Response(JSON.stringify({ ops: [1, 2] }), { status: 200 });
+        }
+        return new Response('{}', { status: 404 });
+      }) as typeof fetch,
+    });
+    // not registered yet -> neutral failure
+    const early = await mod.handleToolCall(call('request', { service: 'orrery', path: '/api/ops' }));
+    expect(early.success).toBe(false);
+
+    await mod.handleToolCall(call('accept_invite', { invite: 'i', name: 'A' }));
+    const res = await mod.handleToolCall(call('request', { service: 'orrery', path: '/api/ops' }));
+    expect(res.success).toBe(true);
+    expect((res.data as any).status).toBe(200);
+    expect((res.data as any).body).toEqual({ ops: [1, 2] });
+    expect(authSeen).toBe('Bearer aid1.fresh.secret');
+    // the credential must never appear in the agent-visible result
+    expect(JSON.stringify(res.data)).not.toContain('aid1.');
+
+    const unknown = await mod.handleToolCall(call('request', { service: 'nope', path: '/x' }));
+    expect(unknown.error).toContain('Available: orrery');
+    const badPath = await mod.handleToolCall(call('request', { service: 'orrery', path: 'api/ops' }));
+    expect(badPath.success).toBe(false);
+  });
+
+  it('request: services come from the home node directory, and a newly-listed one works without a restart', async () => {
+    const dir = mkdtempSync(join(tmpdir(), 'ident-'));
+    // The archipelago's service list lives at the home node, not in this host.
+    // It changes underneath us mid-run: `music` is added after the module has
+    // already fetched and cached a directory without it.
+    let directory: Record<string, string> = { orrery: 'https://orrery.test' };
+    let directoryFetches = 0;
+    const mod = new IdentityModule({
+      keyPath: join(dir, 'k.pem'),
+      home: 'id.test',
+      fetchImpl: (async (url: any, init?: any) => {
+        const u = String(url);
+        if (u.includes('/enroll')) return new Response(JSON.stringify({ sub: 'agent:a@id.test', token: 't0' }), { status: 200 });
+        if (u.includes('/token')) return new Response(JSON.stringify({ token: 'aid1.fresh.secret' }), { status: 200 });
+        if (u === 'https://id.test/services') {
+          directoryFetches++;
+          return new Response(JSON.stringify({ home: 'id.test', services: directory }), { status: 200 });
+        }
+        if (u === 'https://music.test/api/me') return new Response(JSON.stringify({ me: 'mythos' }), { status: 200 });
+        return new Response('{}', { status: 404 });
+      }) as typeof fetch,
+    });
+    await mod.handleToolCall(call('accept_invite', { invite: 'i', name: 'A' }));
+
+    // nothing compiled in, nothing in the recipe: the directory supplied it
+    const listed = await mod.handleToolCall(call('request', { service: 'orrery', path: '/x' }));
+    expect(listed.success).toBe(true); // resolved and called; upstream 404 is reported, not a resolution failure
+    expect((listed.data as any).status).toBe(404);
+
+    // music does not exist yet -> refused, and the refusal cost a re-check
+    const before = await mod.handleToolCall(call('request', { service: 'music', path: '/api/me' }));
+    expect(before.success).toBe(false);
+    expect(before.error).toContain('Unknown service "music"');
+
+    // operator adds it at the home node; no restart, no recipe edit here
+    directory = { orrery: 'https://orrery.test', music: 'https://music.test' };
+    const fetchesBefore = directoryFetches;
+
+    const after = await mod.handleToolCall(call('request', { service: 'music', path: '/api/me' }));
+    expect(after.success).toBe(true);
+    expect((after.data as any).body).toEqual({ me: 'mythos' });
+    // it re-asked rather than serving a stale "unknown" from cache
+    expect(directoryFetches).toBeGreaterThan(fetchesBefore);
+  });
+
+  it('request: a home node that cannot be reached degrades to the built-in map, never to an outage', async () => {
+    const dir = mkdtempSync(join(tmpdir(), 'ident-'));
+    const mod = new IdentityModule({
+      keyPath: join(dir, 'k.pem'),
+      home: 'id.test',
+      fetchImpl: (async (url: any) => {
+        const u = String(url);
+        if (u.includes('/enroll')) return new Response(JSON.stringify({ sub: 'agent:a@id.test', token: 't0' }), { status: 200 });
+        if (u.includes('/token')) return new Response(JSON.stringify({ token: 'aid1.fresh.secret' }), { status: 200 });
+        if (u === 'https://id.test/services') return new Response('nope', { status: 503 });
+        if (u === 'https://eidoverse.animalabs.ai/api/ping') return new Response(JSON.stringify({ ok: true }), { status: 200 });
+        return new Response('{}', { status: 404 });
+      }) as typeof fetch,
+    });
+    await mod.handleToolCall(call('accept_invite', { invite: 'i', name: 'A' }));
+    const res = await mod.handleToolCall(call('request', { service: 'eidoverse', path: '/api/ping' }));
+    expect(res.success).toBe(true);
+    expect((res.data as any).body).toEqual({ ok: true });
+  });
+
+  it('request: fromFile uploads a workspace file byte-exactly, without the bytes touching context', async () => {
+    const dir = mkdtempSync(join(tmpdir(), 'ident-'));
+    // A file far larger than the JSON body cap — the case that made this exist.
+    const audio = Buffer.alloc(REQUEST_BODY_MAX_FOR_TEST + 4096, 0);
+    audio.write('ID3', 0);
+    audio[audio.length - 1] = 0x7f;
+    let sentBody: Buffer | null = null;
+    let sentType = '';
+    const workspace = {
+      readBinary: async (path: string) =>
+        path === 'files/music/track.mp3' ? { data: audio } : { error: `File not found: ${path}` },
+      writeBinary: async () => ({ success: true }),
+    };
+    const mod = new IdentityModule({
+      keyPath: join(dir, 'k.pem'),
+      home: 'id.test',
+      services: { music: 'https://music.test' },
+      fetchImpl: (async (url: any, init?: any) => {
+        const u = String(url);
+        if (u.includes('/enroll')) return new Response(JSON.stringify({ sub: 'agent:a@id.test', token: 't0' }), { status: 200 });
+        if (u.includes('/token')) return new Response(JSON.stringify({ token: 'aid1.fresh.secret' }), { status: 200 });
+        if (u.includes('/services')) return new Response(JSON.stringify({ services: {} }), { status: 200 });
+        if (u === 'https://music.test/api/upload/1/audio') {
+          sentBody = Buffer.from(init?.body as Uint8Array);
+          sentType = String(init?.headers?.['content-type'] ?? '');
+          return new Response(JSON.stringify({ ok: true }), { status: 200 });
+        }
+        return new Response('{}', { status: 404 });
+      }) as typeof fetch,
+    });
+    (mod as any).ctx = { getModule: (n: string) => (n === 'workspace' ? workspace : null) };
+    await mod.handleToolCall(call('accept_invite', { invite: 'i', name: 'A' }));
+
+    const res = await mod.handleToolCall(
+      call('request', { service: 'music', path: '/api/upload/1/audio', method: 'PUT', fromFile: 'files/music/track.mp3' }),
+    );
+    expect(res.success).toBe(true);
+    // byte-exact, and typed from the extension rather than guessed by the model
+    expect(sentBody!.equals(audio)).toBe(true);
+    expect(sentType).toBe('audio/mpeg');
+    // a receipt, but never the payload itself, in the agent-visible result
+    expect((res.data as any).sent).toEqual({
+      path: 'files/music/track.mp3',
+      size: audio.byteLength,
+      contentType: 'audio/mpeg',
+    });
+    expect(JSON.stringify(res.data).length).toBeLessThan(1000);
+
+    // guard rails
+    const both = await mod.handleToolCall(
+      call('request', { service: 'music', path: '/x', method: 'PUT', body: { a: 1 }, fromFile: 'files/music/track.mp3' }),
+    );
+    expect(both.error).toContain('not both');
+    const onGet = await mod.handleToolCall(call('request', { service: 'music', path: '/x', fromFile: 'files/music/track.mp3' }));
+    expect(onGet.error).toContain('POST or PUT');
+    const missing = await mod.handleToolCall(
+      call('request', { service: 'music', path: '/x', method: 'PUT', fromFile: 'files/nope.mp3' }),
+    );
+    expect(missing.error).toContain('could not read');
+  });
+
+  it('request: binary responses are described safely or saved byte-exactly to workspace', async () => {
+    const dir = mkdtempSync(join(tmpdir(), 'ident-'));
+    const png = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0xff, 0x00, 0x7f]);
+    let saved: { path: string; data: Buffer; mime: string } | null = null;
+    const mod = new IdentityModule({
+      keyPath: join(dir, 'k.pem'),
+      home: 'id.test',
+      services: { orrery: 'https://orrery.test' },
+      fetchImpl: (async (url: any) => {
+        const u = String(url);
+        if (u.includes('/enroll')) return new Response(JSON.stringify({ sub: 'agent:a@guest' }), { status: 200 });
+        if (u.includes('/token')) return new Response(JSON.stringify({ token: 'aid1.fresh.secret' }), { status: 200 });
+        if (u === 'https://orrery.test/api/assets/img/file') {
+          return new Response(png, { status: 200, headers: { 'content-type': 'image/png' } });
+        }
+        return new Response('{}', { status: 404, headers: { 'content-type': 'application/json' } });
+      }) as typeof fetch,
+    });
+    await mod.handleToolCall(call('accept_invite', { invite: 'i', name: 'A' }));
+
+    const described = await mod.handleToolCall(call('request', { service: 'orrery', path: '/api/assets/img/file' }));
+    expect(described.success).toBe(true);
+    expect((described.data as any).body).toBe(null);
+    expect((described.data as any).binary).toMatchObject({ size: png.length, contentType: 'image/png' });
+    expect(JSON.stringify(described.data)).not.toContain('�PNG');
+
+    await mod.start({
+      getModule: (name: string) => name === 'workspace' ? {
+        writeBinary: async (path: string, data: Buffer, mime: string) => {
+          saved = { path, data: Buffer.from(data), mime };
+          return { success: true, data: { path, size: data.length, mimeType: mime } };
+        },
+      } : null,
+    } as any);
+    const written = await mod.handleToolCall(call('request', {
+      service: 'orrery', path: '/api/assets/img/file', saveAs: 'files/artifacts/candidate.png',
+    }));
+    expect(written.success).toBe(true);
+    expect((written.data as any).saved).toMatchObject({
+      path: 'files/artifacts/candidate.png', size: png.length, contentType: 'image/png',
+    });
+    expect(saved?.path).toBe('files/artifacts/candidate.png');
+    expect(saved?.mime).toBe('image/png');
+    expect(saved?.data.equals(png)).toBe(true);
+  });
+
   it('host-facing accessFor: requires registration, then exchanges per call', async () => {
     const dir = mkdtempSync(join(tmpdir(), 'ident-'));
     let mints = 0;

package/test/instructions-module.test.ts

@@ -0,0 +1,258 @@
+import { afterEach, beforeEach, describe, expect, spyOn, test } from 'bun:test';
+import { mkdtempSync, rmSync, symlinkSync, utimesSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import {
+  DEFAULT_INSTRUCTIONS_HEADER,
+  DEFAULT_INSTRUCTIONS_PATH,
+  InstructionsModule,
+  type WorkspacePathResolver,
+} from '../src/modules/instructions-module.js';
+
+/**
+ * Minimal stand-in for WorkspaceModule.resolveAbsolutePath: one mount named
+ * `mountName` rooted at `root`, unknown mounts resolve to null (the real
+ * module's fail-open contract). Mirrors the real parsePath in resolving a
+ * bare mount name to the mount root — the module uses that for its realpath
+ * containment check.
+ */
+function makeResolver(mountName: string, root: string): WorkspacePathResolver {
+  return {
+    resolveAbsolutePath(mountPrefixedPath: string): string | null {
+      const slashIdx = mountPrefixedPath.indexOf('/');
+      const name = slashIdx >= 0 ? mountPrefixedPath.slice(0, slashIdx) : mountPrefixedPath;
+      if (name !== mountName) return null;
+      const rel = slashIdx >= 0 ? mountPrefixedPath.slice(slashIdx + 1) : '';
+      return resolve(root, rel);
+    },
+  };
+}
+
+describe('InstructionsModule', () => {
+  let dir: string;
+  let warnSpy: ReturnType<typeof spyOn>;
+
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'instructions-module-'));
+    warnSpy = spyOn(console, 'error').mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    warnSpy.mockRestore();
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  test('injects file content under the default header at the default path', async () => {
+    writeFileSync(join(dir, 'AGENTS.md'), 'Always be excellent.\n');
+    const mod = new InstructionsModule();
+    mod.setWorkspace(makeResolver('instructions', dir));
+
+    const injections = await mod.gatherContext('resident');
+    expect(injections).toHaveLength(1);
+    expect(injections[0].namespace).toBe('instructions');
+    expect(injections[0].position).toBe('system');
+    expect(injections[0].content).toEqual([{
+      type: 'text',
+      text: `${DEFAULT_INSTRUCTIONS_HEADER}\n\nAlways be excellent.\n`,
+    }]);
+    expect(warnSpy).not.toHaveBeenCalled();
+  });
+
+  test('exposes the shared-contract defaults', () => {
+    expect(DEFAULT_INSTRUCTIONS_PATH).toBe('instructions/AGENTS.md');
+    expect(new InstructionsModule().contextTimeoutMs).toBe(2000);
+  });
+
+  test('honors custom path, header, and position', async () => {
+    writeFileSync(join(dir, 'HOUSE-RULES.md'), 'No shouting.');
+    const mod = new InstructionsModule({
+      path: 'shared/HOUSE-RULES.md',
+      header: '## House rules',
+      position: 'afterUser',
+    });
+    mod.setWorkspace(makeResolver('shared', dir));
+
+    const injections = await mod.gatherContext('ephemeral-worker-1');
+    expect(injections).toHaveLength(1);
+    expect(injections[0].position).toBe('afterUser');
+    expect(injections[0].content).toEqual([{ type: 'text', text: '## House rules\n\nNo shouting.' }]);
+  });
+
+  test('supports position beforeUser', async () => {
+    writeFileSync(join(dir, 'AGENTS.md'), 'x');
+    const mod = new InstructionsModule({ position: 'beforeUser' });
+    mod.setWorkspace(makeResolver('instructions', dir));
+    expect((await mod.gatherContext('a'))[0].position).toBe('beforeUser');
+  });
+
+  test('returns the same injection for every agent name', async () => {
+    writeFileSync(join(dir, 'AGENTS.md'), 'shared doc');
+    const mod = new InstructionsModule();
+    mod.setWorkspace(makeResolver('instructions', dir));
+
+    const forResident = await mod.gatherContext('resident');
+    const forEphemeral = await mod.gatherContext('resident_fork_3');
+    expect(forEphemeral).toEqual(forResident);
+  });
+
+  test('missing file fails open with a single warning across turns', async () => {
+    const mod = new InstructionsModule();
+    mod.setWorkspace(makeResolver('instructions', dir));
+
+    expect(await mod.gatherContext('a')).toEqual([]);
+    expect(await mod.gatherContext('a')).toEqual([]);
+    expect(warnSpy).toHaveBeenCalledTimes(1);
+  });
+
+  test('unknown mount fails open with a single warning', async () => {
+    const mod = new InstructionsModule({ path: 'nonexistent/AGENTS.md' });
+    mod.setWorkspace(makeResolver('instructions', dir));
+
+    expect(await mod.gatherContext('a')).toEqual([]);
+    expect(await mod.gatherContext('a')).toEqual([]);
+    expect(warnSpy).toHaveBeenCalledTimes(1);
+  });
+
+  test('no workspace wired fails open', async () => {
+    const mod = new InstructionsModule();
+    expect(await mod.gatherContext('a')).toEqual([]);
+    expect(warnSpy).toHaveBeenCalledTimes(1);
+  });
+
+  test('recovers (and injects) once the file appears', async () => {
+    const mod = new InstructionsModule();
+    mod.setWorkspace(makeResolver('instructions', dir));
+
+    expect(await mod.gatherContext('a')).toEqual([]);
+    writeFileSync(join(dir, 'AGENTS.md'), 'now I exist');
+    const injections = await mod.gatherContext('a');
+    expect(injections).toHaveLength(1);
+    expect((injections[0].content[0] as { text: string }).text).toContain('now I exist');
+  });
+
+  test('caches by (mtime, size) and rereads when the file changes', async () => {
+    const file = join(dir, 'AGENTS.md');
+    writeFileSync(file, 'version one');
+    const mod = new InstructionsModule();
+    mod.setWorkspace(makeResolver('instructions', dir));
+
+    const first = await mod.gatherContext('a');
+    const second = await mod.gatherContext('a');
+    // Unchanged stat → cache hit → identical array, no reread.
+    expect(second).toBe(first);
+
+    // Content change (different size) → cache miss → new content.
+    writeFileSync(file, 'version two, longer');
+    const third = await mod.gatherContext('a');
+    expect(third).not.toBe(first);
+    expect((third[0].content[0] as { text: string }).text).toContain('version two, longer');
+
+    // mtime bump alone (same size, same content) also invalidates.
+    utimesSync(file, new Date(), new Date(Date.now() + 5000));
+    const fourth = await mod.gatherContext('a');
+    expect(fourth).not.toBe(third);
+    expect(fourth).toEqual(third);
+  });
+
+  test('truncates at maxBytes with an explicit marker', async () => {
+    writeFileSync(join(dir, 'AGENTS.md'), 'a'.repeat(100));
+    const mod = new InstructionsModule({ maxBytes: 10 });
+    mod.setWorkspace(makeResolver('instructions', dir));
+
+    const injections = await mod.gatherContext('a');
+    const text = (injections[0].content[0] as { text: string }).text;
+    expect(text).toBe(`${DEFAULT_INSTRUCTIONS_HEADER}\n\n${'a'.repeat(10)}\n\n[truncated: first 10 of 100 bytes]`);
+  });
+
+  test('truncation never splits a multibyte character (no U+FFFD)', async () => {
+    // '€' is 3 bytes in UTF-8; maxBytes: 4 keeps one full '€' plus the lead
+    // byte of the second. The incomplete sequence must be dropped and the
+    // marker report the actual kept byte count.
+    writeFileSync(join(dir, 'AGENTS.md'), '€€€€');
+    const mod = new InstructionsModule({ maxBytes: 4 });
+    mod.setWorkspace(makeResolver('instructions', dir));
+
+    const text = ((await mod.gatherContext('a'))[0].content[0] as { text: string }).text;
+    expect(text).toBe(`${DEFAULT_INSTRUCTIONS_HEADER}\n\n€\n\n[truncated: first 3 of 12 bytes]`);
+    expect(text).not.toContain('�');
+  });
+
+  test('a multibyte character ending exactly at the cap survives', async () => {
+    // '€€' is 6 bytes; maxBytes: 3 keeps exactly one complete '€' — the
+    // boundary backup must not chop a sequence that finished at the cap.
+    writeFileSync(join(dir, 'AGENTS.md'), '€€');
+    const mod = new InstructionsModule({ maxBytes: 3 });
+    mod.setWorkspace(makeResolver('instructions', dir));
+
+    const text = ((await mod.gatherContext('a'))[0].content[0] as { text: string }).text;
+    expect(text).toBe(`${DEFAULT_INSTRUCTIONS_HEADER}\n\n€\n\n[truncated: first 3 of 6 bytes]`);
+    expect(text).not.toContain('�');
+  });
+
+  test('does not truncate a file exactly at maxBytes', async () => {
+    writeFileSync(join(dir, 'AGENTS.md'), 'a'.repeat(10));
+    const mod = new InstructionsModule({ maxBytes: 10 });
+    mod.setWorkspace(makeResolver('instructions', dir));
+
+    const text = ((await mod.gatherContext('a'))[0].content[0] as { text: string }).text;
+    expect(text).toBe(`${DEFAULT_INSTRUCTIONS_HEADER}\n\n${'a'.repeat(10)}`);
+  });
+
+  test('reads at most maxBytes from an oversized file', async () => {
+    // Regression for the unbounded-read finding: a large mounted file must
+    // never be loaded whole. The observable contract is that only the first
+    // maxBytes influence the injection regardless of file size.
+    const big = 'begin-' + 'x'.repeat(512 * 1024) + '-end';
+    writeFileSync(join(dir, 'AGENTS.md'), big);
+    const mod = new InstructionsModule({ maxBytes: 1000 });
+    mod.setWorkspace(makeResolver('instructions', dir));
+
+    const text = ((await mod.gatherContext('a'))[0].content[0] as { text: string }).text;
+    expect(text).toBe(
+      `${DEFAULT_INSTRUCTIONS_HEADER}\n\n${big.slice(0, 1000)}\n\n[truncated: first 1000 of ${big.length} bytes]`,
+    );
+    expect(text).not.toContain('-end');
+  });
+
+  test('rejects an in-mount symlink targeting a file outside the mount', async () => {
+    // Regression for the symlink-escape finding: resolveAbsolutePath's
+    // containment is lexical, so a symlink inside the mount must not import
+    // outside content into the trusted instructions block.
+    const outside = mkdtempSync(join(tmpdir(), 'instructions-outside-'));
+    try {
+      writeFileSync(join(outside, 'secret.txt'), 'OUTSIDE_SECRET');
+      symlinkSync(join(outside, 'secret.txt'), join(dir, 'AGENTS.md'));
+      const mod = new InstructionsModule();
+      mod.setWorkspace(makeResolver('instructions', dir));
+
+      expect(await mod.gatherContext('a')).toEqual([]);
+      expect(await mod.gatherContext('a')).toEqual([]);
+      expect(warnSpy).toHaveBeenCalledTimes(1);
+      expect(String(warnSpy.mock.calls[0]?.[0])).toContain('outside its mount');
+    } finally {
+      rmSync(outside, { recursive: true, force: true });
+    }
+  });
+
+  test('a symlink retargeted outside the mount stops injecting (no stale cache)', async () => {
+    const outside = mkdtempSync(join(tmpdir(), 'instructions-outside-'));
+    try {
+      writeFileSync(join(dir, 'real.md'), 'legit content');
+      symlinkSync(join(dir, 'real.md'), join(dir, 'AGENTS.md'));
+      const mod = new InstructionsModule();
+      mod.setWorkspace(makeResolver('instructions', dir));
+
+      // In-mount symlink is fine — realpath stays under the mount root.
+      const before = await mod.gatherContext('a');
+      expect((before[0].content[0] as { text: string }).text).toContain('legit content');
+
+      // Retarget outside: injection must stop, not serve the cached content.
+      writeFileSync(join(outside, 'secret.txt'), 'OUTSIDE_SECRET');
+      rmSync(join(dir, 'AGENTS.md'));
+      symlinkSync(join(outside, 'secret.txt'), join(dir, 'AGENTS.md'));
+      expect(await mod.gatherContext('a')).toEqual([]);
+    } finally {
+      rmSync(outside, { recursive: true, force: true });
+    }
+  });
+});

package/test/mcpl-admin-module.test.ts

@@ -23,6 +23,11 @@ interface StubServer {
   maskedCapabilities: string[];
   deniedCapabilities: string[];
   allowHostCommands: boolean;
+  manifestState?: {
+    lastValidatedRevision: string | null;
+    lastFetchedAt: number | null;
+    lastNegotiatedAt: number | null;
+  };
   command?: string;
   url?: string;
 }
@@ -46,6 +51,11 @@ function makeStubFramework() {
         maskedCapabilities: ['channels.streaming'],
         deniedCapabilities: ['contextHooks.beforeInference.inject.system'],
         allowHostCommands: false,
+        manifestState: {
+          lastValidatedRevision: 'sha256:validated',
+          lastFetchedAt: Date.parse('2026-08-05T01:02:03.000Z'),
+          lastNegotiatedAt: Date.parse('2026-08-05T01:02:04.000Z'),
+        },
         command: config.command,
         url: config.url,
       });
@@ -69,6 +79,11 @@ function makeStubFramework() {
         maskedCapabilities: ['channels.streaming'],
         deniedCapabilities: ['contextHooks.beforeInference.inject.system'],
         allowHostCommands: false,
+        manifestState: {
+          lastValidatedRevision: 'sha256:validated',
+          lastFetchedAt: Date.parse('2026-08-05T01:02:03.000Z'),
+          lastNegotiatedAt: Date.parse('2026-08-05T01:02:04.000Z'),
+        },
         command: config?.command ?? prev?.command,
       });
     },
@@ -230,7 +245,33 @@ describe('mcpl_list', () => {
     expect(text).toContain('masked=[channels.streaming]');
     expect(text).toContain('denied=[contextHooks.beforeInference.inject.system]');
     expect(text).toContain('hostCommands=deny');
+    expect(text).toContain(
+      'manifest={revision="sha256:validated",' +
+      'fetchedAt=2026-08-05T01:02:03.000Z,' +
+      'negotiatedAt=2026-08-05T01:02:04.000Z}',
+    );
     expect(text).toContain('source=agent-overlay');
     expect(text).toContain('gone: UNLOADED');
   });
+
+  test('distinguishes older-framework unknown and bounds untrusted revisions', async () => {
+    const { stub, servers } = makeStubFramework();
+    await (stub as unknown as { connectMcplServer: (c: { id: string; command: string }) => Promise<void> })
+      .connectMcplServer({ id: 'discord', command: 'node' });
+    const mod = makeModule(stub);
+
+    const server = servers.get('discord')!;
+    delete server.manifestState;
+    expect(String((await call(mod, 'mcpl_list')).data)).toContain('manifest=unknown');
+
+    server.manifestState = {
+      lastValidatedRevision: `unsafe\n${'x'.repeat(100)}`,
+      lastFetchedAt: null,
+      lastNegotiatedAt: null,
+    };
+    const text = String((await call(mod, 'mcpl_list')).data);
+    expect(text).toContain('manifest={revision="unsafe\\n');
+    expect(text).not.toContain('unsafe\n');
+    expect(text).toContain('...",fetchedAt=none,negotiatedAt=none}');
+  });
 });

package/test/mcpl-agent-overlay.test.ts

@@ -13,6 +13,7 @@ import {
   saveAgentOverlay,
   applyAgentOverlay,
   resolveOverlayEntry,
+  AGENT_DEPLOY_DENIED_CAPABILITIES,
   type AgentOverlayEntry,
 } from '../src/mcpl-config.js';
 
@@ -109,18 +110,65 @@ describe('applyAgentOverlay', () => {
 });
 
 describe('resolveOverlayEntry', () => {
+  const BASELINE = [...AGENT_DEPLOY_DENIED_CAPABILITIES].sort();
+
   test('tombstones and empty entries resolve to null', () => {
     expect(resolveOverlayEntry('x', { disabled: true }, '/tmp/o.json')).toBeNull();
     expect(resolveOverlayEntry('x', {}, '/tmp/o.json')).toBeNull();
   });
 
-  test('url entries pass through with transport fields', () => {
+  test('url entries pass through with transport fields (plus the baseline capability mask)', () => {
     const r = resolveOverlayEntry('ws', { url: 'wss://host/mcpl', transport: 'websocket', token: 't' }, '/tmp/o.json');
-    expect(r).toEqual({ id: 'ws', url: 'wss://host/mcpl', transport: 'websocket', token: 't' });
+    expect(r).toEqual({ id: 'ws', url: 'wss://host/mcpl', transport: 'websocket', token: 't', reconnect: true, disabledCapabilities: BASELINE });
   });
 
   test('disabled flag is stripped from resolved config', () => {
     const r = resolveOverlayEntry('s', { command: 'node', disabled: false }, '/tmp/o.json');
-    expect(r).toEqual({ id: 's', command: 'node' });
+    expect(r).toEqual({ id: 's', command: 'node', disabledCapabilities: BASELINE });
+  });
+
+  // OpenAI-style strict function calling forces every schema property, so
+  // agent tool calls arrive with [] where the caller meant "unspecified" —
+  // and a PRESENT-empty allowlist is deny-all under the SPEC 0.5 pin (Mica's
+  // silently eventless eidoverse, 2026-08-04). [] must carry no intent.
+  test('empty allow/deny lists resolve as absent (strict-schema [] is "unspecified", never deny-all)', () => {
+    const r = resolveOverlayEntry('e', {
+      url: 'wss://host/mcpl',
+      enabledFeatureSets: [],
+      disabledFeatureSets: [],
+      enabledTools: [],
+      disabledTools: [],
+    }, '/tmp/o.json');
+    expect(r).toEqual({ id: 'e', url: 'wss://host/mcpl', reconnect: true, disabledCapabilities: BASELINE });
+  });
+
+  test('non-empty lists survive resolution', () => {
+    const r = resolveOverlayEntry('e', { url: 'wss://x/mcpl', enabledFeatureSets: ['eidoverse.*'], enabledTools: ['*'] }, '/tmp/o.json');
+    expect(r?.enabledFeatureSets).toEqual(['eidoverse.*']);
+    expect(r?.enabledTools).toEqual(['*']);
+  });
+
+  test('self-deployed servers never get consequential capabilities: baseline mask covers context hooks, server-initiated inference, lifecycle', () => {
+    expect(BASELINE).toEqual(['contextHooks', 'inferenceLifecycle', 'inferenceRequest']);
+  });
+
+  // A network server the agent deployed should come back when it bounces:
+  // reconnect-defaulted-false left Mythos permanently severed from eidoverse
+  // by a routine door deploy (2026-08-04) until his own next restart, days out.
+  test('websocket entries default reconnect: true; explicit false is respected; stdio keeps no default', () => {
+    expect(resolveOverlayEntry('a', { url: 'wss://x/mcpl' }, '/tmp/o.json')?.reconnect).toBe(true);
+    expect(resolveOverlayEntry('b', { url: 'wss://x/mcpl', reconnect: false }, '/tmp/o.json')?.reconnect).toBe(false);
+    expect(resolveOverlayEntry('c', { command: 'node' }, '/tmp/o.json')?.reconnect).toBeUndefined();
+  });
+
+  test('entry-supplied disabledCapabilities union with the baseline, never replace it', () => {
+    const r = resolveOverlayEntry('e', { url: 'wss://x/mcpl', disabledCapabilities: ['channels.streaming'] } as never, '/tmp/o.json');
+    expect(r?.disabledCapabilities).toEqual(['channels.streaming', ...BASELINE].sort());
+  });
+
+  test('enabledCapabilities is dropped — the agent overlay narrows, never widens (a hand-written entry could re-grant a §13.4 deny-by-default path)', () => {
+    const r = resolveOverlayEntry('e', { url: 'wss://x/mcpl', enabledCapabilities: ['contextHooks.beforeInference.inject.system'] } as never, '/tmp/o.json');
+    expect(r).not.toBeNull();
+    expect('enabledCapabilities' in (r as object)).toBe(false);
   });
 });