@kontourai/flow-agents 3.3.0 → 3.4.1

package/evals/integration/test_telemetry.sh

@@ -83,6 +83,451 @@ for lib in config.sh session.sh enrich.sh transport.sh redact.sh; do
   fi
 done
 
+# --- 1b. Config file resolution precedence ---
+# scripts/telemetry/lib/config.sh must resolve TELEMETRY_CONFIG_FILE in this
+# order: (1) explicit env always wins; (2) a gitignored per-workspace conf at
+# .kontourai/telemetry-console.conf if present AND operator-trusted
+# (project-specific override); (3) a gitignored user-global conf at
+# ~/.flow-agents/telemetry-console.conf if present AND operator-trusted
+# (one machine-wide install, matching the existing ~/.flow-agents
+# install-home convention); (4) the shipped telemetry.conf default. The
+# shipped conf is tracked and ships into dist bundles, so owner credentials
+# must never land there — hence the per-workspace/per-machine fallbacks.
+# "Operator-trusted" means mode 600 and owned by the current user, since
+# install-console-config.sh always chmod 600s the conf it writes while git
+# can only store 644/755 — never 600 — so a conf smuggled in via
+# clone/tarball/PR/supply-chain cannot pass the gate even at the expected
+# path. Symlinks are rejected outright regardless of the link's own mode,
+# since the trust check uses lstat semantics but the later conf read follows
+# the link — a mismatched check/read object. A fake HOME isolates these
+# checks from any real ~/.flow-agents on the machine running the suite.
+echo ""
+echo "--- Config File Resolution ---"
+CONFIG_SH="$ROOT_DIR/scripts/telemetry/lib/config.sh"
+CONFIG_TEST_ROOT=$(mktemp -d /tmp/eval-telemetry-config-test.XXXXXX)
+mkdir -p "$CONFIG_TEST_ROOT/scripts/telemetry/lib"
+cp "$CONFIG_SH" "$CONFIG_TEST_ROOT/scripts/telemetry/lib/config.sh"
+: > "$CONFIG_TEST_ROOT/scripts/telemetry/telemetry.conf"
+FAKE_HOME="$CONFIG_TEST_ROOT/home"
+mkdir -p "$FAKE_HOME"
+
+_resolve_config_file() {
+  env -i PATH="$PATH" HOME="$FAKE_HOME" "$@" \
+    bash -c "source '$CONFIG_TEST_ROOT/scripts/telemetry/lib/config.sh' 2>/dev/null; echo \"\$TELEMETRY_CONFIG_FILE\""
+}
+
+# Same as _resolve_config_file but captures config.sh's stderr into
+# $1 instead of discarding it, so the new "conf exists but is not trusted"
+# warning (AC2, install-flow-foundations Thread B) can be asserted on
+# directly. Call as: _resolve_config_file_with_stderr <stderr-file> [env=val ...]
+_resolve_config_file_with_stderr() {
+  local stderr_file="$1"
+  shift
+  env -i PATH="$PATH" HOME="$FAKE_HOME" "$@" \
+    bash -c "source '$CONFIG_TEST_ROOT/scripts/telemetry/lib/config.sh' 2>'$stderr_file'; echo \"\$TELEMETRY_CONFIG_FILE\""
+}
+
+STDERR_CAPTURE="$CONFIG_TEST_ROOT/config-stderr.txt"
+
+default_resolved=$(_resolve_config_file)
+if [[ "$default_resolved" == "$CONFIG_TEST_ROOT/scripts/telemetry/telemetry.conf" ]]; then
+  _pass "config.sh: falls back to shipped telemetry.conf default"
+else
+  _fail "config.sh: default expected '$CONFIG_TEST_ROOT/scripts/telemetry/telemetry.conf', got '$default_resolved'"
+fi
+
+: > "$STDERR_CAPTURE"
+_resolve_config_file_with_stderr "$STDERR_CAPTURE" >/dev/null
+if [[ ! -s "$STDERR_CAPTURE" ]]; then
+  _pass "config.sh: no conf on disk at all produces no untrusted-conf warning"
+else
+  _fail "config.sh: baseline (no conf) should produce no warning, got: $(cat "$STDERR_CAPTURE")"
+fi
+
+mkdir -p "$FAKE_HOME/.flow-agents"
+GLOBAL_CONF="$FAKE_HOME/.flow-agents/telemetry-console.conf"
+: > "$GLOBAL_CONF"
+chmod 644 "$GLOBAL_CONF"
+untrusted_global_resolved=$(_resolve_config_file)
+if [[ "$untrusted_global_resolved" == "$CONFIG_TEST_ROOT/scripts/telemetry/telemetry.conf" ]]; then
+  _pass "config.sh: untrusted (644) user-global conf falls through to shipped default"
+else
+  _fail "config.sh: untrusted global conf should fall through, got '$untrusted_global_resolved'"
+fi
+
+: > "$STDERR_CAPTURE"
+_resolve_config_file_with_stderr "$STDERR_CAPTURE" >/dev/null
+if grep -qF "$GLOBAL_CONF" "$STDERR_CAPTURE" 2>/dev/null; then
+  _pass "config.sh: untrusted (644) user-global conf prints a visible warning naming its path"
+else
+  _fail "config.sh: expected a warning naming '$GLOBAL_CONF', got: $(cat "$STDERR_CAPTURE" 2>/dev/null)"
+fi
+
+chmod 600 "$GLOBAL_CONF"
+global_resolved=$(_resolve_config_file)
+if [[ "$global_resolved" == "$GLOBAL_CONF" ]]; then
+  _pass "config.sh: trusted (600) user-global telemetry-console.conf wins over shipped default"
+else
+  _fail "config.sh: global conf expected '$GLOBAL_CONF', got '$global_resolved'"
+fi
+
+: > "$STDERR_CAPTURE"
+_resolve_config_file_with_stderr "$STDERR_CAPTURE" >/dev/null
+if [[ ! -s "$STDERR_CAPTURE" ]]; then
+  _pass "config.sh: trusted (600) user-global conf produces no warning"
+else
+  _fail "config.sh: trusted global conf should produce no warning, got: $(cat "$STDERR_CAPTURE")"
+fi
+
+mkdir -p "$CONFIG_TEST_ROOT/.kontourai"
+LOCAL_CONF="$CONFIG_TEST_ROOT/.kontourai/telemetry-console.conf"
+: > "$LOCAL_CONF"
+chmod 644 "$LOCAL_CONF"
+untrusted_local_resolved=$(_resolve_config_file)
+if [[ "$untrusted_local_resolved" == "$GLOBAL_CONF" ]]; then
+  _pass "config.sh: untrusted (644) workspace-local conf falls through to trusted global conf"
+else
+  _fail "config.sh: untrusted local conf should fall through to global, got '$untrusted_local_resolved'"
+fi
+
+# Local is untrusted here while global is trusted (600) and wins the
+# resolution -- the local warning must still fire even though local isn't
+# the file config.sh ultimately picks, since the local conf is still being
+# silently ignored on its own terms.
+: > "$STDERR_CAPTURE"
+_resolve_config_file_with_stderr "$STDERR_CAPTURE" >/dev/null
+if grep -qF "$LOCAL_CONF" "$STDERR_CAPTURE" 2>/dev/null; then
+  _pass "config.sh: untrusted (644) workspace-local conf prints a visible warning naming its path even though global wins"
+else
+  _fail "config.sh: expected a warning naming '$LOCAL_CONF', got: $(cat "$STDERR_CAPTURE" 2>/dev/null)"
+fi
+
+chmod 600 "$LOCAL_CONF"
+local_resolved=$(_resolve_config_file)
+if [[ "$local_resolved" == "$LOCAL_CONF" ]]; then
+  _pass "config.sh: trusted (600) workspace-local telemetry-console.conf wins over user-global conf"
+else
+  _fail "config.sh: local conf expected '$LOCAL_CONF', got '$local_resolved'"
+fi
+
+: > "$STDERR_CAPTURE"
+_resolve_config_file_with_stderr "$STDERR_CAPTURE" >/dev/null
+if [[ ! -s "$STDERR_CAPTURE" ]]; then
+  _pass "config.sh: trusted (600) workspace-local conf produces no warning"
+else
+  _fail "config.sh: trusted local conf should produce no warning, got: $(cat "$STDERR_CAPTURE")"
+fi
+
+# A symlink at the workspace conf path must be ignored outright, even if the
+# link's own mode is 600 (macOS `chmod -h` sets the link's own bits without
+# following it) and it points at a genuinely trusted 600 regular file, since
+# the later conf read follows the link to a possibly different target.
+TARGET_CONF="$CONFIG_TEST_ROOT/.kontourai/telemetry-console-target.conf"
+: > "$TARGET_CONF"
+chmod 600 "$TARGET_CONF"
+rm -f "$LOCAL_CONF"
+ln -s "$TARGET_CONF" "$LOCAL_CONF"
+chmod -h 600 "$LOCAL_CONF" 2>/dev/null || true
+symlink_resolved=$(_resolve_config_file)
+if [[ "$symlink_resolved" == "$GLOBAL_CONF" ]]; then
+  _pass "config.sh: symlinked workspace-local conf is ignored, falls through to trusted global conf"
+else
+  _fail "config.sh: symlinked local conf should fall through to global, got '$symlink_resolved'"
+fi
+
+: > "$STDERR_CAPTURE"
+_resolve_config_file_with_stderr "$STDERR_CAPTURE" >/dev/null
+if grep -qF "$LOCAL_CONF" "$STDERR_CAPTURE" 2>/dev/null; then
+  _pass "config.sh: symlinked workspace-local conf also prints a visible untrusted-conf warning ('-f' follows the link to a real file)"
+else
+  _fail "config.sh: expected a warning naming '$LOCAL_CONF' for the symlink case, got: $(cat "$STDERR_CAPTURE" 2>/dev/null)"
+fi
+
+# A DANGLING symlink (target does not exist) at the workspace conf path is
+# rejected by the trust gate just like the symlink-to-a-real-file case above,
+# but `-f` (which follows the link) returns false for a dangling target --
+# so the warning gate must additionally check `-L` to still fire here
+# (LOW fix: telemetry_conf_warn_untrusted broadened from `-f` alone to
+# `-e || -L`).
+rm -f "$LOCAL_CONF"
+ln -s "$CONFIG_TEST_ROOT/.kontourai/telemetry-console-target-missing.conf" "$LOCAL_CONF"
+dangling_symlink_resolved=$(_resolve_config_file)
+if [[ "$dangling_symlink_resolved" == "$GLOBAL_CONF" ]]; then
+  _pass "config.sh: dangling-symlink workspace-local conf is ignored, falls through to trusted global conf"
+else
+  _fail "config.sh: dangling-symlink local conf should fall through to global, got '$dangling_symlink_resolved'"
+fi
+
+: > "$STDERR_CAPTURE"
+_resolve_config_file_with_stderr "$STDERR_CAPTURE" >/dev/null
+if grep -qF "$LOCAL_CONF" "$STDERR_CAPTURE" 2>/dev/null; then
+  _pass "config.sh: dangling-symlink workspace-local conf prints a visible untrusted-conf warning ('-f' alone would miss this; '-L' catches it)"
+else
+  _fail "config.sh: expected a warning naming '$LOCAL_CONF' for the dangling-symlink case, got: $(cat "$STDERR_CAPTURE" 2>/dev/null)"
+fi
+
+# A symlink pointing at a DIRECTORY (not a regular file) hits the same `-f`
+# gap: `-f` is false for a directory target, so the pre-fix warning gate
+# silently skipped it too.
+rm -f "$LOCAL_CONF"
+mkdir -p "$CONFIG_TEST_ROOT/.kontourai/telemetry-console-target-dir"
+ln -s "$CONFIG_TEST_ROOT/.kontourai/telemetry-console-target-dir" "$LOCAL_CONF"
+symlink_to_dir_resolved=$(_resolve_config_file)
+if [[ "$symlink_to_dir_resolved" == "$GLOBAL_CONF" ]]; then
+  _pass "config.sh: symlink-to-directory workspace-local conf is ignored, falls through to trusted global conf"
+else
+  _fail "config.sh: symlink-to-directory local conf should fall through to global, got '$symlink_to_dir_resolved'"
+fi
+
+: > "$STDERR_CAPTURE"
+_resolve_config_file_with_stderr "$STDERR_CAPTURE" >/dev/null
+if grep -qF "$LOCAL_CONF" "$STDERR_CAPTURE" 2>/dev/null; then
+  _pass "config.sh: symlink-to-directory workspace-local conf prints a visible untrusted-conf warning ('-f' alone would miss this; '-L' catches it)"
+else
+  _fail "config.sh: expected a warning naming '$LOCAL_CONF' for the symlink-to-directory case, got: $(cat "$STDERR_CAPTURE" 2>/dev/null)"
+fi
+
+rm -f "$LOCAL_CONF"
+
+explicit_resolved=$(_resolve_config_file TELEMETRY_CONFIG_FILE="/tmp/explicit-telemetry.conf")
+if [[ "$explicit_resolved" == "/tmp/explicit-telemetry.conf" ]]; then
+  _pass "config.sh: explicit TELEMETRY_CONFIG_FILE env wins over workspace-local conf"
+else
+  _fail "config.sh: explicit env expected '/tmp/explicit-telemetry.conf', got '$explicit_resolved'"
+fi
+
+_resolve_pricing_url() {
+  env -i PATH="$PATH" HOME="$FAKE_HOME" "$@" \
+    bash -c "source '$CONFIG_TEST_ROOT/scripts/telemetry/lib/config.sh' 2>/dev/null; printf '%s\n' \"\${TELEMETRY_PRICING_URL:-}\""
+}
+
+PRICING_EMPTY_CONF="$CONFIG_TEST_ROOT/pricing-empty.conf"
+: > "$PRICING_EMPTY_CONF"
+pricing_from_console=$(_resolve_pricing_url TELEMETRY_CONFIG_FILE="$PRICING_EMPTY_CONF" CONSOLE_TELEMETRY_URL="https://console.example.test")
+if [[ -z "$pricing_from_console" ]]; then
+  _pass "config.sh: console telemetry URL alone does not derive TELEMETRY_PRICING_URL (bundled default)"
+else
+  _fail "config.sh: expected no derived pricing URL from console URL alone, got '$pricing_from_console'"
+fi
+
+pricing_from_env=$(_resolve_pricing_url TELEMETRY_CONFIG_FILE="$PRICING_EMPTY_CONF" CONSOLE_TELEMETRY_URL="https://console.example.test" FLOW_AGENTS_PRICING_URL="https://pricing.example.test/registry.json")
+if [[ "$pricing_from_env" == "https://pricing.example.test/registry.json" ]]; then
+  _pass "config.sh: explicit FLOW_AGENTS_PRICING_URL remains honored"
+else
+  _fail "config.sh: expected explicit FLOW_AGENTS_PRICING_URL to win, got '$pricing_from_env'"
+fi
+
+PRICING_CONF="$CONFIG_TEST_ROOT/pricing-explicit.conf"
+printf '%s\n' 'console_pricing_url=https://pricing.example.test/from-config.json' > "$PRICING_CONF"
+pricing_from_config=$(_resolve_pricing_url TELEMETRY_CONFIG_FILE="$PRICING_CONF" CONSOLE_TELEMETRY_URL="https://console.example.test")
+if [[ "$pricing_from_config" == "https://pricing.example.test/from-config.json" ]]; then
+  _pass "config.sh: explicit console_pricing_url config remains honored"
+else
+  _fail "config.sh: expected console_pricing_url config to win, got '$pricing_from_config'"
+fi
+
+rm -rf "$CONFIG_TEST_ROOT"
+
+# --- 1c. Endpoint allowlist drop warning ---
+# transport.sh's console_post_json silently dropped an endpoint rejected by
+# console_telemetry_endpoint_allowed before this change (AC2, Thread B). It
+# now prints a one-time (per shell process) "warning: transport.sh: ..." line
+# to stderr instead, guarded by a plain global var so a second call in the
+# same sourced shell does not repeat it. Sourcing transport.sh directly
+# (mirroring the Config File Resolution block's own cp-then-source pattern)
+# with a disallowed http (non-local) endpoint means console_post_json must
+# return before ever invoking curl, so PATH is left untouched deliberately.
+echo ""
+echo "--- Endpoint Allowlist Drop Warning ---"
+TRANSPORT_TEST_ROOT=$(mktemp -d /tmp/eval-telemetry-transport-test.XXXXXX)
+mkdir -p "$TRANSPORT_TEST_ROOT/scripts/telemetry/lib"
+cp "$ROOT_DIR/scripts/telemetry/lib/transport.sh" "$TRANSPORT_TEST_ROOT/scripts/telemetry/lib/transport.sh"
+cp "$ROOT_DIR/scripts/telemetry/lib/redact.sh" "$TRANSPORT_TEST_ROOT/scripts/telemetry/lib/redact.sh"
+TRANSPORT_STDERR="$TRANSPORT_TEST_ROOT/transport-stderr.txt"
+TRANSPORT_CURL_MARKER="$TRANSPORT_TEST_ROOT/curl-invoked"
+NO_CURL_BIN="$TRANSPORT_TEST_ROOT/no-curl-bin"
+mkdir -p "$NO_CURL_BIN"
+cat > "$NO_CURL_BIN/curl" <<SH
+#!/usr/bin/env bash
+touch "$TRANSPORT_CURL_MARKER"
+SH
+chmod +x "$NO_CURL_BIN/curl"
+TELEMETRY_DIR="$TRANSPORT_TEST_ROOT/scripts/telemetry" PATH="$NO_CURL_BIN:$PATH" bash -c "
+  source '$TRANSPORT_TEST_ROOT/scripts/telemetry/lib/transport.sh'
+  console_post_json 'http://example.test' '{}'
+  console_post_json 'http://example.test' '{}'
+" 2>"$TRANSPORT_STDERR"
+
+warning_count=$(grep -c "warning: transport.sh:" "$TRANSPORT_STDERR" 2>/dev/null || echo 0)
+if [[ "$warning_count" -eq 1 ]] && grep -qF "http://example.test" "$TRANSPORT_STDERR" 2>/dev/null; then
+  _pass "transport.sh: disallowed endpoint prints exactly one drop warning across two calls in the same shell"
+else
+  _fail "transport.sh: expected exactly 1 warning naming the endpoint, got $warning_count: $(cat "$TRANSPORT_STDERR" 2>/dev/null)"
+fi
+
+if [[ ! -f "$TRANSPORT_CURL_MARKER" ]]; then
+  _pass "transport.sh: disallowed endpoint never invokes curl"
+else
+  _fail "transport.sh: disallowed endpoint should never invoke curl, but it did"
+fi
+
+rm -rf "$TRANSPORT_TEST_ROOT"
+
+# --- Console relay project attribution (canonical precedence, path-free) ---
+echo ""
+echo "--- Console Relay Project Attribution ---"
+PROJ_TEST_ROOT=$(mktemp -d /tmp/eval-telemetry-project.XXXXXX)
+mkdir -p "$PROJ_TEST_ROOT/work/pkg" "$PROJ_TEST_ROOT/plain-dir-name"
+printf '{"name":"@kontourai/inner-pkg"}\n' > "$PROJ_TEST_ROOT/work/pkg/package.json"
+# git fixtures (no package.json ancestor) for the git-remote precedence tier and host-strip hardening
+git init -q "$PROJ_TEST_ROOT/gitrepo"     && git -C "$PROJ_TEST_ROOT/gitrepo"     remote add origin 'https://github.com/test-org/test-repo.git'
+git init -q "$PROJ_TEST_ROOT/gitslash"    && git -C "$PROJ_TEST_ROOT/gitslash"    remote add origin 'https://github.com/test-org/test-repo/'
+git init -q "$PROJ_TEST_ROOT/gitsingle"   && git -C "$PROJ_TEST_ROOT/gitsingle"   remote add origin 'https://github.com/loneseg.git'
+git init -q "$PROJ_TEST_ROOT/githostless" && git -C "$PROJ_TEST_ROOT/githostless" remote add origin 'https://gitserver/reponame.git'
+git init -q "$PROJ_TEST_ROOT/gitselfhost" && git -C "$PROJ_TEST_ROOT/gitselfhost" remote add origin 'https://gitea.example.com/team/proj.git'
+git init -q "$PROJ_TEST_ROOT/gitscphost"  && git -C "$PROJ_TEST_ROOT/gitscphost"  remote add origin 'git@gitserver:reponame.git'
+git init -q "$PROJ_TEST_ROOT/gitfile"     && git -C "$PROJ_TEST_ROOT/gitfile"     remote add origin 'file:///srv/git/secretuser/reponame.git'
+git init -q "$PROJ_TEST_ROOT/gitlocal"    && git -C "$PROJ_TEST_ROOT/gitlocal"    remote add origin '/srv/git/secretuser/reponame'
+
+# Unit-test the precedence engine console_project_label directly. It is byte-identical between the
+# source copy and the context/ mirror (their emit wrappers differ: source delegates to
+# console_post_json, the mirror inlines curl), so calling the function directly is the way to catch
+# a future edit landing in one copy but not the other. Echoes the derived label.
+# args: <full path to a transport.sh> <cwd> [bash prefix run before the call]. TELEMETRY_DIR is
+# derived from the transport path, and only the two full copy paths below are written as literals
+# (both resolve), so the source-tree path validator has nothing unresolvable to flag.
+_label_of() {
+  local transport="$1" cwd="$2" pre="${3:-}"
+  local teldir; teldir=$(dirname "$(dirname "$transport")")
+  bash -c "
+    $pre
+    export TELEMETRY_DIR='$teldir'
+    source \"$transport\"
+    console_project_label '$cwd'
+  "
+}
+_proj_of() { printf '%s' "$1" | jq -r '.context.project // "MISSING"' 2>/dev/null; }
+
+# Precedence matrix against BOTH the source copy and the context/ mirror.
+for transport in \
+  "$ROOT_DIR/scripts/telemetry/lib/transport.sh" \
+  "$ROOT_DIR/context/scripts/telemetry/lib/transport.sh"; do
+  [[ -f "$transport" ]] || continue
+  case "$transport" in *"/context/"*) tag="context-mirror" ;; *) tag="source" ;; esac
+
+  # step 2: nearest package.json name wins
+  lbl=$(_label_of "$transport" "$PROJ_TEST_ROOT/work/pkg")
+  [[ "$lbl" == "@kontourai/inner-pkg" ]] \
+    && _pass "console_project_label ($tag): nearest package.json name wins" \
+    || _fail "console_project_label ($tag): expected @kontourai/inner-pkg, got '$lbl'"
+
+  # step 1: FLOW_AGENTS_PROJECT override beats a present package.json
+  lbl=$(_label_of "$transport" "$PROJ_TEST_ROOT/work/pkg" "export FLOW_AGENTS_PROJECT=my-explicit-proj")
+  [[ "$lbl" == "my-explicit-proj" ]] \
+    && _pass "console_project_label ($tag): FLOW_AGENTS_PROJECT overrides all other tiers" \
+    || _fail "console_project_label ($tag): expected my-explicit-proj, got '$lbl'"
+
+  # step 3: git remote org/repo when no manifest is found on the walk-up
+  lbl=$(_label_of "$transport" "$PROJ_TEST_ROOT/gitrepo")
+  [[ "$lbl" == "test-org/test-repo" ]] \
+    && _pass "console_project_label ($tag): git remote resolves to org/repo" \
+    || _fail "console_project_label ($tag): expected test-org/test-repo, got '$lbl'"
+
+  # step 5: no manifest/git remote -> cwd basename fallback
+  lbl=$(_label_of "$transport" "$PROJ_TEST_ROOT/plain-dir-name")
+  [[ "$lbl" == "plain-dir-name" ]] \
+    && _pass "console_project_label ($tag): falls back to cwd basename when no manifest/git remote" \
+    || _fail "console_project_label ($tag): expected plain-dir-name, got '$lbl'"
+
+  # sed hardening: trailing-slash remote still reduces to a clean org/repo (not the raw URL)
+  lbl=$(_label_of "$transport" "$PROJ_TEST_ROOT/gitslash")
+  [[ "$lbl" == "test-org/test-repo" ]] \
+    && _pass "console_project_label ($tag): trailing-slash git remote reduces to org/repo" \
+    || _fail "console_project_label ($tag): expected test-org/test-repo (trailing slash), got '$lbl'"
+
+  # host-strip: single-segment remote (dotted host, no org tier) must NOT leak host; falls through
+  lbl=$(_label_of "$transport" "$PROJ_TEST_ROOT/gitsingle")
+  [[ "$lbl" == "gitsingle" ]] \
+    && _pass "console_project_label ($tag): single-segment git remote does not leak host" \
+    || _fail "console_project_label ($tag): expected gitsingle fallthrough, got '$lbl'"
+
+  # host-strip: DOT-LESS self-hosted host (URL), single path segment -> no host leak, falls through
+  lbl=$(_label_of "$transport" "$PROJ_TEST_ROOT/githostless")
+  [[ "$lbl" == "githostless" ]] \
+    && _pass "console_project_label ($tag): dot-less self-hosted host does not leak; falls through" \
+    || _fail "console_project_label ($tag): expected githostless fallthrough, got '$lbl'"
+
+  # host-strip: dotted self-hosted FQDN WITH an org tier reduces to org/repo (host stripped)
+  lbl=$(_label_of "$transport" "$PROJ_TEST_ROOT/gitselfhost")
+  [[ "$lbl" == "team/proj" ]] \
+    && _pass "console_project_label ($tag): self-hosted FQDN with org tier reduces to org/repo" \
+    || _fail "console_project_label ($tag): expected team/proj, got '$lbl'"
+
+  # host-strip: scp-form dot-less host, single path segment -> no user@host leak, falls through
+  lbl=$(_label_of "$transport" "$PROJ_TEST_ROOT/gitscphost")
+  [[ "$lbl" == "gitscphost" ]] \
+    && _pass "console_project_label ($tag): scp-form dot-less host does not leak; falls through" \
+    || _fail "console_project_label ($tag): expected gitscphost fallthrough, got '$lbl'"
+
+  # path-free: a file:// remote must not leak local path components; falls through to basename
+  lbl=$(_label_of "$transport" "$PROJ_TEST_ROOT/gitfile")
+  [[ "$lbl" == "gitfile" ]] \
+    && _pass "console_project_label ($tag): file:// remote does not leak local path; falls through" \
+    || _fail "console_project_label ($tag): expected gitfile fallthrough, got '$lbl'"
+
+  # path-free: a bare absolute-local-path remote must not leak path components; falls through
+  lbl=$(_label_of "$transport" "$PROJ_TEST_ROOT/gitlocal")
+  [[ "$lbl" == "gitlocal" ]] \
+    && _pass "console_project_label ($tag): absolute-local-path remote does not leak; falls through" \
+    || _fail "console_project_label ($tag): expected gitlocal fallthrough, got '$lbl'"
+done
+
+# Integration: exercise the real shipping emit wrapper (source copy) end-to-end — proves the label
+# is stamped AND the full cwd is still redacted to null in the same relayed event.
+_relay_source() {
+  local cwd="$1" preset="${2:-}"
+  local ev="{\"type\":\"tool\",\"context\":{\"cwd\":\"$cwd\"}}"
+  [[ -n "$preset" ]] && ev="{\"type\":\"tool\",\"context\":{\"cwd\":\"$cwd\",\"project\":\"$preset\"}}"
+  bash -c "
+    export TELEMETRY_DIR='$ROOT_DIR/scripts/telemetry'
+    source '$ROOT_DIR/scripts/telemetry/lib/transport.sh'
+    console_telemetry_endpoint_url() { echo 'https://console.example.test/records'; }
+    console_post_json() { printf '%s' \"\$2\"; }
+    CONSOLE_TELEMETRY_REDACT='context.cwd' TELEMETRY_SESSION_DIR='' \
+      console_telemetry_emit '$ev'
+  "
+}
+cap=$(_relay_source "$PROJ_TEST_ROOT/work/pkg")
+if [[ "$(_proj_of "$cap")" == "@kontourai/inner-pkg" && "$(printf '%s' "$cap" | jq -r '.context.cwd // "null"')" == "null" ]]; then
+  _pass "console_telemetry_emit: stamps context.project while the full cwd stays redacted to null"
+else
+  _fail "console_telemetry_emit: expected project=@kontourai/inner-pkg cwd=null, got '$cap'"
+fi
+# no-clobber: an adapter-supplied context.project is never overwritten
+cap=$(_relay_source "$PROJ_TEST_ROOT/work/pkg" "adapter-supplied")
+[[ "$(_proj_of "$cap")" == "adapter-supplied" ]] \
+  && _pass "console_telemetry_emit: pre-set context.project is left untouched" \
+  || _fail "console_telemetry_emit: expected project=adapter-supplied, got '$(_proj_of "$cap")'"
+
+# set -e safety: a missing/stale cwd must relay the event unchanged, never abort the caller
+sete_out=$(bash -c "
+  set -euo pipefail
+  export TELEMETRY_DIR='$ROOT_DIR/scripts/telemetry'
+  source '$ROOT_DIR/scripts/telemetry/lib/transport.sh'
+  console_telemetry_endpoint_url() { echo 'https://console.example.test/records'; }
+  console_post_json() { printf '%s' \"\$2\"; }
+  CONSOLE_TELEMETRY_REDACT='context.cwd' TELEMETRY_SESSION_DIR='' \
+    console_telemetry_emit '{\"type\":\"tool\",\"context\":{\"cwd\":\"/no/such/dir/xyz\"}}'
+  echo REACHED_END
+")
+sete_rc=$?
+if [[ $sete_rc -eq 0 && "$sete_out" == *REACHED_END* ]]; then
+  _pass "console_telemetry_emit: under set -e survives a missing cwd (relays, no abort)"
+else
+  _fail "console_telemetry_emit: set -e aborted on missing cwd (rc=$sete_rc, out='$sete_out')"
+fi
+rm -rf "$PROJ_TEST_ROOT"
+
 # --- 2. Event type mapping ---
 echo ""
 echo "--- Event Type Mapping ---"

package/evals/integration/test_telemetry_doctor.sh

@@ -2,6 +2,9 @@
 set -euo pipefail
 
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+# shellcheck source=/dev/null
+source "$ROOT_DIR/scripts/telemetry/console-presets.sh"
+KONTOUR_HOSTED_CONSOLE_URL="$(flow_agents_kontour_hosted_console_url)"
 FLOW_AGENTS_CLI="${FLOW_AGENTS_CLI:-node}"
 FLOW_AGENTS_CLI_ARGS=()
 if [[ "$FLOW_AGENTS_CLI" == "node" ]]; then
@@ -186,6 +189,69 @@ else
   fi
 fi
 
+# --- Hosted Console reachability by default (AC3, install-flow-foundations Thread C) ---
+# console.kontourai.io (or FLOW_AGENTS_KONTOUR_CLOUD_CONSOLE_URL when
+# overridden) is the ONE known hosted Console hostname that is reachability-
+# checkable without --allow-network. Real network reachability is not
+# guaranteed in a CI sandbox, so only endpointAllowed/reachability.checked
+# are asserted, not .ok.
+cat > "$DEST/scripts/telemetry/telemetry.conf" <<CONF
+enabled=true
+channels=full
+console_telemetry_url=$KONTOUR_HOSTED_CONSOLE_URL
+CONF
+
+$FLOW_AGENTS_CLI "${FLOW_AGENTS_CLI_ARGS[@]}" telemetry-doctor --dest "$DEST" --json --headless --timeout-ms 250 >"$TMPDIR_EVAL/hosted.json" 2>&1 || true
+if jq -e '
+  .console.endpointAllowed == true and
+  .console.reachability.checked == true
+' "$TMPDIR_EVAL/hosted.json" >/dev/null 2>&1; then
+  _pass "doctor checks known hosted Console reachability by default (no --allow-network)"
+else
+  _fail "doctor hosted-Console-by-default JSON did not match expected shape: $(cat "$TMPDIR_EVAL/hosted.json" 2>/dev/null)"
+fi
+
+# Regression guard: a generic non-local https endpoint (not the known hosted
+# hostname) must still require --allow-network exactly as before.
+cat > "$DEST/scripts/telemetry/telemetry.conf" <<'CONF'
+enabled=true
+channels=full
+console_telemetry_url=https://console.example.test
+CONF
+
+if $FLOW_AGENTS_CLI "${FLOW_AGENTS_CLI_ARGS[@]}" telemetry-doctor --dest "$DEST" --json --headless --timeout-ms 250 >"$TMPDIR_EVAL/generic-nonlocal.json"; then
+  _fail "doctor returned success for generic non-local Console without --allow-network"
+else
+  if jq -e '
+    .console.endpointAllowed == false and
+    .console.reachability.checked == false
+  ' "$TMPDIR_EVAL/generic-nonlocal.json" >/dev/null; then
+    _pass "doctor still blocks a generic (non-hosted) non-local Console without --allow-network"
+  else
+    _fail "doctor generic non-local block JSON did not match expected shape"
+  fi
+fi
+
+# --- Untrusted telemetry-console.conf surfaces a doctor warning (AC2, Thread B/C wiring) ---
+mkdir -p "$DEST/.kontourai"
+UNTRUSTED_CONF="$DEST/.kontourai/telemetry-console.conf"
+: > "$UNTRUSTED_CONF"
+chmod 644 "$UNTRUSTED_CONF"
+cp "$ROOT_DIR/scripts/telemetry/telemetry.conf" "$DEST/scripts/telemetry/telemetry.conf"
+
+if $FLOW_AGENTS_CLI "${FLOW_AGENTS_CLI_ARGS[@]}" telemetry-doctor --dest "$DEST" --json --headless >"$TMPDIR_EVAL/untrusted-conf.json"; then
+  if jq -e --arg path "$UNTRUSTED_CONF" '
+    (.warnings | any(contains($path)))
+  ' "$TMPDIR_EVAL/untrusted-conf.json" >/dev/null; then
+    _pass "doctor warns about an untrusted-but-present local telemetry-console.conf"
+  else
+    _fail "doctor did not surface a warning for the untrusted local conf: $(cat "$TMPDIR_EVAL/untrusted-conf.json")"
+  fi
+else
+  _fail "doctor failed for untrusted-conf-present case"
+fi
+rm -f "$UNTRUSTED_CONF"
+
 echo ""
 echo "Passed: $pass"
 echo "Failed: $fail"