agentlas 0.4.0 → 0.5.5

package/test/cloud-save-publish.cjs

@@ -0,0 +1,453 @@
+#!/usr/bin/env node
+const assert = require("node:assert/strict");
+const crypto = require("node:crypto");
+const { execFileSync } = require("node:child_process");
+const fs = require("node:fs");
+const http = require("node:http");
+const os = require("node:os");
+const path = require("node:path");
+
+const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "agentlas-cloud-save-publish-"));
+process.env.AGENTLAS_USER_DATA_DIR = path.join(tempDir, "user-data");
+process.env.AGENTLAS_SESSION = "test-owner-session";
+
+const {
+  cloudActionForTopLevelUpload,
+  cloudHashPackage,
+  cloudPortableExecutableForFile,
+  cloudPortablePathConflict,
+  cloudVisibilityForAction,
+  packageCloudAgentCli,
+} = require("../engine/agentlas.cjs");
+
+function writePrivateNotes(root) {
+  fs.mkdirSync(root, { recursive: true });
+  fs.writeFileSync(path.join(root, "notes.md"), "Owner-private agent working notes.\n", "utf8");
+  fs.writeFileSync(path.join(root, "asset.bin"), Buffer.from([0x00, 0xff, 0x81, 0x41, 0x00]));
+  fs.writeFileSync(path.join(root, "run.sh"), "#!/bin/sh\nexit 0\n", { mode: 0o700 });
+  fs.chmodSync(path.join(root, "run.sh"), 0o700);
+  fs.writeFileSync(path.join(root, ".agentlas-cloud-package.json"), JSON.stringify({
+    packageHash: "local-only-marker",
+    packageHashVersion: "path-sha256-executable-v2",
+    executablePaths: ["run.sh"],
+  }));
+}
+
+function writePublicAgent(root) {
+  writePrivateNotes(root);
+  fs.mkdirSync(path.join(root, ".agentlas"), { recursive: true });
+  fs.writeFileSync(path.join(root, "AGENTS.md"), "# Public Test Agent\n\nRun the public test task.\n", "utf8");
+  fs.writeFileSync(
+    path.join(root, ".agentlas", "routing-card.json"),
+    JSON.stringify({
+      schemaVersion: "routing-card/2.0",
+      id: "public-test-agent",
+      type: "agent",
+      name: "Public Test Agent",
+      summary: "Routes public test requests.",
+      capabilities: ["public_test"],
+      routing_status: "routing_ready",
+    }, null, 2) + "\n",
+    "utf8",
+  );
+}
+
+function listen(server) {
+  return new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => resolve(server.address()));
+  });
+}
+
+function close(server) {
+  return new Promise((resolve) => server.close(resolve));
+}
+
+(async () => {
+  const requests = [];
+  const requestHeaders = [];
+  const server = http.createServer((req, res) => {
+    const chunks = [];
+    req.on("data", (chunk) => chunks.push(chunk));
+    req.on("end", () => {
+      requests.push(JSON.parse(Buffer.concat(chunks).toString("utf8")));
+      requestHeaders.push(req.headers);
+      if (requests.at(-1).manifest.slug === "invalid-receipt-agent") {
+        res.writeHead(200, { "content-type": "application/json" });
+        res.end(JSON.stringify({ cloudId: "synthetic-success-must-not-be-accepted" }));
+        return;
+      }
+      const revision = `rev-${requests.length}-${requests.at(-1).manifest.packageHash.slice(0, 16)}`;
+      res.writeHead(200, {
+        "content-type": "application/json",
+        "cache-control": "no-store",
+        etag: `"${revision}"`,
+      });
+      res.end(JSON.stringify({
+        schema: "agentlas.agent_cloud.registration.v1",
+        operation: "created",
+        source: requests.at(-1).visibility === "marketplace" ? "hub" : "agent-cloud",
+        visibility: requests.at(-1).visibility === "marketplace" ? "marketplace" : "owner-private",
+        scope: requests.at(-1).visibility === "marketplace" ? "hub-public" : "owner-private",
+        owner: true,
+        publicHubPublished: requests.at(-1).visibility === "marketplace",
+        cloudId: `cloud-test-${requests.length}`,
+        slug: requests.at(-1).manifest.slug,
+        packageHash: requests.at(-1).manifest.packageHash,
+        packageHashVersion: requests.at(-1).manifest.packageHashVersion,
+        revision,
+        url: `http://agent-cloud.test/owned/${requests.at(-1).manifest.slug}`,
+        marketplaceUrl: requests.at(-1).visibility === "marketplace"
+          ? `http://agent-cloud.test/hub/${requests.at(-1).manifest.slug}`
+          : undefined,
+        registeredAt: new Date().toISOString(),
+        dryRun: false,
+      }));
+    });
+  });
+
+  try {
+    const address = await listen(server);
+    process.env.AGENTLAS_WEB_BASE_URL = `http://127.0.0.1:${address.port}`;
+
+    assert.equal(cloudVisibilityForAction("package", { _: [] }), "private-link");
+    assert.equal(cloudVisibilityForAction("save", { _: [] }), "private-link");
+    assert.equal(cloudVisibilityForAction("save", { _: [], visibility: "private-link" }), "private-link");
+    assert.equal(cloudVisibilityForAction("publish", { _: [] }), "marketplace");
+    assert.equal(cloudVisibilityForAction("publish", { _: [], visibility: "marketplace" }), "marketplace");
+    assert.throws(
+      () => cloudVisibilityForAction("save", { _: [], visibility: "marketplace" }),
+      /owner-private/,
+    );
+    assert.throws(
+      () => cloudVisibilityForAction("publish", { _: [], visibility: "private-link" }),
+      /public Hub publication/,
+    );
+    assert.equal(cloudActionForTopLevelUpload(["/tmp/agent"]), "save");
+    assert.equal(cloudActionForTopLevelUpload(["/tmp/agent", "--visibility", "private-link"]), "save");
+    assert.equal(cloudActionForTopLevelUpload(["/tmp/agent", "--visibility", "marketplace"]), "publish");
+
+    const privateRoot = path.join(tempDir, "private-notes-only");
+    writePrivateNotes(privateRoot);
+    const privateDryRun = await packageCloudAgentCli(null, privateRoot, {
+      dryRun: true,
+      llmReview: true,
+    });
+    assert.equal(privateDryRun.status, "dry-run");
+    assert.equal(privateDryRun.manifest.visibility, "private-link");
+    assert.equal(privateDryRun.review.mode, "static-only");
+    assert.equal(privateDryRun.review.costOwner, "none");
+    assert.equal(privateDryRun.review.verdict, "pass");
+    assert.equal(privateDryRun.review.findings.some((finding) => finding.id === "missing-agent-definition"), false);
+    assert.equal(privateDryRun.review.findings.some((finding) => finding.id.startsWith("routing-card")), false);
+    const privateBundle = JSON.parse(fs.readFileSync(privateDryRun.bundlePath, "utf8"));
+    assert.equal(privateBundle.manifest.packageHashVersion, "path-sha256-executable-v2");
+    assert.equal(
+      privateBundle.manifest.packageHash,
+      cloudHashPackage(privateBundle.files, privateBundle.manifest.packageHashVersion),
+    );
+    assert.equal(
+      privateBundle.manifest.rootFingerprint,
+      crypto.createHash("sha256").update(`agentlas-package-root:${privateBundle.manifest.packageHash}`).digest("hex"),
+      "root fingerprint must be content-derived and match Desktop",
+    );
+    const binary = privateBundle.files.find((file) => file.path === "asset.bin");
+    assert.deepEqual(Buffer.from(binary.contentBase64, "base64"), Buffer.from([0x00, 0xff, 0x81, 0x41, 0x00]));
+    assert.equal(binary.executable, false);
+    assert.equal(privateBundle.files.find((file) => file.path === "run.sh")?.executable, true);
+    assert.equal(privateBundle.files.some((file) => file.path === ".agentlas-cloud-package.json"), false);
+    assert.equal(
+      cloudPortablePathConflict(["Skills/writer/SKILL.md", "skills/reviewer/SKILL.md"])?.code,
+      "path-alias-collision",
+    );
+    assert.equal(
+      cloudPortablePathConflict(["Caf\u00e9/a.md", "Cafe\u0301/b.md"])?.code,
+      "path-alias-collision",
+    );
+    assert.equal(
+      cloudPortableExecutableForFile("run.sh", 0, new Set(["run.sh"]), "win32"),
+      true,
+      "Windows re-save must recover the portable bit from restore metadata",
+    );
+
+    const symlinkRoot = path.join(tempDir, "private-symlink-agent");
+    writePrivateNotes(symlinkRoot);
+    const outsideFile = path.join(tempDir, "outside-secret.txt");
+    fs.writeFileSync(outsideFile, "must not follow this link\n", "utf8");
+    fs.symlinkSync(outsideFile, path.join(symlinkRoot, "outside-link.txt"));
+    const symlinkBlocked = await packageCloudAgentCli(null, symlinkRoot, {
+      dryRun: true,
+      llmReview: false,
+    });
+    assert.equal(symlinkBlocked.status, "blocked");
+    assert.ok(symlinkBlocked.review.findings.some((finding) => finding.id.startsWith("symlink-")));
+
+    const rootSymlink = path.join(tempDir, "private-root-link");
+    try {
+      fs.symlinkSync(privateRoot, rootSymlink, "dir");
+      await assert.rejects(
+        packageCloudAgentCli(null, rootSymlink, { dryRun: true, llmReview: false }),
+        /실제 폴더가 아닙니다/,
+      );
+    } catch (error) {
+      if (!error || !["EPERM", "EACCES"].includes(error.code)) throw error;
+    }
+
+    const outsideRaceSecret = path.join(tempDir, "outside-race-secret.txt");
+    fs.writeFileSync(outsideRaceSecret, "glpat-abcdefghijklmnopqrstuvwxyz123456\n", "utf8");
+    const swapRoot = path.join(tempDir, "file-swap-agent");
+    writePrivateNotes(swapRoot);
+    const swapTarget = path.join(swapRoot, "zz-race.txt");
+    fs.writeFileSync(swapTarget, "safe captured bytes\n", "utf8");
+    const originalOpenSync = fs.openSync;
+    let fileSwapped = false;
+    fs.openSync = function patchedOpenSync(file, flags, ...rest) {
+      if (!fileSwapped && String(file).endsWith(`${path.sep}zz-race.txt`)) {
+        fileSwapped = true;
+        fs.renameSync(swapTarget, `${swapTarget}.original`);
+        fs.symlinkSync(outsideRaceSecret, swapTarget);
+      }
+      return originalOpenSync.call(fs, file, flags, ...rest);
+    };
+    let swapBlocked;
+    try {
+      swapBlocked = await packageCloudAgentCli(null, swapRoot, { dryRun: true, llmReview: false });
+    } finally {
+      fs.openSync = originalOpenSync;
+    }
+    assert.equal(swapBlocked.status, "blocked", JSON.stringify(swapBlocked.review.findings));
+    assert.ok(swapBlocked.review.findings.some((finding) => finding.id.startsWith("unstable-file")));
+    const swapBundle = JSON.parse(fs.readFileSync(swapBlocked.bundlePath, "utf8"));
+    assert.equal(JSON.stringify(swapBundle).includes(Buffer.from("glpat-abcdefghijklmnopqrstuvwxyz123456\n").toString("base64")), false);
+
+    const growthRoot = path.join(tempDir, "file-growth-agent");
+    writePrivateNotes(growthRoot);
+    const growthTarget = path.join(growthRoot, "zz-growth.txt");
+    fs.writeFileSync(growthTarget, "stable start\n", "utf8");
+    const originalReadSync = fs.readSync;
+    let growthFd = null;
+    let grew = false;
+    fs.openSync = function captureGrowthFd(file, flags, ...rest) {
+      const fd = originalOpenSync.call(fs, file, flags, ...rest);
+      if (String(file).endsWith(`${path.sep}zz-growth.txt`) && (Number(flags) & 3) === fs.constants.O_RDONLY) growthFd = fd;
+      return fd;
+    };
+    fs.readSync = function growAfterFirstRead(fd, ...args) {
+      const read = originalReadSync.call(fs, fd, ...args);
+      if (!grew && fd === growthFd && read > 0) {
+        grew = true;
+        const appendFd = originalOpenSync(growthTarget, fs.constants.O_WRONLY | fs.constants.O_APPEND);
+        try { fs.writeSync(appendFd, Buffer.from("changed during scan\n")); } finally { fs.closeSync(appendFd); }
+      }
+      return read;
+    };
+    let growthBlocked;
+    try {
+      growthBlocked = await packageCloudAgentCli(null, growthRoot, { dryRun: true, llmReview: false });
+    } finally {
+      fs.openSync = originalOpenSync;
+      fs.readSync = originalReadSync;
+    }
+    assert.equal(growthBlocked.status, "blocked");
+    assert.ok(growthBlocked.review.findings.some((finding) => finding.id.startsWith("unstable-file")));
+
+    const directorySwapRoot = path.join(tempDir, "directory-swap-agent");
+    writePrivateNotes(directorySwapRoot);
+    const nested = path.join(directorySwapRoot, "nested");
+    fs.mkdirSync(nested);
+    fs.writeFileSync(path.join(nested, "safe.txt"), "safe\n", "utf8");
+    const outsideDirectory = path.join(tempDir, "outside-directory");
+    fs.mkdirSync(outsideDirectory);
+    fs.writeFileSync(path.join(outsideDirectory, "safe.txt"), "outside must not enter\n", "utf8");
+    const originalReadDirSync = fs.readdirSync;
+    let directorySwapped = false;
+    fs.readdirSync = function swapDirectoryAfterListing(dir, options) {
+      const entries = originalReadDirSync.call(fs, dir, options);
+      if (!directorySwapped && String(dir).endsWith(`${path.sep}directory-swap-agent`)) {
+        directorySwapped = true;
+        fs.renameSync(nested, `${nested}.original`);
+        fs.symlinkSync(outsideDirectory, nested, "dir");
+      }
+      return entries;
+    };
+    let directoryBlocked;
+    try {
+      directoryBlocked = await packageCloudAgentCli(null, directorySwapRoot, { dryRun: true, llmReview: false });
+    } finally {
+      fs.readdirSync = originalReadDirSync;
+    }
+    assert.equal(directoryBlocked.status, "blocked");
+    assert.ok(directoryBlocked.review.findings.some((finding) => /unsafe-directory|unstable-directory/.test(finding.id)));
+
+    if (process.platform !== "win32") {
+      const fifoRoot = path.join(tempDir, "fifo-agent");
+      writePrivateNotes(fifoRoot);
+      execFileSync("mkfifo", [path.join(fifoRoot, "blocked.pipe")]);
+      const fifoBlocked = await packageCloudAgentCli(null, fifoRoot, { dryRun: true, llmReview: false });
+      assert.equal(fifoBlocked.status, "blocked");
+      assert.ok(fifoBlocked.review.findings.some((finding) => finding.id.startsWith("unsupported-entry")));
+    }
+
+    const requestsBeforeSecretGates = requests.length;
+    const unquotedSecretRoot = path.join(tempDir, "unquoted-secret-agent");
+    writePrivateNotes(unquotedSecretRoot);
+    fs.writeFileSync(path.join(unquotedSecretRoot, "config.yaml"), "password: hunter2secret\n", "utf8");
+    const unquotedSecret = await packageCloudAgentCli(null, unquotedSecretRoot, { dryRun: false, llmReview: false });
+    assert.equal(unquotedSecret.status, "blocked");
+    assert.ok(unquotedSecret.review.findings.some((finding) => finding.id.startsWith("generic-unquoted-secret")));
+
+    const utf16SecretRoot = path.join(tempDir, "utf16-secret-agent");
+    writePrivateNotes(utf16SecretRoot);
+    fs.writeFileSync(
+      path.join(utf16SecretRoot, "settings.ps1"),
+      Buffer.concat([Buffer.from([0xff, 0xfe]), Buffer.from("api_key=unquoted-secret-value-123456\r\n", "utf16le")]),
+    );
+    const utf16Secret = await packageCloudAgentCli(null, utf16SecretRoot, { dryRun: false, llmReview: false });
+    assert.equal(utf16Secret.status, "blocked");
+
+    const bomlessUtf16SecretRoot = path.join(tempDir, "bomless-utf16-secret-agent");
+    writePrivateNotes(bomlessUtf16SecretRoot);
+    fs.writeFileSync(
+      path.join(bomlessUtf16SecretRoot, "opaque.payload"),
+      Buffer.from(`${"A".repeat(5000)}\napi_key=unquoted-secret-value-123456\n`, "utf16le"),
+    );
+    const bomlessUtf16Secret = await packageCloudAgentCli(null, bomlessUtf16SecretRoot, { dryRun: false, llmReview: false });
+    assert.equal(bomlessUtf16Secret.status, "blocked");
+
+    const binarySecretRoot = path.join(tempDir, "binary-secret-agent");
+    writePrivateNotes(binarySecretRoot);
+    fs.writeFileSync(path.join(binarySecretRoot, "opaque.payload"), Buffer.from([0x00, ...Buffer.from("glpat-abcdefghijklmnopqrstuvwxyz123456"), 0xff]));
+    const binarySecret = await packageCloudAgentCli(null, binarySecretRoot, { dryRun: false, llmReview: false });
+    assert.equal(binarySecret.status, "blocked");
+    assert.ok(binarySecret.review.findings.some((finding) => finding.id.startsWith("gitlab-token")));
+    assert.equal(requests.length, requestsBeforeSecretGates, "blocked secret packages must perform zero registration fetches");
+
+    const placeholderRoot = path.join(tempDir, "placeholder-agent");
+    writePrivateNotes(placeholderRoot);
+    fs.writeFileSync(path.join(placeholderRoot, "config.yaml"), "password: configure_on_this_machine\napi_key: ${API_KEY}\n", "utf8");
+    const placeholderPackage = await packageCloudAgentCli(null, placeholderRoot, { dryRun: true, llmReview: false });
+    assert.equal(placeholderPackage.status, "dry-run");
+
+    const privateSaved = await packageCloudAgentCli(null, privateRoot, {
+      dryRun: false,
+      llmReview: false,
+    });
+    assert.equal(privateSaved.status, "registered");
+    assert.match(privateSaved.summary, /Saved .* privately in Agent Cloud/);
+
+    const invalidReceiptRoot = path.join(tempDir, "invalid-receipt-agent");
+    writePrivateNotes(invalidReceiptRoot);
+    await assert.rejects(
+      packageCloudAgentCli(null, invalidReceiptRoot, {
+        slug: "invalid-receipt-agent",
+        dryRun: false,
+        llmReview: false,
+      }),
+      /invalid or mismatched registration receipt/,
+      "malformed HTTP 2xx must never become synthetic registration success",
+    );
+
+    const publicWithoutRoutingRoot = path.join(tempDir, "public-without-routing");
+    fs.mkdirSync(publicWithoutRoutingRoot, { recursive: true });
+    fs.writeFileSync(path.join(publicWithoutRoutingRoot, "AGENTS.md"), "# Missing Routing\n", "utf8");
+    const publicBlocked = await packageCloudAgentCli(null, publicWithoutRoutingRoot, {
+      visibility: "marketplace",
+      dryRun: true,
+      llmReview: false,
+    });
+    assert.equal(publicBlocked.status, "blocked");
+    assert.ok(publicBlocked.review.findings.some((finding) => finding.id === "routing-card-required"));
+
+    const publicRoot = path.join(tempDir, "public-agent");
+    writePublicAgent(publicRoot);
+    const publicPublished = await packageCloudAgentCli(null, publicRoot, {
+      visibility: "marketplace",
+      dryRun: false,
+      llmReview: false,
+    });
+    assert.equal(publicPublished.status, "registered");
+    assert.match(publicPublished.summary, /Published .* publicly to Agentlas Hub/);
+
+    const publicCareerRoot = path.join(tempDir, "public-career-agent");
+    writePublicAgent(publicCareerRoot);
+    const rawCareerCard = {
+      kind: "agentlas-public-career-card",
+      schemaVersion: "1",
+      projectName: "Career fixture",
+      privacy: {
+        rawLocalPathsIncluded: false,
+        rawPromptsIncluded: false,
+        rawTranscriptsIncluded: false,
+        sourceTextIncluded: false,
+      },
+      counts: { evidence: 3 },
+      generatorInternal: { rawSourceId: "must-not-leave-host" },
+    };
+    fs.writeFileSync(
+      path.join(publicCareerRoot, ".agentlas", "public-career-card.json"),
+      JSON.stringify(rawCareerCard, null, 2) + "\n",
+      "utf8",
+    );
+    const publicCareer = await packageCloudAgentCli(null, publicCareerRoot, {
+      visibility: "marketplace",
+      dryRun: true,
+      llmReview: false,
+    });
+    assert.equal(publicCareer.status, "dry-run");
+    const publicCareerBundle = JSON.parse(fs.readFileSync(publicCareer.bundlePath, "utf8"));
+    const sanitizedCareerFile = publicCareerBundle.files.find((file) => file.path === ".agentlas/public-career-card.json");
+    assert.ok(sanitizedCareerFile);
+    const sanitizedCareer = JSON.parse(Buffer.from(sanitizedCareerFile.contentBase64, "base64").toString("utf8"));
+    assert.equal("generatorInternal" in sanitizedCareer, false);
+    assert.deepEqual(sanitizedCareer, publicCareerBundle.manifest.careerGraph);
+    assert.deepEqual(sanitizedCareer, publicCareerBundle.careerGraph);
+
+    const requestsBeforeLeakyCareer = requests.length;
+    const leakyCareerRoot = path.join(tempDir, "leaky-career-agent");
+    writePublicAgent(leakyCareerRoot);
+    fs.writeFileSync(
+      path.join(leakyCareerRoot, ".agentlas", "public-career-card.json"),
+      JSON.stringify({ ...rawCareerCard, generatorInternal: { sourcePath: "/Users/private/career.sqlite" } }, null, 2) + "\n",
+      "utf8",
+    );
+    const leakyCareer = await packageCloudAgentCli(null, leakyCareerRoot, {
+      visibility: "marketplace",
+      dryRun: false,
+      llmReview: false,
+    });
+    assert.equal(leakyCareer.status, "blocked");
+    assert.ok(leakyCareer.review.findings.some((finding) => finding.id === "career-card-local-path"));
+    const leakyCareerBundle = JSON.parse(fs.readFileSync(leakyCareer.bundlePath, "utf8"));
+    assert.equal(leakyCareerBundle.files.some((file) => file.path === ".agentlas/public-career-card.json"), false);
+    assert.equal(requests.length, requestsBeforeLeakyCareer, "blocked Career Graph packages must perform zero registration fetches");
+
+    const secretRoot = path.join(tempDir, "secret-agent");
+    writePrivateNotes(secretRoot);
+    fs.writeFileSync(path.join(secretRoot, ".env"), "TOKEN=not-a-real-secret-for-tests\n", "utf8");
+    const secretBlocked = await packageCloudAgentCli(null, secretRoot, {
+      dryRun: true,
+      llmReview: false,
+    });
+    assert.equal(secretBlocked.status, "blocked");
+    assert.ok(secretBlocked.review.findings.some((finding) => finding.category === "secret"));
+
+    assert.equal(requests.length, 3);
+    assert.equal(requests[0].visibility, "private-link");
+    assert.equal(requests[0].manifest.visibility, "private-link");
+    assert.equal(requests[0].manifest.packageHashVersion, "path-sha256-executable-v2");
+    assert.equal(requests[0].manifest.routingCard, undefined);
+    assert.equal(requestHeaders[0]["if-none-match"], "*");
+    assert.equal(requestHeaders[0]["if-match"], undefined);
+    assert.equal(requests[2].visibility, "marketplace");
+    assert.equal(requests[2].manifest.visibility, "marketplace");
+    assert.equal(requests[2].manifest.routingCard.schemaVersion, "routing-card/2.0");
+
+    console.log("cloud private-save/public-publish: PASS");
+  } finally {
+    await close(server).catch(() => {});
+    fs.rmSync(tempDir, { recursive: true, force: true });
+  }
+})().catch((error) => {
+  console.error(error);
+  process.exitCode = 1;
+});

package/test/credential-env-regression.cjs

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+"use strict";
+
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+
+const root = path.resolve(__dirname, "..");
+const terminal = require(path.join(root, "engine", "agentlas.cjs"));
+const tools = require(path.join(root, "engine", "agentlas-tools.cjs"));
+const temp = fs.mkdtempSync(path.join(os.tmpdir(), "agentlas-credential-env-"));
+
+try {
+  const shellCwd = path.join(temp, "project");
+  fs.mkdirSync(shellCwd, { recursive: true });
+  assert.equal(
+    terminal.resolveCredentialSourcePath("keys/service.json", shellCwd),
+    path.join(shellCwd, "keys", "service.json"),
+    "relative credential source must resolve from the caller cwd",
+  );
+
+  const credentials = path.join(temp, "credentials.env");
+  terminal.upsertEnvLine(credentials, "SERVICE_TOKEN", "first");
+  terminal.upsertEnvLine(credentials, "SERVICE_TOKEN", "second");
+  assert.equal(fs.readFileSync(credentials, "utf8"), "SERVICE_TOKEN=second\n");
+  if (process.platform !== "win32") {
+    assert.equal(fs.statSync(credentials).mode & 0o777, 0o600, "credential env must be owner-only");
+  }
+
+  const before = process.env.AGENTLAS_SCOPE_TEST;
+  const result = tools.runTool(
+    "bash",
+    { command: 'printf %s "$AGENTLAS_SCOPE_TEST"' },
+    {
+      cwd: shellCwd,
+      permission: "full",
+      env: { ...process.env, AGENTLAS_SCOPE_TEST: "turn-only" },
+    },
+  );
+  assert.equal(result.ok, true);
+  assert.match(result.content, /turn-only/);
+  assert.equal(process.env.AGENTLAS_SCOPE_TEST, before, "turn env must not leak into the host process");
+
+  const replSource = fs.readFileSync(path.join(root, "engine", "agentlas-repl.cjs"), "utf8");
+  assert.equal(replSource.includes("Object.assign(process.env"), false);
+  assert.match(replSource, /ctx:\s*\{ \.\.\.ctx, env: runEnv \}/);
+
+  console.log(JSON.stringify({ ok: true, checks: 8 }, null, 2));
+} finally {
+  fs.rmSync(temp, { recursive: true, force: true });
+}

package/test/login-loopback-security.cjs

@@ -0,0 +1,115 @@
+#!/usr/bin/env node
+"use strict";
+
+const assert = require("node:assert/strict");
+const { create, _test } = require("../engine/agentlas-parity.cjs");
+
+const parity = create({});
+
+function startAttempt(options = {}) {
+  let readyResolve;
+  let readyReject;
+  const ready = new Promise((resolve, reject) => {
+    readyResolve = resolve;
+    readyReject = reject;
+  });
+  const result = parity.waitForLoopbackSession({
+    baseUrl: "https://agentlas.cloud",
+    timeoutMs: options.timeoutMs || 1_000,
+    onLoginUrl(url) {
+      readyResolve(url);
+    },
+  });
+  void result.catch((error) => readyReject(error));
+  return { ready, result };
+}
+
+function callbackFromLoginUrl(loginUrl) {
+  const login = new URL(loginUrl);
+  assert.equal(login.origin, "https://agentlas.cloud");
+  assert.equal(login.pathname, "/account");
+  assert.equal(login.searchParams.get("desktop"), "1");
+  const rawCallback = login.searchParams.get("callback");
+  assert.ok(rawCallback, "Hub login URL must carry the loopback callback");
+  const callback = new URL(rawCallback);
+  assert.equal(callback.hostname, "127.0.0.1");
+  assert.equal(callback.pathname, "/callback");
+  assert.match(callback.searchParams.get("state") || "", /^[A-Za-z0-9_-]{43}$/);
+  return callback;
+}
+
+async function readResponse(response) {
+  await response.text();
+  return response;
+}
+
+async function main() {
+  const stateA = _test.createLoginState();
+  const stateB = _test.createLoginState();
+  assert.match(stateA, /^[A-Za-z0-9_-]{43}$/);
+  assert.notEqual(stateA, stateB, "each login must use a fresh cryptographic state nonce");
+
+  // Pure transaction guard: exact path only, valid response consumes once, replay is rejected.
+  const guard = _test.createLoginCallbackGuard(stateA);
+  assert.equal(guard.consume(`/callback-extra?state=${stateA}&session=evil`).statusCode, 404);
+  assert.equal(guard.isConsumed(), false, "unrelated paths must not consume the transaction");
+  assert.equal(guard.consume(`/callback?state=${stateA}&session=first`).value, "first");
+  assert.equal(guard.isConsumed(), true);
+  assert.equal(guard.consume(`/callback?state=${stateA}&session=second`).statusCode, 410, "callback replay must fail");
+
+  const mismatchGuard = _test.createLoginCallbackGuard(stateB);
+  const mismatch = mismatchGuard.consume(`/callback?state=wrong&session=attacker`);
+  assert.equal(mismatch.ok, false);
+  assert.match(mismatch.message, /state/);
+  assert.equal(mismatchGuard.consume(`/callback?state=${stateB}&session=late`).statusCode, 410, "state mismatch must close the transaction");
+
+  const errorGuard = _test.createLoginCallbackGuard(stateB);
+  assert.match(errorGuard.consume(`/callback?state=${stateB}&error=access_denied`).message, /access_denied/);
+  const missingGuard = _test.createLoginCallbackGuard(stateB);
+  assert.match(missingGuard.consume(`/callback?state=${stateB}`).message, /session/);
+  const tokenGuard = _test.createLoginCallbackGuard(stateB);
+  assert.equal(tokenGuard.consume(`/callback?state=${stateB}&token=legacy-compatible`).value, "legacy-compatible");
+
+  // Real loopback server: unrelated path and non-GET do not consume; correct callback succeeds.
+  const success = startAttempt();
+  const successCallback = callbackFromLoginUrl(await success.ready);
+  const unrelated = new URL("/callback-extra", successCallback.origin);
+  unrelated.searchParams.set("state", successCallback.searchParams.get("state"));
+  unrelated.searchParams.set("session", "evil");
+  assert.equal((await readResponse(await fetch(unrelated))).status, 404);
+  assert.equal((await readResponse(await fetch(successCallback, { method: "POST" }))).status, 405);
+  successCallback.searchParams.set("session", "valid-hub-session");
+  const successResponse = await readResponse(await fetch(successCallback));
+  assert.equal(successResponse.status, 200);
+  assert.match(successResponse.headers.get("cache-control") || "", /no-store/);
+  assert.equal(await success.result, "valid-hub-session");
+
+  // A forged state is never persisted and terminates this login attempt.
+  const forged = startAttempt();
+  const forgedCallback = callbackFromLoginUrl(await forged.ready);
+  forgedCallback.searchParams.set("state", "forged-state");
+  forgedCallback.searchParams.set("session", "attacker-session");
+  assert.equal((await readResponse(await fetch(forgedCallback))).status, 400);
+  await assert.rejects(forged.result, /state/);
+
+  // Hub/OAuth errors with the correct state also fail closed.
+  const denied = startAttempt();
+  const deniedCallback = callbackFromLoginUrl(await denied.ready);
+  deniedCallback.searchParams.set("error", "access_denied");
+  deniedCallback.searchParams.set("error_description", "must-not-be-reflected");
+  const deniedResponse = await readResponse(await fetch(deniedCallback));
+  assert.equal(deniedResponse.status, 400);
+  await assert.rejects(denied.result, /access_denied/);
+
+  // Timeout closes the listener and never returns a session.
+  const timedOut = startAttempt({ timeoutMs: 25 });
+  callbackFromLoginUrl(await timedOut.ready);
+  await assert.rejects(timedOut.result, /대기 시간/);
+
+  console.log("login-loopback-security: PASS");
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exitCode = 1;
+});

package/test/mcp-config-isolation.cjs

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+"use strict";
+
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+
+const temp = fs.mkdtempSync(path.join(os.tmpdir(), "agentlas-mcp-config-"));
+process.env.AGENTLAS_USER_DATA_DIR = temp;
+const host = require("../engine/agentlas-native-host.cjs");
+
+try {
+  const alpha = host.cliMcpConfigPath([
+    { id: "alpha", name: "alpha", transport: "stdio", command: "alpha-mcp", args_json: '["--a"]', enabled: 1 },
+  ]);
+  const beta = host.cliMcpConfigPath([
+    { id: "beta", name: "beta", transport: "stdio", command: "beta-mcp", args_json: '["--b"]', enabled: 1 },
+  ]);
+  assert.notEqual(alpha.file, beta.file, "different MCP sets must not race on one filename");
+  assert.equal(JSON.parse(fs.readFileSync(alpha.file, "utf8")).mcpServers.alpha.command, "alpha-mcp");
+  assert.equal(JSON.parse(fs.readFileSync(beta.file, "utf8")).mcpServers.beta.command, "beta-mcp");
+  assert.equal(host.cliMcpConfigPath([{ id: "alpha", name: "alpha", transport: "stdio", command: "alpha-mcp", args_json: '["--a"]', enabled: 1 }]).file, alpha.file);
+  if (process.platform !== "win32") {
+    assert.equal(fs.statSync(path.dirname(alpha.file)).mode & 0o777, 0o700);
+    assert.equal(fs.statSync(alpha.file).mode & 0o777, 0o600);
+  }
+  const codex = host.codexMcpArgs([{ id: "alpha", name: "alpha", transport: "stdio", command: "alpha-mcp", args_json: '["--a"]', enabled: 1 }]);
+  assert.ok(codex.some((value) => value.includes("mcp_servers.alpha.command")));
+  const mainSource = fs.readFileSync(path.join(__dirname, "../engine/agentlas.cjs"), "utf8");
+  assert.match(mainSource, /agentlas-native-host\.cjs"\)\.cliMcpConfigPath/);
+  assert.equal(mainSource.includes('path.join(dir, "agentlas-cli-mcp.json")'), false);
+  console.log(JSON.stringify({ ok: true, checks: 9 }, null, 2));
+} finally {
+  fs.rmSync(temp, { recursive: true, force: true });
+}