agentlas 0.5.2 → 0.6.0

package/test/permission-mapping.cjs

@@ -0,0 +1,180 @@
+#!/usr/bin/env node
+"use strict";
+
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const {
+  claudeArgs,
+  codexArgs,
+  geminiArgs,
+  prepareCodexRuntimeEnv,
+} = require("../engine/agentlas-native-host.cjs");
+const permissions = require("../engine/agentlas-permissions.cjs");
+const { buildArgs: legacyBuildArgs } = require("../engine/agentlas.cjs");
+
+const mcpServers = [{ name: "playwright", command: "npx", args: ["@playwright/mcp"] }];
+
+function hasPair(args, flag, value) {
+  const index = args.indexOf(flag);
+  return index >= 0 && args[index + 1] === value;
+}
+
+function includesExternalMcp(args) {
+  if (args.some((arg) => String(arg).includes("mcp_servers"))) return true;
+  for (let index = 0; index < args.length; index++) {
+    if (args[index] !== "--mcp-config") continue;
+    const value = String(args[index + 1] || "");
+    try {
+      const parsed = JSON.parse(value);
+      if (Object.keys(parsed.mcpServers || {}).length > 0) return true;
+    } catch {
+      return true; // a generated config file is the explicit full-access inventory
+    }
+  }
+  return false;
+}
+
+function common(level) {
+  return {
+    prompt: "test",
+    systemPrompt: "system",
+    permission: level,
+    session: {},
+    cwd: process.cwd(),
+    mcpServers,
+  };
+}
+
+function testClaude() {
+  const read = claudeArgs(common("read"));
+  const write = claudeArgs(common("write"));
+  const full = claudeArgs(common("full"));
+  assert.ok(hasPair(read, "--permission-mode", "plan"));
+  assert.ok(hasPair(write, "--permission-mode", "acceptEdits"));
+  assert.ok(full.includes("--dangerously-skip-permissions"));
+  assert.ok(!write.includes("--dangerously-skip-permissions"), "write must never launch Claude unrestricted");
+  for (const args of [read, write]) {
+    assert.ok(args.includes("--strict-mcp-config"), "Claude read/write must ignore user/project MCP configuration");
+    assert.equal(includesExternalMcp(args), false, "Claude read/write must receive an explicit empty MCP inventory");
+  }
+  assert.ok(full.includes("--strict-mcp-config"), "Claude full must use only the Agentlas-provided MCP inventory");
+  assert.equal(includesExternalMcp(full), true);
+}
+
+function testCodex() {
+  const read = codexArgs(common("read"));
+  const write = codexArgs(common("write"));
+  const full = codexArgs(common("full"));
+  assert.ok(hasPair(read, "--sandbox", "read-only"));
+  assert.ok(hasPair(write, "--sandbox", "workspace-write"));
+  assert.ok(full.includes("--dangerously-bypass-approvals-and-sandbox"));
+  assert.ok(!write.includes("--dangerously-bypass-approvals-and-sandbox"), "write must stay sandboxed");
+  assert.equal(includesExternalMcp(read), false);
+  assert.equal(includesExternalMcp(write), false, "write must not auto-inject Playwright or another external MCP");
+  assert.equal(includesExternalMcp(full), true);
+}
+
+function testGemini() {
+  const read = geminiArgs(common("read"));
+  const write = geminiArgs(common("write"));
+  const full = geminiArgs(common("full"));
+  assert.ok(hasPair(read, "--approval-mode", "plan"));
+  assert.ok(hasPair(write, "--approval-mode", "auto_edit"));
+  assert.ok(hasPair(full, "--approval-mode", "yolo"));
+  assert.equal(write.includes("--yolo"), false);
+  for (const args of [read, write]) {
+    const index = args.indexOf("--allowed-mcp-server-names");
+    assert.ok(index >= 0 && /^__agentlas_no_mcp_[0-9a-f-]+__$/.test(String(args[index + 1])), "Gemini read/write must use an exclusive empty MCP allow-list");
+  }
+  assert.equal(full.includes("--allowed-mcp-server-names"), false, "Gemini full may use the user's explicitly configured MCP servers");
+}
+
+function testCodexIsolatedHome() {
+  const fixture = fs.mkdtempSync(path.join(os.tmpdir(), "agentlas-codex-home-"));
+  const source = path.join(fixture, "source");
+  const data = path.join(fixture, "agentlas-data");
+  fs.mkdirSync(source, { recursive: true });
+  fs.writeFileSync(path.join(source, "auth.json"), '{"token":"fixture"}\n', { mode: 0o600 });
+  fs.writeFileSync(path.join(source, "config.toml"), '[mcp_servers.victim]\nurl="https://victim.invalid"\n', "utf8");
+  try {
+    const isolated = prepareCodexRuntimeEnv({ CODEX_HOME: source, AGENTLAS_USER_DATA_DIR: data });
+    assert.notEqual(isolated.CODEX_HOME, source);
+    assert.equal(fs.readFileSync(path.join(isolated.CODEX_HOME, "auth.json"), "utf8"), '{"token":"fixture"}\n');
+    assert.doesNotMatch(fs.readFileSync(path.join(isolated.CODEX_HOME, "config.toml"), "utf8"), /mcp_servers/);
+    assert.match(fs.readFileSync(path.join(source, "config.toml"), "utf8"), /victim/);
+    assert.throws(
+      () => prepareCodexRuntimeEnv({ CODEX_HOME: source, AGENTLAS_USER_DATA_DIR: data, AGENTLAS_CODEX_HOME: source }),
+      /must be isolated/,
+    );
+    assert.match(fs.readFileSync(path.join(source, "config.toml"), "utf8"), /victim/, "isolation failure overwrote the user's Codex config");
+  } finally {
+    fs.rmSync(fixture, { recursive: true, force: true });
+  }
+}
+
+function testFailClosedAndCopy() {
+  assert.equal(permissions.normalize("corrupt-value"), "read");
+  const invalidCodex = codexArgs(common("corrupt-value"));
+  assert.ok(hasPair(invalidCodex, "--sandbox", "read-only"));
+  assert.equal(permissions.copy("write", "en").label, "workspace write");
+  assert.match(permissions.copy("full", "ko").description, /승인과 샌드박스를 우회/);
+  assert.deepEqual(permissions.LEVELS, ["read", "write", "full"]);
+}
+
+function testShiftTabFullConfirmation() {
+  let clock = 1_000;
+  const cycle = permissions.createCycleController({ now: () => clock, armMs: 5_000 });
+  assert.deepEqual(cycle.step("read"), { level: "write", armed: false, enteredFull: false });
+  assert.deepEqual(cycle.step("write"), { level: "write", armed: true, enteredFull: false });
+  assert.equal(cycle.armed(), true);
+  cycle.cancel();
+  assert.equal(cycle.armed(), false, "any non-Shift-Tab key must disarm full escalation");
+  assert.deepEqual(cycle.step("write"), { level: "write", armed: true, enteredFull: false });
+  assert.deepEqual(cycle.step("write"), { level: "full", armed: false, enteredFull: true });
+  assert.deepEqual(cycle.step("full"), { level: "read", armed: false, enteredFull: false });
+  cycle.step("write");
+  clock += 5_001;
+  assert.deepEqual(cycle.step("write"), { level: "write", armed: true, enteredFull: false }, "expired arm must require a fresh double press");
+}
+
+function testBackgroundAndSwarmCapturePath() {
+  for (const kind of ["claude-code", "codex", "gemini"]) {
+    const read = legacyBuildArgs(kind, "system", "prompt", "read");
+    const write = legacyBuildArgs(kind, "system", "prompt", "write");
+    const full = legacyBuildArgs(kind, "system", "prompt", "full");
+    assert.equal(includesExternalMcp(read), false, `${kind} read capture must not inject MCP`);
+    assert.equal(includesExternalMcp(write), false, `${kind} write capture must not inject MCP`);
+    if (kind !== "gemini") assert.equal(includesExternalMcp(full), true, `${kind} full capture should retain explicit Playwright access`);
+  }
+
+  const claudeWrite = legacyBuildArgs("claude-code", "system", "prompt", "write");
+  const claudeFull = legacyBuildArgs("claude-code", "system", "prompt", "full");
+  assert.ok(hasPair(claudeWrite, "--permission-mode", "acceptEdits"));
+  assert.ok(claudeFull.includes("--dangerously-skip-permissions"));
+
+  const codexWrite = legacyBuildArgs("codex", "system", "prompt", "write");
+  const codexFull = legacyBuildArgs("codex", "system", "prompt", "full");
+  assert.ok(hasPair(codexWrite, "--sandbox", "workspace-write"));
+  assert.ok(!codexWrite.includes("--dangerously-bypass-approvals-and-sandbox"));
+  assert.ok(codexFull.includes("--dangerously-bypass-approvals-and-sandbox"));
+
+  const geminiWrite = legacyBuildArgs("gemini", "system", "prompt", "write");
+  const geminiFull = legacyBuildArgs("gemini", "system", "prompt", "full");
+  assert.ok(hasPair(geminiWrite, "--approval-mode", "auto_edit"));
+  assert.ok(hasPair(geminiFull, "--approval-mode", "yolo"));
+  assert.equal(geminiWrite.includes("--yolo"), false);
+
+  const invalid = legacyBuildArgs("codex", "system", "prompt", "corrupt-value");
+  assert.ok(hasPair(invalid, "--sandbox", "read-only"), "capture path must also fail closed");
+}
+
+testClaude();
+testCodex();
+testGemini();
+testCodexIsolatedHome();
+testFailClosedAndCopy();
+testShiftTabFullConfirmation();
+testBackgroundAndSwarmCapturePath();
+console.log("permission-mapping: PASS");

package/test/route-regression.cjs

@@ -0,0 +1,121 @@
+#!/usr/bin/env node
+"use strict";
+/*
+ * 자동 라우팅 회귀 테스트 — 2026-07-12 오라우팅 사고 고정.
+ *
+ * 사고: 일반 맥 질문("맥이 잠금상태에서 자꾸 ai 돌릴때 안켜지게 하는법 없나")이
+ * "ai" 단어 하나(+2점)로 Pitch Deck Architect에 라우팅되고, 그 에이전트의 이미지
+ * 힌트 때문에 런타임까지 gemini로 끌려갔다.
+ * 수리: 초범용 토큰 스톱워드 + IDF 근사 필터 + 정체성 가중치 + 확신 임계값(MIN_ROUTE_SCORE)
+ * 미만이면 direct(에이전트·능력 라우팅 없음) 판정.
+ */
+
+const assert = require("node:assert/strict");
+const { autoRouteAgent, autoRouteNote, autoRoutePreamble, directSystemPrompt } = require("../engine/agentlas.cjs");
+
+// 실제 설치 상태를 흉내 낸 스텁 DB — 모든 에이전트 프롬프트에 "AI"가 들어 있다(현실과 동일).
+const AGENTS = [
+  {
+    id: "a1",
+    slug: "pitch-deck-architect",
+    name: "Pitch Deck Architect",
+    name_en: "Pitch Deck Architect",
+    tagline: "투자 유치용 피치덱 설계",
+    tagline_en: "Investor pitch deck design",
+    system_prompt: "You are an AI pitch deck architect. Design slides, visuals, images, 디자인, storytelling for investors.",
+  },
+  {
+    id: "a2",
+    slug: "thumbnail-studio",
+    name: "썸네일 스튜디오",
+    name_en: "Thumbnail Studio",
+    tagline: "유튜브 썸네일 디자인",
+    tagline_en: "YouTube thumbnail design",
+    system_prompt: "You are an AI thumbnail designer. Generate 썸네일 images with bold typography.",
+  },
+  {
+    id: "a3",
+    slug: "agentlas-pm-soul",
+    name: "PM Soul",
+    name_en: "PM Soul",
+    tagline: "프로젝트 연속성 관리",
+    tagline_en: "Project continuity",
+    system_prompt: "You are an AI project manager. Track decisions, plans, handoffs.",
+  },
+  {
+    id: "a4",
+    slug: "agentlas-memory-curator",
+    name: "Memory Curator",
+    name_en: "Memory Curator",
+    tagline: "기억 저장/회상 관리",
+    tagline_en: "Memory curation",
+    system_prompt: "You are an AI memory curator. Store and recall durable memory entries.",
+  },
+];
+const META = [
+  {
+    id: "m1",
+    slug: "agentlas-meta-agent",
+    name: "메타에이전트",
+    name_en: "Meta Agent",
+    tagline: "에이전트/팀 빌더",
+    tagline_en: "Agent/team builder",
+    system_prompt: "You build new agents and teams.",
+  },
+];
+const db = {
+  prepare(sql) {
+    if (/WHERE slug IN/.test(sql)) return { all: () => META };
+    return { all: () => AGENTS };
+  },
+};
+
+// 1) 사고 재현 프롬프트 → direct (어떤 에이전트도, 특히 Pitch Deck Architect도 선택 금지)
+{
+  const choice = autoRouteAgent(db, "맥이 잠금상태에서 자꾸 ai 돌릴때 안켜지게 하는법 없나", "ko");
+  assert.equal(choice.direct, true, `일반 질문은 direct여야 함 — 실제: ${JSON.stringify(choice.agent && choice.agent.slug)}`);
+  assert.equal(choice.agent, null);
+  assert.match(autoRouteNote(choice, "ko"), /사용 에이전트: 없음/);
+  assert.match(autoRouteNote(choice, "en"), /Selected agent: none/);
+  assert.match(autoRoutePreamble(choice, "ko"), /direct answer/i);
+}
+
+// 2) "ai"/"llm" 단독 언급의 영어 일반 질문도 direct
+{
+  const choice = autoRouteAgent(db, "how do I keep my mac from sleeping while ai jobs run", "en");
+  assert.equal(choice.direct, true, "영어 일반 질문도 direct여야 함");
+}
+
+// 3) 정체성(이름/태그라인) 적중은 여전히 전문 라우트 — 썸네일 요청은 썸네일 에이전트로
+{
+  const choice = autoRouteAgent(db, "유튜브 썸네일 하나 뽑아줘", "ko");
+  assert.equal(choice.direct, undefined, "썸네일 요청이 direct로 새면 안 됨");
+  assert.equal(choice.agent.slug, "thumbnail-studio");
+}
+
+// 4) 에이전트 이름을 직접 부르면 그 에이전트로
+{
+  const choice = autoRouteAgent(db, "pitch deck 초안 잡아줘", "ko");
+  assert.equal(choice.direct, undefined);
+  assert.equal(choice.agent.slug, "pitch-deck-architect");
+}
+
+// 5) 빌드 의도는 메타빌더 직행 (기존 동작 유지)
+{
+  const choice = autoRouteAgent(db, "인스타 카드뉴스 에이전트 하나 만들어줘", "ko");
+  assert.equal(choice.agent.slug, "agentlas-meta-agent");
+  assert.equal(choice.score, 1000);
+}
+
+// 6) 설치 에이전트가 없어도 direct로 답한다 (픽커 오류 대신)
+{
+  const empty = { prepare: (sql) => ({ all: () => (/WHERE slug IN/.test(sql) ? [] : []) }) };
+  const choice = autoRouteAgent(empty, "안녕 오늘 날씨 어때", "ko");
+  assert.equal(choice.direct, true);
+}
+
+// 7) 직답 시스템 프롬프트 — 페르소나 없음, 양 언어 모두 존재
+assert.match(directSystemPrompt("ko"), /기본 어시스턴트/);
+assert.match(directSystemPrompt("en"), /default assistant/);
+
+console.log("route-regression: PASS");

package/test/run-api-regression.cjs

@@ -0,0 +1,322 @@
+#!/usr/bin/env node
+"use strict";
+
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+
+const {
+  runApi,
+  DEFAULT_API_MODEL,
+  ANTHROPIC_COMPAT_API,
+} = require("../engine/agentlas.cjs");
+const { create: createParity } = require("../engine/agentlas-parity.cjs");
+
+function response(status, payload, errorText) {
+  return {
+    ok: status >= 200 && status < 300,
+    status,
+    json: async () => payload,
+    text: async () => errorText || "",
+  };
+}
+
+function openFixtureDb(file) {
+  try {
+    const Database = require("better-sqlite3");
+    return new Database(file);
+  } catch {
+    const { DatabaseSync } = require("node:sqlite");
+    return new DatabaseSync(file);
+  }
+}
+
+function quietUi() {
+  const same = (value) => String(value ?? "");
+  return {
+    lang: "en",
+    c: { paw: same, bold: same, text: same, dim: same },
+    line() {},
+    info() {},
+    warn() {},
+    error() {},
+    tool() {},
+    toolResult() {},
+    startSpinner() {},
+    stopSpinner() {},
+    markdown() {},
+  };
+}
+
+async function testAnthropicCompatibleProviders() {
+  for (const backend of ["glm", "kimi", "deepseek"]) {
+    const calls = [];
+    const text = await runApi(backend, null, "system", "prompt", {
+      apiKey: `${backend}-secret`,
+      fetch: async (url, init) => {
+        calls.push({ url, init });
+        return response(200, { content: [{ type: "text", text: `${backend}-ok` }] });
+      },
+    });
+
+    assert.equal(text, `${backend}-ok`);
+    assert.equal(calls.length, 1);
+    assert.equal(calls[0].url, `${ANTHROPIC_COMPAT_API[backend].baseUrl}/v1/messages`);
+    assert.equal(calls[0].init.headers["x-api-key"], `${backend}-secret`);
+    assert.equal(calls[0].init.headers.authorization, `Bearer ${backend}-secret`);
+    assert.equal(calls[0].init.headers["anthropic-version"], "2023-06-01");
+    assert.equal(JSON.parse(calls[0].init.body).model, DEFAULT_API_MODEL[backend]);
+  }
+}
+
+async function testCustomBaseUrlComesFromSharedDb() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "agentlas-run-api-"));
+  const previous = process.env.AGENTLAS_USER_DATA_DIR;
+  process.env.AGENTLAS_USER_DATA_DIR = dir;
+  const db = openFixtureDb(path.join(dir, "agentlas.sqlite"));
+  try {
+    db.exec("CREATE TABLE meta (key TEXT PRIMARY KEY, value TEXT NOT NULL)");
+    db.prepare("INSERT INTO meta(key, value) VALUES (?, ?)").run(
+      "custom_base_url",
+      "https://gateway.example.test/openai/v1/",
+    );
+
+    const calls = [];
+    const text = await runApi("custom", "company-model", "system", "prompt", {
+      apiKey: "custom-secret",
+      fetch: async (url, init) => {
+        calls.push({ url, init });
+        return response(200, { choices: [{ message: { content: "custom-ok" } }] });
+      },
+    });
+
+    assert.equal(text, "custom-ok");
+    assert.equal(calls.length, 1);
+    assert.equal(calls[0].url, "https://gateway.example.test/openai/v1/chat/completions");
+    assert.equal(calls[0].init.headers.authorization, "Bearer custom-secret");
+    assert.equal(JSON.parse(calls[0].init.body).model, "company-model");
+
+    db.prepare("UPDATE meta SET value = ? WHERE key = ?").run(
+      "http://public.example.test/v1",
+      "custom_base_url",
+    );
+    let unsafeFetchCalled = false;
+    await assert.rejects(
+      runApi("custom", "company-model", "system", "prompt", {
+        apiKey: "custom-secret",
+        fetch: async () => {
+          unsafeFetchCalled = true;
+          return response(200, {});
+        },
+      }),
+      /HTTPS.*localhost\/LAN/,
+    );
+    assert.equal(unsafeFetchCalled, false, "invalid public HTTP base URL must not receive the API key");
+  } finally {
+    try { db.close(); } catch { /* ignore */ }
+    if (previous === undefined) delete process.env.AGENTLAS_USER_DATA_DIR;
+    else process.env.AGENTLAS_USER_DATA_DIR = previous;
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+async function testProviderErrorsNeverExitTheHostProcess() {
+  const originalExit = process.exit;
+  let exitCalls = 0;
+  process.exit = (code) => {
+    exitCalls += 1;
+    throw new Error(`unexpected process.exit(${code})`);
+  };
+  try {
+    await assert.rejects(
+      runApi("openai", "gpt-test", "system", "prompt", {
+        apiKey: "openai-secret",
+        fetch: async () => response(429, null, "rate limited"),
+      }),
+      /OpenAI 429: rate limited/,
+    );
+    await assert.rejects(
+      runApi("deepseek", "deepseek-chat", "system", "prompt", {
+        apiKey: "",
+        fetch: async () => response(200, {}),
+      }),
+      /deepseek API \ud0a4/,
+    );
+    await assert.rejects(
+      runApi("unknown", null, "system", "prompt", {
+        apiKey: "secret",
+        fetch: async () => response(200, {}),
+      }),
+      /\uc9c0\uc6d0\ud558\uc9c0 \uc54a\ub294 backend/,
+    );
+    assert.equal(exitCalls, 0, "runApi must throw to swarm/automation instead of exiting");
+  } finally {
+    process.exit = originalExit;
+  }
+}
+
+async function testSwarmAndAutomationContainProviderFailure() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "agentlas-run-api-host-"));
+  const db = openFixtureDb(path.join(dir, "agentlas.sqlite"));
+  const originalExit = process.exit;
+  const originalExitCode = process.exitCode;
+  let exitCalls = 0;
+  process.exit = (code) => {
+    exitCalls += 1;
+    throw new Error(`unexpected process.exit(${code})`);
+  };
+  try {
+    db.exec(`
+      CREATE TABLE installed_agents (
+        id TEXT PRIMARY KEY,
+        name TEXT NOT NULL,
+        system_prompt TEXT
+      );
+      CREATE TABLE automations (
+        id TEXT PRIMARY KEY,
+        name TEXT NOT NULL,
+        schedule TEXT,
+        target_type TEXT NOT NULL,
+        target_id TEXT NOT NULL,
+        prompt_template TEXT NOT NULL,
+        enabled INTEGER NOT NULL,
+        claimed_at TEXT,
+        lease_owner TEXT,
+        last_run_at TEXT,
+        next_run_at TEXT,
+        schedule_json TEXT,
+        timezone TEXT,
+        trigger_type TEXT,
+        run_count INTEGER NOT NULL DEFAULT 0,
+        max_runs INTEGER
+      );
+      CREATE TABLE run_history (
+        id TEXT PRIMARY KEY,
+        automation_id TEXT,
+        scheduled_for TEXT,
+        ran_at TEXT,
+        status TEXT,
+        skipped_count INTEGER,
+        error TEXT
+      );
+      INSERT INTO installed_agents(id, name, system_prompt)
+      VALUES ('agent-1', 'Regression Agent', 'System');
+      INSERT INTO automations(
+        id, name, schedule, target_type, target_id, prompt_template, enabled,
+        next_run_at, timezone, trigger_type, run_count
+      ) VALUES (
+        'automation-1', 'Regression Automation', 'daily-09:00', 'agent', 'agent-1', 'Run', 1,
+        '2026-01-01T00:00:00.000Z', 'Asia/Seoul', 'schedule', 0
+      );
+    `);
+
+    const failingRunApi = (backend, model, system, prompt) => runApi(backend, model, system, prompt, {
+      apiKey: "openai-secret",
+      fetch: async () => response(429, null, "rate limited"),
+    });
+    const parity = createParity({
+      prefsLang: () => "en",
+      resolveRuntime: () => ({ mode: "api", backend: "openai", model: "gpt-test" }),
+      buildChildEnvCli: async () => ({}),
+      runApi: failingRunApi,
+      captureRuntime: async () => "",
+      runCwd: () => dir,
+      out() {},
+      fail(message) { throw new Error(message); },
+    });
+
+    const swarm = await parity.swarmRun(db, "provider failure containment", { ui: quietUi(), concurrency: 2 });
+    assert.equal(swarm.ok, false, "all-failed swarm should finish normally with ok=false");
+
+    await parity.cmdAutomation(db, ["run", "automation-1"]);
+    const automation = db.prepare(
+      "SELECT claimed_at, lease_owner, last_run_at, run_count FROM automations WHERE id = ?",
+    ).get("automation-1");
+    assert.equal(automation.claimed_at, null, "automation lease must be released after provider error");
+    assert.equal(automation.lease_owner, null, "automation lease owner must be cleared after provider error");
+    assert.ok(automation.last_run_at, "automation failure must still be recorded");
+    assert.equal(automation.run_count, 0, "failed automation must not count as success");
+    const history = db.prepare(
+      "SELECT status, error FROM run_history WHERE automation_id = ? ORDER BY ran_at DESC LIMIT 1",
+    ).get("automation-1");
+    assert.equal(history.status, "error");
+    assert.match(history.error, /OpenAI 429: rate limited/);
+    assert.equal(exitCalls, 0, "swarm/automation must contain provider errors without exiting the host");
+
+    const fixedFrom = new Date("2026-07-10T00:30:00.000Z"); // 09:30 Asia/Seoul
+    assert.equal(
+      parity.nextAutomationRun(
+        { schedule: "daily-09:00", schedule_json: null, timezone: "Asia/Seoul" },
+        fixedFrom,
+      ).toISOString(),
+      "2026-07-11T00:00:00.000Z",
+      "legacy desktop token must advance in its stored timezone",
+    );
+
+    const scheduledFailureRow = db.prepare("SELECT * FROM automations WHERE id = ?").get("automation-1");
+    const failedScheduled = await parity.runAutomationOnce(db, scheduledFailureRow, {
+      ui: quietUi(),
+      advanceSchedule: true,
+      scheduledFor: scheduledFailureRow.next_run_at,
+    });
+    assert.equal(failedScheduled.ok, false);
+    const afterScheduledFailure = db.prepare(
+      "SELECT next_run_at, run_count, enabled FROM automations WHERE id = ?",
+    ).get("automation-1");
+    assert.ok(
+      Date.parse(afterScheduledFailure.next_run_at) > Date.now(),
+      "failed scheduled automation must advance beyond now instead of retrying every poll",
+    );
+    assert.equal(afterScheduledFailure.run_count, 0, "failed run remains excluded from success count");
+
+    db.prepare(
+      `INSERT INTO automations(
+        id, name, schedule, target_type, target_id, prompt_template, enabled,
+        next_run_at, timezone, trigger_type, run_count
+      ) VALUES ('automation-2', 'Success Automation', 'cron:*/5 * * * *', 'agent', 'agent-1', 'Run', 1,
+        '2026-01-01T00:00:00.000Z', 'UTC', 'schedule', 0)`,
+    ).run();
+    const successParity = createParity({
+      prefsLang: () => "en",
+      resolveRuntime: () => ({ mode: "api", backend: "openai", model: "gpt-test" }),
+      buildChildEnvCli: async () => ({}),
+      runApi: async () => "ok",
+      captureRuntime: async () => "",
+      runCwd: () => dir,
+      out() {},
+      fail(message) { throw new Error(message); },
+    });
+    const successRow = db.prepare("SELECT * FROM automations WHERE id = ?").get("automation-2");
+    const scheduledSuccess = await successParity.runAutomationOnce(db, successRow, {
+      ui: quietUi(),
+      advanceSchedule: true,
+      scheduledFor: successRow.next_run_at,
+    });
+    assert.equal(scheduledSuccess.ok, true);
+    const afterScheduledSuccess = db.prepare(
+      "SELECT next_run_at, run_count, enabled FROM automations WHERE id = ?",
+    ).get("automation-2");
+    assert.ok(Date.parse(afterScheduledSuccess.next_run_at) > Date.now());
+    assert.equal(afterScheduledSuccess.run_count, 1);
+    assert.equal(afterScheduledSuccess.enabled, 1);
+  } finally {
+    process.exit = originalExit;
+    process.exitCode = originalExitCode;
+    try { db.close(); } catch { /* ignore */ }
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+async function main() {
+  await testAnthropicCompatibleProviders();
+  await testCustomBaseUrlComesFromSharedDb();
+  await testProviderErrorsNeverExitTheHostProcess();
+  await testSwarmAndAutomationContainProviderFailure();
+  process.stdout.write("run-api regression: PASS (BYOK parity + swarm/automation failure containment)\n");
+}
+
+main().catch((error) => {
+  process.stderr.write(`${error && error.stack ? error.stack : error}\n`);
+  process.exitCode = 1;
+});

package/test/runtime-env-protection.cjs

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+const assert = require("node:assert/strict");
+const runtime = require("../engine/agentlas.cjs");
+
+const base = {
+  HOME: "/trusted/home",
+  PATH: "/trusted/bin",
+  CODEX_HOME: "/trusted/codex",
+  AGENTLAS_CODEX_HOME: "/trusted/agentlas-codex",
+  AGENTLAS_USER_DATA_DIR: "/trusted/agentlas-data",
+  CLAUDE_CONFIG_DIR: "/trusted/claude",
+  GEMINI_CLI_HOME: "/trusted/gemini",
+  API_TOKEN: "old",
+};
+const maliciousDotenv = runtime.parseDotEnvCli([
+  "HOME=/tmp/attacker",
+  "PATH=/tmp/attacker/bin",
+  "CODEX_HOME=/tmp/attacker/codex",
+  "AGENTLAS_CODEX_HOME=/tmp/attacker/victim",
+  "AGENTLAS_USER_DATA_DIR=/tmp/attacker/data",
+  "CLAUDE_CONFIG_DIR=/tmp/attacker/claude",
+  "GEMINI_CLI_HOME=/tmp/attacker/gemini",
+  "GEMINI_CLI_EXTENSION_REGISTRY_URI=https://attacker.invalid/extensions",
+  "CLAUDE_CODE_SAFE_MODE=1",
+  "NODE_OPTIONS=--require=/tmp/attacker.js",
+  "API_TOKEN=new",
+].join("\n"));
+maliciousDotenv.Path = "/tmp/attacker/windows-bin";
+
+runtime.mergeChildEnvValuesCli(base, maliciousDotenv, true);
+
+assert.equal(base.HOME, "/trusted/home");
+assert.equal(base.PATH, "/trusted/bin");
+assert.equal(base.Path, undefined);
+assert.equal(base.CODEX_HOME, "/trusted/codex");
+assert.equal(base.AGENTLAS_CODEX_HOME, "/trusted/agentlas-codex");
+assert.equal(base.AGENTLAS_USER_DATA_DIR, "/trusted/agentlas-data");
+assert.equal(base.CLAUDE_CONFIG_DIR, "/trusted/claude");
+assert.equal(base.GEMINI_CLI_HOME, "/trusted/gemini");
+assert.equal(base.GEMINI_CLI_EXTENSION_REGISTRY_URI, undefined);
+assert.equal(base.CLAUDE_CODE_SAFE_MODE, undefined);
+assert.equal(base.NODE_OPTIONS, undefined);
+assert.equal(base.API_TOKEN, "new");
+
+console.log(JSON.stringify({ ok: true, checks: 12 }, null, 2));