deepdebug-local-agent 1.0.23 → 1.1.0

package/test/agent-auth.test.js

@@ -0,0 +1,194 @@
+// test/agent-auth.test.js
+// SECURITY AUDIT 2026-09: the agent's HTTP API (shell exec, file write) was
+// unauthenticated on 0.0.0.0 with CORS allowing any origin outside
+// NODE_ENV=production. These tests pin the auth perimeter.
+
+import { test, describe } from 'node:test';
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import express from 'express';
+import {
+  resolveAuthConfig,
+  authorize,
+  createAuthMiddleware,
+  internalAuthHeaders,
+  isLoopbackAddress,
+  isLoopbackHostHeader,
+  allowedOrigins,
+  corsOriginCallback,
+  describeAuthMode,
+} from '../src/utils/agent-auth.js';
+
+const ORIGINS = allowedOrigins({});
+const req = (over = {}) => ({
+  method: 'POST',
+  path: '/workspace/exec',
+  headers: { host: 'localhost:5055' },
+  remoteAddress: '127.0.0.1',
+  ...over,
+});
+
+describe('resolveAuthConfig', () => {
+  test('LOCAL_AGENT_TOKEN selects enforced token mode', () => {
+    assert.deepEqual(resolveAuthConfig({ LOCAL_AGENT_TOKEN: 't' }), { mode: 'token', token: 't' });
+  });
+  test('AGENT_SHARED_SECRET alone (BYOC ACI) IS enforced: the gateway sends it as X-Agent-Token', () => {
+    const cfg = resolveAuthConfig({ AGENT_SHARED_SECRET: 's3cret' });
+    assert.equal(cfg.mode, 'token');
+    assert.equal(cfg.token, 's3cret');
+    assert.equal(cfg.source, 'AGENT_SHARED_SECRET');
+  });
+  test('LOCAL_AGENT_AUTH=compat is the explicit opt-out that keeps a shared secret unenforced', () => {
+    const cfg = resolveAuthConfig({ AGENT_SHARED_SECRET: 's3cret', LOCAL_AGENT_AUTH: 'compat' });
+    assert.equal(cfg.mode, 'compat');
+    assert.equal(cfg.token, 's3cret');
+    assert.equal(cfg.explicit, true);
+  });
+  test('LOCAL_AGENT_TOKEN wins over AGENT_SHARED_SECRET', () => {
+    assert.deepEqual(resolveAuthConfig({ AGENT_SHARED_SECRET: 's', LOCAL_AGENT_TOKEN: 't' }), { mode: 'token', token: 't' });
+  });
+  test('Cloud Run without token is compat (IAM perimeter)', () => {
+    const cfg = resolveAuthConfig({ K_SERVICE: 'deepdebug-local-agent-qa' });
+    assert.equal(cfg.mode, 'compat');
+    assert.equal(cfg.cloudRun, true);
+  });
+  test('default outside Cloud Run with no token is loopback-only (remote callers refused)', () => {
+    const cfg = resolveAuthConfig({});
+    assert.equal(cfg.mode, 'loopback');
+    assert.equal(cfg.implicit, true);
+  });
+  test('loopback-only is opt-in', () => {
+    assert.equal(resolveAuthConfig({ LOCAL_AGENT_AUTH: 'loopback' }).mode, 'loopback');
+  });
+  test('explicit opt-out', () => {
+    assert.equal(resolveAuthConfig({ LOCAL_AGENT_AUTH: 'off', LOCAL_AGENT_TOKEN: 's' }).mode, 'off');
+  });
+  test('describeAuthMode warns that the token is not enforced only in compat', () => {
+    assert.match(describeAuthMode(resolveAuthConfig({ AGENT_SHARED_SECRET: 's', LOCAL_AGENT_AUTH: 'compat' })), /token not enforced/);
+    assert.match(describeAuthMode(resolveAuthConfig({ AGENT_SHARED_SECRET: 's' })), /enforcing AGENT_SHARED_SECRET/);
+    assert.match(describeAuthMode(resolveAuthConfig({})), /remote callers refused/);
+  });
+});
+
+describe('authorize — AGENT_SHARED_SECRET (BYOC ACI) is enforced', () => {
+  const cfg = resolveAuthConfig({ AGENT_SHARED_SECRET: 's3cret' });
+  test('ACI gateway call WITHOUT X-Agent-Token is refused (was: passed in compat)', () => {
+    const d = authorize(req({ remoteAddress: '20.1.2.3', headers: { host: 'deepdebug-agent-ab.eastus.azurecontainer.io' } }), cfg, ORIGINS);
+    assert.equal(d.ok, false);
+    assert.equal(d.status, 401);
+  });
+  test('ACI gateway call WITH the shared secret passes', () => {
+    const d = authorize(req({ remoteAddress: '20.1.2.3', headers: { host: 'deepdebug-agent-ab.eastus.azurecontainer.io', 'x-agent-token': 's3cret' } }), cfg, ORIGINS);
+    assert.equal(d.ok, true);
+  });
+  test('explicit LOCAL_AGENT_AUTH=compat keeps the old pass-through', () => {
+    const compat = resolveAuthConfig({ AGENT_SHARED_SECRET: 's3cret', LOCAL_AGENT_AUTH: 'compat' });
+    assert.equal(authorize(req({ remoteAddress: '20.1.2.3', headers: { host: 'x.azurecontainer.io' } }), compat, ORIGINS).ok, true);
+  });
+  test('foreign browser Origin is refused', () => {
+    assert.equal(authorize(req({ headers: { host: 'localhost:5055', origin: 'https://attacker.vercel.app' } }), cfg, ORIGINS).ok, false);
+  });
+  test('internal tunnel calls forward the shared secret', () => {
+    assert.deepEqual(internalAuthHeaders(cfg), { 'X-Agent-Token': 's3cret' });
+  });
+});
+
+describe('authorize — loopback mode', () => {
+  const cfg = { mode: 'loopback', token: null };
+  test('in-process tunnel call (loopback, localhost Host, no Origin) is allowed', () => {
+    assert.equal(authorize(req(), cfg, ORIGINS).ok, true);
+  });
+  test('IPv4-mapped loopback is allowed', () => {
+    assert.equal(authorize(req({ remoteAddress: '::ffff:127.0.0.1' }), cfg, ORIGINS).ok, true);
+  });
+  test('LAN caller is rejected', () => {
+    const d = authorize(req({ remoteAddress: '192.168.1.20' }), cfg, ORIGINS);
+    assert.equal(d.ok, false);
+    assert.equal(d.status, 401);
+  });
+  test('docker bridge caller is rejected', () => {
+    assert.equal(authorize(req({ remoteAddress: '172.17.0.1' }), cfg, ORIGINS).ok, false);
+  });
+  test('DNS rebinding (loopback socket, foreign Host) is rejected', () => {
+    const d = authorize(req({ headers: { host: 'evil.example:5055' } }), cfg, ORIGINS);
+    assert.equal(d.ok, false);
+    assert.equal(d.status, 403);
+  });
+  test('drive-by from a web page (foreign Origin) is rejected', () => {
+    const d = authorize(req({ headers: { host: 'localhost:5055', origin: 'https://attacker.vercel.app' } }), cfg, ORIGINS);
+    assert.equal(d.ok, false);
+  });
+  test('/health stays public for probes', () => {
+    assert.equal(authorize(req({ method: 'GET', path: '/health', remoteAddress: '10.0.0.9' }), cfg, ORIGINS).ok, true);
+  });
+  test('/metrics stays public for scrapes', () => {
+    assert.equal(authorize(req({ method: 'GET', path: '/metrics', remoteAddress: '10.0.0.9' }), cfg, ORIGINS).ok, true);
+  });
+  test('POST /health is not public', () => {
+    assert.equal(authorize(req({ method: 'POST', path: '/health', remoteAddress: '10.0.0.9' }), cfg, ORIGINS).ok, false);
+  });
+});
+
+describe('authorize — token mode', () => {
+  const cfg = { mode: 'token', token: 'correct-horse' };
+  test('valid X-Agent-Token from a remote caller is allowed', () => {
+    const d = authorize(req({ remoteAddress: '20.1.2.3', headers: { host: 'agent.azurecontainer.io', 'x-agent-token': 'correct-horse' } }), cfg, ORIGINS);
+    assert.equal(d.ok, true);
+  });
+  test('missing token is rejected even from loopback', () => {
+    assert.equal(authorize(req(), cfg, ORIGINS).ok, false);
+  });
+  test('wrong / prefix token is rejected', () => {
+    assert.equal(authorize(req({ headers: { host: 'x', 'x-agent-token': 'correct' } }), cfg, ORIGINS).ok, false);
+    assert.equal(authorize(req({ headers: { host: 'x', 'x-agent-token': 'correct-horse2' } }), cfg, ORIGINS).ok, false);
+  });
+  test('Authorization bearer is NOT accepted (on Cloud Run it carries the Google ID token)', () => {
+    assert.equal(authorize(req({ headers: { host: 'x', authorization: 'Bearer correct-horse' } }), cfg, ORIGINS).ok, false);
+  });
+  test('internalAuthHeaders carries the token for the WS tunnel', () => {
+    assert.deepEqual(internalAuthHeaders(cfg), { 'X-Agent-Token': 'correct-horse' });
+    assert.deepEqual(internalAuthHeaders({ mode: 'loopback', token: null }), {});
+  });
+});
+
+describe('helpers', () => {
+  test('isLoopbackAddress', () => {
+    for (const a of ['127.0.0.1', '127.9.9.9', '::1', '::ffff:127.0.0.1']) assert.equal(isLoopbackAddress(a), true, a);
+    for (const a of ['0.0.0.0', '10.0.0.1', '::ffff:10.0.0.1', '', undefined]) assert.equal(isLoopbackAddress(a), false, String(a));
+  });
+  test('isLoopbackHostHeader', () => {
+    for (const h of ['localhost', 'localhost:5055', '127.0.0.1:5055', '[::1]:5055']) assert.equal(isLoopbackHostHeader(h), true, h);
+    for (const h of ['localhost.evil.com', 'evil.com', '127.0.0.1.nip.io:5055', undefined]) assert.equal(isLoopbackHostHeader(h), false, String(h));
+  });
+  test('CORS allowlist has no wildcard hosting domains', () => {
+    const cb = corsOriginCallback(ORIGINS);
+    const verdict = (o) => { let r; cb(o, (_e, ok) => { r = ok; }); return r; };
+    assert.equal(verdict('http://localhost:3010'), true);
+    assert.equal(verdict(undefined), true);
+    assert.equal(verdict('https://anything.vercel.app'), false);
+    assert.equal(verdict('https://anything.run.app'), false);
+    assert.equal(verdict('https://x.lovable.app'), false);
+  });
+});
+
+describe('createAuthMiddleware (express, real socket)', () => {
+  test('rejects a token-less exec call, accepts with token, /health public', async () => {
+    const app = express();
+    app.use(createAuthMiddleware({ mode: 'token', token: 'tkn' }, ORIGINS));
+    app.get('/health', (_q, r) => r.json({ ok: true }));
+    app.post('/workspace/exec', (_q, r) => r.json({ ran: true }));
+    const server = http.createServer(app);
+    await new Promise((res) => server.listen(0, '127.0.0.1', res));
+    const base = `http://127.0.0.1:${server.address().port}`;
+    try {
+      assert.equal((await fetch(`${base}/health`)).status, 200);
+      const denied = await fetch(`${base}/workspace/exec`, { method: 'POST' });
+      assert.equal(denied.status, 401);
+      const ok = await fetch(`${base}/workspace/exec`, { method: 'POST', headers: { 'X-Agent-Token': 'tkn' } });
+      assert.equal(ok.status, 200);
+      assert.deepEqual(await ok.json(), { ran: true });
+    } finally {
+      server.close();
+    }
+  });
+});

package/test/bind-host.test.js

@@ -0,0 +1,26 @@
+// test/bind-host.test.js — LOCAL_AGENT_BIND_HOST (ACI TLS sidecar binds the agent to loopback).
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { resolveBindHost, DEFAULT_BIND_HOST } from '../src/utils/bind-host.js';
+
+test('defaults to loopback unless the auth mode is remote-capable (fail-closed)', () => {
+  assert.equal(resolveBindHost({}), '127.0.0.1');
+  assert.equal(resolveBindHost({ LOCAL_AGENT_BIND_HOST: '   ' }, { mode: 'loopback', implicit: true }), '127.0.0.1');
+  assert.equal(resolveBindHost({}, { mode: 'token', token: 't' }), DEFAULT_BIND_HOST);
+  assert.equal(resolveBindHost({}, { mode: 'compat', cloudRun: true }), '0.0.0.0');
+  assert.equal(resolveBindHost({}, { mode: 'off' }), '0.0.0.0');
+});
+
+test('explicit LOCAL_AGENT_BIND_HOST wins over the auth-derived default', () => {
+  assert.equal(resolveBindHost({ LOCAL_AGENT_BIND_HOST: '0.0.0.0' }, { mode: 'loopback' }), '0.0.0.0');
+});
+
+test('accepts loopback / explicit IPs', () => {
+  assert.equal(resolveBindHost({ LOCAL_AGENT_BIND_HOST: '127.0.0.1' }), '127.0.0.1');
+  assert.equal(resolveBindHost({ LOCAL_AGENT_BIND_HOST: 'localhost' }), '127.0.0.1');
+  assert.equal(resolveBindHost({ LOCAL_AGENT_BIND_HOST: '::1' }), '::1');
+});
+
+test('invalid values fall back to the default instead of crashing', () => {
+  assert.equal(resolveBindHost({ LOCAL_AGENT_BIND_HOST: 'not a host;rm -rf' }), '127.0.0.1');
+});

package/test/branch-refspec.test.js

@@ -0,0 +1,224 @@
+// test/branch-refspec.test.js
+// REFSPEC FIX: the /workspace/open REUSE path never saw branches created
+// AFTER the original `git clone --single-branch` (the remote refspec stays
+// restricted to the cloned branch, `git fetch origin` refreshes only that,
+// the checkout error is swallowed and `git reset --hard origin/<branch>`
+// dies with "ambiguous argument ... unknown revision" -> 500). Proven in QA
+// 2026-07-20 (agent rev 00021-kd8): auto-fix cloned vh-e2e-legacy-java8
+// single-branch on main, minutes later the code-review asked for the PR
+// branch fix/autonomousai_order-service-index-out-of-bounds -> 500 ->
+// review FAILED (PR #13 row in ai_pr_reviews). The fix fetches the
+// REQUESTED ref explicitly before checkout/reset.
+
+import { test, describe, before, after } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { exec } from 'node:child_process';
+import { promisify } from 'node:util';
+import {
+  isSafeBranchName,
+  explicitBranchRefspec,
+  isRemoteBranchMissing,
+  fetchRequestedRef,
+} from '../src/utils/branch-refspec.js';
+
+const execAsync = promisify(exec);
+
+const QA_PR_BRANCH = 'fix/autonomousai_order-service-index-out-of-bounds';
+
+describe('isSafeBranchName', () => {
+  test('accepts real-world branch names (incl. the QA PR branch)', () => {
+    for (const b of [
+      'main',
+      'master',
+      'develop',
+      QA_PR_BRANCH,
+      'feature/multi-repo-wiring',
+      'release-1.2.3',
+      'hotfix/JIRA-123_null-check',
+      'user/some.dotted.name',
+    ]) {
+      assert.equal(isSafeBranchName(b), true, `should accept: ${b}`);
+    }
+  });
+
+  test('rejects shell metacharacters (branch is interpolated into a shell line)', () => {
+    for (const b of [
+      'main; rm -rf /',
+      'main && curl evil',
+      'main`id`',
+      'main$(id)',
+      'main|tee /etc/passwd',
+      'main > /tmp/x',
+      "main'",
+      'main"',
+      'ma in',
+      'main\nother',
+      'main\\other',
+    ]) {
+      assert.equal(isSafeBranchName(b), false, `should reject: ${b}`);
+    }
+  });
+
+  test('rejects git-ref footguns and degenerate inputs', () => {
+    for (const b of [
+      '-oProxyCommand=evil',   // leading dash = option injection
+      '.hidden',               // leading dot
+      'a..b',                  // revision range
+      'a//b',
+      'a/',
+      'a.lock',
+      '',
+      '   ',
+      null,
+      undefined,
+      42,
+      'x'.repeat(256),
+    ]) {
+      assert.equal(isSafeBranchName(b), false, `should reject: ${String(b)}`);
+    }
+  });
+});
+
+describe('explicitBranchRefspec', () => {
+  test('builds the +refs/heads/<b>:refs/remotes/origin/<b> refspec', () => {
+    assert.equal(
+      explicitBranchRefspec(QA_PR_BRANCH),
+      `+refs/heads/${QA_PR_BRANCH}:refs/remotes/origin/${QA_PR_BRANCH}`
+    );
+    assert.equal(explicitBranchRefspec('main'), '+refs/heads/main:refs/remotes/origin/main');
+  });
+
+  test('throws on unsafe names (defense in depth, never emits injectable text)', () => {
+    assert.throws(() => explicitBranchRefspec('main; rm -rf /'));
+    assert.throws(() => explicitBranchRefspec(''));
+  });
+});
+
+describe('isRemoteBranchMissing', () => {
+  test('matches the git messages for a nonexistent remote branch', () => {
+    assert.equal(isRemoteBranchMissing(
+      "Command failed: git fetch origin\nfatal: couldn't find remote ref refs/heads/nope"
+    ), true);
+    assert.equal(isRemoteBranchMissing(
+      'fatal: Remote branch nope not found in upstream origin'
+    ), true);
+  });
+
+  test('does NOT match auth/network/other failures (those keep 500 semantics)', () => {
+    assert.equal(isRemoteBranchMissing('Authentication failed for https://...'), false);
+    assert.equal(isRemoteBranchMissing('fatal: unable to access ... Could not resolve host'), false);
+    assert.equal(isRemoteBranchMissing(''), false);
+    assert.equal(isRemoteBranchMissing(null), false);
+    assert.equal(isRemoteBranchMissing(undefined), false);
+  });
+});
+
+describe('fetchRequestedRef (injected exec - pins the exact command)', () => {
+  test('QA failure mode: branch outside the single-branch refspec -> explicit fetch with the right refspec', async () => {
+    const calls = [];
+    const fakeExec = async (cmd, opts) => { calls.push({ cmd, opts }); };
+    await fetchRequestedRef(fakeExec, QA_PR_BRANCH, '/tmp/workspaces/VISIONHAMMER_vh-e2e-legacy-java8');
+    assert.equal(calls.length, 1);
+    assert.equal(
+      calls[0].cmd,
+      `git fetch origin "+refs/heads/${QA_PR_BRANCH}:refs/remotes/origin/${QA_PR_BRANCH}"`
+    );
+    assert.equal(calls[0].opts.cwd, '/tmp/workspaces/VISIONHAMMER_vh-e2e-legacy-java8');
+  });
+
+  test('branch nonexistent on remote -> tagged BRANCH_NOT_FOUND with a clear message (not a generic 500)', async () => {
+    const fakeExec = async () => {
+      throw new Error("Command failed: git fetch\nfatal: couldn't find remote ref refs/heads/nope");
+    };
+    await assert.rejects(
+      () => fetchRequestedRef(fakeExec, 'nope', '/tmp/x'),
+      (err) => {
+        assert.equal(err.code, 'BRANCH_NOT_FOUND');
+        assert.equal(err.httpStatus, 404);
+        assert.equal(err.message, 'branch not found on remote: nope');
+        return true;
+      }
+    );
+  });
+
+  test('shell-unsafe branch -> tagged INVALID_BRANCH, exec is NEVER called', async () => {
+    let called = 0;
+    const fakeExec = async () => { called++; };
+    await assert.rejects(
+      () => fetchRequestedRef(fakeExec, 'main; rm -rf /', '/tmp/x'),
+      (err) => {
+        assert.equal(err.code, 'INVALID_BRANCH');
+        assert.equal(err.httpStatus, 400);
+        return true;
+      }
+    );
+    assert.equal(called, 0);
+  });
+
+  test('other fetch failures (auth/network) are rethrown UNTOUCHED (existing catch semantics)', async () => {
+    const boom = new Error('fatal: Authentication failed');
+    const fakeExec = async () => { throw boom; };
+    await assert.rejects(() => fetchRequestedRef(fakeExec, 'main', '/tmp/x'), (err) => err === boom);
+  });
+});
+
+describe('fetchRequestedRef (real git - reproduces the QA scenario end-to-end)', () => {
+  let base, originDir, cloneDir;
+  const GIT_ID = '-c user.email="t@t" -c user.name="t"';
+
+  before(async () => {
+    base = fs.mkdtempSync(path.join(os.tmpdir(), 'branch-refspec-'));
+    originDir = path.join(base, 'origin-repo');
+    cloneDir = path.join(base, 'clone');
+    fs.mkdirSync(originDir, { recursive: true });
+    // origin repo with main only
+    await execAsync(`git init -b main`, { cwd: originDir });
+    fs.writeFileSync(path.join(originDir, 'a.txt'), 'v1\n');
+    await execAsync(`git add . && git ${GIT_ID} commit -m init`, { cwd: originDir });
+    // the auto-fix session clone: single-branch on main (restricts the refspec)
+    await execAsync(`git clone --branch main --single-branch "file://${originDir}" "${cloneDir}"`);
+    // the PR branch is born on the remote AFTER the clone
+    await execAsync(`git checkout -b ${QA_PR_BRANCH}`, { cwd: originDir });
+    fs.writeFileSync(path.join(originDir, 'a.txt'), 'v2-fix\n');
+    await execAsync(`git ${GIT_ID} commit -am fix`, { cwd: originDir });
+    await execAsync(`git checkout main`, { cwd: originDir });
+  });
+
+  after(() => {
+    try { fs.rmSync(base, { recursive: true, force: true }); } catch (_) {}
+  });
+
+  test('plain `git fetch origin` does NOT bring the new branch (the bug)', async () => {
+    await execAsync(`git fetch origin`, { cwd: cloneDir });
+    await assert.rejects(() => execAsync(`git rev-parse --verify origin/${QA_PR_BRANCH}`, { cwd: cloneDir }));
+  });
+
+  test('explicit ref fetch makes checkout + reset --hard succeed (the fix)', async () => {
+    await fetchRequestedRef((cmd, opts) => execAsync(cmd, opts), QA_PR_BRANCH, cloneDir);
+    await execAsync(`git rev-parse --verify origin/${QA_PR_BRANCH}`, { cwd: cloneDir });
+    // the exact reuse sequence from server.js now succeeds
+    await execAsync(`git checkout ${QA_PR_BRANCH} 2>/dev/null || git checkout -b ${QA_PR_BRANCH} origin/${QA_PR_BRANCH}`, { cwd: cloneDir });
+    await execAsync(`git reset --hard origin/${QA_PR_BRANCH}`, { cwd: cloneDir });
+    assert.equal(fs.readFileSync(path.join(cloneDir, 'a.txt'), 'utf8'), 'v2-fix\n');
+  });
+
+  test('branch already in the refspec (main) -> explicit fetch is a no-op, behavior unchanged', async () => {
+    await fetchRequestedRef((cmd, opts) => execAsync(cmd, opts), 'main', cloneDir);
+    await execAsync(`git checkout main`, { cwd: cloneDir });
+    await execAsync(`git reset --hard origin/main`, { cwd: cloneDir });
+  });
+
+  test('branch that never existed on the remote -> clear BRANCH_NOT_FOUND', async () => {
+    await assert.rejects(
+      () => fetchRequestedRef((cmd, opts) => execAsync(cmd, opts), 'no-such-branch', cloneDir),
+      (err) => {
+        assert.equal(err.code, 'BRANCH_NOT_FOUND');
+        assert.equal(err.message, 'branch not found on remote: no-such-branch');
+        return true;
+      }
+    );
+  });
+});

package/test/burst-suppressor.test.js

@@ -0,0 +1,60 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { BurstSuppressor, normalize, suppressionKey } from '../src/siblings/burst-suppressor.js';
+
+const evt = (message, over = {}) => ({
+    adapter: 'sap', errorCode: 'E', file: '/logs/dev_w0',
+    message, source: 'sap-01', timestamp: '2026-07-28T10:00:00Z', ...over,
+});
+
+test('normalize collapses rotating ids; raw values differ', () => {
+    const a = 'DB timeout id=10001 uuid=1b4e28ba-2fa1-11d2-883f-0016d3cca427 at 2026-07-28T10:00:01Z addr=0x1f3a /job/req-9001';
+    const b = 'DB timeout id=99887 uuid=6ecd8c99-4036-403d-bf84-cf8400f67836 at 2026-07-28T11:22:33.5Z addr=0xbeef /job/req-4444';
+    assert.notEqual(a, b);
+    assert.equal(normalize(a), normalize(b)); // rotating tokens -> same placeholders
+});
+
+test('WITHOUT normalization the storm keys are all distinct (suppresses nothing)', () => {
+    // Proves normalization is what makes suppression work.
+    const rawKeys = new Set();
+    for (let i = 0; i < 500; i++) rawKeys.add(`sap|DB timeout id=${10000 + i}|/logs/dev_w0`); // raw, no normalize
+    assert.equal(rawKeys.size, 500);
+    // Same inputs through suppressionKey (which normalizes) collapse to one.
+    const normKeys = new Set();
+    for (let i = 0; i < 500; i++) normKeys.add(suppressionKey(evt(`DB timeout id=${10000 + i}`)));
+    assert.equal(normKeys.size, 1);
+});
+
+test('storm of 500 variants collapses to 1 within the window', () => {
+    let t = 1_000_000;
+    const s = new BurstSuppressor({ ttlMs: 45000, now: () => t });
+    let passed = 0;
+    for (let i = 0; i < 500; i++) {
+        t += 10; // 5s total, all within the 45s window
+        if (!s.shouldSuppress(evt(`DB timeout id=${10000 + i}`))) passed++;
+    }
+    assert.equal(passed, 1);
+});
+
+test('two genuinely distinct errors both pass', () => {
+    const s = new BurstSuppressor({ ttlMs: 45000, now: () => 5 });
+    assert.equal(s.shouldSuppress(evt('disk full on /data')), false);
+    assert.equal(s.shouldSuppress(evt('connection refused to db')), false);
+});
+
+test('same error passes again after TTL expiry', () => {
+    let t = 0;
+    const s = new BurstSuppressor({ ttlMs: 45000, now: () => t });
+    assert.equal(s.shouldSuppress(evt('DB timeout id=10001')), false); // admit
+    t = 20000;
+    assert.equal(s.shouldSuppress(evt('DB timeout id=10002')), true);  // within window -> suppress
+    t = 46000; // window elapsed from admission
+    assert.equal(s.shouldSuppress(evt('DB timeout id=10003')), false); // passes again (recurrence signal)
+});
+
+test('bounded LRU map does not grow unbounded', () => {
+    let t = 0;
+    const s = new BurstSuppressor({ ttlMs: 45000, maxKeys: 100, now: () => (t += 1) });
+    for (let i = 0; i < 1000; i++) s.shouldSuppress(evt(`unique error number ${i} zzz`, { file: `/f/${i}` }));
+    assert.ok(s.seen.size <= 100, `size ${s.seen.size} must be <= 100`);
+});

package/test/capabilities-access.test.js

@@ -0,0 +1,47 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { isAuthorized, publicCapabilities, fullCapabilities } from '../src/siblings/capabilities.js';
+
+const MANIFEST = {
+    mode: 'SPLIT_PLANE', reason: 'partial local capability',
+    source_available: false, toolchains: ['git', 'python3'],
+    container_runtime: 'docker', docker_sock: false, egress: { gateway: true },
+    build_capable: false, test_capable: false, runtimes: [],
+};
+const STATUS = { contract_ok: false, contract_preflight: { ok: false, reason: 'missing_internal_token' }, stats: {} };
+
+const SENSITIVE = ['toolchains', 'container_runtime', 'docker_sock', 'egress', 'source_available'];
+
+test('unauthenticated view exposes health only, no topology inventory', () => {
+    const v = publicCapabilities(MANIFEST, STATUS, 42);
+    assert.equal(v.authenticated, false);
+    assert.equal(v.mode, 'SPLIT_PLANE');
+    assert.equal(v.contract.ok, false);
+    assert.equal(v.contract.preflight_reason, 'missing_internal_token'); // the C1 signal
+    assert.equal(v.uptime_s, 42);
+    for (const k of SENSITIVE) assert.ok(!(k in v), `${k} must be redacted when unauthenticated`);
+});
+
+test('authenticated view adds the client-infra inventory', () => {
+    const v = fullCapabilities(MANIFEST, STATUS, 42);
+    assert.equal(v.authenticated, true);
+    for (const k of SENSITIVE) assert.ok(k in v, `${k} must be present when authenticated`);
+    assert.deepEqual(v.toolchains, ['git', 'python3']);
+    assert.equal(v.container_runtime, 'docker');
+    // health still present
+    assert.equal(v.mode, 'SPLIT_PLANE');
+    assert.equal(v.contract.ok, false);
+});
+
+test('isAuthorized: correct bearer passes, wrong/absent fails', () => {
+    const tok = 'AGENT_API_KEY_123';
+    assert.equal(isAuthorized({ headers: { authorization: `Bearer ${tok}` } }, tok), true);
+    assert.equal(isAuthorized({ headers: { authorization: 'Bearer wrong' } }, tok), false);
+    assert.equal(isAuthorized({ headers: {} }, tok), false);
+    assert.equal(isAuthorized({ headers: { authorization: tok } }, tok), false); // missing "Bearer "
+});
+
+test('isAuthorized fails closed when no token is configured', () => {
+    assert.equal(isAuthorized({ headers: { authorization: 'Bearer anything' } }, null), false);
+    assert.equal(isAuthorized({ headers: { authorization: 'Bearer anything' } }, ''), false);
+});

package/test/capabilities.test.js

@@ -0,0 +1,87 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { buildManifest, deriveMode, computeCapabilityManifest } from '../src/siblings/capabilities.js';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const loadFixture = (name) =>
+    JSON.parse(fs.readFileSync(path.join(__dirname, 'fixtures', 'capabilities', name), 'utf-8'));
+
+test('pull-only Docker host derives SPLIT_PLANE, not FULL_LOCAL', () => {
+    const fx = loadFixture('pull-only-docker.json');
+    const m = buildManifest(fx);
+
+    assert.equal(m.mode, 'SPLIT_PLANE');
+    assert.notEqual(m.mode, 'FULL_LOCAL');
+    // Evidence the fixture was interpreted as intended:
+    assert.equal(m.source_available, false);
+    assert.equal(m.build_capable, false);
+    assert.equal(m.test_capable, false);
+    assert.deepEqual(m.toolchains.sort(), ['git', 'python3']);
+    assert.match(m.reason, /no source working tree/);
+});
+
+test('full toolchain + source on disk derives FULL_LOCAL', () => {
+    const m = buildManifest({
+        diag: { tools: {
+            git: { installed: true }, java: { installed: true }, maven: { installed: true },
+            node: { installed: true }, npm: { installed: true },
+        } },
+        sourceAvailable: true,
+        egress: { gateway: true },
+        conclusive: true,
+    });
+    assert.equal(m.mode, 'FULL_LOCAL');
+    assert.equal(m.build_capable, true);
+    assert.equal(m.test_capable, true);
+});
+
+test('inconclusive detection NEVER defaults to FULL_LOCAL', () => {
+    const m = buildManifest({
+        diag: { tools: { java: { installed: true }, maven: { installed: true }, git: { installed: true } } },
+        sourceAvailable: true, // even with "everything", inconclusive must degrade
+        egress: { gateway: true },
+        conclusive: false,
+    });
+    assert.equal(m.mode, 'DETECT_ONLY');
+    assert.match(m.reason, /inconclusive/);
+});
+
+test('no source, no toolchain, no git/egress derives DETECT_ONLY', () => {
+    const { mode } = deriveMode({
+        source_available: false, build_capable: false, test_capable: false,
+        hasGit: false, egress: {}, conclusive: true,
+    });
+    assert.equal(mode, 'DETECT_ONLY');
+});
+
+test('computeCapabilityManifest degrades to DETECT_ONLY when diagnostics throw', async () => {
+    const throwingDiagnostics = { diagnose: async () => { throw new Error('boom'); } };
+    const m = await computeCapabilityManifest({
+        diagnostics: throwingDiagnostics,
+        runtimeRegistry: { runtimes: new Map() },
+        probes: { sourceAvailable: true, dockerSock: false, containerRuntime: 'docker', egress: { gateway: true } },
+    });
+    assert.equal(m.mode, 'DETECT_ONLY');
+    assert.match(m.reason, /inconclusive/);
+});
+
+test('computeCapabilityManifest honours injected probes + diagnostics (pull-only)', async () => {
+    const fx = loadFixture('pull-only-docker.json');
+    const diagnostics = { diagnose: async () => fx.diag };
+    const m = await computeCapabilityManifest({
+        diagnostics,
+        runtimeRegistry: { runtimes: new Map() },
+        probes: {
+            sourceAvailable: fx.sourceAvailable,
+            dockerSock: fx.dockerSock,
+            containerRuntime: fx.containerRuntime,
+            egress: fx.egress,
+        },
+    });
+    assert.equal(m.mode, 'SPLIT_PLANE');
+    assert.equal(m.container_runtime, 'docker');
+    assert.equal(m.docker_sock, false);
+});

package/test/child-env.test.js

@@ -0,0 +1,23 @@
+// test/child-env.test.js — model-authored commands must not see the agent's secrets.
+import { test, describe } from 'node:test';
+import assert from 'node:assert/strict';
+import { sanitizedChildEnv, isSecretEnvName } from '../src/utils/child-env.js';
+
+describe('sanitizedChildEnv', () => {
+  test('strips token/secret/password/key variables, keeps the rest and extras', () => {
+    const env = {
+      PATH: '/usr/bin', HOME: '/home/x', JAVA_HOME: '/opt/java',
+      AUTH_TOKEN: 'a', DEEPDEBUG_API_KEY: 'b', AGENT_SHARED_SECRET: 'c', LOCAL_AGENT_TOKEN: 'd',
+      GITHUB_TOKEN: 'e', DB_PASSWORD: 'f', AWS_SECRET_ACCESS_KEY: 'g', LOCAL_AGENT_SIGNING_KEY: 'h',
+      GIT_TERMINAL_PROMPT: '0', GIT_ASKPASS: 'echo', UNDEFINED: undefined,
+    };
+    const out = sanitizedChildEnv(env, { FORCE_COLOR: '0' });
+    assert.deepEqual(out, { PATH: '/usr/bin', HOME: '/home/x', JAVA_HOME: '/opt/java', GIT_TERMINAL_PROMPT: '0', GIT_ASKPASS: 'echo', FORCE_COLOR: '0' });
+  });
+  test('isSecretEnvName', () => {
+    assert.equal(isSecretEnvName('NPM_TOKEN'), true);
+    assert.equal(isSecretEnvName('npm_config_registry'), false);
+    assert.equal(isSecretEnvName('GIT_SSH_COMMAND'), false);
+    assert.equal(isSecretEnvName('MAVEN_OPTS'), false);
+  });
+});