deepdebug-local-agent 1.12.0 → 1.13.0

package/test/la-protocol-v2/chat-store.test.js

@@ -0,0 +1,301 @@
+// LA-3: the ChatStore (disk, retention, no secrets, cursor of a long-poll), the cursor registry and the config. Pure units: no session, no agent2.
+// The same pieces with the real link, the content handlers and a fake agent2 are in chat-la.test.js.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import crypto from "node:crypto";
+import { resolveChatConfig, chatRequested } from "../../src/la-protocol-v2/chat/config.js";
+import { createChatStore } from "../../src/la-protocol-v2/chat/store.js";
+import { createCursorRegistry } from "../../src/la-protocol-v2/chat/cursors.js";
+import { maskChatText, WITHHELD_LINE, WITHHELD_TEXT } from "../../src/la-protocol-v2/chat/dlp.js";
+
+const TENANT = "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f";
+const GH = "ghp_" + "A1b2C3d4E5f6G7h8I9j0K1l2M3n4O5p6Q7r8";
+const PEM = "-----BEGIN RSA PRIVATE KEY-----\nMIIEowIBAAKCAQEAxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\n-----END RSA PRIVATE KEY-----";
+const DLP_ENV = { LOCAL_AGENT_DLP_MODE: "enforce", LOCAL_AGENT_DLP_BLOCK_CLASSES: "private-key" };
+const uuid = () => crypto.randomUUID();
+
+function tmp() { return fs.mkdtempSync(path.join(os.tmpdir(), "la-chat-")); }
+function mk({ env = {}, clock, isActive } = {}) {
+    const dir = tmp();
+    const full = { ...DLP_ENV, LOCAL_AGENT_CHAT: "true", LOCAL_AGENT_CHAT_DIR: dir, ...env };
+    const config = resolveChatConfig(full, () => {});
+    const logs = [];
+    const store = createChatStore({ dir, tenantId: TENANT, config, env: full, log: { info: (m) => logs.push(m), warn: (m) => logs.push(m), log: (m) => logs.push(m) }, ...(clock ? { now: clock } : {}), ...(isActive ? { isActive } : {}) });
+    return { dir, store, config, env: full, logs, stop: () => { store.close(); fs.rmSync(dir, { recursive: true, force: true }); } };
+}
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const line = (o) => JSON.stringify(o);
+
+test("config: off by default; unrecognised stays off; numbers are clamped; 30 days of retention", () => {
+    assert.deepEqual(resolveChatConfig({}, () => {}), { enabled: false });
+    const warns = [];
+    assert.deepEqual(resolveChatConfig({ LOCAL_AGENT_CHAT: "maybe" }, (m) => warns.push(m)), { enabled: false });
+    assert.equal(warns.length, 1);
+    assert.equal(chatRequested({ LOCAL_AGENT_CHAT: "TRUE" }), true);
+    assert.equal(chatRequested({ LOCAL_AGENT_CHAT: "no" }), false);
+    const c = resolveChatConfig({ LOCAL_AGENT_CHAT: "true" }, () => {});
+    assert.equal(c.retentionMs, 30 * 86_400_000);
+    assert.equal(c.pollMs, 8_000);
+    assert.match(c.dir, /\.deepdebug[\\/]chat$/);
+    const x = resolveChatConfig({ LOCAL_AGENT_CHAT: "true", LOCAL_AGENT_CHAT_POLL_MS: "999999", LOCAL_AGENT_CHAT_RETENTION_DAYS: "0", LOCAL_AGENT_CHAT_PAGE_EVENTS: "5000", LOCAL_AGENT_CHAT_MAX_BYTES: "-1" }, () => {});
+    assert.equal(x.pollMs, 8_000, "the long-poll never exceeds the 8 s of the contract");
+    assert.equal(x.retentionMs, 30 * 86_400_000, "an invalid retention falls back to the default, not to forever");
+    assert.equal(x.pageEvents, 256, "above the contract's 512 per page falls back");
+    assert.equal(x.maxBytes, 256 * 1024 * 1024);
+});
+
+test("dlp: enforce only; a secret is masked, a blocked class is withheld, anything else is fail closed", () => {
+    const ok = maskChatText(`key ${GH}`, { env: DLP_ENV });
+    assert.equal(ok.ok, true);
+    assert.ok(!ok.text.includes(GH));
+    assert.match(ok.text, /\[REDACTED:/);
+    assert.equal(maskChatText(PEM, { env: DLP_ENV }).blocked, true);
+    assert.equal(maskChatText("hello", { env: { LOCAL_AGENT_DLP_MODE: "warn" } }).ok, false, "warn is not enough to let chat text out");
+    assert.equal(maskChatText("hello", { env: {} }).ok, false);
+    assert.equal(maskChatText("x".repeat(100), { env: { ...DLP_ENV, LOCAL_AGENT_DLP_MAX_BYTES: "10" } }).ok, false, "above the DLP limit: withheld, never let out");
+    assert.equal(maskChatText(42, { env: DLP_ENV }).ok, false);
+    assert.doesNotThrow(() => JSON.parse(WITHHELD_LINE));
+    assert.equal(JSON.parse(WITHHELD_LINE).type, "status");
+});
+
+test("store: files are 0600 in a 0700 folder, JSONL, and NO secret ever reaches the disk (prompt, events, answer)", async () => {
+    const t = mk();
+    try {
+        const id = uuid();
+        const rec = t.store.begin({ jobId: id, workspaceId: "ws-1", userText: `fix the login, token ${GH} CANARY-PROMPT` });
+        rec.append(line({ type: "token", content: `the key is ${GH} CANARY-TOKEN` }));
+        rec.append(line({ type: "tool_result", content: PEM }));
+        rec.append(line({ type: "summary", content: { answer: `answer ${GH} CANARY-ANSWER` } }));
+        rec.finish("done");
+        await t.store.flush();
+        const file = path.join(t.dir, TENANT, `${id}.jsonl`);
+        const text = fs.readFileSync(file, "utf8");
+        for (const secret of [GH, "BEGIN RSA PRIVATE KEY", "MIIEowIBAAKC"]) assert.ok(!text.includes(secret), `a secret reached the disk: ${secret.slice(0, 12)}`);
+        assert.ok(text.includes("CANARY-PROMPT") && text.includes("CANARY-ANSWER"), "the content itself is kept (it is the customer's conversation)");
+        assert.equal(fs.statSync(file).mode & 0o777, 0o600);
+        assert.equal(fs.statSync(path.join(t.dir, TENANT)).mode & 0o777, 0o700);
+        assert.equal(fs.statSync(t.dir).mode & 0o777, 0o700);
+        const recs = text.trim().split("\n").map((l) => JSON.parse(l));
+        assert.deepEqual(recs.map((r) => r.k), ["meta", "turn", "ev", "ev", "ev", "turn", "end"]);
+        assert.equal(recs[3].e, WITHHELD_LINE, "a blocked class (private key) is withheld as a whole");
+        const s = t.store.readSession({ conversationId: id, workspaceId: "ws-1" });
+        assert.deepEqual(s.turns.map((x) => x.role), ["user", "assistant"]);
+        assert.match(s.turns[1].text, /CANARY-ANSWER/);
+        assert.ok(!JSON.stringify(s).includes(GH));
+        assert.ok(!t.logs.join("\n").includes("CANARY"), "nothing of the content in the logs");
+    } finally { t.stop(); }
+});
+
+test("store: a file name can only be a UUID; a path-like id is not a conversation", () => {
+    const t = mk();
+    try {
+        assert.throws(() => t.store.begin({ jobId: "../../etc/passwd", workspaceId: "ws-1", userText: "x" }));
+        assert.throws(() => t.store.begin({ jobId: "not-a-uuid", workspaceId: "ws-1", userText: "x" }));
+        assert.throws(() => t.store.begin({ jobId: uuid(), workspaceId: "", userText: "x" }));
+        assert.deepEqual(fs.readdirSync(path.join(t.dir, TENANT)), []);
+    } finally { t.stop(); }
+});
+
+test("store: read after a restart (new store, same folder): the turns are there, the unfinished job is `interrupted` and its stream is done; another workspace sees nothing", async () => {
+    const t = mk();
+    try {
+        const a = uuid();
+        const b = uuid();
+        const ra = t.store.begin({ jobId: a, workspaceId: "ws-1", userText: "first question" });
+        ra.append(line({ type: "token", content: "answer one" }));
+        ra.finish("done");
+        const rb = t.store.begin({ jobId: b, workspaceId: "ws-1", userText: "second question" });
+        rb.append(line({ type: "token", content: "half an answer" }));   // the agent dies here: no finish
+        await t.store.flush();
+        t.store.close();
+        const again = createChatStore({ dir: t.dir, tenantId: TENANT, config: t.config, env: t.env, log: console });
+        try {
+            const sa = again.readSession({ conversationId: a, workspaceId: "ws-1" });
+            assert.deepEqual(sa.turns.map((x) => [x.role, x.text]), [["user", "first question"], ["assistant", "answer one"]]);
+            const pa = await again.readStream({ conversationId: a, workspaceId: "ws-1", from: 0, waitMs: 0 });
+            assert.equal(pa.events.length, 1);
+            assert.equal(pa.done, true);
+            const pb = await again.readStream({ conversationId: b, workspaceId: "ws-1", from: 0, waitMs: 0 });
+            assert.equal(pb.status, "ok");
+            assert.equal(pb.done, true, "nobody is writing it any more: the stream closes instead of holding the caller forever");
+            assert.equal((await again.readStream({ conversationId: b, workspaceId: "ws-2", from: 0, waitMs: 0 })).status, "not_found", "a conversation belongs to its workspace");
+            assert.equal(again.readSession({ conversationId: b, workspaceId: "ws-2" }).status, "not_found");
+            assert.equal(again.readSession({ conversationId: uuid(), workspaceId: "ws-1" }).status, "not_found");
+        } finally { again.close(); }
+    } finally { t.stop(); }
+});
+
+test("store: a torn last line (crash while writing) is ignored, the rest is read", async () => {
+    const t = mk();
+    try {
+        const id = uuid();
+        const r = t.store.begin({ jobId: id, workspaceId: "ws-1", userText: "q" });
+        r.append(line({ type: "token", content: "ok" }));
+        r.finish("done");
+        await t.store.flush();
+        fs.appendFileSync(path.join(t.dir, TENANT, `${id}.jsonl`), '{"k":"ev","e":"{\\"type\\":\\"tok');
+        t.store.close();
+        const again = createChatStore({ dir: t.dir, tenantId: TENANT, config: t.config, env: t.env, log: console });
+        try { assert.equal((await again.readStream({ conversationId: id, workspaceId: "ws-1", from: 0, waitMs: 0 })).events.length, 1); } finally { again.close(); }
+    } finally { t.stop(); }
+});
+
+test("stream: events come in order with their position; a page is bounded; `from` past the end is not a position", async () => {
+    const t = mk({ env: { LOCAL_AGENT_CHAT_PAGE_EVENTS: "3" } });
+    try {
+        const id = uuid();
+        const r = t.store.begin({ jobId: id, workspaceId: "ws-1", userText: "q" });
+        for (let i = 0; i < 7; i++) r.append(line({ type: "token", content: `e${i}` }));
+        r.finish("done");
+        const p1 = await t.store.readStream({ conversationId: id, workspaceId: "ws-1", from: 0, waitMs: 0 });
+        assert.deepEqual(p1.events.map((e) => e.i), [0, 1, 2]);
+        assert.equal(p1.next, 3);
+        assert.equal(p1.done, false);
+        const p3 = await t.store.readStream({ conversationId: id, workspaceId: "ws-1", from: 6, waitMs: 0 });
+        assert.deepEqual(p3.events.map((e) => e.i), [6]);
+        assert.equal(p3.done, true);
+        const end = await t.store.readStream({ conversationId: id, workspaceId: "ws-1", from: 7, waitMs: 0 });
+        assert.deepEqual([end.events.length, end.done], [0, true]);
+        assert.equal((await t.store.readStream({ conversationId: id, workspaceId: "ws-1", from: 8, waitMs: 0 })).status, "not_found");
+        assert.equal((await t.store.readStream({ conversationId: id, workspaceId: "ws-1", from: -1, waitMs: 0 })).status, "not_found");
+    } finally { t.stop(); }
+});
+
+test("stream: the long-poll returns as soon as an event arrives, not at the end of the hold; an idle one returns empty with done=false after the hold", async () => {
+    const t = mk();
+    try {
+        const id = uuid();
+        const r = t.store.begin({ jobId: id, workspaceId: "ws-1", userText: "q" });
+        const t0 = Date.now();
+        setTimeout(() => r.append(line({ type: "token", content: "late" })), 60);
+        const p = await t.store.readStream({ conversationId: id, workspaceId: "ws-1", from: 0, waitMs: 3000 });
+        assert.equal(p.events.length, 1);
+        assert.ok(Date.now() - t0 < 1500, `woken by the event (${Date.now() - t0} ms)`);
+        const t1 = Date.now();
+        const idle = await t.store.readStream({ conversationId: id, workspaceId: "ws-1", from: 1, waitMs: 150 });
+        assert.deepEqual([idle.events.length, idle.done, idle.next], [0, false, 1]);
+        assert.ok(Date.now() - t1 >= 120, "the hold was honoured");
+        // finishing wakes a waiting poll with done=true
+        setTimeout(() => r.finish("done"), 50);
+        const last = await t.store.readStream({ conversationId: id, workspaceId: "ws-1", from: 1, waitMs: 3000 });
+        assert.deepEqual([last.events.length, last.done], [0, true]);
+    } finally { t.stop(); }
+});
+
+test("stream: an aborted request returns at once (the request was cancelled); a job that is alive but not begun yet is waited for, one that is not alive is not_found", async () => {
+    let alive = true;
+    const t = mk({ isActive: () => alive });
+    try {
+        const id = uuid();
+        const ac = new AbortController();
+        setTimeout(() => ac.abort(), 40);
+        const t0 = Date.now();
+        const a = await t.store.readStream({ conversationId: id, workspaceId: "ws-1", from: 0, waitMs: 5000, signal: ac.signal });
+        assert.equal(a.status, "aborted");
+        assert.ok(Date.now() - t0 < 1000);
+        alive = false;
+        assert.equal((await t.store.readStream({ conversationId: id, workspaceId: "ws-1", from: 0, waitMs: 200 })).status, "not_found", "nobody has this job");
+        alive = true;
+        setTimeout(() => t.store.begin({ jobId: id, workspaceId: "ws-1", userText: "q" }), 80);
+        const b = await t.store.readStream({ conversationId: id, workspaceId: "ws-1", from: 0, waitMs: 2000 });
+        assert.equal(b.status, "ok", "the job reached its runner while the request was held");
+        assert.equal(b.events.length, 0);
+    } finally { t.stop(); }
+});
+
+test("store: one conversation is capped (events beyond it are dropped, the chat is truncated); the page is bounded in bytes", async () => {
+    const t = mk({ env: { LOCAL_AGENT_CHAT_MAX_CONVERSATION_BYTES: String(16 * 1024), LOCAL_AGENT_CHAT_PAGE_BYTES: String(16 * 1024) } });
+    try {
+        const id = uuid();
+        const r = t.store.begin({ jobId: id, workspaceId: "ws-1", userText: "q" });
+        let kept = 0;
+        for (let i = 0; i < 20; i++) if (r.append(line({ type: "token", content: "x".repeat(2000) }))) kept++;
+        r.finish("done");
+        assert.ok(kept >= 5 && kept < 20, `kept ${kept}`);
+        assert.equal(t.store.stats.truncated, 1);
+        assert.equal(t.store.readSession({ conversationId: id, workspaceId: "ws-1" }).truncated, true);
+        const p = await t.store.readStream({ conversationId: id, workspaceId: "ws-1", from: 0, waitMs: 0 });
+        assert.equal(p.truncated, true);
+        assert.ok(p.events.length <= kept);
+    } finally { t.stop(); }
+});
+
+test("retention: older than the window goes, newer stays; a conversation being written is never swept; the ceiling removes the oldest first", async () => {
+    let clock = Date.parse("2026-11-05T10:00:00Z");
+    const t = mk({ clock: () => clock, env: { LOCAL_AGENT_CHAT_RETENTION_DAYS: "30", LOCAL_AGENT_CHAT_MAX_BYTES: String(1024 * 1024) } });
+    try {
+        const old = uuid(); const fresh = uuid(); const live = uuid();
+        for (const [id, text] of [[old, "old"], [fresh, "fresh"]]) { const r = t.store.begin({ jobId: id, workspaceId: "ws-1", userText: text }); r.finish("done"); }
+        t.store.begin({ jobId: live, workspaceId: "ws-1", userText: "being written" });
+        await t.store.flush();
+        const f = (id) => path.join(t.dir, TENANT, `${id}.jsonl`);
+        const days = (n) => new Date(clock - n * 86_400_000);
+        fs.utimesSync(f(old), days(31), days(31));
+        fs.utimesSync(f(fresh), days(29), days(29));
+        fs.utimesSync(f(live), days(90), days(90));   // old on disk, but alive in this process
+        const r1 = await t.store.sweep();
+        assert.equal(r1.removed, 1);
+        assert.ok(!fs.existsSync(f(old)) && fs.existsSync(f(fresh)) && fs.existsSync(f(live)));
+        assert.equal(t.store.readSession({ conversationId: old, workspaceId: "ws-1" }).status, "not_found", "gone from memory too");
+        // the ceiling: three finished conversations of ~400 KiB each against 1 MiB
+        const ids = [uuid(), uuid(), uuid()];
+        for (const [n, id] of ids.entries()) {
+            const r = t.store.begin({ jobId: id, workspaceId: "ws-1", userText: "big" });
+            for (let i = 0; i < 26; i++) r.append(line({ type: "token", content: "lorem ipsum dolor ".repeat(800) }));
+            r.finish("done");
+            await t.store.flush();
+            fs.utimesSync(f(id), days(10 - n), days(10 - n));
+        }
+        const before = ids.filter((id) => fs.existsSync(f(id))).length;
+        assert.ok(ids.reduce((n, id) => n + fs.statSync(f(id)).size, 0) > 1024 * 1024, "the three together are above the ceiling");
+        const r2 = await t.store.sweep();
+        const after = ids.filter((id) => fs.existsSync(f(id)));
+        assert.equal(before, 3);
+        assert.ok(r2.removed >= 1 && after.length < 3, "the store went under its ceiling");
+        assert.ok(!after.includes(ids[0]), "the oldest of the three is the first to go");
+        assert.ok(fs.existsSync(f(live)), "the one being written is untouched");
+    } finally { t.stop(); }
+});
+
+test("deleteWorkspace: removes the conversations of one workspace and only those", async () => {
+    const t = mk();
+    try {
+        const a = uuid(); const b = uuid();
+        t.store.begin({ jobId: a, workspaceId: "ws-1", userText: "q" }).finish("done");
+        t.store.begin({ jobId: b, workspaceId: "ws-2", userText: "q" }).finish("done");
+        await t.store.flush();
+        assert.equal(await t.store.deleteWorkspace("ws-1"), 1);
+        assert.equal(t.store.readSession({ conversationId: a, workspaceId: "ws-1" }).status, "not_found");
+        assert.equal(t.store.readSession({ conversationId: b, workspaceId: "ws-2" }).status, "ok");
+    } finally { t.stop(); }
+});
+
+test("cursors: 43 chars, opaque, idempotent per position, bound to the workspace, expire, bounded", () => {
+    let now = 1_000;
+    const c = createCursorRegistry({ tenantId: TENANT, ttlMs: 10_000, maxEntries: 4, now: () => now });
+    const job = uuid();
+    const id = c.mint({ workspaceId: "ws-1", jobId: job, next: 5 });
+    assert.match(id, /^[A-Za-z0-9_-]{43}$/);
+    assert.equal(c.mint({ workspaceId: "ws-1", jobId: job, next: 5 }), id, "the same position, the same id (a long-poll that timed out empty does not mint a new one)");
+    assert.notEqual(c.mint({ workspaceId: "ws-1", jobId: job, next: 6 }), id);
+    assert.deepEqual(c.resolve(id, { workspaceId: "ws-1" }), { jobId: job, next: 5 });
+    assert.deepEqual(c.resolve(id, { workspaceId: "ws-1" }), { jobId: job, next: 5 }, "not consumed by use: a lost answer is asked for again");
+    assert.equal(c.resolve(id, { workspaceId: "ws-2" }), null, "another workspace");
+    assert.equal(c.resolve("A".repeat(43), { workspaceId: "ws-1" }), null);
+    assert.equal(c.resolve("short", { workspaceId: "ws-1" }), null);
+    assert.equal(c.resolve(job, { workspaceId: "ws-1" }), null, "a job id is not a cursor");
+    assert.equal(c.resolve(`${id}=`, { workspaceId: "ws-1" }), null);
+    now += 10_001;
+    assert.equal(c.resolve(id, { workspaceId: "ws-1" }), null, "expired");
+    for (let i = 0; i < 10; i++) c.mint({ workspaceId: "ws-1", jobId: job, next: 100 + i });
+    assert.ok(c.size <= 4, "bounded");
+});
+
+test("sanity: the WITHHELD constants are valid pieces for the contract (event line min 1 char, JSON)", () => {
+    assert.ok(WITHHELD_LINE.length > 0 && WITHHELD_LINE.length < 16384);
+    assert.ok(WITHHELD_TEXT.length > 0);
+    void sleep;
+});

package/test/la-protocol-v2/contract-v21.test.js

@@ -15,8 +15,8 @@ const VECTORS = path.join(path.dirname(fileURLToPath(import.meta.url)), "../cont
 const load = (f) => JSON.parse(fs.readFileSync(path.join(VECTORS, f), "utf8")).vectors;
 const sha = (s) => crypto.createHash("sha256").update(Buffer.from(s, "utf8")).digest("hex");
 
-test("the copy is revision 2.2 (2.1 is a subset) and every 2.1 vector group is present with at least its valid and invalid cases", () => {
-    assert.equal(contract.index.revision, "2.2");
+test("the copy is revision 2.3 (2.1 is a subset) and every 2.1 vector group is present with at least its valid and invalid cases", () => {
+    assert.equal(contract.index.revision, "2.3");
     const groups = [
         ["config.update", /^llm-key-/, 6, 27],       // (a): llm-key-* in config.update (the ack and register ones are checked below)
         ["webhook.forward", /^wh-chunk-/, 9, 24],    // (b)

package/test/la-protocol-v2/contract.test.js

@@ -82,11 +82,11 @@ for (const file of vectorFiles) {
     }
 }
 
-test("vectors: counts (363 frames = 82 valid + 281 invalid in this copy (contract 2.2: + policy.check 5+20, policy.decision 5+16), plus the bodies of file.list)", () => {
-    assert.equal(valid + invalid, 363);
-    assert.equal(valid, 82);
-    assert.equal(invalid, 281);
-    assert.equal(bodyVectors, 54, "file.list.body.vectors.json (F3-07c): 54 bodies");
+test("vectors: counts (386 frames = 92 valid + 294 invalid in this copy (contract 2.3: + the chat vectors of job.assign, register, hello, content.request), plus the bodies of file.list, job.stream and chat.session)", () => {
+    assert.equal(valid + invalid, 386);
+    assert.equal(valid, 92);
+    assert.equal(invalid, 294);
+    assert.equal(bodyVectors, 109, "file.list (54, F3-07c) + job.stream (31) + chat.session (24) bodies");
 });
 
 // ------------------------------------------------------------------------------------------------ tables
@@ -123,7 +123,7 @@ test("limits come from index.json and are the documented ones", () => {
         webhookChunkRawBytes: 16384, webhookMaxChunks: 64, webhookMaxBytes: 1048576, webhookSingleFrameRawBytes: 9216, webhookAssemblySeconds: 30, webhookMaxOpenAssemblies: 4,
         policyCheckPerMinute: 120, policyCheckTimeoutMs: 10000,
     });
-    assert.equal(contract.index.revision, "2.2");
+    assert.equal(contract.index.revision, "2.3");
 });
 
 // ------------------------------------------------------------------------------------------------ strict JSON

package/test/la-protocol-v2/helpers/agent2-rig.js

@@ -33,7 +33,7 @@ export function mintApprovalToken({ privateKey, keyId, tenantId = TENANT, worksp
 
 const CLI = fileURLToPath(new URL("./fake-agent2-cli.js", import.meta.url));
 
-export async function agent2Rig({ spawn = null, scenario = "ok_pr", env = {}, behavior = byPath({ chat: okJson(CANARIES.answer, { promptTokens: 40, completionTokens: 11, cost: "0.0042" }), messages: okMessages(CANARIES.answer, { promptTokens: 40, completionTokens: 11, cost: "0.0042" }) }), supportList = true, frameApprovalId = true, setKey = true, policy = null, cpPolicyCapability = true, noRunnerEnv = false, assignOver } = {}) {
+export async function agent2Rig({ spawn = null, scenario = "ok_pr", env = {}, behavior = byPath({ chat: okJson(CANARIES.answer, { promptTokens: 40, completionTokens: 11, cost: "0.0042" }), messages: okMessages(CANARIES.answer, { promptTokens: 40, completionTokens: 11, cost: "0.0042" }) }), supportList = true, frameApprovalId = true, setKey = true, policy = null, cpPolicyCapability = true, noRunnerEnv = false, assignOver, fakeKinds = ["fix", "implement"] } = {}) {
     const root = tmpDir("f308c-");
     write(root, "src/hello.js", `// ${CANARIES.file}\nconst token = "${GH}";\nconsole.log("hello");\n`);
     const fakeLlm = await startFakeLlm(behavior);
@@ -48,7 +48,7 @@ export async function agent2Rig({ spawn = null, scenario = "ok_pr", env = {}, be
     const callbackToken = crypto.randomBytes(32).toString("base64url");
     // spawn mode: the runner starts the fake agent2 as a PROCESS (fake-agent2-cli.js); `env` is the (fake) environment of the Local Agent, so it carries PATH/HOME and some secrets that must NOT reach the child
     const apiPort = spawn ? await freePort() : 0;
-    const fake = spawn ? { port: apiPort, jobs: new Map(), requests: [], approvals: new Map(), async close() {} } : await startFakeAgent2({ token: apiToken, tenantId: TENANT, scenario, llmBase: () => `${bridgeBase}/v1`, callbackUrl: () => bridgeBase, callbackToken: () => callbackToken, workspaceUrl: () => bridgeBase, workspaceToken: () => callbackToken, supportList, frameApprovalId });
+    const fake = spawn ? { port: apiPort, jobs: new Map(), requests: [], approvals: new Map(), async close() {} } : await startFakeAgent2({ token: apiToken, tenantId: TENANT, scenario, kinds: fakeKinds, llmBase: () => `${bridgeBase}/v1`, callbackUrl: () => bridgeBase, callbackToken: () => callbackToken, workspaceUrl: () => bridgeBase, workspaceToken: () => callbackToken, supportList, frameApprovalId });
     const spawnEnv = spawn ? { PATH: process.env.PATH, HOME: process.env.HOME, LOCAL_AGENT_AGENT2_CMD: JSON.stringify(spawn.cmd || [process.execPath, CLI, `--scenario=${scenario}`, ...(spawn.args || [])]), LOCAL_AGENT_AGENT2_PORT: String(apiPort),
         LOCAL_AGENT_AGENT2_START_TIMEOUT_MS: "5000", ...(spawn.env || {}) } : {};
     const fullEnv = spawn ? { ...BASE_ENV, LOCAL_AGENT_AGENT2_PIDFILE: pidFile, ...spawnEnv, ...env } : noRunnerEnv ? { ...BASE_ENV, ...env } : { ...BASE_ENV, LOCAL_AGENT_AGENT2_PIDFILE: pidFile, LOCAL_AGENT_AGENT2_URL: fake.baseUrl, LOCAL_AGENT_AGENT2_TOKEN: apiToken, LOCAL_AGENT_AGENT2_BRIDGE_PORT: String(bridgePort), LOCAL_AGENT_AGENT2_CALLBACK_TOKEN: callbackToken, ...env };

package/test/la-protocol-v2/helpers/fake-agent2-cli.js

@@ -16,6 +16,7 @@ if (has("hang")) { setInterval(() => {}, 1 << 30); } else {
         workspaceUrl: () => process.env.AGENT2_LA_WORKSPACE_URL, workspaceToken: () => process.env.AGENT2_LA_WORKSPACE_TOKEN,
         onCrash: () => process.exit(1),
         supportList: !has("no-list"),
+        kinds: process.env.AGENT2_LOCAL_CHAT_ENABLED === "true" ? ["fix", "implement", "chat"] : ["fix", "implement"],   // like the real agent2: `chat` only with AGENT2_LOCAL_CHAT_ENABLED
     });
     void f;
     if (has("die-on-job")) setInterval(() => { if (f.jobs.size) process.exit(1); }, 20);

package/test/la-protocol-v2/helpers/fake-agent2.js

@@ -115,11 +115,70 @@ export const SCENARIOS = {
         h.event({ state: "succeeded", phase: "done", errorCode: "none" });
         h.result({ outcome: "no_change", prUrl: "javascript:alert(1)" });
     },
+    // ---- LA-3: kind chat. The content stream (`GET /jobs/{id}/stream`) is what agent2's unified loop emits: JSON lines with a `type`, ending in a summary.
+    /** a question answered without a change: session_start, status, two token lines, a summary with the answer */
+    async chat_answer(job, h) {
+        h.event({ state: "running", phase: "context", iteration: 0 });
+        h.line(JSON.stringify({ type: "session_start", content: { conversationId: job.jobId, mode: "unified" } }));
+        h.line(JSON.stringify({ type: "status", content: "reading the code" }));
+        h.line(JSON.stringify({ type: "token", content: "CHAT-TOKEN-ONE the login is in AuthService" }));
+        h.line(JSON.stringify({ type: "token", content: "CHAT-TOKEN-TWO and it validates the session" }));
+        await sleep(30);
+        h.line(JSON.stringify({ type: "summary", content: { status: "COMPLETED", outcome: "ANSWERED", concludedNoChange: "true", answer: "CHAT-ANSWER-FINAL the login is in AuthService", reason: "informational", conversationId: job.jobId, prUrl: "", dryRun: true } }));
+        h.event({ state: "succeeded", phase: "done", errorCode: "none" });
+        h.result({ outcome: "no_change" });
+    },
+    /** the loop changed files on disk, the model concluded no_change: agent2 reports no filesChangedCount in the result */
+    async chat_files(job, h) {
+        h.event({ state: "running", phase: "edit", iteration: 1, filesRead: 3, filesChanged: 1 });
+        h.line(JSON.stringify({ type: "token", content: "CHAT-FILES I patched two files" }));
+        h.event({ state: "running", phase: "edit", iteration: 2, filesRead: 4, filesChanged: 3 });
+        await sleep(160);
+        h.line(JSON.stringify({ type: "summary", content: { status: "COMPLETED", answer: "CHAT-FILES-ANSWER done", conversationId: job.jobId, prUrl: "", dryRun: true } }));
+        h.event({ state: "succeeded", phase: "done", errorCode: "none", filesChanged: 3 });
+        h.result({ outcome: "no_change" });
+    },
+    /** secrets in the content: a token, a private key (a blocked class in the rig), and a canary */
+    async chat_secret(job, h) {
+        h.event({ state: "running", phase: "context" });
+        h.line(JSON.stringify({ type: "token", content: `CHAT-SECRET-CANARY the key is ${"ghp_" + "A1b2C3d4E5f6G7h8I9j0K1l2M3n4O5p6Q7r8"}` }));
+        h.line(JSON.stringify({ type: "tool_result", content: "-----BEGIN RSA PRIVATE KEY-----\nMIIEowIBAAKCAQEAxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\n-----END RSA PRIVATE KEY-----" }));
+        h.line(JSON.stringify({ type: "summary", content: { status: "COMPLETED", answer: `CHAT-SECRET-ANSWER ${"ghp_" + "A1b2C3d4E5f6G7h8I9j0K1l2M3n4O5p6Q7r8"}`, conversationId: job.jobId } }));
+        h.event({ state: "succeeded", phase: "done", errorCode: "none" });
+        h.result({ outcome: "no_change" });
+    },
+    /** streams for a while, until cancelled; then reports cancelled like agent2 does */
+    async chat_slow(job, h) {
+        h.event({ state: "running", phase: "plan" });
+        h.line(JSON.stringify({ type: "token", content: "CHAT-SLOW first" }));
+        let n = 0;
+        const tick = setInterval(() => h.line(JSON.stringify({ type: "token", content: `CHAT-SLOW tick ${++n}` })), 60);
+        await h.cancelled;
+        clearInterval(tick);
+        h.line(JSON.stringify({ type: "summary", content: { status: "CANCELLED", conversationId: job.jobId } }));
+        h.event({ state: "cancelled", errorCode: "cancelled" });
+        h.result({ outcome: "cancelled" });
+    },
+    /** many lines, some at the 16 KiB limit */
+    async chat_many(job, h) {
+        h.event({ state: "running", phase: "plan" });
+        for (let i = 0; i < 60; i++) h.line(JSON.stringify({ type: "token", content: `line-${i} ${"x".repeat(i % 7 === 0 ? 15_000 : 40)}` }));
+        h.line(JSON.stringify({ type: "summary", content: { status: "COMPLETED", answer: "many done", conversationId: job.jobId } }));
+        h.event({ state: "succeeded", phase: "done", errorCode: "none" });
+        h.result({ outcome: "no_change" });
+    },
+    /** the loop fails: lines, then a failed result and no summary */
+    async chat_fail(job, h) {
+        h.event({ state: "running", phase: "plan" });
+        h.line(JSON.stringify({ type: "token", content: "CHAT-FAIL started" }));
+        h.event({ state: "failed", errorCode: "llm_error" });
+        h.result({ outcome: "failed" });
+    },
     /** exits mid-job (spawn mode: the process dies; in-process: the server vanishes) */
     async crash(job, h) { h.event({ state: "running", phase: "plan" }); await sleep(50); h.crash(); },
 };
 
-export async function startFakeAgent2({ token, tenantId, scenario = "ok_pr", port = 0, llmBase = null, callbackUrl = null, callbackToken = null, workspaceUrl = null, workspaceToken = null, supportList = true, frameApprovalId = true, healthDelayMs = 0, onCrash = null } = {}) {
+export async function startFakeAgent2({ token, tenantId, scenario = "ok_pr", kinds = ["fix", "implement"], port = 0, llmBase = null, callbackUrl = null, callbackToken = null, workspaceUrl = null, workspaceToken = null, supportList = true, frameApprovalId = true, healthDelayMs = 0, onCrash = null } = {}) {
     const jobs = new Map();
     const approvals = new Map();
     const requests = [];
@@ -133,19 +192,21 @@ export async function startFakeAgent2({ token, tenantId, scenario = "ok_pr", por
     const body = (req) => new Promise((resolve) => { const c = []; req.on("data", (x) => c.push(x)); req.on("end", () => { try { resolve(JSON.parse(Buffer.concat(c).toString("utf8") || "null")); } catch { resolve(undefined); } }); });
 
     function makeJob(b) {
-        const job = { ...b, frames: [], listeners: new Set(), done: false, seq: 0, record: {}, cancelRequested: false, cancelReason: null };
+        const job = { ...b, frames: [], listeners: new Set(), lines: [], lineListeners: new Set(), done: false, seq: 0, record: {}, cancelRequested: false, cancelReason: null };
         job.cancelled = new Promise((r) => { job.onCancel = r; });
         const push = (type, payload, over = {}) => {
             const f = { seq: ++job.seq, type, tenantId: b.tenantId, workspaceId: b.workspaceId, payload, ...over };
             if (over.drop) for (const k of over.drop) delete f[k];
             job.frames.push(f);
             for (const l of job.listeners) l(f);
-            if (type === "job.result") { job.done = true; for (const l of job.listeners) l(null); }
+            if (type === "job.result") { job.done = true; for (const l of job.listeners) l(null); for (const l of job.lineListeners) l(null); }
         };
         const h = {
             event: (p) => push("job.event", { jobId: b.jobId, ...p }),
             result: (p) => push("job.result", { jobId: b.jobId, ...p }),
             audit: (p) => push("audit.event", p),
+            /** one line of the content stream (`GET /jobs/{id}/stream`): customer content, never in a frame */
+            line: (text) => { job.lines.push(text); for (const l of job.lineListeners) l(text); },
             raw: ({ type, tenantId: t, payload }) => { const f = { seq: ++job.seq, type, ...(t ? { tenantId: t } : { tenantId: b.tenantId }), workspaceId: b.workspaceId, payload }; job.frames.push(f); for (const l of job.listeners) l(f); },
             cancelled: job.cancelled,
             requestApproval({ actionType, toolName, requestHash, summary }) {
@@ -207,7 +268,7 @@ export async function startFakeAgent2({ token, tenantId, scenario = "ok_pr", por
         const url = new URL(req.url, "http://x");
         const p = url.pathname;
         requests.push({ method: req.method, path: p });
-        if (req.method === "GET" && p === "/local/v1/health") { if (healthDelayMs) await sleep(healthDelayMs); return json(res, 200, { status: "up", mode: "local", busy: !!(current && !current.done) }); }
+        if (req.method === "GET" && p === "/local/v1/health") { if (healthDelayMs) await sleep(healthDelayMs); return json(res, 200, { status: "up", mode: "local", busy: !!(current && !current.done), ...(kinds ? { kinds } : {}) }); }
         if (req.method === "GET" && p === "/local/v1/_env") return json(res, 200, { keys: Object.keys(process.env), values: process.env });   // debug route of the CLI wrapper only
         if (!auth(req)) return json(res, 401, { error: "unauthorized" });
         let m;
@@ -216,7 +277,8 @@ export async function startFakeAgent2({ token, tenantId, scenario = "ok_pr", por
             if (!b || typeof b !== "object" || Array.isArray(b)) return json(res, 400, { error: "invalid_body" });
             for (const k of Object.keys(b)) if (!JOB_FIELDS.has(k)) return json(res, 400, { error: "invalid_body" });
             if (b.tenantId !== tenantId) return json(res, 403, { error: "tenant_mismatch" });
-            if (b.kind === "quality") return json(res, 422, { error: "unsupported_kind" });
+            if (b.kind === "quality" || (b.kind === "chat" && !kinds.includes("chat"))) return json(res, 422, { error: "unsupported_kind" });
+            if (b.kind === "chat" && Buffer.byteLength(b.request?.text ?? "", "utf8") > 16 * 1024) return json(res, 400, { error: "invalid", field: "request" });
             if (!/^vh-/.test(b.llm?.alias || "")) return json(res, 400, { error: "invalid", field: "llm.alias" });
             if (jobs.has(b.jobId)) return json(res, 202, { jobId: b.jobId, state: "running", created: false });
             if (current && !current.done) return json(res, 409, { error: "busy" });
@@ -238,6 +300,19 @@ export async function startFakeAgent2({ token, tenantId, scenario = "ok_pr", por
             req.on("close", () => job.listeners.delete(l));
             return;
         }
+        if ((m = p.match(/^\/local\/v1\/jobs\/([^/]+)\/stream$/)) && req.method === "GET") {
+            const job = jobs.get(m[1]);
+            if (!job) return json(res, 404, { error: "unknown_job" });
+            requests.push({ method: "STREAM", path: p });
+            res.writeHead(200, { "content-type": "text/event-stream", "cache-control": "no-store" });
+            const write = (t) => res.write(`data: ${t}\n\n`);   // like Spring's ServerSentEvent.data(line): no event name
+            for (const t of job.lines) write(t);
+            if (job.done) return res.end();
+            const l = (t) => { if (t === null) { res.end(); job.lineListeners.delete(l); } else write(t); };
+            job.lineListeners.add(l);
+            req.on("close", () => job.lineListeners.delete(l));
+            return;
+        }
         if ((m = p.match(/^\/local\/v1\/jobs\/([^/]+)\/cancel$/)) && req.method === "POST") {
             const job = jobs.get(m[1]);
             const b = await body(req);

package/test/la-protocol-v2/traces.test.js

@@ -18,9 +18,9 @@ import { V2Session } from "../../src/la-protocol-v2/session.js";
 const DIR = path.join(path.dirname(fileURLToPath(import.meta.url)), "../contract/la-protocol-v2/vectors/traces");
 const traces = fs.readdirSync(DIR).filter((f) => f.endsWith(".json")).sort().map((f) => ({ file: f, name: f.replace(".json", ""), ...JSON.parse(fs.readFileSync(path.join(DIR, f), "utf8")) }));
 
-test("the suite has all 34 traces (28 invalid, 6 valid: 26 of 2.0 + 8 of the chunked webhooks of 2.1)", () => {
-    assert.equal(traces.length, 34);
-    assert.equal(traces.filter((t) => t.expect.ok).length, 6);
+test("the suite has all 35 traces (28 invalid, 7 valid: 26 of 2.0 + 8 of the chunked webhooks of 2.1 + the chat of 2.3)", () => {
+    assert.equal(traces.length, 35);
+    assert.equal(traces.filter((t) => t.expect.ok).length, 7);
 });
 
 const textOf = (fr) => {

package/test/la-protocol-v2/workspace-materializer-hostile.test.js

@@ -0,0 +1,105 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs"; import os from "node:os"; import path from "node:path"; import http from "node:http";
+import { execFileSync, execSync } from "node:child_process";
+import { createWorkspaceMaterializer, resolveMaterializeConfig, repoTarget } from "../../src/la-protocol-v2/jobs/workspace-materializer.js";
+import { WorkspaceManager } from "../../src/workspace-manager.js";
+const TENANT = "3f2b8c1e-5a4d-4e7b-9c21-0a1b2c3d4e5f";
+const WS = "11111111-2222-4333-8444-555555555555";
+const REF = { provider: "github", org: "acme", repo: "app", branch: "main" };
+const tmp = (p) => fs.mkdtempSync(path.join(os.tmpdir(), `hos-${p}-`));
+const git = (cwd, ...a) => execFileSync("git", ["-c", "user.email=t@t", "-c", "user.name=t", ...a], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+function mk(files = (w) => fs.writeFileSync(path.join(w, "a.txt"), "one\n")) {
+  const bare = tmp("remote"), work = tmp("seed");
+  git(bare, "init", "--bare", "-b", "main", "."); git(work, "init", "-b", "main", ".");
+  files(work); git(work, "add", "-A"); git(work, "commit", "-m", "one"); git(work, "remote", "add", "origin", bare); git(work, "push", "origin", "main");
+  return { bare, work };
+}
+function setup({ remote, cacheDir, env = {}, runGitSeam, allow = "github.com/acme/app" } = {}) {
+  const cache = cacheDir || tmp("cache");
+  const cfg = resolveMaterializeConfig({ LOCAL_AGENT_JOBS_AUTO_WORKSPACE: "true", LOCAL_AGENT_ALLOWED_REPOS: allow, LOCAL_AGENT_WORKSPACE_CACHE: cache, ...env }, () => {});
+  const wsManager = new WorkspaceManager();
+  const seams = { remoteUrl: () => remote, gitConfig: ["-c", "protocol.file.allow=always"] };
+  if (runGitSeam) seams.runGit = runGitSeam;
+  const mat = createWorkspaceMaterializer({ config: cfg, tenantId: TENANT, wsManager, audit: { record() {} }, env: { PATH: process.env.PATH, HOME: process.env.HOME }, seams });
+  return { mat, cache, wsManager, cfg };
+}
+
+
+
+test("hostile repo: a symlink planted at the sidecar temp name never makes open() overwrite a file outside the clone", async () => {
+  const victim = path.join(tmp("victim"), "important.txt"); fs.writeFileSync(victim, "KEEP ME\n");
+  const r = mk((w) => { fs.writeFileSync(path.join(w, "a.txt"), "x\n"); fs.symlinkSync(victim, path.join(w, `.vh-workspace.json.${process.pid}.tmp`)); });
+  const { mat } = setup({ remote: r.bare });
+  assert.equal(mat.admit(WS, REF), true);
+  await mat.ensure(WS, REF);
+  const after = fs.readFileSync(victim, "utf8");
+  console.log("VICTIM AFTER:", JSON.stringify(after.slice(0, 80)));
+  assert.equal(after, "KEEP ME\n", "victim file was clobbered through repo-planted symlink");
+});
+
+test("existing dir with a sidecar but no .git under an ancestor git repository: refused, git never touches the ancestor", async () => {
+  const home = tmp("fakehome"); // acts as $HOME dotfiles repo
+  const up = mk(); // upstream of the "dotfiles" repo with branch main
+  git(home, "init", "-b", "main", "."); fs.writeFileSync(path.join(home, ".zshrc"), "a\n"); git(home, "add", "-A"); git(home, "commit", "-m", "d");
+  git(home, "remote", "add", "origin", up.bare); git(home, "fetch", "origin");
+  git(up.work, "checkout", "-b", "evil"); fs.writeFileSync(path.join(up.work, "PLANTED"), "p\n"); git(up.work, "add", "-A"); git(up.work, "commit", "-m", "evil"); git(up.work, "push", "origin", "evil");
+  const cache = path.join(home, ".deepdebug", "workspaces"); fs.mkdirSync(cache, { recursive: true });
+  fs.writeFileSync(path.join(home, ".gitignore"), ".deepdebug/\n"); git(home, "add", ".gitignore"); git(home, "commit", "-m", "ig");
+  const { mat, wsManager } = setup({ remote: "unused", cacheDir: cache });
+  const dir = path.join(fs.realpathSync(cache), WS); fs.mkdirSync(dir);
+  await wsManager.open(WS, dir, { tenantId: TENANT }); wsManager.close(WS); // leaves no sidecar; write one manually
+  wsManager.workspaces.clear(); fs.writeFileSync(path.join(dir, ".vh-workspace.json"), JSON.stringify({ id: WS, tenantId: TENANT, root: dir }));
+  const before = git(home, "rev-parse", "HEAD").trim();
+  await assert.rejects(mat.ensure(WS, { ...REF, branch: "evil" }), (e) => e.code === "not_a_clone");
+  const afterHead = git(home, "rev-parse", "HEAD").trim();
+  console.log("ancestor HEAD moved:", before !== afterHead, "FETCH_HEAD exists:", fs.existsSync(path.join(home, ".git", "FETCH_HEAD")), "PLANTED in ancestor:", fs.existsSync(path.join(home, "PLANTED")));
+  assert.equal(afterHead, before); assert.ok(!fs.existsSync(path.join(home, "PLANTED")), "git operated on the ancestor repository");
+});
+
+test("cancel of one job does not abort another job waiting for the same clone", async () => {
+  let calls = 0;
+  const slow = (args, o) => new Promise((res) => { calls++; if (o.signal) o.signal.addEventListener("abort", () => res({ ok: false, code: "aborted" })); setTimeout(() => res({ ok: false, code: "failed" }), 3000); });
+  const { mat } = setup({ remote: "x", runGitSeam: slow });
+  const ac1 = new AbortController(), ac2 = new AbortController();
+  const p1 = mat.ensure(WS, REF, ac1.signal).catch((e) => e.code);
+  const p2 = mat.ensure(WS, REF, ac2.signal).catch((e) => e.code);
+  await new Promise((r) => setTimeout(r, 100)); ac1.abort();
+  console.log("job1:", await p1, "job2 (never cancelled):", await p2);
+  assert.notEqual(await p2, "aborted");
+});
+
+
+test("a redirect never makes git send the token to another host", async () => {
+  const seen = [];
+  const evil = http.createServer((q, s) => { seen.push({ host: "evil", auth: q.headers.authorization || null, url: q.url }); if (!q.headers.authorization) { s.writeHead(401, { "WWW-Authenticate": 'Basic realm="x"' }); s.end(); } else { s.writeHead(404); s.end(); } }).listen(0);
+  await new Promise((r) => evil.once("listening", r));
+  const good = http.createServer((q, s) => { seen.push({ host: "good", auth: q.headers.authorization || null, url: q.url }); s.writeHead(302, { Location: `http://127.0.0.1:${evil.address().port}${q.url}` }); s.end(); }).listen(0);
+  await new Promise((r) => good.once("listening", r));
+  const tokf = path.join(tmp("tok"), "t"); fs.writeFileSync(tokf, "SECRETTOKEN123\n", { mode: 0o600 });
+  const { mat } = setup({ remote: `http://127.0.0.1:${good.address().port}/acme/app.git`, env: { LOCAL_AGENT_GIT_TOKEN_FILE: tokf } });
+  try { await mat.ensure(WS, REF); } catch (e) { console.log("ensure:", e.code); }
+  console.log("SEEN:", JSON.stringify(seen.map((s) => ({ ...s, auth: s.auth ? "PRESENT(" + Buffer.from(s.auth.split(" ")[1], "base64").toString().replace(/:.*/, ":***") + ")" : null }))));
+  good.close(); evil.close();
+  assert.ok(!seen.some((s) => s.host === "evil" && s.auth), "token sent to redirect target");
+});
+
+
+test("repoTarget: provider is an own key of the closed list (no prototype keys)", () => {
+  for (const p of ["constructor", "__proto__", "toString", "hasOwnProperty"]) assert.equal(repoTarget({ ...REF, provider: p }), null, p);
+});
+
+test("size limit is enforced WHILE cloning: the clone is aborted once the partial clone passes the limit", async () => {
+  let aborted = false;
+  const fake = (args, o) => new Promise((res) => {
+    const tmpDir = args[args.length - 1]; fs.mkdirSync(tmpDir, { recursive: true });
+    const t = setInterval(() => fs.appendFileSync(path.join(tmpDir, "blob"), Buffer.alloc(512 * 1024)), 100);
+    const stop = (c) => { clearInterval(t); res({ ok: false, code: c }); };
+    o.signal.addEventListener("abort", () => { aborted = true; stop("aborted"); });
+    setTimeout(() => stop("failed"), 15000);
+  });
+  const { mat, cache } = setup({ remote: "x", runGitSeam: fake, env: { LOCAL_AGENT_WORKSPACE_MAX_BYTES: String(1024 * 1024) } });
+  await assert.rejects(mat.ensure(WS, REF), (e) => e.code === "too_large");
+  assert.ok(aborted);
+  assert.deepEqual(fs.readdirSync(cache), []);
+});