deepdebug-local-agent 1.12.1 → 1.13.1

package/test/la-protocol-v2/llm-scope-ids.test.js

@@ -0,0 +1,129 @@
+// QA 2026-11-05: vh-litellm's scope-tag guard (enforce) rejected every Local Agent chat call with tenant_tag_mismatch: the LA sent the tag vh-tenant:<id>
+// but NOT vh_tenant_id / vh_workspace_id in the body. `guard()` below is a JS port of vh_plugins/scope_tags.py (collect + check); the fake gateway applies it to
+// what really arrives, on both routes. Not proven here: the real LiteLLM (how it merges key tags / request tags / litellm_metadata).
+import { test, after } from "node:test";
+import assert from "node:assert/strict";
+import { createLlmKeyHolder } from "../../src/la-protocol-v2/llm-key/store.js";
+import { createLlmClient } from "../../src/la-protocol-v2/llm/client.js";
+import { resolveLlmClientConfig } from "../../src/la-protocol-v2/llm/config.js";
+import { startFakeLlm, closeAllFakes, okJson, okMessages, byPath, mkKey, keySet } from "./helpers/fake-llm.js";
+import { agent2Rig, TENANT, waitFor } from "./helpers/agent2-rig.js";
+
+after(closeAllFakes);
+const noop = () => {};
+const ENFORCE = { LOCAL_AGENT_DLP_MODE: "enforce" };
+const AGENT = "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d";
+
+// ---- port of vh_plugins/scope_tags.py
+const blank = (v) => v === null || v === undefined || (typeof v === "string" && !v.trim());
+const vals = (tags, prefix) => [...new Set(tags.filter((t) => typeof t === "string" && t.startsWith(prefix)).map((t) => t.slice(prefix.length).trim()))].sort();
+export function check(tags, tenantId, workspaceId) {
+    const tt = vals(tags, "vh-tenant:"), wt = vals(tags, "vh-ws:");
+    if (tt.length > 1) return "multiple_tenant_tags";
+    if (wt.length > 1) return "multiple_workspace_tags";
+    if (tt.length && (blank(tenantId) || tt[0] !== String(tenantId).trim())) return "tenant_tag_mismatch";
+    if (wt.length && (blank(workspaceId) || wt[0] !== String(workspaceId).trim())) return "workspace_tag_mismatch";
+    if (!blank(tenantId) && !tt.length) return "missing_tenant_tag";
+    if (!blank(workspaceId) && !wt.length) return "missing_workspace_tag";
+    return null;
+}
+export function collect(data) {
+    const tags = []; const ids = {};
+    for (const f of ["metadata", "litellm_metadata"]) {
+        const md = data[f];
+        if (!md || typeof md !== "object" || Array.isArray(md)) continue;
+        if (Array.isArray(md.tags)) tags.push(...md.tags);
+        for (const k of ["vh_tenant_id", "vh_workspace_id"]) if (blank(ids[k]) && !blank(md[k])) ids[k] = md[k];
+    }
+    if (Array.isArray(data.tags)) tags.push(...data.tags);
+    return [tags, ids.vh_tenant_id, ids.vh_workspace_id];
+}
+/** What the proxy does for /v1/messages: ids stay in `metadata`, the tags are also present in `litellm_metadata` (merged by the proxy), and the key's own tenant tag is added too (the duplicate seen in QA). */
+const asProxySees = (body, route, keyTags = []) => (route === "messages"
+    ? { ...body, litellm_metadata: { tags: [...(body.metadata?.tags || []), ...keyTags] } }
+    : { ...body, metadata: { ...body.metadata, tags: [...(body.metadata?.tags || []), ...keyTags] } });
+export const guard = (body, route, keyTags) => check(...collect(asProxySees(body, route, keyTags)));
+const KEY_TAGS = [`vh-tenant:${TENANT}`, `vh-la:${AGENT}`, "vh-dpm:x"];
+
+async function rig(tenantId = TENANT) {
+    const fake = await startFakeLlm(byPath({ chat: okJson("hi"), messages: okMessages("hi") }));
+    const key = mkKey();
+    const holder = createLlmKeyHolder({ log: { warn: noop } });
+    holder.set(keySet(key));
+    const config = { ...resolveLlmClientConfig({ LOCAL_AGENT_LLM_CLIENT: "true" }, noop), backoffMs: 0 };
+    const client = createLlmClient({ holder: { request: (p, i, o) => holder.request(p, i, o), describe: () => holder.describe(), get held() { return holder.held; } }, config, tenantId, agentId: AGENT, env: ENFORCE, fetchImpl: fake.fetchImpl });
+    return { fake, client };
+}
+const msgs = [{ role: "user", content: "go" }];
+
+test("the guard port rejects what QA rejected (tag without ids) and accepts the agreeing request", () => {
+    assert.equal(check([`vh-tenant:${TENANT}`, `vh-tenant:${TENANT}`], null, null), "tenant_tag_mismatch");
+    assert.equal(check([`vh-tenant:${TENANT}`, `vh-tenant:${TENANT}`], TENANT, null), null, "the same tag twice is one value");
+});
+
+for (const route of ["chat", "messages"]) {
+    test(`${route}: the request carries vh_tenant_id and vh_workspace_id and ONE tag each; the scope guard passes (with the key's tenant tag duplicated on top)`, async () => {
+        const r = await rig();
+        await r.client[route]({ model: "vh-claude-sonnet", messages: msgs, job: { jobId: "job-1", agent: "agent2", workspaceId: "ws-1" } });
+        const body = r.fake.requests[0].body;
+        assert.equal(body.metadata.vh_tenant_id, TENANT);
+        assert.equal(body.metadata.vh_workspace_id, "ws-1");
+        assert.equal(body.metadata.tags.filter((t) => t.startsWith("vh-tenant:")).length, 1);
+        assert.equal(body.metadata.tags.filter((t) => t.startsWith("vh-ws:")).length, 1);
+        assert.equal(new Set(body.metadata.tags).size, body.metadata.tags.length, "no duplicates");
+        assert.equal(guard(body, route, KEY_TAGS), null);
+        assert.equal(guard(body, route, []), null);
+        // before the fix: tags only, no ids
+        const old = { ...body, metadata: { tags: body.metadata.tags } };
+        assert.equal(guard(old, route, KEY_TAGS), "tenant_tag_mismatch");
+    });
+
+    test(`${route}: no workspace (or an unsafe one): the tenant is claimed, the workspace is not, no ws tag`, async () => {
+        const r = await rig();
+        await r.client[route]({ model: "vh-claude-sonnet", messages: msgs, job: { jobId: "job-1" } });
+        await r.client[route]({ model: "vh-claude-sonnet", messages: msgs, job: { jobId: "job-1", workspaceId: "ws-1,vh-tenant:evil" } });
+        for (const q of r.fake.requests) {
+            assert.equal(q.body.metadata.vh_tenant_id, TENANT);
+            assert.equal(q.body.metadata.vh_workspace_id, undefined);
+            assert.ok(!q.body.metadata.tags.some((t) => t.startsWith("vh-ws:") || t.includes("evil")));
+            assert.equal(guard(q.body, route, KEY_TAGS), null);
+        }
+    });
+}
+
+test("agent2 hostile through the bridge: its metadata, tags and headers (another tenant/workspace) are overwritten by the LA's own, on /v1/messages and /v1/chat/completions", async () => {
+    const r = await agent2Rig({ scenario: "stuck" });
+    const a = r.assign();
+    await a.acked();
+    await waitFor(() => r.fake.jobs.size === 1);
+    const job = r.fake.jobs.get(a.p.jobId);
+    const evil = { vh_tenant_id: "11111111-2222-3333-4444-555555555555", vh_workspace_id: "other-ws", tags: ["vh-tenant:11111111-2222-3333-4444-555555555555", "vh-ws:other-ws", "vh-tenant:" + TENANT] };
+    const headers = { authorization: `Bearer ${job.llm.key}`, "content-type": "application/json", "x-litellm-tags": "vh-tenant:11111111-2222-3333-4444-555555555555", "x-vh-tenant-id": "evil" };
+    const before = r.fakeLlm.requests.length;
+    const m = await fetch(`${r.bridgeBase}/v1/messages`, { method: "POST", headers, body: JSON.stringify({ model: "claude-x", max_tokens: 50, messages: msgs, metadata: evil, litellm_metadata: evil, tags: evil.tags }) });
+    const c = await fetch(`${r.bridgeBase}/v1/chat/completions`, { method: "POST", headers, body: JSON.stringify({ model: "gpt-x", messages: msgs, metadata: evil, tags: evil.tags }) });
+    assert.equal(m.status, 200); assert.equal(c.status, 200);
+    const sent = r.fakeLlm.requests.slice(before);
+    assert.equal(sent.length, 2);
+    for (const q of sent) {
+        const route = /\/messages$/.test(q.url) ? "messages" : "chat";
+        assert.equal(q.body.metadata.vh_tenant_id, TENANT);
+        assert.equal(q.body.metadata.vh_workspace_id, "ws-1");
+        assert.ok(!q.raw.includes("11111111-2222") && !q.raw.includes("other-ws") && !q.raw.includes("evil"), "nothing of agent2's claim leaves");
+        assert.equal(q.headers["x-litellm-tags"], undefined);
+        assert.equal(q.body.litellm_metadata, undefined);
+        assert.equal(q.body.tags, undefined);
+        assert.equal(new Set(q.body.metadata.tags).size, q.body.metadata.tags.length);
+        assert.equal(guard(q.body, route, KEY_TAGS), null);
+    }
+    await r.stop();
+});
+
+test("an unsafe tenant id claims nothing and tags nothing (never a smuggled tag)", async () => {
+    const r = await rig("t1,vh-tenant:evil");
+    await r.client.chat({ model: "vh-claude-sonnet", messages: msgs, job: { jobId: "j", workspaceId: "ws-1" } });
+    const md = r.fake.requests[0].body.metadata;
+    assert.equal(md.vh_tenant_id, undefined);
+    assert.equal(md.vh_workspace_id, undefined);
+    assert.ok(!md.tags.some((t) => t.startsWith("vh-tenant:") || t.startsWith("vh-ws:") || t.includes("evil")));
+});

package/test/la-protocol-v2/traces.test.js

@@ -18,9 +18,9 @@ import { V2Session } from "../../src/la-protocol-v2/session.js";
 const DIR = path.join(path.dirname(fileURLToPath(import.meta.url)), "../contract/la-protocol-v2/vectors/traces");
 const traces = fs.readdirSync(DIR).filter((f) => f.endsWith(".json")).sort().map((f) => ({ file: f, name: f.replace(".json", ""), ...JSON.parse(fs.readFileSync(path.join(DIR, f), "utf8")) }));
 
-test("the suite has all 34 traces (28 invalid, 6 valid: 26 of 2.0 + 8 of the chunked webhooks of 2.1)", () => {
-    assert.equal(traces.length, 34);
-    assert.equal(traces.filter((t) => t.expect.ok).length, 6);
+test("the suite has all 35 traces (28 invalid, 7 valid: 26 of 2.0 + 8 of the chunked webhooks of 2.1 + the chat of 2.3)", () => {
+    assert.equal(traces.length, 35);
+    assert.equal(traces.filter((t) => t.expect.ok).length, 7);
 });
 
 const textOf = (fr) => {