deepdebug-local-agent 1.5.0 → 1.7.0

package/test/la-protocol-v2/content-handlers.test.js

@@ -27,7 +27,7 @@ async function withRig(opts, body) {
 // ------------------------------------------------------------------------------------------ file: the happy path
 
 test("file: an id minted by the agent is served; the request is acked `accepted` before the answer; content type from the extension", async () => {
-    await withRig({ dlp: "off" }, async (rig) => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
         write(rig.root(), "docs/readme.md", "# hello\n");
         write(rig.root(), "src/data.json", '{"a":1}');
         write(rig.root(), "src/a.txt", "plain");
@@ -43,7 +43,7 @@ test("file: an id minted by the agent is served; the request is acked `accepted`
 });
 
 test("file: 100 KiB goes out in 4 chunks and the CP rebuilds it byte for byte; exactly the size limit is accepted", async () => {
-    await withRig({ dlp: "off" }, async (rig) => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
         const data = Buffer.from("line of text number x\n".repeat(5000)).subarray(0, 100 * 1024);
         write(rig.root(), "big.txt", data);
         const r = await rig.request({ ref: rig.mint("file", "big.txt") });
@@ -59,14 +59,14 @@ test("file: 100 KiB goes out in 4 chunks and the CP rebuilds it byte for byte; e
 });
 
 test("file: unicode names, spaces and a root reached through a symlink work", async () => {
-    await withRig({ dlp: "off" }, async (rig) => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
         write(rig.root(), "Dir Com Espaço/ficheiro ü ñ 日本.txt", "olá");
         assert.equal((await rig.request({ ref: rig.mint("file", "Dir Com Espaço/ficheiro ü ñ 日本.txt") })).text, "olá");
     });
 });
 
 test("file: range is applied to the bytes as served, and past the end is an empty ok", async () => {
-    await withRig({ dlp: "off" }, async (rig) => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
         write(rig.root(), "r.txt", "0123456789");
         const ref = rig.mint("file", "r.txt");
         assert.equal((await rig.request({ ref, range: { offset: 2, length: 3 } })).text, "234");
@@ -79,7 +79,7 @@ test("file: range is applied to the bytes as served, and past the end is an empt
 // ------------------------------------------------------------------------------------------ refs: opaque ids, nothing is a path
 
 test("ref: path-like refs are never interpreted as paths: traversal, absolute, NUL, %2e%2e, unicode tricks -> not_found, nothing echoed", async () => {
-    await withRig({ dlp: "off" }, async (rig) => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
         const outside = tmpDir(); rig.dirs.push(outside);
         write(outside, "passwd", "OUTSIDE-CONTENT");
         write(rig.root(), "src/a.txt", "inside");
@@ -103,7 +103,7 @@ test("ref: path-like refs are never interpreted as paths: traversal, absolute, N
 
 test("ref: unknown and expired ids are not_found; an expired id does not come back", async () => {
     let t = 5_000_000;
-    await withRig({ dlp: "off", now: () => t, env: { LOCAL_AGENT_CONTENT_REF_TTL_MS: "60000" } }, async (rig) => {
+    await withRig({ dlp: "enforce", now: () => t, env: { LOCAL_AGENT_CONTENT_REF_TTL_MS: "60000" } }, async (rig) => {
         write(rig.root(), "a.txt", "x");
         const id = rig.mint("file", "a.txt");
         assert.equal((await rig.request({ ref: id })).status, "ok");
@@ -118,7 +118,7 @@ test("ref: unknown and expired ids are not_found; an expired id does not come ba
 });
 
 test("ref: an id of workspace A does not open anything through workspace B (both registered), nor through an unregistered one", async () => {
-    await withRig({ dlp: "off" }, async (rig) => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
         write(rig.root("ws-1"), "a.txt", "A-CONTENT");
         write(rig.root("ws-2"), "a.txt", "B-CONTENT");
         const idA = rig.mint("file", "a.txt", "ws-1");
@@ -134,7 +134,7 @@ test("ref: an id of workspace A does not open anything through workspace B (both
 
 test("ref: a workspace that belongs to another tenant is not served, even with a valid id", async () => {
     const rootA = tmpDir(); const rootB = tmpDir();
-    await withRig({ dlp: "off", workspaces: { "ws-1": { root: rootA }, "ws-foreign": { root: rootB, tenantId: "9d1f6a2c-0000-4000-8000-000000000000" } } }, async (rig) => {
+    await withRig({ dlp: "enforce", workspaces: { "ws-1": { root: rootA }, "ws-foreign": { root: rootB, tenantId: "9d1f6a2c-0000-4000-8000-000000000000" } } }, async (rig) => {
         write(rootA, "a.txt", "mine"); write(rootB, "a.txt", "FOREIGN");
         const id = rig.registry.mint({ workspaceId: "ws-foreign", root: rootB, kind: "file", rel: "a.txt" }).id;
         assert.equal((await rig.request({ ref: id, workspaceId: "ws-foreign" })).status, "not_found");
@@ -144,7 +144,7 @@ test("ref: a workspace that belongs to another tenant is not served, even with a
 });
 
 test("ref: a frame for another tenant never reaches the handler (the session refuses it as tenant_mismatch)", async () => {
-    await withRig({ dlp: "off" }, async (rig) => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
         write(rig.root(), "a.txt", "x");
         const f = rig.cp.frameWith("content.request", { kind: "file", ref: rig.mint("file", "a.txt"), actor: { userId: "u-1", role: "member" } }, { requestId: uuid() });
         f.tenantId = "9d1f6a2c-0000-4000-8000-000000000000";
@@ -156,7 +156,7 @@ test("ref: a frame for another tenant never reaches the handler (the session ref
 });
 
 test("ref: a workspace re-opened on another directory invalidates the ids minted for the old root", async () => {
-    await withRig({ dlp: "off" }, async (rig) => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
         write(rig.root(), "a.txt", "old root");
         const id = rig.mint("file", "a.txt");
         const other = tmpDir(); rig.dirs.push(other);
@@ -171,7 +171,7 @@ test("ref: a workspace re-opened on another directory invalidates the ids minted
 // ------------------------------------------------------------------------------------------ path checks at read time
 
 test("file: sensitive files are forbidden by name (an id for them cannot be minted) and by link (a harmless name pointing to .env)", async () => {
-    await withRig({ dlp: "off" }, async (rig) => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
         write(rig.root(), ".env", "DB_PASSWORD=hunter2hunter2");
         write(rig.root(), "certs/server.pem", "PEMDATA");
         write(rig.root(), ".git/config", "[remote]\n\turl = https://user:tok@host/r.git");
@@ -189,7 +189,7 @@ test("file: sensitive files are forbidden by name (an id for them cannot be mint
 });
 
 test("file: the deny list is configurable (LOCAL_AGENT_CONTENT_DENY_GLOBS) and applied at read time too", async () => {
-    await withRig({ dlp: "off", env: { LOCAL_AGENT_CONTENT_DENY_GLOBS: "private-notes/, *.hush" } }, async (rig) => {
+    await withRig({ dlp: "enforce", env: { LOCAL_AGENT_CONTENT_DENY_GLOBS: "private-notes/, *.hush" } }, async (rig) => {
         write(rig.root(), "private-notes/n.txt", "n"); write(rig.root(), "a.hush", "h");
         assert.equal(rig.mint("file", "private-notes/n.txt"), null);
         assert.equal(rig.mint("file", "a.hush"), null);
@@ -202,7 +202,7 @@ test("file: the deny list is configurable (LOCAL_AGENT_CONTENT_DENY_GLOBS) and a
 });
 
 test("file: a symlink that leaves the workspace (swapped in after the id was minted) is forbidden and its target is never read", async () => {
-    await withRig({ dlp: "off" }, async (rig) => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
         const outside = tmpDir(); rig.dirs.push(outside);
         write(outside, "secret.txt", "OUTSIDE-SECRET-CONTENT");
         write(outside, "d/x.txt", "OUTSIDE-DIR-CONTENT");
@@ -221,7 +221,7 @@ test("file: a symlink that leaves the workspace (swapped in after the id was min
 });
 
 test("file: missing file, a directory and an id minted for a path that never existed are not_found", async () => {
-    await withRig({ dlp: "off" }, async (rig) => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
         write(rig.root(), "d/x.txt", "x");
         assert.equal((await rig.request({ ref: rig.mint("file", "nope.txt") })).status, "not_found");
         assert.equal((await rig.request({ ref: rig.mint("file", "d") })).status, "not_found");
@@ -229,7 +229,7 @@ test("file: missing file, a directory and an id minted for a path that never exi
 });
 
 test("file: a file above the limit is payload_too_large WITHOUT being read (3 GiB sparse file answered at once)", async () => {
-    await withRig({ dlp: "off" }, async (rig) => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
         write(rig.root(), "huge.bin", "");
         fs.truncateSync(path.join(rig.root(), "huge.bin"), 3 * 1024 ** 3);
         const t0 = Date.now();
@@ -238,7 +238,7 @@ test("file: a file above the limit is payload_too_large WITHOUT being read (3 Gi
         assert.ok(Date.now() - t0 < 1500);
         write(rig.root(), "over.txt", Buffer.alloc(rig.config.maxBytes + 1, 0x61));
         assert.equal((await rig.request({ ref: rig.mint("file", "over.txt") })).errorCode, "payload_too_large");
-        const small = await setup({ dlp: "off", env: { LOCAL_AGENT_CONTENT_MAX_BYTES: "4096" } });
+        const small = await setup({ dlp: "enforce", env: { LOCAL_AGENT_CONTENT_MAX_BYTES: "4096" } });
         try {
             write(small.root(), "f.txt", Buffer.alloc(4097, 0x61));
             assert.equal((await small.request({ ref: small.mint("file", "f.txt") })).errorCode, "payload_too_large");
@@ -248,19 +248,16 @@ test("file: a file above the limit is payload_too_large WITHOUT being read (3 Gi
 
 // ------------------------------------------------------------------------------------------ binary
 
-test("binary: with the DLP off or warn it is served as octet-stream; in enforce it cannot be inspected and is withheld", async () => {
+test("binary: in enforce it cannot be inspected and is withheld (forbidden); invalid UTF-8 counts as binary", async () => {
     const bin = Buffer.concat([Buffer.from([0x89, 0x50, 0x4e, 0x47, 0, 0, 0, 1]), crypto.randomBytes(5000)]);
-    for (const [dlp, want] of [["off", "ok"], ["warn", "ok"], ["enforce", "forbidden"]]) {
-        await withRig({ dlp }, async (rig) => {
-            write(rig.root(), "logo.png", bin);
-            write(rig.root(), "latin1.txt", Buffer.from([0x63, 0x61, 0x66, 0xe9, 0xff, 0xfe]));
-            const r = await rig.request({ ref: rig.mint("file", "logo.png") });
-            assert.equal(r.status, want, dlp);
-            if (want === "ok") { assert.equal(r.contentType, "application/octet-stream"); assert.ok(r.body.equals(bin)); } else assert.equal(r.body.length, 0);
-            const l = await rig.request({ ref: rig.mint("file", "latin1.txt") });
-            assert.equal(l.status, want, "invalid UTF-8 is binary for the DLP");
-        });
-    }
+    await withRig({ dlp: "enforce" }, async (rig) => {
+        write(rig.root(), "logo.png", bin);
+        write(rig.root(), "latin1.txt", Buffer.from([0x63, 0x61, 0x66, 0xe9, 0xff, 0xfe]));
+        const r = await rig.request({ ref: rig.mint("file", "logo.png") });
+        assert.equal(r.status, "forbidden");
+        assert.equal(r.body.length, 0);
+        assert.equal((await rig.request({ ref: rig.mint("file", "latin1.txt") })).status, "forbidden");
+    });
 });
 
 // ------------------------------------------------------------------------------------------ DLP
@@ -303,23 +300,17 @@ test("DLP enforce: a secret that would straddle two chunks is found (the whole t
     });
 });
 
-test("DLP warn: content goes as read (the existing meaning of warn) and the hits are only counted in the local audit", async () => {
-    await withRig({ dlp: "warn" }, async (rig) => {
-        write(rig.root(), "c.txt", `k=${GH}\n`);
-        const r = await rig.request({ ref: rig.mint("file", "c.txt") });
-        assert.equal(r.text, `k=${GH}\n`);
-        const rec = rig.handler.audit.tail(1)[0];
-        assert.deepEqual([rec.dlpMode, rec.dlpHits], ["warn", 1]);
-        assert.deepEqual(rec.dlpRules, { github_token: 1 });
-    });
-});
-
-test("DLP off: the content goes as read; the agent warns once at install time (see the install test), the audit says dlpMode off", async () => {
-    await withRig({ dlp: "off" }, async (rig) => {
-        write(rig.root(), "c.txt", `k=${GH}\n`);
-        assert.equal((await rig.request({ ref: rig.mint("file", "c.txt") })).text, `k=${GH}\n`);
-        assert.equal(rig.handler.audit.tail(1)[0].dlpMode, "off");
-    });
+test("DLP warn and off (F3-07b): no content is served at all, the answer is protocol_unsupported and nothing was read", async () => {
+    for (const dlp of ["warn", "off"]) {
+        await withRig({ dlp }, async (rig) => {
+            write(rig.root(), "c.txt", `k=${GH}\n`);
+            const r = await rig.request({ ref: rig.mint("file", "c.txt") });
+            assert.deepEqual([r.status, r.errorCode, r.body.length], ["error", "protocol_unsupported", 0], dlp);
+            assert.equal(r.text.includes(GH), false);
+            const rec = rig.handler.audit.tail(1)[0];
+            assert.deepEqual([rec.status, rec.errorCode, rec.bytes], ["error", "protocol_unsupported", 0]);
+        });
+    }
 });
 
 test("DLP enforce: a hit in LOCAL_AGENT_DLP_BLOCK_CLASSES withholds the whole file (forbidden, no body)", async () => {
@@ -351,13 +342,16 @@ test("DLP enforce: masking that makes the text grow past the limit is payload_to
     });
 });
 
-test("DLP: the mode is read from LOCAL_AGENT_DLP_MODE at each request, like the rest of the agent", async () => {
-    await withRig({ dlp: "off" }, async (rig) => {
+test("DLP: the mode is read from LOCAL_AGENT_DLP_MODE at each request; leaving enforce stops serving at once (no opt-out), going back resumes", async () => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
         write(rig.root(), "c.txt", `k=${GH}\n`);
         const id = rig.mint("file", "c.txt");
-        assert.equal((await rig.request({ ref: id })).text.includes(GH), true);
-        rig.env.LOCAL_AGENT_DLP_MODE = "enforce";
         assert.equal((await rig.request({ ref: id })).text.includes(GH), false);
+        rig.env.LOCAL_AGENT_DLP_MODE = "off";
+        const off = await rig.request({ ref: id });
+        assert.deepEqual([off.status, off.errorCode, off.text], ["error", "protocol_unsupported", ""]);
+        rig.env.LOCAL_AGENT_DLP_MODE = "enforce";
+        assert.equal((await rig.request({ ref: id })).status, "ok");
     });
 });
 
@@ -388,7 +382,7 @@ test("every other kind of the allowlist answers `error` + protocol_unsupported (
 });
 
 test("an id minted for a file is not valid as a diff, and the other way round", async () => {
-    await withRig({ dlp: "off" }, async (rig) => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
         write(rig.root(), "a.txt", "x");
         assert.equal((await rig.request({ kind: "diff", ref: rig.mint("file", "a.txt") })).status, "not_found");
         assert.equal((await rig.request({ kind: "file", ref: rig.mint("diff", null) })).status, "not_found");
@@ -433,7 +427,7 @@ test("diff: `worktree` is the work tree against HEAD; sensitive files are left o
 });
 
 test("diff: a minted id can ask for one file; a sensitive path cannot be minted; an unchanged file is an empty ok", async () => {
-    await withRig({ dlp: "off" }, async (rig) => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
         repoWithChanges(rig.root());
         const one = await rig.request({ kind: "diff", ref: rig.mint("diff", "src/app.js") });
         assert.equal(one.status, "ok");
@@ -448,7 +442,7 @@ test("diff: a minted id can ask for one file; a sensitive path cannot be minted;
 });
 
 test("diff: not a repository, or a repository without commits -> not_found; another workspace's id does not diff this one", async () => {
-    await withRig({ dlp: "off" }, async (rig) => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
         write(rig.root("ws-1"), "a.txt", "x");
         assert.equal((await rig.request({ kind: "diff", ref: "worktree" })).status, "not_found");
         git(rig.root("ws-1"), "init", "-q", "-b", "main");
@@ -461,7 +455,7 @@ test("diff: not a repository, or a repository without commits -> not_found; anot
 });
 
 test("diff: a workspace inside a bigger repository only shows its own subtree", async () => {
-    await withRig({ dlp: "off" }, async (rig) => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
         const top = rig.root();
         write(top, "pkg/in.txt", "1\n"); write(top, "outside.txt", "1\n");
         git(top, "init", "-q", "-b", "main"); git(top, "add", "-A"); git(top, "commit", "-q", "-m", "i");
@@ -475,7 +469,7 @@ test("diff: a workspace inside a bigger repository only shows its own subtree",
 });
 
 test("diff: repository config cannot run anything (fsmonitor, external diff, textconv) and GIT_DIR in the agent's env is ignored", async () => {
-    await withRig({ dlp: "off" }, async (rig) => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
         const root = rig.root();
         repoWithChanges(root);
         const marker = path.join(tmpDir(), "PWNED"); rig.dirs.push(path.dirname(marker));
@@ -498,7 +492,7 @@ test("diff: repository config cannot run anything (fsmonitor, external diff, tex
 });
 
 test("diff: above the size limit is payload_too_large (git is stopped while it streams)", async () => {
-    await withRig({ dlp: "off", env: { LOCAL_AGENT_CONTENT_MAX_BYTES: "20000" } }, async (rig) => {
+    await withRig({ dlp: "enforce", env: { LOCAL_AGENT_CONTENT_MAX_BYTES: "20000" } }, async (rig) => {
         write(rig.root(), "big.txt", "a\n");
         git(rig.root(), "init", "-q", "-b", "main"); git(rig.root(), "add", "-A"); git(rig.root(), "commit", "-q", "-m", "i");
         write(rig.root(), "big.txt", "change number x\n".repeat(5000));
@@ -510,7 +504,7 @@ test("diff: above the size limit is payload_too_large (git is stopped while it s
 // ------------------------------------------------------------------------------------------ cancellation, limits, backpressure
 
 test("cancel in the middle of a stream: no further chunk is read or sent, the slot and the memory come back, the audit says cancelled", async () => {
-    await withRig({ dlp: "off" }, async (rig) => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
         write(rig.root(), "big.txt", Buffer.alloc(rig.config.maxBytes, 0x61));
         const requestId = uuid();
         rig.cp.silent = true; // the CP never acks: 8 chunks fit the window, the rest waits (backpressure)
@@ -534,7 +528,7 @@ test("cancel in the middle of a stream: no further chunk is read or sent, the sl
 });
 
 test("the request deadline (LOCAL_AGENT_CONTENT_TOTAL_MS) stops a stream the CP does not consume", async () => {
-    await withRig({ dlp: "off", env: { LOCAL_AGENT_CONTENT_TOTAL_MS: "1000" } }, async (rig) => {
+    await withRig({ dlp: "enforce", env: { LOCAL_AGENT_CONTENT_TOTAL_MS: "1000" } }, async (rig) => {
         write(rig.root(), "big.txt", Buffer.alloc(rig.config.maxBytes, 0x61));
         rig.cp.silent = true;
         const requestId = uuid();
@@ -548,7 +542,7 @@ test("the request deadline (LOCAL_AGENT_CONTENT_TOTAL_MS) stops a stream the CP
 });
 
 test("backpressure: with a slow consumer the window of the session holds (at most 8 chunks unacked) and the file still arrives intact", async () => {
-    await withRig({ dlp: "off", cp: {} }, async (rig) => {
+    await withRig({ dlp: "enforce", cp: {} }, async (rig) => {
         const data = crypto.randomBytes(Math.floor(rig.config.maxBytes / 2)).toString("base64").slice(0, Math.floor(rig.config.maxBytes / 2));
         write(rig.root(), "big.txt", data);
         rig.cp.ackDelayMs = 20;
@@ -563,7 +557,7 @@ test("backpressure: with a slow consumer the window of the session holds (at mos
 });
 
 test("limits: above LOCAL_AGENT_CONTENT_MAX_CONCURRENT the extra request gets rate_limited (a code, no content); the first one is not disturbed", async () => {
-    await withRig({ dlp: "off", env: { LOCAL_AGENT_CONTENT_MAX_CONCURRENT: "1", LOCAL_AGENT_CONTENT_MAX_INFLIGHT_BYTES: String(64 * 1024 * 1024) } }, async (rig) => {
+    await withRig({ dlp: "enforce", env: { LOCAL_AGENT_CONTENT_MAX_CONCURRENT: "1", LOCAL_AGENT_CONTENT_MAX_INFLIGHT_BYTES: String(64 * 1024 * 1024) } }, async (rig) => {
         write(rig.root(), "big.txt", Buffer.alloc(rig.config.maxBytes, 0x61));
         write(rig.root(), "small.txt", "s");
         rig.cp.ackDelayMs = 40;
@@ -581,7 +575,7 @@ test("limits: above LOCAL_AGENT_CONTENT_MAX_CONCURRENT the extra request gets ra
 });
 
 test("limits: the memory reservation (LOCAL_AGENT_CONTENT_MAX_INFLIGHT_BYTES) is enforced too", async () => {
-    await withRig({ dlp: "off", env: { LOCAL_AGENT_CONTENT_MAX_BYTES: "4096", LOCAL_AGENT_CONTENT_MAX_INFLIGHT_BYTES: "16384", LOCAL_AGENT_CONTENT_MAX_CONCURRENT: "8" } }, async (rig) => {
+    await withRig({ dlp: "enforce", env: { LOCAL_AGENT_CONTENT_MAX_BYTES: "4096", LOCAL_AGENT_CONTENT_MAX_INFLIGHT_BYTES: "16384", LOCAL_AGENT_CONTENT_MAX_CONCURRENT: "8" } }, async (rig) => {
         assert.equal(rig.config.maxInFlightBytes, 16384); // each request reserves 2 x 4096: two fit
         write(rig.root(), "a.txt", "a".repeat(4096));
         rig.cp.ackDelayMs = 100;
@@ -625,7 +619,7 @@ test("nothing but codes in errors, audit and logs: no path, no ref, no content,
 });
 
 test("a request without requestId is refused with a rejected ack, not left hanging", async () => {
-    await withRig({ dlp: "off" }, async (rig) => {
+    await withRig({ dlp: "enforce" }, async (rig) => {
         const before = rig.handler.stats.received;
         assert.deepEqual(rig.handler.handle({ params: { kind: "file", ref: "x" }, workspaceId: "ws-1" }), { reject: "schema_violation" });
         assert.equal(rig.handler.stats.received, before + 1);

package/test/la-protocol-v2/content-path-guard.test.js

@@ -41,7 +41,7 @@ test("deny list: secrets by name, keys, credentials, VCS internals (case-insensi
 });
 
 test("deny list: ordinary files are not caught (no false positives on look-alikes)", () => {
-    for (const p of ["src/environment.js", "README.md", "src/keyboard.js", "src/monkey.js", "docs/pem-format.md", "environment/readme.txt", "src/secretary.js", "gitignore.txt", "src/.github/workflows/ci.yml", "src/auth/credentials.js"]) {
+    for (const p of ["src/environment.js", "README.md", "src/keyboard.js", "src/monkey.js", "docs/pem-format.md", "environment/readme.txt", "src/secretary.js", "gitignore.txt", "src/.github/workflows/ci.yml", "src/auth/credential-store.js", "src/kubernetes.js", "docs/kube-notes.md"]) {
         assert.equal(isSensitivePath(p), false, p);
     }
 });
@@ -156,12 +156,17 @@ test("readRegular: size cap before reading, exact bytes, the file swapped for a
 
 // ------------------------------------------------------------------------------------------ ids
 
-test("ids: 128 random bits, not derived from the path, a fresh id per mint", () => {
+test("ids (F3-07b): 43 base64url chars, no prefix, 256 random bits, not derived from the path, a fresh id per mint; the F3-07 form cr1_+22 is gone", () => {
     const reg = new ContentRefRegistry({ tenantId: "t1" });
     const a = reg.mint({ workspaceId: "w", root: "/r", kind: "file", rel: "src/a.txt" });
     const b = reg.mint({ workspaceId: "w", root: "/r", kind: "file", rel: "src/a.txt" });
     assert.match(a.id, REF_PATTERN);
-    assert.equal(a.id.length, 4 + 22);
+    assert.match(a.id, /^[A-Za-z0-9_-]{43}$/);
+    assert.equal(a.id.length, 43);
+    assert.equal(a.id.startsWith("cr1_"), false);
+    assert.equal(Buffer.from(a.id, "base64url").length, 32, "32 random bytes");
+    assert.equal(reg.resolve("cr1_" + "A".repeat(22), { workspaceId: "w", root: "/r", kind: "file" }), null);
+    assert.equal(REF_PATTERN.test("worktree"), false, "the symbolic ref is not an id");
     assert.notEqual(a.id, b.id);
     assert.equal(a.id.includes("a.txt") || a.id.includes("src"), false);
     const ids = new Set(Array.from({ length: 2000 }, () => reg.mint({ workspaceId: "w", root: "/r", kind: "file", rel: "x" }).id));
@@ -171,13 +176,13 @@ test("ids: 128 random bits, not derived from the path, a fresh id per mint", ()
 test("ids: resolve only for the same tenant, workspace, root and kind; anything else is null (indistinguishable from unknown)", () => {
     const reg = new ContentRefRegistry({ tenantId: "t1" });
     const { id } = reg.mint({ workspaceId: "w1", root: "/r1", kind: "file", rel: "src/a.txt" });
-    assert.deepEqual(reg.resolve(id, { workspaceId: "w1", root: "/r1", kind: "file" }), { rel: "src/a.txt" });
+    assert.deepEqual(reg.resolve(id, { workspaceId: "w1", root: "/r1", kind: "file" }), { rel: "src/a.txt", after: null });
     assert.equal(reg.resolve(id, { workspaceId: "w2", root: "/r1", kind: "file" }), null, "other workspace");
     assert.equal(reg.resolve(id, { workspaceId: "w1", root: "/r2", kind: "file" }), null, "same workspace id, re-opened on another root");
     assert.equal(reg.resolve(id, { workspaceId: "w1", root: "/r1", kind: "diff" }), null, "other kind");
     const other = new ContentRefRegistry({ tenantId: "t2" });
     assert.equal(other.resolve(id, { workspaceId: "w1", root: "/r1", kind: "file" }), null, "other tenant's registry");
-    for (const junk of ["", "x", "cr1_", "cr1_short", `${id}0`, `${id.slice(0, -1)}!`, "../etc/passwd", "/etc/passwd", "src/a.txt", "%2e%2e", "a\u0000b", 42, null, undefined, {}]) {
+    for (const junk of ["", "x", "cr1_", "cr1_short", "worktree", "cr1_" + "A".repeat(22), `${id}0`, `${id.slice(0, -1)}!`, "../etc/passwd", "/etc/passwd", "src/a.txt", "%2e%2e", "a\u0000b", 42, null, undefined, {}]) {
         assert.equal(reg.resolve(junk, { workspaceId: "w1", root: "/r1", kind: "file" }), null);
     }
 });

package/test/la-protocol-v2/content-wiring.test.js

@@ -40,9 +40,9 @@ test("config: every number is clamped to a sane range; a bad value falls back to
 
 // ------------------------------------------------------------------------------------------ in process (runtime.js)
 
-async function linkFor(cp, { env, root, tenantWs } = {}) {
+async function linkFor(cp, { env, root, tenantWs, errors = [] } = {}) {
     const logs = [];
-    const log = { info: (m) => logs.push(m), log: (m) => logs.push(m), warn: (m) => logs.push(m) };
+    const log = { info: (m) => logs.push(m), log: (m) => logs.push(m), warn: (m) => logs.push(m), error: (m) => errors.push(m) };
     const wsManager = { list: () => [{ id: "ws-1", root, tenantId: tenantWs ?? TENANT }] };
     const link = await buildV2Link({ tenantId: TENANT, agentId: AGENT, signing: signingFor({ keyId: cp.keyId, publicKeyRaw: cp.publicKeyRaw }, "enforce"), wsManager,
         getWorkspaceRoot: () => root, log, env });
@@ -60,7 +60,7 @@ test("flag off (unset or any non-true value): content.request is acked `rejected
         const { link } = await linkFor(cp, { root, env: { LOCAL_AGENT_CONTENT_HANDLERS: v } });
         assert.equal(link.content, undefined);
         assert.deepEqual(cp.registers[0].capabilities, ["chunk.base64", "protocol.v2", "v1.commands"]);
-        cp.sendData("content.request", { kind: "file", ref: "cr1_" + "A".repeat(22), actor: ACTOR }, { workspaceId: "ws-1", requestId: uuid() });
+        cp.sendData("content.request", { kind: "file", ref: "A".repeat(43), actor: ACTOR }, { workspaceId: "ws-1", requestId: uuid() });
         await waitFor(() => cp.acksFromLa.length > 0);
         assert.deepEqual(cp.acksFromLa[0], { ackSeq: 1, status: "rejected", errorCode: "protocol_unsupported" });
         assert.equal(cp.received.filter((f) => f.type === "content.response").length, 0);
@@ -69,14 +69,14 @@ test("flag off (unset or any non-true value): content.request is acked `rejected
     }
 });
 
-test("flag on: the handler is installed, the register announces content.file and content.diff, mintRef gives the hook for future inventories", async () => {
+test("flag on: the handler is installed, the register announces content.file, content.file.list and content.diff, mintRef is the hook the listing mints through", async () => {
     const root = tmpDir(); write(root, "src/a.txt", "hello"); write(root, ".env", "X=1");
     const cp = new ReferenceCp();
     const { link, logs } = await linkFor(cp, { root, env: { LOCAL_AGENT_CONTENT_HANDLERS: "true", LOCAL_AGENT_DLP_MODE: "enforce" } });
-    assert.deepEqual(cp.registers[0].capabilities, ["chunk.base64", "content.diff", "content.file", "protocol.v2", "v1.commands"]);
+    assert.deepEqual(cp.registers[0].capabilities, ["chunk.base64", "content.diff", "content.file", "content.file.list", "protocol.v2", "v1.commands"]);
     assert.equal(logs.some((l) => l.includes("not enforce")), false, "enforce: no warning");
     const m = link.content.mintRef({ workspaceId: "ws-1", kind: "file", rel: "src/a.txt" });
-    assert.match(m.id, /^cr1_[A-Za-z0-9_-]{22}$/);
+    assert.match(m.id, /^[A-Za-z0-9_-]{43}$/);
     assert.equal(link.content.mintRef({ workspaceId: "ws-1", kind: "file", rel: ".env" }), null);
     assert.equal(link.content.mintRef({ workspaceId: "ws-unknown", kind: "file", rel: "src/a.txt" }), null);
     const requestId = uuid();
@@ -88,13 +88,38 @@ test("flag on: the handler is installed, the register announces content.file and
     fs.rmSync(root, { recursive: true, force: true });
 });
 
-test("flag on with the DLP not in enforce: the agent says so at install time (the operator chose, but it is visible)", async () => {
-    const root = tmpDir();
-    const cp = new ReferenceCp();
-    const { link, logs } = await linkFor(cp, { root, env: { LOCAL_AGENT_CONTENT_HANDLERS: "true" } });
-    assert.ok(logs.some((l) => l.includes("LOCAL_AGENT_DLP_MODE is not enforce")));
-    link.close();
-    fs.rmSync(root, { recursive: true, force: true });
+test("flag on x DLP mode (F3-07b): only enforce registers the handlers; off, warn, unset and unknown values do not (ERROR at startup, no content capability, protocol_unsupported)", async () => {
+    for (const mode of [undefined, "off", "warn", "enforce-ish", "ENFORCE"]) {
+        const root = tmpDir(); write(root, "a.txt", "x");
+        const cp = new ReferenceCp();
+        const errors = [];
+        const env = { LOCAL_AGENT_CONTENT_HANDLERS: "true", ...(mode === undefined ? {} : { LOCAL_AGENT_DLP_MODE: mode }) };
+        const { link, logs } = await linkFor(cp, { root, env, errors });
+        const enforce = mode === "ENFORCE"; // normalizeMode of the DLP module is case-insensitive: the agent and the DLP agree on what enforce means
+        assert.equal(!!link.content, enforce, String(mode));
+        assert.equal(cp.registers.at(-1).capabilities.includes("content.file"), enforce, String(mode));
+        assert.equal(cp.registers.at(-1).capabilities.includes("content.diff"), enforce, String(mode));
+        if (!enforce) {
+            assert.ok(errors.some((l) => l.includes("ERROR") && l.includes("LOCAL_AGENT_DLP_MODE") && l.includes("NOT registered")), String(mode));
+            const requestId = uuid();
+            cp.sendData("content.request", { kind: "diff", ref: "worktree", actor: ACTOR }, { workspaceId: "ws-1", requestId });
+            await waitFor(() => cp.acksFromLa.some((a) => a.status === "rejected"));
+            assert.deepEqual(cp.acksFromLa.filter((a) => a.status === "rejected").map((a) => a.errorCode), ["protocol_unsupported"], String(mode));
+            assert.equal(cp.received.some((f) => f.type === "content.response"), false, "no content.response, no file read");
+            assert.equal(logs.concat(errors).some((l) => l.includes(root)), false, "no path in the logs");
+        }
+        link.close();
+        fs.rmSync(root, { recursive: true, force: true });
+    }
+});
+
+test("installContentHandlers itself refuses to install without DLP enforce (defence in depth, no opt-out)", async () => {
+    const { installContentHandlers } = await import("../../src/la-protocol-v2/content-handlers/install.js");
+    const cfg = resolveContentHandlersConfig({ LOCAL_AGENT_CONTENT_HANDLERS: "true" }, () => {});
+    for (const mode of [undefined, "off", "warn"]) {
+        assert.throws(() => installContentHandlers({ link: { session: {}, close() {} }, tenantId: TENANT, wsManager: null, getWorkspaceRoot: () => null, config: cfg,
+            env: mode ? { LOCAL_AGENT_DLP_MODE: mode } : {} }), /DLP_MODE=enforce/);
+    }
 });
 
 test("flag on: a workspace of another tenant (per the agent's own registry) is not served", async () => {
@@ -113,7 +138,7 @@ test("flag on: a workspace of another tenant (per the agent's own registry) is n
 test("closing the link while a stream is in flight cancels it (no work left behind)", async () => {
     const root = tmpDir(); write(root, "big.txt", Buffer.alloc(900_000, 0x61));
     const cp = new ReferenceCp();
-    const { link } = await linkFor(cp, { root, env: { LOCAL_AGENT_CONTENT_HANDLERS: "true", LOCAL_AGENT_DLP_MODE: "off" } });
+    const { link } = await linkFor(cp, { root, env: { LOCAL_AGENT_CONTENT_HANDLERS: "true", LOCAL_AGENT_DLP_MODE: "enforce" } });
     const id = link.content.mintRef({ workspaceId: "ws-1", kind: "file", rel: "big.txt" }).id;
     cp.silent = true;
     cp.sendData("content.request", { kind: "file", ref: id, actor: ACTOR }, { workspaceId: "ws-1", requestId: uuid() });

package/test/la-protocol-v2/contract.test.js

@@ -52,9 +52,18 @@ test("vectors: the suite is complete (every type has a file, plus cross-type)",
 
 let valid = 0;
 let invalid = 0;
+let bodyVectors = 0;
 for (const file of vectorFiles) {
     const doc = JSON.parse(fs.readFileSync(path.join(VECTORS, file), "utf8"));
     for (const v of doc.vectors) {
+        // F3-07c: `file.list.body.vectors.json` holds bodies (the decoded data of a content.response), not frames: they name their schema
+        if (typeof doc.schema === "string" && doc.schema.endsWith(".body.schema.json")) {
+            test(`vector ${file.replace(".vectors.json", "")} :: ${v.name}`, () => {
+                assert.equal(contract.validateBody(doc.schema, v.message), v.expect.valid === true);
+                bodyVectors++;
+            });
+            continue;
+        }
         test(`vector ${file.replace(".vectors.json", "")} :: ${v.name}`, () => {
             const r = contract.validateFrame(v.message);
             if (v.expect.valid) {
@@ -73,10 +82,11 @@ for (const file of vectorFiles) {
     }
 }
 
-test("vectors: counts (134 = 24 valid + 110 invalid in this copy)", () => {
-    assert.equal(valid + invalid, 134);
-    assert.equal(valid, 24);
-    assert.equal(invalid, 110);
+test("vectors: counts (176 frames = 34 valid + 142 invalid in this copy, plus the bodies of file.list)", () => {
+    assert.equal(valid + invalid, 176);
+    assert.equal(valid, 34);
+    assert.equal(invalid, 142);
+    assert.equal(bodyVectors, 54, "file.list.body.vectors.json (F3-07c): 54 bodies");
 });
 
 // ------------------------------------------------------------------------------------------------ tables
@@ -99,7 +109,7 @@ test("error codes: fatal and retryable sets mirror the gateway (LaV2ErrorCode)",
 
 test("allowlist: the LA receives only cp->la/both types and sends only la->cp/both types; v1 commands are not types", () => {
     assert.deepEqual([...contract.inboundTypes].sort(), ["ack", "approval.decision", "config.update", "content.request", "error", "job.assign", "job.cancel", "ready", "scan.upload", "webhook.forward"]);
-    assert.deepEqual([...contract.outboundTypes].sort(), ["ack", "alert", "audit.event", "content.response", "error", "heartbeat", "hello", "incident.candidate", "job.event", "job.result", "log.stats", "register", "scan.uploaded"]);
+    assert.deepEqual([...contract.outboundTypes].sort(), ["ack", "alert", "audit.event", "content.index", "content.response", "error", "heartbeat", "hello", "incident.candidate", "job.event", "job.result", "log.stats", "register", "scan.uploaded"]);
     for (const v1 of ["mcp.execute-command", "workspace.open", "health", "shell.exec", "__proto__", "constructor", "toString"]) {
         assert.equal(contract.canReceive(v1), false, v1);
         assert.equal(contract.canSend(v1), false, v1);

package/test/la-protocol-v2/helpers/reference-cp.js

@@ -52,6 +52,8 @@ export class ReferenceCp {
         this.rawIn = [];
         this.dropAcks = 0;        // do not ack the next n accepted LA data frames (simulates lost acks)
         this.silent = false;      // do not ack anything
+        this.rejectData = [];     // F3-07b: error codes, consumed one per LA data frame: the frame is acked `rejected` with that code (not stored)
+        this.rejectedFrames = []; // [type, code] of the frames acked `rejected`
         this.ackDelayMs = 0;      // answer acks late (slow consumer)
         this.onReceived = () => {};
         this.contentRequests = new Map(); // requestId -> {chunks:[], done}
@@ -167,6 +169,12 @@ export class ReferenceCp {
         this.ring.set(seq, msgId);
         while (this.ring.size > 512) this.ring.delete(this.ring.keys().next().value);
         if (m.ack !== undefined) this.#ackUpTo(m.ack);
+        if (this.rejectData.length > 0) { // the gateway's non-fatal answer: the seq is consumed, the frame is not stored
+            const code = this.rejectData.shift();
+            this.rejectedFrames.push([m.type, code]);
+            this.#sendAck(seq, "rejected", code);
+            return null;
+        }
         this.received.push(m);
         if (m.type === "content.response") {
             const c = this.contentRequests.get(m.requestId) || { chunks: [], done: false };

package/test/la-protocol-v2/traces.test.js

@@ -1,4 +1,4 @@
-// F3-05b: the 24 whole-session traces of the contract (F3-22), reproduced in Node. "Traces are language
+// F3-05b (+2 of F3-07b, content.index): the 26 whole-session traces of the contract (F3-22), reproduced in Node. "Traces are language
 // neutral; the LA must reproduce each expect.error." Three things are shown for them:
 //   1. the reference CP (test helper) reproduces every trace: same error at the same frame (so the model the
 //      other tests use is the model of the contract);
@@ -18,9 +18,9 @@ import { V2Session } from "../../src/la-protocol-v2/session.js";
 const DIR = path.join(path.dirname(fileURLToPath(import.meta.url)), "../contract/la-protocol-v2/vectors/traces");
 const traces = fs.readdirSync(DIR).filter((f) => f.endsWith(".json")).sort().map((f) => ({ file: f, name: f.replace(".json", ""), ...JSON.parse(fs.readFileSync(path.join(DIR, f), "utf8")) }));
 
-test("the suite has all 24 traces (20 invalid, 4 valid)", () => {
-    assert.equal(traces.length, 24);
-    assert.equal(traces.filter((t) => t.expect.ok).length, 4);
+test("the suite has all 26 traces (21 invalid, 5 valid)", () => {
+    assert.equal(traces.length, 26);
+    assert.equal(traces.filter((t) => t.expect.ok).length, 5);
 });
 
 const textOf = (fr) => {
@@ -223,6 +223,31 @@ test("valid-content-chunks-in-order: the three chunks of the trace go out in ord
     env.session.close();
 });
 
+test("valid-content-index: the two inventories of the trace go out in order after ready and the CP accepts them", async () => {
+    const t = traces.find((x) => x.name === "valid-content-index");
+    const cp = new ReferenceCp({ tenantId: t.session.tenantId, agentId: t.session.agentId });
+    const env = inMemory(cp, { tenantId: t.session.tenantId, agentId: t.session.agentId }).start();
+    await waitFor(() => env.session.state === "ready");
+    for (const fr of LA_FRAMES(t).filter((f) => f.frame.type === "content.index")) {
+        await env.session.send("content.index", fr.frame.payload, { workspaceId: fr.frame.workspaceId });
+    }
+    assert.deepEqual(cp.received.map((f) => [f.type, f.seq]), [["content.index", 1], ["content.index", 2]]);
+    assert.deepEqual(cp.errorsSent, []);
+    env.session.close();
+});
+
+test("invalid-content-index-before-ready: the LA never produces it (no data before ready: not_ready, nothing written)", async () => {
+    const cp = new ReferenceCp();
+    const sent = [];
+    const env = inMemory(cp);
+    env.session.attach({ send: (x) => sent.push(JSON.parse(x)), close() {}, bufferedAmount: () => 0 });
+    const t = traces.find((x) => x.name === "invalid-content-index-before-ready");
+    const bad = t.frames[t.expect.atFrame].frame;
+    await assert.rejects(env.session.enqueue("content.index", bad.payload, { workspaceId: bad.workspaceId }), (e) => e.code === "not_ready");
+    assert.deepEqual(sent.map((f) => f.type), ["register", "hello"]);
+    env.session.close();
+});
+
 test("valid-retransmit-is-idempotent: an ack lost -> the same frame again -> the CP re-acks and counts one event", async () => {
     const cp = new ReferenceCp({ limits: { ackTimeoutMs: 100 } });
     const env = inMemory(cp).start();