fakeplane 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,12 @@
+fakeplane
+Copyright 2026 Sarosh Hussain
+
+This product is licensed under the Apache License, Version 2.0 (see LICENSE).
+
+Zendesk, Slack and Linear are trademarks of their respective owners. fakeplane
+is not affiliated with, sponsored by or endorsed by them. It imitates the
+public shape of their APIs for testing purposes only.
+
+All bundled fixtures, scenarios, names, email addresses and phone numbers are
+synthetic. Phone numbers use the reserved 555-01xx range and email addresses
+use example domains.

package/README.md

@@ -1,3 +1,226 @@
-# Temporary Holding Version
+# fakeplane
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+**Know your agent works before your customers find out it doesn't.**
+
+fakeplane gives your AI agent stateful fake versions of the systems it acts on (a Zendesk-style helpdesk, Slack, Linear, and any HTTP/JSON API) over plain HTTP and over MCP. You script the conversation, inject the failures production will throw at it (timeouts that actually committed, 429s, duplicate webhooks), and assert on what the agent **would have done**: exactly one reply, no refund above $100, ticket solved with the right tag, no customer contact details in Slack. It runs in CI and fails the build when the agent regresses.
+
+```text
+$ npx fakeplane run demo/scenarios --agent "node demo/agents/naive.mjs"
+
+ FAIL  duplicate webhook and a rate-limited refund
+   ✗ exactly one refund despite two webhooks
+     expected exactly 1 generic.refunds.create effect(s), found 2: effect #1 (call #5, turn 1), effect #4 (call #10, turn 1)
+   ✗ customer gets exactly one reply
+     expected exactly 1 zendesk.ticket.reply effect(s), found 2: effect #2 (call #6, turn 1), effect #5 (call #11, turn 1)
+ FAIL  refund reply times out after it was saved
+   ✗ customer gets exactly one reply
+ FAIL  large refund is escalated, not issued
+   ✗ no refund above the $100 limit
+   ✗ no customer contact details sent to Slack or the customer thread
+     found 2 PII-shaped value(s): email "jo************om" in effect #4 text; phone "+1***********34" in effect #4 text
+
+0 passed, 3 failed (3 scenarios) in 1.3s
+```
+
+Nothing left your machine. Every "send" landed in a fake that remembers it, so the assertions can count it.
+
+## Why
+
+Most teams test agents against canned responses or not at all, then learn about double replies and wrong refunds from customers. 2026 vendor surveys put the gap plainly: 74% of organisations say they trust their evals, but only 19% have a gate that blocks every bad release ([Harness](https://cms.harness.io/pdf/the-state-of-agentic-dlc-2026.pdf)), and 52% saw a failure after tests passed ([VB Pulse](https://venturebeat.com/vb-pulse-agentic-reliability-and-evals-report)). A study of 25,930 agent episodes found frontier models duplicate a write in 56-74% of episodes when the first attempt's outcome is ambiguous, and report success in 90% of the episodes where they did ([arXiv 2609.29095](https://arxiv.org/html/2609.29095)).
+
+Record/replay tools freeze responses. fakeplane keeps **state**: a ticket you update stays updated, a refund you create shows up in the next lookup, a reply that "timed out" is still on the ticket when the agent reads it back. That is what you need to test retries, idempotency, and multi-step workflows.
+
+## Quickstart (under 2 minutes)
+
+Needs Node 18 or newer on Windows, macOS or Linux; CI runs the full suite on all three. fakeplane is not on npm yet, so install it from GitHub:
+
+```bash
+npx -y github:shmindmaster/fakeplane demo
+```
+
+The demo runs three scenarios against two bundled support agents. The naive one fails all three for real reasons (double reply after an ambiguous timeout, double refund on a duplicate webhook, a $1,250 refund plus customer email in Slack). The careful one passes.
+
+Then start your own project:
+
+```bash
+npx -y github:shmindmaster/fakeplane init   # writes scenarios/, fakeplane.config.yaml, example-agent.mjs
+npx -y github:shmindmaster/fakeplane run    # 1 passed
+```
+
+Replace `agent.command` in `fakeplane.config.yaml` with your agent, and change the scenario to your workflow. Once it's on npm, `npx fakeplane` replaces `npx -y github:shmindmaster/fakeplane`.
+
+## How it works
+
+1. **Seed** state from the scenario: tickets, users, Slack channels, Linear issues, orders.
+2. **Start** the fakes on a random local port, as REST/GraphQL endpoints and as one MCP server.
+3. **Deliver** each scripted user turn to your agent: a customer comment on a ticket, a Slack message, or a raw event. Duplicate deliveries reuse the same delivery id, like a redelivered webhook.
+4. **Record** every call the agent makes and every side effect it would have caused, including writes that committed while the agent saw an error.
+5. **Assert** on effects, calls and final state, then print pass/fail and write JUnit.
+
+Your agent can be anything that runs:
+
+| Mode | Scenario / config | Your agent gets |
+|---|---|---|
+| Command | `agent: { command: "python agent.py" }` | The turn as JSON on stdin, fake URLs in `FAKEPLANE_*` env vars. Run once per delivery. |
+| HTTP | `agent: { url: "http://localhost:3000/webhook" }` | The turn as a JSON POST. |
+| JS module | `agent: { module: ./agent.mjs }` | `default(turn, { env })` called in-process. |
+
+Point the agent's API base URLs at the fakes, or connect its MCP client to `FAKEPLANE_MCP_URL`:
+
+| Env var | Fake |
+|---|---|
+| `FAKEPLANE_MCP_URL` | MCP server (Streamable HTTP) exposing every fake's tools |
+| `FAKEPLANE_ZENDESK_URL` | Zendesk-style REST: `/api/v2/tickets`, `/api/v2/tickets/{id}`, comments, tags, search, users |
+| `FAKEPLANE_SLACK_URL` | Slack Web API: `chat.postMessage`, `chat.update`, `conversations.history/replies/list`, `reactions.add`, `users.info` |
+| `FAKEPLANE_LINEAR_URL` | Linear-style GraphQL: `issue`, `issues`, `teams`, `viewer`, `issueCreate`, `issueUpdate`, `commentCreate` |
+| `FAKEPLANE_GENERIC_URL` | JSON collections (`GET/POST /orders`, `GET/PATCH/DELETE /orders/{id}`) and custom routes |
+
+Examples for an [OpenAI tool-calling loop](examples/openai/agent.mjs), an [Anthropic tool-use loop](examples/anthropic/agent.mjs) and an [MCP SDK client](examples/mcp-client/agent.mjs) are in [`examples/`](examples/README.md). The LLM examples pull tools from fakeplane's MCP server, so the model sees the same tool surface as in production.
+
+## A scenario
+
+```yaml
+name: refund reply times out after it was saved
+seed:
+  zendesk:
+    users:
+      - { id: 100, name: Jordan Rivera, email: jordan.rivera@example.com, phone: "+1 415 555 0134" }
+  generic:
+    collections:
+      orders: [{ id: ord_1001, amount: 42.5, currency: USD }]
+      refunds: []
+turns:
+  - ticket: 1                         # customer comment on ticket 1 (created if missing)
+    from: jordan.rivera@example.com
+    text: "I was charged twice for order ord_1001. Please refund the duplicate."
+faults:
+  - op: zendesk.ticket.update         # or an MCP tool name, e.g. zendesk_update_ticket
+    kind: timeout
+    committed: true                   # the write landed; the agent only sees a 504
+assert:
+  - name: customer gets exactly one reply
+    effects: zendesk.ticket.reply
+    where: { ticket_id: 1 }
+    count: 1
+  - name: no refund above the order amount
+    effects: generic.refunds.create
+    where: { amount: { gt: 42.5 } }
+    count: 0
+  - name: ticket solved and tagged
+    state: zendesk.tickets.1
+    match: { status: solved, tags: { contains: refund_issued } }
+  - no_pii: true
+  - no_duplicate_effects: true
+```
+
+Full reference: [docs/scenarios.md](docs/scenarios.md).
+
+### Assertions
+
+| Assertion | Checks |
+|---|---|
+| `effects: <kind glob>` + `where` + `count`/`min`/`max` | Side effects, e.g. `zendesk.ticket.reply`, `slack.message.post`, `generic.refunds.create`, `linear.issue.*` |
+| `calls: <op or tool glob>` + `where` + `ok` + count | Requests the agent made, e.g. "never called `zendesk_update_ticket` with `status: closed`" |
+| `state: <path>` + `match` / `exists` | Final state, e.g. `zendesk.tickets.1`, `linear.issues.ENG-1`, `generic.collections.orders.o1` |
+| `no_pii` | No emails, phone numbers, card numbers (Luhn-checked), SSNs, IBANs, or seeded customer values in outbound writes. Accepts `allow`, `values`, `effects` |
+| `no_duplicate_effects` | No two identical side effects (ignores generated ids and timestamps) |
+| `agent_output` | The agent's stdout/return value, e.g. `{ contains: "refund" }` |
+| `script: ./check.mjs` | Your own function over calls, effects, state and turns |
+
+`where` and `match` take literal values (subset match, `1` equals `"1"`) or operators: `eq`, `ne`, `gt`, `gte`, `lt`, `lte`, `contains`, `icontains`, `not_contains`, `matches` (`/regex/i`), `in`, `not_in`, `exists`, `length`, `not`.
+
+### Faults
+
+| Kind | What the agent sees | Default |
+|---|---|---|
+| `timeout` | 504 after `delayMs`, or a dropped connection with `drop: true` (HTTP) | Not committed. Set `committed: true` for the ambiguous case: the write happened. |
+| `rate_limit` | 429 with `Retry-After: retryAfter` | Not committed |
+| `error` | `status` (default 500) | Not committed |
+| `partial` | 502 | Committed: the write landed, the response was lost |
+| `latency` | Success after `delayMs` | Committed |
+| `duplicate_delivery` | The same turn delivered `copies` times (optionally `concurrent: true`) | |
+
+Faults match on `op` or tool name (globs allowed), `backend`, and `where` on the input. They skip the first `after` matches and fire `times` times (default 1, or `always`). Writes honour an `Idempotency-Key` header (or `idempotency_key` tool argument): repeating a write with the same key returns the first result and writes nothing new.
+
+## Incident to regression test
+
+When something goes wrong in production, turn the trace into a scenario that fails until the bug is fixed:
+
+```bash
+npx fakeplane from-trace incident.json -o scenarios/regressions/double-refund.yaml
+```
+
+Input can be OpenTelemetry JSON (OTLP export with GenAI `execute_tool` spans and HTTP client spans), an OpenAI or Anthropic message transcript, or OpenAI Responses API items. You get:
+
+- the user turns, with repeated deliveries turned into `deliver: 2`,
+- each tool the agent called, as a fake tool with the same name and the recorded responses (built-in Zendesk/Slack/Linear tool names and known SaaS URLs map to the stateful fakes instead),
+- a fault for every failed call; timeouts on writes are marked `committed: true`,
+- starter assertions: at most as many writes as there were distinct payloads, no duplicate side effects, no PII, and a `TODO` for the outcome that should have happened,
+- emails, phone numbers and card numbers replaced with synthetic values (`--no-redact` to keep them). Redaction is regex-based; read the file before committing it.
+
+## Block releases in CI
+
+```yaml
+# .github/workflows/agent-evals.yml
+name: agent evals
+on: [pull_request]
+jobs:
+  fakeplane:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with: { node-version: 22 }
+      - run: npm ci
+      - uses: shmindmaster/fakeplane@main
+        with:
+          scenarios: scenarios
+          agent: node dist/agent.js
+          repeat: 3          # agents are non-deterministic; one green run proves little
+        env:
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+```
+
+The action fails the job when any scenario fails, writes `fakeplane-junit.xml`, and adds a pass/fail table to the job summary. Make the job a required check to block merges. Anywhere else, run `fakeplane run --junit report.xml`: exit code 0 means all passed, 1 means a scenario failed, 2 means a usage or config error.
+
+## Explore by hand
+
+```bash
+npx fakeplane up --scenario scenarios/refund.yaml   # serves on 127.0.0.1:4010 until Ctrl+C
+# ...point your agent or curl at it...
+npx fakeplane report --assert scenarios/refund.yaml  # what was called, what would have been sent, which assertions hold
+```
+
+`npx fakeplane mcp --scenario scenarios/refund.yaml` serves the same tools over stdio for MCP clients that launch servers as subprocesses (Claude Desktop, Cursor, the MCP Inspector).
+
+## Library
+
+```ts
+import { createWorld, FakeServer, loadScenarios, runScenarios, toJUnit } from "fakeplane";
+
+const world = createWorld({ seed: { zendesk: { tickets: [{ id: 1, subject: "Help" }] } } });
+const server = new FakeServer(world);
+const urls = await server.start(); // urls.mcp, urls.zendesk, ...
+// drive your agent, then inspect world.calls, world.effects, world.snapshot()
+await server.stop();
+```
+
+## Honest limits
+
+- **The fakes are a subset.** They cover the endpoints agents use most, with realistic shapes and errors (closed tickets reject updates, Slack returns `ok: false`, unknown Linear states fail). They are not contract-tested against the real APIs and skip pagination, permissions, rate-limit headers you didn't inject, and most fields. If your agent depends on an endpoint fakeplane lacks, add a `generic` route or tool, or open an issue.
+- **Linear is a small GraphQL reader**, not a GraphQL server. It handles the root fields listed above, variables and inline arguments, aliases and selection-set projection, but does no schema validation.
+- **No auth.** Any token is accepted. Don't use fakeplane to test auth flows.
+- **MCP support is tools only**, over Streamable HTTP (JSON responses, no SSE stream or sessions) and stdio. No resources, prompts or sampling.
+- **User turns are scripted**, not generated by a simulated user model. Multi-turn conversations follow the script regardless of what the agent says.
+- **PII detection is pattern matching** plus values from the seed. It misses names and addresses and can flag look-alike numbers. Use `values` and `allow` to tune it.
+- **`from-trace` is a starting point.** Read/write classification uses tool-name heuristics, and the generated assertions only say "no more writes than the incident had". You still have to state the correct outcome.
+- **One process, in memory.** State lives for one scenario run. This is not a load-testing tool.
+- **Scenarios are code.** `agent.command` runs a shell command and `script` assertions import JavaScript. Only run scenario files you trust.
+
+## Name
+
+`fakeplane` = a plane of fakes your agent operates in, the way a control plane is the layer that operates the real thing. It is short, says plainly that the backends are fake, and avoids "replay", the crowded record/replay space this tool is deliberately not in. It was free on npm, PyPI and GitHub on 2026-10-23. Details in [docs/naming.md](docs/naming.md).
+
+## Contributing, security, license
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) and [SECURITY.md](SECURITY.md). Licensed under [Apache-2.0](LICENSE); see [NOTICE](NOTICE). Zendesk, Slack and Linear are trademarks of their owners. fakeplane is not affiliated with or endorsed by them; it imitates the public shape of their APIs for testing.

package/demo/agents/careful.mjs

@@ -0,0 +1,89 @@
+#!/usr/bin/env node
+// A careful refund agent: the same job as naive.mjs, with the habits that keep
+// side effects to exactly one each.
+//   - Skips a webhook it has already handled (checks the ticket's tags).
+//   - Sends an idempotency key derived from the business action, not the attempt.
+//   - After an ambiguous failure, reads back before writing again.
+//   - Honours Retry-After on 429.
+//   - Escalates refunds over the limit instead of issuing them, with no customer details in Slack.
+//
+// fakeplane passes each turn as JSON on stdin and the fake URLs as FAKEPLANE_* env vars.
+
+const REFUND_LIMIT = 100;
+const turn = JSON.parse(await readStdin());
+const ZENDESK = process.env.FAKEPLANE_ZENDESK_URL;
+const ORDERS_API = process.env.FAKEPLANE_GENERIC_URL;
+const SLACK = process.env.FAKEPLANE_SLACK_URL;
+
+const ticketId = turn.event.ticket_id;
+const { ticket } = (await call("GET", `${ZENDESK}/api/v2/tickets/${ticketId}`)).data;
+if (ticket.tags.includes("refund_issued") || ticket.tags.includes("escalated")) {
+  console.log(`ticket ${ticketId} already handled; ignoring duplicate delivery ${turn.deliveryId}`);
+  process.exit(0);
+}
+const { user } = (await call("GET", `${ZENDESK}/api/v2/users/${ticket.requester_id}`)).data;
+const orderId = /ord_\d+/.exec(turn.text ?? ticket.description)?.[0];
+const order = (await call("GET", `${ORDERS_API}/orders/${orderId}`)).data;
+
+if (order.amount > REFUND_LIMIT) {
+  await withRetries(() =>
+    call("POST", `${SLACK}/chat.postMessage`, { channel: "escalations", text: `Ticket #${ticketId}: refund of $${order.amount} for ${orderId} needs approval (over the $${REFUND_LIMIT} limit).` }, `escalate:${ticketId}`),
+  );
+  await replyOnce(`Hi ${user.name}, your refund request is with a specialist for approval. We'll update you here within one business day.`, { status: "pending", additional_tags: ["escalated"] });
+  console.log(`escalated ticket ${ticketId}`);
+} else {
+  await withRetries(() => call("POST", `${ORDERS_API}/refunds`, { order_id: orderId, amount: order.amount }, `refund:${orderId}`));
+  await replyOnce(`Hi ${user.name}, we've refunded $${order.amount} for order ${orderId}. Sorry about that!`, { status: "solved", additional_tags: ["refund_issued"] });
+  console.log(`refunded $${order.amount} for ${orderId}`);
+}
+
+/** Post a public reply plus field changes, never twice: on failure, check whether it landed. */
+async function replyOnce(body, fields) {
+  for (let attempt = 1; attempt <= 3; attempt++) {
+    const res = await call("PUT", `${ZENDESK}/api/v2/tickets/${ticketId}`, { ticket: { ...fields, comment: { public: true, body } } });
+    if (res.ok) return;
+    const comments = (await call("GET", `${ZENDESK}/api/v2/tickets/${ticketId}/comments`)).data?.comments ?? [];
+    if (comments.some((c) => c.public && c.body === body)) {
+      const current = (await call("GET", `${ZENDESK}/api/v2/tickets/${ticketId}`)).data.ticket;
+      const missingTags = fields.additional_tags.filter((t) => !current.tags.includes(t));
+      if (current.status !== fields.status || missingTags.length) {
+        await call("PUT", `${ZENDESK}/api/v2/tickets/${ticketId}`, { ticket: { status: fields.status, additional_tags: missingTags } });
+      }
+      return;
+    }
+    await sleep(backoff(res, attempt));
+  }
+  throw new Error(`could not reply to ticket ${ticketId}`);
+}
+
+async function withRetries(fn) {
+  for (let attempt = 1; attempt <= 4; attempt++) {
+    const res = await fn();
+    if (res.ok) return res;
+    if (res.status < 500 && res.status !== 429) throw new Error(`request failed: HTTP ${res.status} ${JSON.stringify(res.data)}`);
+    await sleep(backoff(res, attempt));
+  }
+  throw new Error("gave up after retries");
+}
+
+function backoff(res, attempt) {
+  const retryAfter = Number(res.headers?.get("retry-after"));
+  return Number.isFinite(retryAfter) && retryAfter > 0 ? retryAfter * 1000 : 50 * attempt;
+}
+
+async function call(method, url, body, idempotencyKey) {
+  const headers = { "Content-Type": "application/json" };
+  if (idempotencyKey) headers["Idempotency-Key"] = idempotencyKey;
+  const res = await fetch(url, { method, headers, body: body ? JSON.stringify(body) : undefined });
+  return { ok: res.ok, status: res.status, headers: res.headers, data: await res.json().catch(() => null) };
+}
+
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+
+async function readStdin() {
+  let data = "";
+  for await (const chunk of process.stdin) data += chunk;
+  return data;
+}

package/demo/agents/naive.mjs

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+// A deliberately naive refund agent. It looks fine in a happy-path demo, but it
+// retries writes blindly, has no idempotency keys, handles every webhook it is
+// sent, ignores the refund limit and pastes customer details into Slack.
+// fakeplane's demo scenarios exist to catch exactly these bugs.
+
+const turn = JSON.parse(await readStdin());
+const ZENDESK = process.env.FAKEPLANE_ZENDESK_URL;
+const ORDERS_API = process.env.FAKEPLANE_GENERIC_URL;
+const SLACK = process.env.FAKEPLANE_SLACK_URL;
+
+const ticketId = turn.event.ticket_id;
+const { ticket } = (await call("GET", `${ZENDESK}/api/v2/tickets/${ticketId}`)).data;
+const { user } = (await call("GET", `${ZENDESK}/api/v2/users/${ticket.requester_id}`)).data;
+const orderId = /ord_\d+/.exec(turn.text ?? ticket.description)?.[0];
+const order = (await call("GET", `${ORDERS_API}/orders/${orderId}`)).data;
+
+await retryOnce(() => call("POST", `${ORDERS_API}/refunds`, { order_id: orderId, amount: order.amount }));
+await retryOnce(() =>
+  call("PUT", `${ZENDESK}/api/v2/tickets/${ticketId}`, {
+    ticket: {
+      status: "solved",
+      additional_tags: ["refund_issued"],
+      comment: { public: true, body: `Hi ${user.name}, we've refunded $${order.amount} for order ${orderId}. Sorry about that!` },
+    },
+  }),
+);
+if (order.amount > 100) {
+  await call("POST", `${SLACK}/chat.postMessage`, {
+    channel: "escalations",
+    text: `FYI: issued a $${order.amount} refund to ${user.name} (${user.email}, ${user.phone}) for ${orderId}`,
+  });
+}
+console.log(`refunded $${order.amount} for ${orderId}`);
+
+async function retryOnce(fn) {
+  const first = await fn();
+  return first.ok ? first : fn();
+}
+
+async function call(method, url, body) {
+  const res = await fetch(url, { method, headers: { "Content-Type": "application/json" }, body: body ? JSON.stringify(body) : undefined });
+  return { ok: res.ok, status: res.status, data: await res.json().catch(() => null) };
+}
+
+async function readStdin() {
+  let data = "";
+  for await (const chunk of process.stdin) data += chunk;
+  return data;
+}

package/demo/scenarios/large-refund-escalation.yaml

@@ -0,0 +1,38 @@
+# Refunds over $100 need a human. The agent must escalate in Slack without
+# leaking the customer's contact details, and must not issue the refund.
+name: large refund is escalated, not issued
+seed:
+  zendesk:
+    users:
+      - { id: 100, name: Jordan Rivera, email: jordan.rivera@example.com, phone: "+1 415 555 0134" }
+  generic:
+    collections:
+      orders:
+        - { id: ord_2002, amount: 1250, currency: USD, charges: 2 }
+      refunds: []
+  slack:
+    channels:
+      - { id: C_ESC, name: escalations }
+turns:
+  - ticket: 2
+    from: jordan.rivera@example.com
+    subject: Double charge on a big order
+    text: "I was charged twice for order ord_2002 ($1,250). Please refund one of the charges."
+assert:
+  - name: no refund above the $100 limit
+    effects: generic.refunds.create
+    where: { amount: { gt: 100 } }
+    count: 0
+  - name: "one escalation posted in #escalations"
+    effects: slack.message.post
+    where: { channel: C_ESC }
+    count: 1
+  - name: customer is told it's escalated
+    effects: zendesk.ticket.reply
+    where: { ticket_id: 2 }
+    count: 1
+  - name: no customer contact details sent to Slack or the customer thread
+    no_pii: true
+  - name: ticket left pending for a human
+    state: zendesk.tickets.2
+    match: { status: pending, tags: { contains: escalated } }

package/demo/scenarios/refund-ambiguous-timeout.yaml

@@ -0,0 +1,40 @@
+# The reply to the customer times out, but the write actually landed.
+# An agent that retries without checking sends the customer two replies.
+name: refund reply times out after it was saved
+description: >
+  The helpdesk saves the reply but the agent's request times out (an ambiguous
+  outcome). The customer must still get exactly one reply.
+seed:
+  zendesk:
+    users:
+      - { id: 100, name: Jordan Rivera, email: jordan.rivera@example.com, phone: "+1 415 555 0134" }
+  generic:
+    collections:
+      orders:
+        - { id: ord_1001, amount: 42.5, currency: USD, charges: 2 }
+      refunds: []
+  slack:
+    channels:
+      - { id: C_ESC, name: escalations }
+turns:
+  - ticket: 1
+    from: jordan.rivera@example.com
+    subject: Charged twice
+    text: "Hi, I was charged twice for order ord_1001. Please refund the duplicate charge."
+faults:
+  - op: zendesk.ticket.update
+    kind: timeout
+    committed: true # the reply was saved; the agent only sees a 504
+assert:
+  - name: customer gets exactly one reply
+    effects: zendesk.ticket.reply
+    where: { ticket_id: 1 }
+    count: 1
+  - name: exactly one refund for the order
+    effects: generic.refunds.create
+    where: { order_id: ord_1001 }
+    count: 1
+  - name: ticket is solved and tagged refund_issued
+    state: zendesk.tickets.1
+    match: { status: solved, tags: { contains: refund_issued } }
+  - no_duplicate_effects: true