groove-dev 0.27.92 → 0.27.94

package/node_modules/moe-training/test/client/envelope-builder.test.js

@@ -0,0 +1,107 @@
+// FSL-1.1-Apache-2.0 — see LICENSE
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { EnvelopeBuilder } from '../../client/envelope-builder.js';
+import { CHUNK_SIZE } from '../../shared/constants.js';
+
+const metadata = {
+  model_engine: 'claude-opus-4-6',
+  provider: 'claude-code',
+  agent_role: 'backend',
+  agent_id: 'backend-1',
+  task_complexity: 'medium',
+  team_size: 2,
+  session_quality: 80,
+  groove_version: '0.27.0',
+};
+
+describe('EnvelopeBuilder', () => {
+  it('adding steps below CHUNK_SIZE returns null', () => {
+    const builder = new EnvelopeBuilder('sess_1', 'user_1', metadata);
+    for (let i = 0; i < CHUNK_SIZE - 1; i++) {
+      const result = builder.addStep({ step: i + 1, type: 'thought', timestamp: Date.now() / 1000 });
+      assert.equal(result, null);
+    }
+  });
+
+  it('adding step that hits CHUNK_SIZE returns envelope', () => {
+    const builder = new EnvelopeBuilder('sess_1', 'user_1', metadata);
+    let envelope = null;
+    for (let i = 0; i < CHUNK_SIZE; i++) {
+      envelope = builder.addStep({ step: i + 1, type: 'thought', timestamp: Date.now() / 1000 });
+    }
+    assert.ok(envelope);
+    assert.equal(envelope.trajectory_log.length, CHUNK_SIZE);
+    assert.equal(envelope.session_id, 'sess_1');
+    assert.equal(envelope.contributor_id, 'user_1');
+    assert.ok(envelope.envelope_id.startsWith('env_'));
+    assert.equal(envelope.chunk_sequence, 0);
+  });
+
+  it('flush returns remaining steps', () => {
+    const builder = new EnvelopeBuilder('sess_1', 'user_1', metadata);
+    builder.addStep({ step: 1, type: 'thought', timestamp: 123 });
+    builder.addStep({ step: 2, type: 'action', timestamp: 124 });
+    const envelope = builder.flush();
+    assert.ok(envelope);
+    assert.equal(envelope.trajectory_log.length, 2);
+  });
+
+  it('flush returns null when buffer is empty', () => {
+    const builder = new EnvelopeBuilder('sess_1', 'user_1', metadata);
+    assert.equal(builder.flush(), null);
+  });
+
+  it('SESSION_CLOSE includes outcome data', () => {
+    const builder = new EnvelopeBuilder('sess_1', 'user_1', metadata);
+    const outcome = {
+      status: 'SUCCESS',
+      user_interventions: 1,
+      total_steps: 50,
+      total_chunks: 1,
+      total_tokens: 5000,
+      duration_seconds: 120,
+      files_modified: 3,
+      errors_encountered: 1,
+      errors_recovered: 1,
+      coordination_events: 0,
+    };
+    const close = builder.buildSessionClose(outcome);
+    assert.ok(close.envelope_id.startsWith('env_'));
+    assert.equal(close.session_id, 'sess_1');
+    assert.equal(close.type, 'SESSION_CLOSE');
+    assert.deepEqual(close.outcome, outcome);
+  });
+
+  it('truncates step content at 10000 characters', () => {
+    const builder = new EnvelopeBuilder('sess_1', 'user_1', metadata);
+    const longContent = 'x'.repeat(15_000);
+    builder.addStep({ step: 1, type: 'thought', timestamp: 123, content: longContent });
+    const envelope = builder.flush();
+    assert.equal(envelope.trajectory_log[0].content.length, 10_000);
+  });
+
+  it('caps token_count at 100000', () => {
+    const builder = new EnvelopeBuilder('sess_1', 'user_1', metadata);
+    builder.addStep({ step: 1, type: 'thought', timestamp: 123, token_count: 999_999 });
+    const envelope = builder.flush();
+    assert.equal(envelope.trajectory_log[0].token_count, 100_000);
+  });
+
+  it('chunk sequence increments correctly', () => {
+    const builder = new EnvelopeBuilder('sess_1', 'user_1', metadata);
+    let first = null;
+    let second = null;
+
+    for (let i = 0; i < CHUNK_SIZE; i++) {
+      first = builder.addStep({ step: i + 1, type: 'thought', timestamp: Date.now() / 1000 }) || first;
+    }
+    for (let i = 0; i < CHUNK_SIZE; i++) {
+      second = builder.addStep({ step: CHUNK_SIZE + i + 1, type: 'action', timestamp: Date.now() / 1000 }) || second;
+    }
+
+    assert.equal(first.chunk_sequence, 0);
+    assert.equal(second.chunk_sequence, 1);
+  });
+});

package/node_modules/moe-training/test/client/parsers/claude-code.test.js

@@ -0,0 +1,119 @@
+// FSL-1.1-Apache-2.0 — see LICENSE
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { ClaudeCodeParser } from '../../../client/parsers/claude-code.js';
+
+describe('ClaudeCodeParser', () => {
+  it('parses assistant message as thought', () => {
+    const parser = new ClaudeCodeParser();
+    const event = {
+      type: 'assistant',
+      message: {
+        content: [{ type: 'text', text: 'I need to fix the bug' }],
+        usage: { input_tokens: 100, output_tokens: 50 },
+      },
+    };
+    const result = parser.parseEvent(event);
+    assert.equal(result.type, 'thought');
+    assert.equal(result.content, 'I need to fix the bug');
+    assert.equal(result.token_count, undefined);
+  });
+
+  it('parses tool_use block as action', () => {
+    const parser = new ClaudeCodeParser();
+    const event = {
+      type: 'assistant',
+      message: {
+        content: [{ type: 'tool_use', id: 'tu_1', name: 'Read', input: { file_path: '/test.js' } }],
+        usage: { output_tokens: 10 },
+      },
+    };
+    const result = parser.parseEvent(event);
+    assert.equal(result.type, 'action');
+    assert.equal(result.tool, 'Read');
+    assert.deepEqual(result.arguments, { file_path: '/test.js' });
+  });
+
+  it('parses tool_result as observation', () => {
+    const parser = new ClaudeCodeParser();
+    // First register a tool use
+    parser.parseEvent({
+      type: 'assistant',
+      message: {
+        content: [{ type: 'tool_use', id: 'tu_2', name: 'Read', input: {} }],
+        usage: {},
+      },
+    });
+    // Then parse result
+    const event = {
+      type: 'assistant',
+      message: {
+        content: [{ type: 'tool_result', tool_use_id: 'tu_2', content: 'file contents here', is_error: false }],
+        usage: {},
+      },
+    };
+    const result = parser.parseEvent(event);
+    assert.equal(result.type, 'observation');
+    assert.equal(result.content, 'file contents here');
+    assert.equal(result.is_error, false);
+  });
+
+  it('parses error tool_result as error', () => {
+    const parser = new ClaudeCodeParser();
+    const event = {
+      type: 'assistant',
+      message: {
+        content: [{ type: 'tool_result', tool_use_id: 'tu_3', content: 'Permission denied', is_error: true }],
+        usage: {},
+      },
+    };
+    const result = parser.parseEvent(event);
+    assert.equal(result.type, 'error');
+    assert.equal(result.is_error, true);
+  });
+
+  it('parses result event as resolution', () => {
+    const parser = new ClaudeCodeParser();
+    const event = { type: 'result', result: 'Task completed successfully', total_tokens_used: 500 };
+    const result = parser.parseEvent(event);
+    assert.equal(result.type, 'resolution');
+    assert.equal(result.content, 'Task completed successfully');
+    assert.equal(result.token_count, undefined);
+  });
+
+  it('extracts tokens from assistant event', () => {
+    const parser = new ClaudeCodeParser();
+    const event = {
+      type: 'assistant',
+      message: {
+        usage: {
+          input_tokens: 100,
+          output_tokens: 50,
+          cache_read_input_tokens: 30,
+          cache_creation_input_tokens: 10,
+        },
+      },
+    };
+    const tokens = parser.extractTokens(event);
+    assert.deepEqual(tokens, { input: 100, output: 50, cacheRead: 30, cacheCreation: 10 });
+  });
+
+  it('extracts session id', () => {
+    const parser = new ClaudeCodeParser();
+    assert.equal(parser.extractSessionId({ session_id: 'sess-abc' }), 'sess-abc');
+    assert.equal(parser.extractSessionId({}), null);
+  });
+
+  it('extracts model from assistant event', () => {
+    const parser = new ClaudeCodeParser();
+    assert.equal(parser.extractModel({ type: 'assistant', message: { model: 'claude-opus-4-6' } }), 'claude-opus-4-6');
+    assert.equal(parser.extractModel({ type: 'result' }), null);
+  });
+
+  it('returns null for unknown event types', () => {
+    const parser = new ClaudeCodeParser();
+    assert.equal(parser.parseEvent({ type: 'system' }), null);
+    assert.equal(parser.parseEvent(null), null);
+  });
+});

package/node_modules/moe-training/test/client/parsers/codex.test.js

@@ -0,0 +1,83 @@
+// FSL-1.1-Apache-2.0 — see LICENSE
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { CodexParser } from '../../../client/parsers/codex.js';
+
+describe('CodexParser', () => {
+  it('parses item.started agent_message as thought', () => {
+    const parser = new CodexParser();
+    const result = parser.parseEvent({
+      type: 'item.started',
+      item: { type: 'agent_message', text: 'Let me analyze this' },
+    });
+    assert.equal(result.type, 'thought');
+    assert.equal(result.content, 'Let me analyze this');
+  });
+
+  it('parses item.started command_execution as action', () => {
+    const parser = new CodexParser();
+    const result = parser.parseEvent({
+      type: 'item.started',
+      item: { type: 'command_execution', command: 'ls -la' },
+    });
+    assert.equal(result.type, 'action');
+    assert.equal(result.tool, 'command_execution');
+    assert.deepEqual(result.arguments, { command: 'ls -la' });
+  });
+
+  it('parses item.started file_edit as action', () => {
+    const parser = new CodexParser();
+    const result = parser.parseEvent({
+      type: 'item.started',
+      item: { type: 'file_edit', path: '/src/app.js' },
+    });
+    assert.equal(result.type, 'action');
+    assert.equal(result.tool, 'file_edit');
+  });
+
+  it('parses item.completed command_execution as observation', () => {
+    const parser = new CodexParser();
+    const result = parser.parseEvent({
+      type: 'item.completed',
+      item: { type: 'command_execution', aggregated_output: 'file1\nfile2', exit_code: 0 },
+    });
+    assert.equal(result.type, 'observation');
+    assert.equal(result.content, 'file1\nfile2');
+  });
+
+  it('parses item.completed with error exit code as error', () => {
+    const parser = new CodexParser();
+    const result = parser.parseEvent({
+      type: 'item.completed',
+      item: { type: 'command_execution', aggregated_output: 'ENOENT', exit_code: 1 },
+    });
+    assert.equal(result.type, 'error');
+  });
+
+  it('parses turn.completed as resolution', () => {
+    const parser = new CodexParser();
+    const result = parser.parseEvent({ type: 'turn.completed' });
+    assert.equal(result.type, 'resolution');
+  });
+
+  it('extracts tokens from usage', () => {
+    const parser = new CodexParser();
+    const tokens = parser.extractTokens({
+      type: 'item.completed',
+      usage: { input_tokens: 200, output_tokens: 100 },
+    });
+    assert.deepEqual(tokens, { input: 200, output: 100, cacheRead: 0, cacheCreation: 0 });
+  });
+
+  it('extracts session id from thread.started', () => {
+    const parser = new CodexParser();
+    assert.equal(parser.extractSessionId({ type: 'thread.started', thread_id: 'th_123' }), 'th_123');
+    assert.equal(parser.extractSessionId({ type: 'item.started' }), null);
+  });
+
+  it('returns null for unknown event types', () => {
+    const parser = new CodexParser();
+    assert.equal(parser.parseEvent({ type: 'unknown.event' }), null);
+  });
+});

package/node_modules/moe-training/test/client/parsers/gemini.test.js

@@ -0,0 +1,99 @@
+// FSL-1.1-Apache-2.0 — see LICENSE
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { GeminiParser } from '../../../client/parsers/gemini.js';
+
+describe('GeminiParser', () => {
+  it('parses thought content type as thought', () => {
+    const parser = new GeminiParser();
+    const result = parser.parseEvent({
+      type: 'message',
+      role: 'model',
+      content: [{ type: 'thought', thought: 'I should check the imports' }],
+    });
+    assert.equal(result.type, 'thought');
+    assert.equal(result.content, 'I should check the imports');
+  });
+
+  it('parses model text message as thought', () => {
+    const parser = new GeminiParser();
+    const result = parser.parseEvent({
+      type: 'message',
+      role: 'model',
+      content: [{ text: 'Let me look at that file' }],
+    });
+    assert.equal(result.type, 'thought');
+    assert.equal(result.content, 'Let me look at that file');
+  });
+
+  it('skips user messages', () => {
+    const parser = new GeminiParser();
+    const result = parser.parseEvent({
+      type: 'message',
+      role: 'user',
+      content: [{ text: 'fix the bug' }],
+    });
+    assert.equal(result, null);
+  });
+
+  it('parses tool_request as action', () => {
+    const parser = new GeminiParser();
+    const result = parser.parseEvent({
+      type: 'tool_request',
+      name: 'Grep',
+      args: { pattern: 'TODO' },
+    });
+    assert.equal(result.type, 'action');
+    assert.equal(result.tool, 'Grep');
+    assert.deepEqual(result.arguments, { pattern: 'TODO' });
+  });
+
+  it('parses tool_response as observation', () => {
+    const parser = new GeminiParser();
+    const result = parser.parseEvent({
+      type: 'tool_response',
+      content: 'Found 3 matches',
+    });
+    assert.equal(result.type, 'observation');
+    assert.equal(result.content, 'Found 3 matches');
+  });
+
+  it('parses error event', () => {
+    const parser = new GeminiParser();
+    const result = parser.parseEvent({
+      type: 'error',
+      message: 'Rate limit exceeded',
+    });
+    assert.equal(result.type, 'error');
+    assert.equal(result.content, 'Rate limit exceeded');
+  });
+
+  it('parses agent_end as resolution', () => {
+    const parser = new GeminiParser();
+    const result = parser.parseEvent({ type: 'agent_end' });
+    assert.equal(result.type, 'resolution');
+  });
+
+  it('extracts tokens from usage event', () => {
+    const parser = new GeminiParser();
+    const tokens = parser.extractTokens({
+      type: 'usage',
+      inputTokens: 300,
+      outputTokens: 150,
+      cachedTokens: 50,
+    });
+    assert.deepEqual(tokens, { input: 300, output: 150, cacheRead: 50, cacheCreation: 0 });
+  });
+
+  it('returns null for non-usage token extraction', () => {
+    const parser = new GeminiParser();
+    assert.equal(parser.extractTokens({ type: 'message' }), null);
+  });
+
+  it('extracts session id from agent_start', () => {
+    const parser = new GeminiParser();
+    assert.equal(parser.extractSessionId({ type: 'agent_start', streamId: 'stream-456' }), 'stream-456');
+    assert.equal(parser.extractSessionId({ type: 'message' }), null);
+  });
+});

package/node_modules/moe-training/test/client/scrubber.test.js

@@ -0,0 +1,143 @@
+// FSL-1.1-Apache-2.0 — see LICENSE
+
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { PIIScrubber } from '../../client/scrubber.js';
+
+const scrubber = new PIIScrubber();
+
+describe('PIIScrubber', () => {
+  it('scrubs PEM private keys', () => {
+    const input = '-----BEGIN RSA PRIVATE KEY-----\nMIIEpAIB...\n-----END RSA PRIVATE KEY-----';
+    assert.equal(scrubber.scrub(input), '[PRIVATE_KEY]');
+  });
+
+  it('scrubs AWS access keys', () => {
+    const input = 'key is AKIAIOSFODNN7EXAMPLE here';
+    assert.equal(scrubber.scrub(input), 'key is [AWS_KEY] here');
+  });
+
+  it('scrubs Bearer tokens', () => {
+    const input = 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9';
+    assert.equal(scrubber.scrub(input), 'Authorization: [API_KEY]');
+  });
+
+  it('scrubs sk_/pk_ prefixed keys', () => {
+    const input = 'apikey: sk_test_51HQdMnAbcDefGhIjKlMn';
+    assert.equal(scrubber.scrub(input), 'apikey: [API_KEY]');
+  });
+
+  it('scrubs valid credit cards with Luhn check', () => {
+    const input = 'card: 4111 1111 1111 1111';
+    assert.equal(scrubber.scrub(input), 'card: [CREDIT_CARD]');
+  });
+
+  it('does not scrub random 16-digit numbers failing Luhn', () => {
+    const input = 'number: 1234 5678 9012 3456';
+    assert.equal(scrubber.scrub(input), 'number: 1234 5678 9012 3456');
+  });
+
+  it('scrubs SSNs', () => {
+    const input = 'ssn: 123-45-6789';
+    assert.equal(scrubber.scrub(input), 'ssn: [SSN]');
+  });
+
+  it('scrubs email addresses', () => {
+    const input = 'contact user@example.com for info';
+    assert.equal(scrubber.scrub(input), 'contact [EMAIL] for info');
+  });
+
+  it('scrubs IPv6 addresses', () => {
+    const input = 'server at 2001:0db8:85a3:0000:0000:8a2e:0370:7334';
+    assert.equal(scrubber.scrub(input), 'server at [IP]');
+  });
+
+  it('scrubs IPv4 addresses', () => {
+    const input = 'connect to 192.168.1.100';
+    assert.equal(scrubber.scrub(input), 'connect to [IP]');
+  });
+
+  it('scrubs phone numbers', () => {
+    const input = 'call (555) 123-4567';
+    assert.equal(scrubber.scrub(input), 'call [PHONE]');
+  });
+
+  it('scrubs URLs with token/key/secret params', () => {
+    const input = 'visit https://api.example.com/data?token=abc123&other=val';
+    assert.equal(scrubber.scrub(input), 'visit [REDACTED_URL]&other=val');
+  });
+
+  it('scrubs long hex strings (40+ chars)', () => {
+    const hex = 'a'.repeat(40);
+    const input = `hash: ${hex}`;
+    assert.equal(scrubber.scrub(input), 'hash: [API_KEY]');
+  });
+
+  it('scrubs home directory paths preserving relative path', () => {
+    const input = 'file at /Users/john/Documents/secret.txt';
+    assert.equal(scrubber.scrub(input), 'file at ~/Documents/secret.txt');
+  });
+
+  it('scrubs URL-encoded emails', () => {
+    const input = 'param=ryan%40motovizion.com&next=home';
+    assert.equal(scrubber.scrub(input), 'param=[EMAIL]&next=home');
+  });
+
+  it('scrubs international phone numbers', () => {
+    const input = 'call +44 20 7946 0958 for help';
+    assert.equal(scrubber.scrub(input), 'call [PHONE] for help');
+  });
+
+  it('scrubs JWT tokens without Bearer prefix', () => {
+    const input = 'token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIn0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c';
+    const result = scrubber.scrub(input);
+    assert.ok(result.includes('[API_KEY]'));
+    assert.ok(!result.includes('eyJhbGciOi'));
+  });
+
+  it('scrubs file paths preserving relative path', () => {
+    const input = 'reading /home/alice/project/secret.key now';
+    const result = scrubber.scrub(input);
+    assert.equal(result, 'reading ~/project/secret.key now');
+    assert.ok(!result.includes('/home/alice'));
+  });
+
+  it('scrubs base64 encoded secrets', () => {
+    const b64 = 'YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY3ODk=';
+    const input = `secret: ${b64} done`;
+    const result = scrubber.scrub(input);
+    assert.ok(result.includes('[API_KEY]'));
+    assert.ok(!result.includes(b64));
+  });
+
+  it('passes through non-PII content unchanged', () => {
+    const input = 'This is a normal sentence about coding in JavaScript.';
+    assert.equal(scrubber.scrub(input), input);
+  });
+
+  it('handles null/undefined input gracefully', () => {
+    assert.equal(scrubber.scrub(null), null);
+    assert.equal(scrubber.scrub(undefined), undefined);
+    assert.equal(scrubber.scrub(''), '');
+  });
+
+  it('scrubs Windows home paths preserving relative path', () => {
+    const input = 'file at C:\\Users\\bob\\Desktop\\project\\app.js';
+    assert.equal(scrubber.scrub(input), 'file at ~\\Desktop\\project\\app.js');
+  });
+
+  it('scrubs home path with no trailing path', () => {
+    const input = 'cd /Users/john';
+    assert.equal(scrubber.scrub(input), 'cd ~');
+  });
+
+  it('patterns do not interfere with each other', () => {
+    const input = 'user@example.com called 555-123-4567 from 192.168.1.1';
+    const result = scrubber.scrub(input);
+    assert.ok(result.includes('[EMAIL]'));
+    assert.ok(result.includes('[PHONE]'));
+    assert.ok(result.includes('[IP]'));
+    assert.ok(!result.includes('user@example.com'));
+    assert.ok(!result.includes('192.168.1.1'));
+  });
+});

package/node_modules/moe-training/test/client/session-attestation-security.test.js

@@ -0,0 +1,95 @@
+// FSL-1.1-Apache-2.0 — see LICENSE
+
+import { describe, it, beforeEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { SessionAttestation } from '../../client/session-attestation.js';
+import { verifyEnvelope } from '../../shared/crypto.js';
+
+describe('SessionAttestation security', () => {
+  let attestation;
+
+  beforeEach(() => {
+    attestation = new SessionAttestation('http://localhost:9999');
+  });
+
+  it('HMAC signs entire envelope — tampering metadata after signing fails verification', async () => {
+    const sessionId = 'sess_test_1';
+    await attestation.openSession(sessionId, {
+      provider: 'claude-code',
+      model_engine: 'claude-opus-4-6',
+      groove_version: '0.27.0',
+    });
+
+    const session = attestation._sessions.get(sessionId);
+    if (session.offline) {
+      return;
+    }
+
+    const envelope = {
+      envelope_id: 'env_test',
+      session_id: sessionId,
+      chunk_sequence: 0,
+      contributor_id: 'user_1',
+      attestation: { session_hmac: '', sequence: 0, app_version_hash: '' },
+      metadata: { agent_role: 'backend', agent_id: 'backend-1', provider: 'claude-code' },
+      trajectory_log: [{ step: 1, type: 'thought', timestamp: 123 }],
+    };
+
+    const signed = attestation.signEnvelope(sessionId, envelope);
+    const hmac = signed.attestation.session_hmac;
+    const seq = signed.attestation.sequence - 1;
+
+    const forVerify = { ...signed };
+    delete forVerify.attestation;
+    const valid = verifyEnvelope(session.sharedSecret, JSON.stringify(forVerify), seq, hmac);
+    assert.equal(valid, true, 'HMAC should verify against the full envelope minus attestation');
+
+    forVerify.metadata.agent_role = 'hacked';
+    const invalid = verifyEnvelope(session.sharedSecret, JSON.stringify(forVerify), seq, hmac);
+    assert.equal(invalid, false, 'Tampered metadata should fail HMAC verification');
+  });
+
+  it('offline mode uses OFFLINE marker not empty string', async () => {
+    const sessionId = 'sess_offline';
+    attestation._sessions.set(sessionId, {
+      keypair: null,
+      sharedSecret: null,
+      sequence: 0,
+      appVersionHash: 'test',
+      offline: true,
+    });
+
+    const envelope = {
+      envelope_id: 'env_off',
+      session_id: sessionId,
+      attestation: { session_hmac: '', sequence: 0, app_version_hash: '' },
+      metadata: {},
+      trajectory_log: [],
+    };
+
+    const signed = attestation.signEnvelope(sessionId, envelope);
+    assert.equal(signed.attestation.session_hmac, 'OFFLINE');
+    assert.notEqual(signed.attestation.session_hmac, '');
+  });
+
+  it('machine fingerprint includes hostname and core count', async () => {
+    const os = await import('node:os');
+    const fp = SessionAttestation.getMachineFingerprint();
+    assert.equal(typeof fp, 'string');
+    assert.equal(fp.length, 64);
+
+    const signals = [
+      os.platform(),
+      os.arch(),
+      os.cpus()[0]?.model || '',
+      String(os.totalmem()),
+      os.hostname(),
+      String(os.cpus().length),
+      os.release(),
+      os.endianness(),
+    ];
+    const { createHash } = await import('node:crypto');
+    const expected = createHash('sha256').update(signals.join('|')).digest('hex');
+    assert.equal(fp, expected);
+  });
+});