hop2 0.11.47 → 0.11.49

package/lib/audit-rotation.js

@@ -0,0 +1,113 @@
+// Size rotation and age-based retention for per-session audit logs.
+//
+// Each hop session writes `<logsDir>/<session>/audit.ndjson`: every keystroke
+// and every byte of output, forever. Nothing ever trimmed it. A chatty agent
+// session left running for weeks grows to gigabytes, and a session that
+// ended a year ago still has its full transcript on disk. Two limits:
+//
+//   - SIZE: when the live file passes maxBytes it is renamed to
+//     audit.ndjson.<utc-timestamp> and a fresh file starts; only the newest
+//     `keep` rotated files survive.
+//   - AGE: a session directory whose newest file is older than retentionMs,
+//     and whose session is not live, is deleted whole.
+//
+// Pure functions over the filesystem so they can be unit-tested without the
+// daemon.
+
+const fs = require('fs');
+const path = require('path');
+
+const AUDIT_FILE_NAME = 'audit.ndjson';
+
+function rotatedName(now = Date.now()) {
+  const stamp = new Date(now).toISOString().replace(/[-:]/g, '').replace(/\.\d+Z$/, 'Z');
+  return `${AUDIT_FILE_NAME}.${stamp}`;
+}
+
+/**
+ * Rename the live audit file aside and prune old rotations.
+ * Caller must have closed its write stream first.
+ * @returns {{ rotatedTo: string|null, pruned: string[] }}
+ */
+function rotateAuditFile(filePath, { keep = 5, now = Date.now() } = {}) {
+  const dir = path.dirname(filePath);
+  let rotatedTo = null;
+  try {
+    if (fs.existsSync(filePath) && fs.statSync(filePath).size > 0) {
+      let target = path.join(dir, rotatedName(now));
+      // Two rotations inside one second: keep both.
+      let n = 1;
+      while (fs.existsSync(target)) target = path.join(dir, `${rotatedName(now)}.${n++}`);
+      fs.renameSync(filePath, target);
+      rotatedTo = target;
+    }
+  } catch (e) {
+    return { rotatedTo: null, pruned: [] };
+  }
+  const pruned = [];
+  try {
+    const rotated = fs.readdirSync(dir)
+      .filter((name) => name.startsWith(`${AUDIT_FILE_NAME}.`))
+      .map((name) => {
+        const full = path.join(dir, name);
+        let mtime = 0;
+        try { mtime = fs.statSync(full).mtimeMs; } catch (e) { }
+        return { full, mtime, name };
+      })
+      .sort((a, b) => b.mtime - a.mtime || b.name.localeCompare(a.name));
+    for (const extra of rotated.slice(Math.max(0, keep))) {
+      try { fs.unlinkSync(extra.full); pruned.push(extra.full); } catch (e) { }
+    }
+  } catch (e) { }
+  return { rotatedTo, pruned };
+}
+
+function newestMtime(dir) {
+  let newest = 0;
+  try {
+    for (const name of fs.readdirSync(dir)) {
+      try {
+        const st = fs.statSync(path.join(dir, name));
+        if (st.mtimeMs > newest) newest = st.mtimeMs;
+      } catch (e) { }
+    }
+    if (newest === 0) newest = fs.statSync(dir).mtimeMs;
+  } catch (e) { }
+  return newest;
+}
+
+/**
+ * Delete per-session log directories that are stale.
+ * @param {string[]} logsRoots directories whose children are per-session dirs
+ * @param {object} options
+ * @param {number} options.retentionMs age after which a non-live dir goes
+ * @param {(sessionName: string) => boolean} options.isLive
+ * @param {number} [options.now]
+ * @returns {{ removed: string[], kept: number }}
+ */
+function sweepStaleAuditDirs(logsRoots, { retentionMs, isLive = () => false, now = Date.now() } = {}) {
+  const removed = [];
+  let kept = 0;
+  if (!Number.isFinite(retentionMs) || retentionMs <= 0) return { removed, kept };
+  for (const root of logsRoots) {
+    let entries = [];
+    try { entries = fs.readdirSync(root, { withFileTypes: true }); } catch (e) { continue; }
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      const sessionName = entry.name;
+      const dir = path.join(root, sessionName);
+      if (isLive(sessionName)) { kept++; continue; }
+      const age = now - newestMtime(dir);
+      if (age < retentionMs) { kept++; continue; }
+      try {
+        fs.rmSync(dir, { recursive: true, force: true });
+        removed.push(dir);
+      } catch (e) {
+        kept++;
+      }
+    }
+  }
+  return { removed, kept };
+}
+
+module.exports = { rotateAuditFile, sweepStaleAuditDirs, rotatedName, AUDIT_FILE_NAME };

package/lib/auth-sessions.js

@@ -0,0 +1,194 @@
+// Per-device login sessions for the hop daemon.
+//
+// Before this module every browser, phone and script that ever logged in
+// held the same credential: the daemon's process-wide session secret, minted
+// straight into the cookie. One value for every device meant nothing could
+// be revoked short of rotating the secret and logging everyone out.
+//
+// Now each successful login (TOTP, password+TOTP, passkey) mints its own
+// random token. Only a SHA-256 hash is stored, so the state file cannot be
+// replayed if it leaks; the raw token lives in the client's cookie (or, for
+// device tokens minted from the CLI, wherever the operator pastes it). Each
+// session carries a label, how it was created, and an expiry — 30 days by
+// default, so a phone that logs in once a month stays signed in — and any
+// session can be listed and revoked on its own.
+//
+// The daemon's own secret is still accepted as a Bearer token for local
+// hop-to-hop IPC (CLI, MCP, hay). It is never a cookie any more.
+
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+
+const DEFAULT_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+const TOKEN_PREFIX = 'hs_';
+const ID_PREFIX = 'as_';
+// How often verify() persists lastSeenAt. Every request would turn each
+// keystroke's WebSocket poll into a disk write.
+const LAST_SEEN_WRITE_INTERVAL_MS = 5 * 60 * 1000;
+
+function hashToken(token) {
+  return crypto.createHash('sha256').update(String(token), 'utf8').digest('hex');
+}
+
+function isSessionToken(value) {
+  return typeof value === 'string' && value.startsWith(TOKEN_PREFIX) && value.length >= 40 && value.length <= 128;
+}
+
+function timingSafeEqualHex(a, b) {
+  const ab = Buffer.from(String(a), 'hex');
+  const bb = Buffer.from(String(b), 'hex');
+  if (ab.length !== bb.length || ab.length === 0) return false;
+  return crypto.timingSafeEqual(ab, bb);
+}
+
+class AuthSessionStore {
+  /**
+   * @param {string} filePath JSON state file (written 0600)
+   * @param {object} [options]
+   * @param {number} [options.ttlMs] default lifetime for new sessions
+   * @param {() => number} [options.now] clock, for tests
+   */
+  constructor(filePath, options = {}) {
+    this.filePath = filePath;
+    this.ttlMs = Number.isFinite(options.ttlMs) && options.ttlMs > 0 ? options.ttlMs : DEFAULT_TTL_MS;
+    this.now = typeof options.now === 'function' ? options.now : Date.now;
+    this._cache = null;
+  }
+
+  _load() {
+    if (this._cache) return this._cache;
+    let sessions = [];
+    try {
+      const parsed = JSON.parse(fs.readFileSync(this.filePath, 'utf8'));
+      if (Array.isArray(parsed?.sessions)) {
+        sessions = parsed.sessions.filter((s) => s && typeof s.id === 'string' && typeof s.tokenHash === 'string');
+      }
+    } catch (e) {
+      sessions = [];
+    }
+    this._cache = { sessions };
+    return this._cache;
+  }
+
+  _save() {
+    const state = this._load();
+    const dir = path.dirname(this.filePath);
+    try { fs.mkdirSync(dir, { recursive: true, mode: 0o700 }); } catch (e) { }
+    const tmp = `${this.filePath}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify({ version: 1, sessions: state.sessions }, null, 2), { mode: 0o600 });
+    fs.renameSync(tmp, this.filePath);
+    try { fs.chmodSync(this.filePath, 0o600); } catch (e) { }
+  }
+
+  /** Drop expired sessions. Returns how many were removed. */
+  prune({ save = true } = {}) {
+    const state = this._load();
+    const now = this.now();
+    const before = state.sessions.length;
+    state.sessions = state.sessions.filter((s) => !(Number.isFinite(s.expiresAt) && s.expiresAt <= now));
+    const removed = before - state.sessions.length;
+    if (removed > 0 && save) this._save();
+    return removed;
+  }
+
+  /**
+   * Mint a new session. The raw token is returned exactly once.
+   * @param {object} [meta] { label, via, ip, userAgent, ttlMs }
+   */
+  create(meta = {}) {
+    const state = this._load();
+    this.prune({ save: false });
+    const now = this.now();
+    const ttl = Number.isFinite(meta.ttlMs) && meta.ttlMs > 0 ? meta.ttlMs : this.ttlMs;
+    const token = TOKEN_PREFIX + crypto.randomBytes(32).toString('base64url');
+    const session = {
+      id: ID_PREFIX + crypto.randomBytes(6).toString('hex'),
+      tokenHash: hashToken(token),
+      label: String(meta.label || '').slice(0, 80) || null,
+      via: String(meta.via || 'unknown').slice(0, 32),
+      ip: meta.ip ? String(meta.ip).slice(0, 64) : null,
+      userAgent: meta.userAgent ? String(meta.userAgent).slice(0, 200) : null,
+      createdAt: now,
+      lastSeenAt: now,
+      // null = never expires (device tokens for automation, created explicitly).
+      expiresAt: meta.noExpiry === true ? null : now + ttl
+    };
+    state.sessions.push(session);
+    this._save();
+    return { id: session.id, token, expiresAt: session.expiresAt };
+  }
+
+  /**
+   * Look a raw token up. Returns the public view of the session or null.
+   * Refreshes lastSeenAt (persisted at most every few minutes).
+   */
+  verify(token) {
+    if (!isSessionToken(token)) return null;
+    const state = this._load();
+    const hash = hashToken(token);
+    const now = this.now();
+    for (const s of state.sessions) {
+      if (!timingSafeEqualHex(s.tokenHash, hash)) continue;
+      if (Number.isFinite(s.expiresAt) && s.expiresAt <= now) {
+        this.prune();
+        return null;
+      }
+      if (!Number.isFinite(s.lastSeenAt) || now - s.lastSeenAt >= LAST_SEEN_WRITE_INTERVAL_MS) {
+        s.lastSeenAt = now;
+        try { this._save(); } catch (e) { }
+      }
+      return this._public(s);
+    }
+    return null;
+  }
+
+  /** Revoke one session by id. */
+  revoke(id) {
+    const state = this._load();
+    const before = state.sessions.length;
+    state.sessions = state.sessions.filter((s) => s.id !== String(id));
+    const removed = before - state.sessions.length;
+    if (removed > 0) this._save();
+    return removed > 0;
+  }
+
+  /** Revoke every session, optionally keeping one (the caller's own). */
+  revokeAll({ exceptId = null } = {}) {
+    const state = this._load();
+    const before = state.sessions.length;
+    state.sessions = state.sessions.filter((s) => exceptId && s.id === exceptId);
+    const removed = before - state.sessions.length;
+    if (removed > 0) this._save();
+    return removed;
+  }
+
+  /** Every live session, newest first, without token material. */
+  list() {
+    this.prune();
+    return this._load().sessions
+      .map((s) => this._public(s))
+      .sort((a, b) => (b.lastSeenAt || 0) - (a.lastSeenAt || 0));
+  }
+
+  _public(s) {
+    return {
+      id: s.id,
+      label: s.label,
+      via: s.via,
+      ip: s.ip,
+      userAgent: s.userAgent,
+      createdAt: s.createdAt,
+      lastSeenAt: s.lastSeenAt,
+      expiresAt: s.expiresAt
+    };
+  }
+}
+
+module.exports = {
+  AuthSessionStore,
+  hashToken,
+  isSessionToken,
+  DEFAULT_TTL_MS,
+  TOKEN_PREFIX
+};

package/lib/registration.js

@@ -18,9 +18,10 @@ const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
 
-// Who may register. Subdomains count (cs.uchicago.edu, bsd.uchicago.edu),
-// because plenty of departments hand out mail there.
-const DEFAULT_ALLOWED_EMAIL_DOMAIN = 'uchicago.edu';
+// Who may register is the admin's call (`hop registration domain <d>`); there
+// is deliberately no built-in default. Subdomains of the configured domain
+// count (cs.example.edu under example.edu), because plenty of departments
+// hand out mail there.
 
 // Names that must never become someone's terminal. Two families: hostnames
 // infrastructure assumes it owns (www, mail, ns1) and the addresses CAs and
@@ -102,7 +103,10 @@ function validateSubdomain(raw, { reserved = RESERVED_SUBDOMAINS } = {}) {
  * allowing tags would let one person hold unlimited subdomains, and
  * silently rewriting the address the user typed is worse than saying no.
  */
-function validateEmail(raw, { allowedDomain = DEFAULT_ALLOWED_EMAIL_DOMAIN } = {}) {
+function validateEmail(raw, { allowedDomain = null } = {}) {
+  if (!allowedDomain || !String(allowedDomain).trim()) {
+    return { ok: false, error: 'Registration is not open: no email domain has been configured.' };
+  }
   const value = String(raw || '').trim().toLowerCase();
   if (!value) return { ok: false, error: 'Enter your email address.' };
   if (value.length > 254) return { ok: false, error: 'That address is too long.' };
@@ -133,7 +137,7 @@ class RegistrationStore {
    */
   constructor(filePath, options = {}) {
     this.filePath = filePath;
-    this.allowedDomain = options.allowedDomain || DEFAULT_ALLOWED_EMAIL_DOMAIN;
+    this.allowedDomain = options.allowedDomain || null;
     this.reserved = options.reserved || RESERVED_SUBDOMAINS;
     this.takenSubdomains = options.takenSubdomains || (() => []);
   }
@@ -363,7 +367,6 @@ module.exports = {
   newToken,
   tokenMatches,
   RESERVED_SUBDOMAINS,
-  DEFAULT_ALLOWED_EMAIL_DOMAIN,
   VERIFY_TOKEN_TTL_MS,
   CLAIM_TOKEN_TTL_MS
 };

package/mcp/hop-mcp.js

@@ -34,15 +34,47 @@ const CLAUDE_PERMISSION_MODES = new Set([
   'acceptEdits', 'auto', 'bypassPermissions', 'dontAsk', 'manual', 'plan'
 ]);
 
+// Least → most autonomous. The host operator can cap what a spawned worker
+// may run with (config.json "agent_permission_ceiling", or the env var
+// HOP_AGENT_PERMISSION_CEILING; `hop config agent-ceiling <mode>`). Requests
+// above the cap are clamped, never refused, so orchestration keeps working on
+// a locked-down host — the worker just asks more. Default is the historical
+// behaviour (bypassPermissions): MCP access already implies shell access on
+// this machine, so the ceiling is a safety rail against accidents, not a
+// security boundary against an attacker who holds the daemon secret.
+const CLAUDE_PERMISSION_RANK = { plan: 0, manual: 1, acceptEdits: 2, dontAsk: 3, auto: 3, bypassPermissions: 4 };
+const DEFAULT_AGENT_PERMISSION_CEILING = 'bypassPermissions';
+
+function readAgentPermissionCeiling() {
+  const fromEnv = String(process.env.HOP_AGENT_PERMISSION_CEILING || '').trim();
+  if (CLAUDE_PERMISSION_MODES.has(fromEnv)) return fromEnv;
+  try {
+    const cfg = JSON.parse(fs.readFileSync(path.join(resolveHomeDir(), '.config.json'), 'utf8'));
+    if (CLAUDE_PERMISSION_MODES.has(cfg.agent_permission_ceiling)) return cfg.agent_permission_ceiling;
+  } catch (e) { }
+  return DEFAULT_AGENT_PERMISSION_CEILING;
+}
+
+function clampPermissionMode(requested, ceiling) {
+  const want = CLAUDE_PERMISSION_MODES.has(requested) ? requested : DEFAULT_AGENT_PERMISSION_CEILING;
+  const cap = CLAUDE_PERMISSION_MODES.has(ceiling) ? ceiling : DEFAULT_AGENT_PERMISSION_CEILING;
+  return CLAUDE_PERMISSION_RANK[want] > CLAUDE_PERMISSION_RANK[cap] ? cap : want;
+}
+
 function claudePresetCommand() {
   return `env ${CLAUDE_PRESET_UNSET_ENV.map((name) => `-u ${name}`).join(' ')} claude`;
 }
 
-function codexPresetCommand() {
+function codexPresetCommand(ceiling = DEFAULT_AGENT_PERMISSION_CEILING) {
   // Managed workers cannot answer an interactive workspace-trust or approval
   // prompt. `command` bypasses a same-named interactive-shell function so the
   // autonomous flag is applied exactly once; the config override also keeps a
   // self-update chooser from intercepting the first delegated task.
+  // Below the top ceiling Codex keeps its sandbox and asks on request instead
+  // of bypassing approvals outright.
+  if (ceiling !== 'bypassPermissions') {
+    return 'command codex --full-auto -c check_for_update_on_startup=false';
+  }
   return 'command codex --dangerously-bypass-approvals-and-sandbox -c check_for_update_on_startup=false';
 }
 
@@ -3603,7 +3635,7 @@ class HopMCPServer {
             agent: { type: 'string', enum: ['claude', 'codex', 'gemini', 'custom'], description: 'Agent CLI preset (default: claude, launched with the Opus model alias — override via HOP_SPAWN_CLAUDE_MODEL or args — in autonomous permission mode). Use custom with command=... for anything else.' },
             command: { type: 'string', description: 'Override the launch command (required when agent=custom).' },
             args: { type: 'string', description: 'Extra CLI arguments appended to the launch command (e.g. "--model opus").' },
-            permission_mode: { type: 'string', enum: ['acceptEdits', 'auto', 'bypassPermissions', 'dontAsk', 'manual', 'plan'], description: 'Claude worker permission mode (default: bypassPermissions so delegated tasks cannot park on an approval prompt). Set manual or another Claude mode for restricted workers. Ignored by other presets and explicit command overrides.' },
+            permission_mode: { type: 'string', enum: ['acceptEdits', 'auto', 'bypassPermissions', 'dontAsk', 'manual', 'plan'], description: 'Claude worker permission mode (default: bypassPermissions so delegated tasks cannot park on an approval prompt). Set manual or another Claude mode for restricted workers. The host may cap this (hop config agent-ceiling); a request above the cap is clamped and reported in permission_note. Ignored by other presets and explicit command overrides.' },
             initial_task: { type: 'string', description: 'First task to dispatch once ready. Hop appends a unique success-token instruction unless until_reply_regex is supplied.' },
             until_reply_regex: { type: 'string', description: 'Optional caller-defined completion contract for initial_task. When omitted, Hop creates and instructs the worker to emit a unique success token. The turn is contract_failed if its final reply does not match.' },
             async: { type: 'boolean', description: 'Initial-task behavior: false/default waits for the contracted result and returns initial_task_result; true returns a pending wait_id for explicit fleet orchestration.' },
@@ -5999,7 +6031,10 @@ class HopMCPServer {
   // optional contracted first task that blocks unless async is explicit.
   async handleSpawnAgent(args = {}) {
     const preset = typeof args.agent === 'string' && args.agent ? args.agent : 'claude';
-    const presetCommands = { claude: claudePresetCommand(), codex: codexPresetCommand(), gemini: 'gemini' };
+    const permissionCeiling = readAgentPermissionCeiling();
+    let permissionNote = null;
+    let appliedPermissionMode = null;
+    const presetCommands = { claude: claudePresetCommand(), codex: codexPresetCommand(permissionCeiling), gemini: 'gemini' };
     let command = typeof args.command === 'string' && args.command.trim() ? args.command.trim() : '';
     const usesPresetCommand = command.length === 0;
     if (args.permission_mode !== undefined && !CLAUDE_PERMISSION_MODES.has(args.permission_mode)) {
@@ -6028,10 +6063,17 @@ class HopMCPServer {
         command += ` --model ${defaultModel}`;
       }
       if (preset === 'claude' && !/(?:^|\s)(?:--permission-mode(?:\s|=|$)|--dangerously-skip-permissions(?:\s|$))/.test(extraArgs)) {
-        const permissionMode = typeof args.permission_mode === 'string' && args.permission_mode
+        const requestedMode = typeof args.permission_mode === 'string' && args.permission_mode
           ? args.permission_mode
-          : 'bypassPermissions';
+          : DEFAULT_AGENT_PERMISSION_CEILING;
+        const permissionMode = clampPermissionMode(requestedMode, permissionCeiling);
+        if (permissionMode !== requestedMode) {
+          permissionNote = `permission_mode ${requestedMode} clamped to this host's ceiling ${permissionCeiling} (hop config agent-ceiling)`;
+        }
+        appliedPermissionMode = permissionMode;
         command += ` --permission-mode ${permissionMode}`;
+      } else if (preset === 'codex' && permissionCeiling !== 'bypassPermissions') {
+        permissionNote = `codex runs sandboxed (--full-auto) under this host's ceiling ${permissionCeiling}`;
       }
     }
     if (!usesPresetCommand && args.permission_mode !== undefined) {
@@ -6194,6 +6236,8 @@ class HopMCPServer {
     if (composerReady !== null) {
       result.composer_ready = composerReady;
     }
+    if (appliedPermissionMode) result.permission_mode = appliedPermissionMode;
+    if (permissionNote) result.permission_note = permissionNote;
     if (startupBlocker) {
       result.startup_blocker = startupBlocker;
       result.readiness_status = startupBlocker.kind;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hop2",
-  "version": "0.11.47",
+  "version": "0.11.49",
   "description": "🐰 Hop into your terminal from anywhere. Secure remote shell access with 2FA via Cloudflare Tunnel. Next-gen rewrite with native terminal sharing.",
   "main": "hop",
   "bin": {

package/tests/audit-rotation.unit.test.cjs

@@ -0,0 +1,74 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const { rotateAuditFile, sweepStaleAuditDirs, AUDIT_FILE_NAME } = require('../lib/audit-rotation');
+
+const tmpDir = () => fs.mkdtempSync(path.join(os.tmpdir(), 'hop-audit-rot-'));
+
+test('rotateAuditFile renames the live file aside and keeps only the newest N rotations', () => {
+  const dir = tmpDir();
+  const live = path.join(dir, AUDIT_FILE_NAME);
+  const stamps = [];
+  for (let i = 0; i < 4; i++) {
+    fs.writeFileSync(live, `{"n":${i}}\n`);
+    const now = Date.UTC(2026, 0, 1, 0, 0, i);
+    const r = rotateAuditFile(live, { keep: 2, now });
+    assert.ok(r.rotatedTo, 'live file rotated');
+    stamps.push(path.basename(r.rotatedTo));
+    // Rotated files get distinct mtimes so the prune order is deterministic.
+    fs.utimesSync(r.rotatedTo, now / 1000, now / 1000);
+  }
+  assert.equal(fs.existsSync(live), false);
+  const left = fs.readdirSync(dir).sort();
+  assert.equal(left.length, 2, `two rotations kept, got ${left}`);
+  assert.deepEqual(left, stamps.slice(-2).sort());
+});
+
+test('rotateAuditFile is a no-op on a missing or empty live file', () => {
+  const dir = tmpDir();
+  const live = path.join(dir, AUDIT_FILE_NAME);
+  assert.equal(rotateAuditFile(live).rotatedTo, null);
+  fs.writeFileSync(live, '');
+  assert.equal(rotateAuditFile(live).rotatedTo, null);
+  assert.ok(fs.existsSync(live));
+});
+
+test('sweepStaleAuditDirs removes old non-live session dirs and keeps live or recent ones', () => {
+  const root = tmpDir();
+  const mk = (name, ageMs, now) => {
+    const d = path.join(root, name);
+    fs.mkdirSync(d);
+    const f = path.join(d, AUDIT_FILE_NAME);
+    fs.writeFileSync(f, '{}\n');
+    const t = (now - ageMs) / 1000;
+    fs.utimesSync(f, t, t);
+    fs.utimesSync(d, t, t);
+    return d;
+  };
+  const now = Date.now();
+  const day = 86400000;
+  const stale = mk('old-session', 120 * day, now);
+  const liveButOld = mk('live-session', 120 * day, now);
+  const recent = mk('recent-session', 2 * day, now);
+  const r = sweepStaleAuditDirs([root], {
+    retentionMs: 90 * day,
+    isLive: (name) => name === 'live-session',
+    now
+  });
+  assert.deepEqual(r.removed, [stale]);
+  assert.equal(fs.existsSync(stale), false);
+  assert.ok(fs.existsSync(liveButOld));
+  assert.ok(fs.existsSync(recent));
+  assert.equal(r.kept, 2);
+});
+
+test('sweepStaleAuditDirs does nothing when retention is disabled or the root is missing', () => {
+  const root = tmpDir();
+  fs.mkdirSync(path.join(root, 'x'));
+  assert.deepEqual(sweepStaleAuditDirs([root], { retentionMs: 0 }).removed, []);
+  assert.deepEqual(sweepStaleAuditDirs([path.join(root, 'nope')], { retentionMs: 1 }).removed, []);
+  assert.ok(fs.existsSync(path.join(root, 'x')));
+});