whale-code 6.5.11 → 6.6.0

package/dist/server/lib/__tests__/session-checkpoint-save.test.js

@@ -1,159 +0,0 @@
-import { describe, it, expect, vi, afterEach } from "vitest";
-import { saveCheckpoint } from "../session-checkpoint.js";
-import { HAS_TEST_DB, getTestClient, seedTracked, cleanup, RUN_PREFIX } from "../../handlers/__test-utils__/test-db.js";
-import { randomUUID } from "node:crypto";
-const sb = getTestClient();
-async function createConversation() {
-  const convId = randomUUID();
-  await seedTracked("ai_conversations", [{
-    id: convId,
-    title: `test_${RUN_PREFIX}_${convId.slice(0, 6)}`
-  }]);
-  return convId;
-}
-
-// ============================================================================
-// saveCheckpoint
-// ============================================================================
-
-describe.skipIf(!HAS_TEST_DB)("saveCheckpoint", () => {
-  afterEach(async () => {
-    await cleanup();
-  });
-  it("only saves at checkpoint interval (every 5 turns)", async () => {
-    const convId = await createConversation();
-    await saveCheckpoint(sb, convId, 3, [], {
-      input: 0,
-      output: 0,
-      cacheRead: 0,
-      cacheCreation: 0
-    }, 0, []);
-    const {
-      data: noData
-    } = await sb.from("ai_conversation_checkpoints").select().eq("conversation_id", convId);
-    expect(noData?.length ?? 0).toBe(0);
-    await saveCheckpoint(sb, convId, 5, [], {
-      input: 0,
-      output: 0,
-      cacheRead: 0,
-      cacheCreation: 0
-    }, 0, []);
-    const {
-      data: savedData
-    } = await sb.from("ai_conversation_checkpoints").select().eq("conversation_id", convId);
-    expect(savedData.length).toBeGreaterThanOrEqual(1);
-    await sb.from("ai_conversation_checkpoints").delete().eq("conversation_id", convId);
-  });
-  it("saves at turn 0", async () => {
-    const convId = await createConversation();
-    await saveCheckpoint(sb, convId, 0, [], {
-      input: 0,
-      output: 0,
-      cacheRead: 0,
-      cacheCreation: 0
-    }, 0, []);
-    const {
-      data
-    } = await sb.from("ai_conversation_checkpoints").select().eq("conversation_id", convId);
-    expect(data.length).toBeGreaterThanOrEqual(1);
-    await sb.from("ai_conversation_checkpoints").delete().eq("conversation_id", convId);
-  });
-  it("saves at turn 10 with full data", async () => {
-    const convId = await createConversation();
-    await saveCheckpoint(sb, convId, 10, [{
-      role: "user",
-      content: "hi"
-    }], {
-      input: 100,
-      output: 50,
-      cacheRead: 10,
-      cacheCreation: 5
-    }, 0.05, ["read_file"]);
-    const {
-      data
-    } = await sb.from("ai_conversation_checkpoints").select().eq("conversation_id", convId);
-    expect(data.length).toBeGreaterThanOrEqual(1);
-    await sb.from("ai_conversation_checkpoints").delete().eq("conversation_id", convId);
-  });
-  it("serializes messages as JSON", async () => {
-    const convId = await createConversation();
-    const messages = [{
-      role: "user",
-      content: "hello"
-    }];
-    await saveCheckpoint(sb, convId, 5, messages, {
-      input: 0,
-      output: 0,
-      cacheRead: 0,
-      cacheCreation: 0
-    }, 0, []);
-    const {
-      data
-    } = await sb.from("ai_conversation_checkpoints").select().eq("conversation_id", convId);
-    expect(data.length).toBeGreaterThanOrEqual(1);
-    expect(typeof data[0].messages).toBe("string");
-    expect(JSON.parse(data[0].messages)).toEqual(messages);
-    await sb.from("ai_conversation_checkpoints").delete().eq("conversation_id", convId);
-  });
-  it("deduplicates tools_used", async () => {
-    const convId = await createConversation();
-    await saveCheckpoint(sb, convId, 5, [], {
-      input: 0,
-      output: 0,
-      cacheRead: 0,
-      cacheCreation: 0
-    }, 0, ["read_file", "edit_file", "read_file"]);
-    const {
-      data
-    } = await sb.from("ai_conversation_checkpoints").select().eq("conversation_id", convId);
-    expect(data.length).toBeGreaterThanOrEqual(1);
-    expect(data[0].tools_used).toEqual(["read_file", "edit_file"]);
-    await sb.from("ai_conversation_checkpoints").delete().eq("conversation_id", convId);
-  });
-  it("handles upsert errors gracefully (no throw)", async () => {
-    const mockUpsert = vi.fn().mockResolvedValue({
-      error: {
-        message: "table not found"
-      }
-    });
-    const mockClient = {
-      from: vi.fn(() => ({
-        upsert: mockUpsert
-      }))
-    };
-    await expect(saveCheckpoint(mockClient, "conv-1", 5, [], {
-      input: 0,
-      output: 0,
-      cacheRead: 0,
-      cacheCreation: 0
-    }, 0, [])).resolves.toBeUndefined();
-  });
-  it("handles unexpected exceptions gracefully (no throw)", async () => {
-    const mockClient = {
-      from: vi.fn(() => {
-        throw new Error("connection refused");
-      })
-    };
-    await expect(saveCheckpoint(mockClient, "conv-1", 5, [], {
-      input: 0,
-      output: 0,
-      cacheRead: 0,
-      cacheCreation: 0
-    }, 0, [])).resolves.toBeUndefined();
-  });
-  it("skips non-interval turns (1, 2, 3, 4, 6, 7, 8, 9)", async () => {
-    const convId = await createConversation();
-    for (const turn of [1, 2, 3, 4, 6, 7, 8, 9]) {
-      await saveCheckpoint(sb, convId, turn, [], {
-        input: 0,
-        output: 0,
-        cacheRead: 0,
-        cacheCreation: 0
-      }, 0, []);
-    }
-    const {
-      data
-    } = await sb.from("ai_conversation_checkpoints").select().eq("conversation_id", convId);
-    expect(data?.length ?? 0).toBe(0);
-  });
-});

package/dist/server/lib/__tests__/ssrf-guard.test.js

@@ -1,93 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { isBlockedUrl, validateUrl } from "../ssrf-guard.js";
-describe("isBlockedUrl (synchronous)", () => {
-  // Should block
-  it("blocks localhost", () => {
-    expect(isBlockedUrl("http://localhost/test")).toBe(true);
-    expect(isBlockedUrl("http://127.0.0.1/test")).toBe(true);
-    expect(isBlockedUrl("http://0.0.0.0/test")).toBe(true);
-  });
-  it("blocks IPv6 loopback", () => {
-    expect(isBlockedUrl("http://[::1]/test")).toBe(true);
-  });
-  it("blocks RFC 1918 private ranges", () => {
-    expect(isBlockedUrl("http://10.0.0.1/api")).toBe(true);
-    expect(isBlockedUrl("http://10.255.255.255/api")).toBe(true);
-    expect(isBlockedUrl("http://172.16.0.1/api")).toBe(true);
-    expect(isBlockedUrl("http://172.31.255.255/api")).toBe(true);
-    expect(isBlockedUrl("http://192.168.0.1/api")).toBe(true);
-    expect(isBlockedUrl("http://192.168.255.255/api")).toBe(true);
-  });
-  it("blocks cloud metadata endpoints", () => {
-    expect(isBlockedUrl("http://169.254.169.254/latest/meta-data/")).toBe(true);
-    expect(isBlockedUrl("http://169.254.0.1/test")).toBe(true);
-  });
-  it("blocks CGNAT range (RFC 6598)", () => {
-    expect(isBlockedUrl("http://100.64.0.1/test")).toBe(true);
-    expect(isBlockedUrl("http://100.127.255.255/test")).toBe(true);
-  });
-  it("blocks internal TLDs", () => {
-    expect(isBlockedUrl("http://something.internal/api")).toBe(true);
-    expect(isBlockedUrl("http://something.local/api")).toBe(true);
-    expect(isBlockedUrl("http://something.localhost/api")).toBe(true);
-  });
-  it("blocks .fly.dev (own infrastructure)", () => {
-    expect(isBlockedUrl("http://whale-agent.fly.dev/api")).toBe(true);
-  });
-  it("blocks IPv6-mapped IPv4 private addresses", () => {
-    expect(isBlockedUrl("http://[::ffff:127.0.0.1]/api")).toBe(true);
-    expect(isBlockedUrl("http://[::ffff:10.0.0.1]/api")).toBe(true);
-    expect(isBlockedUrl("http://[::ffff:192.168.1.1]/api")).toBe(true);
-  });
-  it("blocks IPv6 link-local and unique-local", () => {
-    expect(isBlockedUrl("http://[fe80::1]/api")).toBe(true);
-    expect(isBlockedUrl("http://[fc00::1]/api")).toBe(true);
-    expect(isBlockedUrl("http://[fd12::1]/api")).toBe(true);
-  });
-  it("blocks non-HTTP schemes", () => {
-    expect(isBlockedUrl("ftp://example.com/file")).toBe(true);
-    expect(isBlockedUrl("file:///etc/passwd")).toBe(true);
-    expect(isBlockedUrl("gopher://example.com")).toBe(true);
-  });
-  it("blocks malformed URLs", () => {
-    expect(isBlockedUrl("not a url")).toBe(true);
-    expect(isBlockedUrl("")).toBe(true);
-  });
-
-  // Should allow
-  it("allows public HTTP URLs", () => {
-    expect(isBlockedUrl("https://api.example.com/webhook")).toBe(false);
-    expect(isBlockedUrl("https://hooks.slack.com/services/T/B/X")).toBe(false);
-    expect(isBlockedUrl("http://external-api.com/v1/data")).toBe(false);
-  });
-  it("allows public IPs", () => {
-    expect(isBlockedUrl("http://8.8.8.8/test")).toBe(false);
-    expect(isBlockedUrl("http://1.1.1.1/test")).toBe(false);
-  });
-  it("allows non-private 172.x ranges", () => {
-    expect(isBlockedUrl("http://172.15.0.1/api")).toBe(false);
-    expect(isBlockedUrl("http://172.32.0.1/api")).toBe(false);
-  });
-});
-describe("validateUrl (async with DNS check)", () => {
-  it("blocks private IPs", async () => {
-    const err = await validateUrl("http://127.0.0.1/test");
-    expect(err).toBeTruthy();
-  });
-  it("blocks malformed URLs", async () => {
-    const err = await validateUrl("not-a-url");
-    expect(err).toBeTruthy();
-  });
-  it("blocks non-HTTP schemes", async () => {
-    const err = await validateUrl("ftp://example.com");
-    expect(err).toContain("scheme");
-  });
-  it("allows public URLs", async () => {
-    const err = await validateUrl("https://httpbin.org/get");
-    expect(err).toBeNull();
-  });
-  it("blocks .fly.dev", async () => {
-    const err = await validateUrl("https://whale-agent.fly.dev/api");
-    expect(err).toContain("internal infrastructure");
-  });
-});

package/dist/server/lib/__tests__/supabase-client.test.js

@@ -1,111 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from "vitest";
-
-// ============================================================================
-// Mocks
-// ============================================================================
-
-const mockCreateClient = vi.fn(() => ({
-  from: vi.fn(),
-  auth: {
-    signInWithPassword: vi.fn()
-  }
-}));
-vi.mock("@supabase/supabase-js", () => ({
-  createClient: (...args) => mockCreateClient(...args)
-}));
-import { initSupabase, getServiceClient, createUserClient } from "../supabase-client.js";
-
-// ============================================================================
-// Setup
-// ============================================================================
-
-beforeEach(() => {
-  vi.clearAllMocks();
-  // Reset singleton by re-initializing with empty strings first
-  // (this forces the next getServiceClient to create a new client)
-});
-
-// ============================================================================
-// initSupabase
-// ============================================================================
-
-describe("initSupabase", () => {
-  it("stores URL and key for later client creation", () => {
-    initSupabase("https://test.supabase.co", "service-role-key");
-    // No client created yet
-    expect(mockCreateClient).not.toHaveBeenCalled();
-  });
-  it("resets the cached client on re-init", () => {
-    initSupabase("https://first.supabase.co", "key1");
-    getServiceClient(); // create the client
-    const firstCallCount = mockCreateClient.mock.calls.length;
-    initSupabase("https://second.supabase.co", "key2");
-    getServiceClient(); // should create a new client
-    expect(mockCreateClient.mock.calls.length).toBe(firstCallCount + 1);
-  });
-});
-
-// ============================================================================
-// getServiceClient
-// ============================================================================
-
-describe("getServiceClient", () => {
-  it("throws when not initialized", () => {
-    initSupabase("", "");
-    expect(() => getServiceClient()).toThrow("Supabase not initialized");
-  });
-  it("creates client with correct parameters", () => {
-    initSupabase("https://test.supabase.co", "srv-key");
-    getServiceClient();
-    expect(mockCreateClient).toHaveBeenCalledWith("https://test.supabase.co", "srv-key", expect.objectContaining({
-      auth: expect.objectContaining({
-        autoRefreshToken: false,
-        persistSession: false
-      })
-    }));
-  });
-  it("returns singleton (same client on subsequent calls)", () => {
-    initSupabase("https://test.supabase.co", "srv-key");
-    const client1 = getServiceClient();
-    const client2 = getServiceClient();
-    expect(client1).toBe(client2);
-    // createClient should only be called once
-    expect(mockCreateClient).toHaveBeenCalledTimes(1);
-  });
-  it("includes retry fetch in global config", () => {
-    initSupabase("https://test.supabase.co", "srv-key");
-    getServiceClient();
-    const callArgs = mockCreateClient.mock.calls[0];
-    expect(callArgs[2]).toHaveProperty("global");
-    expect(callArgs[2].global).toHaveProperty("fetch");
-    expect(typeof callArgs[2].global.fetch).toBe("function");
-  });
-});
-
-// ============================================================================
-// createUserClient
-// ============================================================================
-
-describe("createUserClient", () => {
-  it("creates client with user token in headers", () => {
-    createUserClient("https://test.supabase.co", "anon-key", "user-jwt");
-    expect(mockCreateClient).toHaveBeenCalledWith("https://test.supabase.co", "anon-key", expect.objectContaining({
-      global: expect.objectContaining({
-        headers: {
-          Authorization: "Bearer user-jwt"
-        }
-      })
-    }));
-  });
-  it("creates a new client each call (not singleton)", () => {
-    const client1 = createUserClient("https://test.supabase.co", "key", "token1");
-    const client2 = createUserClient("https://test.supabase.co", "key", "token2");
-    // Both calls should create separate clients
-    expect(mockCreateClient).toHaveBeenCalledTimes(2);
-  });
-  it("includes retry fetch", () => {
-    createUserClient("https://test.supabase.co", "key", "token");
-    const callArgs = mockCreateClient.mock.calls[0];
-    expect(typeof callArgs[2].global.fetch).toBe("function");
-  });
-});

package/dist/server/lib/__tests__/template-resolver.test.js

@@ -1,317 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { evaluateCondition, resolveTemplate } from "../template-resolver.js";
-const ctx = {
-  steps: {
-    check: {
-      output: {
-        count: 42,
-        status: "active",
-        message: "all > good"
-      },
-      status: "success"
-    },
-    fetch: {
-      output: {
-        items: [1, 2, 3],
-        nested: {
-          deep: "value"
-        }
-      },
-      status: "success"
-    },
-    empty: {
-      output: null,
-      status: "failed"
-    }
-  },
-  trigger: {
-    type: "webhook",
-    source: "stripe",
-    data: {
-      amount: 100
-    }
-  }
-};
-describe("resolveTemplate", () => {
-  it("resolves simple step output", () => {
-    expect(resolveTemplate("{{steps.check.output.count}}", ctx)).toBe(42);
-  });
-  it("resolves trigger fields", () => {
-    expect(resolveTemplate("{{trigger.type}}", ctx)).toBe("webhook");
-  });
-  it("preserves objects for single-expression templates", () => {
-    const result = resolveTemplate("{{steps.fetch.output.items}}", ctx);
-    expect(Array.isArray(result)).toBe(true);
-    expect(result).toEqual([1, 2, 3]);
-  });
-  it("stringifies objects in mixed-text templates", () => {
-    const result = resolveTemplate("Items: {{steps.fetch.output.items}}", ctx);
-    expect(typeof result).toBe("string");
-    expect(result).toContain("[1,2,3]");
-  });
-  it("resolves nested dot paths", () => {
-    expect(resolveTemplate("{{steps.fetch.output.nested.deep}}", ctx)).toBe("value");
-  });
-  it("returns original template for missing paths", () => {
-    expect(resolveTemplate("{{steps.missing.output}}", ctx)).toBe("{{steps.missing.output}}");
-  });
-  it("blocks prototype pollution paths", () => {
-    expect(resolveTemplate("{{steps.check.__proto__}}", ctx)).toBe("{{steps.check.__proto__}}");
-    expect(resolveTemplate("{{steps.check.constructor}}", ctx)).toBe("{{steps.check.constructor}}");
-  });
-  it("resolves built-in variables", () => {
-    const now = resolveTemplate("{{now}}", ctx);
-    expect(typeof now).toBe("string");
-    expect(now).toMatch(/^\d{4}-\d{2}/);
-    const today = resolveTemplate("{{today}}", ctx);
-    expect(typeof today).toBe("string");
-    expect(today).toMatch(/^\d{4}-\d{2}-\d{2}$/);
-  });
-  it("recursively resolves objects", () => {
-    const template = {
-      key: "{{steps.check.output.count}}",
-      nested: {
-        val: "{{trigger.type}}"
-      }
-    };
-    const result = resolveTemplate(template, ctx);
-    expect(result.key).toBe(42);
-    expect(result.nested.val).toBe("webhook");
-  });
-});
-describe("evaluateCondition", () => {
-  it("evaluates numeric comparisons", () => {
-    expect(evaluateCondition("{{steps.check.output.count}} > 10", ctx)).toBe(true);
-    expect(evaluateCondition("{{steps.check.output.count}} < 10", ctx)).toBe(false);
-    expect(evaluateCondition("{{steps.check.output.count}} == 42", ctx)).toBe(true);
-    expect(evaluateCondition("{{steps.check.output.count}} >= 42", ctx)).toBe(true);
-    expect(evaluateCondition("{{steps.check.output.count}} <= 42", ctx)).toBe(true);
-    expect(evaluateCondition("{{steps.check.output.count}} != 100", ctx)).toBe(true);
-  });
-  it("evaluates string comparisons", () => {
-    expect(evaluateCondition("{{steps.check.output.status}} == 'active'", ctx)).toBe(true);
-    expect(evaluateCondition("{{steps.check.output.status}} != 'inactive'", ctx)).toBe(true);
-    expect(evaluateCondition("{{trigger.type}} == 'webhook'", ctx)).toBe(true);
-  });
-  it("evaluates contains operator", () => {
-    expect(evaluateCondition("{{steps.check.output.status}} contains 'act'", ctx)).toBe(true);
-    expect(evaluateCondition("{{steps.check.output.status}} !contains 'xyz'", ctx)).toBe(true);
-  });
-  it("evaluates exists/!exists", () => {
-    expect(evaluateCondition("{{steps.check.output.count}} exists", ctx)).toBe(true);
-    expect(evaluateCondition("{{steps.missing.output}} exists", ctx)).toBe(false);
-  });
-  it("evaluates truthy/falsy", () => {
-    expect(evaluateCondition("true", ctx)).toBe(true);
-    expect(evaluateCondition("false", ctx)).toBe(false);
-    expect(evaluateCondition("1", ctx)).toBe(true);
-    expect(evaluateCondition("0", ctx)).toBe(false);
-  });
-
-  // P1 FIX: Regression test — data containing operator strings shouldn't break matching
-  it("handles data containing operator-like strings", () => {
-    const opCtx = {
-      steps: {
-        s1: {
-          output: {
-            value: "status >= ready"
-          },
-          status: "success"
-        }
-      },
-      trigger: {}
-    };
-    // The value "status >= ready" contains ">=" but the condition should still work
-    expect(evaluateCondition("{{steps.s1.output.value}} == 'status >= ready'", opCtx)).toBe(true);
-  });
-  it("handles data containing 'contains' keyword", () => {
-    const opCtx = {
-      steps: {
-        s1: {
-          output: {
-            description: "this contains special data"
-          },
-          status: "success"
-        }
-      },
-      trigger: {}
-    };
-    expect(evaluateCondition("{{steps.s1.output.description}} contains 'special'", opCtx)).toBe(true);
-  });
-  it("JSON-stringifies objects instead of producing [object Object]", () => {
-    // When a single-expression template resolves to a full object, evaluateCondition
-    // should JSON.stringify it so comparisons work instead of silently failing
-    const objCtx = {
-      steps: {
-        fetch: {
-          output: {
-            items: [1, 2, 3],
-            nested: {
-              deep: "value"
-            }
-          },
-          status: "success"
-        }
-      },
-      trigger: {}
-    };
-    // The object should be stringified, not become "[object Object]"
-    const result = evaluateCondition("{{steps.fetch.output}} contains 'items'", objCtx);
-    expect(result).toBe(true);
-
-    // Verify it doesn't degrade to [object Object]
-    const result2 = evaluateCondition("{{steps.fetch.output}} contains '[object Object]'", objCtx);
-    expect(result2).toBe(false);
-  });
-
-  // Edge cases
-  it("returns false for unresolved templates", () => {
-    expect(evaluateCondition("{{steps.missing.output}} == 'test'", ctx)).toBe(false);
-  });
-  it("handles strict equality operators", () => {
-    expect(evaluateCondition("{{steps.check.output.count}} === 42", ctx)).toBe(true);
-    expect(evaluateCondition("{{steps.check.output.count}} !== 100", ctx)).toBe(true);
-  });
-  it("handles object values without [object Object]", () => {
-    // When comparing a full object value, it should be JSON-stringified
-    const objCtx = {
-      steps: {
-        data: {
-          output: {
-            payload: {
-              key: "val",
-              num: 5
-            }
-          },
-          status: "success"
-        }
-      },
-      trigger: {}
-    };
-    // Should contain the key in JSON form, not "[object Object]"
-    expect(evaluateCondition("{{steps.data.output.payload}} contains 'key'", objCtx)).toBe(true);
-    expect(evaluateCondition("{{steps.data.output.payload}} contains '[object Object]'", objCtx)).toBe(false);
-  });
-  it("handles deeply nested step outputs", () => {
-    const deepCtx = {
-      steps: {
-        api: {
-          output: {
-            response: {
-              data: {
-                users: [{
-                  name: "Alice",
-                  profile: {
-                    city: "NYC"
-                  }
-                }]
-              }
-            }
-          },
-          status: "success"
-        }
-      },
-      trigger: {}
-    };
-    // The template resolver walks dot paths — deep nesting should work
-    expect(evaluateCondition("{{steps.api.output.response.data}} contains 'Alice'", deepCtx)).toBe(true);
-  });
-  it("exists operator on missing template returns false", () => {
-    // A template that doesn't resolve (stays as {{...}}) should be treated as non-existing
-    expect(evaluateCondition("{{steps.nonexistent.output.field}} exists", ctx)).toBe(false);
-  });
-  it("numeric comparison with literal numbers: 5 > 3", () => {
-    // No templates — plain numeric comparison
-    expect(evaluateCondition("5 > 3", ctx)).toBe(true);
-    expect(evaluateCondition("3 > 5", ctx)).toBe(false);
-    expect(evaluateCondition("10 == 10", ctx)).toBe(true);
-    expect(evaluateCondition("7 <= 7", ctx)).toBe(true);
-    expect(evaluateCondition("2 >= 9", ctx)).toBe(false);
-  });
-  it("string containing operator-like text resolves correctly", () => {
-    const messyCtx = {
-      steps: {
-        s1: {
-          output: {
-            value: "status >= 10 is normal == true"
-          },
-          status: "success"
-        }
-      },
-      trigger: {}
-    };
-    // The value itself contains >=, ==, etc. but the actual comparison operator
-    // is the rightmost one matched against the quoted right-hand side
-    expect(evaluateCondition("{{steps.s1.output.value}} == 'status >= 10 is normal == true'", messyCtx)).toBe(true);
-    expect(evaluateCondition("{{steps.s1.output.value}} != 'something else'", messyCtx)).toBe(true);
-  });
-});
-
-// ============================================================================
-// Edge-Case Tests: resolveTemplate
-// ============================================================================
-
-describe("resolveTemplate edge cases", () => {
-  it("handles circular-like deep nesting (depth > 20 returns value as-is)", () => {
-    // Build a deeply nested template object (> 20 levels)
-    let deep = {
-      leaf: "{{steps.check.output.count}}"
-    };
-    for (let i = 0; i < 25; i++) {
-      deep = {
-        level: deep
-      };
-    }
-    const result = resolveTemplate(deep, ctx);
-
-    // The top levels should be resolved objects, but at depth > 20 the leaf
-    // template string should be returned as-is (not resolved)
-    let current = result;
-    for (let i = 0; i < 20; i++) {
-      expect(current).toHaveProperty("level");
-      current = current.level;
-    }
-    // Beyond depth 20, value is returned as-is — the leaf template is not resolved
-    // Walk remaining levels
-    while (current?.level !== undefined) {
-      current = current.level;
-    }
-    expect(current.leaf).toBe("{{steps.check.output.count}}");
-  });
-  it("blocks __proto__ traversal", () => {
-    // Attempting to traverse __proto__ should return the original template
-    expect(resolveTemplate("{{steps.check.__proto__}}", ctx)).toBe("{{steps.check.__proto__}}");
-    expect(resolveTemplate("{{steps.check.output.__proto__}}", ctx)).toBe("{{steps.check.output.__proto__}}");
-    expect(resolveTemplate("{{steps.__proto__.output}}", ctx)).toBe("{{steps.__proto__.output}}");
-  });
-  it("blocks constructor traversal", () => {
-    expect(resolveTemplate("{{steps.check.constructor}}", ctx)).toBe("{{steps.check.constructor}}");
-  });
-  it("blocks __defineGetter__ traversal", () => {
-    expect(resolveTemplate("{{steps.check.__defineGetter__}}", ctx)).toBe("{{steps.check.__defineGetter__}}");
-  });
-  it("env access: only allows whitelisted keys", () => {
-    const envCtx = {
-      steps: {},
-      trigger: {},
-      env: {
-        APP_URL: "https://example.com",
-        APP_NAME: "TestApp",
-        NODE_ENV: "test",
-        SECRET_KEY: "super-secret-123",
-        DATABASE_URL: "postgres://...",
-        AWS_SECRET_ACCESS_KEY: "AKIA..."
-      }
-    };
-
-    // Whitelisted keys should resolve
-    expect(resolveTemplate("{{env.APP_URL}}", envCtx)).toBe("https://example.com");
-    expect(resolveTemplate("{{env.APP_NAME}}", envCtx)).toBe("TestApp");
-    expect(resolveTemplate("{{env.NODE_ENV}}", envCtx)).toBe("test");
-
-    // Non-whitelisted keys should NOT resolve (returned as original template)
-    expect(resolveTemplate("{{env.SECRET_KEY}}", envCtx)).toBe("{{env.SECRET_KEY}}");
-    expect(resolveTemplate("{{env.DATABASE_URL}}", envCtx)).toBe("{{env.DATABASE_URL}}");
-    expect(resolveTemplate("{{env.AWS_SECRET_ACCESS_KEY}}", envCtx)).toBe("{{env.AWS_SECRET_ACCESS_KEY}}");
-  });
-});