langchain-deepagents-code-image.test.ts

// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
// SPDX-License-Identifier: Apache-2.0

import { execFileSync, spawnSync } from "node:child_process";
import { createHash } from "node:crypto";
import fs from "node:fs";
import os from "node:os";
import path from "node:path";
import { pathToFileURL } from "node:url";
import { describe, expect, it } from "vitest";
import YAML from "yaml";

import { loadAgent } from "../src/lib/agent/defs.ts";
import { prepareInitialSandboxCreatePolicy } from "../src/lib/onboard/initial-policy.ts";
import { TOKEN_PREFIX_PATTERNS } from "../src/lib/security/secret-patterns.ts";
import { cloudExperimentalChecksForOnboarding } from "./e2e/live/cloud-experimental-check-list.ts";
import {
  ANALYTICS_DISABLE_ENV_NAMES,
  DCODE_CANONICAL_PATH,
  headlessCheckPath,
  NO_PROXY_ENV_NAMES,
  PROXY_URL_ENV_NAMES,
  runHeadlessCheckHelper,
  runStartScriptProxyProbe,
  TRACING_ENABLE_ENV_NAMES,
} from "./helpers/langchain-deepagents-code-headless.ts";
import {
  makeWrapperFixture,
  readAgentFile,
  runWrapper,
} from "./helpers/langchain-deepagents-code-image.ts";
import { dcodeStateDir, makeStartScriptFixture } from "./support/dcode-start-script-fixture.ts";
import { expectManagedBootstrapNativeImageContract } from "./support/managed-bootstrap-image-contract";

function containsTokenShapedSecret(value: string): boolean {
  return TOKEN_PREFIX_PATTERNS.some((pattern) => {
    pattern.lastIndex = 0;
    const matched = pattern.test(value);
    pattern.lastIndex = 0;
    return matched;
  });
}

const repoRoot = path.resolve(import.meta.dirname, "..");
const tuiStartupCheckPath = path.join(
  repoRoot,
  "test",
  "e2e",
  "e2e-cloud-experimental",
  "checks",
  "10-deepagents-code-tui-startup.sh",
);

type EffectivePolicy = {
  filesystem_policy?: { read_only?: string[] };
  landlock?: { compatibility?: string };
  network_policies?: Record<
    string,
    {
      binaries?: Array<{ path?: unknown }>;
      endpoints?: Array<{ host?: string }>;
    }
  >;
};

function policyBinaryPaths(policy: EffectivePolicy, policyName: string): string[] {
  const binaries = policy.network_policies?.[policyName]?.binaries;
  expect(Array.isArray(binaries), `${policyName} policy must declare binary-scoped egress`).toBe(
    true,
  );
  return (binaries ?? []).map((entry, index) => {
    expect(typeof entry.path, `${policyName} binary #${index} must declare a string path`).toBe(
      "string",
    );
    return entry.path as string;
  });
}

function sha256(contents: string | Buffer): string {
  return createHash("sha256").update(contents).digest("hex");
}

function writeMinimalWheel(directory: string): string {
  const wheelPath = path.join(directory, "nemoclaw_hash_contract-1.0-py3-none-any.whl");
  execFileSync(
    "python3",
    [
      "-c",
      `
import sys
import zipfile

wheel_path = sys.argv[1]
dist_info = "nemoclaw_hash_contract-1.0.dist-info"
with zipfile.ZipFile(wheel_path, "w") as wheel:
    wheel.writestr("nemoclaw_hash_contract/__init__.py", "")
    wheel.writestr(
        f"{dist_info}/METADATA",
        "Metadata-Version: 2.1\\nName: nemoclaw-hash-contract\\nVersion: 1.0\\n",
    )
    wheel.writestr(
        f"{dist_info}/WHEEL",
        "Wheel-Version: 1.0\\nGenerator: nemoclaw-test\\nRoot-Is-Purelib: true\\nTag: py3-none-any\\n",
    )
    wheel.writestr(f"{dist_info}/RECORD", f"{dist_info}/RECORD,,\\n")
`,
      wheelPath,
    ],
    { stdio: "pipe" },
  );
  return wheelPath;
}

function baseImagePipInstallArgs(dockerfile: string, requirementsPath: string): string[] {
  const logicalDockerfile = dockerfile.replace(/\\\r?\n\s*/g, " ");
  const copiedLock = logicalDockerfile.match(
    /COPY\s+agents\/langchain-deepagents-code\/requirements\.lock\s+(\S+)/,
  );
  expect(copiedLock, "base image must copy the reviewed lockfile").not.toBeNull();
  const invocation = logicalDockerfile.match(/"\$VIRTUAL_ENV\/bin\/pip3" install\s+([^\n]+?)\s+&&/);
  expect(
    invocation,
    "base image must install the reviewed lockfile with the managed venv",
  ).not.toBeNull();
  const args = (invocation?.[1] ?? "").trim().split(/\s+/);
  const requirementsFlag = args.indexOf("-r");
  expect(
    requirementsFlag,
    "base image pip install must consume a requirements file",
  ).toBeGreaterThanOrEqual(0);
  expect(args[requirementsFlag + 1]).toBe(copiedLock?.[1]);
  return [...args.slice(0, requirementsFlag), "-r", requirementsPath];
}

function assertEveryRequirementIsHashLocked(requirementsLock: string): void {
  const lines = requirementsLock.split(/\r?\n/);
  const requirementStarts = lines
    .map((line, index) => ({ line, index }))
    .filter(({ line }) => line.length > 0 && !/^\s|#/.test(line));
  expect(requirementStarts.length).toBeGreaterThan(0);

  for (const [position, requirement] of requirementStarts.entries()) {
    expect(
      requirement.line,
      `lock entry on line ${requirement.index + 1} must be exactly pinned`,
    ).toMatch(/^[A-Za-z0-9][A-Za-z0-9_.-]*(?:\[[^\]]+\])?==[^\s\\]+\s+\\$/);
    const nextIndex = requirementStarts[position + 1]?.index ?? lines.length;
    const block = lines.slice(requirement.index, nextIndex).join("\n");
    const hashTokens = block.match(/--hash=[^\s\\]+/g) ?? [];
    expect(hashTokens.length, requirement.line).toBeGreaterThan(0);
    expect(hashTokens.every((token) => /^--hash=sha256:[a-f0-9]{64}$/.test(token))).toBe(true);
  }
}

describe("LangChain Deep Agents Code image contracts", () => {
  it.each(
    [
        "/usr/local/lib/nemoclaw/dcode-managed-exec /usr/bin/true",
        "/usr/local/bin/dcode --version",
        "/usr/local/bin/dcode.real --version",
        "/usr/local/bin/deepagents-code --version",
      ],
  )("hardens copied NemoClaw blueprints against sandbox-user mutation [%s]", (probe) => {
    const dockerfile = readAgentFile("Dockerfile");
    const finalRuntimeRoot = [
      "FROM ${BASE_IMAGE}",
      "",
      "# The supplied base may end as a non-root runtime user. Reset the build user",
      "# explicitly before installing the root-owned managed-startup handoff.",
      "USER root",
    ].join("\n");
    const managedRuntimeDirectory = "&& install -d -o root -g root -m 0755 /run/nemoclaw";
    const runtimeModeReplay = "&& chmod 444 /opt/nemoclaw-deepagents-code/generate-config.ts";

    expect(dockerfile).toContain("ARG BASE_IMAGE\n");
    expect(dockerfile).toContain("ARG NEMOCLAW_MODEL=nvidia/nemotron-3-ultra-550b-a55b");
    expect(dockerfile).not.toContain("langchain-deepagents-code-sandbox-base:latest");
    expect(dockerfile).toContain(
      'timeout 10 env -i /usr/local/lib/nemoclaw/dcode-wrapper.sh -n ""',
    );

    expect(dockerfile).toContain(`env -i ${probe}`);

    expect(dockerfile).toContain("chown root:root /sandbox/.nemoclaw");
    expect(dockerfile).toContain("chmod 1755 /sandbox/.nemoclaw");
    expect(dockerfile).toContain("chown -R root:root /sandbox/.nemoclaw/blueprints");
    expect(dockerfile).toContain("chmod -R 755 /sandbox/.nemoclaw/blueprints");
    expect(dockerfile).toContain("cp -r /opt/nemoclaw-blueprint/*");
    expect(dockerfile).toContain("COPY --from=mcp-tool-discovery-runtime");
    expect(dockerfile.indexOf("cp -r /opt/nemoclaw-blueprint/*")).toBeLessThan(
      dockerfile.indexOf("chown -R root:root /sandbox/.nemoclaw/blueprints"),
    );
    expect(dockerfile.split(managedRuntimeDirectory)).toHaveLength(2);
    expect(dockerfile.indexOf("COPY --from=mcp-tool-discovery-runtime")).toBeLessThan(
      dockerfile.indexOf(managedRuntimeDirectory),
    );
    expect(dockerfile).toContain(finalRuntimeRoot);
    expectManagedBootstrapNativeImageContract(dockerfile);
    expect(dockerfile.indexOf(finalRuntimeRoot)).toBeLessThan(
      dockerfile.indexOf(managedRuntimeDirectory),
    );
    expect(dockerfile.indexOf(managedRuntimeDirectory)).toBeLessThan(
      dockerfile.indexOf(runtimeModeReplay),
    );
    expect(dockerfile).toContain(
      "COPY tools/mcp-tool-discovery-runtime/reviewed-runtime-bundle/managed-startup-image-runtime.bundle /out/managed-startup-image-runtime.cjs",
    );
    expect(dockerfile).not.toContain(
      "COPY src/lib/onboard/managed-bootstrap/ ./src/lib/onboard/managed-bootstrap/",
    );
    expect(dockerfile).toContain(
      "COPY --from=managed-bootstrap-entrypoint-builder /out/usr/local/bin/nemoclaw-managed-bootstrap /usr/local/bin/nemoclaw-managed-bootstrap",
    );
    expect(dockerfile).toContain(
      "COPY --from=managed-bootstrap-entrypoint-builder /out/usr/local/lib/nemoclaw/managed-bootstrap-trampoline.sh /usr/local/lib/nemoclaw/managed-bootstrap-trampoline.sh",
    );
    expect(dockerfile).toContain(
      "chmod 755 /usr/local/bin/nemoclaw-start /usr/local/bin/nemoclaw-managed-startup-hold /usr/local/bin/nemoclaw-managed-bootstrap",
    );
    expect(dockerfile).toContain("ARG NEMOCLAW_MANAGED_IMAGE_RUNTIME_USER=root");
    expect(dockerfile).toContain("root|sandbox) ;; \\");
    expect(dockerfile).toContain("&& command -v setpriv >/dev/null 2>&1");
    expect(dockerfile.trimEnd()).toMatch(
      /USER \$\{NEMOCLAW_MANAGED_IMAGE_RUNTIME_USER\}\nENTRYPOINT \["\/usr\/local\/bin\/nemoclaw-start"\]\nCMD \["\/bin\/bash"\]$/,
    );
  });

  it("does not wire unsupported messaging artifacts into the DeepAgents image", () => {
    const dockerfile = readAgentFile("Dockerfile");
    const startScript = readAgentFile("start.sh");

    expect(dockerfile).not.toContain("NEMOCLAW_MESSAGING_PLAN_B64");
    expect(dockerfile).not.toContain("messaging-build-applier.mts");
    expect(startScript).toContain("Setting up NemoClaw Deep Agents Code runtime");
    expect(startScript).not.toContain("load_messaging_env");
    expect(startScript).not.toContain("TELEGRAM_BOT_TOKEN");
    expect(startScript).not.toContain("DISCORD_BOT_TOKEN");
    expect(startScript).not.toContain("SLACK_BOT_TOKEN");
    expect(startScript).not.toContain("GOOGLECHAT_SERVICE_ACCOUNT");
    expect(startScript).not.toContain("GOOGLE_CHAT_SERVICE_ACCOUNT");
  });

  it("prints NemoClaw setup output before idling as a terminal runtime", () => {
    const startScript = readAgentFile("start.sh");

    expect(startScript).toContain("Setting up NemoClaw Deep Agents Code runtime");
    expect(startScript).toContain("exec -a nemoclaw-dcode-entrypoint tail -f /dev/null");
    expect(startScript).not.toContain("exec sleep infinity");
  });

  it("sources the managed runtime environment in interactive and login shells (#6191)", () => {
    const baseDockerfile = readAgentFile("Dockerfile.base");
    const sourceLine = "[ -f /tmp/nemoclaw-proxy-env.sh ] && . /tmp/nemoclaw-proxy-env.sh";

    expect(baseDockerfile.split(sourceLine)).toHaveLength(3);
    expect(baseDockerfile).toContain("> /sandbox/.bashrc");
    expect(baseDockerfile).toContain("> /sandbox/.profile");
  });

  it("reserves the first DCode login profile under a sticky root workspace (#8624)", () => {
    const dockerfile = readAgentFile("Dockerfile");
    const loginProfile = readAgentFile("dcode-login-profile.sh");
    const startScript = readAgentFile("start.sh");

    expect(dockerfile).toContain(
      "COPY agents/langchain-deepagents-code/dcode-login-profile.sh /usr/local/lib/nemoclaw/dcode-login-profile.sh",
    );
    expect(dockerfile).toContain("chown root:sandbox /sandbox");
    expect(dockerfile).toContain("chmod 1775 /sandbox");
    expect(dockerfile).toContain(
      "install -o root -g root -m 0444 /usr/local/lib/nemoclaw/dcode-login-profile.sh /sandbox/.bash_profile",
    );
    expect(startScript).toContain("protect_dcode_login_profile");
    expect(startScript).toContain("verify_dcode_login_profile");
    expect(startScript).toContain("rm -f -- /sandbox/.bash_profile");
    expect(startScript).toContain(
      "[SECURITY] DCode login profile is not protected; rebuild this sandbox.",
    );
    expect(loginProfile).toContain('case "${BASH_EXECUTION_STRING:-}" in');
    expect(loginProfile).toContain('*"/usr/local/lib/nemoclaw/dcode-managed-exec"*)');
    expect(loginProfile.indexOf("unset BASH_ENV ENV")).toBeLessThan(
      loginProfile.indexOf("/tmp/nemoclaw-proxy-env.sh"),
    );
  });

  it("serializes the sandbox name into the shell env file for in-sandbox identity", () => {
    const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-dcode-start-"));
    try {
      const { envFile, scriptPath } = makeStartScriptFixture(tempDir);

      execFileSync("bash", [scriptPath, "sh", "-c", ":"], {
        env: {
          PATH: process.env.PATH ?? "/usr/bin:/bin",
          NEMOCLAW_SANDBOX_NAME: "dcode-demo",
        },
        encoding: "utf8",
      });

      expect(fs.readFileSync(envFile, "utf8")).toContain("export NEMOCLAW_SANDBOX_NAME=dcode-demo");
    } finally {
      fs.rmSync(tempDir, { recursive: true, force: true });
    }
  });

  it("replaces inherited host proxy values with the managed runtime proxy (#6191)", () => {
    const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-dcode-start-"));
    const { envFile, scriptPath } = makeStartScriptFixture(tempDir, {
      markerDir: dcodeStateDir(tempDir),
    });
    const inheritedSecrets = {
      NVIDIA_API_KEY: `nvapi-${"A".repeat(10)}`,
      OPENAI_API_KEY: `sk-${"B".repeat(20)}`,
      LANGSMITH_API_KEY: `lsv2_pt_${"C".repeat(36)}_${"D".repeat(10)}`,
      LANGSMITH_TRACING: `lsv2_sk_${"I".repeat(36)}_${"J".repeat(10)}`,
      LANGSMITH_PROJECT: `lsv2_pt_${"E".repeat(36)}_${"F".repeat(10)}`,
      DEEPAGENTS_CODE_LANGSMITH_PROJECT: `lsv2_sk_${"G".repeat(36)}_${"H".repeat(10)}`,
    };
    const inheritedTracingFlags = Object.fromEntries(
      TRACING_ENABLE_ENV_NAMES.map((name) => [name, "true"]),
    );
    const inheritedAnalyticsFlags = Object.fromEntries(
      ANALYTICS_DISABLE_ENV_NAMES.map((name) => [name, "0"]),
    );
    const { envFileText, output } = runStartScriptProxyProbe(scriptPath, envFile, {
      HTTP_PROXY: "http://corp-user:corp-password@corp-proxy.example:8080",
      HTTPS_PROXY: "http://corp-user:corp-password@corp-proxy.example:8080",
      NO_PROXY: "corp.internal,inference.local",
      http_proxy: "http://lower-user:lower-password@lower-proxy.example:8080",
      https_proxy: "http://lower-user:lower-password@lower-proxy.example:8080",
      no_proxy: "corp.internal,inference.local",
      ALL_PROXY: "socks5://all-user:all-password@all-proxy.example:1080",
      all_proxy: "socks5://lower-all-user:lower-all-password@lower-all-proxy.example:1080",
      OPENAI_PROXY: "http://openai-user:openai-password@attacker.example:8080",
      ...inheritedSecrets,
      ...inheritedTracingFlags,
      ...inheritedAnalyticsFlags,
    });
    const managedProxy = "http://10.200.0.1:3128";
    const managedNoProxy = "localhost,127.0.0.1,::1,10.200.0.1";
    const outputLines = output.trimEnd().split("\n");
    const envFileLines = envFileText.trimEnd().split("\n");
    expect(fs.statSync(envFile).mode & 0o777).toBe(0o444);
    expect(envFileText).toContain(`export PATH="${DCODE_CANONICAL_PATH}"`);
    for (const name of PROXY_URL_ENV_NAMES) {
      expect(outputLines).toContain(`RUNTIME_${name}=${managedProxy}`);
      expect(outputLines).toContain(`SOURCED_${name}=${managedProxy}`);
      expect(envFileLines).toContain(`export ${name}=${managedProxy}`);
    }
    for (const name of NO_PROXY_ENV_NAMES) {
      expect(outputLines).toContain(`RUNTIME_${name}=${managedNoProxy}`);
      expect(outputLines).toContain(`SOURCED_${name}=${managedNoProxy}`);
      expect(envFileLines).toContain(`export ${name}=${managedNoProxy.replaceAll(",", "\\,")}`);
    }
    for (const name of TRACING_ENABLE_ENV_NAMES) {
      expect(outputLines).toContain(`RUNTIME_${name}=false`);
      expect(outputLines).toContain(`SOURCED_${name}=false`);
      expect(envFileLines).toContain(`export ${name}=false`);
    }
    for (const name of ANALYTICS_DISABLE_ENV_NAMES) {
      expect(outputLines).toContain(`RUNTIME_${name}=1`);
      expect(outputLines).toContain(`SOURCED_${name}=1`);
      expect(envFileLines).toContain(`export ${name}=1`);
    }
    expect(envFileLines).toContain("unset ALL_PROXY all_proxy OPENAI_PROXY");
    expect(
      outputLines.filter((line) => /^(?:RUNTIME|SOURCED)_(?:NO_PROXY|no_proxy)=/.test(line)),
    ).not.toEqual(expect.arrayContaining([expect.stringContaining("inference.local")]));
    expect(envFileLines.filter((line) => /^export (?:NO_PROXY|no_proxy)=/.test(line))).not.toEqual(
      expect.arrayContaining([expect.stringContaining("inference.local")]),
    );
    const combined = `${output}\n${envFileText}`;
    expect(containsTokenShapedSecret(inheritedSecrets.LANGSMITH_API_KEY)).toBe(true);
    expect(containsTokenShapedSecret(envFileText)).toBe(false);
    for (const secret of Object.values(inheritedSecrets)) {
      expect(envFileText).not.toContain(secret);
    }
    expect(combined).not.toContain("proxy.example");
    expect(combined).not.toContain("user");
    expect(combined).not.toContain("password");
    expect(combined).not.toContain("corp.internal");
  });

  it("keeps all Deep Agents Code entry points behind the managed wrapper boundary", () => {
    const dockerfile = readAgentFile("Dockerfile");
    const launcher = readAgentFile("dcode-launcher.sh");
    const wrapper = readAgentFile("dcode-wrapper.sh");
    const expectedVersion = loadAgent("langchain-deepagents-code").expectedVersion;

    expect(dockerfile).not.toContain("NEMOCLAW_WEB_SEARCH_ENABLED");
    expect(dockerfile).not.toContain("NEMOCLAW_DEEPAGENTS_CODE_SHELL_ALLOW_LIST");
    expect(dockerfile).not.toContain("dcode.upstream");
    expect(wrapper).not.toContain("NEMOCLAW_DEEPAGENTS_CODE_SHELL_ALLOW_LIST");
    expect(wrapper).toContain("unset DEEPAGENTS_CODE_SHELL_ALLOW_LIST");
    expect(expectedVersion).not.toBeNull();
    expect(wrapper).toContain(`deepagents-code==${expectedVersion}`);
    expect(wrapper).toContain("Schema pin");
    expect(wrapper).toContain("truthy top-level");
    expect(wrapper).toContain("unset PYTHONHOME PYTHONPATH");
    expect(wrapper).toContain('/opt/venv/bin/python3 -I - "$auth_file"');
    expect(wrapper).toContain("exec /opt/venv/bin/python3 -I -m deepagents_code");
    expect(wrapper).toContain("extra_args=(--sandbox none --no-mcp)");
    expect(wrapper).not.toContain("managed_mcp_config_path");
    expect(wrapper).not.toContain("--mcp-config /sandbox/.mcp.json");
    expect(wrapper).toContain("assert_no_auth_store_credentials");
    expect(wrapper).toContain("assert_no_codex_auth_credentials");
    expect([
          "export DEEPAGENTS_CODE_LANGSMITH_TRACING=false",
          "export LANGSMITH_TRACING=false",
          "export DEEPAGENTS_CODE_OFFLINE=1",
          "export DEEPAGENTS_CODE_RIPGREP_INSTALLER=system",
          'reject_managed_override "dependency update posture"',
          'reject_managed_override "credential posture"',
          'reject_managed_override "managed tool set posture"',
          'reject_managed_override "sandbox isolation"',
          'reject_managed_override "MCP posture"',
          'reject_managed_override "shell allow-list posture"',
        ].every((s) => wrapper.includes(s))).toBe(true);
    expect([
          "managed-dcode-runtime.py",
          "dcode-session-supervisor.py",
          "nemoclaw_observability.py",
          "patch-managed-deepagents-code.py",
          "validate-nemotron-ultra-profile.py",
          "DEEPAGENTS_CODE_LANGSMITH_TRACING=false",
          "LANGSMITH_TRACING=false",
          "DEEPAGENTS_CODE_OFFLINE=1",
          "DEEPAGENTS_CODE_RIPGREP_INSTALLER=system",
          "install -m 0755 /usr/local/lib/nemoclaw/dcode-launcher.sh /usr/local/bin/dcode.real",
          "install -m 0755 /usr/local/lib/nemoclaw/dcode-launcher.sh /usr/local/bin/deepagents-code",
          "install -o root -g root -m 0755 /usr/local/lib/nemoclaw/dcode-launcher.sh /usr/local/lib/nemoclaw/dcode-managed-exec",
          "COPY agents/langchain-deepagents-code/dcode-session-supervisor.py /usr/local/lib/nemoclaw/dcode-session-supervisor.py",
          `test "$(stat -c '%u:%g:%a' /usr/local/lib/nemoclaw/dcode-session-supervisor.py)" = "0:0:755"`,
          "test -f /usr/local/lib/nemoclaw/dcode-managed-exec",
          "test ! -L /usr/local/lib/nemoclaw/dcode-managed-exec",
          `test "$(stat -c '%u:%g:%a' /usr/local/lib/nemoclaw/dcode-managed-exec)" = "0:0:755"`,
          "cmp -s /usr/local/lib/nemoclaw/dcode-launcher.sh /usr/local/lib/nemoclaw/dcode-managed-exec",
          "/usr/local/lib/nemoclaw/dcode-managed-exec /usr/bin/true",
          "/opt/venv/bin/pip3 install --no-index --no-cache-dir --no-deps --no-build-isolation /opt/nemoclaw-deepagents-profile-plugin",
          "find /opt/nemoclaw-deepagents-profile-plugin -type f -print | LC_ALL=C sort",
          "/opt/venv/bin/pip3 check",
          "/opt/venv/bin/python3 -I /opt/nemoclaw-deepagents-code/validate-nemotron-ultra-profile.py",
        ].every((s) => dockerfile.includes(s))).toBe(true);
    expect(
      dockerfile
        .split("\n")
        .filter((line) => line.startsWith("COPY agents/langchain-deepagents-code/profile-plugin")),
    ).toEqual([
      "COPY agents/langchain-deepagents-code/profile-plugin/pyproject.toml /opt/nemoclaw-deepagents-profile-plugin/",
      "COPY agents/langchain-deepagents-code/profile-plugin/src/nemoclaw_deepagents_profile/__init__.py /opt/nemoclaw-deepagents-profile-plugin/src/nemoclaw_deepagents_profile/",
    ]);
    expect(dockerfile).toContain(
      "rm -f /usr/local/bin/dcode /usr/local/bin/deepagents-code /opt/venv/bin/dcode /opt/venv/bin/deepagents-code",
    );
    expect(dockerfile).toContain(
      "COPY agents/langchain-deepagents-code/validate-progressive-tool-disclosure.py",
    );
    expect(dockerfile).toContain(
      "python3 /opt/nemoclaw-deepagents-code/validate-progressive-tool-disclosure.py",
    );
    expect(dockerfile).toContain(
      "rm -f /opt/nemoclaw-deepagents-code/validate-progressive-tool-disclosure.py",
    );
    expect(dockerfile).toContain(
      "rm -f /opt/nemoclaw-deepagents-code/validate-nemotron-ultra-profile.py",
    );
    expect(dockerfile).not.toContain("patch-nemotron-ultra-profile.py");
    expect(dockerfile).not.toContain("nemotron-ultra-harness-profile.py");
    expect(dockerfile).not.toContain("LICENSE.langchain-deepagents");
    expect(dockerfile).not.toContain("langchain-deepagents-MIT.txt");
    expect(dockerfile).toContain("COPY agents/langchain-deepagents-code/validate-observability.py");
    expect(dockerfile).toContain(
      "/opt/venv/bin/python3 -I /opt/nemoclaw-deepagents-code/validate-observability.py",
    );
    expect(dockerfile).toContain("rm -f /opt/nemoclaw-deepagents-code/validate-observability.py");
    expect(dockerfile).toContain("ARG NEMOCLAW_TOOL_DISCLOSURE=progressive");
    expect(dockerfile).toContain("NEMOCLAW_TOOL_DISCLOSURE=${NEMOCLAW_TOOL_DISCLOSURE}");
    expect(dockerfile).toContain("progressive|direct)");
    expect(launcher).toContain(
      'exec /opt/venv/bin/python3 -I "$MANAGED_SESSION_SUPERVISOR" "$MANAGED_DCODE_WRAPPER" "$@"',
    );
    expect(launcher).toContain(
      'readonly MANAGED_SESSION_SUPERVISOR="/usr/local/lib/nemoclaw/dcode-session-supervisor.py"',
    );
    expect(launcher).toContain(
      'status | whoami | identity | --version | -v | -V) exec "$MANAGED_DCODE_WRAPPER" "$@"',
    );
    expect(launcher).toContain("harden_resource_limits");
    expect(launcher).toContain("refusing to launch dcode unhardened");
  });

  it("exposes an exact managed MCP capability marker without starting dcode", () => {
    const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-dcode-mcp-capability-"));
    try {
      const { wrapperPath, ranMarker, authFile, codexAuthFile } = makeWrapperFixture(tempDir);
      fs.writeFileSync(authFile, '{"api_key":"forbidden"}\n', "utf8");
      fs.writeFileSync(codexAuthFile, '{"access_token":"forbidden"}\n', "utf8");
      const result = runWrapper(wrapperPath, ["--nemoclaw-mcp-capability"], {
        OPENAI_API_KEY: "forbidden",
        NEMOCLAW_DEEPAGENTS_CODE_AUTH_MODE: "invalid",
      });

      expect(result.status, result.stderr).toBe(0);
      expect(result.stdout).toBe("NEMOCLAW_DEEPAGENTS_MCP_CAPABILITY=2\n");
      expect(fs.existsSync(ranMarker)).toBe(false);
    } finally {
      fs.rmSync(tempDir, { recursive: true, force: true });
    }
  });

  it("keeps NemoClaw MCP state separate from user discovery", () => {
    const wrapper = readAgentFile("dcode-wrapper.sh");
    const managedRuntime = readAgentFile("managed-dcode-runtime.py");
    const patcher = readAgentFile("patch-managed-deepagents-code.py");
    const agent = loadAgent("langchain-deepagents-code");
    const managedPath = "/sandbox/.deepagents/.nemoclaw-mcp.json";

    // The pinned release's user/project .mcp.json files remain user-authored.
    // Managed images suppress discovery and pass only an integrity-bound
    // snapshot of NemoClaw's dedicated projection.
    expect(wrapper).toContain("extra_args=(--sandbox none --no-mcp)");
    expect(managedRuntime).toContain(`_MCP_CONFIG_FILE = Path("${managedPath}")`);
    expect(patcher).toContain("managed_mcp_config = _nemoclaw_managed_mcp_config_path()");
    expect(patcher).toContain("_nemoclaw_skip_launch_model");
    expect(managedRuntime).toContain("if not servers:\n        return None");
    expect(managedRuntime).toContain("or descriptor != _MANAGED_MCP_FD");
    expect(patcher).toContain("def discover_mcp_configs(");
    expect(patcher).toContain("return []");
    expect(agent.userManagedFiles).toContain(".deepagents/.mcp.json");
    expect(agent.userManagedFiles).not.toContain(".deepagents/.nemoclaw-mcp.json");
    expect(wrapper).not.toContain("--mcp-config /sandbox/.mcp.json");
    expect(wrapper).not.toContain("managed_mcp_config_path");
    expect(patcher).not.toContain('managed_mcp_config = "/sandbox/.mcp.json"');
  });

  it("puts the managed Python venv before system Python in every dcode entry path", () => {
    const baseDockerfile = readAgentFile("Dockerfile.base");
    const dockerfile = readAgentFile("Dockerfile");
    const startScript = readAgentFile("start.sh");
    const wrapper = readAgentFile("dcode-wrapper.sh");
    const pathContractFiles = [baseDockerfile, dockerfile, startScript, wrapper].join("\n");

    expect(baseDockerfile).toContain("VIRTUAL_ENV=/opt/venv");
    expect(dockerfile).toContain("VIRTUAL_ENV=/opt/venv");
    expect(baseDockerfile).toContain(`PATH="${DCODE_CANONICAL_PATH}"`);
    expect(dockerfile).toContain(`PATH="${DCODE_CANONICAL_PATH}"`);
    expect(startScript).toContain(`export PATH="${DCODE_CANONICAL_PATH}"`);
    expect(startScript).toContain(`printf '%s\\n' 'export PATH="${DCODE_CANONICAL_PATH}"'`);
    expect(wrapper).toContain(`export PATH="${DCODE_CANONICAL_PATH}"`);
    expect(pathContractFiles).not.toContain('PATH="/usr/local/bin:${PATH}"');
  });

  it("preseeds managed first-run state and a usable ripgrep binary (#6678)", () => {
    const baseDockerfile = readAgentFile("Dockerfile.base");

    expect(baseDockerfile).toContain("ripgrep=14.1.1-1+b4");
    expect(baseDockerfile).toContain(
      "printf '1\\n' > /sandbox/.deepagents/.state/onboarding_complete",
    );
  });

  it("keeps optional service egress out of the default policy and requires Landlock", () => {
    const basePolicyPath = path.join(
      repoRoot,
      "agents",
      "langchain-deepagents-code",
      "policy-additions.yaml",
    );
    const defaultPrepared = prepareInitialSandboxCreatePolicy(basePolicyPath, [], {
      agentName: "langchain-deepagents-code",
    });
    const tavilyPrepared = prepareInitialSandboxCreatePolicy(basePolicyPath, [], {
      agentName: "langchain-deepagents-code",
      additionalPresets: ["tavily"],
    });
    const defaultPolicy = YAML.parse(
      fs.readFileSync(defaultPrepared.policyPath, "utf8"),
    ) as EffectivePolicy;
    const tavilyPolicy = YAML.parse(
      fs.readFileSync(tavilyPrepared.policyPath, "utf8"),
    ) as EffectivePolicy;

    try {
      const defaultHosts = Object.values(defaultPolicy.network_policies ?? {}).flatMap((entry) =>
        (entry.endpoints ?? []).map((endpoint) => endpoint.host),
      );
      expect(defaultHosts).not.toEqual(
        expect.arrayContaining(["api.tavily.com", "api.smith.langchain.com", "supabase.co"]),
      );
      expect(defaultPolicy.filesystem_policy?.read_only).toEqual(
        expect.arrayContaining(["/usr", "/opt/venv", "/etc"]),
      );
      expect(defaultPolicy.landlock).toMatchObject({ compatibility: "strict" });

      const githubBinaries = policyBinaryPaths(defaultPolicy, "github");
      expect(githubBinaries).toEqual(
        expect.arrayContaining(["/usr/bin/git", "/usr/local/bin/dcode", "/opt/venv/bin/python3*"]),
      );
      expect(githubBinaries).not.toEqual(expect.arrayContaining(["/usr/bin/python3*"]));
      expect(githubBinaries).not.toEqual(expect.arrayContaining(["/usr/local/bin/python3*"]));
      expect(githubBinaries).not.toEqual(expect.arrayContaining(["/usr/local/lib/python3.13/**"]));

      const pypiBinaries = policyBinaryPaths(defaultPolicy, "pypi");
      expect(pypiBinaries).toEqual(
        expect.arrayContaining([
          "/opt/venv/bin/pip3",
          "/sandbox/**/bin/pip3",
          "/opt/venv/bin/python3*",
          "/sandbox/**/bin/python3*",
          "/usr/local/bin/dcode",
        ]),
      );
      expect(pypiBinaries).not.toEqual(expect.arrayContaining(["/usr/bin/python3*"]));
      expect(pypiBinaries).not.toEqual(expect.arrayContaining(["/usr/local/bin/python3*"]));
      expect(pypiBinaries).not.toEqual(expect.arrayContaining(["/usr/local/bin/pip3"]));
      expect(pypiBinaries).not.toEqual(expect.arrayContaining(["/usr/local/lib/python3.13/**"]));

      const defaultBinaries = Object.values(defaultPolicy.network_policies ?? {}).flatMap((entry) =>
        (entry.binaries ?? []).map((binary) => binary.path),
      );
      expect(defaultBinaries).not.toEqual(
        expect.arrayContaining(["/usr/local/bin/dcode.real", "dcode.upstream"]),
      );

      expect(tavilyPrepared.appliedPresets).toContain("tavily");
      expect(
        tavilyPolicy.network_policies?.tavily?.endpoints?.map((endpoint) => endpoint.host),
      ).toContain("api.tavily.com");
      expect(policyBinaryPaths(tavilyPolicy, "tavily")).toContain("/opt/venv/bin/python3*");
    } finally {
      defaultPrepared.cleanup?.();
      tavilyPrepared.cleanup?.();
    }
  });

  it("ships live policy behavior checks for Deep Agents Code", () => {
    const landlockCheck = fs.readFileSync(
      path.join(
        process.cwd(),
        "test",
        "e2e",
        "e2e-cloud-experimental",
        "checks",
        "05-deepagents-code-landlock-readonly.sh",
      ),
      "utf8",
    );
    const pythonEgressCheck = fs.readFileSync(
      path.join(
        process.cwd(),
        "test",
        "e2e",
        "e2e-cloud-experimental",
        "checks",
        "06-deepagents-code-python-egress.sh",
      ),
      "utf8",
    );
    const secretBoundaryCheck = fs.readFileSync(
      path.join(
        process.cwd(),
        "test",
        "e2e",
        "e2e-cloud-experimental",
        "checks",
        "08-deepagents-code-secret-boundary.sh",
      ),
      "utf8",
    );
    const tuiStartupCheck = fs.readFileSync(tuiStartupCheckPath, "utf8");

    for (const expected of [
      "test -d /sandbox/.deepagents && command -v dcode",
      "touch /sandbox/.deepagents/deepagents-landlock-test",
      "touch /usr/deepagents-landlock-test",
      "touch /opt/venv/deepagents-landlock-test",
      "touch /etc/deepagents-landlock-test",
      "touch /tmp/deepagents-landlock-test",
      "/usr is Landlock read-only for Deep Agents Code",
      "/opt/venv is Landlock read-only for Deep Agents Code",
      "/etc is Landlock read-only for Deep Agents Code",
    ]) {
      expect(landlockCheck).toContain(expected);
    }
    expect(pythonEgressCheck).toContain(`DCODE_CANONICAL_PATH="${DCODE_CANONICAL_PATH}"`);
    expect(pythonEgressCheck).not.toContain("mktemp");
    for (const expected of [
      'grep -Fxq "PATH=${DCODE_CANONICAL_PATH}"',
      'printf "PYTHON_REAL=%s\\n"',
      "^PYTHON=/opt/venv/bin/python3$",
      "^PIP=/opt/venv/bin/pip3$",
      "^USRLOCAL_COUNT=1$",
      "import urllib.error",
      "except urllib.error.HTTPError as exc:",
      "except urllib.error.URLError as exc:",
      "ERROR:URLError",
      "lacked denial evidence",
      "python_probe_source",
      'DCODE_MANAGED_EXEC="/usr/local/lib/nemoclaw/dcode-managed-exec"',
      "sandbox_exec_argv",
      'source="$(python_probe_source)"',
      '"$python_bin" -c "$source" "$url"',
      'expect_reached "arbitrary Python" "GitHub" "https://api.github.com/"',
      'expect_reached "arbitrary Python" "PyPI" "https://pypi.org/"',
      '"direct managed-exec Python"',
      '"/opt/venv/bin/python3"',
      'PROJECT_VENV="/sandbox/.nemoclaw-e2e-project-venv"',
      "python3 -m venv --copies",
      'expect_reached "project venv Python under /sandbox" "PyPI" "https://pypi.org/" "$PROJECT_PYTHON"',
      'expect_reached "project venv Python under /sandbox" "files.pythonhosted.org" "https://files.pythonhosted.org/" "$PROJECT_PYTHON"',
      'expect_blocked "project venv Python under /sandbox" "Tavily" "https://api.tavily.com/" "$PROJECT_PYTHON"',
      "https://api.tavily.com/",
      "https://api.smith.langchain.com/",
      "https://modelcontextprotocol.io/",
      "https://example.com/",
      "${actor} cannot reach ${label} without explicit policy",
    ]) {
      expect(pythonEgressCheck).toContain(expected);
    }
    expect(pythonEgressCheck).not.toContain("base64 -d");
    for (const expected of [
      "Case: Deep Agents Code dcode secret boundary",
      "env OPENAI_API_KEY=",
      "dcode -n 'Reply with the single word PING'",
      "dcode_secret_probe_runtime_env",
      "dcode_secret_probe_env_file",
      "remote_cmd=",
      "LOG_MARKER_FOUND:%s",
      "Keep secret injection, output capture, cleanup, and status reporting atomic",
      "NEMOCLAW_E2E_SECRET_BOUNDARY_SELF_TEST",
      "ATOMIC_COMMAND",
      "DCODE_EXIT:%s\\\\n",
      "DCODE_EXIT:0",
      "refusing to start",
      "NETWORK_LOG_PATTERN=",
      "AUDIT_NETWORK_LOG_PATTERN=",
      "NET:OPEN|inference\\\\.local|pypi\\\\.org",
      "integrate\\\\.api\\\\.nvidia\\\\.com",
      "/tmp/gateway.log",
      "/tmp/nemoclaw-start.log",
      "ocsf_json_enabled",
      'openshell logs "$SANDBOX_NAME" -n 500 --source all --since 2m',
      "AUDIT_LOG_READ:1",
      "LOG_MARKER_FOUND:1",
      "assert_no_rejected_interval_audit_logs",
      "assert_no_rejected_interval_network_logs",
      "sha256sum ${DEEPAGENTS_ENV_FILE@Q}",
    ]) {
      expect(secretBoundaryCheck).toContain(expected);
    }
    expect(tuiStartupCheck).toContain("Case: Deep Agents Code interactive TUI startup");
    expect(tuiStartupCheck).not.toContain("-nocase -re {(deep agents|");
    expect(tuiStartupCheck.indexOf("local expect_rc")).toBeLessThan(
      tuiStartupCheck.indexOf('run_tui_expect "$raw_capture_file"'),
    );
    for (const expected of [
      "test -d /sandbox/.deepagents && command -v dcode",
      "expect <<'EXPECT'",
      "set cmd [list openshell sandbox exec --name $sandbox --tty -- sh -lc",
      "spawn {*}$cmd",
      "NEMOCLAW_DCODE_PROBE:deepagents",
      "NEMOCLAW_DCODE_PROBE:other",
      "unable to probe sandbox",
      "unexpected sandbox probe output",
      "cd /sandbox; dcode",
      'NEMOCLAW_TUI_FIRST_RUN_PATTERN="$TUI_FIRST_RUN_PATTERN"',
      "-nocase -re $first_run_pattern",
      'append_marker $markers "NEMOCLAW_TUI_UNEXPECTED_FIRST_RUN"',
      "choose a recommended model",
      "exit 24",
      'send -- "\\003"\nafter 250\ncatch {send -- "\\003"}',
      'append_marker $markers "$expect_out(0,string)"',
      'append_marker $markers "NEMOCLAW_TUI_READY"',
      'append_marker $markers "NEMOCLAW_TUI_TIMEOUT"',
      'append_marker $markers "NEMOCLAW_TUI_EOF_BEFORE_READY"',
      'append_marker $markers "NEMOCLAW_TUI_EXIT_CAPTURED:$expect_out(1,string)"',
      'append_marker $markers "NEMOCLAW_TUI_EXIT_TIMEOUT"',
      'append_marker $markers "NEMOCLAW_TUI_EOF_BEFORE_EXIT"',
      'NEMOCLAW_TUI_MARKERS="$marker_capture_file"',
      'cat "$raw_capture_file" "$expect_log_file" "$marker_capture_file"',
      'print_sanitized_capture_excerpt "$plain_capture_file"',
      "DEEPAGENTS_TUI_TIMEOUT must be a positive integer",
      "strip_terminal_control_sequences",
      "is_tui_ready_capture",
      "redact_secrets_in_file",
      "trap cleanup_sensitive_captures EXIT",
      "cleanup_sensitive_captures",
      "${PREFIX}${suffix}.sanitized.log",
      "for session_index in 1 2",
      'wait_for_dcode_process_baseline "$baseline_process_count"',
      "secret-shaped value found in sanitized TUI capture",
      "nvapi-",
      "sk-",
    ]) {
      expect(tuiStartupCheck).toContain(expected);
    }
    const tavilyOptInCheck = fs.readFileSync(
      path.join(
        process.cwd(),
        "test",
        "e2e",
        "e2e-cloud-experimental",
        "checks",
        "09-deepagents-code-tavily-opt-in.sh",
      ),
      "utf8",
    );
    for (const expected of [
      "policy-add tavily --dry-run",
      "policy-add tavily --yes",
      /urllib\.request\.Request[\s\S]*method='POST'/,
      "python_probe_source",
      "sandbox_exec_argv",
      '"$python_bin" -c "$source" "$url"',
      "NEMOCLAW_E2E_TAVILY_SELF_TEST",
      "/opt/venv/",
      "managed Deep Agents Code python can reach Tavily",
      /python_probe .*api\.tavily\.com\/search.*python3/,
      "system Python remains blocked from Tavily after policy-add",
      "/sandbox/.nemoclaw-e2e-project-venv",
      "project venv Python under /sandbox remains blocked from Tavily after policy-add",
    ]) {
      expect(tavilyOptInCheck).toMatch(expected);
    }
    expect(tavilyOptInCheck).not.toContain("base64 -d");
    expect(cloudExperimentalChecksForOnboarding("cloud-langchain-deepagents-code")).toEqual([
      "test/e2e/e2e-cloud-experimental/checks/03-deepagents-code-nemotron-ultra-profile.sh",
      "test/e2e/e2e-cloud-experimental/checks/04-deepagents-code-fresh-reonboard.sh",
      "test/e2e/e2e-cloud-experimental/checks/05-deepagents-code-landlock-readonly.sh",
      "test/e2e/e2e-cloud-experimental/checks/06-deepagents-code-python-egress.sh",
      "test/e2e/e2e-cloud-experimental/checks/07-deepagents-code-headless-inference.sh",
      "test/e2e/e2e-cloud-experimental/checks/08-deepagents-code-secret-boundary.sh",
      "test/e2e/e2e-cloud-experimental/checks/09-deepagents-code-tavily-opt-in.sh",
      "test/e2e/e2e-cloud-experimental/checks/10-deepagents-code-tui-startup.sh",
      "test/e2e/e2e-cloud-experimental/checks/11-deepagents-code-observability.sh",
      "test/e2e/e2e-cloud-experimental/checks/12-deepagents-code-thread-auto-approval.sh",
    ]);
  });
  it.each(
    [
        'sandbox_exec "test -d /sandbox/.deepagents"',
        "command -v dcode",
        "dcode -n 'Reply with exactly one word: PONG' --json",
        "sandbox_login_exec",
        "sandbox_login_proxy_contract",
        "-u HTTP_PROXY -u HTTPS_PROXY -u NO_PROXY",
        "-u ALL_PROXY -u all_proxy",
        "-u http_proxy -u https_proxy -u no_proxy",
        'HOME=/sandbox bash -lc "$1"',
        'bash -lc "$1"',
        "NEMOCLAW_DCODE_PROXY_ENV_OK",
        "local contract_command",
        'sandbox_login_exec "$contract_command"',
        "sandbox_direct_dcode",
        '-- dcode "$@"',
        "sandbox_dcode_wrapper_contract",
        "NEMOCLAW_DCODE_WRAPPER_CHAIN_OK",
        "cmp -s /usr/local/lib/nemoclaw/dcode-managed-exec /usr/local/lib/nemoclaw/dcode-launcher.sh",
        "dcode_entrypoint_rlimit_contract_command",
        "sandbox_entrypoint_rlimit_contract",
        "nemoclaw-dcode-entrypoint",
        "NEMOCLAW_DCODE_ENTRYPOINT_RLIMIT_OK",
        "process-count",
        "rlimit_shell_contract_command",
        "sandbox_interactive_exec",
        "sandbox_direct_rlimit_exec",
        "/usr/local/lib/nemoclaw/dcode-managed-exec bash -c",
        "NEMOCLAW_DCODE_SHELL_RLIMIT_OK",
        "ulimit -Su 513",
        "ulimit -Sn 65537",
        "dcode entrypoint process tree enforces nproc=512 and nofile=65536",
        "dcode login shell enforces and cannot raise nproc/nofile limits",
        "dcode interactive/connect shell enforces and cannot raise nproc/nofile limits",
        "direct dcode launcher enforces and cannot raise nproc/nofile limits",
        "NEMOCLAW_DCODE_EMPTY_EXIT",
        "login-shell dcode rejects an empty non-interactive prompt with exit 2",
        "direct-exec dcode rejects an empty non-interactive prompt with exit 2",
        "write_openshell_target_shim",
        "OPENSHELL_NEMOCLAW_REAL_BIN",
        "OPENSHELL_NEMOCLAW_TARGET_TRACE",
        "validate_connect_target_trace",
        "NEMOCLAW_DCODE_CONNECT_TARGET_FAIL:missing",
        "NEMOCLAW_DCODE_CONNECT_TARGET_FAIL:mismatch",
        "nemoclaw_connect_probe",
        "unset SANDBOX_NAME NEMOCLAW_SANDBOX_NAME NEMOCLAW_SANDBOX",
        '"${NEMOCLAW_CLI_BIN:-${REPO:-.}/bin/nemoclaw.js}" connect --probe-only 2>&1',
        "bare connect targeted the Deep Agents Code sandbox",
        "${NEMOCLAW_CLI_BIN:-${REPO:-.}/bin/nemoclaw.js}",
        "connect --probe-only 2>&1",
        "dcode_connect_fail_closed_contract",
        "connect rejects untrusted image-backed route evidence before session attach",
        "direct-exec dcode -n reached managed inference",
        "connect --probe-only accepted the managed inference route",
        'sandbox_login_exec "cd /sandbox',
        "https://inference.local/v1/models",
        "HTTP_CODE:%{http_code}",
        '[ "$route_code" = "200" ]',
        "https://inference\\.local(/v1)?",
        "references_managed_placeholder_key",
        'api_key_env[[:space:]]*=[[:space:]]*"DEEPAGENTS_CODE_OPENAI_API_KEY"',
        "classify_headless_output",
        '"schema_version", "command", "data"',
        '"status"',
        '"exit_code"',
        '"response"',
        '"completion"',
        '"thread_id"',
        '"duration_ms"',
        '"response_bytes"',
        "NEMOCLAW_DCODE_DNS_PROBE_MISSING_GETENT",
        "required DNS diagnostic tool getent is unavailable",
        "NEMOCLAW_DCODE_DNS_PROBE_MISSING_TIMEOUT",
        "required DNS diagnostic tool timeout is unavailable",
        "DEEPAGENTS_HEADLESS_TIMEOUT must be a positive integer",
        "nvapi-",
        "nvcf-",
        "ghp_",
        "github_pat_",
        "sk-proj-",
        "sk-ant-",
        "xapp",
        "A(K|S)IA",
        "lsv2_(pt|sk)",
        "/tmp/nemoclaw-proxy-env.sh",
        "sandbox_artifact_scan_command",
        'cat /sandbox/.deepagents/config.toml 2>/dev/null" || true',
        "find /sandbox/.deepagents -maxdepth 3 -type f",
        '-name "*.log"',
      ],
  )("ships a headless inference acceptance check for Deep Agents Code [%s]", (expected) => {
    const headlessCheck = fs.readFileSync(headlessCheckPath, "utf8");
    const wrapperContract = headlessCheck.match(
      /sandbox_dcode_wrapper_contract\(\) \{(?<body>[\s\S]*?)\n\}/,
    )?.groups?.body;
    expect(wrapperContract).toContain("sandbox_direct_rlimit_exec");
    expect(wrapperContract).not.toMatch(/\bsandbox_exec /);

    expect(headlessCheck).toContain(expected);

    expect(headlessCheck).not.toContain(
      '"${NEMOCLAW_CLI_BIN:-${REPO:-.}/bin/nemoclaw.js}" "$SANDBOX_NAME" connect --probe-only',
    );
    const connectProbe = headlessCheck.slice(
      headlessCheck.indexOf("nemoclaw_connect_probe() {"),
      headlessCheck.indexOf("sandbox_login_proxy_contract() {"),
    );
    const shimWriteIndex = connectProbe.indexOf('write_openshell_target_shim "$shim_path"');
    const aliasUnsetIndex = connectProbe.indexOf(
      "unset SANDBOX_NAME NEMOCLAW_SANDBOX_NAME NEMOCLAW_SANDBOX",
    );
    const connectCommandIndex = connectProbe.indexOf(
      '"${NEMOCLAW_CLI_BIN:-${REPO:-.}/bin/nemoclaw.js}" connect --probe-only',
    );
    const traceValidationIndex = connectProbe.indexOf(
      'validate_connect_target_trace "$trace_file"',
    );
    expect(shimWriteIndex).toBeGreaterThan(-1);
    expect(aliasUnsetIndex).toBeGreaterThan(shimWriteIndex);
    expect(connectCommandIndex).toBeGreaterThan(aliasUnsetIndex);
    expect(traceValidationIndex).toBeGreaterThan(connectCommandIndex);
    expect(headlessCheck).not.toContain('sandbox_login_exec ". /tmp/nemoclaw-proxy-env.sh');
    expect(headlessCheck).not.toContain("config_output:0:200");
    expect(headlessCheck).toMatch(/headless_output=.*sandbox_login_exec.*\|\| true\)"/);
  });

  it("binds the live rlimit probe to one exact managed entrypoint process (#6545)", () => {
    const procRoot = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-dcode-proc-"));
    const limits = [
      "Limit Soft Limit Hard Limit Units",
      "Max processes 512 512 processes",
      "Max open files 65536 65536 files",
      "",
    ].join("\n");
    const writeProcess = (pid: number, argv: readonly string[], processLimits = limits) => {
      const procDir = path.join(procRoot, String(pid));
      fs.mkdirSync(procDir);
      fs.writeFileSync(path.join(procDir, "cmdline"), Buffer.from(`${argv.join("\0")}\0`));
      fs.writeFileSync(path.join(procDir, "limits"), processLimits, "utf8");
    };

    try {
      writeProcess(1, ["/opt/openshell/bin/openshell-sandbox"]);
      writeProcess(42, ["nemoclaw-dcode-entrypoint", "-f", "/dev/null"]);
      expect(runHeadlessCheckHelper("entrypoint-rlimits", { PROC_ROOT: procRoot })).toBe(
        "NEMOCLAW_DCODE_ENTRYPOINT_RLIMIT_OK\n",
      );

      writeProcess(43, ["nemoclaw-dcode-entrypoint", "-f", "/dev/null"]);
      expect(() => runHeadlessCheckHelper("entrypoint-rlimits", { PROC_ROOT: procRoot })).toThrow();
      fs.rmSync(path.join(procRoot, "43"), { force: true, recursive: true });

      fs.writeFileSync(
        path.join(procRoot, "42", "limits"),
        limits.replace("Max processes 512 512", "Max processes unlimited unlimited"),
        "utf8",
      );
      expect(() => runHeadlessCheckHelper("entrypoint-rlimits", { PROC_ROOT: procRoot })).toThrow();

      fs.writeFileSync(
        path.join(procRoot, "42", "limits"),
        limits.replace("Max open files 65536 65536", "Max open files 1024 1024"),
        "utf8",
      );
      expect(() => runHeadlessCheckHelper("entrypoint-rlimits", { PROC_ROOT: procRoot })).toThrow();
    } finally {
      fs.rmSync(procRoot, { force: true, recursive: true });
    }
  });

  it("requires the managed inference route and placeholder key in Deep Agents Code config", () => {
    expect(
      runHeadlessCheckHelper("managed-route", {
        CONFIG: 'base_url = "https://inference.local/v1"',
      }),
    ).toBe("route");
    expect(
      runHeadlessCheckHelper("managed-placeholder", {
        CONFIG: 'api_key_env = "DEEPAGENTS_CODE_OPENAI_API_KEY"',
      }),
    ).toBe("key");
  });

  it("rejects unsafe headless timeout values before sandbox execution", () => {
    const validate = (timeout: string) =>
      runHeadlessCheckHelper("positive-integer", { DEEPAGENTS_HEADLESS_TIMEOUT: timeout });

    expect(validate("120")).toBe("valid");
    expect(validate("0")).toBe("invalid");
    expect(validate("1; touch /tmp/nemoclaw-timeout-injection")).toBe("invalid");
  });

  it("detects representative secret families in headless inference artifacts", () => {
    const detectsSecret = (token: string) =>
      runHeadlessCheckHelper("contains-secret", { TOKEN: token });
    const secretSamples = [
      "nvapi-" + "A".repeat(10),
      "nvcf-" + "A".repeat(10),
      "ghp_" + "A".repeat(10),
      "github_pat_" + "A".repeat(30),
      "sk-proj-" + "A".repeat(10),
      "sk-ant-" + "A".repeat(10),
      "sk-" + "A".repeat(20),
      "xapp-" + "A".repeat(10),
      "ASIA" + "A".repeat(16),
    ];

    expect(secretSamples.every((sample) => Object.is(detectsSecret(sample), "secret"))).toBe(true);
    expect(detectsSecret("managed-placeholder-key")).toBe("clean");
  });

  it("makes the base image enforce the reviewed hash-locked dependency set", () => {
    const baseDockerfile = readAgentFile("Dockerfile.base");
    const requirementsLock = readAgentFile("requirements.lock");

    assertEveryRequirementIsHashLocked(requirementsLock);
    expect(baseDockerfile).not.toContain("--break-system-packages");
    expect(baseDockerfile).not.toContain("--ignore-installed");

    const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-pip-hash-contract-"));
    try {
      const venvPath = path.join(tempDir, "venv");
      execFileSync("python3", ["-m", "venv", venvPath], { stdio: "pipe" });
      const pipPath = path.join(venvPath, "bin", "pip3");
      const wheelPath = writeMinimalWheel(tempDir);
      const wheelDigest = sha256(fs.readFileSync(wheelPath));
      const hashedRequirements = path.join(tempDir, "hashed-requirements.txt");
      const unhashedRequirements = path.join(tempDir, "unhashed-requirements.txt");
      const requirement = `nemoclaw-hash-contract @ ${pathToFileURL(wheelPath).href}`;
      fs.writeFileSync(hashedRequirements, `${requirement} --hash=sha256:${wheelDigest}\n`, "utf8");
      fs.writeFileSync(unhashedRequirements, `${requirement}\n`, "utf8");

      const runPip = (requirementsPath: string) =>
        spawnSync(
          pipPath,
          [
            "install",
            "--dry-run",
            "--no-index",
            "--no-deps",
            ...baseImagePipInstallArgs(baseDockerfile, requirementsPath),
          ],
          { encoding: "utf8" },
        );
      const accepted = runPip(hashedRequirements);
      expect(accepted.status, `${accepted.stdout}\n${accepted.stderr}`).toBe(0);

      const rejected = runPip(unhashedRequirements);
      expect(rejected.status).not.toBe(0);
      expect(`${rejected.stdout}\n${rejected.stderr}`).toContain(
        "Hashes are required in --require-hashes mode",
      );
    } finally {
      fs.rmSync(tempDir, { recursive: true, force: true });
    }
  });

  it.each(
    [
        ["aiohttp", "3.14.3"],
        ["cryptography", "50.0.0"],
        ["deepagents-code", "0.1.34"],
        ["langgraph-checkpoint-sqlite", "3.1.1"],
    ] as const,
  )("records dependency advisory review for the lockfile [case %#]", (name, expectedVersion) => {
    const review = readAgentFile("dependency-review.md");
    const requirementsLock = readAgentFile("requirements.lock");
    const adapterModule = readAgentFile(
      "profile-plugin/src/nemoclaw_deepagents_profile/__init__.py",
    );
    const adapterMetadata = readAgentFile("profile-plugin/pyproject.toml");

    expect(review).toContain(`Lockfile SHA-256: \`${sha256(requirementsLock)}\``);
    expect(review).toContain(
      "uv tool run --python 3.13 pip-audit -r agents/langchain-deepagents-code/requirements.lock --progress-spinner off --disable-pip",
    );
    expect(review).toContain(
      "Targeted audit result: `aiohttp 3.14.3, cryptography 50.0.0, uv 0.11.33, langgraph-checkpoint-sqlite 3.1.1, MCP 1.28.1, Pillow 12.3.0, and pyasn1 0.6.4 have no known vulnerabilities`",
    );
    expect(review).toContain(
      "Complete-lock audit result: `2 duplicate records in 1 unrelated package`",
    );
    expect(review).toContain("`GHSA-cq5v-8q36-5273`");
    expect(review).toContain("`GHSA-g6cj-pr64-35w5`");
    expect(review).toContain("Deep Agents Code `0.1.45` and later");
    expect(review).toContain("semantic migration to `>=0.1.45`");
    expect(requirementsLock).toContain("uv==0.11.33");
    expect(requirementsLock).toContain("aiohttp==3.14.3");
    expect(requirementsLock).toContain("cryptography==50.0.0");
    expect(requirementsLock).not.toContain("aiohttp==3.14.1");
    expect(requirementsLock).not.toContain("cryptography==49.0.0");
    expect(requirementsLock).toContain("mcp==1.28.1");
    expect(requirementsLock).toContain("pillow==12.3.0");
    expect(requirementsLock).toContain("pyasn1==0.6.4");
    expect(requirementsLock).toContain("langgraph-checkpoint-sqlite==3.1.1");
    const dockerfileBase = readAgentFile("Dockerfile.base");

    expect(dockerfileBase).toContain(`'${name}': '${expectedVersion}'`);

    expect(review).toContain(`Adapter module SHA-256: \`${sha256(adapterModule)}\``);
    expect(review).toContain(`Adapter project metadata SHA-256: \`${sha256(adapterMetadata)}\``);
    expect(review).toContain("Adapter dependency audit result: `No known vulnerabilities found`");
  });
});