From a65c1ac8b267e2862ef6e20b3ede38903a4ee3df Mon Sep 17 00:00:00 2001
From: anandgupta42 <anand@altimate.ai>
Date: Fri, 27 Mar 2026 08:49:21 -0700
Subject: [PATCH 1/3] test: consolidate test coverage from 10 hourly PRs into
 single PR

Deduplicate overlapping tests from PRs #494, #499, #502, #504, #506,
#507, #508, #510, #511, #512. Most MongoDB/env-var/dbt coverage was
already on main; this adds only genuinely new tests:

- SSH tunnel: `extractSshConfig` validation + lifecycle safety (7 tests)
- dbt profiles: spark->databricks, trino->postgres adapter mapping
- `dbtConnectionsToConfigs` conversion + empty input handling
- `containerToConfig` with fully-populated container
- MongoDB assertions in `telemetry-safety.test.ts`
- Sanity suite: branding, deny, driver, resilience expansions (#494)

Closes #513

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .../test/altimate/connections.test.ts         | 109 ++++++++++++++++-
 .../opencode/test/altimate/ssh-tunnel.test.ts |  84 +++++++++++++
 .../test/altimate/telemetry-safety.test.ts    |   5 +
 test/sanity/Dockerfile                        |   7 +-
 test/sanity/ci-local.sh                       |  16 ++-
 test/sanity/docker-compose.yml                |  19 ++-
 test/sanity/phases/resilience.sh              | 110 ++++++++++++++----
 test/sanity/phases/smoke-tests.sh             |  98 +++++++++++++++-
 test/sanity/phases/verify-install.sh          |  67 +++++++++++
 test/sanity/pr-tests/generate.sh              |  20 ++++
 10 files changed, 495 insertions(+), 40 deletions(-)
 create mode 100644 packages/opencode/test/altimate/ssh-tunnel.test.ts

diff --git a/packages/opencode/test/altimate/connections.test.ts b/packages/opencode/test/altimate/connections.test.ts
index d4baede6ca..2fae89c911 100644
--- a/packages/opencode/test/altimate/connections.test.ts
+++ b/packages/opencode/test/altimate/connections.test.ts
@@ -12,7 +12,7 @@ afterAll(() => { delete process.env.ALTIMATE_TELEMETRY_DISABLED })
 import * as Registry from "../../src/altimate/native/connections/registry"
 import { detectAuthMethod } from "../../src/altimate/native/connections/registry"
 import * as CredentialStore from "../../src/altimate/native/connections/credential-store"
-import { parseDbtProfiles } from "../../src/altimate/native/connections/dbt-profiles"
+import { parseDbtProfiles, dbtConnectionsToConfigs } from "../../src/altimate/native/connections/dbt-profiles"
 import { discoverContainers, containerToConfig } from "../../src/altimate/native/connections/docker-discovery"
 import { registerAll } from "../../src/altimate/native/connections/register"
 
@@ -534,6 +534,91 @@ warehouse_b:
     }
   })
   // altimate_change end
+
+  test("spark adapter maps to databricks", async () => {
+    const fs = await import("fs")
+    const os = await import("os")
+    const path = await import("path")
+
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "dbt-test-"))
+    const profilesPath = path.join(tmpDir, "profiles.yml")
+
+    fs.writeFileSync(
+      profilesPath,
+      `
+spark_project:
+  outputs:
+    prod:
+      type: spark
+      server_hostname: my-spark-cluster.databricks.com
+      http_path: /sql/1.0/warehouses/abc123
+      token: dapi_secret
+`,
+    )
+
+    try {
+      const connections = await parseDbtProfiles(profilesPath)
+      expect(connections).toHaveLength(1)
+      expect(connections[0].type).toBe("databricks")
+      expect(connections[0].config.type).toBe("databricks")
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true })
+    }
+  })
+
+  test("trino adapter maps to postgres (wire-compatible)", async () => {
+    const fs = await import("fs")
+    const os = await import("os")
+    const path = await import("path")
+
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "dbt-test-"))
+    const profilesPath = path.join(tmpDir, "profiles.yml")
+
+    fs.writeFileSync(
+      profilesPath,
+      `
+trino_project:
+  outputs:
+    prod:
+      type: trino
+      host: trino.example.com
+      port: 8080
+      user: analyst
+      dbname: hive
+`,
+    )
+
+    try {
+      const connections = await parseDbtProfiles(profilesPath)
+      expect(connections).toHaveLength(1)
+      expect(connections[0].type).toBe("postgres")
+      expect(connections[0].config.type).toBe("postgres")
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true })
+    }
+  })
+})
+
+// ---------------------------------------------------------------------------
+// dbtConnectionsToConfigs
+// ---------------------------------------------------------------------------
+
+describe("dbtConnectionsToConfigs", () => {
+  test("converts connection array to keyed record", () => {
+    const connections = [
+      { name: "pg_dev", type: "postgres", config: { type: "postgres", host: "localhost" } },
+      { name: "sf_prod", type: "snowflake", config: { type: "snowflake", account: "abc" } },
+    ]
+    const result = dbtConnectionsToConfigs(connections)
+    expect(Object.keys(result)).toHaveLength(2)
+    expect(result["pg_dev"].type).toBe("postgres")
+    expect(result["sf_prod"].type).toBe("snowflake")
+  })
+
+  test("returns empty object for empty array", () => {
+    const result = dbtConnectionsToConfigs([])
+    expect(result).toEqual({})
+  })
 })
 
 // ---------------------------------------------------------------------------
@@ -546,6 +631,28 @@ describe("Docker discovery", () => {
     expect(containers).toEqual([])
   })
 
+  test("containerToConfig creates config with all fields from a fully-populated container", () => {
+    const container = {
+      container_id: "abc123def456",
+      name: "my-postgres",
+      image: "postgres:16",
+      db_type: "postgres",
+      host: "127.0.0.1",
+      port: 5432,
+      user: "admin",
+      password: "secret",
+      database: "mydb",
+      status: "running",
+    }
+    const config = containerToConfig(container as any)
+    expect(config.type).toBe("postgres")
+    expect(config.host).toBe("127.0.0.1")
+    expect(config.port).toBe(5432)
+    expect(config.user).toBe("admin")
+    expect(config.password).toBe("secret")
+    expect(config.database).toBe("mydb")
+  })
+
   test("containerToConfig omits undefined optional fields", () => {
     const container = {
       container_id: "def456",
diff --git a/packages/opencode/test/altimate/ssh-tunnel.test.ts b/packages/opencode/test/altimate/ssh-tunnel.test.ts
new file mode 100644
index 0000000000..8cf8b88e81
--- /dev/null
+++ b/packages/opencode/test/altimate/ssh-tunnel.test.ts
@@ -0,0 +1,84 @@
+// altimate_change start — unit tests for SSH tunnel config extraction and lifecycle
+import { describe, test, expect } from "bun:test"
+import { extractSshConfig, closeTunnel, getActiveTunnel } from "../../src/altimate/native/connections/ssh-tunnel"
+
+// ---------------------------------------------------------------------------
+// extractSshConfig — pure function that extracts SSH tunnel config
+// ---------------------------------------------------------------------------
+
+describe("extractSshConfig", () => {
+  test("returns null when no ssh_host is present", () => {
+    const result = extractSshConfig({ type: "postgres", host: "db.example.com", port: 5432 })
+    expect(result).toBeNull()
+  })
+
+  test("extracts full SSH config with all fields", () => {
+    const result = extractSshConfig({
+      type: "postgres",
+      host: "db.internal",
+      port: 5433,
+      ssh_host: "bastion.example.com",
+      ssh_port: 2222,
+      ssh_user: "deployer",
+      ssh_password: "secret",
+    })
+    expect(result).toEqual({
+      ssh_host: "bastion.example.com",
+      ssh_port: 2222,
+      ssh_user: "deployer",
+      ssh_password: "secret",
+      ssh_private_key: undefined,
+      host: "db.internal",
+      port: 5433,
+    })
+  })
+
+  test("applies defaults for ssh_port, ssh_user, host, port", () => {
+    const result = extractSshConfig({
+      type: "postgres",
+      ssh_host: "bastion.example.com",
+    })
+    expect(result).not.toBeNull()
+    expect(result!.ssh_port).toBe(22)
+    expect(result!.ssh_user).toBe("root")
+    expect(result!.host).toBe("127.0.0.1")
+    expect(result!.port).toBe(5432)
+  })
+
+  test("throws when connection_string is used with SSH tunnel", () => {
+    expect(() => extractSshConfig({
+      type: "postgres",
+      ssh_host: "bastion.example.com",
+      connection_string: "postgresql://user:pass@host:5432/db",
+    })).toThrow("Cannot use SSH tunnel with connection_string")
+  })
+
+  test("supports private key authentication", () => {
+    const result = extractSshConfig({
+      type: "snowflake",
+      host: "db.internal",
+      port: 443,
+      ssh_host: "bastion.example.com",
+      ssh_private_key: "-----BEGIN OPENSSH PRIVATE KEY-----\nAAA...",
+    })
+    expect(result).not.toBeNull()
+    expect(result!.ssh_private_key).toBe("-----BEGIN OPENSSH PRIVATE KEY-----\nAAA...")
+    expect(result!.ssh_password).toBeUndefined()
+  })
+})
+
+// ---------------------------------------------------------------------------
+// closeTunnel / getActiveTunnel — idempotent operations on empty state
+// ---------------------------------------------------------------------------
+
+describe("SSH tunnel state management", () => {
+  test("closeTunnel is a no-op for non-existent tunnel", () => {
+    closeTunnel("nonexistent-tunnel-name")
+    expect(getActiveTunnel("nonexistent-tunnel-name")).toBeUndefined()
+  })
+
+  test("getActiveTunnel returns undefined for non-existent tunnel", () => {
+    expect(getActiveTunnel("nonexistent")).toBeUndefined()
+  })
+})
+// altimate_change end
diff --git a/packages/opencode/test/altimate/telemetry-safety.test.ts b/packages/opencode/test/altimate/telemetry-safety.test.ts
index c268047ed0..a4fd78ba3f 100644
--- a/packages/opencode/test/altimate/telemetry-safety.test.ts
+++ b/packages/opencode/test/altimate/telemetry-safety.test.ts
@@ -59,6 +59,11 @@ describe("Telemetry Safety: Helper functions never throw", () => {
     expect(detectAuthMethod({ type: "duckdb" })).toBe("file")
     expect(detectAuthMethod({ type: "sqlite" })).toBe("file")
     expect(detectAuthMethod({ type: "postgres" })).toBe("unknown")
+    // MongoDB auth detection
+    expect(detectAuthMethod({ type: "mongodb", connection_string: "mongodb://localhost" })).toBe("connection_string")
+    expect(detectAuthMethod({ type: "mongodb", password: "secret" })).toBe("password")
+    expect(detectAuthMethod({ type: "mongodb" })).toBe("connection_string")
+    expect(detectAuthMethod({ type: "mongo" })).toBe("connection_string")
     // Edge cases
     expect(detectAuthMethod({} as any)).toBe("unknown")
     expect(detectAuthMethod({ type: "" })).toBe("unknown")
diff --git a/test/sanity/Dockerfile b/test/sanity/Dockerfile
index 49003e500c..928e185a87 100644
--- a/test/sanity/Dockerfile
+++ b/test/sanity/Dockerfile
@@ -24,7 +24,12 @@ COPY --chown=testuser packages/opencode/script/postinstall.mjs /home/testuser/.a
 COPY --chown=testuser packages/opencode/package.json /home/testuser/.altimate-install/package.json
 COPY --chown=testuser .opencode/skills/ /home/testuser/.altimate-install/skills/
 
-# Install altimate-core native binding (required at runtime)
+# Install altimate-core native binding (required at runtime).
+# NOTE: Database drivers (pg, snowflake-sdk, mysql2, etc.) are NOT installed here
+# because a real `npm install -g altimate-code` doesn't install them either —
+# they're optionalDependencies in the workspace @altimateai/drivers package which
+# is never published. This is issue #295. Driver resolvability tests are expected
+# to FAIL here, proving the bug exists for real users.
 RUN cd /home/testuser/.altimate-install && \
     echo '{"dependencies":{"@altimateai/altimate-core":"latest"}}' > package.json && \
     bun install && \
diff --git a/test/sanity/ci-local.sh b/test/sanity/ci-local.sh
index 90a399fad1..6217ba1b2d 100755
--- a/test/sanity/ci-local.sh
+++ b/test/sanity/ci-local.sh
@@ -56,25 +56,25 @@ if [ "$MODE" = "--full" ] || [ "$MODE" = "full" ]; then
   echo "=== Full CI (Docker) ==="
 
   # Driver E2E with Docker containers
-  run_step "Docker Services Up" docker compose -f "$REPO_ROOT/test/sanity/docker-compose.yml" up -d postgres mysql mssql redshift
+  run_step "Docker Services Up" docker compose -f "$REPO_ROOT/test/sanity/docker-compose.yml" up -d postgres mysql mssql redshift mongodb
 
   echo "  Waiting for services to be healthy..."
   HEALTHY=0
   for _wait in $(seq 1 30); do
     HEALTHY=$(docker compose -f "$REPO_ROOT/test/sanity/docker-compose.yml" ps --format json 2>/dev/null | grep -c '"healthy"' || echo "0")
-    if [ "$HEALTHY" -ge 4 ]; then break; fi
+    if [ "$HEALTHY" -ge 5 ]; then break; fi
     sleep 2
   done
 
-  if [ "$HEALTHY" -lt 4 ]; then
-    echo "  >>> Docker Services: FAILED ($HEALTHY/4 healthy after 60s)"
+  if [ "$HEALTHY" -lt 5 ]; then
+    echo "  >>> Docker Services: FAILED ($HEALTHY/5 healthy after 60s)"
     EXIT_CODE=1
   else
-    echo "  >>> Docker Services: $HEALTHY/4 healthy"
+    echo "  >>> Docker Services: $HEALTHY/5 healthy"
   fi
 
   # Skip driver tests if services aren't healthy
-  if [ "$HEALTHY" -lt 4 ]; then
+  if [ "$HEALTHY" -lt 5 ]; then
     echo "  SKIP: Driver E2E tests (services not healthy)"
   else
 
@@ -88,6 +88,10 @@ if [ "$MODE" = "--full" ] || [ "$MODE" = "full" ]; then
     TEST_REDSHIFT_HOST=127.0.0.1 TEST_REDSHIFT_PORT=15439 TEST_REDSHIFT_PASSWORD=testpass123 \
     bun test test/altimate/drivers-docker-e2e.test.ts --timeout 30000"
 
+  run_step "Driver E2E (mongodb)" bash -c "cd $REPO_ROOT/packages/opencode && \
+    TEST_MONGODB_HOST=127.0.0.1 TEST_MONGODB_PORT=17017 \
+    bun test test/altimate/drivers-mongodb-e2e.test.ts --timeout 30000"
+
   # Full sanity suite in Docker
   run_step "Sanity Suite (Docker)" docker compose -f "$REPO_ROOT/test/sanity/docker-compose.yml" \
     up --build --abort-on-container-exit --exit-code-from sanity
diff --git a/test/sanity/docker-compose.yml b/test/sanity/docker-compose.yml
index 4ead710fa2..217e9a9cf0 100644
--- a/test/sanity/docker-compose.yml
+++ b/test/sanity/docker-compose.yml
@@ -18,15 +18,15 @@ services:
       - TEST_REDSHIFT_HOST=redshift
       - TEST_REDSHIFT_PORT=5432
       - TEST_REDSHIFT_PASSWORD=testpass123
+      - TEST_MONGODB_HOST=mongodb
+      - TEST_MONGODB_PORT=27017
     depends_on:
       postgres:
         condition: service_healthy
-      mysql:
-        condition: service_healthy
-      mssql:
-        condition: service_healthy
-      redshift:
+      mongodb:
         condition: service_healthy
+      # mysql, mssql, redshift are for driver E2E tests (ci-local.sh --full),
+      # not the sanity shell scripts. Don't block sanity on them.
 
   postgres:
     image: postgres:16-alpine
@@ -74,3 +74,12 @@ services:
       test: pg_isready
       interval: 5s
       retries: 10
+
+  mongodb:
+    image: mongo:7
+    ports:
+      - "17017:27017"
+    healthcheck:
+      test: mongosh --eval "db.adminCommand('ping')" --quiet
+      interval: 5s
+      retries: 10
diff --git a/test/sanity/phases/resilience.sh b/test/sanity/phases/resilience.sh
index a31d72d9ac..efa96edda5 100755
--- a/test/sanity/phases/resilience.sh
+++ b/test/sanity/phases/resilience.sh
@@ -23,7 +23,7 @@ echo '{}' > package.json
 git add -A && git commit -q -m "init"
 
 # 1. SQLite DB created after first run
-echo "  [1/7] SQLite DB creation..."
+echo "  [1/10] SQLite DB creation..."
 if [ -n "${ANTHROPIC_API_KEY:-}" ]; then
   altimate_run "db-create" "say hello" || true
   # Find the DB — could be opencode.db, opencode-latest.db, or opencode-{channel}.db
@@ -42,7 +42,7 @@ else
 fi
 
 # 2. WAL mode enabled
-echo "  [2/7] WAL mode..."
+echo "  [2/10] WAL mode..."
 if [ -n "$DB_PATH" ] && [ -f "$DB_PATH" ] && command -v sqlite3 >/dev/null 2>&1; then
   WAL_MODE=$(sqlite3 "$DB_PATH" "PRAGMA journal_mode;" 2>/dev/null || echo "unknown")
   assert_eq "$WAL_MODE" "wal" "WAL mode enabled"
@@ -51,7 +51,7 @@ else
 fi
 
 # 3. Session persisted
-echo "  [3/7] Session persistence..."
+echo "  [3/10] Session persistence..."
 if [ -n "$DB_PATH" ] && [ -f "$DB_PATH" ] && command -v sqlite3 >/dev/null 2>&1; then
   SESSION_COUNT=$(sqlite3 "$DB_PATH" "SELECT count(*) FROM session;" 2>/dev/null || echo "0")
   assert_ge "$SESSION_COUNT" 1 "session persisted (got $SESSION_COUNT)"
@@ -60,7 +60,7 @@ else
 fi
 
 # 4. Session continue (DB survives restart)
-echo "  [4/7] Session continue..."
+echo "  [4/10] Session continue..."
 if [ -n "${ANTHROPIC_API_KEY:-}" ]; then
   altimate_run "continue" --continue "what was my last message" || true
   assert_not_contains "$(get_output continue)" "TIMEOUT" "session continue works"
@@ -69,7 +69,7 @@ else
 fi
 
 # 5. Compaction doesn't crash (best-effort — seed if fixture available)
-echo "  [5/7] Compaction resilience..."
+echo "  [5/10] Compaction resilience..."
 if [ -n "$DB_PATH" ] && [ -f "$SCRIPT_DIR/fixtures/compaction-session.sql" ] && command -v sqlite3 >/dev/null 2>&1; then
   sqlite3 "$DB_PATH" < "$SCRIPT_DIR/fixtures/compaction-session.sql" 2>/dev/null || true
   if [ -n "${ANTHROPIC_API_KEY:-}" ]; then
@@ -90,20 +90,8 @@ else
   skip_test "Compaction resilience" "fixture or sqlite3 not available"
 fi
 
-# 6. Graceful on missing provider key
-echo "  [6/7] Missing API key handling..."
-SAVED_KEY="${ANTHROPIC_API_KEY:-}"
-unset ANTHROPIC_API_KEY
-OUTPUT=$(timeout 10 altimate run --max-turns 1 --yolo "hello" 2>&1 || true)
-# Should get a clean error, not an unhandled exception / stack trace
-assert_not_contains "$OUTPUT" "TypeError" "no TypeError on missing key"
-assert_not_contains "$OUTPUT" "Cannot read properties" "no unhandled error on missing key"
-if [ -n "$SAVED_KEY" ]; then
-  export ANTHROPIC_API_KEY="$SAVED_KEY"
-fi
-
-# 7. Config backwards compatibility
-echo "  [7/7] Config backwards compat..."
+# 6. Config backwards compatibility
+echo "  [6/10] Config backwards compat..."
 CONFIG_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/altimate-code"
 mkdir -p "$CONFIG_DIR"
 if [ -f "$SCRIPT_DIR/fixtures/old-config.json" ]; then
@@ -119,8 +107,8 @@ else
   skip_test "Config backwards compat" "old-config.json fixture not found"
 fi
 
-# 8. Broken config graceful handling
-echo "  [8/8] Broken config handling..."
+# 7. Broken config graceful handling
+echo "  [7/10] Broken config handling..."
 if [ -f "$SCRIPT_DIR/fixtures/broken-config.json" ]; then
   cp "$SCRIPT_DIR/fixtures/broken-config.json" "$CONFIG_DIR/opencode.json"
   if [ -n "${ANTHROPIC_API_KEY:-}" ]; then
@@ -135,6 +123,86 @@ else
   skip_test "Broken config handling" "broken-config.json fixture not found"
 fi
 
+# 8. Yolo deny enforcement — deny rules block even with --yolo (#372, #377)
+echo "  [8/10] Yolo deny enforcement..."
+if [ -n "${ANTHROPIC_API_KEY:-}" ]; then
+  # Create a config with an explicit deny rule
+  # App reads from $XDG_CONFIG_HOME/altimate-code/opencode.jsonc
+  DENY_CONFIG_DIR=$(mktemp -d /tmp/sanity-deny-config-XXXXXX)
+  DENY_MARKER="$DENY_CONFIG_DIR/deny-marker"
+  mkdir -p "$DENY_CONFIG_DIR/altimate-code"
+  cat > "$DENY_CONFIG_DIR/altimate-code/opencode.jsonc" <<DENYEOF
+{
+  "permission": {
+    "bash": {
+      "*": "allow",
+      "touch ${DENY_MARKER}": "deny",
+      "touch /tmp/sanity-deny-*": "deny"
+    }
+  }
+}
+DENYEOF
+  # Use an observable side-effect: deny "touch" on a marker file.
+  # If deny enforcement works, the marker file will NOT be created.
+  DENY_OUTPUT=$(XDG_CONFIG_HOME="$DENY_CONFIG_DIR" timeout 30 altimate run --max-turns 2 --yolo --format json \
+    "run this exact bash command: touch $DENY_MARKER" 2>&1 || true)
+  # Primary check: the marker file must not exist (deny blocked execution)
+  if [ -f "$DENY_MARKER" ]; then
+    echo "  FAIL: yolo mode bypassed deny rule — denied command was executed"
+    FAIL_COUNT=$((FAIL_COUNT + 1))
+  elif echo "$DENY_OUTPUT" | grep -qi "denied\|blocked\|BLOCKED by deny rule\|not allowed"; then
+    echo "  PASS: yolo deny rule explicitly blocked command"
+    PASS_COUNT=$((PASS_COUNT + 1))
+  elif [ -z "$DENY_OUTPUT" ]; then
+    echo "  FAIL: no output from deny enforcement test"
+    FAIL_COUNT=$((FAIL_COUNT + 1))
+  else
+    # Model may have refused on its own — marker absent so still safe
+    echo "  PASS: yolo deny rule (command not executed, marker absent)"
+    PASS_COUNT=$((PASS_COUNT + 1))
+  fi
+  rm -rf "$DENY_CONFIG_DIR"
+else
+  skip_test "Yolo deny enforcement" "no ANTHROPIC_API_KEY"
+fi
+
+# 9. Missing API key handling (no unhandled exceptions)
+echo "  [9/10] Missing API key handling..."
+SAVED_KEY="${ANTHROPIC_API_KEY:-}"
+unset ANTHROPIC_API_KEY
+OUTPUT=$(timeout 10 altimate run --max-turns 1 --yolo "hello" 2>&1 || true)
+assert_not_contains "$OUTPUT" "TypeError" "no TypeError on missing key"
+assert_not_contains "$OUTPUT" "Cannot read properties" "no unhandled error on missing key"
+if [ -n "$SAVED_KEY" ]; then
+  export ANTHROPIC_API_KEY="$SAVED_KEY"
+fi
+
+# 10. No internet — graceful error, not blank screen (#181)
+echo "  [10/10] No internet graceful handling..."
+# Block all outbound HTTPS via multiple methods for reliability:
+# - Set both lowercase and uppercase proxy vars to unreachable TEST-NET-1
+# - Clear NO_PROXY to prevent bypass
+# - Use unshare --net if available (network namespace isolation — most reliable)
+if command -v unshare >/dev/null 2>&1; then
+  NO_NET_OUTPUT=$(timeout 15 unshare --net altimate run --max-turns 1 --yolo "hello" 2>&1 || true)
+else
+  NO_NET_OUTPUT=$(timeout 15 env \
+    https_proxy=http://192.0.2.1:1 http_proxy=http://192.0.2.1:1 \
+    HTTPS_PROXY=http://192.0.2.1:1 HTTP_PROXY=http://192.0.2.1:1 \
+    ALL_PROXY=http://192.0.2.1:1 NO_PROXY="" \
+    altimate run --max-turns 1 --yolo "hello" 2>&1 || true)
+fi
+assert_not_contains "$NO_NET_OUTPUT" "TypeError" "no TypeError without internet"
+assert_not_contains "$NO_NET_OUTPUT" "Cannot read properties" "no unhandled error without internet"
+# Should get some kind of connection/auth error, not a blank hang
+if [ -z "$NO_NET_OUTPUT" ]; then
+  echo "  FAIL: no output at all without internet (blank screen)"
+  FAIL_COUNT=$((FAIL_COUNT + 1))
+else
+  echo "  PASS: produced output without internet ($(echo "$NO_NET_OUTPUT" | wc -l) lines)"
+  PASS_COUNT=$((PASS_COUNT + 1))
+fi
+
 # Cleanup
 rm -rf "$WORKDIR"
 
diff --git a/test/sanity/phases/smoke-tests.sh b/test/sanity/phases/smoke-tests.sh
index 72a5aba532..c6c0ef9678 100755
--- a/test/sanity/phases/smoke-tests.sh
+++ b/test/sanity/phases/smoke-tests.sh
@@ -79,12 +79,19 @@ test_duckdb() {
 }
 
 test_postgres() {
-  if [ -z "${TEST_PG_HOST:-}" ]; then
-    echo "SKIP" > "$RESULTS_DIR/postgres"
-    return
+  # Use env vars if set (Docker compose), else probe local Docker port
+  local pg_host="${TEST_PG_HOST:-}"
+  local pg_port="${TEST_PG_PORT:-5432}"
+  if [ -z "$pg_host" ]; then
+    if timeout 2 bash -c "echo >/dev/tcp/127.0.0.1/15432" 2>/dev/null; then
+      pg_host="127.0.0.1"; pg_port="15432"
+    else
+      echo "SKIP" > "$RESULTS_DIR/postgres"
+      return
+    fi
   fi
   cd "$WORKDIR" || return 1
-  altimate_run "postgres" "run SELECT 1 against postgres at ${TEST_PG_HOST}:${TEST_PG_PORT:-5432}"
+  altimate_run "postgres" "run SELECT 1 against postgres at ${pg_host}:${pg_port}"
   local output=$(get_output "postgres")
   if echo "$output" | grep -qi "TIMEOUT\|unhandled"; then
     echo "FAIL" > "$RESULTS_DIR/postgres"
@@ -94,9 +101,19 @@ test_postgres() {
 }
 
 test_snowflake() {
+  # Snowflake requires real cloud credentials — cannot be Docker'd.
+  # Accepts either ALTIMATE_CODE_CONN_SNOWFLAKE_TEST (JSON config) or
+  # individual SNOWFLAKE_ACCOUNT/USER/PASSWORD env vars.
   if [ -z "${ALTIMATE_CODE_CONN_SNOWFLAKE_TEST:-}" ]; then
-    echo "SKIP" > "$RESULTS_DIR/snowflake"
-    return
+    if [ -n "${SNOWFLAKE_ACCOUNT:-}" ] && [ -n "${SNOWFLAKE_USER:-}" ] && [ -n "${SNOWFLAKE_PASSWORD:-}" ]; then
+      export ALTIMATE_CODE_CONN_SNOWFLAKE_TEST=$(cat <<SFEOF
+{"type":"snowflake","account":"${SNOWFLAKE_ACCOUNT}","user":"${SNOWFLAKE_USER}","password":"${SNOWFLAKE_PASSWORD}","warehouse":"${SNOWFLAKE_WAREHOUSE:-COMPUTE_WH}","role":"${SNOWFLAKE_ROLE:-PUBLIC}"}
+SFEOF
+      )
+    else
+      echo "SKIP" > "$RESULTS_DIR/snowflake"
+      return
+    fi
   fi
   cd "$WORKDIR" || return 1
   altimate_run "snowflake" "run SELECT 1 against snowflake"
@@ -108,6 +125,28 @@ test_snowflake() {
   fi
 }
 
+test_mongodb() {
+  # Use env vars if set (Docker compose), else probe local Docker port
+  local mongo_host="${TEST_MONGODB_HOST:-}"
+  local mongo_port="${TEST_MONGODB_PORT:-27017}"
+  if [ -z "$mongo_host" ]; then
+    if timeout 2 bash -c "echo >/dev/tcp/127.0.0.1/17017" 2>/dev/null; then
+      mongo_host="127.0.0.1"; mongo_port="17017"
+    else
+      echo "SKIP" > "$RESULTS_DIR/mongodb"
+      return
+    fi
+  fi
+  cd "$WORKDIR" || return 1
+  altimate_run "mongodb" "run a find command on the admin database against mongodb at ${mongo_host}:${mongo_port}"
+  local output=$(get_output "mongodb")
+  if echo "$output" | grep -qi "TIMEOUT\|unhandled\|driver not installed"; then
+    echo "FAIL" > "$RESULTS_DIR/mongodb"
+  else
+    echo "PASS" > "$RESULTS_DIR/mongodb"
+  fi
+}
+
 test_builder() {
   cd "$WORKDIR"
   altimate_run "builder" --agent builder "say hello"
@@ -152,6 +191,47 @@ test_discover() {
   fi
 }
 
+test_dbt_discover() {
+  # Use isolated workdir to avoid race conditions with parallel tests (#448, #270)
+  local dbt_dir=$(mktemp -d /tmp/sanity-dbt-XXXXXX)
+  cd "$dbt_dir"
+  git init -q
+  git config user.name "sanity-test"
+  git config user.email "sanity@test.local"
+  echo '{}' > package.json
+  mkdir -p models
+  cat > dbt_project.yml <<'DBTEOF'
+name: sanity_test
+version: '1.0.0'
+config-version: 2
+profile: sanity_test
+DBTEOF
+  cat > models/test_model.sql <<'SQLEOF'
+SELECT 1 AS id
+SQLEOF
+  git add -A && git commit -q -m "add dbt project"
+  SANITY_TIMEOUT=90 altimate_run_with_turns "dbt-discover" 2 "discover dbt project config in this repo" || true
+  local output=$(get_output "dbt-discover")
+  if echo "$output" | grep -qi "unhandled\|TypeError\|Cannot read"; then
+    echo "FAIL" > "$RESULTS_DIR/dbt-discover"
+  else
+    echo "PASS" > "$RESULTS_DIR/dbt-discover"
+  fi
+  rm -rf "$dbt_dir"
+}
+
+test_check_command() {
+  cd "$WORKDIR"
+  # altimate-code check should run deterministic SQL checks without LLM (#453)
+  echo "SELECT * FROM users WHERE 1=1;" > check_target.sql
+  local output=$(timeout 30 altimate check check_target.sql 2>&1 || true)
+  if echo "$output" | grep -qi "TypeError\|unhandled\|Cannot read properties"; then
+    echo "FAIL" > "$RESULTS_DIR/check-cmd"
+  else
+    echo "PASS" > "$RESULTS_DIR/check-cmd"
+  fi
+}
+
 # Run tests in parallel batches
 echo ""
 echo "  Running $MAX_PARALLEL tests concurrently..."
@@ -164,10 +244,13 @@ TESTS=(
   "test_duckdb"
   "test_postgres"
   "test_snowflake"
+  "test_mongodb"
   "test_builder"
   "test_analyst"
   "test_bad_command"
   "test_discover"
+  "test_dbt_discover"
+  "test_check_command"
 )
 
 TEST_NAMES=(
@@ -177,10 +260,13 @@ TEST_NAMES=(
   "duckdb"
   "postgres"
   "snowflake"
+  "mongodb"
   "builder"
   "analyst"
   "bad-cmd"
   "discover"
+  "dbt-discover"
+  "check-cmd"
 )
 
 # Launch in batches of MAX_PARALLEL
diff --git a/test/sanity/phases/verify-install.sh b/test/sanity/phases/verify-install.sh
index a8d31fb87e..7dbedb721f 100755
--- a/test/sanity/phases/verify-install.sh
+++ b/test/sanity/phases/verify-install.sh
@@ -41,4 +41,71 @@ fi
 # 9. git available (needed for project detection)
 assert_exit_0 "git CLI available" git --version
 
+# 10. Version matches semver format (X.Y.Z) — catches #212 regressions
+VERSION_CLEAN=$(echo "$VERSION" | head -1 | tr -d '[:space:]')
+if echo "$VERSION_CLEAN" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+'; then
+  echo "  PASS: version is semver ($VERSION_CLEAN)"
+  PASS_COUNT=$((PASS_COUNT + 1))
+else
+  echo "  FAIL: version is not semver (got '$VERSION_CLEAN')"
+  FAIL_COUNT=$((FAIL_COUNT + 1))
+fi
+
+# 11. --help output doesn't contain upstream "opencode" branding (#416, #417)
+# Legitimate internal names (.opencode/, opencode.json, @opencode-ai/) are allowed;
+# user-facing prose like "opencode is a..." or "start opencode" is not.
+HELP_OUTPUT=$(altimate --help 2>&1 || echo "")
+BRANDING_LEAKS=$(echo "$HELP_OUTPUT" | grep -iE 'opencode' | grep -ivE '\.opencode|opencode\.json[c]?|@opencode-ai|opencode\.local|OPENCODE_' || true)
+if [ -z "$BRANDING_LEAKS" ]; then
+  echo "  PASS: --help has no upstream branding leaks"
+  PASS_COUNT=$((PASS_COUNT + 1))
+else
+  echo "  FAIL: --help contains upstream branding:"
+  echo "$BRANDING_LEAKS" | head -5 | sed 's/^/    /'
+  FAIL_COUNT=$((FAIL_COUNT + 1))
+fi
+
+# 12. No "opencode" in welcome/hint strings visible at startup
+# Check the binary's embedded strings for user-facing "opencode" references
+SUBCOMMAND_HELP=$(altimate run --help 2>&1 || echo "")
+SUBCOMMAND_LEAKS=$(echo "$SUBCOMMAND_HELP" | grep -iE 'opencode' | grep -ivE '\.opencode|opencode\.json[c]?|@opencode-ai|opencode\.local|OPENCODE_' || true)
+if [ -z "$SUBCOMMAND_LEAKS" ]; then
+  echo "  PASS: 'altimate run --help' has no upstream branding leaks"
+  PASS_COUNT=$((PASS_COUNT + 1))
+else
+  echo "  FAIL: 'altimate run --help' contains upstream branding:"
+  echo "$SUBCOMMAND_LEAKS" | head -5 | sed 's/^/    /'
+  FAIL_COUNT=$((FAIL_COUNT + 1))
+fi
+
+# 13. Database driver packages resolvable (#295)
+# All drivers use dynamic import() at runtime — if the package can't be resolved,
+# the tool fails with "driver not installed". This catches the #295 regression
+# where published binaries don't ship driver dependencies.
+echo "  --- Driver Resolvability ---"
+
+DRIVERS=(
+  "pg:pg"
+  "snowflake-sdk:snowflake"
+  "mysql2:mysql"
+  "mssql:sqlserver"
+  "duckdb:duckdb"
+  "mongodb:mongodb"
+  "@google-cloud/bigquery:bigquery"
+  "@databricks/sql:databricks"
+  "oracledb:oracle"
+)
+
+for entry in "${DRIVERS[@]}"; do
+  pkg="${entry%%:*}"
+  label="${entry##*:}"
+  if node -e "require('$pkg')" 2>/dev/null; then
+    echo "  PASS: $label driver resolvable ($pkg)"
+    PASS_COUNT=$((PASS_COUNT + 1))
+  else
+    echo "  FAIL: $label driver not resolvable ($pkg)"
+    FAIL_COUNT=$((FAIL_COUNT + 1))
+  fi
+done
+
 report_results "Phase 1: Verify Installation"
diff --git a/test/sanity/pr-tests/generate.sh b/test/sanity/pr-tests/generate.sh
index 494d41ca15..ef0d08c3d6 100755
--- a/test/sanity/pr-tests/generate.sh
+++ b/test/sanity/pr-tests/generate.sh
@@ -75,6 +75,26 @@ if echo "$changed" | grep -q "migration/"; then
   emit_test "upgrade-needed" "$SCRIPT_DIR/phases/verify-upgrade.sh"
 fi
 
+# permission/yolo changed → run deny enforcement test
+if echo "$changed" | grep -qE "permission|yolo|flag"; then
+  emit_test "yolo-deny" "$SCRIPT_DIR/phases/resilience.sh"
+fi
+
+# branding/welcome/help changed → check for opencode leaks
+if echo "$changed" | grep -qE "welcome|help|hints|cli/|cmd/tui"; then
+  emit_test "branding-check" "$SCRIPT_DIR/phases/verify-install.sh"
+fi
+
+# dbt tools changed → test dbt discovery
+if echo "$changed" | grep -qE "dbt|altimate-dbt|profiles"; then
+  emit_test "dbt-discover" "altimate run --max-turns 2 --yolo 'discover dbt project config'"
+fi
+
+# driver changed → verify all drivers resolvable
+if echo "$changed" | grep -qE "drivers/|driver"; then
+  emit_test "driver-resolvability" "$SCRIPT_DIR/phases/verify-install.sh"
+fi
+
 COUNT=$(wc -l < "$MANIFEST")
 echo ""
 echo "  Generated $COUNT PR-specific test(s)"

From ca7b83a76a6d78104839c4179a8c5b96924a5891 Mon Sep 17 00:00:00 2001
From: anandgupta42 <anand@altimate.ai>
Date: Fri, 27 Mar 2026 09:02:43 -0700
Subject: [PATCH 2/3] fix: address code review findings from 6-model consensus
 review

- Use `require.resolve()` instead of `require()` for driver resolvability
  checks to avoid false negatives from native binding load failures
- Remove unnecessary `altimate_change` markers from new ssh-tunnel test file
- Add `closeAllTunnels()` cleanup in `afterEach` to prevent state leaks

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 packages/opencode/test/altimate/ssh-tunnel.test.ts | 10 ++++++----
 test/sanity/phases/verify-install.sh               |  2 +-
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/packages/opencode/test/altimate/ssh-tunnel.test.ts b/packages/opencode/test/altimate/ssh-tunnel.test.ts
index 8cf8b88e81..b6ab3e9b6d 100644
--- a/packages/opencode/test/altimate/ssh-tunnel.test.ts
+++ b/packages/opencode/test/altimate/ssh-tunnel.test.ts
@@ -1,6 +1,9 @@
-// altimate_change start — unit tests for SSH tunnel config extraction and lifecycle
-import { describe, test, expect } from "bun:test"
-import { extractSshConfig, closeTunnel, getActiveTunnel } from "../../src/altimate/native/connections/ssh-tunnel"
+import { describe, test, expect, afterEach } from "bun:test"
+import { extractSshConfig, closeTunnel, closeAllTunnels, getActiveTunnel } from "../../src/altimate/native/connections/ssh-tunnel"
+
+afterEach(() => {
+  closeAllTunnels()
+})
 
 // ---------------------------------------------------------------------------
 // extractSshConfig — pure function that extracts SSH tunnel config
@@ -81,4 +84,3 @@ describe("SSH tunnel state management", () => {
     expect(getActiveTunnel("nonexistent")).toBeUndefined()
   })
 })
-// altimate_change end
diff --git a/test/sanity/phases/verify-install.sh b/test/sanity/phases/verify-install.sh
index 7dbedb721f..fc341202f9 100755
--- a/test/sanity/phases/verify-install.sh
+++ b/test/sanity/phases/verify-install.sh
@@ -99,7 +99,7 @@ DRIVERS=(
 for entry in "${DRIVERS[@]}"; do
   pkg="${entry%%:*}"
   label="${entry##*:}"
-  if node -e "require('$pkg')" 2>/dev/null; then
+  if node -e "require.resolve('$pkg')" 2>/dev/null; then
     echo "  PASS: $label driver resolvable ($pkg)"
     PASS_COUNT=$((PASS_COUNT + 1))
   else

From 2440bf497aa07bef042bd20bf34f675aeb63b729 Mon Sep 17 00:00:00 2001
From: anandgupta42 <anand@altimate.ai>
Date: Fri, 27 Mar 2026 09:04:01 -0700
Subject: [PATCH 3/3] =?UTF-8?q?fix:=20address=20convergence=20review=20fin?=
 =?UTF-8?q?dings=20=E2=80=94=20driver=20warns,=20unshare=20guard?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Driver resolvability checks now emit warnings instead of failures
  since drivers are intentionally absent from sanity Docker image (#295)
- `unshare --net` now tests with a dry-run before use, falling back to
  proxy-based network blocking when unprivileged (macOS, containers)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 test/sanity/phases/resilience.sh     |  3 ++-
 test/sanity/phases/verify-install.sh | 18 +++++++++++++++---
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/test/sanity/phases/resilience.sh b/test/sanity/phases/resilience.sh
index efa96edda5..df17a25e42 100755
--- a/test/sanity/phases/resilience.sh
+++ b/test/sanity/phases/resilience.sh
@@ -183,7 +183,8 @@ echo "  [10/10] No internet graceful handling..."
 # - Set both lowercase and uppercase proxy vars to unreachable TEST-NET-1
 # - Clear NO_PROXY to prevent bypass
 # - Use unshare --net if available (network namespace isolation — most reliable)
-if command -v unshare >/dev/null 2>&1; then
+# Try unshare --net first (Linux with privileges), fall back to proxy blocking
+if command -v unshare >/dev/null 2>&1 && unshare --net true 2>/dev/null; then
   NO_NET_OUTPUT=$(timeout 15 unshare --net altimate run --max-turns 1 --yolo "hello" 2>&1 || true)
 else
   NO_NET_OUTPUT=$(timeout 15 env \
diff --git a/test/sanity/phases/verify-install.sh b/test/sanity/phases/verify-install.sh
index fc341202f9..ed98c390fc 100755
--- a/test/sanity/phases/verify-install.sh
+++ b/test/sanity/phases/verify-install.sh
@@ -82,6 +82,8 @@ fi
 # All drivers use dynamic import() at runtime — if the package can't be resolved,
 # the tool fails with "driver not installed". This catches the #295 regression
 # where published binaries don't ship driver dependencies.
+# NOTE: Drivers are not installed in the sanity Docker image (see Dockerfile
+# comment). These checks emit warnings, not failures, until #295 is resolved.
 echo "  --- Driver Resolvability ---"
 
 DRIVERS=(
@@ -96,16 +98,26 @@ DRIVERS=(
   "oracledb:oracle"
 )
 
+DRIVER_PASS=0
+DRIVER_FAIL=0
 for entry in "${DRIVERS[@]}"; do
   pkg="${entry%%:*}"
   label="${entry##*:}"
   if node -e "require.resolve('$pkg')" 2>/dev/null; then
     echo "  PASS: $label driver resolvable ($pkg)"
-    PASS_COUNT=$((PASS_COUNT + 1))
+    DRIVER_PASS=$((DRIVER_PASS + 1))
   else
-    echo "  FAIL: $label driver not resolvable ($pkg)"
-    FAIL_COUNT=$((FAIL_COUNT + 1))
+    echo "  WARN: $label driver not resolvable ($pkg) — see #295"
+    DRIVER_FAIL=$((DRIVER_FAIL + 1))
   fi
 done
+echo "  Driver summary: $DRIVER_PASS resolvable, $DRIVER_FAIL missing"
+# Count as a single pass/fail based on whether ANY driver is resolvable
+if [ "$DRIVER_PASS" -gt 0 ]; then
+  PASS_COUNT=$((PASS_COUNT + 1))
+else
+  echo "  FAIL: no drivers resolvable at all"
+  FAIL_COUNT=$((FAIL_COUNT + 1))
+fi
 
 report_results "Phase 1: Verify Installation"