@agenthippo-ai/agenthippo 0.1.0 → 0.1.1

package/out/cli/index.js

@@ -212,7 +212,15 @@ program
     .option('--state-dir <path>', 'Persist session state here (honors AGENTHIPPO_HOME; replaces the tmpdir default)')
     .option('--max-turns-per-session <n>', 'Cap turns per session (abuse/runaway guard); 0 = unlimited', '0')
     .option('--www-dir <path>', 'Serve deploy/www/index.html at GET / (static browser chat UI)')
+    // Deprecated no-ops: kept so deploy artifacts generated by older CLIs (which baked these
+    // into the serve command line) don't crash with "unknown option" after a runtime upgrade.
+    // Serve now trusts its front proxy for auth/CORS; these flags no longer do anything.
+    .option('--production', 'Deprecated: no-op (serve trusts its front proxy; hardening moved to the deploy edge)')
+    .option('--cors-origin <origins>', 'Deprecated: no-op (CORS is handled by the front proxy)')
     .action(async (options) => {
+    if (options.production || options.corsOrigin) {
+        console.warn('[serve] --production/--cors-origin are deprecated no-ops; auth and CORS are enforced by the deploy edge proxy.');
+    }
     const verbose = program.opts().verbose;
     await (0, deps_1.ensureDeps)(verbose);
     await (0, serve_1.serveCommand)({
@@ -243,7 +251,7 @@ program
     .option('-t, --target <target>', 'Deploy target', 'vm')
     .option('-o, --out <path>', 'Staging directory (default: ./deploy-out/<pack>-<target>)')
     .option('--packdir <path>', 'Pack directory (defaults to [pack] arg or cwd)')
-    .option('--image <ref>', 'Runtime image ref', 'ghcr.io/agenthippo/runtime:latest')
+    .option('--image <ref>', 'Runtime image ref (default: engine runtime:latest, or :latest-cursor for cursor packs)')
     .option('-p, --port <port>', 'Container port', '8080')
     .option('--gateway <channels>', 'Agent Anywhere: bind channels (e.g. "slack") + add OpenClaw gateway service (compose target)')
     .option('--hostname <host>', 'Public hostname for SSO edge (Caddy, OAuth, tunnel)', 'auth.agenthippo.ai')

package/out/cli/serve-hardening.js

@@ -36,7 +36,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TurnLimiter = exports.RateLimiter = exports.CONTAINER_SERVE_HOST = exports.SERVE_HOST_ENV = exports.DEFAULT_BIND_HOST = exports.DEFAULT_MAX_BODY_BYTES = void 0;
+exports.TurnGate = exports.TURN_GATE_BUSY_MESSAGE = exports.TURN_GATE_RETRY_AFTER_SECONDS = exports.TURN_QUEUE_ENV = exports.MAX_CONCURRENT_TURNS_ENV = exports.TurnLimiter = exports.IDENTITY_HEADER_ENV = exports.RateLimiter = exports.XFF_TRUSTED_HOPS_ENV = exports.CONTAINER_SERVE_HOST = exports.SERVE_HOST_ENV = exports.DEFAULT_BIND_HOST = exports.DEFAULT_MAX_BODY_BYTES = void 0;
 exports.resolveStateDir = resolveStateDir;
 exports.resolveBindHost = resolveBindHost;
 exports.clientIp = clientIp;
@@ -44,6 +44,8 @@ exports.resolveUserId = resolveUserId;
 exports.resolveDataToken = resolveDataToken;
 exports.peerToUserId = peerToUserId;
 exports.corsHeaders = corsHeaders;
+exports.createTurnGateFromEnv = createTurnGateFromEnv;
+exports.createRejectionWarner = createRejectionWarner;
 exports.readBodyWithCap = readBodyWithCap;
 /**
  * Serve helpers: state-dir resolution, identity header reading, CORS, turn limiting, body cap.
@@ -96,21 +98,29 @@ exports.CONTAINER_SERVE_HOST = '0.0.0.0';
 function resolveBindHost(hostOpt, env = process.env) {
     return hostOpt?.trim() || env.AGENTHIPPO_SERVE_HOST?.trim() || exports.DEFAULT_BIND_HOST;
 }
+/** Env var: number of trusted proxy hops in front of serve (default 1 — the single Caddy). */
+exports.XFF_TRUSTED_HOPS_ENV = 'AGENTHIPPO_XFF_TRUSTED_HOPS';
 /**
  * Best-effort client IP for rate-limiting keys.
  *
- * Behind the documented single trusted proxy (Caddy), `X-Forwarded-For` ends with the IP the
- * proxy observed, so the right-most entry is the real client (a client-spoofed left-most entry
- * is just prepended). Falls back to the socket address for direct/local callers. This is a
- * coarse abuse key, not an identity — never use it for authorization.
+ * Each trusted proxy appends the IP it observed to `X-Forwarded-For`, so with N trusted hops
+ * the real client is the Nth entry from the right (a client-spoofed left-most entry is just
+ * prepended and never reached). Default is 1 (the documented single Caddy). Behind
+ * Cloudflare Tunnel → Caddy there are two hops — Caddy appends cloudflared's container IP,
+ * which is identical for every client, so leaving hops at 1 there collapses all users into one
+ * rate-limit bucket. Set AGENTHIPPO_XFF_TRUSTED_HOPS=2 for the tunnel profile.
+ * Falls back to the socket address for direct/local callers. This is a coarse abuse key, not
+ * an identity — never use it for authorization.
  */
-function clientIp(req) {
+function clientIp(req, env = process.env) {
     const xff = req.headers['x-forwarded-for'];
     const raw = Array.isArray(xff) ? xff[0] : xff;
     if (raw) {
         const parts = raw.split(',').map((s) => s.trim()).filter(Boolean);
         if (parts.length > 0) {
-            return parts[parts.length - 1];
+            const hopsRaw = Number(env[exports.XFF_TRUSTED_HOPS_ENV]);
+            const hops = Number.isInteger(hopsRaw) && hopsRaw >= 1 ? hopsRaw : 1;
+            return parts[Math.max(0, parts.length - hops)];
         }
     }
     return req.socket?.remoteAddress || 'unknown';
@@ -176,12 +186,25 @@ const HEADER_ALIASES = [
     'x-goog-authenticated-user-email', // Cloud Run IAP (prefixed value, stripped below)
     'cf-access-authenticated-user-email', // Cloudflare Access
 ];
+/** Env var: pin the single identity header the deploy layer actually sets (and strips). */
+exports.IDENTITY_HEADER_ENV = 'AGENTHIPPO_IDENTITY_HEADER';
 /**
  * Resolve the end-user identity for a request.
  *
- * Proxy headers win over the request body — the header is set by the SSO proxy
- * serve sits behind; the body is client-controlled. Falls back to body.user_id
- * for dev/internal use (e.g. direct curl against a local serve).
+ * Proxy headers win over the request body. When AGENTHIPPO_IDENTITY_HEADER pins
+ * trust to one header, that pin is a hard boundary: if the pinned header is
+ * absent, identity resolves to undefined (never the request body) — a deployment
+ * that pins a header has declared it has a real proxy-verified identity, so an
+ * unauthenticated caller must not be able to name themselves via the client-
+ * controlled body. Body fallback is dev/internal convenience for the *unpinned*
+ * case only (e.g. direct curl against a local serve with no identity proxy).
+ *
+ * The alias-list default (used when unpinned) is only safe when the proxy strips
+ * or overwrites ALL of the aliases; platforms that strip only their own header
+ * (Cloud Run IAP strips `X-Goog-*` but forwards a client-supplied `x-agent-user`
+ * untouched, which the alias list checks first) MUST pin theirs — deploy
+ * artifacts set it (e.g. cloudrun-deploy.sh pins `x-goog-authenticated-user-email`)
+ * so an authenticated caller cannot impersonate another user.
  *
  * Resolves identity for `analyticsUserId` attribution and the request-scoped
  * credential context (per-user data scoping). Not folded into the session key —
@@ -190,8 +213,10 @@ const HEADER_ALIASES = [
  * Per-turn *data credentials* (OBO token, e.g. X-Forwarded-Access-Token) are
  * handled by resolveDataToken — not read here.
  */
-function resolveUserId(headers, body) {
-    for (const name of HEADER_ALIASES) {
+function resolveUserId(headers, body, env = process.env) {
+    const pinned = env[exports.IDENTITY_HEADER_ENV]?.trim().toLowerCase();
+    const names = pinned ? [pinned] : HEADER_ALIASES;
+    for (const name of names) {
         const v = headers[name];
         const raw = (Array.isArray(v) ? v[0] : v)?.trim();
         if (raw) {
@@ -201,6 +226,12 @@ function resolveUserId(headers, body) {
             return value;
         }
     }
+    if (pinned) {
+        // Pinned but absent: fail closed. Falling back to the body here would let any
+        // caller that merely reaches this port (proxy misconfiguration, direct network
+        // access, gcloud run services proxy bypassing IAP) name an arbitrary victim.
+        return undefined;
+    }
     const fromBody = body?.user_id?.trim();
     return fromBody || undefined;
 }
@@ -281,6 +312,121 @@ class TurnLimiter {
     }
 }
 exports.TurnLimiter = TurnLimiter;
+/** Env: max concurrent engine turns per process (default 10). `0` disables the gate. */
+exports.MAX_CONCURRENT_TURNS_ENV = 'AGENTHIPPO_MAX_CONCURRENT_TURNS';
+/** Env: bounded FIFO waiter depth when at inflight cap (default 20). */
+exports.TURN_QUEUE_ENV = 'AGENTHIPPO_TURN_QUEUE';
+/** Fixed Retry-After seconds when the turn gate rejects (matches default queue timeout). */
+exports.TURN_GATE_RETRY_AFTER_SECONDS = 15;
+/** User-visible capacity message for gateway channels (Slack/Telegram can't receive HTTP 429). */
+exports.TURN_GATE_BUSY_MESSAGE = 'At capacity — please retry in a moment';
+/**
+ * Process-wide concurrency gate for engine turns (semaphore + bounded FIFO).
+ *
+ * Caps simultaneous engine subprocesses so a burst cannot OOM the container.
+ * `maxInflight <= 0` disables. Waiters time out after `queueTimeoutMs` (burst
+ * absorber, not a job queue). Rejected callers get `null` — HTTP maps that to
+ * 429 + Retry-After; the gateway path emits a short channel message instead.
+ */
+class TurnGate {
+    maxInflight;
+    maxQueue;
+    queueTimeoutMs;
+    inflightCount = 0;
+    waiters = [];
+    constructor(maxInflight, maxQueue, queueTimeoutMs = exports.TURN_GATE_RETRY_AFTER_SECONDS * 1000) {
+        this.maxInflight = maxInflight;
+        this.maxQueue = maxQueue;
+        this.queueTimeoutMs = queueTimeoutMs;
+    }
+    /**
+     * Acquire a turn slot. Resolves with a `release()` callback, or `null` when
+     * the queue is full or the wait timed out. Always call `release()` in a
+     * `finally` when non-null.
+     */
+    async acquire() {
+        if (!Number.isFinite(this.maxInflight) || this.maxInflight <= 0) {
+            return () => { };
+        }
+        if (this.inflightCount < this.maxInflight) {
+            this.inflightCount += 1;
+            return () => this.releaseSlot();
+        }
+        if (this.waiters.length >= this.maxQueue) {
+            return null;
+        }
+        return new Promise((resolve) => {
+            let settled = false;
+            const settle = (release) => {
+                if (settled) {
+                    // Timed out after a slot was already offered — give the slot back.
+                    if (release) {
+                        release();
+                    }
+                    return;
+                }
+                settled = true;
+                clearTimeout(timer);
+                resolve(release);
+            };
+            const entry = {
+                resolve: settle,
+                timer: null,
+            };
+            const timer = setTimeout(() => {
+                const idx = this.waiters.indexOf(entry);
+                if (idx >= 0) {
+                    this.waiters.splice(idx, 1);
+                }
+                settle(null);
+            }, this.queueTimeoutMs);
+            entry.timer = timer;
+            this.waiters.push(entry);
+        });
+    }
+    releaseSlot() {
+        const next = this.waiters.shift();
+        if (next) {
+            // Transfer the slot to the head waiter — do not decrement inflight.
+            next.resolve(() => this.releaseSlot());
+            return;
+        }
+        this.inflightCount = Math.max(0, this.inflightCount - 1);
+    }
+    get inflight() {
+        return this.inflightCount;
+    }
+    get queued() {
+        return this.waiters.length;
+    }
+    get max() {
+        return this.maxInflight > 0 ? this.maxInflight : 0;
+    }
+}
+exports.TurnGate = TurnGate;
+/** Build a TurnGate from env (serve-v4 P0.1). Defaults: 10 inflight, 20 queued. */
+function createTurnGateFromEnv(env = process.env) {
+    const inflightRaw = Number(env[exports.MAX_CONCURRENT_TURNS_ENV] ?? 10);
+    const queueRaw = Number(env[exports.TURN_QUEUE_ENV] ?? 20);
+    const maxInflight = Number.isFinite(inflightRaw) ? inflightRaw : 10;
+    const maxQueue = Number.isFinite(queueRaw) && queueRaw >= 0 ? queueRaw : 20;
+    return new TurnGate(maxInflight, maxQueue);
+}
+/**
+ * Rate-limited rejection logger — at most one warn per `intervalMs` so a flood
+ * of 429s does not spam the console.
+ */
+function createRejectionWarner(intervalMs = 5_000) {
+    let lastAt = 0;
+    return (msg) => {
+        const now = Date.now();
+        if (now - lastAt < intervalMs) {
+            return;
+        }
+        lastAt = now;
+        console.warn(msg);
+    };
+}
 /**
  * Read a request body with a hard size cap. Past the cap it stops accumulating
  * and rejects with a `tooLarge`-tagged error so the caller can respond 413.