@agenthippo-ai/agenthippo 0.1.0 → 0.2.3-dataplane

package/out/cli/state-sync.js

@@ -2,37 +2,93 @@
 /*---------------------------------------------------------------------------------------------
  *  Copyright (c) AgentHippo.ai. All rights reserved.
  *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isAwsCliAvailable = isAwsCliAvailable;
 exports.resolveS3StateConfig = resolveS3StateConfig;
+exports.resolveRestoreBootMode = resolveRestoreBootMode;
+exports.safeSessionId = safeSessionId;
+exports.sessionRemoteUri = sessionRemoteUri;
+exports.shardBelongsToSession = shardBelongsToSession;
+exports.hasLocalSessionState = hasLocalSessionState;
+exports.listSessionShardFiles = listSessionShardFiles;
+exports.stageSessionPushDir = stageSessionPushDir;
+exports.mergeSessionStagingIntoState = mergeSessionStagingIntoState;
 exports.restoreState = restoreState;
 exports.pushState = pushState;
+exports.pushSessionState = pushSessionState;
+exports.ensureSessionLocal = ensureSessionLocal;
+exports.clearRestoreAttemptCache = clearRestoreAttemptCache;
 exports.makeStatePusher = makeStatePusher;
+exports.providerSessionShardName = providerSessionShardName;
 /**
- * Object-store state sync (serve-v3 Q1, shared SessionStore).
+ * Object-store state sync (serve-v3 Q1 + serve-v4 P1.2).
  *
- * Persists the durable state root (/state) to an S3-compatible object store so
- * sessions survive scale-to-zero / a fresh instance even where there is NO
- * filesystem mount (Cloudflare R2, Databricks → S3/DBFS), and so a sticky-routed
- * fleet replica can reload an affinity-owned session.
+ * Persists the durable state root to an S3-compatible object store so sessions
+ * survive scale-to-zero / a fresh instance (Cloudflare R2, MinIO, GCS, AWS S3)
+ * and so a sticky-routed fleet can restore-on-miss after resharding.
  *
- * Strategy (agreed): boot restore + per-turn async-delta push (debounced, off
- * the response path) + a SIGTERM flush. Uses `aws s3 sync` (delta by default;
- * S3-compatible via --endpoint-url → MinIO / R2 / GCS / S3) so we add no SDK to
- * the binary. Single-writer-per-session safety comes from sticky-by-session_id.
+ * Strategy:
+ *   - Per-session async-delta push (debounced, off the response path) →
+ *     s3://…/sessions/<sessionId>/
+ *   - Restore-on-miss before a turn when the session is not local
+ *   - Optional boot restore of the whole prefix (`AGENTHIPPO_STATE_RESTORE_BOOT=all`)
+ *   - SIGTERM flush of pending session pushes
+ *
+ * Uses `aws s3 sync` (S3-compatible via --endpoint-url). No SDK in the binary.
+ * Last-write-wins per session prefix — no CAS. Mid-reshard may lose one turn of
+ * context; sticky routing makes that rare.
  *
  * Config (no-op unless AGENTHIPPO_STATE_S3_URI is set):
- *   AGENTHIPPO_STATE_S3_URI       s3://bucket/prefix
- *   AGENTHIPPO_STATE_S3_ENDPOINT  http://minio:9000  (for non-AWS S3)
- *   AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_REGION   (standard aws creds)
+ *   AGENTHIPPO_STATE_S3_URI          s3://bucket/prefix
+ *   AGENTHIPPO_STATE_S3_ENDPOINT     http://minio:9000  (non-AWS S3)
+ *   AGENTHIPPO_STATE_RESTORE_BOOT    all|none (default all for single-instance compat;
+ *                                    multi-replica templates set none)
+ *   AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_REGION
  */
+const crypto_1 = require("crypto");
 const child_process_1 = require("child_process");
+const fsp = __importStar(require("fs/promises"));
+const path = __importStar(require("path"));
 const util_1 = require("util");
 const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
+/** In-process cache: skip repeat S3 pulls for the same session on this replica. */
+const restoreAttempted = new Set();
 /**
  * Verify the `aws` CLI is callable. State sync shells out to it, so when S3 is
  * configured a missing binary means silent data loss — callers should fail fast.
- * Resolves true when available, false otherwise.
  */
 async function isAwsCliAvailable() {
     try {
@@ -54,6 +110,27 @@ function resolveS3StateConfig(env = process.env) {
         endpoint: env.AGENTHIPPO_STATE_S3_ENDPOINT?.trim() || undefined,
     };
 }
+/**
+ * Boot restore mode. Default `all` preserves single-instance behavior.
+ * Multi-replica templates set `none` and rely on restore-on-miss (P1.2).
+ */
+function resolveRestoreBootMode(env = process.env) {
+    const raw = env.AGENTHIPPO_STATE_RESTORE_BOOT?.trim().toLowerCase();
+    if (raw === 'none') {
+        return 'none';
+    }
+    return 'all';
+}
+/** Sanitize a client session id for use as an S3 path segment / local dir name. */
+function safeSessionId(sessionId) {
+    const trimmed = sessionId.trim();
+    const safe = trimmed.replace(/[<>:"/\\|?*\x00-\x1F]+/g, '_').replace(/\.\./g, '_').slice(0, 160);
+    return safe || 'session';
+}
+/** Remote prefix for one session: s3://bucket/prefix/sessions/<id> */
+function sessionRemoteUri(cfg, sessionId) {
+    return `${cfg.uri}/sessions/${safeSessionId(sessionId)}`;
+}
 function syncArgs(cfg, from, to) {
     const args = ['s3', 'sync', from, to, '--no-progress'];
     if (cfg.endpoint) {
@@ -61,6 +138,127 @@ function syncArgs(cfg, from, to) {
     }
     return args;
 }
+function attemptKey(stateDir, sessionId) {
+    return `${path.resolve(stateDir)}\0${sessionId}`;
+}
+/** Conversation key format: engine:chatSessionId:pack:signature */
+function shardBelongsToSession(shardKey, chatSessionId, value) {
+    if (value?.chatSessionId && value.chatSessionId === chatSessionId) {
+        return true;
+    }
+    const parts = shardKey.split(':');
+    return parts.length >= 2 && parts[1] === chatSessionId;
+}
+/**
+ * True when this replica already has provider-session state for the chat session.
+ * Used to skip restore-on-miss on the hot path.
+ */
+async function hasLocalSessionState(stateDir, sessionId) {
+    const dir = path.join(stateDir, 'provider-sessions');
+    let names;
+    try {
+        names = await fsp.readdir(dir);
+    }
+    catch {
+        return false;
+    }
+    for (const name of names) {
+        if (!name.endsWith('.json')) {
+            continue;
+        }
+        try {
+            const raw = await fsp.readFile(path.join(dir, name), 'utf8');
+            const parsed = JSON.parse(raw);
+            if (typeof parsed.key === 'string' && shardBelongsToSession(parsed.key, sessionId, parsed.value)) {
+                return true;
+            }
+        }
+        catch {
+            // skip unreadable
+        }
+    }
+    return false;
+}
+/** Collect provider-session shard filenames that belong to this chat session. */
+async function listSessionShardFiles(stateDir, sessionId) {
+    const dir = path.join(stateDir, 'provider-sessions');
+    let names;
+    try {
+        names = await fsp.readdir(dir);
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const name of names) {
+        if (!name.endsWith('.json')) {
+            continue;
+        }
+        try {
+            const raw = await fsp.readFile(path.join(dir, name), 'utf8');
+            const parsed = JSON.parse(raw);
+            if (typeof parsed.key === 'string' && shardBelongsToSession(parsed.key, sessionId, parsed.value)) {
+                out.push(name);
+            }
+        }
+        catch {
+            // skip
+        }
+    }
+    return out;
+}
+async function pathExists(p) {
+    try {
+        await fsp.access(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Build a local staging tree for session S: provider-sessions/<shards for S> only.
+ *
+ * `<stateDir>/agents/<agentId>/{claude,codex}` (the SDK's own on-disk session/config
+ * cache — see agentpack/paths.ts) is deliberately NOT included here. That directory is
+ * shared by every session/user of the same pack on this replica, keyed only by agentId —
+ * never session-scoped. Treating it as part of one session's push/restore let one
+ * session's stale snapshot force-overwrite the live SDK cache for every other
+ * concurrently active session on the replica (fs.cp force:true in the old
+ * mergeSessionStagingIntoState). It's local-disk-only now, same as before object-store
+ * sync existed: it lives and dies with its replica. A resume target missing after a
+ * replica change already falls back to a fresh SDK session — the same path every
+ * session's true first turn on any replica already takes — so this doesn't introduce a
+ * new failure mode, it just stops the wrong-session-data clobber.
+ */
+async function stageSessionPushDir(stateDir, sessionId, stagingDir) {
+    await fsp.rm(stagingDir, { recursive: true, force: true });
+    await fsp.mkdir(stagingDir, { recursive: true });
+    const shards = await listSessionShardFiles(stateDir, sessionId);
+    const psDest = path.join(stagingDir, 'provider-sessions');
+    if (shards.length > 0) {
+        await fsp.mkdir(psDest, { recursive: true });
+        for (const name of shards) {
+            await fsp.copyFile(path.join(stateDir, 'provider-sessions', name), path.join(psDest, name));
+        }
+    }
+    return shards.length > 0;
+}
+/** Merge a restored staging tree back into stateDir (provider-session shards only — see
+ *  stageSessionPushDir for why the SDK config cache is intentionally excluded). */
+async function mergeSessionStagingIntoState(stagingDir, stateDir) {
+    const psSrc = path.join(stagingDir, 'provider-sessions');
+    if (await pathExists(psSrc)) {
+        const psDest = path.join(stateDir, 'provider-sessions');
+        await fsp.mkdir(psDest, { recursive: true });
+        for (const name of await fsp.readdir(psSrc)) {
+            if (!name.endsWith('.json')) {
+                continue;
+            }
+            await fsp.copyFile(path.join(psSrc, name), path.join(psDest, name));
+        }
+    }
+}
 /** Download state from the bucket into stateDir on boot. An empty bucket is a no-op. */
 async function restoreState(cfg, stateDir, log) {
     try {
@@ -68,46 +266,130 @@ async function restoreState(cfg, stateDir, log) {
         log?.(`State restored from ${cfg.uri}`);
     }
     catch (err) {
-        // First boot / empty bucket / transient — don't block startup.
         log?.(`State restore skipped: ${err instanceof Error ? err.message : String(err)}`);
     }
 }
-/** Upload changed files from stateDir to the bucket (delta). */
+/** Upload changed files from stateDir to the bucket (full-tree delta — legacy / flush fallback). */
 async function pushState(cfg, stateDir, log) {
     try {
         await execFileAsync('aws', syncArgs(cfg, stateDir, cfg.uri));
     }
     catch (err) {
-        // A failed push means sessions aren't durable — surface it unconditionally,
-        // not just under --verbose, so the operator notices state isn't persisting.
         console.error(`[state-sync] push to ${cfg.uri} failed: ${err instanceof Error ? err.message : String(err)}`);
         log?.(`State push failed: ${err instanceof Error ? err.message : String(err)}`);
     }
 }
+/** Push one session's scoped tree to s3://…/sessions/<id>/. */
+async function pushSessionState(cfg, stateDir, sessionId, log) {
+    const safe = safeSessionId(sessionId);
+    const staging = path.join(stateDir, '.push-staging', safe);
+    try {
+        const hasContent = await stageSessionPushDir(stateDir, sessionId, staging);
+        if (!hasContent) {
+            log?.(`State push skipped for session ${safe}: nothing local`);
+            return;
+        }
+        const remote = sessionRemoteUri(cfg, sessionId);
+        await execFileAsync('aws', syncArgs(cfg, staging, remote));
+        log?.(`State pushed session ${safe} → ${remote}`);
+    }
+    catch (err) {
+        console.error(`[state-sync] push session ${safe} failed: ${err instanceof Error ? err.message : String(err)}`);
+        log?.(`State push failed for ${safe}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    finally {
+        await fsp.rm(staging, { recursive: true, force: true }).catch(() => undefined);
+    }
+}
+/**
+ * On a request whose session_id has no local provider-session state, pull
+ * s3://…/sessions/<id>/ before runner.run(). No-ops if already local or already
+ * attempted this process (avoids re-pulling brand-new sessions every turn).
+ */
+async function ensureSessionLocal(cfg, stateDir, sessionId, log) {
+    const key = attemptKey(stateDir, sessionId);
+    if (restoreAttempted.has(key)) {
+        return;
+    }
+    if (await hasLocalSessionState(stateDir, sessionId)) {
+        restoreAttempted.add(key);
+        return;
+    }
+    const safe = safeSessionId(sessionId);
+    const staging = path.join(stateDir, '.restore-staging', safe);
+    try {
+        await fsp.rm(staging, { recursive: true, force: true });
+        await fsp.mkdir(staging, { recursive: true });
+        const remote = sessionRemoteUri(cfg, sessionId);
+        await execFileAsync('aws', syncArgs(cfg, remote, staging));
+        await mergeSessionStagingIntoState(staging, stateDir);
+        log?.(`State restored session ${safe} from ${remote}`);
+    }
+    catch (err) {
+        // Empty prefix / first turn / transient — continue; runner creates fresh state.
+        log?.(`State restore-on-miss skipped for ${safe}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    finally {
+        restoreAttempted.add(key);
+        await fsp.rm(staging, { recursive: true, force: true }).catch(() => undefined);
+    }
+}
+/** Test helper — clear the restore-attempted cache. */
+function clearRestoreAttemptCache() {
+    restoreAttempted.clear();
+}
 /**
- * Debounced, non-overlapping pusher. `schedule()` after each turn (cheap, off the
- * response path); coalesces bursts; `flush()` awaits a final push (SIGTERM).
+ * Debounced, non-overlapping per-session pusher.
+ * `schedule(sessionId)` after each turn; `flush()` awaits pending pushes (SIGTERM).
  */
 function makeStatePusher(cfg, stateDir, log, waitMs = 1000) {
     let timer = null;
     let running = false;
-    let pending = false;
     let inflightPromise = null;
+    const pendingSessions = new Set();
+    let pendingFull = false;
     const runNow = () => {
         running = true;
-        pending = false;
-        inflightPromise = pushState(cfg, stateDir, log).then(() => {
+        const sessions = [...pendingSessions];
+        const doFull = pendingFull;
+        pendingSessions.clear();
+        pendingFull = false;
+        inflightPromise = (async () => {
+            if (doFull) {
+                await pushState(cfg, stateDir, log);
+            }
+            for (const id of sessions) {
+                await pushSessionState(cfg, stateDir, id, log);
+            }
+        })()
+            .catch((err) => {
+            console.error(`[state-sync] push batch failed: ${err instanceof Error ? err.message : String(err)}`);
+        })
+            .finally(() => {
             running = false;
             inflightPromise = null;
-            if (pending) {
-                schedule();
+            if (pendingSessions.size > 0 || pendingFull) {
+                // Re-arm debounce without treating this as a legacy full-push schedule().
+                if (!timer) {
+                    timer = setTimeout(() => {
+                        timer = null;
+                        void runNow();
+                    }, waitMs);
+                    timer.unref?.();
+                }
             }
         });
         return inflightPromise;
     };
-    const schedule = () => {
+    const schedule = (sessionId) => {
+        if (sessionId?.trim()) {
+            pendingSessions.add(sessionId.trim());
+        }
+        else {
+            // Legacy no-arg call → full-tree push (boot-compat / callers that omit id).
+            pendingFull = true;
+        }
         if (running) {
-            pending = true;
             return;
         }
         if (timer) {
@@ -124,12 +406,19 @@ function makeStatePusher(cfg, stateDir, log, waitMs = 1000) {
             clearTimeout(timer);
             timer = null;
         }
-        // Wait for any in-flight push to complete before the final push,
-        // so SIGTERM never runs two concurrent aws s3 sync processes.
         if (inflightPromise) {
             await inflightPromise;
         }
-        await pushState(cfg, stateDir, log);
+        if (pendingSessions.size > 0 || pendingFull) {
+            await runNow();
+            if (inflightPromise) {
+                await inflightPromise;
+            }
+        }
     };
     return { schedule, flush };
 }
+/** Stable hash helper exposed for tests (matches DirectorySessionStore naming). */
+function providerSessionShardName(conversationKey) {
+    return `${(0, crypto_1.createHash)('sha256').update(conversationKey).digest('hex').slice(0, 40)}.json`;
+}

package/out/engines/claude.js

@@ -43,6 +43,8 @@ const base_1 = require("./base");
 const utils_1 = require("../utils");
 const permissions_1 = require("../permissions");
 const mcp_1 = require("../mcp");
+const data_plane_1 = require("../cli/data-plane");
+const runtime_1 = require("../cli/runtime");
 const session_1 = require("../session");
 const agentpack_1 = require("../agentpack");
 const shared_1 = require("../shared");
@@ -241,7 +243,8 @@ class ClaudeEngine {
         // Edit tracker from runtime context (optional)
         const editTracker = runtime.editTracker;
         // Resolve API routing (LiteLLM proxy vs direct Anthropic)
-        const { apiKey, baseUrl, useLiteLLM } = (0, utils_1.resolveApiRouting)(options, this.config.litellmApiKey, this.config.litellmBaseUrl);
+        // claude routes to Anthropic when direct (or the LiteLLM proxy when configured) — never OpenAI.
+        const { apiKey, baseUrl, useLiteLLM } = (0, utils_1.resolveApiRouting)(options, this.config, 'anthropic');
         if (!apiKey) {
             throw new Error('Claude API key not provided');
         }
@@ -267,6 +270,11 @@ class ClaudeEngine {
             'DEBUG_CLAUDE_AGENT_SDK': '1',
             'CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC': '1',
         };
+        // Egress broker active ⇒ the gateway token stays broker-side; scrub it from the child
+        // env so it never reaches the model (secure-obo-design §7.6 / §7.4 gap 1).
+        if (claudeEnv[data_plane_1.EGRESS_URL_ENV]) {
+            delete claudeEnv[runtime_1.OPENCLAW_GATEWAY_TOKEN_ENV];
+        }
         const isSetupTokenAuth = (0, shared_1.isAnthropicSetupToken)(apiKey);
         if (isSetupTokenAuth) {
             const normalizedSetupToken = (0, shared_1.normalizeAnthropicSetupToken)(apiKey);
@@ -541,8 +549,10 @@ class ClaudeEngine {
                 logger.debug(`[AgentIDE] SessionStart hook called! event=${input.hook_event_name}`);
                 return CONTINUE;
             };
-            // Load MCP servers for the active agent and pass directly to SDK
-            const mcpServers = await this.loadMcpServersForClaude(logger, options.workspaceRoot, agentId);
+            // Load MCP servers for the active agent and pass directly to SDK. claudeEnv is the
+            // per-turn child env — URL servers resolve their bearerTokenEnv (turn nonce) from it,
+            // in memory, so no per-turn value ever lands in a shared config file.
+            const mcpServers = await this.loadMcpServersForClaude(logger, options.workspaceRoot, agentId, claudeEnv);
             // Determine cwd and settingSources
             // cwd is ALWAYS workspaceRoot - active agent content has been synced to workspace's .claude/
             // Agent packs: settingSources is 'project' only (no user ~/.claude/ mixing)
@@ -1191,9 +1201,11 @@ class ClaudeEngine {
      * - Default agent: uses bundled MCP servers from extension
      * - Pack agents: uses pack's mcp/ directory
      *
-     * The SDK accepts mcpServers directly in query options.
+     * The SDK accepts mcpServers directly in query options — including HTTP Streamable
+     * servers (`{type:'http', url, headers}`). `turnEnv` is the per-turn child env; a URL
+     * server's `bearerTokenEnv` (e.g. AGENTHIPPO_TURN_NONCE) resolves against it in memory.
      */
-    async loadMcpServersForClaude(logger, workspaceRoot, agentId = 'default') {
+    async loadMcpServersForClaude(logger, workspaceRoot, agentId = 'default', turnEnv) {
         const basePromptsDir = this.getBundledBasePromptsDir();
         const servers = await (0, mcp_1.loadMcpServers)(agentId, workspaceRoot, basePromptsDir);
         if (servers.length === 0) {
@@ -1201,6 +1213,15 @@ class ClaudeEngine {
         }
         const mcpServers = {};
         for (const s of servers) {
+            if (s.url) {
+                const headers = (0, mcp_1.resolveHttpMcpHeaders)(s, turnEnv ?? process.env);
+                mcpServers[s.name] = {
+                    type: 'http',
+                    url: s.url,
+                    ...(headers ? { headers } : {}),
+                };
+                continue;
+            }
             mcpServers[s.name] = {
                 command: s.command,
                 args: s.args,

package/out/engines/codex.js

@@ -46,6 +46,9 @@ const utils_1 = require("../utils");
 const permissions_1 = require("../permissions");
 const session_1 = require("../session");
 const agentpack_1 = require("../agentpack");
+const credential_context_1 = require("../cli/credential-context");
+const data_plane_1 = require("../cli/data-plane");
+const runtime_1 = require("../cli/runtime");
 // Note: HTTP edit server removed - file changes are now handled directly via file_change events
 // -----------------------------------------------------------------------------
 // Constants
@@ -63,7 +66,7 @@ const AGENTIDE_CODEX_SOURCE_ENV_VAR = 'AGENTIDE_ANALYTICS_SOURCE';
 const AGENTIDE_CODEX_ENGINE_ENV_VAR = 'AGENTIDE_ANALYTICS_ENGINE';
 const AGENTIDE_CODEX_REQUEST_ID_ENV_VAR = 'AGENTIDE_ANALYTICS_REQUEST_ID';
 // Bump when we change generated config semantics so long-lived sessions regenerate config.toml.
-const AGENTIDE_CODEX_CONFIG_VERSION = 18; // v18: Codex CLI dropped wire_api=chat; always use responses
+const AGENTIDE_CODEX_CONFIG_VERSION = 20; // v20: default_tools_approval_mode "auto"→"approve" ("auto" is invalid on codex ≥0.131 and cancels every headless MCP tool call)
 // Per-process runtime context for agents (not analytics): lets the agent locate its per-session context export.
 const AGENTIDE_CONTEXT_EXPORT_PATH_ENV_VAR = 'AGENTIDE_CONTEXT_EXPORT_PATH';
 const AGENTIDE_TERMINAL_LOG_PATH_ENV_VAR = 'AGENTIDE_TERMINAL_LOG_PATH';
@@ -100,7 +103,8 @@ class CodexEngine {
         const threadModelId = options.modelId;
         // Resolve API routing (LiteLLM proxy vs direct OpenAI)
         // Use openaiBaseUrl which has overrideOpenAIBaseUrl applied
-        const routing = (0, utils_1.resolveApiRouting)(options, this.config.litellmApiKey, this.config.litellmBaseUrl);
+        // codex routes to OpenAI when direct (or the LiteLLM proxy when configured) — never Anthropic.
+        const routing = (0, utils_1.resolveApiRouting)(options, this.config, 'openai');
         const apiKey = routing.apiKey;
         const baseUrl = routing.openaiBaseUrl; // Use OpenAI-specific URL
         const useLiteLLM = routing.useLiteLLM;
@@ -126,6 +130,13 @@ class CodexEngine {
             ...(runtime.cliEnvPatch ?? {}),
             OPENAI_LOG: 'debug',
         };
+        // When serve runs the egress broker, the OpenClaw gateway token must never enter the
+        // agent's trust domain (secure-obo-design §7.6 / §7.4 gap 1). Scrub it from the child env
+        // at the spawn boundary — belt-and-suspenders with serve's boot-time process.env strip,
+        // so a token in process.env (e.g. captured before the strip) still cannot reach the model.
+        if (codexEnv[data_plane_1.EGRESS_URL_ENV]) {
+            delete codexEnv[runtime_1.OPENCLAW_GATEWAY_TOKEN_ENV];
+        }
         // Always expose the VS Code chat session id to the agent process so it can locate:
         //   .agentide/sessions/<sessionId>/context.md
         const rawChatSessionId = sessionId?.trim();
@@ -141,8 +152,12 @@ class CodexEngine {
         // Note: workingDirectory is ALWAYS workspaceRoot - active agent content is synced to workspace's .codex/
         const agentId = options.agentPackId ?? 'default';
         const runtimePaths = (0, agentpack_1.resolveRuntimePaths)(options.workspaceRoot, this.config.storagePath, agentId, options.agentPackVersion);
-        // Use agent-isolated CODEX_HOME (for session/state isolation)
-        const codexHome = runtimePaths.codexHome;
+        // Use agent-isolated CODEX_HOME (for session/state isolation). In multi-tenant serve,
+        // additionally key it by the verified request user: config.toml is rewritten per turn,
+        // and a shared per-agent home lets concurrent turns of different users race it
+        // (secure-obo-design §1 defect 1 / §8 Phase 0). No credential frame (IDE,
+        // single-tenant CLI) ⇒ unchanged per-agent path.
+        const codexHome = (0, agentpack_1.userScopedEngineHome)(runtimePaths.codexHome, (0, credential_context_1.currentCredential)()?.userId);
         codexEnv['CODEX_HOME'] = codexHome;
         await fs_1.promises.mkdir(codexHome, { recursive: true });
         // Always set AGENT_ID for agent to know its identity
@@ -601,7 +616,11 @@ class CodexEngine {
         // Codex CLI requires wire_api=responses (chat wire was removed in newer Codex releases).
         const wireApi = 'responses';
         const routingType = useLiteLLM ? 'litellm' : (customBaseUrl ? 'custom' : 'openai');
-        const signature = `${AGENTIDE_CODEX_CONFIG_VERSION}:${routingType}:${customBaseUrl ?? ''}:${wireApi}:${agentId}:${codexInstructionsFile ?? ''}:${(0, mcp_1.mcpConfigCacheSignatureSuffix)()}`;
+        // No per-turn component in this signature: config.toml must be byte-identical across
+        // turns (per-turn auth rides the process env via bearer_token_env_var, never the file),
+        // so concurrent same-home turns write identical bytes and the old cross-turn race is
+        // gone by construction (secure-obo-design §3.2).
+        const signature = `${AGENTIDE_CODEX_CONFIG_VERSION}:${routingType}:${customBaseUrl ?? ''}:${wireApi}:${agentId}:${codexInstructionsFile ?? ''}`;
         if (this.lastWrittenConfigSignature === signature) {
             return;
         }

package/out/engines/custom.js

@@ -38,6 +38,8 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CustomEngine = void 0;
 exports.resolveCustomEngineLoadStrategy = resolveCustomEngineLoadStrategy;
+exports.deliverModelRoutingEnv = deliverModelRoutingEnv;
+exports.buildRunnerChildEnv = buildRunnerChildEnv;
 exports.probeCustomEngineImport = probeCustomEngineImport;
 const node_child_process_1 = require("node:child_process");
 const node_readline_1 = require("node:readline");
@@ -83,10 +85,45 @@ function prependNodePath(env, engineDir) {
         ? `${engineNodeModules}${path.delimiter}${existing}`
         : engineNodeModules;
 }
+/**
+ * Deliver the per-turn model-routing values into the env vars a manifest declares
+ * (`model.apiKeyEnvVar` / `baseUrlEnvVar` / `openaiBaseUrlEnvVar`).
+ *
+ * NON-CLOBBERING: a var already set in the host's own ambient env is left alone. Two reasons:
+ * (1) it preserves the effective behavior deployments already relied on — the old
+ *     `{...turn.env, ...process.env}` child-env spread accidentally let ambient values win,
+ *     and operators' engine-owned keys (e.g. a real CURSOR_API_KEY vs a stale manifest that
+ *     wrongly declared it as a delivery slot) must keep winning after that spread is fixed;
+ * (2) it makes the manifest contract safe by construction: mis-declaring an operator-owned
+ *     credential as a delivery slot can shadow nothing.
+ * The flip side is documented on CustomEngineModelConfig: ambient-exporting a genuine
+ * delivery var (e.g. LITELLM_API_KEY in serve's shell) shadows per-turn rotation.
+ */
+function deliverModelRoutingEnv(env, manifest, routing, ambientEnv, logger) {
+    const deliver = (envVar, value, label) => {
+        if (!envVar || !value) {
+            return;
+        }
+        if (ambientEnv[envVar]?.trim()) {
+            logger?.info(`[AgentIDE] Custom engine "${manifest.id}": ${envVar} already set in ambient env — keeping the operator's value, skipping per-turn ${label} delivery`);
+            return;
+        }
+        env[envVar] = value;
+    };
+    deliver(manifest.model?.apiKeyEnvVar, routing.apiKey, 'API key');
+    deliver(manifest.model?.baseUrlEnvVar, routing.baseUrl, 'base URL');
+    deliver(manifest.model?.openaiBaseUrlEnvVar, routing.openaiBaseUrl, 'OpenAI base URL');
+}
 function buildRunnerChildEnv(manifest, turn, probeImport) {
     const childEnv = {
-        ...turn.env,
+        // Per-turn values WIN over the host's ambient env. turn.env starts from a spread of
+        // process.env, so for undeclared vars this is identical either way; the difference is
+        // deliberate per-turn state (AGENTHIPPO_* control vars, the data-plane turn nonce,
+        // session paths, manifest-declared deliveries) which must never be reverted by a
+        // same-named var in the host's own environment. Ambient-vs-delivery precedence for
+        // manifest credential vars is decided earlier, in deliverModelRoutingEnv (non-clobber).
         ...process.env,
+        ...turn.env,
         AGENTHIPPO_ENGINE_ENTRY: manifest.entryPath,
         AGENTHIPPO_MESSAGE: turn.message,
         AGENTHIPPO_WORKSPACE_ROOT: turn.workspaceRoot,
@@ -466,7 +503,10 @@ class CustomEngine {
         const attachmentsDir = path.join(workspaceSessionDir, 'attachments');
         const nativeSessionId = this.activeSessions.get(conversationKey)?.nativeSessionId ??
             (0, base_1.getPersistedSessionId)(`custom:${manifest.id}`, conversationKey);
-        const routing = (0, utils_1.resolveApiRouting)(options, this.config.litellmApiKey, this.config.litellmBaseUrl, runtime.configProvider);
+        // A custom engine isn't pinned to one vendor — infer its direct provider from the model
+        // (e.g. openclaw's litellm/* routes through the proxy anyway; a claude-* model → Anthropic).
+        // The engine's manifest still decides which env var receives the resolved key.
+        const routing = (0, utils_1.resolveApiRouting)(options, this.config, (0, utils_1.inferModelProvider)(options.modelId), runtime.configProvider);
         const routingApiKey = routing.apiKey?.trim() || undefined;
         const routingBaseUrl = routing.baseUrl?.trim() || undefined;
         const routingOpenAIBaseUrl = routing.openaiBaseUrl?.trim() || undefined;
@@ -532,15 +572,7 @@ class CustomEngine {
         if (manifest.homeEnvVar) {
             env[manifest.homeEnvVar] = engineHomeDir;
         }
-        if (manifest.model?.apiKeyEnvVar && routingApiKey) {
-            env[manifest.model.apiKeyEnvVar] = routingApiKey;
-        }
-        if (manifest.model?.baseUrlEnvVar && routingBaseUrl) {
-            env[manifest.model.baseUrlEnvVar] = routingBaseUrl;
-        }
-        if (manifest.model?.openaiBaseUrlEnvVar && routingOpenAIBaseUrl) {
-            env[manifest.model.openaiBaseUrlEnvVar] = routingOpenAIBaseUrl;
-        }
+        deliverModelRoutingEnv(env, manifest, { apiKey: routingApiKey, baseUrl: routingBaseUrl, openaiBaseUrl: routingOpenAIBaseUrl }, process.env, runtime.logger);
         if ((routingBaseUrl && (0, utils_1.applyLocalTlsBypass)(env, routingBaseUrl))
             || (routingOpenAIBaseUrl && routingOpenAIBaseUrl !== routingBaseUrl && (0, utils_1.applyLocalTlsBypass)(env, routingOpenAIBaseUrl))) {
             runtime.logger.info(`[AgentIDE] Disabling TLS verification for local HTTPS (${manifest.id})`);
@@ -550,7 +582,9 @@ class CustomEngine {
             : (routingBaseUrl ? 'custom provider' : 'native provider');
         runtime.logger.info(`[AgentIDE] Custom engine "${manifest.id}" routing: ${routingDescription}, baseUrl=${routingBaseUrl || 'default'}, model=${modelId}`);
         const resolvedMcp = await (0, mcp_1.loadMcpServers)(agentId, options.workspaceRoot, this.getBundledBasePromptsDir());
-        const mcpServers = (0, mcp_1.formatInlineMcpServers)(resolvedMcp);
+        // `env` is this turn's child env — URL servers resolve bearerTokenEnv (turn nonce)
+        // from it in memory, so per-turn auth never lands in a shared file.
+        const mcpServers = (0, mcp_1.formatInlineMcpServers)(resolvedMcp, env);
         if (resolvedMcp.length > 0) {
             runtime.logger.debug(`[AgentIDE] Custom engine "${manifest.id}" MCP (${agentId}): ${resolvedMcp.map(s => s.name).join(', ')}`);
         }