@agenthippo-ai/agenthippo 0.1.0 → 0.2.3-dataplane

package/out/extension.js

@@ -68,6 +68,7 @@ const serveClient_js_1 = require("./remote/serveClient.js");
 const remotePackStatusBar_js_1 = require("./remote/remotePackStatusBar.js");
 const provider_js_1 = require("./auth/provider.js");
 const signInFlow_js_1 = require("./auth/signInFlow.js");
+const onboardingPrompt_js_1 = require("./auth/onboardingPrompt.js");
 const githubStoreGate_js_1 = require("./auth/githubStoreGate.js");
 const sessionEvents_1 = require("./analytics/sessionEvents");
 const base_1 = require("./engines/base");
@@ -323,6 +324,7 @@ async function activate(context) {
     (0, provider_js_1.registerAgentHippoAuth)(context);
     void (0, provider_js_1.refreshBootstrapIfSignedIn)(context);
     context.subscriptions.push((0, provider_js_1.startAgentHippoTokenRefreshTimer)(context));
+    (0, onboardingPrompt_js_1.scheduleSignInOnboardingPrompt)(context);
     // Register commands
     registerCommands(context, _state);
     const remotePackStatusBar = new remotePackStatusBar_js_1.RemotePackStatusBar(syncService, () => getWorkspaceRoot(outputChannel).workspaceRoot, outputChannel);

package/out/gateway/outboundSend.js

@@ -172,12 +172,12 @@ function buildGatewaySendParams(handle, message, media) {
 function buildGatewayRpcCommand(handle, message, media) {
     return [exports.GATEWAY_OUTBOUND_RPC_METHOD, JSON.stringify(buildGatewaySendParams(handle, message, media))];
 }
-async function sendViaGatewayRpc(handle, message, media) {
+async function sendViaGatewayRpc(handle, message, media, explicitToken) {
     const gatewayUrl = process.env.OPENCLAW_GATEWAY_URL?.trim() || `ws://127.0.0.1:${DEFAULT_GATEWAY_PORT}`;
-    const token = (0, runtime_js_1.readOpenClawGatewayToken)();
-    if (token && !process.env.OPENCLAW_GATEWAY_TOKEN?.trim()) {
-        process.env.OPENCLAW_GATEWAY_TOKEN = token;
-    }
+    // Prefer the broker-supplied token; the env re-population that used to happen here is gone
+    // deliberately — under the egress broker it would re-leak the token into process.env, and
+    // every engine child spreads process.env (secure-obo-design §7.6).
+    const token = explicitToken?.trim() || (0, runtime_js_1.readOpenClawGatewayToken)();
     const { client, clientInfo } = (0, client_js_1.createEphemeralGatewayClient)(gatewayUrl, token);
     await client.connect(clientInfo);
     try {
@@ -218,7 +218,7 @@ async function sendGatewayOutboundMessage(handle, options) {
     const cliCommand = [cli, ...cliArgs];
     const rpcCommand = buildGatewayRpcCommand(handle, options.message, media);
     try {
-        const rpc = await sendViaGatewayRpc(handle, options.message, media);
+        const rpc = await sendViaGatewayRpc(handle, options.message, media, options.token);
         return {
             ok: true,
             via: 'gateway-rpc',

package/out/headless/index.js

@@ -175,6 +175,8 @@ const session_1 = require("../session");
 const sync_1 = require("./sync");
 const sessionEvents_1 = require("../analytics/sessionEvents");
 const runtime_1 = require("../cli/runtime");
+const credential_context_1 = require("../cli/credential-context");
+const paths_1 = require("../utils/paths");
 function resolveHeadlessAnalyticsUserId(runOverride, configOverride) {
     const fromRun = runOverride?.trim();
     if (fromRun) {
@@ -223,13 +225,18 @@ function createHeadlessRunner(config) {
         // the legacy single file at provider-sessions.json on first load.
         (0, session_1.initSessionStoreWithStore)(new interfaces_1.DirectorySessionStore(path.join(config.storagePath, 'provider-sessions')));
     }
-    // Build engine config
+    // Per-destination credentials. When a caller supplies the split keys (serve), use them so
+    // each engine picks the key for the endpoint it dials. Otherwise fall back to the single
+    // `apiKey` as the LiteLLM key (back-compat: eval/CLI runners configured one key).
+    const hasSplitKeys = Boolean(config.litellmApiKey || config.openaiApiKey || config.anthropicApiKey);
     const engineConfig = {
         storagePath: config.storagePath,
         codexHome: undefined,
         claudeConfigDir: undefined,
-        litellmApiKey: config.apiKey,
+        litellmApiKey: config.litellmApiKey ?? (hasSplitKeys ? undefined : config.apiKey),
         litellmBaseUrl: config.baseUrl,
+        openaiApiKey: config.openaiApiKey,
+        anthropicApiKey: config.anthropicApiKey,
         claudeCodeExecutablePath: config.claudeCodeExecutablePath,
         codexExecutablePath: config.codexExecutablePath,
     };
@@ -283,8 +290,12 @@ function createHeadlessRunner(config) {
         }
         return customEngine;
     };
-    // Shared session event writer for Layer 2 analytics
-    const sessionEventWriter = new sessionEvents_1.SessionEventWriter();
+    // Shared session event writer for Layer 2 analytics. Defaults to getAgentideHome() — the
+    // exact directory sessionJsonlFleet.ts and query-analytics.sh already scan, so tool-call/
+    // warrant events stay discoverable — but honors an explicit override (config.analyticsSessionsDir)
+    // so callers with their own state-dir precedence (serve.ts) don't regress durability when
+    // no AGENTHIPPO_HOME-style env var is set but a durable --state-dir was given explicitly.
+    const sessionEventWriter = new sessionEvents_1.SessionEventWriter(config.analyticsSessionsDir ?? path.join((0, paths_1.getAgentideHome)(), 'analytics', 'sessions'));
     return {
         async run(options) {
             const result = {
@@ -336,8 +347,10 @@ function createHeadlessRunner(config) {
             const requestId = (0, base_1.generateRequestId)();
             // Wrap emitter with observability (Layer 2 session events)
             // Session events are written to ~/.agent-hippo/analytics/sessions/<session_id>.jsonl
+            // Capture warrant userId here (inside serve's runWithCredential continuation), not
+            // later at tool emit — custom-engine IPC callbacks can lose/stick ambient ALS.
             const sessionId = options.sessionId ?? `headless-${Date.now()}`;
-            const observableEmitter = (0, sessionEvents_1.wrapEmitterWithObservability)(baseEmitter, sessionEventWriter, sessionId, requestId);
+            const observableEmitter = (0, sessionEvents_1.wrapEmitterWithObservability)(baseEmitter, sessionEventWriter, sessionId, requestId, (0, credential_context_1.currentCredential)()?.userId);
             const requestOptions = {
                 modelId: options.modelId,
                 engineId: options.engineId,
@@ -345,7 +358,11 @@ function createHeadlessRunner(config) {
                 additionalDirectories: options.additionalDirectories,
                 sessionId,
                 analyticsUserId: resolveHeadlessAnalyticsUserId(options.analyticsUserId, config.analyticsUserId),
-                apiKey: config.apiKey,
+                // With split keys (serve), leave options.apiKey UNSET so resolveApiRouting selects
+                // the key for the engine's destination — passing the collapsed key here would let
+                // it win over the correct provider key (the original bug). Back-compat single-key
+                // callers keep options.apiKey.
+                apiKey: hasSplitKeys ? undefined : config.apiKey,
                 baseUrl: config.baseUrl,
                 useLiteLLM: config.useLiteLLM,
                 agentPackId: packId,
@@ -364,6 +381,7 @@ function createHeadlessRunner(config) {
                         chatSessionId: sessionId,
                         gatewaySessionKey: options.gatewaySessionKey,
                     }),
+                    ...(options.turnEnv ?? {}),
                 },
             };
             try {

package/out/live-probe/connector.mjs

@@ -0,0 +1,8 @@
+
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+const server = new Server({ name: 'probe', version: '0.0.1' }, { capabilities: { tools: {} } });
+server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: [{ name: 'probe_tool', description: 'x', inputSchema: { type: 'object' } }] }));
+server.setRequestHandler(CallToolRequestSchema, async () => ({ content: [{ type: 'text', text: 'MAGIC=zebra42' }] }));
+await server.connect(new StdioServerTransport());

package/out/live-probe/env-report.mjs

@@ -0,0 +1,8 @@
+
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+const server = new Server({ name: 'env-report', version: '0.0.1' }, { capabilities: { tools: {} } });
+server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: [{ name: 'report_env', description: 'reports a probe env var', inputSchema: { type: 'object' } }] }));
+server.setRequestHandler(CallToolRequestSchema, async () => ({ content: [{ type: 'text', text: 'PROBE_SEEN=' + (process.env.AGENTHIPPO_PROBE_ENV || 'ABSENT') }] }));
+await server.connect(new StdioServerTransport());

package/out/mcp.js

@@ -36,14 +36,14 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AGENTHIPPO_MCP_SERVERS_ENV = exports.AGENTHIPPO_DATA_TOKEN_FILE_ENV = void 0;
+exports.AGENTHIPPO_MCP_SERVERS_ENV = exports.ALLOW_INLINE_DATA_TOKEN_ENV = void 0;
 exports.loadMcpServers = loadMcpServers;
 exports.resolveMcpEnvVar = resolveMcpEnvVar;
-exports.mcpConfigCacheSignatureSuffix = mcpConfigCacheSignatureSuffix;
 exports.resolveMcpServerEnv = resolveMcpServerEnv;
 exports.generateCodexMcpConfig = generateCodexMcpConfig;
 exports.getDefaultMcpConfig = getDefaultMcpConfig;
 exports.loadBundledMcpServers = loadBundledMcpServers;
+exports.resolveHttpMcpHeaders = resolveHttpMcpHeaders;
 exports.formatInlineMcpServers = formatInlineMcpServers;
 exports.serializeInlineMcpServers = serializeInlineMcpServers;
 exports.parseInlineMcpServers = parseInlineMcpServers;
@@ -64,11 +64,16 @@ const MCP_CONFIG_FILE = '.mcp.json';
 /** MCP servers subdirectory in base-prompts */
 const MCP_SERVERS_DIR = 'mcp-servers';
 /**
- * Env var passed to stdio MCP child processes: path to the per-turn data credential
- * file (OBO token, etc.). MCP servers read this file on each tool call — spawn env
- * is fixed at process start and cannot use AsyncLocalStorage.
+ * Explicit local-dev opt-in: allow the per-turn data credential to be resolved INLINE into
+ * MCP child env / `${credential:dataToken}` placeholders. Off by default — in any real
+ * deployment the credential must stay in the broker and reach tools only via the loopback
+ * data-plane gateway + turn nonce (secure-obo-design §2). Without this flag, a credential-
+ * backed value resolves to nothing and the pack's connector fails closed with its own error.
  */
-exports.AGENTHIPPO_DATA_TOKEN_FILE_ENV = 'AGENTHIPPO_DATA_TOKEN_FILE';
+exports.ALLOW_INLINE_DATA_TOKEN_ENV = 'AGENTHIPPO_ALLOW_INLINE_DATA_TOKEN';
+function inlineDataTokenAllowed() {
+    return /^(1|true)$/i.test(process.env[exports.ALLOW_INLINE_DATA_TOKEN_ENV]?.trim() ?? '');
+}
 const ENV_PLACEHOLDER = /\$\{env:(\w+)\}/g;
 const CREDENTIAL_PLACEHOLDER = /\$\{credential:(\w+)\}/g;
 // -----------------------------------------------------------------------------
@@ -146,14 +151,23 @@ async function resolveServerEntry(name, entry, mcpDir, bundledMcpDir, envSources
     }
     // HTTP Streamable MCP server — no subprocess needed
     if (entry.url) {
+        // `${env:VAR}` in the URL resolves against the serve process env (e.g. the
+        // boot-stable AGENTHIPPO_DATA_MCP_URL of the loopback data-plane gateway).
+        const url = entry.url.replace(ENV_PLACEHOLDER, (_, varName) => resolvePlainEnvVar(varName, envSources)).trim();
+        if (!url) {
+            // Placeholder didn't resolve (e.g. gateway-backed entry loaded outside serve):
+            // drop the server rather than hand engines a broken empty-URL entry.
+            return null;
+        }
         return {
             name,
             label: entry.label ?? name,
             description: entry.description,
             command: '',
             args: [],
-            url: entry.url,
+            url,
             headers: resolveHeaders(entry.headers, envSources),
+            bearerTokenEnv: entry.bearerTokenEnv?.trim() || undefined,
         };
     }
     // Custom stdio server - resolve relative paths from mcpDir
@@ -255,82 +269,63 @@ function resolveArgs(args, serverDir) {
 /**
  * Resolve a single ${env:VAR} reference for MCP child processes.
  *
- * The turn's OBO data token is exposed two ways:
+ * The turn's OBO data token is exposed two ways, BOTH gated behind the explicit
+ * local-dev opt-in {@link ALLOW_INLINE_DATA_TOKEN_ENV}:
  *   - `${credential:dataToken}` placeholder (pack-author-facing; handled in resolveEnv).
- *   - A configurable set of env-var aliases (default `DATABRICKS_TOKEN`) for packs that
- *     reference the token via `${env:VAR}` directly. Override the alias list with the
- *     `AGENTHIPPO_DATA_TOKEN_ENV_VARS` env var (comma-separated) — keeps this helper
- *     vendor-neutral instead of hardcoding one provider's token name.
+ *   - A configurable set of env-var aliases for packs that reference the token via
+ *     `${env:VAR}` directly (`AGENTHIPPO_DATA_TOKEN_ENV_VARS`, comma-separated; empty
+ *     by default — inline aliasing must be declared, never ambient).
  *
- * When a turn-scoped data token file exists, the token is NOT baked into spawn env —
- * MCP servers read it from AGENTHIPPO_DATA_TOKEN_FILE on each tool call instead.
+ * In a real deployment neither fires: the credential stays in the broker and tools reach
+ * it via the loopback data-plane gateway + turn nonce (secure-obo-design §3).
  */
 function resolveMcpEnvVar(varName, envSources = {}) {
-    const cred = (0, credential_context_1.currentCredential)();
-    const tokenFile = cred?.dataTokenFile;
     const aliases = getDataTokenEnvAliases();
-    const isDataTokenVar = varName === 'dataToken' || aliases.includes(varName);
-    if (tokenFile && isDataTokenVar) {
-        // Token lives in the per-turn file (AGENTHIPPO_DATA_TOKEN_FILE); don't bake into spawn env.
-        return '';
-    }
     if (varName === 'dataToken') {
-        return cred?.dataToken?.trim() ?? '';
+        const tok = (0, credential_context_1.currentCredential)()?.dataToken?.trim();
+        return tok && inlineDataTokenAllowed() ? tok : '';
     }
-    if (cred?.dataToken?.trim() && aliases.includes(varName)) {
-        return cred.dataToken.trim();
+    if (aliases.includes(varName)) {
+        const tok = (0, credential_context_1.currentCredential)()?.dataToken?.trim();
+        if (tok && inlineDataTokenAllowed()) {
+            return tok;
+        }
     }
     return process.env[varName] ?? envSources[varName] ?? '';
 }
 /**
  * Env-var names that resolve to the turn's OBO data token when a pack references
- * `${env:VAR}` directly. Defaults to `DATABRICKS_TOKEN`; override at deploy time via
- * `AGENTHIPPO_DATA_TOKEN_ENV_VARS=VAR1,VAR2` (empty value → no aliases).
+ * `${env:VAR}` directly. Empty by default — set `AGENTHIPPO_DATA_TOKEN_ENV_VARS=VAR1,VAR2`
+ * (together with the inline opt-in) to enable. The old implicit `DATABRICKS_TOKEN` default
+ * was removed with the disk token path: inline credential exposure is now always explicit.
  */
 function getDataTokenEnvAliases() {
     const raw = process.env.AGENTHIPPO_DATA_TOKEN_ENV_VARS;
     if (raw !== undefined) {
         return raw.split(',').map((v) => v.trim()).filter(Boolean);
     }
-    return ['DATABRICKS_TOKEN'];
+    return [];
 }
 function envValueUsesCredentialDataToken(value) {
     return /\$\{credential:dataToken\}/.test(value);
 }
-/** Suffix for Codex config.toml cache invalidation when MCP credential scope changes. */
-function mcpConfigCacheSignatureSuffix() {
-    const cred = (0, credential_context_1.currentCredential)();
-    const aliases = getDataTokenEnvAliases();
-    if (cred?.dataTokenFile) {
-        return `file:${cred.dataTokenFile}:aliases=${aliases.join(',')}`;
-    }
-    if (cred?.dataToken?.trim()) {
-        return `inline-token:aliases=${aliases.join(',')}`;
-    }
-    return `no-token:aliases=${aliases.join(',')}`;
-}
 function resolveEnv(env, envSources = {}) {
     if (!env) {
         return undefined;
     }
     const resolved = {};
-    const tokenFile = (0, credential_context_1.currentCredential)()?.dataTokenFile;
-    if (tokenFile) {
-        resolved[exports.AGENTHIPPO_DATA_TOKEN_FILE_ENV] = tokenFile;
-    }
     for (const [key, value] of Object.entries(env)) {
         CREDENTIAL_PLACEHOLDER.lastIndex = 0;
         if (envValueUsesCredentialDataToken(value)) {
-            // Credential-backed secret. When a per-turn token file exists, the key is intentionally
-            // NOT set here: the MCP server reads the token from AGENTHIPPO_DATA_TOKEN_FILE
-            // (injected above) on each tool call, so baking it into spawn env would be redundant
-            // and would leak the turn-scoped token into the long-lived child process env.
-            // Prefer the OBO token file, then inline token, then env fallback.
-            if (tokenFile) {
-                // AGENTHIPPO_DATA_TOKEN_FILE already injected above; don't bake the token here.
-            }
-            else if ((0, credential_context_1.currentCredential)()?.dataToken?.trim()) {
-                resolved[key] = (0, credential_context_1.currentCredential)().dataToken.trim();
+            // Credential-backed secret. Baked into spawn env ONLY behind the explicit
+            // local-dev opt-in — the supported transport is the data-plane gateway, where
+            // the credential never leaves the broker process (secure-obo-design §2).
+            const tok = (0, credential_context_1.currentCredential)()?.dataToken?.trim();
+            if (tok) {
+                if (inlineDataTokenAllowed()) {
+                    resolved[key] = tok;
+                }
+                // else: intentionally unset — the connector fails closed with its own error.
             }
             else {
                 // No OBO credential (local dev / non-serve context): fall back to env var.
@@ -429,12 +424,14 @@ function generateCodexMcpConfig(servers, options) {
     if (servers.length === 0) {
         return '';
     }
-    // `default_tools_approval_mode = "auto"` is the documented Codex 0.122+ per-server key
-    // (values: auto/prompt/approve) that lets MCP tools run without an interactive prompt.
+    // `default_tools_approval_mode = "approve"` is the Codex per-server key that lets MCP
+    // tools run without an interactive prompt. The value enum is prompt|approve — "auto" is
+    // NOT valid: Codex ≥0.131 silently ignores it, defaults the server to `prompt`, and a
+    // headless `codex exec` turn then auto-Cancels the approval elicitation, surfacing as
+    // "user cancelled MCP tool call" on every tool call (verified live against 0.131.0).
     // Only emit it in headless/serve auto-approve contexts — the interactive IDE path leaves
-    // it unset so users get Codex's normal approval prompts. The previous `approval_mode =
-    // "never"` was an invalid key/value and was silently ignored by the Codex CLI.
-    const approvalLine = options?.autoApprove ? 'default_tools_approval_mode = "auto"' : undefined;
+    // it unset so users get Codex's normal approval prompts.
+    const approvalLine = options?.autoApprove ? 'default_tools_approval_mode = "approve"' : undefined;
     const sections = servers.map(s => {
         // HTTP Streamable MCP server — codex connects via URL, no subprocess
         if (s.url) {
@@ -442,6 +439,13 @@ function generateCodexMcpConfig(servers, options) {
                 `[mcp_servers.${s.name}]`,
                 `url = ${JSON.stringify(s.url)}`,
             ];
+            if (s.bearerTokenEnv) {
+                // The auth token is read from the codex PROCESS env at request time
+                // (per-spawn codexEnv carries the turn nonce) — the config file itself
+                // stays byte-identical across turns, which is what removes the
+                // cross-user config.toml race (secure-obo-design §3.2).
+                urlLines.push(`bearer_token_env_var = ${JSON.stringify(s.bearerTokenEnv)}`);
+            }
             if (s.headers && Object.keys(s.headers).length > 0) {
                 const headerEntries = Object.entries(s.headers)
                     .map(([k, v]) => `${JSON.stringify(k)} = ${JSON.stringify(v)}`)
@@ -465,7 +469,9 @@ function generateCodexMcpConfig(servers, options) {
             // Use separate [mcp_servers.name.env] section — codex binary requires this form
             lines.push('', `[mcp_servers.${s.name}.env]`);
             for (const [k, v] of Object.entries(s.env)) {
-                lines.push(`${k} = ${JSON.stringify(v)}`);
+                // Quote the key: env-var names may contain '.', spaces, etc. that are not valid
+                // TOML bare keys (a bare `my.token` would parse as a nested table).
+                lines.push(`${JSON.stringify(k)} = ${JSON.stringify(v)}`);
             }
         }
         return lines.join('\n');
@@ -532,6 +538,23 @@ async function loadBundledMcpServers(basePromptsDir) {
 }
 /** Env var carrying JSON-serialized {@link InlineMcpServers} into custom engine workers. */
 exports.AGENTHIPPO_MCP_SERVERS_ENV = 'AGENTHIPPO_MCP_SERVERS';
+/**
+ * Resolve the final HTTP headers for a URL-based MCP server, applying `bearerTokenEnv`
+ * against the ENGINE'S per-turn env (process.env + per-spawn patch). Engines that build
+ * their MCP config in memory per turn (claude, custom) call this with the same env they
+ * hand the engine subprocess, so the turn nonce lands in the request header without ever
+ * touching a shared file.
+ */
+function resolveHttpMcpHeaders(server, turnEnv) {
+    const headers = { ...(server.headers ?? {}) };
+    if (server.bearerTokenEnv) {
+        const token = turnEnv[server.bearerTokenEnv]?.trim();
+        if (token) {
+            headers['Authorization'] = `Bearer ${token}`;
+        }
+    }
+    return Object.keys(headers).length > 0 ? headers : undefined;
+}
 /**
  * Convert resolved pack MCP servers to the inline record shape engines consume.
  *
@@ -539,15 +562,19 @@ exports.AGENTHIPPO_MCP_SERVERS_ENV = 'AGENTHIPPO_MCP_SERVERS';
  * `{ type: 'http', url, headers? }` — the Cursor SDK (`@cursor/sdk` McpServerConfig) accepts
  * this shape inline, so remote MCP servers are available to cursor/custom engines, not just
  * to the Codex engine (which gets them via config.toml).
+ *
+ * `turnEnv` (when provided) resolves each URL server's `bearerTokenEnv` into a concrete
+ * Authorization header — pass the same env the engine subprocess will receive.
  */
-function formatInlineMcpServers(servers) {
+function formatInlineMcpServers(servers, turnEnv) {
     const mcpServers = {};
     for (const server of servers) {
         if (server.url) {
+            const headers = resolveHttpMcpHeaders(server, turnEnv ?? process.env);
             mcpServers[server.name] = {
                 type: 'http',
                 url: server.url,
-                ...(server.headers && Object.keys(server.headers).length > 0 ? { headers: server.headers } : {}),
+                ...(headers ? { headers } : {}),
             };
             continue;
         }

package/out/remote/handleRemoteChat.js

@@ -96,13 +96,19 @@ async function handleRemoteServeChat(deps, args) {
     try {
         syncService.incrementActiveAgentTurns();
         await observableEmitter.emitTurnStart();
-        await (0, serveClient_js_1.streamRemoteServeChat)({
+        const result = await (0, serveClient_js_1.streamRemoteServeChat)({
             baseUrl: remoteUrl,
             message,
             sessionId: remoteSessionId,
             signal: abortController.signal,
             auth,
         }, observableEmitter);
+        if (!result.ok) {
+            // streamRemoteServeChat already surfaced the failure to the emitter (error + done);
+            // record the turn as failed and propagate to the caller without re-emitting.
+            await observableEmitter.emitTurnEnd(false);
+            return { error: result.error ?? 'Remote serve failed' };
+        }
         await observableEmitter.emitTurnEnd(true);
         return { streaming: true };
     }

package/out/remote/serveClient.js

@@ -77,7 +77,7 @@ async function streamRemoteServeChat(options, emitter) {
         const message = err instanceof Error ? err.message : 'Remote serve connection failed';
         await emitter.error(message);
         await emitter.done();
-        return;
+        return { ok: false, error: message };
     }
     if (!response.ok) {
         clearTimers();
@@ -93,29 +93,39 @@ async function streamRemoteServeChat(options, emitter) {
         }
         await emitter.error(errorMessage);
         await emitter.done();
-        return;
+        return { ok: false, error: errorMessage };
     }
     if (!response.body) {
         clearTimers();
-        await emitter.error('Remote serve returned empty body');
+        const message = 'Remote serve returned empty body';
+        await emitter.error(message);
         await emitter.done();
-        return;
+        return { ok: false, error: message };
     }
     try {
-        await consumeServeSse(response.body, emitter, resetIdle);
+        const streamError = await consumeServeSse(response.body, emitter, resetIdle);
+        return streamError ? { ok: false, error: streamError } : { ok: true };
     }
     finally {
         clearTimers();
     }
 }
+/**
+ * Consume the SSE stream. Returns the message of an `error` event if one was seen
+ * (the turn failed even though the stream ended cleanly), otherwise undefined.
+ */
 async function consumeServeSse(body, emitter, resetIdle) {
     const reader = body.getReader();
     const decoder = new TextDecoder();
     let buffer = '';
     let doneEmitted = false;
+    let streamError;
     const markDone = () => {
         doneEmitted = true;
     };
+    const markError = (message) => {
+        streamError = message;
+    };
     try {
         while (true) {
             const { value, done } = await reader.read();
@@ -125,24 +135,25 @@ async function consumeServeSse(body, emitter, resetIdle) {
             // Any data on the wire means the turn is progressing — push the idle window out.
             resetIdle();
             buffer += decoder.decode(value, { stream: true });
-            buffer = await drainServeSseBuffer(buffer, emitter, markDone);
+            buffer = await drainServeSseBuffer(buffer, emitter, markDone, markError);
             if (doneEmitted) {
-                return;
+                return streamError;
             }
         }
         buffer += decoder.decode();
         if (buffer.trim()) {
-            await drainServeSseBuffer(`${buffer}\n`, emitter, markDone);
+            await drainServeSseBuffer(`${buffer}\n`, emitter, markDone, markError);
         }
         if (!doneEmitted) {
             await emitter.done();
         }
+        return streamError;
     }
     finally {
         reader.releaseLock();
     }
 }
-async function drainServeSseBuffer(buffer, emitter, markDone) {
+async function drainServeSseBuffer(buffer, emitter, markDone, markError) {
     const lines = buffer.split('\n');
     const remainder = lines.pop() ?? '';
     for (const line of lines) {
@@ -160,7 +171,7 @@ async function drainServeSseBuffer(buffer, emitter, markDone) {
         catch {
             continue;
         }
-        const finished = await dispatchServeEvent(event, emitter);
+        const finished = await dispatchServeEvent(event, emitter, markError);
         if (finished) {
             markDone();
             return '';
@@ -168,7 +179,7 @@ async function drainServeSseBuffer(buffer, emitter, markDone) {
     }
     return remainder;
 }
-async function dispatchServeEvent(event, emitter) {
+async function dispatchServeEvent(event, emitter, markError) {
     const type = typeof event.type === 'string' ? event.type : '';
     switch (type) {
         case 'thinking':
@@ -204,9 +215,12 @@ async function dispatchServeEvent(event, emitter) {
             }
             return false;
         }
-        case 'error':
-            await emitter.error(typeof event.message === 'string' ? event.message : 'Remote serve error');
+        case 'error': {
+            const message = typeof event.message === 'string' ? event.message : 'Remote serve error';
+            markError(message);
+            await emitter.error(message);
             return false;
+        }
         case 'done':
             await emitter.done();
             return true;

package/out/scripts/analytics/agentide-litellm-otel.config.yaml

@@ -158,3 +158,17 @@ model_list:
       api_base: https://api.openai.com/v1
     model_info:
       upstream_provider: "openai"
+
+  # Fleet / Cloud Run: ah-auto resolves via the central AgentHippo model gateway (same as
+  # colocated agents with AGENTHIPPO_LITELLM_BASE_URL=https://gateway.agenthippo.ai/v1).
+  # Set AGENTHIPPO_GATEWAY_KEY to an ahgw_… service key (create-gateway-key on the gateway host).
+  - model_name: ah-auto
+    litellm_params:
+      # openai/ prefix required — bare `ah-auto` fails LiteLLM router deployment (no provider).
+      model: openai/ah-auto
+      api_base: https://gateway.agenthippo.ai/v1
+      api_key: os.environ/AGENTHIPPO_GATEWAY_KEY
+      drop_params: true
+      additional_drop_params: ["user", "max_output_tokens", "reasoning.effort", "reasoning_effort"]
+    model_info:
+      upstream_provider: "agenthippo-gateway"

package/out/shared/models.js

@@ -25,7 +25,7 @@ exports.BUILTIN_MODELS = [
     // ===========================================
     {
         id: 'ah-auto',
-        name: 'AH-Auto',
+        name: 'Auto',
         provider: 'agenthippo',
         contextWindow: 200000,
         maxOutputTokens: 8192,

package/out/shared/providers.js

@@ -73,12 +73,13 @@ exports.PROVIDERS = {
     },
     litellm: {
         id: 'litellm',
-        displayName: 'LiteLLM (Recommended)',
+        displayName: 'LiteLLM',
         endpointSettingKey: 'agentide.providers.litellm.baseUrl',
         requiresApiKey: true,
         description: 'local adapter for agents to work with Spotlight and all models from OpenAI, Anthropic, Ollama etc.',
         showInAddApiKeyUI: true,
         isGateway: true, // Can route to any backend
+        deferMissingApiKey: true, // base-url configured; key may be empty in dev
     },
     ollama: {
         id: 'ollama',
@@ -95,13 +96,15 @@ exports.PROVIDERS = {
     agenthippo: {
         id: 'agenthippo',
         displayName: 'AgentHippo Gateway',
-        defaultEndpoint: 'https://api.agenthippo.ai/v1',
+        defaultEndpoint: 'https://gateway.agenthippo.ai/v1',
         endpointSettingKey: 'agentide.AgentHippoModelGateway.url',
         requiresApiKey: true,
         description: 'AgentHippo managed gateway — uses account JWT, picks model automatically',
         showInAddApiKeyUI: false,
         isGateway: true,
         staticHeaders: { 'x-agenthippo-source': 'chat-ui' },
+        credentialRefreshCommand: 'agentide.auth.refreshToken', // refresh stale sign-in JWT on 401
+        deferMissingApiKey: true, // key is the sign-in JWT; route branch prompts sign-in
     },
 };
 // -----------------------------------------------------------------------------