@agenthippo-ai/agenthippo 0.1.0

package/out/cli/serve-hardening.js

@@ -0,0 +1,325 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TurnLimiter = exports.RateLimiter = exports.CONTAINER_SERVE_HOST = exports.SERVE_HOST_ENV = exports.DEFAULT_BIND_HOST = exports.DEFAULT_MAX_BODY_BYTES = void 0;
+exports.resolveStateDir = resolveStateDir;
+exports.resolveBindHost = resolveBindHost;
+exports.clientIp = clientIp;
+exports.resolveUserId = resolveUserId;
+exports.resolveDataToken = resolveDataToken;
+exports.peerToUserId = peerToUserId;
+exports.corsHeaders = corsHeaders;
+exports.readBodyWithCap = readBodyWithCap;
+/**
+ * Serve helpers: state-dir resolution, identity header reading, CORS, turn limiting, body cap.
+ *
+ * Auth and credential checking are the deploy layer's responsibility (Caddy, Cloud Run IAP,
+ * Databricks Apps SSO, etc.). Serve trusts the identity headers set by the layer in front;
+ * it does not validate tokens or enforce bearer keys itself.
+ *
+ * SECURITY CONTRACT: serve trusts the identity and data-token headers below unconditionally.
+ * It MUST sit behind a proxy that (a) authenticates the caller and sets the identity header,
+ * and (b) STRIPS any client-supplied copies of these headers on the way in.
+ */
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+/** Default cap on a single request body (1 MiB). Chat messages are small; large bodies are abuse or bugs. */
+exports.DEFAULT_MAX_BODY_BYTES = 1024 * 1024;
+/**
+ * Resolve where session state is persisted. Precedence:
+ *   1. explicit --state-dir
+ *   2. AGENTHIPPO_HOME (the documented container mount point)
+ *   3. tmpdir (dev/local only; lost on restart)
+ *
+ * Returns `{ dir, ephemeral }` so the caller can warn when ephemeral state is
+ * detected in a long-lived deployment.
+ */
+function resolveStateDir(stateDirOpt, env = process.env) {
+    const explicit = stateDirOpt?.trim();
+    if (explicit) {
+        return { dir: path.resolve(explicit), ephemeral: false };
+    }
+    const home = env.AGENTHIPPO_HOME?.trim() || env.AGENTIDE_HOME?.trim();
+    if (home) {
+        return { dir: path.join(path.resolve(home), 'serve-state'), ephemeral: false };
+    }
+    return { dir: path.join(os.tmpdir(), 'agenthippo-server'), ephemeral: true };
+}
+/** Loopback default — safe everywhere a human runs `serve` locally. */
+exports.DEFAULT_BIND_HOST = '127.0.0.1';
+/** Env var for the listen address (used by generated deploy Dockerfiles). */
+exports.SERVE_HOST_ENV = 'AGENTHIPPO_SERVE_HOST';
+/** Bind address baked into container deploy artifacts (Docker / Cloud Run sidecars). */
+exports.CONTAINER_SERVE_HOST = '0.0.0.0';
+/**
+ * Resolve the listen address. Precedence: explicit `--host` → AGENTHIPPO_SERVE_HOST → 127.0.0.1.
+ *
+ * Defaults to loopback so a local `serve` is never reachable off-box by accident. Containers
+ * (where the SSO proxy reaches the agent over a Docker network) MUST opt into `0.0.0.0` —
+ * generated deploy artifacts set `AGENTHIPPO_SERVE_HOST=0.0.0.0` for exactly this reason.
+ */
+function resolveBindHost(hostOpt, env = process.env) {
+    return hostOpt?.trim() || env.AGENTHIPPO_SERVE_HOST?.trim() || exports.DEFAULT_BIND_HOST;
+}
+/**
+ * Best-effort client IP for rate-limiting keys.
+ *
+ * Behind the documented single trusted proxy (Caddy), `X-Forwarded-For` ends with the IP the
+ * proxy observed, so the right-most entry is the real client (a client-spoofed left-most entry
+ * is just prepended). Falls back to the socket address for direct/local callers. This is a
+ * coarse abuse key, not an identity — never use it for authorization.
+ */
+function clientIp(req) {
+    const xff = req.headers['x-forwarded-for'];
+    const raw = Array.isArray(xff) ? xff[0] : xff;
+    if (raw) {
+        const parts = raw.split(',').map((s) => s.trim()).filter(Boolean);
+        if (parts.length > 0) {
+            return parts[parts.length - 1];
+        }
+    }
+    return req.socket?.remoteAddress || 'unknown';
+}
+/**
+ * Fixed-window request rate limiter (per key, in-memory, per-process). Complements the
+ * per-session TurnLimiter: keying on a stable identity (user id, or client IP) closes the
+ * "rotate session_id to bypass" gap. `maxPerWindow <= 0` disables it.
+ */
+class RateLimiter {
+    maxPerWindow;
+    windowMs;
+    hits = new Map();
+    /** Cap the key map so a flood of distinct keys can't grow memory unbounded. */
+    static MAX_KEYS = 100_000;
+    constructor(maxPerWindow, windowMs = 60_000) {
+        this.maxPerWindow = maxPerWindow;
+        this.windowMs = windowMs;
+    }
+    /** Returns true if the request is allowed (and records it); false when the window cap is hit. */
+    tryConsume(key, now = Date.now()) {
+        if (!Number.isFinite(this.maxPerWindow) || this.maxPerWindow <= 0) {
+            return true; // disabled
+        }
+        const entry = this.hits.get(key);
+        if (!entry || entry.resetAt <= now) {
+            if (this.hits.size >= RateLimiter.MAX_KEYS) {
+                this.prune(now);
+            }
+            this.hits.set(key, { count: 1, resetAt: now + this.windowMs });
+            return true;
+        }
+        if (entry.count >= this.maxPerWindow) {
+            return false;
+        }
+        entry.count += 1;
+        return true;
+    }
+    /** Seconds until the key's window resets — for a Retry-After header. */
+    retryAfterSeconds(key, now = Date.now()) {
+        const entry = this.hits.get(key);
+        if (!entry) {
+            return Math.ceil(this.windowMs / 1000);
+        }
+        return Math.max(1, Math.ceil((entry.resetAt - now) / 1000));
+    }
+    prune(now) {
+        for (const [key, entry] of this.hits) {
+            if (entry.resetAt <= now) {
+                this.hits.delete(key);
+            }
+        }
+        if (this.hits.size >= RateLimiter.MAX_KEYS) {
+            this.hits.clear();
+        }
+    }
+}
+exports.RateLimiter = RateLimiter;
+const HEADER_ALIASES = [
+    'x-agent-user', // AgentHippo canonical (set by our Worker / generic proxy)
+    'x-forwarded-email', // Databricks Apps
+    'x-forwarded-preferred-username', // Databricks Apps
+    'x-goog-authenticated-user-email', // Cloud Run IAP (prefixed value, stripped below)
+    'cf-access-authenticated-user-email', // Cloudflare Access
+];
+/**
+ * Resolve the end-user identity for a request.
+ *
+ * Proxy headers win over the request body — the header is set by the SSO proxy
+ * serve sits behind; the body is client-controlled. Falls back to body.user_id
+ * for dev/internal use (e.g. direct curl against a local serve).
+ *
+ * Resolves identity for `analyticsUserId` attribution and the request-scoped
+ * credential context (per-user data scoping). Not folded into the session key —
+ * session continuity uses the client-supplied `session_id`.
+ *
+ * Per-turn *data credentials* (OBO token, e.g. X-Forwarded-Access-Token) are
+ * handled by resolveDataToken — not read here.
+ */
+function resolveUserId(headers, body) {
+    for (const name of HEADER_ALIASES) {
+        const v = headers[name];
+        const raw = (Array.isArray(v) ? v[0] : v)?.trim();
+        if (raw) {
+            // IAP sends "accounts.google.com:user@x.com"; keep the email half.
+            const colon = raw.lastIndexOf(':');
+            const value = colon >= 0 && raw.slice(colon + 1).includes('@') ? raw.slice(colon + 1) : raw;
+            return value;
+        }
+    }
+    const fromBody = body?.user_id?.trim();
+    return fromBody || undefined;
+}
+const DATA_TOKEN_HEADERS = [
+    'x-forwarded-access-token', // Databricks Apps OBO token
+    'x-agent-data-token', // AgentHippo generic per-turn data credential
+];
+/**
+ * Resolve the per-turn *data* credential (the OBO token), distinct from the
+ * identity in resolveUserId. Fed into the request-scoped credential context so
+ * a data tool can act as the asking user. serve-v3 §11.1 (Design B).
+ *
+ * Like the identity headers, this is trusted unconditionally and is only safe
+ * behind a proxy that strips client-supplied copies (see the module SECURITY
+ * CONTRACT above).
+ */
+function resolveDataToken(headers) {
+    for (const name of DATA_TOKEN_HEADERS) {
+        const v = headers[name];
+        const raw = (Array.isArray(v) ? v[0] : v)?.trim();
+        if (raw) {
+            return raw;
+        }
+    }
+    return undefined;
+}
+/**
+ * Map a gateway channel sender (PeerInfo) to a stable `user_id` (serve-v3 §11 / #4).
+ * Prefers the stable channel id, namespaced by channel, so the Slack/Telegram
+ * sender becomes the user_id that drives per-user attribution and data scoping —
+ * extending the per-user-permission wedge to channel surfaces.
+ */
+function peerToUserId(peer) {
+    if (!peer) {
+        return undefined;
+    }
+    const id = peer.senderId?.trim() || peer.senderUsername?.trim() || peer.senderName?.trim();
+    if (!id) {
+        return undefined;
+    }
+    const channel = peer.channel?.trim();
+    return channel ? `${channel}:${id}` : id;
+}
+/** Build CORS headers. Serve is always behind a proxy; CORS is wide-open here. */
+function corsHeaders() {
+    return {
+        'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
+        'Access-Control-Allow-Headers': 'Content-Type, Authorization, X-Agent-User',
+        'Access-Control-Allow-Origin': '*',
+    };
+}
+/**
+ * Per-session turn admission control. Caps the number of turns a single
+ * conversation may run (abuse / runaway-loop guard for exposed deployments).
+ * In-memory and per-process — sufficient for single-container tiers; a shared
+ * store is a later concern.
+ */
+class TurnLimiter {
+    maxPerSession;
+    counts = new Map();
+    constructor(maxPerSession) {
+        this.maxPerSession = maxPerSession;
+    }
+    /** Returns true if the turn is allowed (and records it); false when the cap is exceeded. */
+    tryConsume(sessionKey) {
+        if (!Number.isFinite(this.maxPerSession) || this.maxPerSession <= 0) {
+            return true; // disabled
+        }
+        const current = this.counts.get(sessionKey) ?? 0;
+        if (current >= this.maxPerSession) {
+            return false;
+        }
+        this.counts.set(sessionKey, current + 1);
+        return true;
+    }
+    reset(sessionKey) {
+        this.counts.delete(sessionKey);
+    }
+}
+exports.TurnLimiter = TurnLimiter;
+/**
+ * Read a request body with a hard size cap. Past the cap it stops accumulating
+ * and rejects with a `tooLarge`-tagged error so the caller can respond 413.
+ *
+ * Deliberately does NOT destroy the socket here: destroying mid-upload resets
+ * the connection before the 413 can flush (the client only ever sees the
+ * interim 100-continue). We detach our listeners and let the handler send 413
+ * with `Connection: close`. Replaces serve's unbounded body accumulation.
+ */
+function readBodyWithCap(req, maxBytes = exports.DEFAULT_MAX_BODY_BYTES) {
+    return new Promise((resolve, reject) => {
+        let size = 0;
+        const chunks = [];
+        const onData = (chunk) => {
+            size += chunk.length;
+            if (size > maxBytes) {
+                cleanup();
+                const err = new Error(`Request body exceeds ${maxBytes} bytes`);
+                err.tooLarge = true;
+                reject(err);
+                return;
+            }
+            chunks.push(chunk);
+        };
+        const onEnd = () => {
+            cleanup();
+            resolve(Buffer.concat(chunks).toString('utf8'));
+        };
+        const onError = (err) => {
+            cleanup();
+            reject(err);
+        };
+        const cleanup = () => {
+            req.off('data', onData);
+            req.off('end', onEnd);
+            req.off('error', onError);
+        };
+        req.on('data', onData);
+        req.on('end', onEnd);
+        req.on('error', onError);
+    });
+}

package/out/cli/state-sync.js

@@ -0,0 +1,135 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isAwsCliAvailable = isAwsCliAvailable;
+exports.resolveS3StateConfig = resolveS3StateConfig;
+exports.restoreState = restoreState;
+exports.pushState = pushState;
+exports.makeStatePusher = makeStatePusher;
+/**
+ * Object-store state sync (serve-v3 Q1, shared SessionStore).
+ *
+ * Persists the durable state root (/state) to an S3-compatible object store so
+ * sessions survive scale-to-zero / a fresh instance even where there is NO
+ * filesystem mount (Cloudflare R2, Databricks → S3/DBFS), and so a sticky-routed
+ * fleet replica can reload an affinity-owned session.
+ *
+ * Strategy (agreed): boot restore + per-turn async-delta push (debounced, off
+ * the response path) + a SIGTERM flush. Uses `aws s3 sync` (delta by default;
+ * S3-compatible via --endpoint-url → MinIO / R2 / GCS / S3) so we add no SDK to
+ * the binary. Single-writer-per-session safety comes from sticky-by-session_id.
+ *
+ * Config (no-op unless AGENTHIPPO_STATE_S3_URI is set):
+ *   AGENTHIPPO_STATE_S3_URI       s3://bucket/prefix
+ *   AGENTHIPPO_STATE_S3_ENDPOINT  http://minio:9000  (for non-AWS S3)
+ *   AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_REGION   (standard aws creds)
+ */
+const child_process_1 = require("child_process");
+const util_1 = require("util");
+const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
+/**
+ * Verify the `aws` CLI is callable. State sync shells out to it, so when S3 is
+ * configured a missing binary means silent data loss — callers should fail fast.
+ * Resolves true when available, false otherwise.
+ */
+async function isAwsCliAvailable() {
+    try {
+        await execFileAsync('aws', ['--version']);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Returns the config when AGENTHIPPO_STATE_S3_URI is set, else null (sync disabled). */
+function resolveS3StateConfig(env = process.env) {
+    const uri = env.AGENTHIPPO_STATE_S3_URI?.trim();
+    if (!uri) {
+        return null;
+    }
+    return {
+        uri: uri.replace(/\/+$/, ''),
+        endpoint: env.AGENTHIPPO_STATE_S3_ENDPOINT?.trim() || undefined,
+    };
+}
+function syncArgs(cfg, from, to) {
+    const args = ['s3', 'sync', from, to, '--no-progress'];
+    if (cfg.endpoint) {
+        args.push('--endpoint-url', cfg.endpoint);
+    }
+    return args;
+}
+/** Download state from the bucket into stateDir on boot. An empty bucket is a no-op. */
+async function restoreState(cfg, stateDir, log) {
+    try {
+        await execFileAsync('aws', syncArgs(cfg, cfg.uri, stateDir));
+        log?.(`State restored from ${cfg.uri}`);
+    }
+    catch (err) {
+        // First boot / empty bucket / transient — don't block startup.
+        log?.(`State restore skipped: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+/** Upload changed files from stateDir to the bucket (delta). */
+async function pushState(cfg, stateDir, log) {
+    try {
+        await execFileAsync('aws', syncArgs(cfg, stateDir, cfg.uri));
+    }
+    catch (err) {
+        // A failed push means sessions aren't durable — surface it unconditionally,
+        // not just under --verbose, so the operator notices state isn't persisting.
+        console.error(`[state-sync] push to ${cfg.uri} failed: ${err instanceof Error ? err.message : String(err)}`);
+        log?.(`State push failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+/**
+ * Debounced, non-overlapping pusher. `schedule()` after each turn (cheap, off the
+ * response path); coalesces bursts; `flush()` awaits a final push (SIGTERM).
+ */
+function makeStatePusher(cfg, stateDir, log, waitMs = 1000) {
+    let timer = null;
+    let running = false;
+    let pending = false;
+    let inflightPromise = null;
+    const runNow = () => {
+        running = true;
+        pending = false;
+        inflightPromise = pushState(cfg, stateDir, log).then(() => {
+            running = false;
+            inflightPromise = null;
+            if (pending) {
+                schedule();
+            }
+        });
+        return inflightPromise;
+    };
+    const schedule = () => {
+        if (running) {
+            pending = true;
+            return;
+        }
+        if (timer) {
+            return;
+        }
+        timer = setTimeout(() => {
+            timer = null;
+            void runNow();
+        }, waitMs);
+        timer.unref?.();
+    };
+    const flush = async () => {
+        if (timer) {
+            clearTimeout(timer);
+            timer = null;
+        }
+        // Wait for any in-flight push to complete before the final push,
+        // so SIGTERM never runs two concurrent aws s3 sync processes.
+        if (inflightPromise) {
+            await inflightPromise;
+        }
+        await pushState(cfg, stateDir, log);
+    };
+    return { schedule, flush };
+}

package/out/cli/utils.js

@@ -0,0 +1,220 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SUGGESTED_LITELLM_SMOKE_TEST_COMMAND = exports.COLORS = void 0;
+exports.getBinaryDir = getBinaryDir;
+exports.findClaudeCodePath = findClaudeCodePath;
+exports.findCodexPath = findCodexPath;
+exports.findBundledBasePromptsDir = findBundledBasePromptsDir;
+exports.getLiteLLMQuickstartHintLines = getLiteLLMQuickstartHintLines;
+/**
+ * CLI Utilities
+ */
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const fs = __importStar(require("fs"));
+const child_process_1 = require("child_process");
+const deps_1 = require("./deps");
+/**
+ * Get the directory where the CLI binary is located.
+ * This is used to find bundled SDK assets.
+ */
+function getBinaryDir() {
+    // process.execPath is the path to the running binary
+    return path.dirname(process.execPath);
+}
+/**
+ * Find the Claude Code CLI executable path.
+ * Priority:
+ * 1. CLAUDE_CODE_PATH env
+ * 2. Installed via deps.ts (npm install on first run)
+ * 3. Bundled with binary (dist/claude-sdk/cli.js) - legacy
+ * 4. System 'claude' command
+ * 5. Common install locations
+ */
+function findClaudeCodePath() {
+    // 1. Check environment variable
+    if (process.env.CLAUDE_CODE_PATH) {
+        return process.env.CLAUDE_CODE_PATH;
+    }
+    // 2. Check npm-installed location (.agenthippo-deps/node_modules)
+    const depsPath = (0, deps_1.getClaudeSdkCliPath)();
+    if (depsPath) {
+        return depsPath;
+    }
+    // 3. Check bundled location (next to binary) - legacy fallback
+    const binaryDir = getBinaryDir();
+    const bundledPath = path.join(binaryDir, 'claude-sdk', 'cli.js');
+    try {
+        fs.accessSync(bundledPath, fs.constants.R_OK);
+        return bundledPath;
+    }
+    catch {
+        // Not bundled
+    }
+    // 4. Try 'which claude' (Unix) or 'where claude' (Windows)
+    try {
+        const cmd = process.platform === 'win32' ? 'where claude' : 'which claude';
+        const result = (0, child_process_1.execSync)(cmd, { encoding: 'utf8', stdio: ['pipe', 'pipe', 'ignore'] }).trim();
+        if (result) {
+            return result.split('\n')[0]; // First match
+        }
+    }
+    catch {
+        // Not found
+    }
+    // 5. Check common locations
+    const homeDir = os.homedir();
+    const commonPaths = [
+        path.join(homeDir, '.npm-global', 'bin', 'claude'),
+        path.join(homeDir, '.local', 'bin', 'claude'),
+        '/usr/local/bin/claude',
+        '/opt/homebrew/bin/claude',
+    ];
+    for (const p of commonPaths) {
+        try {
+            fs.accessSync(p, fs.constants.X_OK);
+            return p;
+        }
+        catch {
+            // Not found or not executable
+        }
+    }
+    return undefined;
+}
+/**
+ * Find the Codex CLI executable path.
+ * Priority:
+ * 1. CODEX_PATH env
+ * 2. Installed via deps.ts (@openai/codex/bin/codex.js on first run)
+ * 3. Bundled with binary (dist/codex-sdk/codex) - legacy native bundle
+ * 4. System 'codex' command
+ */
+function findCodexPath() {
+    // 1. Check environment variable
+    if (process.env.CODEX_PATH) {
+        return process.env.CODEX_PATH;
+    }
+    // 2. Check npm-installed location (.agenthippo-deps/node_modules)
+    const depsPath = (0, deps_1.getCodexSdkBinaryPath)();
+    if (depsPath) {
+        return depsPath;
+    }
+    // 3. Check bundled location (next to binary) - legacy fallback
+    const binaryDir = getBinaryDir();
+    const binaryName = process.platform === 'win32' ? 'codex.exe' : 'codex';
+    const bundledPath = path.join(binaryDir, 'codex-sdk', binaryName);
+    try {
+        fs.accessSync(bundledPath, fs.constants.X_OK);
+        return bundledPath;
+    }
+    catch {
+        // Not bundled
+    }
+    // 4. Try 'which codex' (Unix) or 'where codex' (Windows)
+    try {
+        const cmd = process.platform === 'win32' ? 'where codex' : 'which codex';
+        const result = (0, child_process_1.execSync)(cmd, { encoding: 'utf8', stdio: ['pipe', 'pipe', 'ignore'] }).trim();
+        if (result) {
+            return result.split('\n')[0];
+        }
+    }
+    catch {
+        // Not found
+    }
+    return undefined;
+}
+/**
+ * Find the bundled base-prompts directory.
+ * Priority:
+ * 1. AGENTHIPPO_BASE_PROMPTS_DIR env
+ * 2. Next to binary (dist/base-prompts)
+ * 3. Development location (relative to compiled out/)
+ */
+function findBundledBasePromptsDir() {
+    // 1. Check environment variable
+    const envPath = process.env.AGENTHIPPO_BASE_PROMPTS_DIR || process.env.AGENTIDE_BASE_PROMPTS_DIR;
+    if (envPath) {
+        try {
+            fs.accessSync(envPath, fs.constants.R_OK);
+            return envPath;
+        }
+        catch {
+            // Not found
+        }
+    }
+    // 2. Check bundled location (next to binary)
+    const binaryDir = getBinaryDir();
+    const bundledPath = path.join(binaryDir, 'base-prompts');
+    try {
+        fs.accessSync(bundledPath, fs.constants.R_OK);
+        return bundledPath;
+    }
+    catch {
+        // Not bundled
+    }
+    // 3. Development location - check relative to this file's compiled location
+    // When compiled, this is out/cli/utils.js, so base-prompts is at ../base-prompts
+    const devPath = path.resolve(__dirname, '..', 'base-prompts');
+    try {
+        fs.accessSync(devPath, fs.constants.R_OK);
+        return devPath;
+    }
+    catch {
+        // Not found
+    }
+    return undefined;
+}
+// ANSI color codes
+exports.COLORS = {
+    reset: '\x1b[0m',
+    cyan: '\x1b[36m',
+    gray: '\x1b[90m',
+    dim: '\x1b[2m',
+    blue: '\x1b[34m',
+    green: '\x1b[32m',
+    red: '\x1b[31m',
+    yellow: '\x1b[33m',
+};
+exports.SUGGESTED_LITELLM_SMOKE_TEST_COMMAND = 'AGENTHIPPO_LITELLM_BASE_URL="http://localhost:4000" AGENTHIPPO_LITELLM_API_KEY="dummy" AGENTHIPPO_DEFAULT_MODEL="litellm/gpt-5.3-codex" AGENTHIPPO_DEFAULT_ENGINE="codex" agenthippo ask "Reply with exactly: CLI_TEST_OK"';
+function getLiteLLMQuickstartHintLines() {
+    return [
+        'Try local LiteLLM quickstart:',
+        `  ${exports.SUGGESTED_LITELLM_SMOKE_TEST_COMMAND}`,
+    ];
+}