@agenthippo-ai/agenthippo 0.1.1 → 0.2.3-dataplane

package/out/engines/claude.js

@@ -43,6 +43,8 @@ const base_1 = require("./base");
 const utils_1 = require("../utils");
 const permissions_1 = require("../permissions");
 const mcp_1 = require("../mcp");
+const data_plane_1 = require("../cli/data-plane");
+const runtime_1 = require("../cli/runtime");
 const session_1 = require("../session");
 const agentpack_1 = require("../agentpack");
 const shared_1 = require("../shared");
@@ -241,7 +243,8 @@ class ClaudeEngine {
         // Edit tracker from runtime context (optional)
         const editTracker = runtime.editTracker;
         // Resolve API routing (LiteLLM proxy vs direct Anthropic)
-        const { apiKey, baseUrl, useLiteLLM } = (0, utils_1.resolveApiRouting)(options, this.config.litellmApiKey, this.config.litellmBaseUrl);
+        // claude routes to Anthropic when direct (or the LiteLLM proxy when configured) — never OpenAI.
+        const { apiKey, baseUrl, useLiteLLM } = (0, utils_1.resolveApiRouting)(options, this.config, 'anthropic');
         if (!apiKey) {
             throw new Error('Claude API key not provided');
         }
@@ -267,6 +270,11 @@ class ClaudeEngine {
             'DEBUG_CLAUDE_AGENT_SDK': '1',
             'CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC': '1',
         };
+        // Egress broker active ⇒ the gateway token stays broker-side; scrub it from the child
+        // env so it never reaches the model (secure-obo-design §7.6 / §7.4 gap 1).
+        if (claudeEnv[data_plane_1.EGRESS_URL_ENV]) {
+            delete claudeEnv[runtime_1.OPENCLAW_GATEWAY_TOKEN_ENV];
+        }
         const isSetupTokenAuth = (0, shared_1.isAnthropicSetupToken)(apiKey);
         if (isSetupTokenAuth) {
             const normalizedSetupToken = (0, shared_1.normalizeAnthropicSetupToken)(apiKey);
@@ -541,8 +549,10 @@ class ClaudeEngine {
                 logger.debug(`[AgentIDE] SessionStart hook called! event=${input.hook_event_name}`);
                 return CONTINUE;
             };
-            // Load MCP servers for the active agent and pass directly to SDK
-            const mcpServers = await this.loadMcpServersForClaude(logger, options.workspaceRoot, agentId);
+            // Load MCP servers for the active agent and pass directly to SDK. claudeEnv is the
+            // per-turn child env — URL servers resolve their bearerTokenEnv (turn nonce) from it,
+            // in memory, so no per-turn value ever lands in a shared config file.
+            const mcpServers = await this.loadMcpServersForClaude(logger, options.workspaceRoot, agentId, claudeEnv);
             // Determine cwd and settingSources
             // cwd is ALWAYS workspaceRoot - active agent content has been synced to workspace's .claude/
             // Agent packs: settingSources is 'project' only (no user ~/.claude/ mixing)
@@ -1191,9 +1201,11 @@ class ClaudeEngine {
      * - Default agent: uses bundled MCP servers from extension
      * - Pack agents: uses pack's mcp/ directory
      *
-     * The SDK accepts mcpServers directly in query options.
+     * The SDK accepts mcpServers directly in query options — including HTTP Streamable
+     * servers (`{type:'http', url, headers}`). `turnEnv` is the per-turn child env; a URL
+     * server's `bearerTokenEnv` (e.g. AGENTHIPPO_TURN_NONCE) resolves against it in memory.
      */
-    async loadMcpServersForClaude(logger, workspaceRoot, agentId = 'default') {
+    async loadMcpServersForClaude(logger, workspaceRoot, agentId = 'default', turnEnv) {
         const basePromptsDir = this.getBundledBasePromptsDir();
         const servers = await (0, mcp_1.loadMcpServers)(agentId, workspaceRoot, basePromptsDir);
         if (servers.length === 0) {
@@ -1201,6 +1213,15 @@ class ClaudeEngine {
         }
         const mcpServers = {};
         for (const s of servers) {
+            if (s.url) {
+                const headers = (0, mcp_1.resolveHttpMcpHeaders)(s, turnEnv ?? process.env);
+                mcpServers[s.name] = {
+                    type: 'http',
+                    url: s.url,
+                    ...(headers ? { headers } : {}),
+                };
+                continue;
+            }
             mcpServers[s.name] = {
                 command: s.command,
                 args: s.args,

package/out/engines/codex.js

@@ -46,6 +46,9 @@ const utils_1 = require("../utils");
 const permissions_1 = require("../permissions");
 const session_1 = require("../session");
 const agentpack_1 = require("../agentpack");
+const credential_context_1 = require("../cli/credential-context");
+const data_plane_1 = require("../cli/data-plane");
+const runtime_1 = require("../cli/runtime");
 // Note: HTTP edit server removed - file changes are now handled directly via file_change events
 // -----------------------------------------------------------------------------
 // Constants
@@ -63,7 +66,7 @@ const AGENTIDE_CODEX_SOURCE_ENV_VAR = 'AGENTIDE_ANALYTICS_SOURCE';
 const AGENTIDE_CODEX_ENGINE_ENV_VAR = 'AGENTIDE_ANALYTICS_ENGINE';
 const AGENTIDE_CODEX_REQUEST_ID_ENV_VAR = 'AGENTIDE_ANALYTICS_REQUEST_ID';
 // Bump when we change generated config semantics so long-lived sessions regenerate config.toml.
-const AGENTIDE_CODEX_CONFIG_VERSION = 18; // v18: Codex CLI dropped wire_api=chat; always use responses
+const AGENTIDE_CODEX_CONFIG_VERSION = 20; // v20: default_tools_approval_mode "auto"→"approve" ("auto" is invalid on codex ≥0.131 and cancels every headless MCP tool call)
 // Per-process runtime context for agents (not analytics): lets the agent locate its per-session context export.
 const AGENTIDE_CONTEXT_EXPORT_PATH_ENV_VAR = 'AGENTIDE_CONTEXT_EXPORT_PATH';
 const AGENTIDE_TERMINAL_LOG_PATH_ENV_VAR = 'AGENTIDE_TERMINAL_LOG_PATH';
@@ -100,7 +103,8 @@ class CodexEngine {
         const threadModelId = options.modelId;
         // Resolve API routing (LiteLLM proxy vs direct OpenAI)
         // Use openaiBaseUrl which has overrideOpenAIBaseUrl applied
-        const routing = (0, utils_1.resolveApiRouting)(options, this.config.litellmApiKey, this.config.litellmBaseUrl);
+        // codex routes to OpenAI when direct (or the LiteLLM proxy when configured) — never Anthropic.
+        const routing = (0, utils_1.resolveApiRouting)(options, this.config, 'openai');
         const apiKey = routing.apiKey;
         const baseUrl = routing.openaiBaseUrl; // Use OpenAI-specific URL
         const useLiteLLM = routing.useLiteLLM;
@@ -126,6 +130,13 @@ class CodexEngine {
             ...(runtime.cliEnvPatch ?? {}),
             OPENAI_LOG: 'debug',
         };
+        // When serve runs the egress broker, the OpenClaw gateway token must never enter the
+        // agent's trust domain (secure-obo-design §7.6 / §7.4 gap 1). Scrub it from the child env
+        // at the spawn boundary — belt-and-suspenders with serve's boot-time process.env strip,
+        // so a token in process.env (e.g. captured before the strip) still cannot reach the model.
+        if (codexEnv[data_plane_1.EGRESS_URL_ENV]) {
+            delete codexEnv[runtime_1.OPENCLAW_GATEWAY_TOKEN_ENV];
+        }
         // Always expose the VS Code chat session id to the agent process so it can locate:
         //   .agentide/sessions/<sessionId>/context.md
         const rawChatSessionId = sessionId?.trim();
@@ -141,8 +152,12 @@ class CodexEngine {
         // Note: workingDirectory is ALWAYS workspaceRoot - active agent content is synced to workspace's .codex/
         const agentId = options.agentPackId ?? 'default';
         const runtimePaths = (0, agentpack_1.resolveRuntimePaths)(options.workspaceRoot, this.config.storagePath, agentId, options.agentPackVersion);
-        // Use agent-isolated CODEX_HOME (for session/state isolation)
-        const codexHome = runtimePaths.codexHome;
+        // Use agent-isolated CODEX_HOME (for session/state isolation). In multi-tenant serve,
+        // additionally key it by the verified request user: config.toml is rewritten per turn,
+        // and a shared per-agent home lets concurrent turns of different users race it
+        // (secure-obo-design §1 defect 1 / §8 Phase 0). No credential frame (IDE,
+        // single-tenant CLI) ⇒ unchanged per-agent path.
+        const codexHome = (0, agentpack_1.userScopedEngineHome)(runtimePaths.codexHome, (0, credential_context_1.currentCredential)()?.userId);
         codexEnv['CODEX_HOME'] = codexHome;
         await fs_1.promises.mkdir(codexHome, { recursive: true });
         // Always set AGENT_ID for agent to know its identity
@@ -601,7 +616,11 @@ class CodexEngine {
         // Codex CLI requires wire_api=responses (chat wire was removed in newer Codex releases).
         const wireApi = 'responses';
         const routingType = useLiteLLM ? 'litellm' : (customBaseUrl ? 'custom' : 'openai');
-        const signature = `${AGENTIDE_CODEX_CONFIG_VERSION}:${routingType}:${customBaseUrl ?? ''}:${wireApi}:${agentId}:${codexInstructionsFile ?? ''}:${(0, mcp_1.mcpConfigCacheSignatureSuffix)()}`;
+        // No per-turn component in this signature: config.toml must be byte-identical across
+        // turns (per-turn auth rides the process env via bearer_token_env_var, never the file),
+        // so concurrent same-home turns write identical bytes and the old cross-turn race is
+        // gone by construction (secure-obo-design §3.2).
+        const signature = `${AGENTIDE_CODEX_CONFIG_VERSION}:${routingType}:${customBaseUrl ?? ''}:${wireApi}:${agentId}:${codexInstructionsFile ?? ''}`;
         if (this.lastWrittenConfigSignature === signature) {
             return;
         }

package/out/engines/custom.js

@@ -38,6 +38,8 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CustomEngine = void 0;
 exports.resolveCustomEngineLoadStrategy = resolveCustomEngineLoadStrategy;
+exports.deliverModelRoutingEnv = deliverModelRoutingEnv;
+exports.buildRunnerChildEnv = buildRunnerChildEnv;
 exports.probeCustomEngineImport = probeCustomEngineImport;
 const node_child_process_1 = require("node:child_process");
 const node_readline_1 = require("node:readline");
@@ -83,10 +85,45 @@ function prependNodePath(env, engineDir) {
         ? `${engineNodeModules}${path.delimiter}${existing}`
         : engineNodeModules;
 }
+/**
+ * Deliver the per-turn model-routing values into the env vars a manifest declares
+ * (`model.apiKeyEnvVar` / `baseUrlEnvVar` / `openaiBaseUrlEnvVar`).
+ *
+ * NON-CLOBBERING: a var already set in the host's own ambient env is left alone. Two reasons:
+ * (1) it preserves the effective behavior deployments already relied on — the old
+ *     `{...turn.env, ...process.env}` child-env spread accidentally let ambient values win,
+ *     and operators' engine-owned keys (e.g. a real CURSOR_API_KEY vs a stale manifest that
+ *     wrongly declared it as a delivery slot) must keep winning after that spread is fixed;
+ * (2) it makes the manifest contract safe by construction: mis-declaring an operator-owned
+ *     credential as a delivery slot can shadow nothing.
+ * The flip side is documented on CustomEngineModelConfig: ambient-exporting a genuine
+ * delivery var (e.g. LITELLM_API_KEY in serve's shell) shadows per-turn rotation.
+ */
+function deliverModelRoutingEnv(env, manifest, routing, ambientEnv, logger) {
+    const deliver = (envVar, value, label) => {
+        if (!envVar || !value) {
+            return;
+        }
+        if (ambientEnv[envVar]?.trim()) {
+            logger?.info(`[AgentIDE] Custom engine "${manifest.id}": ${envVar} already set in ambient env — keeping the operator's value, skipping per-turn ${label} delivery`);
+            return;
+        }
+        env[envVar] = value;
+    };
+    deliver(manifest.model?.apiKeyEnvVar, routing.apiKey, 'API key');
+    deliver(manifest.model?.baseUrlEnvVar, routing.baseUrl, 'base URL');
+    deliver(manifest.model?.openaiBaseUrlEnvVar, routing.openaiBaseUrl, 'OpenAI base URL');
+}
 function buildRunnerChildEnv(manifest, turn, probeImport) {
     const childEnv = {
-        ...turn.env,
+        // Per-turn values WIN over the host's ambient env. turn.env starts from a spread of
+        // process.env, so for undeclared vars this is identical either way; the difference is
+        // deliberate per-turn state (AGENTHIPPO_* control vars, the data-plane turn nonce,
+        // session paths, manifest-declared deliveries) which must never be reverted by a
+        // same-named var in the host's own environment. Ambient-vs-delivery precedence for
+        // manifest credential vars is decided earlier, in deliverModelRoutingEnv (non-clobber).
         ...process.env,
+        ...turn.env,
         AGENTHIPPO_ENGINE_ENTRY: manifest.entryPath,
         AGENTHIPPO_MESSAGE: turn.message,
         AGENTHIPPO_WORKSPACE_ROOT: turn.workspaceRoot,
@@ -466,7 +503,10 @@ class CustomEngine {
         const attachmentsDir = path.join(workspaceSessionDir, 'attachments');
         const nativeSessionId = this.activeSessions.get(conversationKey)?.nativeSessionId ??
             (0, base_1.getPersistedSessionId)(`custom:${manifest.id}`, conversationKey);
-        const routing = (0, utils_1.resolveApiRouting)(options, this.config.litellmApiKey, this.config.litellmBaseUrl, runtime.configProvider);
+        // A custom engine isn't pinned to one vendor — infer its direct provider from the model
+        // (e.g. openclaw's litellm/* routes through the proxy anyway; a claude-* model → Anthropic).
+        // The engine's manifest still decides which env var receives the resolved key.
+        const routing = (0, utils_1.resolveApiRouting)(options, this.config, (0, utils_1.inferModelProvider)(options.modelId), runtime.configProvider);
         const routingApiKey = routing.apiKey?.trim() || undefined;
         const routingBaseUrl = routing.baseUrl?.trim() || undefined;
         const routingOpenAIBaseUrl = routing.openaiBaseUrl?.trim() || undefined;
@@ -532,15 +572,7 @@ class CustomEngine {
         if (manifest.homeEnvVar) {
             env[manifest.homeEnvVar] = engineHomeDir;
         }
-        if (manifest.model?.apiKeyEnvVar && routingApiKey) {
-            env[manifest.model.apiKeyEnvVar] = routingApiKey;
-        }
-        if (manifest.model?.baseUrlEnvVar && routingBaseUrl) {
-            env[manifest.model.baseUrlEnvVar] = routingBaseUrl;
-        }
-        if (manifest.model?.openaiBaseUrlEnvVar && routingOpenAIBaseUrl) {
-            env[manifest.model.openaiBaseUrlEnvVar] = routingOpenAIBaseUrl;
-        }
+        deliverModelRoutingEnv(env, manifest, { apiKey: routingApiKey, baseUrl: routingBaseUrl, openaiBaseUrl: routingOpenAIBaseUrl }, process.env, runtime.logger);
         if ((routingBaseUrl && (0, utils_1.applyLocalTlsBypass)(env, routingBaseUrl))
             || (routingOpenAIBaseUrl && routingOpenAIBaseUrl !== routingBaseUrl && (0, utils_1.applyLocalTlsBypass)(env, routingOpenAIBaseUrl))) {
             runtime.logger.info(`[AgentIDE] Disabling TLS verification for local HTTPS (${manifest.id})`);
@@ -550,7 +582,9 @@ class CustomEngine {
             : (routingBaseUrl ? 'custom provider' : 'native provider');
         runtime.logger.info(`[AgentIDE] Custom engine "${manifest.id}" routing: ${routingDescription}, baseUrl=${routingBaseUrl || 'default'}, model=${modelId}`);
         const resolvedMcp = await (0, mcp_1.loadMcpServers)(agentId, options.workspaceRoot, this.getBundledBasePromptsDir());
-        const mcpServers = (0, mcp_1.formatInlineMcpServers)(resolvedMcp);
+        // `env` is this turn's child env — URL servers resolve bearerTokenEnv (turn nonce)
+        // from it in memory, so per-turn auth never lands in a shared file.
+        const mcpServers = (0, mcp_1.formatInlineMcpServers)(resolvedMcp, env);
         if (resolvedMcp.length > 0) {
             runtime.logger.debug(`[AgentIDE] Custom engine "${manifest.id}" MCP (${agentId}): ${resolvedMcp.map(s => s.name).join(', ')}`);
         }

package/out/extension.js

@@ -68,6 +68,7 @@ const serveClient_js_1 = require("./remote/serveClient.js");
 const remotePackStatusBar_js_1 = require("./remote/remotePackStatusBar.js");
 const provider_js_1 = require("./auth/provider.js");
 const signInFlow_js_1 = require("./auth/signInFlow.js");
+const onboardingPrompt_js_1 = require("./auth/onboardingPrompt.js");
 const githubStoreGate_js_1 = require("./auth/githubStoreGate.js");
 const sessionEvents_1 = require("./analytics/sessionEvents");
 const base_1 = require("./engines/base");
@@ -323,6 +324,7 @@ async function activate(context) {
     (0, provider_js_1.registerAgentHippoAuth)(context);
     void (0, provider_js_1.refreshBootstrapIfSignedIn)(context);
     context.subscriptions.push((0, provider_js_1.startAgentHippoTokenRefreshTimer)(context));
+    (0, onboardingPrompt_js_1.scheduleSignInOnboardingPrompt)(context);
     // Register commands
     registerCommands(context, _state);
     const remotePackStatusBar = new remotePackStatusBar_js_1.RemotePackStatusBar(syncService, () => getWorkspaceRoot(outputChannel).workspaceRoot, outputChannel);

package/out/gateway/outboundSend.js

@@ -172,12 +172,12 @@ function buildGatewaySendParams(handle, message, media) {
 function buildGatewayRpcCommand(handle, message, media) {
     return [exports.GATEWAY_OUTBOUND_RPC_METHOD, JSON.stringify(buildGatewaySendParams(handle, message, media))];
 }
-async function sendViaGatewayRpc(handle, message, media) {
+async function sendViaGatewayRpc(handle, message, media, explicitToken) {
     const gatewayUrl = process.env.OPENCLAW_GATEWAY_URL?.trim() || `ws://127.0.0.1:${DEFAULT_GATEWAY_PORT}`;
-    const token = (0, runtime_js_1.readOpenClawGatewayToken)();
-    if (token && !process.env.OPENCLAW_GATEWAY_TOKEN?.trim()) {
-        process.env.OPENCLAW_GATEWAY_TOKEN = token;
-    }
+    // Prefer the broker-supplied token; the env re-population that used to happen here is gone
+    // deliberately — under the egress broker it would re-leak the token into process.env, and
+    // every engine child spreads process.env (secure-obo-design §7.6).
+    const token = explicitToken?.trim() || (0, runtime_js_1.readOpenClawGatewayToken)();
     const { client, clientInfo } = (0, client_js_1.createEphemeralGatewayClient)(gatewayUrl, token);
     await client.connect(clientInfo);
     try {
@@ -218,7 +218,7 @@ async function sendGatewayOutboundMessage(handle, options) {
     const cliCommand = [cli, ...cliArgs];
     const rpcCommand = buildGatewayRpcCommand(handle, options.message, media);
     try {
-        const rpc = await sendViaGatewayRpc(handle, options.message, media);
+        const rpc = await sendViaGatewayRpc(handle, options.message, media, options.token);
         return {
             ok: true,
             via: 'gateway-rpc',

package/out/headless/index.js

@@ -175,6 +175,8 @@ const session_1 = require("../session");
 const sync_1 = require("./sync");
 const sessionEvents_1 = require("../analytics/sessionEvents");
 const runtime_1 = require("../cli/runtime");
+const credential_context_1 = require("../cli/credential-context");
+const paths_1 = require("../utils/paths");
 function resolveHeadlessAnalyticsUserId(runOverride, configOverride) {
     const fromRun = runOverride?.trim();
     if (fromRun) {
@@ -223,13 +225,18 @@ function createHeadlessRunner(config) {
         // the legacy single file at provider-sessions.json on first load.
         (0, session_1.initSessionStoreWithStore)(new interfaces_1.DirectorySessionStore(path.join(config.storagePath, 'provider-sessions')));
     }
-    // Build engine config
+    // Per-destination credentials. When a caller supplies the split keys (serve), use them so
+    // each engine picks the key for the endpoint it dials. Otherwise fall back to the single
+    // `apiKey` as the LiteLLM key (back-compat: eval/CLI runners configured one key).
+    const hasSplitKeys = Boolean(config.litellmApiKey || config.openaiApiKey || config.anthropicApiKey);
     const engineConfig = {
         storagePath: config.storagePath,
         codexHome: undefined,
         claudeConfigDir: undefined,
-        litellmApiKey: config.apiKey,
+        litellmApiKey: config.litellmApiKey ?? (hasSplitKeys ? undefined : config.apiKey),
         litellmBaseUrl: config.baseUrl,
+        openaiApiKey: config.openaiApiKey,
+        anthropicApiKey: config.anthropicApiKey,
         claudeCodeExecutablePath: config.claudeCodeExecutablePath,
         codexExecutablePath: config.codexExecutablePath,
     };
@@ -283,11 +290,12 @@ function createHeadlessRunner(config) {
         }
         return customEngine;
     };
-    // Shared session event writer for Layer 2 analytics. Rooted under storagePath (not the
-    // os.homedir() default) so tool-call/warrant events land on the same durable volume as
-    // session state — a container's home directory is ephemeral, storagePath honors
-    // AGENTHIPPO_HOME / --state-dir and is what actually survives a restart or scale event.
-    const sessionEventWriter = new sessionEvents_1.SessionEventWriter(path.join(config.storagePath, 'analytics', 'sessions'));
+    // Shared session event writer for Layer 2 analytics. Defaults to getAgentideHome() — the
+    // exact directory sessionJsonlFleet.ts and query-analytics.sh already scan, so tool-call/
+    // warrant events stay discoverable — but honors an explicit override (config.analyticsSessionsDir)
+    // so callers with their own state-dir precedence (serve.ts) don't regress durability when
+    // no AGENTHIPPO_HOME-style env var is set but a durable --state-dir was given explicitly.
+    const sessionEventWriter = new sessionEvents_1.SessionEventWriter(config.analyticsSessionsDir ?? path.join((0, paths_1.getAgentideHome)(), 'analytics', 'sessions'));
     return {
         async run(options) {
             const result = {
@@ -339,8 +347,10 @@ function createHeadlessRunner(config) {
             const requestId = (0, base_1.generateRequestId)();
             // Wrap emitter with observability (Layer 2 session events)
             // Session events are written to ~/.agent-hippo/analytics/sessions/<session_id>.jsonl
+            // Capture warrant userId here (inside serve's runWithCredential continuation), not
+            // later at tool emit — custom-engine IPC callbacks can lose/stick ambient ALS.
             const sessionId = options.sessionId ?? `headless-${Date.now()}`;
-            const observableEmitter = (0, sessionEvents_1.wrapEmitterWithObservability)(baseEmitter, sessionEventWriter, sessionId, requestId);
+            const observableEmitter = (0, sessionEvents_1.wrapEmitterWithObservability)(baseEmitter, sessionEventWriter, sessionId, requestId, (0, credential_context_1.currentCredential)()?.userId);
             const requestOptions = {
                 modelId: options.modelId,
                 engineId: options.engineId,
@@ -348,7 +358,11 @@ function createHeadlessRunner(config) {
                 additionalDirectories: options.additionalDirectories,
                 sessionId,
                 analyticsUserId: resolveHeadlessAnalyticsUserId(options.analyticsUserId, config.analyticsUserId),
-                apiKey: config.apiKey,
+                // With split keys (serve), leave options.apiKey UNSET so resolveApiRouting selects
+                // the key for the engine's destination — passing the collapsed key here would let
+                // it win over the correct provider key (the original bug). Back-compat single-key
+                // callers keep options.apiKey.
+                apiKey: hasSplitKeys ? undefined : config.apiKey,
                 baseUrl: config.baseUrl,
                 useLiteLLM: config.useLiteLLM,
                 agentPackId: packId,
@@ -367,6 +381,7 @@ function createHeadlessRunner(config) {
                         chatSessionId: sessionId,
                         gatewaySessionKey: options.gatewaySessionKey,
                     }),
+                    ...(options.turnEnv ?? {}),
                 },
             };
             try {

package/out/live-probe/connector.mjs

@@ -0,0 +1,8 @@
+
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+const server = new Server({ name: 'probe', version: '0.0.1' }, { capabilities: { tools: {} } });
+server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: [{ name: 'probe_tool', description: 'x', inputSchema: { type: 'object' } }] }));
+server.setRequestHandler(CallToolRequestSchema, async () => ({ content: [{ type: 'text', text: 'MAGIC=zebra42' }] }));
+await server.connect(new StdioServerTransport());

package/out/live-probe/env-report.mjs

@@ -0,0 +1,8 @@
+
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+const server = new Server({ name: 'env-report', version: '0.0.1' }, { capabilities: { tools: {} } });
+server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: [{ name: 'report_env', description: 'reports a probe env var', inputSchema: { type: 'object' } }] }));
+server.setRequestHandler(CallToolRequestSchema, async () => ({ content: [{ type: 'text', text: 'PROBE_SEEN=' + (process.env.AGENTHIPPO_PROBE_ENV || 'ABSENT') }] }));
+await server.connect(new StdioServerTransport());