@agenthippo-ai/agenthippo 0.1.1 → 1.110.9

package/out/cli/data-plane/sidecar.js

@@ -0,0 +1,161 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startDataPlaneSidecar = startDataPlaneSidecar;
+/**
+ * Data-plane SIDECAR (secure-obo-design §7.6 / aperture-thin) — the connector's own trust
+ * domain, a SEPARATE container from the engine/agent.
+ *
+ * It runs the full data plane (TurnRegistry + gateway + connector) and holds the backend BASE
+ * credential (AWS keys, Postgres pool login, …). The agent container gets NONE of it: it only
+ * (a) registers verified turns via this authenticated control API and (b) points the engine at
+ * the gateway URL. Because the sidecar is a different container (different PID namespace), the
+ * engine cannot read the base credential from `/proc/<pid>/environ`, and because the sidecar
+ * resolves the nonce → userId server-side, the engine cannot forge another user's identity.
+ *
+ * Control API (loopback/pod-network, bearer-authenticated):
+ *   POST   /turns        { userId, sessionKey, inboundToken?, egressStoreKey? } → { nonce }
+ *   DELETE /turns/:nonce                                                        → 204
+ *   GET    /edge/turn    (forward_auth from the trusted EDGE; X-Agent-User header)
+ *                        → 200 + `X-Agent-Turn-Nonce` response header
+ * The gateway (nonce-authenticated MCP) is a separate port the engine dials directly.
+ *
+ * EDGE-registration mode (P1 fix, obo-inprogress §2): the bearer secret is held by the IdP
+ * Caddy — NOT the agent container. Caddy registers each chat turn via `forward_auth` against
+ * `/edge/turn` (identity from the X-Agent-User header its auth-broker hop just verified) and
+ * copies the returned nonce header onto the request it proxies to serve. serve then has no
+ * registration authority at all: a compromised engine reading serve's `/proc/<pid>/environ`
+ * finds no token that can mint a nonce for an arbitrary userId. Release rides the gateway's
+ * nonce-authenticated `DELETE /turn`; the registry deadline is the backstop.
+ */
+const http = __importStar(require("http"));
+const crypto_1 = require("crypto");
+const index_1 = require("./index");
+const serve_hardening_1 = require("../serve-hardening");
+const gateway_1 = require("./gateway");
+function bearer(header) {
+    return header?.match(/^Bearer\s+(\S+)$/i)?.[1];
+}
+function tokenEq(a, b) {
+    const x = Buffer.from(a);
+    const y = Buffer.from(b);
+    return x.length === y.length && (0, crypto_1.timingSafeEqual)(x, y);
+}
+async function startDataPlaneSidecar(opts) {
+    const host = opts.bindHost ?? '0.0.0.0';
+    // The gateway binds `host` on a fixed port so the engine can be told the URL at deploy time.
+    const plane = await index_1.DataPlane.start(opts.config, {
+        logger: opts.logger,
+        audit: opts.audit,
+        gateway: { host, port: opts.gatewayPort, advertiseHost: host === '0.0.0.0' ? undefined : host },
+    });
+    const releases = new Map();
+    const control = http.createServer(async (req, res) => {
+        const reject = (code, msg) => { res.writeHead(code, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ error: msg })); };
+        try {
+            const tok = bearer(req.headers.authorization);
+            if (!tok || !tokenEq(tok, opts.registerToken)) {
+                opts.audit?.('unauthorized', 'sidecar_register_reject', { reason: tok ? 'bad_token' : 'missing_token' });
+                return reject(401, 'unauthorized');
+            }
+            const path = req.url?.split('?')[0] ?? '';
+            // Edge registration (Caddy forward_auth sends GET, no body): identity comes from the
+            // X-Agent-User header the edge's preceding auth-broker hop verified and set. The nonce
+            // rides a response header so `copy_headers` can lift it onto the proxied request.
+            // sessionKey degrades to userId here — the edge never sees the body's session_id.
+            if ((req.method === 'GET' || req.method === 'POST') && path === '/edge/turn') {
+                const userId = (Array.isArray(req.headers['x-agent-user']) ? req.headers['x-agent-user'][0] : req.headers['x-agent-user'])?.trim();
+                if (!userId) {
+                    opts.audit?.('unauthorized', 'sidecar_edge_reject', { reason: 'missing_user' });
+                    return reject(400, 'X-Agent-User required');
+                }
+                const { nonce } = plane.registerTurnRaw({ userId, sessionKey: userId });
+                opts.audit?.(userId, 'sidecar_edge_register', { userId });
+                res.writeHead(200, { 'Content-Type': 'application/json', [gateway_1.TURN_NONCE_HEADER]: nonce });
+                return res.end(JSON.stringify({ ok: true }));
+            }
+            if (req.method === 'POST' && path === '/turns') {
+                let body;
+                try {
+                    body = JSON.parse(await (0, serve_hardening_1.readBodyWithCap)(req));
+                }
+                catch {
+                    return reject(400, 'bad json');
+                }
+                const userId = (body.userId ?? '').trim();
+                if (!userId) {
+                    return reject(400, 'userId required');
+                }
+                const { nonce, release } = plane.registerTurnRaw({
+                    userId, sessionKey: (body.sessionKey ?? '').trim() || userId,
+                    inboundToken: body.inboundToken, egressStoreKey: body.egressStoreKey,
+                });
+                releases.set(nonce, release);
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                return res.end(JSON.stringify({ nonce }));
+            }
+            if (req.method === 'DELETE' && path.startsWith('/turns/')) {
+                const nonce = decodeURIComponent(path.slice('/turns/'.length));
+                releases.get(nonce)?.();
+                releases.delete(nonce);
+                res.writeHead(204);
+                return res.end();
+            }
+            reject(404, 'not found');
+        }
+        catch (err) {
+            opts.logger?.warn(`[Sidecar] control error: ${err instanceof Error ? err.message : String(err)}`);
+            if (!res.headersSent) {
+                res.writeHead(500, { 'Content-Type': 'application/json' });
+            }
+            res.end(JSON.stringify({ error: 'internal' }));
+        }
+    });
+    await new Promise((resolve, reject) => {
+        control.once('error', reject);
+        control.listen(opts.controlPort, host, () => resolve());
+    });
+    const controlAddress = control.address();
+    const controlPort = controlAddress && typeof controlAddress !== 'string' ? controlAddress.port : opts.controlPort;
+    opts.logger?.info(`[Sidecar] gateway ${plane.url} | control :${controlPort} (bound ${host})`);
+    return {
+        gatewayUrl: plane.url,
+        controlPort,
+        close: async () => { await new Promise((r) => control.close(() => r())); await plane.close(); },
+    };
+}

package/out/cli/deploy/blueprints/registry.js

@@ -0,0 +1,84 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BLUEPRINTS = exports.BLUEPRINT_IDS = void 0;
+exports.isBlueprintId = isBlueprintId;
+exports.resolveBlueprint = resolveBlueprint;
+exports.BLUEPRINT_IDS = [
+    'sandbox',
+    'prospect-demo',
+    'team-pilot',
+    'regulated-air-gapped',
+    'enterprise-fleet',
+];
+function isBlueprintId(value) {
+    return exports.BLUEPRINT_IDS.includes(value);
+}
+exports.BLUEPRINTS = {
+    sandbox: {
+        id: 'sandbox',
+        description: 'Internal test, no external users — no edge, no SSO, no host port beyond localhost.',
+        targets: ['vm'],
+    },
+    'prospect-demo': {
+        id: 'prospect-demo',
+        description: 'Throwaway public demo for a prospect — Cloudflare Tunnel + a throwaway Google OAuth client.',
+        targets: ['vm', 'compose'],
+    },
+    'team-pilot': {
+        id: 'team-pilot',
+        description: 'Single-agent pilot. Rides the customer platform\'s own identity when one exists (GCP IAP, ' +
+            'Databricks workspace SSO, Snowflake network, Cloudflare Access); falls back to a self-issued edge ' +
+            '(own Caddy + oauth2-proxy + Google client) on vm/compose/aws-ecs/azure-container-apps, which have ' +
+            'no platform-native option yet.',
+        targets: ['cloudrun', 'databricks-app', 'spcs', 'cloudflare', 'vm', 'compose', 'aws-ecs', 'azure-container-apps'],
+    },
+    'regulated-air-gapped': {
+        id: 'regulated-air-gapped',
+        description: 'VPN/localhost only, no tunnel, no external telemetry — the highest-scrutiny buyer profile. ' +
+            'Currently generator-identical to sandbox (PLAN/deploy.md §2 gap); the distinction is buyer framing, ' +
+            'not yet enforced posture.',
+        targets: ['vm'],
+    },
+    'enterprise-fleet': {
+        id: 'enterprise-fleet',
+        description: 'Federated identity against a central IdP (enterprise-deploy/idp/) for a growing fleet of agents. ' +
+            'Same-host colocation (no edge of its own) is available for vm/compose via the raw ' +
+            '`--ingress edge-fed --colocate` flag — not yet encoded as a blueprint variant.',
+        targets: ['cloudrun', 'vm', 'compose', 'aws-ecs', 'azure-container-apps'],
+    },
+};
+/**
+ * Resolve a blueprint (+ optional platform override) to the `--target`/`--ingress` pair
+ * `deploy-init.ts` already knows how to render. Throws on a platform not in the blueprint's
+ * supported set so a typo doesn't silently produce the wrong deployment shape.
+ */
+function resolveBlueprint(id, platform) {
+    const def = exports.BLUEPRINTS[id];
+    const target = platform ?? def.targets[0];
+    if (!def.targets.includes(target)) {
+        throw new Error(`Blueprint "${id}" does not support --platform ${target}. ` +
+            `Supported: ${def.targets.join(', ')}.`);
+    }
+    switch (id) {
+        case 'sandbox':
+        case 'regulated-air-gapped':
+            return { target };
+        case 'prospect-demo':
+            return { target, ingress: 'edge' };
+        case 'enterprise-fleet':
+            return { target, ingress: 'edge-fed' };
+        case 'team-pilot':
+            // Platform-native identity where the platform actually has one; vm/compose have
+            // none, so they fall back to the self-issued edge (own Caddy + oauth2-proxy).
+            if (target === 'cloudrun') {
+                return { target, ingress: 'iap' };
+            }
+            if (target === 'databricks-app' || target === 'spcs' || target === 'cloudflare') {
+                return { target };
+            }
+            return { target, ingress: 'edge' };
+    }
+}

package/out/cli/deploy/layers/identity.js

@@ -0,0 +1,172 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EDGE_AGENT_PORT = void 0;
+exports.renderIdentityLayer = renderIdentityLayer;
+exports.renderSidecarEdgeCaddyfile = renderSidecarEdgeCaddyfile;
+exports.renderSidecarFedCaddyfile = renderSidecarFedCaddyfile;
+/**
+ * Proof that `X-Auth-Request-Email` was set by THIS Caddy and not by a client.
+ *
+ * The broker now 401s an `X-Auth-Request-Email` that arrives without a matching
+ * `x-agenthippo-proxy-secret` (constant-time compared), because the header is otherwise a bearer
+ * assertion of identity that anything able to reach the broker's port could make. Only the routes
+ * that actually forward a verified email upstream carry it — adding it elsewhere would spread the
+ * secret across hops that have no use for it.
+ *
+ * `{env.…}` rather than `{$…}`: a runtime placeholder, so the secret is never baked into the
+ * rendered config on disk. Unset ⇒ empty ⇒ the broker refuses, which is the intended direction.
+ */
+const BROKER_PROXY_SECRET_LINES = [
+    '      # Proves this hop is the trusted proxy — the broker 401s X-Auth-Request-Email without it.',
+    '      header_up x-agenthippo-proxy-secret {env.AGENTHIPPO_AUTH_PROXY_SECRET}',
+];
+function renderIdentityLayer(opts) {
+    const { mode, authBrokerAddr, healthProxy, agentProxy } = opts;
+    const oauth2ProxyAddr = opts.oauth2ProxyAddr ?? '';
+    const catchallBody = opts.catchallBody ?? agentProxy;
+    const turn = opts.turnRegistration;
+    // The turn-registration hop, inserted AFTER the identity forward_auth (which sets
+    // X-Agent-User — the user the sidecar mints the nonce for). Only POST chat turns match.
+    const turnHop = turn
+        ? [
+            '      # Turn registration — after identity: X-Agent-User (set above) names the user the',
+            '      # sidecar mints the nonce for. Only POST chat turns match; others pass through.',
+            `      forward_auth @turnStart ${turn.connectorAddr} {`,
+            '        uri /edge/turn',
+            '        copy_headers X-Agent-Turn-Nonce',
+            `        header_up Authorization "Bearer {$${turn.tokenEnvVar}}"`,
+            '      }',
+        ]
+        : [];
+    // NOTE: two forward_auth in one handle block do NOT run in source order — Caddy sorts by
+    // its directive table, so the turn-registration hop could fire before identity is
+    // established (the connector then gets no X-Agent-User → 400). Wrapping the sequence in
+    // `route {}` forces source order: identity first (unauth short-circuits), then turn
+    // registration, then proxy.
+    // Re-indent wrapped directives one level so the generated file stays readable — operators
+    // copy these snippets by hand onto the IdP host.
+    const indent = (lines) => lines.map((l) => (l.trim() ? `  ${l}` : l));
+    const gated = (identityGate, body) => turn
+        ? ['    route {', ...indent(identityGate), ...turnHop, ...indent(body), '    }']
+        : [...identityGate, ...body];
+    const lines = [];
+    if (turn) {
+        lines.push('  # Hygiene: never let a client-supplied nonce header through (copy_headers overwrites it', '  # on chat paths anyway, and a forged nonce fails closed at the gateway — belt-and-braces).', '  request_header -X-Agent-Turn-Nonce');
+    }
+    if (mode === 'self-issued') {
+        lines.push('  # IDE PKCE sign-in: broker requires X-Auth-Request-Email from oauth2-proxy. Must come', '  # before the generic /oauth/* handle so authorize is gated (not dumped straight to broker).', '  handle /oauth/authorize {', `    forward_auth ${oauth2ProxyAddr} {`, '      uri /oauth2/auth', '      copy_headers X-Auth-Request-Email', '      header_up X-Forwarded-Proto https', '      header_up X-Forwarded-Host {http.request.host}', '      @unauth status 401', '      handle_response @unauth {', '        redir * "/oauth2/sign_in?rd={http.request.uri}"', '      }', '    }', `    reverse_proxy ${authBrokerAddr} {`, '      header_up X-Forwarded-Proto https', '      header_up X-Forwarded-Host {http.request.host}', ...BROKER_PROXY_SECRET_LINES, '    }', '  }', '  # Federated SSO (A′): browsers from other subdomains land here to stamp the shared cookie.', '  # Same oauth2-proxy gate as authorize; must precede the generic /oauth/* handle.', '  handle /oauth/browser-login {', `    forward_auth ${oauth2ProxyAddr} {`, '      uri /oauth2/auth', '      copy_headers X-Auth-Request-Email', '      header_up X-Forwarded-Proto https', '      header_up X-Forwarded-Host {http.request.host}', '      @unauth status 401', '      handle_response @unauth {', '        redir * "/oauth2/sign_in?rd={http.request.uri}"', '      }', '    }', `    reverse_proxy ${authBrokerAddr} {`, '      header_up X-Forwarded-Proto https', '      header_up X-Forwarded-Host {http.request.host}', ...BROKER_PROXY_SECRET_LINES, '    }', '  }', '  # Auth-broker: token exchange + other /oauth/* routes that must stay ungated.', '  handle /oauth/* {', `    reverse_proxy ${authBrokerAddr} {`, '      header_up X-Forwarded-Proto https', '      header_up X-Forwarded-Host {http.request.host}', '    }', '  }');
+    }
+    lines.push('  handle /api/ide/* {', `    reverse_proxy ${authBrokerAddr} {`, '      header_up X-Forwarded-Proto https', '      header_up X-Forwarded-Host {http.request.host}', '    }', '  }');
+    if (mode === 'self-issued') {
+        lines.push('  # oauth2-proxy: Google SSO callback + sign-in.', '  handle /oauth2/* {', `    reverse_proxy ${oauth2ProxyAddr} {`, '      header_up X-Forwarded-Proto https', '      header_up X-Forwarded-Host {http.request.host}', '    }', '  }');
+    }
+    lines.push('  @health path /health /ready', '  handle @health {', ...healthProxy, '  }');
+    if (turn) {
+        lines.push('  # Chat-turn matcher for edge turn registration (P1 fix): only POST chat turns register.', '  @turnStart {', '    method POST', '    path /v1/chat /v1/chat/stream', '  }');
+    }
+    lines.push('  # API clients (IDE) with a Bearer token: validate via auth-broker, copy identity header.', '  @apiWithAuth {', '    path /v1/*', '    header Authorization *', '  }', '  handle @apiWithAuth {', ...gated([
+        `    forward_auth ${authBrokerAddr} {`,
+        '      uri /api/ide/me',
+        '      copy_headers X-Agent-User',
+        '      header_up X-Forwarded-Proto https',
+        '      header_up X-Forwarded-Host {http.request.host}',
+        '      @unauth status 401',
+        '      handle_response @unauth {',
+        '        respond "Unauthorized" 401',
+        '      }',
+        '    }',
+    ], agentProxy), '  }');
+    if (mode === 'self-issued') {
+        lines.push('  # Browser clients: SSO via oauth2-proxy, identity injected as X-Agent-User.', '  handle {', ...gated([
+            `    forward_auth ${oauth2ProxyAddr} {`,
+            '      uri /oauth2/auth',
+            '      copy_headers X-Auth-Request-Email>X-Agent-User',
+            '      header_up X-Forwarded-Proto https',
+            '      header_up X-Forwarded-Host {http.request.host}',
+            '      @unauth status 401',
+            '      handle_response @unauth {',
+            '        redir * "/oauth2/sign_in?rd={http.request.uri}"',
+            '      }',
+            '    }',
+        ], catchallBody), '  }');
+    }
+    else {
+        const idp = opts.idpUrl?.trim() || '';
+        const loginRedirect = idp
+            ? `        redir * "${idp}/oauth/browser-login?return_to=https://{http.request.host}{http.request.uri}" 302`
+            : '        respond "Unauthorized" 401';
+        lines.push('  # Browser clients: the shared .agenthippo.ai cookie is verified by auth-broker. No cookie', '  # → redirect to the central IdP to log in (it stamps the cookie), then return.', '  handle {', ...gated([
+            `    forward_auth ${authBrokerAddr} {`,
+            '      uri /api/ide/me',
+            '      copy_headers X-Agent-User',
+            '      header_up X-Forwarded-Proto https',
+            '      header_up X-Forwarded-Host {http.request.host}',
+            '      @unauth status 401',
+            '      handle_response @unauth {',
+            loginRedirect,
+            '      }',
+            '    }',
+        ], catchallBody), '  }');
+    }
+    return lines;
+}
+/**
+ * "Sidecar" platforms — Cloud Run, ECS Fargate (`awsvpc` mode), Azure Container Apps (one
+ * replica) — all share one task's network namespace across containers and terminate TLS in
+ * front, so Caddy always listens on plain HTTP `:{$PORT}` and reaches every sidecar via
+ * `localhost:<port>` (never docker-DNS names). The agent isn't the ingress on these platforms,
+ * so it listens on a distinct internal port to avoid clashing with Caddy on `$PORT`.
+ */
+exports.EDGE_AGENT_PORT = 8090;
+/** Caddyfile for a sidecar platform's self-issued edge (own oauth2-proxy + Google client). */
+function renderSidecarEdgeCaddyfile() {
+    return [
+        '# Sidecar-platform edge ingress. TLS terminates in front; Caddy listens on HTTP :{$PORT}.',
+        '# Containers share one task/pod\'s localhost → upstreams are 127.0.0.1:<port> (not docker-DNS names).',
+        '{',
+        '  auto_https off',
+        '}',
+        '',
+        ':{$PORT} {',
+        ...renderIdentityLayer({
+            mode: 'self-issued',
+            oauth2ProxyAddr: 'localhost:4180',
+            authBrokerAddr: 'localhost:9780',
+            healthProxy: [`    reverse_proxy localhost:${exports.EDGE_AGENT_PORT}`],
+            agentProxy: [`    reverse_proxy localhost:${exports.EDGE_AGENT_PORT}`],
+        }),
+        '}',
+        '',
+    ].join('\n');
+}
+/**
+ * A′ — federated sidecar-platform edge. No oauth2-proxy: Google login happens once at the
+ * central IdP (`idpUrl`); this agent only verifies the shared AgentHippo JWT (Bearer for IDE,
+ * cookie for browser). On a browser 401, redirect to the IdP's `/oauth/browser-login` to stamp
+ * the shared cookie, then return.
+ */
+function renderSidecarFedCaddyfile(idpUrl) {
+    const idp = (idpUrl || '').trim().replace(/\/+$/, '');
+    return [
+        '# Sidecar-platform federated edge (A′). TLS terminates in front; Caddy listens on HTTP :{$PORT}.',
+        `# No oauth2-proxy — Google login happens once at the central IdP (${idp || '<IDP_URL>'});`,
+        '# this agent only verifies the shared AgentHippo JWT (Bearer for IDE, cookie for browser).',
+        '{',
+        '  auto_https off',
+        '}',
+        '',
+        ':{$PORT} {',
+        ...renderIdentityLayer({
+            mode: 'federated',
+            authBrokerAddr: 'localhost:9780',
+            idpUrl: idp,
+            healthProxy: [`    reverse_proxy localhost:${exports.EDGE_AGENT_PORT}`],
+            agentProxy: [`    reverse_proxy localhost:${exports.EDGE_AGENT_PORT}`],
+        }),
+        '}',
+        '',
+    ].join('\n');
+}