@agenthippo-ai/agenthippo 0.1.1 → 1.110.9

package/out/cli/index.js

@@ -75,8 +75,10 @@ const commander_1 = require("commander");
 const chat_1 = require("./commands/chat");
 const ask_1 = require("./commands/ask");
 const serve_1 = require("./commands/serve");
+const data_plane_1 = require("./commands/data-plane");
 const auth_broker_1 = require("./commands/auth-broker");
 const deploy_1 = require("./commands/deploy");
+const idp_1 = require("./commands/idp");
 const pack_1 = require("./commands/pack");
 const store_1 = require("./commands/store");
 const anywhere_1 = require("./commands/anywhere");
@@ -85,6 +87,26 @@ const probe_custom_engine_1 = require("./commands/probe-custom-engine");
 const deps_1 = require("./deps");
 const branding_1 = require("../branding");
 const agentEnvFile_1 = require("../utils/agentEnvFile");
+const caps_1 = require("../pack/caps");
+/**
+ * `--max-concurrent-sandboxes`, honouring the deprecated `--max-concurrent-cells`.
+ *
+ * The current spelling wins outright when both are given; the old one is honoured with a loud
+ * notice rather than dropped, because dropping it would silently REMOVE a blast-radius cap from a
+ * deployment that believes it still has one.
+ */
+function resolveMaxConcurrentSandboxes(options) {
+    const current = parseInt(options.maxConcurrentSandboxes ?? '', 10);
+    if (Number.isFinite(current) && current > 0) {
+        return current;
+    }
+    const legacy = parseInt(options.maxConcurrentCells ?? '', 10);
+    if (Number.isFinite(legacy) && legacy > 0) {
+        console.warn(`Warning: --max-concurrent-cells is DEPRECATED; use ${caps_1.DEPRECATED_CAP_SPELLINGS['--max-concurrent-cells']}. Honouring it for now.`);
+        return legacy;
+    }
+    return undefined;
+}
 const VERSION = '1.110.8';
 const CLI_DESCRIPTION = [
     `${branding_1.AGENTIDE_BRAND_NAME} CLI - Run agent packs from the command line`,
@@ -101,14 +123,22 @@ const CLI_DESCRIPTION = [
     '  AGENTHIPPO_STORE_REPO        Override store GitHub repo (owner/repo; CLI store commands)',
     '',
     'Quickstart:',
-    `  AGENTHIPPO_LITELLM_BASE_URL="http://localhost:4000" AGENTHIPPO_LITELLM_API_KEY="dummy" AGENTHIPPO_DEFAULT_MODEL="litellm/gpt-5.3-codex" AGENTHIPPO_DEFAULT_ENGINE="codex" ${branding_1.AGENTIDE_CLI_NAME} ask "Reply with exactly: CLI_TEST_OK"`,
+    `  AGENTHIPPO_LITELLM_BASE_URL="http://localhost:4000" AGENTHIPPO_LITELLM_API_KEY="dummy" AGENTHIPPO_DEFAULT_MODEL="litellm/gpt-5.5" AGENTHIPPO_DEFAULT_ENGINE="codex" ${branding_1.AGENTIDE_CLI_NAME} ask "Reply with exactly: CLI_TEST_OK"`,
     '',
     'Agent Packs:',
     `  Loaded from ~/${branding_1.AGENTIDE_DIR_NAME}/agents/<name>/ or absolute/relative paths.`,
     '  Pack permissions control filesystem access scope.',
 ].join('\n');
 const program = new commander_1.Command();
-program.hook('preAction', async () => {
+program.hook('preAction', async (_thisCommand, actionCommand) => {
+    // A SANDBOX must never absorb ambient credentials. Every other command merges ~/.agent-hippo/.env
+    // as a convenience, but doing that inside a sandbox would silently hand the sandboxed engine
+    // every key on the host — defeating the driver's curated env allowlist (observed live: the
+    // cursor engine picked up CURSOR_API_KEY this way). A sandbox receives only what its driver
+    // explicitly passes.
+    if (actionCommand?.name() === 'sandbox') {
+        return;
+    }
     await (0, agentEnvFile_1.mergeAgentHomeEnvIntoProcessEnv)();
 });
 program
@@ -125,7 +155,7 @@ program
     .description('Start interactive chat session')
     .option('-a, --agent <name>', 'Agent pack to use')
     .option('-e, --engine <id>', 'Override pack engine: claude|codex|<custom-engine-id>')
-    .option('-m, --model <id>', 'Override pack model (e.g. litellm/gpt-4.1-nano)')
+    .option('-m, --model <id>', 'Override pack model (e.g. litellm/gpt-5.6-luna)')
     .option('-w, --workspace <path>', 'Workspace directory', process.cwd())
     .action(async (options) => {
     const verbose = program.opts().verbose;
@@ -144,7 +174,7 @@ program
     .description('Send a single message and exit')
     .option('-a, --agent <name>', 'Agent pack to use')
     .option('-e, --engine <id>', 'Override pack engine: claude|codex|<custom-engine-id>')
-    .option('-m, --model <id>', 'Override pack model (e.g. litellm/gpt-4.1-nano)')
+    .option('-m, --model <id>', 'Override pack model (e.g. litellm/gpt-5.6-luna)')
     .option('-w, --workspace <path>', 'Workspace directory', process.cwd())
     .option('-f, --file <path>', 'Include file content in context')
     .option('--json', 'Output as JSON')
@@ -175,7 +205,7 @@ program
     .requiredOption('--prompt <message>', 'Prompt text')
     .option('--pack <name>', 'Agent pack to use')
     .option('-e, --engine <id>', 'Override pack engine: claude|codex|<custom-engine-id>')
-    .option('-m, --model <id>', 'Override pack model (e.g. litellm/gpt-4.1-nano)')
+    .option('-m, --model <id>', 'Override pack model (e.g. litellm/gpt-5.6-luna)')
     .option('-w, --workspace <path>', 'Workspace directory', process.cwd())
     .option('--session-id <id>', 'Optional session id for the caller')
     .option('--system-prompt <text>', 'Optional system prompt override')
@@ -203,7 +233,7 @@ program
     .description('Start HTTP server')
     .requiredOption('-a, --agent <name>', 'Agent pack to use (required)')
     .option('-e, --engine <id>', 'Override pack engine: claude|codex|<custom-engine-id>')
-    .option('-m, --model <id>', 'Override pack model (e.g. litellm/gpt-4.1-nano)')
+    .option('-m, --model <id>', 'Override pack model (e.g. litellm/gpt-5.6-luna)')
     .option('-p, --port <port>', 'Port to listen on', '3000')
     .option('--host <address>', 'Address to bind the HTTP server (default 127.0.0.1; use 0.0.0.0 in containers/behind a proxy)')
     .option('-w, --workspace <path>', 'Default workspace directory', process.cwd())
@@ -212,18 +242,52 @@ program
     .option('--state-dir <path>', 'Persist session state here (honors AGENTHIPPO_HOME; replaces the tmpdir default)')
     .option('--max-turns-per-session <n>', 'Cap turns per session (abuse/runaway guard); 0 = unlimited', '0')
     .option('--www-dir <path>', 'Serve deploy/www/index.html at GET / (static browser chat UI)')
-    // Deprecated no-ops: kept so deploy artifacts generated by older CLIs (which baked these
-    // into the serve command line) don't crash with "unknown option" after a runtime upgrade.
-    // Serve now trusts its front proxy for auth/CORS; these flags no longer do anything.
-    .option('--production', 'Deprecated: no-op (serve trusts its front proxy; hardening moved to the deploy edge)')
-    .option('--cors-origin <origins>', 'Deprecated: no-op (CORS is handled by the front proxy)')
+    .option('--sandbox <mode>', 'Run each session\'s engine in a sandbox: process (tier 0, no boundary) or container (tier 2, one disposable container per session with only its declared routes). Unset = in-process (default, unchanged)')
+    .option('--sandbox-image <ref>', '--sandbox container: sandbox image pinned BY DIGEST (image@sha256:...)')
+    .option('--pull-packs', 'Fetch the version the lease pins from the store instead of only refusing others. Always verifies the signature; a fetch or verification failure keeps serving the current version')
+    .option('--require-signed-pack', 'Refuse to start a sandbox unless the pack is signed by a trusted key (the lease may also require this; neither side can waive the other). Now the DEFAULT — kept so existing invocations still mean something')
+    .option('--allow-unsigned-pack', 'LOCAL DEVELOPMENT ONLY: run a pack this instance cannot verify. Signature checking is required by default; this disables it and warns loudly on every boot. A lease that sets requireSignedPack still overrides it')
+    .option('--require-signed-lease', 'Refuse to act on a lease that is not signed (ES256 compact JWS) by a trusted key. Tighten-only with lease.requireSignedLease, and sticky once a signed lease has been seen')
+    .option('--lease-max-staleness <seconds>', 'Refuse turns after this long with no successful lease refresh, so network denial cannot hold a revoked fleet open (default 86400; 0 disables)')
+    .option('--sandbox-ttl <seconds>', '--sandbox: reap an idle sandbox after N seconds; the next message recreates it and resumes the session', '1800')
+    .option('--shared-workspace', '--sandbox container: mount ONE workspace into every session\'s sandbox (default: one per session). Sessions can then read and overwrite each other\'s files — only for a single trust domain')
+    // Control plane (serve-v4-clean §5). Caps are enforced by revoking a sandbox's routes, so they
+    // need --sandbox; a lease may impose tighter values than these, and never looser ones.
+    .option('--max-session-seconds <seconds>', '--sandbox: cap one session\'s wall-clock lifetime; a breach revokes or destroys its sandbox')
+    .option('--max-concurrent-sandboxes <n>', '--sandbox: cap live sandboxes on this instance (blast radius)')
+    // Deprecated pre-rename spelling. Hidden so it does not advertise itself, honoured so an
+    // existing deployment does not silently lose its cap, and loud so it gets migrated.
+    .addOption(new commander_1.Option('--max-concurrent-cells <n>', 'DEPRECATED alias for --max-concurrent-sandboxes').hideHelp())
+    .option('--cap-on-breach <action>', '--sandbox: what a cap breach does — revoke-inference (default) or destroy-sandbox. An unrecognised value fails CLOSED to destroy-sandbox')
+    .option('--lease-poll <seconds>', '--sandbox: how often to re-check the lease, so a kill switch stops RUNNING sandboxes. Worst-case kill latency is 2x this (poll + cache); an admin refresh is immediate', '30')
     .action(async (options) => {
-    if (options.production || options.corsOrigin) {
-        console.warn('[serve] --production/--cors-origin are deprecated no-ops; auth and CORS are enforced by the deploy edge proxy.');
-    }
     const verbose = program.opts().verbose;
     await (0, deps_1.ensureDeps)(verbose);
     await (0, serve_1.serveCommand)({
+        sandbox: options.sandbox === 'container' ? 'container' : options.sandbox === 'process' ? 'process' : undefined,
+        sandboxImage: options.sandboxImage,
+        requireSignedPack: Boolean(options.requireSignedPack),
+        allowUnsignedPack: Boolean(options.allowUnsignedPack),
+        requireSignedLease: Boolean(options.requireSignedLease),
+        leaseMaxStalenessSeconds: options.leaseMaxStaleness !== undefined
+            ? (Number.isFinite(Number(options.leaseMaxStaleness)) ? Number(options.leaseMaxStaleness) : undefined)
+            : undefined,
+        pullPacks: Boolean(options.pullPacks),
+        sandboxTtlSeconds: parseInt(options.sandboxTtl, 10) || undefined,
+        sharedWorkspace: Boolean(options.sharedWorkspace),
+        maxSessionSeconds: parseInt(options.maxSessionSeconds, 10) || undefined,
+        maxConcurrentSandboxes: resolveMaxConcurrentSandboxes(options),
+        // Shared with the env path (pack/caps.ts) so a value that is valid in one is valid in the
+        // other. An unrecognised action no longer becomes `undefined` — which mergeCaps then
+        // defaulted to the WEAKER revoke-inference, silently downgrading what the operator typed.
+        capOnBreach: (() => {
+            const r = (0, caps_1.resolveOnBreach)(options.capOnBreach, '--cap-on-breach');
+            for (const w of r.warnings) {
+                console.warn(`Warning: ${w}`);
+            }
+            return r.action;
+        })(),
+        leasePollSeconds: parseInt(options.leasePoll, 10) || undefined,
         agent: options.agent,
         engine: options.engine,
         model: options.model,
@@ -238,6 +302,68 @@ program
         verbose,
     });
 });
+// Conformance — the deployment proves its own claims (serve-v4-clean.md §11 step 5).
+program
+    .command('conformance')
+    .description('Probe a deployment against its own claims: credential confinement, isolation tier, cost-cap binding, warrant integrity, rollback/kill switch. Exit 1 on any failure, 2 when no deployment was probed (--sandbox/--tier omitted) — only exit 0 means a real deployment was measured.')
+    .option('--sandbox <id>', 'Running sandbox container id/name — required to probe INSIDE a sandbox')
+    .option('--tier <n>', 'Declared isolation tier (0-3); probed, not trusted')
+    .option('--runtime <bin>', 'Container runtime binary', 'docker')
+    .option('--json', 'Emit JSON')
+    .action(async (options) => {
+    const { conformanceCommand } = await import('./commands/conformance.js');
+    const code = await conformanceCommand({
+        sandbox: options.sandbox,
+        tier: options.tier === undefined ? undefined : parseInt(options.tier, 10),
+        runtime: options.runtime,
+        json: Boolean(options.json),
+    });
+    process.exitCode = code;
+});
+// Sandbox runner — runs INSIDE a sandbox; holds no credential (serve-v4-clean.md §3).
+program
+    .command('sandbox')
+    .description('Run the in-sandbox engine host (sandbox runner). Speaks the frame protocol to serve over a unix socket or stdio; holds no data or model credential.')
+    .requiredOption('-a, --agent <path>', 'Pack directory mounted into the sandbox')
+    .option('--socket <path>', 'Unix socket to listen on (container driver)')
+    .option('--stdio', 'Speak the protocol on stdin/stdout instead (process driver)')
+    // No default: it must fall back to <state-dir>/workspace inside the command, or a
+    // host-launched sandbox (where --state-dir is a real host path) inherits the container-image
+    // path and dies on mkdir.
+    .option('-w, --workspace <path>', 'Workspace directory (default: <state-dir>/workspace)')
+    .option('--state-dir <path>', 'State directory', '/state')
+    .option('--sandbox-id <id>', 'Sandbox id (joins evidence records)')
+    .action(async (options) => {
+    const { sandboxCommand } = await import('./commands/sandbox.js');
+    await sandboxCommand({
+        agent: options.agent,
+        socket: options.socket,
+        stdio: Boolean(options.stdio),
+        workspace: options.workspace,
+        stateDir: options.stateDir,
+        sandboxId: options.sandboxId,
+    });
+});
+program
+    .command('data-plane')
+    .description('Run the connector as a sidecar (holds the backend base credential; the agent container does not)')
+    .requiredOption('-a, --agent <name>', 'Agent pack (reads spec.dataPlane connector + provider)')
+    .option('-w, --workspace <path>', 'Workspace directory', process.cwd())
+    .option('--gateway-port <port>', 'Port the engine dials (nonce-auth MCP)', '9090')
+    .option('--control-port <port>', 'Port serve dials to register turns (bearer-auth)', '9091')
+    .option('--host <address>', 'Bind address (default 0.0.0.0 for the pod network)')
+    .action(async (options) => {
+    const verbose = program.opts().verbose;
+    await (0, deps_1.ensureDeps)(verbose);
+    await (0, data_plane_1.dataPlaneSidecarCommand)({
+        agent: options.agent,
+        workspace: options.workspace,
+        gatewayPort: parseInt(options.gatewayPort, 10),
+        controlPort: parseInt(options.controlPort, 10),
+        host: options.host,
+        verbose,
+    });
+});
 program
     .command('auth-broker')
     .description('Start the AgentHippo auth broker (OAuth + IDE bootstrap API)')
@@ -247,22 +373,30 @@ program
 // Deploy command - generate platform-native deploy artifacts
 program
     .command('deploy <action> [pack]')
-    .description('Generate a self-contained deploy staging dir (init). Targets: vm, compose, cloudrun, databricks-app, spcs, cloudflare, all')
+    .description('Generate a self-contained deploy staging dir (init). Targets: vm, compose, cloudrun, databricks-app, spcs, cloudflare, aws-ecs, azure-container-apps, all. Or pick a --blueprint instead of raw --target/--ingress.')
     .option('-t, --target <target>', 'Deploy target', 'vm')
-    .option('-o, --out <path>', 'Staging directory (default: ./deploy-out/<pack>-<target>)')
+    .option('--blueprint <id>', 'Named preset (sandbox, prospect-demo, team-pilot, regulated-air-gapped, enterprise-fleet) — resolves --target/--ingress for you (PLAN/deploy.md §3); overrides both when set')
+    .option('--platform <platform>', 'Which platform to use within --blueprint\'s supported set (defaults to the blueprint\'s first); ignored without --blueprint')
+    .option('-o, --out <path>', 'Staging directory (default: ./deploy-out/<pack>-<target> relative to cwd; run from the pack parent, not from inside the pack)')
     .option('--packdir <path>', 'Pack directory (defaults to [pack] arg or cwd)')
     .option('--image <ref>', 'Runtime image ref (default: engine runtime:latest, or :latest-cursor for cursor packs)')
     .option('-p, --port <port>', 'Container port', '8080')
     .option('--gateway <channels>', 'Agent Anywhere: bind channels (e.g. "slack") + add OpenClaw gateway service (compose target)')
     .option('--hostname <host>', 'Public hostname for SSO edge (Caddy, OAuth, tunnel)', 'auth.agenthippo.ai')
-    .option('--ingress <mode>', 'Cloud Run ingress: iap (built-in IAP), edge (per-service AgentHippo edge + Google OAuth), or edge-fed (federated: auth via auth.agenthippo.ai, no per-service OAuth)', 'iap')
+    .option('--ingress <mode>', 'iap (Cloud Run built-in IAP only), edge (self-issued AgentHippo edge + Google OAuth — vm/compose/cloudrun/aws-ecs/azure-container-apps), or edge-fed (federated: auth via the central IdP, no per-target OAuth client — same targets as edge)', 'iap')
     .option('--idp-url <url>', 'edge-fed: central IdP base URL browsers redirect to for login (e.g. https://auth.agenthippo.ai)', 'https://auth.agenthippo.ai')
     .option('--cookie-domain <domain>', 'edge-fed: parent domain the shared auth cookie is scoped to (e.g. .agenthippo.ai)', '.agenthippo.ai')
+    .option('--colocate', 'edge-fed + vm/compose only: ride the org IdP\'s already-running Caddy + auth-broker instead of shipping this agent\'s own (PLAN/deploy.md §4 state 4)')
+    .option('--edge-turn-connector <addr>', 'EDGE turn registration (P1 fix): connector sidecar control-API address (e.g. mypack-connector:9091); the generated route registers each chat turn via forward_auth /edge/turn and copies X-Agent-Turn-Nonce — the agent container never holds the register token')
+    .option('--model-routing <mode>', 'Cloud Run + edge-fed: sidecar (in-pod LiteLLM+OTEL, default) or gateway (agent → gateway.agenthippo.ai directly, lean)')
     .option('--force', 'Overwrite existing files')
     .action(async (action, pack, options) => {
     const ingress = options.ingress === 'edge' ? 'edge' : options.ingress === 'edge-fed' ? 'edge-fed' : 'iap';
+    const modelRouting = options.modelRouting === 'gateway' ? 'gateway' : options.modelRouting === 'sidecar' ? 'sidecar' : undefined;
     await (0, deploy_1.deployCommand)(action, pack, {
         target: options.target,
+        blueprint: options.blueprint,
+        platform: options.platform,
         out: options.out,
         image: options.image,
         gateway: options.gateway,
@@ -273,21 +407,52 @@ program
         ingress,
         idpUrl: options.idpUrl,
         cookieDomain: options.cookieDomain,
+        colocate: Boolean(options.colocate),
+        modelRouting,
+        edgeTurnConnector: options.edgeTurnConnector,
+    });
+});
+// IdP command - generate the central IdP stack (org identity infra, set up once)
+program
+    .command('idp <action>')
+    .description('Generate the central IdP stack (init) — Caddy + oauth2-proxy + auth-broker. One per organization; agents federate against it with `deploy init --ingress edge-fed`.')
+    .option('--hostname <host>', 'Public hostname the IdP is reachable at (e.g. auth.corp.example) — required')
+    .option('--cookie-domain <domain>', 'Parent domain the shared auth cookie is scoped to (e.g. .corp.example); defaults to the hostname\'s own domain')
+    .option('-o, --out <path>', 'Output directory (default: ./enterprise-deploy/idp)')
+    .option('--force', 'Overwrite existing files')
+    .action(async (action, options) => {
+    await (0, idp_1.idpCommand)(action, {
+        hostname: options.hostname,
+        cookieDomain: options.cookieDomain,
+        out: options.out,
+        force: Boolean(options.force),
     });
 });
 // Pack command - pack management
 program
     .command('pack <action>')
-    .description('Manage agent packs (list, validate, install)')
+    .description('Manage agent packs (list, validate, sign, verify, digest, keygen, install)')
     .argument('[name]', 'Pack name or path')
-    .option('-o, --output <path>', 'Output path for export')
+    .option('-o, --output <path>', 'Output path for export, or for a generated signing key')
+    .option('--key <path>', 'pack sign: PEM file holding the ES256 private key')
+    .option('--kid <id>', 'pack sign/keygen: key id published in JWKS so verifiers can find the public half')
+    .option('--keys <path>', 'pack verify: JSON file of kid -> public PEM')
+    .option('--jwks <url>', 'pack verify: JWKS endpoint to fetch public halves from')
+    .option('--to <dir>', 'pack install: destination folder (flat layout for serve/deploy)')
+    .option('-f, --force', 'pack install: overwrite an existing folder')
     .option('-w, --workspace <path>', 'Workspace directory for local packs', process.cwd())
     .action(async (action, name, options) => {
     await (0, pack_1.packCommand)({
         action,
         name,
         output: options.output,
+        to: options.to,
+        force: options.force,
         workspace: options.workspace,
+        key: options.key,
+        kid: options.kid,
+        keys: options.keys,
+        jwks: options.jwks,
         verbose: program.opts().verbose,
     });
 });
@@ -326,8 +491,12 @@ const gatewayCmd = program.command('gateway').description('Gateway outbound mess
 gatewayCmd
     .command('send')
     .description('Send a proactive message via the gateway (WebSocket RPC; hippoclaw CLI fallback)')
-    .requiredOption('--outbound <path>', 'Session gateway-outbound.json (see AGENTHIPPO_GATEWAY_OUTBOUND_FILE)')
-    .requiredOption('-a, --agent <id>', 'Agent pack id')
+    // --outbound/--agent are optional: under `serve` with the egress broker active
+    // (AGENTHIPPO_EGRESS_URL + AGENTHIPPO_TURN_NONCE set), the broker resolves the destination
+    // server-side from the turn nonce and neither is needed (secure-obo-design §7.6). Off-serve
+    // the direct path still requires both (validated in gatewaySendCommand).
+    .option('--outbound <path>', 'Session gateway-outbound.json (see AGENTHIPPO_GATEWAY_OUTBOUND_FILE)')
+    .option('-a, --agent <id>', 'Agent pack id')
     .requiredOption('-m, --message <text>', 'Message to send')
     .option('--media <path-or-url>', 'Attach media (image/audio/video/document); local path or URL. Sent via gateway RPC so the bot token resolves from the gateway runtime snapshot.')
     .option('-t, --target <target>', 'Explicit target (e.g. channel:C01234567); defaults to last inbound route')
@@ -336,8 +505,8 @@ gatewayCmd
     .option('--json', 'Output handle + result as JSON')
     .action(async (options) => {
     await (0, gateway_1.gatewaySendCommand)({
-        outbound: options.outbound,
-        agent: options.agent,
+        outbound: options.outbound ?? '',
+        agent: options.agent ?? '',
         message: options.message,
         media: options.media,
         target: options.target,

package/out/cli/pack-install-ref.js

@@ -0,0 +1,15 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parsePackInstallRef = parsePackInstallRef;
+/** Parse `slug` or `slug@version` from `pack install` positional arg. */
+function parsePackInstallRef(name) {
+    const trimmed = name.trim();
+    const at = trimmed.lastIndexOf('@');
+    if (at > 0) {
+        return { slug: trimmed.slice(0, at), version: trimmed.slice(at + 1) || undefined };
+    }
+    return { slug: trimmed };
+}

package/out/cli/pack-loader.js

@@ -42,6 +42,7 @@ exports.loadAgentPack = loadAgentPack;
 exports.getDefaultConfig = getDefaultConfig;
 exports.getEnvDefaultModel = getEnvDefaultModel;
 exports.getApiConfig = getApiConfig;
+exports.hasCredentialForEngine = hasCredentialForEngine;
 exports.getFileAccess = getFileAccess;
 /**
  * Agent Pack Loader
@@ -330,6 +331,14 @@ function validateManifest(manifest, sourcePath) {
     if (manifest.spec?.cheapModel !== undefined && typeof manifest.spec.cheapModel !== 'string') {
         errors.push('Invalid spec.cheapModel: must be a string when provided');
     }
+    if (manifest.spec?.dataPlane !== undefined) {
+        if (typeof manifest.spec.dataPlane !== 'object' || !manifest.spec.dataPlane.connector?.trim()) {
+            errors.push('Invalid spec.dataPlane: requires a `connector` path (stdio MCP module run broker-side)');
+        }
+        if (manifest.spec.dataPlane?.provider !== undefined && typeof manifest.spec.dataPlane.provider !== 'string') {
+            errors.push('Invalid spec.dataPlane.provider: must be a string when provided');
+        }
+    }
     if (errors.length > 0) {
         throw new Error(`Invalid agent manifest at ${sourcePath}:\n  - ${errors.join('\n  - ')}`);
     }
@@ -354,20 +363,53 @@ function getEnvDefaultModel() {
 }
 /**
  * Get API configuration from environment.
+ *
+ * Returns the credentials keyed by destination (litellm / openai / anthropic) rather than a
+ * single collapsed key. The engine selects the one matching the endpoint it dials — see
+ * resolveApiRouting — so a codex deployment can no longer send an Anthropic key to OpenAI.
  */
 function getApiConfig() {
     const litellmApiKey = getEnvVar('AGENTHIPPO_LITELLM_API_KEY', 'AGENTIDE_LITELLM_API_KEY');
     const litellmBaseUrl = getEnvVar('AGENTHIPPO_LITELLM_BASE_URL', 'AGENTIDE_LITELLM_BASE_URL');
     const anthropicApiKey = process.env.ANTHROPIC_API_KEY || process.env.CLAUDE_API_KEY;
     const openaiApiKey = process.env.OPENAI_API_KEY;
-    const apiKey = litellmApiKey || anthropicApiKey || openaiApiKey;
-    const useLiteLLM = Boolean(litellmApiKey && litellmBaseUrl);
+    // The URL alone defines the trust domain. When a LiteLLM/gateway URL is configured, ALL
+    // engine traffic routes there — so it must authenticate with the LiteLLM key (or
+    // resolveApiRouting's 'sk-dummy' fallback), NEVER a provider secret, and must carry the
+    // analytics metadata headers. Requiring key+URL here once created a silent half-state:
+    // URL-only routed every call to the gateway with the REAL provider key as auth and no
+    // metadata at all (verified live 2026-07-27 with a header-capture stub). A missing key now
+    // yields a clean 401 against a strict gateway instead of a leaked credential.
+    const useLiteLLM = Boolean(litellmBaseUrl);
     return {
-        apiKey,
+        // Kept only for the "is any credential present at all?" boot check; routing never uses it.
+        apiKey: litellmApiKey || anthropicApiKey || openaiApiKey,
         baseUrl: litellmBaseUrl,
         useLiteLLM,
+        litellmApiKey,
+        openaiApiKey,
+        anthropicApiKey,
     };
 }
+/**
+ * Does the environment carry a usable credential for `engine`? Engine-aware so a codex
+ * deployment with only an Anthropic key (or vice-versa) fails loudly at boot instead of
+ * 401-ing at the first model call. A configured LiteLLM proxy satisfies every engine.
+ */
+function hasCredentialForEngine(engine, cfg = getApiConfig()) {
+    if (cfg.useLiteLLM) {
+        return true;
+    }
+    const e = engine.trim().toLowerCase();
+    if (e === 'claude') {
+        return Boolean(cfg.anthropicApiKey);
+    }
+    if (e === 'codex') {
+        return Boolean(cfg.openaiApiKey);
+    }
+    // Custom engines can authenticate via their own manifest-declared env var — don't gate them here.
+    return true;
+}
 /**
  * Get file access mode from pack manifest.
  */

package/out/cli/pack-runtime.js

@@ -0,0 +1,61 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createPackRunner = createPackRunner;
+/**
+ * One way to stand up a `HeadlessRunner` for an agent pack.
+ *
+ * `serve` and `sandbox` run the SAME engines against the SAME pack; the only difference is where
+ * the process sits. Every time the sandbox re-derived a piece of that setup itself it drifted from
+ * serve and broke live (the hand-rolled agent.yaml parser, the engine executable paths, the
+ * skipped `ensureDeps`). So the wiring lives here once and both call it: engine discovery,
+ * bundled prompts, the child env patch, and the credential shape.
+ *
+ * What is NOT here is deliberately not shared: credentials are the caller's business. serve
+ * holds provider keys; a sandbox only ever gets a per-sandbox, budget-capped model token that arrives
+ * on the run frame. Both express that through `credentials`, and nothing in this module can
+ * widen it.
+ */
+const headless_1 = require("../headless");
+const runtime_1 = require("./runtime");
+const utils_1 = require("./utils");
+/**
+ * Build the runner. Engine executables are resolved here rather than by the SDKs themselves:
+ * the engines ship WITH agenthippo, and a runtime image does not carry the SDK's own bundled
+ * cli.js — without these paths every turn inside a sandbox fails with "executable not found".
+ */
+function createPackRunner(options) {
+    return (0, headless_1.createHeadlessRunner)({
+        storagePath: options.storagePath,
+        analyticsSessionsDir: options.analyticsSessionsDir,
+        packId: options.packId,
+        packVersion: options.packVersion,
+        provenance: options.provenance,
+        bundledPromptsDir: (0, utils_1.findBundledBasePromptsDir)(),
+        apiKey: options.credentials.apiKey,
+        baseUrl: options.credentials.baseUrl,
+        useLiteLLM: options.credentials.useLiteLLM,
+        litellmApiKey: options.credentials.litellmApiKey,
+        openaiApiKey: options.credentials.openaiApiKey,
+        anthropicApiKey: options.credentials.anthropicApiKey,
+        logger: options.logger,
+        freshState: options.freshState ?? false,
+        claudeCodeExecutablePath: (0, utils_1.findClaudeCodePath)(),
+        codexExecutablePath: (0, utils_1.findCodexPath)(),
+        permissionHandler: options.permissionHandler,
+        // Gives engine children AGENTHIPPO_WORKSPACE_ROOT / AGENTHIPPO_ACTIVE_AGENT and puts the
+        // agenthippo binary on their PATH — without it a pack skill that shells out to the CLI
+        // cannot find it, which is exactly the kind of silent difference a sandbox must not have.
+        cliEnvPatch: (0, runtime_1.buildCliEnvPatch)({
+            cliPath: process.execPath,
+            workspaceRoot: options.workspaceRoot,
+            agentId: options.packId,
+            chatSessionId: options.chatSessionId,
+            baseEnv: process.env,
+            omitGatewayToken: options.omitGatewayToken,
+        }),
+        ...(options.claudeCheapModel ? { engineSettings: { claudeCheapModel: options.claudeCheapModel } } : {}),
+    });
+}

package/out/cli/runtime.js

@@ -42,6 +42,8 @@ exports.getBundledToolsHealth = getBundledToolsHealth;
 exports.getCliHealth = getCliHealth;
 exports.buildSessionEnvPatch = buildSessionEnvPatch;
 exports.buildCliEnvPatch = buildCliEnvPatch;
+exports.readProvenanceEnvFromProcess = readProvenanceEnvFromProcess;
+exports.buildProvenanceEnv = buildProvenanceEnv;
 exports.runCli = runCli;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
@@ -315,9 +317,16 @@ function buildCliEnvPatch(args) {
             chatSessionId: args.chatSessionId,
         }),
     };
-    const gatewayToken = readOpenClawGatewayToken(args.baseEnv);
-    if (gatewayToken) {
-        env[exports.OPENCLAW_GATEWAY_TOKEN_ENV] = gatewayToken;
+    // When serve runs the egress broker (secure-obo-design §7.6), the gateway token must NOT
+    // reach the agent's trust domain: the broker holds it, the agent presents only the turn
+    // nonce. AGENTHIPPO_EGRESS_URL in the process env is that signal — with it set, never bake
+    // the token into a child env (this closes §7.4 gap 1 for custom engines; codex/claude are
+    // covered by serve stripping the token from its own process.env).
+    if (!args.omitGatewayToken && !process.env.AGENTHIPPO_EGRESS_URL?.trim()) {
+        const gatewayToken = readOpenClawGatewayToken(args.baseEnv);
+        if (gatewayToken) {
+            env[exports.OPENCLAW_GATEWAY_TOKEN_ENV] = gatewayToken;
+        }
     }
     // Claude SDK refuses nested sessions when CLAUDECODE is present.
     // Force-unset in child runtime for CLI ask/chat/serve subprocesses.
@@ -361,6 +370,38 @@ function buildCliEnvPatch(args) {
     }
     return env;
 }
+/** Read provenance stamp env vars injected into sandbox children by serve. */
+function readProvenanceEnvFromProcess() {
+    const pick = (key) => process.env[key]?.trim() || undefined;
+    const tierRaw = pick('AGENTIDE_ANALYTICS_TIER');
+    const tier = tierRaw !== undefined ? Number(tierRaw) : undefined;
+    return {
+        policyVersion: pick('AGENTIDE_ANALYTICS_POLICY_VERSION'),
+        packDigest: pick('AGENTIDE_ANALYTICS_PACK_DIGEST'),
+        engineVersion: pick('AGENTIDE_ANALYTICS_ENGINE_VERSION'),
+        tier: tier !== undefined && Number.isFinite(tier) ? tier : undefined,
+        instanceId: pick('AGENTIDE_ANALYTICS_INSTANCE_ID'),
+    };
+}
+function buildProvenanceEnv(stamp) {
+    const env = {};
+    if (stamp.policyVersion?.trim()) {
+        env.AGENTIDE_ANALYTICS_POLICY_VERSION = stamp.policyVersion.trim();
+    }
+    if (stamp.packDigest?.trim()) {
+        env.AGENTIDE_ANALYTICS_PACK_DIGEST = stamp.packDigest.trim();
+    }
+    if (stamp.engineVersion?.trim()) {
+        env.AGENTIDE_ANALYTICS_ENGINE_VERSION = stamp.engineVersion.trim();
+    }
+    if (stamp.tier !== undefined) {
+        env.AGENTIDE_ANALYTICS_TIER = String(stamp.tier);
+    }
+    if (stamp.instanceId?.trim()) {
+        env.AGENTIDE_ANALYTICS_INSTANCE_ID = stamp.instanceId.trim();
+    }
+    return env;
+}
 async function runCli(binaryPath, args, opts) {
     return await new Promise((resolve, reject) => {
         const child = (0, child_process_1.spawn)(binaryPath, args, {