@agenthippo-ai/agenthippo 0.1.1 → 1.110.9

package/out/cli/serve-hardening.js

@@ -36,13 +36,18 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TurnGate = exports.TURN_GATE_BUSY_MESSAGE = exports.TURN_GATE_RETRY_AFTER_SECONDS = exports.TURN_QUEUE_ENV = exports.MAX_CONCURRENT_TURNS_ENV = exports.TurnLimiter = exports.IDENTITY_HEADER_ENV = exports.RateLimiter = exports.XFF_TRUSTED_HOPS_ENV = exports.CONTAINER_SERVE_HOST = exports.SERVE_HOST_ENV = exports.DEFAULT_BIND_HOST = exports.DEFAULT_MAX_BODY_BYTES = void 0;
+exports.TurnGate = exports.TURN_LIMIT_BUSY_MESSAGE = exports.RATE_LIMIT_BUSY_MESSAGE = exports.TURN_GATE_BUSY_MESSAGE = exports.TURN_GATE_RETRY_AFTER_SECONDS = exports.TURN_QUEUE_ENV = exports.MAX_CONCURRENT_TURNS_ENV = exports.TurnLimiter = exports.SESSION_WITHOUT_USER_REASON = exports.IDENTITY_HEADER_ENV = exports.PIN_ONLY_IDENTITY_HEADERS = exports.RateLimiter = exports.XFF_TRUSTED_HOPS_ENV = exports.CONTAINER_SERVE_HOST = exports.SERVE_HOST_ENV = exports.DEFAULT_BIND_HOST = exports.DEFAULT_MAX_BODY_BYTES = void 0;
 exports.resolveStateDir = resolveStateDir;
+exports.resolveAnalyticsSessionsDir = resolveAnalyticsSessionsDir;
+exports.isLoopbackHost = isLoopbackHost;
 exports.resolveBindHost = resolveBindHost;
 exports.clientIp = clientIp;
+exports.identityHeaderAdvice = identityHeaderAdvice;
 exports.resolveUserId = resolveUserId;
 exports.resolveDataToken = resolveDataToken;
 exports.peerToUserId = peerToUserId;
+exports.userNamespaceHash = userNamespaceHash;
+exports.resolveServeSessionKey = resolveServeSessionKey;
 exports.corsHeaders = corsHeaders;
 exports.createTurnGateFromEnv = createTurnGateFromEnv;
 exports.createRejectionWarner = createRejectionWarner;
@@ -60,6 +65,8 @@ exports.readBodyWithCap = readBodyWithCap;
  */
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
+const crypto = __importStar(require("crypto"));
+const paths_1 = require("../utils/paths");
 /** Default cap on a single request body (1 MiB). Chat messages are small; large bodies are abuse or bugs. */
 exports.DEFAULT_MAX_BODY_BYTES = 1024 * 1024;
 /**
@@ -82,8 +89,33 @@ function resolveStateDir(stateDirOpt, env = process.env) {
     }
     return { dir: path.join(os.tmpdir(), 'agenthippo-server'), ephemeral: true };
 }
+/**
+ * Where serve's Layer 2 analytics (tool-call/warrant JSONL) should live. Precedence:
+ *   1. AGENT_HOME_DIR / AGENTHIPPO_HOME set → getAgentideHome()/analytics/sessions — the
+ *      exact location sessionJsonlFleet.ts and query-analytics.sh already scan by default,
+ *      so this data stays discoverable to Spotlight/DuckDB.
+ *   2. Neither set, but the resolved state dir is non-ephemeral (an explicit --state-dir
+ *      was given) → <stateDir>/analytics/sessions. Not the canonical scan location, but
+ *      still durable — never regress below whatever durability the caller already
+ *      established just to be discoverable.
+ *   3. Neither set and state is ephemeral (no --state-dir, no home-dir env var at all) →
+ *      falls through to getAgentideHome()'s own os.homedir() default, matching the
+ *      already-correct IDE-local behavior — nothing durable was configured either way.
+ */
+function resolveAnalyticsSessionsDir(stateDir, stateDirEphemeral, env = process.env) {
+    const homeOverride = env.AGENT_HOME_DIR?.trim() || env.AGENTHIPPO_HOME?.trim();
+    if (!homeOverride && !stateDirEphemeral) {
+        return path.join(stateDir, 'analytics', 'sessions');
+    }
+    return path.join((0, paths_1.getAgentideHome)(), 'analytics', 'sessions');
+}
 /** Loopback default — safe everywhere a human runs `serve` locally. */
 exports.DEFAULT_BIND_HOST = '127.0.0.1';
+/** True when a bind address is reachable only from this machine. */
+function isLoopbackHost(host) {
+    const h = host.trim().toLowerCase().replace(/^\[|\]$/g, '');
+    return h === 'localhost' || h === '::1' || /^127\./.test(h);
+}
 /** Env var for the listen address (used by generated deploy Dockerfiles). */
 exports.SERVE_HOST_ENV = 'AGENTHIPPO_SERVE_HOST';
 /** Bind address baked into container deploy artifacts (Docker / Cloud Run sidecars). */
@@ -179,15 +211,78 @@ class RateLimiter {
     }
 }
 exports.RateLimiter = RateLimiter;
+/**
+ * Identity headers trusted when NOTHING is pinned.
+ *
+ * Every entry here is a header that exactly one platform sets AND owns the request path for, so
+ * a client-supplied copy cannot reach serve without that platform having been bypassed entirely.
+ *
+ * `x-agent-user` is deliberately NOT in this list, and this is a breaking change for anything
+ * that relied on it being trusted by default. It is AgentHippo's own canonical header — the name
+ * an arbitrary client is most likely to guess — it belongs to no platform that strips it, and it
+ * used to sit FIRST, so it beat every platform header that follows. The consequence on any
+ * deployment that had not pinned `AGENTHIPPO_IDENTITY_HEADER`: any HTTP client could send
+ * `x-agent-user: victim@example.com` and be namespaced into that user's session state, attach to
+ * their conversation, and be issued a data-plane turn nonce scoped to them. Cloud Run IAP makes
+ * this concrete — it strips `X-Goog-*` and forwards a client-supplied `x-agent-user` untouched.
+ *
+ * It remains perfectly valid as a PINNED header (`AGENTHIPPO_IDENTITY_HEADER=x-agent-user`),
+ * which is what a deployment whose proxy really does set and strip it should use — including the
+ * Caddy `forward_auth` flow, where `auth-broker/server.ts` sets `X-Agent-User` on `/api/ide/me`
+ * so Caddy can copy a VALIDATED identity upstream. That direction is the correct and only source
+ * of the header, and it is unaffected: pinning is exactly the declaration that it is trustworthy.
+ */
 const HEADER_ALIASES = [
-    'x-agent-user', // AgentHippo canonical (set by our Worker / generic proxy)
     'x-forwarded-email', // Databricks Apps
     'x-forwarded-preferred-username', // Databricks Apps
     'x-goog-authenticated-user-email', // Cloud Run IAP (prefixed value, stripped below)
     'cf-access-authenticated-user-email', // Cloudflare Access
 ];
+/**
+ * Headers that are only ever trusted when explicitly pinned.
+ *
+ * Kept as a named list rather than deleted, because "why is my identity header ignored?" needs an
+ * answer, and `identityHeaderAdvice` gives one that names the env var to set.
+ */
+exports.PIN_ONLY_IDENTITY_HEADERS = ['x-agent-user'];
 /** Env var: pin the single identity header the deploy layer actually sets (and strips). */
 exports.IDENTITY_HEADER_ENV = 'AGENTHIPPO_IDENTITY_HEADER';
+/**
+ * Boot-time advice about identity trust. Returns the lines serve must print, loudest first.
+ *
+ * Not a refusal. Refusing to boot without a pin would stop deployments that are configured
+ * correctly today (Databricks Apps, Cloudflare Access) and whose platform header is genuinely
+ * unforgeable — a fail-closed default that mostly punishes the compliant is not a security win.
+ * What was actually dangerous was `x-agent-user` being trusted by default, and that is now gone.
+ */
+function identityHeaderAdvice(env = process.env, bindHost) {
+    const pinned = env[exports.IDENTITY_HEADER_ENV]?.trim();
+    if (pinned) {
+        return [];
+    }
+    // Severity follows reachability. On loopback nothing off-box can reach the port, so the same
+    // paragraph every local run is warning fatigue — and fatigue is why the message gets ignored
+    // on the deploy where it decides whether strangers can name themselves as another user.
+    const host = bindHost?.trim();
+    if (host && isLoopbackHost(host)) {
+        return [
+            `${exports.IDENTITY_HEADER_ENV} is not set. Fine for this loopback bind; pin it before exposing ` +
+                `serve on a network interface.`,
+        ];
+    }
+    return [
+        ...(host
+            ? [`serve is bound to ${host} — reachable beyond this machine — with no ${exports.IDENTITY_HEADER_ENV} pinned. ` +
+                    `Anyone who can reach this port is trusted to state who they are.`]
+            : []),
+        `${exports.IDENTITY_HEADER_ENV} is not set, so identity falls back to the platform header aliases ` +
+            `(${HEADER_ALIASES.join(', ')}). That is only safe when your proxy sets AND STRIPS every one of them. ` +
+            `Pin the single header your deploy layer really controls, e.g. ${exports.IDENTITY_HEADER_ENV}=x-goog-authenticated-user-email.`,
+        `NOTE: ${exports.PIN_ONLY_IDENTITY_HEADERS.join(', ')} is NO LONGER trusted by default — it is not stripped by any ` +
+            `platform, so an arbitrary client could send it and be namespaced as another user. If your proxy does set it ` +
+            `(the Caddy forward_auth / auth-broker flow does), pin it: ${exports.IDENTITY_HEADER_ENV}=x-agent-user.`,
+    ];
+}
 /**
  * Resolve the end-user identity for a request.
  *
@@ -197,7 +292,10 @@ exports.IDENTITY_HEADER_ENV = 'AGENTHIPPO_IDENTITY_HEADER';
  * that pins a header has declared it has a real proxy-verified identity, so an
  * unauthenticated caller must not be able to name themselves via the client-
  * controlled body. Body fallback is dev/internal convenience for the *unpinned*
- * case only (e.g. direct curl against a local serve with no identity proxy).
+ * case only (e.g. direct curl against a local serve with no identity proxy) —
+ * and it must be OPTED INTO via AGENTHIPPO_ALLOW_BODY_IDENTITY=1 (serve-v4 §10
+ * hole 3). Before the gate it was safe "by convention": any deployment that
+ * forgot to pin a header silently let every caller name an arbitrary victim.
  *
  * The alias-list default (used when unpinned) is only safe when the proxy strips
  * or overwrites ALL of the aliases; platforms that strip only their own header
@@ -232,6 +330,10 @@ function resolveUserId(headers, body, env = process.env) {
         // access, gcloud run services proxy bypassing IAP) name an arbitrary victim.
         return undefined;
     }
+    // Unpinned body identity is an explicit opt-in, never a default (§10 hole 3).
+    if (env.AGENTHIPPO_ALLOW_BODY_IDENTITY?.trim() !== '1') {
+        return undefined;
+    }
     const fromBody = body?.user_id?.trim();
     return fromBody || undefined;
 }
@@ -275,6 +377,36 @@ function peerToUserId(peer) {
     const channel = peer.channel?.trim();
     return channel ? `${channel}:${id}` : id;
 }
+/** Stable reason code when a session_id is presented without a verified user on a pinned-identity deployment. */
+exports.SESSION_WITHOUT_USER_REASON = 'session_without_verified_user';
+/** Filesystem/S3-safe per-user namespace segment (user ids are emails/subjects — never raw path segments). */
+function userNamespaceHash(userId) {
+    return crypto.createHash('sha256').update(userId).digest('hex').slice(0, 16);
+}
+/**
+ * Namespace the session key by the verified user (secure-obo-design §3.4 / §8 Phase 0).
+ *
+ * `session_id` is client-supplied; un-namespaced, any authenticated user who guesses another
+ * user's session_id attaches to that session's conversation state (which holds the other
+ * user's row-filtered query results). Prefixing the key with a hash of the verified user makes
+ * cross-user attachment structurally impossible without changing client behavior.
+ *
+ * Fail-closed rule: when the deployment pins an identity header (it declared a real
+ * proxy-verified identity exists) and a request carries a session_id but no verified user,
+ * reject — never let an unauthenticated caller name a session. Unpinned deployments
+ * (local dev, no identity boundary at all) keep today's raw-key behavior.
+ */
+function resolveServeSessionKey(sessionId, userId, env = process.env) {
+    const sid = sessionId?.trim();
+    const uid = userId?.trim();
+    if (uid) {
+        return { sessionKey: `u${userNamespaceHash(uid)}--${sid || 'default'}` };
+    }
+    if (sid && env[exports.IDENTITY_HEADER_ENV]?.trim()) {
+        return { sessionKey: '', rejected: exports.SESSION_WITHOUT_USER_REASON };
+    }
+    return { sessionKey: sid || 'anon-unknown' };
+}
 /** Build CORS headers. Serve is always behind a proxy; CORS is wide-open here. */
 function corsHeaders() {
     return {
@@ -320,6 +452,10 @@ exports.TURN_QUEUE_ENV = 'AGENTHIPPO_TURN_QUEUE';
 exports.TURN_GATE_RETRY_AFTER_SECONDS = 15;
 /** User-visible capacity message for gateway channels (Slack/Telegram can't receive HTTP 429). */
 exports.TURN_GATE_BUSY_MESSAGE = 'At capacity — please retry in a moment';
+/** User-visible message for gateway channels when the per-identity RateLimiter rejects. */
+exports.RATE_LIMIT_BUSY_MESSAGE = 'Rate limit exceeded — please retry in a moment';
+/** User-visible message for gateway channels when the per-session TurnLimiter rejects. */
+exports.TURN_LIMIT_BUSY_MESSAGE = 'Per-session turn limit reached';
 /**
  * Process-wide concurrency gate for engine turns (semaphore + bounded FIFO).
  *

package/out/cli/state-sync.js

@@ -216,17 +216,20 @@ async function pathExists(p) {
         return false;
     }
 }
-async function copyDirIfExists(src, dest) {
-    if (!(await pathExists(src))) {
-        return;
-    }
-    await fsp.mkdir(dest, { recursive: true });
-    await fsp.cp(src, dest, { recursive: true, force: true });
-}
 /**
- * Build a local staging tree for session S:
- *   provider-sessions/<shards for S>
- *   agents/            (replica snapshot — sticky-by-user keeps this scoped)
+ * Build a local staging tree for session S: provider-sessions/<shards for S> only.
+ *
+ * `<stateDir>/agents/<agentId>/{claude,codex}` (the SDK's own on-disk session/config
+ * cache — see agentpack/paths.ts) is deliberately NOT included here. That directory is
+ * shared by every session/user of the same pack on this replica, keyed only by agentId —
+ * never session-scoped. Treating it as part of one session's push/restore let one
+ * session's stale snapshot force-overwrite the live SDK cache for every other
+ * concurrently active session on the replica (fs.cp force:true in the old
+ * mergeSessionStagingIntoState). It's local-disk-only now, same as before object-store
+ * sync existed: it lives and dies with its replica. A resume target missing after a
+ * replica change already falls back to a fresh SDK session — the same path every
+ * session's true first turn on any replica already takes — so this doesn't introduce a
+ * new failure mode, it just stops the wrong-session-data clobber.
  */
 async function stageSessionPushDir(stateDir, sessionId, stagingDir) {
     await fsp.rm(stagingDir, { recursive: true, force: true });
@@ -239,11 +242,10 @@ async function stageSessionPushDir(stateDir, sessionId, stagingDir) {
             await fsp.copyFile(path.join(stateDir, 'provider-sessions', name), path.join(psDest, name));
         }
     }
-    await copyDirIfExists(path.join(stateDir, 'agents'), path.join(stagingDir, 'agents'));
-    const hasAgents = await pathExists(path.join(stagingDir, 'agents'));
-    return shards.length > 0 || hasAgents;
+    return shards.length > 0;
 }
-/** Merge a restored staging tree back into stateDir. */
+/** Merge a restored staging tree back into stateDir (provider-session shards only — see
+ *  stageSessionPushDir for why the SDK config cache is intentionally excluded). */
 async function mergeSessionStagingIntoState(stagingDir, stateDir) {
     const psSrc = path.join(stagingDir, 'provider-sessions');
     if (await pathExists(psSrc)) {
@@ -256,7 +258,6 @@ async function mergeSessionStagingIntoState(stagingDir, stateDir) {
             await fsp.copyFile(path.join(psSrc, name), path.join(psDest, name));
         }
     }
-    await copyDirIfExists(path.join(stagingDir, 'agents'), path.join(stateDir, 'agents'));
 }
 /** Download state from the bucket into stateDir on boot. An empty bucket is a no-op. */
 async function restoreState(cfg, stateDir, log) {

package/out/cli/utils.js

@@ -77,6 +77,13 @@ function findClaudeCodePath() {
     if (depsPath) {
         return depsPath;
     }
+    // 2b. Our OWN dependency tree — the case where the runtime ships as a node app with the
+    // SDK already in node_modules. Without this, such a deployment fails with "Claude Code CLI
+    // not found" while the SDK sits right there (hit on the Hanoi VM, 2026-07-27).
+    const ownCli = (0, deps_1.resolveFromOwnDeps)('@anthropic-ai/claude-agent-sdk', 'cli.js');
+    if (ownCli) {
+        return ownCli;
+    }
     // 3. Check bundled location (next to binary) - legacy fallback
     const binaryDir = getBinaryDir();
     const bundledPath = path.join(binaryDir, 'claude-sdk', 'cli.js');
@@ -131,6 +138,10 @@ function findCodexPath() {
         return process.env.CODEX_PATH;
     }
     // 2. Check npm-installed location (.agenthippo-deps/node_modules)
+    const ownCodex = (0, deps_1.resolveFromOwnDeps)('@openai/codex', 'bin/codex.js');
+    if (ownCodex) {
+        return ownCodex;
+    }
     const depsPath = (0, deps_1.getCodexSdkBinaryPath)();
     if (depsPath) {
         return depsPath;
@@ -211,7 +222,7 @@ exports.COLORS = {
     red: '\x1b[31m',
     yellow: '\x1b[33m',
 };
-exports.SUGGESTED_LITELLM_SMOKE_TEST_COMMAND = 'AGENTHIPPO_LITELLM_BASE_URL="http://localhost:4000" AGENTHIPPO_LITELLM_API_KEY="dummy" AGENTHIPPO_DEFAULT_MODEL="litellm/gpt-5.3-codex" AGENTHIPPO_DEFAULT_ENGINE="codex" agenthippo ask "Reply with exactly: CLI_TEST_OK"';
+exports.SUGGESTED_LITELLM_SMOKE_TEST_COMMAND = 'AGENTHIPPO_LITELLM_BASE_URL="http://localhost:4000" AGENTHIPPO_LITELLM_API_KEY="dummy" AGENTHIPPO_DEFAULT_MODEL="litellm/gpt-5.5" AGENTHIPPO_DEFAULT_ENGINE="codex" agenthippo ask "Reply with exactly: CLI_TEST_OK"';
 function getLiteLLMQuickstartHintLines() {
     return [
         'Try local LiteLLM quickstart:',

package/out/engines/base.js

@@ -1,6 +1,7 @@
 "use strict";
 /*---------------------------------------------------------------------------------------------
  *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *  Licensed under the MIT License. See LICENSE.txt in the project root for license information.
  *--------------------------------------------------------------------------------------------*/
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -42,6 +43,7 @@ exports.generateRequestId = generateRequestId;
 exports.persistSessionIfNeeded = persistSessionIfNeeded;
 exports.touchSessionIfNeeded = touchSessionIfNeeded;
 exports.getPersistedSessionId = getPersistedSessionId;
+const identity_1 = require("../analytics/identity");
 const session_1 = require("../session");
 const path = __importStar(require("path"));
 /**
@@ -54,16 +56,26 @@ const path = __importStar(require("path"));
  * Langfuse passthrough: langfuse_session_id / langfuse_trace_user_id headers
  * are included so users who add Langfuse as a LiteLLM callback get session
  * grouping automatically.
+ *
+ * IDENTITY: the user id is a salted hash (see analytics/identity.ts). It used to be the raw
+ * value — usually an email — sent on two headers to a proxy that logs every request and forwards
+ * to a third-party observability backend. The hash is stable, so grouping and per-user analytics
+ * still work; it is just no longer a directory of who works here. Set
+ * AGENTHIPPO_EVIDENCE_RAW_IDS=1 to send the raw value again.
+ *
+ * The provider never sees either form: `additional_drop_params: ["user"]` in the LiteLLM config
+ * strips the end-user field before dispatch.
  */
 function buildLiteLLMMetadataHeaders(useLiteLLM, metadata) {
     if (!useLiteLLM) {
         return [];
     }
     const headers = [];
-    if (metadata.analyticsUserId?.trim()) {
-        headers.push(`x-litellm-metadata-user-id: ${metadata.analyticsUserId.trim()}`);
+    const userId = (0, identity_1.hashIdentity)(metadata.analyticsUserId);
+    if (userId) {
+        headers.push(`x-litellm-metadata-user-id: ${userId}`);
         // Langfuse passthrough: maps to Langfuse trace user_id when Langfuse callback is enabled
-        headers.push(`langfuse_trace_user_id: ${metadata.analyticsUserId.trim()}`);
+        headers.push(`langfuse_trace_user_id: ${userId}`);
     }
     if (metadata.sessionId?.trim()) {
         headers.push(`x-litellm-metadata-session-id: ${metadata.sessionId.trim()}`);
@@ -88,6 +100,23 @@ function buildLiteLLMMetadataHeaders(useLiteLLM, metadata) {
     if (metadata.requestId?.trim()) {
         headers.push(`x-litellm-metadata-request-id: ${metadata.requestId.trim()}`);
     }
+    // Provenance stamp (PLAN/compliance.md §3.1): lands in requester_metadata on every OTEL
+    // span, which is where the evidence index reads policy_version / pack_digest from.
+    if (metadata.policyVersion?.trim()) {
+        headers.push(`x-litellm-metadata-policy-version: ${metadata.policyVersion.trim()}`);
+    }
+    if (metadata.packDigest?.trim()) {
+        headers.push(`x-litellm-metadata-pack-digest: ${metadata.packDigest.trim()}`);
+    }
+    if (metadata.engineVersion?.trim()) {
+        headers.push(`x-litellm-metadata-engine-version: ${metadata.engineVersion.trim()}`);
+    }
+    if (metadata.tier !== undefined) {
+        headers.push(`x-litellm-metadata-tier: ${metadata.tier}`);
+    }
+    if (metadata.instanceId?.trim()) {
+        headers.push(`x-litellm-metadata-instance-id: ${metadata.instanceId.trim()}`);
+    }
     return headers;
 }
 /**

package/out/engines/claude.js

@@ -39,12 +39,15 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ClaudeEngine = void 0;
 const fs_1 = require("fs");
 const path = __importStar(require("path"));
+const branding_1 = require("../branding");
 const base_1 = require("./base");
 const utils_1 = require("../utils");
 const permissions_1 = require("../permissions");
 const mcp_1 = require("../mcp");
+const runtime_1 = require("../cli/runtime");
 const session_1 = require("../session");
 const agentpack_1 = require("../agentpack");
+const credential_context_1 = require("../cli/credential-context");
 const shared_1 = require("../shared");
 // File tools we track for edit diffs via hooks (Set for O(1) lookup)
 // Includes Claude SDK tools, Computer Use tools, and common variations
@@ -241,7 +244,8 @@ class ClaudeEngine {
         // Edit tracker from runtime context (optional)
         const editTracker = runtime.editTracker;
         // Resolve API routing (LiteLLM proxy vs direct Anthropic)
-        const { apiKey, baseUrl, useLiteLLM } = (0, utils_1.resolveApiRouting)(options, this.config.litellmApiKey, this.config.litellmBaseUrl);
+        // claude routes to Anthropic when direct (or the LiteLLM proxy when configured) — never OpenAI.
+        const { apiKey, baseUrl, useLiteLLM } = (0, utils_1.resolveApiRouting)(options, this.config, 'anthropic');
         if (!apiKey) {
             throw new Error('Claude API key not provided');
         }
@@ -258,6 +262,11 @@ class ClaudeEngine {
             source: 'agenthippo',
             engine: 'claude',
             requestId: options.requestId,
+            policyVersion: options.policyVersion,
+            packDigest: options.packDigest,
+            instanceId: options.instanceId,
+            engineVersion: options.engineVersion,
+            tier: options.tier,
         });
         // Build environment for Claude SDK.
         // Setup-token auth must use Claude's OAuth token env var instead of ANTHROPIC_API_KEY.
@@ -267,6 +276,13 @@ class ClaudeEngine {
             'DEBUG_CLAUDE_AGENT_SDK': '1',
             'CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC': '1',
         };
+        // The gateway token stays broker-side; scrub it from the child env so it never reaches
+        // the model (secure-obo-design §7.6 / §7.4 gap 1). UNCONDITIONALLY (serve-v4 §10 hole 2):
+        // gating this on the egress broker let a deployment without --gateway-bridge re-inherit
+        // the token, including via buildCliEnvPatch's bake from the host's ~/.openclaw config.
+        delete claudeEnv[runtime_1.OPENCLAW_GATEWAY_TOKEN_ENV];
+        // Data-plane sidecar control token: never the engine's to hold (secure-obo-design §7.6).
+        delete claudeEnv['AGENTHIPPO_DATA_PLANE_TOKEN'];
         const isSetupTokenAuth = (0, shared_1.isAnthropicSetupToken)(apiKey);
         if (isSetupTokenAuth) {
             const normalizedSetupToken = (0, shared_1.normalizeAnthropicSetupToken)(apiKey);
@@ -295,8 +311,13 @@ class ClaudeEngine {
         // Note: cwd is ALWAYS workspaceRoot - active agent content is synced to workspace's .claude/.codex
         const agentId = options.agentPackId ?? 'default';
         const runtimePaths = (0, agentpack_1.resolveRuntimePaths)(options.workspaceRoot, this.config.storagePath, agentId, options.agentPackVersion);
-        // Claude config directory (isolated per agent for session/state isolation)
-        const claudeConfigDir = runtimePaths.claudeConfigDir;
+        // Claude config directory (isolated per agent for session/state isolation). In
+        // multi-tenant serve, additionally key it by the verified request user — the same
+        // §8 Phase 0 scoping codex.ts applies to CODEX_HOME. A shared per-agent dir lets
+        // concurrent turns of different users race each other's per-turn credential state
+        // (the agentpack/paths.ts race); per-user scoping makes any remaining race
+        // same-user. No credential frame (IDE, single-tenant CLI) ⇒ unchanged path.
+        const claudeConfigDir = (0, agentpack_1.userScopedEngineHome)(runtimePaths.claudeConfigDir, (0, credential_context_1.currentCredential)()?.userId);
         claudeEnv['CLAUDE_CONFIG_DIR'] = claudeConfigDir;
         await fs_1.promises.mkdir(claudeConfigDir, { recursive: true });
         // Always set AGENT_ID for agent to know its identity
@@ -541,8 +562,11 @@ class ClaudeEngine {
                 logger.debug(`[AgentIDE] SessionStart hook called! event=${input.hook_event_name}`);
                 return CONTINUE;
             };
-            // Load MCP servers for the active agent and pass directly to SDK
-            const mcpServers = await this.loadMcpServersForClaude(logger, options.workspaceRoot, agentId);
+            // Load MCP servers for the active agent and pass directly to SDK. URL servers carry a
+            // `${NAME}` bearer reference the CLI expands from claudeEnv at connect time, so the
+            // turn nonce rides neither a shared config file nor the SDK's --mcp-config argv —
+            // claudeEnv is passed for the rare non-expandable-name fallback only.
+            const mcpServers = await this.loadMcpServersForClaude(logger, options.workspaceRoot, agentId, claudeEnv);
             // Determine cwd and settingSources
             // cwd is ALWAYS workspaceRoot - active agent content has been synced to workspace's .claude/
             // Agent packs: settingSources is 'project' only (no user ~/.claude/ mixing)
@@ -1058,7 +1082,7 @@ class ClaudeEngine {
                 logger.info(`[AgentIDE] Claude thinking summary: startBlocks=${thinkingStartBlockCount}, redactedBlocks=${redactedThinkingBlockCount}, deltas=${thinkingDeltaCount}, chars=${thinkingCharCount}`);
                 logger.info(`[AgentIDE] Claude tool summary: toolBlocks=${toolUseBlockCount}, toolEmits=${toolUseEmitCount}, toolProgressMsgs=${toolProgressCount}, inputJsonDeltas=${inputJsonDeltaCount}`);
                 if (thinkingStartBlockCount === 0 && thinkingDeltaCount === 0 && redactedThinkingBlockCount === 0) {
-                    logger.debug('[AgentIDE] Claude emitted no thinking blocks/deltas. Ensure model supports extended thinking and set agentide.claude.maxThinkingTokens >= 1024.');
+                    logger.debug(`[AgentIDE] Claude emitted no thinking blocks/deltas. Ensure model supports extended thinking and set ${(0, branding_1.toSettingsDisplayKey)('agentide.claude.maxThinkingTokens')} >= 1024.`);
                 }
                 if (toolUseBlockCount === 0 && toolProgressCount === 0) {
                     logger.debug('[AgentIDE] Claude emitted no tool usage events. If tools were used, ensure includePartialMessages=true and parse tool_use blocks.');
@@ -1191,9 +1215,15 @@ class ClaudeEngine {
      * - Default agent: uses bundled MCP servers from extension
      * - Pack agents: uses pack's mcp/ directory
      *
-     * The SDK accepts mcpServers directly in query options.
+     * The SDK accepts mcpServers directly in query options — including HTTP Streamable
+     * servers (`{type:'http', url, headers}`). A URL server's `bearerTokenEnv` (e.g.
+     * AGENTHIPPO_TURN_NONCE) becomes a `${NAME}` reference the CLI expands from its own env,
+     * NOT a resolved header: the SDK serializes mcpServers into `--mcp-config` argv, and a
+     * resolved bearer there is world-readable via /proc/<pid>/cmdline (see
+     * referenceHttpMcpHeaders). `turnEnv` is the per-turn child env, used only for the
+     * fallback when a name is outside the CLI's expansion grammar.
      */
-    async loadMcpServersForClaude(logger, workspaceRoot, agentId = 'default') {
+    async loadMcpServersForClaude(logger, workspaceRoot, agentId = 'default', turnEnv) {
         const basePromptsDir = this.getBundledBasePromptsDir();
         const servers = await (0, mcp_1.loadMcpServers)(agentId, workspaceRoot, basePromptsDir);
         if (servers.length === 0) {
@@ -1201,6 +1231,15 @@ class ClaudeEngine {
         }
         const mcpServers = {};
         for (const s of servers) {
+            if (s.url) {
+                const headers = (0, mcp_1.referenceHttpMcpHeaders)(s, turnEnv ?? process.env);
+                mcpServers[s.name] = {
+                    type: 'http',
+                    url: s.url,
+                    ...(headers ? { headers } : {}),
+                };
+                continue;
+            }
             mcpServers[s.name] = {
                 command: s.command,
                 args: s.args,