@agenthippo-ai/agenthippo 0.1.1 → 1.110.9

package/out/gateway/secretsPreflight.js

@@ -0,0 +1,90 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseStrictJsonConfig = parseStrictJsonConfig;
+exports.collectMissingChannelEnvSecrets = collectMissingChannelEnvSecrets;
+exports.disableChannelsInConfigText = disableChannelsInConfigText;
+const MAX_WALK_DEPTH = 8;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * Parse config content as strict JSON, or undefined when it does not parse.
+ *
+ * OpenClaw accepts JSON5 (the starter template has comments). A JSON5 file cannot be
+ * round-tripped through JSON.parse/stringify without losing comments, so callers must
+ * treat `undefined` as "hands off — detect nothing, rewrite nothing".
+ */
+function parseStrictJsonConfig(content) {
+    try {
+        return JSON.parse(content);
+    }
+    catch {
+        return undefined;
+    }
+}
+function collectEnvRefs(value, out, depth) {
+    if (depth > MAX_WALK_DEPTH) {
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            collectEnvRefs(item, out, depth + 1);
+        }
+        return;
+    }
+    if (!isRecord(value)) {
+        return;
+    }
+    if (value.source === 'env' && typeof value.id === 'string' && value.id.trim()) {
+        out.add(value.id.trim());
+        return;
+    }
+    for (const child of Object.values(value)) {
+        collectEnvRefs(child, out, depth + 1);
+    }
+}
+/**
+ * List enabled channels whose env-sourced secret refs resolve to nothing in `env`.
+ *
+ * A channel counts as enabled unless it says `enabled: false` — a configured channel is
+ * intent, and the gateway will try (and fail) to start it either way. Literal token
+ * strings are not env refs and are never reported.
+ */
+function collectMissingChannelEnvSecrets(config, env) {
+    if (!isRecord(config) || !isRecord(config.channels)) {
+        return [];
+    }
+    const result = [];
+    for (const [name, channel] of Object.entries(config.channels)) {
+        if (!isRecord(channel) || channel.enabled === false) {
+            continue;
+        }
+        const refs = new Set();
+        collectEnvRefs(channel, refs, 0);
+        const missing = [...refs].filter((id) => !env[id]?.trim()).sort();
+        if (missing.length) {
+            result.push({ channel: name, envVars: missing });
+        }
+    }
+    return result;
+}
+/**
+ * Return config text with the named channels set to `enabled: false`, or undefined when
+ * the content is not strict JSON (rewriting JSON5 would destroy comments).
+ */
+function disableChannelsInConfigText(content, channels) {
+    const config = parseStrictJsonConfig(content);
+    if (!isRecord(config) || !isRecord(config.channels)) {
+        return undefined;
+    }
+    for (const name of channels) {
+        const channel = config.channels[name];
+        if (isRecord(channel)) {
+            channel.enabled = false;
+        }
+    }
+    return `${JSON.stringify(config, null, 2)}\n`;
+}

package/out/gateway/service.js

@@ -46,10 +46,12 @@ exports.GatewayService = exports.GatewaySessionBindingError = void 0;
  * - Session routing: disk-backed route index + per-session gateway-session.json
  * - Publish: user connects an existing IDE session to the gateway
  */
+const crypto_1 = require("crypto");
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const vscode = __importStar(require("vscode"));
 const scheduledFleetStorage_js_1 = require("../analytics/dashboard/scheduledFleetStorage.js");
+const branding_js_1 = require("../branding.js");
 const bridge_js_1 = require("./bridge.js");
 const gateway_scope_errors_js_1 = require("./gateway-scope-errors.js");
 const gatewayRouteIndex_js_1 = require("./gatewayRouteIndex.js");
@@ -769,7 +771,10 @@ class GatewayService {
      */
     createSessionAwareChatUIHandler(agentId, packName) {
         return async (message, sessionKey, peerInfo, emitter, runContext) => {
-            const gatewayRequestToken = `gw-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+            // Unguessable: this token is a bearer capability for the run's output stream, and
+            // `getGatewayEmitter` is a destructive first-reader-wins read. A predictable value
+            // lets any chat message beginning with `[gw:...]` steal or drop another run's stream.
+            const gatewayRequestToken = `gw-${(0, crypto_1.randomUUID)()}`;
             GatewayService.gatewayEmitters.set(gatewayRequestToken, emitter);
             const markedMessage = `[gw:${gatewayRequestToken}]${message}`;
             try {
@@ -983,7 +988,7 @@ class GatewayService {
         const tokenRaw = (gwLive.get("token") ?? "").trim() || (this.config.token ?? "").trim();
         if (!url) {
             if (!silent) {
-                vscode.window.showWarningMessage("Gateway URL not configured. Set agentide.gateway.url in settings.");
+                vscode.window.showWarningMessage(`Gateway URL not configured. Set ${(0, branding_js_1.toSettingsDisplayKey)("agentide.gateway.url")} in settings.`);
             }
             return;
         }

package/out/headless/index.js

@@ -175,6 +175,8 @@ const session_1 = require("../session");
 const sync_1 = require("./sync");
 const sessionEvents_1 = require("../analytics/sessionEvents");
 const runtime_1 = require("../cli/runtime");
+const credential_context_1 = require("../cli/credential-context");
+const paths_1 = require("../utils/paths");
 function resolveHeadlessAnalyticsUserId(runOverride, configOverride) {
     const fromRun = runOverride?.trim();
     if (fromRun) {
@@ -223,13 +225,18 @@ function createHeadlessRunner(config) {
         // the legacy single file at provider-sessions.json on first load.
         (0, session_1.initSessionStoreWithStore)(new interfaces_1.DirectorySessionStore(path.join(config.storagePath, 'provider-sessions')));
     }
-    // Build engine config
+    // Per-destination credentials. When a caller supplies the split keys (serve), use them so
+    // each engine picks the key for the endpoint it dials. Otherwise fall back to the single
+    // `apiKey` as the LiteLLM key (back-compat: eval/CLI runners configured one key).
+    const hasSplitKeys = Boolean(config.litellmApiKey || config.openaiApiKey || config.anthropicApiKey);
     const engineConfig = {
         storagePath: config.storagePath,
         codexHome: undefined,
         claudeConfigDir: undefined,
-        litellmApiKey: config.apiKey,
+        litellmApiKey: config.litellmApiKey ?? (hasSplitKeys ? undefined : config.apiKey),
         litellmBaseUrl: config.baseUrl,
+        openaiApiKey: config.openaiApiKey,
+        anthropicApiKey: config.anthropicApiKey,
         claudeCodeExecutablePath: config.claudeCodeExecutablePath,
         codexExecutablePath: config.codexExecutablePath,
     };
@@ -283,11 +290,12 @@ function createHeadlessRunner(config) {
         }
         return customEngine;
     };
-    // Shared session event writer for Layer 2 analytics. Rooted under storagePath (not the
-    // os.homedir() default) so tool-call/warrant events land on the same durable volume as
-    // session state — a container's home directory is ephemeral, storagePath honors
-    // AGENTHIPPO_HOME / --state-dir and is what actually survives a restart or scale event.
-    const sessionEventWriter = new sessionEvents_1.SessionEventWriter(path.join(config.storagePath, 'analytics', 'sessions'));
+    // Shared session event writer for Layer 2 analytics. Defaults to getAgentideHome() — the
+    // exact directory sessionJsonlFleet.ts and query-analytics.sh already scan, so tool-call/
+    // warrant events stay discoverable — but honors an explicit override (config.analyticsSessionsDir)
+    // so callers with their own state-dir precedence (serve.ts) don't regress durability when
+    // no AGENTHIPPO_HOME-style env var is set but a durable --state-dir was given explicitly.
+    const sessionEventWriter = new sessionEvents_1.SessionEventWriter(config.analyticsSessionsDir ?? path.join((0, paths_1.getAgentideHome)(), 'analytics', 'sessions'));
     return {
         async run(options) {
             const result = {
@@ -339,8 +347,21 @@ function createHeadlessRunner(config) {
             const requestId = (0, base_1.generateRequestId)();
             // Wrap emitter with observability (Layer 2 session events)
             // Session events are written to ~/.agent-hippo/analytics/sessions/<session_id>.jsonl
+            // Capture warrant userId here (inside serve's runWithCredential continuation), not
+            // later at tool emit — custom-engine IPC callbacks can lose/stick ambient ALS.
             const sessionId = options.sessionId ?? `headless-${Date.now()}`;
-            const observableEmitter = (0, sessionEvents_1.wrapEmitterWithObservability)(baseEmitter, sessionEventWriter, sessionId, requestId);
+            const provenance = config.provenance?.();
+            const observableEmitter = (0, sessionEvents_1.wrapEmitterWithObservability)(baseEmitter, sessionEventWriter, sessionId, requestId, (0, credential_context_1.currentCredential)()?.userId, provenance && {
+                policy_version: provenance.policyVersion,
+                pack_digest: provenance.packDigest,
+                engine_version: provenance.engineVersion,
+                tier: provenance.tier,
+                // Layer 2 must be joinable to an instance ON ITS OWN. Without this the session
+                // lane could only be attributed by going through Layer 1 (the OTEL span), which
+                // defeats the point of self-stamping: with a shared collector spool, the
+                // shipper's INSTANCE_ID cannot know which instance actually ran a turn.
+                instance_id: provenance.instanceId,
+            });
             const requestOptions = {
                 modelId: options.modelId,
                 engineId: options.engineId,
@@ -348,11 +369,20 @@ function createHeadlessRunner(config) {
                 additionalDirectories: options.additionalDirectories,
                 sessionId,
                 analyticsUserId: resolveHeadlessAnalyticsUserId(options.analyticsUserId, config.analyticsUserId),
-                apiKey: config.apiKey,
+                // With split keys (serve), leave options.apiKey UNSET so resolveApiRouting selects
+                // the key for the engine's destination — passing the collapsed key here would let
+                // it win over the correct provider key (the original bug). Back-compat single-key
+                // callers keep options.apiKey.
+                apiKey: hasSplitKeys ? undefined : config.apiKey,
                 baseUrl: config.baseUrl,
                 useLiteLLM: config.useLiteLLM,
                 agentPackId: packId,
                 agentPackVersion: config.packVersion,
+                policyVersion: provenance?.policyVersion,
+                packDigest: provenance?.packDigest,
+                engineVersion: provenance?.engineVersion,
+                tier: provenance?.tier,
+                instanceId: provenance?.instanceId,
                 permissions: options.permissions,
                 requestId, // Same requestId used by ObservableStreamEmitter for Layer 1/2 correlation
             };
@@ -367,6 +397,7 @@ function createHeadlessRunner(config) {
                         chatSessionId: sessionId,
                         gatewaySessionKey: options.gatewaySessionKey,
                     }),
+                    ...(options.turnEnv ?? {}),
                 },
             };
             try {

package/out/live-e2e/mcp-demo/server.mjs

@@ -0,0 +1,32 @@
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+
+const BALANCES = {
+  'alice@corp.com': 4242,
+  'bob@corp.com': 99,
+};
+const TURN = 'ai.agenthippo/turn';
+
+const server = new Server({ name: 'e2e-demo', version: '0.0.1' }, { capabilities: { tools: {} } });
+server.setRequestHandler(ListToolsRequestSchema, async () => ({
+  tools: [{
+    name: 'get_my_balance',
+    description: 'Return the signed-in user balance. No args.',
+    inputSchema: { type: 'object', properties: {} },
+  }],
+}));
+server.setRequestHandler(CallToolRequestSchema, async (req) => {
+  const turn = (req.params._meta ?? {})[TURN] ?? null;
+  const userId = typeof turn?.userId === 'string' ? turn.userId.trim() : '';
+  if (!userId) {
+    return { isError: true, content: [{ type: 'text', text: 'fail-closed: no verified user' }] };
+  }
+  const bal = BALANCES[userId];
+  if (bal === undefined) {
+    return { isError: true, content: [{ type: 'text', text: `fail-closed: no balance for ${userId}` }] };
+  }
+  console.error(`[e2e-connector] ${userId} → ${bal}`);
+  return { content: [{ type: 'text', text: JSON.stringify({ userId, balance: bal }) }] };
+});
+await server.connect(new StdioServerTransport());

package/out/live-probe/connector.mjs

@@ -0,0 +1,8 @@
+
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+const server = new Server({ name: 'probe', version: '0.0.1' }, { capabilities: { tools: {} } });
+server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: [{ name: 'probe_tool', description: 'x', inputSchema: { type: 'object' } }] }));
+server.setRequestHandler(CallToolRequestSchema, async () => ({ content: [{ type: 'text', text: 'MAGIC=zebra42' }] }));
+await server.connect(new StdioServerTransport());

package/out/live-probe/env-report.mjs

@@ -0,0 +1,8 @@
+
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+const server = new Server({ name: 'env-report', version: '0.0.1' }, { capabilities: { tools: {} } });
+server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: [{ name: 'report_env', description: 'reports a probe env var', inputSchema: { type: 'object' } }] }));
+server.setRequestHandler(CallToolRequestSchema, async () => ({ content: [{ type: 'text', text: 'PROBE_SEEN=' + (process.env.AGENTHIPPO_PROBE_ENV || 'ABSENT') }] }));
+await server.connect(new StdioServerTransport());

package/out/mcp.js

@@ -36,14 +36,15 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AGENTHIPPO_MCP_SERVERS_ENV = exports.AGENTHIPPO_DATA_TOKEN_FILE_ENV = void 0;
+exports.AGENTHIPPO_MCP_SERVERS_ENV = exports.ALLOW_INLINE_DATA_TOKEN_ENV = void 0;
 exports.loadMcpServers = loadMcpServers;
 exports.resolveMcpEnvVar = resolveMcpEnvVar;
-exports.mcpConfigCacheSignatureSuffix = mcpConfigCacheSignatureSuffix;
 exports.resolveMcpServerEnv = resolveMcpServerEnv;
 exports.generateCodexMcpConfig = generateCodexMcpConfig;
 exports.getDefaultMcpConfig = getDefaultMcpConfig;
 exports.loadBundledMcpServers = loadBundledMcpServers;
+exports.resolveHttpMcpHeaders = resolveHttpMcpHeaders;
+exports.referenceHttpMcpHeaders = referenceHttpMcpHeaders;
 exports.formatInlineMcpServers = formatInlineMcpServers;
 exports.serializeInlineMcpServers = serializeInlineMcpServers;
 exports.parseInlineMcpServers = parseInlineMcpServers;
@@ -64,11 +65,16 @@ const MCP_CONFIG_FILE = '.mcp.json';
 /** MCP servers subdirectory in base-prompts */
 const MCP_SERVERS_DIR = 'mcp-servers';
 /**
- * Env var passed to stdio MCP child processes: path to the per-turn data credential
- * file (OBO token, etc.). MCP servers read this file on each tool call — spawn env
- * is fixed at process start and cannot use AsyncLocalStorage.
+ * Explicit local-dev opt-in: allow the per-turn data credential to be resolved INLINE into
+ * MCP child env / `${credential:dataToken}` placeholders. Off by default — in any real
+ * deployment the credential must stay in the broker and reach tools only via the loopback
+ * data-plane gateway + turn nonce (secure-obo-design §2). Without this flag, a credential-
+ * backed value resolves to nothing and the pack's connector fails closed with its own error.
  */
-exports.AGENTHIPPO_DATA_TOKEN_FILE_ENV = 'AGENTHIPPO_DATA_TOKEN_FILE';
+exports.ALLOW_INLINE_DATA_TOKEN_ENV = 'AGENTHIPPO_ALLOW_INLINE_DATA_TOKEN';
+function inlineDataTokenAllowed() {
+    return /^(1|true)$/i.test(process.env[exports.ALLOW_INLINE_DATA_TOKEN_ENV]?.trim() ?? '');
+}
 const ENV_PLACEHOLDER = /\$\{env:(\w+)\}/g;
 const CREDENTIAL_PLACEHOLDER = /\$\{credential:(\w+)\}/g;
 // -----------------------------------------------------------------------------
@@ -146,14 +152,23 @@ async function resolveServerEntry(name, entry, mcpDir, bundledMcpDir, envSources
     }
     // HTTP Streamable MCP server — no subprocess needed
     if (entry.url) {
+        // `${env:VAR}` in the URL resolves against the serve process env (e.g. the
+        // boot-stable AGENTHIPPO_DATA_MCP_URL of the loopback data-plane gateway).
+        const url = entry.url.replace(ENV_PLACEHOLDER, (_, varName) => resolvePlainEnvVar(varName, envSources)).trim();
+        if (!url) {
+            // Placeholder didn't resolve (e.g. gateway-backed entry loaded outside serve):
+            // drop the server rather than hand engines a broken empty-URL entry.
+            return null;
+        }
         return {
             name,
             label: entry.label ?? name,
             description: entry.description,
             command: '',
             args: [],
-            url: entry.url,
+            url,
             headers: resolveHeaders(entry.headers, envSources),
+            bearerTokenEnv: entry.bearerTokenEnv?.trim() || undefined,
         };
     }
     // Custom stdio server - resolve relative paths from mcpDir
@@ -255,89 +270,63 @@ function resolveArgs(args, serverDir) {
 /**
  * Resolve a single ${env:VAR} reference for MCP child processes.
  *
- * The turn's OBO data token is exposed two ways:
+ * The turn's OBO data token is exposed two ways, BOTH gated behind the explicit
+ * local-dev opt-in {@link ALLOW_INLINE_DATA_TOKEN_ENV}:
  *   - `${credential:dataToken}` placeholder (pack-author-facing; handled in resolveEnv).
- *   - A configurable set of env-var aliases (default `DATABRICKS_TOKEN`) for packs that
- *     reference the token via `${env:VAR}` directly. Override the alias list with the
- *     `AGENTHIPPO_DATA_TOKEN_ENV_VARS` env var (comma-separated) — keeps this helper
- *     vendor-neutral instead of hardcoding one provider's token name.
+ *   - A configurable set of env-var aliases for packs that reference the token via
+ *     `${env:VAR}` directly (`AGENTHIPPO_DATA_TOKEN_ENV_VARS`, comma-separated; empty
+ *     by default — inline aliasing must be declared, never ambient).
  *
- * When a turn-scoped data token file exists, the token is NOT baked into spawn env —
- * MCP servers read it from AGENTHIPPO_DATA_TOKEN_FILE on each tool call instead.
+ * In a real deployment neither fires: the credential stays in the broker and tools reach
+ * it via the loopback data-plane gateway + turn nonce (secure-obo-design §3).
  */
 function resolveMcpEnvVar(varName, envSources = {}) {
-    const cred = (0, credential_context_1.currentCredential)();
-    const tokenFile = cred?.dataTokenFile;
     const aliases = getDataTokenEnvAliases();
-    const isDataTokenVar = varName === 'dataToken' || aliases.includes(varName);
-    if (tokenFile && isDataTokenVar) {
-        // Token lives in the per-turn file (AGENTHIPPO_DATA_TOKEN_FILE); never bake the OBO token
-        // into spawn env. The explicit ${credential:dataToken} placeholder resolves to empty
-        // (AgentHippo-aware servers read the file). A plain ${env:ALIAS} reference falls through to
-        // any operator-provided ambient value so a stock server that reads the var directly still
-        // works, instead of being clobbered to an empty string.
-        if (varName === 'dataToken') {
-            return '';
-        }
-        return process.env[varName] ?? envSources[varName] ?? '';
-    }
     if (varName === 'dataToken') {
-        return cred?.dataToken?.trim() ?? '';
+        const tok = (0, credential_context_1.currentCredential)()?.dataToken?.trim();
+        return tok && inlineDataTokenAllowed() ? tok : '';
     }
-    if (cred?.dataToken?.trim() && aliases.includes(varName)) {
-        return cred.dataToken.trim();
+    if (aliases.includes(varName)) {
+        const tok = (0, credential_context_1.currentCredential)()?.dataToken?.trim();
+        if (tok && inlineDataTokenAllowed()) {
+            return tok;
+        }
     }
     return process.env[varName] ?? envSources[varName] ?? '';
 }
 /**
  * Env-var names that resolve to the turn's OBO data token when a pack references
- * `${env:VAR}` directly. Defaults to `DATABRICKS_TOKEN`; override at deploy time via
- * `AGENTHIPPO_DATA_TOKEN_ENV_VARS=VAR1,VAR2` (empty value → no aliases).
+ * `${env:VAR}` directly. Empty by default — set `AGENTHIPPO_DATA_TOKEN_ENV_VARS=VAR1,VAR2`
+ * (together with the inline opt-in) to enable. The old implicit `DATABRICKS_TOKEN` default
+ * was removed with the disk token path: inline credential exposure is now always explicit.
  */
 function getDataTokenEnvAliases() {
     const raw = process.env.AGENTHIPPO_DATA_TOKEN_ENV_VARS;
     if (raw !== undefined) {
         return raw.split(',').map((v) => v.trim()).filter(Boolean);
     }
-    return ['DATABRICKS_TOKEN'];
+    return [];
 }
 function envValueUsesCredentialDataToken(value) {
     return /\$\{credential:dataToken\}/.test(value);
 }
-/** Suffix for Codex config.toml cache invalidation when MCP credential scope changes. */
-function mcpConfigCacheSignatureSuffix() {
-    const cred = (0, credential_context_1.currentCredential)();
-    const aliases = getDataTokenEnvAliases();
-    if (cred?.dataTokenFile) {
-        return `file:${cred.dataTokenFile}:aliases=${aliases.join(',')}`;
-    }
-    if (cred?.dataToken?.trim()) {
-        return `inline-token:aliases=${aliases.join(',')}`;
-    }
-    return `no-token:aliases=${aliases.join(',')}`;
-}
 function resolveEnv(env, envSources = {}) {
     if (!env) {
         return undefined;
     }
     const resolved = {};
-    const tokenFile = (0, credential_context_1.currentCredential)()?.dataTokenFile;
-    if (tokenFile) {
-        resolved[exports.AGENTHIPPO_DATA_TOKEN_FILE_ENV] = tokenFile;
-    }
     for (const [key, value] of Object.entries(env)) {
         CREDENTIAL_PLACEHOLDER.lastIndex = 0;
         if (envValueUsesCredentialDataToken(value)) {
-            // Credential-backed secret. When a per-turn token file exists, the key is intentionally
-            // NOT set here: the MCP server reads the token from AGENTHIPPO_DATA_TOKEN_FILE
-            // (injected above) on each tool call, so baking it into spawn env would be redundant
-            // and would leak the turn-scoped token into the long-lived child process env.
-            // Prefer the OBO token file, then inline token, then env fallback.
-            if (tokenFile) {
-                // AGENTHIPPO_DATA_TOKEN_FILE already injected above; don't bake the token here.
-            }
-            else if ((0, credential_context_1.currentCredential)()?.dataToken?.trim()) {
-                resolved[key] = (0, credential_context_1.currentCredential)().dataToken.trim();
+            // Credential-backed secret. Baked into spawn env ONLY behind the explicit
+            // local-dev opt-in — the supported transport is the data-plane gateway, where
+            // the credential never leaves the broker process (secure-obo-design §2).
+            const tok = (0, credential_context_1.currentCredential)()?.dataToken?.trim();
+            if (tok) {
+                if (inlineDataTokenAllowed()) {
+                    resolved[key] = tok;
+                }
+                // else: intentionally unset — the connector fails closed with its own error.
             }
             else {
                 // No OBO credential (local dev / non-serve context): fall back to env var.
@@ -436,12 +425,14 @@ function generateCodexMcpConfig(servers, options) {
     if (servers.length === 0) {
         return '';
     }
-    // `default_tools_approval_mode = "auto"` is the documented Codex 0.122+ per-server key
-    // (values: auto/prompt/approve) that lets MCP tools run without an interactive prompt.
+    // `default_tools_approval_mode = "approve"` is the Codex per-server key that lets MCP
+    // tools run without an interactive prompt. The value enum is prompt|approve — "auto" is
+    // NOT valid: Codex ≥0.131 silently ignores it, defaults the server to `prompt`, and a
+    // headless `codex exec` turn then auto-Cancels the approval elicitation, surfacing as
+    // "user cancelled MCP tool call" on every tool call (verified live against 0.131.0).
     // Only emit it in headless/serve auto-approve contexts — the interactive IDE path leaves
-    // it unset so users get Codex's normal approval prompts. The previous `approval_mode =
-    // "never"` was an invalid key/value and was silently ignored by the Codex CLI.
-    const approvalLine = options?.autoApprove ? 'default_tools_approval_mode = "auto"' : undefined;
+    // it unset so users get Codex's normal approval prompts.
+    const approvalLine = options?.autoApprove ? 'default_tools_approval_mode = "approve"' : undefined;
     const sections = servers.map(s => {
         // HTTP Streamable MCP server — codex connects via URL, no subprocess
         if (s.url) {
@@ -449,6 +440,13 @@ function generateCodexMcpConfig(servers, options) {
                 `[mcp_servers.${s.name}]`,
                 `url = ${JSON.stringify(s.url)}`,
             ];
+            if (s.bearerTokenEnv) {
+                // The auth token is read from the codex PROCESS env at request time
+                // (per-spawn codexEnv carries the turn nonce) — the config file itself
+                // stays byte-identical across turns, which is what removes the
+                // cross-user config.toml race (secure-obo-design §3.2).
+                urlLines.push(`bearer_token_env_var = ${JSON.stringify(s.bearerTokenEnv)}`);
+            }
             if (s.headers && Object.keys(s.headers).length > 0) {
                 const headerEntries = Object.entries(s.headers)
                     .map(([k, v]) => `${JSON.stringify(k)} = ${JSON.stringify(v)}`)
@@ -541,6 +539,52 @@ async function loadBundledMcpServers(basePromptsDir) {
 }
 /** Env var carrying JSON-serialized {@link InlineMcpServers} into custom engine workers. */
 exports.AGENTHIPPO_MCP_SERVERS_ENV = 'AGENTHIPPO_MCP_SERVERS';
+/**
+ * Resolve the final HTTP headers for a URL-based MCP server, applying `bearerTokenEnv`
+ * against the ENGINE'S per-turn env (process.env + per-spawn patch). Engines that build
+ * their MCP config in memory per turn (claude, custom) call this with the same env they
+ * hand the engine subprocess, so the turn nonce lands in the request header without ever
+ * touching a shared file.
+ */
+function resolveHttpMcpHeaders(server, turnEnv) {
+    const headers = { ...(server.headers ?? {}) };
+    if (server.bearerTokenEnv) {
+        const token = turnEnv[server.bearerTokenEnv]?.trim();
+        if (token) {
+            headers['Authorization'] = `Bearer ${token}`;
+        }
+    }
+    return Object.keys(headers).length > 0 ? headers : undefined;
+}
+/**
+ * The variable names the Claude CLI's `${NAME}` config expansion accepts. A `bearerTokenEnv`
+ * outside this shape would ship a header the CLI sends verbatim, so it falls back to in-memory
+ * resolution instead.
+ */
+const CLI_EXPANDABLE_ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/**
+ * Claude-engine variant of {@link resolveHttpMcpHeaders}: emit a `${NAME}` REFERENCE and let the
+ * CLI expand it from its own environment at connect time, instead of resolving the secret here.
+ *
+ * The Agent SDK serializes the whole mcpServers object into `--mcp-config <json>` argv, and
+ * /proc/<pid>/cmdline is world-readable — no ptrace gate, unlike environ — so a resolved
+ * Authorization header there is visible to every uid on the host and to execve-argv audit
+ * tooling. The reference keeps the turn nonce at environ-level exposure, which the engine child
+ * already carries for the egress CLI. Expansion verified live on CLI 2.1.220, including the
+ * failure mode this relies on: an UNSET name passes through literally and the data gateway
+ * rejects it — fail closed, never fail open.
+ */
+function referenceHttpMcpHeaders(server, turnEnv) {
+    const name = server.bearerTokenEnv;
+    if (name && !CLI_EXPANDABLE_ENV_NAME.test(name)) {
+        return resolveHttpMcpHeaders(server, turnEnv);
+    }
+    const headers = { ...(server.headers ?? {}) };
+    if (name) {
+        headers['Authorization'] = `Bearer \${${name}}`;
+    }
+    return Object.keys(headers).length > 0 ? headers : undefined;
+}
 /**
  * Convert resolved pack MCP servers to the inline record shape engines consume.
  *
@@ -548,15 +592,19 @@ exports.AGENTHIPPO_MCP_SERVERS_ENV = 'AGENTHIPPO_MCP_SERVERS';
  * `{ type: 'http', url, headers? }` — the Cursor SDK (`@cursor/sdk` McpServerConfig) accepts
  * this shape inline, so remote MCP servers are available to cursor/custom engines, not just
  * to the Codex engine (which gets them via config.toml).
+ *
+ * `turnEnv` (when provided) resolves each URL server's `bearerTokenEnv` into a concrete
+ * Authorization header — pass the same env the engine subprocess will receive.
  */
-function formatInlineMcpServers(servers) {
+function formatInlineMcpServers(servers, turnEnv) {
     const mcpServers = {};
     for (const server of servers) {
         if (server.url) {
+            const headers = resolveHttpMcpHeaders(server, turnEnv ?? process.env);
             mcpServers[server.name] = {
                 type: 'http',
                 url: server.url,
-                ...(server.headers && Object.keys(server.headers).length > 0 ? { headers: server.headers } : {}),
+                ...(headers ? { headers } : {}),
             };
             continue;
         }