@agenthippo-ai/agenthippo 0.2.3-dataplane → 1.110.11

package/out/engines/codex.js

@@ -37,6 +37,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CodexEngine = void 0;
+exports.registerNewFilesWithTracker = registerNewFilesWithTracker;
 const fs_1 = require("fs");
 const path = __importStar(require("path"));
 const mcp_1 = require("../mcp");
@@ -47,8 +48,8 @@ const permissions_1 = require("../permissions");
 const session_1 = require("../session");
 const agentpack_1 = require("../agentpack");
 const credential_context_1 = require("../cli/credential-context");
-const data_plane_1 = require("../cli/data-plane");
 const runtime_1 = require("../cli/runtime");
+const types_1 = require("../sandbox/types");
 // Note: HTTP edit server removed - file changes are now handled directly via file_change events
 // -----------------------------------------------------------------------------
 // Constants
@@ -65,11 +66,56 @@ const AGENTIDE_CODEX_AGENT_VERSION_ENV_VAR = 'AGENTIDE_ANALYTICS_AGENT_VERSION';
 const AGENTIDE_CODEX_SOURCE_ENV_VAR = 'AGENTIDE_ANALYTICS_SOURCE';
 const AGENTIDE_CODEX_ENGINE_ENV_VAR = 'AGENTIDE_ANALYTICS_ENGINE';
 const AGENTIDE_CODEX_REQUEST_ID_ENV_VAR = 'AGENTIDE_ANALYTICS_REQUEST_ID';
+const AGENTIDE_CODEX_POLICY_VERSION_ENV_VAR = 'AGENTIDE_ANALYTICS_POLICY_VERSION';
+const AGENTIDE_CODEX_PACK_DIGEST_ENV_VAR = 'AGENTIDE_ANALYTICS_PACK_DIGEST';
+const AGENTIDE_CODEX_ENGINE_VERSION_ENV_VAR = 'AGENTIDE_ANALYTICS_ENGINE_VERSION';
+const AGENTIDE_CODEX_TIER_ENV_VAR = 'AGENTIDE_ANALYTICS_TIER';
+const AGENTIDE_CODEX_INSTANCE_ID_ENV_VAR = 'AGENTIDE_ANALYTICS_INSTANCE_ID';
 // Bump when we change generated config semantics so long-lived sessions regenerate config.toml.
-const AGENTIDE_CODEX_CONFIG_VERSION = 20; // v20: default_tools_approval_mode "auto"→"approve" ("auto" is invalid on codex ≥0.131 and cancels every headless MCP tool call)
+const AGENTIDE_CODEX_CONFIG_VERSION = 21; // v21: sandbox_mode "danger-full-access" now requires tier 2, not merely being inside a sandbox — a tier-0 home written by v20 must be rewritten
 // Per-process runtime context for agents (not analytics): lets the agent locate its per-session context export.
 const AGENTIDE_CONTEXT_EXPORT_PATH_ENV_VAR = 'AGENTIDE_CONTEXT_EXPORT_PATH';
 const AGENTIDE_TERMINAL_LOG_PATH_ENV_VAR = 'AGENTIDE_TERMINAL_LOG_PATH';
+/**
+ * Hand files codex just CREATED to the edit tracker so the IDE can render them against an empty
+ * original — without ever risking the agent's work.
+ *
+ * The IDE trick is read → delete → `applyEdit`. That delete caused live data loss: headless
+ * (`serve`/`ask`/`chat` and every sandbox) gets `NoOpEditTracker`, whose `applyEdit` does nothing, so
+ * every new file codex created was silently destroyed. The command exited 0, the file was there
+ * during the command, and it was gone by the next one — while standalone `codex exec` wrote it
+ * fine. Two guards now: skip trackers that do not write back, and restore the file if it is
+ * missing when we are done, whatever the tracker did or threw.
+ *
+ * Exported so the invariant "a file the agent created still exists after the turn" is testable.
+ */
+async function registerNewFilesWithTracker(files, editTracker, sessionId) {
+    // A tracker that does not write the file back must never see a delete.
+    if (editTracker.appliesEdits === false) {
+        return;
+    }
+    for (const f of files) {
+        try {
+            if ((0, utils_1.isBinaryFile)(f)) {
+                continue; // Binary would be corrupted by the UTF-8 read/write round trip.
+            }
+            if (!(await (0, utils_1.pathExists)(f))) {
+                continue;
+            }
+            const code = await fs_1.promises.readFile(f, 'utf-8');
+            try {
+                await fs_1.promises.unlink(f);
+                await editTracker.applyEdit(sessionId, f, code, true);
+            }
+            finally {
+                if (!(await (0, utils_1.pathExists)(f))) {
+                    await fs_1.promises.writeFile(f, code, 'utf-8');
+                }
+            }
+        }
+        catch { /* ignore — never fail a turn over edit-diff bookkeeping */ }
+    }
+}
 function isCodexItemEvent(event) {
     return event.type === 'item.started' || event.type === 'item.updated' || event.type === 'item.completed';
 }
@@ -130,13 +176,17 @@ class CodexEngine {
             ...(runtime.cliEnvPatch ?? {}),
             OPENAI_LOG: 'debug',
         };
-        // When serve runs the egress broker, the OpenClaw gateway token must never enter the
-        // agent's trust domain (secure-obo-design §7.6 / §7.4 gap 1). Scrub it from the child env
-        // at the spawn boundary — belt-and-suspenders with serve's boot-time process.env strip,
-        // so a token in process.env (e.g. captured before the strip) still cannot reach the model.
-        if (codexEnv[data_plane_1.EGRESS_URL_ENV]) {
-            delete codexEnv[runtime_1.OPENCLAW_GATEWAY_TOKEN_ENV];
-        }
+        // The OpenClaw gateway token must never enter the agent's trust domain (secure-obo-design
+        // §7.6 / §7.4 gap 1). UNCONDITIONALLY (serve-v4 §10 hole 2): the scrub used to depend on
+        // the egress broker being up, so a deployment without --gateway-bridge re-inherited the
+        // token — and buildCliEnvPatch can bake it in from the host's ~/.openclaw config, not just
+        // process.env. This engine never needs it: outbound goes through the broker's turn nonce,
+        // and the openclaw CLI reads its own config file on single-tenant hosts.
+        delete codexEnv[runtime_1.OPENCLAW_GATEWAY_TOKEN_ENV];
+        // Data-plane sidecar control token: the engine only needs the gateway URL + its per-turn
+        // nonce, never the register token — scrub it so a compromised agent can't forge a turn as
+        // another user (secure-obo-design §7.6). Harmless when absent (in-process/no data plane).
+        delete codexEnv['AGENTHIPPO_DATA_PLANE_TOKEN'];
         // Always expose the VS Code chat session id to the agent process so it can locate:
         //   .agentide/sessions/<sessionId>/context.md
         const rawChatSessionId = sessionId?.trim();
@@ -157,7 +207,7 @@ class CodexEngine {
         // and a shared per-agent home lets concurrent turns of different users race it
         // (secure-obo-design §1 defect 1 / §8 Phase 0). No credential frame (IDE,
         // single-tenant CLI) ⇒ unchanged per-agent path.
-        const codexHome = (0, agentpack_1.userScopedEngineHome)(runtimePaths.codexHome, (0, credential_context_1.currentCredential)()?.userId);
+        const codexHome = (0, agentpack_1.userScopedEngineHomeFromKey)(runtimePaths.codexHome, (0, credential_context_1.resolveEngineHomeUserKey)(options.engineHomeUserKey));
         codexEnv['CODEX_HOME'] = codexHome;
         await fs_1.promises.mkdir(codexHome, { recursive: true });
         // Always set AGENT_ID for agent to know its identity
@@ -179,7 +229,15 @@ class CodexEngine {
         agentId, // Pass agent ID for correct skills path
         runtime.permissionHandler instanceof interfaces_1.AutoApprovePermissionHandler);
         // LiteLLM analytics metadata (enriched - see PLAN/analytics-design.md)
-        if (useLiteLLM && this.config.codexHome) {
+        //
+        // Gate on the codexHome actually in use (resolved above), NOT `this.config.codexHome`:
+        // headless/index.ts passes `codexHome: undefined`, so under serve/ask/chat and inside
+        // every sandbox this block was skipped and codex sent NO metadata headers at all — no
+        // session-id, user-id, agent-id, source, request-id, or engine. Spotlight lost codex
+        // attribution outside the IDE, and the gateway could not see `x-litellm-metadata-engine`,
+        // so engine-conditional ah-auto routing never fired. config.toml was written correctly
+        // the whole time (it uses this same resolved home) — only the env vars it reads were missing.
+        if (useLiteLLM && codexHome) {
             if (analyticsUserId?.trim()) {
                 codexEnv[AGENTIDE_CODEX_USER_ENV_VAR] = analyticsUserId.trim();
             }
@@ -197,6 +255,21 @@ class CodexEngine {
             if (options.requestId) {
                 codexEnv[AGENTIDE_CODEX_REQUEST_ID_ENV_VAR] = options.requestId;
             }
+            if (options.policyVersion?.trim()) {
+                codexEnv[AGENTIDE_CODEX_POLICY_VERSION_ENV_VAR] = options.policyVersion.trim();
+            }
+            if (options.packDigest?.trim()) {
+                codexEnv[AGENTIDE_CODEX_PACK_DIGEST_ENV_VAR] = options.packDigest.trim();
+            }
+            if (options.engineVersion?.trim()) {
+                codexEnv[AGENTIDE_CODEX_ENGINE_VERSION_ENV_VAR] = options.engineVersion.trim();
+            }
+            if (options.tier !== undefined) {
+                codexEnv[AGENTIDE_CODEX_TIER_ENV_VAR] = String(options.tier);
+            }
+            if (options.instanceId?.trim()) {
+                codexEnv[AGENTIDE_CODEX_INSTANCE_ID_ENV_VAR] = options.instanceId.trim();
+            }
         }
         // For custom providers (OpenRouter, LiteLLM), set API key in CODEX_API_KEY.
         // The config.toml's `env_key = "CODEX_API_KEY"` tells the CLI to read from this variable.
@@ -225,6 +298,16 @@ class CodexEngine {
             ];
             // Map unified permissions to Codex SDK options
             const codexPermOpts = (0, permissions_1.toCodexOptions)(effectivePerms, workspaceFolders);
+            // One boundary, not two — but only when the OTHER boundary is real. Inside a tier-2
+            // container Codex's own bubblewrap sandbox cannot start (it needs a user namespace
+            // `--cap-drop ALL` + `no-new-privileges` deny), so standing it down is the difference
+            // between working shell commands and silent failures. The tier-0 process driver
+            // provides NO boundary — same uid, same filesystem as serve — so there Codex's own
+            // sandbox is the only thing between the agent and the host and must stay on.
+            // The SDK's ThreadOptions.sandboxMode overrides config.toml, so force it here too.
+            if ((0, types_1.isContainerSandbox)()) {
+                codexPermOpts.sandboxMode = 'danger-full-access';
+            }
             logger.info(`[AgentIDE] Codex mapped: sandboxMode=${codexPermOpts.sandboxMode}, approvalPolicy=${codexPermOpts.approvalPolicy}`);
             // Build thread options
             // workingDirectory is ALWAYS workspaceRoot - pack content is synced to workspace's .codex/
@@ -411,21 +494,7 @@ class CodexEngine {
                                         catch { /* ignore */ }
                                         pendingOperations.delete(item.id);
                                     }
-                                    // New files: read, delete, apply (so VS Code sees original=empty)
-                                    // Skip binary files - they would be corrupted by UTF-8 read/write
-                                    for (const f of pendingNewFiles.get(item.id) ?? []) {
-                                        try {
-                                            if ((0, utils_1.isBinaryFile)(f)) {
-                                                continue; // Don't track binary files for edit diffs
-                                            }
-                                            if (await (0, utils_1.pathExists)(f)) {
-                                                const code = await fs_1.promises.readFile(f, 'utf-8');
-                                                await fs_1.promises.unlink(f);
-                                                await editTracker.applyEdit(rawChatSessionId, f, code, true);
-                                            }
-                                        }
-                                        catch { /* ignore */ }
-                                    }
+                                    await registerNewFilesWithTracker(pendingNewFiles.get(item.id) ?? [], editTracker, rawChatSessionId);
                                     pendingNewFiles.delete(item.id);
                                 }
                             }
@@ -637,6 +706,16 @@ class CodexEngine {
             // Codex CLI loads a single "model instructions" file that acts like a system/developer prompt overlay.
             // Note: experimental_instructions_file is deprecated and ignored by newer Codex CLI versions.
             codexInstructionsFile ? `model_instructions_file = ${JSON.stringify(codexInstructionsFile)}` : undefined,
+            // Inside a TIER-2 sandbox the container is the boundary, so Codex's own sandbox is not
+            // just redundant — it cannot start. It shells out to bubblewrap, which needs to create
+            // a user namespace and scratch space under /tmp; a container drops those capabilities by
+            // design (`--cap-drop ALL`, `no-new-privileges`), so every shell command and file
+            // write failed while still reporting exit 0. One boundary, not two — but the tier-0
+            // process driver is not a boundary at all, so it never earns this. Keyed on the tier
+            // the driver reports, not on merely being inside a sandbox.
+            ...((0, types_1.isContainerSandbox)()
+                ? ['sandbox_mode = "danger-full-access"']
+                : []),
         ];
         // Add custom provider section for LiteLLM or custom providers (e.g., OpenRouter)
         if (customBaseUrl) {
@@ -655,7 +734,12 @@ class CodexEngine {
                     `"x-litellm-metadata-agent-version" = "${AGENTIDE_CODEX_AGENT_VERSION_ENV_VAR}", ` +
                     `"x-litellm-metadata-source" = "${AGENTIDE_CODEX_SOURCE_ENV_VAR}", ` +
                     `"x-litellm-metadata-engine" = "${AGENTIDE_CODEX_ENGINE_ENV_VAR}", ` +
-                    `"x-litellm-metadata-request-id" = "${AGENTIDE_CODEX_REQUEST_ID_ENV_VAR}" }`);
+                    `"x-litellm-metadata-request-id" = "${AGENTIDE_CODEX_REQUEST_ID_ENV_VAR}", ` +
+                    `"x-litellm-metadata-policy-version" = "${AGENTIDE_CODEX_POLICY_VERSION_ENV_VAR}", ` +
+                    `"x-litellm-metadata-pack-digest" = "${AGENTIDE_CODEX_PACK_DIGEST_ENV_VAR}", ` +
+                    `"x-litellm-metadata-engine-version" = "${AGENTIDE_CODEX_ENGINE_VERSION_ENV_VAR}", ` +
+                    `"x-litellm-metadata-tier" = "${AGENTIDE_CODEX_TIER_ENV_VAR}", ` +
+                    `"x-litellm-metadata-instance-id" = "${AGENTIDE_CODEX_INSTANCE_ID_ENV_VAR}" }`);
             }
         }
         // Add MCP servers section (pack-aware)

package/out/engines/custom.js

@@ -47,8 +47,10 @@ const fs_1 = require("fs");
 const path = __importStar(require("path"));
 const url_1 = require("url");
 const base_1 = require("./base");
+const runtime_1 = require("../cli/runtime");
 const customRegistry_1 = require("./customRegistry");
 const paths_1 = require("../agentpack/paths");
+const credential_context_1 = require("../cli/credential-context");
 const utils_1 = require("../utils");
 const resolveNodeBinary_1 = require("../utils/resolveNodeBinary");
 const customEngineIpc_1 = require("./customEngineIpc");
@@ -493,7 +495,12 @@ class CustomEngine {
         const customBaseDir = this.config.customEnginesStoragePath
             ?? path.join(this.config.storagePath, paths_1.AGENT_CONSTANTS.AGENTS_DIR, agentId, 'custom');
         const engineBaseDir = path.join(customBaseDir, manifest.id);
-        const engineHomeDir = path.join(engineBaseDir, 'home');
+        // Per-user, on the same rule claude and codex use. This engine had NO user scoping at all
+        // — in serve or in a sandbox — so on a multi-user deployment every custom engine's home
+        // (its config, caches, and whatever the engine chooses to persist) was one shared
+        // directory. `home` is the one that needed it: engineSessionDir is already per session.
+        // No verified user ⇒ unchanged path, so the IDE and single-tenant CLI are unaffected.
+        const engineHomeDir = (0, paths_1.userScopedEngineHomeFromKey)(path.join(engineBaseDir, 'home'), (0, credential_context_1.resolveEngineHomeUserKey)(options.engineHomeUserKey));
         const engineSessionDir = path.join(engineBaseDir, paths_1.AGENT_CONSTANTS.SESSIONS_DIR, sessionDirName);
         await fs_1.promises.mkdir(engineHomeDir, { recursive: true });
         await fs_1.promises.mkdir(engineSessionDir, { recursive: true });
@@ -534,6 +541,8 @@ class CustomEngine {
             AGENTHIPPO_MODEL_ID: modelId,
             AGENTHIPPO_USE_LITELLM: routing.useLiteLLM ? 'true' : 'false',
         };
+        delete env[runtime_1.OPENCLAW_GATEWAY_TOKEN_ENV];
+        delete env['AGENTHIPPO_DATA_PLANE_TOKEN'];
         prependNodePath(env, manifest.manifestDir);
         if (routingApiKey) {
             env.AGENTHIPPO_API_KEY = routingApiKey;
@@ -560,6 +569,11 @@ class CustomEngine {
                 source: 'agenthippo',
                 engine: `custom:${manifest.id}`,
                 requestId: options.requestId,
+                policyVersion: options.policyVersion,
+                packDigest: options.packDigest,
+                instanceId: options.instanceId,
+                engineVersion: options.engineVersion,
+                tier: options.tier,
             });
             if (litellmMetadataHeaders.length > 0) {
                 env.AGENTHIPPO_LITELLM_METADATA_HEADERS = litellmMetadataHeaders.join('\n');