@agenthippo-ai/agenthippo 0.2.3-dataplane → 1.110.11

package/out/gateway/secretsPreflight.js

@@ -0,0 +1,90 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseStrictJsonConfig = parseStrictJsonConfig;
+exports.collectMissingChannelEnvSecrets = collectMissingChannelEnvSecrets;
+exports.disableChannelsInConfigText = disableChannelsInConfigText;
+const MAX_WALK_DEPTH = 8;
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * Parse config content as strict JSON, or undefined when it does not parse.
+ *
+ * OpenClaw accepts JSON5 (the starter template has comments). A JSON5 file cannot be
+ * round-tripped through JSON.parse/stringify without losing comments, so callers must
+ * treat `undefined` as "hands off — detect nothing, rewrite nothing".
+ */
+function parseStrictJsonConfig(content) {
+    try {
+        return JSON.parse(content);
+    }
+    catch {
+        return undefined;
+    }
+}
+function collectEnvRefs(value, out, depth) {
+    if (depth > MAX_WALK_DEPTH) {
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            collectEnvRefs(item, out, depth + 1);
+        }
+        return;
+    }
+    if (!isRecord(value)) {
+        return;
+    }
+    if (value.source === 'env' && typeof value.id === 'string' && value.id.trim()) {
+        out.add(value.id.trim());
+        return;
+    }
+    for (const child of Object.values(value)) {
+        collectEnvRefs(child, out, depth + 1);
+    }
+}
+/**
+ * List enabled channels whose env-sourced secret refs resolve to nothing in `env`.
+ *
+ * A channel counts as enabled unless it says `enabled: false` — a configured channel is
+ * intent, and the gateway will try (and fail) to start it either way. Literal token
+ * strings are not env refs and are never reported.
+ */
+function collectMissingChannelEnvSecrets(config, env) {
+    if (!isRecord(config) || !isRecord(config.channels)) {
+        return [];
+    }
+    const result = [];
+    for (const [name, channel] of Object.entries(config.channels)) {
+        if (!isRecord(channel) || channel.enabled === false) {
+            continue;
+        }
+        const refs = new Set();
+        collectEnvRefs(channel, refs, 0);
+        const missing = [...refs].filter((id) => !env[id]?.trim()).sort();
+        if (missing.length) {
+            result.push({ channel: name, envVars: missing });
+        }
+    }
+    return result;
+}
+/**
+ * Return config text with the named channels set to `enabled: false`, or undefined when
+ * the content is not strict JSON (rewriting JSON5 would destroy comments).
+ */
+function disableChannelsInConfigText(content, channels) {
+    const config = parseStrictJsonConfig(content);
+    if (!isRecord(config) || !isRecord(config.channels)) {
+        return undefined;
+    }
+    for (const name of channels) {
+        const channel = config.channels[name];
+        if (isRecord(channel)) {
+            channel.enabled = false;
+        }
+    }
+    return `${JSON.stringify(config, null, 2)}\n`;
+}

package/out/gateway/service.js

@@ -46,10 +46,12 @@ exports.GatewayService = exports.GatewaySessionBindingError = void 0;
  * - Session routing: disk-backed route index + per-session gateway-session.json
  * - Publish: user connects an existing IDE session to the gateway
  */
+const crypto_1 = require("crypto");
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const vscode = __importStar(require("vscode"));
 const scheduledFleetStorage_js_1 = require("../analytics/dashboard/scheduledFleetStorage.js");
+const branding_js_1 = require("../branding.js");
 const bridge_js_1 = require("./bridge.js");
 const gateway_scope_errors_js_1 = require("./gateway-scope-errors.js");
 const gatewayRouteIndex_js_1 = require("./gatewayRouteIndex.js");
@@ -769,7 +771,10 @@ class GatewayService {
      */
     createSessionAwareChatUIHandler(agentId, packName) {
         return async (message, sessionKey, peerInfo, emitter, runContext) => {
-            const gatewayRequestToken = `gw-${Date.now()}-${Math.random().toString(36).slice(2)}`;
+            // Unguessable: this token is a bearer capability for the run's output stream, and
+            // `getGatewayEmitter` is a destructive first-reader-wins read. A predictable value
+            // lets any chat message beginning with `[gw:...]` steal or drop another run's stream.
+            const gatewayRequestToken = `gw-${(0, crypto_1.randomUUID)()}`;
             GatewayService.gatewayEmitters.set(gatewayRequestToken, emitter);
             const markedMessage = `[gw:${gatewayRequestToken}]${message}`;
             try {
@@ -983,7 +988,7 @@ class GatewayService {
         const tokenRaw = (gwLive.get("token") ?? "").trim() || (this.config.token ?? "").trim();
         if (!url) {
             if (!silent) {
-                vscode.window.showWarningMessage("Gateway URL not configured. Set agentide.gateway.url in settings.");
+                vscode.window.showWarningMessage(`Gateway URL not configured. Set ${(0, branding_js_1.toSettingsDisplayKey)("agentide.gateway.url")} in settings.`);
             }
             return;
         }

package/out/headless/index.js

@@ -350,7 +350,18 @@ function createHeadlessRunner(config) {
             // Capture warrant userId here (inside serve's runWithCredential continuation), not
             // later at tool emit — custom-engine IPC callbacks can lose/stick ambient ALS.
             const sessionId = options.sessionId ?? `headless-${Date.now()}`;
-            const observableEmitter = (0, sessionEvents_1.wrapEmitterWithObservability)(baseEmitter, sessionEventWriter, sessionId, requestId, (0, credential_context_1.currentCredential)()?.userId);
+            const provenance = config.provenance?.();
+            const observableEmitter = (0, sessionEvents_1.wrapEmitterWithObservability)(baseEmitter, sessionEventWriter, sessionId, requestId, (0, credential_context_1.currentCredential)()?.userId, provenance && {
+                policy_version: provenance.policyVersion,
+                pack_digest: provenance.packDigest,
+                engine_version: provenance.engineVersion,
+                tier: provenance.tier,
+                // Layer 2 must be joinable to an instance ON ITS OWN. Without this the session
+                // lane could only be attributed by going through Layer 1 (the OTEL span), which
+                // defeats the point of self-stamping: with a shared collector spool, the
+                // shipper's INSTANCE_ID cannot know which instance actually ran a turn.
+                instance_id: provenance.instanceId,
+            });
             const requestOptions = {
                 modelId: options.modelId,
                 engineId: options.engineId,
@@ -362,12 +373,24 @@ function createHeadlessRunner(config) {
                 // the key for the engine's destination — passing the collapsed key here would let
                 // it win over the correct provider key (the original bug). Back-compat single-key
                 // callers keep options.apiKey.
-                apiKey: hasSplitKeys ? undefined : config.apiKey,
+                //
+                // A per-run `modelToken` outranks both. That is safe precisely where it is used:
+                // inside a sandbox there are no provider keys to lose a precedence fight with
+                // (the credential invariant), and the warrant IS the only route to a model.
+                apiKey: options.modelToken ?? (hasSplitKeys ? undefined : config.apiKey),
                 baseUrl: config.baseUrl,
                 useLiteLLM: config.useLiteLLM,
                 agentPackId: packId,
                 agentPackVersion: config.packVersion,
+                policyVersion: provenance?.policyVersion,
+                packDigest: provenance?.packDigest,
+                engineVersion: provenance?.engineVersion,
+                tier: provenance?.tier,
+                instanceId: provenance?.instanceId,
                 permissions: options.permissions,
+                // Only ever set by a sandbox child. In serve's own process the engine reads the
+                // credential frame directly and this is undefined.
+                engineHomeUserKey: options.engineHomeUserKey,
                 requestId, // Same requestId used by ObservableStreamEmitter for Layer 1/2 correlation
             };
             // Emit turn_start event

package/out/live-e2e/mcp-demo/server.mjs

@@ -0,0 +1,32 @@
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+
+const BALANCES = {
+  'alice@corp.com': 4242,
+  'bob@corp.com': 99,
+};
+const TURN = 'ai.agenthippo/turn';
+
+const server = new Server({ name: 'e2e-demo', version: '0.0.1' }, { capabilities: { tools: {} } });
+server.setRequestHandler(ListToolsRequestSchema, async () => ({
+  tools: [{
+    name: 'get_my_balance',
+    description: 'Return the signed-in user balance. No args.',
+    inputSchema: { type: 'object', properties: {} },
+  }],
+}));
+server.setRequestHandler(CallToolRequestSchema, async (req) => {
+  const turn = (req.params._meta ?? {})[TURN] ?? null;
+  const userId = typeof turn?.userId === 'string' ? turn.userId.trim() : '';
+  if (!userId) {
+    return { isError: true, content: [{ type: 'text', text: 'fail-closed: no verified user' }] };
+  }
+  const bal = BALANCES[userId];
+  if (bal === undefined) {
+    return { isError: true, content: [{ type: 'text', text: `fail-closed: no balance for ${userId}` }] };
+  }
+  console.error(`[e2e-connector] ${userId} → ${bal}`);
+  return { content: [{ type: 'text', text: JSON.stringify({ userId, balance: bal }) }] };
+});
+await server.connect(new StdioServerTransport());

package/out/mcp.js

@@ -44,6 +44,7 @@ exports.generateCodexMcpConfig = generateCodexMcpConfig;
 exports.getDefaultMcpConfig = getDefaultMcpConfig;
 exports.loadBundledMcpServers = loadBundledMcpServers;
 exports.resolveHttpMcpHeaders = resolveHttpMcpHeaders;
+exports.referenceHttpMcpHeaders = referenceHttpMcpHeaders;
 exports.formatInlineMcpServers = formatInlineMcpServers;
 exports.serializeInlineMcpServers = serializeInlineMcpServers;
 exports.parseInlineMcpServers = parseInlineMcpServers;
@@ -555,6 +556,35 @@ function resolveHttpMcpHeaders(server, turnEnv) {
     }
     return Object.keys(headers).length > 0 ? headers : undefined;
 }
+/**
+ * The variable names the Claude CLI's `${NAME}` config expansion accepts. A `bearerTokenEnv`
+ * outside this shape would ship a header the CLI sends verbatim, so it falls back to in-memory
+ * resolution instead.
+ */
+const CLI_EXPANDABLE_ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/**
+ * Claude-engine variant of {@link resolveHttpMcpHeaders}: emit a `${NAME}` REFERENCE and let the
+ * CLI expand it from its own environment at connect time, instead of resolving the secret here.
+ *
+ * The Agent SDK serializes the whole mcpServers object into `--mcp-config <json>` argv, and
+ * /proc/<pid>/cmdline is world-readable — no ptrace gate, unlike environ — so a resolved
+ * Authorization header there is visible to every uid on the host and to execve-argv audit
+ * tooling. The reference keeps the turn nonce at environ-level exposure, which the engine child
+ * already carries for the egress CLI. Expansion verified live on CLI 2.1.220, including the
+ * failure mode this relies on: an UNSET name passes through literally and the data gateway
+ * rejects it — fail closed, never fail open.
+ */
+function referenceHttpMcpHeaders(server, turnEnv) {
+    const name = server.bearerTokenEnv;
+    if (name && !CLI_EXPANDABLE_ENV_NAME.test(name)) {
+        return resolveHttpMcpHeaders(server, turnEnv);
+    }
+    const headers = { ...(server.headers ?? {}) };
+    if (name) {
+        headers['Authorization'] = `Bearer \${${name}}`;
+    }
+    return Object.keys(headers).length > 0 ? headers : undefined;
+}
 /**
  * Convert resolved pack MCP servers to the inline record shape engines consume.
  *

package/out/pack/caps.js

@@ -0,0 +1,271 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CapMeter = exports.CAP_ENV_ALIASES = exports.parseCapPolicy = exports.STRICTEST_ON_BREACH = exports.ON_BREACH_ALIASES = exports.ON_BREACH_ACTIONS = exports.LEASE_CAP_FIELDS = exports.LEASE_CAP_ALIASES = exports.DEPRECATED_CAP_SPELLINGS = void 0;
+exports.resolveOnBreach = resolveOnBreach;
+exports.mergeCaps = mergeCaps;
+exports.capsAreUnbounded = capsAreUnbounded;
+exports.capsFromEnv = capsFromEnv;
+/**
+ * Caps and the live kill switch — the enforcement half of the control plane (serve-v4-clean §5).
+ *
+ * `assertAdmitted` already answers "may this artifact run here, now?" at sandbox CREATION. That is
+ * necessary and not sufficient for an enterprise control plane, which also needs:
+ *
+ *   caps  — a bound on what one session may consume, enforced by serve rather than requested of
+ *           the agent. A cap the agent could talk its way past is not a cap.
+ *   kill  — "stop now", not "stop admitting". Lease revocation alone leaves running sandboxes alive
+ *           until their TTL (up to 30 minutes); an operator hitting the emergency stop means the
+ *           work ends, so the lease watcher below destroys live sandboxes too.
+ *
+ * Precedence is deliberate: an operator's local limit may only ever be *tighter* than the
+ * control plane's. A self-hosted deployment can impose more restraint on itself, never less —
+ * so a compromised or misconfigured instance cannot raise its own ceiling by editing a flag.
+ */
+const lease_schema_1 = require("./lease-schema");
+/**
+ * Re-exported so callers outside pack/ have ONE import site for the cap vocabulary.
+ *
+ * The tables themselves live in `lease-schema.ts`, next to the lease validator that consumes them,
+ * because the whole point is that a lease field, an env var and a CLI flag are held to the same
+ * vocabulary. Adding an alias in one place changes all three.
+ */
+var lease_schema_2 = require("./lease-schema");
+Object.defineProperty(exports, "DEPRECATED_CAP_SPELLINGS", { enumerable: true, get: function () { return lease_schema_2.DEPRECATED_CAP_SPELLINGS; } });
+Object.defineProperty(exports, "LEASE_CAP_ALIASES", { enumerable: true, get: function () { return lease_schema_2.LEASE_CAP_ALIASES; } });
+Object.defineProperty(exports, "LEASE_CAP_FIELDS", { enumerable: true, get: function () { return lease_schema_2.LEASE_CAP_FIELDS; } });
+Object.defineProperty(exports, "ON_BREACH_ACTIONS", { enumerable: true, get: function () { return lease_schema_2.ON_BREACH_ACTIONS; } });
+Object.defineProperty(exports, "ON_BREACH_ALIASES", { enumerable: true, get: function () { return lease_schema_2.ON_BREACH_ALIASES; } });
+Object.defineProperty(exports, "STRICTEST_ON_BREACH", { enumerable: true, get: function () { return lease_schema_2.STRICTEST_ON_BREACH; } });
+Object.defineProperty(exports, "parseCapPolicy", { enumerable: true, get: function () { return lease_schema_2.parseCapPolicy; } });
+/** Env var aliases, old spelling → current spelling. */
+exports.CAP_ENV_ALIASES = {
+    AGENTHIPPO_MAX_CONCURRENT_CELLS: 'AGENTHIPPO_MAX_CONCURRENT_SANDBOXES',
+};
+/**
+ * Resolve a breach action from ANY untrusted source (env, CLI flag, lease field).
+ *
+ * The governing rule, and the reason this is one function rather than three:
+ * **an unrecognised action fails closed to the STRICTER action, loudly. It never softens.**
+ *
+ * It used to soften, in two places at once. `capsFromEnv` mapped an unknown value to `undefined`,
+ * and `cli/index.ts` did the same for `--cap-on-breach`; `mergeCaps` then found no
+ * `'destroy-sandbox'` on either side and `governor.enforce` defaulted to `revoke-inference`. So a
+ * typo — or the perfectly reasonable pre-rename value `destroy-cell` — quietly downgraded
+ * enforcement from "end the session" to "take away its model route", while the console showed the
+ * stricter setting the operator had typed.
+ *
+ * @param source what to name in the warning, e.g. `AGENTHIPPO_CAP_ON_BREACH` or `--cap-on-breach`.
+ */
+function resolveOnBreach(raw, source) {
+    const value = raw?.trim();
+    if (!value) {
+        return { action: undefined, warnings: [] };
+    }
+    if (value in lease_schema_1.ON_BREACH_ACTIONS) {
+        return { action: value, warnings: [] };
+    }
+    const aliased = lease_schema_1.ON_BREACH_ALIASES[value];
+    if (aliased) {
+        return {
+            action: aliased,
+            warnings: [
+                `${source}="${value}" is DEPRECATED; use "${lease_schema_1.DEPRECATED_CAP_SPELLINGS[value] ?? aliased}". ` +
+                    `Treating it as "${aliased}". The old spelling will stop being accepted.`,
+            ],
+        };
+    }
+    return {
+        action: lease_schema_1.STRICTEST_ON_BREACH,
+        warnings: [
+            `${source}="${value}" is not a breach action this build understands. ` +
+                `FAILING CLOSED to "${lease_schema_1.STRICTEST_ON_BREACH}" — an unreadable enforcement setting must never ` +
+                `weaken enforcement. Known actions: ${Object.keys(lease_schema_1.ON_BREACH_ACTIONS).join(', ')}.`,
+        ],
+    };
+}
+/** Ceiling on metered sessions, so an unbounded instance cannot grow meters without limit. */
+const MAX_METERED_SESSIONS = 10_000;
+/**
+ * Tighten-only merge. `local` may lower any bound the control plane set, never raise it, and may
+ * only escalate the breach action (revoke → destroy), never soften it.
+ */
+function mergeCaps(controlPlane, local) {
+    const cp = controlPlane ?? {};
+    const lo = local ?? {};
+    const tighter = (a, b) => {
+        if (a === undefined) {
+            return b;
+        }
+        if (b === undefined) {
+            return a;
+        }
+        return Math.min(a, b);
+    };
+    return {
+        maxTurnsPerSession: tighter(cp.maxTurnsPerSession, lo.maxTurnsPerSession),
+        maxSessionSeconds: tighter(cp.maxSessionSeconds, lo.maxSessionSeconds),
+        maxConcurrentSandboxes: tighter(cp.maxConcurrentSandboxes, lo.maxConcurrentSandboxes),
+        // destroy is stricter than revoke; either side may escalate, neither may soften.
+        onBreach: cp.onBreach === 'destroy-sandbox' || lo.onBreach === 'destroy-sandbox'
+            ? 'destroy-sandbox'
+            : (cp.onBreach ?? lo.onBreach),
+    };
+}
+/** True when no bound is set at all — lets callers skip the machinery entirely. */
+function capsAreUnbounded(caps) {
+    return caps.maxTurnsPerSession === undefined
+        && caps.maxSessionSeconds === undefined
+        && caps.maxConcurrentSandboxes === undefined;
+}
+/**
+ * Per-session meter. Checked BEFORE a turn runs: a cap discovered afterwards has already let the
+ * spend happen, so `check` is the gate and `record` only advances the counters.
+ */
+class CapMeter {
+    caps;
+    sessions = new Map();
+    constructor(caps) {
+        this.caps = caps;
+    }
+    /**
+     * Adopt caps the control plane pushed since boot.
+     *
+     * Caps used to be read from the lease exactly ONCE, at construction, so tightening a cap in
+     * the control plane did nothing until every instance was restarted — the fleet reported the
+     * new policy while enforcing the old one. Live-caught by the control-plane acceptance test.
+     * Existing per-session counters are deliberately kept: a lowered cap must bite immediately on
+     * sessions already over it, not hand them a fresh allowance.
+     */
+    setCaps(caps) {
+        this.caps = caps;
+    }
+    /** Current policy in force — surfaced on the admin/health endpoint. */
+    policy() {
+        return this.caps;
+    }
+    /**
+     * @param liveSandboxes Current live sandbox count — concurrency is an instance-wide bound, so it is
+     *                  supplied by the caller rather than tracked here.
+     */
+    check(sessionKey, liveSandboxes, nowMs = Date.now()) {
+        const usage = this.sessions.get(sessionKey);
+        if (this.caps.maxTurnsPerSession !== undefined && usage && usage.turns >= this.caps.maxTurnsPerSession) {
+            return {
+                allowed: false,
+                cap: 'turns',
+                reason: `session turn cap reached (${usage.turns}/${this.caps.maxTurnsPerSession})`,
+            };
+        }
+        if (this.caps.maxSessionSeconds !== undefined && usage) {
+            const elapsed = Math.floor((nowMs - usage.startedAtMs) / 1000);
+            if (elapsed >= this.caps.maxSessionSeconds) {
+                return {
+                    allowed: false,
+                    cap: 'duration',
+                    reason: `session duration cap reached (${elapsed}s/${this.caps.maxSessionSeconds}s)`,
+                };
+            }
+        }
+        // Concurrency applies only to sessions that would need a NEW sandbox; an established session
+        // reuses its own, so counting it against the cap would strand it once the fleet filled up.
+        if (this.caps.maxConcurrentSandboxes !== undefined && !usage && liveSandboxes >= this.caps.maxConcurrentSandboxes) {
+            return {
+                allowed: false,
+                cap: 'concurrency',
+                reason: `instance is at its concurrent sandbox cap (${liveSandboxes}/${this.caps.maxConcurrentSandboxes})`,
+            };
+        }
+        return { allowed: true };
+    }
+    /**
+     * Advance the counters for a turn that actually ran.
+     *
+     * Metering happens even when caps are currently unbounded, and that is the point: caps can be
+     * tightened from the control plane mid-flight, and a session that ran fifty turns under an
+     * unbounded policy must not then receive a fresh allowance the moment a cap appears. Counting
+     * only while a cap happens to be set is precisely the kind of gap an agent can be steered into.
+     */
+    record(sessionKey, nowMs = Date.now()) {
+        const existing = this.sessions.get(sessionKey);
+        if (existing) {
+            existing.turns += 1;
+            return;
+        }
+        // Bounded so an unbounded, long-lived instance cannot accumulate meters forever; the
+        // oldest session is the one least likely to still be running.
+        if (this.sessions.size >= MAX_METERED_SESSIONS) {
+            let oldestKey;
+            let oldestAt = Infinity;
+            for (const [key, usage] of this.sessions) {
+                if (usage.startedAtMs < oldestAt) {
+                    oldestAt = usage.startedAtMs;
+                    oldestKey = key;
+                }
+            }
+            if (oldestKey) {
+                this.sessions.delete(oldestKey);
+            }
+        }
+        this.sessions.set(sessionKey, { turns: 1, startedAtMs: nowMs });
+    }
+    /** Drop a session's meter — called when its sandbox is destroyed so a fresh session starts clean. */
+    forget(sessionKey) {
+        this.sessions.delete(sessionKey);
+    }
+    usage(sessionKey) {
+        const u = this.sessions.get(sessionKey);
+        if (!u) {
+            return undefined;
+        }
+        return { turns: u.turns, ageSeconds: Math.floor((Date.now() - u.startedAtMs) / 1000) };
+    }
+}
+exports.CapMeter = CapMeter;
+/**
+ * Parse `AGENTHIPPO_MAX_*` style env, ignoring blanks and non-numbers rather than guessing.
+ *
+ * LOCAL config, so the rules differ from a lease deliberately: a typo in an operator's own env is
+ * dropped (they can see and fix it, and dropping it only affects their own instance), whereas the
+ * same typo arriving from a control plane means the fleet believes a cap is in force that is not.
+ * The `onBreach` vocabulary, however, comes from the same table `parseCapPolicy` uses, so a value
+ * that is valid in a lease is valid here and vice versa — including any back-compat aliases layered
+ * into `ON_BREACH_ALIASES`.
+ */
+function capsFromEnv(env = process.env, warn = (m) => console.warn(`Warning: ${m}`)) {
+    const num = (raw) => {
+        const v = parseInt((raw ?? '').trim(), 10);
+        return Number.isFinite(v) && v > 0 ? v : undefined;
+    };
+    /** Current spelling wins; a deprecated one is honoured once, loudly. */
+    const numWithAlias = (current) => {
+        const direct = num(env[current]);
+        if (direct !== undefined) {
+            return direct;
+        }
+        for (const [old, replacement] of Object.entries(exports.CAP_ENV_ALIASES)) {
+            if (replacement !== current) {
+                continue;
+            }
+            const legacy = num(env[old]);
+            if (legacy === undefined) {
+                continue;
+            }
+            warn(`${old} is DEPRECATED; use ${current}. Honouring it for now.`);
+            return legacy;
+        }
+        return undefined;
+    };
+    const breach = resolveOnBreach(env.AGENTHIPPO_CAP_ON_BREACH, 'AGENTHIPPO_CAP_ON_BREACH');
+    for (const w of breach.warnings) {
+        warn(w);
+    }
+    return {
+        maxTurnsPerSession: numWithAlias('AGENTHIPPO_MAX_TURNS_PER_SESSION'),
+        maxSessionSeconds: numWithAlias('AGENTHIPPO_MAX_SESSION_SECONDS'),
+        maxConcurrentSandboxes: numWithAlias('AGENTHIPPO_MAX_CONCURRENT_SANDBOXES'),
+        onBreach: breach.action,
+    };
+}