@agenthippo-ai/agenthippo 0.2.3-dataplane → 1.110.11

package/out/auth/bootstrapApply.js

@@ -19,7 +19,6 @@ async function applyIdeBootstrap(bootstrap, target) {
     const skipped = [];
     const teamManaged = bootstrap.policy.teamManagedSettings ?? [];
     const storeConfig = target.getConfiguration('agentide');
-    const litellmConfig = target.getConfiguration('agentide.providers.litellm');
     if (shouldApplySetting(target.globalStateGet(exports.TEAM_MANAGED_STORE_KEY), teamManaged, 'store')) {
         await storeConfig.update('storeRepo', bootstrap.store.repo, target.ConfigurationTarget.Global);
         await storeConfig.update('store.indexUrl', bootstrap.store.indexUrl, target.ConfigurationTarget.Global);
@@ -29,22 +28,19 @@ async function applyIdeBootstrap(bootstrap, target) {
     else {
         skipped.push('store');
     }
+    // Routing configures the `agenthippo` provider slot ONLY. The `litellm` slot stays user-owned
+    // (a developer's local Spotlight proxy) — sign-in must never overwrite it. No credential is
+    // written here: the account JWT is synced to the provider by the auth provider's timer, and
+    // the bootstrap carries no routing key at all.
     if (shouldApplySetting(target.globalStateGet(exports.TEAM_MANAGED_ROUTING_KEY), teamManaged, 'routing')) {
-        await litellmConfig.update('baseUrl', bootstrap.routing.litellmBaseUrl, target.ConfigurationTarget.Global);
-        if (target.setParticipantApiKey) {
-            await target.setParticipantApiKey({
-                provider: 'litellm',
-                apiKey: bootstrap.routing.litellmApiKey,
-                baseUrl: bootstrap.routing.litellmBaseUrl,
-            });
-        }
+        await storeConfig.update('AgentHippoModelGateway.url', bootstrap.routing.inferenceGatewayUrl, target.ConfigurationTarget.Global);
         await target.globalStateUpdate(exports.TEAM_MANAGED_ROUTING_KEY, teamManaged.includes('routing'));
         applied.push('routing');
     }
     else {
         skipped.push('routing');
     }
-    await target.globalStateUpdate(exports.TEAM_ID_KEY, bootstrap.team.id);
+    await target.globalStateUpdate(exports.TEAM_ID_KEY, bootstrap.team?.id);
     await target.globalStateUpdate(exports.TEAM_LAST_BOOTSTRAP_KEY, new Date().toISOString());
     await target.globalStateUpdate(exports.TEAM_BOOTSTRAP_CACHE_KEY, bootstrap);
     return { applied, skipped };
@@ -59,6 +55,9 @@ async function revertTeamManagedBootstrap(target) {
         await storeConfig.update('store.indexUrl', 'https://agenthippoai.github.io/agenthippo-store', target.ConfigurationTarget.Global);
     }
     if (routingManaged) {
+        await storeConfig.update('AgentHippoModelGateway.url', undefined, target.ConfigurationTarget.Global);
+        // Clean up state written by pre-separation installs, where team routing overwrote the
+        // user-owned litellm slot with the team base URL and a shared key.
         await litellmConfig.update('baseUrl', '', target.ConfigurationTarget.Global);
         if (target.setParticipantApiKey) {
             await target.setParticipantApiKey({ provider: 'litellm', apiKey: '', baseUrl: '' });

package/out/auth/brokerClient.js

@@ -3,21 +3,66 @@
  *  Copyright (c) AgentHippo.ai. All rights reserved.
  *--------------------------------------------------------------------------------------------*/
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_AUTH_BROKER_BASE_URL = void 0;
+exports.isLoopbackAuthHost = isLoopbackAuthHost;
+exports.assertSafeAuthBaseUrl = assertSafeAuthBaseUrl;
 exports.getAuthBrokerBaseUrl = getAuthBrokerBaseUrl;
 exports.devLoginForTests = devLoginForTests;
 exports.exchangeAuthorizationCode = exchangeAuthorizationCode;
 exports.refreshAccessToken = refreshAccessToken;
-exports.fetchBootstrapRefresh = fetchBootstrapRefresh;
 exports.fetchBootstrap = fetchBootstrap;
 exports.fetchMe = fetchMe;
 exports.buildAuthorizeUrl = buildAuthorizeUrl;
 exports.completeDevPkceLogin = completeDevPkceLogin;
 const types_js_1 = require("./types.js");
 const pkce_js_1 = require("./pkce.js");
+exports.DEFAULT_AUTH_BROKER_BASE_URL = 'https://auth.agenthippo.ai';
+/** Hostnames for which plain `http://` is accepted — an operator running a broker locally. */
+const LOOPBACK_HOSTNAMES = new Set(['localhost', '127.0.0.1', '::1', '[::1]']);
+function isLoopbackAuthHost(hostname) {
+    return LOOPBACK_HOSTNAMES.has(hostname.toLowerCase());
+}
+/**
+ * Refuse an auth base URL that cannot safely carry a bearer token.
+ *
+ * Every request built from this value carries either the PKCE authorization code or the user's
+ * AgentHippo access token (`/oauth/token`, `/api/ide/bootstrap`, `/api/ide/me`), and the bootstrap
+ * response is written straight into the user's model-routing settings. A cleartext or non-http(s)
+ * endpoint therefore leaks the credential on the wire; anything but https is refused unless the
+ * host is loopback, which is the local-development case and never crosses a network.
+ *
+ * Returns the normalized (trailing-slash-stripped) URL, or throws with an actionable message.
+ */
+function assertSafeAuthBaseUrl(value) {
+    const trimmed = value.trim();
+    let url;
+    try {
+        url = new URL(trimmed);
+    }
+    catch {
+        throw new Error(`AgentHippo auth base URL "${trimmed}" is not a valid URL. ` +
+            `Fix "agentide.auth.baseUrl" (or AGENTHIPPO_AUTH_BASE_URL), or clear it to use ${exports.DEFAULT_AUTH_BROKER_BASE_URL}.`);
+    }
+    if (url.protocol === 'https:') {
+        return trimmed.replace(/\/+$/, '');
+    }
+    if (url.protocol === 'http:' && isLoopbackAuthHost(url.hostname)) {
+        return trimmed.replace(/\/+$/, '');
+    }
+    throw new Error(`Refusing to use AgentHippo auth base URL "${trimmed}": it must be https:// ` +
+        `(plain http:// is accepted only for loopback hosts such as http://127.0.0.1:9780). ` +
+        `Your AgentHippo access token is sent to this host, so it is never sent over cleartext. ` +
+        `Fix "agentide.auth.baseUrl" (or AGENTHIPPO_AUTH_BASE_URL), or clear it to use ${exports.DEFAULT_AUTH_BROKER_BASE_URL}.`);
+}
+/**
+ * Resolve the auth broker base URL. `configured` must already have been filtered for scope by the
+ * caller (see `auth/authBaseUrl.ts` — a workspace-scoped value is dropped before it gets here);
+ * this function is the second gate and enforces the transport requirement.
+ */
 function getAuthBrokerBaseUrl(configured) {
     const fromEnv = process.env.AGENTHIPPO_AUTH_BASE_URL?.trim();
-    const value = configured?.trim() || fromEnv || 'https://auth.agenthippo.ai';
-    return value.replace(/\/+$/, '');
+    const value = configured?.trim() || fromEnv || exports.DEFAULT_AUTH_BROKER_BASE_URL;
+    return assertSafeAuthBaseUrl(value);
 }
 async function devLoginForTests(baseUrl, email, redirectUri, codeChallenge) {
     const res = await fetch(`${baseUrl}/oauth/dev/login`, {
@@ -73,17 +118,6 @@ async function refreshAccessToken(baseUrl, refreshToken) {
     }
     return res.json();
 }
-async function fetchBootstrapRefresh(baseUrl, accessToken) {
-    const res = await fetch(`${baseUrl}/api/ide/bootstrap/refresh`, {
-        method: 'POST',
-        headers: { Authorization: `Bearer ${accessToken}` },
-    });
-    if (!res.ok) {
-        const text = await res.text();
-        throw new Error(`bootstrap refresh failed: ${res.status} ${text}`.trim());
-    }
-    return res.json();
-}
 async function fetchBootstrap(baseUrl, accessToken) {
     const res = await fetch(`${baseUrl}/api/ide/bootstrap`, {
         headers: { Authorization: `Bearer ${accessToken}` },

package/out/auth/provider.js

@@ -41,7 +41,7 @@ exports.registerAgentHippoAuth = registerAgentHippoAuth;
 exports.refreshBootstrapIfSignedIn = refreshBootstrapIfSignedIn;
 exports.startAgentHippoTokenRefreshTimer = startAgentHippoTokenRefreshTimer;
 const vscode = __importStar(require("vscode"));
-const brokerClient_js_1 = require("./brokerClient.js");
+const authBaseUrl_js_1 = require("./authBaseUrl.js");
 const bootstrapApply_js_1 = require("./bootstrapApply.js");
 const types_js_1 = require("./types.js");
 const signInFlow_js_1 = require("./signInFlow.js");
@@ -111,7 +111,7 @@ class AgentHippoAuthProvider {
         const stored = await (0, sessionStore_js_1.getStoredAuthSession)(this.context.secrets);
         const removedSession = stored ? (0, sessionStore_js_1.storedSessionToVsCode)(stored) : undefined;
         if (stored) {
-            const baseUrl = (0, brokerClient_js_1.getAuthBrokerBaseUrl)(vscode.workspace.getConfiguration('agentide').get('auth.baseUrl'));
+            const baseUrl = (0, authBaseUrl_js_1.resolveAuthBrokerBaseUrl)(vscode.workspace.getConfiguration('agentide'), (m) => console.warn(m));
             try {
                 await fetch(`${baseUrl}/api/ide/signout`, {
                     method: 'POST',
@@ -184,20 +184,17 @@ async function refreshBootstrapIfSignedIn(context) {
     void syncAgentHippoModelGatewayToken(token.accessToken);
 }
 /**
- * Refresh cadence for the model-gateway JWT and LiteLLM routing key. The access token TTL is
- * ~1h; getAgentHippoAccessToken refreshes it inside a 5-min pre-expiry window, so a 60s tick
- * always lands inside that window with buffer and re-syncs the agenthippo provider key before
- * the old JWT expires (fixes stale-key 401s on long sessions). Routing credentials are refreshed
- * less often (every ~5 min) so a server-side rotation of the team LiteLLM key is picked up
- * without re-sign-in. Both syncs are diff-gated so we don't churn SecretStorage / settings /
- * onDidChangeKeys every tick when nothing changed.
+ * Refresh cadence for the model-gateway JWT. The access token TTL is ~1h;
+ * getAgentHippoAccessToken refreshes it inside a 5-min pre-expiry window, so a 60s tick always
+ * lands inside that window with buffer and re-syncs the agenthippo provider key before the old
+ * JWT expires (fixes stale-key 401s on long sessions). The sync is diff-gated so we don't churn
+ * SecretStorage / onDidChangeKeys every tick when nothing changed. There is no routing-key
+ * refresh: the bootstrap carries no routing credential — the JWT is the credential.
  */
 const TOKEN_REFRESH_INTERVAL_MS = 60_000;
-const ROUTING_REFRESH_EVERY_N_TICKS = 5;
 function startAgentHippoTokenRefreshTimer(context) {
     let lastSyncedAccessToken = '';
     let running = false;
-    let tick = 0;
     const handle = setInterval(() => {
         // Guard against overlapping ticks: a stalled fetch shouldn't let the next tick stack up.
         if (running) {
@@ -219,16 +216,6 @@ function startAgentHippoTokenRefreshTimer(context) {
                         lastSyncedAccessToken = token.accessToken;
                     }
                 }
-                // Routing key rotation is rare; refresh infrequently and let the helper skip the
-                // settings write when the key hasn't changed.
-                if (++tick % ROUTING_REFRESH_EVERY_N_TICKS === 0) {
-                    try {
-                        await (0, sessionStore_js_1.refreshRoutingCredentialsForContext)(context, token.accessToken);
-                    }
-                    catch {
-                        // best-effort routing refresh; next cycle retries
-                    }
-                }
             }
             finally {
                 running = false;

package/out/auth/sessionStore.js

@@ -39,12 +39,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getStoredAuthSession = getStoredAuthSession;
 exports.persistAuthSession = persistAuthSession;
 exports.applyIdeBootstrapForContext = applyIdeBootstrapForContext;
-exports.refreshRoutingCredentialsForContext = refreshRoutingCredentialsForContext;
 exports.getAgentHippoAccessToken = getAgentHippoAccessToken;
 exports.clearAuthSession = clearAuthSession;
 exports.storedSessionToVsCode = storedSessionToVsCode;
 const vscode = __importStar(require("vscode"));
 const brokerClient_js_1 = require("./brokerClient.js");
+const authBaseUrl_js_1 = require("./authBaseUrl.js");
 const bootstrapApply_js_1 = require("./bootstrapApply.js");
 const SESSION_SECRET_KEY = 'agenthippo.auth.session';
 /**
@@ -94,7 +94,7 @@ async function persistAuthSession(secrets, tokens, bootstrap, scopes) {
     return toVsCodeSession(session);
 }
 async function applyIdeBootstrapForContext(context, accessToken) {
-    const baseUrl = (0, brokerClient_js_1.getAuthBrokerBaseUrl)(vscode.workspace.getConfiguration('agentide').get('auth.baseUrl'));
+    const baseUrl = (0, authBaseUrl_js_1.resolveAuthBrokerBaseUrl)(vscode.workspace.getConfiguration('agentide'), (m) => console.warn(m));
     const bootstrap = await (0, brokerClient_js_1.fetchBootstrap)(baseUrl, accessToken);
     await (0, bootstrapApply_js_1.applyIdeBootstrap)(bootstrap, {
         getConfiguration: (section) => vscode.workspace.getConfiguration(section),
@@ -110,43 +110,6 @@ async function applyIdeBootstrapForContext(context, accessToken) {
     });
     return bootstrap;
 }
-/**
- * Refresh only the LiteLLM routing credentials (lighter than re-fetching the full bootstrap)
- * and re-apply them, merging into the last cached bootstrap. Handles server-side rotation of
- * the team routing key without requiring a re-sign-in. No-op if no bootstrap has been applied.
- */
-async function refreshRoutingCredentialsForContext(context, accessToken) {
-    const cached = context.globalState.get(bootstrapApply_js_1.TEAM_BOOTSTRAP_CACHE_KEY);
-    if (!cached) {
-        return;
-    }
-    const baseUrl = (0, brokerClient_js_1.getAuthBrokerBaseUrl)(vscode.workspace.getConfiguration('agentide').get('auth.baseUrl'));
-    const refreshed = await (0, brokerClient_js_1.fetchBootstrapRefresh)(baseUrl, accessToken);
-    // Skip the settings write when nothing rotated: applyIdeBootstrap re-writes store + routing
-    // and setAPIKey fires onDidChangeKeys on every call, so re-applying an unchanged key every
-    // few minutes would churn listeners and SecretStorage.
-    const keyChanged = refreshed.routing.litellmApiKey !== cached.routing.litellmApiKey;
-    const baseUrlChanged = refreshed.routing.litellmBaseUrl !== cached.routing.litellmBaseUrl;
-    if (!keyChanged && !baseUrlChanged) {
-        return;
-    }
-    const merged = {
-        ...cached,
-        routing: { ...cached.routing, ...refreshed.routing },
-    };
-    await (0, bootstrapApply_js_1.applyIdeBootstrap)(merged, {
-        getConfiguration: (section) => vscode.workspace.getConfiguration(section),
-        ConfigurationTarget: vscode.ConfigurationTarget,
-        setParticipantApiKey: async (args) => {
-            await vscode.commands.executeCommand('agentide.setParticipantApiKey', args);
-            await vscode.commands.executeCommand('agentide.auth.applyBootstrapKeys', args);
-        },
-        globalStateUpdate: async (key, value) => {
-            await context.globalState.update(key, value);
-        },
-        globalStateGet: (key) => context.globalState.get(key),
-    });
-}
 async function getAgentHippoAccessToken(context) {
     const stored = await getStoredAuthSession(context.secrets);
     if (!stored) {
@@ -157,7 +120,7 @@ async function getAgentHippoAccessToken(context) {
     }
     // Near expiry — refresh exactly once across concurrent callers.
     if (!inFlightRefresh) {
-        const baseUrl = (0, brokerClient_js_1.getAuthBrokerBaseUrl)(vscode.workspace.getConfiguration('agentide').get('auth.baseUrl'));
+        const baseUrl = (0, authBaseUrl_js_1.resolveAuthBrokerBaseUrl)(vscode.workspace.getConfiguration('agentide'), (m) => console.warn(m));
         const refreshing = stored;
         inFlightRefresh = (async () => {
             try {

package/out/auth/signInFlow.js

@@ -40,6 +40,7 @@ exports.runAgentHippoSignInFlow = runAgentHippoSignInFlow;
 exports.ensureAgentHippoSignedIn = ensureAgentHippoSignedIn;
 const vscode = __importStar(require("vscode"));
 const brokerClient_js_1 = require("./brokerClient.js");
+const authBaseUrl_js_1 = require("./authBaseUrl.js");
 const pkce_js_1 = require("./pkce.js");
 const callbackUriParse_js_1 = require("./callbackUriParse.js");
 const types_js_1 = require("./types.js");
@@ -77,7 +78,7 @@ function extractRedirectUriFromText(text) {
  * Falls back to pasted redirect URL when loopback does not fire (remote/SSH/headless).
  */
 async function runAgentHippoSignInFlow(context, options) {
-    const baseUrl = (0, brokerClient_js_1.getAuthBrokerBaseUrl)(vscode.workspace.getConfiguration('agentide').get('auth.baseUrl'));
+    const baseUrl = (0, authBaseUrl_js_1.resolveAuthBrokerBaseUrl)(vscode.workspace.getConfiguration('agentide'), (m) => console.warn(m));
     const scopes = options?.scopes ?? [...types_js_1.AUTH_SCOPES];
     const loopback = new loopbackAuthServer_js_1.AgentHippoLoopbackAuthServer();
     const verifier = (0, pkce_js_1.generateCodeVerifier)();

package/out/auth-broker/config.js

@@ -3,7 +3,8 @@
  *  Copyright (c) AgentHippo.ai. All rights reserved.
  *--------------------------------------------------------------------------------------------*/
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_LITELLM_API_KEY = exports.DEFAULT_JWT_SECRET = void 0;
+exports.DEFAULT_AUTH_BIND = exports.AUTH_PROXY_SECRET_HEADER = exports.DEFAULT_JWT_SECRET = void 0;
+exports.resolveAuthBrokerBind = resolveAuthBrokerBind;
 exports.loadAuthBrokerConfig = loadAuthBrokerConfig;
 exports.emailDomainAllowed = emailDomainAllowed;
 function parseDomains(raw) {
@@ -14,8 +15,50 @@ function parseDomains(raw) {
 }
 /** Well-known default secret used in dev/test. Never acceptable in production. */
 exports.DEFAULT_JWT_SECRET = 'dev-agenthippo-auth-secret-change-me';
-/** Well-known default LiteLLM team key used in dev/test. Never acceptable in production. */
-exports.DEFAULT_LITELLM_API_KEY = 'ahk_team_dev_key';
+/**
+ * Header the trusted proxy sets to prove it is the trusted proxy.
+ *
+ * `X-Auth-Request-Email` is set by oauth2-proxy AFTER a real Google login, but nothing about the
+ * header itself proves it came from oauth2-proxy — anything that can reach the broker's port can
+ * send it. The proxy therefore also sets this header from a secret only it and the broker know.
+ */
+exports.AUTH_PROXY_SECRET_HEADER = 'x-agenthippo-proxy-secret';
+/**
+ * Where the broker listens. 127.0.0.1 by default: this port mints tokens, and every intended caller
+ * (the Caddy/oauth2-proxy sidecar) is same-host. Binding a routable interface is an explicit,
+ * separately-flagged decision — see `resolveAuthBrokerBind`.
+ */
+exports.DEFAULT_AUTH_BIND = '127.0.0.1';
+const LOOPBACK_BINDS = new Set(['127.0.0.1', 'localhost', '::1', '[::1]']);
+/**
+ * Resolve (and gate) the bind address.
+ *
+ * The old default was `0.0.0.0`, which put a token-minting endpoint on every interface: reach
+ * :9780 directly, forge `X-Auth-Request-Email`, get an auth code for any address, and exchange it
+ * at the ungated `/oauth/token`. Loopback is now the default, and a public bind must be asked for
+ * TWICE — the address plus `AGENTHIPPO_AUTH_ALLOW_PUBLIC_BIND=1` — so it can never happen by
+ * inheriting a stray env var from a base image.
+ */
+function resolveAuthBrokerBind(env = process.env) {
+    const requested = env.AGENTHIPPO_AUTH_BIND?.trim() || exports.DEFAULT_AUTH_BIND;
+    const isPublic = !LOOPBACK_BINDS.has(requested.toLowerCase());
+    if (!isPublic) {
+        return { address: requested, isPublic: false };
+    }
+    if (env.AGENTHIPPO_AUTH_ALLOW_PUBLIC_BIND !== '1') {
+        throw new Error(`Refusing to bind the auth broker to "${requested}". This port issues authorization codes ` +
+            `and access tokens, and a directly reachable broker can be asked to mint a token for an ` +
+            `arbitrary email by forging X-Auth-Request-Email.\n` +
+            `  - Same-host proxy (recommended): bind 127.0.0.1 and run Caddy/oauth2-proxy alongside it.\n` +
+            `  - SEPARATE CONTAINER for the proxy (the compose/Cloud Run layout, where Caddy dials\n` +
+            `    "auth-broker:9780"): the broker must listen on the container's network interface, so set\n` +
+            `    BOTH  AGENTHIPPO_AUTH_BIND=${requested}  AND  AGENTHIPPO_AUTH_ALLOW_PUBLIC_BIND=1,\n` +
+            `    and make sure the port is not published outside the private network.\n` +
+            `In either case set AGENTHIPPO_AUTH_PROXY_SECRET (and have the proxy send it) so a forged ` +
+            `X-Auth-Request-Email is rejected — that is what actually stops the token-minting attack.`);
+    }
+    return { address: requested, isPublic: true };
+}
 function loadAuthBrokerConfig(env = process.env) {
     const jwtSecret = env.AGENTHIPPO_AUTH_JWT_SECRET?.trim() || exports.DEFAULT_JWT_SECRET;
     const publicBaseUrl = (env.AGENTHIPPO_AUTH_PUBLIC_URL?.trim() || `http://127.0.0.1:${env.AGENTHIPPO_AUTH_PORT?.trim() || '9780'}`).replace(/\/+$/, '');
@@ -38,15 +81,17 @@ function loadAuthBrokerConfig(env = process.env) {
         cookieName: env.AGENTHIPPO_AUTH_COOKIE_NAME?.trim() || 'ah_token',
         cookieDomain: env.AGENTHIPPO_AUTH_COOKIE_DOMAIN?.trim() || '',
         idpBaseUrl: (env.AGENTHIPPO_AUTH_IDP_URL?.trim() || '').replace(/\/+$/, ''),
+        proxySecret: env.AGENTHIPPO_AUTH_PROXY_SECRET?.trim() || '',
+        trustProxyHeadersUnverified: env.AGENTHIPPO_AUTH_TRUST_PROXY_UNVERIFIED === '1',
         dataDir: env.AGENTHIPPO_AUTH_DATA_DIR?.trim() || undefined,
+        teamConfigured: Boolean(env.AGENTHIPPO_TEAM_ID?.trim()),
         team: {
             id: env.AGENTHIPPO_TEAM_ID?.trim() || 'team_default',
             name: env.AGENTHIPPO_TEAM_NAME?.trim() || 'Default Team',
             storeRepo,
             storeIndexUrl: env.AGENTHIPPO_TEAM_STORE_INDEX_URL?.trim() || `https://${storeOwner}.github.io/${storeName}`,
             githubOrg: env.AGENTHIPPO_TEAM_GITHUB_ORG?.trim() || storeOwner,
-            litellmBaseUrl: env.AGENTHIPPO_TEAM_LITELLM_BASE_URL?.trim() || 'http://127.0.0.1:4000',
-            litellmApiKey: env.AGENTHIPPO_TEAM_LITELLM_API_KEY?.trim() || exports.DEFAULT_LITELLM_API_KEY,
+            gatewayUrl: env.AGENTHIPPO_TEAM_GATEWAY_URL?.trim() || 'https://gateway.agenthippo.ai/v1',
         },
     };
 }

package/out/auth-broker/server.js

@@ -36,6 +36,8 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasTrustedProxyProof = void 0;
+exports.isAllowedRedirectUri = isAllowedRedirectUri;
 exports.createAuthBrokerServer = createAuthBrokerServer;
 exports.startAuthBrokerServer = startAuthBrokerServer;
 const http = __importStar(require("http"));
@@ -65,11 +67,49 @@ function isAllowedRedirectUri(redirectUri) {
     catch {
         return false;
     }
+    // No embedded credentials, no query, no fragment. A permitted shape with a `?next=…` rider or a
+    // `user:pass@` prefix is a different destination wearing an allowed hostname; the exchange binds
+    // the code to this exact string, so anything that isn't the literal callback is refused here.
+    if (target.username || target.password || target.search || target.hash) {
+        return false;
+    }
     if (target.protocol === 'http:') {
-        return (target.hostname === '127.0.0.1' || target.hostname === 'localhost') && target.pathname === '/callback';
+        // The loopback callback is the real IDE/CLI flow (loopbackAuthServer.ts binds an OS-assigned
+        // port on 127.0.0.1), so the port cannot be pinned. The port is not what makes this safe:
+        // the code is single-use, bound to THIS redirect_uri at issue time and verified against it at
+        // /oauth/token, and PKCE binds it to a verifier only the initiating client holds. An attacker
+        // who forges a loopback redirect_uri still receives a code they cannot exchange.
+        // `localhost` is accepted for parity with the client, but nothing else resolves here.
+        if (target.hostname !== '127.0.0.1' && target.hostname !== 'localhost') {
+            return false;
+        }
+        if (target.pathname !== '/callback') {
+            return false;
+        }
+        // A bare `http://127.0.0.1/callback` (port 80) is not something the loopback server ever
+        // asks for — it needs a bindable ephemeral port — and port 80 is the one loopback port a
+        // non-root process cannot claim, so refuse it rather than leave the shape open.
+        return target.port !== '' && Number(target.port) > 1024;
+    }
+    if (target.protocol === 'https:') {
+        // No https redirect target is a client of this broker: the IDE uses the editor URI scheme
+        // and the CLI uses loopback. Allowing https here would make "redirect to my server" a
+        // one-line manifest away.
+        return false;
     }
     return (0, callbackUriParse_js_1.isAuthCallbackParts)(target.host, target.pathname);
 }
+/**
+ * Does this request carry the trusted proxy's proof?
+ *
+ * `X-Auth-Request-Email` is only meaningful when it was set by our oauth2-proxy sidecar after a real
+ * Google login. Nothing about the header says so, so the proxy also stamps a shared secret which is
+ * checked constant-time, so a mismatched secret cannot be recovered byte by byte. The check lives in
+ * serve-hardening (serve applies the same contract to its identity header via
+ * AGENTHIPPO_IDENTITY_PROXY_SECRET); re-exported here for the broker's existing consumers.
+ */
+var serve_hardening_js_2 = require("../cli/serve-hardening.js");
+Object.defineProperty(exports, "hasTrustedProxyProof", { enumerable: true, get: function () { return serve_hardening_js_2.hasTrustedProxyProof; } });
 function sendJson(res, status, body) {
     res.writeHead(status, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify(body));
@@ -161,11 +201,27 @@ function createAuthBrokerServer(config) {
         throw new Error('AGENTHIPPO_AUTH_JWT_SECRET must be set to a strong secret in production. ' +
             'Generate one with: openssl rand -hex 32');
     }
-    // Fail-closed: a known-default LiteLLM key would hand every team member the same
-    // publicly-known credential if the operator forgot to set the real one.
-    if (!resolved.devMode && resolved.team.litellmApiKey === config_js_1.DEFAULT_LITELLM_API_KEY) {
-        throw new Error('AGENTHIPPO_TEAM_LITELLM_API_KEY must be set in production. ' +
-            'The default dev key must not be issued to real users via bootstrap.');
+    // Fail-closed: without a proxy proof, `X-Auth-Request-Email` is a self-asserted claim. Anything
+    // that can reach this port could send `X-Auth-Request-Email: ceo@example.com` with a loopback
+    // redirect_uri to /oauth/authorize and exchange the resulting code at the ungated /oauth/token —
+    // a full account takeover with no credential. Same posture as the JWT/LiteLLM defaults above:
+    // refuse to boot rather than run a broker whose identity input is unauthenticated.
+    if (!resolved.devMode && !resolved.proxySecret && !resolved.trustProxyHeadersUnverified) {
+        throw new Error('AGENTHIPPO_AUTH_PROXY_SECRET must be set in production. The broker trusts ' +
+            'X-Auth-Request-Email from the oauth2-proxy/Caddy forward_auth sidecar; without a shared ' +
+            'secret proving the header came from that sidecar, any caller that reaches this port can ' +
+            'mint a token for an arbitrary email.\n' +
+            '  1. Generate one:  openssl rand -hex 32\n' +
+            `  2. Set it here:   AGENTHIPPO_AUTH_PROXY_SECRET=<secret>\n` +
+            `  3. Have the proxy send it, e.g. in the Caddyfile:\n` +
+            `       header_up ${config_js_1.AUTH_PROXY_SECRET_HEADER} {env.AGENTHIPPO_AUTH_PROXY_SECRET}\n` +
+            'If the broker is genuinely unreachable except through the proxy and you accept the risk, ' +
+            'set AGENTHIPPO_AUTH_TRUST_PROXY_UNVERIFIED=1.');
+    }
+    if (!resolved.devMode && !resolved.proxySecret && resolved.trustProxyHeadersUnverified) {
+        console.warn('[auth-broker] WARNING: AGENTHIPPO_AUTH_TRUST_PROXY_UNVERIFIED=1 — X-Auth-Request-Email is ' +
+            'accepted without proof. Anything that can reach this port can mint a token for any email. ' +
+            'Set AGENTHIPPO_AUTH_PROXY_SECRET to close this.');
     }
     // Warn when no domain restriction is configured: any SSO-authenticated email can sign in.
     if (!resolved.devMode && resolved.allowedEmailDomains.length === 0) {
@@ -229,11 +285,12 @@ function createAuthBrokerServer(config) {
         // IdP's own broker still hits getUser for its locally-created users, so this fallback is
         // a no-op there.
         if (!user) {
+            const teamIdFromToken = typeof payload.team_id === 'string' && payload.team_id ? payload.team_id : undefined;
             user = {
                 id: String(payload.sub),
                 email: String(payload.email),
                 displayName: typeof payload.name === 'string' && payload.name ? payload.name : String(payload.email),
-                teamId: typeof payload.team_id === 'string' && payload.team_id ? payload.team_id : resolved.team.id,
+                teamId: teamIdFromToken ?? (resolved.teamConfigured ? resolved.team.id : undefined),
             };
         }
         if (payload.exp) {
@@ -253,6 +310,33 @@ function createAuthBrokerServer(config) {
         }
         return user;
     }
+    /**
+     * Read the SSO-asserted email, but only if the request proved it came from the trusted proxy.
+     * Returns `undefined` when there is no email, and `null` when an email was present but the proof
+     * was missing/wrong — those are different failures and the second one is worth auditing loudly.
+     */
+    const proxyAssertedEmail = (req) => {
+        const email = (req.headers['x-auth-request-email'] || '').trim().toLowerCase();
+        if (!email) {
+            return undefined;
+        }
+        // devMode and the explicit unverified opt-in are the only ways past the proof.
+        if (resolved.devMode || (!resolved.proxySecret && resolved.trustProxyHeadersUnverified)) {
+            return email;
+        }
+        if (!(0, serve_hardening_js_1.hasTrustedProxyProof)(req.headers, resolved.proxySecret)) {
+            return null;
+        }
+        return email;
+    };
+    const rejectForgedProxyHeader = (res, ip, pathname) => {
+        audit('proxy_header.unverified', { ip, path: pathname });
+        sendJson(res, 401, {
+            error: 'unauthorized',
+            error_description: `X-Auth-Request-Email was present without a valid ${config_js_1.AUTH_PROXY_SECRET_HEADER} header. ` +
+                'Only the trusted reverse proxy may assert an identity to this broker.',
+        });
+    };
     const server = http.createServer(async (req, res) => {
         try {
             const host = req.headers.host || `127.0.0.1:${resolved.port}`;
@@ -308,8 +392,14 @@ function createAuthBrokerServer(config) {
                 }
                 // Caddy forward_auth (via oauth2-proxy) sets X-Auth-Request-Email after the user
                 // logs in with Google. The authorize endpoint is gated behind forward_auth in the
-                // Caddyfile so this header is always present when the request reaches the broker.
-                const userEmail = (req.headers['x-auth-request-email'] || '').trim().toLowerCase();
+                // Caddyfile so this header is always present when the request reaches the broker —
+                // but a caller that reaches the broker DIRECTLY can set it too, which is why the
+                // proxy also has to prove who it is.
+                const userEmail = proxyAssertedEmail(req);
+                if (userEmail === null) {
+                    rejectForgedProxyHeader(res, ip, pathname);
+                    return;
+                }
                 if (!userEmail) {
                     sendJson(res, 401, { error: 'unauthorized', error_description: 'No authenticated user (missing X-Auth-Request-Email)' });
                     return;
@@ -335,7 +425,11 @@ function createAuthBrokerServer(config) {
                 // (same as /oauth/authorize) — X-Auth-Request-Email is only set once Google login
                 // completes. Federated agent services never hit this path (they have no oauth2-proxy),
                 // so it 401s there, which is correct.
-                const userEmail = (req.headers['x-auth-request-email'] || '').trim().toLowerCase();
+                const userEmail = proxyAssertedEmail(req);
+                if (userEmail === null) {
+                    rejectForgedProxyHeader(res, ip, pathname);
+                    return;
+                }
                 if (!userEmail) {
                     sendJson(res, 401, { error: 'unauthorized', error_description: 'No authenticated user (missing X-Auth-Request-Email)' });
                     return;
@@ -508,6 +602,21 @@ function createAuthBrokerServer(config) {
                 // Set X-Agent-User so Caddy's forward_auth can copy the validated identity
                 // into the upstream request without serve needing its own JWT validation.
                 res.setHeader('X-Agent-User', user.email || user.id);
+                // …and the ASSERTION alongside the identifier (PLAN/agent-identity.md §8.5 G1).
+                // The identifier alone is all the edge forwarded until now, so an edge-registered
+                // turn carried no `inboundToken`: `passthrough` failed closed on every tool call
+                // and an RFC 8693 `exchange` provider had no subject_token. This is the same
+                // token this request just verified — the browser (cookie) lane has no
+                // Authorization header for the edge to relay, so it has to come from here.
+                //
+                // Not a new exposure: whatever presented this token — Bearer header or cookie —
+                // is already on the request Caddy proxies to the agent. What changes is that the
+                // connector sidecar can now reach it, which is the whole point.
+                const presented = (0, jwt_js_1.extractBearerToken)(req.headers.authorization)
+                    || extractCookieToken(req.headers.cookie, resolved.cookieName);
+                if (presented) {
+                    res.setHeader('X-Agent-User-Assertion', presented);
+                }
                 sendJson(res, 200, store.buildMe(user));
                 return;
             }
@@ -519,20 +628,6 @@ function createAuthBrokerServer(config) {
                 sendJson(res, 200, store.buildBootstrap(user));
                 return;
             }
-            if (req.method === 'POST' && pathname === '/api/ide/bootstrap/refresh') {
-                if (!user) {
-                    sendJson(res, 401, { error: 'unauthorized' });
-                    return;
-                }
-                const routing = store.refreshRoutingCredentials();
-                sendJson(res, 200, {
-                    routing: {
-                        litellmBaseUrl: resolved.team.litellmBaseUrl,
-                        ...routing,
-                    },
-                });
-                return;
-            }
             if (req.method === 'POST' && pathname === '/api/ide/signout') {
                 if (user) {
                     store.revokeRefreshTokensForUser(user.id);
@@ -572,9 +667,14 @@ function createAuthBrokerServer(config) {
 }
 async function startAuthBrokerServer(config) {
     const broker = createAuthBrokerServer(config);
-    const bind = process.env.AGENTHIPPO_AUTH_BIND?.trim() || '0.0.0.0';
+    const bind = (0, config_js_1.resolveAuthBrokerBind)();
+    if (bind.isPublic) {
+        console.warn(`[auth-broker] WARNING: listening on ${bind.address}:${broker.config.port} — this ` +
+            `token-issuing endpoint is reachable from off-host (AGENTHIPPO_AUTH_ALLOW_PUBLIC_BIND=1). ` +
+            `Ensure only the reverse proxy can reach it and that AGENTHIPPO_AUTH_PROXY_SECRET is set.`);
+    }
     await new Promise((resolve, reject) => {
-        broker.server.listen(broker.config.port, bind, () => resolve());
+        broker.server.listen(broker.config.port, bind.address, () => resolve());
         broker.server.once('error', reject);
     });
     return broker;