@agenthippo-ai/agenthippo 0.2.3-dataplane → 1.110.11

package/out/cli/commands/data-plane.js

@@ -0,0 +1,151 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createDataPlaneAuditSink = createDataPlaneAuditSink;
+exports.dataPlaneSidecarCommand = dataPlaneSidecarCommand;
+/**
+ * `agenthippo data-plane` — run the connector as a SIDECAR (secure-obo-design §7.6).
+ *
+ * This process is the connector's own trust domain: it holds the backend BASE credential
+ * (AWS keys, Postgres pool login, …) and runs in a SEPARATE container from the engine. The
+ * agent container's `serve` registers turns with this sidecar's authenticated control API and
+ * never sees the base credential.
+ */
+const fs_1 = require("fs");
+const pack_loader_1 = require("../pack-loader");
+const data_plane_1 = require("../data-plane");
+const serve_hardening_1 = require("../serve-hardening");
+const sessionEvents_1 = require("../../analytics/sessionEvents");
+const identity_1 = require("../../analytics/identity");
+const base_1 = require("../../engines/base");
+const headless_1 = require("../../headless");
+const utils_1 = require("../utils");
+/**
+ * Build the sidecar's audit sink.
+ *
+ * Until this existed the sidecar passed no `audit` to `startDataPlaneSidecar`, and since every
+ * emit site in the data plane is `opts.audit?.(…)` the entire trust-boundary record —
+ * `tool_authorize`, `tool_deny`, `sidecar_register_reject`, `sidecar_edge_register` — was
+ * discarded in sidecar and edge mode: the two shapes the blueprints actually deploy. The
+ * "which user touched which rows" claim had no writer exactly where it was being made.
+ *
+ * `ok: false` means the directory could not be prepared. The caller decides what that costs,
+ * using the existing AGENTHIPPO_EVIDENCE_REQUIRED contract rather than a new knob.
+ */
+async function createDataPlaneAuditSink(stateDirOpt, 
+/**
+ * The pack THIS sidecar loaded — stamped onto every row so evidence answers "via which agent",
+ * not only "for which user" (PLAN/agent-identity.md §1 failure 3).
+ *
+ * There is no digest here on purpose: the sidecar does not verify a signature (`pack-loader.ts`
+ * has no signature code), so claiming one would dress an unverified read as an attestation.
+ * What serve ASSERTS about the pack arrives separately, per turn, via the register payload —
+ * and the two being different is the §4.4 detection.
+ */
+agent) {
+    const { dir: stateDir, ephemeral } = (0, serve_hardening_1.resolveStateDir)(stateDirOpt);
+    const auditDir = (0, serve_hardening_1.resolveAnalyticsSessionsDir)(stateDir, ephemeral);
+    let ok = true;
+    let error;
+    // Preflight, rather than discovering it on the first denied tool call.
+    try {
+        await fs_1.promises.mkdir(auditDir, { recursive: true });
+        await fs_1.promises.access(auditDir);
+    }
+    catch (err) {
+        ok = false;
+        error = err instanceof Error ? err.message : String(err);
+    }
+    const writer = new sessionEvents_1.SessionEventWriter(auditDir);
+    const audit = (sessionKey, event, fields) => {
+        // Pseudonymise identity before it lands, matching the tool-event lane
+        // (ObservableStreamEmitter → hashIdentity). These records ship wholesale to the evidence
+        // server, so a raw address here leaves the machine; hashIdentity honours the operator's
+        // AGENTHIPPO_EVIDENCE_RAW_IDS / _ID_SALT choices so this lane makes the same trade as
+        // every other producer rather than a private one.
+        const rawUser = typeof fields.userId === 'string' ? fields.userId : undefined;
+        const anonUser = (0, identity_1.hashIdentity)(rawUser);
+        const safeFields = anonUser ? { ...fields, userId: anonUser } : fields;
+        // In EDGE mode the sidecar registers with `sessionKey: userId` (sidecar.ts:97), so the
+        // session key IS the identity and would otherwise become the evidence FILENAME —
+        // `alice@corp.com.jsonl`. Hash it the same way when, and only when, it is exactly the
+        // identity; a genuine session key is left alone so it still joins across lanes.
+        const safeSession = anonUser && sessionKey === rawUser ? anonUser : sessionKey;
+        void writer.append(safeSession, (0, base_1.generateRequestId)(), event, agent ? { ...safeFields, agent: { ...agent, digest: null } } : safeFields);
+    };
+    return { audit, auditDir, ephemeral, ok, error };
+}
+async function dataPlaneSidecarCommand(options) {
+    const registerToken = process.env.AGENTHIPPO_DATA_PLANE_TOKEN?.trim();
+    if (!registerToken) {
+        console.error('Error: AGENTHIPPO_DATA_PLANE_TOKEN is required (shared secret the trusted EDGE — or, legacy, the agent\'s serve — presents to register turns).');
+        process.exit(1);
+    }
+    let pack;
+    try {
+        pack = await (0, pack_loader_1.loadAgentPack)(options.agent, options.workspace);
+    }
+    catch (err) {
+        console.error(`Error: ${err instanceof Error ? err.message : err}`);
+        process.exit(1);
+        return;
+    }
+    const cfg = (0, data_plane_1.resolveDataPlaneConfig)(pack.manifest.spec, pack.packPath);
+    if (!cfg) {
+        console.error('Error: pack declares no spec.dataPlane — nothing for the sidecar to run.');
+        process.exit(1);
+        return;
+    }
+    const logger = options.verbose ? new headless_1.ConsoleLogger('[Sidecar]') : new headless_1.NoOpLogger();
+    const { audit: auditEvent, auditDir, ephemeral, ok: auditOk, error: auditError } = await createDataPlaneAuditSink(options.stateDir, {
+        pack: pack.manifest.metadata.name,
+        version: pack.manifest.metadata.version ?? '0.0.0',
+    });
+    if (!auditOk) {
+        const detail = `${auditDir}: ${auditError}`;
+        // The existing AGENTHIPPO_EVIDENCE_REQUIRED contract decides what an unwritable sink
+        // costs — no new knob, and it already means "a hole in the record must fail the turn".
+        if ((0, sessionEvents_1.evidenceRequired)()) {
+            console.error(`${utils_1.COLORS.red}Error: data-plane audit directory is not writable${utils_1.COLORS.reset} — ${detail}`);
+            console.error(`AGENTHIPPO_EVIDENCE_REQUIRED is set, so refusing to run an unauditable data plane. Unset it to downgrade this to a warning.`);
+            process.exit(1);
+            return;
+        }
+        console.warn(`${utils_1.COLORS.yellow}Warning:${utils_1.COLORS.reset} data-plane audit directory is not writable — ${detail}`);
+        console.warn('  Tool authorizations and denials will NOT be recorded. Set --state-dir or AGENTHIPPO_HOME to a writable path.');
+    }
+    let sidecar;
+    try {
+        sidecar = await (0, data_plane_1.startDataPlaneSidecar)({
+            config: cfg,
+            registerToken,
+            gatewayPort: options.gatewayPort,
+            controlPort: options.controlPort,
+            bindHost: options.host ?? '0.0.0.0',
+            logger,
+            audit: auditEvent,
+            agent: {
+                pack: pack.manifest.metadata.name,
+                version: pack.manifest.metadata.version ?? '0.0.0',
+            },
+        });
+    }
+    catch (err) {
+        console.error(`${utils_1.COLORS.red}Error: failed to start the data-plane sidecar:${utils_1.COLORS.reset} ${err instanceof Error ? err.message : err}`);
+        process.exit(1);
+        return;
+    }
+    console.log(`OK: Data-plane sidecar (provider=${cfg.provider ?? 'passthrough'}) — connector: ${cfg.connectorPath}`);
+    console.log(`  gateway (engine dials, nonce-auth): ${sidecar.gatewayUrl}`);
+    console.log(`  control (edge/serve registers, bearer):  :${sidecar.controlPort}`);
+    console.log(`  audit (tool_authorize / tool_deny / register events): ${auditDir}${ephemeral ? ' (EPHEMERAL — lost on restart; set AGENTHIPPO_HOME or --state-dir)' : ''}`);
+    console.log('  Base credentials live here only — never in the agent container.');
+    console.log('  Edge mode (P1): give the register token to the IdP edge only; serve runs with AGENTHIPPO_DATA_PLANE_EDGE=1 and no token.');
+    const shutdown = () => { void sidecar.close().finally(() => process.exit(0)); };
+    process.on('SIGINT', shutdown);
+    process.on('SIGTERM', shutdown);
+    // Keep the process alive.
+    await new Promise(() => { });
+}

package/out/cli/commands/deploy.js

@@ -215,6 +215,7 @@ async function deployCommand(action, packArg, options) {
         cookieDomain: options.cookieDomain,
         colocate: options.colocate,
         modelRouting,
+        edgeTurnConnector: options.edgeTurnConnector?.trim() || undefined,
     };
     for (const target of targetsRequested) {
         const routingSuffix = modelRouting === 'gateway' ? '-gateway' : '';

package/out/cli/commands/gateway.js

@@ -115,6 +115,10 @@ async function gatewaySendCommand(options) {
         await sendViaEgressBroker(egressUrl, nonce, options);
         return;
     }
+    if (egressUrl) {
+        console.error('Error: egress broker is active but AGENTHIPPO_TURN_NONCE is missing — refusing direct gateway send');
+        process.exit(1);
+    }
     const storePath = resolveOutboundPath(options.outbound);
     await ensureStoreFileExists(storePath);
     const agentId = options.agent.trim();

package/out/cli/commands/pack.js

@@ -44,6 +44,10 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const pack_loader_1 = require("../pack-loader");
 const branding_1 = require("../../branding");
+const warrant_1 = require("../../authority/warrant");
+const signature_1 = require("../../pack/signature");
+const store_1 = require("./store");
+const pack_install_ref_1 = require("../pack-install-ref");
 const BANNER_LINE = '-'.repeat(62);
 async function packCommand(options) {
     const workspace = options.workspace;
@@ -65,9 +69,20 @@ async function packCommand(options) {
             }
             await showPackInfo(options.name, workspace);
             break;
+        case 'sign':
+            await signPackCommand(options);
+            break;
+        case 'verify':
+            await verifyPackCommand(options);
+            break;
+        case 'digest':
+            await digestCommand(options);
+            break;
+        case 'keygen':
+            keygenCommand(options);
+            break;
         case 'install':
-            console.log('Pack installation is not yet implemented.');
-            console.log(`   For now, manually copy your pack to ~/${branding_1.AGENTIDE_DIR_NAME}/agents/<name>/`);
+            await installPackCommand(options);
             break;
         case 'export':
             console.log('Pack export is not yet implemented.');
@@ -79,11 +94,44 @@ async function packCommand(options) {
             console.log('  list      List installed packs');
             console.log('  validate  Validate a pack');
             console.log('  info      Show pack details');
-            console.log('  install   Install a pack (coming soon)');
+            console.log('  sign      Sign a pack so a fleet can verify it before running');
+            console.log('  verify    Verify a pack against trusted public keys');
+            console.log('  digest    Print the pack content digest (what a signature covers)');
+            console.log('  keygen    Generate an ES256 signing keypair');
+            console.log('  install   Install a pack from the store to a folder');
             console.log('  export    Export a pack (coming soon)');
             process.exit(1);
     }
 }
+async function installPackCommand(options) {
+    if (!options.name?.trim()) {
+        console.error('Error: pack slug required.');
+        console.log('Usage: agenthippo pack install <slug>[@version] --to <dir>');
+        console.log('');
+        console.log('Examples:');
+        console.log('  agenthippo pack install joker1 --to ./packs/joker1');
+        console.log('  agenthippo pack install code-reviewer@1.0.0 --to ./packs/code-reviewer');
+        process.exit(1);
+    }
+    const dest = options.to?.trim();
+    if (!dest) {
+        console.error('Error: --to <dir> is required.');
+        console.log('Usage: agenthippo pack install <slug>[@version] --to <dir>');
+        console.log('');
+        console.log('Same download as `agenthippo store install pack/<slug>`, extracted flat for serve/deploy.');
+        process.exit(1);
+    }
+    const { slug, version } = (0, pack_install_ref_1.parsePackInstallRef)(options.name);
+    await (0, store_1.installFromStore)({
+        action: 'install',
+        query: `pack/${slug}${version ? `@${version}` : ''}`,
+        workspace: options.workspace,
+        version,
+        force: options.force,
+        installDir: path.resolve(dest),
+        verbose: options.verbose,
+    });
+}
 async function listPacks(workspace) {
     const packs = (0, pack_loader_1.listAvailablePacks)(workspace);
     if (packs.length === 0) {
@@ -218,3 +266,134 @@ async function showPackInfo(nameOrPath, workspace) {
         process.exit(1);
     }
 }
+// -----------------------------------------------------------------------------
+// Signing
+//
+// Publishing has to be a one-liner before `--require-signed-pack` can be turned
+// on in anger: a requirement nobody can satisfy just gets switched off again.
+// -----------------------------------------------------------------------------
+/** Resolve a pack path and its declared identity — a signature binds both, not just bytes. */
+async function loadForSigning(nameOrPath, workspace) {
+    if (!nameOrPath) {
+        console.error('Error: pack name or path required');
+        process.exit(1);
+    }
+    const packPath = (0, pack_loader_1.resolvePackPath)(nameOrPath, workspace);
+    if (!packPath) {
+        console.error(`Error: pack not found: ${nameOrPath}`);
+        process.exit(1);
+    }
+    const loaded = await (0, pack_loader_1.loadAgentPack)(packPath, workspace);
+    return {
+        packPath: loaded.packPath,
+        name: loaded.manifest.metadata.name,
+        version: loaded.manifest.metadata.version ?? '0.0.0',
+    };
+}
+function keygenCommand(options) {
+    const kid = options.kid || `sign-${new Date().toISOString().slice(0, 10)}`;
+    const key = (0, warrant_1.generateWarrantKeypair)(kid);
+    const out = options.output;
+    if (out) {
+        fs.writeFileSync(out, key.privateKeyPem, { mode: 0o600 });
+        console.log(`Private key written to ${out} (mode 0600) — keep it off shared disks.`);
+    }
+    else {
+        console.log(key.privateKeyPem);
+    }
+    console.log('');
+    console.log(`kid: ${kid}`);
+    console.log('Public half — publish this to the control plane so instances can verify:');
+    console.log(key.publicKeyPem.trim());
+    console.log('');
+    console.log(`  curl -X POST "$CONTROL/api/keys" -H 'content-type: application/json' \\`);
+    console.log(`    -d '{"kid":"${kid}","publicPem":"…"}'`);
+}
+async function signPackCommand(options) {
+    const { packPath, name, version } = await loadForSigning(options.name, options.workspace);
+    if (!options.key) {
+        console.error('Error: --key <private-key.pem> required. Generate one with: agenthippo pack keygen -o key.pem');
+        process.exit(1);
+    }
+    let privateKeyPem;
+    try {
+        privateKeyPem = fs.readFileSync(options.key, 'utf8');
+    }
+    catch (err) {
+        console.error(`Error: cannot read key ${options.key}: ${err instanceof Error ? err.message : err}`);
+        process.exit(1);
+        return;
+    }
+    const kid = options.kid;
+    if (!kid) {
+        console.error('Error: --kid <id> required — it is how a verifier finds the public half in JWKS.');
+        process.exit(1);
+    }
+    const { digest } = (0, signature_1.signPack)({ packDir: packPath, pack: name, packVersion: version, privateKeyPem, kid: kid });
+    console.log(`Signed ${name}@${version}`);
+    console.log(`  digest    ${digest}`);
+    console.log(`  key       ${kid}`);
+    console.log(`  written   ${path.join(packPath, signature_1.PACK_SIGNATURE_FILE)}`);
+    console.log('');
+    console.log('Commit pack.sig with the pack: it travels WITH the artifact, and a fleet that');
+    console.log('requires signatures refuses anything whose contents no longer match it.');
+}
+async function verifyPackCommand(options) {
+    const { packPath, name, version } = await loadForSigning(options.name, options.workspace);
+    const token = (0, signature_1.readPackSignature)(packPath);
+    if (!token) {
+        console.error(`UNSIGNED: no ${signature_1.PACK_SIGNATURE_FILE} at ${packPath}`);
+        console.error((0, signature_1.describePackRefusal)({ kind: 'unsigned', detail: `no ${signature_1.PACK_SIGNATURE_FILE}`, pack: name, packVersion: version, packDir: packPath }));
+        process.exit(1);
+    }
+    let keys = {};
+    if (options.keys) {
+        try {
+            keys = JSON.parse(fs.readFileSync(options.keys, 'utf8'));
+        }
+        catch (err) {
+            console.error(`Error: cannot read keys ${options.keys}: ${err instanceof Error ? err.message : err}`);
+            process.exit(1);
+        }
+    }
+    else {
+        const trust = await (0, signature_1.loadPackTrustRoot)({
+            env: options.jwks ? { ...process.env, [signature_1.PACK_JWKS_URL_ENV]: options.jwks } : process.env,
+            leaseUrl: process.env.AGENTHIPPO_LEASE_URL,
+        });
+        for (const w of trust.warnings) {
+            console.error(`Warning: ${w}`);
+        }
+        if (trust.status === 'unavailable') {
+            // Distinct from "no keys configured", and with a different fix. Collapsing the two into
+            // an empty keyring is finding A4 — a 503 read exactly like an unmanaged install.
+            console.error(`REFUSED: a trust root is configured but could not be loaded — ${trust.reason}`);
+            console.error((0, signature_1.describePackRefusal)({
+                kind: 'trust-root-unavailable', detail: trust.reason ?? 'unavailable', pack: name, packVersion: version,
+                packDir: packPath, trustRootHint: trust.url ? `Trust root: ${trust.url}` : undefined,
+            }));
+            process.exit(1);
+        }
+        keys = trust.keys;
+    }
+    if (Object.keys(keys).length === 0) {
+        // "No keys" is a refusal, never a pass: verifying against an empty keyring would report
+        // success for any signature at all.
+        console.error('REFUSED: no trusted public keys. Pass --keys <file>, --jwks <url>, or set AGENTHIPPO_PACK_SIGNING_KEYS.');
+        process.exit(1);
+    }
+    const res = (0, signature_1.verifyPack)(token, keys, { packDir: packPath, pack: name, packVersion: version });
+    if (!res.ok) {
+        console.error(`INVALID: ${res.reason}`);
+        console.error((0, signature_1.describePackRefusal)({ kind: res.kind, detail: res.reason, pack: name, packVersion: version, packDir: packPath }));
+        process.exit(1);
+    }
+    console.log(`OK: ${name}@${version} verified`);
+    console.log(`  digest ${res.claims.digest}`);
+    console.log(`  NOTE: .claude/, .codex/ and .agent-hippo/ ARE covered by this digest — they carry hooks`);
+    console.log('        and other executable content, and were previously outside the signature.');
+}
+async function digestCommand(options) {
+    const { packPath, name, version } = await loadForSigning(options.name, options.workspace);
+    console.log(`${(0, signature_1.computePackDigest)(packPath)}  ${name}@${version}`);
+}