@agenthippo-ai/agenthippo 0.2.3-dataplane → 1.110.11

package/out/cli/index.js

@@ -75,6 +75,7 @@ const commander_1 = require("commander");
 const chat_1 = require("./commands/chat");
 const ask_1 = require("./commands/ask");
 const serve_1 = require("./commands/serve");
+const data_plane_1 = require("./commands/data-plane");
 const auth_broker_1 = require("./commands/auth-broker");
 const deploy_1 = require("./commands/deploy");
 const idp_1 = require("./commands/idp");
@@ -86,7 +87,36 @@ const probe_custom_engine_1 = require("./commands/probe-custom-engine");
 const deps_1 = require("./deps");
 const branding_1 = require("../branding");
 const agentEnvFile_1 = require("../utils/agentEnvFile");
-const VERSION = '1.110.8';
+const caps_1 = require("../pack/caps");
+/**
+ * `--max-concurrent-sandboxes`, honouring the deprecated `--max-concurrent-cells`.
+ *
+ * The current spelling wins outright when both are given; the old one is honoured with a loud
+ * notice rather than dropped, because dropping it would silently REMOVE a blast-radius cap from a
+ * deployment that believes it still has one.
+ */
+function resolveMaxConcurrentSandboxes(options) {
+    const current = parseInt(options.maxConcurrentSandboxes ?? '', 10);
+    if (Number.isFinite(current) && current > 0) {
+        return current;
+    }
+    const legacy = parseInt(options.maxConcurrentCells ?? '', 10);
+    if (Number.isFinite(legacy) && legacy > 0) {
+        console.warn(`Warning: --max-concurrent-cells is DEPRECATED; use ${caps_1.DEPRECATED_CAP_SPELLINGS['--max-concurrent-cells']}. Honouring it for now.`);
+        return legacy;
+    }
+    return undefined;
+}
+/** Single source: extensions/agentide/package.json (bundled into the compiled CLI by Bun). */
+function resolveCliVersion() {
+    try {
+        return require('../../package.json').version ?? 'dev';
+    }
+    catch {
+        return 'dev';
+    }
+}
+const VERSION = resolveCliVersion();
 const CLI_DESCRIPTION = [
     `${branding_1.AGENTIDE_BRAND_NAME} CLI - Run agent packs from the command line`,
     '',
@@ -102,14 +132,22 @@ const CLI_DESCRIPTION = [
     '  AGENTHIPPO_STORE_REPO        Override store GitHub repo (owner/repo; CLI store commands)',
     '',
     'Quickstart:',
-    `  AGENTHIPPO_LITELLM_BASE_URL="http://localhost:4000" AGENTHIPPO_LITELLM_API_KEY="dummy" AGENTHIPPO_DEFAULT_MODEL="litellm/gpt-5.3-codex" AGENTHIPPO_DEFAULT_ENGINE="codex" ${branding_1.AGENTIDE_CLI_NAME} ask "Reply with exactly: CLI_TEST_OK"`,
+    `  AGENTHIPPO_LITELLM_BASE_URL="http://localhost:4000" AGENTHIPPO_LITELLM_API_KEY="dummy" AGENTHIPPO_DEFAULT_MODEL="litellm/gpt-5.5" AGENTHIPPO_DEFAULT_ENGINE="codex" ${branding_1.AGENTIDE_CLI_NAME} ask "Reply with exactly: CLI_TEST_OK"`,
     '',
     'Agent Packs:',
     `  Loaded from ~/${branding_1.AGENTIDE_DIR_NAME}/agents/<name>/ or absolute/relative paths.`,
     '  Pack permissions control filesystem access scope.',
 ].join('\n');
 const program = new commander_1.Command();
-program.hook('preAction', async () => {
+program.hook('preAction', async (_thisCommand, actionCommand) => {
+    // A SANDBOX must never absorb ambient credentials. Every other command merges ~/.agent-hippo/.env
+    // as a convenience, but doing that inside a sandbox would silently hand the sandboxed engine
+    // every key on the host — defeating the driver's curated env allowlist (observed live: the
+    // cursor engine picked up CURSOR_API_KEY this way). A sandbox receives only what its driver
+    // explicitly passes.
+    if (actionCommand?.name() === 'sandbox') {
+        return;
+    }
     await (0, agentEnvFile_1.mergeAgentHomeEnvIntoProcessEnv)();
 });
 program
@@ -126,7 +164,7 @@ program
     .description('Start interactive chat session')
     .option('-a, --agent <name>', 'Agent pack to use')
     .option('-e, --engine <id>', 'Override pack engine: claude|codex|<custom-engine-id>')
-    .option('-m, --model <id>', 'Override pack model (e.g. litellm/gpt-4.1-nano)')
+    .option('-m, --model <id>', 'Override pack model (e.g. litellm/gpt-5.6-luna)')
     .option('-w, --workspace <path>', 'Workspace directory', process.cwd())
     .action(async (options) => {
     const verbose = program.opts().verbose;
@@ -145,7 +183,7 @@ program
     .description('Send a single message and exit')
     .option('-a, --agent <name>', 'Agent pack to use')
     .option('-e, --engine <id>', 'Override pack engine: claude|codex|<custom-engine-id>')
-    .option('-m, --model <id>', 'Override pack model (e.g. litellm/gpt-4.1-nano)')
+    .option('-m, --model <id>', 'Override pack model (e.g. litellm/gpt-5.6-luna)')
     .option('-w, --workspace <path>', 'Workspace directory', process.cwd())
     .option('-f, --file <path>', 'Include file content in context')
     .option('--json', 'Output as JSON')
@@ -176,7 +214,7 @@ program
     .requiredOption('--prompt <message>', 'Prompt text')
     .option('--pack <name>', 'Agent pack to use')
     .option('-e, --engine <id>', 'Override pack engine: claude|codex|<custom-engine-id>')
-    .option('-m, --model <id>', 'Override pack model (e.g. litellm/gpt-4.1-nano)')
+    .option('-m, --model <id>', 'Override pack model (e.g. litellm/gpt-5.6-luna)')
     .option('-w, --workspace <path>', 'Workspace directory', process.cwd())
     .option('--session-id <id>', 'Optional session id for the caller')
     .option('--system-prompt <text>', 'Optional system prompt override')
@@ -204,7 +242,7 @@ program
     .description('Start HTTP server')
     .requiredOption('-a, --agent <name>', 'Agent pack to use (required)')
     .option('-e, --engine <id>', 'Override pack engine: claude|codex|<custom-engine-id>')
-    .option('-m, --model <id>', 'Override pack model (e.g. litellm/gpt-4.1-nano)')
+    .option('-m, --model <id>', 'Override pack model (e.g. litellm/gpt-5.6-luna)')
     .option('-p, --port <port>', 'Port to listen on', '3000')
     .option('--host <address>', 'Address to bind the HTTP server (default 127.0.0.1; use 0.0.0.0 in containers/behind a proxy)')
     .option('-w, --workspace <path>', 'Default workspace directory', process.cwd())
@@ -213,18 +251,56 @@ program
     .option('--state-dir <path>', 'Persist session state here (honors AGENTHIPPO_HOME; replaces the tmpdir default)')
     .option('--max-turns-per-session <n>', 'Cap turns per session (abuse/runaway guard); 0 = unlimited', '0')
     .option('--www-dir <path>', 'Serve deploy/www/index.html at GET / (static browser chat UI)')
-    // Deprecated no-ops: kept so deploy artifacts generated by older CLIs (which baked these
-    // into the serve command line) don't crash with "unknown option" after a runtime upgrade.
-    // Serve now trusts its front proxy for auth/CORS; these flags no longer do anything.
-    .option('--production', 'Deprecated: no-op (serve trusts its front proxy; hardening moved to the deploy edge)')
-    .option('--cors-origin <origins>', 'Deprecated: no-op (CORS is handled by the front proxy)')
+    .option('--sandbox <mode>', 'Run each session\'s engine in a sandbox: process (tier 0, no boundary) or container (tier 2, one disposable container per session with only its declared routes). Unset = in-process (default, unchanged)')
+    .option('--sandbox-image <ref>', '--sandbox container: sandbox image pinned BY DIGEST (image@sha256:...)')
+    .option('--sandbox-scope <scope>', '--sandbox: what one sandbox holds — session (default, one per conversation) or user (one per verified user on this instance, so their sessions share a container, workspace, TTL and kill). Unidentified callers get one each either way')
+    .option('--pull-packs', 'Fetch the version the lease pins from the store instead of only refusing others. Always verifies the signature; a fetch or verification failure keeps serving the current version')
+    .option('--require-signed-pack', 'Refuse to start a sandbox unless the pack is signed by a trusted key (the lease may also require this; neither side can waive the other). Now the DEFAULT — kept so existing invocations still mean something')
+    .option('--allow-unsigned-pack', 'LOCAL DEVELOPMENT ONLY: run a pack this instance cannot verify. Signature checking is required by default; this disables it and warns loudly on every boot. A lease that sets requireSignedPack still overrides it')
+    .option('--require-signed-lease', 'Refuse to act on a lease that is not signed (ES256 compact JWS) by a trusted key. Tighten-only with lease.requireSignedLease, and sticky once a signed lease has been seen')
+    .option('--lease-max-staleness <seconds>', 'Refuse turns after this long with no successful lease refresh, so network denial cannot hold a revoked fleet open (default 86400; 0 disables)')
+    .option('--sandbox-ttl <seconds>', '--sandbox: reap an idle sandbox after N seconds; the next message recreates it and resumes the session', '1800')
+    .option('--shared-workspace', '--sandbox container: mount ONE workspace into every session\'s sandbox (default: one per session). Sessions can then read and overwrite each other\'s files — only for a single trust domain')
+    // Control plane (serve-v4-clean §5). Caps are enforced by revoking a sandbox's routes, so they
+    // need --sandbox; a lease may impose tighter values than these, and never looser ones.
+    .option('--max-session-seconds <seconds>', '--sandbox: cap one session\'s wall-clock lifetime; a breach revokes or destroys its sandbox')
+    .option('--max-concurrent-sandboxes <n>', '--sandbox: cap live sandboxes on this instance (blast radius)')
+    // Deprecated pre-rename spelling. Hidden so it does not advertise itself, honoured so an
+    // existing deployment does not silently lose its cap, and loud so it gets migrated.
+    .addOption(new commander_1.Option('--max-concurrent-cells <n>', 'DEPRECATED alias for --max-concurrent-sandboxes').hideHelp())
+    .option('--cap-on-breach <action>', '--sandbox: what a cap breach does — revoke-inference (default) or destroy-sandbox. An unrecognised value fails CLOSED to destroy-sandbox')
+    .option('--lease-poll <seconds>', '--sandbox: how often to re-check the lease, so a kill switch stops RUNNING sandboxes. Worst-case kill latency is 2x this (poll + cache); an admin refresh is immediate', '30')
     .action(async (options) => {
-    if (options.production || options.corsOrigin) {
-        console.warn('[serve] --production/--cors-origin are deprecated no-ops; auth and CORS are enforced by the deploy edge proxy.');
-    }
     const verbose = program.opts().verbose;
     await (0, deps_1.ensureDeps)(verbose);
     await (0, serve_1.serveCommand)({
+        sandbox: options.sandbox === 'container' ? 'container' : options.sandbox === 'process' ? 'process' : undefined,
+        sandboxImage: options.sandboxImage,
+        // Anything but an explicit `user` means session scope: an unrecognised value must not
+        // quietly widen what a sandbox holds.
+        sandboxScope: options.sandboxScope === 'user' ? 'user' : 'session',
+        requireSignedPack: Boolean(options.requireSignedPack),
+        allowUnsignedPack: Boolean(options.allowUnsignedPack),
+        requireSignedLease: Boolean(options.requireSignedLease),
+        leaseMaxStalenessSeconds: options.leaseMaxStaleness !== undefined
+            ? (Number.isFinite(Number(options.leaseMaxStaleness)) ? Number(options.leaseMaxStaleness) : undefined)
+            : undefined,
+        pullPacks: Boolean(options.pullPacks),
+        sandboxTtlSeconds: parseInt(options.sandboxTtl, 10) || undefined,
+        sharedWorkspace: Boolean(options.sharedWorkspace),
+        maxSessionSeconds: parseInt(options.maxSessionSeconds, 10) || undefined,
+        maxConcurrentSandboxes: resolveMaxConcurrentSandboxes(options),
+        // Shared with the env path (pack/caps.ts) so a value that is valid in one is valid in the
+        // other. An unrecognised action no longer becomes `undefined` — which mergeCaps then
+        // defaulted to the WEAKER revoke-inference, silently downgrading what the operator typed.
+        capOnBreach: (() => {
+            const r = (0, caps_1.resolveOnBreach)(options.capOnBreach, '--cap-on-breach');
+            for (const w of r.warnings) {
+                console.warn(`Warning: ${w}`);
+            }
+            return r.action;
+        })(),
+        leasePollSeconds: parseInt(options.leasePoll, 10) || undefined,
         agent: options.agent,
         engine: options.engine,
         model: options.model,
@@ -239,6 +315,70 @@ program
         verbose,
     });
 });
+// Conformance — the deployment proves its own claims (serve-v4-clean.md §11 step 5).
+program
+    .command('conformance')
+    .description('Probe a deployment against its own claims: credential confinement, isolation tier, cost-cap binding, warrant integrity, rollback/kill switch. Exit 1 on any failure, 2 when no deployment was probed (--sandbox/--tier omitted) — only exit 0 means a real deployment was measured.')
+    .option('--sandbox <id>', 'Running sandbox container id/name — required to probe INSIDE a sandbox')
+    .option('--tier <n>', 'Declared isolation tier (0-3); probed, not trusted')
+    .option('--runtime <bin>', 'Container runtime binary', 'docker')
+    .option('--json', 'Emit JSON')
+    .action(async (options) => {
+    const { conformanceCommand } = await import('./commands/conformance.js');
+    const code = await conformanceCommand({
+        sandbox: options.sandbox,
+        tier: options.tier === undefined ? undefined : parseInt(options.tier, 10),
+        runtime: options.runtime,
+        json: Boolean(options.json),
+    });
+    process.exitCode = code;
+});
+// Sandbox runner — runs INSIDE a sandbox; holds no credential (serve-v4-clean.md §3).
+program
+    .command('sandbox')
+    .description('Run the in-sandbox engine host (sandbox runner). Speaks the frame protocol to serve over a unix socket or stdio; holds no data or model credential.')
+    .requiredOption('-a, --agent <path>', 'Pack directory mounted into the sandbox')
+    .option('--socket <path>', 'Unix socket to listen on (container driver)')
+    .option('--stdio', 'Speak the protocol on stdin/stdout instead (process driver)')
+    // No default: it must fall back to <state-dir>/workspace inside the command, or a
+    // host-launched sandbox (where --state-dir is a real host path) inherits the container-image
+    // path and dies on mkdir.
+    .option('-w, --workspace <path>', 'Workspace directory (default: <state-dir>/workspace)')
+    .option('--state-dir <path>', 'State directory', '/state')
+    .option('--sandbox-id <id>', 'Sandbox id (joins evidence records)')
+    .action(async (options) => {
+    const { sandboxCommand } = await import('./commands/sandbox.js');
+    await sandboxCommand({
+        agent: options.agent,
+        socket: options.socket,
+        stdio: Boolean(options.stdio),
+        workspace: options.workspace,
+        stateDir: options.stateDir,
+        sandboxId: options.sandboxId,
+    });
+});
+program
+    .command('data-plane')
+    .description('Run the connector as a sidecar (holds the backend base credential; the agent container does not)')
+    .requiredOption('-a, --agent <name>', 'Agent pack (reads spec.dataPlane connector + provider)')
+    .option('-w, --workspace <path>', 'Workspace directory', process.cwd())
+    .option('--gateway-port <port>', 'Port the engine dials (nonce-auth MCP)', '9090')
+    .option('--control-port <port>', 'Port serve dials to register turns (bearer-auth)', '9091')
+    .option('--host <address>', 'Bind address (default 0.0.0.0 for the pod network)')
+    .option('--state-dir <path>', 'Where data-plane audit events are written. Same precedence as serve: --state-dir, then AGENTHIPPO_HOME, then tmpdir')
+    .action(async (options) => {
+    const verbose = program.opts().verbose;
+    await (0, deps_1.ensureDeps)(verbose);
+    await (0, data_plane_1.dataPlaneSidecarCommand)({
+        agent: options.agent,
+        workspace: options.workspace,
+        gatewayPort: parseInt(options.gatewayPort, 10),
+        controlPort: parseInt(options.controlPort, 10),
+        host: options.host,
+        stateDir: options.stateDir,
+        verbose,
+    });
+});
 program
     .command('auth-broker')
     .description('Start the AgentHippo auth broker (OAuth + IDE bootstrap API)')
@@ -262,6 +402,7 @@ program
     .option('--idp-url <url>', 'edge-fed: central IdP base URL browsers redirect to for login (e.g. https://auth.agenthippo.ai)', 'https://auth.agenthippo.ai')
     .option('--cookie-domain <domain>', 'edge-fed: parent domain the shared auth cookie is scoped to (e.g. .agenthippo.ai)', '.agenthippo.ai')
     .option('--colocate', 'edge-fed + vm/compose only: ride the org IdP\'s already-running Caddy + auth-broker instead of shipping this agent\'s own (PLAN/deploy.md §4 state 4)')
+    .option('--edge-turn-connector <addr>', 'EDGE turn registration (P1 fix): connector sidecar control-API address (e.g. mypack-connector:9091); the generated route registers each chat turn via forward_auth /edge/turn and copies X-Agent-Turn-Nonce — the agent container never holds the register token')
     .option('--model-routing <mode>', 'Cloud Run + edge-fed: sidecar (in-pod LiteLLM+OTEL, default) or gateway (agent → gateway.agenthippo.ai directly, lean)')
     .option('--force', 'Overwrite existing files')
     .action(async (action, pack, options) => {
@@ -283,6 +424,7 @@ program
         cookieDomain: options.cookieDomain,
         colocate: Boolean(options.colocate),
         modelRouting,
+        edgeTurnConnector: options.edgeTurnConnector,
     });
 });
 // IdP command - generate the central IdP stack (org identity infra, set up once)
@@ -304,16 +446,28 @@ program
 // Pack command - pack management
 program
     .command('pack <action>')
-    .description('Manage agent packs (list, validate, install)')
+    .description('Manage agent packs (list, validate, sign, verify, digest, keygen, install)')
     .argument('[name]', 'Pack name or path')
-    .option('-o, --output <path>', 'Output path for export')
+    .option('-o, --output <path>', 'Output path for export, or for a generated signing key')
+    .option('--key <path>', 'pack sign: PEM file holding the ES256 private key')
+    .option('--kid <id>', 'pack sign/keygen: key id published in JWKS so verifiers can find the public half')
+    .option('--keys <path>', 'pack verify: JSON file of kid -> public PEM')
+    .option('--jwks <url>', 'pack verify: JWKS endpoint to fetch public halves from')
+    .option('--to <dir>', 'pack install: destination folder (flat layout for serve/deploy)')
+    .option('-f, --force', 'pack install: overwrite an existing folder')
     .option('-w, --workspace <path>', 'Workspace directory for local packs', process.cwd())
     .action(async (action, name, options) => {
     await (0, pack_1.packCommand)({
         action,
         name,
         output: options.output,
+        to: options.to,
+        force: options.force,
         workspace: options.workspace,
+        key: options.key,
+        kid: options.kid,
+        keys: options.keys,
+        jwks: options.jwks,
         verbose: program.opts().verbose,
     });
 });

package/out/cli/pack-install-ref.js

@@ -0,0 +1,15 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parsePackInstallRef = parsePackInstallRef;
+/** Parse `slug` or `slug@version` from `pack install` positional arg. */
+function parsePackInstallRef(name) {
+    const trimmed = name.trim();
+    const at = trimmed.lastIndexOf('@');
+    if (at > 0) {
+        return { slug: trimmed.slice(0, at), version: trimmed.slice(at + 1) || undefined };
+    }
+    return { slug: trimmed };
+}

package/out/cli/pack-loader.js

@@ -373,7 +373,14 @@ function getApiConfig() {
     const litellmBaseUrl = getEnvVar('AGENTHIPPO_LITELLM_BASE_URL', 'AGENTIDE_LITELLM_BASE_URL');
     const anthropicApiKey = process.env.ANTHROPIC_API_KEY || process.env.CLAUDE_API_KEY;
     const openaiApiKey = process.env.OPENAI_API_KEY;
-    const useLiteLLM = Boolean(litellmApiKey && litellmBaseUrl);
+    // The URL alone defines the trust domain. When a LiteLLM/gateway URL is configured, ALL
+    // engine traffic routes there — so it must authenticate with the LiteLLM key (or
+    // resolveApiRouting's 'sk-dummy' fallback), NEVER a provider secret, and must carry the
+    // analytics metadata headers. Requiring key+URL here once created a silent half-state:
+    // URL-only routed every call to the gateway with the REAL provider key as auth and no
+    // metadata at all (verified live 2026-07-27 with a header-capture stub). A missing key now
+    // yields a clean 401 against a strict gateway instead of a leaked credential.
+    const useLiteLLM = Boolean(litellmBaseUrl);
     return {
         // Kept only for the "is any credential present at all?" boot check; routing never uses it.
         apiKey: litellmApiKey || anthropicApiKey || openaiApiKey,

package/out/cli/pack-runtime.js

@@ -0,0 +1,61 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createPackRunner = createPackRunner;
+/**
+ * One way to stand up a `HeadlessRunner` for an agent pack.
+ *
+ * `serve` and `sandbox` run the SAME engines against the SAME pack; the only difference is where
+ * the process sits. Every time the sandbox re-derived a piece of that setup itself it drifted from
+ * serve and broke live (the hand-rolled agent.yaml parser, the engine executable paths, the
+ * skipped `ensureDeps`). So the wiring lives here once and both call it: engine discovery,
+ * bundled prompts, the child env patch, and the credential shape.
+ *
+ * What is NOT here is deliberately not shared: credentials are the caller's business. serve
+ * holds provider keys; a sandbox only ever gets a per-sandbox, budget-capped model token that arrives
+ * on the run frame. Both express that through `credentials`, and nothing in this module can
+ * widen it.
+ */
+const headless_1 = require("../headless");
+const runtime_1 = require("./runtime");
+const utils_1 = require("./utils");
+/**
+ * Build the runner. Engine executables are resolved here rather than by the SDKs themselves:
+ * the engines ship WITH agenthippo, and a runtime image does not carry the SDK's own bundled
+ * cli.js — without these paths every turn inside a sandbox fails with "executable not found".
+ */
+function createPackRunner(options) {
+    return (0, headless_1.createHeadlessRunner)({
+        storagePath: options.storagePath,
+        analyticsSessionsDir: options.analyticsSessionsDir,
+        packId: options.packId,
+        packVersion: options.packVersion,
+        provenance: options.provenance,
+        bundledPromptsDir: (0, utils_1.findBundledBasePromptsDir)(),
+        apiKey: options.credentials.apiKey,
+        baseUrl: options.credentials.baseUrl,
+        useLiteLLM: options.credentials.useLiteLLM,
+        litellmApiKey: options.credentials.litellmApiKey,
+        openaiApiKey: options.credentials.openaiApiKey,
+        anthropicApiKey: options.credentials.anthropicApiKey,
+        logger: options.logger,
+        freshState: options.freshState ?? false,
+        claudeCodeExecutablePath: (0, utils_1.findClaudeCodePath)(),
+        codexExecutablePath: (0, utils_1.findCodexPath)(),
+        permissionHandler: options.permissionHandler,
+        // Gives engine children AGENTHIPPO_WORKSPACE_ROOT / AGENTHIPPO_ACTIVE_AGENT and puts the
+        // agenthippo binary on their PATH — without it a pack skill that shells out to the CLI
+        // cannot find it, which is exactly the kind of silent difference a sandbox must not have.
+        cliEnvPatch: (0, runtime_1.buildCliEnvPatch)({
+            cliPath: process.execPath,
+            workspaceRoot: options.workspaceRoot,
+            agentId: options.packId,
+            chatSessionId: options.chatSessionId,
+            baseEnv: process.env,
+            omitGatewayToken: options.omitGatewayToken,
+        }),
+        ...(options.claudeCheapModel ? { engineSettings: { claudeCheapModel: options.claudeCheapModel } } : {}),
+    });
+}

package/out/cli/runtime.js

@@ -42,6 +42,8 @@ exports.getBundledToolsHealth = getBundledToolsHealth;
 exports.getCliHealth = getCliHealth;
 exports.buildSessionEnvPatch = buildSessionEnvPatch;
 exports.buildCliEnvPatch = buildCliEnvPatch;
+exports.readProvenanceEnvFromProcess = readProvenanceEnvFromProcess;
+exports.buildProvenanceEnv = buildProvenanceEnv;
 exports.runCli = runCli;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
@@ -320,7 +322,7 @@ function buildCliEnvPatch(args) {
     // nonce. AGENTHIPPO_EGRESS_URL in the process env is that signal — with it set, never bake
     // the token into a child env (this closes §7.4 gap 1 for custom engines; codex/claude are
     // covered by serve stripping the token from its own process.env).
-    if (!process.env.AGENTHIPPO_EGRESS_URL?.trim()) {
+    if (!args.omitGatewayToken && !process.env.AGENTHIPPO_EGRESS_URL?.trim()) {
         const gatewayToken = readOpenClawGatewayToken(args.baseEnv);
         if (gatewayToken) {
             env[exports.OPENCLAW_GATEWAY_TOKEN_ENV] = gatewayToken;
@@ -368,6 +370,38 @@ function buildCliEnvPatch(args) {
     }
     return env;
 }
+/** Read provenance stamp env vars injected into sandbox children by serve. */
+function readProvenanceEnvFromProcess() {
+    const pick = (key) => process.env[key]?.trim() || undefined;
+    const tierRaw = pick('AGENTIDE_ANALYTICS_TIER');
+    const tier = tierRaw !== undefined ? Number(tierRaw) : undefined;
+    return {
+        policyVersion: pick('AGENTIDE_ANALYTICS_POLICY_VERSION'),
+        packDigest: pick('AGENTIDE_ANALYTICS_PACK_DIGEST'),
+        engineVersion: pick('AGENTIDE_ANALYTICS_ENGINE_VERSION'),
+        tier: tier !== undefined && Number.isFinite(tier) ? tier : undefined,
+        instanceId: pick('AGENTIDE_ANALYTICS_INSTANCE_ID'),
+    };
+}
+function buildProvenanceEnv(stamp) {
+    const env = {};
+    if (stamp.policyVersion?.trim()) {
+        env.AGENTIDE_ANALYTICS_POLICY_VERSION = stamp.policyVersion.trim();
+    }
+    if (stamp.packDigest?.trim()) {
+        env.AGENTIDE_ANALYTICS_PACK_DIGEST = stamp.packDigest.trim();
+    }
+    if (stamp.engineVersion?.trim()) {
+        env.AGENTIDE_ANALYTICS_ENGINE_VERSION = stamp.engineVersion.trim();
+    }
+    if (stamp.tier !== undefined) {
+        env.AGENTIDE_ANALYTICS_TIER = String(stamp.tier);
+    }
+    if (stamp.instanceId?.trim()) {
+        env.AGENTIDE_ANALYTICS_INSTANCE_ID = stamp.instanceId.trim();
+    }
+    return env;
+}
 async function runCli(binaryPath, args, opts) {
     return await new Promise((resolve, reject) => {
         const child = (0, child_process_1.spawn)(binaryPath, args, {