@agenthippo-ai/agenthippo 0.2.3-dataplane → 1.110.9

package/out/analytics/dashboard/provider.js

@@ -2058,12 +2058,23 @@ class AnalyticsDashboardProvider {
         await fs_1.promises.mkdir(panelDir, { recursive: true });
         const webviewBasePath = this.getWebviewPath();
         const bundledDir = path.join(this.extensionContext.extensionPath, webviewBasePath);
-        // Bundled source → user destination filename
+        // Bundled source → user destination filename.
+        // panel.js is deliberately NOT seeded: getHtmlContent always loads the bundled panel.js,
+        // so a seeded copy is never executed. Writing one only created a file that looks editable,
+        // silently diverges from the bundle, and makes "my dashboard edit did nothing" reports.
         const seedMap = [
-            { bundled: 'panel.js', userFile: 'panel.js' },
             { bundled: 'styles.css', userFile: 'panel.css' },
             { bundled: 'analytics-panel.html', userFile: 'panel.html' },
         ];
+        // Explain a pre-existing seeded copy rather than deleting the user's file.
+        try {
+            await fs_1.promises.access(path.join(panelDir, 'panel.js'));
+            this.outputChannel.appendLine(`[Dashboard] Note: ${path.join(panelDir, 'panel.js')} is not used — the bundled panel.js always loads. ` +
+                `Edit panel.html / panel.css to customize the dashboard.`);
+        }
+        catch {
+            // No stale copy — nothing to explain.
+        }
         for (const { bundled, userFile } of seedMap) {
             const dest = path.join(panelDir, userFile);
             try {

package/out/analytics/dashboard/webview/panel.js

@@ -5,8 +5,9 @@
  * Handles artifact display, rendering, and interactions.
  * Uses panelApi (provided by runtime-bridge.js) instead of raw VS Code API.
  *
- * This file is seeded to .agent-hippo/analytics/panel/panel.js on first use.
- * Users can edit the seeded copy to customize the dashboard UI.
+ * This bundled file is the ONLY panel.js ever executed (see provider.getHtmlContent).
+ * It is not seeded to .agent-hippo/analytics/panel/ — a copy there would never run.
+ * Dashboard UI is customized via panel.html / panel.css, which ARE read from that directory.
  * ----------------------------------------------------------------------------- */
 
 // @ts-check

package/out/analytics/service.js

@@ -800,21 +800,22 @@ class AnalyticsService {
             '-ConfigPath',
             options.configPath,
         ]);
+        // A missing config is not fatal: the launcher re-seeds the managed default
+        // (~/.agent-hippo/litellm-otel.yaml) from its bundled template before starting.
         return [
             'Write-Host "Starting LiteLLM proxy..."',
             `if (-not (Test-Path ${q(options.configPath)})) {`,
-            `  Write-Host ${q(`[WARN] LiteLLM config not found: ${options.configPath}`)} -ForegroundColor Yellow`,
-            '} else {',
-            `  $env:LITELLM_CONFIG_PATH = ${q(options.configPath)}`,
-            '  try {',
-            `    $proc = Start-Process -FilePath ${q(getWindowsPwshOrPowerShell())} -WindowStyle Hidden -WorkingDirectory ${q(path.dirname(options.litellmScript))} -ArgumentList ${q(launcherArgumentLine)} -RedirectStandardOutput ${q(options.stdoutPath)} -RedirectStandardError ${q(options.stderrPath)} -PassThru -ErrorAction Stop`,
-            '    Write-Host "[OK]   LiteLLM launcher started (PID: $($proc.Id))"',
-            `    Write-Host ${q(`       Logs: ${options.stdoutPath}`)}`,
-            `    Write-Host ${q(`       Errors: ${options.stderrPath}`)}`,
-            '  } catch {',
-            '    Write-Host "[ERROR] Failed to start LiteLLM launcher." -ForegroundColor Red',
-            '    Write-Host $_.Exception.Message -ForegroundColor Red',
-            '  }',
+            `  Write-Host ${q(`[INFO] LiteLLM config missing: ${options.configPath} — launcher will re-create it from the bundled template.`)}`,
+            '}',
+            `$env:LITELLM_CONFIG_PATH = ${q(options.configPath)}`,
+            'try {',
+            `  $proc = Start-Process -FilePath ${q(getWindowsPwshOrPowerShell())} -WindowStyle Hidden -WorkingDirectory ${q(path.dirname(options.litellmScript))} -ArgumentList ${q(launcherArgumentLine)} -RedirectStandardOutput ${q(options.stdoutPath)} -RedirectStandardError ${q(options.stderrPath)} -PassThru -ErrorAction Stop`,
+            '  Write-Host "[OK]   LiteLLM launcher started (PID: $($proc.Id))"',
+            `  Write-Host ${q(`       Logs: ${options.stdoutPath}`)}`,
+            `  Write-Host ${q(`       Errors: ${options.stderrPath}`)}`,
+            '} catch {',
+            '  Write-Host "[ERROR] Failed to start LiteLLM launcher." -ForegroundColor Red',
+            '  Write-Host $_.Exception.Message -ForegroundColor Red',
             '}',
         ];
     }
@@ -854,17 +855,18 @@ class AnalyticsService {
         if (!options.litellmScript) {
             return ['echo "[WARN] LiteLLM launcher script not found. Skipping LiteLLM start." >&2'];
         }
+        // A missing config is not fatal: the launcher re-seeds the managed default
+        // (~/.agent-hippo/litellm-otel.yaml) from its bundled template before starting.
         return [
             'echo "Starting LiteLLM proxy..."',
             `if [ ! -f ${q(options.configPath)} ]; then`,
-            `  echo ${q(`[WARN] LiteLLM config not found: ${options.configPath}`)} >&2`,
-            'else',
-            `  export LITELLM_CONFIG_PATH=${q(options.configPath)}`,
-            `  nohup ${q(options.litellmScript)} --config ${q(options.configPath)} >> ${q(options.stdoutPath)} 2>> ${q(options.stderrPath)} &`,
-            '  echo "[OK]   LiteLLM launcher started (PID: $!)"',
-            `  echo ${q(`       Logs: ${options.stdoutPath}`)}`,
-            `  echo ${q(`       Errors: ${options.stderrPath}`)}`,
+            `  echo ${q(`[INFO] LiteLLM config missing: ${options.configPath} — launcher will re-create it from the bundled template.`)}`,
             'fi',
+            `export LITELLM_CONFIG_PATH=${q(options.configPath)}`,
+            `nohup ${q(options.litellmScript)} --config ${q(options.configPath)} >> ${q(options.stdoutPath)} 2>> ${q(options.stderrPath)} &`,
+            'echo "[OK]   LiteLLM launcher started (PID: $!)"',
+            `echo ${q(`       Logs: ${options.stdoutPath}`)}`,
+            `echo ${q(`       Errors: ${options.stderrPath}`)}`,
         ];
     }
     getLifecycleTerminalIntro(action) {
@@ -893,13 +895,9 @@ class AnalyticsService {
      * Start LiteLLM in a detached background process. Logs go to .agent-hippo/analytics/litellm.{log,error.log}.
      */
     async startLiteLLMDirectly() {
+        // No existence check: a missing managed config is re-seeded from the bundled
+        // template by the launcher itself (deleting it is a "reset to defaults" gesture).
         const configPath = path.join((0, index_1.getAgentideHome)(), 'litellm-otel.yaml');
-        try {
-            await fs_1.promises.access(configPath);
-        }
-        catch {
-            return false;
-        }
         const isWindows = process.platform === 'win32';
         const args = isWindows
             ? ['-ConfigPath', configPath]

package/out/analytics/sessionEvents.js

@@ -1,6 +1,7 @@
 "use strict";
 /*---------------------------------------------------------------------------------------------
  *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *  Licensed under the MIT License. See LICENSE.txt in the project root for license information.
  *--------------------------------------------------------------------------------------------*/
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -37,6 +38,8 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ObservableStreamEmitter = exports.SessionEventWriter = void 0;
+exports.getSessionEventWriterStats = getSessionEventWriterStats;
+exports.resetSessionEventWriterStatsForTest = resetSessionEventWriterStatsForTest;
 exports.wrapEmitterWithObservability = wrapEmitterWithObservability;
 /**
  * Session Event Writer & Observable Stream Emitter
@@ -47,24 +50,51 @@ exports.wrapEmitterWithObservability = wrapEmitterWithObservability;
  *
  * Events are written to ~/.agent-hippo/analytics/sessions/<session_id>.jsonl
  * and queryable by DuckDB alongside OTEL traces.
+ *
+ * PRIVACY: user identifiers are salted hashes and tool I/O is a sha256 + length, unless an
+ * operator opts in — see ./identity.ts. These records are shipped wholesale to the evidence
+ * server, so whatever lands in this file leaves the machine.
  */
 const path = __importStar(require("path"));
 const fs_1 = require("fs");
 const branding_1 = require("../branding");
 const os = __importStar(require("os"));
-// -----------------------------------------------------------------------------
-// Session Event Writer
-// -----------------------------------------------------------------------------
+const identity_1 = require("./identity");
+/** Process-wide counters, aggregated across every writer instance. */
+const globalStats = {
+    written: 0,
+    failed: 0,
+};
 /**
- * Append-only JSONL writer for session events.
- * One file per session: ~/.agent-hippo/analytics/sessions/<session_id>.jsonl
+ * Process-wide evidence-write health, for /health-style output.
  *
- * Design: write-through (no buffering). Each event appends immediately.
- * JSONL is safe for concurrent writes and crash-safe.
+ * `failed > 0` means at least one consequential act produced no record (R-1 completeness).
+ */
+function getSessionEventWriterStats() {
+    return { written: globalStats.written, failed: globalStats.failed, lastError: globalStats.lastError };
+}
+/** Reset the process-wide counters. Tests only. */
+function resetSessionEventWriterStatsForTest() {
+    globalStats.written = 0;
+    globalStats.failed = 0;
+    globalStats.lastError = undefined;
+}
+/**
+ * Set when evidence is REQUIRED: a failed write then rejects rather than returning, so the turn
+ * fails instead of proceeding unrecorded. Off by default — an IDE user should not lose a turn
+ * because a disk was full — but a regulated deployment wants the opposite trade.
  */
+const EVIDENCE_REQUIRED_ENV = 'AGENTHIPPO_EVIDENCE_REQUIRED';
+function evidenceRequired(env = process.env) {
+    const v = (env[EVIDENCE_REQUIRED_ENV] ?? '').trim().toLowerCase();
+    return v === '1' || v === 'true' || v === 'yes' || v === 'on';
+}
 class SessionEventWriter {
     baseDir;
     ensuredDirs = new Set();
+    written = 0;
+    failed = 0;
+    lastError;
     sanitizeSessionId(sessionId) {
         const trimmed = sessionId.trim();
         if (!trimmed) {
@@ -78,6 +108,14 @@ class SessionEventWriter {
     }
     /**
      * Append a session event to the session's JSONL file.
+     *
+     * A failed write is a HOLE IN THE RECORD, not a nuisance: the act still happened, and nothing
+     * downstream can tell the difference between "no tool ran" and "the tool event never landed".
+     * So every failure is logged at error level and counted into /health-visible state. With
+     * AGENTHIPPO_EVIDENCE_REQUIRED set it also rejects, so the caller fails the turn rather than
+     * completing it unrecorded.
+     *
+     * This used to swallow every error in an empty catch block — silence on every failure.
      */
     async append(sessionId, requestId, eventType, payload) {
         try {
@@ -97,11 +135,27 @@ class SessionEventWriter {
             const filePath = path.join(this.baseDir, `${safeSessionId}.jsonl`);
             const line = JSON.stringify(event) + '\n';
             await fs_1.promises.appendFile(filePath, line);
+            this.written++;
+            globalStats.written++;
         }
-        catch {
-            // Best-effort: don't crash the agent if event writing fails
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            this.failed++;
+            globalStats.failed++;
+            const record = { at: Date.now(), message, eventType };
+            this.lastError = record;
+            globalStats.lastError = record;
+            console.error(`[evidence] LOST session event ${eventType} (session=${sessionId} request=${requestId}): ` +
+                `${message} — ${globalStats.failed} evidence write(s) lost since start`);
+            if (evidenceRequired()) {
+                throw new Error(`evidence write failed for ${eventType}: ${message}`);
+            }
         }
     }
+    /** Per-writer evidence-write health. See {@link getSessionEventWriterStats} for the process view. */
+    getStats() {
+        return { written: this.written, failed: this.failed, lastError: this.lastError };
+    }
     /**
      * Get the sessions directory path (for DuckDB queries).
      */
@@ -126,9 +180,15 @@ class ObservableStreamEmitter {
     writer;
     sessionId;
     requestId;
-    userId;
+    stamp;
     missingCallIdCounter = 0;
     pendingSyntheticCallIds = new Map();
+    /**
+     * Salted pseudonym of the acting user — the warrant, in the form the evidence index wants
+     * (PLAN/compliance.md §2 "salted identity hashes"). Raw only under
+     * AGENTHIPPO_EVIDENCE_RAW_IDS=1. Derived in the constructor; the raw id is never a field.
+     */
+    actorId;
     constructor(inner, writer, sessionId, requestId, 
     /**
      * Acting user for the warrant audit trail on tool events. Captured once at
@@ -138,13 +198,25 @@ class ObservableStreamEmitter {
      * parent IPC callback whose ALS can stick to the spawn request; constructor
      * capture keeps attribution correct for every engine. Undefined outside a
      * serve credential scope (IDE-local / CLI without runWithCredential).
+     *
+     * NOT a field: it is hashed into `actorId` in the constructor and the raw value is then
+     * unreachable from any emit path.
+     */
+    userId, 
+    /**
+     * Provenance stamp merged into turn_start (policy_version, pack_digest, engine_version,
+     * tier) — which rules and which artifacts governed this turn, recorded at the moment of
+     * the act rather than reconstructed later (PLAN/compliance.md §3.1).
      */
-    userId) {
+    stamp) {
         this.inner = inner;
         this.writer = writer;
         this.sessionId = sessionId;
         this.requestId = requestId;
-        this.userId = userId;
+        this.stamp = stamp;
+        // Hash once at construction: the raw id is never stored on this object, so no later edit
+        // to an emit path can leak it by reaching for `this.userId`.
+        this.actorId = (0, identity_1.hashIdentity)(userId);
     }
     makeCallIdKey(toolName) {
         return `${this.sessionId}:${this.requestId}:${toolName}`;
@@ -185,10 +257,12 @@ class ObservableStreamEmitter {
         await this.writer.append(this.sessionId, this.requestId, 'tool_start', {
             toolName,
             callId: loggedCallId,
-            // Truncate input to avoid huge JSONL files
-            inputPreview: input?.slice(0, 500),
+            // Tool arguments are content — paths, queries, credentials people paste into prompts.
+            // Digest by default (input_sha256 + input_length); `inputPreview` returns only under
+            // AGENTHIPPO_EVIDENCE_CONTENT_CAPTURE=1.
+            ...(0, identity_1.describeContent)('input', input),
             // The warrant: who this tool call ran as (captured at wrap; see constructor).
-            userId: this.userId,
+            userId: this.actorId,
         });
         return this.inner.toolStart(toolName, input, toolCallId, metadata);
     }
@@ -200,9 +274,10 @@ class ObservableStreamEmitter {
             toolName,
             callId: loggedCallId,
             isError: isError ?? false,
-            // Truncate result to avoid huge JSONL files
-            resultPreview: result?.slice(0, 500),
-            userId: this.userId,
+            // Tool output is content — file contents, command output, customer data. Digest by
+            // default; `resultPreview` returns only under AGENTHIPPO_EVIDENCE_CONTENT_CAPTURE=1.
+            ...(0, identity_1.describeContent)('result', result),
+            userId: this.actorId,
         });
         return this.inner.toolEnd(toolName, toolCallId, result, isError, metadata);
     }
@@ -215,7 +290,7 @@ class ObservableStreamEmitter {
     async error(message) {
         await this.writer.append(this.sessionId, this.requestId, 'error', {
             message,
-            userId: this.userId,
+            userId: this.actorId,
         });
         return this.inner.error(message);
     }
@@ -226,7 +301,7 @@ class ObservableStreamEmitter {
      * Emit a turn_start event. Call at the beginning of stream().
      */
     async emitTurnStart() {
-        await this.writer.append(this.sessionId, this.requestId, 'turn_start', { userId: this.userId });
+        await this.writer.append(this.sessionId, this.requestId, 'turn_start', { userId: this.actorId, ...this.stamp });
     }
     /**
      * Emit a turn_end event. Call at the end of stream().
@@ -234,7 +309,7 @@ class ObservableStreamEmitter {
     async emitTurnEnd(success) {
         await this.writer.append(this.sessionId, this.requestId, 'turn_end', {
             success,
-            userId: this.userId,
+            userId: this.actorId,
         });
     }
 }
@@ -243,6 +318,6 @@ exports.ObservableStreamEmitter = ObservableStreamEmitter;
  * Create an ObservableStreamEmitter that wraps the given emitter.
  * Returns both the wrapped emitter and emit helpers for turn boundaries.
  */
-function wrapEmitterWithObservability(inner, writer, sessionId, requestId, userId) {
-    return new ObservableStreamEmitter(inner, writer, sessionId, requestId, userId);
+function wrapEmitterWithObservability(inner, writer, sessionId, requestId, userId, stamp) {
+    return new ObservableStreamEmitter(inner, writer, sessionId, requestId, userId, stamp);
 }

package/out/auth/authBaseUrl.js

@@ -0,0 +1,59 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertSafeAuthBaseUrl = void 0;
+exports.pickTrustedAuthBaseUrl = pickTrustedAuthBaseUrl;
+exports.resolveAuthBrokerBaseUrl = resolveAuthBrokerBaseUrl;
+/**
+ * Where `agentide.auth.baseUrl` is allowed to come from.
+ *
+ * The setting is declared `"scope": "application"` in package.json, which is what actually stops a
+ * repo's `.vscode/settings.json` from setting it. This module is the defence in depth behind that
+ * declaration: it re-derives the value from `inspect()` and takes ONLY the user/application/default
+ * layers, so even if the contribution scope is ever loosened by accident (or the value arrives
+ * through a remote/folder layer this extension does not expect), a workspace-supplied endpoint is
+ * dropped rather than trusted.
+ *
+ * Why this matters concretely: the resolved URL receives the PKCE authorization code, then
+ * `Authorization: Bearer <AgentHippo access token>` on `/api/ide/bootstrap`, and the response
+ * configures team store settings plus `agentide.AgentHippoModelGateway.url` (application-scoped).
+ * The access token is also synced to the `agenthippo` model provider. A workspace that could
+ * steer the auth endpoint would capture the token AND every subsequent prompt.
+ */
+const brokerClient_js_1 = require("./brokerClient.js");
+Object.defineProperty(exports, "assertSafeAuthBaseUrl", { enumerable: true, get: function () { return brokerClient_js_1.assertSafeAuthBaseUrl; } });
+/**
+ * Pick the auth base URL from the trusted layers only.
+ *
+ * Precedence matches VS Code's own (most specific trusted layer wins): remote user → local user →
+ * user → default. `workspaceValue` / `workspaceFolderValue` are never consulted for the result;
+ * they are only reported so the caller can warn.
+ */
+function pickTrustedAuthBaseUrl(inspect) {
+    if (!inspect) {
+        return {};
+    }
+    const ignored = inspect.workspaceFolderValue?.trim() || inspect.workspaceValue?.trim() || undefined;
+    const trusted = inspect.globalRemoteValue?.trim() ||
+        inspect.globalLocalValue?.trim() ||
+        inspect.globalValue?.trim() ||
+        inspect.defaultValue?.trim() ||
+        undefined;
+    // A workspace value that merely repeats the trusted value is not an override worth warning about.
+    const ignoredWorkspaceValue = ignored && ignored !== trusted ? ignored : undefined;
+    return { value: trusted, ...(ignoredWorkspaceValue ? { ignoredWorkspaceValue } : {}) };
+}
+/**
+ * Resolve the auth broker base URL from configuration, dropping workspace-scoped values and
+ * enforcing the https/loopback requirement. Throws (with an actionable message) on a bad URL.
+ */
+function resolveAuthBrokerBaseUrl(config, warn) {
+    const picked = pickTrustedAuthBaseUrl(config?.inspect('auth.baseUrl'));
+    if (picked.ignoredWorkspaceValue) {
+        warn?.(`[AgentIDE] Ignoring workspace-provided "agentide.auth.baseUrl" (${picked.ignoredWorkspaceValue}). ` +
+            `This endpoint receives your AgentHippo access token, so it is only honoured from user/application settings.`);
+    }
+    return (0, brokerClient_js_1.getAuthBrokerBaseUrl)(picked.value);
+}

package/out/auth/bootstrapApply.js

@@ -19,7 +19,6 @@ async function applyIdeBootstrap(bootstrap, target) {
     const skipped = [];
     const teamManaged = bootstrap.policy.teamManagedSettings ?? [];
     const storeConfig = target.getConfiguration('agentide');
-    const litellmConfig = target.getConfiguration('agentide.providers.litellm');
     if (shouldApplySetting(target.globalStateGet(exports.TEAM_MANAGED_STORE_KEY), teamManaged, 'store')) {
         await storeConfig.update('storeRepo', bootstrap.store.repo, target.ConfigurationTarget.Global);
         await storeConfig.update('store.indexUrl', bootstrap.store.indexUrl, target.ConfigurationTarget.Global);
@@ -29,22 +28,19 @@ async function applyIdeBootstrap(bootstrap, target) {
     else {
         skipped.push('store');
     }
+    // Routing configures the `agenthippo` provider slot ONLY. The `litellm` slot stays user-owned
+    // (a developer's local Spotlight proxy) — sign-in must never overwrite it. No credential is
+    // written here: the account JWT is synced to the provider by the auth provider's timer, and
+    // the bootstrap carries no routing key at all.
     if (shouldApplySetting(target.globalStateGet(exports.TEAM_MANAGED_ROUTING_KEY), teamManaged, 'routing')) {
-        await litellmConfig.update('baseUrl', bootstrap.routing.litellmBaseUrl, target.ConfigurationTarget.Global);
-        if (target.setParticipantApiKey) {
-            await target.setParticipantApiKey({
-                provider: 'litellm',
-                apiKey: bootstrap.routing.litellmApiKey,
-                baseUrl: bootstrap.routing.litellmBaseUrl,
-            });
-        }
+        await storeConfig.update('AgentHippoModelGateway.url', bootstrap.routing.inferenceGatewayUrl, target.ConfigurationTarget.Global);
         await target.globalStateUpdate(exports.TEAM_MANAGED_ROUTING_KEY, teamManaged.includes('routing'));
         applied.push('routing');
     }
     else {
         skipped.push('routing');
     }
-    await target.globalStateUpdate(exports.TEAM_ID_KEY, bootstrap.team.id);
+    await target.globalStateUpdate(exports.TEAM_ID_KEY, bootstrap.team?.id);
     await target.globalStateUpdate(exports.TEAM_LAST_BOOTSTRAP_KEY, new Date().toISOString());
     await target.globalStateUpdate(exports.TEAM_BOOTSTRAP_CACHE_KEY, bootstrap);
     return { applied, skipped };
@@ -59,6 +55,9 @@ async function revertTeamManagedBootstrap(target) {
         await storeConfig.update('store.indexUrl', 'https://agenthippoai.github.io/agenthippo-store', target.ConfigurationTarget.Global);
     }
     if (routingManaged) {
+        await storeConfig.update('AgentHippoModelGateway.url', undefined, target.ConfigurationTarget.Global);
+        // Clean up state written by pre-separation installs, where team routing overwrote the
+        // user-owned litellm slot with the team base URL and a shared key.
         await litellmConfig.update('baseUrl', '', target.ConfigurationTarget.Global);
         if (target.setParticipantApiKey) {
             await target.setParticipantApiKey({ provider: 'litellm', apiKey: '', baseUrl: '' });

package/out/auth/brokerClient.js

@@ -3,21 +3,66 @@
  *  Copyright (c) AgentHippo.ai. All rights reserved.
  *--------------------------------------------------------------------------------------------*/
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_AUTH_BROKER_BASE_URL = void 0;
+exports.isLoopbackAuthHost = isLoopbackAuthHost;
+exports.assertSafeAuthBaseUrl = assertSafeAuthBaseUrl;
 exports.getAuthBrokerBaseUrl = getAuthBrokerBaseUrl;
 exports.devLoginForTests = devLoginForTests;
 exports.exchangeAuthorizationCode = exchangeAuthorizationCode;
 exports.refreshAccessToken = refreshAccessToken;
-exports.fetchBootstrapRefresh = fetchBootstrapRefresh;
 exports.fetchBootstrap = fetchBootstrap;
 exports.fetchMe = fetchMe;
 exports.buildAuthorizeUrl = buildAuthorizeUrl;
 exports.completeDevPkceLogin = completeDevPkceLogin;
 const types_js_1 = require("./types.js");
 const pkce_js_1 = require("./pkce.js");
+exports.DEFAULT_AUTH_BROKER_BASE_URL = 'https://auth.agenthippo.ai';
+/** Hostnames for which plain `http://` is accepted — an operator running a broker locally. */
+const LOOPBACK_HOSTNAMES = new Set(['localhost', '127.0.0.1', '::1', '[::1]']);
+function isLoopbackAuthHost(hostname) {
+    return LOOPBACK_HOSTNAMES.has(hostname.toLowerCase());
+}
+/**
+ * Refuse an auth base URL that cannot safely carry a bearer token.
+ *
+ * Every request built from this value carries either the PKCE authorization code or the user's
+ * AgentHippo access token (`/oauth/token`, `/api/ide/bootstrap`, `/api/ide/me`), and the bootstrap
+ * response is written straight into the user's model-routing settings. A cleartext or non-http(s)
+ * endpoint therefore leaks the credential on the wire; anything but https is refused unless the
+ * host is loopback, which is the local-development case and never crosses a network.
+ *
+ * Returns the normalized (trailing-slash-stripped) URL, or throws with an actionable message.
+ */
+function assertSafeAuthBaseUrl(value) {
+    const trimmed = value.trim();
+    let url;
+    try {
+        url = new URL(trimmed);
+    }
+    catch {
+        throw new Error(`AgentHippo auth base URL "${trimmed}" is not a valid URL. ` +
+            `Fix "agentide.auth.baseUrl" (or AGENTHIPPO_AUTH_BASE_URL), or clear it to use ${exports.DEFAULT_AUTH_BROKER_BASE_URL}.`);
+    }
+    if (url.protocol === 'https:') {
+        return trimmed.replace(/\/+$/, '');
+    }
+    if (url.protocol === 'http:' && isLoopbackAuthHost(url.hostname)) {
+        return trimmed.replace(/\/+$/, '');
+    }
+    throw new Error(`Refusing to use AgentHippo auth base URL "${trimmed}": it must be https:// ` +
+        `(plain http:// is accepted only for loopback hosts such as http://127.0.0.1:9780). ` +
+        `Your AgentHippo access token is sent to this host, so it is never sent over cleartext. ` +
+        `Fix "agentide.auth.baseUrl" (or AGENTHIPPO_AUTH_BASE_URL), or clear it to use ${exports.DEFAULT_AUTH_BROKER_BASE_URL}.`);
+}
+/**
+ * Resolve the auth broker base URL. `configured` must already have been filtered for scope by the
+ * caller (see `auth/authBaseUrl.ts` — a workspace-scoped value is dropped before it gets here);
+ * this function is the second gate and enforces the transport requirement.
+ */
 function getAuthBrokerBaseUrl(configured) {
     const fromEnv = process.env.AGENTHIPPO_AUTH_BASE_URL?.trim();
-    const value = configured?.trim() || fromEnv || 'https://auth.agenthippo.ai';
-    return value.replace(/\/+$/, '');
+    const value = configured?.trim() || fromEnv || exports.DEFAULT_AUTH_BROKER_BASE_URL;
+    return assertSafeAuthBaseUrl(value);
 }
 async function devLoginForTests(baseUrl, email, redirectUri, codeChallenge) {
     const res = await fetch(`${baseUrl}/oauth/dev/login`, {
@@ -73,17 +118,6 @@ async function refreshAccessToken(baseUrl, refreshToken) {
     }
     return res.json();
 }
-async function fetchBootstrapRefresh(baseUrl, accessToken) {
-    const res = await fetch(`${baseUrl}/api/ide/bootstrap/refresh`, {
-        method: 'POST',
-        headers: { Authorization: `Bearer ${accessToken}` },
-    });
-    if (!res.ok) {
-        const text = await res.text();
-        throw new Error(`bootstrap refresh failed: ${res.status} ${text}`.trim());
-    }
-    return res.json();
-}
 async function fetchBootstrap(baseUrl, accessToken) {
     const res = await fetch(`${baseUrl}/api/ide/bootstrap`, {
         headers: { Authorization: `Bearer ${accessToken}` },

package/out/auth/provider.js

@@ -41,7 +41,7 @@ exports.registerAgentHippoAuth = registerAgentHippoAuth;
 exports.refreshBootstrapIfSignedIn = refreshBootstrapIfSignedIn;
 exports.startAgentHippoTokenRefreshTimer = startAgentHippoTokenRefreshTimer;
 const vscode = __importStar(require("vscode"));
-const brokerClient_js_1 = require("./brokerClient.js");
+const authBaseUrl_js_1 = require("./authBaseUrl.js");
 const bootstrapApply_js_1 = require("./bootstrapApply.js");
 const types_js_1 = require("./types.js");
 const signInFlow_js_1 = require("./signInFlow.js");
@@ -111,7 +111,7 @@ class AgentHippoAuthProvider {
         const stored = await (0, sessionStore_js_1.getStoredAuthSession)(this.context.secrets);
         const removedSession = stored ? (0, sessionStore_js_1.storedSessionToVsCode)(stored) : undefined;
         if (stored) {
-            const baseUrl = (0, brokerClient_js_1.getAuthBrokerBaseUrl)(vscode.workspace.getConfiguration('agentide').get('auth.baseUrl'));
+            const baseUrl = (0, authBaseUrl_js_1.resolveAuthBrokerBaseUrl)(vscode.workspace.getConfiguration('agentide'), (m) => console.warn(m));
             try {
                 await fetch(`${baseUrl}/api/ide/signout`, {
                     method: 'POST',
@@ -184,20 +184,17 @@ async function refreshBootstrapIfSignedIn(context) {
     void syncAgentHippoModelGatewayToken(token.accessToken);
 }
 /**
- * Refresh cadence for the model-gateway JWT and LiteLLM routing key. The access token TTL is
- * ~1h; getAgentHippoAccessToken refreshes it inside a 5-min pre-expiry window, so a 60s tick
- * always lands inside that window with buffer and re-syncs the agenthippo provider key before
- * the old JWT expires (fixes stale-key 401s on long sessions). Routing credentials are refreshed
- * less often (every ~5 min) so a server-side rotation of the team LiteLLM key is picked up
- * without re-sign-in. Both syncs are diff-gated so we don't churn SecretStorage / settings /
- * onDidChangeKeys every tick when nothing changed.
+ * Refresh cadence for the model-gateway JWT. The access token TTL is ~1h;
+ * getAgentHippoAccessToken refreshes it inside a 5-min pre-expiry window, so a 60s tick always
+ * lands inside that window with buffer and re-syncs the agenthippo provider key before the old
+ * JWT expires (fixes stale-key 401s on long sessions). The sync is diff-gated so we don't churn
+ * SecretStorage / onDidChangeKeys every tick when nothing changed. There is no routing-key
+ * refresh: the bootstrap carries no routing credential — the JWT is the credential.
  */
 const TOKEN_REFRESH_INTERVAL_MS = 60_000;
-const ROUTING_REFRESH_EVERY_N_TICKS = 5;
 function startAgentHippoTokenRefreshTimer(context) {
     let lastSyncedAccessToken = '';
     let running = false;
-    let tick = 0;
     const handle = setInterval(() => {
         // Guard against overlapping ticks: a stalled fetch shouldn't let the next tick stack up.
         if (running) {
@@ -219,16 +216,6 @@ function startAgentHippoTokenRefreshTimer(context) {
                         lastSyncedAccessToken = token.accessToken;
                     }
                 }
-                // Routing key rotation is rare; refresh infrequently and let the helper skip the
-                // settings write when the key hasn't changed.
-                if (++tick % ROUTING_REFRESH_EVERY_N_TICKS === 0) {
-                    try {
-                        await (0, sessionStore_js_1.refreshRoutingCredentialsForContext)(context, token.accessToken);
-                    }
-                    catch {
-                        // best-effort routing refresh; next cycle retries
-                    }
-                }
             }
             finally {
                 running = false;