@agenthippo-ai/agenthippo 0.2.3-dataplane → 1.110.9

package/out/sandbox/support.js

@@ -0,0 +1,301 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEPRECATED_SANDBOX_ENV_ALIASES = void 0;
+exports.dockerExec = dockerExec;
+exports.alignSandboxWorkspaceOwnership = alignSandboxWorkspaceOwnership;
+exports.resolveSandboxImageUser = resolveSandboxImageUser;
+exports.ensureSandboxStateDir = ensureSandboxStateDir;
+exports.sandboxScriptArg = sandboxScriptArg;
+exports.applyDeprecatedSandboxEnvAliases = applyDeprecatedSandboxEnvAliases;
+exports.loadWarrantKeypair = loadWarrantKeypair;
+exports.mintSandboxInferenceWarrant = mintSandboxInferenceWarrant;
+/**
+ * Small pieces the sandbox layer needs at its composition root: the container-runtime shim and
+ * the per-sandbox model token (blocker C — the model key leaves the engine's reach).
+ */
+const node_child_process_1 = require("node:child_process");
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const warrant_1 = require("../authority/warrant");
+/** Runs `docker <args>`; never throws — the driver decides what a non-zero code means. */
+function dockerExec(args) {
+    return new Promise((resolve) => {
+        (0, node_child_process_1.execFile)('docker', args, { maxBuffer: 8 << 20 }, (err, stdout, stderr) => {
+            if (err) {
+                const code = typeof err.code === 'number' ? err.code : 1;
+                resolve({ stdout: `${stdout ?? ''}${stderr ?? ''}`, code });
+                return;
+            }
+            resolve({ stdout: stdout ?? '', stderr: stderr ?? '', code: 0 });
+        });
+    });
+}
+/**
+ * Make the shared workspace writable BY THE SANDBOX, without giving the sandbox root.
+ *
+ * A sandbox image runs non-root (the runtime image is uid 10001) while serve runs as root — it has
+ * to, it drives the container runtime. So every file serve syncs into the bind-mounted workspace
+ * lands root-owned, and the sandbox's own pack sync then dies on `EACCES: unlink …/SKILL.md`. Until
+ * now that was a manual `chown -R 10001:10001 <workspace>` AFTER serve booted, which is exactly
+ * the kind of undocumented step a deployment forgets.
+ *
+ * The uid is ASKED OF THE IMAGE rather than hardcoded — `Config.User` is often a name ("agent")
+ * that only resolves inside the image, so `id -u` in the image is the only honest source. The
+ * alternative fix, `--user <serve uid>`, would make the sandbox run as root inside the container and
+ * trade an ownership problem for a weaker boundary; this keeps the sandbox non-root.
+ *
+ * Best effort by design: a failure here is a warning with the exact command to run, never a boot
+ * failure — an operator whose workspace is already aligned must not be blocked by it.
+ */
+async function alignSandboxWorkspaceOwnership(opts) {
+    const hostDirs = opts.writable.map((e) => (e.includes(':') ? e.slice(0, e.indexOf(':')) : e));
+    if (hostDirs.length === 0) {
+        return;
+    }
+    const owner = await resolveSandboxImageUser(opts.exec, opts.image);
+    if (!owner) {
+        opts.logger?.warn(`[Sandbox] could not determine the sandbox image's uid; if turns fail with EACCES in the workspace, run: chown -R <image-uid> ${hostDirs.join(' ')}`);
+        return;
+    }
+    // A root image needs no alignment: it can already write anything serve wrote.
+    if (owner.uid === 0) {
+        return;
+    }
+    const { uid, gid } = owner;
+    for (const dir of hostDirs) {
+        try {
+            const changed = chownTree(dir, uid, gid);
+            if (changed > 0) {
+                opts.logger?.info(`[Sandbox] aligned ${changed} path(s) under ${dir} to the sandbox image's uid ${uid}:${gid}`);
+            }
+        }
+        catch (err) {
+            opts.logger?.warn(`[Sandbox] could not align ownership of ${dir} for the sandbox (uid ${uid}): ${err instanceof Error ? err.message : String(err)}. Run: chown -R ${uid}:${gid} ${dir}`);
+        }
+    }
+}
+/**
+ * The uid/gid the sandbox image actually runs as. Resolved once per boot and reused — it costs two
+ * container starts, and both the workspace alignment and every per-session state dir need it.
+ */
+async function resolveSandboxImageUser(exec, image) {
+    const uid = await imageId(exec, image, '-u');
+    if (uid === undefined) {
+        return undefined;
+    }
+    return { uid, gid: (await imageId(exec, image, '-g')) ?? uid };
+}
+/**
+ * Create this session's state directory, owned by the sandbox so it can write there.
+ *
+ * The directory outlives the sandbox on purpose — it holds `provider-sessions/` and the engines'
+ * rollout files, which is the only reason a session can resume after its sandbox is reaped.
+ */
+function ensureSandboxStateDir(dir, owner) {
+    fs.mkdirSync(dir, { recursive: true });
+    if (owner && owner.uid !== 0) {
+        try {
+            chownTree(dir, owner.uid, owner.gid);
+        }
+        catch { /* best effort — warned at boot */ }
+    }
+    return dir;
+}
+/** `id -u` / `id -g` AS THE IMAGE'S DEFAULT USER — the only place a name like "agent" resolves. */
+async function imageId(exec, image, flag) {
+    const res = await exec(['run', '--rm', '--network', 'none', '--entrypoint', 'id', image, flag]);
+    if (res.code !== 0) {
+        return undefined;
+    }
+    const parsed = Number.parseInt(res.stdout.trim(), 10);
+    return Number.isInteger(parsed) ? parsed : undefined;
+}
+/** Recursive chown, touching only what is not already owned by the sandbox. Returns how many. */
+function chownTree(dir, uid, gid) {
+    let changed = 0;
+    const visit = (p) => {
+        // lstat/lchown: a symlink is retargeted by chown, so follow nothing.
+        const st = fs.lstatSync(p);
+        if (st.uid !== uid || st.gid !== gid) {
+            fs.lchownSync(p, uid, gid);
+            changed++;
+        }
+        if (st.isDirectory()) {
+            for (const entry of fs.readdirSync(p)) {
+                visit(path.join(p, entry));
+            }
+        }
+    };
+    if (!fs.existsSync(dir)) {
+        return 0;
+    }
+    visit(dir);
+    return changed;
+}
+// REMOVED (2026-07-29): `mintSandboxModelToken` / `verifySandboxModelToken`.
+//
+// They HMAC'd the upstream provider key and truncated the result to 32 hex characters, and their
+// own docstring conceded that the "spend cap" they claimed to carry was never actually encoded in
+// the token, let alone enforced. Nothing in serve used them — the shipped path is the ES256
+// warrant below (`mintSandboxInferenceWarrant`), which the inference proxy verifies with a public
+// key it cannot mint with. A second, weaker credential format that looks like it does the same job
+// is a liability: it invites a future call site to reach for the one with no signature and no
+// audience separation. The conformance `cost-cap` check now exercises the warrant path instead.
+// -----------------------------------------------------------------------------
+// Warrant-based sandbox model tokens (the shape the inference proxy verifies)
+// -----------------------------------------------------------------------------
+/**
+ * Load the authority plane's signing key, or generate an ephemeral one.
+ *
+ * `AGENTHIPPO_WARRANT_PRIVATE_KEY` (PKCS#8 PEM) + `AGENTHIPPO_WARRANT_KID` pin a stable key so
+ * gateways can be configured with the matching public key. With neither set, serve generates a
+ * keypair at boot and logs the public key: fine for a single-node dev run, useless across a
+ * restart — which is the honest tradeoff, not a silent one.
+ */
+/**
+ * Virtual filesystem roots used by single-file builds. Paths under these are reported by
+ * `process.argv[1]` but are not real files a child process can be pointed at — and crucially the
+ * runtime mounts them, so `fs.existsSync` returns TRUE and cannot be used to tell them apart.
+ */
+const VIRTUAL_SCRIPT_ROOTS = ['/$bunfs', '/snapshot'];
+/**
+ * Normalize a script path for the virtual-root check: Windows separators become `/`, and a drive
+ * letter is stripped. `pkg` on Windows reports `C:\snapshot\app\index.js`, which the bare
+ * `startsWith('/snapshot')` test missed. serve is effectively Linux-only so this has never bitten,
+ * but the check costs one line and the failure it prevents (`unknown command 'C:\snapshot\…'`,
+ * every sandbox dead at boot) is opaque.
+ */
+function normalizeScriptPath(script) {
+    return script.replace(/\\/g, '/').replace(/^[A-Za-z]:/, '');
+}
+/**
+ * The script argument to pass when re-invoking ourselves to launch a sandbox.
+ *
+ * `node <script> sandbox …` needs the script path; a compiled single-file binary must be invoked as
+ * `<binary> sandbox …` with no script at all. Passing the virtual path made the child treat it as
+ * the subcommand (`unknown command '/$bunfs/root/index.js'`), so every tier-0 sandbox died at boot.
+ */
+function sandboxScriptArg(argv = process.argv, execPath = process.execPath) {
+    const script = argv[1];
+    if (!script || script === execPath) {
+        return [];
+    }
+    const normalized = normalizeScriptPath(script);
+    if (VIRTUAL_SCRIPT_ROOTS.some((root) => normalized.startsWith(root))) {
+        return [];
+    }
+    return [script];
+}
+// -----------------------------------------------------------------------------
+// cell → sandbox migration: deprecated environment aliases
+// -----------------------------------------------------------------------------
+/**
+ * Environment variables renamed by the cell → sandbox migration, old name → new name.
+ *
+ * Only variables that actually CHANGE BEHAVIOUR are listed. An operator env file still saying
+ * `AGENTHIPPO_CELL_TIER=2` would otherwise select nothing at all — the deployment would come up
+ * one tier weaker than asked for, with no error anywhere. Silent degradation is the failure mode
+ * this migration must not have; a loud warning plus the old value continuing to work is.
+ */
+exports.DEPRECATED_SANDBOX_ENV_ALIASES = [
+    ['AGENTHIPPO_CELL', 'AGENTHIPPO_SANDBOX'],
+    ['AGENTHIPPO_CELL_TIER', 'AGENTHIPPO_SANDBOX_TIER'],
+    ['AGENTHIPPO_CELL_SOCKET_DIR', 'AGENTHIPPO_SANDBOX_SOCKET_DIR'],
+    ['AGENTHIPPO_CELL_STRICT_EGRESS', 'AGENTHIPPO_SANDBOX_STRICT_EGRESS'],
+    ['AGENTHIPPO_CELL_ALLOW_PROVIDER_KEY', 'AGENTHIPPO_SANDBOX_ALLOW_PROVIDER_KEY'],
+];
+/** One warning per process per variable — a per-turn log would bury it. */
+const warnedAliases = new Set();
+/**
+ * Accept the pre-rename `AGENTHIPPO_CELL*` spellings, loudly.
+ *
+ * A NEW name already present always wins: an operator who has migrated is never overridden by a
+ * stale variable left in a shell profile. Returns the aliases that were applied, for tests.
+ */
+function applyDeprecatedSandboxEnvAliases(env = process.env, warn = (m) => console.warn(m), once = warnedAliases) {
+    const applied = [];
+    for (const [oldName, newName] of exports.DEPRECATED_SANDBOX_ENV_ALIASES) {
+        const legacy = env[oldName];
+        if (legacy === undefined || legacy === '') {
+            continue;
+        }
+        if (env[newName] !== undefined && env[newName] !== '') {
+            if (!once.has(oldName)) {
+                once.add(oldName);
+                warn(`[Sandbox] DEPRECATED: ${oldName} is set but ${newName} is also set — using ${newName} ` +
+                    `and IGNORING ${oldName}. Remove ${oldName}; it was renamed in the cell → sandbox migration.`);
+            }
+            continue;
+        }
+        env[newName] = legacy;
+        applied.push(newName);
+        if (!once.has(oldName)) {
+            once.add(oldName);
+            warn(`[Sandbox] DEPRECATED: ${oldName} was renamed to ${newName} in the cell → sandbox migration. ` +
+                `The old value is being honoured for now, but it will stop working — set ${newName}=${legacy} instead.`);
+        }
+    }
+    return applied;
+}
+// Applied at import so the aliases are in place before anything reads the new names. This module is
+// on the import path of every sandbox composition root (serve and the `sandbox` subcommand both
+// pull `dockerExec` / `sandboxScriptArg` / `loadWarrantKeypair` from here), and the alternative —
+// a call the composition root must remember to make — is exactly the kind of step a deployment
+// forgets, which is the failure this exists to prevent.
+applyDeprecatedSandboxEnvAliases();
+function loadWarrantKeypair(logger) {
+    const pem = process.env.AGENTHIPPO_WARRANT_PRIVATE_KEY?.trim();
+    const kid = process.env.AGENTHIPPO_WARRANT_KID?.trim();
+    if (pem) {
+        const crypto = require('node:crypto');
+        const publicKeyPem = crypto.createPublicKey(pem).export({ type: 'spki', format: 'pem' }).toString();
+        return { privateKeyPem: pem, publicKeyPem, kid: kid || 'default' };
+    }
+    const generated = (0, warrant_1.generateWarrantKeypair)(kid);
+    logger?.info(`[Warrant] no AGENTHIPPO_WARRANT_PRIVATE_KEY — generated an ephemeral key (kid=${generated.kid}). Configure gateways with:\nGATEWAY_SANDBOX_WARRANT_KEYS=${JSON.stringify({ [generated.kid]: generated.publicKeyPem })}`);
+    return generated;
+}
+/**
+ * Mint the token a sandbox presents to the inference proxy: a signed, audience-bound warrant naming
+ * the end user (cost attribution), the sandbox (spend metering + replay defence), and the tier.
+ * The proxy verifies with a public key and can never mint one.
+ */
+function mintSandboxInferenceWarrant(key, claims) {
+    return (0, warrant_1.mintWarrant)({ ...claims, aud: 'inference' }, key);
+}

package/out/sandbox/types.js

@@ -0,0 +1,55 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RevocationUnsupportedError = exports.SANDBOX_PROVIDER_KEY_ENV = exports.SANDBOX_TIER_ENV = void 0;
+exports.sandboxHoldsProviderKey = sandboxHoldsProviderKey;
+exports.isContainerSandbox = isContainerSandbox;
+/**
+ * The tier the surrounding sandbox ACTUALLY delivers, declared by the driver that created it.
+ *
+ * Read by engines that sandbox themselves: an engine may only stand its own boundary down when
+ * something stronger already confines it. `AGENTHIPPO_SANDBOX=1` cannot answer that question —
+ * it says "inside a sandbox", and the tier-0 process driver is a sandbox that confines nothing.
+ * Set from the driver's own `tier`, never from the caller's spec, because the driver is the only
+ * thing that knows what boundary was really built.
+ */
+exports.SANDBOX_TIER_ENV = 'AGENTHIPPO_SANDBOX_TIER';
+/**
+ * Set to `1` when this sandbox was handed a RAW PROVIDER KEY (the Cursor exception — see
+ * `processDriver.baseSandboxEnv`).
+ *
+ * The tier says how strong the surrounding boundary is; this says whether the credential invariant
+ * ("the sandbox holds no provider key") actually holds inside it. They are different claims and a
+ * deployment that discloses one while quietly violating the other is the failure this exists to
+ * prevent: an engine here can reach the provider directly, around the inference proxy's meter and
+ * around the per-sandbox warrant.
+ */
+exports.SANDBOX_PROVIDER_KEY_ENV = 'AGENTHIPPO_SANDBOX_PROVIDER_KEY';
+/** True when this process was given a raw provider key despite running in a sandbox. */
+function sandboxHoldsProviderKey(env = process.env) {
+    return env[exports.SANDBOX_PROVIDER_KEY_ENV] === '1';
+}
+/**
+ * True only when a boundary stronger than the engine's own confinement surrounds this process.
+ *
+ * Absent or unparseable ⇒ false: an engine keeps its own sandbox rather than dropping it on a
+ * guess. The failure mode of guessing wrong in the other direction is an unconfined agent.
+ */
+function isContainerSandbox(env = process.env) {
+    return Number(env[exports.SANDBOX_TIER_ENV]) >= 2;
+}
+/**
+ * Thrown when a driver is asked for an enforcement it cannot actually deliver — e.g. narrowing a
+ * single route on the tier-0 `process` driver, which has no network boundary. Failing loudly
+ * beats a silent no-op: a caller that believes it revoked the inference route when nothing
+ * happened is exactly the "safe by convention" failure this architecture exists to remove.
+ */
+class RevocationUnsupportedError extends Error {
+    constructor(driver, what) {
+        super(`${driver} driver cannot revoke '${what}' — no enforcement boundary at this tier (use 'all', which kills the sandbox)`);
+        this.name = 'RevocationUnsupportedError';
+    }
+}
+exports.RevocationUnsupportedError = RevocationUnsupportedError;

package/out/scripts/agentide-litellm.sh

@@ -1,4 +1,8 @@
 #!/usr/bin/env bash
+#---------------------------------------------------------------------------------------------
+# Copyright (c) AgentHippo.ai. All rights reserved.
+# Licensed under the MIT License. See LICENSE.txt in the project root for license information.
+#---------------------------------------------------------------------------------------------
 #
 # Starts LiteLLM via uv. By default installs litellm[proxy] from PyPI (pinned version).
 # Use --git or LITELLM_FROM_GIT=true to install from GitHub at DEFAULT_LITELLM_VERSION instead.
@@ -49,7 +53,7 @@ augment_path_for_tools
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 DEFAULT_CONFIG_PATH="${SCRIPT_DIR}/analytics/agentide-litellm-otel.config.yaml"
-DEFAULT_LITELLM_VERSION="${DEFAULT_LITELLM_VERSION:-1.85.0}"
+DEFAULT_LITELLM_VERSION="${DEFAULT_LITELLM_VERSION:-1.94.0}"
 # Resolve branded home dir from env first, then legacy fallbacks.
 AGENT_HOME_DIR="${AGENT_HOME_DIR:-${AGENTHIPPO_HOME:-$HOME/.agent-hippo}}"
 DEFAULT_ENV_FILE="${AGENT_HOME_DIR}/.env"
@@ -325,8 +329,20 @@ if [[ "$TLS_ENABLED" == true ]]; then
 fi
 
 if [[ ! -f "$CONFIG_PATH" ]]; then
-	echo "LiteLLM config not found at ${CONFIG_PATH}. Update LITELLM_CONFIG_PATH or create the file." >&2
-	exit 1
+	# Self-heal the managed default config: deleting ~/.agent-hippo/litellm-otel.yaml is a
+	# supported "reset to defaults" gesture, so re-seed it from the bundled template instead
+	# of dying. Any other (custom) path stays a hard error — we cannot guess intent there.
+	MANAGED_DEFAULT_CONFIG="${AGENT_HOME_DIR}/litellm-otel.yaml"
+	CONFIG_TEMPLATE="${SCRIPT_DIR}/analytics/agentide-litellm-otel.config.yaml"
+	if [[ "$CONFIG_PATH" == "$MANAGED_DEFAULT_CONFIG" && -f "$CONFIG_TEMPLATE" ]]; then
+		mkdir -p "$AGENT_HOME_DIR"
+		cp "$CONFIG_TEMPLATE" "$CONFIG_PATH"
+		echo "LiteLLM config was missing; re-created ${CONFIG_PATH} from the bundled template."
+		echo "Model routes are commented out in a fresh config — uncomment the providers you use."
+	else
+		echo "LiteLLM config not found at ${CONFIG_PATH}. Update LITELLM_CONFIG_PATH or create the file." >&2
+		exit 1
+	fi
 fi
 
 # LiteLLM 1.85+ resolves custom callback modules beside the config file (not only PYTHONPATH).
@@ -406,10 +422,56 @@ if command -v cygpath >/dev/null 2>&1; then
 	esac
 fi
 
-if grep -q 'OPENAI_API_KEY' "$CONFIG_PATH" && [[ -z "${OPENAI_API_KEY:-}" ]]; then
-	echo "OPENAI_API_KEY is not set but the config references it. Export OPENAI_API_KEY before running this script." >&2
+# Warn (don't die) about every env var the config references but the environment
+# lacks — driven by the config's own os.environ/… declarations, so it covers any
+# provider without a hardcoded list. LiteLLM resolves these per model, so routes
+# whose credentials are present (and the OTEL pipeline) still work; only the
+# models using a missing var fail, at request time. LITELLM_MASTER_KEY is
+# excluded: it gates the proxy itself and fails closed below.
+MISSING_ENV_REFS=""
+for ref in $(grep -v '^[[:space:]]*#' "$CONFIG_PATH" | grep -oE 'os\.environ/[A-Za-z_][A-Za-z0-9_]*' | sed 's|os\.environ/||' | sort -u); do
+	[[ "$ref" == "LITELLM_MASTER_KEY" ]] && continue
+	if [[ -z "${!ref:-}" ]]; then
+		MISSING_ENV_REFS="${MISSING_ENV_REFS:+$MISSING_ENV_REFS, }$ref"
+	fi
+done
+if [[ -n "$MISSING_ENV_REFS" ]]; then
+	echo "⚠️  ${CONFIG_PATH} references environment variables that are not set:" >&2
+	echo "     ${MISSING_ENV_REFS}" >&2
+	echo "   Models using them will fail until you add them to ${ENV_FILE}, e.g.:" >&2
+	echo "     echo '${MISSING_ENV_REFS%%,*}=...' >> ${ENV_FILE}" >&2
+fi
+
+# Fail closed on an unauthenticated proxy. Without general_settings.master_key LiteLLM serves
+# /v1/chat/completions to anything that can reach the port, using the provider credentials this
+# process holds. There is deliberately no default value.
+if grep -q 'LITELLM_MASTER_KEY' "$CONFIG_PATH" && [[ -z "${LITELLM_MASTER_KEY:-}" ]]; then
+	echo "" >&2
+	echo "LITELLM_MASTER_KEY is not set but the config requires it (general_settings.master_key)." >&2
+	echo "Without it the proxy would accept unauthenticated requests on port ${PORT}." >&2
+	echo "  export LITELLM_MASTER_KEY=\"sk-\$(openssl rand -hex 24)\"" >&2
+	echo "Then pass the same value as AGENTHIPPO_LITELLM_API_KEY to clients." >&2
+	echo "" >&2
 	exit 1
 fi
+if ! grep -q 'master_key' "$CONFIG_PATH"; then
+	echo "⚠️  ${CONFIG_PATH} has no general_settings.master_key — the proxy will accept" >&2
+	echo "   unauthenticated requests from anything that can reach port ${PORT}." >&2
+fi
+
+# Prompt/completion capture is opt-in (PLAN/compliance-req.md §6). Say which mode is in force —
+# an operator must never have to read a YAML file to find out whether prompts are being recorded.
+case "$(printf '%s' "${AGENTHIPPO_EVIDENCE_CONTENT_CAPTURE:-}" | tr '[:upper:]' '[:lower:]')" in
+	1|true|yes|on)
+		echo "" >&2
+		echo "!! CONTENT CAPTURE IS ON — prompts and completions will be recorded in spans." >&2
+		echo "!! AGENTHIPPO_EVIDENCE_CONTENT_CAPTURE is set. Unset it for metadata-only evidence." >&2
+		echo "" >&2
+		;;
+	*)
+		echo "  privacy: content capture OFF (metadata + sha256 only); set AGENTHIPPO_EVIDENCE_CONTENT_CAPTURE=1 to record prompts/completions"
+		;;
+esac
 
 LANGFUSE_CALLBACK_PRESENT=false
 LANGFUSE_SHOULD_INSTALL=false