@agenthippo-ai/agenthippo 0.2.3-dataplane → 1.110.9

package/out/authority/warrant.js

@@ -0,0 +1,206 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.b64urlEncode = b64urlEncode;
+exports.signCompactJws = signCompactJws;
+exports.verifyCompactJws = verifyCompactJws;
+exports.timingSafeEqualString = timingSafeEqualString;
+exports.generateWarrantKeypair = generateWarrantKeypair;
+exports.mintWarrant = mintWarrant;
+exports.verifyWarrant = verifyWarrant;
+exports.jwks = jwks;
+/**
+ * Signed warrants (PLAN/serve-v4-clean.md §6).
+ *
+ * The P1 breach was not a nonce bug — it was **misplaced minting authority**: serve held a
+ * bearer secret that let any holder mint a turn for any user. Edge mode relocated that secret;
+ * signing removes it. And the deploy samples still share ONE symmetric HMAC
+ * `AGENTHIPPO_AUTH_JWT_SECRET` fleet-wide, so compromising any single federated agent yields
+ * token-minting authority for the whole fleet including the IdP.
+ *
+ *   warrant = sign_ES256{ user, pack_version, sandbox_id, tier, exp ≈ turn }
+ *
+ * The authority plane holds the private key. Data/inference/egress gateways hold **verification
+ * keys only** (JWKS) — no plane can mint on another's behalf, and an edge node that is fully
+ * compromised can verify but never issue. There is no revocation registry: `exp` is turn-length
+ * and anything longer-lived is revoked by killing the sandbox's route (`SandboxDriver.revoke`).
+ *
+ * Channel binding: a warrant names the `sandbox_id` it was minted for, and the gateway verifies the
+ * peer identity of the channel it arrived on INDEPENDENTLY. A warrant lifted from one sandbox and
+ * replayed from another fails even though its signature is perfectly valid.
+ */
+const crypto = __importStar(require("node:crypto"));
+/** base64url of a UTF-8 string. */
+function b64urlEncode(s) {
+    return Buffer.from(s, 'utf8').toString('base64url');
+}
+/** Sign `payload` as a compact JWS. The ONLY place a private key is used for a JWS in this tree. */
+function signCompactJws(header, payload, privateKeyPem) {
+    const fullHeader = { alg: 'ES256', typ: header.typ ?? 'JWT', kid: header.kid };
+    const signingInput = `${b64urlEncode(JSON.stringify(fullHeader))}.${b64urlEncode(JSON.stringify(payload))}`;
+    const sig = crypto.sign('sha256', Buffer.from(signingInput), {
+        key: crypto.createPrivateKey(privateKeyPem),
+        dsaEncoding: 'ieee-p1363', // JWS ES256 is raw R||S, not DER
+    });
+    return `${signingInput}.${sig.toString('base64url')}`;
+}
+/**
+ * Verify a compact JWS against public keys only. Claim checking (exp, aud, digest, …) is the
+ * caller's job — this answers exactly one question: was this byte sequence signed by a key we
+ * already trust, under the algorithm we pinned?
+ */
+function verifyCompactJws(token, publicKeysByKid, opts = {}) {
+    const parts = token.split('.');
+    if (parts.length !== 3) {
+        return { ok: false, reason: 'malformed' };
+    }
+    const [headerB64, payloadB64, sigB64] = parts;
+    let header;
+    let payload;
+    try {
+        header = JSON.parse(Buffer.from(headerB64, 'base64url').toString('utf8'));
+        payload = JSON.parse(Buffer.from(payloadB64, 'base64url').toString('utf8'));
+    }
+    catch {
+        return { ok: false, reason: 'unparseable' };
+    }
+    if (header.alg !== 'ES256') {
+        return { ok: false, reason: `unsupported alg ${header.alg}` };
+    }
+    // A signed artifact of one KIND must never verify as another, even under the same key.
+    if (opts.typ !== undefined && header.typ !== undefined && header.typ !== opts.typ) {
+        return { ok: false, reason: `unexpected token type ${header.typ}` };
+    }
+    const publicKeyPem = header.kid ? publicKeysByKid[header.kid] : undefined;
+    if (!publicKeyPem) {
+        return { ok: false, reason: 'unknown kid' };
+    }
+    let signatureValid = false;
+    try {
+        signatureValid = crypto.verify('sha256', Buffer.from(`${headerB64}.${payloadB64}`), { key: crypto.createPublicKey(publicKeyPem), dsaEncoding: 'ieee-p1363' }, Buffer.from(sigB64, 'base64url'));
+    }
+    catch {
+        return { ok: false, reason: 'bad signature' };
+    }
+    if (!signatureValid) {
+        return { ok: false, reason: 'bad signature' };
+    }
+    return { ok: true, header, payload, signingInput: `${headerB64}.${payloadB64}` };
+}
+/**
+ * Constant-time string compare for values that gate a security decision (digests, thumbprints).
+ *
+ * These are public values, so a timing oracle is not a practical break — but a digest comparison
+ * that short-circuits on the first differing byte is the kind of detail a reviewer has to
+ * re-derive every time. One helper, used everywhere, removes the question.
+ */
+function timingSafeEqualString(a, b) {
+    const bufA = Buffer.from(a, 'utf8');
+    const bufB = Buffer.from(b, 'utf8');
+    if (bufA.length !== bufB.length) {
+        return false;
+    }
+    return crypto.timingSafeEqual(bufA, bufB);
+}
+/** Generate an ES256 (P-256) keypair for the authority plane. */
+function generateWarrantKeypair(kid) {
+    const { privateKey, publicKey } = crypto.generateKeyPairSync('ec', { namedCurve: 'P-256' });
+    const publicKeyPem = publicKey.export({ type: 'spki', format: 'pem' }).toString();
+    return {
+        privateKeyPem: privateKey.export({ type: 'pkcs8', format: 'pem' }).toString(),
+        publicKeyPem,
+        kid: kid ?? crypto.createHash('sha256').update(publicKeyPem).digest('hex').slice(0, 16),
+    };
+}
+/** Longer than a turn is not a warrant, it's a credential. Hard cap rather than a default. */
+const MAX_TTL_SECONDS = 300;
+function mintWarrant(input, key) {
+    const now = input.nowSeconds ?? Math.floor(Date.now() / 1000);
+    const ttl = Math.min(input.ttlSeconds ?? 120, MAX_TTL_SECONDS);
+    const claims = {
+        user: input.user,
+        pack: input.pack,
+        packVersion: input.packVersion,
+        sandboxId: input.sandboxId,
+        tier: input.tier,
+        aud: input.aud,
+        iat: now,
+        exp: now + ttl,
+        jti: crypto.randomUUID(),
+    };
+    return signCompactJws({ typ: 'JWT', kid: key.kid }, claims, key.privateKeyPem);
+}
+/**
+ * Verify with a public key only. A gateway that can run this cannot mint — that asymmetry is
+ * the entire point, and it is what deletes the shared fleet-wide HMAC secret.
+ */
+function verifyWarrant(token, publicKeysByKid, input) {
+    // Algorithm confusion is the classic JWT break: a token claiming `none`, or claiming HS256
+    // so the verifier uses the public key as an HMAC secret, must be refused outright. That, plus
+    // the kid-must-be-known rule, lives in verifyCompactJws — one implementation, no drift.
+    const jws = verifyCompactJws(token, publicKeysByKid);
+    if (!jws.ok) {
+        return { ok: false, reason: jws.reason };
+    }
+    const claims = jws.payload;
+    const now = input.nowSeconds ?? Math.floor(Date.now() / 1000);
+    if (typeof claims.exp !== 'number' || claims.exp <= now) {
+        return { ok: false, reason: 'expired' };
+    }
+    if (claims.aud !== input.audience) {
+        return { ok: false, reason: `wrong audience ${claims.aud}` };
+    }
+    // Channel binding — the property §12.4b promises. A stolen warrant presented from a
+    // different sandbox fails here even though its signature verifies.
+    if (input.channelSandboxId !== undefined && claims.sandboxId !== input.channelSandboxId) {
+        return { ok: false, reason: 'warrant not bound to this channel' };
+    }
+    if (!claims.user) {
+        return { ok: false, reason: 'no principal' };
+    }
+    return { ok: true, claims };
+}
+/** JWKS document for gateways to fetch. Publishes verification material ONLY. */
+function jwks(keys) {
+    return {
+        keys: keys.map((k) => {
+            const jwk = crypto.createPublicKey(k.publicKeyPem).export({ format: 'jwk' });
+            return { ...jwk, kid: k.kid, alg: 'ES256', use: 'sig' };
+        }),
+    };
+}

package/out/branding.js

@@ -3,7 +3,9 @@
  *  Copyright (c) AgentHippo.ai. All rights reserved.
  *--------------------------------------------------------------------------------------------*/
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AGENTIDE_DEPS_PACKAGE_NAME = exports.AGENTIDE_DEPS_DIR_NAME = exports.AGENTIDE_CLI_NAME = exports.AGENTIDE_DIR_NAME = exports.AGENTIDE_EXTENSION_NAME = exports.AGENTIDE_BRAND_NAME = void 0;
+exports.SETTINGS_DISPLAY_PREFIX = exports.SETTINGS_KEY_PREFIX = exports.AGENTIDE_DEPS_PACKAGE_NAME = exports.AGENTIDE_DEPS_DIR_NAME = exports.AGENTIDE_CLI_NAME = exports.AGENTIDE_DIR_NAME = exports.AGENTIDE_EXTENSION_NAME = exports.AGENTIDE_BRAND_NAME = void 0;
+exports.toSettingsDisplayKey = toSettingsDisplayKey;
+exports.describeSettingKey = describeSettingKey;
 exports.applyBrandingTokens = applyBrandingTokens;
 exports.brandify = brandify;
 // Centralized branding so we can rename without sweeping string edits.
@@ -13,6 +15,30 @@ exports.AGENTIDE_DIR_NAME = '.agent-hippo';
 exports.AGENTIDE_CLI_NAME = 'agenthippo';
 exports.AGENTIDE_DEPS_DIR_NAME = `.${exports.AGENTIDE_CLI_NAME}-deps`;
 exports.AGENTIDE_DEPS_PACKAGE_NAME = `${exports.AGENTIDE_CLI_NAME}-deps`;
+/** Internal VS Code settings prefix (stored in settings.json). */
+exports.SETTINGS_KEY_PREFIX = 'agentide.';
+/** User-visible settings prefix in the Settings UI (see workbench settingsDisplayKey.ts). */
+exports.SETTINGS_DISPLAY_PREFIX = 'agenthippoai.';
+/** Map an internal setting key to the label users see in Settings. */
+function toSettingsDisplayKey(key) {
+    return key.startsWith(exports.SETTINGS_KEY_PREFIX)
+        ? exports.SETTINGS_DISPLAY_PREFIX + key.slice(exports.SETTINGS_KEY_PREFIX.length)
+        : key;
+}
+/**
+ * Name a setting in prose that a user can act on.
+ *
+ * The display alias exists only inside the Settings UI: `agenthippoai.*` is not a real
+ * configuration key, so a message that prints it alone sends the user to paste a key into
+ * settings.json that configures nothing. Anything outside the Settings tree — notifications,
+ * errors, docs — must name the REAL key and mention the alias only to connect the two.
+ */
+function describeSettingKey(key) {
+    const displayKey = toSettingsDisplayKey(key);
+    return displayKey === key
+        ? key
+        : `${key} (shown in Settings as ${displayKey})`;
+}
 function applyBrandingTokens(text) {
     return text
         .replace(/\{\{AGENT_BRAND\}\}|\{\{AGENTIDE_BRAND\}\}/g, exports.AGENTIDE_BRAND_NAME)

package/out/cli/commands/conformance.js

@@ -0,0 +1,249 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.conformanceCommand = conformanceCommand;
+/**
+ * `agenthippo conformance` — the deployment's own proof (PLAN/serve-v4-clean.md §11 step 5).
+ *
+ * This is the artifact a partner runs at a client site without us in the room, and the honest
+ * answer to "why should I believe the isolation claim": the buyer runs the test themselves.
+ *
+ * Deployment checks PROBE rather than assert — "the four keys are undefined in-sandbox" has to be
+ * measured inside a running sandbox, not read off a config file. Checks that cannot be measured in
+ * the current environment report `skip` with the reason; a skip is never a pass.
+ *
+ * The contract checks (cost-cap, warrant-integrity, rollback-kill-switch) are a different claim:
+ * they verify THIS BINARY implements the bindings it advertises, and pass anywhere, including on a
+ * machine with no deployment. They are reported separately and cannot make a run green on their
+ * own — a conformance run that probed nothing exits 2, because a buyer must never be able to get a
+ * clean report against a system that was never touched.
+ */
+const node_child_process_1 = require("node:child_process");
+const node_util_1 = require("node:util");
+const support_1 = require("../../sandbox/support");
+const lease_1 = require("../../pack/lease");
+const warrant_1 = require("../../authority/warrant");
+const pexec = (0, node_util_1.promisify)(node_child_process_1.execFile);
+async function run(bin, args) {
+    try {
+        const { stdout } = await pexec(bin, args, { maxBuffer: 8 << 20 });
+        return { out: stdout, code: 0 };
+    }
+    catch (e) {
+        const err = e;
+        return { out: `${err.stdout ?? ''}${err.stderr ?? ''}`, code: typeof err.code === 'number' ? err.code : 1 };
+    }
+}
+/**
+ * credential-confinement — no data, model, or channel credential is reachable from inside a
+ * sandbox (env, /proc, filesystem). This is the check that would have caught the P2 leak: with the
+ * connector in the agent container, `PGPASSWORD` was readable from a sibling's /proc.
+ */
+async function credentialConfinement(opts) {
+    const name = 'credential-confinement';
+    if (!opts.sandbox) {
+        return { name, status: 'skip', detail: 'no --sandbox given; cannot probe inside a running sandbox' };
+    }
+    const rt = opts.runtime ?? 'docker';
+    // 1. The sandbox's own environment.
+    const env = await run(rt, ['exec', opts.sandbox, 'sh', '-c', 'env']);
+    if (env.code !== 0) {
+        return { name, status: 'skip', detail: `cannot exec in sandbox ${opts.sandbox}: ${env.out.trim().slice(0, 120)}` };
+    }
+    const SECRET_PATTERNS = [
+        ['provider-key', /sk-[A-Za-z0-9]{16,}/],
+        ['api-key-var', /(^|\n)[A-Z_]*API_KEY=\S/],
+        ['db-password', /(^|\n)PG(PASSWORD|PASSFILE)=\S/],
+        ['aws-secret', /(^|\n)AWS_SECRET_ACCESS_KEY=\S/],
+        ['bearer-token-var', /(^|\n)[A-Z_]*_TOKEN=\S/],
+        ['generic-secret-var', /(^|\n)[A-Z_]*SECRET[A-Z_]*=\S/],
+    ];
+    // The ONE credential permitted in a sandbox is its own model token: sandbox-bound, spend-capped,
+    // worthless anywhere else. Normalize those assignments away so the scan reports only
+    // material that would actually be worth stealing.
+    const stripSandboxTokens = (text) => text.replace(/^[A-Z_]*=ahc_\S*$/gm, '');
+    const hits = (text) => SECRET_PATTERNS.filter(([, re]) => re.test(stripSandboxTokens(text))).map(([label]) => label);
+    const envHits = hits(env.out);
+    // 2. Every readable process environment in the sandbox's PID namespace — the actual attack that
+    // recovered PGPASSWORD from a sibling when the connector ran in the agent container (P2).
+    const proc = await run(rt, ['exec', opts.sandbox, 'sh', '-c',
+        'for p in /proc/[0-9]*; do tr "\\0" "\\n" < $p/environ 2>/dev/null; done']);
+    const procHits = hits(proc.out);
+    if (envHits.length === 0 && procHits.length === 0) {
+        const hasSandboxToken = /=ahc_/.test(env.out);
+        return {
+            name, status: 'pass',
+            detail: hasSandboxToken
+                ? 'only a sandbox-scoped model token is present; no provider key, DB password, or bearer secret in env or any /proc environ'
+                : 'no credential reachable in the sandbox env or any process environ',
+        };
+    }
+    return {
+        name, status: 'fail',
+        detail: `credential material reachable inside the sandbox — env: [${envHits.join(', ') || 'none'}], /proc: [${procHits.join(', ') || 'none'}]`,
+    };
+}
+/** isolation-tier — the declared tier is actually in force, probed, not assumed. */
+async function isolationTier(opts) {
+    const name = 'isolation-tier';
+    if (opts.tier === undefined) {
+        return { name, status: 'skip', detail: 'no --tier declared' };
+    }
+    if (opts.tier === 0) {
+        return { name, status: 'pass', detail: 'tier 0 declares no boundary — nothing to enforce' };
+    }
+    if (!opts.sandbox) {
+        return { name, status: 'skip', detail: 'no --sandbox given; cannot probe the boundary' };
+    }
+    const rt = opts.runtime ?? 'docker';
+    const pids = await run(rt, ['exec', opts.sandbox, 'sh', '-c', 'ls -d /proc/[0-9]* | wc -l']);
+    if (pids.code !== 0) {
+        return { name, status: 'skip', detail: 'cannot probe the sandbox' };
+    }
+    const count = parseInt(pids.out.trim(), 10);
+    // A sandbox in its own PID namespace sees only its own handful of processes. A sandbox sharing the
+    // host namespace sees everything — which is what tier 0 looks like wearing a tier-2 label.
+    if (!Number.isFinite(count)) {
+        return { name, status: 'skip', detail: 'unreadable process count' };
+    }
+    if (count > 50) {
+        return { name, status: 'fail', detail: `sandbox sees ${count} processes — PID namespace is NOT isolated despite tier ${opts.tier}` };
+    }
+    const nets = await run(rt, ['inspect', opts.sandbox, '--format', '{{json .NetworkSettings.Networks}}']);
+    const networks = Object.keys(JSON.parse(nets.out.trim() || '{}'));
+    if (networks.includes('bridge')) {
+        return { name, status: 'fail', detail: 'sandbox is on the default bridge — it is not route-confined' };
+    }
+    return {
+        name, status: 'pass',
+        detail: `tier ${opts.tier} in force: own PID namespace (${count} procs), routes=${networks.join(',') || 'none'}`,
+    };
+}
+/**
+ * cost-cap — the model credential in a sandbox cannot be replayed elsewhere (blocker C).
+ *
+ * Exercises the SHIPPED credential (the ES256 inference warrant serve actually mints), not the
+ * removed HMAC token: a check that proves a property of dead code proves nothing about the
+ * deployment. The proxy verifies with a public key, so it can check a warrant but never mint one.
+ */
+function costCap() {
+    const name = 'cost-cap';
+    const upstream = 'sk-conformance-upstream-key';
+    const key = (0, warrant_1.generateWarrantKeypair)('conformance-cost-cap');
+    const pubs = { [key.kid]: key.publicKeyPem };
+    const token = (0, support_1.mintSandboxInferenceWarrant)(key, {
+        user: 'probe@corp.com', pack: 'probe', packVersion: '0.0.0', sandboxId: 'sandbox-A', tier: 2,
+    });
+    const boundToOwnSandbox = (0, warrant_1.verifyWarrant)(token, pubs, { audience: 'inference', channelSandboxId: 'sandbox-A' }).ok;
+    const usableElsewhere = (0, warrant_1.verifyWarrant)(token, pubs, { audience: 'inference', channelSandboxId: 'sandbox-B' }).ok;
+    const leaksProvider = token.includes(upstream);
+    if (boundToOwnSandbox && !usableElsewhere && !leaksProvider) {
+        return { name, status: 'pass', detail: 'model token is a sandbox-bound signed warrant and carries no provider key — a cap cannot be evaded by replay' };
+    }
+    return {
+        name, status: 'fail',
+        detail: `warrant binding broken (own=${boundToOwnSandbox}, elsewhere=${usableElsewhere}, leaks=${leaksProvider})`,
+    };
+}
+/** evidence-integrity — a warrant proves authority and a gateway cannot mint one. */
+function warrantIntegrity() {
+    const name = 'warrant-integrity';
+    const key = (0, warrant_1.generateWarrantKeypair)('conformance');
+    const pubs = { [key.kid]: key.publicKeyPem };
+    const token = (0, warrant_1.mintWarrant)({
+        user: 'probe@corp.com', pack: 'probe', packVersion: '0.0.0',
+        sandboxId: 'sandbox-A', tier: 2, aud: 'data',
+    }, key);
+    const own = (0, warrant_1.verifyWarrant)(token, pubs, { audience: 'data', channelSandboxId: 'sandbox-A' });
+    const lifted = (0, warrant_1.verifyWarrant)(token, pubs, { audience: 'data', channelSandboxId: 'sandbox-B' });
+    const wrongAud = (0, warrant_1.verifyWarrant)(token, pubs, { audience: 'inference', channelSandboxId: 'sandbox-A' });
+    if (own.ok && !lifted.ok && !wrongAud.ok) {
+        return { name, status: 'pass', detail: 'warrants are signed, sandbox-bound, and audience-scoped; gateways verify but cannot mint' };
+    }
+    return { name, status: 'fail', detail: `warrant binding broken (own=${own.ok}, lifted=${lifted.ok}, wrongAud=${wrongAud.ok})` };
+}
+/** rollback + kill-switch — admission refuses unpinned versions and revoked leases. */
+function rollbackAndKill() {
+    const name = 'rollback-kill-switch';
+    const now = Math.floor(Date.now() / 1000);
+    const pinned = { pack: 'probe', version: '1.0.0', expiresAt: now + 60, enabled: true };
+    const results = {
+        pinnedAdmits: safe(() => (0, lease_1.assertAdmitted)(pinned, { pack: 'probe', version: '1.0.0', nowSeconds: now })),
+        otherVersionRefused: !safe(() => (0, lease_1.assertAdmitted)(pinned, { pack: 'probe', version: '1.0.1', nowSeconds: now })),
+        killSwitchRefuses: !safe(() => (0, lease_1.assertAdmitted)({ ...pinned, enabled: false }, { pack: 'probe', version: '1.0.0', nowSeconds: now })),
+        expiredRefused: !safe(() => (0, lease_1.assertAdmitted)({ ...pinned, expiresAt: now - 1 }, { pack: 'probe', version: '1.0.0', nowSeconds: now })),
+    };
+    const ok = Object.values(results).every(Boolean);
+    return {
+        name, status: ok ? 'pass' : 'fail',
+        detail: ok
+            ? 'pinned version admits, other versions refused, kill switch and expiry both fail closed'
+            : `admission contract broken: ${JSON.stringify(results)}`,
+    };
+}
+function safe(fn) {
+    try {
+        fn();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function conformanceCommand(opts) {
+    const tag = (kind) => (c) => ({ ...c, kind });
+    const results = [
+        tag('deployment')(await credentialConfinement(opts)),
+        tag('deployment')(await isolationTier(opts)),
+        tag('algorithm')(costCap()),
+        tag('algorithm')(warrantIntegrity()),
+        tag('algorithm')(rollbackAndKill()),
+    ];
+    const deployment = results.filter((r) => r.kind === 'deployment');
+    const probed = deployment.filter((r) => r.status !== 'skip');
+    const failed = results.filter((r) => r.status === 'fail');
+    // A run that probed nothing is the case this command exists to prevent: it must never be
+    // mistaken for a deployment that passed, in the text output, the JSON, or the exit code.
+    const nothingProbed = probed.length === 0;
+    if (opts.json) {
+        console.log(JSON.stringify({
+            results,
+            deployment_probed: !nothingProbed,
+            summary: nothingProbed
+                ? 'no deployment was probed — algorithm checks verify this binary only'
+                : `${probed.filter((r) => r.status === 'pass').length}/${probed.length} deployment checks passed`,
+        }, null, 2));
+    }
+    else {
+        console.log('\nAgentHippo conformance\n');
+        const show = (r) => {
+            const mark = r.status === 'pass' ? 'PASS' : r.status === 'fail' ? 'FAIL' : 'SKIP';
+            console.log(`  ${mark}  ${r.name}\n        ${r.detail}`);
+        };
+        console.log('THIS DEPLOYMENT  (probes a running sandbox)');
+        deployment.forEach(show);
+        console.log('\nTHIS BINARY  (contract checks — environment-independent, pass with no deployment)');
+        results.filter((r) => r.kind === 'algorithm').forEach(show);
+        console.log('');
+        if (nothingProbed) {
+            console.log('NO DEPLOYMENT WAS PROBED. The binary checks above say nothing about a running');
+            console.log('system — pass --sandbox <container> --tier <n> to actually test one.');
+        }
+        else {
+            const passed = probed.filter((r) => r.status === 'pass').length;
+            console.log(`${passed}/${probed.length} deployment checks passed` +
+                (deployment.length - probed.length ? `, ${deployment.length - probed.length} not probed` : ''));
+        }
+        if (failed.length) {
+            console.log(`${failed.length} FAILED`);
+        }
+    }
+    // Non-zero on failure so this can gate a deployment in CI — and non-zero when nothing was
+    // probed, so "green" always means a real deployment was measured.
+    if (failed.length) {
+        return 1;
+    }
+    return nothingProbed ? 2 : 0;
+}

package/out/cli/commands/data-plane.js

@@ -0,0 +1,67 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dataPlaneSidecarCommand = dataPlaneSidecarCommand;
+/**
+ * `agenthippo data-plane` — run the connector as a SIDECAR (secure-obo-design §7.6).
+ *
+ * This process is the connector's own trust domain: it holds the backend BASE credential
+ * (AWS keys, Postgres pool login, …) and runs in a SEPARATE container from the engine. The
+ * agent container's `serve` registers turns with this sidecar's authenticated control API and
+ * never sees the base credential.
+ */
+const pack_loader_1 = require("../pack-loader");
+const data_plane_1 = require("../data-plane");
+const headless_1 = require("../../headless");
+const utils_1 = require("../utils");
+async function dataPlaneSidecarCommand(options) {
+    const registerToken = process.env.AGENTHIPPO_DATA_PLANE_TOKEN?.trim();
+    if (!registerToken) {
+        console.error('Error: AGENTHIPPO_DATA_PLANE_TOKEN is required (shared secret the trusted EDGE — or, legacy, the agent\'s serve — presents to register turns).');
+        process.exit(1);
+    }
+    let pack;
+    try {
+        pack = await (0, pack_loader_1.loadAgentPack)(options.agent, options.workspace);
+    }
+    catch (err) {
+        console.error(`Error: ${err instanceof Error ? err.message : err}`);
+        process.exit(1);
+        return;
+    }
+    const cfg = (0, data_plane_1.resolveDataPlaneConfig)(pack.manifest.spec, pack.packPath);
+    if (!cfg) {
+        console.error('Error: pack declares no spec.dataPlane — nothing for the sidecar to run.');
+        process.exit(1);
+        return;
+    }
+    const logger = options.verbose ? new headless_1.ConsoleLogger('[Sidecar]') : new headless_1.NoOpLogger();
+    let sidecar;
+    try {
+        sidecar = await (0, data_plane_1.startDataPlaneSidecar)({
+            config: cfg,
+            registerToken,
+            gatewayPort: options.gatewayPort,
+            controlPort: options.controlPort,
+            bindHost: options.host ?? '0.0.0.0',
+            logger,
+        });
+    }
+    catch (err) {
+        console.error(`${utils_1.COLORS.red}Error: failed to start the data-plane sidecar:${utils_1.COLORS.reset} ${err instanceof Error ? err.message : err}`);
+        process.exit(1);
+        return;
+    }
+    console.log(`OK: Data-plane sidecar (provider=${cfg.provider ?? 'passthrough'}) — connector: ${cfg.connectorPath}`);
+    console.log(`  gateway (engine dials, nonce-auth): ${sidecar.gatewayUrl}`);
+    console.log(`  control (edge/serve registers, bearer):  :${sidecar.controlPort}`);
+    console.log('  Base credentials live here only — never in the agent container.');
+    console.log('  Edge mode (P1): give the register token to the IdP edge only; serve runs with AGENTHIPPO_DATA_PLANE_EDGE=1 and no token.');
+    const shutdown = () => { void sidecar.close().finally(() => process.exit(0)); };
+    process.on('SIGINT', shutdown);
+    process.on('SIGTERM', shutdown);
+    // Keep the process alive.
+    await new Promise(() => { });
+}

package/out/cli/commands/deploy.js

@@ -215,6 +215,7 @@ async function deployCommand(action, packArg, options) {
         cookieDomain: options.cookieDomain,
         colocate: options.colocate,
         modelRouting,
+        edgeTurnConnector: options.edgeTurnConnector?.trim() || undefined,
     };
     for (const target of targetsRequested) {
         const routingSuffix = modelRouting === 'gateway' ? '-gateway' : '';

package/out/cli/commands/gateway.js

@@ -115,6 +115,10 @@ async function gatewaySendCommand(options) {
         await sendViaEgressBroker(egressUrl, nonce, options);
         return;
     }
+    if (egressUrl) {
+        console.error('Error: egress broker is active but AGENTHIPPO_TURN_NONCE is missing — refusing direct gateway send');
+        process.exit(1);
+    }
     const storePath = resolveOutboundPath(options.outbound);
     await ensureStoreFileExists(storePath);
     const agentId = options.agent.trim();