@agenthippo-ai/agenthippo 0.2.3-dataplane → 1.110.9

package/out/test/tls-bypass.test.js

@@ -0,0 +1,90 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *
+ *  `applyLocalTlsBypass` sets NODE_TLS_REJECT_UNAUTHORIZED=0 in an engine child's environment.
+ *  It used to decide with `url.includes('localhost')`, so `https://localhost.attacker.tld/v1`
+ *  disabled certificate verification for that child.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const utils_1 = require("../utils");
+suite('local HTTPS detection', () => {
+    test('recognises the genuinely local endpoints', () => {
+        assert.ok((0, utils_1.isLocalHttps)('https://localhost:4000/v1'));
+        assert.ok((0, utils_1.isLocalHttps)('https://127.0.0.1:4000/v1'));
+        assert.ok((0, utils_1.isLocalHttps)('https://0.0.0.0:4000/v1'));
+        assert.ok((0, utils_1.isLocalHttps)('https://[::1]:4000/v1'));
+        assert.ok((0, utils_1.isLocalHttps)('https://LOCALHOST:4000/v1'), 'hostname comparison is case-insensitive');
+    });
+    test('a registrable domain that merely CONTAINS a loopback name is not local', () => {
+        // The bug: an attacker registers localhost.attacker.tld, points a routing setting at it,
+        // and the engine child stops verifying certificates for every TLS connection it makes.
+        assert.ok(!(0, utils_1.isLocalHttps)('https://localhost.attacker.tld/v1'));
+        assert.ok(!(0, utils_1.isLocalHttps)('https://127.0.0.1.attacker.tld/v1'));
+        assert.ok(!(0, utils_1.isLocalHttps)('https://not-localhost.example/v1'));
+        assert.ok(!(0, utils_1.isLocalHttps)('https://evil.example/?redirect=localhost'));
+        assert.ok(!(0, utils_1.isLocalHttps)('https://evil.example/localhost'));
+        assert.ok(!(0, utils_1.isLocalHttps)('https://evil.example/#127.0.0.1'));
+        assert.ok(!(0, utils_1.isLocalHttps)('https://user@localhost.attacker.tld/v1'));
+    });
+    test('http, empty and malformed values are not local HTTPS', () => {
+        assert.ok(!(0, utils_1.isLocalHttps)('http://localhost:4000/v1'), 'plain http needs no TLS bypass');
+        assert.ok(!(0, utils_1.isLocalHttps)(undefined));
+        assert.ok(!(0, utils_1.isLocalHttps)(''));
+        assert.ok(!(0, utils_1.isLocalHttps)('https://'));
+        assert.ok(!(0, utils_1.isLocalHttps)('localhost:4000'));
+    });
+});
+suite('local TLS bypass application', () => {
+    test('sets the bypass only for a genuinely local HTTPS endpoint', () => {
+        const env = {};
+        assert.strictEqual((0, utils_1.applyLocalTlsBypass)(env, 'https://127.0.0.1:4000/v1'), true);
+        assert.strictEqual(env.NODE_TLS_REJECT_UNAUTHORIZED, '0');
+    });
+    test('leaves the child env untouched for a lookalike host', () => {
+        const env = {};
+        assert.strictEqual((0, utils_1.applyLocalTlsBypass)(env, 'https://localhost.attacker.tld/v1'), false);
+        assert.strictEqual(env.NODE_TLS_REJECT_UNAUTHORIZED, undefined);
+        assert.deepStrictEqual(env, {}, 'nothing at all is added');
+    });
+    test('leaves the child env untouched for a remote provider', () => {
+        const env = {};
+        assert.strictEqual((0, utils_1.applyLocalTlsBypass)(env, 'https://api.anthropic.com/v1'), false);
+        assert.strictEqual(env.NODE_TLS_REJECT_UNAUTHORIZED, undefined);
+    });
+});

package/out/test/warrant.test.js

@@ -0,0 +1,138 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Signed warrants (PLAN/serve-v4-clean.md §6).
+ *
+ *  The properties under test are the ones that delete the P1 bug class:
+ *   - a gateway can verify but NEVER mint (no shared secret anywhere);
+ *   - a warrant is bound to its sandbox, so a lifted one fails from another sandbox;
+ *   - audience, expiry, and algorithm confusion are all refused.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const crypto = __importStar(require("node:crypto"));
+const warrant_1 = require("../authority/warrant");
+const KEY = (0, warrant_1.generateWarrantKeypair)('kid-1');
+const PUBS = { [KEY.kid]: KEY.publicKeyPem };
+function mint(over = {}) {
+    return (0, warrant_1.mintWarrant)({
+        user: 'alice@corp.com', pack: 'analyst', packVersion: '1.4.2',
+        sandboxId: 'sandbox-1', tier: 2, aud: 'data', ...over,
+    }, KEY);
+}
+suite('signed warrants', () => {
+    test('round-trips and carries the full evidence key', () => {
+        const res = (0, warrant_1.verifyWarrant)(mint(), PUBS, { audience: 'data', channelSandboxId: 'sandbox-1' });
+        assert.ok(res.ok, `expected ok, got ${JSON.stringify(res)}`);
+        if (!res.ok) {
+            return;
+        }
+        assert.strictEqual(res.claims.user, 'alice@corp.com');
+        assert.strictEqual(res.claims.packVersion, '1.4.2');
+        assert.strictEqual(res.claims.tier, 2, 'the isolation tier in force is recorded on every turn');
+        assert.ok(res.claims.jti, 'warrant id present — the key observers join evidence on');
+    });
+    test('a warrant lifted into another sandbox FAILS — channel binding, not bearer', () => {
+        const stolen = mint({ sandboxId: 'sandbox-1' });
+        const asOwner = (0, warrant_1.verifyWarrant)(stolen, PUBS, { audience: 'data', channelSandboxId: 'sandbox-1' });
+        const asThief = (0, warrant_1.verifyWarrant)(stolen, PUBS, { audience: 'data', channelSandboxId: 'sandbox-2' });
+        assert.ok(asOwner.ok, 'valid in its own sandbox');
+        assert.ok(!asThief.ok && /not bound to this channel/.test(asThief.reason), 'the same signature is refused from a different sandbox');
+    });
+    test('a gateway holding only the public key cannot mint', () => {
+        // The structural claim: verification material is not signing material. Attempting to
+        // sign with the SPKI public key throws — there is no path from verify to mint.
+        assert.throws(() => {
+            crypto.sign('sha256', Buffer.from('x.y'), {
+                key: crypto.createPrivateKey(KEY.publicKeyPem),
+                dsaEncoding: 'ieee-p1363',
+            });
+        }, 'a public key cannot be loaded as a private key');
+        const doc = (0, warrant_1.jwks)([KEY]);
+        const serialized = JSON.stringify(doc);
+        assert.ok(!serialized.includes('PRIVATE'), 'JWKS publishes no private material');
+        assert.ok(!doc.keys[0].d, 'the EC private scalar `d` must never appear in JWKS');
+    });
+    test('wrong audience is refused — a data warrant cannot spend at the inference proxy', () => {
+        const res = (0, warrant_1.verifyWarrant)(mint({ aud: 'data' }), PUBS, { audience: 'inference', channelSandboxId: 'sandbox-1' });
+        assert.ok(!res.ok && /wrong audience/.test(res.reason));
+    });
+    test('expiry is enforced and TTL is hard-capped at turn length', () => {
+        const now = 1_800_000_000;
+        const t = mint({ nowSeconds: now, ttlSeconds: 10 });
+        assert.ok((0, warrant_1.verifyWarrant)(t, PUBS, { audience: 'data', channelSandboxId: 'sandbox-1', nowSeconds: now + 5 }).ok);
+        const late = (0, warrant_1.verifyWarrant)(t, PUBS, { audience: 'data', channelSandboxId: 'sandbox-1', nowSeconds: now + 11 });
+        assert.ok(!late.ok && /expired/.test(late.reason));
+        // A caller asking for a day-long warrant gets a turn-long one — there is no revocation
+        // registry, so lifetime IS the bound.
+        const greedy = mint({ nowSeconds: now, ttlSeconds: 86_400 });
+        const capped = (0, warrant_1.verifyWarrant)(greedy, PUBS, { audience: 'data', channelSandboxId: 'sandbox-1', nowSeconds: now + 301 });
+        assert.ok(!capped.ok && /expired/.test(capped.reason), 'TTL capped at 300s regardless of request');
+    });
+    test('algorithm confusion is refused (alg=none, alg=HS256)', () => {
+        const claims = Buffer.from(JSON.stringify({
+            user: 'mallory', pack: 'p', packVersion: '1', sandboxId: 'sandbox-1', tier: 2,
+            aud: 'data', iat: 0, exp: 9_999_999_999, jti: 'x',
+        })).toString('base64url');
+        const none = `${Buffer.from(JSON.stringify({ alg: 'none', kid: KEY.kid })).toString('base64url')}.${claims}.`;
+        assert.ok(!(0, warrant_1.verifyWarrant)(none, PUBS, { audience: 'data' }).ok, 'alg=none refused');
+        // The classic break: sign with HMAC using the PUBLIC key as the secret.
+        const hdr = Buffer.from(JSON.stringify({ alg: 'HS256', kid: KEY.kid })).toString('base64url');
+        const forged = crypto.createHmac('sha256', KEY.publicKeyPem).update(`${hdr}.${claims}`).digest('base64url');
+        assert.ok(!(0, warrant_1.verifyWarrant)(`${hdr}.${claims}.${forged}`, PUBS, { audience: 'data' }).ok, 'HS256 confusion refused');
+    });
+    test('a tampered claim invalidates the signature', () => {
+        const [h, c, s] = mint().split('.');
+        const swapped = JSON.parse(Buffer.from(c, 'base64url').toString('utf8'));
+        swapped.user = 'mallory@evil.com'; // escalate to another principal
+        const tampered = `${h}.${Buffer.from(JSON.stringify(swapped)).toString('base64url')}.${s}`;
+        const res = (0, warrant_1.verifyWarrant)(tampered, PUBS, { audience: 'data', channelSandboxId: 'sandbox-1' });
+        assert.ok(!res.ok && /bad signature/.test(res.reason), 'rewriting the principal breaks the signature');
+    });
+    test('an unknown key id is refused (no implicit trust on rotation)', () => {
+        const other = (0, warrant_1.generateWarrantKeypair)('kid-2');
+        const res = (0, warrant_1.verifyWarrant)((0, warrant_1.mintWarrant)({
+            user: 'a', pack: 'p', packVersion: '1', sandboxId: 'sandbox-1', tier: 2, aud: 'data',
+        }, other), PUBS, { audience: 'data', channelSandboxId: 'sandbox-1' });
+        assert.ok(!res.ok && /unknown kid/.test(res.reason));
+    });
+    test('malformed input never throws — the sandbox is untrusted toward the gateway', () => {
+        for (const bad of ['', 'a', 'a.b', 'a.b.c', '..', 'null.null.null']) {
+            const res = (0, warrant_1.verifyWarrant)(bad, PUBS, { audience: 'data' });
+            assert.ok(!res.ok, `must refuse: ${bad}`);
+        }
+    });
+});

package/out/utils.js

@@ -76,6 +76,7 @@ const path = __importStar(require("path"));
 const crypto = __importStar(require("crypto"));
 const shared_1 = require("./shared");
 const branding_1 = require("./branding");
+const customRegistry_1 = require("./engines/customRegistry");
 const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
 // Lazy-load vscode to allow bundling for CLI/headless mode
 // Use eval to prevent Bun from statically analyzing the require
@@ -463,12 +464,19 @@ async function syncDirByFileLinks(sourceDir, targetDir, logger, label) {
     };
     await cleanup(targetDir, '');
 }
+function getManagedWorkspaceDirs(workspaceRoot, extraSearchPath) {
+    const builtins = Object.values(shared_1.AGENT_ENGINES).map(engine => engine.workspaceDir);
+    const custom = (0, customRegistry_1.discoverCustomEngineManifests)(workspaceRoot, extraSearchPath)
+        .filter(manifest => manifest.workspaceSync?.enabled)
+        .map(manifest => manifest.workspaceSync.dir);
+    return [...new Set([...builtins, ...custom])];
+}
 /**
  * Ensure workspace root has git initialized and .gitignore entries for agent directories.
  * If the folder is not a git repository, runs `git init`.
- * Adds the agent root, .claude, .codex to the root .gitignore if not already present.
+ * Adds managed engine workspace dirs (builtins + custom engines with workspaceSync) to root .gitignore.
  */
-async function ensureWorkspaceGitAndGitignore(workspaceRoot, logger) {
+async function ensureWorkspaceGitAndGitignore(workspaceRoot, logger, options) {
     const gitDir = path.join(workspaceRoot, '.git');
     // Check if .git exists
     const gitExists = await pathExists(gitDir);
@@ -485,10 +493,7 @@ async function ensureWorkspaceGitAndGitignore(workspaceRoot, logger) {
     }
     // Ensure root .gitignore has entries for agent directories
     const rootGitignorePath = path.join(workspaceRoot, '.gitignore');
-    // Build the list of directories to ignore from AGENT_ENGINES
-    const agentideDirs = [
-        ...Object.values(shared_1.AGENT_ENGINES).map(engine => engine.workspaceDir),
-    ];
+    const agentideDirs = getManagedWorkspaceDirs(workspaceRoot, options?.extraSearchPath);
     const managedBlockLines = [
         `# ${branding_1.AGENTIDE_BRAND_NAME} (managed)`,
         `# These directories are managed by ${branding_1.AGENTIDE_BRAND_NAME} and should not be committed.`,
@@ -609,17 +614,49 @@ function shortSig(input) {
 // Environment Utilities
 // -----------------------------------------------------------------------------
 /**
- * Check if a URL is a local HTTPS address (localhost, 127.0.0.1, 0.0.0.0).
+ * Hostnames that are unambiguously this machine. Compared against the PARSED hostname, never a
+ * substring of the URL.
+ */
+const LOCAL_TLS_HOSTNAMES = new Set(['localhost', '127.0.0.1', '0.0.0.0', '::1', '[::1]']);
+/**
+ * Is this URL an HTTPS endpoint on the local machine (a dev LiteLLM/proxy with a self-signed cert)?
+ *
+ * This used to be `url.includes('localhost')`, which is a substring test on the WHOLE URL — so
+ * `https://localhost.attacker.tld/v1` matched, and the caller then disabled TLS verification for
+ * the engine child process talking to it. The hostname is parsed and compared exactly now: a
+ * registrable domain that merely *contains* "localhost" is a remote host like any other.
+ *
+ * Note the IPv6 form: `new URL('https://[::1]/').hostname` is `[::1]` (brackets included), so both
+ * spellings are in the set.
  */
 function isLocalHttps(url) {
     if (!url) {
         return false;
     }
-    return url.startsWith('https://') && (url.includes('localhost') || url.includes('127.0.0.1') || url.includes('0.0.0.0'));
+    try {
+        const parsed = new URL(url);
+        return parsed.protocol === 'https:' && LOCAL_TLS_HOSTNAMES.has(parsed.hostname.toLowerCase());
+    }
+    catch {
+        return false;
+    }
 }
 /**
  * Apply TLS verification bypass for local HTTPS in an environment object.
- * Returns the modified env and whether TLS was disabled.
+ * Returns whether TLS verification was disabled.
+ *
+ * **Residual risk, stated plainly.** `NODE_TLS_REJECT_UNAUTHORIZED=0` is PROCESS-WIDE inside the
+ * engine child: it disables certificate verification for every TLS connection that child makes,
+ * not just the one to the local proxy. Scoping it per-request is not available to us here — the
+ * engines are vendor SDKs (Claude Agent SDK, Codex SDK, arbitrary custom-engine binaries) spawned
+ * as separate processes, and the only channel we have into their HTTP stack is the environment.
+ * Passing a CA bundle instead (`NODE_EXTRA_CA_CERTS`) would be the real fix and requires the local
+ * proxy to publish its cert, which it does not today.
+ *
+ * What bounds the risk is therefore entirely the check above: the bypass is only ever enabled when
+ * the routing endpoint is literally this machine, which is also the only place a self-signed cert
+ * is expected. That is why the substring match mattered — it turned an opt-in for `127.0.0.1` into
+ * an opt-in for any hostname an attacker could register.
  */
 function applyLocalTlsBypass(env, baseUrl) {
     if (isLocalHttps(baseUrl)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenthippo-ai/agenthippo",
-  "version": "0.2.3-dataplane",
+  "version": "1.110.9",
   "description": "AgentHippo CLI — serve, chat, and deploy agent packs",
   "author": "AgentHippo <dev@agenthippo.ai>",
   "license": "SEE LICENSE IN LICENSE",