@agenthippo-ai/agenthippo 0.2.3-dataplane → 1.110.9

package/out/cli/index.js

@@ -75,6 +75,7 @@ const commander_1 = require("commander");
 const chat_1 = require("./commands/chat");
 const ask_1 = require("./commands/ask");
 const serve_1 = require("./commands/serve");
+const data_plane_1 = require("./commands/data-plane");
 const auth_broker_1 = require("./commands/auth-broker");
 const deploy_1 = require("./commands/deploy");
 const idp_1 = require("./commands/idp");
@@ -86,6 +87,26 @@ const probe_custom_engine_1 = require("./commands/probe-custom-engine");
 const deps_1 = require("./deps");
 const branding_1 = require("../branding");
 const agentEnvFile_1 = require("../utils/agentEnvFile");
+const caps_1 = require("../pack/caps");
+/**
+ * `--max-concurrent-sandboxes`, honouring the deprecated `--max-concurrent-cells`.
+ *
+ * The current spelling wins outright when both are given; the old one is honoured with a loud
+ * notice rather than dropped, because dropping it would silently REMOVE a blast-radius cap from a
+ * deployment that believes it still has one.
+ */
+function resolveMaxConcurrentSandboxes(options) {
+    const current = parseInt(options.maxConcurrentSandboxes ?? '', 10);
+    if (Number.isFinite(current) && current > 0) {
+        return current;
+    }
+    const legacy = parseInt(options.maxConcurrentCells ?? '', 10);
+    if (Number.isFinite(legacy) && legacy > 0) {
+        console.warn(`Warning: --max-concurrent-cells is DEPRECATED; use ${caps_1.DEPRECATED_CAP_SPELLINGS['--max-concurrent-cells']}. Honouring it for now.`);
+        return legacy;
+    }
+    return undefined;
+}
 const VERSION = '1.110.8';
 const CLI_DESCRIPTION = [
     `${branding_1.AGENTIDE_BRAND_NAME} CLI - Run agent packs from the command line`,
@@ -102,14 +123,22 @@ const CLI_DESCRIPTION = [
     '  AGENTHIPPO_STORE_REPO        Override store GitHub repo (owner/repo; CLI store commands)',
     '',
     'Quickstart:',
-    `  AGENTHIPPO_LITELLM_BASE_URL="http://localhost:4000" AGENTHIPPO_LITELLM_API_KEY="dummy" AGENTHIPPO_DEFAULT_MODEL="litellm/gpt-5.3-codex" AGENTHIPPO_DEFAULT_ENGINE="codex" ${branding_1.AGENTIDE_CLI_NAME} ask "Reply with exactly: CLI_TEST_OK"`,
+    `  AGENTHIPPO_LITELLM_BASE_URL="http://localhost:4000" AGENTHIPPO_LITELLM_API_KEY="dummy" AGENTHIPPO_DEFAULT_MODEL="litellm/gpt-5.5" AGENTHIPPO_DEFAULT_ENGINE="codex" ${branding_1.AGENTIDE_CLI_NAME} ask "Reply with exactly: CLI_TEST_OK"`,
     '',
     'Agent Packs:',
     `  Loaded from ~/${branding_1.AGENTIDE_DIR_NAME}/agents/<name>/ or absolute/relative paths.`,
     '  Pack permissions control filesystem access scope.',
 ].join('\n');
 const program = new commander_1.Command();
-program.hook('preAction', async () => {
+program.hook('preAction', async (_thisCommand, actionCommand) => {
+    // A SANDBOX must never absorb ambient credentials. Every other command merges ~/.agent-hippo/.env
+    // as a convenience, but doing that inside a sandbox would silently hand the sandboxed engine
+    // every key on the host — defeating the driver's curated env allowlist (observed live: the
+    // cursor engine picked up CURSOR_API_KEY this way). A sandbox receives only what its driver
+    // explicitly passes.
+    if (actionCommand?.name() === 'sandbox') {
+        return;
+    }
     await (0, agentEnvFile_1.mergeAgentHomeEnvIntoProcessEnv)();
 });
 program
@@ -126,7 +155,7 @@ program
     .description('Start interactive chat session')
     .option('-a, --agent <name>', 'Agent pack to use')
     .option('-e, --engine <id>', 'Override pack engine: claude|codex|<custom-engine-id>')
-    .option('-m, --model <id>', 'Override pack model (e.g. litellm/gpt-4.1-nano)')
+    .option('-m, --model <id>', 'Override pack model (e.g. litellm/gpt-5.6-luna)')
     .option('-w, --workspace <path>', 'Workspace directory', process.cwd())
     .action(async (options) => {
     const verbose = program.opts().verbose;
@@ -145,7 +174,7 @@ program
     .description('Send a single message and exit')
     .option('-a, --agent <name>', 'Agent pack to use')
     .option('-e, --engine <id>', 'Override pack engine: claude|codex|<custom-engine-id>')
-    .option('-m, --model <id>', 'Override pack model (e.g. litellm/gpt-4.1-nano)')
+    .option('-m, --model <id>', 'Override pack model (e.g. litellm/gpt-5.6-luna)')
     .option('-w, --workspace <path>', 'Workspace directory', process.cwd())
     .option('-f, --file <path>', 'Include file content in context')
     .option('--json', 'Output as JSON')
@@ -176,7 +205,7 @@ program
     .requiredOption('--prompt <message>', 'Prompt text')
     .option('--pack <name>', 'Agent pack to use')
     .option('-e, --engine <id>', 'Override pack engine: claude|codex|<custom-engine-id>')
-    .option('-m, --model <id>', 'Override pack model (e.g. litellm/gpt-4.1-nano)')
+    .option('-m, --model <id>', 'Override pack model (e.g. litellm/gpt-5.6-luna)')
     .option('-w, --workspace <path>', 'Workspace directory', process.cwd())
     .option('--session-id <id>', 'Optional session id for the caller')
     .option('--system-prompt <text>', 'Optional system prompt override')
@@ -204,7 +233,7 @@ program
     .description('Start HTTP server')
     .requiredOption('-a, --agent <name>', 'Agent pack to use (required)')
     .option('-e, --engine <id>', 'Override pack engine: claude|codex|<custom-engine-id>')
-    .option('-m, --model <id>', 'Override pack model (e.g. litellm/gpt-4.1-nano)')
+    .option('-m, --model <id>', 'Override pack model (e.g. litellm/gpt-5.6-luna)')
     .option('-p, --port <port>', 'Port to listen on', '3000')
     .option('--host <address>', 'Address to bind the HTTP server (default 127.0.0.1; use 0.0.0.0 in containers/behind a proxy)')
     .option('-w, --workspace <path>', 'Default workspace directory', process.cwd())
@@ -213,18 +242,52 @@ program
     .option('--state-dir <path>', 'Persist session state here (honors AGENTHIPPO_HOME; replaces the tmpdir default)')
     .option('--max-turns-per-session <n>', 'Cap turns per session (abuse/runaway guard); 0 = unlimited', '0')
     .option('--www-dir <path>', 'Serve deploy/www/index.html at GET / (static browser chat UI)')
-    // Deprecated no-ops: kept so deploy artifacts generated by older CLIs (which baked these
-    // into the serve command line) don't crash with "unknown option" after a runtime upgrade.
-    // Serve now trusts its front proxy for auth/CORS; these flags no longer do anything.
-    .option('--production', 'Deprecated: no-op (serve trusts its front proxy; hardening moved to the deploy edge)')
-    .option('--cors-origin <origins>', 'Deprecated: no-op (CORS is handled by the front proxy)')
+    .option('--sandbox <mode>', 'Run each session\'s engine in a sandbox: process (tier 0, no boundary) or container (tier 2, one disposable container per session with only its declared routes). Unset = in-process (default, unchanged)')
+    .option('--sandbox-image <ref>', '--sandbox container: sandbox image pinned BY DIGEST (image@sha256:...)')
+    .option('--pull-packs', 'Fetch the version the lease pins from the store instead of only refusing others. Always verifies the signature; a fetch or verification failure keeps serving the current version')
+    .option('--require-signed-pack', 'Refuse to start a sandbox unless the pack is signed by a trusted key (the lease may also require this; neither side can waive the other). Now the DEFAULT — kept so existing invocations still mean something')
+    .option('--allow-unsigned-pack', 'LOCAL DEVELOPMENT ONLY: run a pack this instance cannot verify. Signature checking is required by default; this disables it and warns loudly on every boot. A lease that sets requireSignedPack still overrides it')
+    .option('--require-signed-lease', 'Refuse to act on a lease that is not signed (ES256 compact JWS) by a trusted key. Tighten-only with lease.requireSignedLease, and sticky once a signed lease has been seen')
+    .option('--lease-max-staleness <seconds>', 'Refuse turns after this long with no successful lease refresh, so network denial cannot hold a revoked fleet open (default 86400; 0 disables)')
+    .option('--sandbox-ttl <seconds>', '--sandbox: reap an idle sandbox after N seconds; the next message recreates it and resumes the session', '1800')
+    .option('--shared-workspace', '--sandbox container: mount ONE workspace into every session\'s sandbox (default: one per session). Sessions can then read and overwrite each other\'s files — only for a single trust domain')
+    // Control plane (serve-v4-clean §5). Caps are enforced by revoking a sandbox's routes, so they
+    // need --sandbox; a lease may impose tighter values than these, and never looser ones.
+    .option('--max-session-seconds <seconds>', '--sandbox: cap one session\'s wall-clock lifetime; a breach revokes or destroys its sandbox')
+    .option('--max-concurrent-sandboxes <n>', '--sandbox: cap live sandboxes on this instance (blast radius)')
+    // Deprecated pre-rename spelling. Hidden so it does not advertise itself, honoured so an
+    // existing deployment does not silently lose its cap, and loud so it gets migrated.
+    .addOption(new commander_1.Option('--max-concurrent-cells <n>', 'DEPRECATED alias for --max-concurrent-sandboxes').hideHelp())
+    .option('--cap-on-breach <action>', '--sandbox: what a cap breach does — revoke-inference (default) or destroy-sandbox. An unrecognised value fails CLOSED to destroy-sandbox')
+    .option('--lease-poll <seconds>', '--sandbox: how often to re-check the lease, so a kill switch stops RUNNING sandboxes. Worst-case kill latency is 2x this (poll + cache); an admin refresh is immediate', '30')
     .action(async (options) => {
-    if (options.production || options.corsOrigin) {
-        console.warn('[serve] --production/--cors-origin are deprecated no-ops; auth and CORS are enforced by the deploy edge proxy.');
-    }
     const verbose = program.opts().verbose;
     await (0, deps_1.ensureDeps)(verbose);
     await (0, serve_1.serveCommand)({
+        sandbox: options.sandbox === 'container' ? 'container' : options.sandbox === 'process' ? 'process' : undefined,
+        sandboxImage: options.sandboxImage,
+        requireSignedPack: Boolean(options.requireSignedPack),
+        allowUnsignedPack: Boolean(options.allowUnsignedPack),
+        requireSignedLease: Boolean(options.requireSignedLease),
+        leaseMaxStalenessSeconds: options.leaseMaxStaleness !== undefined
+            ? (Number.isFinite(Number(options.leaseMaxStaleness)) ? Number(options.leaseMaxStaleness) : undefined)
+            : undefined,
+        pullPacks: Boolean(options.pullPacks),
+        sandboxTtlSeconds: parseInt(options.sandboxTtl, 10) || undefined,
+        sharedWorkspace: Boolean(options.sharedWorkspace),
+        maxSessionSeconds: parseInt(options.maxSessionSeconds, 10) || undefined,
+        maxConcurrentSandboxes: resolveMaxConcurrentSandboxes(options),
+        // Shared with the env path (pack/caps.ts) so a value that is valid in one is valid in the
+        // other. An unrecognised action no longer becomes `undefined` — which mergeCaps then
+        // defaulted to the WEAKER revoke-inference, silently downgrading what the operator typed.
+        capOnBreach: (() => {
+            const r = (0, caps_1.resolveOnBreach)(options.capOnBreach, '--cap-on-breach');
+            for (const w of r.warnings) {
+                console.warn(`Warning: ${w}`);
+            }
+            return r.action;
+        })(),
+        leasePollSeconds: parseInt(options.leasePoll, 10) || undefined,
         agent: options.agent,
         engine: options.engine,
         model: options.model,
@@ -239,6 +302,68 @@ program
         verbose,
     });
 });
+// Conformance — the deployment proves its own claims (serve-v4-clean.md §11 step 5).
+program
+    .command('conformance')
+    .description('Probe a deployment against its own claims: credential confinement, isolation tier, cost-cap binding, warrant integrity, rollback/kill switch. Exit 1 on any failure, 2 when no deployment was probed (--sandbox/--tier omitted) — only exit 0 means a real deployment was measured.')
+    .option('--sandbox <id>', 'Running sandbox container id/name — required to probe INSIDE a sandbox')
+    .option('--tier <n>', 'Declared isolation tier (0-3); probed, not trusted')
+    .option('--runtime <bin>', 'Container runtime binary', 'docker')
+    .option('--json', 'Emit JSON')
+    .action(async (options) => {
+    const { conformanceCommand } = await import('./commands/conformance.js');
+    const code = await conformanceCommand({
+        sandbox: options.sandbox,
+        tier: options.tier === undefined ? undefined : parseInt(options.tier, 10),
+        runtime: options.runtime,
+        json: Boolean(options.json),
+    });
+    process.exitCode = code;
+});
+// Sandbox runner — runs INSIDE a sandbox; holds no credential (serve-v4-clean.md §3).
+program
+    .command('sandbox')
+    .description('Run the in-sandbox engine host (sandbox runner). Speaks the frame protocol to serve over a unix socket or stdio; holds no data or model credential.')
+    .requiredOption('-a, --agent <path>', 'Pack directory mounted into the sandbox')
+    .option('--socket <path>', 'Unix socket to listen on (container driver)')
+    .option('--stdio', 'Speak the protocol on stdin/stdout instead (process driver)')
+    // No default: it must fall back to <state-dir>/workspace inside the command, or a
+    // host-launched sandbox (where --state-dir is a real host path) inherits the container-image
+    // path and dies on mkdir.
+    .option('-w, --workspace <path>', 'Workspace directory (default: <state-dir>/workspace)')
+    .option('--state-dir <path>', 'State directory', '/state')
+    .option('--sandbox-id <id>', 'Sandbox id (joins evidence records)')
+    .action(async (options) => {
+    const { sandboxCommand } = await import('./commands/sandbox.js');
+    await sandboxCommand({
+        agent: options.agent,
+        socket: options.socket,
+        stdio: Boolean(options.stdio),
+        workspace: options.workspace,
+        stateDir: options.stateDir,
+        sandboxId: options.sandboxId,
+    });
+});
+program
+    .command('data-plane')
+    .description('Run the connector as a sidecar (holds the backend base credential; the agent container does not)')
+    .requiredOption('-a, --agent <name>', 'Agent pack (reads spec.dataPlane connector + provider)')
+    .option('-w, --workspace <path>', 'Workspace directory', process.cwd())
+    .option('--gateway-port <port>', 'Port the engine dials (nonce-auth MCP)', '9090')
+    .option('--control-port <port>', 'Port serve dials to register turns (bearer-auth)', '9091')
+    .option('--host <address>', 'Bind address (default 0.0.0.0 for the pod network)')
+    .action(async (options) => {
+    const verbose = program.opts().verbose;
+    await (0, deps_1.ensureDeps)(verbose);
+    await (0, data_plane_1.dataPlaneSidecarCommand)({
+        agent: options.agent,
+        workspace: options.workspace,
+        gatewayPort: parseInt(options.gatewayPort, 10),
+        controlPort: parseInt(options.controlPort, 10),
+        host: options.host,
+        verbose,
+    });
+});
 program
     .command('auth-broker')
     .description('Start the AgentHippo auth broker (OAuth + IDE bootstrap API)')
@@ -262,6 +387,7 @@ program
     .option('--idp-url <url>', 'edge-fed: central IdP base URL browsers redirect to for login (e.g. https://auth.agenthippo.ai)', 'https://auth.agenthippo.ai')
     .option('--cookie-domain <domain>', 'edge-fed: parent domain the shared auth cookie is scoped to (e.g. .agenthippo.ai)', '.agenthippo.ai')
     .option('--colocate', 'edge-fed + vm/compose only: ride the org IdP\'s already-running Caddy + auth-broker instead of shipping this agent\'s own (PLAN/deploy.md §4 state 4)')
+    .option('--edge-turn-connector <addr>', 'EDGE turn registration (P1 fix): connector sidecar control-API address (e.g. mypack-connector:9091); the generated route registers each chat turn via forward_auth /edge/turn and copies X-Agent-Turn-Nonce — the agent container never holds the register token')
     .option('--model-routing <mode>', 'Cloud Run + edge-fed: sidecar (in-pod LiteLLM+OTEL, default) or gateway (agent → gateway.agenthippo.ai directly, lean)')
     .option('--force', 'Overwrite existing files')
     .action(async (action, pack, options) => {
@@ -283,6 +409,7 @@ program
         cookieDomain: options.cookieDomain,
         colocate: Boolean(options.colocate),
         modelRouting,
+        edgeTurnConnector: options.edgeTurnConnector,
     });
 });
 // IdP command - generate the central IdP stack (org identity infra, set up once)
@@ -304,16 +431,28 @@ program
 // Pack command - pack management
 program
     .command('pack <action>')
-    .description('Manage agent packs (list, validate, install)')
+    .description('Manage agent packs (list, validate, sign, verify, digest, keygen, install)')
     .argument('[name]', 'Pack name or path')
-    .option('-o, --output <path>', 'Output path for export')
+    .option('-o, --output <path>', 'Output path for export, or for a generated signing key')
+    .option('--key <path>', 'pack sign: PEM file holding the ES256 private key')
+    .option('--kid <id>', 'pack sign/keygen: key id published in JWKS so verifiers can find the public half')
+    .option('--keys <path>', 'pack verify: JSON file of kid -> public PEM')
+    .option('--jwks <url>', 'pack verify: JWKS endpoint to fetch public halves from')
+    .option('--to <dir>', 'pack install: destination folder (flat layout for serve/deploy)')
+    .option('-f, --force', 'pack install: overwrite an existing folder')
     .option('-w, --workspace <path>', 'Workspace directory for local packs', process.cwd())
     .action(async (action, name, options) => {
     await (0, pack_1.packCommand)({
         action,
         name,
         output: options.output,
+        to: options.to,
+        force: options.force,
         workspace: options.workspace,
+        key: options.key,
+        kid: options.kid,
+        keys: options.keys,
+        jwks: options.jwks,
         verbose: program.opts().verbose,
     });
 });

package/out/cli/pack-install-ref.js

@@ -0,0 +1,15 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parsePackInstallRef = parsePackInstallRef;
+/** Parse `slug` or `slug@version` from `pack install` positional arg. */
+function parsePackInstallRef(name) {
+    const trimmed = name.trim();
+    const at = trimmed.lastIndexOf('@');
+    if (at > 0) {
+        return { slug: trimmed.slice(0, at), version: trimmed.slice(at + 1) || undefined };
+    }
+    return { slug: trimmed };
+}

package/out/cli/pack-loader.js

@@ -373,7 +373,14 @@ function getApiConfig() {
     const litellmBaseUrl = getEnvVar('AGENTHIPPO_LITELLM_BASE_URL', 'AGENTIDE_LITELLM_BASE_URL');
     const anthropicApiKey = process.env.ANTHROPIC_API_KEY || process.env.CLAUDE_API_KEY;
     const openaiApiKey = process.env.OPENAI_API_KEY;
-    const useLiteLLM = Boolean(litellmApiKey && litellmBaseUrl);
+    // The URL alone defines the trust domain. When a LiteLLM/gateway URL is configured, ALL
+    // engine traffic routes there — so it must authenticate with the LiteLLM key (or
+    // resolveApiRouting's 'sk-dummy' fallback), NEVER a provider secret, and must carry the
+    // analytics metadata headers. Requiring key+URL here once created a silent half-state:
+    // URL-only routed every call to the gateway with the REAL provider key as auth and no
+    // metadata at all (verified live 2026-07-27 with a header-capture stub). A missing key now
+    // yields a clean 401 against a strict gateway instead of a leaked credential.
+    const useLiteLLM = Boolean(litellmBaseUrl);
     return {
         // Kept only for the "is any credential present at all?" boot check; routing never uses it.
         apiKey: litellmApiKey || anthropicApiKey || openaiApiKey,

package/out/cli/pack-runtime.js

@@ -0,0 +1,61 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createPackRunner = createPackRunner;
+/**
+ * One way to stand up a `HeadlessRunner` for an agent pack.
+ *
+ * `serve` and `sandbox` run the SAME engines against the SAME pack; the only difference is where
+ * the process sits. Every time the sandbox re-derived a piece of that setup itself it drifted from
+ * serve and broke live (the hand-rolled agent.yaml parser, the engine executable paths, the
+ * skipped `ensureDeps`). So the wiring lives here once and both call it: engine discovery,
+ * bundled prompts, the child env patch, and the credential shape.
+ *
+ * What is NOT here is deliberately not shared: credentials are the caller's business. serve
+ * holds provider keys; a sandbox only ever gets a per-sandbox, budget-capped model token that arrives
+ * on the run frame. Both express that through `credentials`, and nothing in this module can
+ * widen it.
+ */
+const headless_1 = require("../headless");
+const runtime_1 = require("./runtime");
+const utils_1 = require("./utils");
+/**
+ * Build the runner. Engine executables are resolved here rather than by the SDKs themselves:
+ * the engines ship WITH agenthippo, and a runtime image does not carry the SDK's own bundled
+ * cli.js — without these paths every turn inside a sandbox fails with "executable not found".
+ */
+function createPackRunner(options) {
+    return (0, headless_1.createHeadlessRunner)({
+        storagePath: options.storagePath,
+        analyticsSessionsDir: options.analyticsSessionsDir,
+        packId: options.packId,
+        packVersion: options.packVersion,
+        provenance: options.provenance,
+        bundledPromptsDir: (0, utils_1.findBundledBasePromptsDir)(),
+        apiKey: options.credentials.apiKey,
+        baseUrl: options.credentials.baseUrl,
+        useLiteLLM: options.credentials.useLiteLLM,
+        litellmApiKey: options.credentials.litellmApiKey,
+        openaiApiKey: options.credentials.openaiApiKey,
+        anthropicApiKey: options.credentials.anthropicApiKey,
+        logger: options.logger,
+        freshState: options.freshState ?? false,
+        claudeCodeExecutablePath: (0, utils_1.findClaudeCodePath)(),
+        codexExecutablePath: (0, utils_1.findCodexPath)(),
+        permissionHandler: options.permissionHandler,
+        // Gives engine children AGENTHIPPO_WORKSPACE_ROOT / AGENTHIPPO_ACTIVE_AGENT and puts the
+        // agenthippo binary on their PATH — without it a pack skill that shells out to the CLI
+        // cannot find it, which is exactly the kind of silent difference a sandbox must not have.
+        cliEnvPatch: (0, runtime_1.buildCliEnvPatch)({
+            cliPath: process.execPath,
+            workspaceRoot: options.workspaceRoot,
+            agentId: options.packId,
+            chatSessionId: options.chatSessionId,
+            baseEnv: process.env,
+            omitGatewayToken: options.omitGatewayToken,
+        }),
+        ...(options.claudeCheapModel ? { engineSettings: { claudeCheapModel: options.claudeCheapModel } } : {}),
+    });
+}

package/out/cli/runtime.js

@@ -42,6 +42,8 @@ exports.getBundledToolsHealth = getBundledToolsHealth;
 exports.getCliHealth = getCliHealth;
 exports.buildSessionEnvPatch = buildSessionEnvPatch;
 exports.buildCliEnvPatch = buildCliEnvPatch;
+exports.readProvenanceEnvFromProcess = readProvenanceEnvFromProcess;
+exports.buildProvenanceEnv = buildProvenanceEnv;
 exports.runCli = runCli;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
@@ -320,7 +322,7 @@ function buildCliEnvPatch(args) {
     // nonce. AGENTHIPPO_EGRESS_URL in the process env is that signal — with it set, never bake
     // the token into a child env (this closes §7.4 gap 1 for custom engines; codex/claude are
     // covered by serve stripping the token from its own process.env).
-    if (!process.env.AGENTHIPPO_EGRESS_URL?.trim()) {
+    if (!args.omitGatewayToken && !process.env.AGENTHIPPO_EGRESS_URL?.trim()) {
         const gatewayToken = readOpenClawGatewayToken(args.baseEnv);
         if (gatewayToken) {
             env[exports.OPENCLAW_GATEWAY_TOKEN_ENV] = gatewayToken;
@@ -368,6 +370,38 @@ function buildCliEnvPatch(args) {
     }
     return env;
 }
+/** Read provenance stamp env vars injected into sandbox children by serve. */
+function readProvenanceEnvFromProcess() {
+    const pick = (key) => process.env[key]?.trim() || undefined;
+    const tierRaw = pick('AGENTIDE_ANALYTICS_TIER');
+    const tier = tierRaw !== undefined ? Number(tierRaw) : undefined;
+    return {
+        policyVersion: pick('AGENTIDE_ANALYTICS_POLICY_VERSION'),
+        packDigest: pick('AGENTIDE_ANALYTICS_PACK_DIGEST'),
+        engineVersion: pick('AGENTIDE_ANALYTICS_ENGINE_VERSION'),
+        tier: tier !== undefined && Number.isFinite(tier) ? tier : undefined,
+        instanceId: pick('AGENTIDE_ANALYTICS_INSTANCE_ID'),
+    };
+}
+function buildProvenanceEnv(stamp) {
+    const env = {};
+    if (stamp.policyVersion?.trim()) {
+        env.AGENTIDE_ANALYTICS_POLICY_VERSION = stamp.policyVersion.trim();
+    }
+    if (stamp.packDigest?.trim()) {
+        env.AGENTIDE_ANALYTICS_PACK_DIGEST = stamp.packDigest.trim();
+    }
+    if (stamp.engineVersion?.trim()) {
+        env.AGENTIDE_ANALYTICS_ENGINE_VERSION = stamp.engineVersion.trim();
+    }
+    if (stamp.tier !== undefined) {
+        env.AGENTIDE_ANALYTICS_TIER = String(stamp.tier);
+    }
+    if (stamp.instanceId?.trim()) {
+        env.AGENTIDE_ANALYTICS_INSTANCE_ID = stamp.instanceId.trim();
+    }
+    return env;
+}
 async function runCli(binaryPath, args, opts) {
     return await new Promise((resolve, reject) => {
         const child = (0, child_process_1.spawn)(binaryPath, args, {

package/out/cli/serve-hardening.js

@@ -36,11 +36,13 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TurnGate = exports.TURN_LIMIT_BUSY_MESSAGE = exports.RATE_LIMIT_BUSY_MESSAGE = exports.TURN_GATE_BUSY_MESSAGE = exports.TURN_GATE_RETRY_AFTER_SECONDS = exports.TURN_QUEUE_ENV = exports.MAX_CONCURRENT_TURNS_ENV = exports.TurnLimiter = exports.SESSION_WITHOUT_USER_REASON = exports.IDENTITY_HEADER_ENV = exports.RateLimiter = exports.XFF_TRUSTED_HOPS_ENV = exports.CONTAINER_SERVE_HOST = exports.SERVE_HOST_ENV = exports.DEFAULT_BIND_HOST = exports.DEFAULT_MAX_BODY_BYTES = void 0;
+exports.TurnGate = exports.TURN_LIMIT_BUSY_MESSAGE = exports.RATE_LIMIT_BUSY_MESSAGE = exports.TURN_GATE_BUSY_MESSAGE = exports.TURN_GATE_RETRY_AFTER_SECONDS = exports.TURN_QUEUE_ENV = exports.MAX_CONCURRENT_TURNS_ENV = exports.TurnLimiter = exports.SESSION_WITHOUT_USER_REASON = exports.IDENTITY_HEADER_ENV = exports.PIN_ONLY_IDENTITY_HEADERS = exports.RateLimiter = exports.XFF_TRUSTED_HOPS_ENV = exports.CONTAINER_SERVE_HOST = exports.SERVE_HOST_ENV = exports.DEFAULT_BIND_HOST = exports.DEFAULT_MAX_BODY_BYTES = void 0;
 exports.resolveStateDir = resolveStateDir;
 exports.resolveAnalyticsSessionsDir = resolveAnalyticsSessionsDir;
+exports.isLoopbackHost = isLoopbackHost;
 exports.resolveBindHost = resolveBindHost;
 exports.clientIp = clientIp;
+exports.identityHeaderAdvice = identityHeaderAdvice;
 exports.resolveUserId = resolveUserId;
 exports.resolveDataToken = resolveDataToken;
 exports.peerToUserId = peerToUserId;
@@ -109,6 +111,11 @@ function resolveAnalyticsSessionsDir(stateDir, stateDirEphemeral, env = process.
 }
 /** Loopback default — safe everywhere a human runs `serve` locally. */
 exports.DEFAULT_BIND_HOST = '127.0.0.1';
+/** True when a bind address is reachable only from this machine. */
+function isLoopbackHost(host) {
+    const h = host.trim().toLowerCase().replace(/^\[|\]$/g, '');
+    return h === 'localhost' || h === '::1' || /^127\./.test(h);
+}
 /** Env var for the listen address (used by generated deploy Dockerfiles). */
 exports.SERVE_HOST_ENV = 'AGENTHIPPO_SERVE_HOST';
 /** Bind address baked into container deploy artifacts (Docker / Cloud Run sidecars). */
@@ -204,15 +211,78 @@ class RateLimiter {
     }
 }
 exports.RateLimiter = RateLimiter;
+/**
+ * Identity headers trusted when NOTHING is pinned.
+ *
+ * Every entry here is a header that exactly one platform sets AND owns the request path for, so
+ * a client-supplied copy cannot reach serve without that platform having been bypassed entirely.
+ *
+ * `x-agent-user` is deliberately NOT in this list, and this is a breaking change for anything
+ * that relied on it being trusted by default. It is AgentHippo's own canonical header — the name
+ * an arbitrary client is most likely to guess — it belongs to no platform that strips it, and it
+ * used to sit FIRST, so it beat every platform header that follows. The consequence on any
+ * deployment that had not pinned `AGENTHIPPO_IDENTITY_HEADER`: any HTTP client could send
+ * `x-agent-user: victim@example.com` and be namespaced into that user's session state, attach to
+ * their conversation, and be issued a data-plane turn nonce scoped to them. Cloud Run IAP makes
+ * this concrete — it strips `X-Goog-*` and forwards a client-supplied `x-agent-user` untouched.
+ *
+ * It remains perfectly valid as a PINNED header (`AGENTHIPPO_IDENTITY_HEADER=x-agent-user`),
+ * which is what a deployment whose proxy really does set and strip it should use — including the
+ * Caddy `forward_auth` flow, where `auth-broker/server.ts` sets `X-Agent-User` on `/api/ide/me`
+ * so Caddy can copy a VALIDATED identity upstream. That direction is the correct and only source
+ * of the header, and it is unaffected: pinning is exactly the declaration that it is trustworthy.
+ */
 const HEADER_ALIASES = [
-    'x-agent-user', // AgentHippo canonical (set by our Worker / generic proxy)
     'x-forwarded-email', // Databricks Apps
     'x-forwarded-preferred-username', // Databricks Apps
     'x-goog-authenticated-user-email', // Cloud Run IAP (prefixed value, stripped below)
     'cf-access-authenticated-user-email', // Cloudflare Access
 ];
+/**
+ * Headers that are only ever trusted when explicitly pinned.
+ *
+ * Kept as a named list rather than deleted, because "why is my identity header ignored?" needs an
+ * answer, and `identityHeaderAdvice` gives one that names the env var to set.
+ */
+exports.PIN_ONLY_IDENTITY_HEADERS = ['x-agent-user'];
 /** Env var: pin the single identity header the deploy layer actually sets (and strips). */
 exports.IDENTITY_HEADER_ENV = 'AGENTHIPPO_IDENTITY_HEADER';
+/**
+ * Boot-time advice about identity trust. Returns the lines serve must print, loudest first.
+ *
+ * Not a refusal. Refusing to boot without a pin would stop deployments that are configured
+ * correctly today (Databricks Apps, Cloudflare Access) and whose platform header is genuinely
+ * unforgeable — a fail-closed default that mostly punishes the compliant is not a security win.
+ * What was actually dangerous was `x-agent-user` being trusted by default, and that is now gone.
+ */
+function identityHeaderAdvice(env = process.env, bindHost) {
+    const pinned = env[exports.IDENTITY_HEADER_ENV]?.trim();
+    if (pinned) {
+        return [];
+    }
+    // Severity follows reachability. On loopback nothing off-box can reach the port, so the same
+    // paragraph every local run is warning fatigue — and fatigue is why the message gets ignored
+    // on the deploy where it decides whether strangers can name themselves as another user.
+    const host = bindHost?.trim();
+    if (host && isLoopbackHost(host)) {
+        return [
+            `${exports.IDENTITY_HEADER_ENV} is not set. Fine for this loopback bind; pin it before exposing ` +
+                `serve on a network interface.`,
+        ];
+    }
+    return [
+        ...(host
+            ? [`serve is bound to ${host} — reachable beyond this machine — with no ${exports.IDENTITY_HEADER_ENV} pinned. ` +
+                    `Anyone who can reach this port is trusted to state who they are.`]
+            : []),
+        `${exports.IDENTITY_HEADER_ENV} is not set, so identity falls back to the platform header aliases ` +
+            `(${HEADER_ALIASES.join(', ')}). That is only safe when your proxy sets AND STRIPS every one of them. ` +
+            `Pin the single header your deploy layer really controls, e.g. ${exports.IDENTITY_HEADER_ENV}=x-goog-authenticated-user-email.`,
+        `NOTE: ${exports.PIN_ONLY_IDENTITY_HEADERS.join(', ')} is NO LONGER trusted by default — it is not stripped by any ` +
+            `platform, so an arbitrary client could send it and be namespaced as another user. If your proxy does set it ` +
+            `(the Caddy forward_auth / auth-broker flow does), pin it: ${exports.IDENTITY_HEADER_ENV}=x-agent-user.`,
+    ];
+}
 /**
  * Resolve the end-user identity for a request.
  *
@@ -222,7 +292,10 @@ exports.IDENTITY_HEADER_ENV = 'AGENTHIPPO_IDENTITY_HEADER';
  * that pins a header has declared it has a real proxy-verified identity, so an
  * unauthenticated caller must not be able to name themselves via the client-
  * controlled body. Body fallback is dev/internal convenience for the *unpinned*
- * case only (e.g. direct curl against a local serve with no identity proxy).
+ * case only (e.g. direct curl against a local serve with no identity proxy) —
+ * and it must be OPTED INTO via AGENTHIPPO_ALLOW_BODY_IDENTITY=1 (serve-v4 §10
+ * hole 3). Before the gate it was safe "by convention": any deployment that
+ * forgot to pin a header silently let every caller name an arbitrary victim.
  *
  * The alias-list default (used when unpinned) is only safe when the proxy strips
  * or overwrites ALL of the aliases; platforms that strip only their own header
@@ -257,6 +330,10 @@ function resolveUserId(headers, body, env = process.env) {
         // access, gcloud run services proxy bypassing IAP) name an arbitrary victim.
         return undefined;
     }
+    // Unpinned body identity is an explicit opt-in, never a default (§10 hole 3).
+    if (env.AGENTHIPPO_ALLOW_BODY_IDENTITY?.trim() !== '1') {
+        return undefined;
+    }
     const fromBody = body?.user_id?.trim();
     return fromBody || undefined;
 }

package/out/cli/utils.js

@@ -77,6 +77,13 @@ function findClaudeCodePath() {
     if (depsPath) {
         return depsPath;
     }
+    // 2b. Our OWN dependency tree — the case where the runtime ships as a node app with the
+    // SDK already in node_modules. Without this, such a deployment fails with "Claude Code CLI
+    // not found" while the SDK sits right there (hit on the Hanoi VM, 2026-07-27).
+    const ownCli = (0, deps_1.resolveFromOwnDeps)('@anthropic-ai/claude-agent-sdk', 'cli.js');
+    if (ownCli) {
+        return ownCli;
+    }
     // 3. Check bundled location (next to binary) - legacy fallback
     const binaryDir = getBinaryDir();
     const bundledPath = path.join(binaryDir, 'claude-sdk', 'cli.js');
@@ -131,6 +138,10 @@ function findCodexPath() {
         return process.env.CODEX_PATH;
     }
     // 2. Check npm-installed location (.agenthippo-deps/node_modules)
+    const ownCodex = (0, deps_1.resolveFromOwnDeps)('@openai/codex', 'bin/codex.js');
+    if (ownCodex) {
+        return ownCodex;
+    }
     const depsPath = (0, deps_1.getCodexSdkBinaryPath)();
     if (depsPath) {
         return depsPath;
@@ -211,7 +222,7 @@ exports.COLORS = {
     red: '\x1b[31m',
     yellow: '\x1b[33m',
 };
-exports.SUGGESTED_LITELLM_SMOKE_TEST_COMMAND = 'AGENTHIPPO_LITELLM_BASE_URL="http://localhost:4000" AGENTHIPPO_LITELLM_API_KEY="dummy" AGENTHIPPO_DEFAULT_MODEL="litellm/gpt-5.3-codex" AGENTHIPPO_DEFAULT_ENGINE="codex" agenthippo ask "Reply with exactly: CLI_TEST_OK"';
+exports.SUGGESTED_LITELLM_SMOKE_TEST_COMMAND = 'AGENTHIPPO_LITELLM_BASE_URL="http://localhost:4000" AGENTHIPPO_LITELLM_API_KEY="dummy" AGENTHIPPO_DEFAULT_MODEL="litellm/gpt-5.5" AGENTHIPPO_DEFAULT_ENGINE="codex" agenthippo ask "Reply with exactly: CLI_TEST_OK"';
 function getLiteLLMQuickstartHintLines() {
     return [
         'Try local LiteLLM quickstart:',