@agenthippo-ai/agenthippo 0.2.3-dataplane → 1.110.9

package/out/engines/base.js

@@ -1,6 +1,7 @@
 "use strict";
 /*---------------------------------------------------------------------------------------------
  *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *  Licensed under the MIT License. See LICENSE.txt in the project root for license information.
  *--------------------------------------------------------------------------------------------*/
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -42,6 +43,7 @@ exports.generateRequestId = generateRequestId;
 exports.persistSessionIfNeeded = persistSessionIfNeeded;
 exports.touchSessionIfNeeded = touchSessionIfNeeded;
 exports.getPersistedSessionId = getPersistedSessionId;
+const identity_1 = require("../analytics/identity");
 const session_1 = require("../session");
 const path = __importStar(require("path"));
 /**
@@ -54,16 +56,26 @@ const path = __importStar(require("path"));
  * Langfuse passthrough: langfuse_session_id / langfuse_trace_user_id headers
  * are included so users who add Langfuse as a LiteLLM callback get session
  * grouping automatically.
+ *
+ * IDENTITY: the user id is a salted hash (see analytics/identity.ts). It used to be the raw
+ * value — usually an email — sent on two headers to a proxy that logs every request and forwards
+ * to a third-party observability backend. The hash is stable, so grouping and per-user analytics
+ * still work; it is just no longer a directory of who works here. Set
+ * AGENTHIPPO_EVIDENCE_RAW_IDS=1 to send the raw value again.
+ *
+ * The provider never sees either form: `additional_drop_params: ["user"]` in the LiteLLM config
+ * strips the end-user field before dispatch.
  */
 function buildLiteLLMMetadataHeaders(useLiteLLM, metadata) {
     if (!useLiteLLM) {
         return [];
     }
     const headers = [];
-    if (metadata.analyticsUserId?.trim()) {
-        headers.push(`x-litellm-metadata-user-id: ${metadata.analyticsUserId.trim()}`);
+    const userId = (0, identity_1.hashIdentity)(metadata.analyticsUserId);
+    if (userId) {
+        headers.push(`x-litellm-metadata-user-id: ${userId}`);
         // Langfuse passthrough: maps to Langfuse trace user_id when Langfuse callback is enabled
-        headers.push(`langfuse_trace_user_id: ${metadata.analyticsUserId.trim()}`);
+        headers.push(`langfuse_trace_user_id: ${userId}`);
     }
     if (metadata.sessionId?.trim()) {
         headers.push(`x-litellm-metadata-session-id: ${metadata.sessionId.trim()}`);
@@ -88,6 +100,23 @@ function buildLiteLLMMetadataHeaders(useLiteLLM, metadata) {
     if (metadata.requestId?.trim()) {
         headers.push(`x-litellm-metadata-request-id: ${metadata.requestId.trim()}`);
     }
+    // Provenance stamp (PLAN/compliance.md §3.1): lands in requester_metadata on every OTEL
+    // span, which is where the evidence index reads policy_version / pack_digest from.
+    if (metadata.policyVersion?.trim()) {
+        headers.push(`x-litellm-metadata-policy-version: ${metadata.policyVersion.trim()}`);
+    }
+    if (metadata.packDigest?.trim()) {
+        headers.push(`x-litellm-metadata-pack-digest: ${metadata.packDigest.trim()}`);
+    }
+    if (metadata.engineVersion?.trim()) {
+        headers.push(`x-litellm-metadata-engine-version: ${metadata.engineVersion.trim()}`);
+    }
+    if (metadata.tier !== undefined) {
+        headers.push(`x-litellm-metadata-tier: ${metadata.tier}`);
+    }
+    if (metadata.instanceId?.trim()) {
+        headers.push(`x-litellm-metadata-instance-id: ${metadata.instanceId.trim()}`);
+    }
     return headers;
 }
 /**

package/out/engines/claude.js

@@ -39,14 +39,15 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ClaudeEngine = void 0;
 const fs_1 = require("fs");
 const path = __importStar(require("path"));
+const branding_1 = require("../branding");
 const base_1 = require("./base");
 const utils_1 = require("../utils");
 const permissions_1 = require("../permissions");
 const mcp_1 = require("../mcp");
-const data_plane_1 = require("../cli/data-plane");
 const runtime_1 = require("../cli/runtime");
 const session_1 = require("../session");
 const agentpack_1 = require("../agentpack");
+const credential_context_1 = require("../cli/credential-context");
 const shared_1 = require("../shared");
 // File tools we track for edit diffs via hooks (Set for O(1) lookup)
 // Includes Claude SDK tools, Computer Use tools, and common variations
@@ -261,6 +262,11 @@ class ClaudeEngine {
             source: 'agenthippo',
             engine: 'claude',
             requestId: options.requestId,
+            policyVersion: options.policyVersion,
+            packDigest: options.packDigest,
+            instanceId: options.instanceId,
+            engineVersion: options.engineVersion,
+            tier: options.tier,
         });
         // Build environment for Claude SDK.
         // Setup-token auth must use Claude's OAuth token env var instead of ANTHROPIC_API_KEY.
@@ -270,11 +276,13 @@ class ClaudeEngine {
             'DEBUG_CLAUDE_AGENT_SDK': '1',
             'CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC': '1',
         };
-        // Egress broker active ⇒ the gateway token stays broker-side; scrub it from the child
-        // env so it never reaches the model (secure-obo-design §7.6 / §7.4 gap 1).
-        if (claudeEnv[data_plane_1.EGRESS_URL_ENV]) {
-            delete claudeEnv[runtime_1.OPENCLAW_GATEWAY_TOKEN_ENV];
-        }
+        // The gateway token stays broker-side; scrub it from the child env so it never reaches
+        // the model (secure-obo-design §7.6 / §7.4 gap 1). UNCONDITIONALLY (serve-v4 §10 hole 2):
+        // gating this on the egress broker let a deployment without --gateway-bridge re-inherit
+        // the token, including via buildCliEnvPatch's bake from the host's ~/.openclaw config.
+        delete claudeEnv[runtime_1.OPENCLAW_GATEWAY_TOKEN_ENV];
+        // Data-plane sidecar control token: never the engine's to hold (secure-obo-design §7.6).
+        delete claudeEnv['AGENTHIPPO_DATA_PLANE_TOKEN'];
         const isSetupTokenAuth = (0, shared_1.isAnthropicSetupToken)(apiKey);
         if (isSetupTokenAuth) {
             const normalizedSetupToken = (0, shared_1.normalizeAnthropicSetupToken)(apiKey);
@@ -303,8 +311,13 @@ class ClaudeEngine {
         // Note: cwd is ALWAYS workspaceRoot - active agent content is synced to workspace's .claude/.codex
         const agentId = options.agentPackId ?? 'default';
         const runtimePaths = (0, agentpack_1.resolveRuntimePaths)(options.workspaceRoot, this.config.storagePath, agentId, options.agentPackVersion);
-        // Claude config directory (isolated per agent for session/state isolation)
-        const claudeConfigDir = runtimePaths.claudeConfigDir;
+        // Claude config directory (isolated per agent for session/state isolation). In
+        // multi-tenant serve, additionally key it by the verified request user — the same
+        // §8 Phase 0 scoping codex.ts applies to CODEX_HOME. A shared per-agent dir lets
+        // concurrent turns of different users race each other's per-turn credential state
+        // (the agentpack/paths.ts race); per-user scoping makes any remaining race
+        // same-user. No credential frame (IDE, single-tenant CLI) ⇒ unchanged path.
+        const claudeConfigDir = (0, agentpack_1.userScopedEngineHome)(runtimePaths.claudeConfigDir, (0, credential_context_1.currentCredential)()?.userId);
         claudeEnv['CLAUDE_CONFIG_DIR'] = claudeConfigDir;
         await fs_1.promises.mkdir(claudeConfigDir, { recursive: true });
         // Always set AGENT_ID for agent to know its identity
@@ -549,9 +562,10 @@ class ClaudeEngine {
                 logger.debug(`[AgentIDE] SessionStart hook called! event=${input.hook_event_name}`);
                 return CONTINUE;
             };
-            // Load MCP servers for the active agent and pass directly to SDK. claudeEnv is the
-            // per-turn child env — URL servers resolve their bearerTokenEnv (turn nonce) from it,
-            // in memory, so no per-turn value ever lands in a shared config file.
+            // Load MCP servers for the active agent and pass directly to SDK. URL servers carry a
+            // `${NAME}` bearer reference the CLI expands from claudeEnv at connect time, so the
+            // turn nonce rides neither a shared config file nor the SDK's --mcp-config argv —
+            // claudeEnv is passed for the rare non-expandable-name fallback only.
             const mcpServers = await this.loadMcpServersForClaude(logger, options.workspaceRoot, agentId, claudeEnv);
             // Determine cwd and settingSources
             // cwd is ALWAYS workspaceRoot - active agent content has been synced to workspace's .claude/
@@ -1068,7 +1082,7 @@ class ClaudeEngine {
                 logger.info(`[AgentIDE] Claude thinking summary: startBlocks=${thinkingStartBlockCount}, redactedBlocks=${redactedThinkingBlockCount}, deltas=${thinkingDeltaCount}, chars=${thinkingCharCount}`);
                 logger.info(`[AgentIDE] Claude tool summary: toolBlocks=${toolUseBlockCount}, toolEmits=${toolUseEmitCount}, toolProgressMsgs=${toolProgressCount}, inputJsonDeltas=${inputJsonDeltaCount}`);
                 if (thinkingStartBlockCount === 0 && thinkingDeltaCount === 0 && redactedThinkingBlockCount === 0) {
-                    logger.debug('[AgentIDE] Claude emitted no thinking blocks/deltas. Ensure model supports extended thinking and set agentide.claude.maxThinkingTokens >= 1024.');
+                    logger.debug(`[AgentIDE] Claude emitted no thinking blocks/deltas. Ensure model supports extended thinking and set ${(0, branding_1.toSettingsDisplayKey)('agentide.claude.maxThinkingTokens')} >= 1024.`);
                 }
                 if (toolUseBlockCount === 0 && toolProgressCount === 0) {
                     logger.debug('[AgentIDE] Claude emitted no tool usage events. If tools were used, ensure includePartialMessages=true and parse tool_use blocks.');
@@ -1202,8 +1216,12 @@ class ClaudeEngine {
      * - Pack agents: uses pack's mcp/ directory
      *
      * The SDK accepts mcpServers directly in query options — including HTTP Streamable
-     * servers (`{type:'http', url, headers}`). `turnEnv` is the per-turn child env; a URL
-     * server's `bearerTokenEnv` (e.g. AGENTHIPPO_TURN_NONCE) resolves against it in memory.
+     * servers (`{type:'http', url, headers}`). A URL server's `bearerTokenEnv` (e.g.
+     * AGENTHIPPO_TURN_NONCE) becomes a `${NAME}` reference the CLI expands from its own env,
+     * NOT a resolved header: the SDK serializes mcpServers into `--mcp-config` argv, and a
+     * resolved bearer there is world-readable via /proc/<pid>/cmdline (see
+     * referenceHttpMcpHeaders). `turnEnv` is the per-turn child env, used only for the
+     * fallback when a name is outside the CLI's expansion grammar.
      */
     async loadMcpServersForClaude(logger, workspaceRoot, agentId = 'default', turnEnv) {
         const basePromptsDir = this.getBundledBasePromptsDir();
@@ -1214,7 +1232,7 @@ class ClaudeEngine {
         const mcpServers = {};
         for (const s of servers) {
             if (s.url) {
-                const headers = (0, mcp_1.resolveHttpMcpHeaders)(s, turnEnv ?? process.env);
+                const headers = (0, mcp_1.referenceHttpMcpHeaders)(s, turnEnv ?? process.env);
                 mcpServers[s.name] = {
                     type: 'http',
                     url: s.url,

package/out/engines/codex.js

@@ -37,6 +37,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CodexEngine = void 0;
+exports.registerNewFilesWithTracker = registerNewFilesWithTracker;
 const fs_1 = require("fs");
 const path = __importStar(require("path"));
 const mcp_1 = require("../mcp");
@@ -47,8 +48,8 @@ const permissions_1 = require("../permissions");
 const session_1 = require("../session");
 const agentpack_1 = require("../agentpack");
 const credential_context_1 = require("../cli/credential-context");
-const data_plane_1 = require("../cli/data-plane");
 const runtime_1 = require("../cli/runtime");
+const types_1 = require("../sandbox/types");
 // Note: HTTP edit server removed - file changes are now handled directly via file_change events
 // -----------------------------------------------------------------------------
 // Constants
@@ -65,11 +66,56 @@ const AGENTIDE_CODEX_AGENT_VERSION_ENV_VAR = 'AGENTIDE_ANALYTICS_AGENT_VERSION';
 const AGENTIDE_CODEX_SOURCE_ENV_VAR = 'AGENTIDE_ANALYTICS_SOURCE';
 const AGENTIDE_CODEX_ENGINE_ENV_VAR = 'AGENTIDE_ANALYTICS_ENGINE';
 const AGENTIDE_CODEX_REQUEST_ID_ENV_VAR = 'AGENTIDE_ANALYTICS_REQUEST_ID';
+const AGENTIDE_CODEX_POLICY_VERSION_ENV_VAR = 'AGENTIDE_ANALYTICS_POLICY_VERSION';
+const AGENTIDE_CODEX_PACK_DIGEST_ENV_VAR = 'AGENTIDE_ANALYTICS_PACK_DIGEST';
+const AGENTIDE_CODEX_ENGINE_VERSION_ENV_VAR = 'AGENTIDE_ANALYTICS_ENGINE_VERSION';
+const AGENTIDE_CODEX_TIER_ENV_VAR = 'AGENTIDE_ANALYTICS_TIER';
+const AGENTIDE_CODEX_INSTANCE_ID_ENV_VAR = 'AGENTIDE_ANALYTICS_INSTANCE_ID';
 // Bump when we change generated config semantics so long-lived sessions regenerate config.toml.
-const AGENTIDE_CODEX_CONFIG_VERSION = 20; // v20: default_tools_approval_mode "auto"→"approve" ("auto" is invalid on codex ≥0.131 and cancels every headless MCP tool call)
+const AGENTIDE_CODEX_CONFIG_VERSION = 21; // v21: sandbox_mode "danger-full-access" now requires tier 2, not merely being inside a sandbox — a tier-0 home written by v20 must be rewritten
 // Per-process runtime context for agents (not analytics): lets the agent locate its per-session context export.
 const AGENTIDE_CONTEXT_EXPORT_PATH_ENV_VAR = 'AGENTIDE_CONTEXT_EXPORT_PATH';
 const AGENTIDE_TERMINAL_LOG_PATH_ENV_VAR = 'AGENTIDE_TERMINAL_LOG_PATH';
+/**
+ * Hand files codex just CREATED to the edit tracker so the IDE can render them against an empty
+ * original — without ever risking the agent's work.
+ *
+ * The IDE trick is read → delete → `applyEdit`. That delete caused live data loss: headless
+ * (`serve`/`ask`/`chat` and every sandbox) gets `NoOpEditTracker`, whose `applyEdit` does nothing, so
+ * every new file codex created was silently destroyed. The command exited 0, the file was there
+ * during the command, and it was gone by the next one — while standalone `codex exec` wrote it
+ * fine. Two guards now: skip trackers that do not write back, and restore the file if it is
+ * missing when we are done, whatever the tracker did or threw.
+ *
+ * Exported so the invariant "a file the agent created still exists after the turn" is testable.
+ */
+async function registerNewFilesWithTracker(files, editTracker, sessionId) {
+    // A tracker that does not write the file back must never see a delete.
+    if (editTracker.appliesEdits === false) {
+        return;
+    }
+    for (const f of files) {
+        try {
+            if ((0, utils_1.isBinaryFile)(f)) {
+                continue; // Binary would be corrupted by the UTF-8 read/write round trip.
+            }
+            if (!(await (0, utils_1.pathExists)(f))) {
+                continue;
+            }
+            const code = await fs_1.promises.readFile(f, 'utf-8');
+            try {
+                await fs_1.promises.unlink(f);
+                await editTracker.applyEdit(sessionId, f, code, true);
+            }
+            finally {
+                if (!(await (0, utils_1.pathExists)(f))) {
+                    await fs_1.promises.writeFile(f, code, 'utf-8');
+                }
+            }
+        }
+        catch { /* ignore — never fail a turn over edit-diff bookkeeping */ }
+    }
+}
 function isCodexItemEvent(event) {
     return event.type === 'item.started' || event.type === 'item.updated' || event.type === 'item.completed';
 }
@@ -130,13 +176,17 @@ class CodexEngine {
             ...(runtime.cliEnvPatch ?? {}),
             OPENAI_LOG: 'debug',
         };
-        // When serve runs the egress broker, the OpenClaw gateway token must never enter the
-        // agent's trust domain (secure-obo-design §7.6 / §7.4 gap 1). Scrub it from the child env
-        // at the spawn boundary — belt-and-suspenders with serve's boot-time process.env strip,
-        // so a token in process.env (e.g. captured before the strip) still cannot reach the model.
-        if (codexEnv[data_plane_1.EGRESS_URL_ENV]) {
-            delete codexEnv[runtime_1.OPENCLAW_GATEWAY_TOKEN_ENV];
-        }
+        // The OpenClaw gateway token must never enter the agent's trust domain (secure-obo-design
+        // §7.6 / §7.4 gap 1). UNCONDITIONALLY (serve-v4 §10 hole 2): the scrub used to depend on
+        // the egress broker being up, so a deployment without --gateway-bridge re-inherited the
+        // token — and buildCliEnvPatch can bake it in from the host's ~/.openclaw config, not just
+        // process.env. This engine never needs it: outbound goes through the broker's turn nonce,
+        // and the openclaw CLI reads its own config file on single-tenant hosts.
+        delete codexEnv[runtime_1.OPENCLAW_GATEWAY_TOKEN_ENV];
+        // Data-plane sidecar control token: the engine only needs the gateway URL + its per-turn
+        // nonce, never the register token — scrub it so a compromised agent can't forge a turn as
+        // another user (secure-obo-design §7.6). Harmless when absent (in-process/no data plane).
+        delete codexEnv['AGENTHIPPO_DATA_PLANE_TOKEN'];
         // Always expose the VS Code chat session id to the agent process so it can locate:
         //   .agentide/sessions/<sessionId>/context.md
         const rawChatSessionId = sessionId?.trim();
@@ -179,7 +229,15 @@ class CodexEngine {
         agentId, // Pass agent ID for correct skills path
         runtime.permissionHandler instanceof interfaces_1.AutoApprovePermissionHandler);
         // LiteLLM analytics metadata (enriched - see PLAN/analytics-design.md)
-        if (useLiteLLM && this.config.codexHome) {
+        //
+        // Gate on the codexHome actually in use (resolved above), NOT `this.config.codexHome`:
+        // headless/index.ts passes `codexHome: undefined`, so under serve/ask/chat and inside
+        // every sandbox this block was skipped and codex sent NO metadata headers at all — no
+        // session-id, user-id, agent-id, source, request-id, or engine. Spotlight lost codex
+        // attribution outside the IDE, and the gateway could not see `x-litellm-metadata-engine`,
+        // so engine-conditional ah-auto routing never fired. config.toml was written correctly
+        // the whole time (it uses this same resolved home) — only the env vars it reads were missing.
+        if (useLiteLLM && codexHome) {
             if (analyticsUserId?.trim()) {
                 codexEnv[AGENTIDE_CODEX_USER_ENV_VAR] = analyticsUserId.trim();
             }
@@ -197,6 +255,21 @@ class CodexEngine {
             if (options.requestId) {
                 codexEnv[AGENTIDE_CODEX_REQUEST_ID_ENV_VAR] = options.requestId;
             }
+            if (options.policyVersion?.trim()) {
+                codexEnv[AGENTIDE_CODEX_POLICY_VERSION_ENV_VAR] = options.policyVersion.trim();
+            }
+            if (options.packDigest?.trim()) {
+                codexEnv[AGENTIDE_CODEX_PACK_DIGEST_ENV_VAR] = options.packDigest.trim();
+            }
+            if (options.engineVersion?.trim()) {
+                codexEnv[AGENTIDE_CODEX_ENGINE_VERSION_ENV_VAR] = options.engineVersion.trim();
+            }
+            if (options.tier !== undefined) {
+                codexEnv[AGENTIDE_CODEX_TIER_ENV_VAR] = String(options.tier);
+            }
+            if (options.instanceId?.trim()) {
+                codexEnv[AGENTIDE_CODEX_INSTANCE_ID_ENV_VAR] = options.instanceId.trim();
+            }
         }
         // For custom providers (OpenRouter, LiteLLM), set API key in CODEX_API_KEY.
         // The config.toml's `env_key = "CODEX_API_KEY"` tells the CLI to read from this variable.
@@ -225,6 +298,16 @@ class CodexEngine {
             ];
             // Map unified permissions to Codex SDK options
             const codexPermOpts = (0, permissions_1.toCodexOptions)(effectivePerms, workspaceFolders);
+            // One boundary, not two — but only when the OTHER boundary is real. Inside a tier-2
+            // container Codex's own bubblewrap sandbox cannot start (it needs a user namespace
+            // `--cap-drop ALL` + `no-new-privileges` deny), so standing it down is the difference
+            // between working shell commands and silent failures. The tier-0 process driver
+            // provides NO boundary — same uid, same filesystem as serve — so there Codex's own
+            // sandbox is the only thing between the agent and the host and must stay on.
+            // The SDK's ThreadOptions.sandboxMode overrides config.toml, so force it here too.
+            if ((0, types_1.isContainerSandbox)()) {
+                codexPermOpts.sandboxMode = 'danger-full-access';
+            }
             logger.info(`[AgentIDE] Codex mapped: sandboxMode=${codexPermOpts.sandboxMode}, approvalPolicy=${codexPermOpts.approvalPolicy}`);
             // Build thread options
             // workingDirectory is ALWAYS workspaceRoot - pack content is synced to workspace's .codex/
@@ -411,21 +494,7 @@ class CodexEngine {
                                         catch { /* ignore */ }
                                         pendingOperations.delete(item.id);
                                     }
-                                    // New files: read, delete, apply (so VS Code sees original=empty)
-                                    // Skip binary files - they would be corrupted by UTF-8 read/write
-                                    for (const f of pendingNewFiles.get(item.id) ?? []) {
-                                        try {
-                                            if ((0, utils_1.isBinaryFile)(f)) {
-                                                continue; // Don't track binary files for edit diffs
-                                            }
-                                            if (await (0, utils_1.pathExists)(f)) {
-                                                const code = await fs_1.promises.readFile(f, 'utf-8');
-                                                await fs_1.promises.unlink(f);
-                                                await editTracker.applyEdit(rawChatSessionId, f, code, true);
-                                            }
-                                        }
-                                        catch { /* ignore */ }
-                                    }
+                                    await registerNewFilesWithTracker(pendingNewFiles.get(item.id) ?? [], editTracker, rawChatSessionId);
                                     pendingNewFiles.delete(item.id);
                                 }
                             }
@@ -637,6 +706,16 @@ class CodexEngine {
             // Codex CLI loads a single "model instructions" file that acts like a system/developer prompt overlay.
             // Note: experimental_instructions_file is deprecated and ignored by newer Codex CLI versions.
             codexInstructionsFile ? `model_instructions_file = ${JSON.stringify(codexInstructionsFile)}` : undefined,
+            // Inside a TIER-2 sandbox the container is the boundary, so Codex's own sandbox is not
+            // just redundant — it cannot start. It shells out to bubblewrap, which needs to create
+            // a user namespace and scratch space under /tmp; a container drops those capabilities by
+            // design (`--cap-drop ALL`, `no-new-privileges`), so every shell command and file
+            // write failed while still reporting exit 0. One boundary, not two — but the tier-0
+            // process driver is not a boundary at all, so it never earns this. Keyed on the tier
+            // the driver reports, not on merely being inside a sandbox.
+            ...((0, types_1.isContainerSandbox)()
+                ? ['sandbox_mode = "danger-full-access"']
+                : []),
         ];
         // Add custom provider section for LiteLLM or custom providers (e.g., OpenRouter)
         if (customBaseUrl) {
@@ -655,7 +734,12 @@ class CodexEngine {
                     `"x-litellm-metadata-agent-version" = "${AGENTIDE_CODEX_AGENT_VERSION_ENV_VAR}", ` +
                     `"x-litellm-metadata-source" = "${AGENTIDE_CODEX_SOURCE_ENV_VAR}", ` +
                     `"x-litellm-metadata-engine" = "${AGENTIDE_CODEX_ENGINE_ENV_VAR}", ` +
-                    `"x-litellm-metadata-request-id" = "${AGENTIDE_CODEX_REQUEST_ID_ENV_VAR}" }`);
+                    `"x-litellm-metadata-request-id" = "${AGENTIDE_CODEX_REQUEST_ID_ENV_VAR}", ` +
+                    `"x-litellm-metadata-policy-version" = "${AGENTIDE_CODEX_POLICY_VERSION_ENV_VAR}", ` +
+                    `"x-litellm-metadata-pack-digest" = "${AGENTIDE_CODEX_PACK_DIGEST_ENV_VAR}", ` +
+                    `"x-litellm-metadata-engine-version" = "${AGENTIDE_CODEX_ENGINE_VERSION_ENV_VAR}", ` +
+                    `"x-litellm-metadata-tier" = "${AGENTIDE_CODEX_TIER_ENV_VAR}", ` +
+                    `"x-litellm-metadata-instance-id" = "${AGENTIDE_CODEX_INSTANCE_ID_ENV_VAR}" }`);
             }
         }
         // Add MCP servers section (pack-aware)

package/out/engines/custom.js

@@ -47,6 +47,7 @@ const fs_1 = require("fs");
 const path = __importStar(require("path"));
 const url_1 = require("url");
 const base_1 = require("./base");
+const runtime_1 = require("../cli/runtime");
 const customRegistry_1 = require("./customRegistry");
 const paths_1 = require("../agentpack/paths");
 const utils_1 = require("../utils");
@@ -534,6 +535,8 @@ class CustomEngine {
             AGENTHIPPO_MODEL_ID: modelId,
             AGENTHIPPO_USE_LITELLM: routing.useLiteLLM ? 'true' : 'false',
         };
+        delete env[runtime_1.OPENCLAW_GATEWAY_TOKEN_ENV];
+        delete env['AGENTHIPPO_DATA_PLANE_TOKEN'];
         prependNodePath(env, manifest.manifestDir);
         if (routingApiKey) {
             env.AGENTHIPPO_API_KEY = routingApiKey;
@@ -560,6 +563,11 @@ class CustomEngine {
                 source: 'agenthippo',
                 engine: `custom:${manifest.id}`,
                 requestId: options.requestId,
+                policyVersion: options.policyVersion,
+                packDigest: options.packDigest,
+                instanceId: options.instanceId,
+                engineVersion: options.engineVersion,
+                tier: options.tier,
             });
             if (litellmMetadataHeaders.length > 0) {
                 env.AGENTHIPPO_LITELLM_METADATA_HEADERS = litellmMetadataHeaders.join('\n');