@agenthippo-ai/agenthippo 1.110.11 → 1.110.19

package/out/cli/data-plane/sidecar.js

@@ -1,225 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ASSERTION_HEADER = void 0;
-exports.startDataPlaneSidecar = startDataPlaneSidecar;
-/**
- * Data-plane SIDECAR (secure-obo-design §7.6 / aperture-thin) — the connector's own trust
- * domain, a SEPARATE container from the engine/agent.
- *
- * It runs the full data plane (TurnRegistry + gateway + connector) and holds the backend BASE
- * credential (AWS keys, Postgres pool login, …). The agent container gets NONE of it: it only
- * (a) registers verified turns via this authenticated control API and (b) points the engine at
- * the gateway URL. Because the sidecar is a different container (different PID namespace), the
- * engine cannot read the base credential from `/proc/<pid>/environ`, and because the sidecar
- * resolves the nonce → userId server-side, the engine cannot forge another user's identity.
- *
- * Control API (loopback/pod-network, bearer-authenticated):
- *   POST   /turns        { userId, sessionKey, inboundToken?, egressStoreKey? } → { nonce }
- *   DELETE /turns/:nonce                                                        → 204
- *   GET    /edge/turn    (forward_auth from the trusted EDGE; X-Agent-User header)
- *                        → 200 + `X-Agent-Turn-Nonce` response header
- * The gateway (nonce-authenticated MCP) is a separate port the engine dials directly.
- *
- * EDGE-registration mode (P1 fix, obo-inprogress §2): the bearer secret is held by the IdP
- * Caddy — NOT the agent container. Caddy registers each chat turn via `forward_auth` against
- * `/edge/turn` (identity from the X-Agent-User header its auth-broker hop just verified) and
- * copies the returned nonce header onto the request it proxies to serve. serve then has no
- * registration authority at all: a compromised engine reading serve's `/proc/<pid>/environ`
- * finds no token that can mint a nonce for an arbitrary userId. Release rides the gateway's
- * nonce-authenticated `DELETE /turn`; the registry deadline is the backstop.
- */
-const http = __importStar(require("http"));
-const crypto_1 = require("crypto");
-const index_1 = require("./index");
-const serve_hardening_1 = require("../serve-hardening");
-const gateway_1 = require("./gateway");
-/**
- * Header carrying the EDGE-verified user ASSERTION (agent-identity.md §8.5 G1) — the signed
- * artifact, as opposed to `X-Agent-User` which is only the identifier. It becomes the turn's
- * `inboundToken`, which is what `passthrough` hands the backend and what an RFC 8693 `exchange`
- * provider presents as its `subject_token`.
- *
- * Set by the trusted edge on the turn-registration hop only, so it never reaches the agent
- * container. A client-supplied copy must be stripped at the edge, exactly as for the nonce.
- */
-exports.ASSERTION_HEADER = 'x-agent-user-assertion';
-function headerValue(req, name) {
-    const v = req.headers[name];
-    return (Array.isArray(v) ? v[0] : v)?.trim() || undefined;
-}
-/** Audit-safe fingerprint of a bearer credential — never the credential. */
-function sha256Prefix(value) {
-    return (0, crypto_1.createHash)('sha256').update(value).digest('hex').slice(0, 12);
-}
-function bearer(header) {
-    return header?.match(/^Bearer\s+(\S+)$/i)?.[1];
-}
-function tokenEq(a, b) {
-    const x = Buffer.from(a);
-    const y = Buffer.from(b);
-    return x.length === y.length && (0, crypto_1.timingSafeEqual)(x, y);
-}
-async function startDataPlaneSidecar(opts) {
-    const host = opts.bindHost ?? '0.0.0.0';
-    // The gateway binds `host` on a fixed port so the engine can be told the URL at deploy time.
-    const plane = await index_1.DataPlane.start(opts.config, {
-        logger: opts.logger,
-        audit: opts.audit,
-        gateway: { host, port: opts.gatewayPort, advertiseHost: host === '0.0.0.0' ? undefined : host },
-    });
-    const releases = new Map();
-    const control = http.createServer(async (req, res) => {
-        const reject = (code, msg) => { res.writeHead(code, { 'Content-Type': 'application/json' }); res.end(JSON.stringify({ error: msg })); };
-        try {
-            const tok = bearer(req.headers.authorization);
-            if (!tok || !tokenEq(tok, opts.registerToken)) {
-                opts.audit?.('unauthorized', 'sidecar_register_reject', { reason: tok ? 'bad_token' : 'missing_token' });
-                return reject(401, 'unauthorized');
-            }
-            const path = req.url?.split('?')[0] ?? '';
-            // Edge registration (Caddy forward_auth sends GET, no body): identity comes from the
-            // X-Agent-User header the edge's preceding auth-broker hop verified and set. The nonce
-            // rides a response header so `copy_headers` can lift it onto the proxied request.
-            // sessionKey degrades to userId here — the edge never sees the body's session_id.
-            if ((req.method === 'GET' || req.method === 'POST') && path === '/edge/turn') {
-                const userId = (Array.isArray(req.headers['x-agent-user']) ? req.headers['x-agent-user'][0] : req.headers['x-agent-user'])?.trim();
-                if (!userId) {
-                    opts.audit?.('unauthorized', 'sidecar_edge_reject', { reason: 'missing_user' });
-                    return reject(400, 'X-Agent-User required');
-                }
-                // The user ASSERTION, not just the identifier (agent-identity.md §8.5 G1). The edge
-                // forwarded only X-Agent-User until now, so `registerTurnRaw` got no inboundToken and
-                // edge mode silently supported the `identity` provider alone: `passthrough` failed
-                // closed on every call, and an RFC 8693 `exchange` provider had no subject_token to
-                // exchange. Trusted exactly like X-Agent-User — only the in-network edge can reach
-                // this port, and the edge overwrites any client-supplied copy.
-                const inboundToken = headerValue(req, exports.ASSERTION_HEADER)?.replace(/^Bearer\s+/i, '').trim() || undefined;
-                const { nonce } = plane.registerTurnRaw({ userId, sessionKey: userId, inboundToken });
-                // Never the assertion itself: it is a bearer credential, and these rows ship to the
-                // evidence server. A hash prefix still proves which assertion a turn used.
-                opts.audit?.(userId, 'sidecar_edge_register', {
-                    userId,
-                    assertion: inboundToken ? `sha256:${sha256Prefix(inboundToken)}` : 'none',
-                });
-                res.writeHead(200, { 'Content-Type': 'application/json', [gateway_1.TURN_NONCE_HEADER]: nonce });
-                return res.end(JSON.stringify({ ok: true }));
-            }
-            if (req.method === 'POST' && path === '/turns') {
-                let body;
-                try {
-                    body = JSON.parse(await (0, serve_hardening_1.readBodyWithCap)(req));
-                }
-                catch {
-                    return reject(400, 'bad json');
-                }
-                const userId = (body.userId ?? '').trim();
-                if (!userId) {
-                    return reject(400, 'userId required');
-                }
-                // Which agent SAYS it is asking. Recorded, never trusted: the register token is
-                // shared, so this claim is only as good as whoever holds it. `binding: 'asserted'`
-                // travels with it so nobody reading evidence later mistakes it for a verified fact
-                // (PLAN/agent-identity.md §4.4 — the successor is warrant verification, F3).
-                const claimed = body.agent?.pack?.trim();
-                // One connector is meant to serve one agent. When it does not, this is where it
-                // becomes visible — and visibility is the whole deliverable, since the sidecar
-                // cannot safely refuse on an unverifiable claim.
-                const mismatch = Boolean(claimed && opts.agent?.pack && claimed !== opts.agent.pack);
-                if (mismatch) {
-                    // console.warn, not logger.warn: the logger is a no-op without --verbose, and two
-                    // agents sharing one connector is the exact condition E2's agent bound rests on
-                    // NOT happening. It must be unmissable in the default deployment, not a debug line.
-                    console.warn(`Warning: turn registration claims agent "${claimed}" but this connector loaded ` +
-                        `"${opts.agent?.pack}". One connector is meant to serve one agent ` +
-                        `(PLAN/agent-identity.md §4.4) — both now share this connector's base credential, ` +
-                        `so neither is bounded by the job it was deployed for.`);
-                }
-                opts.audit?.((body.sessionKey ?? '').trim() || userId, 'sidecar_register', {
-                    userId,
-                    claimedAgent: claimed ?? 'none',
-                    binding: 'asserted',
-                    ...(mismatch ? { agentMismatch: true, loadedAgent: opts.agent?.pack } : {}),
-                });
-                const { nonce, release } = plane.registerTurnRaw({
-                    userId, sessionKey: (body.sessionKey ?? '').trim() || userId,
-                    inboundToken: body.inboundToken, egressStoreKey: body.egressStoreKey,
-                });
-                releases.set(nonce, release);
-                res.writeHead(200, { 'Content-Type': 'application/json' });
-                return res.end(JSON.stringify({ nonce }));
-            }
-            if (req.method === 'DELETE' && path.startsWith('/turns/')) {
-                const nonce = decodeURIComponent(path.slice('/turns/'.length));
-                releases.get(nonce)?.();
-                releases.delete(nonce);
-                res.writeHead(204);
-                return res.end();
-            }
-            reject(404, 'not found');
-        }
-        catch (err) {
-            opts.logger?.warn(`[Sidecar] control error: ${err instanceof Error ? err.message : String(err)}`);
-            if (!res.headersSent) {
-                res.writeHead(500, { 'Content-Type': 'application/json' });
-            }
-            res.end(JSON.stringify({ error: 'internal' }));
-        }
-    });
-    await new Promise((resolve, reject) => {
-        control.once('error', reject);
-        control.listen(opts.controlPort, host, () => resolve());
-    });
-    const controlAddress = control.address();
-    const controlPort = controlAddress && typeof controlAddress !== 'string' ? controlAddress.port : opts.controlPort;
-    opts.logger?.info(`[Sidecar] gateway ${plane.url} | control :${controlPort} (bound ${host})`);
-    // A `passthrough` provider has nothing of its own: with no inbound token it fails closed on
-    // EVERY call (broker.ts). Before the assertion header existed, an edge-registered turn never
-    // carried one, so this combination looked healthy at boot and then denied every single tool
-    // call at runtime. Say it once, at boot, where an operator can act on it.
-    if ((opts.config.provider ?? 'passthrough').trim().toLowerCase() === 'passthrough') {
-        console.warn(`Warning: provider=passthrough needs a per-user token on every turn. Edge-registered turns ` +
-            `supply it via the ${exports.ASSERTION_HEADER} header — if your edge does not forward it, every tool ` +
-            `call will fail closed. See PLAN/agent-identity.md §8.5 G1.`);
-    }
-    return {
-        gatewayUrl: plane.url,
-        controlPort,
-        close: async () => { await new Promise((r) => control.close(() => r())); await plane.close(); },
-    };
-}

package/out/cli/deploy/blueprints/registry.js

@@ -1,84 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BLUEPRINTS = exports.BLUEPRINT_IDS = void 0;
-exports.isBlueprintId = isBlueprintId;
-exports.resolveBlueprint = resolveBlueprint;
-exports.BLUEPRINT_IDS = [
-    'sandbox',
-    'prospect-demo',
-    'team-pilot',
-    'regulated-air-gapped',
-    'enterprise-fleet',
-];
-function isBlueprintId(value) {
-    return exports.BLUEPRINT_IDS.includes(value);
-}
-exports.BLUEPRINTS = {
-    sandbox: {
-        id: 'sandbox',
-        description: 'Internal test, no external users — no edge, no SSO, no host port beyond localhost.',
-        targets: ['vm'],
-    },
-    'prospect-demo': {
-        id: 'prospect-demo',
-        description: 'Throwaway public demo for a prospect — Cloudflare Tunnel + a throwaway Google OAuth client.',
-        targets: ['vm', 'compose'],
-    },
-    'team-pilot': {
-        id: 'team-pilot',
-        description: 'Single-agent pilot. Rides the customer platform\'s own identity when one exists (GCP IAP, ' +
-            'Databricks workspace SSO, Snowflake network, Cloudflare Access); falls back to a self-issued edge ' +
-            '(own Caddy + oauth2-proxy + Google client) on vm/compose/aws-ecs/azure-container-apps, which have ' +
-            'no platform-native option yet.',
-        targets: ['cloudrun', 'databricks-app', 'spcs', 'cloudflare', 'vm', 'compose', 'aws-ecs', 'azure-container-apps'],
-    },
-    'regulated-air-gapped': {
-        id: 'regulated-air-gapped',
-        description: 'VPN/localhost only, no tunnel, no external telemetry — the highest-scrutiny buyer profile. ' +
-            'Currently generator-identical to sandbox (PLAN/deploy.md §2 gap); the distinction is buyer framing, ' +
-            'not yet enforced posture.',
-        targets: ['vm'],
-    },
-    'enterprise-fleet': {
-        id: 'enterprise-fleet',
-        description: 'Federated identity against a central IdP (enterprise-deploy/idp/) for a growing fleet of agents. ' +
-            'Same-host colocation (no edge of its own) is available for vm/compose via the raw ' +
-            '`--ingress edge-fed --colocate` flag — not yet encoded as a blueprint variant.',
-        targets: ['cloudrun', 'vm', 'compose', 'aws-ecs', 'azure-container-apps'],
-    },
-};
-/**
- * Resolve a blueprint (+ optional platform override) to the `--target`/`--ingress` pair
- * `deploy-init.ts` already knows how to render. Throws on a platform not in the blueprint's
- * supported set so a typo doesn't silently produce the wrong deployment shape.
- */
-function resolveBlueprint(id, platform) {
-    const def = exports.BLUEPRINTS[id];
-    const target = platform ?? def.targets[0];
-    if (!def.targets.includes(target)) {
-        throw new Error(`Blueprint "${id}" does not support --platform ${target}. ` +
-            `Supported: ${def.targets.join(', ')}.`);
-    }
-    switch (id) {
-        case 'sandbox':
-        case 'regulated-air-gapped':
-            return { target };
-        case 'prospect-demo':
-            return { target, ingress: 'edge' };
-        case 'enterprise-fleet':
-            return { target, ingress: 'edge-fed' };
-        case 'team-pilot':
-            // Platform-native identity where the platform actually has one; vm/compose have
-            // none, so they fall back to the self-issued edge (own Caddy + oauth2-proxy).
-            if (target === 'cloudrun') {
-                return { target, ingress: 'iap' };
-            }
-            if (target === 'databricks-app' || target === 'spcs' || target === 'cloudflare') {
-                return { target };
-            }
-            return { target, ingress: 'edge' };
-    }
-}

package/out/cli/deploy/layers/identity.js

@@ -1,175 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.EDGE_AGENT_PORT = void 0;
-exports.renderIdentityLayer = renderIdentityLayer;
-exports.renderSidecarEdgeCaddyfile = renderSidecarEdgeCaddyfile;
-exports.renderSidecarFedCaddyfile = renderSidecarFedCaddyfile;
-/**
- * Proof that `X-Auth-Request-Email` was set by THIS Caddy and not by a client.
- *
- * The broker now 401s an `X-Auth-Request-Email` that arrives without a matching
- * `x-agenthippo-proxy-secret` (constant-time compared), because the header is otherwise a bearer
- * assertion of identity that anything able to reach the broker's port could make. Only the routes
- * that actually forward a verified email upstream carry it — adding it elsewhere would spread the
- * secret across hops that have no use for it.
- *
- * `{env.…}` rather than `{$…}`: a runtime placeholder, so the secret is never baked into the
- * rendered config on disk. Unset ⇒ empty ⇒ the broker refuses, which is the intended direction.
- */
-const BROKER_PROXY_SECRET_LINES = [
-    '      # Proves this hop is the trusted proxy — the broker 401s X-Auth-Request-Email without it.',
-    '      header_up x-agenthippo-proxy-secret {env.AGENTHIPPO_AUTH_PROXY_SECRET}',
-];
-function renderIdentityLayer(opts) {
-    const { mode, authBrokerAddr, healthProxy, agentProxy } = opts;
-    const oauth2ProxyAddr = opts.oauth2ProxyAddr ?? '';
-    const catchallBody = opts.catchallBody ?? agentProxy;
-    const turn = opts.turnRegistration;
-    // The turn-registration hop, inserted AFTER the identity forward_auth (which sets
-    // X-Agent-User — the user the sidecar mints the nonce for). Only POST chat turns match.
-    const turnHop = turn
-        ? [
-            '      # Turn registration — after identity: X-Agent-User (set above) names the user the',
-            '      # sidecar mints the nonce for. Only POST chat turns match; others pass through.',
-            '      # X-Agent-User-Assertion (also set above) rides along as the turn\'s inboundToken:',
-            '      # without it `passthrough` fails closed on every call and an RFC 8693 `exchange`',
-            '      # provider has no subject_token. See PLAN/agent-identity.md §8.5 G1.',
-            `      forward_auth @turnStart ${turn.connectorAddr} {`,
-            '        uri /edge/turn',
-            '        copy_headers X-Agent-Turn-Nonce',
-            `        header_up Authorization "Bearer {$${turn.tokenEnvVar}}"`,
-            '      }',
-        ]
-        : [];
-    // NOTE: two forward_auth in one handle block do NOT run in source order — Caddy sorts by
-    // its directive table, so the turn-registration hop could fire before identity is
-    // established (the connector then gets no X-Agent-User → 400). Wrapping the sequence in
-    // `route {}` forces source order: identity first (unauth short-circuits), then turn
-    // registration, then proxy.
-    // Re-indent wrapped directives one level so the generated file stays readable — operators
-    // copy these snippets by hand onto the IdP host.
-    const indent = (lines) => lines.map((l) => (l.trim() ? `  ${l}` : l));
-    const gated = (identityGate, body) => turn
-        ? ['    route {', ...indent(identityGate), ...turnHop, ...indent(body), '    }']
-        : [...identityGate, ...body];
-    const lines = [];
-    if (turn) {
-        lines.push('  # Hygiene: never let a client-supplied nonce header through (copy_headers overwrites it', '  # on chat paths anyway, and a forged nonce fails closed at the gateway — belt-and-braces).', '  request_header -X-Agent-Turn-Nonce', '  # Same for the user assertion: it is set from the verified /api/ide/me response below,', '  # never from the client. A forged one would become the turn\'s inboundToken.', '  request_header -X-Agent-User-Assertion');
-    }
-    if (mode === 'self-issued') {
-        lines.push('  # IDE PKCE sign-in: broker requires X-Auth-Request-Email from oauth2-proxy. Must come', '  # before the generic /oauth/* handle so authorize is gated (not dumped straight to broker).', '  handle /oauth/authorize {', `    forward_auth ${oauth2ProxyAddr} {`, '      uri /oauth2/auth', '      copy_headers X-Auth-Request-Email', '      header_up X-Forwarded-Proto https', '      header_up X-Forwarded-Host {http.request.host}', '      @unauth status 401', '      handle_response @unauth {', '        redir * "/oauth2/sign_in?rd={http.request.uri}"', '      }', '    }', `    reverse_proxy ${authBrokerAddr} {`, '      header_up X-Forwarded-Proto https', '      header_up X-Forwarded-Host {http.request.host}', ...BROKER_PROXY_SECRET_LINES, '    }', '  }', '  # Federated SSO (A′): browsers from other subdomains land here to stamp the shared cookie.', '  # Same oauth2-proxy gate as authorize; must precede the generic /oauth/* handle.', '  handle /oauth/browser-login {', `    forward_auth ${oauth2ProxyAddr} {`, '      uri /oauth2/auth', '      copy_headers X-Auth-Request-Email', '      header_up X-Forwarded-Proto https', '      header_up X-Forwarded-Host {http.request.host}', '      @unauth status 401', '      handle_response @unauth {', '        redir * "/oauth2/sign_in?rd={http.request.uri}"', '      }', '    }', `    reverse_proxy ${authBrokerAddr} {`, '      header_up X-Forwarded-Proto https', '      header_up X-Forwarded-Host {http.request.host}', ...BROKER_PROXY_SECRET_LINES, '    }', '  }', '  # Auth-broker: token exchange + other /oauth/* routes that must stay ungated.', '  handle /oauth/* {', `    reverse_proxy ${authBrokerAddr} {`, '      header_up X-Forwarded-Proto https', '      header_up X-Forwarded-Host {http.request.host}', '    }', '  }');
-    }
-    lines.push('  handle /api/ide/* {', `    reverse_proxy ${authBrokerAddr} {`, '      header_up X-Forwarded-Proto https', '      header_up X-Forwarded-Host {http.request.host}', '    }', '  }');
-    if (mode === 'self-issued') {
-        lines.push('  # oauth2-proxy: Google SSO callback + sign-in.', '  handle /oauth2/* {', `    reverse_proxy ${oauth2ProxyAddr} {`, '      header_up X-Forwarded-Proto https', '      header_up X-Forwarded-Host {http.request.host}', '    }', '  }');
-    }
-    lines.push('  @health path /health /ready', '  handle @health {', ...healthProxy, '  }');
-    if (turn) {
-        lines.push('  # Chat-turn matcher for edge turn registration (P1 fix): only POST chat turns register.', '  @turnStart {', '    method POST', '    path /v1/chat /v1/chat/stream', '  }');
-    }
-    lines.push('  # API clients (IDE) with a Bearer token: validate via auth-broker, copy identity header.', '  @apiWithAuth {', '    path /v1/*', '    header Authorization *', '  }', '  handle @apiWithAuth {', ...gated([
-        `    forward_auth ${authBrokerAddr} {`,
-        '      uri /api/ide/me',
-        `      copy_headers X-Agent-User${turn ? ' X-Agent-User-Assertion' : ''}`,
-        '      header_up X-Forwarded-Proto https',
-        '      header_up X-Forwarded-Host {http.request.host}',
-        '      @unauth status 401',
-        '      handle_response @unauth {',
-        '        respond "Unauthorized" 401',
-        '      }',
-        '    }',
-    ], agentProxy), '  }');
-    if (mode === 'self-issued') {
-        lines.push('  # Browser clients: SSO via oauth2-proxy, identity injected as X-Agent-User.', '  handle {', ...gated([
-            `    forward_auth ${oauth2ProxyAddr} {`,
-            '      uri /oauth2/auth',
-            '      copy_headers X-Auth-Request-Email>X-Agent-User',
-            '      header_up X-Forwarded-Proto https',
-            '      header_up X-Forwarded-Host {http.request.host}',
-            '      @unauth status 401',
-            '      handle_response @unauth {',
-            '        redir * "/oauth2/sign_in?rd={http.request.uri}"',
-            '      }',
-            '    }',
-        ], catchallBody), '  }');
-    }
-    else {
-        const idp = opts.idpUrl?.trim() || '';
-        const loginRedirect = idp
-            ? `        redir * "${idp}/oauth/browser-login?return_to=https://{http.request.host}{http.request.uri}" 302`
-            : '        respond "Unauthorized" 401';
-        lines.push('  # Browser clients: the shared .agenthippo.ai cookie is verified by auth-broker. No cookie', '  # → redirect to the central IdP to log in (it stamps the cookie), then return.', '  handle {', ...gated([
-            `    forward_auth ${authBrokerAddr} {`,
-            '      uri /api/ide/me',
-            '      copy_headers X-Agent-User',
-            '      header_up X-Forwarded-Proto https',
-            '      header_up X-Forwarded-Host {http.request.host}',
-            '      @unauth status 401',
-            '      handle_response @unauth {',
-            loginRedirect,
-            '      }',
-            '    }',
-        ], catchallBody), '  }');
-    }
-    return lines;
-}
-/**
- * "Sidecar" platforms — Cloud Run, ECS Fargate (`awsvpc` mode), Azure Container Apps (one
- * replica) — all share one task's network namespace across containers and terminate TLS in
- * front, so Caddy always listens on plain HTTP `:{$PORT}` and reaches every sidecar via
- * `localhost:<port>` (never docker-DNS names). The agent isn't the ingress on these platforms,
- * so it listens on a distinct internal port to avoid clashing with Caddy on `$PORT`.
- */
-exports.EDGE_AGENT_PORT = 8090;
-/** Caddyfile for a sidecar platform's self-issued edge (own oauth2-proxy + Google client). */
-function renderSidecarEdgeCaddyfile() {
-    return [
-        '# Sidecar-platform edge ingress. TLS terminates in front; Caddy listens on HTTP :{$PORT}.',
-        '# Containers share one task/pod\'s localhost → upstreams are 127.0.0.1:<port> (not docker-DNS names).',
-        '{',
-        '  auto_https off',
-        '}',
-        '',
-        ':{$PORT} {',
-        ...renderIdentityLayer({
-            mode: 'self-issued',
-            oauth2ProxyAddr: 'localhost:4180',
-            authBrokerAddr: 'localhost:9780',
-            healthProxy: [`    reverse_proxy localhost:${exports.EDGE_AGENT_PORT}`],
-            agentProxy: [`    reverse_proxy localhost:${exports.EDGE_AGENT_PORT}`],
-        }),
-        '}',
-        '',
-    ].join('\n');
-}
-/**
- * A′ — federated sidecar-platform edge. No oauth2-proxy: Google login happens once at the
- * central IdP (`idpUrl`); this agent only verifies the shared AgentHippo JWT (Bearer for IDE,
- * cookie for browser). On a browser 401, redirect to the IdP's `/oauth/browser-login` to stamp
- * the shared cookie, then return.
- */
-function renderSidecarFedCaddyfile(idpUrl) {
-    const idp = (idpUrl || '').trim().replace(/\/+$/, '');
-    return [
-        '# Sidecar-platform federated edge (A′). TLS terminates in front; Caddy listens on HTTP :{$PORT}.',
-        `# No oauth2-proxy — Google login happens once at the central IdP (${idp || '<IDP_URL>'});`,
-        '# this agent only verifies the shared AgentHippo JWT (Bearer for IDE, cookie for browser).',
-        '{',
-        '  auto_https off',
-        '}',
-        '',
-        ':{$PORT} {',
-        ...renderIdentityLayer({
-            mode: 'federated',
-            authBrokerAddr: 'localhost:9780',
-            idpUrl: idp,
-            healthProxy: [`    reverse_proxy localhost:${exports.EDGE_AGENT_PORT}`],
-            agentProxy: [`    reverse_proxy localhost:${exports.EDGE_AGENT_PORT}`],
-        }),
-        '}',
-        '',
-    ].join('\n');
-}