@agenthippo-ai/agenthippo 1.110.11 → 1.110.19

package/out/auth-broker/server.js

@@ -1,681 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.hasTrustedProxyProof = void 0;
-exports.isAllowedRedirectUri = isAllowedRedirectUri;
-exports.createAuthBrokerServer = createAuthBrokerServer;
-exports.startAuthBrokerServer = startAuthBrokerServer;
-const http = __importStar(require("http"));
-const crypto = __importStar(require("crypto"));
-const url_1 = require("url");
-const path = __importStar(require("path"));
-const config_js_1 = require("./config.js");
-const store_js_1 = require("./store.js");
-const pkce_js_1 = require("./pkce.js");
-const jwt_js_1 = require("./jwt.js");
-const types_js_1 = require("../auth/types.js");
-const callbackUriParse_js_1 = require("../auth/callbackUriParse.js");
-const serve_hardening_js_1 = require("../cli/serve-hardening.js");
-/**
- * Restrict `redirect_uri` to the shapes our own clients actually send — the CLI/IDE loopback
- * callback (127.0.0.1/localhost, any OS-assigned port, see loopbackAuthServer.ts) and the IDE
- * URI-scheme callback (any editor scheme, fixed authority+path, see callbackUri.ts). Without
- * this, `/oauth/authorize` would hand a real auth code to whatever `redirect_uri` a caller
- * supplies — an attacker can send a victim (who has an active SSO session) a link with their
- * own redirect_uri and code_challenge and steal the resulting code via their own server.
- */
-function isAllowedRedirectUri(redirectUri) {
-    let target;
-    try {
-        target = new url_1.URL(redirectUri);
-    }
-    catch {
-        return false;
-    }
-    // No embedded credentials, no query, no fragment. A permitted shape with a `?next=…` rider or a
-    // `user:pass@` prefix is a different destination wearing an allowed hostname; the exchange binds
-    // the code to this exact string, so anything that isn't the literal callback is refused here.
-    if (target.username || target.password || target.search || target.hash) {
-        return false;
-    }
-    if (target.protocol === 'http:') {
-        // The loopback callback is the real IDE/CLI flow (loopbackAuthServer.ts binds an OS-assigned
-        // port on 127.0.0.1), so the port cannot be pinned. The port is not what makes this safe:
-        // the code is single-use, bound to THIS redirect_uri at issue time and verified against it at
-        // /oauth/token, and PKCE binds it to a verifier only the initiating client holds. An attacker
-        // who forges a loopback redirect_uri still receives a code they cannot exchange.
-        // `localhost` is accepted for parity with the client, but nothing else resolves here.
-        if (target.hostname !== '127.0.0.1' && target.hostname !== 'localhost') {
-            return false;
-        }
-        if (target.pathname !== '/callback') {
-            return false;
-        }
-        // A bare `http://127.0.0.1/callback` (port 80) is not something the loopback server ever
-        // asks for — it needs a bindable ephemeral port — and port 80 is the one loopback port a
-        // non-root process cannot claim, so refuse it rather than leave the shape open.
-        return target.port !== '' && Number(target.port) > 1024;
-    }
-    if (target.protocol === 'https:') {
-        // No https redirect target is a client of this broker: the IDE uses the editor URI scheme
-        // and the CLI uses loopback. Allowing https here would make "redirect to my server" a
-        // one-line manifest away.
-        return false;
-    }
-    return (0, callbackUriParse_js_1.isAuthCallbackParts)(target.host, target.pathname);
-}
-/**
- * Does this request carry the trusted proxy's proof?
- *
- * `X-Auth-Request-Email` is only meaningful when it was set by our oauth2-proxy sidecar after a real
- * Google login. Nothing about the header says so, so the proxy also stamps a shared secret which is
- * checked constant-time, so a mismatched secret cannot be recovered byte by byte. The check lives in
- * serve-hardening (serve applies the same contract to its identity header via
- * AGENTHIPPO_IDENTITY_PROXY_SECRET); re-exported here for the broker's existing consumers.
- */
-var serve_hardening_js_2 = require("../cli/serve-hardening.js");
-Object.defineProperty(exports, "hasTrustedProxyProof", { enumerable: true, get: function () { return serve_hardening_js_2.hasTrustedProxyProof; } });
-function sendJson(res, status, body) {
-    res.writeHead(status, { 'Content-Type': 'application/json' });
-    res.end(JSON.stringify(body));
-}
-/** Mask the local-part of an email for logs: `n***@example.com` (domain kept for debugging). */
-function maskEmail(value) {
-    const at = value.indexOf('@');
-    if (at <= 0) {
-        return value;
-    }
-    return `${value[0]}***@${value.slice(at + 1)}`;
-}
-/** Auth request bodies (PKCE codes, emails, form fields) are always tiny. */
-const MAX_BODY_BYTES = 64 * 1024;
-async function readBody(req) {
-    const chunks = [];
-    let size = 0;
-    for await (const chunk of req) {
-        const buf = typeof chunk === 'string' ? Buffer.from(chunk) : chunk;
-        size += buf.length;
-        if (size > MAX_BODY_BYTES) {
-            const err = new Error('Request body too large');
-            err.status = 413;
-            throw err;
-        }
-        chunks.push(buf);
-    }
-    return Buffer.concat(chunks).toString('utf8');
-}
-function parseFormBody(raw) {
-    const params = new URLSearchParams(raw);
-    const out = {};
-    for (const [key, value] of params.entries()) {
-        out[key] = value;
-    }
-    return out;
-}
-/** Read a named cookie from the Cookie header. */
-function extractCookieToken(cookieHeader, name) {
-    if (!cookieHeader?.trim()) {
-        return undefined;
-    }
-    for (const part of cookieHeader.split(';')) {
-        const eq = part.indexOf('=');
-        if (eq <= 0) {
-            continue;
-        }
-        const key = part.slice(0, eq).trim();
-        if (key === name) {
-            const val = part.slice(eq + 1).trim();
-            if (val) {
-                return val;
-            }
-        }
-    }
-    return undefined;
-}
-/**
- * Federated SSO (A′): validate a `return_to` redirect target for the browser-login endpoint.
- * The target host must live under the configured `cookieDomain` (e.g. `.agenthippo.ai`) so the
- * shared cookie we're about to set will actually be sent back to it. With no cookie domain
- * configured (dev), allow same-host / localhost.
- */
-function safeReturnTo(rawReturnTo, cookieDomain, fallback) {
-    try {
-        const target = new url_1.URL(rawReturnTo);
-        if (target.protocol !== 'http:' && target.protocol !== 'https:') {
-            return fallback;
-        }
-        if (cookieDomain) {
-            const parent = cookieDomain.replace(/^\./, '').toLowerCase();
-            if (target.hostname.toLowerCase() === parent || target.hostname.toLowerCase().endsWith('.' + parent)) {
-                return target.toString();
-            }
-        }
-        else if (target.hostname === '127.0.0.1' || target.hostname === 'localhost') {
-            return target.toString();
-        }
-    }
-    catch {
-        // fall through
-    }
-    return fallback;
-}
-function createAuthBrokerServer(config) {
-    const resolved = config ?? (0, config_js_1.loadAuthBrokerConfig)();
-    // Fail-closed: a known-default secret makes JWT forgery trivial.
-    if (!resolved.devMode && resolved.jwtSecret === config_js_1.DEFAULT_JWT_SECRET) {
-        throw new Error('AGENTHIPPO_AUTH_JWT_SECRET must be set to a strong secret in production. ' +
-            'Generate one with: openssl rand -hex 32');
-    }
-    // Fail-closed: without a proxy proof, `X-Auth-Request-Email` is a self-asserted claim. Anything
-    // that can reach this port could send `X-Auth-Request-Email: ceo@example.com` with a loopback
-    // redirect_uri to /oauth/authorize and exchange the resulting code at the ungated /oauth/token —
-    // a full account takeover with no credential. Same posture as the JWT/LiteLLM defaults above:
-    // refuse to boot rather than run a broker whose identity input is unauthenticated.
-    if (!resolved.devMode && !resolved.proxySecret && !resolved.trustProxyHeadersUnverified) {
-        throw new Error('AGENTHIPPO_AUTH_PROXY_SECRET must be set in production. The broker trusts ' +
-            'X-Auth-Request-Email from the oauth2-proxy/Caddy forward_auth sidecar; without a shared ' +
-            'secret proving the header came from that sidecar, any caller that reaches this port can ' +
-            'mint a token for an arbitrary email.\n' +
-            '  1. Generate one:  openssl rand -hex 32\n' +
-            `  2. Set it here:   AGENTHIPPO_AUTH_PROXY_SECRET=<secret>\n` +
-            `  3. Have the proxy send it, e.g. in the Caddyfile:\n` +
-            `       header_up ${config_js_1.AUTH_PROXY_SECRET_HEADER} {env.AGENTHIPPO_AUTH_PROXY_SECRET}\n` +
-            'If the broker is genuinely unreachable except through the proxy and you accept the risk, ' +
-            'set AGENTHIPPO_AUTH_TRUST_PROXY_UNVERIFIED=1.');
-    }
-    if (!resolved.devMode && !resolved.proxySecret && resolved.trustProxyHeadersUnverified) {
-        console.warn('[auth-broker] WARNING: AGENTHIPPO_AUTH_TRUST_PROXY_UNVERIFIED=1 — X-Auth-Request-Email is ' +
-            'accepted without proof. Anything that can reach this port can mint a token for any email. ' +
-            'Set AGENTHIPPO_AUTH_PROXY_SECRET to close this.');
-    }
-    // Warn when no domain restriction is configured: any SSO-authenticated email can sign in.
-    if (!resolved.devMode && resolved.allowedEmailDomains.length === 0) {
-        console.warn('[auth-broker] Warning: AGENTHIPPO_AUTH_ALLOWED_DOMAINS is not set — ' +
-            'any upstream-SSO-authenticated email can receive a token. ' +
-            'Set it to restrict sign-in (e.g. "example.com").');
-    }
-    const persistPath = resolved.dataDir
-        ? path.join(resolved.dataDir, 'auth-store.json')
-        : undefined;
-    const store = new store_js_1.AuthBrokerStore(resolved, persistPath);
-    // Per-client-IP cap on the credential-issuing endpoints (authorize/token/dev-login) so a
-    // direct caller can't brute-force or hammer them. /api/ide/me is deliberately exempt: Caddy
-    // forward_auth calls it on every IDE request and it's already cheap + cached.
-    const authLimiter = new serve_hardening_js_1.RateLimiter(resolved.rateLimitPerMin);
-    /** Structured auth-event audit log; emails masked unless AGENTHIPPO_AUTH_LOG_PII=1. */
-    const audit = (event, fields = {}) => {
-        const parts = Object.entries(fields)
-            .filter(([, v]) => v !== undefined && v !== '')
-            .map(([k, v]) => {
-            const masked = !resolved.logPii && typeof v === 'string' && v.includes('@') ? maskEmail(v) : v;
-            return `${k}=${masked}`;
-        })
-            .join(' ');
-        console.log(`[auth-broker] ${event}${parts ? ' ' + parts : ''}`);
-    };
-    // Short-lived positive cache for /api/ide/me (Caddy forward_auth calls it on every IDE
-    // /v1/* request). Access tokens are short-lived JWTs with no server-side revocation, so
-    // trusting a verified token for a few seconds is safe and avoids a verifyJwt+getUser
-    // round-trip on every chat turn. Keyed by token hash; capped + pruned.
-    const ME_CACHE_TTL_MS = 10_000;
-    const ME_CACHE_MAX = 2048;
-    const meCache = new Map();
-    // Throttle the per-turn /me 401 audit so an expired-token burst doesn't spam the log.
-    const ME_UNAUTHORIZED_LOG_INTERVAL_MS = 5_000;
-    let lastMeUnauthorizedLogMs = 0;
-    function resolveAuthedUser(req) {
-        // Bearer (IDE) first; fall back to the federated `.agenthippo.ai` cookie (browser).
-        const bearer = (0, jwt_js_1.extractBearerToken)(req.headers.authorization)
-            || extractCookieToken(req.headers.cookie, resolved.cookieName);
-        if (!bearer) {
-            return undefined;
-        }
-        const key = crypto.createHash('sha256').update(bearer).digest('hex');
-        const cached = meCache.get(key);
-        if (cached) {
-            if (cached.exp > Date.now()) {
-                return cached.user;
-            }
-            meCache.delete(key);
-        }
-        const payload = (0, jwt_js_1.verifyJwt)(bearer, resolved.jwtSecret);
-        if (!payload?.sub || !payload.email) {
-            return undefined;
-        }
-        let user = store.getUser(String(payload.sub));
-        // Federated trust (A′): a token signed with our shared AGENTHIPPO_AUTH_JWT_SECRET is
-        // authoritative even when the issuing user record lives in the central IdP's store, not
-        // this broker's local store (which is an empty ephemeral volume on distributed edge
-        // services). The IdP vouches for sub/email/name; the HMAC signature is the proof. The
-        // IdP's own broker still hits getUser for its locally-created users, so this fallback is
-        // a no-op there.
-        if (!user) {
-            const teamIdFromToken = typeof payload.team_id === 'string' && payload.team_id ? payload.team_id : undefined;
-            user = {
-                id: String(payload.sub),
-                email: String(payload.email),
-                displayName: typeof payload.name === 'string' && payload.name ? payload.name : String(payload.email),
-                teamId: teamIdFromToken ?? (resolved.teamConfigured ? resolved.team.id : undefined),
-            };
-        }
-        if (payload.exp) {
-            const exp = Math.min(payload.exp * 1000, Date.now() + ME_CACHE_TTL_MS);
-            if (meCache.size >= ME_CACHE_MAX) {
-                const now = Date.now();
-                for (const [k, v] of meCache) {
-                    if (v.exp < now) {
-                        meCache.delete(k);
-                    }
-                }
-                if (meCache.size >= ME_CACHE_MAX) {
-                    meCache.clear();
-                }
-            }
-            meCache.set(key, { user, exp });
-        }
-        return user;
-    }
-    /**
-     * Read the SSO-asserted email, but only if the request proved it came from the trusted proxy.
-     * Returns `undefined` when there is no email, and `null` when an email was present but the proof
-     * was missing/wrong — those are different failures and the second one is worth auditing loudly.
-     */
-    const proxyAssertedEmail = (req) => {
-        const email = (req.headers['x-auth-request-email'] || '').trim().toLowerCase();
-        if (!email) {
-            return undefined;
-        }
-        // devMode and the explicit unverified opt-in are the only ways past the proof.
-        if (resolved.devMode || (!resolved.proxySecret && resolved.trustProxyHeadersUnverified)) {
-            return email;
-        }
-        if (!(0, serve_hardening_js_1.hasTrustedProxyProof)(req.headers, resolved.proxySecret)) {
-            return null;
-        }
-        return email;
-    };
-    const rejectForgedProxyHeader = (res, ip, pathname) => {
-        audit('proxy_header.unverified', { ip, path: pathname });
-        sendJson(res, 401, {
-            error: 'unauthorized',
-            error_description: `X-Auth-Request-Email was present without a valid ${config_js_1.AUTH_PROXY_SECRET_HEADER} header. ` +
-                'Only the trusted reverse proxy may assert an identity to this broker.',
-        });
-    };
-    const server = http.createServer(async (req, res) => {
-        try {
-            const host = req.headers.host || `127.0.0.1:${resolved.port}`;
-            const url = new url_1.URL(req.url || '/', `http://${host}`);
-            const pathname = url.pathname;
-            // Gate on the credential-issuing endpoints only (see authLimiter note above).
-            const ip = (0, serve_hardening_js_1.clientIp)(req);
-            const rateLimited = () => {
-                if (authLimiter.tryConsume(ip)) {
-                    return false;
-                }
-                audit('rate_limited', { ip, path: pathname });
-                res.writeHead(429, { 'Content-Type': 'application/json', 'Retry-After': String(authLimiter.retryAfterSeconds(ip)) });
-                res.end(JSON.stringify({ error: 'rate_limited' }));
-                return true;
-            };
-            if (req.method === 'GET' && (pathname === '/health' || pathname === '/api/ide/health')) {
-                sendJson(res, 200, { status: 'ok', service: 'auth-broker' });
-                return;
-            }
-            if (req.method === 'GET' && pathname === '/oauth/authorize') {
-                if (rateLimited()) {
-                    return;
-                }
-                const clientId = url.searchParams.get('client_id') || '';
-                const redirectUri = url.searchParams.get('redirect_uri') || '';
-                const codeChallenge = url.searchParams.get('code_challenge') || '';
-                const state = url.searchParams.get('state') || '';
-                const loginHint = url.searchParams.get('login_hint') || url.searchParams.get('email') || '';
-                if (clientId !== types_js_1.AUTH_CLIENT_ID || !redirectUri || !codeChallenge) {
-                    audit('authorize.invalid_request', { client_id: clientId });
-                    sendJson(res, 400, { error: 'invalid_request' });
-                    return;
-                }
-                if (!isAllowedRedirectUri(redirectUri)) {
-                    audit('authorize.invalid_redirect_uri', { client_id: clientId });
-                    sendJson(res, 400, { error: 'invalid_request', error_description: 'redirect_uri not allowed' });
-                    return;
-                }
-                // Dev mode with explicit login_hint: auto-authenticate (backward compat for tests).
-                if (resolved.devMode && loginHint) {
-                    const user = store.upsertUser(loginHint);
-                    const code = store.createAuthCode({ userId: user.id, clientId, redirectUri, codeChallenge });
-                    audit('authorize.dev', { user: user.email });
-                    const redirect = new url_1.URL(redirectUri);
-                    redirect.searchParams.set('code', code);
-                    if (state) {
-                        redirect.searchParams.set('state', state);
-                    }
-                    res.writeHead(302, { Location: redirect.toString() });
-                    res.end();
-                    return;
-                }
-                // Caddy forward_auth (via oauth2-proxy) sets X-Auth-Request-Email after the user
-                // logs in with Google. The authorize endpoint is gated behind forward_auth in the
-                // Caddyfile so this header is always present when the request reaches the broker —
-                // but a caller that reaches the broker DIRECTLY can set it too, which is why the
-                // proxy also has to prove who it is.
-                const userEmail = proxyAssertedEmail(req);
-                if (userEmail === null) {
-                    rejectForgedProxyHeader(res, ip, pathname);
-                    return;
-                }
-                if (!userEmail) {
-                    sendJson(res, 401, { error: 'unauthorized', error_description: 'No authenticated user (missing X-Auth-Request-Email)' });
-                    return;
-                }
-                const user = store.upsertUser(userEmail);
-                const code = store.createAuthCode({ userId: user.id, clientId, redirectUri, codeChallenge });
-                audit('authorize.signin', { user: user.email });
-                const redirect = new url_1.URL(redirectUri);
-                redirect.searchParams.set('code', code);
-                if (state) {
-                    redirect.searchParams.set('state', state);
-                }
-                res.writeHead(302, { Location: redirect.toString() });
-                res.end();
-                return;
-            }
-            if (req.method === 'GET' && pathname === '/oauth/browser-login') {
-                if (rateLimited()) {
-                    return;
-                }
-                // Federated SSO (A′): the central IdP (auth.agenthippo.ai) stamps the shared
-                // `.agenthippo.ai` cookie after Google SSO. Gated behind oauth2-proxy forward_auth
-                // (same as /oauth/authorize) — X-Auth-Request-Email is only set once Google login
-                // completes. Federated agent services never hit this path (they have no oauth2-proxy),
-                // so it 401s there, which is correct.
-                const userEmail = proxyAssertedEmail(req);
-                if (userEmail === null) {
-                    rejectForgedProxyHeader(res, ip, pathname);
-                    return;
-                }
-                if (!userEmail) {
-                    sendJson(res, 401, { error: 'unauthorized', error_description: 'No authenticated user (missing X-Auth-Request-Email)' });
-                    return;
-                }
-                const user = store.upsertUser(userEmail);
-                const tokens = store.issueTokens(user, types_js_1.AUTH_CLIENT_ID, 'openid profile email agenthippo:ide');
-                audit('browser.login', { user: user.email });
-                const secure = resolved.publicBaseUrl.startsWith('https');
-                const cookieParts = [
-                    `${resolved.cookieName}=${tokens.accessToken}`,
-                    'Path=/',
-                    'HttpOnly',
-                    'SameSite=Lax',
-                    ...(secure ? ['Secure'] : []),
-                    ...(resolved.cookieDomain ? [`Domain=${resolved.cookieDomain}`] : []),
-                    `Max-Age=${tokens.expiresIn}`,
-                ];
-                const returnTo = safeReturnTo(url.searchParams.get('return_to') || '', resolved.cookieDomain, resolved.publicBaseUrl || '/');
-                res.writeHead(302, { 'Set-Cookie': cookieParts.join('; '), Location: returnTo });
-                res.end();
-                return;
-            }
-            if (req.method === 'POST' && pathname === '/oauth/dev/login') {
-                if (rateLimited()) {
-                    return;
-                }
-                if (!resolved.devMode) {
-                    sendJson(res, 404, { error: 'not_found' });
-                    return;
-                }
-                const raw = await readBody(req);
-                const body = raw.trim().startsWith('{')
-                    ? JSON.parse(raw)
-                    : parseFormBody(raw);
-                const email = body.email?.trim();
-                const codeChallenge = body.code_challenge?.trim();
-                const redirectUri = body.redirect_uri?.trim();
-                const clientId = body.client_id?.trim() || types_js_1.AUTH_CLIENT_ID;
-                if (!email || !codeChallenge || !redirectUri) {
-                    sendJson(res, 400, { error: 'invalid_request' });
-                    return;
-                }
-                const user = store.upsertUser(email);
-                const code = store.createAuthCode({
-                    userId: user.id,
-                    clientId,
-                    redirectUri,
-                    codeChallenge,
-                });
-                audit('dev.login', { user: user.email });
-                sendJson(res, 200, { code });
-                return;
-            }
-            if (req.method === 'POST' && pathname === '/oauth/token') {
-                if (rateLimited()) {
-                    return;
-                }
-                const raw = await readBody(req);
-                const body = parseFormBody(raw);
-                const grantType = body.grant_type;
-                const clientId = body.client_id || types_js_1.AUTH_CLIENT_ID;
-                const scope = body.scope || 'openid profile email agenthippo:ide';
-                if (grantType === 'authorization_code') {
-                    const code = body.code;
-                    const codeVerifier = body.code_verifier;
-                    const redirectUri = body.redirect_uri;
-                    if (!code || !codeVerifier || !redirectUri) {
-                        sendJson(res, 400, { error: 'invalid_request' });
-                        return;
-                    }
-                    const authCode = store.consumeAuthCode(code);
-                    if (!authCode || authCode.clientId !== clientId || authCode.redirectUri !== redirectUri) {
-                        sendJson(res, 400, { error: 'invalid_grant' });
-                        return;
-                    }
-                    if (!(0, pkce_js_1.verifyPkceChallenge)(codeVerifier, authCode.codeChallenge)) {
-                        sendJson(res, 400, { error: 'invalid_grant', error_description: 'PKCE verification failed' });
-                        return;
-                    }
-                    const user = store.getUser(authCode.userId);
-                    if (!user) {
-                        sendJson(res, 400, { error: 'invalid_grant' });
-                        return;
-                    }
-                    const tokens = store.issueTokens(user, clientId, scope);
-                    audit('token.signin', { user: user.email, client_id: clientId });
-                    sendJson(res, 200, {
-                        access_token: tokens.accessToken,
-                        refresh_token: tokens.refreshToken,
-                        token_type: 'Bearer',
-                        expires_in: tokens.expiresIn,
-                        scope,
-                    });
-                    return;
-                }
-                if (grantType === 'refresh_token') {
-                    const refreshToken = body.refresh_token;
-                    if (!refreshToken) {
-                        sendJson(res, 400, { error: 'invalid_request' });
-                        return;
-                    }
-                    const record = store.consumeRefreshToken(refreshToken);
-                    if (!record || record.clientId !== clientId) {
-                        audit('token.refresh.invalid_grant');
-                        sendJson(res, 400, { error: 'invalid_grant' });
-                        return;
-                    }
-                    const user = store.getUser(record.userId);
-                    if (!user) {
-                        sendJson(res, 400, { error: 'invalid_grant' });
-                        return;
-                    }
-                    const tokens = store.issueTokens(user, clientId, scope);
-                    audit('token.refresh', { user: user.email });
-                    sendJson(res, 200, {
-                        access_token: tokens.accessToken,
-                        refresh_token: tokens.refreshToken,
-                        token_type: 'Bearer',
-                        expires_in: tokens.expiresIn,
-                        scope,
-                    });
-                    return;
-                }
-                sendJson(res, 400, { error: 'unsupported_grant_type' });
-                return;
-            }
-            if (req.method === 'POST' && pathname === '/oauth/introspect') {
-                // RFC 7662: introspect must be protected. Require a valid bearer (any live JWT)
-                // so an anonymous caller can't probe arbitrary tokens for user claims.
-                if (!resolveAuthedUser(req)) {
-                    audit('introspect.unauthorized');
-                    sendJson(res, 401, { error: 'unauthorized' });
-                    return;
-                }
-                const raw = await readBody(req);
-                const body = parseFormBody(raw);
-                const token = body.token;
-                if (!token) {
-                    sendJson(res, 400, { error: 'invalid_request' });
-                    return;
-                }
-                const payload = (0, jwt_js_1.verifyJwt)(token, resolved.jwtSecret);
-                if (!payload?.sub) {
-                    sendJson(res, 200, { active: false });
-                    return;
-                }
-                sendJson(res, 200, {
-                    active: true,
-                    sub: payload.sub,
-                    email: payload.email,
-                    team_id: payload.team_id,
-                    scope: payload.scope,
-                    exp: payload.exp,
-                });
-                return;
-            }
-            const user = resolveAuthedUser(req);
-            if (req.method === 'GET' && pathname === '/api/ide/me') {
-                if (!user) {
-                    // /me is called per IDE turn via Caddy forward_auth; an expired-token burst
-                    // would spam this log, so throttle to one line per few seconds.
-                    const now = Date.now();
-                    if (now - lastMeUnauthorizedLogMs > ME_UNAUTHORIZED_LOG_INTERVAL_MS) {
-                        lastMeUnauthorizedLogMs = now;
-                        audit('me.unauthorized');
-                    }
-                    sendJson(res, 401, { error: 'unauthorized' });
-                    return;
-                }
-                // Set X-Agent-User so Caddy's forward_auth can copy the validated identity
-                // into the upstream request without serve needing its own JWT validation.
-                res.setHeader('X-Agent-User', user.email || user.id);
-                // …and the ASSERTION alongside the identifier (PLAN/agent-identity.md §8.5 G1).
-                // The identifier alone is all the edge forwarded until now, so an edge-registered
-                // turn carried no `inboundToken`: `passthrough` failed closed on every tool call
-                // and an RFC 8693 `exchange` provider had no subject_token. This is the same
-                // token this request just verified — the browser (cookie) lane has no
-                // Authorization header for the edge to relay, so it has to come from here.
-                //
-                // Not a new exposure: whatever presented this token — Bearer header or cookie —
-                // is already on the request Caddy proxies to the agent. What changes is that the
-                // connector sidecar can now reach it, which is the whole point.
-                const presented = (0, jwt_js_1.extractBearerToken)(req.headers.authorization)
-                    || extractCookieToken(req.headers.cookie, resolved.cookieName);
-                if (presented) {
-                    res.setHeader('X-Agent-User-Assertion', presented);
-                }
-                sendJson(res, 200, store.buildMe(user));
-                return;
-            }
-            if (req.method === 'GET' && pathname === '/api/ide/bootstrap') {
-                if (!user) {
-                    sendJson(res, 401, { error: 'unauthorized' });
-                    return;
-                }
-                sendJson(res, 200, store.buildBootstrap(user));
-                return;
-            }
-            if (req.method === 'POST' && pathname === '/api/ide/signout') {
-                if (user) {
-                    store.revokeRefreshTokensForUser(user.id);
-                    audit('signout', { user: user.email });
-                }
-                sendJson(res, 200, { ok: true });
-                return;
-            }
-            sendJson(res, 404, { error: 'not_found' });
-        }
-        catch (err) {
-            const status = err.status;
-            if (status === 413) {
-                sendJson(res, 413, { error: 'request_entity_too_large' });
-                return;
-            }
-            if (status === 403) {
-                audit('forbidden', { reason: 'email_domain' });
-                sendJson(res, 403, { error: 'forbidden', error_description: 'email domain not allowed' });
-                return;
-            }
-            // Log the real error internally; return a generic message so clients don't see
-            // stack fragments / internal paths in the 500 body.
-            console.error('[auth-broker] internal error', err);
-            sendJson(res, 500, { error: 'server_error' });
-        }
-    });
-    return {
-        server,
-        baseUrl: resolved.publicBaseUrl,
-        store,
-        config: resolved,
-        close: () => new Promise((resolve, reject) => {
-            server.close((err) => (err ? reject(err) : resolve()));
-        }),
-    };
-}
-async function startAuthBrokerServer(config) {
-    const broker = createAuthBrokerServer(config);
-    const bind = (0, config_js_1.resolveAuthBrokerBind)();
-    if (bind.isPublic) {
-        console.warn(`[auth-broker] WARNING: listening on ${bind.address}:${broker.config.port} — this ` +
-            `token-issuing endpoint is reachable from off-host (AGENTHIPPO_AUTH_ALLOW_PUBLIC_BIND=1). ` +
-            `Ensure only the reverse proxy can reach it and that AGENTHIPPO_AUTH_PROXY_SECRET is set.`);
-    }
-    await new Promise((resolve, reject) => {
-        broker.server.listen(broker.config.port, bind.address, () => resolve());
-        broker.server.once('error', reject);
-    });
-    return broker;
-}