@agenthippo-ai/agenthippo 1.110.11 → 1.110.20

package/out/cli/credential-context.js

@@ -1,108 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ON_DENIED_TIMEOUT_MS = exports.WARRANT_DENIED_REASON = void 0;
-exports.runWithCredential = runWithCredential;
-exports.currentCredential = currentCredential;
-exports.resolveEngineHomeUserKey = resolveEngineHomeUserKey;
-exports.requireUserId = requireUserId;
-/**
- * Request-scoped credential context — the "Design B" seam from serve-v3 §11.1.
- *
- * A single turn runs inside `runWithCredential({ userId, dataToken }, fn)`. Any
- * in-process data tool reads the acting user / per-turn token *at call time*
- * via `currentCredential()` / `requireUserId()`. The credential is never
- * persisted and is automatically discarded when the turn's async scope ends —
- * exactly as the Databricks OBO docs prescribe ("read it from the request on
- * each call … rather than trying to have it persist").
- *
- * The credential lives in broker (serve) process memory only. It is never
- * written to disk and never crosses into an engine subprocess: engines receive
- * a turn-scoped nonce for the loopback data-plane gateway instead
- * (secure-obo-design §2/§3 — the agent gets a capability, not the credential).
- */
-const async_hooks_1 = require("async_hooks");
-const paths_1 = require("../agentpack/paths");
-/** Stable, queryable reason code for the one case runWithCredential rejects. */
-exports.WARRANT_DENIED_REASON = 'token_without_verified_user';
-/** Default bound on `onDenied` so a hung audit write cannot stall admission forever. */
-exports.ON_DENIED_TIMEOUT_MS = 2_000;
-const storage = new async_hooks_1.AsyncLocalStorage();
-/**
- * Invoke `onDenied` best-effort with a hard timeout. Never throws: logging must
- * not replace or delay the fail-closed rejection that follows.
- */
-async function invokeOnDenied(onDenied, reason, timeoutMs) {
-    if (!onDenied) {
-        return;
-    }
-    const ms = Number.isFinite(timeoutMs) && timeoutMs > 0 ? timeoutMs : exports.ON_DENIED_TIMEOUT_MS;
-    let timer;
-    try {
-        await Promise.race([
-            Promise.resolve().then(() => onDenied(reason)),
-            new Promise((resolve) => {
-                timer = setTimeout(resolve, ms);
-                timer.unref?.();
-            }),
-        ]);
-    }
-    catch {
-        // Evidence logging must never suppress or replace the fail-closed error below.
-    }
-    finally {
-        if (timer) {
-            clearTimeout(timer);
-        }
-    }
-}
-async function checkCredentialScope(cred, options) {
-    const token = cred.dataToken?.trim();
-    // A per-turn OBO credential without a verified identity would hand a tool someone's
-    // live data-plane token while the turn can't attribute or scope its use to anyone —
-    // fail closed before the turn runs, rather than let a tool run with a real credential
-    // attached to an unknown/placeholder user.
-    if (token && !cred.userId?.trim()) {
-        await invokeOnDenied(options?.onDenied, exports.WARRANT_DENIED_REASON, options?.onDeniedTimeoutMs ?? exports.ON_DENIED_TIMEOUT_MS);
-        throw new Error(`OBO data token present without a verified user in request scope (fail-closed: ${exports.WARRANT_DENIED_REASON})`);
-    }
-}
-/**
- * Run `fn` with `cred` as the ambient request-scoped credential (memory only).
- */
-async function runWithCredential(cred, fn, options) {
-    await checkCredentialScope(cred, options);
-    return storage.run(cred, async () => fn());
-}
-/** The current turn's credential, or `undefined` outside any `runWithCredential` scope. */
-function currentCredential() {
-    return storage.getStore();
-}
-/**
- * The per-user engine-home segment for this turn, from whichever source actually has it.
- *
- * Two processes need the same answer and only one of them can read the credential. In serve the
- * frame is authoritative. In a sandbox child there is no frame — that is the design, the
- * credential never crosses — so the key arrives pre-computed on the run frame and is used as-is.
- * The frame wins where both exist, so a child cannot widen its own scope by sending a key.
- *
- * Every engine must go through this rather than reading the credential directly: doing the latter
- * is what silently unscoped every sandboxed turn, and the failure was invisible because the
- * unscoped path is a perfectly good directory that simply holds everyone's data.
- */
-function resolveEngineHomeUserKey(fromRunFrame) {
-    return (0, paths_1.engineHomeUserKey)(storage.getStore()?.userId) ?? fromRunFrame?.trim() ?? undefined;
-}
-/**
- * Fail-closed accessor for the acting user id. Throws when there is no
- * authenticated user in scope, so a tool can never silently run unscoped.
- */
-function requireUserId() {
-    const userId = storage.getStore()?.userId?.trim();
-    if (!userId) {
-        throw new Error('No authenticated user in request scope (fail-closed)');
-    }
-    return userId;
-}

package/out/cli/data-plane/broker.js

@@ -1,78 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CredentialBroker = exports.identityProvider = exports.passthroughProvider = void 0;
-exports.resolveProvider = resolveProvider;
-/** Databricks Apps-style: the platform minted the downscoped per-user token already. */
-exports.passthroughProvider = {
-    name: 'passthrough',
-    refreshOnInbound: true,
-    async acquire({ userId, inboundToken }) {
-        const token = inboundToken?.trim();
-        if (!token) {
-            // The passthrough provider holds nothing of its own — no inbound credential on
-            // this turn means no data access. Never fall back to any shared credential.
-            throw new Error(`No inbound data credential for user (fail-closed) — the platform did not forward a per-user token on this request (userId=${userId})`);
-        }
-        // TTL is the platform's problem; cache briefly so mid-turn calls reuse one token.
-        return { expiresAt: Date.now() + 10 * 60_000, secretRef: token };
-    },
-};
-/** Backends where authorization is a server-side identity mapping (Postgres RLS, SAP B1 vault). */
-exports.identityProvider = {
-    name: 'identity',
-    async acquire({ userId }) {
-        if (!userId.trim()) {
-            throw new Error('No verified user (fail-closed)');
-        }
-        return { expiresAt: Number.MAX_SAFE_INTEGER, secretRef: null };
-    },
-};
-function resolveProvider(name) {
-    const n = (name ?? 'passthrough').trim().toLowerCase();
-    if (n === 'passthrough') {
-        return exports.passthroughProvider;
-    }
-    if (n === 'identity') {
-        return exports.identityProvider;
-    }
-    throw new Error(`Unknown data credential provider "${name}" (supported: passthrough, identity)`);
-}
-class CredentialBroker {
-    provider;
-    /** Per-user cache — plain in-memory Map, entries dropped on expiry. Never serialized. */
-    cache = new Map();
-    constructor(provider) {
-        this.provider = provider;
-    }
-    /**
-     * Server-side credential selection (secure-obo-design §5 step 7): the caller supplies
-     * a verified userId from the TurnRegistry — never anything client-controlled.
-     */
-    async acquire(userId, inboundToken) {
-        if (this.provider.refreshOnInbound) {
-            // Passthrough-style providers get the platform token on every legitimate request,
-            // so the cache must never bridge a turn that arrived WITHOUT one — that would let
-            // a token-less turn (broken forwarding, channel-originated) silently reuse the
-            // user's previous token for the cache TTL instead of failing closed. Always
-            // re-acquire from exactly what this turn carried. Nothing is cached: caching
-            // would only ever serve the token-less case this branch exists to reject.
-            return this.provider.acquire({ userId, inboundToken });
-        }
-        const cached = this.cache.get(userId);
-        if (cached && cached.expiresAt > Date.now()) {
-            return cached;
-        }
-        this.cache.delete(userId);
-        const fresh = await this.provider.acquire({ userId, inboundToken });
-        this.cache.set(userId, fresh);
-        return fresh;
-    }
-    /** Drop a user's cached credential (mid-turn 401 retry path / offboarding). */
-    invalidate(userId) {
-        this.cache.delete(userId);
-    }
-}
-exports.CredentialBroker = CredentialBroker;

package/out/cli/data-plane/connector-host.js

@@ -1,121 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ConnectorHost = exports.TURN_META_KEY = void 0;
-/**
- * ConnectorHost — runs the pack's data connector as a BROKER-owned stdio MCP subprocess
- * (secure-obo-design §3.1 "Data-plane MCP gateway": provider connectors live in the
- * broker's trust domain, not the agent's).
- *
- * The connector is the same familiar shape as the old pack `server.mjs` (a stdio MCP
- * server), but it is spawned by serve — never by the engine — and it receives the turn's
- * credential per call over the private stdio pipe via MCP `_meta`
- * (`ai.agenthippo/turn`), never via env, argv, or disk. Its own node_modules resolve
- * from the connector's directory, so backend SDKs (@databricks/sql, pg, …) stay out of
- * the AgentHippo CLI.
- */
-const path = __importStar(require("path"));
-const fs_1 = require("fs");
-const index_js_1 = require("@modelcontextprotocol/sdk/client/index.js");
-const stdio_js_1 = require("@modelcontextprotocol/sdk/client/stdio.js");
-const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
-const resolveNodeBinary_1 = require("../../utils/resolveNodeBinary");
-/** `_meta` key carrying the turn context to the connector (namespaced per MCP convention). */
-exports.TURN_META_KEY = 'ai.agenthippo/turn';
-class ConnectorHost {
-    client;
-    logger;
-    connectorPath;
-    constructor(client, logger, connectorPath) {
-        this.client = client;
-        this.logger = logger;
-        this.connectorPath = connectorPath;
-    }
-    static async spawn(opts) {
-        const connectorPath = path.resolve(opts.connectorPath);
-        await fs_1.promises.access(connectorPath);
-        const nodeBin = await (0, resolveNodeBinary_1.resolveNodeBinary)();
-        const transport = new stdio_js_1.StdioClientTransport({
-            command: nodeBin,
-            args: [connectorPath],
-            // cwd = connector dir so its own node_modules resolve (backend SDKs live there).
-            cwd: path.dirname(connectorPath),
-            env: { ...process.env, AGENTHIPPO_DATA_CONNECTOR: '1' },
-            stderr: 'pipe',
-        });
-        const client = new index_js_1.Client({ name: 'agenthippo-data-gateway', version: '1.0.0' });
-        await client.connect(transport);
-        transport.stderr?.on('data', (chunk) => {
-            opts.logger?.warn(`[DataPlane] connector stderr: ${String(chunk).trimEnd()}`);
-        });
-        opts.logger?.info(`[DataPlane] connector started: ${connectorPath}`);
-        return new ConnectorHost(client, opts.logger, connectorPath);
-    }
-    async listTools() {
-        const res = await this.client.listTools();
-        return res.tools.map((t) => ({
-            name: t.name,
-            description: t.description,
-            inputSchema: (t.inputSchema ?? { type: 'object' }),
-        }));
-    }
-    /**
-     * Forward a tool call with the turn context in `_meta`. The credential crosses only the
-     * private serve↔connector stdio pipe — both ends are the broker trust domain.
-     */
-    async callTool(name, args, turn) {
-        const result = await this.client.request({
-            method: 'tools/call',
-            params: {
-                name,
-                arguments: args,
-                _meta: { [exports.TURN_META_KEY]: { userId: turn.userId, credential: turn.credential } },
-            },
-        }, types_js_1.CallToolResultSchema);
-        return result;
-    }
-    async close() {
-        try {
-            await this.client.close();
-        }
-        catch (e) {
-            this.logger?.warn(`[DataPlane] connector close: ${e instanceof Error ? e.message : String(e)}`);
-        }
-    }
-}
-exports.ConnectorHost = ConnectorHost;

package/out/cli/data-plane/egress.js

@@ -1,189 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.EGRESS_URL_ENV = void 0;
-exports.startEgressBroker = startEgressBroker;
-/**
- * Egress broker — the outbound mirror of the data-plane gateway (secure-obo-design §7.6).
- *
- * The agent-anywhere channel token (OpenClaw bot/gateway token) is the exfiltration key §2
- * forbids the agent from holding: with it in the agent env, a prompt-injected pack talks to
- * the gateway RPC directly and bypasses the reply-to-sender handle allowlist (§7.4 gap 1).
- *
- * This broker interposes the same shape as the data plane: the agent presents ONLY the
- * per-turn nonce (the SAME `AGENTHIPPO_TURN_NONCE` the data plane uses — one TurnRegistry
- * entry grants both capabilities, no second secret) and a message. The broker:
- *
- *   1. resolves the nonce → verified {userId, sessionKey, egressStoreKey} (off-turn/expired
- *      nonce ⇒ 401, fail closed);
- *   2. loads THAT session's outbound handle store SERVER-SIDE (never a client-supplied path);
- *   3. resolves the destination from the session's already-bound handles — reply-to-sender.
- *      `to` may only SELECT AMONG bound handles, never name a new target (§7.6 step 4);
- *   4. calls the real OpenClaw `send` with the BROKER-held token — which never entered the
- *      agent's env.
- *
- * What a stolen egress nonce buys (§7.6): exactly what the agent could already do this turn —
- * reply to its own session's bound peers, on-box, until the turn ends. It cannot address a new
- * peer (`user:attacker` never resolves), reach another session's handles (server-side scoping),
- * or reach OpenClaw directly (no token in its env). That is the §3.3 property, for egress.
- */
-const http = __importStar(require("http"));
-const serve_hardening_1 = require("../serve-hardening");
-const registry_1 = require("./registry");
-const outboundHandles_1 = require("../../gateway/outboundHandles");
-const outboundPaths_1 = require("../../gateway/outboundPaths");
-/** Loopback URL of the egress broker; set into the engine child env per boot (turn-invariant). */
-exports.EGRESS_URL_ENV = 'AGENTHIPPO_EGRESS_URL';
-function bearerToken(header) {
-    const m = header?.match(/^Bearer\s+(\S+)$/i);
-    return m?.[1];
-}
-function noncePrefix(nonce) {
-    return nonce ? (0, registry_1.hashNonce)(nonce).slice(0, 12) : 'none';
-}
-/**
- * The session's outbound store lives at a server-derived path — the caller can NEVER name it.
- * The gateway bridge records reply handles under the raw (un-namespaced) gateway key, so the
- * store dir id is that key (see serve.ts resolveGatewaySessionKey `outboundKey`).
- */
-function storePathForTurn(workspaceRoot, egressStoreKey) {
-    return (0, outboundPaths_1.getGatewayOutboundFilePath)(workspaceRoot, (0, outboundPaths_1.safeGatewaySessionDirId)(egressStoreKey));
-}
-async function startEgressBroker(opts) {
-    const server = http.createServer(async (req, res) => {
-        const reject = (code, message, auditEvent, fields) => {
-            if (auditEvent) {
-                opts.audit?.('unauthorized', auditEvent, fields ?? {});
-            }
-            res.writeHead(code, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ ok: false, error: message }));
-        };
-        try {
-            const urlPath = req.url?.split('?')[0] ?? '';
-            if (urlPath !== '/egress/send') {
-                reject(404, 'not found');
-                return;
-            }
-            if (req.method !== 'POST') {
-                res.writeHead(405, { 'Content-Type': 'application/json', 'Allow': 'POST' });
-                res.end(JSON.stringify({ ok: false, error: 'method not allowed' }));
-                return;
-            }
-            const nonce = bearerToken(req.headers.authorization);
-            const turn = nonce ? opts.registry.resolve(nonce) : undefined;
-            if (!turn) {
-                // Off-turn / expired / missing — a stale or injected caller fails CLOSED, exactly
-                // like the data-plane gateway (§3.2). No token in the agent env to fall back on.
-                reject(401, 'Unauthorized: missing, unknown, or expired turn nonce', 'egress_nonce_reject', {
-                    reason: nonce ? 'unknown_or_expired' : 'missing',
-                    nonce_sha256_prefix: noncePrefix(nonce),
-                });
-                return;
-            }
-            // A channel turn carries the outbound store key; a bare data turn (HTTP /v1/chat, no
-            // channel) has none — nothing to reply to, so egress is not available to it.
-            const storeKey = turn.egressStoreKey?.trim();
-            if (!storeKey) {
-                reject(403, 'no outbound route for this turn (not a channel-originated session)', 'egress_deny', { userId: turn.userId, reason: 'no_store_key' });
-                return;
-            }
-            let body;
-            try {
-                body = JSON.parse(await (0, serve_hardening_1.readBodyWithCap)(req));
-            }
-            catch {
-                reject(400, 'invalid JSON body');
-                return;
-            }
-            const message = typeof body.message === 'string' ? body.message : '';
-            if (!message.trim()) {
-                reject(400, 'message is required');
-                return;
-            }
-            // `to` is a SELECTOR among bound handles only — never a new destination (§7.6 step 4).
-            const to = typeof body.to === 'string' ? body.to.trim() : undefined;
-            const media = typeof body.media === 'string' ? body.media.trim() || undefined : undefined;
-            // Server-side resolution: the store path is derived from the VERIFIED turn, never the
-            // request. `resolveGatewayOutboundHandle` returns only a handle bound by a prior
-            // inbound message (reply-to-sender); an unknown `to` matches nothing ⇒ undefined.
-            const storePath = storePathForTurn(opts.workspaceRoot, storeKey);
-            let handle;
-            try {
-                handle = await (0, outboundHandles_1.resolveGatewayOutboundHandle)(storePath, opts.agentId, to ? { target: to } : undefined);
-            }
-            catch (err) {
-                opts.logger?.warn(`[Egress] store read failed: ${err instanceof Error ? err.message : String(err)}`);
-            }
-            if (!handle) {
-                // No bound destination — a prompt-injected `to: user:attacker` lands here.
-                reject(404, to
-                    ? `no bound handle matches "${to}" for this session (cannot address a new destination)`
-                    : 'no reply destination bound for this session yet', 'egress_deny', { userId: turn.userId, reason: 'no_matching_handle', to: to ?? '(reply-to-sender)' });
-                return;
-            }
-            opts.audit?.(turn.sessionKey, 'egress_authorize', {
-                userId: turn.userId, channel: handle.channel, target: handle.target,
-            });
-            const result = await opts.send(handle, message, media);
-            res.writeHead(result.ok ? 200 : 502, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify(result));
-        }
-        catch (err) {
-            opts.logger?.warn(`[Egress] broker error: ${err instanceof Error ? err.message : String(err)}`);
-            if (!res.headersSent) {
-                res.writeHead(500, { 'Content-Type': 'application/json' });
-            }
-            res.end(JSON.stringify({ ok: false, error: 'Internal error' }));
-        }
-    });
-    await new Promise((resolve, reject) => {
-        server.once('error', reject);
-        // Loopback ONLY — the broker must never be reachable off-box.
-        server.listen(0, '127.0.0.1', () => resolve());
-    });
-    const address = server.address();
-    if (!address || typeof address === 'string') {
-        throw new Error('Egress broker failed to bind a loopback port');
-    }
-    const url = `http://127.0.0.1:${address.port}/egress/send`;
-    opts.logger?.info(`[Egress] broker listening at ${url}`);
-    return {
-        url,
-        close: () => new Promise((resolve) => server.close(() => resolve())),
-    };
-}