@agenthippo-ai/agenthippo 1.110.9 → 1.110.11

package/out/agentpack/index.js

@@ -3,7 +3,7 @@
  *  Copyright (c) AgentHippo.ai. All rights reserved.
  *--------------------------------------------------------------------------------------------*/
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.checkGitHubUpdate = exports.installFromGitHub = exports.validateForPublish = exports.publishToGitHub = exports.getGitHubUser = exports.isGitHubAuthenticated = exports.getGitHubToken = exports.formatGitHubSource = exports.parseGitHubSource = exports.resetDefaultAgent = exports.duplicateAgent = exports.updateFromUserLibrary = exports.checkForUpdate = exports.readAgentSource = exports.promoteToUserLibrary = exports.hydrateFromUserLibrary = exports.isAgentInUserLibrary = exports.isWorkspaceAgentAvailable = exports.listUserLibraryAgents = exports.updateManifestName = exports.parseAgentManifest = exports.loadAgentManifest = exports.stringifyYaml = exports.parseYaml = exports.AgentPackManager = exports.getUserAgentCurrentPath = exports.getUserAgentVersionDir = exports.getUserAgentRoot = exports.getUserAgentsDir = exports.getAgentideHome = exports.parseAgentIdFromPath = exports.getSessionsDir = exports.getAgentMcpDir = exports.getAgentRulesDir = exports.getAgentSkillsDir = exports.getAgentContextPath = exports.getAgentAgentsMdPath = exports.getAgentManifestPath = exports.isDefaultAgent = exports.userScopedEngineHome = exports.resolveRuntimePaths = exports.resolveAgentRuntimePaths = exports.getAgentRoot = exports.getAgentsDir = exports.getAgentideDir = exports.AGENT_CONSTANTS = void 0;
+exports.checkGitHubUpdate = exports.installFromGitHub = exports.validateForPublish = exports.publishToGitHub = exports.getGitHubUser = exports.isGitHubAuthenticated = exports.getGitHubToken = exports.formatGitHubSource = exports.parseGitHubSource = exports.resetDefaultAgent = exports.duplicateAgent = exports.updateFromUserLibrary = exports.checkForUpdate = exports.readAgentSource = exports.promoteToUserLibrary = exports.hydrateFromUserLibrary = exports.isAgentInUserLibrary = exports.isWorkspaceAgentAvailable = exports.listUserLibraryAgents = exports.updateManifestName = exports.parseAgentManifest = exports.loadAgentManifest = exports.stringifyYaml = exports.parseYaml = exports.AgentPackManager = exports.getUserAgentCurrentPath = exports.getUserAgentVersionDir = exports.getUserAgentRoot = exports.getUserAgentsDir = exports.getAgentideHome = exports.parseAgentIdFromPath = exports.getSessionsDir = exports.getAgentMcpDir = exports.getAgentRulesDir = exports.getAgentSkillsDir = exports.getAgentContextPath = exports.getAgentAgentsMdPath = exports.getAgentManifestPath = exports.isDefaultAgent = exports.engineHomeUserKey = exports.userScopedEngineHomeFromKey = exports.userScopedEngineHome = exports.resolveRuntimePaths = exports.resolveAgentRuntimePaths = exports.getAgentRoot = exports.getAgentsDir = exports.getAgentideDir = exports.AGENT_CONSTANTS = void 0;
 // Path utilities
 var paths_1 = require("./paths");
 Object.defineProperty(exports, "AGENT_CONSTANTS", { enumerable: true, get: function () { return paths_1.AGENT_CONSTANTS; } });
@@ -13,6 +13,8 @@ Object.defineProperty(exports, "getAgentRoot", { enumerable: true, get: function
 Object.defineProperty(exports, "resolveAgentRuntimePaths", { enumerable: true, get: function () { return paths_1.resolveAgentRuntimePaths; } });
 Object.defineProperty(exports, "resolveRuntimePaths", { enumerable: true, get: function () { return paths_1.resolveRuntimePaths; } });
 Object.defineProperty(exports, "userScopedEngineHome", { enumerable: true, get: function () { return paths_1.userScopedEngineHome; } });
+Object.defineProperty(exports, "userScopedEngineHomeFromKey", { enumerable: true, get: function () { return paths_1.userScopedEngineHomeFromKey; } });
+Object.defineProperty(exports, "engineHomeUserKey", { enumerable: true, get: function () { return paths_1.engineHomeUserKey; } });
 Object.defineProperty(exports, "isDefaultAgent", { enumerable: true, get: function () { return paths_1.isDefaultAgent; } });
 Object.defineProperty(exports, "getAgentManifestPath", { enumerable: true, get: function () { return paths_1.getAgentManifestPath; } });
 Object.defineProperty(exports, "getAgentAgentsMdPath", { enumerable: true, get: function () { return paths_1.getAgentAgentsMdPath; } });

package/out/agentpack/paths.js

@@ -52,6 +52,8 @@ exports.getAgentRoot = getAgentRoot;
 exports.resolveAgentRuntimePaths = resolveAgentRuntimePaths;
 exports.resolveRuntimePaths = resolveRuntimePaths;
 exports.userScopedEngineHome = userScopedEngineHome;
+exports.engineHomeUserKey = engineHomeUserKey;
+exports.userScopedEngineHomeFromKey = userScopedEngineHomeFromKey;
 exports.isDefaultAgent = isDefaultAgent;
 exports.getAgentManifestPath = getAgentManifestPath;
 exports.getAgentAgentsMdPath = getAgentAgentsMdPath;
@@ -227,12 +229,33 @@ function resolveRuntimePaths(workspaceRoot, storageUri, agentId, agentVersion) {
  * The user id is hashed — it is an email/subject, never safe as a raw path segment.
  */
 function userScopedEngineHome(baseHome, verifiedUserId) {
+    return userScopedEngineHomeFromKey(baseHome, engineHomeUserKey(verifiedUserId));
+}
+/**
+ * The opaque per-user directory segment, derived from a verified identity.
+ *
+ * Split out from `userScopedEngineHome` so it can cross a process boundary. A sandbox child has
+ * no `runWithCredential` frame — the credential deliberately never leaves broker memory — so
+ * before this existed every engine inside a tier-0 sandbox resolved the UNSCOPED base dir and
+ * every user's transcripts landed in one directory. The key is safe to send where the identity is
+ * not: it is a one-way hash, it authorizes nothing, and the child only ever uses it as a path
+ * segment.
+ */
+function engineHomeUserKey(verifiedUserId) {
     const uid = verifiedUserId?.trim();
     if (!uid) {
+        return undefined;
+    }
+    return crypto.createHash('sha256').update(uid).digest('hex').slice(0, 16);
+}
+/** `userScopedEngineHome` for a caller that already holds the key (i.e. inside a sandbox). */
+function userScopedEngineHomeFromKey(baseHome, userKey) {
+    // A key from the wire is a path segment, so it is checked rather than trusted: anything but
+    // the hex this function produces would let a caller aim an engine home anywhere on disk.
+    if (!userKey || !/^[0-9a-f]{16}$/.test(userKey)) {
         return baseHome;
     }
-    const hash = crypto.createHash('sha256').update(uid).digest('hex').slice(0, 16);
-    return path.join(baseHome, 'users', hash);
+    return path.join(baseHome, 'users', userKey);
 }
 /**
  * Check if an agent is the default workspace agent.

package/out/analytics/dashboard/localFleetAdapter.js

@@ -36,12 +36,14 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.mergeSessionJsonlIntoFleetRows = mergeSessionJsonlIntoFleetRows;
 exports.getScheduledFleetRequests = getScheduledFleetRequests;
 exports.createLocalFleetAdapter = createLocalFleetAdapter;
 const vscode = __importStar(require("vscode"));
 const fleetTypes_1 = require("./fleetTypes");
 const fleetDisplayUtils_1 = require("./fleetDisplayUtils");
 const fleetRowDefaults_1 = require("./fleetRowDefaults");
+const sessionJsonlFleet_1 = require("./sessionJsonlFleet");
 const scheduledFleetStorage_1 = require("./scheduledFleetStorage");
 const LOCAL_SOURCE_ID = 'local';
 const FUTURE_START_SCHEDULED_MS = 60_000;
@@ -101,12 +103,87 @@ function toRow(sessionId, agentId, startedAt, endedAt, status, taskTitle, model,
         disconnectCapable: false,
     });
 }
+function scheduleSnapshotByChatSessionId(scheduled) {
+    const map = new Map();
+    for (const item of scheduled) {
+        const sessionId = String(item.sessionId ?? '').trim();
+        if (!sessionId) {
+            continue;
+        }
+        const existing = map.get(sessionId);
+        if (!existing || item.runAt >= existing.runAt) {
+            map.set(sessionId, item);
+        }
+    }
+    return map;
+}
+function applyJsonlHintToRow(row, hint) {
+    row.turns = Math.max(row.turns, hint.turns);
+    if (hint.startedAt) {
+        row.startedAt = hint.startedAt;
+    }
+    if (hint.endedAt) {
+        row.endedAt = hint.endedAt;
+    }
+    // JSONL turn events are authoritative when traces are missing or still show in_progress.
+    if (hint.turns > 0 || hint.status === 'done') {
+        row.status = hint.status;
+    }
+    else if (row.status === 'in_progress' && hint.status !== 'in_progress') {
+        row.status = hint.status;
+    }
+}
+function jsonlHintToRow(hint, schedule) {
+    const messagePreview = schedule?.messageText
+        ? (schedule.messageText.length > 80
+            ? `${schedule.messageText.slice(0, 77)}...`
+            : schedule.messageText)
+        : hint.sessionId;
+    return toRow(hint.sessionId, schedule?.agentId, hint.startedAt, hint.endedAt, hint.status, messagePreview, schedule?.model ?? 'unknown', schedule?.engine ?? (0, fleetDisplayUtils_1.inferFleetEngineId)(schedule?.model), hint.turns, 0);
+}
+/** Drop schedule:* cards when the linked chat session is live or finished. */
+function dropScheduleRowsSupersededByChatSession(sessionsById) {
+    for (const key of [...sessionsById.keys()]) {
+        if (!key.startsWith('schedule:')) {
+            continue;
+        }
+        const scheduleRow = sessionsById.get(key);
+        if (!scheduleRow) {
+            continue;
+        }
+        const linked = String(scheduleRow.channelTarget ?? '').trim();
+        if (!linked) {
+            continue;
+        }
+        const chatRow = sessionsById.get(linked);
+        if (chatRow && chatRow.status !== 'scheduled') {
+            sessionsById.delete(key);
+        }
+    }
+}
+/** @internal Exported for unit tests. */
+function mergeSessionJsonlIntoFleetRows(sessionsById, scheduleByChatSessionId, filters, sessionsDir) {
+    for (const hint of (0, sessionJsonlFleet_1.scanSessionJsonlFleetHints)(sessionsDir)) {
+        const schedule = scheduleByChatSessionId.get(hint.sessionId);
+        if (filters.agentId && schedule?.agentId && schedule.agentId !== filters.agentId) {
+            continue;
+        }
+        const existing = sessionsById.get(hint.sessionId);
+        if (existing) {
+            applyJsonlHintToRow(existing, hint);
+            continue;
+        }
+        sessionsById.set(hint.sessionId, jsonlHintToRow(hint, schedule));
+    }
+    dropScheduleRowsSupersededByChatSession(sessionsById);
+}
 /** Returns scheduled chat requests for fleet merge (used by orchestrator for formal local script). */
 async function getScheduledFleetRequests() {
     return (0, scheduledFleetStorage_1.loadScheduledFleetRequests)();
 }
 /**
- * Local fleet source adapter: trace-derived sessions + scheduled chat requests, merged and status-normalized.
+ * Local fleet source adapter: trace-derived sessions, session JSONL hints, and scheduled chat
+ * requests, merged and status-normalized.
  */
 function createLocalFleetAdapter(queryRunner) {
     return {
@@ -120,7 +197,9 @@ function createLocalFleetAdapter(queryRunner) {
                 // Trace DB may be missing; continue with scheduled only.
             }
             const scheduledRequests = await getScheduledFleetRequests();
-            const scheduleHintsByChatSessionId = (0, fleetDisplayUtils_1.buildScheduleHintsByChatSessionId)(await (0, scheduledFleetStorage_1.loadScheduledFleetEnrichmentHints)());
+            const scheduleEnrichment = await (0, scheduledFleetStorage_1.loadScheduledFleetEnrichmentHints)();
+            const scheduleByChatSessionId = scheduleSnapshotByChatSessionId(scheduleEnrichment);
+            const scheduleHintsByChatSessionId = (0, fleetDisplayUtils_1.buildScheduleHintsByChatSessionId)(scheduleEnrichment);
             const sessionsById = new Map();
             for (const session of sessions) {
                 const status = normalizeStatus(session);
@@ -153,6 +232,7 @@ function createLocalFleetAdapter(queryRunner) {
                 });
                 sessionsById.set(scheduleRowKey, scheduleRow);
             }
+            mergeSessionJsonlIntoFleetRows(sessionsById, scheduleByChatSessionId, filters);
             const sessionIdsForTitles = [...new Set(Array.from(sessionsById.values()).flatMap(row => {
                     const ids = [];
                     if (row.sessionId && !row.sessionId.startsWith('schedule:')) {

package/out/analytics/service.js

@@ -920,6 +920,12 @@ class AnalyticsService {
             ? ['-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', scriptPath, ...args]
             : [scriptPath, ...args];
         const env = { ...process.env, AGENT_HOME_DIR: (0, index_1.getAgentideHome)() };
+        // IDE-launched proxies default to content capture ON so Spotlight can show prompts and
+        // correlate sessions; serve/gateway deployments launch LiteLLM elsewhere and keep the
+        // metadata-only default. An explicit AGENTHIPPO_EVIDENCE_CONTENT_CAPTURE=0 still wins.
+        if (!env.AGENTHIPPO_EVIDENCE_CONTENT_CAPTURE) {
+            env.AGENTHIPPO_EVIDENCE_CONTENT_CAPTURE = '1';
+        }
         if (opts.configPath) {
             env.LITELLM_CONFIG_PATH = opts.configPath;
         }

package/out/analytics/sessionEvents.js

@@ -37,9 +37,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ObservableStreamEmitter = exports.SessionEventWriter = void 0;
+exports.ObservableStreamEmitter = exports.SessionEventWriter = exports.EVIDENCE_REQUIRED_ENV = void 0;
 exports.getSessionEventWriterStats = getSessionEventWriterStats;
 exports.resetSessionEventWriterStatsForTest = resetSessionEventWriterStatsForTest;
+exports.evidenceRequired = evidenceRequired;
 exports.wrapEmitterWithObservability = wrapEmitterWithObservability;
 /**
  * Session Event Writer & Observable Stream Emitter
@@ -84,9 +85,9 @@ function resetSessionEventWriterStatsForTest() {
  * fails instead of proceeding unrecorded. Off by default — an IDE user should not lose a turn
  * because a disk was full — but a regulated deployment wants the opposite trade.
  */
-const EVIDENCE_REQUIRED_ENV = 'AGENTHIPPO_EVIDENCE_REQUIRED';
+exports.EVIDENCE_REQUIRED_ENV = 'AGENTHIPPO_EVIDENCE_REQUIRED';
 function evidenceRequired(env = process.env) {
-    const v = (env[EVIDENCE_REQUIRED_ENV] ?? '').trim().toLowerCase();
+    const v = (env[exports.EVIDENCE_REQUIRED_ENV] ?? '').trim().toLowerCase();
     return v === '1' || v === 'true' || v === 'yes' || v === 'on';
 }
 class SessionEventWriter {

package/out/auth-broker/server.js

@@ -36,8 +36,8 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasTrustedProxyProof = void 0;
 exports.isAllowedRedirectUri = isAllowedRedirectUri;
-exports.hasTrustedProxyProof = hasTrustedProxyProof;
 exports.createAuthBrokerServer = createAuthBrokerServer;
 exports.startAuthBrokerServer = startAuthBrokerServer;
 const http = __importStar(require("http"));
@@ -103,24 +103,13 @@ function isAllowedRedirectUri(redirectUri) {
  * Does this request carry the trusted proxy's proof?
  *
  * `X-Auth-Request-Email` is only meaningful when it was set by our oauth2-proxy sidecar after a real
- * Google login. Nothing about the header says so, so the proxy also stamps a shared secret and this
- * is where it is checked — constant-time, so a mismatched secret cannot be recovered byte by byte.
+ * Google login. Nothing about the header says so, so the proxy also stamps a shared secret which is
+ * checked constant-time, so a mismatched secret cannot be recovered byte by byte. The check lives in
+ * serve-hardening (serve applies the same contract to its identity header via
+ * AGENTHIPPO_IDENTITY_PROXY_SECRET); re-exported here for the broker's existing consumers.
  */
-function hasTrustedProxyProof(headers, expectedSecret) {
-    if (!expectedSecret) {
-        return false;
-    }
-    const raw = headers[config_js_1.AUTH_PROXY_SECRET_HEADER];
-    const presented = typeof raw === 'string' ? raw : Array.isArray(raw) ? String(raw[0] ?? '') : '';
-    if (!presented) {
-        return false;
-    }
-    // Hash both sides first: timingSafeEqual throws on a length mismatch, which would itself leak
-    // the secret's length.
-    const a = crypto.createHash('sha256').update(presented).digest();
-    const b = crypto.createHash('sha256').update(expectedSecret).digest();
-    return crypto.timingSafeEqual(a, b);
-}
+var serve_hardening_js_2 = require("../cli/serve-hardening.js");
+Object.defineProperty(exports, "hasTrustedProxyProof", { enumerable: true, get: function () { return serve_hardening_js_2.hasTrustedProxyProof; } });
 function sendJson(res, status, body) {
     res.writeHead(status, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify(body));
@@ -335,7 +324,7 @@ function createAuthBrokerServer(config) {
         if (resolved.devMode || (!resolved.proxySecret && resolved.trustProxyHeadersUnverified)) {
             return email;
         }
-        if (!hasTrustedProxyProof(req.headers, resolved.proxySecret)) {
+        if (!(0, serve_hardening_js_1.hasTrustedProxyProof)(req.headers, resolved.proxySecret)) {
             return null;
         }
         return email;
@@ -613,6 +602,21 @@ function createAuthBrokerServer(config) {
                 // Set X-Agent-User so Caddy's forward_auth can copy the validated identity
                 // into the upstream request without serve needing its own JWT validation.
                 res.setHeader('X-Agent-User', user.email || user.id);
+                // …and the ASSERTION alongside the identifier (PLAN/agent-identity.md §8.5 G1).
+                // The identifier alone is all the edge forwarded until now, so an edge-registered
+                // turn carried no `inboundToken`: `passthrough` failed closed on every tool call
+                // and an RFC 8693 `exchange` provider had no subject_token. This is the same
+                // token this request just verified — the browser (cookie) lane has no
+                // Authorization header for the edge to relay, so it has to come from here.
+                //
+                // Not a new exposure: whatever presented this token — Bearer header or cookie —
+                // is already on the request Caddy proxies to the agent. What changes is that the
+                // connector sidecar can now reach it, which is the whole point.
+                const presented = (0, jwt_js_1.extractBearerToken)(req.headers.authorization)
+                    || extractCookieToken(req.headers.cookie, resolved.cookieName);
+                if (presented) {
+                    res.setHeader('X-Agent-User-Assertion', presented);
+                }
                 sendJson(res, 200, store.buildMe(user));
                 return;
             }

package/out/cli/commands/data-plane.js

@@ -3,6 +3,7 @@
  *  Copyright (c) AgentHippo.ai. All rights reserved.
  *--------------------------------------------------------------------------------------------*/
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.createDataPlaneAuditSink = createDataPlaneAuditSink;
 exports.dataPlaneSidecarCommand = dataPlaneSidecarCommand;
 /**
  * `agenthippo data-plane` — run the connector as a SIDECAR (secure-obo-design §7.6).
@@ -12,10 +13,70 @@ exports.dataPlaneSidecarCommand = dataPlaneSidecarCommand;
  * agent container's `serve` registers turns with this sidecar's authenticated control API and
  * never sees the base credential.
  */
+const fs_1 = require("fs");
 const pack_loader_1 = require("../pack-loader");
 const data_plane_1 = require("../data-plane");
+const serve_hardening_1 = require("../serve-hardening");
+const sessionEvents_1 = require("../../analytics/sessionEvents");
+const identity_1 = require("../../analytics/identity");
+const base_1 = require("../../engines/base");
 const headless_1 = require("../../headless");
 const utils_1 = require("../utils");
+/**
+ * Build the sidecar's audit sink.
+ *
+ * Until this existed the sidecar passed no `audit` to `startDataPlaneSidecar`, and since every
+ * emit site in the data plane is `opts.audit?.(…)` the entire trust-boundary record —
+ * `tool_authorize`, `tool_deny`, `sidecar_register_reject`, `sidecar_edge_register` — was
+ * discarded in sidecar and edge mode: the two shapes the blueprints actually deploy. The
+ * "which user touched which rows" claim had no writer exactly where it was being made.
+ *
+ * `ok: false` means the directory could not be prepared. The caller decides what that costs,
+ * using the existing AGENTHIPPO_EVIDENCE_REQUIRED contract rather than a new knob.
+ */
+async function createDataPlaneAuditSink(stateDirOpt, 
+/**
+ * The pack THIS sidecar loaded — stamped onto every row so evidence answers "via which agent",
+ * not only "for which user" (PLAN/agent-identity.md §1 failure 3).
+ *
+ * There is no digest here on purpose: the sidecar does not verify a signature (`pack-loader.ts`
+ * has no signature code), so claiming one would dress an unverified read as an attestation.
+ * What serve ASSERTS about the pack arrives separately, per turn, via the register payload —
+ * and the two being different is the §4.4 detection.
+ */
+agent) {
+    const { dir: stateDir, ephemeral } = (0, serve_hardening_1.resolveStateDir)(stateDirOpt);
+    const auditDir = (0, serve_hardening_1.resolveAnalyticsSessionsDir)(stateDir, ephemeral);
+    let ok = true;
+    let error;
+    // Preflight, rather than discovering it on the first denied tool call.
+    try {
+        await fs_1.promises.mkdir(auditDir, { recursive: true });
+        await fs_1.promises.access(auditDir);
+    }
+    catch (err) {
+        ok = false;
+        error = err instanceof Error ? err.message : String(err);
+    }
+    const writer = new sessionEvents_1.SessionEventWriter(auditDir);
+    const audit = (sessionKey, event, fields) => {
+        // Pseudonymise identity before it lands, matching the tool-event lane
+        // (ObservableStreamEmitter → hashIdentity). These records ship wholesale to the evidence
+        // server, so a raw address here leaves the machine; hashIdentity honours the operator's
+        // AGENTHIPPO_EVIDENCE_RAW_IDS / _ID_SALT choices so this lane makes the same trade as
+        // every other producer rather than a private one.
+        const rawUser = typeof fields.userId === 'string' ? fields.userId : undefined;
+        const anonUser = (0, identity_1.hashIdentity)(rawUser);
+        const safeFields = anonUser ? { ...fields, userId: anonUser } : fields;
+        // In EDGE mode the sidecar registers with `sessionKey: userId` (sidecar.ts:97), so the
+        // session key IS the identity and would otherwise become the evidence FILENAME —
+        // `alice@corp.com.jsonl`. Hash it the same way when, and only when, it is exactly the
+        // identity; a genuine session key is left alone so it still joins across lanes.
+        const safeSession = anonUser && sessionKey === rawUser ? anonUser : sessionKey;
+        void writer.append(safeSession, (0, base_1.generateRequestId)(), event, agent ? { ...safeFields, agent: { ...agent, digest: null } } : safeFields);
+    };
+    return { audit, auditDir, ephemeral, ok, error };
+}
 async function dataPlaneSidecarCommand(options) {
     const registerToken = process.env.AGENTHIPPO_DATA_PLANE_TOKEN?.trim();
     if (!registerToken) {
@@ -38,6 +99,23 @@ async function dataPlaneSidecarCommand(options) {
         return;
     }
     const logger = options.verbose ? new headless_1.ConsoleLogger('[Sidecar]') : new headless_1.NoOpLogger();
+    const { audit: auditEvent, auditDir, ephemeral, ok: auditOk, error: auditError } = await createDataPlaneAuditSink(options.stateDir, {
+        pack: pack.manifest.metadata.name,
+        version: pack.manifest.metadata.version ?? '0.0.0',
+    });
+    if (!auditOk) {
+        const detail = `${auditDir}: ${auditError}`;
+        // The existing AGENTHIPPO_EVIDENCE_REQUIRED contract decides what an unwritable sink
+        // costs — no new knob, and it already means "a hole in the record must fail the turn".
+        if ((0, sessionEvents_1.evidenceRequired)()) {
+            console.error(`${utils_1.COLORS.red}Error: data-plane audit directory is not writable${utils_1.COLORS.reset} — ${detail}`);
+            console.error(`AGENTHIPPO_EVIDENCE_REQUIRED is set, so refusing to run an unauditable data plane. Unset it to downgrade this to a warning.`);
+            process.exit(1);
+            return;
+        }
+        console.warn(`${utils_1.COLORS.yellow}Warning:${utils_1.COLORS.reset} data-plane audit directory is not writable — ${detail}`);
+        console.warn('  Tool authorizations and denials will NOT be recorded. Set --state-dir or AGENTHIPPO_HOME to a writable path.');
+    }
     let sidecar;
     try {
         sidecar = await (0, data_plane_1.startDataPlaneSidecar)({
@@ -47,6 +125,11 @@ async function dataPlaneSidecarCommand(options) {
             controlPort: options.controlPort,
             bindHost: options.host ?? '0.0.0.0',
             logger,
+            audit: auditEvent,
+            agent: {
+                pack: pack.manifest.metadata.name,
+                version: pack.manifest.metadata.version ?? '0.0.0',
+            },
         });
     }
     catch (err) {
@@ -57,6 +140,7 @@ async function dataPlaneSidecarCommand(options) {
     console.log(`OK: Data-plane sidecar (provider=${cfg.provider ?? 'passthrough'}) — connector: ${cfg.connectorPath}`);
     console.log(`  gateway (engine dials, nonce-auth): ${sidecar.gatewayUrl}`);
     console.log(`  control (edge/serve registers, bearer):  :${sidecar.controlPort}`);
+    console.log(`  audit (tool_authorize / tool_deny / register events): ${auditDir}${ephemeral ? ' (EPHEMERAL — lost on restart; set AGENTHIPPO_HOME or --state-dir)' : ''}`);
     console.log('  Base credentials live here only — never in the agent container.');
     console.log('  Edge mode (P1): give the register token to the IdP edge only; serve runs with AGENTHIPPO_DATA_PLANE_EDGE=1 and no token.');
     const shutdown = () => { void sidecar.close().finally(() => process.exit(0)); };

package/out/cli/commands/sandbox.js

@@ -84,8 +84,8 @@ function isForeignWorkspace(wireRoot, sandboxWorkspace) {
 }
 /**
  * Adapts the headless runner to `AgentEngine` so `startRunnerHost` can drive it. The model
- * credential is *per-run*: the sandbox rebuilds its runner if the token changes (rotation), and
- * never persists a provider key of its own.
+ * credential is *per-run* — it rides each frame rather than the runner — and this process never
+ * persists a provider key of its own.
  */
 class SandboxEngine {
     defaults;
@@ -101,7 +101,12 @@ class SandboxEngine {
         this.defaults = defaults;
     }
     ensureRunner(opts) {
-        const key = `${opts.baseUrl ?? ''}|${opts.modelToken ?? ''}`;
+        // Keyed on baseUrl ALONE. The warrant is re-minted every turn (runner/remoteEngine.ts), so
+        // including it rebuilt — and disposed — the runner on every single turn. Harmless while a
+        // sandbox held one session and turns arrived one at a time; with several of a user's
+        // sessions here, that dispose lands in the middle of another session's stream. The token
+        // now travels per run instead (`modelToken` below).
+        const key = opts.baseUrl ?? '';
         if (this.runner && this.builtWith === key) {
             return this.runner;
         }
@@ -117,6 +122,8 @@ class SandboxEngine {
             workspaceRoot: this.defaults.workspace,
             credentials: {
                 baseUrl: opts.baseUrl,
+                // The warrant this runner was BUILT with, kept only as the fallback for a frame
+                // that carries none; every turn normally supplies its own.
                 litellmApiKey: opts.modelToken,
                 useLiteLLM: Boolean(opts.baseUrl),
             },
@@ -136,10 +143,15 @@ class SandboxEngine {
         }
         try {
             fs.mkdirSync(workspaceRoot, { recursive: true });
-            // A sandbox hosts exactly one session, so its working directory IS that session's
-            // workspace. Without the chdir the engine inherits the sandbox process's cwd and a tool
-            // that writes a RELATIVE path (codex runs `sh -lc 'printf ... > proof.txt'`) lands the
-            // file outside the workspace — it exits 0, the agent reports success, work is lost.
+            // Without the chdir the engine inherits the sandbox process's cwd and a tool that writes
+            // a RELATIVE path (codex runs `sh -lc 'printf ... > proof.txt'`) lands the file outside
+            // the workspace — it exits 0, the agent reports success, work is lost.
+            //
+            // INVARIANT: workspace scope must never be narrower than sandbox scope. chdir is
+            // process-global; concurrent turns in one sandbox are only safe when every session
+            // resolves to the same workspaceRoot (serve's sandboxFsFor must key writable mounts at
+            // sandbox scope, not session scope). The chdir is then idempotent. Per-session workspaces
+            // inside a shared sandbox would race here — stream demuxing would not fix it.
             process.chdir(workspaceRoot);
         }
         catch (err) {
@@ -165,11 +177,17 @@ class SandboxEngine {
             workspaceRoot,
             additionalDirectories: wire.additionalDirectories,
             sessionId: wire.sessionId,
+            // Per-turn warrant, not the one this runner was built with — see ensureRunner.
+            modelToken: wire.modelToken,
             permissions: perms,
             // Parity with serve's in-process runner: attribution for evidence, the per-turn
             // data-plane nonce (without which a sandbox cannot reach the data gateway at all), and
             // the bound gateway session.
             analyticsUserId: wire.analyticsUserId,
+            // The credential does not cross into this process by design, so the per-user engine
+            // home key arrives pre-computed on the frame. Absent ⇒ unscoped, which is correct for
+            // a single-tenant run and is what every multi-user sandbox turn used to get.
+            engineHomeUserKey: wire.engineHomeUserKey,
             turnEnv: wire.turnEnv,
             gatewaySessionKey: wire.gatewaySessionKey,
             emitter,
@@ -185,8 +203,9 @@ class SandboxEngine {
     dispose() { this.runner?.dispose(); }
 }
 /**
- * A sandbox hosts ONE session for its whole life, so an engine-side async error must not take the
- * process down — that would lose the session, not just the turn. Vendor SDKs reject outside the
+ * A sandbox outlives every turn it runs — and under user scope holds several of one person's
+ * sessions — so an engine-side async error must not take the process down: that would lose every
+ * conversation here, not just the turn. Vendor SDKs reject outside the
  * `engine.stream()` await chain (observed: the Claude SDK's `streamInput` rejecting after its
  * child process dies), which Node treats as fatal by default. Log and stay up; the turn's own
  * catch still emits `failed`, and serve can always destroy the sandbox if it wants it gone.