@agenthippo-ai/agenthippo 1.110.9 → 1.110.11

package/out/cli/data-plane/sidecar.js

@@ -36,6 +36,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.ASSERTION_HEADER = void 0;
 exports.startDataPlaneSidecar = startDataPlaneSidecar;
 /**
  * Data-plane SIDECAR (secure-obo-design §7.6 / aperture-thin) — the connector's own trust
@@ -68,6 +69,24 @@ const crypto_1 = require("crypto");
 const index_1 = require("./index");
 const serve_hardening_1 = require("../serve-hardening");
 const gateway_1 = require("./gateway");
+/**
+ * Header carrying the EDGE-verified user ASSERTION (agent-identity.md §8.5 G1) — the signed
+ * artifact, as opposed to `X-Agent-User` which is only the identifier. It becomes the turn's
+ * `inboundToken`, which is what `passthrough` hands the backend and what an RFC 8693 `exchange`
+ * provider presents as its `subject_token`.
+ *
+ * Set by the trusted edge on the turn-registration hop only, so it never reaches the agent
+ * container. A client-supplied copy must be stripped at the edge, exactly as for the nonce.
+ */
+exports.ASSERTION_HEADER = 'x-agent-user-assertion';
+function headerValue(req, name) {
+    const v = req.headers[name];
+    return (Array.isArray(v) ? v[0] : v)?.trim() || undefined;
+}
+/** Audit-safe fingerprint of a bearer credential — never the credential. */
+function sha256Prefix(value) {
+    return (0, crypto_1.createHash)('sha256').update(value).digest('hex').slice(0, 12);
+}
 function bearer(header) {
     return header?.match(/^Bearer\s+(\S+)$/i)?.[1];
 }
@@ -104,8 +123,20 @@ async function startDataPlaneSidecar(opts) {
                     opts.audit?.('unauthorized', 'sidecar_edge_reject', { reason: 'missing_user' });
                     return reject(400, 'X-Agent-User required');
                 }
-                const { nonce } = plane.registerTurnRaw({ userId, sessionKey: userId });
-                opts.audit?.(userId, 'sidecar_edge_register', { userId });
+                // The user ASSERTION, not just the identifier (agent-identity.md §8.5 G1). The edge
+                // forwarded only X-Agent-User until now, so `registerTurnRaw` got no inboundToken and
+                // edge mode silently supported the `identity` provider alone: `passthrough` failed
+                // closed on every call, and an RFC 8693 `exchange` provider had no subject_token to
+                // exchange. Trusted exactly like X-Agent-User — only the in-network edge can reach
+                // this port, and the edge overwrites any client-supplied copy.
+                const inboundToken = headerValue(req, exports.ASSERTION_HEADER)?.replace(/^Bearer\s+/i, '').trim() || undefined;
+                const { nonce } = plane.registerTurnRaw({ userId, sessionKey: userId, inboundToken });
+                // Never the assertion itself: it is a bearer credential, and these rows ship to the
+                // evidence server. A hash prefix still proves which assertion a turn used.
+                opts.audit?.(userId, 'sidecar_edge_register', {
+                    userId,
+                    assertion: inboundToken ? `sha256:${sha256Prefix(inboundToken)}` : 'none',
+                });
                 res.writeHead(200, { 'Content-Type': 'application/json', [gateway_1.TURN_NONCE_HEADER]: nonce });
                 return res.end(JSON.stringify({ ok: true }));
             }
@@ -121,6 +152,30 @@ async function startDataPlaneSidecar(opts) {
                 if (!userId) {
                     return reject(400, 'userId required');
                 }
+                // Which agent SAYS it is asking. Recorded, never trusted: the register token is
+                // shared, so this claim is only as good as whoever holds it. `binding: 'asserted'`
+                // travels with it so nobody reading evidence later mistakes it for a verified fact
+                // (PLAN/agent-identity.md §4.4 — the successor is warrant verification, F3).
+                const claimed = body.agent?.pack?.trim();
+                // One connector is meant to serve one agent. When it does not, this is where it
+                // becomes visible — and visibility is the whole deliverable, since the sidecar
+                // cannot safely refuse on an unverifiable claim.
+                const mismatch = Boolean(claimed && opts.agent?.pack && claimed !== opts.agent.pack);
+                if (mismatch) {
+                    // console.warn, not logger.warn: the logger is a no-op without --verbose, and two
+                    // agents sharing one connector is the exact condition E2's agent bound rests on
+                    // NOT happening. It must be unmissable in the default deployment, not a debug line.
+                    console.warn(`Warning: turn registration claims agent "${claimed}" but this connector loaded ` +
+                        `"${opts.agent?.pack}". One connector is meant to serve one agent ` +
+                        `(PLAN/agent-identity.md §4.4) — both now share this connector's base credential, ` +
+                        `so neither is bounded by the job it was deployed for.`);
+                }
+                opts.audit?.((body.sessionKey ?? '').trim() || userId, 'sidecar_register', {
+                    userId,
+                    claimedAgent: claimed ?? 'none',
+                    binding: 'asserted',
+                    ...(mismatch ? { agentMismatch: true, loadedAgent: opts.agent?.pack } : {}),
+                });
                 const { nonce, release } = plane.registerTurnRaw({
                     userId, sessionKey: (body.sessionKey ?? '').trim() || userId,
                     inboundToken: body.inboundToken, egressStoreKey: body.egressStoreKey,
@@ -153,6 +208,15 @@ async function startDataPlaneSidecar(opts) {
     const controlAddress = control.address();
     const controlPort = controlAddress && typeof controlAddress !== 'string' ? controlAddress.port : opts.controlPort;
     opts.logger?.info(`[Sidecar] gateway ${plane.url} | control :${controlPort} (bound ${host})`);
+    // A `passthrough` provider has nothing of its own: with no inbound token it fails closed on
+    // EVERY call (broker.ts). Before the assertion header existed, an edge-registered turn never
+    // carried one, so this combination looked healthy at boot and then denied every single tool
+    // call at runtime. Say it once, at boot, where an operator can act on it.
+    if ((opts.config.provider ?? 'passthrough').trim().toLowerCase() === 'passthrough') {
+        console.warn(`Warning: provider=passthrough needs a per-user token on every turn. Edge-registered turns ` +
+            `supply it via the ${exports.ASSERTION_HEADER} header — if your edge does not forward it, every tool ` +
+            `call will fail closed. See PLAN/agent-identity.md §8.5 G1.`);
+    }
     return {
         gatewayUrl: plane.url,
         controlPort,

package/out/cli/deploy/layers/identity.js

@@ -34,6 +34,9 @@ function renderIdentityLayer(opts) {
         ? [
             '      # Turn registration — after identity: X-Agent-User (set above) names the user the',
             '      # sidecar mints the nonce for. Only POST chat turns match; others pass through.',
+            '      # X-Agent-User-Assertion (also set above) rides along as the turn\'s inboundToken:',
+            '      # without it `passthrough` fails closed on every call and an RFC 8693 `exchange`',
+            '      # provider has no subject_token. See PLAN/agent-identity.md §8.5 G1.',
             `      forward_auth @turnStart ${turn.connectorAddr} {`,
             '        uri /edge/turn',
             '        copy_headers X-Agent-Turn-Nonce',
@@ -54,7 +57,7 @@ function renderIdentityLayer(opts) {
         : [...identityGate, ...body];
     const lines = [];
     if (turn) {
-        lines.push('  # Hygiene: never let a client-supplied nonce header through (copy_headers overwrites it', '  # on chat paths anyway, and a forged nonce fails closed at the gateway — belt-and-braces).', '  request_header -X-Agent-Turn-Nonce');
+        lines.push('  # Hygiene: never let a client-supplied nonce header through (copy_headers overwrites it', '  # on chat paths anyway, and a forged nonce fails closed at the gateway — belt-and-braces).', '  request_header -X-Agent-Turn-Nonce', '  # Same for the user assertion: it is set from the verified /api/ide/me response below,', '  # never from the client. A forged one would become the turn\'s inboundToken.', '  request_header -X-Agent-User-Assertion');
     }
     if (mode === 'self-issued') {
         lines.push('  # IDE PKCE sign-in: broker requires X-Auth-Request-Email from oauth2-proxy. Must come', '  # before the generic /oauth/* handle so authorize is gated (not dumped straight to broker).', '  handle /oauth/authorize {', `    forward_auth ${oauth2ProxyAddr} {`, '      uri /oauth2/auth', '      copy_headers X-Auth-Request-Email', '      header_up X-Forwarded-Proto https', '      header_up X-Forwarded-Host {http.request.host}', '      @unauth status 401', '      handle_response @unauth {', '        redir * "/oauth2/sign_in?rd={http.request.uri}"', '      }', '    }', `    reverse_proxy ${authBrokerAddr} {`, '      header_up X-Forwarded-Proto https', '      header_up X-Forwarded-Host {http.request.host}', ...BROKER_PROXY_SECRET_LINES, '    }', '  }', '  # Federated SSO (A′): browsers from other subdomains land here to stamp the shared cookie.', '  # Same oauth2-proxy gate as authorize; must precede the generic /oauth/* handle.', '  handle /oauth/browser-login {', `    forward_auth ${oauth2ProxyAddr} {`, '      uri /oauth2/auth', '      copy_headers X-Auth-Request-Email', '      header_up X-Forwarded-Proto https', '      header_up X-Forwarded-Host {http.request.host}', '      @unauth status 401', '      handle_response @unauth {', '        redir * "/oauth2/sign_in?rd={http.request.uri}"', '      }', '    }', `    reverse_proxy ${authBrokerAddr} {`, '      header_up X-Forwarded-Proto https', '      header_up X-Forwarded-Host {http.request.host}', ...BROKER_PROXY_SECRET_LINES, '    }', '  }', '  # Auth-broker: token exchange + other /oauth/* routes that must stay ungated.', '  handle /oauth/* {', `    reverse_proxy ${authBrokerAddr} {`, '      header_up X-Forwarded-Proto https', '      header_up X-Forwarded-Host {http.request.host}', '    }', '  }');
@@ -70,7 +73,7 @@ function renderIdentityLayer(opts) {
     lines.push('  # API clients (IDE) with a Bearer token: validate via auth-broker, copy identity header.', '  @apiWithAuth {', '    path /v1/*', '    header Authorization *', '  }', '  handle @apiWithAuth {', ...gated([
         `    forward_auth ${authBrokerAddr} {`,
         '      uri /api/ide/me',
-        '      copy_headers X-Agent-User',
+        `      copy_headers X-Agent-User${turn ? ' X-Agent-User-Assertion' : ''}`,
         '      header_up X-Forwarded-Proto https',
         '      header_up X-Forwarded-Host {http.request.host}',
         '      @unauth status 401',

package/out/cli/deploy-init.js

@@ -1082,7 +1082,7 @@ function composeArtifacts(ctx) {
         '  # (build: docker build -f extensions/agentide/scripts/Dockerfile.litellm -t this-tag .)',
         '  litellm:',
         '    profiles: ["gateway"]',
-        `    image: ${agenthippoImage('litellm-gateway')}`,
+        `    image: ${agenthippoImage('agenthippo-litellm')}`,
         '    env_file:',
         '      - path: .env',
         '        required: false',
@@ -1405,7 +1405,7 @@ function renderCloudrunSpotlightDeploy(ctx) {
         'PROJECT_ID="${PROJECT_ID:-$(gcloud config get-value project)}"',
         'REPO="${ARTIFACT_REPO:-agenthippo}"',
         'IMAGE="${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/${SERVICE}:latest"',
-        `LITELLM_IMAGE="\${LITELLM_IMAGE:-${agenthippoImage('litellm-gateway')}}"`,
+        `LITELLM_IMAGE="\${LITELLM_IMAGE:-${agenthippoImage('agenthippo-litellm')}}"`,
         'STATE_BUCKET="${STATE_BUCKET:?set STATE_BUCKET=your-gcs-bucket (gcloud storage buckets create gs://...)}"',
         '# LITELLM_KEY = the proxy key the agent presents to LiteLLM (and LiteLLM master key).',
         'LITELLM_KEY="${LITELLM_KEY:?set LITELLM_KEY=<litellm proxy key>}"',
@@ -1592,7 +1592,7 @@ function renderCloudrunEdgeDeploy(ctx) {
         'PROJECT_ID="${PROJECT_ID:-$(gcloud config get-value project)}"',
         'REPO="${ARTIFACT_REPO:-agenthippo}"',
         'IMAGE="${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/${SERVICE}:latest"',
-        `LITELLM_IMAGE="\${LITELLM_IMAGE:-${agenthippoImage('litellm-gateway')}}"`,
+        `LITELLM_IMAGE="\${LITELLM_IMAGE:-${agenthippoImage('agenthippo-litellm')}}"`,
         '# Public hostname (custom domain mapped to the service) + the Google Workspace domain allowed by SSO.',
         'PUBLIC_HOSTNAME="${PUBLIC_HOSTNAME:?set PUBLIC_HOSTNAME=your.edge.hostname (gcloud run domain-mappings create --service $SERVICE --domain ...)}"',
         'ALLOWED_DOMAINS="${ALLOWED_DOMAINS:?set ALLOWED_DOMAINS=yourworkspace.com (oauth2-proxy email domain + broker allowed domains)}"',
@@ -2157,7 +2157,7 @@ function renderCloudrunFedDeploy(ctx) {
         'PROJECT_ID="${PROJECT_ID:-$(gcloud config get-value project)}"',
         'REPO="${ARTIFACT_REPO:-agenthippo}"',
         'IMAGE="${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPO}/${SERVICE}:latest"',
-        `LITELLM_IMAGE="\${LITELLM_IMAGE:-${agenthippoImage('litellm-gateway')}}"`,
+        `LITELLM_IMAGE="\${LITELLM_IMAGE:-${agenthippoImage('agenthippo-litellm')}}"`,
         '# Public hostname = a *.agenthippo.ai subdomain mapped to this service (one-time wildcard DNS).',
         'PUBLIC_HOSTNAME="${PUBLIC_HOSTNAME:?set PUBLIC_HOSTNAME=<subdomain>.agenthippo.ai}"',
         'ALLOWED_DOMAINS="${ALLOWED_DOMAINS:-agenthippo.ai}"',

package/out/cli/index.js

@@ -107,7 +107,16 @@ function resolveMaxConcurrentSandboxes(options) {
     }
     return undefined;
 }
-const VERSION = '1.110.8';
+/** Single source: extensions/agentide/package.json (bundled into the compiled CLI by Bun). */
+function resolveCliVersion() {
+    try {
+        return require('../../package.json').version ?? 'dev';
+    }
+    catch {
+        return 'dev';
+    }
+}
+const VERSION = resolveCliVersion();
 const CLI_DESCRIPTION = [
     `${branding_1.AGENTIDE_BRAND_NAME} CLI - Run agent packs from the command line`,
     '',
@@ -244,6 +253,7 @@ program
     .option('--www-dir <path>', 'Serve deploy/www/index.html at GET / (static browser chat UI)')
     .option('--sandbox <mode>', 'Run each session\'s engine in a sandbox: process (tier 0, no boundary) or container (tier 2, one disposable container per session with only its declared routes). Unset = in-process (default, unchanged)')
     .option('--sandbox-image <ref>', '--sandbox container: sandbox image pinned BY DIGEST (image@sha256:...)')
+    .option('--sandbox-scope <scope>', '--sandbox: what one sandbox holds — session (default, one per conversation) or user (one per verified user on this instance, so their sessions share a container, workspace, TTL and kill). Unidentified callers get one each either way')
     .option('--pull-packs', 'Fetch the version the lease pins from the store instead of only refusing others. Always verifies the signature; a fetch or verification failure keeps serving the current version')
     .option('--require-signed-pack', 'Refuse to start a sandbox unless the pack is signed by a trusted key (the lease may also require this; neither side can waive the other). Now the DEFAULT — kept so existing invocations still mean something')
     .option('--allow-unsigned-pack', 'LOCAL DEVELOPMENT ONLY: run a pack this instance cannot verify. Signature checking is required by default; this disables it and warns loudly on every boot. A lease that sets requireSignedPack still overrides it')
@@ -266,6 +276,9 @@ program
     await (0, serve_1.serveCommand)({
         sandbox: options.sandbox === 'container' ? 'container' : options.sandbox === 'process' ? 'process' : undefined,
         sandboxImage: options.sandboxImage,
+        // Anything but an explicit `user` means session scope: an unrecognised value must not
+        // quietly widen what a sandbox holds.
+        sandboxScope: options.sandboxScope === 'user' ? 'user' : 'session',
         requireSignedPack: Boolean(options.requireSignedPack),
         allowUnsignedPack: Boolean(options.allowUnsignedPack),
         requireSignedLease: Boolean(options.requireSignedLease),
@@ -352,6 +365,7 @@ program
     .option('--gateway-port <port>', 'Port the engine dials (nonce-auth MCP)', '9090')
     .option('--control-port <port>', 'Port serve dials to register turns (bearer-auth)', '9091')
     .option('--host <address>', 'Bind address (default 0.0.0.0 for the pod network)')
+    .option('--state-dir <path>', 'Where data-plane audit events are written. Same precedence as serve: --state-dir, then AGENTHIPPO_HOME, then tmpdir')
     .action(async (options) => {
     const verbose = program.opts().verbose;
     await (0, deps_1.ensureDeps)(verbose);
@@ -361,6 +375,7 @@ program
         gatewayPort: parseInt(options.gatewayPort, 10),
         controlPort: parseInt(options.controlPort, 10),
         host: options.host,
+        stateDir: options.stateDir,
         verbose,
     });
 });

package/out/cli/serve-hardening.js

@@ -36,13 +36,16 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TurnGate = exports.TURN_LIMIT_BUSY_MESSAGE = exports.RATE_LIMIT_BUSY_MESSAGE = exports.TURN_GATE_BUSY_MESSAGE = exports.TURN_GATE_RETRY_AFTER_SECONDS = exports.TURN_QUEUE_ENV = exports.MAX_CONCURRENT_TURNS_ENV = exports.TurnLimiter = exports.SESSION_WITHOUT_USER_REASON = exports.IDENTITY_HEADER_ENV = exports.PIN_ONLY_IDENTITY_HEADERS = exports.RateLimiter = exports.XFF_TRUSTED_HOPS_ENV = exports.CONTAINER_SERVE_HOST = exports.SERVE_HOST_ENV = exports.DEFAULT_BIND_HOST = exports.DEFAULT_MAX_BODY_BYTES = void 0;
+exports.TurnGate = exports.TURN_LIMIT_BUSY_MESSAGE = exports.RATE_LIMIT_BUSY_MESSAGE = exports.TURN_GATE_BUSY_MESSAGE = exports.TURN_GATE_RETRY_AFTER_SECONDS = exports.TURN_QUEUE_ENV = exports.MAX_CONCURRENT_TURNS_ENV = exports.TurnLimiter = exports.SESSION_WITHOUT_USER_REASON = exports.REQUIRE_TENANT_ISOLATION_ENV = exports.IDENTITY_PROXY_SECRET_ENV = exports.IDENTITY_HEADER_ENV = exports.PIN_ONLY_IDENTITY_HEADERS = exports.RateLimiter = exports.XFF_TRUSTED_HOPS_ENV = exports.CONTAINER_SERVE_HOST = exports.SERVE_HOST_ENV = exports.DEFAULT_BIND_HOST = exports.SERVICE_USER_ENV = exports.DEFAULT_MAX_BODY_BYTES = void 0;
 exports.resolveStateDir = resolveStateDir;
 exports.resolveAnalyticsSessionsDir = resolveAnalyticsSessionsDir;
+exports.resolveServiceIdentity = resolveServiceIdentity;
 exports.isLoopbackHost = isLoopbackHost;
 exports.resolveBindHost = resolveBindHost;
 exports.clientIp = clientIp;
+exports.hasTrustedProxyProof = hasTrustedProxyProof;
 exports.identityHeaderAdvice = identityHeaderAdvice;
+exports.tenantIsolationAdvice = tenantIsolationAdvice;
 exports.resolveUserId = resolveUserId;
 exports.resolveDataToken = resolveDataToken;
 exports.peerToUserId = peerToUserId;
@@ -61,12 +64,15 @@ exports.readBodyWithCap = readBodyWithCap;
  *
  * SECURITY CONTRACT: serve trusts the identity and data-token headers below unconditionally.
  * It MUST sit behind a proxy that (a) authenticates the caller and sets the identity header,
- * and (b) STRIPS any client-supplied copies of these headers on the way in.
+ * and (b) STRIPS any client-supplied copies of these headers on the way in. Deployments where
+ * other workloads share the network with serve (compose, sidecar platforms) can additionally
+ * require proof that a request came through that proxy — see IDENTITY_PROXY_SECRET_ENV.
  */
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const crypto = __importStar(require("crypto"));
 const paths_1 = require("../utils/paths");
+const config_1 = require("../auth-broker/config");
 /** Default cap on a single request body (1 MiB). Chat messages are small; large bodies are abuse or bugs. */
 exports.DEFAULT_MAX_BODY_BYTES = 1024 * 1024;
 /**
@@ -109,6 +115,56 @@ function resolveAnalyticsSessionsDir(stateDir, stateDirEphemeral, env = process.
     }
     return path.join((0, paths_1.getAgentideHome)(), 'analytics', 'sessions');
 }
+/**
+ * Env: the identity an UNATTENDED turn runs as — a cron- or channel-fired run with no chat peer
+ * (PLAN/agent-identity.md §5). Deployment configuration, deliberately not a pack field: it names
+ * an identity that exists only in the operator's environment and must match their role map.
+ */
+exports.SERVICE_USER_ENV = 'AGENTHIPPO_SERVICE_USER';
+/** Longest identity we will carry. Generous; the point is to reject a pasted file, not to be tight. */
+const MAX_SERVICE_USER_LEN = 256;
+/**
+ * Validate the service identity at boot.
+ *
+ * **Shape, not vocabulary.** An earlier draft of the design required `^svc:[a-z0-9-]+$` and would
+ * have refused to boot on the two handles an enterprise operator is most likely to bind: a SPIFFE
+ * ID (`spiffe://corp/ns/agents/invoice`) and a Microsoft Entra agent identity object id. Both are
+ * exactly the federated principals §8 wants this to become, so the validator checks that the value
+ * is a usable single token and warns — rather than refuses — when it carries no recognisable
+ * namespace.
+ *
+ * Malformed IS a boot refusal though: the alternative is a fleet that looks configured and runs
+ * every scheduled job anonymously.
+ */
+function resolveServiceIdentity(env = process.env) {
+    const raw = env[exports.SERVICE_USER_ENV];
+    if (raw === undefined) {
+        return {};
+    }
+    const identity = raw.trim();
+    if (!identity) {
+        return { error: `${exports.SERVICE_USER_ENV} is set but empty. Unset it, or give it the identity unattended runs should act as.` };
+    }
+    if (/\s/.test(identity)) {
+        return { error: `${exports.SERVICE_USER_ENV} must not contain whitespace, got ${JSON.stringify(raw)}.` };
+    }
+    if (identity.length > MAX_SERVICE_USER_LEN) {
+        return { error: `${exports.SERVICE_USER_ENV} is ${identity.length} chars; the maximum is ${MAX_SERVICE_USER_LEN}.` };
+    }
+    // Recognised shapes: the local convention, a SPIFFE ID, or a bare GUID (Entra object id).
+    const namespaced = /^svc:/.test(identity)
+        || /^spiffe:\/\//.test(identity)
+        || /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(identity);
+    if (!namespaced) {
+        return {
+            identity,
+            warning: `${exports.SERVICE_USER_ENV}="${identity}" carries no namespace marker (svc: / spiffe:// / GUID). `
+                + 'It will be used verbatim and must be mapped in the connector role map, exactly like a human identity. '
+                + 'If it can collide with a real user id, prefix it with `svc:`.',
+        };
+    }
+    return { identity };
+}
 /** Loopback default — safe everywhere a human runs `serve` locally. */
 exports.DEFAULT_BIND_HOST = '127.0.0.1';
 /** True when a bind address is reachable only from this machine. */
@@ -247,6 +303,42 @@ const HEADER_ALIASES = [
 exports.PIN_ONLY_IDENTITY_HEADERS = ['x-agent-user'];
 /** Env var: pin the single identity header the deploy layer actually sets (and strips). */
 exports.IDENTITY_HEADER_ENV = 'AGENTHIPPO_IDENTITY_HEADER';
+/**
+ * Env var: shared secret proving the identity header was set by the trusted proxy, not by
+ * something else that can reach serve's port.
+ *
+ * Pinning declares WHICH header carries identity; it says nothing about WHO may assert it. On a
+ * shared network (compose, sidecar platforms where every container shares localhost) any
+ * neighbour that can dial serve can send the pinned header and be namespaced as that user —
+ * network topology cannot express "the agent may dial the gateway but not the reverse". When
+ * this is set, serve honours identity headers only on requests that also carry the matching
+ * `x-agenthippo-proxy-secret` (the same proof-of-proxy contract the auth-broker enforces for
+ * `X-Auth-Request-Email`); without proof the request runs anonymous, same as an unpinned
+ * header. Opt-in: unset keeps today's behaviour, because platform-header deployments (IAP,
+ * Databricks Apps) have an unforgeable header and no proxy hop that could attach a secret.
+ */
+exports.IDENTITY_PROXY_SECRET_ENV = 'AGENTHIPPO_IDENTITY_PROXY_SECRET';
+/**
+ * Proof that an identity header was set by the trusted proxy and not by a client: the request
+ * carries `x-agenthippo-proxy-secret` matching the configured secret. Shared with the
+ * auth-broker, which applies the same contract to `X-Auth-Request-Email` (it lives here rather
+ * than in the broker because the broker already imports from this module).
+ */
+function hasTrustedProxyProof(headers, expectedSecret) {
+    if (!expectedSecret) {
+        return false;
+    }
+    const raw = headers[config_1.AUTH_PROXY_SECRET_HEADER];
+    const presented = typeof raw === 'string' ? raw : Array.isArray(raw) ? String(raw[0] ?? '') : '';
+    if (!presented) {
+        return false;
+    }
+    // Hash both sides first: timingSafeEqual throws on a length mismatch, which would itself leak
+    // the secret's length.
+    const a = crypto.createHash('sha256').update(presented).digest();
+    const b = crypto.createHash('sha256').update(expectedSecret).digest();
+    return crypto.timingSafeEqual(a, b);
+}
 /**
  * Boot-time advice about identity trust. Returns the lines serve must print, loudest first.
  *
@@ -283,6 +375,69 @@ function identityHeaderAdvice(env = process.env, bindHost) {
             `(the Caddy forward_auth / auth-broker flow does), pin it: ${exports.IDENTITY_HEADER_ENV}=x-agent-user.`,
     ];
 }
+/** Env var: turn the tenant-isolation advice below into a boot refusal. */
+exports.REQUIRE_TENANT_ISOLATION_ENV = 'AGENTHIPPO_REQUIRE_TENANT_ISOLATION';
+/** True when `child` is `parent` or sits beneath it. */
+function isWithin(child, parent) {
+    const c = path.resolve(child);
+    const p = path.resolve(parent);
+    return c === p || c.startsWith(p + path.sep);
+}
+/**
+ * Boot-time advice about what a second user of this agent can read off the disk.
+ *
+ * The condition this exists for: a deployment that PINS an identity header has declared it serves
+ * more than one person, and a tier-0 (`--sandbox=process`) or sandbox-less serve gives every one
+ * of them the same uid, the same workspace and the same state dir. Per-user namespacing —
+ * `userScopedEngineHome`'s `users/<hash>`, user-namespaced session keys, per-session analytics
+ * JSONL — is naming, not access control: a same-uid process reads its neighbours' names by
+ * listing the directory. What sits there is the engines' own session files, i.e. the plaintext of
+ * every other user's conversation, including whatever rows the OBO connector correctly scoped to
+ * them on the way in. The data path stays isolated and the artifact path undoes it.
+ *
+ * The nesting check is the sharper half. `--workspace=/state/workspace --state-dir=/state` is the
+ * shape the samples shipped, and it puts the artifact store one `..` above the agent's own cwd —
+ * so reaching it takes no traversal trick, just a relative path. Unrelated subtrees
+ * (`--workspace=/work --state-dir=/state`) do not make a same-uid process unable to read /state;
+ * they stop it being the obvious next directory.
+ *
+ * Warn, not refuse, by default — the shipped samples are in exactly this shape and a fatal check
+ * would brick them on upgrade, which is the same trade `identityHeaderAdvice` documents. An
+ * operator who has finished the migration sets REQUIRE_TENANT_ISOLATION_ENV and gets the refusal.
+ */
+function tenantIsolationAdvice(input, env = process.env) {
+    // Unpinned means serve cannot tell one caller from another at all; identityHeaderAdvice owns
+    // that case and saying both at once buries the one the operator can act on.
+    if (!env[exports.IDENTITY_HEADER_ENV]?.trim()) {
+        return { level: 'ok', lines: [] };
+    }
+    const perSessionFilesystem = input.sandbox === 'container' && !input.sharedWorkspace;
+    if (perSessionFilesystem) {
+        return { level: 'ok', lines: [] };
+    }
+    const tier = input.sandbox === 'process' ? 'a tier-0 (--sandbox=process) sandbox' : 'no sandbox';
+    const lines = [
+        `${exports.IDENTITY_HEADER_ENV} is pinned — so this serve has more than one user — but it runs with ` +
+            `${tier}, which shares one uid, one workspace (${input.workspace ?? 'unset'}) and one state dir ` +
+            `(${input.stateDir}) across all of them. Any user can read every other user's engine session ` +
+            `files, which hold their conversations verbatim. Per-user paths are namespacing, not isolation.`,
+        `The boundary is --sandbox=container (per-session workspace and state, without ` +
+            `--shared-workspace) or one serve per tenant. Until then, restrict the pack's tool surface so ` +
+            `the agent has no way to read arbitrary files.`,
+    ];
+    if (input.workspace && isWithin(input.workspace, input.stateDir)) {
+        lines.push(`--workspace ${input.workspace} sits INSIDE --state-dir ${input.stateDir}: every other ` +
+            `user's sessions, analytics and evidence spool are one '..' above the agent's own cwd. ` +
+            `Put them in unrelated subtrees (e.g. --workspace=/work --state-dir=/state).`);
+    }
+    else if (input.workspace && isWithin(input.stateDir, input.workspace)) {
+        lines.push(`--state-dir ${input.stateDir} sits INSIDE --workspace ${input.workspace}: every other ` +
+            `user's sessions, analytics and evidence spool are inside the directory the agent is ` +
+            `pointed at. Put them in unrelated subtrees (e.g. --workspace=/work --state-dir=/state).`);
+    }
+    const strict = /^(1|true|yes|on)$/i.test(env[exports.REQUIRE_TENANT_ISOLATION_ENV]?.trim() ?? '');
+    return { level: strict ? 'refuse' : 'warn', lines };
+}
 /**
  * Resolve the end-user identity for a request.
  *
@@ -304,14 +459,22 @@ function identityHeaderAdvice(env = process.env, bindHost) {
  * artifacts set it (e.g. cloudrun-deploy.sh pins `x-goog-authenticated-user-email`)
  * so an authenticated caller cannot impersonate another user.
  *
- * Resolves identity for `analyticsUserId` attribution and the request-scoped
- * credential context (per-user data scoping). Not folded into the session key —
- * session continuity uses the client-supplied `session_id`.
+ * Resolves identity for `analyticsUserId` attribution, the request-scoped
+ * credential context (per-user data scoping), and the user-namespaced session
+ * key (resolveServeSessionKey folds this identity into every session key).
  *
  * Per-turn *data credentials* (OBO token, e.g. X-Forwarded-Access-Token) are
  * handled by resolveDataToken — not read here.
  */
 function resolveUserId(headers, body, env = process.env) {
+    // Proof-of-proxy gate (IDENTITY_PROXY_SECRET_ENV): when configured, no identity — header OR
+    // body — is honoured without the matching secret header. A caller that fails this check is
+    // by definition not the trusted proxy, so the request runs anonymous rather than letting a
+    // network neighbour (or a dev body fallback) name a victim.
+    const proxySecret = env[exports.IDENTITY_PROXY_SECRET_ENV]?.trim();
+    if (proxySecret && !hasTrustedProxyProof(headers, proxySecret)) {
+        return undefined;
+    }
     const pinned = env[exports.IDENTITY_HEADER_ENV]?.trim().toLowerCase();
     const names = pinned ? [pinned] : HEADER_ALIASES;
     for (const name of names) {
@@ -392,20 +555,26 @@ function userNamespaceHash(userId) {
  * cross-user attachment structurally impossible without changing client behavior.
  *
  * Fail-closed rule: when the deployment pins an identity header (it declared a real
- * proxy-verified identity exists) and a request carries a session_id but no verified user,
- * reject — never let an unauthenticated caller name a session. Unpinned deployments
+ * proxy-verified identity exists), any turn without a verified user is rejected — with or
+ * without a session_id. Rejecting only named sessions would leave every identity-less
+ * caller sharing the durable `anon-unknown` conversation state. Unpinned deployments
  * (local dev, no identity boundary at all) keep today's raw-key behavior.
  */
-function resolveServeSessionKey(sessionId, userId, env = process.env) {
+function resolveServeSessionKey(sessionId, userId, scope = 'session', env = process.env) {
     const sid = sessionId?.trim();
     const uid = userId?.trim();
     if (uid) {
-        return { sessionKey: `u${userNamespaceHash(uid)}--${sid || 'default'}` };
+        const sessionKey = `u${userNamespaceHash(uid)}--${sid || 'default'}`;
+        return { sessionKey, sandboxKey: scope === 'user' ? `u${userNamespaceHash(uid)}` : sessionKey };
     }
-    if (sid && env[exports.IDENTITY_HEADER_ENV]?.trim()) {
-        return { sessionKey: '', rejected: exports.SESSION_WITHOUT_USER_REASON };
+    if (env[exports.IDENTITY_HEADER_ENV]?.trim()) {
+        return { sessionKey: '', sandboxKey: '', rejected: exports.SESSION_WITHOUT_USER_REASON };
     }
-    return { sessionKey: sid || 'anon-unknown' };
+    // No verified user, so there is no user to scope a sandbox TO. `user` scope deliberately does
+    // not apply here: merging unidentified callers would put two strangers in one sandbox on the
+    // strength of a fact nobody established. Local dev keeps one sandbox per session.
+    const sessionKey = sid || 'anon-unknown';
+    return { sessionKey, sandboxKey: sessionKey };
 }
 /** Build CORS headers. Serve is always behind a proxy; CORS is wide-open here. */
 function corsHeaders() {

package/out/engines/claude.js

@@ -317,7 +317,7 @@ class ClaudeEngine {
         // concurrent turns of different users race each other's per-turn credential state
         // (the agentpack/paths.ts race); per-user scoping makes any remaining race
         // same-user. No credential frame (IDE, single-tenant CLI) ⇒ unchanged path.
-        const claudeConfigDir = (0, agentpack_1.userScopedEngineHome)(runtimePaths.claudeConfigDir, (0, credential_context_1.currentCredential)()?.userId);
+        const claudeConfigDir = (0, agentpack_1.userScopedEngineHomeFromKey)(runtimePaths.claudeConfigDir, (0, credential_context_1.resolveEngineHomeUserKey)(options.engineHomeUserKey));
         claudeEnv['CLAUDE_CONFIG_DIR'] = claudeConfigDir;
         await fs_1.promises.mkdir(claudeConfigDir, { recursive: true });
         // Always set AGENT_ID for agent to know its identity

package/out/engines/codex.js

@@ -207,7 +207,7 @@ class CodexEngine {
         // and a shared per-agent home lets concurrent turns of different users race it
         // (secure-obo-design §1 defect 1 / §8 Phase 0). No credential frame (IDE,
         // single-tenant CLI) ⇒ unchanged per-agent path.
-        const codexHome = (0, agentpack_1.userScopedEngineHome)(runtimePaths.codexHome, (0, credential_context_1.currentCredential)()?.userId);
+        const codexHome = (0, agentpack_1.userScopedEngineHomeFromKey)(runtimePaths.codexHome, (0, credential_context_1.resolveEngineHomeUserKey)(options.engineHomeUserKey));
         codexEnv['CODEX_HOME'] = codexHome;
         await fs_1.promises.mkdir(codexHome, { recursive: true });
         // Always set AGENT_ID for agent to know its identity

package/out/engines/custom.js

@@ -50,6 +50,7 @@ const base_1 = require("./base");
 const runtime_1 = require("../cli/runtime");
 const customRegistry_1 = require("./customRegistry");
 const paths_1 = require("../agentpack/paths");
+const credential_context_1 = require("../cli/credential-context");
 const utils_1 = require("../utils");
 const resolveNodeBinary_1 = require("../utils/resolveNodeBinary");
 const customEngineIpc_1 = require("./customEngineIpc");
@@ -494,7 +495,12 @@ class CustomEngine {
         const customBaseDir = this.config.customEnginesStoragePath
             ?? path.join(this.config.storagePath, paths_1.AGENT_CONSTANTS.AGENTS_DIR, agentId, 'custom');
         const engineBaseDir = path.join(customBaseDir, manifest.id);
-        const engineHomeDir = path.join(engineBaseDir, 'home');
+        // Per-user, on the same rule claude and codex use. This engine had NO user scoping at all
+        // — in serve or in a sandbox — so on a multi-user deployment every custom engine's home
+        // (its config, caches, and whatever the engine chooses to persist) was one shared
+        // directory. `home` is the one that needed it: engineSessionDir is already per session.
+        // No verified user ⇒ unchanged path, so the IDE and single-tenant CLI are unaffected.
+        const engineHomeDir = (0, paths_1.userScopedEngineHomeFromKey)(path.join(engineBaseDir, 'home'), (0, credential_context_1.resolveEngineHomeUserKey)(options.engineHomeUserKey));
         const engineSessionDir = path.join(engineBaseDir, paths_1.AGENT_CONSTANTS.SESSIONS_DIR, sessionDirName);
         await fs_1.promises.mkdir(engineHomeDir, { recursive: true });
         await fs_1.promises.mkdir(engineSessionDir, { recursive: true });