@agenthippo-ai/agenthippo 1.110.9 → 1.110.19

package/out/remote/remoteTrust.js

@@ -1,277 +1,6 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.RemoteTrustStore = exports.DEFAULT_TRUSTED_REMOTE_DOMAINS = void 0;
-exports.isLoopbackHostname = isLoopbackHostname;
-exports.classifyRemoteServeUrl = classifyRemoteServeUrl;
-exports.mayReceiveAccessToken = mayReceiveAccessToken;
-exports.defaultRemoteTrustStorePath = defaultRemoteTrustStorePath;
-exports.trustedDomainsFromEnv = trustedDomainsFromEnv;
-exports.createRemoteTrustGate = createRemoteTrustGate;
-exports.untrustedRefusalMessage = untrustedRefusalMessage;
-exports.vscodeRemoteTrustPrompt = vscodeRemoteTrustPrompt;
-/**
- * Who is allowed to receive the user's AgentHippo access token.
- *
- * `spec.remote.url` comes from a PACK MANIFEST — a file that arrives from the store, a PR, or a
- * teammate's library. Before this module existed the remote chat path read that URL, FORCED a
- * sign-in for any non-loopback host, and then sent `Authorization: Bearer <access token>` plus the
- * user's full message to it. Publishing a pack whose manifest named an attacker host was therefore
- * a one-step token exfiltration with no prompt and no scheme check.
- *
- * The model here is deliberately small:
- *
- *  - **loopback** (`127.0.0.1` / `localhost` / `::1`): a serve the user started themselves. Allowed
- *    without a prompt, and may receive the token — a locally-run `agenthippo serve` validates it,
- *    and refusing here would break that with no way to opt back in. Residual risk, stated: another
- *    local account that can bind the port would receive the token. That is the same trust boundary
- *    the user already extends to anything running as them on that machine.
- *  - **trusted**: the product's own domains, plus hosts the user has explicitly approved. These may
- *    receive the bearer token.
- *  - **untrusted**: everything else. The turn either gets explicit consent (a modal naming the host
- *    and saying the access token will be sent) or it is refused. The token is NEVER attached to an
- *    unapproved host — not even "just this once".
- *  - **refused**: cleartext `http://` to a non-loopback host, or a non-http(s) scheme. There is no
- *    consent prompt for these; a bearer token does not go over cleartext.
- *
- * Approvals are persisted per HOST (scheme+hostname+port) in the user's home directory, never in
- * workspace state — a repo must not be able to pre-approve itself by shipping a state file.
- */
-const fs = __importStar(require("node:fs"));
-const os = __importStar(require("node:os"));
-const path = __importStar(require("node:path"));
-/**
- * Hosts trusted without a prompt. Exact host or any subdomain. Keep this list to domains the
- * product actually operates: every entry here is a host that may receive a user's access token.
- */
-exports.DEFAULT_TRUSTED_REMOTE_DOMAINS = ['agenthippo.ai'];
-const LOOPBACK_HOSTNAMES = new Set(['127.0.0.1', 'localhost', '::1', '[::1]']);
-function isLoopbackHostname(hostname) {
-    return LOOPBACK_HOSTNAMES.has(hostname.toLowerCase());
-}
-function matchesDomain(hostname, domain) {
-    const h = hostname.toLowerCase();
-    const d = domain.toLowerCase().replace(/^\./, '');
-    return h === d || h.endsWith(`.${d}`);
-}
-/**
- * Classify a remote serve URL. Pure — the caller supplies the extra trust it knows about
- * (built-in domains are always included; `approvedOrigins` comes from the persisted consent store).
- */
-function classifyRemoteServeUrl(rawUrl, opts = {}) {
-    const trimmed = (rawUrl ?? '').trim();
-    let url;
-    try {
-        url = new URL(trimmed);
-    }
-    catch {
-        return {
-            level: 'refused',
-            origin: trimmed,
-            hostname: '',
-            reason: `remote agent URL "${trimmed}" is not a valid URL`,
-        };
-    }
-    const hostname = url.hostname;
-    const origin = `${url.protocol}//${url.host}`;
-    if (url.protocol !== 'https:' && url.protocol !== 'http:') {
-        return {
-            level: 'refused',
-            origin,
-            hostname,
-            reason: `remote agent URL "${trimmed}" uses an unsupported scheme (${url.protocol}) — only https:// is allowed (http:// for loopback)`,
-        };
-    }
-    if (isLoopbackHostname(hostname)) {
-        // Loopback over http is the normal `agenthippo serve` development case and never leaves
-        // the machine. It is also the only case that gets no bearer token, so there is nothing
-        // on the wire worth protecting with TLS.
-        return { level: 'loopback', origin, hostname };
-    }
-    if (url.protocol === 'http:') {
-        return {
-            level: 'refused',
-            origin,
-            hostname,
-            reason: `remote agent URL "${trimmed}" is plain http:// to a non-loopback host. ` +
-                `This request would carry your AgentHippo access token and your full message, ` +
-                `so it is refused. Ask the pack author for an https:// endpoint.`,
-        };
-    }
-    const trusted = opts.trustedDomains ?? exports.DEFAULT_TRUSTED_REMOTE_DOMAINS;
-    if (trusted.some((domain) => matchesDomain(hostname, domain))) {
-        return { level: 'trusted', origin, hostname };
-    }
-    if ((opts.approvedOrigins ?? []).some((approved) => approved.toLowerCase() === origin.toLowerCase())) {
-        return { level: 'trusted', origin, hostname };
-    }
-    return { level: 'untrusted', origin, hostname };
-}
-/** A verdict that permits sending `Authorization: Bearer <access token>`. */
-function mayReceiveAccessToken(verdict) {
-    return verdict.level === 'trusted' || verdict.level === 'loopback';
-}
-// -----------------------------------------------------------------------------
-// Persisted per-host approvals
-// -----------------------------------------------------------------------------
-/**
- * Where approvals live. The user's home directory, NOT workspace state and NOT the extension's
- * workspace-scoped storage: a repository must not be able to ship a file that pre-approves its own
- * exfiltration endpoint. 0600 so another local account cannot add an entry.
- */
-function defaultRemoteTrustStorePath(homeDir = os.homedir()) {
-    return path.join(homeDir, '.agent-hippo', 'remote-trust.json');
-}
-class RemoteTrustStore {
-    storePath;
-    constructor(storePath = defaultRemoteTrustStorePath()) {
-        this.storePath = storePath;
-    }
-    readApprovedOrigins() {
-        try {
-            const raw = fs.readFileSync(this.storePath, 'utf8');
-            const parsed = JSON.parse(raw);
-            return Array.isArray(parsed.approvedOrigins)
-                ? parsed.approvedOrigins.filter((o) => typeof o === 'string')
-                : [];
-        }
-        catch {
-            // Missing / unreadable / malformed ⇒ nothing is approved. Fail closed.
-            return [];
-        }
-    }
-    approveOrigin(origin) {
-        const existing = new Set(this.readApprovedOrigins().map((o) => o.toLowerCase()));
-        if (existing.has(origin.toLowerCase())) {
-            return;
-        }
-        const next = [...this.readApprovedOrigins(), origin];
-        fs.mkdirSync(path.dirname(this.storePath), { recursive: true });
-        fs.writeFileSync(this.storePath, JSON.stringify({ approvedOrigins: next }, null, 2), { mode: 0o600 });
-        try {
-            fs.chmodSync(this.storePath, 0o600);
-        }
-        catch { /* best effort on platforms without chmod */ }
-    }
-    revokeOrigin(origin) {
-        const next = this.readApprovedOrigins().filter((o) => o.toLowerCase() !== origin.toLowerCase());
-        fs.mkdirSync(path.dirname(this.storePath), { recursive: true });
-        fs.writeFileSync(this.storePath, JSON.stringify({ approvedOrigins: next }, null, 2), { mode: 0o600 });
-    }
-}
-exports.RemoteTrustStore = RemoteTrustStore;
-/**
- * Additional trusted domains from the process environment. Deliberately env and not a VS Code
- * setting that a workspace could reach: this is the enterprise/self-host escape hatch, set by
- * whoever launches the editor, and it must not be settable by a repository.
- */
-function trustedDomainsFromEnv(env = process.env) {
-    return (env.AGENTHIPPO_REMOTE_TRUSTED_HOSTS ?? '')
-        .split(',')
-        .map((s) => s.trim())
-        .filter(Boolean);
-}
-function createRemoteTrustGate(opts = {}) {
-    const store = opts.store ?? new RemoteTrustStore();
-    const trustedDomains = opts.trustedDomains
-        ?? [...exports.DEFAULT_TRUSTED_REMOTE_DOMAINS, ...trustedDomainsFromEnv()];
-    return {
-        async evaluate(url) {
-            const approvedOrigins = store.readApprovedOrigins();
-            let verdict = classifyRemoteServeUrl(url, { trustedDomains, approvedOrigins });
-            if (verdict.level === 'refused') {
-                return { allowed: false, sendAuth: false, requireAuth: false, verdict };
-            }
-            if (verdict.level === 'loopback') {
-                // The user's own machine. Allowed without a prompt, and the token may go — a local
-                // `agenthippo serve` validates it, and this path has always worked that way. Crucially
-                // it does NOT force a sign-in: an unauthenticated local serve stays usable.
-                return { allowed: true, sendAuth: true, requireAuth: false, verdict };
-            }
-            if (verdict.level === 'trusted') {
-                return { allowed: true, sendAuth: true, requireAuth: true, verdict };
-            }
-            // Untrusted: one explicit, modal, host-naming consent — or nothing.
-            if (!opts.prompt) {
-                return {
-                    allowed: false,
-                    sendAuth: false,
-                    requireAuth: false,
-                    verdict: {
-                        ...verdict,
-                        reason: untrustedRefusalMessage(verdict),
-                    },
-                };
-            }
-            const approved = await opts.prompt(verdict);
-            if (!approved) {
-                return {
-                    allowed: false,
-                    sendAuth: false,
-                    requireAuth: false,
-                    verdict: { ...verdict, reason: untrustedRefusalMessage(verdict) },
-                };
-            }
-            store.approveOrigin(verdict.origin);
-            verdict = { ...verdict, level: 'trusted' };
-            return { allowed: true, sendAuth: true, requireAuth: true, verdict };
-        },
-    };
-}
-function untrustedRefusalMessage(verdict) {
-    return (`This agent pack routes your chat to "${verdict.origin}", which is not an AgentHippo host and ` +
-        `which you have not approved. The request would include your AgentHippo access token and your ` +
-        `full message, so it was refused. If you trust this host, approve it when prompted, or set ` +
-        `AGENTHIPPO_REMOTE_TRUSTED_HOSTS=${verdict.hostname} in the environment that launches your editor.`);
-}
-/**
- * The consent prompt, as a modal. Separated from the gate so tests never touch the VS Code API and
- * so a headless/CLI host simply has no prompt (⇒ refuse) rather than a broken import.
- */
-function vscodeRemoteTrustPrompt(showWarningMessage) {
-    return async (verdict) => {
-        const choice = await showWarningMessage(`Send your AgentHippo access token to ${verdict.origin}?`, {
-            modal: true,
-            detail: `This agent pack runs remotely on ${verdict.hostname}, which is not an AgentHippo host.\n\n` +
-                `Approving sends your AgentHippo access token and the full text of every message in this ` +
-                `chat to that host. Approve only if you operate or trust it.\n\n` +
-                `This choice is remembered for ${verdict.origin} on this machine.`,
-        }, 'Approve and Remember');
-        return choice === 'Approve and Remember';
-    };
-}
+/*! Copyright (c) 2026 AgentHippo.ai. All rights reserved. Proprietary; see LICENSE. */
+"use strict";var __createBinding=this&&this.__createBinding||(Object.create?(function(t,e,o,r){r===void 0&&(r=o);var s=Object.getOwnPropertyDescriptor(e,o);(!s||("get"in s?!e.__esModule:s.writable||s.configurable))&&(s={enumerable:!0,get:function(){return e[o]}}),Object.defineProperty(t,r,s)}):(function(t,e,o,r){r===void 0&&(r=o),t[r]=e[o]})),__setModuleDefault=this&&this.__setModuleDefault||(Object.create?(function(t,e){Object.defineProperty(t,"default",{enumerable:!0,value:e})}):function(t,e){t.default=e}),__importStar=this&&this.__importStar||(function(){var t=function(e){return t=Object.getOwnPropertyNames||function(o){var r=[];for(var s in o)Object.prototype.hasOwnProperty.call(o,s)&&(r[r.length]=s);return r},t(e)};return function(e){if(e&&e.__esModule)return e;var o={};if(e!=null)for(var r=t(e),s=0;s<r.length;s++)r[s]!=="default"&&__createBinding(o,e,r[s]);return __setModuleDefault(o,e),o}})();Object.defineProperty(exports,"__esModule",{value:!0}),exports.RemoteTrustStore=exports.DEFAULT_TRUSTED_REMOTE_DOMAINS=void 0,exports.isLoopbackHostname=isLoopbackHostname,exports.classifyRemoteServeUrl=classifyRemoteServeUrl,exports.mayReceiveAccessToken=mayReceiveAccessToken,exports.defaultRemoteTrustStorePath=defaultRemoteTrustStorePath,exports.trustedDomainsFromEnv=trustedDomainsFromEnv,exports.createRemoteTrustGate=createRemoteTrustGate,exports.untrustedRefusalMessage=untrustedRefusalMessage,exports.vscodeRemoteTrustPrompt=vscodeRemoteTrustPrompt;const fs=__importStar(require("node:fs")),os=__importStar(require("node:os")),path=__importStar(require("node:path"));exports.DEFAULT_TRUSTED_REMOTE_DOMAINS=["agenthippo.ai"];const LOOPBACK_HOSTNAMES=new Set(["127.0.0.1","localhost","::1","[::1]"]);function isLoopbackHostname(t){return LOOPBACK_HOSTNAMES.has(t.toLowerCase())}function matchesDomain(t,e){const o=t.toLowerCase(),r=e.toLowerCase().replace(/^\./,"");return o===r||o.endsWith(`.${r}`)}function classifyRemoteServeUrl(t,e={}){const o=(t??"").trim();let r;try{r=new URL(o)}catch{return{level:"refused",origin:o,hostname:"",reason:`remote agent URL "${o}" is not a valid URL`}}const s=r.hostname,n=`${r.protocol}//${r.host}`;return r.protocol!=="https:"&&r.protocol!=="http:"?{level:"refused",origin:n,hostname:s,reason:`remote agent URL "${o}" uses an unsupported scheme (${r.protocol}) \u2014 only https:// is allowed (http:// for loopback)`}:isLoopbackHostname(s)?{level:"loopback",origin:n,hostname:s}:r.protocol==="http:"?{level:"refused",origin:n,hostname:s,reason:`remote agent URL "${o}" is plain http:// to a non-loopback host. This request would carry your AgentHippo access token and your full message, so it is refused. Ask the pack author for an https:// endpoint.`}:(e.trustedDomains??exports.DEFAULT_TRUSTED_REMOTE_DOMAINS).some(i=>matchesDomain(s,i))?{level:"trusted",origin:n,hostname:s}:(e.approvedOrigins??[]).some(i=>i.toLowerCase()===n.toLowerCase())?{level:"trusted",origin:n,hostname:s}:{level:"untrusted",origin:n,hostname:s}}function mayReceiveAccessToken(t){return t.level==="trusted"||t.level==="loopback"}function defaultRemoteTrustStorePath(t=os.homedir()){return path.join(t,".agent-hippo","remote-trust.json")}class RemoteTrustStore{storePath;constructor(e=defaultRemoteTrustStorePath()){this.storePath=e}readApprovedOrigins(){try{const e=fs.readFileSync(this.storePath,"utf8"),o=JSON.parse(e);return Array.isArray(o.approvedOrigins)?o.approvedOrigins.filter(r=>typeof r=="string"):[]}catch{return[]}}approveOrigin(e){if(new Set(this.readApprovedOrigins().map(s=>s.toLowerCase())).has(e.toLowerCase()))return;const r=[...this.readApprovedOrigins(),e];fs.mkdirSync(path.dirname(this.storePath),{recursive:!0}),fs.writeFileSync(this.storePath,JSON.stringify({approvedOrigins:r},null,2),{mode:384});try{fs.chmodSync(this.storePath,384)}catch{}}revokeOrigin(e){const o=this.readApprovedOrigins().filter(r=>r.toLowerCase()!==e.toLowerCase());fs.mkdirSync(path.dirname(this.storePath),{recursive:!0}),fs.writeFileSync(this.storePath,JSON.stringify({approvedOrigins:o},null,2),{mode:384})}}exports.RemoteTrustStore=RemoteTrustStore;function trustedDomainsFromEnv(t=process.env){return(t.AGENTHIPPO_REMOTE_TRUSTED_HOSTS??"").split(",").map(e=>e.trim()).filter(Boolean)}function createRemoteTrustGate(t={}){const e=t.store??new RemoteTrustStore,o=t.trustedDomains??[...exports.DEFAULT_TRUSTED_REMOTE_DOMAINS,...trustedDomainsFromEnv()];return{async evaluate(r){const s=e.readApprovedOrigins();let n=classifyRemoteServeUrl(r,{trustedDomains:o,approvedOrigins:s});return n.level==="refused"?{allowed:!1,sendAuth:!1,requireAuth:!1,verdict:n}:n.level==="loopback"?{allowed:!0,sendAuth:!0,requireAuth:!1,verdict:n}:n.level==="trusted"?{allowed:!0,sendAuth:!0,requireAuth:!0,verdict:n}:t.prompt?await t.prompt(n)?(e.approveOrigin(n.origin),n={...n,level:"trusted"},{allowed:!0,sendAuth:!0,requireAuth:!0,verdict:n}):{allowed:!1,sendAuth:!1,requireAuth:!1,verdict:{...n,reason:untrustedRefusalMessage(n)}}:{allowed:!1,sendAuth:!1,requireAuth:!1,verdict:{...n,reason:untrustedRefusalMessage(n)}}}}}function untrustedRefusalMessage(t){return`This agent pack routes your chat to "${t.origin}", which is not an AgentHippo host and which you have not approved. The request would include your AgentHippo access token and your full message, so it was refused. If you trust this host, approve it when prompted, or set AGENTHIPPO_REMOTE_TRUSTED_HOSTS=${t.hostname} in the environment that launches your editor.`}function vscodeRemoteTrustPrompt(t){return async e=>await t(`Send your AgentHippo access token to ${e.origin}?`,{modal:!0,detail:`This agent pack runs remotely on ${e.hostname}, which is not an AgentHippo host.
+
+Approving sends your AgentHippo access token and the full text of every message in this chat to that host. Approve only if you operate or trust it.
+
+This choice is remembered for ${e.origin} on this machine.`},"Approve and Remember")==="Approve and Remember"}

package/out/remote/serveClient.js

@@ -1,277 +1,4 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.buildServeAuthHeaders = buildServeAuthHeaders;
-exports.normalizeServeBaseUrl = normalizeServeBaseUrl;
-exports.getRemoteServeUrl = getRemoteServeUrl;
-exports.getRemoteServeUrlDiagnostic = getRemoteServeUrlDiagnostic;
-exports.streamRemoteServeChat = streamRemoteServeChat;
-const remoteTrust_js_1 = require("./remoteTrust.js");
-/** Abort if the stream sends no data for this long (reset on every chunk). */
-const IDLE_TIMEOUT_MS = 120_000;
-/** Safety net so a runaway stream can't hold the conversation open forever. */
-const HARD_CAP_MS = 30 * 60_000;
-/**
- * Build the outbound auth headers.
- *
- * **No self-asserted identity header.** This used to also send `X-Agent-User: <auth.userEmail>`,
- * and the serve side trusts `x-agent-user` as its first identity alias. On any deployment that does
- * not pin `AGENTHIPPO_IDENTITY_HEADER`, a client could put someone else's address there and be
- * namespaced into that user's session and state, and be issued a data-plane nonce scoped to them.
- * The bearer token already carries a *verified* identity, so the header added nothing but an
- * impersonation primitive: send the credential and let the server derive who it belongs to.
- */
-function buildServeAuthHeaders(auth) {
-    const headers = {};
-    if (!auth?.accessToken) {
-        return headers;
-    }
-    headers.Authorization = `Bearer ${auth.accessToken}`;
-    return headers;
-}
-function normalizeServeBaseUrl(url) {
-    return url.trim().replace(/\/+$/, '');
-}
-/**
- * The remote endpoint declared by a pack manifest.
- *
- * This value is attacker-controllable in the interesting case: manifests arrive from the store, a
- * pull request, or a shared library. Only the scheme is decided here (`https://`, or `http://` for
- * loopback); WHO may receive the user's access token is decided by `remote/remoteTrust.ts` at the
- * moment of use, because that decision needs the user's persisted approvals.
- *
- * A URL with an unusable scheme is dropped rather than returned, so no other code path can dial it;
- * `getRemoteServeUrlDiagnostic` explains the drop for callers that want to tell the user.
- */
-function getRemoteServeUrl(manifest) {
-    const url = manifest?.spec?.remote?.url?.trim();
-    if (!url) {
-        return undefined;
-    }
-    return (0, remoteTrust_js_1.classifyRemoteServeUrl)(url).level === 'refused' ? undefined : url;
-}
-/** The reason `getRemoteServeUrl` dropped a manifest's URL, or undefined if it did not. */
-function getRemoteServeUrlDiagnostic(manifest) {
-    const url = manifest?.spec?.remote?.url?.trim();
-    if (!url) {
-        return undefined;
-    }
-    const verdict = (0, remoteTrust_js_1.classifyRemoteServeUrl)(url);
-    return verdict.level === 'refused' ? verdict.reason : undefined;
-}
-async function streamRemoteServeChat(options, emitter) {
-    const base = normalizeServeBaseUrl(options.baseUrl);
-    // Final gate before anything leaves the process. A refused scheme never reaches fetch(), and a
-    // host the caller did not vouch for never receives the bearer token — the request goes out
-    // unauthenticated instead, so a misconfigured pack fails with the remote's own 401 rather than
-    // handing over the credential.
-    const verdict = (0, remoteTrust_js_1.classifyRemoteServeUrl)(base, {
-        trustedDomains: [...remoteTrust_js_1.DEFAULT_TRUSTED_REMOTE_DOMAINS, ...(0, remoteTrust_js_1.trustedDomainsFromEnv)()],
-    });
-    if (verdict.level === 'refused') {
-        const message = verdict.reason ?? `Refusing to contact remote agent at ${base}`;
-        await emitter.error(message);
-        await emitter.done();
-        return { ok: false, error: message };
-    }
-    const authAllowed = options.authorizedForAuth === true || (0, remoteTrust_js_1.mayReceiveAccessToken)(verdict);
-    const auth = authAllowed ? options.auth : undefined;
-    const url = `${base}/v1/chat/stream`;
-    const body = { message: options.message };
-    if (options.sessionId?.trim()) {
-        body.session_id = options.sessionId.trim();
-    }
-    // Idle-based timeout: a stalled remote aborts, but a long turn that keeps streaming
-    // (slow model, long tool execution) is not cut off mid-stream. A hard cap guards against
-    // a runaway. Both abort via the same controller; the caller maps the abort into an error.
-    const ac = new AbortController();
-    const hardCap = setTimeout(() => ac.abort(new Error('Remote serve exceeded max duration')), HARD_CAP_MS);
-    let idleTimer;
-    const resetIdle = () => {
-        if (idleTimer) {
-            clearTimeout(idleTimer);
-        }
-        idleTimer = setTimeout(() => ac.abort(new Error('Remote serve timed out (idle)')), IDLE_TIMEOUT_MS);
-    };
-    const clearTimers = () => {
-        if (idleTimer) {
-            clearTimeout(idleTimer);
-            idleTimer = undefined;
-        }
-        clearTimeout(hardCap);
-    };
-    resetIdle();
-    if (options.signal) {
-        options.signal.addEventListener('abort', () => ac.abort(options.signal.reason), { once: true });
-    }
-    let response;
-    try {
-        response = await fetch(url, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                Accept: 'text/event-stream',
-                ...buildServeAuthHeaders(auth),
-            },
-            body: JSON.stringify(body),
-            signal: ac.signal,
-        });
-    }
-    catch (err) {
-        clearTimers();
-        const message = err instanceof Error ? err.message : 'Remote serve connection failed';
-        await emitter.error(message);
-        await emitter.done();
-        return { ok: false, error: message };
-    }
-    if (!response.ok) {
-        clearTimers();
-        let errorMessage = `Remote serve returned ${response.status}`;
-        try {
-            const errBody = (await response.json());
-            if (errBody.error) {
-                errorMessage = errBody.error;
-            }
-        }
-        catch {
-            // ignore non-JSON error bodies
-        }
-        await emitter.error(errorMessage);
-        await emitter.done();
-        return { ok: false, error: errorMessage };
-    }
-    if (!response.body) {
-        clearTimers();
-        const message = 'Remote serve returned empty body';
-        await emitter.error(message);
-        await emitter.done();
-        return { ok: false, error: message };
-    }
-    try {
-        const streamError = await consumeServeSse(response.body, emitter, resetIdle);
-        return streamError ? { ok: false, error: streamError } : { ok: true };
-    }
-    finally {
-        clearTimers();
-    }
-}
-/**
- * Consume the SSE stream. Returns the message of an `error` event if one was seen
- * (the turn failed even though the stream ended cleanly), otherwise undefined.
- */
-async function consumeServeSse(body, emitter, resetIdle) {
-    const reader = body.getReader();
-    const decoder = new TextDecoder();
-    let buffer = '';
-    let doneEmitted = false;
-    let streamError;
-    const markDone = () => {
-        doneEmitted = true;
-    };
-    const markError = (message) => {
-        streamError = message;
-    };
-    try {
-        while (true) {
-            const { value, done } = await reader.read();
-            if (done) {
-                break;
-            }
-            // Any data on the wire means the turn is progressing — push the idle window out.
-            resetIdle();
-            buffer += decoder.decode(value, { stream: true });
-            buffer = await drainServeSseBuffer(buffer, emitter, markDone, markError);
-            if (doneEmitted) {
-                return streamError;
-            }
-        }
-        buffer += decoder.decode();
-        if (buffer.trim()) {
-            await drainServeSseBuffer(`${buffer}\n`, emitter, markDone, markError);
-        }
-        if (!doneEmitted) {
-            await emitter.done();
-        }
-        return streamError;
-    }
-    finally {
-        reader.releaseLock();
-    }
-}
-async function drainServeSseBuffer(buffer, emitter, markDone, markError) {
-    const lines = buffer.split('\n');
-    const remainder = lines.pop() ?? '';
-    for (const line of lines) {
-        if (!line.startsWith('data: ')) {
-            continue;
-        }
-        const payload = line.slice(6).trim();
-        if (!payload) {
-            continue;
-        }
-        let event;
-        try {
-            event = JSON.parse(payload);
-        }
-        catch {
-            continue;
-        }
-        const finished = await dispatchServeEvent(event, emitter, markError);
-        if (finished) {
-            markDone();
-            return '';
-        }
-    }
-    return remainder;
-}
-async function dispatchServeEvent(event, emitter, markError) {
-    const type = typeof event.type === 'string' ? event.type : '';
-    switch (type) {
-        case 'thinking':
-            if (typeof event.delta === 'string') {
-                await emitter.thinking(event.delta);
-            }
-            return false;
-        case 'text':
-            if (typeof event.delta === 'string') {
-                await emitter.text(event.delta);
-            }
-            return false;
-        case 'tool_start':
-            await emitter.toolStart(typeof event.name === 'string' ? event.name : 'tool', typeof event.input === 'string' ? event.input : undefined, typeof event.tool_call_id === 'string' ? event.tool_call_id : undefined);
-            return false;
-        case 'tool_end':
-            await emitter.toolEnd(typeof event.name === 'string' ? event.name : 'tool', typeof event.tool_call_id === 'string' ? event.tool_call_id : '', typeof event.result === 'string' ? event.result : undefined, event.is_error === true);
-            return false;
-        case 'progress':
-            if (typeof event.message === 'string') {
-                await emitter.progress(event.message);
-            }
-            return false;
-        case 'question': {
-            // Remote serve auto-declines questions server-side and continues the run —
-            // the one-way SSE stream has no back-channel to deliver an answer. Surface the
-            // prompt for visibility rather than dropping it (default case) or blocking on an
-            // answer that can never reach the remote.
-            const payload = event.payload;
-            const prompt = typeof payload?.prompt === 'string' ? payload.prompt.trim() : '';
-            if (prompt) {
-                await emitter.progress(`Agent asked (auto-skipped on remote): ${prompt}`);
-            }
-            return false;
-        }
-        case 'error': {
-            const message = typeof event.message === 'string' ? event.message : 'Remote serve error';
-            markError(message);
-            await emitter.error(message);
-            return false;
-        }
-        case 'done':
-            await emitter.done();
-            return true;
-        default:
-            return false;
-    }
-}
+/*! Copyright (c) 2026 AgentHippo.ai. All rights reserved. Proprietary; see LICENSE. */
+"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.buildServeAuthHeaders=buildServeAuthHeaders,exports.normalizeServeBaseUrl=normalizeServeBaseUrl,exports.getRemoteServeUrl=getRemoteServeUrl,exports.getRemoteServeUrlDiagnostic=getRemoteServeUrlDiagnostic,exports.streamRemoteServeChat=streamRemoteServeChat;const remoteTrust_js_1=require("./remoteTrust.js"),IDLE_TIMEOUT_MS=12e4,HARD_CAP_MS=30*6e4;function buildServeAuthHeaders(e){const r={};return e?.accessToken&&(r.Authorization=`Bearer ${e.accessToken}`),r}function normalizeServeBaseUrl(e){return e.trim().replace(/\/+$/,"")}function getRemoteServeUrl(e){const r=e?.spec?.remote?.url?.trim();if(r)return(0,remoteTrust_js_1.classifyRemoteServeUrl)(r).level==="refused"?void 0:r}function getRemoteServeUrlDiagnostic(e){const r=e?.spec?.remote?.url?.trim();if(!r)return;const s=(0,remoteTrust_js_1.classifyRemoteServeUrl)(r);return s.level==="refused"?s.reason:void 0}async function streamRemoteServeChat(e,r){const s=normalizeServeBaseUrl(e.baseUrl),c=(0,remoteTrust_js_1.classifyRemoteServeUrl)(s,{trustedDomains:[...remoteTrust_js_1.DEFAULT_TRUSTED_REMOTE_DOMAINS,...(0,remoteTrust_js_1.trustedDomainsFromEnv)()]});if(c.level==="refused"){const t=c.reason??`Refusing to contact remote agent at ${s}`;return await r.error(t),await r.done(),{ok:!1,error:t}}const o=e.authorizedForAuth===!0||(0,remoteTrust_js_1.mayReceiveAccessToken)(c)?e.auth:void 0,u=`${s}/v1/chat/stream`,l={message:e.message};e.sessionId?.trim()&&(l.session_id=e.sessionId.trim());const n=new AbortController,f=setTimeout(()=>n.abort(new Error("Remote serve exceeded max duration")),HARD_CAP_MS);let i;const p=()=>{i&&clearTimeout(i),i=setTimeout(()=>n.abort(new Error("Remote serve timed out (idle)")),IDLE_TIMEOUT_MS)},g=()=>{i&&(clearTimeout(i),i=void 0),clearTimeout(f)};p(),e.signal&&e.signal.addEventListener("abort",()=>n.abort(e.signal.reason),{once:!0});let d;try{d=await fetch(u,{method:"POST",headers:{"Content-Type":"application/json",Accept:"text/event-stream",...buildServeAuthHeaders(o)},body:JSON.stringify(l),signal:n.signal})}catch(t){g();const m=t instanceof Error?t.message:"Remote serve connection failed";return await r.error(m),await r.done(),{ok:!1,error:m}}if(!d.ok){g();let t=`Remote serve returned ${d.status}`;try{const m=await d.json();m.error&&(t=m.error)}catch{}return await r.error(t),await r.done(),{ok:!1,error:t}}if(!d.body){g();const t="Remote serve returned empty body";return await r.error(t),await r.done(),{ok:!1,error:t}}try{const t=await consumeServeSse(d.body,r,p);return t?{ok:!1,error:t}:{ok:!0}}finally{g()}}async function consumeServeSse(e,r,s){const c=e.getReader(),a=new TextDecoder;let o="",u=!1,l;const n=()=>{u=!0},f=i=>{l=i};try{for(;;){const{value:i,done:p}=await c.read();if(p)break;if(s(),o+=a.decode(i,{stream:!0}),o=await drainServeSseBuffer(o,r,n,f),u)return l}return o+=a.decode(),o.trim()&&await drainServeSseBuffer(`${o}
+`,r,n,f),u||await r.done(),l}finally{c.releaseLock()}}async function drainServeSseBuffer(e,r,s,c){const a=e.split(`
+`),o=a.pop()??"";for(const u of a){if(!u.startsWith("data: "))continue;const l=u.slice(6).trim();if(!l)continue;let n;try{n=JSON.parse(l)}catch{continue}if(await dispatchServeEvent(n,r,c))return s(),""}return o}async function dispatchServeEvent(e,r,s){switch(typeof e.type=="string"?e.type:""){case"thinking":return typeof e.delta=="string"&&await r.thinking(e.delta),!1;case"text":return typeof e.delta=="string"&&await r.text(e.delta),!1;case"tool_start":return await r.toolStart(typeof e.name=="string"?e.name:"tool",typeof e.input=="string"?e.input:void 0,typeof e.tool_call_id=="string"?e.tool_call_id:void 0),!1;case"tool_end":return await r.toolEnd(typeof e.name=="string"?e.name:"tool",typeof e.tool_call_id=="string"?e.tool_call_id:"",typeof e.result=="string"?e.result:void 0,e.is_error===!0),!1;case"progress":return typeof e.message=="string"&&await r.progress(e.message),!1;case"question":{const a=e.payload,o=typeof a?.prompt=="string"?a.prompt.trim():"";return o&&await r.progress(`Agent asked (auto-skipped on remote): ${o}`),!1}case"error":{const a=typeof e.message=="string"?e.message:"Remote serve error";return s(a),await r.error(a),!1}case"done":return await r.done(),!0;default:return!1}}