@cabane/companion 0.6.215 → 0.6.216

package/README.md

@@ -152,6 +152,24 @@ What your command can rely on, and can set:
 
 These names are a contract: changing one would break your command, so none changes without a note in the release.
 
+### Keeping provider credentials outside a sandbox
+
+An operator-managed sandbox can use the host-side `@cabane/companion/credential-broker` module. This is an embedding API for a trusted host adapter, not a proxy that becomes safe by listening on localhost. The adapter must authenticate the accepted socket as one live sandbox instance and revoke its grants when that instance is stopped. A shared UID, a copied placeholder, a socket filename or an HTTP header is not an instance identity. An unresolved, ambiguous or changed identity must return `null` from `resolveIdentity(socket)`.
+
+Run the broker and its credential files under a host identity outside every sandbox UID mapping. Hold an exclusive process lock for the entire service lifetime, including shutdown: there must be exactly one renewal owner for each account file. The parent of an account file must be owned by that identity with mode `0700`; the file must be a regular, single-link `0600` file. Stop the service before importing or changing login state. `fileCredentialStore(path)` and `openBrokerCredentials(store)` read that state; share the resulting owner between every grant using the account. Renewal writes and fsyncs a replacement before releasing it. A failed persistence write refuses further use until the operator recovers the stored account.
+
+The account format is `{ mode, accessToken, refreshToken?, idToken?, expiresAt?, accountId? }`. `mode` is `claude-setup`, `claude-oauth`, `codex-oauth` or `github`. OAuth modes require a refresh token and an expiry in epoch milliseconds. A setup token never renews. Normal Claude OAuth renews inside the broker before expiry, or on one upstream 401; Codex renewal returns fresh placeholders to its client. Never place the real account file, a credential-store bind, or an alternate harness login inside the sandbox. Real OAuth compatibility must be verified with the installed harness and login mode; a successful setup-token turn proves nothing about OAuth renewal.
+
+Create the broker with `createCredentialBroker({ resolveIdentity, audit? })`. Its `server` handles model and git routes; bind it only to host loopback. Git's HTTP proxy requests are accepted only for the exact `http://github.com/` authority, then forwarded to fixed HTTPS GitHub upstreams. Arbitrary proxy destinations and CONNECT tunnels are refused. Its `githubServer` handles gh's `http_unix_socket` transport; authenticate that socket's peer too. Neither exposes a management endpoint. Call `grant({ identity, credentials, expiresAt })` only from the trusted host adapter. `credentials` maps `claude`, `codex` and `github` to their corresponding credential owners. The returned `token` is disposable; `revoke()` aborts active requests and removes its aliases. Teardown calls `revokeIdentity(identity)`; service shutdown calls `revokeAll()` and closes both servers. A restart creates fresh grants, so old placeholders stop working.
+
+Scope the GitHub token on GitHub's side; the broker imposes no repository, branch, PR-action or GraphQL-shape policy.
+
+Set `runner.brokeredCredentials: true` beside `runner.command` in the Companion config. This removes provider and GitHub credential variables from the launcher's environment, secret-store payload and device-grant payload before the wrapper receives them. The wrapper supplies `brokerClientConfiguration({ baseUrl, placeholder, githubSocket, codexConfig })`'s environment and generated configuration to the isolated home, and writes `await grant.codexAuth()` as its placeholder-only Codex `auth.json`. The helper preserves the supplied Codex settings while selecting the broker provider and HTTP Responses transport. Include its git configuration in the sandbox's global config and use its gh configuration there. For a GitHub-enabled box, provide `githubSocket`. The helper sets `GH_TOKEN` and preserves `github.com` in git's expanded remote so gh can resolve a tracked branch, without setting `GH_REPO`. The generated git config rewrites HTTPS URLs to an HTTP GitHub URL carrying only a placeholder, and sends that origin through the loopback broker using Git's per-origin `http.proxy`; the broker's upstream hop remains HTTPS. Install the entire generated config, replacing the previous generated file, rather than retaining an older rewrite. Do not bypass this proxy with `NO_PROXY` or a per-remote proxy override. For a model-only box, omit `githubSocket` or pass `null`; no GitHub environment is emitted and both git/gh config strings are empty, so an adapter can clear any previous generated routing. The wrapper must remove old credential mounts and alternate authentication helpers; this switch cannot inspect or secure an operator's filesystem mounts.
+
+The fixed upstream hosts are `api.anthropic.com`, `chatgpt.com`, `api.github.com` and `github.com`. Paths and request bodies pass through without a workflow policy, except for known credential-minting, credential-registering or disclosure endpoints: Claude CLI API-key creation and OAuth token exchange, ChatGPT session/token disclosure, and GitHub app-manifest conversion, installation/application token endpoints, legacy authorizations, SSH user/deploy-key registration, runner registration/removal/JIT credentials and OAuth/device token endpoints. These return new secrets the echo filter cannot know in advance, or register box-chosen credentials that would outlive the grant. This deny-list must be revisited when providers add credential-returning or credential-registering routes; it is not a guarantee against unknown endpoints or arbitrary encodings. Redirects are refused and responses are filtered for known credential echoes. Credential-free injection is restricted to Codex's designated `/backend-api/ps/mcp` route. Each upstream exchange is capped at ten minutes, and request bodies at 64 MiB.
+
+Arbitrary room secrets and other MCP credentials still follow their existing delivery contract. This API does not protect SSH keys or offer general secret injection into arbitrary HTTP destinations. Claude's feature flags fall back to defaults when their direct requests use placeholders. Before enabling a sandbox deployment, verify actual socket ownership, PID/namespace reuse, service UID separation, grant revocation, concurrent renewal and restart, required client operations, and a canary extraction attempt from inside the real sandbox. A successful unit test or package installation does not establish that host boundary.
+
 ### Harness permissions
 
 The Companion approves Claude Code's tools through a hook and approves OpenCode permission requests; no turn waits for a tool-approval dialog. For Codex it disables approvals and, when your configuration sets a top-level `sandbox_mode`, passes no sandbox flag; without that setting it uses `danger-full-access`. Choose where agents run using [Agent access](https://cabane.ai/docs/agent-access), and configure the tools through [Harness sandboxes](https://cabane.ai/docs/harness-sandboxes).

package/dist/cli.js

@@ -778,7 +778,10 @@ var init_config = __esm({
       // credential and secrets on its stdin (`runner/launch.ts`, `wrapped`). The README lists
       // what a wrapper can rely on.
       runner: z2.object({
-        command: z2.array(z2.string().min(1)).min(1)
+        command: z2.array(z2.string().min(1)).min(1),
+        // The external wrapper supplies only broker placeholders and removes
+        // credential mounts. Do not hand provider logins to that runner on stdin.
+        brokeredCredentials: z2.boolean().optional()
       }).strict().optional()
     });
     RETIRED_ROW_KEYS = ["sandbox"];
@@ -8464,7 +8467,7 @@ var init_build_options = __esm({
 import { readFile as readFile2 } from "fs/promises";
 import { homedir as homedir7 } from "os";
 import { join as join16 } from "path";
-import { parse } from "smol-toml";
+import { parse as parse2 } from "smol-toml";
 function codexConfigPath(env = process.env, home = homedir7()) {
   return join16(env.CODEX_HOME || join16(home, ".codex"), "config.toml");
 }
@@ -8479,7 +8482,7 @@ async function readCodexConfigSetsSandboxMode(path = codexConfigPath()) {
 }
 function configSetsSandboxMode(text) {
   try {
-    return parse(text).sandbox_mode !== void 0;
+    return parse2(text).sandbox_mode !== void 0;
   } catch {
     return false;
   }
@@ -13255,6 +13258,32 @@ init_boot_id();
 init_turn_containment();
 init_protocol();
 import { createInterface } from "readline";
+
+// src/credential-broker/client-config.ts
+import { parse, stringify } from "smol-toml";
+var BROKERED_CREDENTIAL_NAMES = /* @__PURE__ */ new Set([
+  "ANTHROPIC_API_KEY",
+  "ANTHROPIC_AUTH_TOKEN",
+  "CLAUDE_CODE_OAUTH_TOKEN",
+  "CLAUDE_CODE_OAUTH_REFRESH_TOKEN",
+  "CLAUDE_CODE_SESSION_ACCESS_TOKEN",
+  "CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR",
+  "CLAUDE_CODE_HOST_CREDS_FILE",
+  "CODEX_API_KEY",
+  "OPENAI_API_KEY",
+  "OPENAI_ACCESS_TOKEN",
+  "GH_TOKEN",
+  "GITHUB_TOKEN",
+  "GH_ENTERPRISE_TOKEN",
+  "GITHUB_ENTERPRISE_TOKEN"
+]);
+function withoutBrokeredCredentials(values) {
+  return Object.fromEntries(
+    Object.entries(values).filter(([name]) => !BROKERED_CREDENTIAL_NAMES.has(name))
+  );
+}
+
+// src/runner/launch.ts
 function gzipBodiesSignal() {
   let on = false;
   const listeners = /* @__PURE__ */ new Set();
@@ -13517,12 +13546,22 @@ async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
   }
   try {
     const wrapped = launch.wrapped === true;
-    const env = runnerExecEnv(launch.env ?? process.env, wrapped);
-    const grants = minted.deviceGrants.length > 0 ? launch.grants?.(minted.deviceGrants) ?? {} : {};
+    if (launch.brokeredCredentials && !wrapped)
+      throw new Error("credential broker requires a wrapped runner");
+    const inherited = runnerExecEnv(launch.env ?? process.env, wrapped);
+    const env = launch.brokeredCredentials ? withoutBrokeredCredentials(inherited) : inherited;
+    const directGrants = minted.deviceGrants.length > 0 ? launch.grants?.(minted.deviceGrants) ?? {} : {};
+    const grants = launch.brokeredCredentials ? Object.fromEntries(
+      Object.entries(directGrants).map(([key, values]) => [
+        key,
+        withoutBrokeredCredentials(values)
+      ])
+    ) : directGrants;
+    const secrets = wrapped ? launch.secrets?.() ?? {} : void 0;
     const input = {
       baseUrl: opts.baseUrl,
       credential: minted.credential,
-      ...wrapped ? { secrets: launch.secrets?.() ?? {} } : {},
+      ...secrets ? { secrets: launch.brokeredCredentials ? withoutBrokeredCredentials(secrets) : secrets } : {},
       ...Object.keys(grants).length > 0 ? { grants } : {},
       dispatch: payload,
       turnId,
@@ -15526,6 +15565,7 @@ var CompanionSupervisor = class {
         ),
         ...this.config.runner?.command ? {
           wrapped: true,
+          brokeredCredentials: this.config.runner.brokeredCredentials,
           secrets: () => loadSecretValuesTolerant(
             (m) => this.log.warn({ err: m }, "Could not read the secrets file for a wrapped turn.")
           )

package/dist/credential-broker.js

@@ -0,0 +1,653 @@
+// src/credential-broker/broker.ts
+import { randomBytes } from "crypto";
+import { createServer } from "http";
+import { Readable } from "stream";
+import { pipeline } from "stream/promises";
+
+// src/credential-broker/policy.ts
+function createsOrRevealsCredential(origin, path) {
+  if (origin === "https://api.anthropic.com")
+    return /^\/api\/oauth\/claude_cli\/create_api_key(?:\/|$)/.test(path) || /^\/(?:v1\/)?oauth\/token(?:\/|$)/.test(path);
+  if (origin === "https://chatgpt.com")
+    return /^\/api\/auth\/session(?:\/|$)/.test(path) || /^\/(?:v1\/)?oauth\/token(?:\/|$)/.test(path);
+  if (origin === "https://github.com")
+    return /^\/login\/(?:oauth\/access_token|device\/code)(?:\/|$)/.test(path);
+  path = path.replace(/^\/repositories\/[^/]+(?=\/|$)/, "/repos/_/_");
+  return /^\/user\/keys(?:\/|$)/.test(path) || /^\/repos\/[^/]+\/[^/]+\/keys(?:\/|$)/.test(path) || /^\/authorizations(?:\/|$)/.test(path) || /^\/app-manifests\/[^/]+\/conversions(?:\/|$)/.test(path) || /^\/app\/installations\/[^/]+\/access_tokens(?:\/|$)/.test(path) || /^\/applications\/[^/]+\/token(?:\/|$)/.test(path) || /^\/(?:repos\/[^/]+\/[^/]+|orgs\/[^/]+|enterprises\/[^/]+)\/actions\/runners\/(?:registration-token|remove-token|generate-jitconfig)(?:\/|$)/.test(
+    path
+  );
+}
+function brokerRoute(method, target) {
+  if (method === "CONNECT") return null;
+  if (target.startsWith("http://github.com/"))
+    target = "/git/" + target.slice("http://github.com/".length);
+  if (!target.startsWith("/") || target.startsWith("//") || /[\\#]/.test(target) || [...target].some((char) => char.charCodeAt(0) <= 32))
+    return null;
+  const path = target.split("?")[0];
+  let decoded;
+  try {
+    decoded = decodeURIComponent(path);
+  } catch {
+    return null;
+  }
+  if (/[\\%;]/.test(decoded) || /%2f/i.test(path) || decoded.split("/").some((part) => part === "." || part === "..") || [...decoded].some((char) => char.charCodeAt(0) <= 32))
+    return null;
+  const url = new URL(target, "http://broker.invalid");
+  if (path === "/codex/refresh" && method === "POST" && !url.search)
+    return { origin: "https://chatgpt.com", path, service: "codex", refresh: true };
+  const destinations = [
+    ["/claude", "https://api.anthropic.com", "claude"],
+    ["/codex", "https://chatgpt.com", "codex"],
+    ["/github", "https://api.github.com", "github"],
+    ["/git", "https://github.com", "github"]
+  ];
+  for (const [prefix, origin, service] of destinations) {
+    if (!path.startsWith(prefix + "/")) continue;
+    const upstreamPath = path.slice(prefix.length);
+    const canonical = decoded.slice(prefix.length).replace(/\/{2,}/g, "/").toLowerCase();
+    if (createsOrRevealsCredential(origin, canonical)) return null;
+    const operation = upstreamPath.endsWith("/info/refs") ? url.searchParams.get("service") : upstreamPath.split("/").at(-1);
+    const git = origin === "https://github.com" && (operation === "git-upload-pack" || operation === "git-receive-pack");
+    return {
+      origin,
+      path: upstreamPath + url.search,
+      service,
+      ...git ? { git: operation === "git-upload-pack" ? "upload" : "receive" } : {},
+      ...origin === "https://chatgpt.com" && upstreamPath === "/backend-api/ps/mcp" && ["GET", "POST", "DELETE"].includes(method) ? { identityOnly: true } : {}
+    };
+  }
+  return null;
+}
+
+// src/credential-broker/response-filter.ts
+import { Transform } from "stream";
+function credentialEchoes(secrets) {
+  return [
+    ...new Set(
+      secrets.flatMap((secret) => [secret, `Bearer ${secret}`, `x-access-token:${secret}`]).flatMap((value) => [
+        value,
+        encodeURIComponent(value),
+        Buffer.from(value).toString("base64"),
+        Buffer.from(value).toString("base64url"),
+        JSON.stringify(value).slice(1, -1)
+      ])
+    )
+  ].filter(Boolean);
+}
+function secretResponseFilter(secrets) {
+  const needles = credentialEchoes(secrets).map((value) => Buffer.from(value));
+  const keep = Math.max(1, ...needles.map((needle) => needle.length)) - 1;
+  let pending = Buffer.alloc(0);
+  return new Transform({
+    transform(chunk, _encoding, done) {
+      const bytes = Buffer.concat([pending, chunk]);
+      if (needles.some((needle) => bytes.includes(needle))) {
+        done(new Error("credential_echo"));
+        return;
+      }
+      const length = Math.max(0, bytes.length - keep);
+      if (length) this.push(bytes.subarray(0, length));
+      pending = bytes.subarray(length);
+      done();
+    },
+    flush(done) {
+      if (pending.length) this.push(pending);
+      done();
+    }
+  });
+}
+
+// src/credential-broker/broker.ts
+var REQUEST_HEADERS = [
+  "accept",
+  "content-type",
+  "content-encoding",
+  "user-agent",
+  "anthropic-version",
+  "anthropic-beta",
+  "x-app",
+  "originator",
+  "version",
+  "session_id",
+  "conversation_id",
+  "openai-beta",
+  "git-protocol",
+  "mcp-protocol-version",
+  "mcp-session-id"
+];
+var RESPONSE_HEADERS = [
+  "link",
+  "content-type",
+  "retry-after",
+  "x-request-id",
+  "request-id",
+  "x-ratelimit-limit",
+  "x-ratelimit-remaining",
+  "x-ratelimit-reset",
+  "mcp-session-id"
+];
+async function readBody(req, limit = 64 * 1024 * 1024) {
+  const chunks = [];
+  let length = 0;
+  for await (const chunk of req) {
+    length += chunk.length;
+    if (length > limit) throw new Error("body_limit");
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks);
+}
+function requestToken(req) {
+  const auth = req.headers.authorization;
+  const apiKey = req.headers["x-api-key"];
+  const names = req.rawHeaders.filter((_, index) => index % 2 === 0).map((name) => name.toLowerCase());
+  if (names.filter((name) => ["authorization", "x-api-key"].includes(name)).length > 1 || req.headers["proxy-authorization"] !== void 0)
+    throw new Error("conflicting_credentials");
+  if (apiKey !== void 0) return typeof apiKey === "string" ? apiKey : null;
+  if (auth === void 0) return null;
+  const bearer = auth.match(/^(?:Bearer|token) ([A-Za-z0-9_.-]+)$/i);
+  if (bearer) return bearer[1];
+  const basic = auth.match(/^Basic ([A-Za-z0-9+/=]+)$/i);
+  if (basic) {
+    const value = Buffer.from(basic[1], "base64").toString("utf8");
+    const parts = value.split(":");
+    if (parts.length === 2 && ["x-access-token", "oauth2"].includes(parts[0])) return parts[1];
+  }
+  throw new Error("invalid_credentials");
+}
+function refuse(res, route, body, status = 403) {
+  if (res.headersSent) {
+    res.destroy();
+    return;
+  }
+  if (route?.git === "receive") {
+    const capabilities = body.subarray(0, 1048576).toString().split("\0")[1]?.split("\n")[0]?.split(" ") ?? [];
+    const sideband = capabilities.includes("side-band-64k") || capabilities.includes("side-band");
+    const line = `${sideband ? "" : ""}ERR credential broker refused this operation
+`;
+    res.writeHead(route.path.endsWith("/git-receive-pack") ? 200 : status, {
+      "content-type": "application/x-git-receive-pack-result"
+    });
+    res.end((Buffer.byteLength(line) + 4).toString(16).padStart(4, "0") + line + "0000");
+  } else {
+    res.writeHead(status, { "content-type": "application/json", "cache-control": "no-store" });
+    res.end('{"error":"credential_broker_refused"}\n');
+  }
+}
+function createCredentialBroker(options) {
+  const now = options.now ?? Date.now;
+  const upstream = options.fetch ?? fetch;
+  const grants = /* @__PURE__ */ new Set();
+  const byToken = /* @__PURE__ */ new Map();
+  function revoke(grant) {
+    grant.revoked = true;
+    for (const alias of grant.aliases) byToken.delete(alias);
+    for (const active of grant.active) active.abort();
+    grants.delete(grant);
+  }
+  async function handle(req, res, githubSocket = false) {
+    const route = brokerRoute(req.method ?? "", (githubSocket ? "/github" : "") + (req.url ?? ""));
+    let grant;
+    let abort;
+    let upstreamStarted = false;
+    let requestBody = Buffer.alloc(0);
+    try {
+      for (const item of grants) if (item.expiresAt <= now()) revoke(item);
+      if (!route || githubSocket && req.headers.host !== "api.github.com") throw new Error();
+      const identity = await options.resolveIdentity(req.socket);
+      if (!identity) throw new Error();
+      let token2 = requestToken(req);
+      if (route.git && token2 === null) {
+        res.writeHead(401, {
+          "www-authenticate": 'Basic realm="credential-broker"',
+          "cache-control": "no-store"
+        });
+        res.end();
+        return;
+      }
+      let body;
+      if (route.refresh) {
+        body = await readBody(req, 16384);
+        const input = JSON.parse(body.toString());
+        if (input.grant_type !== "refresh_token" || typeof input.refresh_token !== "string" || token2 !== null && token2 !== input.refresh_token)
+          throw new Error();
+        token2 = input.refresh_token;
+      }
+      if (token2 !== null) grant = byToken.get(token2);
+      else if (route.identityOnly) {
+        const matches = [...grants].filter(
+          (item) => item.identity === identity && !item.revoked && item.expiresAt > now() && item.credentials[route.service]
+        );
+        if (matches.length === 1) grant = matches[0];
+      }
+      if (!grant || grant.revoked || grant.identity !== identity || grant.expiresAt <= now())
+        throw new Error();
+      const credential = grant.credentials[route.service];
+      if (!credential) throw new Error();
+      if (grant.active.size >= (grant.concurrentRequests ?? 16)) throw new Error();
+      if (now() - grant.windowStart >= 6e4) {
+        grant.windowStart = now();
+        grant.requests = 0;
+      }
+      if (++grant.requests > (grant.requestsPerMinute ?? 120)) throw new Error();
+      abort = new AbortController();
+      grant.active.add(abort);
+      const signal = AbortSignal.any([
+        abort.signal,
+        AbortSignal.timeout(Math.max(1, Math.min(6e5, grant.expiresAt - now())))
+      ]);
+      res.once("close", () => abort?.abort());
+      body ??= await readBody(req);
+      requestBody = body;
+      if (grant.revoked || grant.expiresAt <= now() || signal.aborted || await options.resolveIdentity(req.socket) !== identity)
+        throw new Error();
+      let account = await credential.current();
+      if (grant.revoked || grant.expiresAt <= now() || signal.aborted || await options.resolveIdentity(req.socket) !== identity)
+        throw new Error();
+      if (route.refresh) {
+        if (account.mode !== "codex-oauth") throw new Error();
+        const access = placeholderJwt(
+          grant,
+          account.accountId,
+          account.expiresAt ?? now() + 36e5
+        );
+        res.writeHead(200, { "content-type": "application/json", "cache-control": "no-store" });
+        res.end(
+          JSON.stringify({
+            access_token: access,
+            refresh_token: grant.token,
+            id_token: access,
+            token_type: "Bearer",
+            expires_in: Math.max(1, Math.floor(((account.expiresAt ?? now()) - now()) / 1e3))
+          })
+        );
+        options.audit?.("allowed");
+        return;
+      }
+      const headers = new Headers();
+      for (const name of REQUEST_HEADERS) {
+        const value = req.headers[name];
+        if (typeof value === "string") headers.set(name, value);
+      }
+      headers.set("accept-encoding", "identity");
+      headers.set(
+        "authorization",
+        route.git ? `Basic ${Buffer.from(`x-access-token:${account.accessToken}`).toString("base64")}` : `Bearer ${account.accessToken}`
+      );
+      if (route.service === "codex" && account.accountId)
+        headers.set("chatgpt-account-id", account.accountId);
+      const forward = () => {
+        upstreamStarted = true;
+        return upstream(route.origin + route.path, {
+          method: req.method,
+          headers,
+          redirect: "error",
+          signal,
+          ...body.length ? { body: new Uint8Array(body) } : {}
+        });
+      };
+      let response = await forward();
+      if (response.status === 401 && account.mode.endsWith("-oauth")) {
+        await response.body?.cancel();
+        if (grant.revoked || grant.expiresAt <= now() || signal.aborted || await options.resolveIdentity(req.socket) !== identity)
+          throw new Error();
+        account = await credential.current(account.accessToken);
+        if (grant.revoked || grant.expiresAt <= now() || signal.aborted || await options.resolveIdentity(req.socket) !== identity)
+          throw new Error();
+        headers.set("authorization", `Bearer ${account.accessToken}`);
+        response = await forward();
+      }
+      if (response.status >= 300 && response.status < 400 || response.headers.has("content-encoding") && response.headers.get("content-encoding") !== "identity") {
+        await response.body?.cancel();
+        throw new Error();
+      }
+      if (grant.revoked || grant.expiresAt <= now() || signal.aborted) {
+        await response.body?.cancel();
+        throw new Error();
+      }
+      const forbidden = credential.secrets();
+      const echoes = credentialEchoes(forbidden);
+      for (const value of response.headers.values()) {
+        if (echoes.some((secret) => value.includes(secret))) {
+          await response.body?.cancel();
+          throw new Error();
+        }
+      }
+      for (const name of RESPONSE_HEADERS) {
+        const value = response.headers.get(name);
+        if (value) res.setHeader(name, value);
+      }
+      res.setHeader("cache-control", "no-store");
+      res.statusCode = response.status;
+      if (response.body) {
+        await pipeline(
+          Readable.fromWeb(response.body),
+          secretResponseFilter(forbidden),
+          res,
+          { signal }
+        );
+      } else res.end();
+      options.audit?.("allowed");
+    } catch {
+      options.audit?.(upstreamStarted ? "upstream_failed" : "refused");
+      refuse(res, route, requestBody);
+    } finally {
+      if (grant && abort) grant.active.delete(abort);
+    }
+  }
+  function placeholderJwt(grant, accountId, expiresAt) {
+    const encode = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
+    const token2 = `${encode({ alg: "none", typ: "JWT" })}.${encode({
+      exp: Math.floor(expiresAt / 1e3),
+      sub: grant.token,
+      "https://api.openai.com/auth": { chatgpt_account_id: accountId ?? "broker" }
+    })}.${grant.token}`;
+    grant.aliases.add(token2);
+    byToken.set(token2, grant);
+    return token2;
+  }
+  return {
+    server: createServer((req, res) => {
+      void handle(req, res);
+    }),
+    // gh speaks HTTP to its configured Unix socket with api.github.com as Host.
+    // The adapter MUST still authenticate the peer; the socket path is no proof.
+    githubServer: createServer((req, res) => {
+      void handle(req, res, true);
+    }),
+    grant(input) {
+      for (const item of grants) if (item.expiresAt <= now()) revoke(item);
+      if (grants.size >= 1e4) throw new Error("grant_limit");
+      if (!input.identity || input.expiresAt <= now()) throw new Error("invalid_grant");
+      if (input.credentials.claude && !["claude-setup", "claude-oauth"].includes(input.credentials.claude.mode) || input.credentials.codex && input.credentials.codex.mode !== "codex-oauth" || input.credentials.github && input.credentials.github.mode !== "github")
+        throw new Error("invalid_grant");
+      const grant = {
+        ...input,
+        credentials: { ...input.credentials },
+        token: `cbg_${randomBytes(32).toString("hex")}`,
+        aliases: /* @__PURE__ */ new Set(),
+        revoked: false,
+        active: /* @__PURE__ */ new Set(),
+        windowStart: now(),
+        requests: 0
+      };
+      grant.aliases.add(grant.token);
+      grants.add(grant);
+      byToken.set(grant.token, grant);
+      return {
+        token: grant.token,
+        revoke: () => revoke(grant),
+        async codexAuth() {
+          if (grant.revoked || grant.expiresAt <= now() || !grant.credentials.codex)
+            throw new Error("invalid_grant");
+          const account = await grant.credentials.codex.current();
+          if (account.mode !== "codex-oauth" || grant.revoked) throw new Error("invalid_grant");
+          const token2 = placeholderJwt(grant, account.accountId, account.expiresAt ?? now());
+          return {
+            auth_mode: "chatgpt",
+            OPENAI_API_KEY: null,
+            tokens: {
+              access_token: token2,
+              refresh_token: grant.token,
+              id_token: token2,
+              account_id: account.accountId ?? "broker"
+            },
+            last_refresh: new Date(now()).toISOString()
+          };
+        }
+      };
+    },
+    revokeIdentity(identity) {
+      for (const grant of grants) if (grant.identity === identity) revoke(grant);
+    },
+    revokeAll() {
+      for (const grant of grants) revoke(grant);
+    }
+  };
+}
+
+// src/credential-broker/credentials.ts
+import { randomUUID } from "crypto";
+import { constants } from "fs";
+import { open, rename, unlink } from "fs/promises";
+import { dirname } from "path";
+import { z } from "zod";
+var token = z.string().min(8).max(32768).regex(/^[\x21-\x7e]+$/);
+var accountSchema = z.object({
+  mode: z.enum(["claude-setup", "claude-oauth", "codex-oauth", "github"]),
+  accessToken: token,
+  refreshToken: token.optional(),
+  idToken: token.optional(),
+  expiresAt: z.number().finite().optional(),
+  accountId: z.string().min(1).optional()
+}).strict().superRefine((value, ctx) => {
+  if (value.mode.endsWith("-oauth") && (!value.refreshToken || value.expiresAt === void 0)) {
+    ctx.addIssue({ code: "custom", message: "OAuth requires renewal state" });
+  }
+});
+var BrokerError = class extends Error {
+  constructor(code) {
+    super(code);
+    this.code = code;
+  }
+  code;
+};
+function fileCredentialStore(path) {
+  return {
+    async read() {
+      let file;
+      try {
+        file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+        const stat = await file.stat();
+        if (!stat.isFile() || stat.nlink !== 1 || (stat.mode & 63) !== 0 || stat.uid !== process.getuid?.() || stat.size > 131072)
+          throw new Error();
+        return accountSchema.parse(JSON.parse(await file.readFile("utf8")));
+      } catch {
+        throw new BrokerError("credential_unavailable");
+      } finally {
+        await file?.close();
+      }
+    },
+    async write(account) {
+      const tmp = `${path}.${randomUUID()}.tmp`;
+      try {
+        const validated = accountSchema.parse(account);
+        const file = await open(tmp, "wx", 384);
+        try {
+          await file.writeFile(JSON.stringify(validated) + "\n");
+          await file.sync();
+        } finally {
+          await file.close();
+        }
+        await rename(tmp, path);
+        const dir = await open(dirname(path), constants.O_RDONLY | constants.O_DIRECTORY);
+        try {
+          await dir.sync();
+        } finally {
+          await dir.close();
+        }
+      } catch {
+        throw new BrokerError("persistence_failed");
+      } finally {
+        await unlink(tmp).catch(() => {
+        });
+      }
+    }
+  };
+}
+var renewalSchema = z.object({
+  access_token: token,
+  refresh_token: token.optional(),
+  id_token: token.optional(),
+  expires_in: z.number().positive().finite().max(31536e3).optional()
+});
+var OAUTH = {
+  "claude-oauth": {
+    url: "https://platform.claude.com/v1/oauth/token",
+    clientId: "9d1c250a-e61b-44d9-88ed-5944d1962f5e"
+  },
+  "codex-oauth": {
+    url: "https://auth.openai.com/oauth/token",
+    clientId: "app_EMoamEEZ73f0CkXaXp7hrann"
+  }
+};
+async function openBrokerCredentials(store, ports = {}) {
+  let account;
+  try {
+    account = accountSchema.parse(await store.read());
+  } catch {
+    throw new BrokerError("credential_unavailable");
+  }
+  const fetchUpstream = ports.fetch ?? fetch;
+  const now = ports.now ?? Date.now;
+  let pending;
+  let poisoned = false;
+  const secrets = /* @__PURE__ */ new Set();
+  function remember(value) {
+    for (const secret of [value.accessToken, value.refreshToken, value.idToken]) {
+      if (secret) secrets.add(secret);
+    }
+  }
+  remember(account);
+  async function renew() {
+    const mode = account.mode;
+    if (mode !== "claude-oauth" && mode !== "codex-oauth") return account;
+    try {
+      const oauth = OAUTH[mode];
+      const response = await fetchUpstream(oauth.url, {
+        method: "POST",
+        redirect: "error",
+        signal: AbortSignal.timeout(3e4),
+        headers: { "content-type": "application/json", accept: "application/json" },
+        body: JSON.stringify({
+          grant_type: "refresh_token",
+          client_id: oauth.clientId,
+          refresh_token: account.refreshToken
+        })
+      });
+      if (!response.ok) {
+        await response.body?.cancel();
+        throw new Error();
+      }
+      const reader = response.body?.getReader();
+      if (!reader) throw new Error();
+      const chunks = [];
+      let size = 0;
+      try {
+        while (true) {
+          const chunk = await reader.read();
+          if (chunk.done) break;
+          size += chunk.value.length;
+          if (size > 131072) throw new Error();
+          chunks.push(chunk.value);
+        }
+      } finally {
+        await reader.cancel().catch(() => {
+        });
+      }
+      const renewed = renewalSchema.parse(JSON.parse(Buffer.concat(chunks).toString("utf8")));
+      let lifetime = renewed.expires_in;
+      if (lifetime === void 0 && mode === "codex-oauth") {
+        const payload = JSON.parse(
+          Buffer.from(renewed.access_token.split(".")[1] ?? "", "base64url").toString()
+        );
+        if (typeof payload.exp === "number") lifetime = payload.exp - now() / 1e3;
+      }
+      if (!lifetime || !Number.isFinite(lifetime) || lifetime <= 0) throw new Error();
+      const next = accountSchema.parse({
+        ...account,
+        accessToken: renewed.access_token,
+        refreshToken: renewed.refresh_token ?? account.refreshToken,
+        idToken: renewed.id_token ?? account.idToken,
+        expiresAt: now() + lifetime * 1e3
+      });
+      remember(next);
+      try {
+        await store.write(next);
+      } catch {
+        poisoned = true;
+        throw new BrokerError("persistence_failed");
+      }
+      account = next;
+      return account;
+    } catch (error) {
+      if (error instanceof BrokerError) throw error;
+      throw new BrokerError("refresh_failed");
+    }
+  }
+  return {
+    mode: account.mode,
+    // A snapshot used only by the response filter, inside the trusted process.
+    secrets: () => [...secrets],
+    async current(rejectedAccessToken) {
+      if (poisoned) throw new BrokerError("persistence_failed");
+      if (pending) return pending;
+      if (!account.mode.endsWith("-oauth") || rejectedAccessToken !== void 0 && rejectedAccessToken !== account.accessToken || rejectedAccessToken === void 0 && (account.expiresAt ?? 0) > now() + 6e4) {
+        return account;
+      }
+      pending = renew();
+      try {
+        return await pending;
+      } finally {
+        pending = void 0;
+      }
+    }
+  };
+}
+
+// src/credential-broker/client-config.ts
+import { parse, stringify } from "smol-toml";
+function brokerClientConfiguration(input) {
+  const base = new URL(input.baseUrl);
+  if (base.protocol !== "http:" || !["127.0.0.1", "[::1]"].includes(base.hostname) || base.username || base.password || base.pathname !== "/" || base.search || base.hash || !/^cbg_[a-f0-9]{64}$/.test(input.placeholder) || input.githubSocket != null && (!input.githubSocket.startsWith("/") || [...input.githubSocket].some((char) => char.charCodeAt(0) < 32)))
+    throw new Error("invalid_broker_configuration");
+  const origin = base.origin;
+  const config = parse(input.codexConfig);
+  const providers = config.model_providers;
+  if (providers !== void 0 && (!providers || typeof providers !== "object" || Array.isArray(providers) || providers instanceof Date)) {
+    throw new Error("invalid_broker_configuration");
+  }
+  config.model_provider = "credential_broker";
+  config.chatgpt_base_url = `${origin}/codex/backend-api/`;
+  config.model_providers = {
+    ...providers,
+    credential_broker: {
+      name: "Credential broker",
+      base_url: `${origin}/codex/backend-api/codex`,
+      wire_api: "responses",
+      requires_openai_auth: true,
+      supports_websockets: false
+    }
+  };
+  const git = new URL("http://github.com/");
+  git.username = "x-access-token";
+  git.password = input.placeholder;
+  const githubEnv = input.githubSocket == null ? {} : {
+    GH_TOKEN: input.placeholder
+  };
+  return {
+    env: {
+      ANTHROPIC_BASE_URL: `${origin}/claude`,
+      CLAUDE_CODE_OAUTH_TOKEN: input.placeholder,
+      CODEX_REFRESH_TOKEN_URL_OVERRIDE: `${origin}/codex/refresh`,
+      ...githubEnv
+    },
+    codexConfig: stringify(config),
+    // Include from the sandbox's global config. The stored remote stays HTTPS.
+    // No generic forward proxy, CONNECT tunnel or arbitrary host is enabled.
+    gitConfig: input.githubSocket == null ? "" : `[url ${JSON.stringify(git.href)}]
+	insteadOf = https://github.com/
+[http "http://github.com/"]
+	proxy = ${JSON.stringify(origin)}
+	followRedirects = false
+`,
+    // YAML accepts a JSON string scalar, including quotes/backslashes in paths.
+    ghConfig: input.githubSocket == null ? "" : `http_unix_socket: ${JSON.stringify(input.githubSocket)}
+`
+  };
+}
+export {
+  brokerClientConfiguration,
+  createCredentialBroker,
+  fileCredentialStore,
+  openBrokerCredentials
+};

package/dist/launch.js

@@ -185,7 +185,10 @@ var companionConfigSchema = z2.object({
   // credential and secrets on its stdin (`runner/launch.ts`, `wrapped`). The README lists
   // what a wrapper can rely on.
   runner: z2.object({
-    command: z2.array(z2.string().min(1)).min(1)
+    command: z2.array(z2.string().min(1)).min(1),
+    // The external wrapper supplies only broker placeholders and removes
+    // credential mounts. Do not hand provider logins to that runner on stdin.
+    brokeredCredentials: z2.boolean().optional()
   }).strict().optional()
 });
 var legacyOfferSchema = z2.object({

package/dist/pairing-config.js

@@ -210,7 +210,10 @@ var companionConfigSchema = z2.object({
   // credential and secrets on its stdin (`runner/launch.ts`, `wrapped`). The README lists
   // what a wrapper can rely on.
   runner: z2.object({
-    command: z2.array(z2.string().min(1)).min(1)
+    command: z2.array(z2.string().min(1)).min(1),
+    // The external wrapper supplies only broker placeholders and removes
+    // credential mounts. Do not hand provider logins to that runner on stdin.
+    brokeredCredentials: z2.boolean().optional()
   }).strict().optional()
 });
 var RETIRED_ROW_KEYS = ["sandbox"];

package/dist/runtime.js

@@ -294,7 +294,10 @@ var companionConfigSchema = z2.object({
   // credential and secrets on its stdin (`runner/launch.ts`, `wrapped`). The README lists
   // what a wrapper can rely on.
   runner: z2.object({
-    command: z2.array(z2.string().min(1)).min(1)
+    command: z2.array(z2.string().min(1)).min(1),
+    // The external wrapper supplies only broker placeholders and removes
+    // credential mounts. Do not hand provider logins to that runner on stdin.
+    brokeredCredentials: z2.boolean().optional()
   }).strict().optional()
 });
 function workRoot(cfg) {
@@ -7801,6 +7804,30 @@ function decodeRunnerEvent(line) {
   return value;
 }
 
+// src/credential-broker/client-config.ts
+import { parse, stringify } from "smol-toml";
+var BROKERED_CREDENTIAL_NAMES = /* @__PURE__ */ new Set([
+  "ANTHROPIC_API_KEY",
+  "ANTHROPIC_AUTH_TOKEN",
+  "CLAUDE_CODE_OAUTH_TOKEN",
+  "CLAUDE_CODE_OAUTH_REFRESH_TOKEN",
+  "CLAUDE_CODE_SESSION_ACCESS_TOKEN",
+  "CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR",
+  "CLAUDE_CODE_HOST_CREDS_FILE",
+  "CODEX_API_KEY",
+  "OPENAI_API_KEY",
+  "OPENAI_ACCESS_TOKEN",
+  "GH_TOKEN",
+  "GITHUB_TOKEN",
+  "GH_ENTERPRISE_TOKEN",
+  "GITHUB_ENTERPRISE_TOKEN"
+]);
+function withoutBrokeredCredentials(values) {
+  return Object.fromEntries(
+    Object.entries(values).filter(([name]) => !BROKERED_CREDENTIAL_NAMES.has(name))
+  );
+}
+
 // src/runner/launch.ts
 function gzipBodiesSignal() {
   let on = false;
@@ -8064,12 +8091,22 @@ async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
   }
   try {
     const wrapped = launch.wrapped === true;
-    const env = runnerExecEnv(launch.env ?? process.env, wrapped);
-    const grants = minted.deviceGrants.length > 0 ? launch.grants?.(minted.deviceGrants) ?? {} : {};
+    if (launch.brokeredCredentials && !wrapped)
+      throw new Error("credential broker requires a wrapped runner");
+    const inherited = runnerExecEnv(launch.env ?? process.env, wrapped);
+    const env = launch.brokeredCredentials ? withoutBrokeredCredentials(inherited) : inherited;
+    const directGrants = minted.deviceGrants.length > 0 ? launch.grants?.(minted.deviceGrants) ?? {} : {};
+    const grants = launch.brokeredCredentials ? Object.fromEntries(
+      Object.entries(directGrants).map(([key, values]) => [
+        key,
+        withoutBrokeredCredentials(values)
+      ])
+    ) : directGrants;
+    const secrets = wrapped ? launch.secrets?.() ?? {} : void 0;
     const input = {
       baseUrl: opts.baseUrl,
       credential: minted.credential,
-      ...wrapped ? { secrets: launch.secrets?.() ?? {} } : {},
+      ...secrets ? { secrets: launch.brokeredCredentials ? withoutBrokeredCredentials(secrets) : secrets } : {},
       ...Object.keys(grants).length > 0 ? { grants } : {},
       dispatch: payload,
       turnId,
@@ -8319,7 +8356,7 @@ var CANCEL_WAKE_TOOL_NAME = `mcp__${COMPANION_LOCAL_MCP_SERVER}__${CANCEL_WAKE_T
 import { readFile as readFile2 } from "fs/promises";
 import { homedir as homedir6 } from "os";
 import { join as join15 } from "path";
-import { parse } from "smol-toml";
+import { parse as parse2 } from "smol-toml";
 
 // src/codex-images.ts
 import { mkdtemp, rm, writeFile } from "fs/promises";
@@ -10761,6 +10798,7 @@ var CompanionSupervisor = class {
         ),
         ...this.config.runner?.command ? {
           wrapped: true,
+          brokeredCredentials: this.config.runner.brokeredCredentials,
           secrets: () => loadSecretValuesTolerant(
             (m) => this.log.warn({ err: m }, "Could not read the secrets file for a wrapped turn.")
           )

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cabane/companion",
-  "version": "0.6.215",
+  "version": "0.6.216",
   "type": "module",
   "description": "The Cabane Companion (headless): connect an agent on your machine to your Cabane workspace as a responder — drive work against your own codebase, files, and MCP servers without putting any of it in Cabane.",
   "license": "UNLICENSED",
@@ -14,6 +14,14 @@
     "cabane-companion": "./dist/bin.js"
   },
   "main": "./dist/cli.js",
+  "exports": {
+    ".": "./dist/cli.js",
+    "./runtime": "./dist/runtime.js",
+    "./pairing": "./dist/pairing-config.js",
+    "./credential-broker": "./dist/credential-broker.js",
+    "./package.json": "./package.json",
+    "./*": "./*"
+  },
   "files": [
     "dist"
   ],
@@ -37,6 +45,7 @@
     "commander": "12.1.0",
     "eventsource-parser": "3.0.8",
     "hono": "4.12.18",
+    "graphql": "16.11.0",
     "picocolors": "1.1.1",
     "pino": "10.3.1",
     "smol-toml": "1.8.0",