@peakflo/agent-harness 0.2.14-rc.1 → 0.2.14-rc.2

package/dist/github-proxy-certificates.d.ts

@@ -3,6 +3,9 @@ export interface GitHubProxyCertificateOptions {
     /** Override only for deterministic tests. Production preserves process.env. */
     environment?: NodeJS.ProcessEnv;
 }
+export declare function ambientCaCertificates(environment: NodeJS.ProcessEnv, outputPath: string): Promise<Buffer[]>;
+/** Node's bundled public roots, PEM, newline-terminated. */
+export declare function publicRootCertificates(): string;
 export interface GitHubProxyCertificates {
     caCertificate: Buffer;
     caCertificatePath: string;

package/dist/github-proxy-certificates.js

@@ -1,5 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.ambientCaCertificates = ambientCaCertificates;
+exports.publicRootCertificates = publicRootCertificates;
 exports.createGitHubProxyCertificates = createGitHubProxyCertificates;
 require("reflect-metadata");
 const node_crypto_1 = require("node:crypto");
@@ -54,6 +56,10 @@ async function ambientCaCertificates(environment, outputPath) {
     }
     return certificates;
 }
+/** Node's bundled public roots, PEM, newline-terminated. */
+function publicRootCertificates() {
+    return `${node_tls_1.rootCertificates.join('\n')}\n`;
+}
 function validity() {
     const now = Date.now();
     return {
@@ -103,7 +109,7 @@ async function createGitHubProxyCertificates(stateRoot, options = {}) {
     const caCertificate = Buffer.from(ca.toString('pem'));
     const caCertificatePath = (0, node_path_1.join)(root, CA_CERTIFICATE_FILE);
     const ambientRoots = await ambientCaCertificates(options.environment ?? process.env, caCertificatePath);
-    const publicRoots = `${node_tls_1.rootCertificates.join('\n')}\n`;
+    const publicRoots = publicRootCertificates();
     await (0, promises_1.writeFile)(caCertificatePath, Buffer.concat([...ambientRoots, Buffer.from(publicRoots), caCertificate]), { mode: 0o644 });
     await (0, promises_1.chmod)(caCertificatePath, 0o644);
     const leaves = new Map();

package/dist/github-workspace.d.ts

@@ -11,6 +11,12 @@ export interface GitHubWorkspaceOptions {
     /** Injected in tests: the proxy's peer-uid lookup. See `GitHubTlsProxy`. */
     peerUid?: PeerUidResolver;
 }
+/**
+ * Hostnames of URLs the agent reaches WITHOUT a proxy (control plane, model
+ * gateway, MCP). Shared with the credential proxy's NO_PROXY so both proxies
+ * bypass exactly the same hosts.
+ */
+export declare function directHostnames(urls: string[]): string[];
 /** Bare clone plus one worktree per session, adapted from 20x. */
 export declare class GitHubWorkspaceProvider implements WorkspaceProvider {
     private readonly options;

package/dist/github-workspace.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GitHubWorkspaceProvider = void 0;
+exports.directHostnames = directHostnames;
 const node_child_process_1 = require("node:child_process");
 const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
@@ -17,6 +18,25 @@ const DEFAULT_PROXY_PORT = 7780;
 const LINK_SECRET_FILE = '.github-proxy-link-secret';
 const WIP_PUSH_FAILED_FILE = '.worktree-wip-push-failed';
 const WIP_COMMIT_MESSAGE = 'chore(agent): wip — uncommitted at turn end';
+/**
+ * Hostnames of URLs the agent reaches WITHOUT a proxy (control plane, model
+ * gateway, MCP). Shared with the credential proxy's NO_PROXY so both proxies
+ * bypass exactly the same hosts.
+ */
+function directHostnames(urls) {
+    const hosts = [];
+    for (const value of urls) {
+        if (!value)
+            continue;
+        try {
+            hosts.push(new URL(value).hostname.toLowerCase());
+        }
+        catch {
+            /* The component that owns an invalid URL reports it. */
+        }
+    }
+    return hosts;
+}
 /** Bare clone plus one worktree per session, adapted from 20x. */
 class GitHubWorkspaceProvider {
     options;
@@ -46,16 +66,8 @@ class GitHubWorkspaceProvider {
         this.rememberDirectUrls(options.directUrls ?? []);
     }
     rememberDirectUrls(urls) {
-        for (const value of urls) {
-            if (!value)
-                continue;
-            try {
-                this.directHosts.add(new URL(value).hostname.toLowerCase());
-            }
-            catch {
-                /* The component that owns an invalid URL reports it. */
-            }
-        }
+        for (const host of directHostnames(urls))
+            this.directHosts.add(host);
     }
     runGit(args, options = {}) {
         const { environment, ...execOptions } = options;

package/dist/harness.js

@@ -1872,6 +1872,8 @@ class Harness {
             events: this.events,
             telemetry: this.telemetry,
             coldStartLog: (line) => coldStart.add(line),
+            runtime: this.options.runtime,
+            directUrls: [this.options.controlPlaneUrl],
             notifier: this.notifier,
             artifacts: this.artifacts,
             conversation: this.conversation,

package/dist/index.d.ts

@@ -59,4 +59,4 @@ export * from './adapters';
  * "ephemeral" means. A rule written twice is a rule that drifts.
  */
 export { CONTRACT_ERROR_CODES, DEFAULT_BASE_DELAY_MS, DEFAULT_HEARTBEAT_INTERVAL_MS, DEFAULT_LEASE_TTL_MS, DEFAULT_LEASE_WAIT_SECONDS, DEFAULT_MAX_ATTEMPTS, EPHEMERAL_PART_TYPES, FINAL_HTTP_STATUSES, HARNESS_UPGRADE_EXIT_CODE, MAX_INGEST_PARTS, MAX_INGEST_PART_BYTES, MAX_LEASE_WAIT_SECONDS, MIN_SUPPORTED_PROTOCOL_VERSION, MISSED_HEARTBEATS_BEFORE_OFFLINE, PERSISTED_PART_TYPES, PROTOCOL_VERSION, PROTOCOL_VERSION_HEADER, ROUTES, ingestPartByteLength, isEphemeralPartType, isFinalStatus, isPersistablePart, isProtocolSupported } from './contract';
-export type { BootstrapRequest, BootstrapResponse, ControlPlaneErrorBody, CredentialRotateRequest, CredentialRotateResponse, DeregisterRequest, DeregisterResponse, HarnessOptions, HealthReport, IngestRejection, IngestRejectionReason, IngestRequest, IngestResponse, JsonValue, LeaseRenewRequest, LeaseRenewResponse, LeaseResponse, LeasedAgent, LeasedAttachment, LeasedLimits, LeasedMcpServer, LeasedModel, LeasedSession, LeasedSkill, LeasedTurnInput, LeasedWorkspace, LeasedGitHubCredential, LeasedGitHubRepository, ProtocolEnvelope, RunnerBackend, RunnerCapabilities, RunnerHeartbeatRequest, RunnerHeartbeatResponse, RunnerModel, RunnerRegisterRequest, RunnerRegisterResponse, RunnerRuntime, RunnerStatus, SessionCommand, TranscriptPart, TranscriptPartInput, TurnMetadata } from './types';
+export type { BootstrapRequest, BootstrapResponse, ControlPlaneErrorBody, CredentialRotateRequest, CredentialRotateResponse, DeregisterRequest, DeregisterResponse, HarnessOptions, HealthReport, IngestRejection, IngestRejectionReason, IngestRequest, IngestResponse, JsonValue, LeaseRenewRequest, LeaseRenewResponse, LeaseResponse, LeasedAgent, LeasedAttachment, LeasedCredentialProxy, LeasedLimits, LeasedMcpServer, LeasedModel, LeasedSession, LeasedSkill, LeasedTurnInput, LeasedWorkspace, LeasedGitHubCredential, LeasedGitHubRepository, ProtocolEnvelope, RunnerBackend, RunnerCapabilities, RunnerHeartbeatRequest, RunnerHeartbeatResponse, RunnerModel, RunnerRegisterRequest, RunnerRegisterResponse, RunnerRuntime, RunnerStatus, SessionCommand, TranscriptPart, TranscriptPartInput, TurnMetadata } from './types';

package/dist/runtime/credential-proxy.d.ts

@@ -0,0 +1,44 @@
+import type { LeasedCredentialProxy, RunnerRuntime } from '../types';
+export declare const CREDENTIAL_PROXY_CA_BUNDLE_FILE = ".pf-credential-proxy-ca.pem";
+export declare const CREDENTIAL_PROXY_HEALTH_TIMEOUT_MS = 1000;
+export declare const CREDENTIAL_PROXY_TOKEN_REDACTION = "[credential-proxy-token]";
+/** Every key this module may add or replace. Nothing else is ever touched. */
+export declare const CREDENTIAL_PROXY_ENV_KEYS: readonly ["HTTPS_PROXY", "https_proxy", "HTTP_PROXY", "http_proxy", "NO_PROXY", "no_proxy", "SSL_CERT_FILE", "CURL_CA_BUNDLE", "NODE_EXTRA_CA_CERTS", "GIT_SSL_CAINFO", "REQUESTS_CA_BUNDLE", "PF_CREDENTIAL_PROXY"];
+export type CredentialProxyUnavailableReason = 'not_offered' | 'runtime_not_sandbox' | 'vendor_backend' | 'invalid_descriptor' | 'health_check_failed' | 'ca_unreadable' | 'bundle_write_failed';
+export interface CredentialProxyEnvironmentInput {
+    /** The HARNESS's own runtime (its CLI/env option), not the lease's claim. */
+    harnessRuntime: RunnerRuntime | undefined;
+    /** The lease's session runtime. Both must say `sandbox`. */
+    sessionRuntime: RunnerRuntime | string | undefined;
+    backend: string;
+    sessionId: string;
+    /** Session directory; the merged CA bundle is written here, 0644. */
+    sessionDir: string;
+    descriptor: LeasedCredentialProxy | undefined | null;
+    /** The environment the turn would get today (GitHub's, or undefined). */
+    environment: Record<string, string> | undefined;
+    /** Hosts the agent reaches directly (gateway, MCP, control plane...). */
+    directUrls: string[];
+    logger: Pick<Console, 'log' | 'warn'>;
+    /** Tests only. Production reads process.env, like the GitHub bundle. */
+    ambientEnvironment?: NodeJS.ProcessEnv;
+}
+export interface CredentialProxyEnvironmentResult {
+    environment: Record<string, string> | undefined;
+    /** Non-null exactly when the proxy variables were applied. */
+    token: string | null;
+    reason: CredentialProxyUnavailableReason | null;
+}
+/** TCP connect to 127.0.0.1:port; true when it connects within the timeout. */
+export declare function probeLoopbackPort(port: number, timeoutMs?: number): Promise<boolean>;
+/** The GitHub proxy's loopback port, read off the env GitHub already built. */
+export declare function githubProxyPort(environment: Record<string, string> | undefined): number | null;
+export declare function credentialProxyEnvironment(input: CredentialProxyEnvironmentInput): Promise<CredentialProxyEnvironmentResult>;
+/** Replace every occurrence of `token` in a string. No-op without a token. */
+export declare function redactCredentialProxyToken(text: string, token: string | null): string;
+/**
+ * Same, for a JSON-shaped value (transcript parts, turn metadata). The token
+ * alphabet needs no JSON escaping, so a string split over the serialised form
+ * finds every occurrence in every nested string.
+ */
+export declare function redactCredentialProxyTokenDeep<T>(value: T, token: string | null): T;

package/dist/runtime/credential-proxy.js

@@ -0,0 +1,230 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CREDENTIAL_PROXY_ENV_KEYS = exports.CREDENTIAL_PROXY_TOKEN_REDACTION = exports.CREDENTIAL_PROXY_HEALTH_TIMEOUT_MS = exports.CREDENTIAL_PROXY_CA_BUNDLE_FILE = void 0;
+exports.probeLoopbackPort = probeLoopbackPort;
+exports.githubProxyPort = githubProxyPort;
+exports.credentialProxyEnvironment = credentialProxyEnvironment;
+exports.redactCredentialProxyToken = redactCredentialProxyToken;
+exports.redactCredentialProxyTokenDeep = redactCredentialProxyTokenDeep;
+/**
+ * THE AGENT'S ROUTE TO THE SANDBOX CREDENTIAL PROXY.
+ *
+ * The credential proxy runs in the ROOT sandbox broker, not in this process.
+ * It holds every real credential value; the harness never does. That is not a
+ * style choice: the harness and the agent it spawns share one uid (1500), so
+ * anything in the harness's memory or `/proc/<pid>/environ` is readable by the
+ * agent. The only thing the harness ever handles is the lease's
+ * `credentialProxy` descriptor — a loopback port, a CA path, and a token that
+ * is bound to tenant/session/turn/sandbox and is NOT a credential value.
+ *
+ * What this module does with it, and nothing more:
+ *   - decide whether the proxy is usable for THIS turn (sandbox runtime, Pi or
+ *     OpenCode backend, port answers within 1 s, CA readable), and
+ *   - if so, layer the proxy variables over the turn's existing environment.
+ *
+ * Any failed check returns the input environment UNCHANGED, plus one log line
+ * carrying the sessionId and a reason code. The token is never logged.
+ */
+const node_crypto_1 = require("node:crypto");
+const promises_1 = require("node:fs/promises");
+const node_net_1 = require("node:net");
+const node_path_1 = require("node:path");
+const github_proxy_certificates_1 = require("../github-proxy-certificates");
+const github_workspace_1 = require("../github-workspace");
+const vendor_backends_1 = require("../vendor-backends");
+exports.CREDENTIAL_PROXY_CA_BUNDLE_FILE = '.pf-credential-proxy-ca.pem';
+exports.CREDENTIAL_PROXY_HEALTH_TIMEOUT_MS = 1_000;
+exports.CREDENTIAL_PROXY_TOKEN_REDACTION = '[credential-proxy-token]';
+/** Every key this module may add or replace. Nothing else is ever touched. */
+exports.CREDENTIAL_PROXY_ENV_KEYS = [
+    'HTTPS_PROXY',
+    'https_proxy',
+    'HTTP_PROXY',
+    'http_proxy',
+    'NO_PROXY',
+    'no_proxy',
+    'SSL_CERT_FILE',
+    'CURL_CA_BUNDLE',
+    'NODE_EXTRA_CA_CERTS',
+    'GIT_SSL_CAINFO',
+    'REQUESTS_CA_BUNDLE',
+    'PF_CREDENTIAL_PROXY'
+];
+/*
+ * The token lands in the userinfo of a proxy URL, so it must need no
+ * percent-encoding. The contract format `pfcp_<b64url>.<b64url>` satisfies
+ * this; anything else is refused rather than silently mangled.
+ */
+const TOKEN_SHAPE = /^[A-Za-z0-9._~-]{1,2048}$/;
+/** TCP connect to 127.0.0.1:port; true when it connects within the timeout. */
+function probeLoopbackPort(port, timeoutMs = exports.CREDENTIAL_PROXY_HEALTH_TIMEOUT_MS) {
+    return new Promise((resolvePromise) => {
+        const socket = (0, node_net_1.connect)({ host: '127.0.0.1', port });
+        let settled = false;
+        const finish = (ok) => {
+            if (settled)
+                return;
+            settled = true;
+            socket.destroy();
+            resolvePromise(ok);
+        };
+        // Covers the connect phase too: no SYN-ACK within the window -> 'timeout'.
+        socket.setTimeout(timeoutMs);
+        socket.once('timeout', () => finish(false));
+        socket.once('connect', () => finish(true));
+        socket.once('error', () => finish(false));
+    });
+}
+function validDescriptor(descriptor) {
+    return (typeof descriptor === 'object' &&
+        descriptor !== null &&
+        Number.isInteger(descriptor.port) &&
+        descriptor.port > 0 &&
+        descriptor.port < 65_536 &&
+        typeof descriptor.token === 'string' &&
+        TOKEN_SHAPE.test(descriptor.token) &&
+        typeof descriptor.caPath === 'string' &&
+        descriptor.caPath.length > 0);
+}
+/** The GitHub proxy's loopback port, read off the env GitHub already built. */
+function githubProxyPort(environment) {
+    const value = environment?.HTTPS_PROXY ?? environment?.https_proxy;
+    if (!value)
+        return null;
+    try {
+        const url = new URL(value);
+        if (url.hostname !== '127.0.0.1' || url.username)
+            return null;
+        const port = Number(url.port);
+        return Number.isInteger(port) && port > 0 ? port : null;
+    }
+    catch {
+        return null;
+    }
+}
+function withNewline(contents) {
+    return contents.length === 0 || contents.at(-1) === 0x0a
+        ? contents
+        : Buffer.concat([contents, Buffer.from('\n')]);
+}
+/**
+ * System trust + GitHub proxy CA (if any) + credential proxy CA.
+ *
+ * The GitHub bundle, when the turn has one, already IS "ambient roots + Node's
+ * public roots + GitHub CA" (see `createGitHubProxyCertificates`), so it is
+ * the base as-is. Without it the base is built the same way GitHub builds it.
+ */
+async function writeMergedBundle(input, credentialCa) {
+    const path = (0, node_path_1.join)((0, node_path_1.resolve)(input.sessionDir), exports.CREDENTIAL_PROXY_CA_BUNDLE_FILE);
+    const githubBundle = input.environment?.SSL_CERT_FILE;
+    let base;
+    if (githubBundle && (0, node_path_1.resolve)(githubBundle) !== path) {
+        base = [withNewline(await (0, promises_1.readFile)(githubBundle))];
+    }
+    else {
+        base = [
+            ...(await (0, github_proxy_certificates_1.ambientCaCertificates)(input.ambientEnvironment ?? process.env, path)),
+            Buffer.from((0, github_proxy_certificates_1.publicRootCertificates)())
+        ];
+    }
+    const temporary = `${path}.${(0, node_crypto_1.randomUUID)()}.tmp`;
+    await (0, promises_1.writeFile)(temporary, Buffer.concat([...base, withNewline(credentialCa)]), {
+        mode: 0o644
+    });
+    await (0, promises_1.chmod)(temporary, 0o644);
+    await (0, promises_1.rename)(temporary, path);
+    return path;
+}
+async function credentialProxyEnvironment(input) {
+    const unchanged = (reason) => {
+        // A self-hosted/desktop turn without the field is the normal case there,
+        // not a degradation; it stays silent. Everything else is one line.
+        if (!(reason === 'runtime_not_sandbox' && !input.descriptor)) {
+            input.logger.warn(`[CredentialProxy] credential proxy unavailable sessionId=${input.sessionId} reason=${reason}`);
+        }
+        return { environment: input.environment, token: null, reason };
+    };
+    // Defence in depth: the API never sends the field off-sandbox, and even if
+    // it did, a runner on a user's machine must not route through it.
+    if (input.harnessRuntime !== 'sandbox' || input.sessionRuntime !== 'sandbox')
+        return unchanged('runtime_not_sandbox');
+    if (!input.descriptor)
+        return unchanged('not_offered');
+    // A vendor CLI gets only an allowlisted env (vendor-environment.ts); it is
+    // not a supported credential-proxy client.
+    if ((0, vendor_backends_1.isVendorBackend)(input.backend))
+        return unchanged('vendor_backend');
+    const descriptor = input.descriptor;
+    if (!validDescriptor(descriptor))
+        return unchanged('invalid_descriptor');
+    if (!(await probeLoopbackPort(descriptor.port)))
+        return unchanged('health_check_failed');
+    let credentialCa;
+    try {
+        credentialCa = await (0, promises_1.readFile)(descriptor.caPath);
+    }
+    catch {
+        return unchanged('ca_unreadable');
+    }
+    if (!credentialCa.includes('-----BEGIN CERTIFICATE-----'))
+        return unchanged('ca_unreadable');
+    let bundle;
+    try {
+        bundle = await writeMergedBundle(input, credentialCa);
+    }
+    catch {
+        return unchanged('bundle_write_failed');
+    }
+    const base = input.environment ?? {};
+    // The cred proxy is the FIRST hop. When the turn has a GitHub proxy, the
+    // broker chains GitHub traffic to it; the password slot says where.
+    const chainPort = githubProxyPort(base) ?? 0;
+    const proxy = `http://${descriptor.token}:${chainPort}@127.0.0.1:${descriptor.port}`;
+    const noProxy = base.NO_PROXY ??
+        base.no_proxy ??
+        [
+            ...new Set([
+                '127.0.0.1',
+                'localhost',
+                ...(0, github_workspace_1.directHostnames)(input.directUrls)
+            ])
+        ].join(',');
+    return {
+        environment: {
+            ...base,
+            HTTPS_PROXY: proxy,
+            https_proxy: proxy,
+            HTTP_PROXY: proxy,
+            http_proxy: proxy,
+            NO_PROXY: noProxy,
+            no_proxy: noProxy,
+            SSL_CERT_FILE: bundle,
+            CURL_CA_BUNDLE: bundle,
+            NODE_EXTRA_CA_CERTS: bundle,
+            GIT_SSL_CAINFO: bundle,
+            REQUESTS_CA_BUNDLE: bundle,
+            PF_CREDENTIAL_PROXY: '1'
+        },
+        token: descriptor.token,
+        reason: null
+    };
+}
+/** Replace every occurrence of `token` in a string. No-op without a token. */
+function redactCredentialProxyToken(text, token) {
+    return token
+        ? text.split(token).join(exports.CREDENTIAL_PROXY_TOKEN_REDACTION)
+        : text;
+}
+/**
+ * Same, for a JSON-shaped value (transcript parts, turn metadata). The token
+ * alphabet needs no JSON escaping, so a string split over the serialised form
+ * finds every occurrence in every nested string.
+ */
+function redactCredentialProxyTokenDeep(value, token) {
+    if (!token || value === undefined)
+        return value;
+    const serialised = JSON.stringify(value);
+    if (!serialised.includes(token))
+        return value;
+    return JSON.parse(redactCredentialProxyToken(serialised, token));
+}

package/dist/runtime/session-runner.d.ts

@@ -21,7 +21,7 @@
 import type { CodingAgentAdapter } from '../adapters';
 import { SessionModelGateway } from '../adapters/model-gateway';
 import { ArtifactInspector, ConversationStore, EventSink, ModelMessageRecord, Notifier, SecretProvider, Telemetry, TranscriptStore, WorkspaceProvider } from '../ports';
-import { LeaseResponse, LeasedTurnInput, ModelMessageInput, TranscriptPartInput, TurnMetadata } from '../types';
+import { LeaseResponse, LeasedTurnInput, ModelMessageInput, RunnerRuntime, TranscriptPartInput, TurnMetadata } from '../types';
 import { KnowledgeToolHost, type KnowledgeControl } from './knowledge-tools';
 import { McpAuthProxy } from './mcp-auth-proxy';
 import { type FailedMcpCheck } from './mcp-preflight';
@@ -47,6 +47,13 @@ export interface SessionRunnerDeps {
     telemetry: Telemetry;
     /** Send a structured timing event to the control plane without waiting. */
     coldStartLog?: (line: string) => void;
+    /**
+     * The HARNESS's own runtime. Only `sandbox` may route the agent through the
+     * credential proxy, whatever the lease says; absent means "not sandbox".
+     */
+    runtime?: RunnerRuntime;
+    /** Harness-level hosts the agent reaches directly (the control plane). */
+    directUrls?: string[];
     notifier: Notifier;
     artifacts: ArtifactInspector;
     /**
@@ -406,6 +413,12 @@ export declare class SessionRunner {
     private browserPauseStartedAt;
     /** When the last browser pause ended; the idle clock restarts from here. */
     private browserPauseEndedAt;
+    /**
+     * The credential-proxy token in force for this turn, kept ONLY so it can be
+     * scrubbed from everything this runner sends or logs. Not a credential
+     * value (see `LeaseResponse.credentialProxy`); null when the proxy is off.
+     */
+    private credentialProxyToken;
     constructor(deps: SessionRunnerDeps);
     /**
      * True while a permission prompt is outstanding. Read by the harness to
@@ -643,6 +656,8 @@ export declare class SessionRunner {
      * old Space's copies. Never throws; a failed sync is logged and the turn runs.
      */
     private syncSpaceFilesForTurn;
+    /** URLs this session's agent reaches without a proxy. */
+    private sessionDirectUrls;
     /**
      * Build the backend's session config.
      *

package/dist/runtime/session-runner.js

@@ -38,6 +38,7 @@ const vendor_backends_1 = require("../vendor-backends");
 const attachments_1 = require("./attachments");
 const cold_start_steps_1 = require("./cold-start-steps");
 const conversation_1 = require("./conversation");
+const credential_proxy_1 = require("./credential-proxy");
 const knowledge_tools_1 = require("./knowledge-tools");
 const mcp_preflight_1 = require("./mcp-preflight");
 const mcp_tool_store_1 = require("./mcp-tool-store");
@@ -657,6 +658,12 @@ class SessionRunner {
     browserPauseStartedAt = null;
     /** When the last browser pause ended; the idle clock restarts from here. */
     browserPauseEndedAt = null;
+    /**
+     * The credential-proxy token in force for this turn, kept ONLY so it can be
+     * scrubbed from everything this runner sends or logs. Not a credential
+     * value (see `LeaseResponse.credentialProxy`); null when the proxy is off.
+     */
+    credentialProxyToken = null;
     constructor(deps) {
         this.deps = deps;
         this.logger = deps.logger ?? console;
@@ -724,7 +731,9 @@ class SessionRunner {
     async run(leased, signal) {
         const lease = withoutGatewayForVendorBackend(leased);
         const { session } = lease;
-        const logColdStart = (line) => {
+        this.credentialProxyToken = null;
+        const logColdStart = (raw) => {
+            const line = (0, credential_proxy_1.redactCredentialProxyToken)(raw, this.credentialProxyToken);
             this.logger.log(line);
             this.deps.coldStartLog?.(line);
         };
@@ -1012,6 +1021,27 @@ class SessionRunner {
             const unavailableMcpServers = [];
             const config = this.buildSessionConfig(session, workspaceDir, secretToken, signal, knowledgeUrl, unavailableMcpServers);
             config.coldStartLog = this.deps.coldStartLog;
+            /*
+             * THE CREDENTIAL PROXY. Layered over the env built above only when the
+             * lease offers it, the runner is a sandbox, and the broker answers; any
+             * failed check leaves `config.environment` exactly as it was.
+             */
+            const credentialProxy = await (0, credential_proxy_1.credentialProxyEnvironment)({
+                harnessRuntime: this.deps.runtime,
+                sessionRuntime: session.runtime,
+                backend: session.agent.backend,
+                sessionId: session.sessionId,
+                sessionDir: workspaceDir,
+                descriptor: lease.credentialProxy,
+                environment: config.environment,
+                directUrls: [
+                    ...(this.deps.directUrls ?? []),
+                    ...this.sessionDirectUrls(session, knowledgeUrl)
+                ],
+                logger: this.logger
+            });
+            config.environment = credentialProxy.environment;
+            this.credentialProxyToken = credentialProxy.token;
             /*
              * ITEM 1(b). A server whose stored listing is still valid for this
              * toolset and this speaker is not checked again: its tools are seeded
@@ -2467,9 +2497,14 @@ class SessionRunner {
         if (chunks.length === 0) {
             chunks.push([]);
         }
+        // The agent can echo its own env (`env`, a failing curl) into a tool
+        // result; the credential-proxy token must not reach the transcript.
+        const token = this.credentialProxyToken;
         for (let i = 0; i < chunks.length; i += 1) {
             const isLast = i === chunks.length - 1;
-            await this.deps.ingest(sessionId, chunks[i], isLast ? turn : undefined, isLast ? final : false, isLast ? modelMessages : undefined);
+            await this.deps.ingest(sessionId, (0, credential_proxy_1.redactCredentialProxyTokenDeep)(chunks[i], token), isLast ? (0, credential_proxy_1.redactCredentialProxyTokenDeep)(turn, token) : undefined, isLast ? final : false, isLast
+                ? (0, credential_proxy_1.redactCredentialProxyTokenDeep)(modelMessages, token)
+                : undefined);
         }
     }
     /* ---------------------------------------------------------------- */
@@ -2737,6 +2772,14 @@ class SessionRunner {
             this.logger.warn(`[SessionRunner] Space files sync failed: ${(error instanceof Error ? error.message : String(error)).replace(/https?:\/\/\S+/gi, '<url>')}`);
         }
     }
+    /** URLs this session's agent reaches without a proxy. */
+    sessionDirectUrls(session, knowledgeUrl) {
+        return [
+            session.agent.model.gatewayUrl ?? '',
+            ...session.agent.mcpServers.map((server) => server.url),
+            ...(knowledgeUrl ? [knowledgeUrl] : [])
+        ];
+    }
     /**
      * Build the backend's session config.
      *
@@ -2859,11 +2902,7 @@ class SessionRunner {
             secretBrokerPort: brokerPort ?? undefined,
             secretSessionToken: secretToken ?? undefined,
             secretShellPath: this.deps.secrets.writeShellWrapper() ?? undefined,
-            environment: this.deps.workspace.getEnvironment?.(session.sessionId, [
-                session.agent.model.gatewayUrl ?? '',
-                ...session.agent.mcpServers.map((server) => server.url),
-                ...(knowledgeUrl ? [knowledgeUrl] : [])
-            ]),
+            environment: this.deps.workspace.getEnvironment?.(session.sessionId, this.sessionDirectUrls(session, knowledgeUrl)),
             /*
              * DEFECT G1, THE OTHER HALF.
              *

package/dist/types.d.ts

@@ -516,6 +516,28 @@ export interface LeaseResponse {
     modelTokenExpiresAt?: string;
     /** In-memory only. It is never passed through a process environment. */
     githubCredential?: LeasedGitHubCredential;
+    /**
+     * Where the agent reaches the sandbox CREDENTIAL PROXY for this turn.
+     *
+     * NOT A SECRET VALUE. The real credential values live only in the root
+     * sandbox broker that runs the proxy; the harness (same uid as the agent)
+     * never holds one. `token` is a capability bound to tenant, session, turn
+     * and sandbox, which the agent presents to the proxy as the proxy URL's
+     * username. It is still never logged.
+     *
+     * ADDITIVE AND OPTIONAL (no protocol bump). Sent only for `sandbox` leases;
+     * the harness also refuses it on any other runtime and health-checks the
+     * port before using it. See `runtime/credential-proxy.ts`.
+     */
+    credentialProxy?: LeasedCredentialProxy;
+}
+export interface LeasedCredentialProxy {
+    /** Loopback port of the broker's proxy, e.g. 7790. */
+    port: number;
+    /** `pfcp_<b64url payload>.<b64url hmac>` — a bound capability, not a credential. */
+    token: string;
+    /** Public CA certificate (PEM) the proxy signs leaves with. */
+    caPath: string;
 }
 export interface LeasedSession {
     sessionId: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peakflo/agent-harness",
-  "version": "0.2.14-rc.1",
+  "version": "0.2.14-rc.2",
   "description": "Headless Peakflo coding-agent harness. One codebase, three hosting modes: a Daytona cloud sandbox, a customer VM, and the 20x desktop.",
   "license": "MIT",
   "type": "commonjs",