@runuai/host 0.9.171 → 0.9.172

package/lib/custom-connection-launch.ts

@@ -0,0 +1,299 @@
+/** ADR-164: compile one validated, hard-pinned connection into a CLI launch.
+ * Only the runner calls these builders. No caller may supply arbitrary TOML,
+ * environment keys, credential-helper commands or a second destination. */
+import { createHash } from "node:crypto";
+
+import {
+  customConnectionEnabled,
+  isCustomConnectionReason,
+  parseCustomConnectionLease,
+  parseCustomConnectionMaterial,
+  validConnectionModels,
+  type CustomConnectionCombination,
+  type CustomConnectionLease,
+  type CustomConnectionMaterial,
+  type CustomConnectionReason,
+} from "../src/custom-connections";
+import { isOwnedInternalConnectionRuntime } from "./internal-connections";
+import { isPublicAddress, isInternalConnectionAddress } from "./secrets-proxy/address";
+
+export class CustomConnectionLaunchError extends Error {
+  constructor(readonly reason: CustomConnectionReason) {
+    super(reason);
+    this.name = "CustomConnectionLaunchError";
+  }
+}
+
+/** JSON string escaping is also valid for TOML basic string values. Never
+ * interpolate an unquoted model id, URL or label into a -c argument. */
+export function tomlString(value: string): string {
+  return JSON.stringify(value).replace(/\u007f/g, "\\u007f");
+}
+
+/** A native account must not inherit a previous connection's route, token or
+ * model aliases. Native credentials are applied AFTER these blanks. AWS's
+ * ordinary identity is isolated below only for a connection launch. */
+const CONNECTION_ENV_NAMES = [
+  "ANTHROPIC_BASE_URL", "ANTHROPIC_CUSTOM_HEADERS", "ANTHROPIC_MODEL",
+  "CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST",
+  "ANTHROPIC_DEFAULT_MODEL", "ANTHROPIC_DEFAULT_FABLE_MODEL",
+  "ANTHROPIC_DEFAULT_OPUS_MODEL", "ANTHROPIC_DEFAULT_SONNET_MODEL",
+  "ANTHROPIC_DEFAULT_HAIKU_MODEL", "ANTHROPIC_SMALL_FAST_MODEL",
+  "ANTHROPIC_SMALL_FAST_MODEL_AWS_REGION", "CLAUDE_CODE_SUBAGENT_MODEL",
+  "CLAUDE_CODE_SUBAGENT_MODEL_FORCE", "CLAUDE_CODE_EXTRA_BODY",
+  "CLAUDE_CODE_USE_BEDROCK", "CLAUDE_CODE_USE_MANTLE", "CLAUDE_CODE_USE_GATEWAY",
+  "CLAUDE_CODE_USE_ANTHROPIC_GOOGLE_CLOUD", "CLAUDE_CODE_API_BASE_URL",
+  "ANTHROPIC_UNIX_SOCKET", "_CLAUDE_CODE_ASSUME_FIRST_PARTY_BASE_URL",
+  "CLAUDE_CODE_USE_VERTEX", "CLAUDE_CODE_USE_FOUNDRY",
+  "CLAUDE_CODE_USE_ANTHROPIC_AWS", "CLAUDE_CODE_SKIP_BEDROCK_AUTH",
+  "CLAUDE_CODE_SKIP_MANTLE_AUTH", "CLAUDE_CODE_SKIP_VERTEX_AUTH",
+  "CLAUDE_CODE_SKIP_FOUNDRY_AUTH", "ANTHROPIC_BEDROCK_BASE_URL",
+  "ANTHROPIC_BEDROCK_MANTLE_BASE_URL", "ANTHROPIC_BEDROCK_REGION_PREFIX",
+  "ANTHROPIC_VERTEX_BASE_URL", "ANTHROPIC_VERTEX_PROJECT_ID",
+  "ANTHROPIC_FOUNDRY_BASE_URL", "ANTHROPIC_FOUNDRY_RESOURCE",
+  "ANTHROPIC_FOUNDRY_API_KEY", "ANTHROPIC_FOUNDRY_AUTH_TOKEN",
+  "ANTHROPIC_AWS_API_KEY", "ANTHROPIC_AWS_BASE_URL", "ANTHROPIC_AWS_WORKSPACE_ID",
+  "ANTHROPIC_GOOGLE_CLOUD_BASE_URL", "CLAUDE_CODE_AUTO_MODE_MODEL",
+  "CLAUDE_CODE_BG_CLASSIFIER_MODEL", "CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL",
+  "ANTHROPIC_PROFILE", "ANTHROPIC_ORGANIZATION_ID",
+  "ANTHROPIC_WORKSPACE_ID", "ANTHROPIC_FEDERATION_RULE_ID",
+  "CLAUDE_CODE_DISABLE_MODEL_ACCESS_FALLBACK",
+  "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC",
+  "OPENAI_API_KEY", "OPENAI_BASE_URL", "OPENAI_ORGANIZATION", "OPENAI_PROJECT",
+  "UAI_CUSTOM_API_KEY", "UAI_INFERENCE_TOKEN", "AWS_BEARER_TOKEN_BEDROCK",
+] as const;
+
+const ENGINE_AUTH_BLANKS = {
+  CLAUDE_CODE_OAUTH_TOKEN: "", CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR: "", CCR_OAUTH_TOKEN_FILE: "",
+  CLAUDE_CODE_HOST_AUTH_ENV_VAR: "", CLAUDE_CODE_HOST_CREDS_FILE: "",
+  ANTHROPIC_API_KEY: "", ANTHROPIC_AUTH_TOKEN: "", OPENAI_API_KEY: "",
+};
+
+export const CONNECTION_NATIVE_BLANKS: Readonly<Record<string, string>> = Object.freeze(
+  Object.fromEntries(CONNECTION_ENV_NAMES.map(name => [name, ""])),
+);
+
+export function connectionNativeBlanks(): Record<string, string> {
+  return { ...CONNECTION_NATIVE_BLANKS };
+}
+
+/** The AWS SDK must never consult an ambient credential provider or endpoint.
+ * Empty files, not a nonexistent path, make profile/process lookup inert. */
+export const CONNECTION_AWS_BLANKS: Readonly<Record<string, string>> = Object.freeze(
+  Object.fromEntries([
+    "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "AWS_SECURITY_TOKEN",
+    "AWS_PROFILE", "AWS_DEFAULT_PROFILE", "AWS_ROLE_ARN", "AWS_ROLE_SESSION_NAME",
+    "AWS_WEB_IDENTITY_TOKEN_FILE", "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI",
+    "AWS_CONTAINER_CREDENTIALS_FULL_URI", "AWS_CONTAINER_AUTHORIZATION_TOKEN",
+    "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE", "AWS_ENDPOINT_URL",
+    "AWS_ENDPOINT_URL_BEDROCK", "AWS_ENDPOINT_URL_BEDROCK_RUNTIME",
+    "AWS_EC2_METADATA_SERVICE_ENDPOINT", "AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE",
+    "AWS_REGION", "AWS_DEFAULT_REGION", "AWS_SDK_LOAD_CONFIG",
+  ].map(name => [name, ""])),
+);
+
+/** Shared by connection launches and the Managed Engine delegation. */
+export function endpointAuthEnv(
+  provider: "anthropic" | "openai",
+  baseUrl: string,
+  token: string,
+  authMode: "bearer" | "x-api-key" = "bearer",
+  tokenVariable = "UAI_CUSTOM_API_KEY",
+): Record<string, string> {
+  return provider === "anthropic"
+    ? { ...connectionNativeBlanks(), ...ENGINE_AUTH_BLANKS, ANTHROPIC_BASE_URL: baseUrl,
+        [authMode === "bearer" ? "ANTHROPIC_AUTH_TOKEN" : "ANTHROPIC_API_KEY"]: token }
+    : { ...connectionNativeBlanks(), ...ENGINE_AUTH_BLANKS,
+        ...(tokenVariable === "UAI_INFERENCE_TOKEN" ? { OPENAI_BASE_URL: baseUrl, OPENAI_API_KEY: token } : {}),
+        [tokenVariable]: token };
+}
+
+/** baseUrl is already the provider's Responses root, including /v1 where
+ * appropriate. Only Managed Engine's caller appends its own /v1. */
+export function codexProviderOverrides(
+  baseUrl: string,
+  options: { provider?: "uai" | "uai_custom"; name?: string; envKey?: "UAI_INFERENCE_TOKEN" | "UAI_CUSTOM_API_KEY" } = {},
+): string[] {
+  const provider = options.provider ?? "uai_custom";
+  return [
+    `model_provider=${provider}`,
+    `model_providers.${provider}.name=${tomlString(options.name ?? "Custom connection")}`,
+    `model_providers.${provider}.base_url=${tomlString(baseUrl)}`,
+    `model_providers.${provider}.env_key=${tomlString(options.envKey ?? "UAI_CUSTOM_API_KEY")}`,
+    `model_providers.${provider}.wire_api="responses"`,
+    `model_providers.${provider}.requires_openai_auth=false`,
+    `model_providers.${provider}.supports_websockets=false`,
+  ];
+}
+
+export interface CustomConnectionLaunch {
+  model: string;
+  agentEnv: Record<string, string>;
+  cliConfigOverrides: string[];
+  claudeSettings?: Record<string, unknown>;
+}
+
+export function buildCustomConnectionLaunch(args: {
+  material: CustomConnectionMaterial;
+  connection: CustomConnectionLease;
+  model?: string;
+  enabled: readonly CustomConnectionCombination[];
+  /** A connection-owned home prepared without copying a native account. */
+  home: string;
+  now?: number;
+  /** Actual destination provider, never inferred from sealed settings. */
+  runtimeProvider?: string;
+}): CustomConnectionLaunch {
+  const material = parseCustomConnectionMaterial(args.material);
+  const connection = parseCustomConnectionLease(args.connection, args.material.engine);
+  if (!material || !connection || !customConnectionEnabled(material, args.enabled)) throw new CustomConnectionLaunchError("unsupported");
+  if (material.internal === true && !isOwnedInternalConnectionRuntime(args.runtimeProvider)) throw new CustomConnectionLaunchError("unsupported");
+  if ((material.internal === true) !== (connection.internal === true)) throw new CustomConnectionLaunchError("unsupported");
+  if (new URL(material.baseUrl).host !== connection.host || material.providerType !== connection.providerType || material.authMode !== connection.authMode || material.region !== connection.region || material.transport !== connection.transport || (material.expiresAt ?? null) !== (connection.expiresAt ?? null)) throw new CustomConnectionLaunchError("unsupported");
+  if (material.expiresAt !== undefined && material.expiresAt !== null && material.expiresAt <= (args.now ?? Date.now())) throw new CustomConnectionLaunchError("expired");
+  if (!validConnectionModels(connection.models, connection.defaultModel, connection.backgroundModel, material.engine, material.apiKey)) throw new CustomConnectionLaunchError("invalid-models");
+  const model = args.model ?? connection.defaultModel;
+  if (!connection.models.includes(model)) throw new CustomConnectionLaunchError("model-not-found");
+  assertConnectionHome(args.home);
+  const aws = { ...CONNECTION_AWS_BLANKS, AWS_EC2_METADATA_DISABLED: "true",
+    AWS_CONFIG_FILE: `${args.home}/aws-config`, AWS_SHARED_CREDENTIALS_FILE: `${args.home}/aws-credentials` };
+  const agentEnv: Record<string, string> = {
+    ...connectionNativeBlanks(), ...ENGINE_AUTH_BLANKS, ...aws,
+    // Bound Claude's SDK attempts as well as its CLI retry loop. The
+    // host applies the connection's separate rate-limit recovery backoff.
+    AWS_MAX_ATTEMPTS: "1",
+    UAI_CUSTOM_CONNECTION: "1",
+  };
+  if (material.providerType === "bedrock") {
+    agentEnv.AWS_REGION = material.region!;
+    agentEnv.AWS_BEARER_TOKEN_BEDROCK = material.apiKey;
+    if (material.engine === "claude") agentEnv.CLAUDE_CODE_USE_BEDROCK = "1";
+  } else {
+    Object.assign(agentEnv, endpointAuthEnv(material.engine === "claude" ? "anthropic" : "openai", material.baseUrl, material.apiKey, material.authMode));
+  }
+  if (material.engine === "claude") {
+    Object.assign(agentEnv, {
+      // Claude 2.1.312 ignores settings-sourced provider/auth/headers when
+      // its embedding host owns routing. Keep project hooks/plugins intact.
+      CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST: "1",
+      // Verified on 2.1.312: replaces its ten-retry cloud-auth loop while
+      // retaining one retry for a transient 429/5xx response.
+      CLAUDE_CODE_MAX_RETRIES: "1",
+      ANTHROPIC_MODEL: model, ANTHROPIC_DEFAULT_FABLE_MODEL: model,
+      ANTHROPIC_DEFAULT_OPUS_MODEL: model, ANTHROPIC_DEFAULT_SONNET_MODEL: model,
+      ANTHROPIC_DEFAULT_HAIKU_MODEL: connection.backgroundModel!, CLAUDE_CODE_SUBAGENT_MODEL: model,
+      CLAUDE_CODE_AUTO_MODE_MODEL: connection.backgroundModel!, CLAUDE_CODE_BG_CLASSIFIER_MODEL: connection.backgroundModel!,
+      CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL: model,
+      CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1", CLAUDE_CODE_DISABLE_MODEL_ACCESS_FALLBACK: "1",
+    });
+    return { model, agentEnv, cliConfigOverrides: [], claudeSettings: {
+      apiKeyHelper: "", awsAuthRefresh: "", awsCredentialExport: "", fallbackModel: [],
+    } };
+  }
+  agentEnv.CODEX_HOME = args.home;
+  const cliConfigOverrides = material.providerType === "bedrock"
+    ? [`model_provider=${tomlString(material.transport === "runtime" ? "amazon-bedrock-runtime" : "amazon-bedrock")}`,
+        `model_providers.${material.transport === "runtime" ? "amazon-bedrock-runtime" : "amazon-bedrock"}.aws.region=${tomlString(material.region!)}`]
+    : codexProviderOverrides(material.baseUrl);
+  const provider = material.providerType === "bedrock"
+    ? material.transport === "runtime" ? "amazon-bedrock-runtime" : "amazon-bedrock"
+    : "uai_custom";
+  // Codex 0.164 rejects retry overrides on its built-in AWS providers.
+  // The connection runner bounds their streamed retries instead.
+  const retryOverrides = material.providerType === "bedrock" ? [] : [
+    `model_providers.${provider}.request_max_retries=1`,
+    `model_providers.${provider}.stream_max_retries=1`,
+  ];
+  return { model, agentEnv, cliConfigOverrides: [...cliConfigOverrides, ...retryOverrides,
+    'web_search="disabled"'] };
+}
+
+const HOME_ROOT = "/home/node/.uai-connection";
+function assertConnectionHome(home: string): void {
+  if (!new RegExp(`^${HOME_ROOT.replaceAll(".", "\\.")}/[A-Za-z0-9_-]{1,128}$`).test(home)) throw new CustomConnectionLaunchError("unsupported");
+}
+export function newConnectionHome(credentialId: string, revision: string, agentId: string, settingsHash: string): string {
+  const segment = createHash("sha256").update(JSON.stringify([credentialId, revision, agentId, settingsHash])).digest("hex");
+  return `${HOME_ROOT}/${segment}`;
+}
+
+const HOME_PREPARE = String.raw`
+import os, stat, sys
+home = sys.argv[1]
+parent, name = home.rsplit("/", 1)
+fd = os.open("/", os.O_RDONLY | os.O_DIRECTORY)
+try:
+    for part in parent.split("/"):
+        if not part: continue
+        try: os.mkdir(part, 0o700, dir_fd=fd)
+        except FileExistsError: pass
+        child = os.open(part, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW, dir_fd=fd)
+        os.close(fd)
+        fd = child
+    info = os.fstat(fd)
+    if info.st_uid != os.getuid() or (info.st_mode & 0o077): raise PermissionError()
+    try: os.mkdir(name, 0o700, dir_fd=fd)
+    except FileExistsError: pass
+    child = os.open(name, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW, dir_fd=fd)
+    try:
+        info = os.fstat(child)
+        if info.st_uid != os.getuid() or (info.st_mode & 0o077): raise PermissionError()
+        # This provider authenticates through its scoped env key. A saved
+        # interactive login is never accepted when resuming the same home.
+        try: os.stat("auth.json", dir_fd=child, follow_symlinks=False)
+        except FileNotFoundError: pass
+        else: raise PermissionError()
+        # Provider/model/tool settings are generated as CLI overrides. The
+        # only config.toml we generate is empty; reject planted commands.
+        for filename in ["config.toml", "aws-config", "aws-credentials"]:
+            file = os.open(filename, os.O_WRONLY | os.O_CREAT | os.O_NOFOLLOW | os.O_NONBLOCK, 0o600, dir_fd=child)
+            try:
+                info = os.fstat(file)
+                if not stat.S_ISREG(info.st_mode) or info.st_uid != os.getuid() or info.st_nlink != 1 or info.st_size or (info.st_mode & 0o077): raise PermissionError()
+            finally: os.close(file)
+    finally: os.close(child)
+finally: os.close(fd)
+`;
+
+/** Execute as the task user. Nonzero exit fails the launch; there is no
+ * fallback home. Reuses only a private home with the empty generated config
+ * and empty AWS credential files. */
+export function connectionHomePreparation(home: string): [string, ...string[]] {
+  assertConnectionHome(home);
+  return ["/usr/bin/python3", "-I", "-c", HOME_PREPARE, home];
+}
+
+const DNS_LOOKUP = String.raw`require("node:dns").lookup(process.argv[1],{all:true,verbatim:true},(error,answers)=>{if(error||!answers.length||answers.length>64){process.exitCode=1;return;}process.stdout.write(JSON.stringify(answers.map(x=>x.address)));});`;
+export function connectionDnsLookupArgv(baseUrl: string): [string, ...string[]] {
+  const hostname = new URL(baseUrl).hostname.replace(/^\[|\]$/g, "");
+  return ["node", "-e", DNS_LOOKUP, "--", hostname];
+}
+/** Evaluate all DNS answers from inside the task runtime, not the runner's
+ * own resolver. The caller bounds exec output/time and rejects nonzero exit. */
+export function validateConnectionAddresses(raw: string, internal = false): void {
+  let addresses: unknown;
+  try { addresses = JSON.parse(raw); } catch { throw new CustomConnectionLaunchError("unreachable"); }
+  if (!Array.isArray(addresses) || !addresses.length || addresses.length > 64 || !addresses.every(x => typeof x === "string")) throw new CustomConnectionLaunchError("unreachable");
+  if (!addresses.every(internal ? isInternalConnectionAddress : isPublicAddress)) throw new CustomConnectionLaunchError("private-address");
+}
+
+export function redactConnectionText(value: string, key: string): string {
+  if (!key) return value;
+  return value.split(key).join("[redacted]".includes(key) ? "" : "[redacted]");
+}
+/** A diagnostic may be inspected to choose a reason, never sent back. */
+export function connectionFailureReason(error: unknown): CustomConnectionReason {
+  if (error instanceof CustomConnectionLaunchError) return error.reason;
+  const o = error && typeof error === "object" ? error as Record<string, unknown> : {};
+  if (isCustomConnectionReason(o.reason)) return o.reason;
+  const status = o.statusCode ?? o.status;
+  const text = typeof error === "string" ? error : error instanceof Error ? error.message : "";
+  if (isCustomConnectionReason(text)) return text;
+  if (status === 401 || /\b401\b|unauthori[sz]ed|authentication_failed|unrecognized.?client|expired.?token|token.{0,80}(?:expired|revoked)|invalid api.?key/i.test(text)) return "unauthorized";
+  if (status === 403 || /\b403\b|forbidden|access.?denied/i.test(text)) return "forbidden";
+  if (status === 404 || /\b404\b|model.{0,30}not.found/i.test(text)) return "model-not-found";
+  if (status === 429 || /\b429\b|rate.?limit|throttl/i.test(text)) return "rate-limited";
+  if (/expired/i.test(text)) return "expired";
+  if (status === 408 || /timeout|timed.out/i.test(text)) return "timeout";
+  return "upstream-error";
+}

package/lib/custom-connection-runtime.ts

@@ -0,0 +1,70 @@
+import type { AgentEvent } from "./agents/types";
+
+import { connectionFailureReason, redactConnectionText } from "./custom-connection-launch";
+export { connectionFailureReason } from "./custom-connection-launch";
+
+/** Redact literal secrets recursively, including tool arguments and notices. */
+export function redactConnectionValue<T>(value: T, key: string): T {
+  if (typeof value === "string") return redactConnectionText(value, key) as T;
+  if (Array.isArray(value)) return value.map(v => redactConnectionValue(v, key)) as T;
+  if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([k, v]) => [redactConnectionValue(k, key), redactConnectionValue(v, key)])) as T;
+  return value;
+}
+
+export function sanitizeConnectionEvent(event: AgentEvent, key: string): AgentEvent {
+  const redacted = redactConnectionValue(event, key);
+  if (event.type === "error") {
+    const diagnostic = event.diagnosticMessage ?? event.message;
+    const message = connectionFailureReason(diagnostic);
+    let resetsAt = Number.isSafeInteger(event.resetsAt) && event.resetsAt! > 0 ? event.resetsAt : undefined;
+    if (message === "rate-limited") {
+      // Preserve only a numeric retry deadline, never provider text/headers.
+      const retryAfter = /retry-after\s*[:=]\s*([^\r\n]+)/i.exec(diagnostic)?.[1]?.trim();
+      const deadline = retryAfter && /^\d+(?:\.\d+)?$/.test(retryAfter)
+        ? Date.now() + Math.ceil(Number(retryAfter) * 1000)
+        : retryAfter ? Date.parse(retryAfter) : NaN;
+      if (Number.isSafeInteger(deadline) && deadline > 0) resetsAt = Math.max(resetsAt ?? 0, deadline);
+    }
+    return { type: "error", message, aborted: event.aborted, code: event.code,
+      ...(message === "rate-limited" && resetsAt !== undefined ? { resetsAt } : {}) };
+  }
+  if (event.type === "notice") return { type: "notice", message: connectionFailureReason(event.message) };
+  if (event.type === "turn_complete" && event.usage) {
+    const usage = { ...event.usage };
+    delete usage.costUsd;
+    return redactConnectionValue({ ...event, usage }, key);
+  }
+  return redacted;
+}
+
+/** A delta may end inside a credential. Retain only a possible credential
+ * prefix; no byte of a complete key can cross the output boundary. */
+export class ConnectionEventSanitizer {
+  private tail = "";
+  constructor(private readonly key: string) {}
+
+  push(event: AgentEvent): AgentEvent[] {
+    if (event.type === "message_delta") {
+      const text = this.tail + event.text;
+      let keep = 0;
+      for (let n = Math.min(this.key.length - 1, text.length); n > 0; n--) {
+        if (text.endsWith(this.key.slice(0, n))) { keep = n; break; }
+      }
+      // Replace first: a complete key may itself end in a key prefix.
+      const safe = redactConnectionText(text, this.key);
+      keep = Math.min(keep, safe.length);
+      if (keep && !safe.endsWith(this.key.slice(0, keep))) keep = 0;
+      this.tail = keep ? safe.slice(-keep) : "";
+      const emitted = keep ? safe.slice(0, -keep) : safe;
+      return emitted ? [{ type: "message_delta", text: emitted }] : [];
+    }
+    if (event.type === "message_complete") {
+      this.tail = ""; // The complete assembled message replaces the deltas.
+      return [sanitizeConnectionEvent(event, this.key)];
+    }
+    const final = event.type === "turn_complete" || event.type === "error" || event.type === "exit";
+    const pending: AgentEvent[] = final && this.tail ? [{ type: "message_delta", text: this.tail }] : [];
+    if (final) this.tail = "";
+    return [...pending, sanitizeConnectionEvent(event, this.key)];
+  }
+}

package/lib/engine-accounts.ts

@@ -941,7 +941,7 @@ type PlannedAccount = { ok: false; message: string } | { ok: true; plan: Labeled
 export function pastedSecretMaterial(
   kind: string,
   rawSecret: string,
-): { ok: true; material: EngineCaptureMaterial } | { ok: false; message: string } {
+): { ok: true; material: Exclude<EngineCaptureMaterial, { authKind: "custom-connection" }> } | { ok: false; message: string } {
   const secret = rawSecret.trim();
   if (!secret) return { ok: false, message: "Paste a token or API key." };
   if (/\s/.test(secret) || secret.length < 12) {

package/lib/engine-credential-env.ts

@@ -30,6 +30,8 @@ export const TASK_SECRET_ENV_NAMES: ReadonlySet<string> = new Set([
   "UAI_INFERENCE_TOKEN",
   "OPENAI_API_KEY",
   "ANTHROPIC_AUTH_TOKEN",
+  "UAI_CUSTOM_API_KEY",
+  "AWS_BEARER_TOKEN_BEDROCK",
 ]);
 
 /** Every name whose value never rides a runner's command line. */

package/lib/internal-connections.ts

@@ -0,0 +1,5 @@
+/** ADR-164: the workspace switch is cloud-only. The host independently
+ * checks the concrete runtime identity; unknown and task machines refuse. */
+export function isOwnedInternalConnectionRuntime(provider: string | null | undefined): boolean {
+  return provider === "docker-compose" || provider === "apple-container";
+}

package/lib/obs.ts

@@ -41,6 +41,7 @@ import { join } from "node:path";
 import * as Sentry from "@sentry/node";
 
 import { env } from "./env";
+import { redactActiveConnectionSecrets } from "./connection-secret-redaction";
 import { isDevelopmentLaunch } from "./launch-mode";
 
 /**
@@ -216,7 +217,7 @@ const TASK_WORKSPACE_SLUG_RE =
   /([/\\]tasks[/\\][A-Za-z0-9_-]+[/\\]workspace[/\\])[^/\\\s"']+/g;
 
 export function scrubHostString(value: string): string {
-  let out = value;
+  let out = redactActiveConnectionSecrets(value);
   out = out.replace(URL_CREDENTIALS_RE, "$1[redacted]@");
   out = out.replace(URL_TAIL_RE, "$1$2[redacted]");
   out = out.replace(RELATIVE_URL_TAIL_RE, "$1$2$3[redacted]");

package/lib/openrouter-budget.ts

@@ -0,0 +1,247 @@
+/** ADR-164: OpenRouter key budgets, never account credit balance or CLI usage.
+ * A credential is read only while a task's current lease serves it. Several
+ * tasks sharing one credential/revision share one ten-minute poll. */
+import type { CustomConnectionReason, OpenRouterBudget, OpenRouterBudgetFrame, OpenRouterBudgetResult } from "../src/custom-connections";
+import { SafeHttpRefusal, readSafeBody, safeRequest } from "./safe-http";
+
+export const OPENROUTER_BUDGET_URL = "https://openrouter.ai/api/v1/key";
+export const OPENROUTER_BUDGET_POLL_MS = 10 * 60_000;
+export const OPENROUTER_BUDGET_TIMEOUT_MS = 20_000;
+export const OPENROUTER_BUDGET_MAX_BYTES = 64 * 1024;
+
+function object(value: unknown): Record<string, unknown> | null {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value as Record<string, unknown> : null;
+}
+function amount(value: unknown): value is number | null {
+  return value === null || (typeof value === "number" && Number.isFinite(value) && value >= 0);
+}
+/** Provider timestamps are ISO instants. An interval such as "monthly" is
+ * deliberately not converted into an invented reset date. */
+function timestamp(value: unknown): number | null | undefined {
+  if (value === null || value === undefined) return null;
+  if (typeof value !== "string" || !/^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d+)?(?:Z|[+-]\d\d:\d\d)$/.test(value)) return undefined;
+  const ms = Date.parse(value);
+  return Number.isSafeInteger(ms) && ms > 0 ? ms : undefined;
+}
+
+/** Select only the bounded public values from an arbitrary /key response.
+ * Required nulls remain meaningful: a missing limit is not "unlimited". */
+export function parseOpenRouterKeyBudget(value: unknown): OpenRouterBudget | null {
+  const data = object(object(value)?.data);
+  if (!data || !Object.hasOwn(data, "usage") || !Object.hasOwn(data, "limit") || !Object.hasOwn(data, "limit_remaining") || !amount(data.usage) || !amount(data.limit) || !amount(data.limit_remaining)) return null;
+  const keyExpiresAt = timestamp(data.expires_at);
+  if (keyExpiresAt === undefined) return null;
+  let resetsAt: number | null = null;
+  // A future API may return a timestamp instead of the documented interval.
+  if (typeof data.limit_reset === "string" && data.limit_reset.includes("T")) {
+    const reset = timestamp(data.limit_reset);
+    if (reset === undefined) return null;
+    resetsAt = reset;
+  }
+  let effectiveBudget: number | null = null;
+  if (data.effective_budget !== undefined && data.effective_budget !== null) {
+    const budget = object(data.effective_budget);
+    if (!budget || !Object.hasOwn(budget, "remaining_usd") || !amount(budget.remaining_usd)) return null;
+    effectiveBudget = budget.remaining_usd;
+    const reset = timestamp(budget.resets_at);
+    if (reset === undefined) return null;
+    // This reset belongs to the effective, stricter budget when it binds.
+    if (effectiveBudget !== null && (data.limit_remaining === null || effectiveBudget < data.limit_remaining)) resetsAt = reset;
+  }
+  return { usage: data.usage, limit: data.limit, remaining: data.limit_remaining, effectiveBudget, resetsAt, keyExpiresAt };
+}
+
+function responseReason(status: number): CustomConnectionReason {
+  if (status === 401) return "unauthorized";
+  if (status === 402 || status === 403) return "forbidden";
+  if (status === 429) return "rate-limited";
+  return status >= 500 ? "upstream-error" : "wrong-protocol";
+}
+function failureReason(error: unknown): CustomConnectionReason {
+  if (error instanceof SafeHttpRefusal) {
+    if (error.reason === "non_public_address") return "private-address";
+    if (error.reason === "timeout") return "timeout";
+    if (error.reason === "response_too_large" || error.reason === "url") return "wrong-protocol";
+  }
+  return "unreachable";
+}
+export interface ReadOpenRouterBudgetOptions {
+  signal?: AbortSignal;
+  /** Tests inject transport; production always uses the DNS-pinned client. */
+  request?: typeof safeRequest;
+  now?: () => number;
+}
+
+/** Reads neither a caller-provided URL nor any redirect. No provider text,
+ * key, arbitrary object or exception escapes this boundary. */
+export async function readOpenRouterBudget(apiKey: string, options: ReadOpenRouterBudgetOptions = {}): Promise<OpenRouterBudgetResult> {
+  if (!apiKey || apiKey.length > 8192 || /[\s\u0000-\u001f\u007f]/.test(apiKey)) return { status: "error", reason: "unauthorized" };
+  if (options.signal?.aborted) return { status: "error", reason: "timeout" };
+  const controller = new AbortController();
+  const onAbort = (): void => controller.abort();
+  if (options.signal?.aborted) controller.abort();
+  else options.signal?.addEventListener("abort", onAbort, { once: true });
+  const timeout = setTimeout(() => controller.abort(), OPENROUTER_BUDGET_TIMEOUT_MS);
+  timeout.unref();
+  try {
+    const response = await (options.request ?? safeRequest)({
+      url: OPENROUTER_BUDGET_URL,
+      method: "GET",
+      headers: { Authorization: `Bearer ${apiKey}`, Accept: "application/json" },
+      signal: controller.signal,
+    }, { connectMs: 10_000, headersMs: OPENROUTER_BUDGET_TIMEOUT_MS, idleMs: OPENROUTER_BUDGET_TIMEOUT_MS, maxRequestBodyBytes: 0 });
+    if (response.status !== 200) {
+      response.body.destroy();
+      return { status: "error", reason: responseReason(response.status) };
+    }
+    const raw = await readSafeBody(response, OPENROUTER_BUDGET_MAX_BYTES);
+    const budget = parseOpenRouterKeyBudget(JSON.parse(raw.toString("utf8")) as unknown);
+    return budget ? { status: "ok", ...budget } : { status: "error", reason: "wrong-protocol" };
+  } catch (error) {
+    return { status: "error", reason: controller.signal.aborted ? "timeout" : error instanceof SyntaxError ? "wrong-protocol" : failureReason(error) };
+  } finally {
+    clearTimeout(timeout);
+    options.signal?.removeEventListener("abort", onAbort);
+  }
+}
+
+export interface OpenRouterBudgetAccount {
+  credentialId: string;
+  revision: string;
+  apiKey: string;
+}
+interface Watcher {
+  identity: OpenRouterBudgetAccount;
+  tasks: Set<string>;
+  controller: AbortController | null;
+  timer: ReturnType<typeof setTimeout> | null;
+  last: { observedAt: number; result: OpenRouterBudgetResult } | null;
+}
+export interface OpenRouterBudgetPollerOptions {
+  emit: (frame: OpenRouterBudgetFrame) => void;
+  read?: (apiKey: string, options: ReadOpenRouterBudgetOptions) => Promise<OpenRouterBudgetResult>;
+  now?: () => number;
+}
+
+function identityKey(account: Pick<OpenRouterBudgetAccount, "credentialId" | "revision">): string {
+  return `${account.credentialId}\u0000${account.revision}`;
+}
+
+export class OpenRouterBudgetPoller {
+  private readonly watchers = new Map<string, Watcher>();
+  private readonly tasks = new Map<string, Set<string>>();
+  private readonly lastPoll = new Map<string, number>();
+  private readonly pending = new Set<Promise<void>>();
+  private readonly now: () => number;
+  private readonly read: NonNullable<OpenRouterBudgetPollerOptions["read"]>;
+
+  constructor(private readonly options: OpenRouterBudgetPollerOptions) {
+    this.now = options.now ?? Date.now;
+    this.read = options.read ?? readOpenRouterBudget;
+  }
+
+  /** The caller passes only OpenRouter accounts from the task's OPEN current
+   * lease. Passing [] ends that task's references and aborts unused reads. */
+  sync(taskId: string, accounts: readonly OpenRouterBudgetAccount[]): void {
+    this.pruneCooldowns();
+    const next = new Map(accounts.map(account => [identityKey(account), account]));
+    const previous = this.tasks.get(taskId) ?? new Set<string>();
+    for (const key of previous) if (!next.has(key)) this.removeTask(key, taskId);
+    const keys = new Set<string>();
+    for (const [key, identity] of next) {
+      keys.add(key);
+      let watcher = this.watchers.get(key);
+      if (!watcher) {
+        watcher = { identity: { ...identity }, tasks: new Set(), controller: null, timer: null, last: null };
+        this.watchers.set(key, watcher);
+      }
+      const added = !watcher.tasks.has(taskId);
+      watcher.tasks.add(taskId);
+      if (added && watcher.last) this.report(taskId, watcher, watcher.last);
+      if (!watcher.timer && !watcher.controller) this.schedule(key, watcher);
+    }
+    if (keys.size) this.tasks.set(taskId, keys);
+    else this.tasks.delete(taskId);
+  }
+
+  /** Removal releases the key, aborts its request when unused, and prevents a
+   * late response from publishing under a subsequent run or revision. */
+  stop(taskId?: string): void {
+    if (taskId !== undefined) {
+      for (const key of this.tasks.get(taskId) ?? []) this.removeTask(key, taskId);
+      this.tasks.delete(taskId);
+      return;
+    }
+    for (const watcher of this.watchers.values()) {
+      if (watcher.timer) clearTimeout(watcher.timer);
+      watcher.controller?.abort();
+    }
+    this.watchers.clear();
+    this.tasks.clear();
+  }
+
+  async drain(): Promise<void> {
+    await Promise.all([...this.pending]);
+  }
+
+  private removeTask(key: string, taskId: string): void {
+    const watcher = this.watchers.get(key);
+    if (!watcher) return;
+    watcher.tasks.delete(taskId);
+    if (watcher.tasks.size) return;
+    if (watcher.timer) clearTimeout(watcher.timer);
+    watcher.controller?.abort();
+    this.watchers.delete(key);
+  }
+
+  private schedule(key: string, watcher: Watcher): void {
+    const last = this.lastPoll.get(key);
+    const delay = last === undefined ? 0 : Math.max(0, last + OPENROUTER_BUDGET_POLL_MS - this.now());
+    if (delay === 0) {
+      this.start(key, watcher);
+      return;
+    }
+    watcher.timer = setTimeout(() => {
+      watcher.timer = null;
+      if (this.watchers.get(key) === watcher) this.start(key, watcher);
+    }, delay);
+    watcher.timer.unref();
+  }
+
+  private start(key: string, watcher: Watcher): void {
+    if (this.watchers.get(key) !== watcher || watcher.controller) return;
+    const controller = new AbortController();
+    watcher.controller = controller;
+    this.lastPoll.set(key, this.now());
+    const operation = (async (): Promise<void> => {
+      let result: OpenRouterBudgetResult;
+      try { result = await this.read(watcher.identity.apiKey, { signal: controller.signal, now: this.now }); }
+      catch { result = { status: "error", reason: "unreachable" }; }
+      if (this.watchers.get(key) !== watcher || controller.signal.aborted) return;
+      const observation = { observedAt: this.now(), result };
+      watcher.last = observation;
+      for (const taskId of watcher.tasks) this.report(taskId, watcher, observation);
+    })();
+    this.pending.add(operation);
+    void operation.finally(() => {
+      this.pending.delete(operation);
+      if (this.watchers.get(key) === watcher) {
+        watcher.controller = null;
+        this.schedule(key, watcher);
+      }
+    });
+  }
+
+  private report(taskId: string, watcher: Watcher, observation: NonNullable<Watcher["last"]>): void {
+    try {
+      this.options.emit({ kind: "openrouter.budget", taskId, credentialId: watcher.identity.credentialId, revision: watcher.identity.revision, observedAt: observation.observedAt, ...observation.result });
+    } catch {
+      // A disconnected transport is not an upstream response and never logs a key.
+    }
+  }
+
+  private pruneCooldowns(): void {
+    const before = this.now() - OPENROUTER_BUDGET_POLL_MS;
+    for (const [key, at] of this.lastPoll) if (at <= before && !this.watchers.has(key)) this.lastPoll.delete(key);
+  }
+}