openrod 0.0.0 → 0.1.0

package/server/sandbox-identity.js

@@ -0,0 +1,14 @@
+import { userInfo } from 'node:os'
+import { identityContext } from './security.js'
+
+// This local console has no per-browser login. Attribute launches to its
+// configured operator, or the OS account running the server, never request data.
+export function sandboxIdentityLabels() {
+  const identity = identityContext.getStore()
+  if (identity) return { 'openshell.console/created-by': identity.uid, 'openshell.console/owner': identity.uid, 'openrod/org': identity.org }
+  const operator = process.env.OPENSHELL_CONSOLE_OPERATOR?.trim() || userInfo().username
+  return {
+    'openshell.console/created-by': operator,
+    'openshell.console/owner': operator,
+  }
+}

package/server/security.js

@@ -0,0 +1,139 @@
+import { verifyWorkerRequest } from './worker-auth.js'
+import { isIP } from 'node:net'
+import {createHash} from 'node:crypto'
+import { AsyncLocalStorage } from 'node:async_hooks'
+export function requestPath(req) {
+  if (typeof req.url !== 'string' || !req.url.startsWith('/') || req.url.startsWith('//') || req.url.includes('\\')) throw fail('Invalid request target', 400)
+  try { return new URL(req.url, 'http://local').pathname } catch { throw fail('Invalid request target', 400) }
+}
+export const identityContext = new AsyncLocalStorage()
+const fail = (message, status) => Object.assign(new Error(message), { status })
+export function isLocalApiRequest(req) {
+  const { host = '', origin, 'sec-fetch-site': site } = req.headers
+  return ['127.0.0.1', '::1', '::ffff:127.0.0.1'].includes(req.socket?.remoteAddress)
+    && /^(localhost|127\.0\.0\.1|\[::1\])(?::\d+)?$/.test(host)
+    && (origin === undefined || origin === `http://${host}`)
+    && (site === undefined || site === 'same-origin' || site === 'none')
+}
+export function cloudConfig(env = process.env) {
+  const mode = env.OPENROD_MODE ?? 'local'
+  if (!['local', 'cloud', 'worker'].includes(mode)) throw Error('OPENROD_MODE must be local, cloud or worker')
+  if (mode === 'local') return { mode }
+  if (mode === 'worker') {
+    if (!/^[a-f0-9]{64}$/.test(env.OPENROD_WORKER_KEY ?? '') || !env.OPENROD_WORKER_UID || !env.OPENROD_PUBLIC_ORIGIN) throw Error('Worker mode requires its owner, key and public origin')
+    const origin = new URL(env.OPENROD_PUBLIC_ORIGIN)
+    if (origin.protocol !== 'https:' || origin.origin !== env.OPENROD_PUBLIC_ORIGIN) throw Error('Invalid worker public origin')
+    return {mode, key: env.OPENROD_WORKER_KEY, owner: env.OPENROD_WORKER_UID, origin: origin.origin, host: origin.host}
+  }
+  for (const key of ['OPENROD_ORG_ID', 'OPENROD_PUBLIC_ORIGIN', 'GOOGLE_CLOUD_PROJECT', 'OPENROD_FIREBASE_API_KEY', 'OPENROD_FIREBASE_AUTH_DOMAIN']) if (!env[key]?.trim()) throw Error(`Cloud mode requires ${key}`)
+  if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(env.OPENROD_ORG_ID)) throw Error('Invalid OPENROD_ORG_ID')
+  if (!/^[a-z0-9.-]+$/i.test(env.OPENROD_FIREBASE_AUTH_DOMAIN) || !/^[a-z][a-z0-9-]{4,62}$/.test(env.GOOGLE_CLOUD_PROJECT)) throw Error('Invalid Identity Platform project or auth domain')
+  const origin = new URL(env.OPENROD_PUBLIC_ORIGIN)
+  if (origin.protocol !== 'https:' || origin.origin !== env.OPENROD_PUBLIC_ORIGIN || origin.username || origin.password) throw Error('OPENROD_PUBLIC_ORIGIN must be an HTTPS origin without a path')
+  if (env.FIREBASE_AUTH_EMULATOR_HOST) throw Error('Cloud mode cannot use the authentication emulator')
+  return { mode, org: env.OPENROD_ORG_ID, origin: origin.origin, host: origin.host, firebase: { apiKey: env.OPENROD_FIREBASE_API_KEY, authDomain: env.OPENROD_FIREBASE_AUTH_DOMAIN, projectId: env.GOOGLE_CLOUD_PROJECT } }
+}
+export async function firebaseAuth(config) {
+  const { initializeApp, getApps, applicationDefault } = await import('firebase-admin/app')
+  const { getAuth } = await import('firebase-admin/auth')
+  return getAuth(getApps()[0] ?? initializeApp({ credential: applicationDefault(), projectId: config.firebase.projectId }))
+}
+const COOKIE = '__Host-openrod_session'
+const cookieOf = req => (req.headers.cookie ?? '').split(';').map(s => s.trim()).find(s => s.startsWith(`${COOKIE}=`))?.slice(COOKIE.length + 1)
+export function createSecurity(config, auth, revocations = { has: () => false, add: () => { throw Error("Session revocation store is required") } }) {
+  const verified = new WeakMap()
+  const attempts = new Map()
+  const originFor = req => config.mode !== 'local' ? config.origin : `http://${req.headers.host}`
+  const checkBoundary = req => {
+    if (config.mode === 'local') { if (!isLocalApiRequest(req)) throw fail('Request rejected', 403); return }
+    const { host, origin, 'sec-fetch-site': site } = req.headers
+    if (host !== config.host || (req.headers.upgrade?.toLowerCase() === 'websocket' && origin !== config.origin) || (origin !== undefined && origin !== config.origin) || (site && !['same-origin', 'none'].includes(site)) || (req.method !== 'GET' && origin !== config.origin)) throw fail('Request rejected', 403)
+  }
+  const member = async decoded => {
+    const user = await auth.getUser(decoded.uid)
+    const claims = user.customClaims ?? {}
+    if (user.disabled || !user.emailVerified || !user.providerData?.some(p => p.providerId === 'google.com')) throw fail('Sign in with a verified Google account. Disabled accounts cannot access OpenRod Cloud.', 403)
+    return { uid: user.uid, email: user.email, org: config.org, role: claims.openrod_org === config.org && claims.openrod_role === 'admin' ? 'admin' : 'member', expires: decoded.exp * 1000 }
+  }
+  const authenticate = async req => {
+    checkBoundary(req)
+    if (config.mode === 'local') return null
+    if (config.mode === 'worker') {
+      const identity = verifyWorkerRequest(config.key, config.owner, req)
+      verified.set(req, identity)
+      return identity
+    }
+    const cookie = cookieOf(req)
+    if (!cookie || cookie.length > 10000 || revocations.has(cookie)) throw fail('Sign in to OpenRod Cloud', 401)
+    let decoded
+    try { decoded = await auth.verifySessionCookie(cookie, true) } catch { throw fail('Session expired. Sign in again.', 401) }
+    const identity = await member(decoded)
+    if (!Number.isFinite(identity.expires) || identity.expires <= Date.now()) throw fail('Session expired', 401)
+    verified.set(req, identity)
+    return identity
+  }
+  const isAllowed = req => config.mode === 'local' ? isLocalApiRequest(req) : verified.has(req)
+  const json = (res, status, value) => { res.writeHead(status, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' }); res.end(JSON.stringify(value)) }
+  const setCookie = (res, value, age) => res.setHeader('Set-Cookie', `${COOKIE}=${value}; Path=/; HttpOnly; Secure; SameSite=Strict; Max-Age=${age}`)
+  const middleware = async (req, res, next) => {
+    try {
+      const pathname = requestPath(req)
+      if (!pathname.startsWith('/api/')) return next()
+      checkBoundary(req)
+      if (pathname === '/api/auth/config' && req.method === 'GET') return json(res, 200, { mode: config.mode, ...(config.mode === 'cloud' ? { firebase: config.firebase } : {}) })
+      if (config.mode === 'cloud' && pathname === '/api/auth/session' && req.method === 'POST') {
+        if (req.headers['x-openshell-console'] !== '1' || req.headers['content-type'] !== 'application/json') throw fail('Request rejected', 403)
+        // nginx overwrites this header from the GCP-appended client address.
+        // Trust it only from our loopback proxy, never from an external socket.
+        const forwarded = req.headers['x-openrod-client-ip']
+        const loopback = ['127.0.0.1', '::1', '::ffff:127.0.0.1'].includes(req.socket.remoteAddress)
+        const key = loopback && typeof forwarded === 'string' && isIP(forwarded) ? forwarded : req.socket.remoteAddress
+        const now = Date.now()
+        if (attempts.size > 10000) for (const [ip, values] of attempts) if (!values.some(at => now-at < 60000)) attempts.delete(ip)
+        if (attempts.size > 20000 && !attempts.has(key)) throw fail('Too many sign-in attempts. Try again shortly.', 429)
+        const recent = (attempts.get(key) ?? []).filter(at => now-at < 60000)
+        if (recent.length >= 30) throw fail('Too many sign-in attempts. Try again shortly.', 429)
+        attempts.set(key, [...recent, now])
+        let raw = ''
+        for await (const chunk of req) { raw += chunk; if (Buffer.byteLength(raw) > 16000) throw fail('Request too large', 413) }
+        let token
+        try { token = JSON.parse(raw).idToken } catch { throw fail('Invalid request', 400) }
+        if (typeof token !== 'string') throw fail('Invalid request', 400)
+        let decoded
+        try { decoded = await auth.verifyIdToken(token, true) } catch { throw fail('Sign-in failed', 401) }
+        if (!Number.isFinite(decoded.auth_time) || now/1000-decoded.auth_time > 300 || decoded.auth_time > now/1000+30) throw fail('Please sign in again', 401)
+        if (decoded.firebase?.sign_in_provider !== 'google.com' || decoded.email_verified !== true) throw fail('Use a verified Google account to sign in.', 403)
+        const identity = await member(decoded)
+        const cookie = await auth.createSessionCookie(token, { expiresIn: 3600000 })
+        setCookie(res, cookie, 3600)
+        return json(res, 200, { user: identity })
+      }
+      if (config.mode === 'cloud' && pathname === '/api/auth/logout' && req.method === 'POST') {
+        if (req.headers['x-openshell-console'] !== '1') throw fail('Request rejected', 403)
+        setCookie(res, '', 0)
+        const cookie = cookieOf(req)
+        if (cookie) revocations.add(cookie, Date.now() + 3600000)
+        return json(res, 200, { ok: true })
+      }
+      const identity = await authenticate(req)
+      if (pathname === '/api/auth/me' && req.method === 'GET') return json(res, 200, { mode: config.mode, user: identity })
+      if (config.mode === 'cloud' && pathname.startsWith('/api/cloud/')) return identityContext.run(identity, next)
+      if (!pathname.startsWith('/api/os/')) return json(res, 404, { error: 'Not found' })
+      if (identity && req.method !== 'GET') console.info(JSON.stringify({ event: 'openrod.request', uid: identity.uid, org: identity.org, method: req.method, path: pathname }))
+      if (identity && pathname === '/api/os/stream') watch(req, res, identity)
+      identityContext.run(identity, next)
+    } catch (error) { json(res, error.status ?? 503, { error: error.status ? error.message : 'Authentication unavailable. Try again shortly.' }) }
+  }
+  function watch(req, target, identity) {
+    const expiry = setTimeout(() => target.destroy(), Math.max(1, identity.expires-Date.now()))
+    expiry.unref?.()
+    const check = config.mode === 'worker' ? null : setInterval(() => { authenticate(req).catch(() => target.destroy()) }, 60000)
+    check?.unref?.()
+    target.once('close', () => { clearTimeout(expiry); clearInterval(check) })
+  }
+  return { config, authenticate, isAllowed, originFor, middleware, watch, sessionHash: req => createHash('sha256').update(cookieOf(req) ?? '').digest('hex'), isSessionRevoked: hash => revocations.hasDigest?.(hash) ?? false }
+}
+export function assertCloudOperation(parts, input = {}) {
+  if (!identityContext.getStore()) return
+  if (parts[0] === 'local-folder' || parts[0] === 'editors' || (parts[0] === 'sandboxes' && ['editor', 'terminal'].includes(parts[2])) || (parts[0] === 'sandboxes' && parts.length === 1 && input?.folder)) throw fail('Host-local actions are unavailable in OpenRod Cloud. Use the browser terminal or upload files.', 403)
+}

package/server/session-revocations.js

@@ -0,0 +1,20 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import { createHash } from 'node:crypto'
+import { DatabaseSync } from 'node:sqlite'
+const digest = value => createHash('sha256').update(value).digest('hex')
+export function createSessionRevocations(filename) {
+  fs.mkdirSync(path.dirname(filename), { recursive: true, mode: 0o700 })
+  const db = new DatabaseSync(filename)
+  fs.chmodSync(filename, 0o600)
+  db.exec('PRAGMA journal_mode=WAL; CREATE TABLE IF NOT EXISTS revoked (hash TEXT PRIMARY KEY, expires INTEGER NOT NULL)')
+  return {
+    hasDigest: hash => Boolean(db.prepare('SELECT 1 FROM revoked WHERE hash=? AND expires>?').get(hash, Date.now())),
+    has: cookie => Boolean(db.prepare('SELECT 1 FROM revoked WHERE hash=? AND expires>?').get(digest(cookie), Date.now())),
+    add(cookie, expires) {
+      db.prepare('DELETE FROM revoked WHERE expires<=?').run(Date.now())
+      db.prepare('INSERT OR REPLACE INTO revoked VALUES (?, ?)').run(digest(cookie), expires)
+    },
+    close: () => db.close(),
+  }
+}

package/server/setup-artifact-installer.py

@@ -0,0 +1,54 @@
+"""Extract a verified package archive without executing its contents."""
+import hashlib, io, json, os, pathlib, shutil, sys, tarfile, tempfile
+root = pathlib.Path('/sandbox/.openshell/packages')
+try:
+    expected = sys.argv[1]
+    if len(expected) != 64 or any(c not in '0123456789abcdef' for c in expected): raise ValueError()
+    data = sys.stdin.buffer.read(100 * 1024 * 1024 + 1)
+    if len(data) > 100 * 1024 * 1024 or hashlib.sha256(data).hexdigest() != expected: raise ValueError()
+    for p in [pathlib.Path('/sandbox'), root.parent, root]:
+        if p.is_symlink(): raise ValueError()
+    root.mkdir(parents=True, exist_ok=True)
+    dest = root / expected
+    # Never trust a previously writable artifact; compare before replacing.
+    temp = pathlib.Path(tempfile.mkdtemp(prefix='.package-', dir=root))
+    try:
+        with tarfile.open(fileobj=io.BytesIO(data), mode='r:gz') as archive:
+            members = archive.getmembers()
+            if len(members) > 30000 or sum(m.size for m in members) > 200 * 1024 * 1024: raise ValueError()
+            seen = set()
+            for m in members:
+                name = pathlib.PurePosixPath(m.name)
+                if name.is_absolute() or '..' in name.parts or m.name in seen: raise ValueError()
+                seen.add(m.name)
+                if not (m.isfile() or m.isdir() or m.issym()): raise ValueError()
+                if m.issym():
+                    link = pathlib.PurePosixPath(m.linkname)
+                    if link.is_absolute() or not os.path.realpath(temp / name.parent / link).startswith(str(temp) + '/'): raise ValueError()
+            # Symlinks are written last; archive members never traverse links.
+            for m in sorted(members, key=lambda m: m.issym()):
+                p = temp / m.name
+                if not str(p.resolve()).startswith(str(temp) + '/') and p.resolve() != temp: raise ValueError()
+                if m.isdir(): p.mkdir(parents=True, exist_ok=True)
+                elif m.isfile():
+                    p.parent.mkdir(parents=True, exist_ok=True)
+                    with open(p, 'xb') as out: shutil.copyfileobj(archive.extractfile(m), out)
+                    p.chmod(0o700 if m.mode & 0o111 else 0o600)
+                else:
+                    p.parent.mkdir(parents=True, exist_ok=True); p.symlink_to(m.linkname)
+        if dest.exists() or dest.is_symlink():
+            # Avoid replacing code a running MCP may be using.
+            def inventory(base):
+                result = {}
+                for d, dirs, files in os.walk(base, followlinks=False):
+                    for n in dirs + files:
+                        p = pathlib.Path(d) / n; key = str(p.relative_to(base))
+                        result[key] = ('link', os.readlink(p)) if p.is_symlink() else ('dir', '') if p.is_dir() else ('file', hashlib.sha256(p.read_bytes()).hexdigest(), bool(p.stat().st_mode & 0o111))
+                return result
+            if dest.is_symlink() or inventory(dest) != inventory(temp): raise ValueError()
+        else: temp.rename(dest); temp = None
+    finally:
+        if temp: shutil.rmtree(temp)
+    print(json.dumps({'installed': expected}))
+except Exception:
+    print(json.dumps({'error': 'Package integrity, filesystem or archive validation failed.'})); sys.exit(1)

package/server/setup-artifacts.js

@@ -0,0 +1,23 @@
+import fs from 'node:fs/promises'
+import path from 'node:path'
+import { artifactFile } from './setup-packages.js'
+import { withSandboxInput } from './setup-transfer.js'
+import { fail } from './setup-discovery.js'
+const extractor = await fs.readFile(path.join(import.meta.dirname, 'setup-artifact-installer.py'), 'utf8')
+export async function installArtifacts(client, sandbox, items) {
+  for (const artifact of new Map(items.filter(i => i.artifact).map(i => [i.artifact.digest, i.artifact])).values()) {
+    const runtime = await client.sandbox.exec(sandbox.name, ['node', '-e', "console.log(JSON.stringify({arch:process.arch,platform:process.platform,major:process.versions.node.split('.')[0],glibc:Boolean(process.report.getReport().header.glibcVersionRuntime)}))"], {workspace:sandbox.workspace,noLoginShell:true,timeoutSecs:10})
+    let compatible = false
+    try { const env=JSON.parse(runtime.stdout.toString()); compatible = env.arch === artifact.arch && env.platform === 'linux' && env.major === artifact.node.split('.')[0] && env.glibc } catch {}
+    if (!compatible) throw fail('Prepared package needs Linux with glibc, Node.js 22 and the same CPU architecture as its builder. Rebuild for this target.',409)
+    if (!/^[a-f0-9]{64}$/.test(artifact.digest)) throw fail('Invalid package digest.',409)
+    const baked = `/sandbox/.openshell/bundles/${artifact.digest}.tar.gz`
+    const present = await client.sandbox.exec(sandbox.name, ['python3', '-c', 'import os,sys;sys.exit(0 if os.path.isfile(sys.argv[1]) else 1)', baked], { workspace:sandbox.workspace, noLoginShell:true, timeoutSecs:10 })
+    const extract = file => client.sandbox.exec(sandbox.name, ['python3', '-c', `import sys;sys.stdin=open(sys.argv[2], 'r');\n${extractor}`, artifact.digest, file], { workspace: sandbox.workspace, noLoginShell: true, timeoutSecs: 120 })
+    // Baked archives receive the same digest/traversal checks as uploaded ones.
+    const result = present.exitCode === 0 ? await extract(baked) : await withSandboxInput(client, sandbox, (await artifactFile(artifact)).data, extract)
+    let output
+    try { output = JSON.parse(result.stdout.toString()) } catch { throw fail('Prepared package could not be installed.', 409) }
+    if (result.exitCode !== 0 || output.error) throw fail(output.error || 'Prepared package could not be installed.', 409)
+  }
+}

package/server/setup-auth-discovery.js

@@ -0,0 +1,24 @@
+import { discoverOAuthServerInfo } from '@modelcontextprotocol/sdk/client/auth.js'
+import { oauthFetch, publicHTTPS } from './setup-http.js'
+// Metadata only. The sandbox's own harness owns authorization, tokens and
+// refresh. New sign-in hosts are proposed, never silently contacted or granted.
+export async function discoverSignIn(item) {
+  const allowed = new Set([new URL(item.config.url).hostname, ...item.requirements.filter(r => r.phase === 'auth').map(r => r.host)])
+  const pending = new Set()
+  let metadata
+  try {
+    metadata = await discoverOAuthServerInfo(item.config.url, { fetchFn: (url, init = {}) => {
+      if (init.method && init.method !== 'GET') throw new Error('Metadata discovery only permits GET')
+      return oauthFetch(url, init, allowed, pending)
+    } })
+  } catch { /* Unknown auth destinations remain explicit proposed requirements. */ }
+  const server = metadata?.authorizationServerMetadata
+  for (const value of [server?.authorization_endpoint, server?.token_endpoint, server?.registration_endpoint]) {
+    if (value) { try { const host = publicHTTPS(value).hostname; if (!allowed.has(host)) pending.add(host) } catch {} }
+  }
+  const requirements = [...item.requirements]
+  const mcpHost = new URL(item.config.url).hostname
+  if (!requirements.some(r => r.phase === 'auth' && r.host === mcpHost)) requirements.push({phase:'auth',host:mcpHost,port:443,path:'/.well-known/**',reason:'Sign-in details for this MCP.'})
+  for (const host of pending) if (!requirements.some(r => r.host === host && r.phase === 'auth')) requirements.push({ phase:'auth',host,port:443,reason:'Sign-in service for this MCP.' })
+  return { ...item, requirements, auth: {mode:'agent-session',status:'sign-in-required',discovery:server?'metadata-found':'destinations-proposed'} }
+}

package/server/setup-credentials.js

@@ -0,0 +1,54 @@
+import { randomUUID } from 'node:crypto'
+import { gateway } from './gateway.js'
+import { fail } from './setup-discovery.js'
+
+export async function connectCredentials(item, input = {}, source = {}) {
+  if (!item.credentialFields?.length) return item
+  const { client, workspace, workspaceScope } = await gateway()
+  const hosts = item.requirements.filter((r) => r.phase === 'runtime')
+  if (!hosts.length) throw fail('Enter where this MCP sends its credentials (for example api.github.com), then try the import again.')
+  let provider, aliases = {}
+  if (input.provider) {
+    if (!/^[a-z0-9][a-z0-9-]{0,61}$/.test(input.provider)) throw fail('Choose an existing OpenShell secret.')
+    const found = (await client.raw.getProvider({name:input.provider,workspaceScope})).provider
+    const profile = (await client.raw.getProviderProfile({id:found.type,workspaceScope})).profile
+    // Existing providers must be endpointless: otherwise attachment grants
+    // profile rules before the target-specific approval has been checked.
+    if (profile.endpoints?.length) throw fail('Use a dedicated MCP secret. This provider carries unrelated endpoint grants.')
+    for (const key of item.credentialFields) {
+      const alias = input.aliases?.[key] || key
+      if (!Object.hasOwn(found.credentials || {},alias)) throw fail(`The selected secret has no mapping for ${key}.`)
+      aliases[key] = alias
+    }
+    provider = input.provider
+  } else {
+    const values = { ...(input.useSourceSecrets === true ? source : {}), ...(input.secrets || {}) }
+    const credentials = {}, definitions = []
+    const suffix = randomUUID().replaceAll('-','').slice(0,16)
+    for (const key of item.credentialFields) {
+      const value = values[key]
+      if (typeof value !== 'string' || !value || value.length > 8192 || /[\r\n\x00]/.test(value)) throw fail(`Connect ${key} to continue.`)
+      const alias = `OS_MCP_${suffix.toUpperCase()}_${key.replace(/[^A-Z0-9_]/gi,'_').toUpperCase()}`
+      aliases[key]=alias; credentials[alias]=value
+      definitions.push({name:key.toLowerCase().replace(/[^a-z0-9_]/g,'_'),description:key,envVars:[alias],required:true})
+    }
+    provider='mcp-'+suffix
+    const profile={id:provider,displayName:`MCP: ${item.name}`,credentials:definitions,endpoints:[],binaries:[],annotations:{'openshell.console/managed':'setup-import'}}
+    const imported=await client.raw.importProviderProfiles({workspaceScope,profiles:[{profile}],requestId:randomUUID()})
+    if(!imported.imported)throw fail('The gateway does not support the required credential profile. No credentials were stored.')
+    try{await client.raw.createProvider({workspaceScope,requestId:randomUUID(),provider:{metadata:{name:provider},type:provider,profileWorkspace:workspace,credentials,config:{}}});
+
+    }
+    catch{await client.raw.deleteProvider({name:provider,workspaceScope}).catch(()=>{});await client.raw.deleteProviderProfile({id:provider,workspaceScope,allowMissing:true}).catch(()=>{});throw fail('The gateway could not store this MCP credential.')}
+  }
+  const config={...item.config}, env={...(config.env||{})}, headers={...(config.headers||{})}
+  for(const [key,alias] of Object.entries(aliases)){
+    const binding=item.credentialBindings?.[key]
+    const placeholder=`openshell:resolve:env:${alias}`
+    if(binding?.header) headers[binding.header]=(binding.prefix||'')+placeholder
+    else env[key]=placeholder
+  }
+  if(Object.keys(env).length)config.env=env
+  if(Object.keys(headers).length)config.headers=headers
+  return {...item,config,credentialRef:{provider,aliases},credentialFields:[],issues:item.issues.filter(i=>!i.startsWith('Connect credentials'))}
+}