agentenv-framework 0.9.1501__tar.gz → 0.9.1502__tar.gz

{agentenv_framework-0.9.1501 → agentenv_framework-0.9.1502}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentenv-framework
-Version: 0.9.1501
+Version: 0.9.1502
 Summary: SDK and CLI for building, deploying and running agent environments and the tasks that grade agents in them.
 Project-URL: Homepage, https://www.agentenvframework.com
 Project-URL: Documentation, https://www.agentenvframework.com/docs
@@ -29,7 +29,7 @@ Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
 Classifier: Typing :: Typed
 Requires-Python: >=3.11.4
 Requires-Dist: a2a-sdk==0.3.26
-Requires-Dist: agentenv-framework-protocol[computer]==0.1.516
+Requires-Dist: agentenv-framework-protocol[computer]==0.1.517
 Requires-Dist: certifi>=2024.2.2
 Requires-Dist: click>=8.0.0
 Requires-Dist: cryptography>=42

{agentenv_framework-0.9.1501 → agentenv_framework-0.9.1502}/packages/agentenv-protocol/README.md

@@ -258,6 +258,16 @@ Code that names none runs under `client.authorized({env_url: client.control_head
 within it, a call to an address under `env_url` sends those headers. agent-env runs every task
 step, a verifier's `verify` included, under such a grant for each environment it deployed.
 
+The env gateway agent-env deploys in front of an environment's servers takes the same token in the
+same header, but for now checks it only on tool access (`POST /tools/disable`, `POST /tools/enable`)
+and on the writes of triggers and notifications (`/triggers/register`, `/triggers/remove`,
+`/triggers/clear`, `/notifications/config`, `/notifications/take`, `/notifications/clear`). A call to
+one of those without it gets 401 and `{"ok": false, "error": "this route takes the env's control
+token"}`. Its other routes, the clock's writes, the state reads, `/svc` and `/agentenv` among them,
+stay open while callers outside agent-env use them without the token. No card, the gateway's or an
+environment's, marks which routes take it: a client sends the token to every route but the MCP
+endpoint and the card, and an open route ignores it.
+
 ### Tool access without a gateway
 
 An environment agents reach directly, with no gateway in front, can enforce per-role tool access

{agentenv_framework-0.9.1501 → agentenv_framework-0.9.1502}/packages/agentenv-protocol/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "agentenv-framework-protocol"
-version = "0.1.516"
+version = "0.1.517"
 description = "Open data-plane protocol and server SDK for agent environments."
 readme = "README.md"
 license = "Apache-2.0"

{agentenv_framework-0.9.1501 → agentenv_framework-0.9.1502}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentenv-framework"
-version = "0.9.1501"
+version = "0.9.1502"
 description = "SDK and CLI for building, deploying and running agent environments and the tasks that grade agents in them."
 readme = "README.md"
 license = "Apache-2.0"
@@ -29,7 +29,7 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "agentenv-framework-protocol[computer]==0.1.516",  # a computer_driver env's put reads the driver class with it
+    "agentenv-framework-protocol[computer]==0.1.517",  # a computer_driver env's put reads the driver class with it
     "certifi>=2024.2.2",  # the public roots the local transfer CA's trust bundle carries
     "click>=8.0.0",
     "cryptography>=42",  # the local transfer CA

{agentenv_framework-0.9.1501 → agentenv_framework-0.9.1502}/src/agent_env/drivers/envs/agent-desktop/requirements-macos.txt

@@ -1,4 +1,4 @@
 # What a composed macOS computer installs into the driver's venv: the protocol with MacOSDriver, whose screen and input
 # need its macos extra, and the MCP client the forwarded tools reach agent-desktop's server with. A release pins it to
 # the version it ships. agent-desktop itself is its release's executable, whose sha256 the driver checks.
-agentenv-framework-protocol[computer,macos]==0.1.516
+agentenv-framework-protocol[computer,macos]==0.1.517

{agentenv_framework-0.9.1501 → agentenv_framework-0.9.1502}/src/agent_env/drivers/envs/agent-desktop/requirements-windows.txt

@@ -1,4 +1,4 @@
 # What a composed Windows computer installs into the driver's venv: the protocol with WindowsDriver, whose screen and
 # input need its windows extra, and the MCP client the forwarded tools reach agent-desktop's server with. A release pins
 # it to the version it ships. agent-desktop itself is its release's executable, whose sha256 the driver checks.
-agentenv-framework-protocol[computer,windows]==0.1.516
+agentenv-framework-protocol[computer,windows]==0.1.517

{agentenv_framework-0.9.1501 → agentenv_framework-0.9.1502}/src/agent_env/drivers/envs/agent-desktop/requirements.txt

@@ -1,4 +1,4 @@
 # What a composed Linux computer installs into the driver's venv: the protocol with X11Driver, whose screen and input
 # need its x11 extra, and the MCP client the forwarded tools reach agent-desktop's server with. A release pins it to the
 # version it ships. agent-desktop itself is its release's executables, whose sha256 the driver checks.
-agentenv-framework-protocol[computer,x11]==0.1.516
+agentenv-framework-protocol[computer,x11]==0.1.517

{agentenv_framework-0.9.1501 → agentenv_framework-0.9.1502}/src/agent_env/drivers/envs/codex-computer-use/requirements-macos.txt

@@ -1,4 +1,4 @@
 # What a composed macOS computer installs into the driver's venv: the protocol with MacOSDriver, whose screen and input
 # need its macos extra, and the MCP client the forwarded tools reach Codex's cua_repl server with. A release pins it to
 # the version it ships. The ChatGPT app is the pinned download, whose executables' sha256 the driver checks.
-agentenv-framework-protocol[computer,macos]==0.1.516
+agentenv-framework-protocol[computer,macos]==0.1.517

{agentenv_framework-0.9.1501 → agentenv_framework-0.9.1502}/src/agent_env/drivers/envs/codex-computer-use/requirements-windows.txt

@@ -1,4 +1,4 @@
 # What a composed Windows computer installs into the driver's venv: the protocol with WindowsDriver, whose screen and
 # input need its windows extra, and the MCP client the forwarded tools reach Codex's cua_repl server with. A release pins
 # it to the version it ships. The ChatGPT app is the pinned MSIX, whose executables' sha256 the driver checks.
-agentenv-framework-protocol[computer,windows]==0.1.516
+agentenv-framework-protocol[computer,windows]==0.1.517

{agentenv_framework-0.9.1501 → agentenv_framework-0.9.1502}/src/agent_env/drivers/envs/cua-driver/requirements-macos.txt

@@ -1,4 +1,4 @@
 # What a composed macOS computer installs into the driver's venv. A release pins agentenv-framework-protocol to the
 # version it ships, which serves the driver with agentenv_protocol.computer.serve. cua-driver itself is CuaDriver.app,
 # whose executable's sha256 the driver checks.
-agentenv-framework-protocol[computer]==0.1.516
+agentenv-framework-protocol[computer]==0.1.517

{agentenv_framework-0.9.1501 → agentenv_framework-0.9.1502}/src/agent_env/drivers/envs/cua-driver/requirements-omarchy.txt

@@ -2,6 +2,6 @@
 # the driver checks (EXECUTABLES["hyprland/amd64"]), with Omarchy's base carrying the Hyprland plugin it drives input
 # through; python-xlib, which driver.py imports on any Linux. A release pins agentenv-framework-protocol to the version
 # it ships.
-agentenv-framework-protocol[computer]==0.1.516
+agentenv-framework-protocol[computer]==0.1.517
 cua-driver==0.44.0
 python-xlib>=0.33,<0.34

{agentenv_framework-0.9.1501 → agentenv_framework-0.9.1502}/src/agent_env/drivers/envs/cua-driver/requirements-windows.txt

@@ -1,4 +1,4 @@
 # What a composed Windows computer installs into the driver's venv. A release pins agentenv-framework-protocol to the
 # version it ships, which serves the driver with agentenv_protocol.computer.serve. cua-driver itself is the release's
 # zip, unpacked beside the driver, whose executable's sha256 the driver checks.
-agentenv-framework-protocol[computer]==0.1.516
+agentenv-framework-protocol[computer]==0.1.517

{agentenv_framework-0.9.1501 → agentenv_framework-0.9.1502}/src/agent_env/drivers/envs/cua-driver/requirements.txt

@@ -1,6 +1,6 @@
 # What a composed computer installs into the driver's venv. A release pins agentenv-framework-protocol to the version
 # it ships, which serves the driver with agentenv_protocol.computer.serve. cua-driver's wheel carries its executable for
 # each arch, whose sha256 the driver checks; python-xlib keeps the characters typed text needs on X's keymap.
-agentenv-framework-protocol[computer]==0.1.516
+agentenv-framework-protocol[computer]==0.1.517
 cua-driver==0.38.0
 python-xlib>=0.33,<0.34

{agentenv_framework-0.9.1501 → agentenv_framework-0.9.1502}/src/agent_env/drivers/envs/macos-harness/requirements-macos.txt

@@ -1,5 +1,5 @@
 # What a composed macOS computer installs into the driver's venv: the protocol with MacOSDriver, whose screen and input
 # need its macos extra, and browser-use's macOS harness at the pinned version, whose skill's sha256 the driver checks.
 # A release pins the protocol to the version it ships.
-agentenv-framework-protocol[computer,macos]==0.1.516
+agentenv-framework-protocol[computer,macos]==0.1.517
 macos-harness==0.2.1

{agentenv_framework-0.9.1501 → agentenv_framework-0.9.1502}/src/agent_env/drivers/envs/page/requirements.txt

@@ -1,3 +1,3 @@
 # What a composed computer installs into the driver's venv. A release pins agentenv-framework-protocol to the version
 # it ships, which serves the driver with agentenv_protocol.computer.serve.
-agentenv-framework-protocol[computer]==0.1.516
+agentenv-framework-protocol[computer]==0.1.517

{agentenv_framework-0.9.1501 → agentenv_framework-0.9.1502}/src/agent_env/drivers/envs/reference/requirements.txt

@@ -1,3 +1,3 @@
 # What a composed computer installs into the driver's venv. A release pins agentenv-framework-protocol to the version
 # it ships, which serves the driver with agentenv_protocol.computer.serve, and X11Driver with its x11 extra.
-agentenv-framework-protocol[computer,x11]==0.1.516
+agentenv-framework-protocol[computer,x11]==0.1.517

{agentenv_framework-0.9.1501 → agentenv_framework-0.9.1502}/src/agent_env/env/gateway/constants.py

@@ -68,6 +68,7 @@ METHOD_RESET = "data/reset"
 METHOD_ADD = "data/add"
 METHOD_GET = "data/get"
 MCP_TRANSPORT = "mcp"
+CONTROL_TOKEN_ENV = "AGENTENV_CONTROL_TOKEN"
 
 # Env/gateway-level extensions the gateway itself owns (tool gating + triggers).
 EXT_DISABLE_TOOL_URI = "urn:agentenv:disable-tool/v1"
@@ -159,6 +160,14 @@ DEFAULT_ROLE = "default"
 WILDCARD = "*"
 TOOL_DISABLE_ACTION = "disable"
 TOOL_ENABLE_ACTION = "enable"
+# The harness's routes that take the deploy's control token: the ones that change tool access, triggers and
+# notifications. Every other route stays open for now, the clock's writes included: callers outside agent-env set the
+# clock over plain HTTP and don't send the token yet.
+CONTROL_ROUTES = frozenset({
+    f"/tools/{TOOL_DISABLE_ACTION}", f"/tools/{TOOL_ENABLE_ACTION}",
+    "/triggers/register", "/triggers/remove", "/triggers/clear",
+    "/notifications/config", "/notifications/take", "/notifications/clear",
+})
 
 
 class GatewayMode(str, Enum):

{agentenv_framework-0.9.1501 → agentenv_framework-0.9.1502}/src/agent_env/env/gateway/entrypoint.py

@@ -8,7 +8,8 @@ from urllib.parse import urlsplit
 import httpx
 
 from . import AGENT_ENV_GATEWAY_MCP_PORT, GatewayMode, InternalMCPServer
-from .constants import DEFAULT_MCP_SERVER_NAME, GATEWAY_PROVIDER_HEADERS_ENV, MCP_TRANSPORT, WELL_KNOWN_PATH
+from .constants import (CONTROL_TOKEN_ENV, DEFAULT_MCP_SERVER_NAME, GATEWAY_PROVIDER_HEADERS_ENV, MCP_TRANSPORT,
+                        WELL_KNOWN_PATH)
 from .gateway import Gateway, card_url
 
 logger = logging.getLogger(__name__)
@@ -215,6 +216,7 @@ if __name__ == "__main__":
         rest_proxy_urls=rest_proxy_urls,
         gateway_mode=gateway_mode,
         service_db_url=service_db_url,
+        control_token=os.environ.get(CONTROL_TOKEN_ENV),
         provider_headers=os.environ.get(GATEWAY_PROVIDER_HEADERS_ENV, "").split(","),
     )
     gateway.run()

{agentenv_framework-0.9.1501 → agentenv_framework-0.9.1502}/src/agent_env/env/gateway/gateway.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 
 import asyncio
 import atexit
+import hmac
 import json
 import logging
 import os
@@ -46,6 +47,7 @@ from .constants import (
     CHANGES_PAGE_DEFAULT,
     CHANGES_PAGE_MAX,
     CHILD_DISCOVERY_TIMEOUT_S,
+    CONTROL_ROUTES,
     DATA_PLANE_LOAD_TIMEOUT_MAX_S,
     DEFAULT_ROLE,
     EXT_WEBSITE_URI,
@@ -138,6 +140,7 @@ class Gateway:
         rest_proxy_urls: dict[str, str] | None = None,
         gateway_mode: GatewayMode = GatewayMode.PERFORMANCE,
         service_db_url: str | None = None,
+        control_token: str | None = None,
         provider_headers: Iterable[str] = (),
     ):
         """`provider_headers` names the headers the sandbox provider in front of the gateway is sent, its credentials,
@@ -159,6 +162,7 @@ class Gateway:
                 log.addFilter(TokenRedaction())
         self.gateway_mode = gateway_mode
         self._service_db_url = service_db_url
+        self._control_bearer = f"Bearer {control_token}".encode() if control_token else None
         self._website_routes: dict[str, list[WebsiteRoute] | None] = {}
         self._db_conn: psycopg2.extensions.connection | None = None
         if service_db_url:
@@ -451,14 +455,24 @@ class Gateway:
     # inherited). Process: child sessions and the time-trigger driver, outer to the MCP session manager's lifespan.
 
     def _asgi_app(self):
-        """The served app: FastMCP's Starlette app with the request's caller bound around it, and the process
-        lifespan wrapped around the MCP session manager's."""
+        """The served app: FastMCP's Starlette app with the request's caller bound around it, the control routes behind
+        the deploy's token when it has one, and the process lifespan wrapped around the MCP session manager's."""
         inner = self._mcp.streamable_http_app()
         inner.router.lifespan_context = self._process_lifespan(inner.router.lifespan_context)
         if self.rest_proxy_urls:
             inner.router.routes.append(WebSocketRoute(BROWSER_ROUTE, self._browsers.relay))
 
         async def app(scope, receive, send):
+            if self._control_bearer and scope["type"] in ("http", "websocket"):
+                headers = scope.get("headers", ())
+                if scope["type"] == "http" and scope["path"] in CONTROL_ROUTES and not hmac.compare_digest(
+                        dict(headers).get(b"authorization", b""), self._control_bearer):
+                    response = self._json_response({"ok": False, "error": "this route takes the env's control token"}, 401)
+                    await response(scope, receive, send)
+                    return
+                # The token is the gateway's own: no route reads it, and no service a route proxies to receives it.
+                scope = {**scope, "headers": [(name, value) for name, value in headers if not (
+                    name == b"authorization" and hmac.compare_digest(value, self._control_bearer))]}
             if scope["type"] != "http":
                 await inner(scope, receive, send)
                 return

{agentenv_framework-0.9.1501 → agentenv_framework-0.9.1502}/src/agent_env/env/published_images.json

@@ -1 +1 @@
-{"images":[{"repository":"ghcr.io/scaleapi/agentenv-browser-use","tag":"src-b31b0530e7413029c1b05e91bfafea1d05ca954b000bbb35d2524971787c5b75","digest":"sha256:ba6f591791ae86518733789d70631555237b1e1ed06e04319b535f5dcdf11fc3"},{"repository":"ghcr.io/scaleapi/agentenv-claude-code","tag":"src-8ee768350e2c1c0392e8e475caa9620918e5c2248f2bc7d7c8102832ad570fa9","digest":"sha256:6cd28556242fca105e33441a7612014d00953fdf914d91a56782a8f95e80e7f1"},{"repository":"ghcr.io/scaleapi/agentenv-codex","tag":"src-390f3aa530e92924b1da2e9a99cab3c8e360252ae04d4bccd9c5a368f872f1d8","digest":"sha256:246a0038834790aa5b93e22c74a568fd015a7d725daae743c40b70fae046b380"},{"repository":"ghcr.io/scaleapi/agentenv-db-mcp","tag":"src-8f8a64ea02549c388c26db342fc0798c7e809303f9ac42c7116eade52b96628b","digest":"sha256:44ded28ec1ee54e28561f167952dccfa08f5322bdb9db552a45dcb6233479e1e"},{"repository":"ghcr.io/scaleapi/agentenv-db-web","tag":"src-f993cd3a657cdfcc5d79f6935fb229422159853043908dc8db94306ea5660522","digest":"sha256:f0f8880cd5e69a775f2d3239d522a88d2a59664384d09f683aae46a0a97c6716"},{"repository":"ghcr.io/scaleapi/agentenv-disk-tools","tag":"src-83c15af52620c6648b7e7e345ecfb0adf36b8d92e389de143d8175c4001ab671","digest":"sha256:73f6469dac6937fcdc8f3c4e5437869e7103a6085f6966db7dadb344f2169c97"},{"repository":"ghcr.io/scaleapi/agentenv-gateway","tag":"src-237da26216163596560608091257828c91a64101a096d678f7b37e16ea305b55","digest":"sha256:b81e7d551c5a10fc75734198eff4302a2f7e1520e297a49b4cf4ed5d9732962a"},{"repository":"ghcr.io/scaleapi/agentenv-gemini","tag":"src-0c866dbfce13a762d8b99d708268338cad062dabc29a70c98858d3214ce50441","digest":"sha256:c3882e8b7b6f43b0398c7403473728e4ee3186836455a3737e56a46ab4c79214"},{"repository":"ghcr.io/scaleapi/agentenv-hermes","tag":"src-3e028a7a120f96033a77cd8d991579f6537c56405be4501879d09c9d9ed054bb","digest":"sha256:a987806de0441900404c638520d4750764116fa68b8ac0a2aee3c33710091d8d"},{"repository":"ghcr.io/scaleapi/agentenv-letta-code","tag":"src-47bc354f9ea8e2a9abfb7319b6bb6a789e5d220f16a2e31e6c3c864f9b015be6","digest":"sha256:cdfcc0a1ce43cd95ffaefe3d3f0ff7f56baeca7693f6de81ff00d31fdbc7c1e2"},{"repository":"ghcr.io/scaleapi/agentenv-mail-mcp","tag":"src-e2ca0f211a8b5537aac6d53d0afb4c16dea4f01a78459c9e1eed2b48f941a779","digest":"sha256:3d35069a7b7fb5982b22fa26cc6e414d3267bf26bf4dd2dad90c29637295d963"},{"repository":"ghcr.io/scaleapi/agentenv-opencode","tag":"src-06eaa84fc68e79f2cc6daeabb1f3ad04336f8f6164fcaad83d62132ffc38bd44","digest":"sha256:c30beaca7889e47642275f034af0c4d103ccde592de12dbd7ff9b2582d230549"},{"repository":"ghcr.io/scaleapi/agentenv-openhands","tag":"src-047f6eb1a42297c83c12b6f13b9cbbc34e580fe2aa744f69d0b8b178b257666b","digest":"sha256:6c7ef1a55def93f34322daac2662fc4d9577105b99d91fdfea8ac13fe4821100"},{"repository":"ghcr.io/scaleapi/agentenv-pi","tag":"src-da290feef8c3a0d04731c25c4f8341715165dc64b75bf33e5e89b3bf77a28edc","digest":"sha256:27223c8c362fc1f036d2d6f36d171f68399532a424d8b1931c493eb6826fc0bd"},{"repository":"ghcr.io/scaleapi/agentenv-playwright-mcp","tag":"src-5fecee7b755e09649cda81bace2566a4f5f41e206095f39da2acfa17ac459ade","digest":"sha256:5860038869ccbb5d6c7fb687d3bbcb956be17b2b61881e3f338729e9948d4103"},{"repository":"ghcr.io/scaleapi/agentenv-proxy","tag":"src-358fa814b6a10ced8f677f3b3219d536f3d186f07d9d0b38f1a9eef196221022","digest":"sha256:280cfa399620854a28c98f411f2891d22516bce632689e017cfbaefd47114680"},{"repository":"ghcr.io/scaleapi/agentenv-pydantic-ai","tag":"src-f16d381b984f40e598c17fd123493947dedec0b3fbe2c34e556f5f20bb3a8bf5","digest":"sha256:f1d7fa28a6947ce50e3e0000e0b166f7a4b89697b6fe16205bb3f359ca1bffa5"},{"repository":"ghcr.io/scaleapi/agentenv-qemu-launcher","tag":"src-571557e03fbe3d564fe8ff8c46c4084f9fc1eedd1402863e2e8a495ed2f739a5","digest":"sha256:45fce258145fa8e6c2ee1ce7fbe3916c31122c937619c33f27915cc3d22d3281"},{"repository":"ghcr.io/scaleapi/agentenv-service-db","tag":"src-0915035efbb2dc62c3e9b6e387a1acde56bd3401569904eab9a9e659d5482dc9","digest":"sha256:d257f65cce5a5568d44a5d72632fecd5c3d2e9de66a5be8991dac317de423ebb"},{"repository":"ghcr.io/scaleapi/agentenv-ubuntu-24.04-disk","tag":"src-c5b4624fdd69d25a271d40fd5f701ea46b2205dcb8266aa021de65e1b7917df0","digest":"sha256:76d05e2e8902def11a9490c7f8b0129ca825e60e601832492d991f383a159f8b"},{"repository":"ghcr.io/scaleapi/agentenv-ubuntu-24.04-headless","tag":"src-010feb4d0018425a3e0cd23c7b9bbf66690abb4c398d735dece09b841e2004a9","digest":"sha256:e06dfbe3e7500c036e0cb53d08b3350e1f3936cfcd9031ca8945d5da667b12ed"},{"repository":"ghcr.io/scaleapi/agentenv-ubuntu-24.04","tag":"src-4785ce75c3ec31f8d9aa0ae7d080fefbb0102676d109b9bbb258325bc6ef1c84","digest":"sha256:6ca7a10ae4fe739a793b2447ed789794cf2e6651bb2a098cecad2500cc4d6a1d"}]}
+{"images":[{"repository":"ghcr.io/scaleapi/agentenv-browser-use","tag":"src-b31b0530e7413029c1b05e91bfafea1d05ca954b000bbb35d2524971787c5b75","digest":"sha256:ba6f591791ae86518733789d70631555237b1e1ed06e04319b535f5dcdf11fc3"},{"repository":"ghcr.io/scaleapi/agentenv-claude-code","tag":"src-8ee768350e2c1c0392e8e475caa9620918e5c2248f2bc7d7c8102832ad570fa9","digest":"sha256:6cd28556242fca105e33441a7612014d00953fdf914d91a56782a8f95e80e7f1"},{"repository":"ghcr.io/scaleapi/agentenv-codex","tag":"src-390f3aa530e92924b1da2e9a99cab3c8e360252ae04d4bccd9c5a368f872f1d8","digest":"sha256:246a0038834790aa5b93e22c74a568fd015a7d725daae743c40b70fae046b380"},{"repository":"ghcr.io/scaleapi/agentenv-db-mcp","tag":"src-8f8a64ea02549c388c26db342fc0798c7e809303f9ac42c7116eade52b96628b","digest":"sha256:44ded28ec1ee54e28561f167952dccfa08f5322bdb9db552a45dcb6233479e1e"},{"repository":"ghcr.io/scaleapi/agentenv-db-web","tag":"src-f993cd3a657cdfcc5d79f6935fb229422159853043908dc8db94306ea5660522","digest":"sha256:f0f8880cd5e69a775f2d3239d522a88d2a59664384d09f683aae46a0a97c6716"},{"repository":"ghcr.io/scaleapi/agentenv-disk-tools","tag":"src-83c15af52620c6648b7e7e345ecfb0adf36b8d92e389de143d8175c4001ab671","digest":"sha256:73f6469dac6937fcdc8f3c4e5437869e7103a6085f6966db7dadb344f2169c97"},{"repository":"ghcr.io/scaleapi/agentenv-gateway","tag":"src-ab2552f5d467ee821c21fe34afcca3b5e13cfa855bacdefa626bf567a437223c","digest":"sha256:4e5d256429106a7c64d8ae1ed44025d895c2a1386b765e426095fe10fc1355cd"},{"repository":"ghcr.io/scaleapi/agentenv-gemini","tag":"src-0c866dbfce13a762d8b99d708268338cad062dabc29a70c98858d3214ce50441","digest":"sha256:c3882e8b7b6f43b0398c7403473728e4ee3186836455a3737e56a46ab4c79214"},{"repository":"ghcr.io/scaleapi/agentenv-hermes","tag":"src-3e028a7a120f96033a77cd8d991579f6537c56405be4501879d09c9d9ed054bb","digest":"sha256:a987806de0441900404c638520d4750764116fa68b8ac0a2aee3c33710091d8d"},{"repository":"ghcr.io/scaleapi/agentenv-letta-code","tag":"src-47bc354f9ea8e2a9abfb7319b6bb6a789e5d220f16a2e31e6c3c864f9b015be6","digest":"sha256:cdfcc0a1ce43cd95ffaefe3d3f0ff7f56baeca7693f6de81ff00d31fdbc7c1e2"},{"repository":"ghcr.io/scaleapi/agentenv-mail-mcp","tag":"src-e2ca0f211a8b5537aac6d53d0afb4c16dea4f01a78459c9e1eed2b48f941a779","digest":"sha256:3d35069a7b7fb5982b22fa26cc6e414d3267bf26bf4dd2dad90c29637295d963"},{"repository":"ghcr.io/scaleapi/agentenv-opencode","tag":"src-06eaa84fc68e79f2cc6daeabb1f3ad04336f8f6164fcaad83d62132ffc38bd44","digest":"sha256:c30beaca7889e47642275f034af0c4d103ccde592de12dbd7ff9b2582d230549"},{"repository":"ghcr.io/scaleapi/agentenv-openhands","tag":"src-047f6eb1a42297c83c12b6f13b9cbbc34e580fe2aa744f69d0b8b178b257666b","digest":"sha256:6c7ef1a55def93f34322daac2662fc4d9577105b99d91fdfea8ac13fe4821100"},{"repository":"ghcr.io/scaleapi/agentenv-pi","tag":"src-da290feef8c3a0d04731c25c4f8341715165dc64b75bf33e5e89b3bf77a28edc","digest":"sha256:27223c8c362fc1f036d2d6f36d171f68399532a424d8b1931c493eb6826fc0bd"},{"repository":"ghcr.io/scaleapi/agentenv-playwright-mcp","tag":"src-5fecee7b755e09649cda81bace2566a4f5f41e206095f39da2acfa17ac459ade","digest":"sha256:5860038869ccbb5d6c7fb687d3bbcb956be17b2b61881e3f338729e9948d4103"},{"repository":"ghcr.io/scaleapi/agentenv-proxy","tag":"src-358fa814b6a10ced8f677f3b3219d536f3d186f07d9d0b38f1a9eef196221022","digest":"sha256:280cfa399620854a28c98f411f2891d22516bce632689e017cfbaefd47114680"},{"repository":"ghcr.io/scaleapi/agentenv-pydantic-ai","tag":"src-f16d381b984f40e598c17fd123493947dedec0b3fbe2c34e556f5f20bb3a8bf5","digest":"sha256:f1d7fa28a6947ce50e3e0000e0b166f7a4b89697b6fe16205bb3f359ca1bffa5"},{"repository":"ghcr.io/scaleapi/agentenv-qemu-launcher","tag":"src-571557e03fbe3d564fe8ff8c46c4084f9fc1eedd1402863e2e8a495ed2f739a5","digest":"sha256:45fce258145fa8e6c2ee1ce7fbe3916c31122c937619c33f27915cc3d22d3281"},{"repository":"ghcr.io/scaleapi/agentenv-service-db","tag":"src-0915035efbb2dc62c3e9b6e387a1acde56bd3401569904eab9a9e659d5482dc9","digest":"sha256:d257f65cce5a5568d44a5d72632fecd5c3d2e9de66a5be8991dac317de423ebb"},{"repository":"ghcr.io/scaleapi/agentenv-ubuntu-24.04-disk","tag":"src-c5b4624fdd69d25a271d40fd5f701ea46b2205dcb8266aa021de65e1b7917df0","digest":"sha256:76d05e2e8902def11a9490c7f8b0129ca825e60e601832492d991f383a159f8b"},{"repository":"ghcr.io/scaleapi/agentenv-ubuntu-24.04-headless","tag":"src-010feb4d0018425a3e0cd23c7b9bbf66690abb4c398d735dece09b841e2004a9","digest":"sha256:e06dfbe3e7500c036e0cb53d08b3350e1f3936cfcd9031ca8945d5da667b12ed"},{"repository":"ghcr.io/scaleapi/agentenv-ubuntu-24.04","tag":"src-4785ce75c3ec31f8d9aa0ae7d080fefbb0102676d109b9bbb258325bc6ef1c84","digest":"sha256:6ca7a10ae4fe739a793b2447ed789794cf2e6651bb2a098cecad2500cc4d6a1d"}]}

{agentenv_framework-0.9.1501 → agentenv_framework-0.9.1502}/src/agent_env/examples/echo-mcp/envs/echo/requirements.txt

@@ -1,3 +1,3 @@
 # A release pins agentenv-framework-protocol to the version it was released with.
-agentenv-framework-protocol==0.1.516
+agentenv-framework-protocol==0.1.517
 mcp>=1.25,<2

{agentenv_framework-0.9.1501 → agentenv_framework-0.9.1502}/src/agent_env/examples/next-env-event/envs/inbox/requirements.txt

@@ -1,3 +1,3 @@
 # A release pins agentenv-framework-protocol to the version it was released with.
-agentenv-framework-protocol==0.1.516
+agentenv-framework-protocol==0.1.517
 mcp>=1.25,<2

{agentenv_framework-0.9.1501 → agentenv_framework-0.9.1502}/src/agent_env/providers/env_providers/env_gateway_provider.py

@@ -48,6 +48,8 @@ from agent_env.env.envs.service_db import (
     DB_WEB_PORT,
     PGWEB_SERVICE_NAME,
 )
+from agent_env.env.envs.computer.utils.boot import control_environment
+from agent_env.env.envs.computer.utils.boot import control_token as new_control_token
 from agent_env.providers.env_providers.constants import (
     AGENT_ENV_WEBSITE_BACKEND_PORT,
     AGENT_ENV_WEBSITE_BACKEND_SUFFIX,
@@ -140,6 +142,8 @@ class DeployedGateway:
     # The env card the readiness probe read, and when (ISO 8601, UTC).
     environment_card: dict | None = None
     environment_card_read_at_utc: str | None = None
+    # The token the gateway's control routes take, which the record keeps; None for a gateway started without one.
+    control_token: str | None = None
 
 
 @dataclass
@@ -313,6 +317,7 @@ class EnvironmentGatewayProvider(_SandboxEnvironmentProvider):
         extra_hosts: tuple[str, ...] = (),
         mcp_server_name: str | None = None,
         external_children: tuple[ExternalChild, ...] = (),
+        control_token: str | None = None,
     ) -> str:
         """Generate docker-compose.yml content for a gateway deployment onto a VM/laptop/arbitrary machine.
 
@@ -524,6 +529,7 @@ class EnvironmentGatewayProvider(_SandboxEnvironmentProvider):
             gateway_env.append(f"      - REST_PROXY_URLS={','.join(rest_proxy_urls)}")
         gateway_env.append(f"      - GATEWAY_MODE={gateway_mode.value}")
         gateway_env.append(f"      - SERVICE_DB_URL={state_provider.base_url(state_instance)}")
+        gateway_env.extend(f"      - {key}={value}" for key, value in control_environment(control_token).items())
         if provider_headers := sandbox_request_header_names():
             gateway_env.append(f"      - {GATEWAY_PROVIDER_HEADERS_ENV}={','.join(provider_headers)}")
         publish = host_port or (lambda port: port)
@@ -662,6 +668,7 @@ class EnvironmentGatewayProvider(_SandboxEnvironmentProvider):
             website_images=topology.website_images, mcp_server_name=topology.mcp_server_name, gateway_mode=gateway_mode,
             ttl_seconds=ttl_seconds, disk_size_gb=disk_size_gb, cpu=cpu, memory_mb=memory_mb, attribution=attribution,
             children=children,
+            control_token=new_control_token(),
         )
         return DeployedGatewayEnv(
             env_id=env.id,
@@ -678,6 +685,7 @@ class EnvironmentGatewayProvider(_SandboxEnvironmentProvider):
             website_frontend_urls=deployed.website_frontend_urls,
             gateway_mode=gateway_mode.value,
             env_state_instance_ids=deployed.env_state_instance_ids,
+            control_token=deployed.control_token,
         )
 
     async def create_gateway(
@@ -700,6 +708,7 @@ class EnvironmentGatewayProvider(_SandboxEnvironmentProvider):
         mcp_server_name: str | None = None,
         *,
         attribution: Optional[Attribution] = None,
+        control_token: str | None = None,
     ) -> DeployedGateway:
         """Create and start a gateway from explicit topology, for a caller that builds its own record rather than calling ``deploy()``.
 
@@ -713,13 +722,16 @@ class EnvironmentGatewayProvider(_SandboxEnvironmentProvider):
 
         ``mcp_server_name`` is the name the gateway presents on its card and as its MCP server; drawn as ``env`` +
         4 random digits when the env declares none; the record takes it from the gateway's card.
+
+        ``control_token`` is the token the gateway's control routes take, which the caller's record must keep; without one
+        they stay open.
         """
         return await self._launch(
             sandbox_provider, env_id, state_instance=state_instance, mcp_servers=mcp_servers, mcp_server_images=mcp_server_images,
             gateway_port=gateway_port, website_configs=website_configs, website_images=website_images,
             gateway_mode=gateway_mode, ttl_seconds=ttl_seconds, disk_size_gb=disk_size_gb, cpu=cpu, memory_mb=memory_mb,
             existing_sandbox=existing_sandbox, sidecars=sidecars, mcp_server_name=mcp_server_name,
-            attribution=attribution,
+            attribution=attribution, control_token=control_token,
         )
 
     async def _launch(self, sandbox_provider: SandboxProvider, env_id: str | None, *, mcp_server_name: str | None = None, **gateway) -> DeployedGateway:
@@ -779,6 +791,7 @@ class EnvironmentGatewayProvider(_SandboxEnvironmentProvider):
         sidecars: list[SidecarConfig] | None = None,
         mcp_server_name: str | None = None,
         children: "Callable[[Optional[str]], Awaitable[list[ExternalChild]]] | None" = None,
+        control_token: str | None = None,
     ) -> DeployedGateway:
         from agent_env.env.env import Env
         from agent_env.config import gateway_env_id, get_config, website_browser_env_id
@@ -871,6 +884,7 @@ class EnvironmentGatewayProvider(_SandboxEnvironmentProvider):
             host_ips=sandbox.host_ips,
             extra_hosts=sandbox.extra_hosts,
             mcp_server_name=mcp_server_name,
+            control_token=control_token,
         )
         compose_content = compose()
         logger.info(f"Generated docker-compose.yml:\n{_redact_compose_secrets(compose_content)}")
@@ -974,7 +988,7 @@ class EnvironmentGatewayProvider(_SandboxEnvironmentProvider):
             gateway_url=gateway_url, mcp_url=mcp_url, db_web_url=db_web_url, db_mcp_url=db_mcp_url,
             website_frontend_urls=website_frontend_urls, mcp_server_name=mcp_server_name,
             env_state_instance_ids=[state_instance.instance_id],
-            environment_card=card, environment_card_read_at_utc=card_read_at_utc,
+            environment_card=card, environment_card_read_at_utc=card_read_at_utc, control_token=control_token,
         )
 
     async def _deploy_via_containers(
@@ -992,6 +1006,7 @@ class EnvironmentGatewayProvider(_SandboxEnvironmentProvider):
         attribution: Optional[Attribution] = None,
         mcp_server_name: str | None = None,
         children: "Callable[[Optional[str]], Awaitable[list[ExternalChild]]] | None" = None,
+        control_token: str | None = None,
     ) -> DeployedGateway:
         from agent_env.env.env import Env
         from agent_env.config import gateway_env_id, get_config
@@ -1095,6 +1110,7 @@ class EnvironmentGatewayProvider(_SandboxEnvironmentProvider):
                 "GATEWAY_MODE": gateway_mode.value,
                 "SERVICE_DB_URL": self._state_provider.base_url(state_instance),
                 "MCP_SERVER_NAME": mcp_server_name or DEFAULT_MCP_SERVER_NAME,
+                **control_environment(control_token),
                 **({GATEWAY_PROVIDER_HEADERS_ENV: ",".join(names)} if (names := sandbox_request_header_names()) else {}),
             }
             gateway_sb = await sandbox_provider.create_container(
@@ -1129,6 +1145,7 @@ class EnvironmentGatewayProvider(_SandboxEnvironmentProvider):
                 env_state_instance_ids=[state_instance.instance_id],
                 environment_card=card,
                 environment_card_read_at_utc=card_read_at_utc,
+                control_token=control_token,
             )
         except Exception:
             await self.close()
@@ -1426,6 +1443,7 @@ class EnvironmentGatewayProvider(_SandboxEnvironmentProvider):
         existing_sandbox: Sandbox | None = None,
         sidecars: list[SidecarConfig] | None = None,
         mcp_server_name: str | None = None,
+        control_token: str | None = None,
         attribution: Optional[Attribution] = None,
         children: "Callable[[Optional[str]], Awaitable[list[ExternalChild]]] | None" = None,
     ) -> DeployedGateway:
@@ -1452,7 +1470,8 @@ class EnvironmentGatewayProvider(_SandboxEnvironmentProvider):
                 sandbox_provider, mcp_servers, mcp_server_images,
                 gateway_port=gateway_port, website_configs=website_configs, gateway_mode=gateway_mode,
                 ttl_seconds=ttl_seconds, disk_size_gb=disk_size_gb,
-                cpu=cpu, memory_mb=memory_mb, mcp_server_name=mcp_server_name, children=children, **deploy_kwargs,
+                cpu=cpu, memory_mb=memory_mb, mcp_server_name=mcp_server_name, children=children,
+                control_token=control_token, **deploy_kwargs,
             )
         earlier_sandbox = self._sandbox
         try:
@@ -1461,7 +1480,7 @@ class EnvironmentGatewayProvider(_SandboxEnvironmentProvider):
                 gateway_port=gateway_port, website_configs=website_configs, website_images=website_images,
                 gateway_mode=gateway_mode, ttl_seconds=ttl_seconds, disk_size_gb=disk_size_gb,
                 cpu=cpu, memory_mb=memory_mb, existing_sandbox=existing_sandbox, sidecars=sidecars,
-                mcp_server_name=mcp_server_name, children=children, **deploy_kwargs,
+                mcp_server_name=mcp_server_name, children=children, control_token=control_token, **deploy_kwargs,
             )
         except BaseException:
             await self._terminate_new_sandbox(earlier_sandbox=earlier_sandbox, existing_sandbox=existing_sandbox)

{agentenv_framework-0.9.1501 → agentenv_framework-0.9.1502}/tst/integration/env/gateway/gateway_test.py

@@ -709,7 +709,7 @@ async def test_gateway_with_single_mcp_server(mcp_server_envs, email_service_art
 
         # Role-based tool filtering: disable list_emails for "default" role, verify it's hidden from
         # default callers but still accessible to a non-default role; then re-enable and verify recovery.
-        async with httpx.AsyncClient() as client:
+        async with httpx.AsyncClient(headers=result.control_headers) as client:
             resp = await client.post(
                 f"{result.gateway_url}/tools/{TOOL_DISABLE_ACTION}",
                 json={"role": "default", "tools": ["list_emails"]},
@@ -785,7 +785,7 @@ async def test_gateway_with_single_mcp_server(mcp_server_envs, email_service_art
             assert "alex.chen@techcorp.com" in (await cli_session.call_tool("list_emails", {"folder_name": "INBOX"})).text
 
         # Re-enable: list_emails accessible to default role again
-        async with httpx.AsyncClient() as client:
+        async with httpx.AsyncClient(headers=result.control_headers) as client:
             resp = await client.post(
                 f"{result.gateway_url}/tools/{TOOL_ENABLE_ACTION}",
                 json={"role": "default", "tools": ["list_emails"]},
@@ -809,7 +809,7 @@ async def test_gateway_with_single_mcp_server(mcp_server_envs, email_service_art
 
         # Global disable (role="*"): tool should be hidden from every role, including never-seen ones,
         # and become visible to everyone again on global enable.
-        async with httpx.AsyncClient() as client:
+        async with httpx.AsyncClient(headers=result.control_headers) as client:
             resp = await client.post(
                 f"{result.gateway_url}/tools/{TOOL_DISABLE_ACTION}",
                 json={"role": "*", "tools": ["list_emails"]},
@@ -847,7 +847,7 @@ async def test_gateway_with_single_mcp_server(mcp_server_envs, email_service_art
                 tools_result = await session.list_tools()
                 assert "list_emails" not in [t.name for t in tools_result.tools]
 
-        async with httpx.AsyncClient() as client:
+        async with httpx.AsyncClient(headers=result.control_headers) as client:
             resp = await client.post(
                 f"{result.gateway_url}/tools/{TOOL_ENABLE_ACTION}",
                 json={"role": "*", "tools": ["list_emails"]},
@@ -866,7 +866,7 @@ async def test_gateway_with_single_mcp_server(mcp_server_envs, email_service_art
         # Override scenario: globally disable everything via the wildcard tool sentinel ("*"), then
         # re-enable everything for one specific role. Verifies (a) per-role allow beats global deny,
         # and (b) wildcard rules apply to all tools without snapshotting (future-tool semantic).
-        async with httpx.AsyncClient() as client:
+        async with httpx.AsyncClient(headers=result.control_headers) as client:
             resp = await client.post(
                 f"{result.gateway_url}/tools/{TOOL_DISABLE_ACTION}",
                 json={"role": "*", "tools": "*"},
@@ -2325,7 +2325,7 @@ async def test_gateway_with_agentenv_environment(agentenv_items_env, monkeypatch
 
         await _verify_list_tools(mcp_url=result.mcp_url, tool_verifier_callback=assert_list_items_present)
 
-        async with httpx.AsyncClient(timeout=30) as client:
+        async with httpx.AsyncClient(timeout=30, headers=result.control_headers) as client:
             r = await client.post(
                 f"{result.gateway_url}{disable_params['endpoint']}",
                 json={"role": "default", "tools": ["list_items"]},
@@ -2567,7 +2567,7 @@ async def test_gateway_triggers_extension(sandbox_provider, mcp_server_envs, ema
                                      "predicate": {"regex": r"alex\.chen@techcorp\.com"}}}]},
         ]
 
-        async with httpx.AsyncClient() as client:
+        async with httpx.AsyncClient(headers=result.control_headers) as client:
             # Baseline: pre-disable send_email for role default so the grant has a visible effect.
             r = await client.post(f"{gw}/tools/{TOOL_DISABLE_ACTION}",
                                   json={"role": "default", "tools": ["send_email"]}, timeout=30)
@@ -2734,7 +2734,7 @@ async def test_gateway_barrier_orders_a_templated_mirror(sandbox_provider, mcp_s
         result = await email_env.deploy()
         gw = result.gateway_url
 
-        async with httpx.AsyncClient() as client:
+        async with httpx.AsyncClient(headers=result.control_headers) as client:
             reg = await client.post(f"{gw}/triggers/register",
                                     json={"watch_roles": ["default"], "triggers": [mirror]}, timeout=30)
             assert reg.status_code == 200, f"register failed: {reg.status_code} {reg.text}"
@@ -2846,7 +2846,7 @@ async def test_gateway_trigger_rearms_after_a_failed_mirror(sandbox_provider, mc
         result = await email_env.deploy()
         gw = result.gateway_url
 
-        async with httpx.AsyncClient() as client:
+        async with httpx.AsyncClient(headers=result.control_headers) as client:
             reg = await client.post(f"{gw}/triggers/register",
                                     json={"watch_roles": ["default"], "triggers": [breaks]}, timeout=30)
             assert reg.status_code == 200, f"register failed: {reg.status_code} {reg.text}"
@@ -2918,7 +2918,7 @@ async def test_gateway_trigger_registration_is_fail_loud(sandbox_provider, mcp_s
         result = await email_env.deploy()
         gw = result.gateway_url
 
-        async with httpx.AsyncClient() as client:
+        async with httpx.AsyncClient(headers=result.control_headers) as client:
             # Force discovery, so the unknown-tool checks are live rather than skipped.
             lt = await client.post(f"{gw}/step", json={"action": "list_tools"}, timeout=30)
             assert "send_email" in [t["name"] for t in lt.json()["tools"]], lt.text
@@ -2953,7 +2953,7 @@ async def test_gateway_website_trigger_fires_on_a_request_through_the_website_pr
         card = await protocol_v1.get_card(gw)
         assert TRIGGER_WEBSITE in protocol_v1.extension_params(card, EXT_TRIGGERS_URI)["features"], card
 
-        async with httpx.AsyncClient() as client:
+        async with httpx.AsyncClient(headers=result.control_headers) as client:
             unknown = await client.post(f"{gw}/triggers/register", timeout=30, json={
                 "triggers": [{**visit, "when": {**visit["when"], "app": "calendar"}}]})
             assert unknown.status_code == 400 and "unknown website 'calendar'" in unknown.text, unknown.text
@@ -3007,7 +3007,7 @@ async def test_gateway_queued_trigger_is_not_reported_settled(sandbox_provider,
         result = await email_env.deploy()
         gw = result.gateway_url
 
-        async with httpx.AsyncClient() as client:
+        async with httpx.AsyncClient(headers=result.control_headers) as client:
             reg = await client.post(f"{gw}/triggers/register",
                                     json={"watch_roles": ["default"], "triggers": [slow]}, timeout=30)
             assert reg.status_code == 200, f"register failed: {reg.status_code} {reg.text}"
@@ -3105,7 +3105,7 @@ async def test_gateway_triggers_nl_executor(sandbox_provider, mcp_server_envs, e
         await email_env.load_environment_artifact(email_service_artifact)
         ctx = TaskStepContext(deployed_envs=[result], metadata={})
 
-        async with httpx.AsyncClient() as client:
+        async with httpx.AsyncClient(headers=result.control_headers) as client:
             # Lock the executor role to exactly one tool (deny-all, then allow send_email). Wrong
             # realizations become structurally impossible, and the executor's own call stays outside
             # watch_roles (no cascade).
@@ -3261,7 +3261,7 @@ async def test_gateway_clock_extension(sandbox_provider, mcp_server_envs):
         result = await env.deploy()
         gw = result.gateway_url
 
-        async with httpx.AsyncClient() as client:
+        async with httpx.AsyncClient(headers=result.control_headers) as client:
             # Off-by-default + unconditional advertisement.
             assert (await _read(client, gw)).status_code == 404, "unarmed clock should 404"
             card = (await client.get(f"{gw}/.well-known/agent-env.json", timeout=30)).json()
@@ -3286,6 +3286,16 @@ async def test_gateway_clock_extension(sandbox_provider, mcp_server_envs):
             assert GET_TIME not in (await _get_time_surfaces(client, gw, result.mcp_url)).mcp
             assert (await _read(client, gw)).status_code == 404, "rejected arm must not arm the clock"
 
+            # Without the deploy's control token, every control route refuses; the clock's routes and the reads stay open.
+            async with httpx.AsyncClient() as agent:
+                for method, path in (("POST", "/tools/enable"), ("POST", "/tools/disable"), ("POST", "/triggers/register"),
+                                     ("POST", "/triggers/remove"), ("POST", "/triggers/clear"),
+                                     ("POST", "/notifications/config"), ("POST", "/notifications/take"),
+                                     ("POST", "/notifications/clear")):
+                    refused = await agent.request(method, f"{gw}{path}", timeout=30, json={})
+                    assert refused.status_code == 401, (path, refused.text)
+                assert (await agent.get(f"{gw}/clock/time", timeout=30)).status_code == 404
+
             # Arm at t0a, rate=3600 (1 real s -> 1 virtual h); baseline near t0a.
             armed_at = time.monotonic()
             arm = await client.put(f"{gw}/clock/set-time", json={"virtual_time": t0a, "virtual_seconds_per_real_second": 3600}, timeout=30)
@@ -3455,7 +3465,7 @@ async def test_gateway_clock_rate_accuracy(sandbox_provider, mcp_server_envs):
     try:
         result = await env.deploy()
         gw = result.gateway_url
-        async with httpx.AsyncClient() as client:
+        async with httpx.AsyncClient(headers=result.control_headers) as client:
             for rate in rates:
                 arm = await client.put(f"{gw}/clock/set-time", json={"virtual_time": t0, "virtual_seconds_per_real_second": rate}, timeout=30)
                 assert arm.status_code == 200 and arm.json()["virtual_seconds_per_real_second"] == rate, f"rate={rate}: {arm.text}"
@@ -3528,7 +3538,7 @@ async def test_gateway_time_trigger_extension(sandbox_provider, mcp_server_envs)
     try:
         result = await env.deploy()
         gw = result.gateway_url
-        async with httpx.AsyncClient() as client:
+        async with httpx.AsyncClient(headers=result.control_headers) as client:
             # Pre-disable send_email so the flagship's permission mutation is observable.
             await client.post(f"{gw}/tools/{TOOL_DISABLE_ACTION}",
                               json={"role": "default", "tools": ["send_email"]}, timeout=30)
@@ -3624,7 +3634,7 @@ async def test_gateway_autonomous_time_trigger(sandbox_provider, mcp_server_envs
     try:
         result = await env.deploy()
         gw = result.gateway_url
-        async with httpx.AsyncClient() as client:
+        async with httpx.AsyncClient(headers=result.control_headers) as client:
             # rate 3600: 1 real s = 1 virtual h, so PT2H lands in ~2 real s and PT1H arrives ~1/real s.
             arm = await client.put(f"{gw}/clock/set-time",
                                    json={"virtual_time": t0, "virtual_seconds_per_real_second": 3600}, timeout=30)
@@ -5605,7 +5615,7 @@ async def _set_async_wait(result, tool_name, min_seconds, max_seconds=None, scal
 
 async def _clock_clear(result) -> None:
     """Disarm the gateway clock (POST /clock/clear); it then 404s on /clock/time."""
-    async with httpx.AsyncClient() as client:
+    async with httpx.AsyncClient(headers=result.control_headers) as client:
         r = await client.post(f"{result.gateway_url}/clock/clear", timeout=30)
         assert r.status_code == 200 and r.json()["armed"] is False, r.text