Merge origin/main into chore/oss-cleanup-public

Resolves 9 conflicts arising from PR #10 (policy guardrails) landing on
main after this branch was cut. Strategy:

- Backend files where main has the real new policy feature (engine.ts,
  permission-bridge.ts, run-session.ts, sdk/src/types.ts, protocol/src/
  policy.ts, harness-server/services/srs-policy-decider.ts): took main's
  version, then re-applied the customer-name scrub on top (Lyzr SRS
  mentions, hardcoded srs-dev.test.studio.lyzr.ai URL).

- packages/sdk/src/types.ts: kept main's full ComputerAgentOptions
  (policy field with structured spec) AND added back the telemetry?
  field from the cleanup branch (AgentTelemetry hook). Both fields
  coexist.

- 5 source files (engine.ts, permission-bridge.ts, types.ts,
  run-session.ts, srs-policy-decider.ts) had stale
  'import from "@computeragent/protocol"' lines from PR #10 — that
  package name does not exist on public npm (the scope is unowned;
  d19ada7 renamed the workspace package to @open-gitagent/protocol).
  Updated all 5 imports to @open-gitagent/protocol, matching what the
  other 19 workspace packages already use.

- examples/agentos-api.ts: union-merged HEAD's cookie-session login +
  /me / /logout endpoints with main's SRS policy proxy block.
  Scrubbed LYZR_API_KEY env var → SRS_API_KEY, dropped hardcoded
  srs-dev.test.studio.lyzr.ai default (now requires explicit
  SRS_BASE_URL).

- agentos files (App.tsx, vite.config.ts): HEAD's shadcn-based version
  is strictly newer than main's hand-rolled one (Observability rail
  item, AgentCard import, full ui/* primitives). Took HEAD.

Verification:
  - pnpm -r build green across all 22 packages
  - 0 hits of {lyzr, nordstrom, clawagent, shreyas-lyzr} in source
    (excluding gitignored private.md / PLAN.md / docs.md, none of
    which make the public surface)

Author: kapaleshreyas

examples/agentos-api.ts

@@ -22,6 +22,7 @@ import { sandboxBodyForBot } from "./slack-bot.ts";
 import { AgentLogStore } from "./agent-log-store.ts";
 import { ScheduleStore, computeNextRun, describeSchedule, type ScheduleKind } from "./schedule-store.ts";
 import { runAgentOnce } from "./scheduler.ts";
+import { AgentPolicyStore } from "./agent-policy-store.ts";
 
 // ── Cookie-based session auth ───────────────────────────────────────────────
 // HMAC-signed cookie (no DB session table — stateless). Format:
@@ -135,6 +136,7 @@ export interface AgentOSOptions {
   readonly agents: readonly AgentDef[];
   readonly logStore: AgentLogStore;
   readonly scheduleStore?: ScheduleStore;
+  readonly policyStore?: AgentPolicyStore;
 }
 
 interface SessionDoc {
@@ -248,7 +250,7 @@ export function createAgentOSApp(opts: AgentOSOptions): Hono {
     const token = signSession(body.user, expMs);
     setCookie(c, SESSION_COOKIE, token, {
       httpOnly: true,
-      secure: true,            // Caddy terminates TLS so all real-world requests are https
+      secure: true,            // reverse proxy terminates TLS so all real-world requests are https
       sameSite: "Strict",
       maxAge: SESSION_MAX_AGE_SEC,
       path: "/",
@@ -275,6 +277,29 @@ export function createAgentOSApp(opts: AgentOSOptions): Hono {
   // Everything else under /agentos/api/* requires auth.
   app.use("/agentos/api/*", requireAuth);
 
+  // SRS (policy backend) — hoisted so the chat-sandbox handler and the
+  // policy-proxy routes share the same config.
+  const srsBase = (process.env.SRS_BASE_URL ?? "").replace(/\/+$/, "");
+  const srsKey = process.env.SRS_API_KEY ?? "";
+  const srsHeaders = (extra: Record<string, string> = {}): Record<string, string> => {
+    const h: Record<string, string> = { ...extra };
+    if (srsKey) h["x-api-key"] = srsKey;
+    return h;
+  };
+  const srsProxy = async (method: string, path: string, body?: unknown): Promise<Response> => {
+    if (!srsKey || !srsBase) {
+      return new Response(JSON.stringify({ error: { code: "SRS_NOT_CONFIGURED", message: "SRS_BASE_URL and SRS_API_KEY must be set" } }), { status: 503, headers: { "content-type": "application/json" } });
+    }
+    const init: RequestInit = {
+      method,
+      headers: srsHeaders(body !== undefined ? { "content-type": "application/json" } : {}),
+    };
+    if (body !== undefined) init.body = JSON.stringify(body);
+    const r = await fetch(`${srsBase}${path}`, init);
+    const text = await r.text();
+    return new Response(text, { status: r.status, headers: { "content-type": r.headers.get("content-type") ?? "application/json" } });
+  };
+
   // ── Agents list + per-agent stats ──────────────────────────────────────
   app.get("/agentos/api/agents", async (c) => {
     // Live sandboxes (loopback) — used to mark which agents have warm sessions.
@@ -629,9 +654,24 @@ export function createAgentOSApp(opts: AgentOSOptions): Hono {
     }
     if (!sessionId) sessionId = `agentos-${agent.name}-${randomUUID().slice(0, 12)}`;
 
+    // Lookup policy binding (if any) and translate to a sandbox policy spec.
+    let policySpec: { kind: "srs"; endpoint: string; apiKey: string; policyId: string; principalId: string } | undefined;
+    if (opts.policyStore && srsKey) {
+      const binding = await opts.policyStore.get(agent.name);
+      if (binding) {
+        policySpec = {
+          kind: "srs",
+          endpoint: srsBase,
+          apiKey: srsKey,
+          policyId: binding.policyId,
+          principalId: `agentos:${agent.name}`,
+        };
+      }
+    }
     const sandboxBody = sandboxBodyForBot(
       { name: agent.name, harness: agent.harness, source: agent.source, model: agent.model, extraEnvs: agent.envs, gitToken: agent.gitToken },
       sessionId,
+      policySpec,
     );
     const r = await fetch(`${caBase}/sandboxes`, {
       method: "POST",
@@ -831,6 +871,52 @@ export function createAgentOSApp(opts: AgentOSOptions): Hono {
     return c.json({ ok: true, running: true });
   });
 
+  // ── Policies — proxy SRS so the browser never sees SRS_API_KEY ─────────
+  //
+  // The external SRS (Service-RBAC-Service) owns policy CRUD. We forward
+  // GET/POST/PUT/DELETE on /v1/rai/policies, inject `x-api-key` server-side,
+  // and pass the body through unchanged. The dropdown on the agent screen
+  // uses GET /policies to populate; the policy editor uses POST/PUT.
+  app.get("/agentos/api/policies", async () => srsProxy("GET", "/v1/rai/policies"));
+  app.get("/agentos/api/policies/:id", async (c) => srsProxy("GET", `/v1/rai/policies/${encodeURIComponent(c.req.param("id"))}`));
+  app.post("/agentos/api/policies", async (c) => srsProxy("POST", "/v1/rai/policies", await c.req.json().catch(() => ({}))));
+  app.put("/agentos/api/policies/:id", async (c) => srsProxy("PUT", `/v1/rai/policies/${encodeURIComponent(c.req.param("id"))}`, await c.req.json().catch(() => ({}))));
+  app.delete("/agentos/api/policies/:id", async (c) => srsProxy("DELETE", `/v1/rai/policies/${encodeURIComponent(c.req.param("id"))}`));
+
+  // OPA rego policies — referenced by RAI policies' opa_guardrail.managed_policies[].policy_id.
+  app.get("/agentos/api/opa-policies", async () => srsProxy("GET", "/v1/opa-policies"));
+  app.get("/agentos/api/opa-policies/:id", async (c) => srsProxy("GET", `/v1/opa-policies/${encodeURIComponent(c.req.param("id"))}`));
+  app.post("/agentos/api/opa-policies", async (c) => srsProxy("POST", "/v1/opa-policies", await c.req.json().catch(() => ({}))));
+  app.put("/agentos/api/opa-policies/:id", async (c) => srsProxy("PUT", `/v1/opa-policies/${encodeURIComponent(c.req.param("id"))}`, await c.req.json().catch(() => ({}))));
+  app.delete("/agentos/api/opa-policies/:id", async (c) => srsProxy("DELETE", `/v1/opa-policies/${encodeURIComponent(c.req.param("id"))}`));
+
+  // ── Agent → policy binding (our own; lives in Mongo, not SRS) ───────────
+  //
+  // One policy_id per agent. The runtime reads this at sandbox-create time
+  // and feeds it into the SrsPolicyDecider that gates every tool call.
+  app.get("/agentos/api/agents/:name/policy", async (c) => {
+    if (!opts.policyStore) return c.json({ error: { code: "NO_POLICY_STORE" } }, 503);
+    if (!byName.has(c.req.param("name"))) return c.json({ error: { code: "UNKNOWN_AGENT" } }, 404);
+    const b = await opts.policyStore.get(c.req.param("name"));
+    return c.json({ binding: b });
+  });
+  app.put("/agentos/api/agents/:name/policy", async (c) => {
+    if (!opts.policyStore) return c.json({ error: { code: "NO_POLICY_STORE" } }, 503);
+    if (!byName.has(c.req.param("name"))) return c.json({ error: { code: "UNKNOWN_AGENT" } }, 404);
+    const body = await c.req.json().catch(() => ({})) as { policy_id?: string | null };
+    if (body.policy_id == null) {
+      await opts.policyStore.delete(c.req.param("name"));
+      return c.json({ binding: null });
+    }
+    const b = await opts.policyStore.set(c.req.param("name"), body.policy_id);
+    return c.json({ binding: b });
+  });
+  app.delete("/agentos/api/agents/:name/policy", async (c) => {
+    if (!opts.policyStore) return c.json({ error: { code: "NO_POLICY_STORE" } }, 503);
+    await opts.policyStore.delete(c.req.param("name"));
+    return c.json({ ok: true });
+  });
+
   app.get("/agentos/api/health", (c) => c.json({ ok: true, agents: opts.agents.map((a) => a.name) }));
 
   // ── Policies stubs ─────────────────────────────────────────────────────────

examples/slack-bot.ts

@@ -404,11 +404,23 @@ export interface AgentRuntimeSpec {
  * session store, S3 auto-save, TTLs) so the Slack flow and the AgentOS web console
  * create identically-configured sandboxes. Secrets stay server-side.
  */
-export function sandboxBodyForBot(bot: AgentRuntimeSpec, sessionId: string): Record<string, unknown> {
+export interface SandboxPolicySpec {
+  readonly kind: "srs";
+  readonly endpoint: string;
+  readonly apiKey: string;
+  readonly policyId: string;
+  readonly principalId: string;
+}
+
+export function sandboxBodyForBot(
+  bot: AgentRuntimeSpec,
+  sessionId: string,
+  policy?: SandboxPolicySpec,
+): Record<string, unknown> {
   const body: Record<string, unknown> = {
     source: bot.source,
     harness: bot.harness,
-    runtime: "bwrap",
+    runtime: process.env.DEFAULT_SANDBOX_RUNTIME ?? "bwrap",
     options: { permissionMode: "bypassPermissions", settingSources: ["project"] },
     sessionId,
     sessionStore: { kind: "mongo" },
@@ -421,6 +433,7 @@ export function sandboxBodyForBot(bot: AgentRuntimeSpec, sessionId: string): Rec
   };
   if (bot.model) body.model = bot.model;
   if (bot.gitToken) body.gitToken = bot.gitToken;
+  if (policy) body.policy = policy;
   return body;
 }
 

packages/engine-claude-agent-sdk/src/engine.ts

@@ -8,7 +8,7 @@ import type {
   UserMessage,
 } from "@open-gitagent/protocol";
 import { nopLogger } from "@open-gitagent/protocol";
-import { buildCanUseTool } from "./permission-bridge.js";
+import { buildCanUseTool, buildPreToolUseHook } from "./permission-bridge.js";
 import { deriveEngineUuid } from "./derive-uuid.js";
 
 const CAPABILITIES: EngineCapabilities = {
@@ -106,6 +106,14 @@ export class ClaudeAgentEngine implements EngineDriver<ClaudeAgentOptions> {
       includePartialMessages: true,
       abortController,
       canUseTool: buildCanUseTool(ctx.onPermissionRequest),
+      // PreToolUse hook — fires even in bypassPermissions mode (where canUseTool
+      // is skipped) and its deny overrides any other permission decision. The
+      // harness routes this to its policy decider; without one, the hook
+      // returns allow and falls through to canUseTool / the default flow.
+      hooks: {
+        ...((ctx.options as { hooks?: ClaudeAgentOptions["hooks"] }).hooks ?? {}),
+        PreToolUse: [{ hooks: [buildPreToolUseHook(ctx.onPermissionRequest)] }],
+      },
       ...(ctx.budget?.maxUsd !== undefined ? { maxBudgetUsd: ctx.budget.maxUsd } : {}),
       ...storeOpts,
     };
@@ -261,13 +269,7 @@ function signalToController(signal: AbortSignal): AbortController {
  *
  * Caller envs (api keys, etc.) override these on conflict.
  */
-/**
- * Pure: snapshot the env vars the spawned harness subprocess needs from the
- * parent process. Includes the standard POSIX/XDG essentials plus the AWS
- * Bedrock envs the Claude Agent SDK reads when `CLAUDE_CODE_USE_BEDROCK=1`.
- * Exported for testability — the engine itself calls it inline.
- */
-export function inheritEssentialHostEnv(): Record<string, string> {
+function inheritEssentialHostEnv(): Record<string, string> {
   const out: Record<string, string> = {};
   for (const k of [
     "HOME",
@@ -279,21 +281,6 @@ export function inheritEssentialHostEnv(): Record<string, string> {
     "CLAUDE_CONFIG_DIR",
     "XDG_CONFIG_HOME",
     "XDG_DATA_HOME",
-    // AWS Bedrock — when CLAUDE_CODE_USE_BEDROCK=1, the Claude Agent SDK
-    // switches transport to Bedrock and uses the standard AWS credential
-    // chain. On EKS that means the IRSA-projected web-identity token at
-    // AWS_WEB_IDENTITY_TOKEN_FILE + AWS_ROLE_ARN; locally it's the usual
-    // AWS_PROFILE / shared-credentials flow. Pass these through so the
-    // chain can find them inside the spawned harness subprocess.
-    "CLAUDE_CODE_USE_BEDROCK",
-    "AWS_REGION",
-    "AWS_DEFAULT_REGION",
-    "AWS_BEDROCK_MODEL_ID",
-    "AWS_ROLE_ARN",
-    "AWS_WEB_IDENTITY_TOKEN_FILE",
-    "AWS_PROFILE",
-    "AWS_SHARED_CREDENTIALS_FILE",
-    "AWS_CONFIG_FILE",
   ]) {
     const v = process.env[k];
     if (v) out[k] = v;

packages/engine-claude-agent-sdk/src/permission-bridge.ts

@@ -1,4 +1,4 @@
-import type { CanUseTool, PermissionResult } from "@anthropic-ai/claude-agent-sdk";
+import type { CanUseTool, HookCallback, PermissionResult } from "@anthropic-ai/claude-agent-sdk";
 import type { PermissionRequest } from "@open-gitagent/protocol";
 import { classifyRisk } from "./risk.js";
 
@@ -19,6 +19,43 @@ export function buildCanUseTool(
   };
 }
 
+/**
+ * PreToolUse hook bridge — fires for every tool call regardless of
+ * permissionMode (canUseTool is skipped in bypassPermissions, but
+ * PreToolUse hooks always run and their deny overrides canUseTool).
+ *
+ * The same `onPermissionRequest` callback is reused — the harness uses
+ * it for policy enforcement (SrsPolicyDecider gates here in
+ * bypassPermissions sandboxes).
+ */
+export function buildPreToolUseHook(
+  onPermissionRequest: (req: PermissionRequest) => Promise<PermissionResult>,
+): HookCallback {
+  return async (input, toolUseID) => {
+    if (input.hook_event_name !== "PreToolUse") return {};
+    const callId = toolUseID ?? `call_${cryptoRandomId()}`;
+    const toolName = input.tool_name;
+    const toolInput = input.tool_input;
+    const risk = classifyRisk(toolName, toolInput);
+    const decision = await onPermissionRequest({ callId, toolName, input: toolInput, risk });
+    if (decision.behavior === "deny") {
+      return {
+        hookSpecificOutput: {
+          hookEventName: "PreToolUse",
+          permissionDecision: "deny",
+          permissionDecisionReason: decision.message ?? "denied by policy",
+        },
+      };
+    }
+    return {
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "allow",
+      },
+    };
+  };
+}
+
 function cryptoRandomId(): string {
   return Math.random().toString(36).slice(2, 10);
 }

packages/protocol/src/policy.ts

@@ -54,7 +54,7 @@ export interface SrsPolicyConfig {
   readonly endpoint: string;
   /** x-api-key for SRS. Never leaves the harness. */
   readonly apiKey: string;
-  /** Policy id whose cedar_guardrail + opa_guardrail to apply. */
+  /** RAI policy_id whose cedar_guardrail + opa_guardrail to apply. */
   readonly policyId: string;
   /** Forwarded to SRS as the `principal_id` for audit. */
   readonly principalId: string;