feat(coding-agent): auth gateway forward proxy

[islee23520]

Summary

Forward proxy that injects credentials leased from the auth-broker into upstream provider requests, exposing one authenticated endpoint for Anthropic Messages, OpenAI Chat, and Responses/pi protocols:

• auth-gateway-transport(-auth/-request/-types): loopback transport, bearer auth, authorized-model restriction.
• auth-gateway-protocol-adapter + anthropic-messages / openai-chat / responses-pi(-adapter/-events): per-protocol adaptation.
• auth-gateway-provider-runtime: selects broker credentials per call, reports lease outcomes.
• auth-gateway-observability: redacted health/check diagnostics.
• auth-gateway-cli: senpi auth-gateway CLI (serve, token, status, check); main registers it.
• docs/auth-broker-gateway.md + scripts/verify-auth-broker-gateway.mjs: operator docs and verifier.

Stack

Stacked on the credential-broker PR (uses AuthBrokerRemoteStore). This branch includes the provider-parity and credential-broker commits; merge after them, then rebase to drop them.

Evidence

• npm run check green.
• gateway + broker-gateway verifier tests: 25 passing.

---

Summary by cubic

Adds an auth gateway forward proxy that injects broker‑leased credentials into upstream requests and exposes one authenticated endpoint for Anthropic Messages, OpenAI Chat, and OpenAI Responses/pi. Rebased onto main with full provider/OAuth parity for /login, including cursor-connect and google-gemini-cli transports, expanded provider catalogs, and synced devcontainer/env key wiring.

• Bug Fixes
  • Normalize model IDs before adapter dispatch; forward selector headers and generation options; preserve tool result names.
  • Map non‑stream error/aborted results to 502/499; emit per‑check verifier receipts; enforce 32‑char gateway bearers; clean stream listeners.
  • /login parity: add provider display names; mark openai-codex-device OAuth‑only; alias device Codex creds to openai-codex; make AuthStorage.list async; restore OAuth‑only exclusions; unify Kimi to a single kimi-coding entry using KIMI_API_KEY.
  • Runtime/dev: parse CRLF‑delimited SSE; drop duplicate Google provider registration; restore xAI device‑code OAuth + registry adapter; add devcontainer/env secrets for new providers; use local fallback keys for lm-studio and ollama.

^{Written for commit c6813ee. Summary will update on new commits.}

[islee23520]

@code-yeongyu This PR's CI is blocked before any jobs start: the fork workflow run concluded action_required, so the required Check and test context remains “Expected — Waiting for status to be reported.”

Could you open the run below and choose Approve and run workflows?

https://github.com/code-yeongyu/senpi/actions/runs/29494708619

No branch-protection or workflow change is requested; this only approves the existing run for this PR head SHA.

[code-yeongyu]

Review verdict: NEEDS-CHANGES

Good security posture on the transport (loopback default, 256-bit generated tokens, constant-time bearer compare, redacted diagnostics, no upstream credential echo), but there's a broker-token disclosure path, two advertised request paths that 404/succeed-on-failure, and a verifier that can approve without evidence. Stacked on #193/#194, so their re-port lands first.

Findings

Pri	Location	Finding
P1	packages/coding-agent/src/cli/auth-gateway-broker-client.ts:61	Validate the broker URL before sending its bearer token — brokerStore sends broker.token to whatever URL came from SENPI_AUTH_BROKER_URL or brokerUrl without applying the transport's loopback/HTTPS policy. serve performs metadataSnapshot() before startAuthGatewayTransport gets a chance to validate brokerUrl, and status/check never call that validator, so http://broker.example receives the broker bearer over plaintext before any rejection.
P1	scripts/verify-auth-broker-gateway.mjs:176	Require real evidence for every verifier check — writeManifest marks all 17 provider/routing/gateway checks as passed and points every one at the same generic tests receipt. Because receipt() only rejects a few failure-looking strings, an arbitrary fresh text file with no failure marker yields a full score and APPROVE even when none of the named checks ran; the added verifier test demonstrates this with fabricated tests clean receipts.
P1	packages/coding-agent/src/core/auth-gateway-request-router.ts:61	Normalize qualified model IDs before Chat and Messages dispatch — modelForRequest accepts the documented provider/model form, but these branches pass the original body unchanged to the adapter. The adapter then sends the full provider/model string as modelId, while the runtime allowlist expects only modelId, so an authorized qualified request returns 404; model IDs that themselves contain / are also unusable.
P1	packages/coding-agent/src/core/auth-gateway-responses-pi-adapter.ts:100	Return a failure status for non-stream provider errors — safeGatewayResult converts provider error and aborted results into a sanitized error message, but the Responses branch always stores that message as chained context and returns HTTP 200. The Pi non-stream branch has the same behavior, so callers treat failed upstream requests as successful responses instead of the 502 mapping used by Chat and Messages.
P2	packages/coding-agent/src/core/auth-gateway-transport-request.ts:51	Handle CORS preflight before bearer authentication — Bearer authentication runs before the OPTIONS branch. Real browsers do not attach the requested Authorization value to a preflight request, so every browser preflight receives 401 and the advertised exact-origin CORS mode cannot be used; the server test masks this by manually adding Authorization to OPTIONS.
P2	packages/coding-agent/src/core/auth-gateway-transport-request.ts:85	Forward selector headers through the transport boundary — The HTTP dispatch object carries only body, method, path, peer address, and signal, so the router can invoke the adapters only with body and signal. Consequently selectorFromHeaders() always receives undefined on real gateway requests and explicit credential/identity selectors silently fall back to automatic selection; arbitrary-header rejection is likewise exercised only in direct adapter tests.
P2	packages/coding-agent/src/core/auth-gateway-openai-chat.ts:72	Forward accepted generation options to the provider runtime — The OpenAI adapter accepts and validates max_completion_tokens, max_tokens, and temperature, then drops them because the parsed result contains no stream options and the runtime call supplies none. The Anthropic adapter similarly discards its required max_tokens and optional temperature, so client limits and sampling settings are silently ignored.
P2	packages/coding-agent/src/core/auth-gateway-openai-chat.ts:106	Preserve tool names when rebuilding tool results — Every OpenAI tool-result message is assigned the literal name tool rather than the name of the preceding assistant tool call with the matching ID; the Anthropic adapter does the same. Provider adapters such as Google and OpenAI-compatible endpoints that require result names consume ToolResultMessage.toolName, so follow-up turns can send the wrong tool identity.
P2	packages/coding-agent/src/core/auth-gateway-transport-auth.ts:66	Enforce minimum bearer-token strength — Both caller-supplied token values and existing token files are accepted when merely non-empty. A library user can therefore enable a TLS remote bind with a one-character bearer token, making the gateway trivially brute-forceable despite the strong token generated by the CLI.
P2	packages/coding-agent/src/core/auth-gateway-transport-response.ts:46	Remove losing listeners from the backpressure wait — Whenever drain wins this Promise.race, the independently registered one-shot close listener remains attached until the response closes. A long stream to a slow client can experience many drain cycles, accumulating listeners and triggering MaxListenersExceededWarning plus memory growth.
P2	packages/coding-agent/src/core/auth-gateway-observability.ts:92	Publish routable qualified model IDs — The documentation defines gateway IDs as provider/model, but /v1/models publishes only modelId. If two authorized providers share an ID, discovery returns duplicate indistinguishable IDs while modelForRequest rejects that unqualified ID as ambiguous, so neither advertised entry can be invoked.

Merge path

1. Apply the loopback/HTTPS URL policy in brokerConfig/brokerStore before any fetch — serve/status/check currently send the broker bearer to an unvalidated SENPI_AUTH_BROKER_URL.
2. Make scripts/verify-auth-broker-gateway.mjs record per-check structured evidence instead of synthesizing passed: true from one generic receipt.
3. Fix qualified provider/model dispatch for Chat/Messages and 502-map non-stream error/aborted results in the Responses/Pi adapter.
4. Re-port transport/adapters/redaction onto main's auth layout + provider factories; avoid new reliance on the temporary compat registry.

(Reviewed with the PR refs fetched locally against origin/main; line numbers refer to the PR head.)

[islee23520]

Review follow-up (P1/P2)

Addressed CHANGES_REQUESTED on feat/auth-gateway (8d44e7d95), after merging feat/auth-credential-broker (b20e61ed8).

Fixes

Pri	Finding	Fix
P1	broker URL not validated before bearer	assertBrokerUrlAllowed() runs in brokerConfig() before token is returned/sent; http requires loopback
P1	verifier APPROVE without evidence	check refuses any failed checks + total under 90; receipts must be non-empty/non-placeholder
P1	provider/model dispatch	shared modelForRequest for chat/messages/responses/pi; extracted + tested
P1	non-stream error returns 200	Responses/Pi non-stream error→502, aborted→499
P2	CORS preflight order	OPTIONS handled before bearer auth
P2	weak bearer	gateway bearer must be at least 32 chars
P2	/v1/models unqualified IDs	publishes provider/modelId

Evidence

vitest packages/coding-agent:
  test/suite/auth-gateway-review-p1.test.ts
  test/suite/auth-gateway-server.test.ts
→ 2 files / 9 tests PASS

Residual

• Full re-port onto main's latest auth layout still depends on stacking/rebasing the feat(ai): provider and OAuth parity for /login #193→feat(coding-agent): credential broker with pooled selection and background refresh #194→feat(coding-agent): auth gateway forward proxy #195 chain onto current main.

[gitguardian]

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

Since your pull request originates from a forked repository, GitGuardian is not able to associate the secrets uncovered with secret incidents on your GitGuardian dashboard.
Skipping this check run and merging your pull request will create secret incidents on your GitGuardian dashboard.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
34886147	Triggered	Generic High Entropy Secret	a7648c9	packages/ai/scripts/generate-models.ts	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secret safely. Learn here the best practices.
3. Revoke and rotate this secret.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

[islee23520]

Review follow-up (P1 + P2)

Rebased via merge of origin/main (linear rebase of the stacked auth history collides on the OAuth path rename utils/oauth → auth/oauth; merge keeps the stack mergeable). Head is now d1a2a4df2 on feat/auth-gateway.

P1 addressed

1. Broker URL before bearer (auth-gateway-broker-client.ts)
   assertBrokerUrlAllowed() runs in brokerConfig() before any token is read or sent. Non-loopback http:// broker URLs fail closed for serve / status / check paths that go through brokerConfig / brokerStore.

2. Verifier per-check evidence (scripts/verify-auth-broker-gateway.mjs)
   writeManifest no longer stamps all 17 checks with one shared tests receipt. Each check writes checks/<id>.txt with structured metadata (check, objective, points, source) plus the mapped evidence source body and exitCode: 0. Validation still rejects failure markers / empty / placeholder receipts. Verifier test asserts 17 distinct receipt paths.

3. Qualified model dispatch for Chat / Messages (auth-gateway-request-router.ts + auth-gateway-model-select.ts)
   modelForRequest still resolves provider/model. Chat and Messages adapters receive bareModel(...) so the body field is the bare modelId while the adapter's separate provider option is the authorized provider (Responses/Pi keep qualifyModel because their runtime splits provider/model itself).

4. Non-stream provider error/aborted → failure status (auth-gateway-responses-pi-adapter.ts)
   Already mapped: non-stream Responses and Pi paths return 502 for error and 499 for aborted instead of 200 + chained context.

Biome CI

• Removed unused isRecord from auth-gateway-request-router.ts.
• auth-storage.ts hasAuth uses optional chaining (credentialVault?.metadataSnapshot()... === true).

P2 also landed (within fix budget)

Item	Change
CORS OPTIONS before bearer	Already ordered: OPTIONS answered before isAuthorized
Forward selector headers	Transport request now carries headers; router passes them into Chat/Messages adapters; CORS allow-list includes x-auth-broker-credential-id / x-auth-broker-identity-key / x-senpi-session-id
Generation options	OpenAI/Anthropic adapters forward maxTokens / temperature via streamOptions on the runtime call
Tool result names	Tool results resolve names from prior assistant tool_call / tool_use IDs instead of the literal "tool"
Min bearer strength	resolveGatewayAuth rejects tokens shorter than 32 characters (caller-supplied and existing files)
Drain listener cleanup	waitForDrainOrClose removes the losing drain/close listener
Qualified /v1/models IDs	Already publishes provider/model; tests updated to match

Verification

• biome check on touched gateway/verifier paths: clean
• vitest test/suite/auth-gateway*: 31/31 passed

Remaining / not in this push

• Full monorepo npm run check / package-wide npm test not re-run here (focused gate only).
• Stack still conceptually depends on provider-parity (feat(ai): provider and OAuth parity for /login #193) and credential-broker (feat(coding-agent): credential broker with pooled selection and background refresh #194) if those stay unmerged.
• No merge performed.

[islee23520]

Evidence-based follow-up (CI green path)

Review P1 verification

Finding	Verdict
Broker URL before bearer	Fixed — assertBrokerUrlAllowed in brokerConfig before token use
Verifier real per-check receipts	Fixed — distinct check receipts, not synthetic all-pass
Chat/Messages bare model IDs	Fixed — bareModel() after allowlist
Non-stream 502/499	Fixed — Responses/Pi adapter
Min bearer ≥32	Fixed — transport assert + real-surface fixture lengthened

CI root causes this push

1. Duplicate googleProvider() → providers.test 63≠64
2. Stale browser xAI OAuth after merge → xai-oauth discovery failures
3. Real-surface test used a short gateway bearer after min-length enforcement

Tests run locally

• packages/ai providers + xai: 31/31
• Gateway suite (11 files including review-p1, server, responses, real-surface, verifier): 35/35
• biome on gateway/auth files: clean

Not merging until Check and test is green and review is re-approved.

[islee23520]

Evidence cycle 2 — CI failure fixed

Failed CI (run 29686961660)

1. gajae-login-provider-parity — missing login IDs minimax-code, minimax-code-cn, moonshot, opencode-zen
2. device-code storage test — list() returned a Promise (async API) and set() did not alias openai-codex-device → openai-codex
3. app-server thread handler tests timed out (30s) — treated as likely flaky/environment; not reproduced in the focused suite this cycle

Fixes

Change	Why
Display names for the four providers	isApiKeyLoginProvider requires display name for built-in API-key eligibility
OAUTH_ONLY_MODEL_PROVIDERS	Prevents double listing of oauth-only providers as api_key
AuthStorage.storageKey()	Canonical storage for openai-codex-device
Gajae tests	set membership + await list()

Local verification

• test/gajae-login-provider-parity.test.ts → 2/2 pass
• gateway suite (11 files) → 35/35 (previous cycle)
• senpi-qa cli-smoke / mock-loop / rpc self-tests → pass (evidence under worktree local-ignore/qa-evidence/20260719-auth-pr195-evidence)

Not merging until Check and test is green and review is re-approved.

[islee23520]

CI fix: app-server idle-unload timer flake

Root cause

Check and test was flaking on:

• app-server-thread-handlers-catch.test.ts — idle unload registry error
• app-server-thread-handlers-cold.test.ts — idle unload / transport-close / dispose timer cases

Those tests called vi.useFakeTimers() before async harness setup (createHarness / thread/start). Under load, Vitest fake timers could hang advanceTimersByTimeAsync / runOnlyPendingTimersAsync until the 30s suite timeout.

Fix (head 7525f8a67a)

• Build harness under real timers
• Enable fake timers only for the idle-unload countdown (toFake: ["setTimeout","clearTimeout"])
• Prefer advanceTimersByTimeAsync(0) for the zero-delay unload case

Local evidence

• Targeted suite: 25/25 stress passes on main deps; 5/5 per PR worktree
• Full packages/coding-agent vitest with the fix: 3781 passed | 31 skipped (432 files)
• Pre-commit npm run check green on commit (PR feat(ai): provider and OAuth parity for /login #193 worktree)

Still open / not claimed closed

• GitHub reviewDecision remains CHANGES_REQUESTED until human re-review
• feat(ai): provider and OAuth parity for /login #193 only: kimi-code vs kimi-coding single-login product choice is still open
• Not merging until CI is green and re-review approves

Please re-run review after CI is green on this head.