feat(agent-harness): secure billed model inference

[iscekic]

The current Quick Chat experience stays unchanged. This adds a protected model endpoint for the shared harness.

---

Summary

The new POST /api/internal/agent-harness/model route requires service authentication and agent-harness:model capabilities; Input and harnessModelScope bind requests to current primary authority.
proxyHarnessModel mints five-minute user tokens for the existing billed gateway, retaining policy checks, organization billing, and Quick Chat attribution.
Bounded streaming preserves progressive output, identifiers, cancellation, empty output, and sanitized failures; maxDuration permits 100 seconds around the 90-second request deadline.

Files

• apps/web/src/lib/agent-harness/model-gateway.ts — adds the server-only proxy and capability scope. Checks existing INTERNAL_API_SECRET with a timing-safe comparison and requires a Bearer capability; ordinary client tokens cannot authorize inference. Reads x-agent-harness-conversation-id, x-agent-harness-run-id, and x-agent-harness-operation-id. Validates bounded JavaScript Object Notation (JSON) bodies with strict 8-bit Unicode Transformation Format (UTF-8) decoding. Requires a nonempty trimmed model, messages, stream: true, and max_tokens between 1 and 8192. Allows optional n: 1 and function tools; rejects max_completion_tokens and plugins while retaining other completion fields. The scope includes the input digest, dispatch identity, model audience, definition version 1, and backend target. Delegates current grant, conversation, user, and membership checks to the existing authorizer. Creates a token with tokenSource: 'agent-harness' and posts the completion to /api/openrouter/chat/completions under existing APP_URL, with redirects disabled. The billed gateway retains eligibility, balance checks, free-model exceptions, bring-your-own-key exceptions, and charges. Uses the authorized organization instead of incoming attribution, sets FEATURE_HEADER to quick-chat, and maps identifiers to x-kilo-request, x-kilocode-taskid, and x-kilo-session. Composes boundedBody and streamHarnessModel with request cancellation, reader cancellation, the deadline, and no-store responses. Keeps server credentials out of returned headers, output, checkpoints, and logs. Shared messages classify access, limits, cancellation, invalid input/output, and availability failures. Invalid request UTF-8 returns 400; invalid upstream UTF-8 produces 422; transport failures return retryable 503. Marks only storage_unavailable errors as retryable.
• apps/web/src/app/api/internal/agent-harness/model/route.ts — adds the POST export through proxyHarnessModel and sets maxDuration to 100 seconds. Existing routes and stored formats remain unchanged.

Tests: 1 file added — apps/web/src/lib/agent-harness/model-gateway.test.ts (+268/−0 lines), with 27 focused cases. Covers authorization, inference validation, billing attribution, progressive output, both UTF-8 boundaries, sanitized transport errors, cancellation, and terminal-only empty output.
Generated: 0 files changed.

---

Verification

Manual and end-to-end (E2E) verification did not run because Worker composition and the completed runtime stack remain pending.

Visual Changes

Visual Changes: N/A

Reviewer Notes

Recorded checks and scope

• The supplied isolation evidence records 27 passing focused Jest cases and passing scoped formatting, lint, import, whitespace, and preservation checks.
• The recorded lint check reports zero warnings and errors.
• The mocked tests prove delegation and attribution, not real ledger writes or live provider behavior.
• This description round did not rerun product checks. No current-head continuous integration (CI) pass or final section acceptance exists.
• The additional 34 security cases belong to level 37 and are absent from this pull request.
• Worker composition remains a22; live proof remains a32 and the final tip E2E loop.

Human steps

No action is required before merge or after merge for this level.

• After merge, for full-stack deployment only: supply scoped Worker and web configuration.

Notes

• Runtime verification remains pending on the completed stack; this server-only level has no visual changes.
• Font-scaling variants, including large text and dynamic type: owner-descoped.
• Light, dark, and other theme variants, including variant-only geometry: owner-descoped.
• Visual contrast, scaled-text layout, and screen-reader presentation checks: owner-descoped.

Stacked PRs — merge bottom to top. Each level shows only its own diff.

Runtime verification (E2E, user advocacy, simplify) runs on the tip PR over every level.
Every level keeps its own checks, its own bot review, and its own threads; each one is answered on its own PR.
Each level is its own deliverable: it builds and passes its own checks alone.
A finding on a level is repaired on that level, then carried upward with stack.sh forward.

1. shared-agent-harness-3bb0 — chore(agent-harness): register workspaces and enforce CI boundaries #5632
2. shared-agent-harness-3bb0-s2 — feat(agent-harness): define portable domain and snapshots #5637
3. shared-agent-harness-3bb0-s3 — feat(agent-harness): define commands tools and permission policy #5639
4. shared-agent-harness-3bb0-s4 — feat(agent-harness): share client state and cursor recovery #5643
5. shared-agent-harness-3bb0-s5 — feat(agent-harness): persist command intents and execution receipts #5647
6. shared-agent-harness-3bb0-s6 — feat(db): add harness ingress grants and retirement fences #5655
7. shared-agent-harness-3bb0-s7 — feat(agent-harness): deliver legacy history and project durable text #5659
8. shared-agent-harness-3bb0-s8 — feat(agent-harness): authorize durable grants and registered clients #5662
9. shared-agent-harness-3bb0-s9 — feat(agent-harness): fence retirement and retry payload cleanup #5667
10. shared-agent-harness-3bb0-s10 — feat(agent-harness): persist authoritative state in SQLite #5675
11. shared-agent-harness-3bb0-s11 — feat(agent-harness): admit durable runs and revisioned commands #5678
12. shared-agent-harness-3bb0-s12 — feat(agent-harness): recover queued runs and stream checkpointed steps #5688
13. shared-agent-harness-3bb0-s13 — feat(agent-harness): resolve interactions and dispatch tools sequentially #5693
14. shared-agent-harness-3bb0-s14 — feat(agent-harness): fence designated client tool execution #5697
15. shared-agent-harness-3bb0-s15 — feat(agent-harness): synchronize durable snapshots and legacy history #5701
16. shared-agent-harness-3bb0-s16 — feat(agent-harness): reuse authorized invitations with durable replay #5704
17. shared-agent-harness-3bb0-s17 — feat(integrations): bound repository transport for harness reads #5710
18. shared-agent-harness-3bb0-s18 — feat(integrations): expose bounded authorized repository reads #5714
19. shared-agent-harness-3bb0-s19 — feat(agent-harness): expose named authorized resource reads #5718
20. shared-agent-harness-3bb0-s20 — feat(sessions): bound history transport for harness reads #5724
21. shared-agent-harness-3bb0-s21 — feat(agent-harness): read scoped Cloud Agent context and progress #5726
22. shared-agent-harness-3bb0-s22 — fix(agent-harness): preserve ordered Cloud Agent dispatch identity #5731
23. shared-agent-harness-3bb0-s23 — feat(agent-harness): hand coding work to authorized Cloud Agent sessions #5733
24. shared-agent-harness-3bb0-s24 — feat(agent-harness): authorize scoped MCP gateway connections #5737
25. shared-agent-harness-3bb0-s25 — feat(agent-harness): bound MCP gateway transport in the Worker #5740
26. shared-agent-harness-3bb0-s26 — feat(agent-harness): execute validated remote MCP tools #5743
27. shared-agent-harness-3bb0-s27 — refactor(exa): share provider dispatch and usage recording #5746
28. shared-agent-harness-3bb0-s28 — feat(agent-harness): authorize bounded web provider requests #5747
29. shared-agent-harness-3bb0-s29 — feat(agent-harness): normalize web sources and preserve citations #5749
30. shared-agent-harness-3bb0-s30 — feat(agent-harness): define closed internal operation contracts #5753
31. shared-agent-harness-3bb0-s31 — feat(agent-harness): authorize internal maintenance operations #5754
32. shared-agent-harness-3bb0-s32 — feat(agent-harness): authorize named Kilo operation dispatch #5755
33. shared-agent-harness-3bb0-s33 — feat(agent-harness): authorize internal provider operations #5757
34. shared-agent-harness-3bb0-s34 — feat(agent-harness): secure the internal operations endpoint #5758
35. shared-agent-harness-3bb0-s35 — feat(agent-harness): bound and sanitize model streams #5767
36. shared-agent-harness-3bb0-s36 — feat(agent-harness): secure billed model inference #5776 ← this PR
37. shared-agent-harness-3bb0-s37 — test(agent-harness): cover model gateway security boundaries #5777 (tip)

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (3 files)

• apps/web/src/app/api/internal/agent-harness/model/route.ts
• apps/web/src/lib/agent-harness/model-gateway.ts
• apps/web/src/lib/agent-harness/model-gateway.test.ts

---

_{Reviewed by grok-4.6 · Input: 117.3K · Output: 22.5K · Cached: 1.4M}

_{Review guidance: REVIEW.md from base branch shared-agent-harness-3bb0-s35}

[iscekic]

Closing: the owner stopped this workflow section. The branch is retained.