fix: route managed tools to owning Commons environment

Author: bashybaranaba

apps/api/src/routes/agentRuntime.ts

@@ -47,8 +47,10 @@ async function proxyAgentCommonsTools(
       body: { error: "Agent Commons service authorization is unavailable" },
     };
   }
+  const targetBaseUrl =
+    agent.commons.apiUrl?.replace(/\/$/, "") || AGC_BASE_URL;
   const response = await fetch(
-    `${AGC_BASE_URL}/v1/runtime/agents/${encodeURIComponent(
+    `${targetBaseUrl}/v1/runtime/agents/${encodeURIComponent(
       commons.agentId
     )}/tools${suffix}`,
     {

apps/api/src/routes/computers.ts

@@ -41,6 +41,7 @@ const AGC_URL = (
 
 type ComputerRequestBody = {
   agentCommonsId?: string;
+  agentCommonsApiUrl?: string | null;
   ownerUserId?: string | null;
   workspaceId?: string | null;
   computerId?: string;
@@ -65,6 +66,21 @@ type ComputerRequestBody = {
   };
 };
 
+function agentCommonsApiUrl(c: any, value: string | null | undefined): string {
+  if (c.get("authType") !== "service" || !value?.trim()) return AGC_URL;
+  const url = new URL(value.trim());
+  if (
+    url.protocol !== "https:" ||
+    url.username ||
+    url.password ||
+    url.search ||
+    url.hash
+  ) {
+    throw new Error("agentCommonsApiUrl must be an HTTPS API origin");
+  }
+  return url.origin;
+}
+
 function runtimeRequest(body: ComputerRequestBody) {
   const integrationPath = body.integrationPath ?? "native";
   if (!["native", "openclaw", "hermes", "guest"].includes(integrationPath)) {
@@ -433,6 +449,7 @@ router.post("/", async (c) => {
   if ("response" in verified) return verified.response;
 
   try {
+    const commonsApiUrl = agentCommonsApiUrl(c, body.agentCommonsApiUrl);
     const runtime = runtimeRequest(body);
     const tenant = await ensureCanonicalComputerTenant(verified.owner);
     const fleet = await ensureTenantComputerFleet({
@@ -462,12 +479,14 @@ router.post("/", async (c) => {
             fleetId: fleet._id,
             "compute.ownerUserId": verified.owner.ownerUserId,
             "compute.workspaceId": verified.owner.workspaceId,
+            "commons.apiUrl": commonsApiUrl,
             updatedAt: new Date(),
           },
         }
       );
       existing = {
         ...existing,
+        commons: { ...existing.commons, apiUrl: commonsApiUrl },
         tenantId: tenant._id,
         fleetId: fleet._id,
         compute: existing.compute
@@ -567,6 +586,7 @@ router.post("/", async (c) => {
             "config.nativeConfig": updated.config.nativeConfig,
             "config.openclawConfig": updated.config.openclawConfig,
             "config.hermesConfig": updated.config.hermesConfig,
+            "commons.apiUrl": commonsApiUrl,
             resourceProfile: updated.resourceProfile,
             resourceMode: updated.resourceMode,
             resourceSpec: updated.resourceSpec,
@@ -621,6 +641,7 @@ router.post("/", async (c) => {
       userId: verified.owner.ownerUserId,
       workspaceId: verified.owner.workspaceId ?? undefined,
       existingCommonsAgentId: agentCommonsId,
+      agentCommonsApiUrl: commonsApiUrl,
       fleet,
       role,
       systemPrompt:

apps/api/src/services/agentCommonsIdentity.ts

@@ -24,6 +24,7 @@ export function normalizeCommonsIdentity(
 
 	return {
 		agentId: runtimeId,
+		apiUrl: commons.apiUrl ?? null,
 		apiKey: null,
 		walletAddress: commons.walletAddress ?? null,
 		registryAgentId,
@@ -38,6 +39,7 @@ export async function persistNormalizedCommonsIdentity(agent: AgentDoc): Promise
 		{
 			$set: {
 				"commons.agentId": commons.agentId,
+				"commons.apiUrl": commons.apiUrl ?? null,
 				"commons.apiKey": null,
 				"commons.walletAddress": commons.walletAddress,
 				"commons.registryAgentId": commons.registryAgentId ?? null,

apps/api/src/services/provisioner.ts

@@ -70,6 +70,7 @@ export interface ProvisionAgentOptions {
   userId?: string;
   workspaceId?: string;
   existingCommonsAgentId?: string;
+  agentCommonsApiUrl?: string | null;
   fleet: FleetDoc;
   role: string;
   systemPrompt: string;
@@ -136,6 +137,7 @@ export async function provisionAgent(
   const commons = opts.existingCommonsAgentId
     ? {
         agentId: opts.existingCommonsAgentId,
+        apiUrl: opts.agentCommonsApiUrl ?? AGC_BASE_URL,
         ownerUserId: opts.userId ?? null,
         workspaceId: opts.workspaceId ?? null,
         apiKey: null,
@@ -145,6 +147,7 @@ export async function provisionAgent(
     : opts.integrationPath === "openclaw" || opts.integrationPath === "hermes"
     ? {
         agentId: null,
+        apiUrl: null,
         apiKey: null,
         walletAddress: null,
         registryAgentId: null,

apps/api/src/types.ts

@@ -107,6 +107,8 @@ export interface AgentDoc {
   tenantId: string;
   commons: {
     agentId: string | null;
+    /** Agent Commons API origin that owns this identity (staging or production). */
+    apiUrl?: string | null;
     ownerUserId?: string | null;
     workspaceId?: string | null;
     apiKey: string | null;