Reject direct first-party relay endpoints

Author: Gini

HANDOVER.md

@@ -43,7 +43,7 @@ The abstraction that enforces this: `server/runtime-adapter.ts` — the `Runtime
 | SSE streaming | `server/task-event-stream.ts` | Real |
 | Approval service | `server/wallet-approval-service.ts` | Real — wallet-gated approvals |
 | UI — cosmetic | `src/index.css`, `src/components/*` | Done — Claude-calibrated light mode, Inter font, cream palette |
-| Tests | `server/*.test.ts`, `src/components/*.test.ts`, `scripts/*.test.ts` | 252 tests passing |
+| Tests | `server/*.test.ts`, `src/components/*.test.ts`, `scripts/*.test.ts` | 256 tests passing |
 | Container | `Dockerfile`, `docker-compose.yml` | Local hardened image verified; SQLite volume only until Postgres/auth slices land |
 
 ### What is critically broken
@@ -74,7 +74,7 @@ Do not configure a direct Anthropic API key as a substitute for the relay. Local
 ```bash
 npm run check
 # = oxlint src server scripts
-# + vitest run (252 tests at this handover update)
+# + vitest run (256 tests at this handover update)
 # + tsc -b
 # + tsc -p tsconfig.server.json
 # + vite build

TODO.md

@@ -8,7 +8,7 @@
 >
 > **Current state**: The local-first foundation is substantially implemented: backend-offline recovery, truthful simulation labelling, durable SSE replay/reconnect, LiteLLM-only routing, provider-neutral runtime lifecycle, runtime health/routing, task workspaces, durable guidance queueing, assistant-ui conversation rendering, owner-scoped local auth, bounded MCP health/facade controls, and the initial skill marketplace boundary are in place. Remaining release blockers are live provider acceptance, Postgres/runtime deployment, sandbox attestation, production MCP secret brokering/external health attestation, document/provider/browser evidence, and the remaining professional-UI gates. See `HANDOVER.md` and `plan/00-gap-analysis.md`.
 >
-> **Release gate**: `npm run check` must stay green (oxlint + 252 vitest tests + tsc build + e2e harness typecheck) after every task.
+> **Release gate**: `npm run check` must stay green (oxlint + 256 vitest tests + tsc build + e2e harness typecheck) after every task.
 
 > **Current handover policy**: all model traffic must traverse the protected LiteLLM boundary. Direct first-party Anthropic API traffic is prohibited, not a fallback. The Claude SDK configuration now fails closed unless the server-controlled relay is configured; Codex/AgentCore remain blocked until their adapters also use the same boundary.
 

docs/IMPLEMENTATION-LOG.md

@@ -1,5 +1,11 @@
 # Implementation log
 
+## 2026-07-17 — fail closed on known first-party model endpoints
+
+- Expanded the shared `isLiteLlmRelayUrl` guard used by the Claude SDK and ONEComputer worker to reject known Anthropic, OpenAI, Bedrock, Gemini, Groq, Mistral, Cohere, xAI, and DeepSeek first-party hosts when they are mislabeled as LiteLLM relays.
+- Added regression coverage for OpenAI, Bedrock, Gemini, and Groq endpoints. A relay must remain an operator-controlled HTTP(S) endpoint without embedded credentials; the server never silently falls back to a first-party provider.
+- Focused provider tests, lint, build, and the full test suite pass (51 files / 256 tests).
+
 ## 2026-07-17 — enforce the hardened container contract in CI
 
 - Added a separate GitHub Actions container job that builds the multi-stage image, starts it with a read-only root filesystem, no-new-privileges, dropped capabilities, and an ephemeral writable data mount, then verifies `/api/health` and UID 10001.

server/claude-provider-config.test.ts

@@ -36,4 +36,13 @@ describe('Claude provider configuration', () => {
     expect(isLiteLlmRelayUrl('https://api.anthropic.com')).toBe(false)
     expect(isLiteLlmRelayUrl('https://relay.internal.example/v1')).toBe(true)
   })
+
+  it.each([
+    'https://api.openai.com/v1',
+    'https://bedrock-runtime.us-east-1.amazonaws.com',
+    'https://generativelanguage.googleapis.com/v1beta',
+    'https://api.groq.com/openai/v1',
+  ])('rejects known first-party provider relay URL %s', (url) => {
+    expect(isLiteLlmRelayUrl(url)).toBe(false)
+  })
 })

server/claude-provider-config.ts

@@ -6,6 +6,17 @@ export type ClaudeProviderConfig = {
 }
 
 const trimTrailingSlash = (value: string) => value.replace(/\/+$/, '')
+const firstPartyProviderHost = (hostname: string) => hostname === 'api.anthropic.com'
+  || hostname.endsWith('.anthropic.com')
+  || hostname === 'api.openai.com'
+  || hostname.endsWith('.openai.com')
+  || hostname === 'generativelanguage.googleapis.com'
+  || hostname === 'api.groq.com'
+  || hostname === 'api.mistral.ai'
+  || hostname === 'api.cohere.com'
+  || hostname === 'api.x.ai'
+  || hostname === 'api.deepseek.com'
+  || /^bedrock(?:-runtime)?\.[a-z0-9-]+\.amazonaws\.com$/.test(hostname)
 
 /**
  * A relay variable is not permission to call a provider directly. Keep the
@@ -17,7 +28,7 @@ export const isLiteLlmRelayUrl = (value: string): boolean => {
     const url = new URL(value)
     if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password) return false
     const hostname = url.hostname.toLowerCase()
-    return hostname !== 'api.anthropic.com' && !hostname.endsWith('.anthropic.com')
+    return !firstPartyProviderHost(hostname)
   } catch {
     return false
   }