feat: make SRS endpoint and apiKey optional, fallback to server-side defaults

Author: patel-lyzr

examples/computeragent-server.ts

@@ -300,7 +300,7 @@ interface RunBody {
    */
   attachments?: Array<{ path: string; content: string; encoding?: "utf8" | "base64" }>;
   /** Per-tool-call policy enforcement (forwarded to the harness decider). */
-  policy?: { kind: "srs"; endpoint: string; apiKey: string; policyId: string; principalId: string };
+  policy?: { kind: "srs"; endpoint?: string; apiKey?: string; policyId: string; principalId: string };
 }
 
 interface ActiveRun {
@@ -705,7 +705,7 @@ interface SandboxBody {
   sessionId?: string;
   debug?: boolean;
   sessionStore?: { kind: string; options?: unknown };
-  policy?: { kind: "srs"; endpoint: string; apiKey: string; policyId: string; principalId: string };
+  policy?: { kind: "srs"; endpoint?: string; apiKey?: string; policyId: string; principalId: string };
   /** RBAC / multi-tenancy identity for observability — see RunBody.identity. */
   identity?: InvocationIdentity;
   /** Display name of the agent — recorded in the dashboard session index. */

packages/harness-server/src/services/create-session.ts

@@ -66,15 +66,29 @@ export async function createSession(
 
   // Build a policy decider from wire-side config. Only "srs" is supported
   // today — extend by branching on body.policy.kind here.
-  const policyDecider = body.policy
-    ? new SrsPolicyDecider({
-        kind: "srs",
-        endpoint: body.policy.endpoint,
-        apiKey: body.policy.apiKey,
-        policyId: body.policy.policyId,
-        principalId: body.policy.principalId,
-      })
-    : undefined;
+  //
+  // `endpoint`/`apiKey` may be omitted by the caller (e.g. an SDK that knows
+  // the binding but is never handed the SRS key). Fall back to this server's
+  // own SRS_BASE_URL / SRS_API_KEY env so the key stays server-side.
+  let policyDecider: SrsPolicyDecider | undefined;
+  if (body.policy) {
+    const endpoint = body.policy.endpoint ?? process.env["SRS_BASE_URL"];
+    const apiKey = body.policy.apiKey ?? process.env["SRS_API_KEY"];
+    if (!endpoint || !apiKey) {
+      throw BadRequest(
+        "SRS_NOT_CONFIGURED",
+        "policy is set but the SRS endpoint/apiKey is neither supplied in the " +
+          "request nor available via SRS_BASE_URL/SRS_API_KEY on the harness",
+      );
+    }
+    policyDecider = new SrsPolicyDecider({
+      kind: "srs",
+      endpoint,
+      apiKey,
+      policyId: body.policy.policyId,
+      principalId: body.policy.principalId,
+    });
+  }
 
   const session = new Session(
     sessionId,

packages/protocol/src/harness-rest.ts

@@ -81,12 +81,17 @@ export const CreateSessionBody = z.object({
    * tool call through it. Deny short-circuits the engine's permission
    * request with `behavior: "deny"` — no SSE round-trip to a client.
    *
-   * Currently supported: `{ kind: "srs", endpoint, apiKey, policyId, principalId }`.
+   * Currently supported: `{ kind: "srs", endpoint?, apiKey?, policyId, principalId }`.
+   *
+   * `endpoint`/`apiKey` are optional: a caller that only knows the binding
+   * (e.g. a client that fetched policyId/principalId from AgentOS but is never
+   * given the SRS key) may omit them, and the harness fills both from its own
+   * `SRS_BASE_URL` / `SRS_API_KEY` env. This keeps the SRS key server-side.
    */
   policy: z.object({
     kind: z.literal("srs"),
-    endpoint: z.string().min(1),
-    apiKey: z.string().min(1),
+    endpoint: z.string().min(1).optional(),
+    apiKey: z.string().min(1).optional(),
     policyId: z.string().min(1),
     principalId: z.string().min(1),
   }).optional(),

packages/sdk/src/types.ts

@@ -153,8 +153,10 @@ export interface ComputerAgentOptions {
    */
   readonly policy?: {
     readonly kind: "srs";
-    readonly endpoint: string;
-    readonly apiKey: string;
+    /** Optional — harness falls back to its own SRS_BASE_URL when omitted. */
+    readonly endpoint?: string;
+    /** Optional — harness falls back to its own SRS_API_KEY when omitted. */
+    readonly apiKey?: string;
     readonly policyId: string;
     readonly principalId: string;
   };