fix(restricted-network): allowlist an agent's own service host (#989)

A tbh trial on a restricted task failed at the first model call with
'failed to fetch model catalog: transport error ... https://api.meta.ai/
muse-code/models'. The allowlist held only api.ai.meta.com, derived from
the meta/ model prefix, because host inference assumes an agent talks to
the endpoint its model id names.

That holds for every agent that calls the provider directly, but tbh
fronts the model through Meta's own service, so its host follows from the
AGENT rather than the model. Cursor has the same property and is handled
by a cursor/ model prefix; tbh has no such prefix, since its models are
ordinary meta/ ids.

Adds an agent-keyed host map unioned into the single-container
restricted-phase allowlist. A caller-supplied endpoint (base_url kwarg or
TBH_BASE_URL) is added alongside the default rather than replacing it, so
pointing at staging cannot silently un-allowlist a production fallback.

Co-authored-by: Cursor Agent <cursoragent@cursor.com>

Author: RishiDesai

oddish/src/oddish/workers/harbor/model_hosts.py

@@ -105,6 +105,15 @@
 # api5), and the installer is intentionally unpinned. Use Cursor's official
 # domain boundary instead of encoding ephemeral transport hostnames.
 _CURSOR_RUNTIME_HOSTS = ("*.cursor.sh",)
+# tbh (published as ``muse``) reaches Meta through its own service rather than
+# the OpenAI-compatible model API, so its host does not follow from the model
+# id the way every other agent's does: a ``meta/`` model resolves
+# ``api.ai.meta.com`` while the harness dials ``api.meta.ai`` for its model
+# catalog and inference. Keyed on the AGENT, unlike the cursor arm below, which
+# is keyed on a ``cursor/`` model prefix.
+TBH_BASE_URL_KEYS = ("TBH_BASE_URL",)
+_TBH_RUNTIME_HOSTS = ("api.meta.ai",)
+_AGENT_RUNTIME_HOSTS: dict[str, tuple[str, ...]] = {"tbh": _TBH_RUNTIME_HOSTS}
 
 _DEFAULT_BEDROCK_REGION = "us-east-1"
 _BEDROCK_STS_DOMAINS = ("sts.amazonaws.com",)
@@ -177,6 +186,50 @@ def _default_host(url: str) -> str | None:
     return _host_from_url(url)
 
 
+def agent_runtime_hosts(
+    *,
+    agent_name: str | None,
+    import_path: str | None = None,
+    agent_kwargs: Mapping[str, Any] | None = None,
+    agent_env: Mapping[str, str] | None = None,
+) -> list[str]:
+    """Hosts an agent's OWN service needs, independent of the model provider.
+
+    Model-derived hosts cover every agent that talks to the provider endpoint
+    the model id names. An agent that fronts its own service needs its host
+    added on top, or a restricted trial's allowlist is missing the only host
+    the harness actually dials. A caller-supplied endpoint (the ``base_url``
+    kwarg or ``TBH_BASE_URL``) is added alongside rather than replacing the
+    default, so pointing at a staging endpoint cannot silently drop the
+    production one a fallback might still use.
+    """
+    key = (agent_name or "").strip().lower()
+    if not key and import_path:
+        # Oddish wrappers null the name and set an import path instead.
+        key = import_path.rsplit(":", 1)[-1].strip().lower()
+    hosts = list(_AGENT_RUNTIME_HOSTS.get(key, ()))
+    if not hosts:
+        return []
+
+    override: Any = None
+    if isinstance(agent_kwargs, Mapping):
+        override = agent_kwargs.get("base_url")
+        extra_env = agent_kwargs.get("extra_env")
+        if not override and isinstance(extra_env, Mapping):
+            override = next(
+                (extra_env.get(k) for k in TBH_BASE_URL_KEYS if extra_env.get(k)), None
+            )
+    if not override and isinstance(agent_env, Mapping):
+        override = next(
+            (agent_env.get(k) for k in TBH_BASE_URL_KEYS if agent_env.get(k)), None
+        )
+    if isinstance(override, str):
+        host = _host_from_url(override)
+        if host:
+            hosts.append(host)
+    return list(dict.fromkeys(hosts))
+
+
 def outbound_hosts_for_model(
     model_name: str | None,
     *,

oddish/src/oddish/workers/harbor/runner.py

@@ -61,6 +61,7 @@
 from .model_hosts import (
     GEMINI_BASE_URL_KEYS,
     GEMINI_OAUTH_ENV_KEYS,
+    agent_runtime_hosts,
     outbound_hosts_for_model,
 )
 from .redaction import redact_exact_text, redact_exact_value
@@ -974,11 +975,22 @@ def _inject_restricted_agent_model_hosts(
     if resolved_env:
         agent_kwargs["extra_env"] = resolved_env
     inferred_hosts = normalize_allowed_hosts(
-        outbound_hosts_for_model(
-            agent_config.model_name,
-            agent_env=resolved_env,
-            agent_kwargs=agent_kwargs,
-        )
+        [
+            *outbound_hosts_for_model(
+                agent_config.model_name,
+                agent_env=resolved_env,
+                agent_kwargs=agent_kwargs,
+            ),
+            # An agent that fronts its own service dials a host the model id
+            # does not name; without this the allowlist holds only the model
+            # API and the harness cannot reach its own endpoint.
+            *agent_runtime_hosts(
+                agent_name=agent_config.name,
+                import_path=agent_config.import_path,
+                agent_kwargs=agent_kwargs,
+                agent_env=resolved_env,
+            ),
+        ]
     )
     agent_config.extra_allowed_hosts = list(
         dict.fromkeys([*agent_config.extra_allowed_hosts, *inferred_hosts])

oddish/tests/test_model_hosts.py

@@ -1,4 +1,7 @@
-from oddish.workers.harbor.model_hosts import outbound_hosts_for_model
+from oddish.workers.harbor.model_hosts import (
+    agent_runtime_hosts,
+    outbound_hosts_for_model,
+)
 
 
 def test_outbound_hosts_follow_model_not_agent_env_shape():
@@ -98,3 +101,42 @@ def test_bare_classifier_only_provider_infers_host_opt_in_only():
     # path leaves it empty (no widening).
     assert outbound_hosts_for_model("grok-4", infer_bare_provider=True) == ["api.x.ai"]
     assert outbound_hosts_for_model("grok-4") == []
+
+
+def test_tbh_gets_its_own_service_host_which_the_model_id_never_names():
+    # Regression: a meta/ model resolves the OpenAI-compatible model API
+    # (api.ai.meta.com) while the tbh harness dials api.meta.ai for its model
+    # catalog and inference. A trial allowlisted from the model id alone failed
+    # with "failed to fetch model catalog: transport error".
+    assert outbound_hosts_for_model("meta/striking_tomcat172") == ["api.ai.meta.com"]
+    assert agent_runtime_hosts(agent_name="tbh") == ["api.meta.ai"]
+
+
+def test_agent_runtime_hosts_are_empty_for_provider_talking_agents():
+    # Every other agent reaches the endpoint its model id names, so it must not
+    # gain a host here.
+    assert agent_runtime_hosts(agent_name="claude-code") == []
+    assert agent_runtime_hosts(agent_name="codex") == []
+    assert agent_runtime_hosts(agent_name=None) == []
+
+
+def test_a_custom_endpoint_is_added_alongside_the_default():
+    # Added rather than substituted: a fallback to the production endpoint
+    # must not be silently un-allowlisted by pointing at staging.
+    assert agent_runtime_hosts(
+        agent_name="tbh", agent_kwargs={"base_url": "https://staging.meta.ai/v1"}
+    ) == ["api.meta.ai", "staging.meta.ai"]
+    assert agent_runtime_hosts(
+        agent_name="tbh", agent_env={"TBH_BASE_URL": "https://staging.meta.ai"}
+    ) == ["api.meta.ai", "staging.meta.ai"]
+    assert agent_runtime_hosts(
+        agent_name="tbh",
+        agent_kwargs={"extra_env": {"TBH_BASE_URL": "https://staging.meta.ai"}},
+    ) == ["api.meta.ai", "staging.meta.ai"]
+
+
+def test_an_oddish_wrapper_import_path_still_resolves_its_agent():
+    # Wrappers null the name and set an import path instead.
+    assert agent_runtime_hosts(
+        agent_name=None, import_path="oddish.workers.agents.tbh:Tbh"
+    ) == ["api.meta.ai"]