Security: credential-free sandboxes via a per-rollout model proxy, CSP, local-mode hardening

CONTRIBUTING.md

@@ -17,8 +17,9 @@ uv run uvicorn app.main:app --port 8000     # http://localhost:8000
 ```
 
 Locally there is no OAuth app: your own Hugging Face token (`HF_TOKEN` or `hf auth login`) is the signed-in user,
-rollouts run on your account, and traces go to `./.local-runs`. `docker build -t mimo . && docker run -p 7860:7860 mimo`
-runs the same image the Space runs.
+rollouts run on your account, and traces go to `./.local-runs`. The same image the Space runs:
+`docker build -t mimo . && docker run -p 127.0.0.1:7860:7860 -e HF_TOKEN -e MIMO_TRUST_NETWORK=1 mimo`.
+Read [SECURITY.md](SECURITY.md) before exposing it beyond your own machine.
 
 ## How a rollout works
 
@@ -103,6 +104,8 @@ which opens each task's image as a sandbox; nothing in them comes from the hidde
   If a grader needs a fix, fix it around the vendored file, not inside it.
 * **"Not scored" is never 0.** If the testbed, the judge or the render fails, the reward is `None` and the page says
   why. Averaging infrastructure failures in as zeros misreads results; Xiaomi's harness masks them the same way.
+* **Sandboxes hold no credential on the Space.** Model and judge calls go through `/api/llm/<capability>`; don't
+  add code that puts a token or key into a sandbox when `config.PUBLIC_URL` is set.
 * **Nothing secret reaches a trace.** Tokens and endpoint keys are held in memory for the rollout only, and every
   event passes through the redaction in `Rollout._redact`. Never log a request header or an environment dump.
 * **Public means anonymous.** The public view of a rollout (`_public_view` in `app/main.py`) has no user, no sandbox

README.md

@@ -48,7 +48,7 @@ and Jobs permissions). A rollout runs on **your** account:
 
 Nothing that grades a task (hidden tests, rubric answers, the expected crash) is in the sandbox while the agent works,
 and the agent has no web tools. Rollouts keep running if you close the page; find them under **Rollouts**.
-Traces are kept in a private bucket. Your token is never stored with them: it lives only in an encrypted cookie in your browser.
+Traces are kept in a private bucket. Your token is never stored with them: it lives only in an encrypted cookie in your browser, and the sandbox never sees it (model calls go through a per-rollout proxy). See [SECURITY.md](SECURITY.md).
 
 ## Rollouts and the community
 

SECURITY.md

@@ -0,0 +1,63 @@
+# Security
+
+How the explorer protects accounts, credentials and data, on the public Space and when you run it yourself.
+Report a vulnerability privately to the FineEnvs team through Hugging Face rather than in a public discussion.
+
+## Credentials
+
+* **Sessions.** Signing in (OAuth, or a pasted token) produces one cookie, encrypted with Fernet under
+  `SESSION_SECRET`, HttpOnly, Secure, valid 7 days. The token inside cannot be read back out of it.
+* **On the Space, sandboxes hold no credential.** A rollout's sandbox reaches its model, and the General verifier
+  its judge, through `/api/llm/<capability>/v1`. The capability is random per rollout, works only while that
+  rollout is live, and only for its own agent model and judge; this server adds the user's HF token or endpoint key
+  on the way out. Whatever the agent runs, it cannot read your token.
+* **Locally, the token is forwarded into the sandbox.** A remote HF Sandbox can't reach your machine, so it calls
+  the model directly with your token, and processes in the sandbox can read it. Use a token you can revoke, or set
+  `MIMO_PUBLIC_URL` to a public tunnel to this server so the proxy is used instead.
+* **Nothing secret reaches a trace.** Every event is redacted (the exact token, endpoint key and capability, and
+  anything shaped like `hf_…`, `sk-…` or `Bearer …`) before it is stored. The General verifier prints the first
+  characters of its judge key; that is caught too.
+
+## Your own endpoint
+
+This server calls a bring-your-own endpoint (to test it, list its models, proxy the agent, and for Music), so:
+the URL must be `https`, every address its name resolves to must be public, and the connection goes to the address
+that was checked (TLS still verified against the name), which closes DNS rebinding. Replies to probes are capped
+at 4 MB, probes at 30 per account per 10 minutes, and redirects are not followed.
+
+## Requests
+
+* **Cross-site requests.** The cookie is `SameSite=None` so the Space works inside the huggingface.co iframe, so
+  every state-changing request must come from this page (checked by `Origin`, or `Sec-Fetch-Site`).
+* **Headers.** A strict Content-Security-Policy on every page (scripts only from this origin and jsDelivr, no
+  inline scripts, framing only by huggingface.co and hf.space), `nosniff`, a referrer policy and a permissions
+  policy. Task files and rollout artifacts are served with `Content-Security-Policy: sandbox`, so a task's HTML
+  can never run with this origin.
+* **Input.** Model ids, URLs and keys are length- and character-limited; task files are confined to their
+  workspace; database tables are looked up, never interpolated; run ids and paths are validated.
+
+## Rollouts
+
+* **Private rollouts** are visible only to their owner. Rollouts from before visibility existed stay private.
+* **Public rollouts** are shown without who ran them: the public view has no user, no sandbox id, no endpoint URL,
+  and the owner's username and endpoint host are scrubbed from every string in the trace.
+* Only the owner can stop a rollout or change its visibility. My rollouts lists only your own.
+* Per account at most 4 rollouts run at once, and 24 across the Space.
+
+## Running it yourself
+
+Without an OAuth app the server is in local mode: your machine's HF token (`HF_TOKEN` or `hf auth login`) is the
+signed-in user. To keep that safe:
+
+* It answers only to `localhost`, `127.0.0.1` and `[::1]` (a web page can't DNS-rebind its name onto your
+  machine to use your token). Set `MIMO_ALLOWED_HOSTS` to serve under another name.
+* The machine's token signs in only requests from this machine. Anyone else on the network has to sign in with
+  their own token. Requests that arrive through a proxy are not treated as local.
+* In Docker, publish to localhost only and say so explicitly:
+  `docker run -p 127.0.0.1:7860:7860 -e HF_TOKEN -e MIMO_TRUST_NETWORK=1 mimo`. Without `MIMO_TRUST_NETWORK=1`,
+  requests from Docker's network must sign in like anyone else.
+
+## Hosting your own Space
+
+Set `SESSION_SECRET` as a Space secret (sessions otherwise use the OAuth client secret), keep the runs bucket
+private, and leave `hf_oauth_scopes` at `inference-api` and `jobs`.

app/auth.py

@@ -13,6 +13,7 @@ from __future__ import annotations
 import base64
 import hashlib
 import json
+import os
 import secrets
 import time
 from urllib.parse import urlencode
@@ -21,7 +22,7 @@ import httpx
 from cryptography.fernet import Fernet, InvalidToken
 from fastapi import APIRouter, HTTPException, Request
 from fastapi.responses import JSONResponse, RedirectResponse
-from pydantic import BaseModel
+from pydantic import BaseModel, Field
 
 from . import config
 
@@ -66,8 +67,28 @@ def _cookie_user(request: Request) -> dict | None:
     return data if data.get("exp", 0) > time.time() else None
 
 
+TRUST_NETWORK = os.environ.get("MIMO_TRUST_NETWORK") == "1"
+
+
+def _is_loopback(request: Request) -> bool:
+    import ipaddress
+    # a browser on this machine talks to us directly; forwarding headers mean a proxy is in between (or someone
+    # spoofing one, which uvicorn's --proxy-headers would otherwise believe), so the peer isn't provably local
+    if any(h in request.headers for h in ("x-forwarded-for", "x-real-ip", "forwarded")):
+        return False
+    try:
+        return ipaddress.ip_address((request.client.host if request.client else "") or "").is_loopback
+    except ValueError:
+        return False
+
+
 def current_user(request: Request) -> dict | None:
-    return _cookie_user(request) or (_local_user() if config.LOCAL_MODE else None)
+    """Locally, the machine's own token signs in only requests from this machine (a browser on it, or
+    `docker run -p 127.0.0.1:...` with MIMO_TRUST_NETWORK=1): anyone else on the network has to sign in."""
+    u = _cookie_user(request)
+    if u or not config.LOCAL_MODE:
+        return u
+    return _local_user() if (_is_loopback(request) or TRUST_NETWORK) else None
 
 
 def require_user(request: Request) -> dict:
@@ -99,6 +120,8 @@ def login(request: Request):
     for s, t in list(_states.items()):
         if now - t > 600:
             _states.pop(s, None)
+    if len(_states) > 5000:   # an unauthenticated route: don't let it grow without bound
+        raise HTTPException(429, "Too many sign-ins in progress. Try again in a few minutes.")
     state = secrets.token_urlsafe(24)
     _states[state] = now
     q = urlencode({"client_id": config.OAUTH_CLIENT_ID, "redirect_uri": _redirect_uri(request), "response_type": "code",
@@ -130,7 +153,7 @@ def callback(request: Request, code: str = "", state: str = ""):
 
 # ── access token ─────────────────────────────────────────────────────────────
 class TokenLogin(BaseModel):
-    token: str
+    token: str = Field(max_length=300)
 
 
 def _token_gaps(access: dict) -> list[str]:
@@ -168,13 +191,6 @@ def token_login(body: TokenLogin):
                          "exp": time.time() + config.SESSION_DAYS * 86400, "missing_scopes": gaps})
 
 
-@router.get("/logout")
-def logout():
-    resp = RedirectResponse("/")
-    resp.delete_cookie(COOKIE, samesite="none", secure=True, path="/")
-    return resp
-
-
 @router.post("/api/logout")
 def logout_api():
     resp = JSONResponse({"ok": True})

app/config.py

@@ -23,6 +23,10 @@ OAUTH_CLIENT_ID = os.environ.get("OAUTH_CLIENT_ID", "")
 OAUTH_CLIENT_SECRET = os.environ.get("OAUTH_CLIENT_SECRET", "")
 OPENID_PROVIDER_URL = os.environ.get("OPENID_PROVIDER_URL", "https://huggingface.co")
 SPACE_HOST = os.environ.get("SPACE_HOST", "")
+# Where a sandbox can reach this server. When set (always on a Space), sandboxes never hold the user's HF token or
+# endpoint key: model and judge calls go through /api/llm/<per-rollout capability>. Locally a remote sandbox can't
+# reach your machine, so the token is forwarded into it instead (set MIMO_PUBLIC_URL to a tunnel to avoid that).
+PUBLIC_URL = (os.environ.get("MIMO_PUBLIC_URL") or (f"https://{SPACE_HOST}" if SPACE_HOST else "")).rstrip("/")
 LOCAL_MODE = not OAUTH_CLIENT_ID
 # `jobs` runs the sandbox on the user's account, `inference-api` calls Inference Providers as them.
 OAUTH_SCOPES = ["openid", "profile", "inference-api", "jobs"]

app/endpoints.py

@@ -1,8 +1,9 @@
 """Bring your own model: any OpenAI-compatible endpoint (a LiteLLM proxy, vLLM, OpenAI, Together, OpenRouter...).
 
 The sandbox still runs on the user's Hugging Face account, so they sign in with HF either way; only the agent's
-model calls go to their endpoint. The API key is held in memory for the rollout and handed to the sandbox
-through a root-only file. It is never written to a trace, to the run record or to disk on this server.
+model calls go to their endpoint. The API key is held in memory for the rollout. On the Space it never enters the
+sandbox (calls go through this server's per-rollout proxy); locally it is handed over through a root-only file.
+It is never written to a trace, to the run record or to disk on this server.
 
 This server calls the endpoint too (to test it, list its models, and for Music, which has no sandbox), so the
 URL must be https and resolve to public addresses only: otherwise anyone could make the Space probe its own
@@ -25,24 +26,61 @@ class EndpointError(ValueError):
     pass
 
 
-def check_url(base_url: str) -> str:
-    u = urlparse((base_url or "").strip())
-    if u.scheme != "https" or not u.hostname:
-        raise EndpointError("Use an https URL, like https://api.example.com/v1. The sandbox reaches it over the internet.")
-    if u.username or u.password:
-        raise EndpointError("Put the key in the API key field, not in the URL.")
+def _resolve(host: str, port: int) -> list[str]:
     try:
-        infos = socket.getaddrinfo(u.hostname, u.port or 443, proto=socket.IPPROTO_TCP)
+        infos = socket.getaddrinfo(host, port, proto=socket.IPPROTO_TCP)
     except socket.gaierror:
-        raise EndpointError(f"Couldn't resolve {u.hostname}.")
+        raise EndpointError(f"Couldn't resolve {host}.")
+    ips = []
     for *_, addr in infos:
         ip = ipaddress.ip_address(addr[0])
         if not ip.is_global:
-            raise EndpointError(f"{u.hostname} resolves to a private address. The endpoint has to be reachable from "
+            raise EndpointError(f"{host} resolves to a private address. The endpoint has to be reachable from "
                                 "the internet, because the agent calls it from an HF Sandbox.")
+        ips.append(addr[0])
+    return ips
+
+
+def check_url(base_url: str) -> str:
+    u = urlparse((base_url or "").strip())
+    if u.scheme != "https" or not u.hostname:
+        raise EndpointError("Use an https URL, like https://api.example.com/v1. The sandbox reaches it over the internet.")
+    if u.username or u.password:
+        raise EndpointError("Put the key in the API key field, not in the URL.")
+    if len(base_url) > 500:
+        raise EndpointError("That URL is too long.")
+    _resolve(u.hostname, u.port or 443)
     return u.geturl().rstrip("/")
 
 
+def pinned(url: str) -> tuple[str, dict, dict]:
+    """(url with the host replaced by an IP we checked, Host header, TLS extensions).
+
+    Checking a hostname and then letting the HTTP client resolve it again leaves a gap: a DNS answer that
+    changes in between (DNS rebinding) could point the second lookup at this server's own network. Connecting
+    to the address that was checked closes it; TLS is still verified against the real hostname (SNI)."""
+    u = urlparse(url)
+    ip = _resolve(u.hostname, u.port or 443)[0]
+    host_ip = f"[{ip}]" if ":" in ip else ip
+    netloc = host_ip + (f":{u.port}" if u.port else "")
+    return u._replace(netloc=netloc).geturl(), {"Host": u.netloc}, {"sni_hostname": u.hostname}
+
+
+MAX_BODY = 4_000_000   # a probe's reply is small; don't let an endpoint stream gigabytes into this server
+
+
+def request(method: str, url: str, key: str | None, **kw) -> httpx.Response:
+    target, host, ext = pinned(url)
+    with httpx.Client(timeout=kw.pop("timeout", TIMEOUT), follow_redirects=False) as c:
+        with c.stream(method, target, headers={**_headers(key), **host}, extensions=ext, **kw) as r:
+            body = b""
+            for chunk in r.iter_bytes():
+                body += chunk
+                if len(body) > MAX_BODY:
+                    raise EndpointError("The endpoint's reply was too large.")
+            return httpx.Response(r.status_code, headers=r.headers, content=body, request=r.request)
+
+
 def _headers(key: str | None) -> dict:
     return {"Authorization": f"Bearer {key}"} if key else {}
 
@@ -60,7 +98,7 @@ def _explain(r: httpx.Response) -> str:
 
 def list_models(base_url: str, key: str | None) -> list[str]:
     base = check_url(base_url)
-    r = httpx.get(f"{base}/models", headers=_headers(key), timeout=TIMEOUT)
+    r = request("GET", f"{base}/models", key)
     if r.status_code != 200:
         raise EndpointError(f"Couldn't list models: {_explain(r)}")
     data = r.json()
@@ -78,13 +116,13 @@ def test(base_url: str, key: str | None, model: str) -> dict:
     if not (model or "").strip():
         raise EndpointError("Enter the model name your endpoint expects.")
     t = time.time()
-    r = httpx.post(f"{base}/chat/completions", headers=_headers(key), timeout=60, json={
+    r = request("POST", f"{base}/chat/completions", key, timeout=60, json={
         "model": model.strip(), "max_tokens": 400, "tools": [PROBE_TOOL], "tool_choice": "auto",
         "messages": [{"role": "user", "content": "Call record_answer with the answer to 2+2."}]})
     ms = round((time.time() - t) * 1000)
     if r.status_code != 200:
         # some servers reject the tools field outright: tell chat-only apart from broken
-        plain = httpx.post(f"{base}/chat/completions", headers=_headers(key), timeout=60, json={
+        plain = request("POST", f"{base}/chat/completions", key, timeout=60, json={
             "model": model.strip(), "max_tokens": 50, "messages": [{"role": "user", "content": "Say OK."}]})
         if plain.status_code == 200:
             return {"ok": True, "tools": False, "ms": ms, "detail": f"Chat works, but tool calls failed: {_explain(r)}"}

app/main.py

@@ -7,6 +7,7 @@ from __future__ import annotations
 
 import json
 import mimetypes
+import os
 import random
 from functools import lru_cache
 
@@ -34,6 +35,30 @@ async def _revalidate(request: Request, call_next):
     return resp
 
 
+LOCAL_HOSTS = {"localhost", "127.0.0.1", "[::1]", "::1"} | {h.strip() for h in os.environ.get("MIMO_ALLOWED_HOSTS", "").split(",") if h.strip()}
+CSP = ("default-src 'self'; script-src 'self' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; "
+       "font-src https://fonts.gstatic.com; img-src 'self' data: blob: https:; connect-src 'self'; frame-src 'self'; object-src 'none'; "
+       "base-uri 'none'; form-action 'self'; frame-ancestors 'self' https://huggingface.co https://*.hf.space")
+
+
+@app.middleware("http")
+async def _security(request: Request, call_next):
+    """Locally, only answer to localhost: a web page could otherwise DNS-rebind its own name to 127.0.0.1 and drive
+    this server (and the machine's HF token) from the browser. Everywhere: the usual security headers."""
+    if config.LOCAL_MODE:
+        host = (request.headers.get("host") or "").rsplit(":", 1)[0] if not (request.headers.get("host") or "").startswith("[") \
+            else (request.headers.get("host") or "").split("]")[0] + "]"
+        if host not in LOCAL_HOSTS:
+            return JSONResponse({"detail": "host not allowed (set MIMO_ALLOWED_HOSTS to serve under another name)"}, 403)
+    resp = await call_next(request)
+    resp.headers.setdefault("X-Content-Type-Options", "nosniff")
+    resp.headers.setdefault("Referrer-Policy", "strict-origin-when-cross-origin")
+    resp.headers.setdefault("Permissions-Policy", "camera=(), microphone=(), geolocation=(), payment=()")
+    if not request.url.path.startswith("/api/"):
+        resp.headers.setdefault("Content-Security-Policy", CSP)
+    return resp
+
+
 @app.middleware("http")
 async def _same_origin_posts(request: Request, call_next):
     """The session cookie is SameSite=None (it has to work in the huggingface.co iframe), so a state-changing
@@ -161,10 +186,13 @@ def list_models():
 
 
 # ── rollouts ─────────────────────────────────────────────────────────────────
+SAFE_NAME = r"^[A-Za-z0-9._:/@+\-]{1,200}$"   # model ids: letters, digits and the punctuation real ids use
+
+
 class Endpoint(BaseModel):
-    base_url: str
-    model: str
-    api_key: str | None = None
+    base_url: str = Field(max_length=500)
+    model: str = Field(pattern=SAFE_NAME)
+    api_key: str | None = Field(None, max_length=500)
     price_in: float | None = Field(None, ge=0, le=1000)    # $ per 1M tokens, only for the cost shown
     price_out: float | None = Field(None, ge=0, le=1000)
 
@@ -178,24 +206,37 @@ class Params(BaseModel):
 
 
 class RunRequest(BaseModel):
-    task_id: str
-    model: str | None = None
-    provider: str | None = None
-    judge: str | None = None
+    task_id: str = Field(max_length=200)
+    model: str | None = Field(None, pattern=SAFE_NAME)
+    provider: str | None = Field(None, pattern=SAFE_NAME)
+    judge: str | None = Field(None, pattern=SAFE_NAME)
     endpoint: Endpoint | None = None
     params: Params = Params()
     visibility: Literal["public", "private"] = "public"
 
 
 class EndpointProbe(BaseModel):
-    base_url: str
-    api_key: str | None = None
-    model: str | None = None
+    base_url: str = Field(max_length=500)
+    api_key: str | None = Field(None, max_length=500)
+    model: str | None = Field(None, pattern=SAFE_NAME)
+
+
+_probes: dict[str, list[float]] = {}
+
+
+def _probe_limit(user: str) -> None:
+    """This server makes the call, so cap how often one account can have it do so."""
+    import time as _t
+    now = _t.time()
+    hits = [t for t in _probes.get(user, []) if now - t < 600]
+    if len(hits) >= 30:
+        raise HTTPException(429, "Too many endpoint checks. Wait a few minutes.")
+    _probes[user] = hits + [now]
 
 
 @app.post("/api/endpoints/models")
 def endpoint_models(body: EndpointProbe, request: Request):
-    auth.require_user(request)   # this server makes the call, so only for signed-in users
+    _probe_limit(auth.require_user(request)["name"])   # this server makes the call, so only for signed-in users
     try:
         return {"models": endpoints.list_models(body.base_url, body.api_key)}
     except endpoints.EndpointError as e:
@@ -206,7 +247,7 @@ def endpoint_models(body: EndpointProbe, request: Request):
 
 @app.post("/api/endpoints/test")
 def endpoint_test(body: EndpointProbe, request: Request):
-    auth.require_user(request)
+    _probe_limit(auth.require_user(request)["name"])
     try:
         return endpoints.test(body.base_url, body.api_key, body.model or "")
     except endpoints.EndpointError as e:
@@ -273,16 +314,26 @@ def _is_public(run: dict) -> bool:
     return run.get("visibility") == "public"
 
 
-def _scrub(value, name: str):
+def _scrub(value, secrets_: list[str] | str):
+    if isinstance(secrets_, str):
+        secrets_ = [secrets_] if secrets_ and len(secrets_) > 2 else []
     if isinstance(value, str):
-        return value.replace(name, "[user]") if name and len(name) > 2 else value
+        for x in secrets_:
+            value = value.replace(x, "[redacted]" if "." in x or "/" in x else "[user]")
+        return value
     if isinstance(value, dict):
-        return {k: _scrub(v, name) for k, v in value.items()}
+        return {k: _scrub(v, secrets_) for k, v in value.items()}
     if isinstance(value, list):
-        return [_scrub(v, name) for v in value]
+        return [_scrub(v, secrets_) for v in value]
     return value
 
 
+def _private_strings(run: dict) -> list[str]:
+    """What must never show publicly: the owner's name, and where their own endpoint lives."""
+    ep = run.get("endpoint") or {}
+    return [x for x in (run.get("user"), ep.get("base_url"), ep.get("host")) if x and len(x) > 2]
+
+
 def _public_view(run: dict) -> dict:
     out = {k: run.get(k) for k in PUBLIC_FIELDS if k in run}
     ep = run.get("endpoint")
@@ -291,7 +342,7 @@ def _public_view(run: dict) -> dict:
     if run.get("error"):
         out["error"] = run["error"]
     out["visibility"] = "public"
-    return _scrub(out, run.get("user") or "")
+    return _scrub(out, _private_strings(run))
 
 
 def _owner_view(run: dict) -> dict:
@@ -329,7 +380,7 @@ def get_run(run_id: str, request: Request, after: int = 0):
     events = core.events(run_id, after)
     if owner:
         return {"run": _owner_view(run), "events": events, "live": live is not None}
-    return {"run": _public_view(run), "events": _scrub(events, run.get("user") or ""), "live": live is not None}
+    return {"run": _public_view(run), "events": _scrub(events, _private_strings(run)), "live": live is not None}
 
 
 class Visibility(BaseModel):
@@ -447,7 +498,56 @@ def artifact(run_id: str, name: str, request: Request):
     data = store.read_artifact(run_id, name)
     if data is None:
         raise HTTPException(404, "no such artifact")
-    return Response(data, media_type=mimetypes.guess_type(name)[0] or "application/octet-stream")
+    return Response(data, media_type=mimetypes.guess_type(name)[0] or "application/octet-stream",
+                    headers={"Content-Security-Policy": "sandbox", "X-Content-Type-Options": "nosniff"})
+
+
+# ── the model proxy ──────────────────────────────────────────────────────────
+# On the Space, a sandbox holds no credential: OpenCode (and the General verifier's judge) call this route with a
+# per-rollout capability in the path. It works only while that rollout is live, only for the rollout's own agent
+# model and judge, and this server adds the user's token or endpoint key on the way out.
+@app.post("/api/llm/{cap}/v1/chat/completions")
+async def llm_proxy(cap: str, request: Request):
+    import asyncio
+
+    from starlette.background import BackgroundTask
+    from starlette.responses import StreamingResponse
+
+    r = core.by_cap(cap)
+    if r is None:
+        return JSONResponse({"error": {"message": "unknown or finished rollout"}}, 404)
+    raw = await request.body()
+    if len(raw) > 20_000_000:
+        return JSONResponse({"error": {"message": "request too large"}}, 413)
+    try:
+        body = json.loads(raw)
+    except ValueError:
+        return JSONResponse({"error": {"message": "invalid JSON"}}, 400)
+    up = r.upstream(str(body.get("model") or ""))
+    if up is None:
+        return JSONResponse({"error": {"message": "this rollout may not call that model"}}, 403)
+    base, key = up
+    url = f"{base}/chat/completions"
+    headers = {"Content-Type": "application/json", **({"Authorization": f"Bearer {key}"} if key else {})}
+    ext = {}
+    if r.run.get("endpoint") and base != config.ROUTER:   # the user's own endpoint: connect to the address we checked
+        try:
+            url, host, ext = await asyncio.to_thread(endpoints.pinned, url)
+        except endpoints.EndpointError as e:
+            return JSONResponse({"error": {"message": str(e)}}, 502)
+        headers.update(host)
+    client = httpx.AsyncClient(timeout=httpx.Timeout(900, connect=30), follow_redirects=False)
+    try:
+        resp = await client.send(client.build_request("POST", url, content=raw, headers=headers, extensions=ext), stream=True)
+    except httpx.HTTPError as e:
+        await client.aclose()
+        return JSONResponse({"error": {"message": f"upstream unreachable: {type(e).__name__}"}}, 502)
+
+    async def close():
+        await resp.aclose()
+        await client.aclose()
+    return StreamingResponse(resp.aiter_bytes(), status_code=resp.status_code,
+                             media_type=resp.headers.get("content-type", "application/json"), background=BackgroundTask(close))
 
 
 # ── the site ────────────────────────────────────────────────────────���────────

app/runner/core.py

@@ -17,6 +17,7 @@ The user's token is held here for the rollout's lifetime only. It never reaches
 from __future__ import annotations
 
 import re
+import secrets
 import threading
 import time
 import traceback
@@ -27,6 +28,7 @@ from .. import catalog, config, models, store, version
 
 _pool = ThreadPoolExecutor(max_workers=config.MAX_ACTIVE_ROLLOUTS, thread_name_prefix="rollout")
 _live: dict[str, "Rollout"] = {}
+_caps: dict[str, "Rollout"] = {}   # model-proxy capability -> its rollout, while it runs
 _live_lock = threading.Lock()
 
 
@@ -47,6 +49,8 @@ class Rollout:
         self.id = run["id"]
         self.token = token
         self.agent_key = agent_key   # a bring-your-own endpoint's key: memory only, like the HF token
+        # what the sandbox gets instead of credentials (see config.PUBLIC_URL): valid while this rollout is live
+        self.cap = secrets.token_urlsafe(32)
         self.events: list[dict] = store.read_events(self.id)
         self._pending: list[dict] = []
         self._last_flush = time.time()
@@ -62,7 +66,7 @@ class Rollout:
         """Nothing secret reaches a trace: the user's HF token, an endpoint key, or anything shaped like one
         (the General verifier, for one, prints the first characters of its judge key)."""
         if isinstance(v, str):
-            for secret in (self.token, self.agent_key):
+            for secret in (self.token, self.agent_key, getattr(self, "cap", None)):
                 if secret:
                     v = v.replace(secret, "[redacted]")
             return SECRET_RE.sub(lambda m: m.group(1) + "[redacted]", v)
@@ -131,7 +135,7 @@ class Rollout:
         self.update(flavor=flavor)
         t = time.time()
         self.sandbox = Sandbox.create(image=image, flavor=flavor, idle_timeout=config.SANDBOX_IDLE_TIMEOUT,
-                                      forward_hf_token=True, token=self.token, start_timeout=900,
+                                      forward_hf_token=not config.PUBLIC_URL, token=self.token, start_timeout=900,
                                       labels={"app": "mimo-explorer", "run": self.id})
         self.update(sandbox_id=self.sandbox.id)
         self.phase("sandbox", "done", f"ready in {time.time() - t:.0f}s")
@@ -145,6 +149,19 @@ class Rollout:
         mid = f"{self.run['model']}:{self.run['provider']}" if self.run.get("provider") else self.run["model"]
         return config.ROUTER, self.token, mid
 
+    def llm_base(self) -> str | None:
+        """The OpenAI-compatible base URL the sandbox should use, or None to call the provider directly."""
+        return f"{config.PUBLIC_URL}/api/llm/{self.cap}/v1" if config.PUBLIC_URL else None
+
+    def upstream(self, model: str) -> tuple[str, str | None] | None:
+        """For the model proxy: (base URL, key) for a model this rollout may call, else None."""
+        base, key, mid = self.agent_api()
+        if model == mid:
+            return base, key
+        if self.run.get("judge") and model == self.run["judge"]:
+            return config.ROUTER, self.token
+        return None
+
     def sh(self, cmd: str, timeout: float = 600, **kw):
         """Run a shell command in the sandbox; never raises on a non-zero exit."""
         self.check_cancel()
@@ -176,6 +193,8 @@ class Rollout:
                 self._flush()
             self.stop_sandbox()
             self.agent_key = None
+            with _live_lock:
+                _caps.pop(self.cap, None)
             with _live_lock:
                 _live.pop(self.id, None)
 
@@ -231,10 +250,17 @@ def submit(user: str, token: str, task: dict, model: str, provider: str | None,
     r = Rollout(run, token, agent_key)
     with _live_lock:
         _live[r.id] = r
+        _caps[r.cap] = r
     _pool.submit(r.execute)
     return run
 
 
+def by_cap(cap: str) -> Rollout | None:
+    with _live_lock:
+        r = _caps.get(cap)
+    return r if r is not None and not r.cancelled.is_set() else None
+
+
 def live(run_id: str) -> Rollout | None:
     with _live_lock:
         return _live.get(run_id)
@@ -253,6 +279,8 @@ def cancel(run_id: str) -> bool:
     if r is None:
         return False
     r.cancelled.set()
+    with _live_lock:
+        _caps.pop(r.cap, None)
     # Say so at once: the worker may sit in a blocking sandbox call for a while after the kill.
     r.update(status="cancelled", finished_at=time.time(), cost=r.cost_now())
     r.phase("done", "error", "stopped by you")

app/runner/domains.py

@@ -297,8 +297,9 @@ class General:
             r.sh(f"chown agent:agent {shlex.quote(man['cwd'])}/answer.md")
         self._push(r, root, [(u["source"], u["target"]) for u in man["verifier"]["uploads"]], "verifier")
         judge = r.run.get("judge") or "thinkingmachines/Inkling"
-        env = {"GA_JUDGE_KEY": "$HF_TOKEN", "GA_JUDGE_MODEL": judge, "GA_JUDGE_API": "chat",
-               "GA_JUDGE_URL": config.ROUTER, "VERIFY_DETERMINISTIC": "1", "VERIFY_AGENT_JUDGE": "1"}
+        proxy = r.llm_base()   # on the Space the judge goes through the rollout's proxy: no token in the sandbox
+        env = {"GA_JUDGE_KEY": "proxied" if proxy else "$HF_TOKEN", "GA_JUDGE_MODEL": judge, "GA_JUDGE_API": "chat",
+               "GA_JUDGE_URL": proxy or config.ROUTER, "VERIFY_DETERMINISTIC": "1", "VERIFY_AGENT_JUDGE": "1"}
         exports = " ".join(f'{k}="{v}"' for k, v in env.items())
         rf = man["verifier"].get("reward_file") or "/logs/verifier/reward.json"
         rd = man["verifier"].get("reward_detail_file") or "/logs/verifier/reward_detail.json"
@@ -529,9 +530,10 @@ class Music:
         params = r.run.get("params") or {}
         if r.run.get("scripted") is not None:   # validation: score a fixed piece, no model call
             return self._score(r, raw, r.run.get("scripted_final", ""), "", {}, params)
-        if r.run.get("endpoint"):
+        url, host_hdr, ext = f"{base}/chat/completions", {}, {}
+        if r.run.get("endpoint"):   # the user's own endpoint: connect to the address that was checked
             from .. import endpoints
-            base = endpoints.check_url(base)   # re-checked at call time: DNS can change after the test
+            url, host_hdr, ext = endpoints.pinned(f"{endpoints.check_url(base)}/chat/completions")
         text, thinking, usage = "", "", {}
         # verl recipes/design/config/music.yaml: response_length 100000. Providers that cap output lower refuse
         # such a request outright, so step down rather than fail the rollout on a limit.
@@ -541,8 +543,8 @@ class Music:
                     **({"temperature": params["temperature"]} if params.get("temperature") is not None else {}),
                     **({"reasoning_effort": params["thinking"]} if params.get("thinking") not in (None, "default") else {}),
                     "messages": [{"role": "user", "content": raw["prompt"]}]}
-            with httpx.stream("POST", f"{base}/chat/completions", timeout=900, json=body,
-                              headers={"Authorization": f"Bearer {key}"} if key else {}) as resp:
+            with httpx.stream("POST", url, timeout=900, json=body, extensions=ext,
+                              headers={**host_hdr, **({"Authorization": f"Bearer {key}"} if key else {})}) as resp:
                 if resp.status_code != 200:
                     err = resp.read()[:400].decode(errors="replace")
                     if resp.status_code in (400, 422) and n + 1 < len(budgets):

app/runner/opencode.py

@@ -63,17 +63,20 @@ def install(r) -> str:
 
 
 def config_for(model: str, provider: str | None, steps: int, mcp: list[dict] | None = None,
-               endpoint: dict | None = None, params: dict | None = None) -> dict:
+               endpoint: dict | None = None, params: dict | None = None, proxy: str | None = None) -> dict:
+    """With `proxy` (the Space), every model call goes to this server's per-rollout proxy and the sandbox holds no
+    credential at all; the capability in the URL is the only secret, and it dies with the rollout."""
     params = params or {}
-    if endpoint:   # your own OpenAI-compatible endpoint; the key arrives as AGENT_API_KEY
+    if endpoint:   # your own OpenAI-compatible endpoint; without the proxy, the key arrives as AGENT_API_KEY
         mid, prov = model, {"byo": {"npm": "@ai-sdk/openai-compatible", "name": "Your endpoint",
-                                    "options": {"baseURL": endpoint["base_url"], "apiKey": "{env:AGENT_API_KEY}"},
+                                    "options": {"baseURL": proxy or endpoint["base_url"],
+                                                "apiKey": "proxied" if proxy else "{env:AGENT_API_KEY}"},
                                     "models": {model: {"name": model, "tool_call": True}}}}
         ref = f"byo/{model}"
     else:
         mid = f"{model}:{provider}" if provider else model
         prov = {"hf": {"npm": "@ai-sdk/openai-compatible", "name": "Hugging Face Inference Providers",
-                       "options": {"baseURL": config.ROUTER, "apiKey": "{env:HF_TOKEN}"},
+                       "options": {"baseURL": proxy or config.ROUTER, "apiKey": "proxied" if proxy else "{env:HF_TOKEN}"},
                        "models": {mid: {"name": model, "tool_call": True}}}}
         ref = f"hf/{mid}"
     entry = next(iter(next(iter(prov.values()))["models"].values()))
@@ -104,12 +107,13 @@ def run(r, prompt: str, cwd: str, *, steps: int, timeout: float, user: str | Non
     ep, params = r.run.get("endpoint"), r.run.get("params") or {}
     steps = params.get("steps") or steps
     timeout = params["timeout_min"] * 60 if params.get("timeout_min") else timeout
-    cfg = config_for(r.run["model"], r.run.get("provider"), steps, mcp, ep, params)
+    proxy = r.llm_base()
+    cfg = config_for(r.run["model"], r.run.get("provider"), steps, mcp, ep, params, proxy)
     r.sandbox.files.write("/tmp/opencode.json", json.dumps(cfg))
     r.sandbox.files.write("/tmp/prompt.txt", prompt)
     r.sh("chmod 644 /tmp/opencode.json /tmp/prompt.txt")
     key_env = ""
-    if ep:
+    if ep and not proxy:
         # a root-only file, read by the root shell when it builds the command: the key is never on a command line
         r.sandbox.files.write("/root/.agent_key", r.agent_key or "")
         r.sh("chmod 600 /root/.agent_key")
@@ -122,7 +126,8 @@ def run(r, prompt: str, cwd: str, *, steps: int, timeout: float, user: str | Non
              "XDG_CACHE_HOME": f"{xdg}/cache", "XDG_STATE_HOME": f"{xdg}/state"}
     if (params.get("max_tokens") or 0) > 32000:   # upstream silently caps output at 32k otherwise
         flags["OPENCODE_EXPERIMENTAL_OUTPUT_TOKEN_MAX"] = str(params["max_tokens"])
-    env = f"env {key_env}HF_TOKEN=\"$HF_TOKEN\" HOME={home or '$HOME'} " + " ".join(f"{k}={v}" for k, v in flags.items())
+    token_env = "" if proxy else 'HF_TOKEN="$HF_TOKEN" '
+    env = f"env {key_env}{token_env}HOME={home or '$HOME'} " + " ".join(f"{k}={v}" for k, v in flags.items())
     # --thinking streams the model's reasoning as its own events, so the trace shows why, not only what;
     # --title skips the extra model call that would otherwise name the session
     inner = f'{env} opencode run --format json --thinking --auto --title mimo-rollout "$(cat /tmp/prompt.txt)"'
@@ -146,7 +151,7 @@ def run(r, prompt: str, cwd: str, *, steps: int, timeout: float, user: str | Non
     try:
         res = r.sh(cmd, timeout=timeout, on_stdout=on_out, on_stderr=on_err)
     finally:
-        if ep:
+        if ep and not proxy:
             r.sandbox.run("rm -f /root/.agent_key", shell=True, check=False, timeout=30)
     if buf[0].strip():
         _event(r, buf[0], texts)

web/index.html

@@ -12,7 +12,7 @@
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
   <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet">
   <link rel="stylesheet" href="/app.css">
-  <script>try { const t = localStorage.getItem("theme"); if (t) document.documentElement.dataset.theme = t; } catch (e) {}</script>
+  <script src="/js/boot.js"></script>
 </head>
 <body>
   <div class="progress" id="progress" aria-hidden="true"><i></i></div>

web/js/boot.js

@@ -0,0 +1,2 @@
+// Runs before the page paints (loaded blocking in <head>): apply the saved theme so there's no flash.
+try { const t = localStorage.getItem("theme"); if (t) document.documentElement.dataset.theme = t; } catch (e) { /* private mode */ }

web/js/explore.js

@@ -50,7 +50,7 @@ export async function mount(el, params) {
   if (!DATA) {
     el.innerHTML = skeleton();
     try { await progress.wrap(load()); }
-    catch (e) { el.innerHTML = `<div class="wrap page">${emptyState("alert", "Couldn't load the environments", esc(e.message), `<button class="btn" onclick="location.reload()">${icon("refresh")}Try again</button>`)}</div>`; return; }
+    catch (e) { el.innerHTML = `<div class="wrap page">${emptyState("alert", "Couldn't load the environments", esc(e.message), `<button class="btn" id="reload" type="button">${icon("refresh")}Try again</button>`)}</div>`; $("#reload", el)?.addEventListener("click", () => location.reload()); return; }
     if (root !== el) return;
   }
   if (params) {