From a2791bee5dc3469bcd544ec3d085b6ecbb93b425 Mon Sep 17 00:00:00 2001
From: Ravi Kumar L <ravi.lazar@clickhouse.com>
Date: Mon, 22 Jun 2026 10:38:34 +0200
Subject: [PATCH] fix: narrow remote agent run config

---
 packages/api/src/agents/openai/service.spec.ts | 12 +++++++++++-
 packages/api/src/agents/openai/service.ts      |  9 +++++++--
 2 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/packages/api/src/agents/openai/service.spec.ts b/packages/api/src/agents/openai/service.spec.ts
index 3df759858a..48892e627f 100644
--- a/packages/api/src/agents/openai/service.spec.ts
+++ b/packages/api/src/agents/openai/service.spec.ts
@@ -111,10 +111,16 @@ describe('createAgentChatCompletion - MCP permission user propagation', () => {
 
   it('forwards appConfig and tenantId to createRun', async () => {
     const appConfig = {
+      endpoints: {
+        agents: { capabilities: ['execute_code'] },
+      },
       langfuse: {
         publicKey: 'pk-tenant-1',
         secretKey: 'sk-tenant-1',
       },
+      interfaceConfig: {
+        modelSelect: true,
+      },
     };
     deps.appConfig = appConfig as never;
     const req = createMockReq({
@@ -128,6 +134,10 @@ describe('createAgentChatCompletion - MCP permission user propagation', () => {
     expect(createRun).toHaveBeenCalledTimes(1);
     const runArgs = createRun.mock.calls[0][0] as CreateRunArgs;
     expect(runArgs.tenantId).toBe('tenant-1');
-    expect(runArgs.appConfig).toBe(appConfig);
+    expect(runArgs.appConfig).toEqual({
+      endpoints: appConfig.endpoints,
+      langfuse: appConfig.langfuse,
+    });
+    expect(runArgs.appConfig).not.toHaveProperty('interfaceConfig');
   });
 });
diff --git a/packages/api/src/agents/openai/service.ts b/packages/api/src/agents/openai/service.ts
index a89550fd4f..65493e8375 100644
--- a/packages/api/src/agents/openai/service.ts
+++ b/packages/api/src/agents/openai/service.ts
@@ -178,7 +178,7 @@ type CreateRunFn = (params: {
   requestBody: Record<string, unknown>;
   user: Record<string, unknown>;
   tenantId?: string;
-  appConfig?: AppConfig;
+  appConfig?: Pick<AppConfig, 'endpoints' | 'langfuse'>;
   tokenCounter?: (message: unknown) => number;
 }) => Promise<{
   Graph?: unknown;
@@ -529,7 +529,12 @@ export async function createAgentChatCompletion(
         },
         user: safeUser,
         tenantId: typeof reqUser?.tenantId === 'string' ? reqUser.tenantId : undefined,
-        appConfig: deps.appConfig,
+        appConfig: deps.appConfig
+          ? {
+              endpoints: deps.appConfig.endpoints,
+              langfuse: deps.appConfig.langfuse,
+            }
+          : undefined,
       });
 
       if (run) {