[Tal Zaccai (TalZaccai)]

Issue

The production API container ran as root, established an Azure CLI session, and used the general getKeys bootstrap to import broad shared configuration into plaintext. A compromised API or dependency could therefore access substantially more credentials and runtime authority than required.

Mitigating steps

• Run the production API as a dedicated non-root UID/GID with only the required runtime directory writable.
• Remove Azure CLI/login, the general getKeys bootstrap, and persistent Azure CLI account state from the runtime image.
• Add a dedicated in-process managed-identity bootstrap that fetches only the API-hosted secret and validates an explicit hosted Azure OpenAI configuration allowlist.
• Reject or scrub static, legacy, stale, and unrelated credentials; keep validated configuration in memory and fail before listening when required configuration is missing or invalid.
• Add offline sentinel, permissions, account, logging, HTTP/WebSocket, and hosted API regressions plus a committed production container smoke harness.
• Validate the affected builds, 713 focused tests, frozen-lockfile install, formatting, lint, complexity, circular-dependency, and test-debt ratchets.
• Container smoke could not execute locally because the Linux Docker engine was unavailable. Deployment requires the dedicated hosted-config secret in TYPEAGENT_API_CONFIG_VAULT and least-privilege Key Vault secret-read plus Azure OpenAI RBAC for the managed identity.

[Copilot]

🟡 Changes recommended

Default builds select the smoke runner, smoke imports fail, and Cosmos DB credentials bypass hosted filtering.

3 open issues

• Smoke stage becomes the default production Docker image · New
• Cosmos DB credentials are not rejected or scrubbed · New
• Smoke runner imports resolve to the wrong dist directory · New

What changed in this PR

Hardens the production API container with non-root execution and dedicated managed-identity configuration.

Changes:

• Replaces Azure CLI bootstrap with validated, in-memory hosted configuration.
• Restricts runtime permissions and credential handling.
• Adds bootstrap regressions, container smoke checks, and deployment documentation.

File	Description
ts/​tools/​scripts/​testApiContainer.mjs	Builds and checks container images.
ts/​packages/​api/​test/​containerImage.spec.ts	Checks production image configuration.
ts/​packages/​api/​test/​containerBootstrap.spec.ts	Tests bootstrap validation and credential rejection.
ts/​packages/​api/​src/​typeAgentServer.ts	Accepts validated runtime configuration.
ts/​packages/​api/​src/​storageProviders/​azureStorageProvider.ts	Uses the shared credential factory.
ts/​packages/​api/​src/​startup.ts	Gates startup on configuration loading.
ts/​packages/​api/​src/​index.ts	Integrates bootstrap before server startup.
ts/​packages/​api/​src/​containerBootstrap.ts	Implements dedicated hosted configuration loading.
ts/​packages/​api/​README.md	Documents configuration and deployment requirements.
ts/​packages/​api/​package.json	Restricts packaged runtime files.
ts/​packages/​api/​container/​start.sh	Adds fail-fast startup checks.
ts/​packages/​api/​container/​smoke.mjs	Checks runtime behavior with local mocks.
ts/​packages/​aiclient/​test/​auth.spec.ts	Tests credential selection.
ts/​packages/​aiclient/​src/​auth.ts	Adds managed-identity credential selection.
ts/​Dockerfile	Separates build dependencies and configures non-root runtime.

_{Review effort: Balanced}