Repository navigation
Secret placeholders: orchestrator substitutes real values, agents never see them #289
Description
Inspired by Browser Use's sensitive_data pattern.
Per-project secrets are stored by Solenta and referenced in prompts/config as placeholders; the orchestrator substitutes real values only at process-spawn/env-injection time (#188). Secret values never enter the agent's context window, thread transcripts, memory, or run artifacts. Complements #264 (guided credential flows) and #262 (governance).
Activity
currentbits commentedon Aug 17, 2026
Deep-dive detail (Keycard-for-coding-agents pattern): per-agent credential VENDING, not shared tokens — issue each thread a short-lived, branch-scoped credential (a GitHub App installation token scoped per worktree is 90% of this with zero new infra). Sharpens trust dials into a mechanism and gives Agent Trace (#374) a real per-agent signal.
currentbits commentedon Aug 18, 2026
From the Warp doc-mine: dynamic secret-manager-backed env objects — store the COMMAND (vault kv get -field=...), never the secret; resolve at injection time. Plus their BYOK stdin pattern: secret-manager read key | warp --set-provider-api-key anthropic, so keys never hit shell history or disk.
currentbits commentedon Aug 18, 2026
Round 22: Anthropic shipped the reference implementation of this exact idea. Claude Code sandbox credential files now accept
mode: "mask"(Linux/WSL2): the sandboxed command reads a sentinel copy of the credential file, and the sandbox proxy substitutes the real value on egress. It ships withextract, JWT-aware decode, and AWS SigV4 re-signing options, i.e. the proxy understands the credential's wire format well enough to re-sign requests so the agent never touches the secret but signed calls still work. That egress-proxy substitution with format-aware re-signing is the hard part this issue needs; the sentinel-file part is easy. Note the interplay with #295 (render-time redaction): the sentinel value is what should appear in transcripts too.currentbits commentedon Aug 18, 2026
Round 29 intel: intentic (intentic.dev) shipped the sandbox-boundary version of this: Capabilities connect an agent's sandbox to GitHub, Postgres, Sentry, Stripe, SSH, and MCP servers, with each credential kept inside the capability and injected per turn. The agent sees the effect of the credential (an authenticated client, a scoped connection) but never the secret itself. Their framing: "the machine is an image you approve, so two agents on one host can carry entirely different toolchains." Design note for Solenta: capabilities are named, per-service grants (not raw env vars), so the permission UI can show "this thread has the github:push capability" and revoke it without rotating the underlying secret.