Local credential proxy for AI agents (proxy MVP) by theoephraim · Pull Request #780 · dmno-dev/varlock

theoephraim · 2026-06-13T00:51:20Z

Summary

Local credential proxy for AI agents (Tier 0 of the proxy roadmap). A developer can run an agent through the local proxy so the agent only ever sees placeholder secrets, real secrets are injected at the wire bound to a verified upstream identity, responses are scrubbed, and every request is policy-checked, optionally gated on approval, and audited.

varlock proxy command + sessions — proxy is its own command with a session registry; varlock run no longer takes --proxy (rejected with a clear error). Placeholder→real rewrite for items tagged @proxy, with placeholder-safe loading. proxy run attaches to a running proxy start daemon for the current directory (so its terminal handles approval prompts), validating the schema fingerprint and failing loudly on drift; --session <id> targets one, --new forces a fresh proxy.
Security invariants — inject secrets only onto connections whose upstream TLS identity is cryptographically verified (defeats DNS/host tampering), refuse injection over cleartext, and scrub + leak-scan responses so real values never reach the child.
Dual-form @proxy + default-omit — @proxy(...) configures a rule; the value forms @proxy=passthrough / @proxy=omit opt a single item in/out (mutually exclusive with the function form on the same item). Unhandled sensitive items are omitted from the child env by default (warned, not blocked); _VARLOCK_* reserved keys are never proxied.
Per-call policy — host/path/method matching with block (deny) and scoped injection per request. Precedence is block > require-approval > allow.
require-approval verdict (Invariant varlock init command #8) — @proxy(approval=true) holds a request for an out-of-band, request-bound approval (method + verified host + path + body-hash + nonce + expiry) before forwarding, so a future signed phone-approval relay drops in unchanged. MVP approver is a TTY prompt under proxy start; everything fails closed.
Scoped + granular approvals — an approval can be granted once, for the session, or for N minutes, remembered as a standing grant in a store decoupled from the approver (so the future phone writes grants the proxy honors without a round-trip). approvalEach (host/endpoint/request) sets what one grant covers and approvalMaxDuration caps how long a "yes" is remembered — enforced (clamped) proxy-side, so the schema is the ceiling even if a client over-claims (0 ⇒ always-ask).
Append-only audit log (Invariant basic vscode plugin to provide highlighting #7) — one no-secrets JSON line per request (host, method, path, request-hash, matched rule, decision, injected key names), persisting after the session ends. View with varlock proxy audit [--session <id>] [--format text|json].
Session-as-record — each session is a durable directory ~/.config/varlock/proxy/sessions/<uuid>/ holding its session.json, audit.jsonl, and grants.jsonl together. Stopping marks a session ended rather than deleting it; proxy status shows active sessions by default, --all includes ended ones.
Hardened agent runs — proxy/CA env injection into the child, proxied-context CLI guards (block nested secret-recovery commands, restrict varlock load formats), and a schema-fingerprint guard that blocks proxied loads if the schema changes after the proxy starts. The fingerprint covers the full definition (pre-resolution value sources + all non-inert decorators), so flipping @sensitive/@proxy, egress, or a resolver is caught — cosmetic decorators (@example, @docs, …) are marked inert and ignored.
Ephemeral in-memory MITM CA (@peculiar/x509); secrets stay on the host.
Tests for env-graph proxy decorators, runtime proxy TLS behavior, context guards, the session registry, per-call policy, the audit log, approvals + grants, and the schema fingerprint.

Cert pinning and request re-signing (pin/sign/transform) were removed as dead config — pinning is deferred for delegated external identity verification, and re-signing is designed as a future @proxyResign decorator.

Rebased onto latest main; redaction conflicts resolved in favor of main's per-stream TTY auto-detect model.

+  let out = '';
+  while (out.length < length) {
+    const byte = crypto.randomBytes(1)[0]!;
+    out += alphabet[byte % alphabet.length];


cloudflare-workers-and-pages · 2026-06-16T22:13:09Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	varlock-website	`3101d12`	Commit Preview URL Branch Preview URL	Jun 17 2026, 06:42 AM

@Proxy

Builds on the phase-1 proxy guardrails (PR #755) with security and usability hardening for local, no-sandbox agent runs: - Per-item domain scoping: an item's secret is injected only on hosts its own @Proxy rule matches (was: all managed items on any ruled host). - In-memory ephemeral CA via @peculiar/x509 over WebCrypto (EC P-256); CA + per-host leaf private keys never touch disk, drops the openssl dependency. IP-literal ruled domains now get IP SANs. - Schema-fingerprint enforcement actually compares on nested commands, closing the @sensitive-downgrade re-load. - Process-ancestry context detection: guards + placeholder overrides resolve the session by process tree, not just the env marker, closing the `env -u __VARLOCK_PROXY_CHILD` bypass. - Streaming: SSE/unknown-length responses stream through instead of buffering; body redaction limited to bounded small text bodies. - Placeholder generation: drop @example derivation; data-type generatePlaceholder() is the blessed source; warn on generic fallback. - Revert global Accept-Encoding force (kept header + bounded-body redaction). - Correctness: byte-accurate content-length, strict-mode 403 length. - Tests: per-item scoping, ancestry, cert authority, end-to-end TLS MITM (CONNECT + leaf trust + injection + streaming), placeholder priority.

…, cleartext guard, response scrub) - Invariant #1: bind secret injection to the verified upstream TLS identity (public-PKI validation + cert identity matches the rule host, optional per-rule cert pinning). DNS-poison / rebound host → failed connection, never a leaked secret. Regression test included. - Invariant #2/#5: refuse to inject a secret into a cleartext (http://) connection; fail closed. Upstream-error path tears down the client connection rather than half-delivering. - Invariant #6: scrub real values back to placeholders in responses, now including streamed (SSE) text scrubbed chunk-by-chunk without breaking streaming; bounded-response post-scrub fail-safe withholds rather than leaks. - Tests moved onto the real HTTPS/MITM path (injection, redaction, per-item scoping, DNS-poison, cleartext guard, SSE stream + scrub).

@Proxy

…ny + scoped injection) Adds a facts→verdict policy layer (packages/varlock/src/proxy/policy.ts): - Requests are normalized to facts (host + method + path) and evaluated against @Proxy rules. A matching block=true rule denies the request (fail closed — never reaches upstream): static per-call authorization. - Credential injection is scoped by path/method, not just host (getRequestScopedManagedItems), so a secret can be limited to specific endpoints/methods. - Glob path matching (* within a segment, ** across); comma-separated methods. - Modeled as facts→verdict (allow|deny|require-approval) over a generic fact bag so domain plugins / non-HTTP protocols slot onto the same seam later. The require-approval verdict + approval provider is a follow-up. Note: short MITM-tunnel responses (deny 403, upstream-error 502) don't flush reliably through the CONNECT tunnel, so they fail closed by tearing the connection down. Clean status-code delivery over the tunnel is a follow-up. Tests: policy unit tests (matching, block precedence, scoped injection) + end-to-end block-deny over the HTTPS/MITM path.

Record one no-secrets JSON line per proxied request (host, method, path, request-hash, rule, decision, injected keys) under ~/.config/varlock/proxy/audit/<uuid>.jsonl; view with `varlock proxy audit`.

These ProxyRule fields were parsed but never used: pin (cert pinning) is deferred for delegated external identity verification, and sign/transform belong to a future @proxyResign decorator, not routing rules. Removing avoids implying features that don't exist. Invariant #1 (PKI + SAN identity check) is unchanged.

@Proxy

@Proxy(approve=true) holds a request for an out-of-band, request-bound approval (method+host+path+body-hash+nonce+expiry) before forwarding. Precedence block>require-approval>allow. MVP approver = TTY prompt under proxy start; fails closed (deny) on timeout/no-TTY/no-approver. Outcomes audited as approval-granted/denied.

@Proxy

@Proxy is registered as both item and root decorator, but the header placement validator rejected any item-registered name, making detached rules (and header block/approve rules) unauthorable. Accept a name that is also a root decorator. Also fixes attached rules being dropped when a header @Proxy was present.

Replace the fail-closed block (session refused when a sensitive item wasn't @proxy-managed or @proxyPassthrough) with default-omit: such items are withheld from the child (dropped from vars + the __VARLOCK_ENV blob) with a notice. Least privilege by default; no need to annotate every secret to start a session. Rename getBlockedSensitiveKeys → getOmittedSensitiveKeys.

…itive vars Reword the default-omit message as a startup warning explaining the vars were omitted because no proxy policy is set for them.

Reserved _VARLOCK_* keys are varlock's own internal plumbing, not user secrets, so getOmittedSensitiveKeys skips them — they're never flagged as omitted/needing a rule and pass through as infrastructure (consistent with normal varlock run).

@Proxy

…ing @proxyPassthrough Adds isFunctionOrValue decorator capability: @Proxy can be a function (@Proxy(domain=...) to route) or a value (@Proxy=passthrough to inject the real value, @Proxy=omit to withhold explicitly). The two forms are mutually exclusive per item. Removes @proxyPassthrough. @Proxy=omit suppresses the no-policy omit warning.

…anding grants TTY prompt now offers [y]once [s]session [m]15min. Session/duration approvals persist as standing grants (per-session file, no secrets) so matching requests auto-approve without re-prompting. New approval-grants.ts decouples the grant store from the approver via createGrantingApprovalProvider, so the future phone/native-app approver reuses the same store. Enabled for proxy start; proxy run stays fail-closed.

@Proxy

…on cap @Proxy(approval=true) gains approvalEach (host|endpoint|request) and approvalMaxDuration (e.g. 15m, or 0=always-ask). Grants are keyed by rule + granularity so one rule yields fine-grained approvals; the lifetime is clamped to approvalMaxDuration proxy-side (schema is the ceiling). Renames approve→approval and runtime ApprovalScope→ApprovalLifetime. Interim flat props (object form when that branch lands).

@deprecated

…-defs + decorators) Rebuild buildProxySchemaFingerprint to hash per-item value definitions (pre-resolution) + all non-inert decorators + root decorators, canonical and location-independent. Add an 'inert' decorator flag (marks @example/@docs/@docsUrl/@icon/@deprecated) excluded from the fingerprint. Closes gaps the shape-only fingerprint missed (proxied→passthrough flip, domain/egress changes). Prereq for proxy run --session attach.

…o / --new) proxy run now attaches to a proxy start daemon for the current dir (single cwd-match, or --session <id>) instead of always spawning a fresh auto-deny proxy — so the daemon's terminal handles approvals. Validates the schema fingerprint and fails loudly on drift; --new forces a fresh proxy. Reuses the session's env + placeholders; no new runtime/approver in attach mode.

… keep on stop

… reference)

… keys=[...]

cloudflare-workers-and-pages · 2026-06-16T22:39:34Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	varlock-docs-mcp	`9a88dd1`	Jun 16 2026, 10:40 PM

github-actions · 2026-06-16T22:40:00Z

The changes in this PR will be included in the next version bump.

Patch releases

varlock 1.7.1 → 1.7.2

Bump files in this PR

proxy-phase1-guardrails.md (view diff) (edit)
proxy-audit-log.md (view diff) (edit)
proxy-require-approval.md (view diff) (edit)
proxy-root-decorator-fix.md (view diff) (edit)
proxy-default-omit-sensitive.md (view diff) (edit)
proxy-dual-form-decorator.md (view diff) (edit)
proxy-approval-scopes.md (view diff) (edit)
proxy-approval-granularity.md (view diff) (edit)
proxy-schema-fingerprint-full.md (view diff) (edit)
proxy-run-attach.md (view diff) (edit)
proxy-session-record.md (view diff) (edit)
proxy-array-literals.md (view diff) (edit)
proxy-refresh-hot-reload.md (view diff) (edit)

Click here if you want to add another bump file to this PR

This comment is maintained by bumpy.

pkg-pr-new · 2026-06-16T22:45:46Z

Open in StackBlitz

npm i https://pkg.pr.new/varlock@780

commit: ecaacb5

…ntical

…y swap)

…es SIGHUP)

github-actions Bot added maintainer core:varlock labels Jun 13, 2026

github-advanced-security AI found potential problems Jun 13, 2026

View reviewed changes

Comment thread packages/varlock/src/proxy/session-registry.ts

let out = '';

while (out.length < length) {

const byte = crypto.randomBytes(1)[0]!;

out += alphabet[byte % alphabet.length];

theoephraim force-pushed the feat/proxy-mvp branch from 123c3b6 to b76e527 Compare June 14, 2026 19:50

github-actions Bot added the core:website label Jun 16, 2026

theoephraim added 21 commits June 16, 2026 15:20

Add phase-1 proxy guardrails and strict egress enforcement

1f13608

Fix proxy guard typecheck and add bumpy changeset

84efa8a

feat(varlock): add proxy sessions and placeholder-safe proxy behavior

ed969d9

feat(varlock): proxy append-only audit log (Invariant #7)

d882bbc

Record one no-secrets JSON line per proxied request (host, method, path, request-hash, rule, decision, injected keys) under ~/.config/varlock/proxy/audit/<uuid>.jsonl; view with `varlock proxy audit`.

feat(varlock): warn (not just notice) when proxy omits unhandled sens…

225136c

…itive vars Reword the default-omit message as a startup warning explaining the vars were omitted because no proxy policy is set for them.

feat(varlock): session-as-record reorg — co-locate per-session files,…

b45015e

… keep on stop

docs(varlock): document the credential proxy (guide + decorator & CLI…

6a15cac

… reference)

feat(varlock): @Proxy uses array literals for domain/method lists and…

9a88dd1

… keys=[...]

theoephraim force-pushed the feat/proxy-mvp branch from 9822048 to 9a88dd1 Compare June 16, 2026 22:39

theoephraim added 3 commits June 16, 2026 16:45

fix(varlock): proxy fingerprint treats domain=a and domain=[a] as ide…

08e7f09

…ntical

feat(varlock): proxy refresh hot-reloads a running daemon (live polic…

3101d12

…y swap)

feat(varlock): blocking proxy refresh via file reload channel (replac…

ecaacb5

…es SIGHUP)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Local credential proxy for AI agents (proxy MVP)#780

Local credential proxy for AI agents (proxy MVP)#780
theoephraim wants to merge 24 commits into
mainfrom
feat/proxy-mvp

theoephraim commented Jun 13, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Jun 16, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Jun 16, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 16, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Jun 16, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

theoephraim commented Jun 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

cloudflare-workers-and-pages Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

cloudflare-workers-and-pages Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

github-actions Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Patch releases

Bump files in this PR

Uh oh!

pkg-pr-new Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

theoephraim commented Jun 13, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Jun 16, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Jun 16, 2026 •

edited

Loading

github-actions Bot commented Jun 16, 2026 •

edited

Loading

pkg-pr-new Bot commented Jun 16, 2026 •

edited

Loading