Scope delivered secrets to declared steps

[miyaontherelay]

Summary

Add per-step secret grants to authored f.run, f.agent, and f.llm options and declarative specs. Only names enter the spec. The kernel filters delivered secrets from each deterministic child environment; agent and LLM CLIs, including Relay communication agents, receive their own model login plus explicitly granted other user-delivered secrets. Unknown, malformed, duplicate, and unavailable names fail closed.

On a daemon with step_secret_scoping, plain agent and LLM steps use a clean environment by default, even when no step declares a grant. The environment retains system variables, trusted repository git/gh setup and hardening, and model login for the selected CLI, including delivered login names. Cloud will mark the exact Bedrock login names it selected in the CLI-only RELAY_PLATFORM_AGENT_ENV_NAMES JSON array; the SDK accepts only known Bedrock names for Claude. It keeps the marker out of run.start/run.resume and child processes.

An SDK talking to the currently pinned older runtime still admits plain runs with delivered secrets. It refuses only a step with a nonempty grant when the daemon lacks step_secret_scoping. Upgrading the runtime changes the environment of existing ungranted agent/LLM steps and removes ungranted delivered secrets from deterministic children; flows relying on such secrets must declare them.

This PR is rebased on main through #669 and #670 and can merge independently of #667. It touches deterministic lowering and run.start, which #667 also touches; that conflict was resolved in a local combined-branch check.

Threat model

• Cloud supplies the name-only RELAY_SECRET_ENV_NAMES manifest alongside run envSecrets. Values remain in the run's in-memory environment and never enter step specs, journals, or logs.
• The filter removes ungranted delivered names from deterministic children and agent CLIs, except the selected CLI's own model login. A login for a different CLI remains filtered without a grant. Trusted repository setup remains available unless its name is user-delivered. Cloud must reserve platform names from caller envSecrets and supply the Bedrock marker only for active Bedrock login.
• The private RELAYFLOW_V2_SIGNAL_READ_TOKEN is refused as a step grant, excluded from run.start/run.resume, and stripped from agent children on both capability paths. Cloud must also launch the daemon with --det-withhold RELAYFLOW_V2_SIGNAL_READ_TOKEN. Relay communication CLIs continue to clear broker credentials; Relay-transport agent steps cannot request grants.
• A same-UID step can still inspect another process's /proc/<pid>/environ on Linux or read CLI login files under HOME. Environment filtering is not process isolation; UID and filesystem isolation remain follow-up work in AgentWorkforce/cloud#4715.

Release order

1. Merge the flows PRs (test(kernel): wait for durable run before agent crash boundary kill #669, Test: isolate SDK artifact gate filesystem races #670, Run authored f.run children concurrently #667, Scope delivered secrets to declared steps #668, feat(sdk): add run completion signal helpers #665, feat(sdk): skip unchanged syncCode uploads by digest #666), then publish flows 2.0.51.
2. Deploy the Cloud admission/launch changes while still pinned to runtime 2.0.49. Cloud must reserve platform keys from caller envSecrets, derive the CLI-only Bedrock marker from active delivered Bedrock values inside relayflowV2ChildEnvironments, and launch the daemon with --det-withhold RELAYFLOW_V2_SIGNAL_READ_TOKEN before signal token issuance. Older SDKs ignore the marker.
3. Bump the Cloud surface/runtime pin to 2.0.51 only after the marker has deployed, or in the same deploy. Identify affected existing flows and call out the changed agent and f.run environments in release notes.
4. Enable hosted per-step grants and signal-read token issuance only after Cloud runs the pinned tuple.

Verification

• SDK npm run typecheck, npm run typecheck:tests, and npm run build passed.
• Six focused Vitest files passed, 27/27 tests. They cover real AgentWorker, LlmWorker, and Relay communication worker capability switches; active Bedrock login; repository git/gh setup and hardening; user secret filtering; marker exclusion; and legacy compatibility.
• Negative mutation checks: forcing the three real worker capability switches to false failed three tests; removing the delivered-name filter failed two tests. Restoring the implementation passed all focused tests.
• Focused Rust deterministic-child test passed. rustfmt --edition 2024 --check on exec_det.rs and git diff --check passed. The Rust fallback now handles non-UTF-8 process environment entries without panicking. The scoped agent child test also confirms RELAY_AGENT_TOKEN is absent.
• The branch is rebased on main with Test: isolate SDK artifact gate filesystem races #670, which fixes the shared-suite filesystem and packaging races that caused earlier artifact failures. The rebased head passed 27 focused SDK tests and both SDK typechecks locally. The Linux artifact gate passed on f22f146ed30809d31505535d4992db4831f8f7fd, including the full SDK suite and exact artifact smoke.
• The authored live fixture hit its fixed timeout on a loaded Mac after the signal-token assertion was added; the Linux CI integration job is the release gate. No fixture timeout was raised.

Review-thread fixes (dcf807d0)

• Every CLI preflight subprocess, including executable lookup, filters delivered secrets using the step's grants. Probe caching includes the grants.
• Canonical bundle loading preserves step grants through kernelStepToAuthoring.
• Daemon-withheld names are removed from the forwarded delivered-name manifest; granting a withheld name fails at run admission.
• Legacy communication agents also strip ungranted delivered repository and network credentials while retaining Cloud-selected Bedrock login.
• Focused SDK tests passed 44/44; the Rust shell-step regression passed. Each of these four production fixes was temporarily reverted in isolation and its regression failed, then the fix was restored. Seven review threads were answered and resolved.

Selected CLI login compatibility (0d9b7a34)

• A delivered name in the selected CLI's ordinary login allowlist remains available in worker, preflight, and communication environments on old and new daemons. Delivered AWS/Bedrock names need Cloud's trusted selected-login marker or an explicit grant. Other delivered names still need a step grant; a foreign CLI's login is filtered without one.
• The legacy communication path continues to filter delivered repository and network secrets. The old-daemon capability test now checks both retained login and stripped GH_TOKEN.
• Seven focused SDK files passed 55/55 tests and both SDK typechecks passed. Mutating the shared login helper to reject all login names failed three tests; allowing every delivered name failed three tests. Both new Greptile threads were answered and resolved.

Bedrock selection guard (4a7364ed)

• The shared login helper exempts ordinary selected CLI login; delivered AWS/Bedrock names remain grant-only unless Cloud lists them in RELAY_PLATFORM_AGENT_ENV_NAMES.
• A regression covers worker, preflight, scoped communication, and legacy communication environments, with and without the marker and with an explicit grant. Reverting the Bedrock guard fails the regression. Focused tests and both SDK typechecks pass; the new Greptile security thread was answered and resolved.

Full-suite CI call shape (99ee8235)

• Plain steps keep the original three-argument direct or four-argument managed probe call; grant-bearing steps pass the additional grant argument. This preserves existing preflight probes and fixes five full-suite budget preflight spy failures from the prior head.
• budget-preflight, cli-probe, and step-secrets pass 54/54 locally; both SDK typechecks pass.

Communication provider login (74fb6c47)

• Scoped and legacy communication CLIs retain their own delivered provider login using the existing provider map, including Gemini, Cursor, Grok, and Factory. Delivered AWS_*, GOOGLE_API_KEY, and GOOGLE_APPLICATION_CREDENTIALS remain grant-only; delivered repository names remain filtered.
• Focused communication and secret tests pass 22/22, and both SDK typechecks pass. Removing the provider map or the generic Google exclusion makes the regression fail. The Cursor review thread was answered and resolved. Linux artifact CI is running for this head.

---

Agent Relay sessions

• codex session 01a14312 · opened via gh pr create · last active 2026-10-16

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9c42b7fc-c317-4908-b338-1c5b3645aafe

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[capy-ai]

Capy found 4 potential issues (1 high, 3 medium).

[cursor]

Stale Bugbot comment from a previous run.

[greptile-apps]

Confidence Score: 5/5

[Critical impact] The PR appears safe to merge; no new blocking issue was found.

Summary

Adds name-only secret grants to authored and declarative steps. The kernel filters deterministic children, while SDK workers and readiness checks filter agent environments.

• Flow steps can name the run secrets they are allowed to use.
• Deterministic steps pass only the delivered secrets they are granted.
• Agent and LLM steps use a clean environment with their selected CLI login.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Run environment and secret-name manifest] --> B[Step declares secret names]
  B --> C{Execution path}
  C --> D[Kernel filters deterministic child]
  C --> E[SDK filters agent or readiness environment]
  E --> F[Keep selected CLI login and trusted Bedrock names]
  D --> G[Add explicitly granted secrets]
  F --> G
  G --> H[Start child without secret metadata]

Loading

_{Reviews (8) · Last reviewed commit: "fix: retain communication provider login..." · Reviewed by Greptile}

[cursor]

Stale Bugbot comment from a previous run.

[capy-ai]

Capy found no issues.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 4a7364e. Configure here.}

[capy-ai]

Capy found no issues.