[feat] Deliver agent credentials through Daytona Secrets

docs/docs/self-host/concepts/02-how-agents-run.mdx

@@ -55,6 +55,29 @@ Two kinds of credential meet at the runner:
 A run can also carry no managed key at all and authenticate the harness from a mounted personal
 subscription. See [Use your own subscription](/self-host/use-your-own-subscription).
 
+### What the sandbox can see
+
+A model key normally arrives in the sandbox as an environment variable, and an MCP server's key as
+a request header. Both are readable by the agent running there, which matters because an agent
+writes and runs its own code: a prompt injection that convinces it to print its environment prints
+your keys.
+
+On Daytona you can close that gap. Set
+[`AGENTA_RUNNER_DAYTONA_OPAQUE_SECRETS=process_local`](/self-host/configuration#hiding-api-keys-from-the-sandbox)
+and the runner stores each key as a Daytona Secret restricted to the single hostname that key
+authenticates against, then puts a placeholder in the sandbox. Daytona swaps the placeholder for
+the real value on requests to that host, so the model call and the MCP call still work while the
+agent itself only ever holds a useless string. A request to any other host carries the placeholder,
+which is what makes exfiltration fail.
+
+This works for a key the remote service reads over HTTPS, which covers the provider keys and the
+MCP keys. It does not work for a key a provider SDK signs with locally, which today means the AWS
+access keys behind Bedrock: that secret never leaves the sandbox, so there is no outbound request
+to substitute it into, and the sandbox holds the real value.
+
+The local sandbox is unaffected. The harness runs inside the runner container there, so its keys are
+already inside your own deployment rather than a third party's.
+
 ## Persistence depends on the run
 
 What a run keeps depends on what the run is:

docs/docs/self-host/reference/01-configuration.mdx

@@ -293,6 +293,7 @@ Read by the `runner` service. Required only when `daytona` is enabled.
 | `AGENTA_RUNNER_DAYTONA_IMAGE` | Image to start from | Unset | no | `...daytona.image` |
 | `AGENTA_RUNNER_DAYTONA_AUTOSTOP_MINUTES` | Idle minutes before stop | `15` | no | `...daytona.autostopMinutes` |
 | `AGENTA_RUNNER_DAYTONA_AUTODELETE_MINUTES` | Idle minutes before delete | `30` | no | `...daytona.autodeleteMinutes` |
+| `AGENTA_RUNNER_DAYTONA_OPAQUE_SECRETS` | Hide API keys from the sandbox | Unset (off) | no | `...daytona.opaqueSecrets` |
 
 When neither `AGENTA_RUNNER_DAYTONA_SNAPSHOT` nor `AGENTA_RUNNER_DAYTONA_IMAGE` is set, the runner
 starts from its pinned default snapshot `agenta-agent-sandbox-v1`. The two variables are mutually
@@ -301,6 +302,39 @@ exclusive. The autostop and autodelete values must be positive integers. See
 and [Customize the agent runtime](/self-host/agent-execution/customize-the-agent-runtime) for the
 CPU, memory, and disk each sandbox gets.
 
+#### Hiding API keys from the sandbox
+
+By default, a Daytona run receives its model and MCP API keys as ordinary environment variables, so
+an agent that reads its own environment can read the keys. Set
+`AGENTA_RUNNER_DAYTONA_OPAQUE_SECRETS=process_local` to change that: the runner stores each key as a
+Daytona Secret, restricted to the one hostname that key authenticates against, and puts a
+placeholder in the sandbox instead. Daytona substitutes the real value into outbound requests to
+that host; requests anywhere else carry only the placeholder.
+
+`process_local` is the only accepted value, and it names the guarantee it can make. The runner
+tracks the Secret records it created in its own memory and deletes them when the sandbox goes away.
+Restart the runner while sandboxes are live and those records are orphaned in your Daytona account
+until you remove them; a future value will add durable tracking.
+
+:::warning Check the API key's permissions first
+A Daytona API key is minted with a set of permissions, and a key that can create sandboxes does
+not automatically have the separate permission to manage Secrets. Grant that permission to the key
+in `AGENTA_RUNNER_DAYTONA_API_KEY` before you set this variable.
+
+If you skip it, **every Daytona run that carries a model or MCP key fails at sandbox creation.**
+The runner does not fall back to sending the key as plaintext, because silently doing the
+unprotected thing is worse than stopping. The error names this variable and the permission, so the
+failure is recognizable, but the runs still fail until the key is fixed. Unsetting the variable
+restores the previous behavior immediately.
+:::
+
+One more thing to know: keys that a provider SDK signs with locally instead of sending, which
+today means the AWS access keys used for Bedrock, cannot be hidden this way and still reach the
+sandbox in full. Nothing Daytona substitutes on the way out can help there, because the secret
+never leaves the sandbox in the first place.
+
+Leaving the variable unset keeps the previous behavior exactly.
+
 :::warning The bare `DAYTONA_*` variables configure a different sandbox
 `DAYTONA_API_KEY`, `DAYTONA_API_URL`, `DAYTONA_TARGET`, `DAYTONA_SNAPSHOT`, and
 `DAYTONA_SNAPSHOT_CODE` configure the code evaluator's sandbox, which runs custom evaluator code.

hosting/docker-compose/ee/docker-compose.dev.yml

@@ -430,6 +430,7 @@ services:
             AGENTA_RUNNER_DAYTONA_SESSION_IDLE_TTL_MS: ${AGENTA_RUNNER_DAYTONA_SESSION_IDLE_TTL_MS:-}
             AGENTA_RUNNER_DAYTONA_SESSION_MAX_WARM: ${AGENTA_RUNNER_DAYTONA_SESSION_MAX_WARM:-}
             AGENTA_RUNNER_DAYTONA_AUTODELETE_MINUTES: ${AGENTA_RUNNER_DAYTONA_AUTODELETE_MINUTES:-}
+            AGENTA_RUNNER_DAYTONA_OPAQUE_SECRETS: ${AGENTA_RUNNER_DAYTONA_OPAQUE_SECRETS:-}
             # This service has no env_file (see above), so the session flags must be listed
             # here or they can never be set. Both default ON: absent or empty means on, and
             # only the literal "false" disables. Disable AGENTA_SESSIONS_RECONSTRUCT together

hosting/docker-compose/ee/docker-compose.gh.local.yml

@@ -300,6 +300,7 @@ services:
             AGENTA_RUNNER_DAYTONA_SESSION_IDLE_TTL_MS: ${AGENTA_RUNNER_DAYTONA_SESSION_IDLE_TTL_MS:-}
             AGENTA_RUNNER_DAYTONA_SESSION_MAX_WARM: ${AGENTA_RUNNER_DAYTONA_SESSION_MAX_WARM:-}
             AGENTA_RUNNER_DAYTONA_AUTODELETE_MINUTES: ${AGENTA_RUNNER_DAYTONA_AUTODELETE_MINUTES:-}
+            AGENTA_RUNNER_DAYTONA_OPAQUE_SECRETS: ${AGENTA_RUNNER_DAYTONA_OPAQUE_SECRETS:-}
         # === NETWORK ============================================== #
         networks:
             - agenta-ee-gh-network

hosting/docker-compose/ee/docker-compose.gh.yml

@@ -302,6 +302,7 @@ services:
             AGENTA_RUNNER_DAYTONA_SESSION_IDLE_TTL_MS: ${AGENTA_RUNNER_DAYTONA_SESSION_IDLE_TTL_MS:-}
             AGENTA_RUNNER_DAYTONA_SESSION_MAX_WARM: ${AGENTA_RUNNER_DAYTONA_SESSION_MAX_WARM:-}
             AGENTA_RUNNER_DAYTONA_AUTODELETE_MINUTES: ${AGENTA_RUNNER_DAYTONA_AUTODELETE_MINUTES:-}
+            AGENTA_RUNNER_DAYTONA_OPAQUE_SECRETS: ${AGENTA_RUNNER_DAYTONA_OPAQUE_SECRETS:-}
             # This service has no env_file (see above), so the session flags must be listed
             # here or they can never be set. Both default ON: absent or empty means on, and
             # only the literal "false" disables. Disable AGENTA_SESSIONS_RECONSTRUCT together

hosting/docker-compose/ee/env.ee.dev.example

@@ -89,6 +89,12 @@ AGENTA_RUNNER_DEFAULT_SANDBOX_PROVIDER=local
 # AGENTA_RUNNER_DAYTONA_AUTOSTOP_MINUTES=15
 # AGENTA_RUNNER_DAYTONA_AUTODELETE_MINUTES=30
 
+# Hide model and MCP API keys from the sandbox. When set to process_local, the runner stores each
+# key as a Daytona Secret restricted to the one host it authenticates against, and the sandbox sees
+# only a placeholder. Needs a Daytona API key with permission to manage Secrets. Leave unset to
+# keep passing keys as plain environment variables.
+# AGENTA_RUNNER_DAYTONA_OPAQUE_SECRETS=process_local
+
 # --- Warm sessions ---
 # Milliseconds. Must stay below AGENTA_RUNNER_DAYTONA_AUTOSTOP_MINUTES, or Daytona stops a sandbox
 # the runner still holds. 0 stops the sandbox after each turn.

hosting/docker-compose/ee/env.ee.gh.example

@@ -91,6 +91,12 @@ AGENTA_RUNNER_TOKEN=replace-me
 # AGENTA_RUNNER_DAYTONA_AUTOSTOP_MINUTES=15
 # AGENTA_RUNNER_DAYTONA_AUTODELETE_MINUTES=30
 
+# Hide model and MCP API keys from the sandbox. When set to process_local, the runner stores each
+# key as a Daytona Secret restricted to the one host it authenticates against, and the sandbox sees
+# only a placeholder. Needs a Daytona API key with permission to manage Secrets. Leave unset to
+# keep passing keys as plain environment variables.
+# AGENTA_RUNNER_DAYTONA_OPAQUE_SECRETS=process_local
+
 # --- Warm sessions ---
 # Milliseconds. Must stay below AGENTA_RUNNER_DAYTONA_AUTOSTOP_MINUTES, or Daytona stops a sandbox
 # the runner still holds. 0 stops the sandbox after each turn.

hosting/docker-compose/oss/docker-compose.dev.yml

@@ -416,6 +416,7 @@ services:
             AGENTA_RUNNER_DAYTONA_SESSION_IDLE_TTL_MS: ${AGENTA_RUNNER_DAYTONA_SESSION_IDLE_TTL_MS:-}
             AGENTA_RUNNER_DAYTONA_SESSION_MAX_WARM: ${AGENTA_RUNNER_DAYTONA_SESSION_MAX_WARM:-}
             AGENTA_RUNNER_DAYTONA_AUTODELETE_MINUTES: ${AGENTA_RUNNER_DAYTONA_AUTODELETE_MINUTES:-}
+            AGENTA_RUNNER_DAYTONA_OPAQUE_SECRETS: ${AGENTA_RUNNER_DAYTONA_OPAQUE_SECRETS:-}
             # This service has no env_file (see above), so the session flags must be listed
             # here or they can never be set. Both default ON: absent or empty means on, and
             # only the literal "false" disables. Disable AGENTA_SESSIONS_RECONSTRUCT together

hosting/docker-compose/oss/docker-compose.gh.local.yml

@@ -298,6 +298,7 @@ services:
             AGENTA_RUNNER_DAYTONA_SESSION_IDLE_TTL_MS: ${AGENTA_RUNNER_DAYTONA_SESSION_IDLE_TTL_MS:-}
             AGENTA_RUNNER_DAYTONA_SESSION_MAX_WARM: ${AGENTA_RUNNER_DAYTONA_SESSION_MAX_WARM:-}
             AGENTA_RUNNER_DAYTONA_AUTODELETE_MINUTES: ${AGENTA_RUNNER_DAYTONA_AUTODELETE_MINUTES:-}
+            AGENTA_RUNNER_DAYTONA_OPAQUE_SECRETS: ${AGENTA_RUNNER_DAYTONA_OPAQUE_SECRETS:-}
         # === NETWORK ============================================== #
         networks:
             - agenta-oss-gh-network

hosting/docker-compose/oss/docker-compose.gh.ssl.yml

@@ -322,6 +322,7 @@ services:
             AGENTA_RUNNER_DAYTONA_SESSION_IDLE_TTL_MS: ${AGENTA_RUNNER_DAYTONA_SESSION_IDLE_TTL_MS:-}
             AGENTA_RUNNER_DAYTONA_SESSION_MAX_WARM: ${AGENTA_RUNNER_DAYTONA_SESSION_MAX_WARM:-}
             AGENTA_RUNNER_DAYTONA_AUTODELETE_MINUTES: ${AGENTA_RUNNER_DAYTONA_AUTODELETE_MINUTES:-}
+            AGENTA_RUNNER_DAYTONA_OPAQUE_SECRETS: ${AGENTA_RUNNER_DAYTONA_OPAQUE_SECRETS:-}
         # === NETWORK ============================================== #
         networks:
             - agenta-gh-ssl-network

hosting/docker-compose/oss/docker-compose.gh.yml

@@ -319,6 +319,7 @@ services:
             AGENTA_RUNNER_DAYTONA_SESSION_IDLE_TTL_MS: ${AGENTA_RUNNER_DAYTONA_SESSION_IDLE_TTL_MS:-}
             AGENTA_RUNNER_DAYTONA_SESSION_MAX_WARM: ${AGENTA_RUNNER_DAYTONA_SESSION_MAX_WARM:-}
             AGENTA_RUNNER_DAYTONA_AUTODELETE_MINUTES: ${AGENTA_RUNNER_DAYTONA_AUTODELETE_MINUTES:-}
+            AGENTA_RUNNER_DAYTONA_OPAQUE_SECRETS: ${AGENTA_RUNNER_DAYTONA_OPAQUE_SECRETS:-}
             # This service has no env_file (see above), so the session flags must be listed
             # here or they can never be set. Both default ON: absent or empty means on, and
             # only the literal "false" disables. Disable AGENTA_SESSIONS_RECONSTRUCT together

hosting/docker-compose/oss/env.oss.dev.example

@@ -89,6 +89,12 @@ AGENTA_RUNNER_DEFAULT_SANDBOX_PROVIDER=local
 # AGENTA_RUNNER_DAYTONA_AUTOSTOP_MINUTES=15
 # AGENTA_RUNNER_DAYTONA_AUTODELETE_MINUTES=30
 
+# Hide model and MCP API keys from the sandbox. When set to process_local, the runner stores each
+# key as a Daytona Secret restricted to the one host it authenticates against, and the sandbox sees
+# only a placeholder. Needs a Daytona API key with permission to manage Secrets. Leave unset to
+# keep passing keys as plain environment variables.
+# AGENTA_RUNNER_DAYTONA_OPAQUE_SECRETS=process_local
+
 # --- Warm sessions ---
 # Milliseconds. Must stay below AGENTA_RUNNER_DAYTONA_AUTOSTOP_MINUTES, or Daytona stops a sandbox
 # the runner still holds. 0 stops the sandbox after each turn.

hosting/docker-compose/oss/env.oss.gh.example

@@ -91,6 +91,12 @@ AGENTA_RUNNER_TOKEN=replace-me
 # AGENTA_RUNNER_DAYTONA_AUTOSTOP_MINUTES=15
 # AGENTA_RUNNER_DAYTONA_AUTODELETE_MINUTES=30
 
+# Hide model and MCP API keys from the sandbox. When set to process_local, the runner stores each
+# key as a Daytona Secret restricted to the one host it authenticates against, and the sandbox sees
+# only a placeholder. Needs a Daytona API key with permission to manage Secrets. Leave unset to
+# keep passing keys as plain environment variables.
+# AGENTA_RUNNER_DAYTONA_OPAQUE_SECRETS=process_local
+
 # --- Warm sessions ---
 # Milliseconds. Must stay below AGENTA_RUNNER_DAYTONA_AUTOSTOP_MINUTES, or Daytona stops a sandbox
 # the runner still holds. 0 stops the sandbox after each turn.

hosting/kubernetes/helm/templates/runner-deployment.yaml

@@ -118,6 +118,10 @@ spec:
             - name: AGENTA_RUNNER_DAYTONA_AUTODELETE_MINUTES
               value: {{ $daytona.autodeleteMinutes | quote }}
             {{- end }}
+            {{- if $daytona.opaqueSecrets }}
+            - name: AGENTA_RUNNER_DAYTONA_OPAQUE_SECRETS
+              value: {{ $daytona.opaqueSecrets | quote }}
+            {{- end }}
             {{- if $daytona.apiKeySecretRef }}
             - name: AGENTA_RUNNER_DAYTONA_API_KEY
               valueFrom:

hosting/kubernetes/helm/values.schema.json

@@ -339,7 +339,8 @@
                 "autostopMinutes":   { "type": ["integer", "string"], "description": "AGENTA_RUNNER_DAYTONA_AUTOSTOP_MINUTES." },
                 "autodeleteMinutes": { "type": ["integer", "string"], "description": "AGENTA_RUNNER_DAYTONA_AUTODELETE_MINUTES." },
                 "sessionIdleTtlMs":  { "type": ["integer", "string"], "description": "AGENTA_RUNNER_DAYTONA_SESSION_IDLE_TTL_MS." },
-                "sessionMaxWarm":    { "type": ["integer", "string"], "description": "AGENTA_RUNNER_DAYTONA_SESSION_MAX_WARM." }
+                "sessionMaxWarm":    { "type": ["integer", "string"], "description": "AGENTA_RUNNER_DAYTONA_SESSION_MAX_WARM." },
+                "opaqueSecrets":     { "type": "string", "enum": ["process_local"], "description": "AGENTA_RUNNER_DAYTONA_OPAQUE_SECRETS; hide model and MCP keys from the sandbox behind Daytona Secrets. Omit to keep passing them as plain environment variables." }
               }
             }
           }

hosting/kubernetes/helm/values.yaml

@@ -151,6 +151,8 @@ redisDurable:
 #       autodeleteMinutes: 30
 #       sessionIdleTtlMs: ""
 #       sessionMaxWarm: ""
+#       opaqueSecrets: process_local   # hide model/MCP keys from the sandbox; needs a Daytona
+#                                      # API key that may manage Secrets
 #   auth:
 #     tokenSecretRef:          # AGENTA_RUNNER_TOKEN; Services sends it, the runner verifies it
 #       name: agenta-runner

sdks/python/agenta/sdk/agents/adapters/harnesses.py

@@ -64,9 +64,9 @@ def _to_harness_config(self, config: SessionConfig) -> PiAgentTemplate:
         return PiAgentTemplate(
             agents_md=config.agent.instructions,
             model=config.agent.model,
-            # Thread the structured ref so the author's connection {mode, slug} reaches the /run
-            # wire (via wire_model_ref). Without it a named custom (OpenAI-compatible) connection
-            # loses its slug and the runner cannot build its models.json plan.
+            # Thread the structured ref so the author's connection {mode, slug} reaches the
+            # connection resolver. Without it a named custom (OpenAI-compatible) connection
+            # loses its slug and cannot be selected; only the resolved connection rides the wire.
             model_ref=config.agent.model_ref,
             resolved_connection=config.resolved_connection,
             tool_specs=list(config.tool_specs),

sdks/python/agenta/sdk/agents/adapters/sandbox_agent.py

@@ -64,7 +64,6 @@ def __init__(
         config: HarnessAgentTemplate,
         *,
         harness: HarnessKind,
-        secrets: Optional[Mapping[str, str]],
         trace: Optional[TraceContext],
         run_context: Optional[RunContext],
         session_id: Optional[str],
@@ -73,7 +72,6 @@ def __init__(
         self._sandbox = sandbox
         self._config = config
         self._harness = harness
-        self._secrets = dict(secrets or {})
         self._trace = trace
         self._run_context = run_context
         self._session_id = session_id
@@ -89,7 +87,6 @@ def _wire_payload(self, messages: Sequence[Message]) -> Dict[str, Any]:
             sandbox=self._sandbox.sandbox_id,
             config=self._config,
             messages=messages,
-            secrets=self._secrets,
             trace=self._trace,
             run_context=self._run_context,
             session_id=self._session_id,
@@ -175,7 +172,6 @@ async def create_session(
             sandbox,
             config,
             harness=harness,
-            secrets=secrets,
             trace=trace,
             run_context=run_context,
             session_id=session_id,

sdks/python/agenta/sdk/agents/capabilities.py

@@ -14,8 +14,8 @@
 
 - **Pi** reaches eight Agenta-vault-mapped providers directly (the ones whose ``provider_key``
   secret drives a Pi provider via its env-key map), plus ``openai-codex`` (OpenAI's ChatGPT/Codex
-  subscription), which Pi reaches through its own OAuth login rather than a vault key — usable
-  under ``self_managed`` (and the ``agenta`` default's ``runtime_provided`` fallback). Pi also
+  subscription), which Pi reaches through its own OAuth login rather than a vault key, usable
+  under ``self_managed``. Pi also
   reaches ~24 more providers that have no Agenta vault kind; those are out of scope unless a
   ``custom_provider`` secret is made for them, so they are not enumerated here. Pi consumes the
   ``direct`` deployment for all of them, plus the ``custom`` (OpenAI-compatible) deployment for
@@ -64,9 +64,8 @@
 # ``/login``), NOT an Agenta vault ``provider_key`` (no vault secret kind maps to it). ``self_managed``
 # is broader than this one provider: it covers any way a harness signs itself in without an
 # Agenta-stored key, including machine credentials such as environment variables. This provider's
-# on-ramp under ``self_managed`` happens to be the subscription OAuth. It is also reachable under
-# the ``agenta`` default's ``runtime_provided`` fallback, so it belongs in Pi's reachable providers
-# even though it carries no vault key. Its model ids are carried explicitly below because they are
+# on-ramp under ``self_managed`` happens to be the subscription OAuth. Its model ids are carried
+# explicitly below because they are
 # not in the litellm-derived ``supported_llm_models`` catalog. See
 # ``docs/design/agent-workflows/projects/provider-model-auth/harness-provider-matrix.md`` and the
 # subscription-sidecar recipe.

sdks/python/agenta/sdk/agents/connections/__init__.py

@@ -12,6 +12,8 @@
     ConnectionNotFoundError,
     ConnectionResolutionError,
     EndpointResolutionError,
+    InvalidConnectionConfigurationError,
+    MissingCredentialError,
     MissingProviderError,
     ProviderMismatchError,
     UnsupportedConnectionModeError,
@@ -22,10 +24,13 @@
 from .models import (
     Connection,
     CredentialMode,
+    CredentialUsage,
     Deployment,
     Endpoint,
+    EnvironmentCredentialBinding,
     ModelRef,
     ResolvedConnection,
+    ResolvedCredential,
     RuntimeAuthContext,
 )
 from .resolver import EnvConnectionResolver, StaticConnectionResolver
@@ -34,10 +39,13 @@
     # Contracts
     "Connection",
     "Endpoint",
+    "EnvironmentCredentialBinding",
     "ModelRef",
     "ResolvedConnection",
+    "ResolvedCredential",
     "RuntimeAuthContext",
     "CredentialMode",
+    "CredentialUsage",
     "Deployment",
     # Port + adapters
     "ConnectionResolver",
@@ -47,7 +55,9 @@
     "AgentConnectionError",
     "ConnectionResolutionError",
     "EndpointResolutionError",
+    "InvalidConnectionConfigurationError",
     "ConnectionNotFoundError",
+    "MissingCredentialError",
     "MissingProviderError",
     "AmbiguousConnectionError",
     "ProviderMismatchError",