feat(secrets): inject bound vault secrets into agent shells as env vars

[JongSikLim]

Summary

Lets a user bind a vault secret to a task so its value is injected into the agent's shell as an environment variable — the model can use it (curl -H "Authorization: Bearer $KEY") but never see the plaintext. This is the "C" option from the design discussion: consumption without exposure.

The value flows Electron-main → child-process env only. It never enters runtimeOptions (ids only), never crosses preload for runtime use, and never lands in prompts, transcripts, BridgeEvents, diagnostics, or logs.

Honest trade-off: this is an automatic-leak guarantee, not a sandbox. A deliberate echo $KEY can still surface a bound value. The Settings copy and AGENTS.md say so explicitly.

What changed

Data model (envVarName on a secret)

• Optional POSIX-validated envVarName on the stored secret (secret-vault.ts, secrets.ts, IPC schema, settings form). No VAULT_VERSION bump — older files load fine.
• Reserved-key denylist (PATH, CLAUDE_CONFIG_DIR, CODEX_HOME, STAVE_LOCAL_MCP_TOKEN, ELECTRON_*, …) + global uniqueness among env-var names.

Binding (boundSecretIds, ids only)

• Plumbed through RuntimeOptionsObjectSchema, ProviderRuntimeOptions, PromptDraftRuntimeOverrides (+ its schema), ResolvedPromptDraftRuntimeState, and buildProviderRuntimeOptions.
• Persists in the workspace snapshot (survives restart); no SQLite migration.
• New composer control (SecretBindingControl) to pick which injectable secrets bind to the task. Shows masked preview + env-var name only.

Resolver (main-process only)

• resolveBoundSecretEnv({ ids }) maps ids → env map, skipping non-injectable / reserved / duplicate names. Not exposed via preload. Logs counts + names only, never values. electron is now lazy-required so importing it into the runtimes doesn't break the bun test import graph.

Claude injection

• secretEnv spread last into options.env, for the primary turn only — kept out of buildClaudeDiagnostics and every aux/introspection query by construction.

Codex injection + resume-drop fix

• Injects via per-thread shell_environment_policy.set.<KEY> overrides (same channel as the NVM PATH shim), merged into configOverrides.
• Folds a name-only fingerprint into the thread key so a changed binding forces a fresh thread/start.
• Bug fix: thread/resume previously dropped caller configOverrides entirely (MCP isolation + our secrets). Now forwarded on both start and resume.

Testing

• bun run typecheck clean.
• bun run check:max-lines-ratchet / check:switch-exhaustiveness / check:reliability-gates pass.
• New/extended unit tests: tests/secrets.test.ts (+13: env-var normalize, denylist, vault round-trip, legacy load, uniqueness, resolveEnvForIds), tests/codex-app-server-secret-env.test.ts (resume/start override forwarding), tests/prompt-draft-runtime.test.ts (+2: boundSecretIds resolution + equality).
• Full suite: branch adds zero new failures vs main baseline (remaining failures are pre-existing environmental: nvm binary discovery, fs/timeout).

Not done / follow-ups

• Manual in-app verification (printenv NAME in the agent shell; confirm value present in shell, absent from transcript) was not run in this environment — the code path is unit-covered but not exercised against a live Electron session.
• Codex read-only advisor path is intentionally not injected (main-turn parity with Claude), per the plan's v1 recommendation.

🤖 Generated with Claude Code

[upwind-code-us]

Upwind IaC Scan - ✅ Proceed with Deployment

0 misconfigurations detected

View full analysis in Upwind Console →

Scan completed in 4s

Scan history (2 scans)

Commit	Scanned at	New	Resolved	Net
ee62f25	2026-07-29 08:27 UTC	—	—	—
ee62f25 <	2026-07-29 08:27 UTC	—	—	—

Last scanned: ee62f25 · 2026-07-29 08:27 UTC