Credential non-exposure: inject secrets upstream so the agent never sees raw keys

[claude]

Motivation. coop hardens how secrets enter the guest (kept off argv, redacted, passed via stdin), but the agent can still read any credential once inside — so a prompt-injected or rogue agent can exfiltrate it, and the VM boundary doesn't help (egress is open today; see #2). Even a server-scoped token (#73) leaks its scope if the agent can read it.

Idea. Run an L7 proxy that injects auth into upstream requests so the agent never holds the raw secret. coop already runs this exact plumbing for local models (ANTHROPIC_BASE_URL → host gateway, see #62), so the seam already exists.

Scope. A host-side injecting proxy on the guest's egress path: the agent points at a loopback/gateway endpoint; the host holds the secret, injects Authorization, and forwards upstream. Shares the networking seam with #2's egress filter.

Open design question — general injecting proxy vs. per-integration.

• One general injecting proxy — a single host-side proxy on the egress path handles all credentials. Pro: closes the pattern uniformly, one place to audit, composes directly with the Restrict guest network egress (allowlist + offline lockdown) #2 egress filter. Con: bigger build — must terminate TLS for arbitrary upstreams (a guest-trusted MITM CA to manage), handle SSE streaming and tool-use round-trips, and carry per-service injection rules.
• Per-integration — each credential handled by its own mechanism (Anthropic via the Forward Claude Code OAuth credentials from host into the guest #62 host relay, GitHub via Creating a scoped gh token #73 server-scoping, etc.). Pro: incremental, each piece is simpler and independently shippable, and avoids a guest-trusted MITM CA. Con: leaves gaps — any integration without a bespoke path still hands the agent a raw key — and duplicates injection logic across services.

Caveats. Whichever path: must handle SSE streaming + tool-use round-trips and TLS termination (non-trivial — a genuine build, not a quick win); ship with sane defaults so it doesn't force policy authoring.

Relationships. Generalizes the #62 host-relay follow-up (the model-API instance); complements #73 (server-enforced scope) and #2 (egress control).