No way to hand the daemon a secret without it passing through the model transcript #22
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
In session
mt82q1ns-l8nrgethe operator pasted a Google service-account JSON— including the full
private_key— into chat so a calendar integration couldbe tried. The agent then embedded it verbatim as a string literal inside an
mcp__endo__execbody.The key is now in plaintext in the session JSONL at least twice: once as the
user message, once as tool input. It is also in whatever context windows that
session used.
There is no capability-shaped alternative. Every route to "give the daemon a
credential" currently runs through the agent as text.
Wanted: a secret-ingestion path where the operator submits the value to the
daemon directly (a form field, a drop target, a paste box in the UI) and the
agent receives only a capability referring to it — never the bytes. The agent
should be able to say "send me a credential for X" and get back a handle it can
pass to
provideGitRemote,provideHttpClientand friends.Implemented on
feature/secret-ingestion(a48bea2b3).requestSecret/writeSecrettools on every Floot session (API and Claude CLI). The operator gets a paste box in the Floot UI; the model receives only{ petName, kind, audience, byteLength }.EndoHost.writeSecret(mount, path, credential)writes material to a mount without revealing it.secretplusasCredential/audience/secretKindmint a credential cap on submit instead of storing the string. Existing Lal-stylesecret: truefields are unchanged.Not deployed yet. After review we pin this revision and the paste box will be live.