feat: secrets agent-proxy start and connect commands by saifsmailbox98 · Pull Request #308 · Infisical/cli

saifsmailbox98 · 2026-07-10T18:51:07Z

Description 📣

Adds the Infisical Agent Proxy — the client that powers Secrets Brokering. Untrusted code (AI agents, unsafe code-execution environments) routes its HTTP traffic through the proxy, which injects real credentials on the wire so the agent only ever handles placeholders. Backend + frontend companion PR: Infisical/infisical#7246.

Two commands under infisical secrets agent-proxy:

start — a single-port MITM proxy that brokers credentials on the wire. On the first request from an agent it discovers that agent's proxied services (using the agent's JWT) and fetches the real secret values (using its own machine identity), caches per agent, and re-polls on an interval. It signs a short-lived intermediate CA against the org root CA and mints leaf certs per hostname locally. Supports header rewriting (bearer / basic auth / API key) and credential substitution across path/query/body/header, plus --unmatched-host=allow|block, --poll-interval, and --port.
connect — the wrapper that sets up an agent: authenticates the agent machine identity, downloads the org root CA, fetches proxied-service placeholders + regular secrets, and forks the agent with the environment wired up (HTTPS_PROXY/HTTP_PROXY, CA-trust vars, NO_PROXY, placeholder env vars, real secrets). Machine-identity credentials are stripped from the child so the agent only gets a scoped JWT. --no-proxy adds bypass hosts (merged with the loopback defaults).

Host matching follows exact-host > specific-port > longest-path-prefix, with full ties broken deterministically by service name. Credential injection always wins over client-supplied headers (hop-by-hop stripping runs before injection).

Type ✨

Tests 🛠️

# Here's some code block to paste some code snippets

I have read the contributing guide, agreed and acknowledged the code of conduct. 📝

MITM agent proxy that brokers credentials on the wire (header rewriting and credential substitution), plus the connect wrapper that fetches the root CA, placeholders, and secrets and forks the agent process.

- refresh the proxy MI access token before it expires (re-login goroutine), so secret fetches and CA signing don't start 401ing after the token TTL - evict an agent's cache on a 401/403 during refresh, so a revoked or expired agent JWT stops receiving brokered credentials (fail closed) - leaf certs use the IP SAN for IP-literal CONNECT targets (not DNS names) - connection deadlines: bound CONNECT read, TLS handshake, and idle tunnel - case-insensitive host matching for wildcards (matching exact behavior) - blocked hosts return 403 (not 502) so policy blocks are distinguishable - pass INFISICAL_DOMAIN to the agent so its infisical commands hit the same instance - require --env (no silent 'dev' default)

- register --token flag so INFISICAL_TOKEN auth works in connect - strip machine identity credentials from the agent environment - retry proxy token refresh on failure instead of waiting a full cycle - standardize on zerolog; name cert lifetime constants - cap leaf cert expiry at the intermediate; close re-sign cache race - exit accept loop on listener close; handle IPv6 CONNECT targets - strip hop-by-hop headers; drain request body on keep-alive tunnels - tiered host-pattern precedence matching the design doc

linear · 2026-07-10T18:51:10Z

AGE2-39

infisical-review-police · 2026-07-10T18:51:11Z

💬 Discussion in Slack: #pr-review-cli-308-feat-secrets-agent-proxy-start-and-connect-commands

Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel.

gitguardian · 2026-07-10T18:51:12Z

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
34725125	Triggered	Base64 Basic Authentication	`8a9ea27`	packages/agentproxy/rewrite_test.go	View secret

🛠 Guidelines to remediate hardcoded secrets

Understand the implications of revoking this secret by investigating where it is used in your code.
Replace and store your secret safely. Learn here the best practices.
Revoke and rotate this secret.
If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

following these best practices for managing and storing secrets including API keys and other credentials
install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

greptile-apps · 2026-07-10T19:00:04Z

Greptile Summary

This PR adds the Infisical Agent Proxy — a MITM HTTP/HTTPS proxy that brokers credentials on the wire so untrusted agents only ever see placeholders. It introduces two CLI commands (secrets agent-proxy start and secrets agent-proxy connect) and a new agentproxy package covering the CA lifecycle, per-agent credential cache, host matching, and credential rewriting.

start: Authenticates a machine identity, signs an intermediate CA against the org root, mints per-hostname leaf certs, and forwards/rewrites requests with real credentials substituted in-band.
connect: Authenticates the agent MI, fetches the root CA and placeholders, builds a fully wired environment (proxy vars, CA trust, placeholder env vars, real secrets), and forks the agent with long-lived credentials stripped from its environment.
Tests: Comprehensive table-driven and integration-style tests cover matching, rewriting, CA fallback, signal forwarding, and the plain/CONNECT proxy paths.

Confidence Score: 4/5

The proxy core is safe to merge; the open listener-binding finding from a prior review round remains unaddressed but was already known.

The proxy still accepts connections from any network interface via net.Listen on all addresses. No new blocking issues were introduced in this pass; all new findings are non-blocking quality items.

packages/agentproxy/match.go (IPv6 host patterns always fail to match), packages/cmd/agent_proxy.go (signal subscription scope, lowercase proxy env vars not set)

Important Files Changed

Filename	Overview
packages/agentproxy/proxy.go	Core MITM proxy: auth, routing, CONNECT/plain-forward paths. Previously flagged: binds 0.0.0.0 (no loopback-only option). New code is otherwise well-structured with proper hop-by-hop stripping, host pinning, and policy checks.
packages/agentproxy/cache.go	Agent credential cache with periodic refresh. TOCTOU on concurrent miss and revocation lag were previously discussed and accepted as intentional design. Logic is sound.
packages/agentproxy/ca.go	Intermediate CA lifecycle: lazy init, renewal with fallback on Infisical outage, leaf cache with generation-stamped eviction. Correct use of dual-lock pattern to avoid leaf-to-stale-intermediate association.
packages/agentproxy/match.go	Host/port/path pattern matching. IPv6 literals in patterns are broken: bracketed form stores brackets but incoming hostnames never have them; unbracketed form mis-parses address colons as port separators.
packages/agentproxy/rewrite.go	Header rewriting and placeholder substitution across path/query/body/header. Oversized body pass-through is correct (avoids truncation) but emits no log, making silent credential non-injection hard to detect.
packages/cmd/agent_proxy.go	connect command: auth, CA fetch, placeholder/secret injection, env building. Lowercase proxy env vars (https_proxy, http_proxy, no_proxy) are stripped but not re-set; signal.Notify subscribes to all signals with a buffer of 1.
packages/cmd/agent_proxy_start.go	start command: MI auth, token refresh goroutine with retry backoff, delegates to agentproxy.Start. Token refresh logic is correct (half-TTL refresh, short retry on failure).
packages/api/agent_proxy.go	API client methods for CA fetch, intermediate CA signing, and proxied-service listing. Straightforward REST wrappers with proper error handling.

_{Reviews (4): Last reviewed commit: "fix: pin upstream Host header to the mat..." | Re-trigger Greptile}

veria-ai · 2026-07-10T19:02:58Z

PR overview

All previously flagged issues have been addressed. No open security concerns remain on this pull request.

Security review

No open security issues remain on this pull request.

Fixed/addressed: 11 · PR risk: 0/10

…tunnel

saifsmailbox98 · 2026-07-10T22:03:03Z

@greptile review

saifsmailbox98 · 2026-07-10T22:24:58Z

@greptile review

saifsmailbox98 · 2026-07-10T22:39:53Z

@greptile review

…rets The agent proxy's credential fetch and the connect wrapper's secret fetch now request reference expansion and imported secrets, matching infisical run.

akhilmhdh

Pending application test

…ifecycle timeouts

saifsmailbox98 added 11 commits July 9, 2026 23:31

feat: secrets agent-proxy start and connect commands

8a9ea27

MITM agent proxy that brokers credentials on the wire (header rewriting and credential substitution), plus the connect wrapper that fetches the root CA, placeholders, and secrets and forks the agent process.

docs: note substring-replacement behavior in credential substitution

b114ad4

fix: fall back to still-valid intermediate CA when re-sign fails

491d4ff

feat: broker plain-HTTP upstreams via absolute-form forward proxying

bd2006f

fix: skip placeholders of disabled proxied services in connect

b968e07

fix: break proxied service host-match ties deterministically by name

3731285

test: cover credential rewrite surfaces, prefixes, and body edge cases

9fe18cb

fix: strip hop-by-hop headers before injecting so credentials always win

4025bba

feat: merge operator NO_PROXY entries and add --no-proxy flag to connect

415e65d

saifsmailbox98 mentioned this pull request Jul 10, 2026

feat(secret-manager): secrets brokering (proxied services + agent proxy CA) Infisical/infisical#7246

Open

11 tasks

greptile-apps Bot reviewed Jul 10, 2026

View reviewed changes

Comment thread packages/agentproxy/proxy.go

Comment thread packages/agentproxy/cache.go

veria-ai Bot reviewed Jul 10, 2026

View reviewed changes

Comment thread packages/cmd/agent_proxy.go

Comment thread packages/agentproxy/proxy.go

Comment thread packages/agentproxy/proxy.go

Comment thread packages/agentproxy/cache.go

fix: force HTTP/1.1 upstream so HTTP/2 responses don't hang the MITM …

c5e2e3c

…tunnel

veria-ai Bot reviewed Jul 10, 2026

View reviewed changes

Comment thread packages/agentproxy/proxy.go

fix: authenticate before minting proxy leaf certs and bound leaf cache

1a9f187

veria-ai Bot reviewed Jul 10, 2026

View reviewed changes

Comment thread packages/agentproxy/proxy.go Outdated

Comment thread packages/agentproxy/proxy.go

fix: pin upstream Host header to the matched authority

dd4ba4d

veria-ai Bot reviewed Jul 10, 2026

View reviewed changes

Comment thread packages/cmd/agent_proxy.go

saifsmailbox98 added 2 commits July 11, 2026 04:48

chore: trim non-essential comments from agent proxy code

f7f4c1b

feat: expand references and include imports when fetching proxied sec…

392116c

…rets The agent proxy's credential fetch and the connect wrapper's secret fetch now request reference expansion and imported secrets, matching infisical run.

veria-ai Bot reviewed Jul 11, 2026

View reviewed changes

Comment thread packages/agentproxy/proxy.go Outdated

akhilmhdh reviewed Jul 13, 2026

View reviewed changes

saifsmailbox98 added 2 commits July 13, 2026 13:27

feat: match IPv6 host patterns in the agent proxy

4dbe55a

fix(agentproxy): bound request header size to prevent memory exhaustion

486c678

saifsmailbox98 requested a review from akhilmhdh July 13, 2026 11:24

veria-ai Bot reviewed Jul 13, 2026

View reviewed changes

Comment thread packages/agentproxy/cache.go

fix(agentproxy): cap resolution cache with LRU eviction to bound memory

f2ed427

veria-ai Bot reviewed Jul 13, 2026

View reviewed changes

Comment thread packages/agentproxy/proxy.go Outdated

refactor(agentproxy): serve via http.Server with connection cap and l…

cbf540a

…ifecycle timeouts

Uh oh!

Conversation

saifsmailbox98 commented Jul 10, 2026

Description 📣

Type ✨

Tests 🛠️

Uh oh!

linear Bot commented Jul 10, 2026

Uh oh!

infisical-review-police Bot commented Jul 10, 2026

Uh oh!

gitguardian Bot commented Jul 10, 2026

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Uh oh!

greptile-apps Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 4/5

Important Files Changed

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

veria-ai Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR overview

Security review

Uh oh!

Uh oh!

saifsmailbox98 commented Jul 10, 2026

Uh oh!

Uh oh!

Uh oh!

saifsmailbox98 commented Jul 10, 2026

Uh oh!

Uh oh!

saifsmailbox98 commented Jul 10, 2026

Uh oh!

Uh oh!

akhilmhdh left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

greptile-apps Bot commented Jul 10, 2026 •

edited

Loading

veria-ai Bot commented Jul 10, 2026 •

edited

Loading