Local credential proxy for AI agents (proxy MVP)#780

Open

theoephraim wants to merge 31 commits into

mainfrom

Commits on Jun 20, 2026

Add phase-1 proxy guardrails and strict egress enforcement
theoephraim
committed
Fix proxy guard typecheck and add bumpy changeset
theoephraim
committed
feat(varlock): add proxy sessions and placeholder-safe proxy behavior
theoephraim
committed
feat(varlock): harden local proxy for agent runs
theoephraim
committed
feat(varlock): proxy security invariants (verified-identity injection, cleartext guard, response scrub)
theoephraim
committed
feat(varlock): proxy per-call policy (path/method matching + block-deny + scoped injection)
theoephraim
committed
feat(varlock): proxy append-only audit log (Invariant #7)
theoephraim
committed
refactor(varlock): remove dead proxy config (pin/sign/transform)
theoephraim
committed
feat(varlock): proxy require-approval verdict (Invariant #8)
theoephraim
committed
fix(varlock): allow @proxy in the schema header (detached rules)
theoephraim
committed
feat(varlock): proxy omits unhandled sensitive items by default
theoephraim
committed
feat(varlock): warn (not just notice) when proxy omits unhandled sensitive vars
theoephraim
committed
feat(varlock): exclude _VARLOCK_* reserved keys from proxy omit policy
theoephraim
committed
feat(varlock): dual-form @proxy decorator (function or value), replacing @proxyPassthrough
theoephraim
committed
feat(varlock): scoped proxy approvals (once/session/duration) with standing grants
theoephraim
committed
feat(varlock): proxy approval granularity (approvalEach) + max-duration cap
theoephraim
committed
feat(varlock): proxy schema fingerprint covers full definition (value-defs + decorators)
theoephraim
committed
feat(varlock): proxy run attaches to a running proxy (--session / auto / --new)
theoephraim
committed
feat(varlock): session-as-record reorg — co-locate per-session files, keep on stop
theoephraim
committed
docs(varlock): document the credential proxy (guide + decorator & CLI reference)
theoephraim
committed
feat(varlock): @proxy uses array literals for domain/method lists and keys=[...]
theoephraim
committed
fix(varlock): proxy fingerprint treats domain=a and domain=[a] as identical
theoephraim
committed
feat(varlock): proxy refresh hot-reloads a running daemon (live policy swap)
theoephraim
committed
feat(varlock): blocking proxy refresh via file reload channel (replaces SIGHUP)
theoephraim
committed
harden proxy secret isolation + fail-closed config, dedup handlers
theoephraim
committed
refactor(proxy): group approval options into an approval={...} object
theoephraim
committed
refactor(proxy): nest approval granularity in the runtime ProxyRule type
theoephraim
committed
feat(proxy): live request/response log in `proxy start`
theoephraim
committed
fix(proxy): keep the live log from corrupting the approval prompt
theoephraim
committed
feat(proxy): color the proxy-start request log
theoephraim
committed
feat(proxy): add `proxy rules` summary, document limitations
theoephraim
committed