Staff Software Engineer @ Navan, ML Flow & Cypress Ambassador, Docker Captain and creator of agent-inspect, writing about production AI agents, TypeScript, observability, testing, and developer tools.
Appreciate your source-level follow-up on inject_env: the child process can read the credential, while kernel egress policy limits where it can send it. That's a different guarantee from “the agent never holds keys.” A canary-key test covering stdout/logs and approved-host requests would make that boundary concrete. Is request-time proxy injection on the roadmap, or intentionally outside OpenShell's model?
Senior Lead Tech/Dev, 20+ years. Building NoireBox — the flight recorder for your of AI agents. Proof, not promises. Rust · TS · Python · PHP. I write about trust in AI.
Right — and the honest name for what the kernel side actually gives you: egress policy approves destinations, not content. It is content-blind by design. An approved host is an exfil channel for anything the child process can read, at full bandwidth, because a token riding a query string to an allowed domain is indistinguishable from legitimate traffic at that layer.
Your canary test is the right instrument, and it pre-registers cleanly. Plant a canary credential through a provider, then run three legs: read it from env and write it to a log file, echo it to stdout, and place it in a request to an approved host. Predictions on record before the run: legs one and two land wherever the sandbox lets files and stdout land; leg three leaves, because the policy said yes to the destination and was never asked about the payload. A fourth leg is worth adding: check whether the OCSF HTTP Activity events capture request headers — if the recorder logs the request, the evidence stream itself is a channel, and that finding is worth more than the architecture post.
On request-time proxy injection: that's NVIDIA's roadmap to declare, not mine to guess. What the repo shows is the seam — the gateway-interceptors middleware is exactly where request-time injection would attach, so it is buildable inside their extension model without forking the thesis; nothing in the default path does it today. Buildable-in-principle, shipped-by-no-one is the honest state of the art, and the canary test is how anyone would know the moment that changes.
For further actions, you may consider blocking this person and/or reporting abuse
We're a place where coders share, stay up-to-date and grow their careers.
Appreciate your source-level follow-up on inject_env: the child process can read the credential, while kernel egress policy limits where it can send it. That's a different guarantee from “the agent never holds keys.” A canary-key test covering stdout/logs and approved-host requests would make that boundary concrete. Is request-time proxy injection on the roadmap, or intentionally outside OpenShell's model?
Right — and the honest name for what the kernel side actually gives you: egress policy approves destinations, not content. It is content-blind by design. An approved host is an exfil channel for anything the child process can read, at full bandwidth, because a token riding a query string to an allowed domain is indistinguishable from legitimate traffic at that layer.
Your canary test is the right instrument, and it pre-registers cleanly. Plant a canary credential through a provider, then run three legs: read it from env and write it to a log file, echo it to stdout, and place it in a request to an approved host. Predictions on record before the run: legs one and two land wherever the sandbox lets files and stdout land; leg three leaves, because the policy said yes to the destination and was never asked about the payload. A fourth leg is worth adding: check whether the OCSF
HTTP Activityevents capture request headers — if the recorder logs the request, the evidence stream itself is a channel, and that finding is worth more than the architecture post.On request-time proxy injection: that's NVIDIA's roadmap to declare, not mine to guess. What the repo shows is the seam — the
gateway-interceptorsmiddleware is exactly where request-time injection would attach, so it is buildable inside their extension model without forking the thesis; nothing in the default path does it today. Buildable-in-principle, shipped-by-no-one is the honest state of the art, and the canary test is how anyone would know the moment that changes.