@cabane/companion 0.6.133 → 0.6.135

package/README.md

@@ -311,12 +311,12 @@ What the sandbox allows is `runners.policy` in `~/.cabane/config.json`. Every ke
 }
 ```
 
-| Setting                                   | Default                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **Hosts**, always reachable               | Cabane, and the model provider of the turn's harness (Anthropic for Claude Code, OpenAI for Codex). `allow` and `defaults` never remove these; a `deny` entry naming one does, and blocks the turn from reaching it.                                                                                                                                                                                                                                                                                                                                                            |
-| **Hosts**, `defaults`                     | `github.com`, `*.github.com`, `*.githubusercontent.com`, `registry.npmjs.org`, `pypi.org`, `files.pythonhosted.org`, `crates.io`, `static.crates.io`, `index.crates.io`. `allow` adds to them, `deny` removes a host (and wins), `defaults: false` drops the list.                                                                                                                                                                                                                                                                                                              |
-| **Reads**, `blocklist` mode (the default) | Everything is readable except every companion's store (`~/.cabane`, and any `.cabane` under your home or beside this companion's home; see below), the `.claude` and `.codex` of the other companion homes those stores sit in, `~/.ssh`, `~/.aws`, `~/.gnupg`, `~/.config/gh`, `~/.git-credentials`, `~/.netrc`, `~/.npmrc`, `~/.pypirc`, `~/.docker/config.json`, `~/.kube`, `~/.config/gcloud`, `~/.azure`, `~/.config/op`, `~/.password-store`, any `.env` or `.env.*` in the working directory, and your `denyRead` paths. `allowRead` reopens a path inside a denied one. |
-| **Writes**                                | The working directory, the temp dir, `~/.claude`, `~/.claude.json`, `~/.codex`, plus `allowWrite`.                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| Setting                                   | Default                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| **Hosts**, always reachable               | Cabane, and the model provider of the turn's harness (Anthropic for Claude Code, OpenAI for Codex). `allow` and `defaults` never remove these; a `deny` entry naming one does, and blocks the turn from reaching it.                                                                                                                                                                                                                                                                                                           |
+| **Hosts**, `defaults`                     | `github.com`, `*.github.com`, `*.githubusercontent.com`, `registry.npmjs.org`, `pypi.org`, `files.pythonhosted.org`, `crates.io`, `static.crates.io`, `index.crates.io`. `allow` adds to them, `deny` removes a host (and wins), `defaults: false` drops the list.                                                                                                                                                                                                                                                             |
+| **Reads**, `blocklist` mode (the default) | Everything is readable except every companion's store (`~/.cabane`, and any `.cabane` under your home or beside this companion's home; see below), the `.claude` and `.codex` of the other companion homes those stores sit in, `~/.ssh`, `~/.aws`, `~/.gnupg`, `~/.config/gh`, `~/.git-credentials`, `~/.netrc`, `~/.npmrc`, `~/.pypirc`, `~/.docker/config.json`, `~/.kube`, `~/.config/gcloud`, `~/.azure`, `~/.config/op`, `~/.password-store`, and your `denyRead` paths. `allowRead` reopens a path inside a denied one. |
+| **Writes**                                | The working directory, the temp dir, `~/.claude`, `~/.claude.json`, `~/.codex`, plus `allowWrite`.                                                                                                                                                                                                                                                                                                                                                                                                                             |
 
 **One agent can be excepted.** The sandbox is set per device, and one agent's row in `agents` can say otherwise — for example an ops agent whose job is the machine itself, on a device whose other agents stay sandboxed:
 
@@ -341,7 +341,7 @@ Paths may start with `~/` and may be globs. An invalid `policy` doesn't stop the
 
 **Other companions on the same machine.** A second companion (another account, a test device) keeps its own secrets in its own `.cabane`, so a turn can't read any companion's store, not only this device's. Every turn denies this companion's store and `~/.cabane` (both, when the Companion runs from a home set with `CABANE_COMPANION_HOME`), plus any `.cabane` up to two levels under your home or beside this companion's home, where companion homes conventionally sit. Stores anywhere deeper are found by a search of your home with `find`, along with the `.claude` and `.codex` beside each one, which hold that companion's harness logins. That search takes seconds over a large home, so the Companion runs it in the background: when it starts, and again whenever a turn starts more than 5 minutes after the last search finished. Only the first turn after a start waits for it. **A store created deeper than two levels is denied within about 5 minutes plus one search, not instantly.** If a search can't finish (`find` is missing, runs past 60 seconds, or hits a directory it can't list), the stores it did find are still denied, and the log says so. The search runs in strict mode too, because strict mode reopens the working directory, and a store inside it must stay hidden.
 
-**`.env` files in other projects.** Only the working directory's `.env` files are denied by default. Another project's `.env` stays readable by its absolute path. If your other projects hold secrets, list their roots, for example `"denyRead": ["~/work/**/.env", "~/work/**/.env.*"]`. Each glob is expanded when the turn starts, which costs a walk of that tree on every turn and misses files created during the turn. When other projects' secrets really matter, strict mode is the better answer, because it hides them all without a walk.
+**`.env` files are readable.** Beyond the credential locations above, nothing guesses which of your files hold secrets, so `.env` files, in the working directory or any other project, are readable unless you deny them. To hide them, list the roots that hold them, for example `"denyRead": ["~/work/**/.env", "~/work/**/.env.*"]`. Each glob is expanded when the turn starts, which costs a walk of that tree on every turn and misses files created during the turn, so keep the roots narrow. When other projects' secrets really matter, strict mode is the better answer, because it hides them all without a walk.
 
 **Strict mode.** `"filesystem": { "mode": "strict" }` hides your whole home directory except the working directory, the harness state (`~/.claude`, `~/.codex`), what the Companion and its harnesses run from, and the paths you list in `allowRead`. Toolchains live all over a home directory (`~/.nvm`, `~/.local/share/pnpm`, `~/.cargo`, `~/.pyenv`, mise or asdf shims), so list yours, or builds will fail with "No such file or directory" on a path you didn't expect. On Linux a hidden path looks missing rather than denied, so the Companion log prints the readable list at the start of each strict turn. Compare it against the path the build couldn't find.
 

package/dist/cli.js

@@ -2024,12 +2024,14 @@ var init_turn_request = __esm({
       z8.object({
         type: z8.literal("http"),
         url: z8.string(),
-        headers: z8.record(z8.string(), z8.string()).optional()
+        headers: z8.record(z8.string(), z8.string()).optional(),
+        headersFromEnv: z8.record(z8.string(), z8.string()).optional()
       }),
       z8.object({
         type: z8.literal("sse"),
         url: z8.string(),
-        headers: z8.record(z8.string(), z8.string()).optional()
+        headers: z8.record(z8.string(), z8.string()).optional(),
+        headersFromEnv: z8.record(z8.string(), z8.string()).optional()
       })
     ]);
     resolvedMcpServersSchema = z8.record(z8.string(), resolvedMcpServerSchema);
@@ -2070,6 +2072,11 @@ var init_turn_request = __esm({
         cwd: z8.string().optional(),
         env: z8.record(z8.string(), z8.string()).optional(),
         mcpServers: resolvedMcpServersSchema.optional(),
+        // CT1698: the values `headersFromEnv` names, per turn (`CABANE_MCP_<n>` →
+        // complete header value). The adapter merges them into the harness
+        // process's environment and nowhere else; the host never merges them into
+        // its own. Absent when no server references one.
+        secretEnv: z8.record(z8.string(), z8.string()).optional(),
         // CT289: machine-local claude-code adapter knobs the operator sets on a
         // companion they run themselves — the auto-memory escape hatch. `autoMemory:
         // true` opts back into Claude Code's auto-memory (governed by the operator's
@@ -2565,6 +2572,29 @@ var init_addendum = __esm({
   }
 });
 
+// packages/agent-runtime/src/mcp-secret-env.ts
+function headersAsEnvReferences(server) {
+  const refs = Object.entries(server.headersFromEnv ?? {}).map(
+    ([header, envName]) => [header, `\${${envName}}`]
+  );
+  if (!server.headers && refs.length === 0) return void 0;
+  return { ...server.headers, ...Object.fromEntries(refs) };
+}
+function headersResolvedFrom(server, secretEnv) {
+  const resolved = {};
+  for (const [header, envName] of Object.entries(server.headersFromEnv ?? {})) {
+    const value = secretEnv?.[envName];
+    if (value !== void 0) resolved[header] = value;
+  }
+  if (!server.headers && Object.keys(resolved).length === 0) return void 0;
+  return { ...server.headers, ...resolved };
+}
+var init_mcp_secret_env = __esm({
+  "packages/agent-runtime/src/mcp-secret-env.ts"() {
+    "use strict";
+  }
+});
+
 // packages/agent-runtime/src/claude-code/policy.ts
 import { z as z10 } from "zod";
 function disallowedToolsFor(policy) {
@@ -2713,8 +2743,18 @@ async function preToolUseHook(input) {
 function buildClaudeCodeOptions(req, augment) {
   const { policy, config } = req;
   const cwd = req.local.cwd;
+  const userServers = {};
+  for (const [name, server] of Object.entries(req.local.mcpServers ?? {})) {
+    if ("url" in server) {
+      const { headersFromEnv: _refs, headers: _headers, ...rest } = server;
+      const headers = headersAsEnvReferences(server);
+      userServers[name] = { ...rest, ...headers ? { headers } : {} };
+    } else {
+      userServers[name] = server;
+    }
+  }
   const mcpServers = {
-    ...req.local.mcpServers ?? {},
+    ...userServers,
     ...req.extra.mcpServers
   };
   if (!(CABANE_MCP_SERVER in mcpServers)) {
@@ -2796,9 +2836,13 @@ function buildClaudeCodeOptions(req, augment) {
     // SDK's own doc on `Options.env`), which is why `process.env` is spread here
     // and why this key is now always present — previously it appeared only when
     // `req.local.env` was set, and an absent `env` inherits `process.env`.
+    //
+    // CT1698: `secretEnv` joins here, and only here — the values the MCP
+    // headers above reference. It is this child's environment, not the host's.
     env: {
       ...process.env,
       ...req.local.env,
+      ...req.local.secretEnv,
       CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: "1"
     },
     ...resume ? { resume } : {}
@@ -2832,6 +2876,7 @@ var CABANE_MCP_SERVER, ACTIVE_CONVERSATION_HEADER;
 var init_options = __esm({
   "packages/agent-runtime/src/claude-code/options.ts"() {
     "use strict";
+    init_mcp_secret_env();
     init_policy();
     init_model();
     init_session();
@@ -4121,7 +4166,10 @@ function buildRunSpec(req, resumeSessionId) {
     // Fresh session → mint + send a client id; resumed → let opencode mint it.
     sendClientMessageId: resumeSessionId == null,
     ...dialect.agent ? { agent: dialect.agent } : {},
-    mcp: buildMcp(req)
+    mcp: buildMcp(req),
+    credentialServers: Object.entries(req.local.mcpServers ?? {}).filter(
+      ([, server]) => "url" in server && Object.keys(server.headersFromEnv ?? {}).length > 0
+    ).map(([name]) => name)
   };
 }
 function buildParts(req) {
@@ -4140,10 +4188,11 @@ function buildMcp(req) {
   const mcp = {};
   for (const [name, server] of Object.entries(req.local.mcpServers ?? {})) {
     if ("url" in server) {
+      const headers = headersResolvedFrom(server, req.local.secretEnv);
       mcp[name] = {
         type: "remote",
         url: server.url,
-        ...server.headers ? { headers: server.headers } : {},
+        ...headers ? { headers } : {},
         enabled: true
       };
     } else if ("command" in server) {
@@ -4202,6 +4251,7 @@ var CABANE_MCP_SERVER2, TURN_CONTROL_MCP_SERVER, ACTIVE_CONVERSATION_HEADER2;
 var init_run_spec = __esm({
   "packages/agent-runtime/src/opencode/run-spec.ts"() {
     "use strict";
+    init_mcp_secret_env();
     init_policy2();
     init_model2();
     CABANE_MCP_SERVER2 = "cabane";
@@ -4338,23 +4388,47 @@ async function* releaseAfter(events, release) {
   }
 }
 async function installMcp(doFetch, base, spec, signal) {
+  const [live, configured] = await Promise.all([
+    getJson(doFetch, `${base}/mcp`, signal),
+    getJson(doFetch, `${base}/config`, signal)
+  ]);
+  const operatorOwned = new Set(Object.keys(asRecord2(asRecord2(configured).mcp)));
+  const stale = Object.keys(asRecord2(live)).filter(
+    (name) => !(name in spec.mcp) && !operatorOwned.has(name)
+  );
+  await Promise.all(stale.map((name) => postMcp(doFetch, base, name, SCRUBBED_MCP_CONFIG, signal)));
+  const shadowing = (spec.credentialServers ?? []).filter((name) => operatorOwned.has(name));
+  if (shadowing.length > 0) {
+    throw new Error(
+      `opencode: ${shadowing.map((n) => `"${n}"`).join(", ")} would replace an MCP server this opencode instance configures itself; rename that server in the opencode config to use this connection here`
+    );
+  }
   await Promise.all(
-    Object.entries(spec.mcp).map(async ([name, config]) => {
-      const res = await doFetch(`${base}/mcp`, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ name, config }),
-        signal
-      });
-      if (!res.ok) {
-        const detail = await res.text().catch(() => "");
-        throw new Error(
-          `opencode: MCP config install failed for "${name}" (HTTP ${res.status}${detail ? `: ${detail}` : ""})`
-        );
-      }
-    })
+    Object.entries(spec.mcp).map(([name, config]) => postMcp(doFetch, base, name, config, signal))
   );
 }
+async function postMcp(doFetch, base, name, config, signal) {
+  const res = await doFetch(`${base}/mcp`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ name, config }),
+    signal
+  });
+  if (!res.ok) {
+    const detail = await res.text().catch(() => "");
+    throw new Error(
+      `opencode: MCP config install failed for "${name}" (HTTP ${res.status}${detail ? `: ${detail}` : ""})`
+    );
+  }
+}
+async function getJson(doFetch, url, signal) {
+  const res = await doFetch(url, { signal });
+  if (!res.ok) throw new Error(`opencode: ${url} unavailable (HTTP ${res.status})`);
+  return res.json();
+}
+function asRecord2(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
 async function* parseSseStream(body, sessionId, signal) {
   const reader = body.getReader();
   const decoder = new TextDecoder();
@@ -4404,11 +4478,16 @@ function newOpencodeMessageId() {
 function trimSlash(s) {
   return s.endsWith("/") ? s.slice(0, -1) : s;
 }
-var serverTurnTails;
+var serverTurnTails, SCRUBBED_MCP_CONFIG;
 var init_transport = __esm({
   "packages/agent-runtime/src/opencode/transport.ts"() {
     "use strict";
     serverTurnTails = /* @__PURE__ */ new Map();
+    SCRUBBED_MCP_CONFIG = {
+      type: "remote",
+      url: "http://127.0.0.1:9/cabane-removed",
+      enabled: false
+    };
   }
 });
 
@@ -4972,7 +5051,7 @@ var init_addendum3 = __esm({
 });
 
 // packages/agent-runtime/src/codex/events.ts
-function asRecord2(v) {
+function asRecord3(v) {
   return v && typeof v === "object" ? v : null;
 }
 function str(v) {
@@ -4982,7 +5061,7 @@ function readThreadId(ev) {
   return str(ev.thread_id);
 }
 function readItem(ev) {
-  return asRecord2(ev.item);
+  return asRecord3(ev.item);
 }
 function readItemText(item) {
   return str(item.text);
@@ -5053,7 +5132,7 @@ function readItemType(item) {
 function readErrorMessage(ev) {
   const direct = str(ev.message);
   if (direct) return direct;
-  const err = asRecord2(ev.error);
+  const err = asRecord3(ev.error);
   if (err) {
     const m = str(err.message);
     if (m) return m;
@@ -5061,7 +5140,7 @@ function readErrorMessage(ev) {
   return "unknown";
 }
 function readUsage(ev) {
-  const usage = asRecord2(ev.usage);
+  const usage = asRecord3(ev.usage);
   if (!usage) return void 0;
   const num = (v) => typeof v === "number" && Number.isFinite(v) ? v : 0;
   return {
@@ -5085,7 +5164,7 @@ function toStatus(v) {
   return v === "completed" || v === "failed" ? v : "in_progress";
 }
 function readMcpResult(result) {
-  const rec2 = asRecord2(result);
+  const rec2 = asRecord3(result);
   if (!rec2) return result;
   if (hasOnlyNonTextContentBlocks(rec2.content)) return rec2.content;
   if (rec2.structured_content !== void 0 && rec2.structured_content !== null) {
@@ -5101,7 +5180,7 @@ function hasOnlyNonTextContentBlocks(content) {
   if (!Array.isArray(content) || content.length === 0) return false;
   let sawTypedBlock = false;
   for (const raw of content) {
-    const block = asRecord2(raw);
+    const block = asRecord3(raw);
     const type = block && str(block.type);
     if (!type) continue;
     sawTypedBlock = true;
@@ -5119,7 +5198,7 @@ function hasMcpReceipt(result) {
   return true;
 }
 function readMcpError(error) {
-  const rec2 = asRecord2(error);
+  const rec2 = asRecord3(error);
   return rec2 && str(rec2.message) || "error";
 }
 var init_events2 = __esm({
@@ -5427,7 +5506,8 @@ function buildRunSpec2(req, resumeThreadId, instructionsFile = null, threadPromp
     input: buildInput(req, promptRidesInput),
     promptRidesInput,
     promptFingerprint,
-    config: buildConfig(req, baseInstructionsFile)
+    config: buildConfig(req, baseInstructionsFile),
+    secretEnv: req.local.secretEnv && Object.keys(req.local.secretEnv).length > 0 ? req.local.secretEnv : null
   };
 }
 function buildInput(req, promptRidesInput) {
@@ -5443,9 +5523,11 @@ function buildConfig(req, baseInstructionsFile) {
   const mcp_servers = {};
   for (const [name, server] of Object.entries(req.local.mcpServers ?? {})) {
     if ("url" in server) {
+      const fromEnv = server.headersFromEnv ?? {};
       mcp_servers[name] = {
         url: server.url,
         ...server.headers ? { http_headers: server.headers } : {},
+        ...Object.keys(fromEnv).length > 0 ? { env_http_headers: fromEnv } : {},
         default_tools_approval_mode: "approve"
       };
     } else if ("command" in server) {
@@ -5611,6 +5693,13 @@ function buildSdkThreadOptions(spec) {
     ...spec.modelReasoningEffort ? { modelReasoningEffort: spec.modelReasoningEffort } : {}
   };
 }
+function codexProcessEnv(secretEnv) {
+  const inherited = {};
+  for (const [key, value] of Object.entries(process.env)) {
+    if (value !== void 0) inherited[key] = value;
+  }
+  return { ...inherited, ...secretEnv };
+}
 function createSdkCodexTransport(opts = {}) {
   return {
     async run(spec, signal) {
@@ -5627,7 +5716,8 @@ function createSdkCodexTransport(opts = {}) {
         // also what makes the PUBLISHED companion correct, where the vendored
         // patch never reached — and why that patch is gone. See
         // `config-overrides.ts`.
-        configOverrides: buildConfigOverrides(spec.config)
+        configOverrides: buildConfigOverrides(spec.config),
+        ...spec.secretEnv ? { env: codexProcessEnv(spec.secretEnv) } : {}
       };
       const codex = new Codex(codexOptions);
       const threadOptions = buildSdkThreadOptions(spec);
@@ -7324,8 +7414,14 @@ function requiredSecretNames(mcpServers) {
   }
   return [...names].sort();
 }
-function resolveMcpSecrets(mcpServers, store) {
+function resolveMcpSecrets(mcpServers, store, serverSecretEnv = {}) {
   const missing = /* @__PURE__ */ new Set();
+  const secretEnv = { ...serverSecretEnv };
+  let counter = 0;
+  for (const name of Object.keys(serverSecretEnv)) {
+    const n = SECRET_ENV_NAME.exec(name);
+    if (n) counter = Math.max(counter, Number(n[1]));
+  }
   const interpolate = (value) => value.replace(PLACEHOLDER_RE, (_match, name) => {
     const resolved = store.get(name);
     if (resolved === void 0) {
@@ -7343,10 +7439,25 @@ function resolveMcpSecrets(mcpServers, store) {
   for (const [name, server] of Object.entries(mcpServers)) {
     const next = { ...server };
     if ("env" in next && next.env) next.env = mapBag(next.env);
-    if ("headers" in next && next.headers) next.headers = mapBag(next.headers);
+    if ("url" in next && next.headers) {
+      const headers = {};
+      const fromEnv = { ...next.headersFromEnv };
+      for (const [header, value] of Object.entries(next.headers)) {
+        if (!value.match(PLACEHOLDER_RE)) {
+          headers[header] = value;
+          continue;
+        }
+        const envName = `CABANE_MCP_${++counter}`;
+        secretEnv[envName] = interpolate(value);
+        fromEnv[header] = envName;
+      }
+      next.headers = headers;
+      if (Object.keys(headers).length === 0) delete next.headers;
+      if (Object.keys(fromEnv).length > 0) next.headersFromEnv = fromEnv;
+    }
     servers[name] = next;
   }
-  return { servers, missing: [...missing].sort() };
+  return { servers, secretEnv, missing: [...missing].sort() };
 }
 function missingSecretReason(missing) {
   const prefix = "missing_secret: ";
@@ -7358,7 +7469,7 @@ function missingSecretReason(missing) {
   }
   return `${prefix}+${missing.length}`;
 }
-var PLACEHOLDER_RE, secretStoreSchema, ERROR_REASON_MAX;
+var PLACEHOLDER_RE, secretStoreSchema, SECRET_ENV_NAME, ERROR_REASON_MAX;
 var init_secrets = __esm({
   "src/secrets.ts"() {
     "use strict";
@@ -7366,6 +7477,7 @@ var init_secrets = __esm({
     init_errors();
     PLACEHOLDER_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
     secretStoreSchema = z14.record(z14.string(), z14.string());
+    SECRET_ENV_NAME = /^CABANE_MCP_(\d+)$/;
     ERROR_REASON_MAX = 200;
   }
 });
@@ -7393,12 +7505,20 @@ var init_run_config = __esm({
     mcpHttpServerSchema = z15.object({
       type: z15.literal("http"),
       url: z15.string().url(),
-      headers: z15.record(z15.string(), z15.string()).optional()
+      headers: z15.record(z15.string(), z15.string()).optional(),
+      // CT1698: header → the name of a `secretEnv` entry holding its value. Set by
+      // the server on a room connection's entry, and by `resolveMcpSecrets` on a
+      // header whose `${VAR}` it resolved.
+      headersFromEnv: z15.record(z15.string(), z15.string()).optional()
     });
     mcpSseServerSchema = z15.object({
       type: z15.literal("sse"),
       url: z15.string().url(),
-      headers: z15.record(z15.string(), z15.string()).optional()
+      headers: z15.record(z15.string(), z15.string()).optional(),
+      // CT1698: header → the name of a `secretEnv` entry holding its value. Set by
+      // the server on a room connection's entry, and by `resolveMcpSecrets` on a
+      // header whose `${VAR}` it resolved.
+      headersFromEnv: z15.record(z15.string(), z15.string()).optional()
     });
     mcpServerDefSchema = z15.union([mcpHttpServerSchema, mcpSseServerSchema, mcpStdioServerSchema]);
     thinkingConfigSchema = z15.discriminatedUnion("type", [
@@ -8280,6 +8400,7 @@ function buildCompanionTurnRequest(params) {
       // User MCP servers (already `${PLACEHOLDER}`-resolved). Structurally the
       // adapter's `ResolvedMcpServers`.
       ...Object.keys(params.mcpServers).length > 0 ? { mcpServers: params.mcpServers } : {},
+      ...params.secretEnv && Object.keys(params.secretEnv).length > 0 ? { secretEnv: params.secretEnv } : {},
       // CT289: the auto-memory escape hatch, when the operator set it.
       ...params.claudeCode ? { claudeCode: params.claudeCode } : {}
     },
@@ -8925,6 +9046,9 @@ var init_turn_execution = __esm({
       resumedSpoke = false;
       turnContext;
       resolvedMcpServers;
+      // CT1698: the harness's secret environment for this turn. Only ever handed
+      // to the adapter; never logged, never merged into `process.env`.
+      secretEnv = {};
       effectiveCwd;
       hookEnv;
       turnEnv;
@@ -9212,11 +9336,17 @@ var init_turn_execution = __esm({
         const secretStore = this.opts.secretStore ?? (fromLauncher ? await fromLauncher(requiredSecretNames(this.turnContext.mcpServers)) : null) ?? loadSecretStoreTolerant(
           (m) => turnLog.warn({ err: m }, "Could not read the secrets file. Check ~/.cabane/secrets.json.")
         );
-        const { servers: resolvedMcpServers, missing } = resolveMcpSecrets(
+        const {
+          servers: resolvedMcpServers,
+          secretEnv,
+          missing
+        } = resolveMcpSecrets(
           // CT262: the user MCP DEFINITIONS (placeholder form) come from the turn
-          // context now, not a separate `getAgentSelf` run-config fetch.
+          // context now, not a separate `getAgentSelf` run-config fetch. CT1698: and
+          // the room connections' entries, whose values arrive in `secretEnv`.
           this.turnContext.mcpServers ?? {},
-          secretStore
+          secretStore,
+          this.turnContext.secretEnv
         );
         if (missing.length > 0) {
           turnLog.debug({ missing }, "dispatcher: turn needs secrets not declared on this companion");
@@ -9224,6 +9354,7 @@ var init_turn_execution = __esm({
           throw this.concluded(reason, reason);
         }
         this.resolvedMcpServers = resolvedMcpServers;
+        this.secretEnv = secretEnv;
       }
       async prepareEnvironment() {
         const { payload, workspaceId, turnId, turnLog } = this;
@@ -9456,6 +9587,7 @@ var init_turn_execution = __esm({
           // CT1103: the prepare-hook env plus the authoritative host-access token.
           env: this.turnEnv,
           mcpServers: this.resolvedMcpServers,
+          secretEnv: this.secretEnv,
           turnControlServer,
           // CT238: this turn's conversation, forwarded as the active-conversation
           // header so a cross-thread post/spawn stamps its origin.
@@ -10559,7 +10691,6 @@ function harnessSandboxConfig(input) {
     ...policy.hosts?.allow ?? []
   ];
   const allowedDomains = [.../* @__PURE__ */ new Set([...cabane, ...models, ...reachable])];
-  const envGlobs = input.cwd ? [join18(input.cwd, "**/.env"), join18(input.cwd, "**/.env.*")] : [];
   const secrets = [
     ...companionStoreDenies({
       homes,
@@ -10568,7 +10699,6 @@ function harnessSandboxConfig(input) {
       ownState: [claudeDir, codexDir]
     }),
     ...homes.flatMap((home) => SECRET_PATHS_UNDER_HOME.map((p) => join18(home, p))),
-    ...envGlobs,
     ...expand(policy.filesystem?.denyRead)
   ];
   const strict = policy.filesystem?.mode === "strict";

package/dist/runtime.js

@@ -3493,12 +3493,14 @@ var resolvedMcpServerSchema = z8.union([
   z8.object({
     type: z8.literal("http"),
     url: z8.string(),
-    headers: z8.record(z8.string(), z8.string()).optional()
+    headers: z8.record(z8.string(), z8.string()).optional(),
+    headersFromEnv: z8.record(z8.string(), z8.string()).optional()
   }),
   z8.object({
     type: z8.literal("sse"),
     url: z8.string(),
-    headers: z8.record(z8.string(), z8.string()).optional()
+    headers: z8.record(z8.string(), z8.string()).optional(),
+    headersFromEnv: z8.record(z8.string(), z8.string()).optional()
   })
 ]);
 var resolvedMcpServersSchema = z8.record(z8.string(), resolvedMcpServerSchema);
@@ -3539,6 +3541,11 @@ var turnRequestSchema = z8.object({
     cwd: z8.string().optional(),
     env: z8.record(z8.string(), z8.string()).optional(),
     mcpServers: resolvedMcpServersSchema.optional(),
+    // CT1698: the values `headersFromEnv` names, per turn (`CABANE_MCP_<n>` →
+    // complete header value). The adapter merges them into the harness
+    // process's environment and nowhere else; the host never merges them into
+    // its own. Absent when no server references one.
+    secretEnv: z8.record(z8.string(), z8.string()).optional(),
     // CT289: machine-local claude-code adapter knobs the operator sets on a
     // companion they run themselves — the auto-memory escape hatch. `autoMemory:
     // true` opts back into Claude Code's auto-memory (governed by the operator's
@@ -3989,6 +3996,24 @@ var CLAUDE_CODE_ADDENDUM = [
   "read/edit) keep their ordinary names and act on the local machine only."
 ].join(" ");
 
+// packages/agent-runtime/src/mcp-secret-env.ts
+function headersAsEnvReferences(server) {
+  const refs = Object.entries(server.headersFromEnv ?? {}).map(
+    ([header, envName]) => [header, `\${${envName}}`]
+  );
+  if (!server.headers && refs.length === 0) return void 0;
+  return { ...server.headers, ...Object.fromEntries(refs) };
+}
+function headersResolvedFrom(server, secretEnv) {
+  const resolved = {};
+  for (const [header, envName] of Object.entries(server.headersFromEnv ?? {})) {
+    const value = secretEnv?.[envName];
+    if (value !== void 0) resolved[header] = value;
+  }
+  if (!server.headers && Object.keys(resolved).length === 0) return void 0;
+  return { ...server.headers, ...resolved };
+}
+
 // packages/agent-runtime/src/claude-code/policy.ts
 import { z as z10 } from "zod";
 var HOST_FS_TOOLS = [
@@ -4122,8 +4147,18 @@ async function preToolUseHook(input) {
 function buildClaudeCodeOptions(req, augment) {
   const { policy, config } = req;
   const cwd = req.local.cwd;
+  const userServers = {};
+  for (const [name, server] of Object.entries(req.local.mcpServers ?? {})) {
+    if ("url" in server) {
+      const { headersFromEnv: _refs, headers: _headers, ...rest } = server;
+      const headers = headersAsEnvReferences(server);
+      userServers[name] = { ...rest, ...headers ? { headers } : {} };
+    } else {
+      userServers[name] = server;
+    }
+  }
   const mcpServers = {
-    ...req.local.mcpServers ?? {},
+    ...userServers,
     ...req.extra.mcpServers
   };
   if (!(CABANE_MCP_SERVER in mcpServers)) {
@@ -4205,9 +4240,13 @@ function buildClaudeCodeOptions(req, augment) {
     // SDK's own doc on `Options.env`), which is why `process.env` is spread here
     // and why this key is now always present — previously it appeared only when
     // `req.local.env` was set, and an absent `env` inherits `process.env`.
+    //
+    // CT1698: `secretEnv` joins here, and only here — the values the MCP
+    // headers above reference. It is this child's environment, not the host's.
     env: {
       ...process.env,
       ...req.local.env,
+      ...req.local.secretEnv,
       CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: "1"
     },
     ...resume ? { resume } : {}
@@ -5442,7 +5481,10 @@ function buildRunSpec(req, resumeSessionId) {
     // Fresh session → mint + send a client id; resumed → let opencode mint it.
     sendClientMessageId: resumeSessionId == null,
     ...dialect.agent ? { agent: dialect.agent } : {},
-    mcp: buildMcp(req)
+    mcp: buildMcp(req),
+    credentialServers: Object.entries(req.local.mcpServers ?? {}).filter(
+      ([, server]) => "url" in server && Object.keys(server.headersFromEnv ?? {}).length > 0
+    ).map(([name]) => name)
   };
 }
 function buildParts(req) {
@@ -5461,10 +5503,11 @@ function buildMcp(req) {
   const mcp = {};
   for (const [name, server] of Object.entries(req.local.mcpServers ?? {})) {
     if ("url" in server) {
+      const headers = headersResolvedFrom(server, req.local.secretEnv);
       mcp[name] = {
         type: "remote",
         url: server.url,
-        ...server.headers ? { headers: server.headers } : {},
+        ...headers ? { headers } : {},
         enabled: true
       };
     } else if ("command" in server) {
@@ -5643,24 +5686,53 @@ async function* releaseAfter(events, release) {
     release();
   }
 }
+var SCRUBBED_MCP_CONFIG = {
+  type: "remote",
+  url: "http://127.0.0.1:9/cabane-removed",
+  enabled: false
+};
 async function installMcp(doFetch, base, spec, signal) {
+  const [live, configured] = await Promise.all([
+    getJson(doFetch, `${base}/mcp`, signal),
+    getJson(doFetch, `${base}/config`, signal)
+  ]);
+  const operatorOwned = new Set(Object.keys(asRecord2(asRecord2(configured).mcp)));
+  const stale = Object.keys(asRecord2(live)).filter(
+    (name) => !(name in spec.mcp) && !operatorOwned.has(name)
+  );
+  await Promise.all(stale.map((name) => postMcp(doFetch, base, name, SCRUBBED_MCP_CONFIG, signal)));
+  const shadowing = (spec.credentialServers ?? []).filter((name) => operatorOwned.has(name));
+  if (shadowing.length > 0) {
+    throw new Error(
+      `opencode: ${shadowing.map((n) => `"${n}"`).join(", ")} would replace an MCP server this opencode instance configures itself; rename that server in the opencode config to use this connection here`
+    );
+  }
   await Promise.all(
-    Object.entries(spec.mcp).map(async ([name, config]) => {
-      const res = await doFetch(`${base}/mcp`, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ name, config }),
-        signal
-      });
-      if (!res.ok) {
-        const detail = await res.text().catch(() => "");
-        throw new Error(
-          `opencode: MCP config install failed for "${name}" (HTTP ${res.status}${detail ? `: ${detail}` : ""})`
-        );
-      }
-    })
+    Object.entries(spec.mcp).map(([name, config]) => postMcp(doFetch, base, name, config, signal))
   );
 }
+async function postMcp(doFetch, base, name, config, signal) {
+  const res = await doFetch(`${base}/mcp`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ name, config }),
+    signal
+  });
+  if (!res.ok) {
+    const detail = await res.text().catch(() => "");
+    throw new Error(
+      `opencode: MCP config install failed for "${name}" (HTTP ${res.status}${detail ? `: ${detail}` : ""})`
+    );
+  }
+}
+async function getJson(doFetch, url, signal) {
+  const res = await doFetch(url, { signal });
+  if (!res.ok) throw new Error(`opencode: ${url} unavailable (HTTP ${res.status})`);
+  return res.json();
+}
+function asRecord2(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
 async function* parseSseStream(body, sessionId, signal) {
   const reader = body.getReader();
   const decoder = new TextDecoder();
@@ -6236,7 +6308,7 @@ var CODEX_ADDENDUM = [
 ].join(" ");
 
 // packages/agent-runtime/src/codex/events.ts
-function asRecord2(v) {
+function asRecord3(v) {
   return v && typeof v === "object" ? v : null;
 }
 function str(v) {
@@ -6246,7 +6318,7 @@ function readThreadId(ev) {
   return str(ev.thread_id);
 }
 function readItem(ev) {
-  return asRecord2(ev.item);
+  return asRecord3(ev.item);
 }
 function readItemText(item) {
   return str(item.text);
@@ -6317,7 +6389,7 @@ function readItemType(item) {
 function readErrorMessage(ev) {
   const direct = str(ev.message);
   if (direct) return direct;
-  const err = asRecord2(ev.error);
+  const err = asRecord3(ev.error);
   if (err) {
     const m = str(err.message);
     if (m) return m;
@@ -6325,7 +6397,7 @@ function readErrorMessage(ev) {
   return "unknown";
 }
 function readUsage(ev) {
-  const usage = asRecord2(ev.usage);
+  const usage = asRecord3(ev.usage);
   if (!usage) return void 0;
   const num = (v) => typeof v === "number" && Number.isFinite(v) ? v : 0;
   return {
@@ -6349,7 +6421,7 @@ function toStatus(v) {
   return v === "completed" || v === "failed" ? v : "in_progress";
 }
 function readMcpResult(result) {
-  const rec = asRecord2(result);
+  const rec = asRecord3(result);
   if (!rec) return result;
   if (hasOnlyNonTextContentBlocks(rec.content)) return rec.content;
   if (rec.structured_content !== void 0 && rec.structured_content !== null) {
@@ -6365,7 +6437,7 @@ function hasOnlyNonTextContentBlocks(content) {
   if (!Array.isArray(content) || content.length === 0) return false;
   let sawTypedBlock = false;
   for (const raw of content) {
-    const block = asRecord2(raw);
+    const block = asRecord3(raw);
     const type = block && str(block.type);
     if (!type) continue;
     sawTypedBlock = true;
@@ -6383,7 +6455,7 @@ function hasMcpReceipt(result) {
   return true;
 }
 function readMcpError(error) {
-  const rec = asRecord2(error);
+  const rec = asRecord3(error);
   return rec && str(rec.message) || "error";
 }
 
@@ -6671,7 +6743,8 @@ function buildRunSpec2(req, resumeThreadId, instructionsFile = null, threadPromp
     input: buildInput(req, promptRidesInput),
     promptRidesInput,
     promptFingerprint,
-    config: buildConfig(req, baseInstructionsFile)
+    config: buildConfig(req, baseInstructionsFile),
+    secretEnv: req.local.secretEnv && Object.keys(req.local.secretEnv).length > 0 ? req.local.secretEnv : null
   };
 }
 function buildInput(req, promptRidesInput) {
@@ -6687,9 +6760,11 @@ function buildConfig(req, baseInstructionsFile) {
   const mcp_servers = {};
   for (const [name, server] of Object.entries(req.local.mcpServers ?? {})) {
     if ("url" in server) {
+      const fromEnv = server.headersFromEnv ?? {};
       mcp_servers[name] = {
         url: server.url,
         ...server.headers ? { http_headers: server.headers } : {},
+        ...Object.keys(fromEnv).length > 0 ? { env_http_headers: fromEnv } : {},
         default_tools_approval_mode: "approve"
       };
     } else if ("command" in server) {
@@ -6831,6 +6906,13 @@ function buildSdkThreadOptions(spec) {
     ...spec.modelReasoningEffort ? { modelReasoningEffort: spec.modelReasoningEffort } : {}
   };
 }
+function codexProcessEnv(secretEnv) {
+  const inherited = {};
+  for (const [key, value] of Object.entries(process.env)) {
+    if (value !== void 0) inherited[key] = value;
+  }
+  return { ...inherited, ...secretEnv };
+}
 function createSdkCodexTransport(opts = {}) {
   return {
     async run(spec, signal) {
@@ -6847,7 +6929,8 @@ function createSdkCodexTransport(opts = {}) {
         // also what makes the PUBLISHED companion correct, where the vendored
         // patch never reached — and why that patch is gone. See
         // `config-overrides.ts`.
-        configOverrides: buildConfigOverrides(spec.config)
+        configOverrides: buildConfigOverrides(spec.config),
+        ...spec.secretEnv ? { env: codexProcessEnv(spec.secretEnv) } : {}
       };
       const codex = new Codex(codexOptions);
       const threadOptions = buildSdkThreadOptions(spec);
@@ -8464,8 +8547,15 @@ function requiredSecretNames(mcpServers) {
   }
   return [...names].sort();
 }
-function resolveMcpSecrets(mcpServers, store) {
+var SECRET_ENV_NAME = /^CABANE_MCP_(\d+)$/;
+function resolveMcpSecrets(mcpServers, store, serverSecretEnv = {}) {
   const missing = /* @__PURE__ */ new Set();
+  const secretEnv = { ...serverSecretEnv };
+  let counter = 0;
+  for (const name of Object.keys(serverSecretEnv)) {
+    const n = SECRET_ENV_NAME.exec(name);
+    if (n) counter = Math.max(counter, Number(n[1]));
+  }
   const interpolate = (value) => value.replace(PLACEHOLDER_RE, (_match, name) => {
     const resolved = store.get(name);
     if (resolved === void 0) {
@@ -8483,10 +8573,25 @@ function resolveMcpSecrets(mcpServers, store) {
   for (const [name, server] of Object.entries(mcpServers)) {
     const next = { ...server };
     if ("env" in next && next.env) next.env = mapBag(next.env);
-    if ("headers" in next && next.headers) next.headers = mapBag(next.headers);
+    if ("url" in next && next.headers) {
+      const headers = {};
+      const fromEnv = { ...next.headersFromEnv };
+      for (const [header, value] of Object.entries(next.headers)) {
+        if (!value.match(PLACEHOLDER_RE)) {
+          headers[header] = value;
+          continue;
+        }
+        const envName = `CABANE_MCP_${++counter}`;
+        secretEnv[envName] = interpolate(value);
+        fromEnv[header] = envName;
+      }
+      next.headers = headers;
+      if (Object.keys(headers).length === 0) delete next.headers;
+      if (Object.keys(fromEnv).length > 0) next.headersFromEnv = fromEnv;
+    }
     servers[name] = next;
   }
-  return { servers, missing: [...missing].sort() };
+  return { servers, secretEnv, missing: [...missing].sort() };
 }
 var ERROR_REASON_MAX = 200;
 function missingSecretReason(missing) {
@@ -8514,12 +8619,20 @@ var mcpStdioServerSchema = z15.object({
 var mcpHttpServerSchema = z15.object({
   type: z15.literal("http"),
   url: z15.string().url(),
-  headers: z15.record(z15.string(), z15.string()).optional()
+  headers: z15.record(z15.string(), z15.string()).optional(),
+  // CT1698: header → the name of a `secretEnv` entry holding its value. Set by
+  // the server on a room connection's entry, and by `resolveMcpSecrets` on a
+  // header whose `${VAR}` it resolved.
+  headersFromEnv: z15.record(z15.string(), z15.string()).optional()
 });
 var mcpSseServerSchema = z15.object({
   type: z15.literal("sse"),
   url: z15.string().url(),
-  headers: z15.record(z15.string(), z15.string()).optional()
+  headers: z15.record(z15.string(), z15.string()).optional(),
+  // CT1698: header → the name of a `secretEnv` entry holding its value. Set by
+  // the server on a room connection's entry, and by `resolveMcpSecrets` on a
+  // header whose `${VAR}` it resolved.
+  headersFromEnv: z15.record(z15.string(), z15.string()).optional()
 });
 var mcpServerDefSchema = z15.union([mcpHttpServerSchema, mcpSseServerSchema, mcpStdioServerSchema]);
 var thinkingConfigSchema = z15.discriminatedUnion("type", [
@@ -9355,6 +9468,7 @@ function buildCompanionTurnRequest(params) {
       // User MCP servers (already `${PLACEHOLDER}`-resolved). Structurally the
       // adapter's `ResolvedMcpServers`.
       ...Object.keys(params.mcpServers).length > 0 ? { mcpServers: params.mcpServers } : {},
+      ...params.secretEnv && Object.keys(params.secretEnv).length > 0 ? { secretEnv: params.secretEnv } : {},
       // CT289: the auto-memory escape hatch, when the operator set it.
       ...params.claudeCode ? { claudeCode: params.claudeCode } : {}
     },
@@ -9911,6 +10025,9 @@ var TurnExecution = class {
   resumedSpoke = false;
   turnContext;
   resolvedMcpServers;
+  // CT1698: the harness's secret environment for this turn. Only ever handed
+  // to the adapter; never logged, never merged into `process.env`.
+  secretEnv = {};
   effectiveCwd;
   hookEnv;
   turnEnv;
@@ -10198,11 +10315,17 @@ var TurnExecution = class {
     const secretStore = this.opts.secretStore ?? (fromLauncher ? await fromLauncher(requiredSecretNames(this.turnContext.mcpServers)) : null) ?? loadSecretStoreTolerant(
       (m) => turnLog.warn({ err: m }, "Could not read the secrets file. Check ~/.cabane/secrets.json.")
     );
-    const { servers: resolvedMcpServers, missing } = resolveMcpSecrets(
+    const {
+      servers: resolvedMcpServers,
+      secretEnv,
+      missing
+    } = resolveMcpSecrets(
       // CT262: the user MCP DEFINITIONS (placeholder form) come from the turn
-      // context now, not a separate `getAgentSelf` run-config fetch.
+      // context now, not a separate `getAgentSelf` run-config fetch. CT1698: and
+      // the room connections' entries, whose values arrive in `secretEnv`.
       this.turnContext.mcpServers ?? {},
-      secretStore
+      secretStore,
+      this.turnContext.secretEnv
     );
     if (missing.length > 0) {
       turnLog.debug({ missing }, "dispatcher: turn needs secrets not declared on this companion");
@@ -10210,6 +10333,7 @@ var TurnExecution = class {
       throw this.concluded(reason, reason);
     }
     this.resolvedMcpServers = resolvedMcpServers;
+    this.secretEnv = secretEnv;
   }
   async prepareEnvironment() {
     const { payload, workspaceId, turnId, turnLog } = this;
@@ -10442,6 +10566,7 @@ var TurnExecution = class {
       // CT1103: the prepare-hook env plus the authoritative host-access token.
       env: this.turnEnv,
       mcpServers: this.resolvedMcpServers,
+      secretEnv: this.secretEnv,
       turnControlServer,
       // CT238: this turn's conversation, forwarded as the active-conversation
       // header so a cross-thread post/spawn stamps its origin.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cabane/companion",
-  "version": "0.6.133",
+  "version": "0.6.135",
   "type": "module",
   "description": "The Cabane Companion (headless): connect a coding agent on your machine to your Cabane workspace as a responder — drive work against your own codebase, files, and MCP servers without putting any of it in Cabane.",
   "license": "UNLICENSED",