boxdown 1.2.0 → 1.2.1

package/docs/superpowers/plans/2026-07-17-runtime-secret-environment.md

@@ -0,0 +1,174 @@
+# Runtime Secret Environment Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use `superpowers:executing-plans` to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Keep Boxdown-provided secrets available in Bash sessions without writing their values to the repository, persistent Boxdown state, Docker environment configuration, or workspace logs.
+
+**Architecture:** A private per-workspace runtime directory holds three secret files and is mounted read-only at `/run/boxdown/secrets`. A Bash bootstrap exports values for interactive, non-interactive, SSH, and Boxdown coding-agent Bash sessions. Docker configuration carries only paths; metadata inspection requests only image fields; logging structurally redacts known assignments.
+
+**Tech Stack:** Node.js 24, TypeScript, Bash, `node:test`, Docker/Dev Containers configuration.
+
+## Global Constraints
+
+- Do not print, log, serialize, or place a secret value in generated configuration, command arguments, metadata, or diagnostics.
+- Fixed Boxdown secret names: `ANTHROPIC_API_KEY`, `SNYK_TOKEN`, and `OP_SERVICE_ACCOUNT_TOKEN`.
+- Missing values and unavailable 1Password access are non-blocking; the affected variable is absent.
+- `.env.development` is project-owned: Boxdown does not create, edit, delete, or migrate it.
+- Runtime secret directories/files use `0700`/`0600` and are outside `workspaceDataDir`.
+- Existing containers require `boxdown start --recreate`; do not add legacy cleanup or `doctor --fix-secrets`.
+
+---
+
+## File Structure
+
+| File | Responsibility |
+| --- | --- |
+| `src/constants.ts`, `src/paths.ts` | Runtime secret paths and fixed secret-name constants. |
+| `src/config.ts`, `assets/devcontainer/devcontainer.json` | Read-only mount and non-secret Bash bootstrap config. |
+| `assets/devcontainer/hooks/initialize.sh` | Atomically create/remove runtime secret files. |
+| `assets/devcontainer/utils/secret-env-bootstrap.sh` | Read fixed files and export present values without output. |
+| `assets/devcontainer/hooks/post-create.sh`, `src/shell.ts` | Source bootstrap for interactive and Boxdown-launched Bash sessions. |
+| `src/main.ts`, `src/purge.ts` | Remove workspace runtime state after down/purge. |
+| `src/devcontainer.ts`, `src/logging.ts` | Narrow Docker inspection and structural redaction. |
+| `src/doctor.ts`, docs, `__tests__/app.test.ts` | Safety checks, documentation, and regression tests. |
+
+### Task 1: Define runtime secret state and remove workspace injection
+
+**Files:**
+
+- Modify: `src/constants.ts`, `src/paths.ts`, `src/config.ts`, `assets/devcontainer/devcontainer.json`, `assets/devcontainer/hooks/initialize.sh`, `assets/devcontainer/hooks/post-start.sh`, `__tests__/app.test.ts`
+
+**Interfaces:**
+
+```ts
+export const BOXDOWN_SECRET_ENV_NAMES = ['ANTHROPIC_API_KEY', 'SNYK_TOKEN', 'OP_SERVICE_ACCOUNT_TOKEN'] as const
+export const BOXDOWN_CONTAINER_SECRET_ENV_DIR = '/run/boxdown/secrets'
+export const BOXDOWN_CONTAINER_SECRET_ENV_BOOTSTRAP = '/opt/boxdown/devcontainer/utils/secret-env-bootstrap.sh'
+export function defaultRuntimeRoot (env?: NodeJS.ProcessEnv): string
+// WorkspaceContext adds runtimeRoot, workspaceRuntimeDir, workspaceSecretEnvDir.
+```
+
+- [ ] **Step 1: Write failing tests**
+
+Create a context with `BOXDOWN_RUNTIME_HOME`. Assert that its secret directory starts below runtime root but not persistent workspace data. Assert generated config mounts that directory read-only at `/run/boxdown/secrets`, sets the non-secret bootstrap `BASH_ENV`, retains `NODE_ENV`, and serializes none of `--env-file`, `.env.development`, or the three secret names.
+
+- [ ] **Step 2: Verify red**
+
+Run `pnpm test -- --test-name-pattern "runtime secret|generated config"`. Expected: FAIL because the current config injects workspace-file and Docker-environment secrets.
+
+- [ ] **Step 3: Implement paths and config**
+
+Add the fixed constants. Resolve runtime root in this order: `BOXDOWN_RUNTIME_HOME`; then `join(XDG_RUNTIME_DIR, PACKAGE_NAME)`; then `join(tmpdir(), package-name plus UID)`. Add workspace-ID scoped runtime/secret paths. Append the read-only secret mount and `BASH_ENV`; remove the base `--env-file` pair and secret `containerEnv` values while preserving non-secret entries.
+
+- [ ] **Step 4: Implement host runtime-file refresh**
+
+Pass only `BOXDOWN_SECRET_ENV_DIR` to `initializeCommand`. Set `umask 077`; create the directory at `0700`; write each nonempty file through `mktemp` plus `chmod 0600` plus atomic rename; remove a file when its host value is absent. Read the existing 1Password reference into a local variable and never echo it. Remove all `.env.development` preparation/upsert logic and post-start deletion.
+
+- [ ] **Step 5: Verify green and commit**
+
+Run `pnpm test -- --test-name-pattern "runtime secret|generated config|devcontainer git config hooks"` and `bash -n assets/devcontainer/hooks/initialize.sh assets/devcontainer/hooks/post-start.sh`; expect both to pass. Commit the listed sources and tests as `feat: mount runtime secret environment`.
+
+### Task 2: Export secret files in supported Bash sessions and clean runtime state
+
+**Files:**
+
+- Create: `assets/devcontainer/utils/secret-env-bootstrap.sh`
+- Modify: `assets/devcontainer/hooks/post-create.sh`, `src/shell.ts`, `src/main.ts`, `src/purge.ts`, `__tests__/app.test.ts`
+
+**Interfaces:**
+
+```bash
+# Bootstrap reads /run/boxdown/secrets/<fixed-name> and exports only present values.
+```
+
+- [ ] **Step 1: Write failing tests**
+
+Run the bootstrap against a temporary secret directory with sentinel values. Assert each present value is exported, an absent file remains unset, and stdout/stderr do not contain a sentinel. Assert interactive shell/agent scripts source the bootstrap before `exec`. Assert down/purge remove only workspace runtime state.
+
+- [ ] **Step 2: Verify red**
+
+Run `pnpm test -- --test-name-pattern "secret bootstrap|runtime secret cleanup|interactive shell setup"`. Expected: FAIL because no bootstrap or runtime cleanup exists.
+
+- [ ] **Step 3: Implement bootstrap/session loading**
+
+Create a no-output script that reads the three fixed files with `IFS= read -r`, exports only nonempty values, and never sources secret file contents as code. Add an idempotent source line to the node user's `.bashrc` in post-create. Add the same bootstrap source before final `exec` in both shell script builders; never add a value to `interactiveShellEnvArgs`.
+
+- [ ] **Step 4: Implement safe runtime cleanup**
+
+Add a path-contained helper that removes only `context.workspaceRuntimeDir`, accepts absence, and never removes `runtimeRoot`. Invoke it after successful down and during purge before persistent state removal.
+
+- [ ] **Step 5: Verify green and commit**
+
+Run `pnpm test -- --test-name-pattern "secret bootstrap|runtime secret cleanup|interactive shell setup"` and `bash -n assets/devcontainer/utils/secret-env-bootstrap.sh assets/devcontainer/hooks/post-create.sh`; expect pass. Commit as `feat: export runtime secrets in Bash sessions`.
+
+### Task 3: Replace full Docker inspection and harden logging
+
+**Files:**
+
+- Modify: `src/devcontainer.ts`, `src/logging.ts`, `__tests__/app.test.ts`
+
+**Interfaces:**
+
+```ts
+export function parseDockerInspectImage (output: string, containerId: string): DockerImageInfo | undefined
+export function redactKnownSecretEnvironmentAssignments (value: string): string
+```
+
+- [ ] **Step 1: Write failing tests**
+
+Test parsing two JSON-string lines representing image ID/name. Add a fake Docker complete-inspect fixture containing an OP sentinel, assert the lifecycle log omits it and inspect uses a narrow format. Test plain and Docker-JSON assignment forms for each known secret variable.
+
+- [ ] **Step 2: Verify red**
+
+Run `pnpm test -- --test-name-pattern "docker inspect|known secret|workspace logger"`. Expected: FAIL because inspect uses `{{json .}}` and logging is value-only.
+
+- [ ] **Step 3: Implement projection/redaction**
+
+Use Docker format `{{json .Image}}` followed by `{{json .Config.Image}}`; parse exactly two scalar JSON lines and provide a container-ID-specific malformed-output error. Redact values after each fixed name before dynamic redactions and apply it through logger `#redact` for arguments, sections, errors, and child output while preserving the names.
+
+- [ ] **Step 4: Verify green and commit**
+
+Run `pnpm test -- --test-name-pattern "docker inspect|known secret|workspace logger"`; expect pass. Commit as `fix: keep container secrets out of workspace logs`.
+
+### Task 4: Doctor coverage and documentation
+
+**Files:**
+
+- Modify: `src/doctor.ts`, `__tests__/app.test.ts`, `assets/devcontainer/README.md`, `docs/features/generated-config-and-state.md`, `docs/features/start-and-shell.md`
+
+- [ ] **Step 1: Write failing tests**
+
+Extend doctor fake-command tests to require a disposable runtime-secret mount probe and a warning when generated config contains env-file, `.env.development`, or a fixed secret name in `containerEnv`. Add existing-style static documentation assertions for session exposure and `--recreate`.
+
+- [ ] **Step 2: Verify red**
+
+Run `pnpm test -- --test-name-pattern "doctor|generated config|runtime secret"`. Expected: FAIL because doctor does not inspect those conditions.
+
+- [ ] **Step 3: Implement non-blocking checks/docs**
+
+Add `workspaceSecretEnvDir` to disposable mount probes. Add a `secret-environment-config` doctor result: missing generated config is warning, unsafe config is warning, safe config is ok; never read secret file contents. Update docs: values are ordinary Bash-session variables but not Docker config; `.env.development` is ignored; missing values are non-blocking; existing containers need recreate; legacy leaked values/logs require manual removal and rotation.
+
+- [ ] **Step 4: Verify green and commit**
+
+Run `pnpm test -- --test-name-pattern "doctor|generated config|runtime secret"`; expect pass. Commit as `docs: describe runtime secret environment handling`.
+
+### Task 5: Full verification
+
+- [ ] **Step 1: Run the complete suite**
+
+Run `pnpm test`, `pnpm lint`, `pnpm build`, `bash -n` for all changed hooks/utilities, `git diff --check`, and `git diff main...HEAD --check`. Expected: every command exits 0.
+
+- [ ] **Step 2: Review secret-safety diff**
+
+Run `git diff main...HEAD -- assets/devcontainer/devcontainer.json src/config.ts src/devcontainer.ts src/logging.ts`. Confirm no implementation path writes `.env.development`, uses `--env-file`, or contains literal token-like values.
+
+- [ ] **Step 3: Commit a verification-only correction when required**
+
+If verification requires a source correction, commit only that correction as `test: cover runtime secret environment regression`.
+
+## Plan Self-Review
+
+- Tasks 1–2 implement runtime-only state and compatible Bash-session exports.
+- Task 3 removes the full-inspect log leak and adds a logging backstop.
+- Task 4 adds doctor/documentation coverage without legacy cleanup.
+- Task 5 runs full test, lint, build, Bash syntax, and diff checks.

package/docs/superpowers/specs/2026-07-11-default-commit-signing-design.md

@@ -115,6 +115,12 @@ Boxdown resolves a signing identity in this order:
 4. With zero or multiple unresolved identities, produce a disabled signing
    plan and a warning reason. Do not guess.
 
+`user.signingKey` accepts an inline SSH public key, Git's `key::` public-key
+form, an absolute path, a `~/` path, or a path relative to the workspace.
+Boxdown reads public-key files only. An explicitly configured key is
+authoritative: unreadable, malformed, or unloaded configured keys disable
+signing and never fall through to GitHub or single-identity selection.
+
 Failure to execute `ssh-add`, query GitHub, parse a public key, or resolve a
 single identity is non-fatal.
 
@@ -321,7 +327,10 @@ testable. At minimum, reasons distinguish:
 - host agent unavailable;
 - no loaded identities;
 - ambiguous loaded identities;
+- configured host SSH signing key unreadable or malformed;
 - configured host SSH signing key not loaded;
+- host agent socket unavailable;
+- no local Docker image available for the agent mount probe;
 - Docker agent bridge unavailable;
 - public-key snapshot failure;
 - selected identity missing in the container;
@@ -333,6 +342,17 @@ Human-readable warnings state that commits will remain unsigned but are not
 blocked. A missing GitHub registration warning instead states that commits are
 signed locally but will not appear Verified on GitHub.
 
+User-facing lifecycle commands print the concise warning. The workspace
+command log additionally records the stable reason code and sanitized detail,
+without public-key material or secrets. Internal SSH proxy startup remains
+log-only. Generated configuration passes the stable host reason into container
+bootstrap so later lifecycle warnings preserve the original diagnosis.
+
+Docker Desktop may expose the mounted host-agent socket only to root. Boxdown
+therefore relays it through a root-owned Unix-socket proxy to a node-owned
+socket. Explicit user Git-signing preferences remain authoritative; Boxdown
+uses SSH signing only as the default when no preference exists.
+
 ## Testing Strategy
 
 ### Unit tests

package/docs/superpowers/specs/2026-07-17-node-ssh-agent-proxy-design.md

@@ -0,0 +1,63 @@
+# Node SSH-Agent Proxy for Commit Signing
+
+## Goal
+
+Make Boxdown's default SSH commit signing usable by the container's `node`
+user when Docker Desktop mounts the host agent socket as `root:root` with mode
+`0660`. Signing must remain best-effort and never expose a private key.
+
+## Root Cause
+
+The host preflight and the raw socket mount both succeed, but lifecycle hooks
+run as `node`. In the reproduced environment, `ssh-add -L` succeeds as root
+and fails as `node` with `Permission denied`. The signing bootstrap therefore
+sets `commit.gpgsign=false` and reports `container-agent-unavailable`.
+
+## Architecture
+
+Boxdown continues to bind-mount the host-facing agent socket at
+`/run/boxdown/ssh-agent.sock`. A small Node Unix-socket proxy runs as root and
+forwards each connection from that raw socket to
+`/run/boxdown/ssh-agent-node.sock`. The proxy creates the latter socket with
+ownership and permissions suitable for `node`. Generated configuration sets
+`SSH_AUTH_SOCK` to the node-facing socket and exposes the raw path only through
+`BOXDOWN_GIT_SIGNING_SOURCE_SOCKET` for the proxy.
+
+The post-create hook starts the proxy with passwordless `sudo`, waits briefly
+for its socket, verifies `ssh-add -L` as `node`, then invokes the existing
+signing bootstrap. A proxy failure is non-blocking and has its own stable
+reason code.
+
+## Git Configuration Precedence
+
+**Decision:** Boxdown does not make its SSH configuration authoritative over
+explicit user Git signing preferences. This is intentional because the
+container begins from a writable copy of the user's Git configuration.
+
+- With no explicit global or repository-local signing preference, Boxdown
+  configures SSH signing as the default.
+- With an explicit SSH preference, Boxdown preserves the selected identity;
+  it only translates an inaccessible host public-key path to the mounted
+  public-key snapshot in the container.
+- With `commit.gpgsign=false`, a non-SSH `gpg.format`, or an explicit
+  `gpg.program`, Boxdown preserves that preference and does not replace it.
+
+Repository-local settings retain Git's normal precedence. In particular, a
+local `commit.gpgsign=false` keeps commits unsigned even when agent forwarding
+is healthy. A future product decision may deliberately reverse this policy and
+make Boxdown authoritative; that would be a behavior change, not a bug fix.
+
+## Failure Handling
+
+The proxy never reads, copies, or logs private-key material. It reports
+`container-agent-proxy-unavailable` when `sudo`, Node, proxy readiness, or the
+node-user agent probe fails. The signing bootstrap remains non-blocking and
+preserves explicit user configuration rather than setting a contradictory
+global value.
+
+## Validation
+
+Tests cover forwarding a real Unix-socket request through the proxy, a proxy
+startup failure, generated socket environment values, successful default SSH
+signing, and preservation of global and local user preferences. Documentation
+will require `--recreate` after upgrade.

package/docs/superpowers/specs/2026-07-17-runtime-secret-environment-design.md

@@ -0,0 +1,194 @@
+# Runtime Secret Environment Design
+
+## Goal
+
+Keep Boxdown-provided secrets available as ordinary environment variables in
+container user sessions without placing their values in Docker container
+configuration, the workspace, or Boxdown's persistent state and logs.
+
+This design covers `ANTHROPIC_API_KEY`, `SNYK_TOKEN`, and
+`OP_SERVICE_ACCOUNT_TOKEN`. It also prevents the Docker inspection command
+used for image metadata from logging the complete container configuration.
+
+## Non-goals
+
+- Migrating, deleting, or rewriting legacy `.env.development` files.
+- Adding a `boxdown doctor --fix-secrets` command.
+- Preventing a user who can enter the container from reading secrets that are
+  deliberately available to that user's session.
+- Changing GitHub CLI authentication refresh, which already passes its host
+  token over stdin and redacts it from the workspace log.
+
+## Security Model
+
+The user has requested compatibility with the current developer experience:
+the three values above remain ordinary environment variables in Bash-based
+container sessions. This intentionally permits session processes to read them.
+
+The protection boundary is against accidental exposure outside that session:
+
+- Docker inspection must not contain secret values.
+- The repository and its `.env.development` file must not be created,
+  modified, or removed by Boxdown secret handling.
+- Boxdown's persistent workspace data and `boxdown.log` must not contain
+  secret values.
+- Secret files are short-lived, host-private runtime state and are mounted
+  read-only into the container.
+
+## Architecture
+
+### Host runtime secret state
+
+`WorkspaceContext` gains a per-workspace runtime-secret directory under a
+user-private runtime root. The root uses `XDG_RUNTIME_DIR` when available and
+a user-private directory under the system temporary directory otherwise. It
+is distinct from `workspaceDataDir`, which is persistent and contains logs and
+metadata.
+
+The directory and each secret file are created with owner-only permissions
+(`0700` directory, `0600` files). The three files use fixed names matching
+their environment variables. No secret value appears in generated
+configuration, command arguments, progress output, metadata, or diagnostics.
+
+The host-side `initializeCommand` refreshes this directory before each
+Dev Container startup:
+
+1. It creates the runtime directory safely.
+2. It writes `ANTHROPIC_API_KEY` and `SNYK_TOKEN` only when each corresponding
+   host environment value is non-empty.
+3. It retrieves `OP_SERVICE_ACCOUNT_TOKEN` from the existing 1Password item
+   only when `op` is available and can read it.
+4. It atomically replaces files for available values and removes files for
+   unavailable values, preventing a stale token from a previous start.
+
+Failures to retrieve 1Password or an absent host variable are informational
+and non-blocking. The affected variable is absent from the next container
+session.
+
+### Generated Dev Container configuration
+
+The base `runArgs` no longer includes:
+
+```text
+--env-file ${localWorkspaceFolder}/.env.development
+```
+
+The base `containerEnv` no longer includes secret values via `localEnv`.
+`NODE_ENV` remains ordinary non-secret configuration.
+
+Boxdown's generated configuration adds a read-only bind mount from the host
+runtime-secret directory to `/run/boxdown/secrets`. It may contain non-secret
+bootstrap configuration such as `BASH_ENV` and the mounted directory path,
+but never a secret value.
+
+Because mounts are create-time settings, `boxdown start --recreate` is needed
+for an already-created container to receive the new mount. New containers get
+it automatically through every Boxdown lifecycle path (`setup`, `start`,
+`codex`, and the other coding-agent commands).
+
+### Container session bootstrap
+
+A mounted Boxdown bootstrap script reads only the fixed secret files, then
+exports values that are present. It never echoes values or shell source lines.
+It handles missing or unreadable files by leaving the corresponding variable
+unset.
+
+The generated configuration sets the non-secret `BASH_ENV` path so
+non-interactive Bash processes source the bootstrap. The container setup also
+installs the bootstrap in the `node` user's Bash startup path for interactive
+shells and SSH sessions. Boxdown's direct shell and coding-agent launch
+scripts source it explicitly before `exec` as an additional deterministic
+path.
+
+Consequently, an ordinary Bash session can use, for example,
+`$ANTHROPIC_API_KEY`, `$SNYK_TOKEN`, and `$OP_SERVICE_ACCOUNT_TOKEN` as it can
+today. Docker's configured environment contains only the bootstrap path and
+other non-secret values, so `docker inspect` cannot reveal secret contents.
+
+### Workspace file handling
+
+The initialization hook stops creating or editing `.env.development`. The
+post-start hook stops deleting it. Boxdown therefore treats that file as
+project-owned in all cases.
+
+This release deliberately does not modify legacy files. A pre-existing
+`OP_SERVICE_ACCOUNT_TOKEN` value remains the user's responsibility to remove
+or rotate. Documentation will state that Boxdown no longer reads the file and
+that users should remove a legacy accidental entry manually.
+
+### Logging and Docker inspection
+
+Boxdown currently runs `docker inspect --format '{{json .}}'` only to record
+the image ID and image name. The full payload includes `.Config.Env`, and the
+command logger writes all child output even when it is not mirrored to the
+terminal.
+
+The implementation replaces that command with a narrow template that returns
+only the image ID and configured image name. Its parser accepts that narrow,
+non-sensitive output; it never parses a complete inspect object.
+
+The workspace logger also gains structural redaction for assignments of the
+three Boxdown secret variable names. This is a defense-in-depth backstop for
+legacy logs or future accidental command output, not the primary protection.
+Existing value-based redaction remains for dynamically acquired GitHub tokens.
+
+## Lifecycle and Cleanup
+
+- `initializeCommand` is the only writer of runtime secret files.
+- `down` and `purge` remove the runtime-secret directory after stopping or
+  removing the associated container.
+- A new start refreshes values atomically, so no previous value remains when a
+  host value is absent or 1Password lookup fails.
+- Runtime secret state is never written below `workspaceDataDir` and is never
+  included in status output.
+- Existing workspaces require `boxdown start --recreate` to replace the old
+  Docker environment configuration. Boxdown will not automatically migrate
+  existing containers or `.env.development` files.
+
+## Diagnostics and Documentation
+
+Startup output may state whether the optional 1Password token was available,
+but must not print values, file contents, or paths that encode secret data.
+`boxdown doctor` verifies that the runtime-secret mount is constructible and
+that the generated configuration contains neither the legacy `--env-file`
+argument nor secret `containerEnv` entries. Missing optional values are
+warnings, not failures.
+
+Documentation will explain:
+
+- which host values Boxdown forwards;
+- that they are exposed to Bash sessions but not Docker configuration;
+- that `.env.development` is project-owned and ignored by Boxdown;
+- that `--recreate` is required for existing containers; and
+- how to manually remove and rotate a legacy 1Password token if it was
+  previously written to a workspace or log.
+
+## Test Strategy
+
+Tests will cover:
+
+- host secret-state creation, owner-only modes, atomic refresh, and removal of
+  stale files without printing values;
+- success, missing host values, missing `op`, and failed 1Password lookup as
+  non-blocking cases;
+- generated configuration contains the read-only runtime mount and contains no
+  `--env-file`, secret `containerEnv` keys, or secret values;
+- `.env.development` is neither created nor altered by initialization or
+  post-start hooks;
+- interactive, non-interactive, SSH, and Boxdown coding-agent Bash launch
+  paths export available values and leave unavailable values unset;
+- image inspection uses only a narrow projection and workspace logs never
+  receive a synthetic inspect environment value;
+- logger structural redaction for all three known keys;
+- doctor warnings and mount probes, with optional-secret absence non-fatal;
+- focused tests first, then the full test suite, lint, build, Bash syntax
+  checks, and `git diff --check`.
+
+## Decision Record
+
+The chosen design favors compatibility over strict command-level least
+privilege. The three values are intentionally ordinary environment variables
+inside Bash sessions. If this causes unacceptable in-container exposure or
+developer-experience problems, a future design may replace session bootstrap
+with per-command wrappers. That change would be a deliberate compatibility
+break and is not part of this work.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "boxdown",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "Run a reusable devcontainer sandbox for any local project",
   "types": "dist/main.d.mts",
   "type": "module",

package/src/config.ts

@@ -8,6 +8,8 @@ import {
   BOXDOWN_CONTAINER_DEVCONTAINER_DIR,
   BOXDOWN_CONTAINER_GITCONFIG_PATH,
   BOXDOWN_CONTAINER_HOST_GITCONFIG_DIR,
+  BOXDOWN_CONTAINER_SECRET_ENV_BOOTSTRAP,
+  BOXDOWN_CONTAINER_SECRET_ENV_DIR,
   BOXDOWN_CONTAINER_SSH_DIR,
   BOXDOWN_CONTAINER_SSH_PUBLIC_KEY_PATH
 } from './constants.ts'
@@ -67,7 +69,8 @@ export function buildGeneratedDevcontainerConfig (context: WorkspaceContext, sig
   const boxdownMounts = [
     `type=bind,source=${context.assetsDevcontainerDir},target=${BOXDOWN_CONTAINER_DEVCONTAINER_DIR},readonly`,
     `type=bind,source=${context.sshPublicKeyRuntimeDir},target=${BOXDOWN_CONTAINER_SSH_DIR},readonly`,
-    `type=bind,source=${context.hostGitconfigSnapshotDir},target=${BOXDOWN_CONTAINER_HOST_GITCONFIG_DIR},readonly`
+    `type=bind,source=${context.hostGitconfigSnapshotDir},target=${BOXDOWN_CONTAINER_HOST_GITCONFIG_DIR},readonly`,
+    `type=bind,source=${context.workspaceSecretEnvDir},target=${BOXDOWN_CONTAINER_SECRET_ENV_DIR},readonly`
   ]
 
   if (
@@ -98,6 +101,7 @@ export function buildGeneratedDevcontainerConfig (context: WorkspaceContext, sig
       `BOXDOWN_WORKSPACE_FOLDER=${shellQuote(context.workspaceFolder)}`,
       `BOXDOWN_HOST_GITCONFIG_PATH=${shellQuote(context.hostGitconfigPath)}`,
       `BOXDOWN_HOST_GITCONFIG_SNAPSHOT_PATH=${shellQuote(context.hostGitconfigSnapshotPath)}`,
+      `BOXDOWN_SECRET_ENV_DIR=${shellQuote(context.workspaceSecretEnvDir)}`,
       `BOXDOWN_PROGRESS=${shellQuote('${localEnv:BOXDOWN_PROGRESS}')}`,
       `BOXDOWN_VERBOSE=${shellQuote('${localEnv:BOXDOWN_VERBOSE}')}`,
       'bash',
@@ -119,10 +123,18 @@ export function buildGeneratedDevcontainerConfig (context: WorkspaceContext, sig
       ...(baseConfig.containerEnv ?? {}),
       BOXDOWN_CONTAINER_WORKSPACE_FOLDER: '/workspaces/${localWorkspaceFolderBasename}',
       BOXDOWN_WORKSPACE_BASENAME: '${localWorkspaceFolderBasename}',
+      BOXDOWN_SECRET_ENV_DIR: BOXDOWN_CONTAINER_SECRET_ENV_DIR,
+      BASH_ENV: BOXDOWN_CONTAINER_SECRET_ENV_BOOTSTRAP,
       DEVCONTAINER_SSH_PUBLIC_KEY_FILE: BOXDOWN_CONTAINER_SSH_PUBLIC_KEY_PATH,
       BOXDOWN_GIT_SIGNING_ENABLED: signing?.enabled === true ? '1' : '0',
       BOXDOWN_GIT_SIGNING_KEY_PATH: '/opt/boxdown/state/git-signing/signing-key.pub',
-      ...(signing?.enabled === true ? { SSH_AUTH_SOCK: '/run/boxdown/ssh-agent.sock' } : {})
+      ...(signing?.enabled === false && signing.reason !== undefined ? { BOXDOWN_GIT_SIGNING_REASON: signing.reason } : {}),
+      ...(signing?.enabled === true
+        ? {
+            BOXDOWN_GIT_SIGNING_SOURCE_SOCKET: '/run/boxdown/ssh-agent.sock',
+            SSH_AUTH_SOCK: '/run/boxdown/ssh-agent-node.sock'
+          }
+        : {})
     }
   }
 }

package/src/constants.ts

@@ -10,5 +10,12 @@ export const BOXDOWN_CONTAINER_AGENTS_DIR = '/home/node/.agents'
 export const BOXDOWN_CONTAINER_GITCONFIG_PATH = '/home/node/.gitconfig'
 export const BOXDOWN_CONTAINER_CODEX_DIR = '/home/node/.codex'
 export const BOXDOWN_CONTAINER_CODEX_AUTH_PATH = `${BOXDOWN_CONTAINER_CODEX_DIR}/auth.json`
+export const BOXDOWN_CONTAINER_SECRET_ENV_DIR = '/run/boxdown/secrets'
+export const BOXDOWN_CONTAINER_SECRET_ENV_BOOTSTRAP = `${BOXDOWN_CONTAINER_DEVCONTAINER_DIR}/utils/secret-env-bootstrap.sh`
+export const BOXDOWN_SECRET_ENV_NAMES = [
+  'ANTHROPIC_API_KEY',
+  'SNYK_TOKEN',
+  'OP_SERVICE_ACCOUNT_TOKEN'
+] as const
 
 export const PACKAGE_NAME = 'boxdown'

package/src/devcontainer.ts

@@ -5,7 +5,7 @@ import { buildGeneratedDevcontainerConfig, publishContainerPortFromConfig, write
 import { codingAgentBinary, type CodingAgentCli } from './coding-agents.ts'
 import { resolveDevcontainerCli } from './devcontainer-cli.ts'
 import { configureWorkspaceGithubGitAuth } from './github-git-auth.ts'
-import { resolveGitSigningPlan } from './git-signing.ts'
+import { reportGitSigningPlan, resolveGitSigningPlan } from './git-signing.ts'
 import type { WorkspaceCommandLogger } from './logging.ts'
 import { recordWorkspaceDockerImage } from './metadata.ts'
 import type { WorkspaceContext } from './paths.ts'
@@ -43,10 +43,6 @@ export interface DockerImageInfo {
   name?: string
 }
 
-interface DockerInspectContainer {
-  Image?: unknown
-  Config?: unknown
-}
 
 function devcontainerWorkspaceArgs (context: WorkspaceContext): string[] {
   return [
@@ -142,36 +138,28 @@ export async function findRunningContainerId (context: WorkspaceContext, options
   return result.stdout.split(/\r?\n/).find((line) => line.length > 0)
 }
 
-function isRecord (value: unknown): value is Record<string, unknown> {
-  return value !== null && typeof value === 'object' && !Array.isArray(value)
-}
-
-function parseDockerInspectImage (output: string, containerId: string): DockerImageInfo | undefined {
-  const trimmed = output.trim()
+export function parseDockerInspectImage (output: string, containerId: string): DockerImageInfo | undefined {
+  const [rawId, rawName] = output.trim().split('|')
 
-  if (trimmed.length === 0) {
+  if (rawId === undefined || rawId.length === 0) {
     return undefined
   }
 
-  let parsed: DockerInspectContainer
+  let id: unknown
+  let name: unknown
 
   try {
-    parsed = JSON.parse(trimmed) as DockerInspectContainer
+    id = JSON.parse(rawId)
+    name = rawName === undefined || rawName.length === 0 ? undefined : JSON.parse(rawName)
   } catch (error) {
     throw new Error(`Could not parse docker inspect output for ${containerId}`, { cause: error })
   }
 
-  if (typeof parsed.Image !== 'string' || parsed.Image.length === 0) {
-    return undefined
-  }
-
-  const configImage = isRecord(parsed.Config) && typeof parsed.Config.Image === 'string' && parsed.Config.Image.length > 0
-    ? parsed.Config.Image
-    : undefined
+  if (typeof id !== 'string' || id.length === 0) return undefined
 
   return {
-    id: parsed.Image,
-    ...(configImage === undefined ? {} : { name: configImage })
+    id,
+    ...(typeof name === 'string' && name.length > 0 ? { name } : {})
   }
 }
 
@@ -179,7 +167,7 @@ export async function inspectContainerImage (containerId: string, options: { log
   const result = await runBuffered('docker', [
     'inspect',
     '--format',
-    '{{json .}}',
+    '{{json .Image}}|{{json .Config.Image}}',
     containerId
   ], {
     logger: options.logger,
@@ -320,7 +308,19 @@ export async function startDevcontainer (context: WorkspaceContext, options: Sta
     progress.detail(context.generatedConfigPath)
   }
   try {
-    writeGeneratedDevcontainerConfig(context, await resolveGitSigningPlan(context))
+    const signingPlan = await resolveGitSigningPlan(context)
+    reportGitSigningPlan(signingPlan, {
+      logger: options.logger,
+      quiet: proxyMode,
+      ...(progress === undefined
+        ? {}
+        : {
+            writeWarning: (message: string) => {
+              progress.warn(message.trimEnd())
+            }
+          })
+    })
+    writeGeneratedDevcontainerConfig(context, signingPlan)
     if (hasConfigStep) {
       progress?.completeStep('devcontainer-config')
     }
@@ -669,7 +669,18 @@ export async function refreshContainerGhAuth (context: WorkspaceContext, options
       quiet: true,
       progress
     })
-    writeGeneratedDevcontainerConfig(context, await resolveGitSigningPlan(context))
+    const signingPlan = await resolveGitSigningPlan(context)
+    reportGitSigningPlan(signingPlan, {
+      logger: options.logger,
+      ...(progress === undefined
+        ? {}
+        : {
+            writeWarning: (message: string) => {
+              progress.warn(message.trimEnd())
+            }
+          })
+    })
+    writeGeneratedDevcontainerConfig(context, signingPlan)
     if (hasConfigStep) {
       progress?.completeStep('gh-auth-config')
     }