Harness auth is environmental now: the harness sets a placeholder in its auth variable (claude: ANTHROPIC_AUTH_TOKEN), and the swap layer substitutes the real value at egress. But the CLI can also read other auth variables from the session environment, and a foreign value there competes with the one druks set.
This is not theoretical. Docker Sandboxes injects ANTHROPIC_API_KEY=proxy-managed into every session, also with no stored secret and credential mode none (docker/sbx-releases#538). drukbox registers druks secrets as custom placeholders, so that service placeholder stays unsubstituted. A docker-sbx sandbox then carries both: a valid swap-backed ANTHROPIC_AUTH_TOKEN and an invalid ANTHROPIC_API_KEY. Which one the CLI uses decides whether the run works.
Proposed fix: the harness launches its CLI with foreign provider keys removed from the environment, and keeps the auth variable it set itself. Then druks-issued auth is the one source on every provider, and no guest environment can compete with it.
Note: an earlier version of this issue proposed env -u on all provider keys. That predates the placeholder model — clearing the harness's own auth variable would now break auth. The scrub must be selective.
Harness auth is environmental now: the harness sets a placeholder in its auth variable (claude:
ANTHROPIC_AUTH_TOKEN), and the swap layer substitutes the real value at egress. But the CLI can also read other auth variables from the session environment, and a foreign value there competes with the one druks set.This is not theoretical. Docker Sandboxes injects
ANTHROPIC_API_KEY=proxy-managedinto every session, also with no stored secret and credential modenone(docker/sbx-releases#538). drukbox registers druks secrets as custom placeholders, so that service placeholder stays unsubstituted. A docker-sbx sandbox then carries both: a valid swap-backedANTHROPIC_AUTH_TOKENand an invalidANTHROPIC_API_KEY. Which one the CLI uses decides whether the run works.Proposed fix: the harness launches its CLI with foreign provider keys removed from the environment, and keeps the auth variable it set itself. Then druks-issued auth is the one source on every provider, and no guest environment can compete with it.
Note: an earlier version of this issue proposed
env -uon all provider keys. That predates the placeholder model — clearing the harness's own auth variable would now break auth. The scrub must be selective.