Repository navigation
T28 — Inject a stored key in the registered form, read from the Keychain per request #2292
Description
Task
| slice | size | difficulty | model | who | estimated lines |
|---|---|---|---|---|---|
| Keychain secrets by reference | L | needs care | strongest | an agent | 800 (380 code, 420 tests) |
A request to the rule's upstream carries the stored key in the registered header, and a replaced key is sent next time.
Covers:
- BEP-032
- BEP-033
- BEP-045
- BEP-054
- BEP-065
- BEP-066
Layers:
- inject:
- crates/bep/src/inject.rs (new): emits the registered prefix and the value as the header's value, or one
basic_authfield; refuses CR or LF in a value or prefix - crates/bep/src/store.rs: reads the value per request, writes it nowhere, refuses a deleted or disabled item
- crates/bep/src/forward.rs: injects for an admitted store reference; refuses a sign-in reference naming another instance
- crates/bep/src/lib.rs: module line
cargo nextest run -p bep store_reference_injects_in_registered_formcargo nextest run -p bep store_value_read_per_request_never_writtencargo nextest run -p bep deleted_keychain_item_refuses_next_injectioncargo nextest run -p bep reference_to_another_sign_in_instance_is_refusedcargo nextest run -p bep replaced_secret_is_injected_on_next_requestcargo nextest run -p bep injected_value_is_exactly_prefix_plus_valuecargo nextest run -p bep crlf_in_value_or_prefix_refuses_injection
- crates/bep/src/inject.rs (new): emits the registered prefix and the value as the header's value, or one
Waits on:
- T26 — Store, list and remove secrets with min secret under proxy-only access #2287
- T27 — Mint store handles and keep the client's key registered across proxy restarts #2288
- SP1 — Do Claude Code and an MCP client send a sealed handle unmodified? #2257
Plan block
### T28 — Inject a stored key in the registered form, read from the Keychain per request
slice: S3
kind: task
covers: BEP-032, BEP-033, BEP-045, BEP-054, BEP-065, BEP-066
size: L
est: 380 code, 420 tests
executor: agent
difficulty: needs care
model: strongest
diagnostics: `min box audit <box>` shows each injection's store and identifier, and a refused one marked `injection_invalid` or as a deleted item, never the value
observability: one debug log line per injection naming the store, the identifier and the header, never the value
layers:
- inject:
- crates/bep/src/inject.rs (new): emits the registered prefix and the value as the header's value, or one `basic_auth` field; refuses CR or LF in a value or prefix
- crates/bep/src/store.rs: reads the value per request, writes it nowhere, refuses a deleted or disabled item
- crates/bep/src/forward.rs: injects for an admitted store reference; refuses a sign-in reference naming another instance
- crates/bep/src/lib.rs: module line
test: cargo nextest run -p bep store_reference_injects_in_registered_form
test: cargo nextest run -p bep store_value_read_per_request_never_written
test: cargo nextest run -p bep deleted_keychain_item_refuses_next_injection
test: cargo nextest run -p bep reference_to_another_sign_in_instance_is_refused
test: cargo nextest run -p bep replaced_secret_is_injected_on_next_request
test: cargo nextest run -p bep injected_value_is_exactly_prefix_plus_value
test: cargo nextest run -p bep crlf_in_value_or_prefix_refuses_injection
produces: none
consumes:
- crates/bep/src/store.rs
proof: A request to the rule's upstream carries the stored key in the registered header, and a replaced key is sent next time.
depends on:
- blocked by #2287
- blocked by #2288
- blocked by #2257
Reacted by minimal-foundry
Activity
fix(bep): check each box's declared egress on a passthrough
feat(bep): validate the upstream, pass unsealed requests through, and…
minimal-foundry commentedon Oct 25, 2026
Done. #2574 merged.
branch
agent/2292-inject-a-stored-key-in-the-registered-form-read· epic #1501 · PR #25741c61b8ad9d0c96156c190c33c78748dd14b3e4006282bc7b24b143f8b60795d80ab1deb8Updated 2026-10-26T04:17:07.275Z.