[feat] Hide Daytona credentials by default - #5705
Merged
Merged
Conversation
The variable now switches the protection OFF rather than on. An operator who does nothing gets keys hidden behind Daytona Secrets. The reasoning is which choice should need a deliberate decision. Leaving provider keys readable inside a sandbox that runs model-written code is the surprising option, so it should be the one someone has to ask for in writing, not the one they get by not knowing the variable exists. `AGENTA_RUNNER_DAYTONA_OPAQUE_SECRETS` accepts `off`, `false`, `0`, `no`, `disabled`, or `plaintext` to switch hiding off, case-insensitively and with whitespace trimmed. Anything it does not recognize leaves hiding ON, so a typo in this variable fails safe: you keep the protection you would have had by doing nothing instead of silently losing it. `process_local` still works and still names the cleanup guarantee, so it stays meaningful as further modes arrive. The operational consequence, which is the real cost of this change: the runner's Daytona API key now needs permission to manage Secrets on every deployment using Daytona, not only ones that opted in. A key without it fails every run carrying a model or MCP key, at sandbox creation, with the named error added earlier. The upgrade note in the configuration reference says this plainly and gives `=off` as the way out for anyone who would rather not grant it. There is still no silent plaintext fallback. Config and docs follow the new default: the env examples now show how to turn it off rather than on, the Helm values comment warns that a bare `off` is a YAML boolean and would be dropped by the template (leaving hiding on, the opposite of the intent), and the schema accepts `process_local` or `off`. Four tests encoded the old default and now encode the new one, plus coverage for every off spelling and for typos failing safe. Runner tsc clean, 99 files / 1538 tests.
dosubot
Bot
added
the
size:L
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
Railway Preview Environment
Updated at 2026-08-03T19:42:35.536Z |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
Hiding Daytona credentials shipped in #5670 behind
AGENTA_RUNNER_DAYTONA_OPAQUE_SECRETS=process_local, off unless an operator opted in. This inverts that: hiding is on by default and the variable now switches it off.The reasoning is about which choice should need a deliberate decision. Leaving provider keys readable inside a sandbox that runs model-written code is the surprising option, so it should be the one someone has to ask for in writing, not the one they get by never learning the variable exists.
Changes
The default. With the variable unset, a Daytona run stores each model and MCP key as a Daytona Secret restricted to the one host it authenticates against, and the sandbox gets a placeholder.
Turning it off takes
off,false,0,no,disabled, orplaintext, case-insensitively and with whitespace trimmed.Anything unrecognized leaves hiding ON. This is the part worth reviewing closely. A typo now fails safe: someone who meant to switch hiding off and wrote
ofkeeps the protection they would have had by doing nothing, instead of silently losing it. The opposite default would turn a one-character mistake into an unprotected deployment that looks configured.process_localstill works and is identical to leaving the variable unset. It stays because it names the cleanup guarantee (the runner tracks the Secret records it created in its own memory), which will matter when a durable mode arrives. That is also why the setting takes a mode name rather than a plainon.Before:
After:
The operational cost, which is the real content of this PR
The runner's Daytona API key now needs permission to manage Secrets on every deployment that uses Daytona, not only on ones that opted in. That is a different permission from creating sandboxes. A key without it fails every run carrying a model or MCP key, at sandbox creation, with the named error added in #5670. There is still no silent plaintext fallback, because quietly doing the unprotected thing is worse than stopping.
The configuration reference now carries an upgrade warning saying exactly this, and gives
=offas the way out for anyone who would rather not grant the permission. Our own keys across all environments were updated before this PR.Tests / notes
tsc --noEmitclean, 99 files / 1538 tests.values.yaml: a bareoffin YAML parses as booleanfalse, the Helm template'sifthen skips the variable, and hiding stays on, the opposite of the intent. The value must be quoted. The schema types it as a string so an unquoted one fails validation rather than passing silently.process_localoroff.What to QA
ANTHROPIC_API_KEY. It shows adtn_secret_placeholder, not the key. This is the whole point and the release gate does not check it.OPENAI_API_KEY.AGENTA_RUNNER_DAYTONA_OPAQUE_SECRETS=off, restart the runner, run again. The real key is present, matching pre-v0.108.1 behavior.of(a deliberate typo), restart, run again. The placeholder is back, because an unrecognized value leaves hiding on.