Proxy credentials for environments

Draft
SA
2mo ago
+23067-105

What

An environment gets a Proxy credentials section next to its variables. A proxy credential is a secret the sandbox can use but never read: the provider's egress proxy injects it into requests to the hosts the rule names, and inside the sandbox the tool only sees a placeholder in the env var it reads.

It is its own section, not a delivery mode on a variable, because it is a value plus a rule (hosts, header, header value template, placeholder env) while a variable is just a value. Presets for Anthropic and OpenAI fill the rule in and lock it; Custom exposes all four fields. The sheet's "How it works" panel rewrites itself from what is typed, so the mechanism is visible at the point of entry.

Screenshots and the proof: https://app.superset.sh/page/proxy-credentials-wr3r37

How it reaches the sandbox

  • packages/shared/src/environment-proxy-credentials.ts: presets, validation, and the {{secret}} token the edge fills in.
  • environment_proxy_credentials (migration 0106). The value is encrypted with the row id as its key, so a rotated secret keeps its ciphertext bound to the row. Same-name create replaces in place.
  • environment.proxyCredentials.list/create/remove, with the same guards as variables (assertInternal, loadEnvironment, secretOwnerOrganizationId, so per-org rows on a shared environment).
  • resolveEnvironment returns the decrypted rules; provisionSandbox turns each into a routing rule with its own scoped secret and sets the placeholder env. An environment rule for a host replaces the org default for that host; a placeholder replaces a variable of the same name (the edge would overwrite the header anyway, so the env says so).

Evidence

A custom rule (httpbin.org, header X-Proxy-Test, value injected-{{secret}}, placeholder PROXY_TEST) saved through the desktop UI on the Default environment, then a cloud workspace created from it and this run inside the sandbox:

PROXY_TEST=proxy-injected-see-network-routing
HTTPS_PROXY=http://localhost:49152
--- httpbin.org/headers sees:
    "X-Proxy-Test": "injected-s3cr3t-value-123"
--- example.com (no rule): 200

The sandbox's routing carried the two org defaults plus the environment rule. The workspace was deleted afterwards.

Also: @blaxel/core 0.3.19, and forks take their env on the fork request

Per Blaxel's fork doc, fork() now accepts envs. That replaces the spec update (and the restart it caused) that used to hand a fork its identity: forkSandbox is one call, and promoting a workspace blanks its identity on the fork request instead of stripping it with a spec update. updateSandbox is gone from the module. Measured through the desktop: a workspace from the Superset environment reaches ready in 12 s instead of about 25 s, and Claude launched inside it with its identity intact.

One caveat, verified twice: the values reach processes only when the sandbox runtime baked into the image is current. On a golden built 2026-09-02 they landed in the spec and no process saw them, PID 1 included; on one rebuilt 2026-09-03 every process did. The boot script's exec carries the same env for goldens from before that rebuild; docs/cloud-sandbox-mismatches.md records it. Both goldens were re-released on the rebuilt base (dev and prod).

bunfig.toml excludes @blaxel/core from the 3-day release-age guard: the pin is exact, and this SDK ships sandbox fixes we depend on within hours.

Not in this PR

  • Forks cannot carry the proxy. It exists only on sandboxes created with it, and a fork is created without it (docs/cloud-sandbox-mismatches.md). The section says so on a fork environment; the rules apply once the environment starts from an image. The ask to Blaxel is network config on the fork request.
  • Superset's own keys still come from the API env (agentCredentialRoutes) for every image sandbox. Per-organization keys for attribution would be an organization setting writing the same kind of rule.
  • Domain allow and deny lists, which ride on the same network object, are a later section.

Notes for review

  • Migrations 0106 and 0107 (the second shortens the unique constraint name to fit Postgres's 63-byte limit) were generated with drizzle-kit and applied only to my dev database branch; CI applies them on merge.
  • New strings are Lingui with settings.environments.proxy.* ids and were translated locally with the package's translate script.

Summary by CodeRabbit

  • New Features
    • Added proxy credential management to environment settings.
    • Create credentials for Anthropic, OpenAI, or custom providers with validation and secure secret handling.
    • View, search, and delete proxy credentials, with confirmation before deletion.
    • Proxy credentials are automatically applied to supported sandbox requests while secrets remain protected.
    • Added loading error messages with retry support.
    • Added fork-specific messaging where proxy credentials are unavailable.
  • Localization
    • Added translations for the proxy credential interface across supported languages.