--- title: "Secrets and agent terminals" --- # Secrets and agent terminals How the Editor keeps your credentials out of agent terminals and model context, and how to run one of your own tasks with secrets from your organisation's vault. Two protections work today. Agent terminals never inherit your credentials, and tool results are redacted before they reach a model; this needs no server. And you can run one of your own tasks with secrets from your organisation's vault in Govern, without the values ever reaching a window, an extension or a model. Agents cannot receive vault secrets yet. ## Agent terminals do not inherit credentials Every terminal the agent host starts is treated as an agent terminal. Before it starts, environment variables are withheld: - **by name**: names that say they hold a credential (`TOKEN`, `SECRET`, `PASSWORD`, `PASSPHRASE`, `CREDENTIAL`, `APIKEY` anywhere; `KEY`, `PAT`, `DSN`, `AUTH`, `COOKIE` as the last word; pairs such as `PRIVATE_KEY`, `ACCESS_KEY`, `API_KEY`, `CONNECTION_STRING`, `WEBHOOK_URL`), every `AWS_*` except `AWS_REGION`, `AWS_DEFAULT_REGION`, `AWS_PROFILE` and `AWS_DEFAULT_PROFILE`, `AZURE_*_SECRET`, and well-known names such as `GITHUB_TOKEN`, `GH_TOKEN`, `NPM_TOKEN`, `GOOGLE_APPLICATION_CREDENTIALS`, `DATABASE_URL`, `PGPASSWORD` and `VAULT_TOKEN`; - **by value**: credentials in a URL (`scheme://user:password@`) and tokens of a known shape, whatever the variable is called; - **by your organisation's policy** (below), which can only withhold more. After the shell starts and before the agent's first command, the agent host asks the shell which variables it exported (names only) and removes withheld ones, so your `.bashrc`, `.zshrc`, `config.fish` or PowerShell profile cannot export them again. This re-check covers bash, zsh, fish and PowerShell. The agent's first shell result says how many variables were withheld (the number only). Proxy variables such as `HTTPS_PROXY` are kept, because the terminal could not reach the network otherwise; their values are redacted from what reaches a model. `SSH_AUTH_SOCK` is kept so git over SSH works; a policy can withhold it. Your own integrated terminals are not agent terminals and are unchanged. ### Tool results are redacted Before a tool result reaches a model, the values withheld from agent terminals (in raw, JSON-escaped, URL-encoded, hexadecimal and base64 forms) and whatever the secret scanner detects are replaced by `[redacted: ]`. This runs for the Claude and Codex engines and the models you connect. Known limits: a failed tool call of the Claude engine on your own Claude account, and tool results of a Codex thread on your own ChatGPT account, are not redacted by the Editor (those engines give no hook to rewrite them); their environments are still withheld. ### For administrators The managed policy `NeuralInverseVaultAgentEnvironment` (setting `neuralInverse.vault.agentEnvironment`) takes a JSON object: ```json { "withhold": ["NAME", "PREFIX_*"], "allowOnly": ["NAME", "PREFIX_*"] } ``` `withhold` adds names or patterns. With `allowOnly`, every variable that matches none of its entries is withheld too. The built-in rules always apply; an invalid policy leaves the defaults. Only the managed value is read. ## Run a task with vault secrets This lets you run one of your own programs with secrets from your organisation's vault in Govern. The values go into that one program's environment and nowhere else. ### Before you start - Sign in. Your organisation's Govern deployment must offer the vault and grant you access to the secrets. - Your operating system needs a usable credential store: the Editor makes a device key (ECDSA P-256; in the Windows TPM when available, otherwise a software key in the credential store) and registers it with Govern before the first grant. - Add a `.env.template` to the folder that names each variable and its vault reference: ``` DB_PASSWORD=ks:/# ``` The file is a request, never authority: it names variables and references only. ### Steps 1. Run **Run with Secrets...** (category Neural Inverse Vault). 2. Choose the folder, then one of its tasks (`tasks.json`, shell or process) or a Node.js launch configuration from `launch.json` (run without the debugger). 3. A native dialog shows exactly what will run: the full command, the folder, every variable and reference and where it was read, the purpose, the lifetime (one use within five minutes, revoked when the program ends) and the server. Cancel is the default. 4. Confirm. The Editor asks Govern for a grant bound to you, this app, your device key, the command and the folder. 5. If the secret is on a sensitive path, Govern needs approval from other people with a passkey in the Govern console. The Editor tells you how many, can open the console's front page, and waits up to four and a half minutes. The Editor never approves its own requests. 6. The grant is redeemed once and the program starts with a new environment holding the values. Its output is redacted and shown in a read-only "Vault run" document held in memory. 7. When the program exits, crashes or cannot start, when you stop it, close the window, sign out or quit, the grant is revoked. A value shorter than 8 characters, or longer than 16 KiB, cannot be redacted reliably, so the whole output of that run is withheld and only the exit code comes back. ### Other commands - **Show Secret References** lists the template's references with Govern's metadata (mount type, version, sensitive), never a value. - **Vault Grants...** lists your grants as Govern describes them, and revokes one after confirmation. A chat message that contains a value injected in this session is not sent (best effort; attachments and text beyond 64 KiB are not checked). ## Not available yet - Vault secrets for agents (placeholders by default, with a person's approval for a value) wait for a later Govern phase. - Debugging with secrets, secrets as files, and an interactive terminal with secrets. - The Agents app's own entry points and the CLI. - Until Govern verifies hardware attestation, every device key is recorded as software; an organisation that requires hardware keys is then refused.