Runtime-assert the credential cipher at mint and hub boot (CL-7222)

apps/hub/src/index.ts

@@ -119,6 +119,7 @@ import {
   createCryptoProviderCache,
   findFoldedRunByAddress,
   lookupFoldedRunReconnectKey,
+  tagCredentialCipher,
 } from "@corbits/folded-runs";
 import { createTopLevelRunRoutes } from "@corbits/run-scope";
 import {
@@ -513,6 +514,18 @@ export function credentialCipherFrom(
   );
 }
 
+/**
+ * Hub-boot mint of the process-wide credential cipher: build from
+ * config, then runtime-tag the result. Missing or wrong-shape input
+ * fails closed — the hub does not boot.
+ */
+export function hubCredentialCipher(
+  config: HubConfig,
+  log: ReturnType<typeof getLogger>,
+): CredentialCipher {
+  return tagCredentialCipher(credentialCipherFrom(config, log));
+}
+
 /**
  * Instantiates one configured sidecar-provisioner backend. This is the
  * extension point named in `.env.example` and `apps/hub/src/config.ts`:
@@ -571,9 +584,9 @@ export async function createHub(config: HubConfig) {
     bus: mailboxBus,
   });
   const log = getLogger(["hub", "auth"]);
-  // Built once and shared by every secret-at-rest seam in this
-  // composition root — see `credentialCipherFrom`'s own doc comment.
-  const credentialCipher = credentialCipherFrom(config, log);
+  // Built once, tagged, and shared by every secret-at-rest seam in this
+  // composition root — see `hubCredentialCipher`.
+  const credentialCipher = hubCredentialCipher(config, log);
 
   const auth = betterAuth({
     baseURL: config.baseUrl,
@@ -2238,6 +2251,7 @@ export async function createHub(config: HubConfig) {
             assetService,
             sidecarRouter,
             eventCollectors,
+            credentialCipher,
             toolGrantsForPins,
             mcpCredentialBindingsFor,
             pinnedPackageCredentialBindingsFor,

apps/hub/test/credential-cipher.test.ts

@@ -6,8 +6,9 @@
 
 import { describe, expect, test } from "bun:test";
 import { getLogger } from "@intx/log";
+import { tagCredentialCipher } from "@corbits/folded-runs";
 import type { HubConfig } from "../src/config.ts";
-import { credentialCipherFrom } from "../src/index.ts";
+import { credentialCipherFrom, hubCredentialCipher } from "../src/index.ts";
 
 const log = getLogger(["hub", "test"]);
 
@@ -75,3 +76,34 @@ describe("credentialCipherFrom", () => {
     expect(encrypted).not.toBe("secret-value");
   });
 });
+
+describe("hubCredentialCipher", () => {
+  test("boot tags the cipher built from a configured key", async () => {
+    const cipher = hubCredentialCipher(
+      {
+        ...baseConfig,
+        credentialEncryptionKeyHex: "a".repeat(64),
+      },
+      log,
+    );
+    expect(cipher).toBe(tagCredentialCipher(cipher));
+    const encrypted = await cipher.encrypt("secret-value", "aad");
+    expect(encrypted).not.toBe("secret-value");
+  });
+
+  test("boot tags the noop cipher when ALLOW_PLAINTEXT_SECRETS is set", async () => {
+    const cipher = hubCredentialCipher(
+      { ...baseConfig, allowPlaintextSecrets: true },
+      log,
+    );
+    expect(cipher).toBe(tagCredentialCipher(cipher));
+    const encrypted = await cipher.encrypt("secret-value", "aad");
+    expect(encrypted).toBe("secret-value");
+  });
+
+  test("boot still hard-fails when the key is missing and plaintext is not opted in", () => {
+    expect(() => hubCredentialCipher(baseConfig, log)).toThrow(
+      /CREDENTIAL_ENCRYPTION_KEY/,
+    );
+  });
+});

packages/chat/src/platform-adapter.ts

@@ -27,6 +27,7 @@ import {
   resolveNewestProjectedDefinition,
   sendFoldedMail,
   wakeFoldedRun,
+  tagCredentialCipher,
   type FoldedRunMode,
   type FoldedRunsDeps,
   type SendFoldedMailParams,
@@ -62,7 +63,7 @@ import { withTimeout } from "./with-timeout";
 import { wrapWakeInferenceError } from "./model-unavailable";
 import type { EventCollectorRegistry, SidecarRouter } from "@intx/hub-sessions";
 import type { InferencePreference } from "@intx/agent";
-import { formatRunAddress } from "@intx/types";
+import { formatRunAddress, type CredentialCipher } from "@intx/types";
 import type { FoldedBody } from "@intx/workflow-deploy";
 import {
   AgentUnreachableError,
@@ -87,13 +88,11 @@ export type CreateHubChatPlatformDeps = {
   /**
    * Decrypts credential secrets when an invited agent's launch resolves
    * inference sources against the tenant catalog — see
-   * `@corbits/folded-runs`' `FoldedRunsDeps.credentialCipher`; every
-   * invited-agent launch and wake needs it.
-   * Omitted, `resolveDefinitionSources` falls back to a noop cipher and
-   * hands the raw stored secret to the provider unchanged — correct only
-   * when the credential was itself written unencrypted.
+   * `@corbits/folded-runs`' `FoldedRunsDeps.credentialCipher`. Tagged at
+   * construction: missing or wrong-shape input fails closed and the
+   * platform is not minted.
    */
-  credentialCipher?: FoldedRunsDeps["credentialCipher"];
+  credentialCipher: CredentialCipher;
   /**
    * Every caller of `createHubChatPlatform` builds this via
    * `createEventCollectorRegistry` and passes it through — without it,
@@ -240,16 +239,15 @@ export type HubChatPlatform = ChatPlatform & {
 export function createHubChatPlatform(
   deps: CreateHubChatPlatformDeps,
 ): HubChatPlatform {
+  const credentialCipher = tagCredentialCipher(deps.credentialCipher);
   const foldedRunsDeps: FoldedRunsDeps = {
     db: deps.db,
     sessionService: deps.sessionService,
     assetService: deps.assetService,
     sidecarRouter: deps.sidecarRouter,
     eventCollectors: deps.eventCollectors,
     toolGrantsForPins: deps.toolGrantsForPins,
-    ...(deps.credentialCipher !== undefined
-      ? { credentialCipher: deps.credentialCipher }
-      : {}),
+    credentialCipher,
     ...(deps.mcpCredentialBindingsFor !== undefined
       ? { mcpCredentialBindingsFor: deps.mcpCredentialBindingsFor }
       : {}),