feat(net): credential injection primitives — inject an auth secret in the proxy (RFC #66)

crates/sandlock-cli/src/main.rs

@@ -461,6 +461,8 @@ async fn run_command(args: RunArgs) -> Result<i32> {
     if !pb.extra_deny_syscalls.is_empty() { builder = builder.extra_deny_syscalls(pb.extra_deny_syscalls.clone()); }
     for rule in &pb.http_allow { builder = builder.http_allow(rule); }
     for rule in &pb.http_deny { builder = builder.http_deny(rule); }
+    for c in &pb.credentials { builder = builder.credential_spec(c); }
+    for rule in &pb.http_inject { builder = builder.http_inject(rule); }
     for port in &pb.http_ports { builder = builder.http_port(*port); }
     if let Some(ref ca) = pb.http_ca { builder = builder.http_ca(ca); }
     if let Some(ref key) = pb.http_key { builder = builder.http_key(key); }

crates/sandlock-core/src/checkpoint/capture.rs

@@ -297,6 +297,18 @@ fn parse_fdinfo(pid: i32, fd: i32) -> io::Result<(i32, u64)> {
 /// Capture a checkpoint from a running, stopped sandbox.
 /// The sandbox must already be frozen (SIGSTOP'd and fork-held).
 pub(crate) fn capture(pid: i32, policy: &Sandbox) -> Result<Checkpoint, SandlockError> {
+    // Credential-injection rules hold supervisor-only secrets that are
+    // deliberately not serialized (`#[serde(skip)]`). A checkpoint image would
+    // therefore restore with no injection rules and send every request
+    // uncredentialed — reject rather than silently drop them.
+    if !policy.inject.is_empty() {
+        return Err(SandlockError::Runtime(SandboxRuntimeError::Child(
+            "checkpoint is not supported with credential injection (--http-inject); \
+             the injected secrets cannot be serialized into the image"
+                .into(),
+        )));
+    }
+
     // Seize via ptrace (PTRACE_SEIZE + PTRACE_INTERRUPT -- doesn't auto-SIGSTOP)
     ptrace_seize(pid).map_err(|e| {
         SandlockError::Runtime(SandboxRuntimeError::Child(format!("ptrace seize: {}", e)))

crates/sandlock-core/src/context.rs

@@ -498,6 +498,15 @@ pub(crate) fn confine_child(args: ChildSpawnArgs<'_>) -> ! {
             std::env::remove_var(&key);
         }
     }
+    // Remove env vars whose value was loaded into the supervisor as a credential
+    // source, so the agent can't read the real secret straight from its own
+    // environment (this is the child; the mutation is process-local and post-fork).
+    // This runs *before* applying `sandbox.env`, so the inherited real secret is
+    // dropped but a deliberate placeholder the user passes (e.g.
+    // `--env OPENAI_API_KEY=dummy`, which SDKs need set to start) still survives.
+    for name in &sandbox.inject_env_strip {
+        std::env::remove_var(name);
+    }
     for (key, value) in &sandbox.env {
         std::env::set_var(key, value);
     }