feat(vault): support credential networking and injection policies

Author: chenanran555

docs/guides/use-mcp-and-vaults.md

@@ -24,6 +24,7 @@ vaults:
         secret_value: ${DB_TOKEN}
         networking:
           type: limited
+          allowed_hosts: ["api.example.com"]
 ```
 
 | Credential type | Key fields |
@@ -33,6 +34,34 @@ vaults:
 
 Secrets are referenced with `${VAR_NAME}` and loaded from `.env`; never inline a real token.
 
+### Bailian credential injection
+
+Bailian supports `environment_variable` credentials. Declare the outbound hosts and
+request locations where the secret may be injected:
+
+```yaml
+vaults:
+  api-credentials:
+    provider: bailian
+    display_name: "API Credentials"
+    credentials:
+      - name: api-token
+        type: environment_variable
+        secret_name: API_TOKEN
+        secret_value: ${API_TOKEN}
+        networking:
+          allowed_hosts: ["api.example.com", "*.example.org"]
+        injection_location:
+          header: true
+          body: false
+```
+
+The API receives both objects under `auth`. You do not need to send `networking.type`.
+Use `["*"]` to explicitly allow all hosts. Existing declarations with no networking
+policy or with `type: unrestricted` retain that scope; an omitted injection location
+defaults to headers enabled and body disabled. Legacy `type: limited` requires an
+explicit `allowed_hosts` list.
+
 ## Attach MCP servers to an agent
 
 Reference a URL-based MCP server and bind the vault that holds its token:

docs/reference/configuration.md

@@ -222,7 +222,18 @@ vaults:
 | `type` | `"environment_variable"` | yes | |
 | `secret_name` | string | yes | Secret name. |
 | `secret_value` | string | yes | Secret value (string or number, coerced). |
-| `networking.type` | `"unrestricted"` \| `"limited"` | no | |
+| `networking.type` | `"unrestricted"` \| `"limited"` | no | Legacy policy type. Bailian requests use `allowed_hosts` instead. |
+| `networking.allowed_hosts` | string[] | no | Bailian credential injection host allow-list, e.g. `["api.example.com", "*.example.org"]`; `["*"]` allows all hosts. |
+| `injection_location.header` | boolean | no | Bailian: allow secret replacement in request headers. |
+| `injection_location.body` | boolean | no | Bailian: allow secret replacement in request bodies. |
+
+For Bailian, these fields are nested under `auth` in credential create/update requests.
+When omitted, creation uses `networking: { allowed_hosts: ["*"] }` and
+`injection_location: { header: true, body: false }`. Legacy `networking.type: unrestricted`
+maps to `["*"]`; `limited` must include `allowed_hosts` and is never widened implicitly.
+Explicit host lists and injection booleans are preserved, including through sync/export.
+Credential retry adoption compares host sets and injection policy as well as the existing
+identity and metadata fields; a different policy is not treated as an exact match.
 
 ## Memory store
 

packages/playbooks/src/types.ts

@@ -73,7 +73,8 @@ export interface VaultCredentialStructure {
 	name: string;
 	type: "environment_variable";
 	secret_name: string;
-	networking?: { type: "unrestricted" | "limited" };
+	networking?: { type?: "unrestricted" | "limited"; allowed_hosts?: string[] };
+	injection_location?: { header?: boolean; body?: boolean };
 }
 
 export interface VaultProfile {

packages/sdk/src/index.ts

@@ -25,6 +25,8 @@ export {
 
 export type {
 	CredentialDecl,
+	CredentialInjectionLocation,
+	CredentialNetworking,
 	DeploymentDecl,
 	EnvironmentDecl,
 	ProjectConfig,

packages/sdk/src/internal/core/validate-config.ts

@@ -157,6 +157,20 @@ export function collectProviderCapabilities(
 		}
 		const caps = def.capabilities;
 
+		for (const [name, vault] of Object.entries(config.vaults ?? {})) {
+			if (vault.provider && vault.provider !== providerName) continue;
+			if (
+				providerName !== "bailian" &&
+				vault.credentials.some((credential) => credential.injection_location !== undefined)
+			) {
+				diagnostics.error(
+					`${providerName}.vault.injection_location.unsupported`,
+					`vault.${name}: provider '${providerName}' does not support credential injection_location; pin this vault to bailian.`,
+					{ type: "vault", name, provider: providerName },
+				);
+			}
+		}
+
 		for (const [name, environment] of Object.entries(config.environments ?? {})) {
 			if (environment.provider && environment.provider !== providerName) continue;
 			if (environment.environment_id) continue;

packages/sdk/src/internal/core/vault-credential-runtime.ts

@@ -206,12 +206,28 @@ function resolveVaultProvider(
 function credentialMatches(remote: VaultCredentialInfo, desired: CredentialDecl): boolean {
 	if (remote.auth_type !== desired.type || !metadataMatches(remote.metadata, desired.metadata)) return false;
 	if (desired.type === "static_bearer") return remote.mcp_server_url === desired.mcp_server_url;
+	const desiredHosts = credentialHosts(desired.networking);
+	const remoteHosts = credentialHosts(remote.networking ?? { type: remote.networking_type });
+	const desiredLocation = desired.injection_location;
+	const remoteLocation = remote.injection_location;
+	// An omitted response cannot prove that an explicitly requested injection policy matches.
+	if (desiredLocation && !remoteLocation) return false;
 	return (
 		remote.secret_name === desired.secret_name &&
-		(remote.networking_type ?? "unrestricted") === (desired.networking?.type ?? "unrestricted")
+		desiredHosts !== undefined &&
+		remoteHosts !== undefined &&
+		desiredHosts.length === remoteHosts.length &&
+		desiredHosts.every((host) => remoteHosts.includes(host)) &&
+		(desiredLocation?.header ?? true) === (remoteLocation?.header ?? true) &&
+		(desiredLocation?.body ?? false) === (remoteLocation?.body ?? false)
 	);
 }
 
+function credentialHosts(networking: { type?: string; allowed_hosts?: string[] } | undefined): string[] | undefined {
+	if (networking?.allowed_hosts !== undefined) return [...new Set(networking.allowed_hosts)];
+	return networking?.type === "limited" ? undefined : ["*"];
+}
+
 function metadataMatches(
 	remote: Record<string, string> | undefined,
 	desired: Record<string, string> | undefined,

packages/sdk/src/internal/parser/schema.ts

@@ -61,7 +61,18 @@ const environmentVariableCredentialSchema = z.object({
 	metadata: z.record(z.string(), z.string()).optional(),
 	secret_name: z.string(),
 	secret_value: coerceString,
-	networking: z.object({ type: z.enum(["unrestricted", "limited"]) }).optional(),
+	networking: z
+		.object({
+			type: z.enum(["unrestricted", "limited"]).optional(),
+			allowed_hosts: z.array(z.string()).optional(),
+		})
+		.optional(),
+	injection_location: z
+		.object({
+			header: z.boolean().optional(),
+			body: z.boolean().optional(),
+		})
+		.optional(),
 });
 
 const credentialSchema = z.discriminatedUnion("type", [

packages/sdk/src/internal/providers/bailian/adapter.ts

@@ -639,6 +639,8 @@ export class BailianAdapter implements ProviderAdapter {
 				secret_name: auth.secret_name as string | undefined,
 				mcp_server_url: auth.mcp_server_url as string | undefined,
 				networking_type: networking?.type as string | undefined,
+				networking: networking as CredentialDecl["networking"],
+				injection_location: auth.injection_location as CredentialDecl["injection_location"],
 				metadata: metadata
 					? Object.fromEntries(
 							Object.entries(metadata).filter((entry): entry is [string, string] => typeof entry[1] === "string"),
@@ -655,7 +657,17 @@ export class BailianAdapter implements ProviderAdapter {
 	async updateCredential(
 		vaultId: string,
 		credentialId: string,
-		patch: { display_name?: string; metadata?: Record<string, string> },
+		patch: {
+			display_name?: string;
+			metadata?: Record<string, string>;
+			auth?: {
+				type: "environment_variable";
+				secret_name?: string;
+				secret_value?: string;
+				networking?: { allowed_hosts: string[] };
+				injection_location?: CredentialDecl["injection_location"];
+			};
+		},
 	): Promise<RemoteResource> {
 		const res = (await this.client.post(`/vaults/${vaultId}/credentials/${credentialId}`, patch)) as Record<
 			string,

packages/sdk/src/internal/providers/bailian/mapper.ts

@@ -59,12 +59,16 @@ export function mapCredential(cred: CredentialDecl): unknown {
 			`credential '${cred.name}': Bailian only supports credential type 'environment_variable', but '${cred.type}' was declared.`,
 		);
 	}
+	if (cred.networking?.type === "limited" && cred.networking.allowed_hosts === undefined) {
+		throw new UserError(`credential '${cred.name}': Bailian limited networking requires networking.allowed_hosts.`);
+	}
 	const body: Record<string, unknown> = {
 		auth: {
 			type: "environment_variable",
 			secret_name: cred.secret_name,
 			secret_value: cred.secret_value,
-			networking: cred.networking ?? { type: "unrestricted" },
+			networking: { allowed_hosts: cred.networking?.allowed_hosts ?? ["*"] },
+			injection_location: cred.injection_location ?? { header: true, body: false },
 		},
 		display_name: cred.name,
 	};
@@ -95,14 +99,16 @@ export function credToDecl(raw: Record<string, unknown>, vaultName: string): Cre
 	}
 
 	// Default to environment_variable (Bailian's accepted credential type).
-	const networking = auth.networking as { type: "unrestricted" | "limited" } | undefined;
+	const networking = auth.networking as CredentialDecl["networking"];
+	const injectionLocation = auth.injection_location as CredentialDecl["injection_location"];
 	return {
 		name,
 		type: "environment_variable",
 		metadata: stripAgentsMetadata(raw.metadata),
 		secret_name: (auth.secret_name as string) ?? name,
 		secret_value: placeholder,
 		networking: networking ?? { type: "unrestricted" },
+		...(injectionLocation ? { injection_location: injectionLocation } : {}),
 	};
 }
 

packages/sdk/src/internal/types/config.ts

@@ -100,6 +100,17 @@ export interface VaultDecl {
 
 export type CredentialType = "static_bearer" | "environment_variable";
 
+export interface CredentialNetworking {
+	/** Legacy policy type; Bailian requests use allowed_hosts instead. */
+	type?: "unrestricted" | "limited";
+	allowed_hosts?: string[];
+}
+
+export interface CredentialInjectionLocation {
+	header?: boolean;
+	body?: boolean;
+}
+
 export interface CredentialDecl {
 	name: string;
 	type: CredentialType;
@@ -111,7 +122,8 @@ export interface CredentialDecl {
 	// environment_variable
 	secret_name?: string;
 	secret_value?: string;
-	networking?: { type: "unrestricted" | "limited" };
+	networking?: CredentialNetworking;
+	injection_location?: CredentialInjectionLocation;
 }
 
 // --- Memory Store ---