fix(vault): scope credential injection policies to bailian

Author: chenanran555

docs/guides/use-mcp-and-vaults.md

@@ -24,7 +24,6 @@ vaults:
         secret_value: ${DB_TOKEN}
         networking:
           type: limited
-          allowed_hosts: ["api.example.com"]
 ```
 
 | Credential type | Key fields |
@@ -62,6 +61,11 @@ policy or with `type: unrestricted` retain that scope; an omitted injection loca
 defaults to headers enabled and body disabled. Legacy `type: limited` requires an
 explicit `allowed_hosts` list.
 
+Credential `networking.allowed_hosts` and `injection_location` are Bailian-only.
+For other providers, keep using `networking.type` (`unrestricted` or `limited`);
+it is required when `networking` is present. Pin the vault with `provider: bailian`
+when using these new fields in a multi-provider project.
+
 ## Attach MCP servers to an agent
 
 Reference a URL-based MCP server and bind the vault that holds its token:

docs/reference/configuration.md

@@ -222,7 +222,7 @@ vaults:
 | `type` | `"environment_variable"` | yes | |
 | `secret_name` | string | yes | Secret name. |
 | `secret_value` | string | yes | Secret value (string or number, coerced). |
-| `networking.type` | `"unrestricted"` \| `"limited"` | no | Legacy policy type. Bailian requests use `allowed_hosts` instead. |
+| `networking.type` | `"unrestricted"` \| `"limited"` | conditional | Required when `networking` is present for non-Bailian providers. Bailian requests use `allowed_hosts` instead. |
 | `networking.allowed_hosts` | string[] | no | Bailian credential injection host allow-list, e.g. `["api.example.com", "*.example.org"]`; `["*"]` allows all hosts. |
 | `injection_location.header` | boolean | no | Bailian: allow secret replacement in request headers. |
 | `injection_location.body` | boolean | no | Bailian: allow secret replacement in request bodies. |
@@ -232,9 +232,14 @@ When omitted, creation uses `networking: { allowed_hosts: ["*"] }` and
 `injection_location: { header: true, body: false }`. Legacy `networking.type: unrestricted`
 maps to `["*"]`; `limited` must include `allowed_hosts` and is never widened implicitly.
 Explicit host lists and injection booleans are preserved, including through sync/export.
-Credential retry adoption compares host sets and injection policy as well as the existing
+Bailian credential retry adoption compares host sets and injection policy as well as the existing
 identity and metadata fields; a different policy is not treated as an exact match.
 
+Credential `networking.allowed_hosts` and `injection_location` are rejected for
+non-Bailian providers, whose legacy networking and retry-matching behavior is unchanged.
+In multi-provider projects, pin such vaults with `provider: bailian` (or select
+Bailian via `defaults.provider`) to avoid applying these fields to other providers.
+
 ## Memory store
 
 ```yaml

packages/sdk/src/internal/core/validate-config.ts

@@ -11,6 +11,7 @@ import type { Diagnostic } from "../types/plan.ts";
 import type { ResourceAddress } from "../types/state.ts";
 import { providerMountPrefix, resolveSandboxMountPath } from "../utils/sandbox-mount.ts";
 import { findMissingBailianMcpToolConfigs } from "../validation/bailian.ts";
+import { validateCredentialPolicy } from "../validation/vault-credential.ts";
 import { resolveAgentMaterialization } from "./agent-materialization.ts";
 
 export interface ValidateProjectConfigOptions {
@@ -159,15 +160,14 @@ export function collectProviderCapabilities(
 
 		for (const [name, vault] of Object.entries(config.vaults ?? {})) {
 			if (vault.provider && vault.provider !== providerName) continue;
-			if (
-				providerName !== "bailian" &&
-				vault.credentials.some((credential) => credential.injection_location !== undefined)
-			) {
-				diagnostics.error(
-					`${providerName}.vault.injection_location.unsupported`,
-					`vault.${name}: provider '${providerName}' does not support credential injection_location; pin this vault to bailian.`,
-					{ type: "vault", name, provider: providerName },
-				);
+			for (const credential of vault.credentials) {
+				for (const issue of validateCredentialPolicy(providerName, credential)) {
+					diagnostics.error(
+						`${providerName}.vault.${issue.code}`,
+						`vault.${name} credential '${credential.name}': ${issue.message}`,
+						{ type: "vault", name, provider: providerName },
+					);
+				}
 			}
 		}
 

packages/sdk/src/internal/core/vault-credential-runtime.ts

@@ -4,6 +4,7 @@ import type { ProviderAdapter } from "../providers/interface.ts";
 import type { CredentialDecl, ResolvedProjectConfig } from "../types/config.ts";
 import type { VaultCredentialInfo } from "../types/managed-api.ts";
 import type { ResourceAddress, ResourceState } from "../types/state.ts";
+import { validateCredentialPolicy } from "../validation/vault-credential.ts";
 import type { BackendRuntimeInput, ProjectRuntimeContext } from "./project-runtime.ts";
 import { getRuntimeProvider, readProjectRuntime, writeProjectRuntime } from "./project-runtime.ts";
 import { planProjectContext } from "./resource-runtime.ts";
@@ -131,6 +132,8 @@ async function prepareVaultCredentialCreate(
 	if (vault.credentials.slice(0, -1).some((entry) => entry.name === credentialName)) {
 		throw new UserError(`Vault '${vaultName}' already declares a credential named '${credentialName}'.`);
 	}
+	const policyIssue = validateCredentialPolicy(provider, credential)[0];
+	if (policyIssue) throw new UserError(policyIssue.message);
 	if (provider === "bailian" && credential.type !== "environment_variable") {
 		throw new UserError(
 			`Credential '${credentialName}' uses '${credential.type}', but Bailian only supports 'environment_variable' credentials.`,
@@ -179,7 +182,7 @@ async function prepareVaultCredentialCreate(
 				(remoteCredential) => remoteCredential.display_name === credentialName,
 			)
 		: [];
-	const exact = sameName.find((remoteCredential) => credentialMatches(remoteCredential, credential));
+	const exact = sameName.find((remoteCredential) => credentialMatches(provider, remoteCredential, credential));
 	if (sameName.length > 0 && !exact) {
 		throw new UserError(`Vault '${vaultName}' already has a different remote credential named '${credentialName}'.`);
 	}
@@ -203,9 +206,15 @@ function resolveVaultProvider(
 	throw new UserError("Cannot infer one provider for Vault Credential create.");
 }
 
-function credentialMatches(remote: VaultCredentialInfo, desired: CredentialDecl): boolean {
+function credentialMatches(provider: string, remote: VaultCredentialInfo, desired: CredentialDecl): boolean {
 	if (remote.auth_type !== desired.type || !metadataMatches(remote.metadata, desired.metadata)) return false;
 	if (desired.type === "static_bearer") return remote.mcp_server_url === desired.mcp_server_url;
+	if (provider !== "bailian") {
+		return (
+			remote.secret_name === desired.secret_name &&
+			(remote.networking_type ?? "unrestricted") === (desired.networking?.type ?? "unrestricted")
+		);
+	}
 	const desiredHosts = credentialHosts(desired.networking);
 	const remoteHosts = credentialHosts(remote.networking ?? { type: remote.networking_type });
 	const desiredLocation = desired.injection_location;

packages/sdk/src/internal/parser/schema.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { canonicalToolName } from "../utils/tool-permissions.ts";
+import { validateCredentialPolicy } from "../validation/vault-credential.ts";
 
 const networkingSchema = z.object({
 	type: z.enum(["unrestricted", "limited"]),
@@ -366,25 +367,46 @@ const deploymentSchema = z.object({
 	environment_variables: z.string().optional(),
 });
 
-export const projectConfigSchema = z.object({
-	version: z.string(),
-	providers: z.record(z.string(), z.unknown()),
-	defaults: z
-		.object({
-			provider: z.string().optional(),
-			identity: z.string().min(1).optional(),
-		})
-		.optional(),
-	environments: z.record(z.string(), environmentSchema).optional(),
-	tunnels: z.record(z.string(), tunnelSchema).optional(),
-	vaults: z.record(z.string(), vaultSchema).optional(),
-	memory_stores: z.record(z.string(), memoryStoreSchema).optional(),
-	skills: z.record(z.string(), skillSchema).optional(),
-	files: z.record(z.string(), fileSchema).optional(),
-	identities: z.record(z.string(), identitySchema).optional(),
-	agents: z.record(z.string(), agentSchema).optional(),
-	channels: z.record(z.string(), channelSchema).optional(),
-	deployments: z.record(z.string(), deploymentSchema).optional(),
-});
+export const projectConfigSchema = z
+	.object({
+		version: z.string(),
+		providers: z.record(z.string(), z.unknown()),
+		defaults: z
+			.object({
+				provider: z.string().optional(),
+				identity: z.string().min(1).optional(),
+			})
+			.optional(),
+		environments: z.record(z.string(), environmentSchema).optional(),
+		tunnels: z.record(z.string(), tunnelSchema).optional(),
+		vaults: z.record(z.string(), vaultSchema).optional(),
+		memory_stores: z.record(z.string(), memoryStoreSchema).optional(),
+		skills: z.record(z.string(), skillSchema).optional(),
+		files: z.record(z.string(), fileSchema).optional(),
+		identities: z.record(z.string(), identitySchema).optional(),
+		agents: z.record(z.string(), agentSchema).optional(),
+		channels: z.record(z.string(), channelSchema).optional(),
+		deployments: z.record(z.string(), deploymentSchema).optional(),
+	})
+	.superRefine((config, context) => {
+		const defaultProvider = config.defaults?.provider;
+		const targetProviders =
+			defaultProvider && defaultProvider !== "all" ? [defaultProvider] : Object.keys(config.providers);
+		for (const [vaultName, vault] of Object.entries(config.vaults ?? {})) {
+			const providers = vault.provider ? [vault.provider] : targetProviders;
+			// Only a positively identified Bailian target may omit type or use injection policy fields.
+			for (const provider of providers.length > 0 ? providers : ["unknown"]) {
+				for (const [index, credential] of vault.credentials.entries()) {
+					for (const issue of validateCredentialPolicy(provider, credential)) {
+						context.addIssue({
+							code: "custom",
+							path: ["vaults", vaultName, "credentials", index, ...issue.field.split(".")],
+							message: issue.message,
+						});
+					}
+				}
+			}
+		}
+	});
 
 export type ParsedConfig = z.infer<typeof projectConfigSchema>;

packages/sdk/src/internal/types/config.ts

@@ -101,8 +101,9 @@ export interface VaultDecl {
 export type CredentialType = "static_bearer" | "environment_variable";
 
 export interface CredentialNetworking {
-	/** Legacy policy type; Bailian requests use allowed_hosts instead. */
+	/** Required when networking is declared for non-Bailian providers; optional for Bailian. */
 	type?: "unrestricted" | "limited";
+	/** Bailian only. Other providers retain their networking.type contract. */
 	allowed_hosts?: string[];
 }
 
@@ -123,6 +124,7 @@ export interface CredentialDecl {
 	secret_name?: string;
 	secret_value?: string;
 	networking?: CredentialNetworking;
+	/** Bailian only. */
 	injection_location?: CredentialInjectionLocation;
 }
 

packages/sdk/src/internal/validation/vault-credential.ts

@@ -0,0 +1,37 @@
+import type { CredentialDecl } from "../types/config.ts";
+
+interface CredentialPolicyIssue {
+	field: string;
+	code: string;
+	message: string;
+}
+
+/** Keep Bailian's injection policy separate from other providers' legacy networking contract. */
+export function validateCredentialPolicy(provider: string, credential: CredentialDecl): CredentialPolicyIssue[] {
+	if (provider === "bailian") return [];
+	const issues: CredentialPolicyIssue[] = [];
+	for (const [field, value] of [
+		["networking.allowed_hosts", credential.networking?.allowed_hosts],
+		["injection_location", credential.injection_location],
+	] as const) {
+		if (value !== undefined) {
+			issues.push({
+				field,
+				code: `${field}.unsupported`,
+				message: `Credential ${field} is only supported by bailian; remove it or pin this vault to bailian.`,
+			});
+		}
+	}
+	if (
+		credential.type === "environment_variable" &&
+		credential.networking !== undefined &&
+		credential.networking.type === undefined
+	) {
+		issues.push({
+			field: "networking.type",
+			code: "networking.type.required",
+			message: `Credential networking.type is required for provider '${provider}' when networking is declared.`,
+		});
+	}
+	return issues;
+}

packages/sdk/tests/unit/bailian-credential-policy.test.ts

@@ -103,4 +103,71 @@ describe("Bailian credential injection policy", () => {
 		});
 		expect(diagnostics).toEqual([]);
 	});
+
+	test.each(["claude", "qoder", "ark"])("keeps legacy networking validation for %s", (provider) => {
+		for (const networking of [undefined, { type: "unrestricted" as const }, { type: "limited" as const }]) {
+			const legacy = { ...credential, networking, injection_location: undefined };
+			const config = {
+				version: "1",
+				providers: { [provider]: {} },
+				vaults: { secrets: { display_name: "Secrets", credentials: [legacy] } },
+			};
+			expect(projectConfigSchema.parse(config).vaults?.secrets?.credentials[0]).toEqual(legacy);
+			expect(validateProjectConfig(config)).toEqual([]);
+		}
+		const missingType = {
+			version: "1",
+			providers: { [provider]: {} },
+			vaults: {
+				secrets: {
+					display_name: "Secrets",
+					credentials: [{ ...credential, networking: {}, injection_location: undefined }],
+				},
+			},
+		};
+		expect(projectConfigSchema.safeParse(missingType).success).toBe(false);
+		expect(validateProjectConfig(missingType).map((diagnostic) => diagnostic.code)).toContain(
+			`${provider}.vault.networking.type.required`,
+		);
+	});
+
+	test.each(["claude", "qoder", "ark"])("blocks Bailian policy fields for %s before execution", (provider) => {
+		const config = {
+			version: "1",
+			providers: { [provider]: {} },
+			vaults: { secrets: { display_name: "Secrets", credentials: [credential] } },
+		};
+		const parsed = projectConfigSchema.safeParse(config);
+		expect(parsed.success).toBe(false);
+		if (!parsed.success) {
+			expect(parsed.error.issues.map((issue) => issue.path.join("."))).toContain(
+				"vaults.secrets.credentials.0.networking.allowed_hosts",
+			);
+			expect(JSON.stringify(parsed.error.issues)).not.toContain(credential.secret_value!);
+		}
+		expect(validateProjectConfig(config).map((diagnostic) => diagnostic.code)).toContain(
+			`${provider}.vault.networking.allowed_hosts.unsupported`,
+		);
+	});
+
+	test("resolves policy ownership from the vault, defaults, and provider selection", () => {
+		const config = {
+			version: "1",
+			providers: { bailian: {}, qoder: {} },
+			vaults: { secrets: { display_name: "Secrets", credentials: [credential] } },
+		};
+		expect(projectConfigSchema.safeParse(config).success).toBe(false);
+		const bailianDefault = { ...config, defaults: { provider: "bailian" } };
+		expect(projectConfigSchema.safeParse(bailianDefault).success).toBe(true);
+		expect(
+			validateProjectConfig(bailianDefault, { providers: ["qoder"] }).map((diagnostic) => diagnostic.code),
+		).toContain("qoder.vault.networking.allowed_hosts.unsupported");
+		expect(
+			projectConfigSchema.safeParse({
+				...config,
+				defaults: { provider: "qoder" },
+				vaults: { secrets: { ...config.vaults.secrets, provider: "bailian" } },
+			}).success,
+		).toBe(true);
+	});
 });