feat: credential injection via --inject-header

CLAUDE.md

@@ -38,8 +38,10 @@ go test ./sandbox/ -run TestCurb_FS_ -v  # run a subset
 - `/etc` is not a blanket default. Only specific files/dirs are exposed (ssl, ca-certificates, ld.so, resolv.conf, hosts, passwd, etc.). Use `--read /etc` to restore full access.
 - `/proc` is safe as default RO: user namespace blocks ptrace-guarded access across namespace boundaries.
 - When the proxy is enabled, `NO_PROXY=localhost,127.0.0.1,::1` is set by default so sandbox-internal servers are reachable. `--host-loopback` suppresses this and forwards localhost traffic through the proxy to the host. User-provided `--env NO_PROXY=...` takes precedence.
+- The SOCKS proxy is advertised via `ALL_PROXY`/`all_proxy` (HTTP/HTTPS still prefer `HTTP_PROXY`/`HTTPS_PROXY`). A user-provided value takes precedence, so `--env ALL_PROXY=` suppresses it — useful for HTTP-only workloads with clients that eagerly construct a SOCKS transport (e.g. httpx, which then needs the `httpx[socks]` extra). ssh routing does not use it (it has its own config).
 - `--ips` allows connections to specific IP addresses or CIDR ranges. Works alongside or independently of `--domains`. IP-matched connections bypass domain filtering (forwarded directly on any port via SOCKS5 or CONNECT). In IPs-only mode (no `--domains`), DNS queries are not intercepted.
 - `--unrestricted-net` skips network namespace creation entirely, allowing unrestricted network access while keeping FS sandboxing. Cannot be combined with `--domains` or `--ips`.
+- `--inject-bearer HOST=SOURCE` and `--inject-header HOST=HEADER=SOURCE` (Linux) terminate TLS for `HOST` only and set a credential header (`Authorization: Bearer <token>`, or any header e.g. `x-api-key`), so the token never enters the sandbox. `--inject-bearer` is sugar for `--inject-header HOST=Authorization=Bearer …`. The proxy holds the credential and a per-run CA; curb delivers a combined CA bundle (system roots + per-run CA) to the child via the standard CA env vars. `SOURCE` is `@ENV_VAR` (kept out of argv) or a literal. Settable via the flags, `CURB_INJECT_BEARER`/`CURB_INJECT_HEADER`, or the `inject-bearer:`/`inject-header:` config-file/profile keys (all merged additively); the `@ENV_VAR` form resolves at run time regardless of source. The CA key and token are parent-only — never serialized to the child. `@?VAR` is an optional source (inject only if set), and `VAR=?value` sets an env var only if it is set on the host; the `claude` profile uses both to seal `ANTHROPIC_API_KEY` out of Claude Code when present while staying a no-op for OAuth users.
 - `--domains` validates input: rejects URLs (suggests bare domain), IP addresses (suggests `--ips`), invalid characters, and malformed wildcards. `--ips` validates that values parse as IP addresses or CIDR prefixes.
 - `!` prefix in list flags removes from defaults AND actively denies via overmount when the path is under an allowed parent. `--read '!/path'` hides (tmpfs/dev-null), `--write '!/path'` makes read-only, `--exec '!/path'` makes noexec. `!*` clears all defaults (not deny-all). `\!` escapes literal `!`. Sub-path denials require mount NS; Landlock-only mode warns.
 - HOME defaults to a private tmpDir. `--env HOME` passes through the host HOME; `--env HOME=/path` sets it explicitly. `~` and `$HOME` in config/profile paths both resolve to the **host** home (the shell's view), not the sandbox HOME — they are host-side shorthands. When sandbox HOME differs from host HOME and a path uses `~`, curb warns that the sandboxed program cannot reach those paths via its own `$HOME`. Built-in profiles include `HOME` in their env passthrough so sandbox HOME = host HOME and `~` paths align. See `docs/configuration.md` for full details.

README.md

@@ -154,6 +154,13 @@ Pass through a specific environment variable:
 curb --env 'DATABASE_URL' -- ./migrate.sh
 ```
 
+Inject a credential the sandboxed process never sees — the token stays in
+curb's proxy, which adds it to requests bound for the named host:
+
+```
+GH_TOKEN=ghp_xxx curb --inject-bearer 'api.github.com=@GH_TOKEN' -- gh api user
+```
+
 ## CLI reference
 
 ### Network
@@ -162,6 +169,8 @@ curb --env 'DATABASE_URL' -- ./migrate.sh
 |------|---------|-------------|
 | `--domains` | `CURB_DOMAINS` | Allowed domain patterns (comma-separated). `*.example.com` for subdomains, `*` to allow all. |
 | `--ips` | `CURB_IPS` | Allowed IP addresses or CIDR ranges (e.g. `10.0.0.1`, `192.168.0.0/16`, `::1`). |
+| `--inject-bearer` | `CURB_INJECT_BEARER` | Terminate TLS for a host and inject `Authorization: Bearer <token>` on the way out, so the token never enters the sandbox. `HOST=@ENV_VAR` reads the token from an env var (kept out of argv); `HOST=literal` also works but exposes it in process arguments. Repeatable; also settable via the `inject-bearer:` config-file/profile key. Linux only. |
+| `--inject-header` | `CURB_INJECT_HEADER` | Like `--inject-bearer`, but injects an arbitrary request header: `HOST=HEADER=SOURCE` (e.g. `api.example.com=x-api-key=@KEY`). `--inject-bearer HOST=SOURCE` is sugar for `HOST=Authorization=Bearer …`. Repeatable; also a config-file/profile key. Linux only. |
 | `--host-loopback` | `CURB_HOST_LOOPBACK` | Forward localhost/127.0.0.1 traffic to the host loopback. Cannot combine with `--unrestricted-net`. |
 | `--unrestricted-net` | `CURB_UNRESTRICTED_NET` | Skip network filtering entirely. Cannot combine with `--domains`, `--ips`, or `--host-loopback`. |
 

cmd/help.go

@@ -20,7 +20,7 @@ type flagGroup struct {
 // flagGroups defines the order and grouping of flags in help output.
 var flagGroups = []flagGroup{
 	{"Filesystem", []string{"read", "write"}},
-	{"Network", []string{"domains", "ips", "unrestricted-net", "host-loopback", "allow-unix-sockets"}},
+	{"Network", []string{"domains", "ips", "inject-bearer", "inject-header", "unrestricted-net", "host-loopback", "allow-unix-sockets"}},
 	{"Executables", []string{"exec"}},
 	{"Environment", []string{"env"}},
 	{"Profiles & Config", []string{"profiles", "auto", "config-file"}},

cmd/root.go

@@ -27,7 +27,8 @@ Use -- before the command when it has its own flags.`,
   curb --domains example.com -- curl https://example.com    # allow specific domains
   curb -p node -w . -- npm install                          # profile + writable cwd
   curb -a cargo build                                       # auto-select profile
-  curb --dry-run -p node -- npm install                     # preview sandbox plan`,
+  curb --dry-run -p node -- npm install                     # preview sandbox plan
+  curb --inject-bearer api.github.com=@TOK -- gh pr list    # inject a token, kept out of the sandbox`,
 		Args: cobra.ArbitraryArgs,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			if len(args) == 0 {
@@ -329,6 +330,8 @@ func registerFlags(cmd *cobra.Command) {
 	f.StringSlice("ips", nil, "allowed IP/CIDR ranges (e.g. 10.0.0.1, 192.168.0.0/16)")
 	f.Bool("unrestricted-net", false, "skip network restrictions entirely")
 	f.Bool("host-loopback", false, "forward localhost traffic to host loopback")
+	f.StringSlice("inject-bearer", nil, "terminate TLS for HOST and inject 'Authorization: Bearer <token>' (HOST=@ENV_VAR reads the token from an env var, keeping it out of argv)")
+	f.StringSlice("inject-header", nil, "terminate TLS for HOST and inject an arbitrary request header (HOST=HEADER=@ENV_VAR, e.g. api.example.com=x-api-key=@KEY)")
 
 	// Executables.
 	f.StringSlice("exec", nil, "allowed executables (default: invoked command only)")

config/config.go

@@ -21,6 +21,8 @@ type Config struct {
 	EnvSet            []string
 	EnvPassthroughAll bool
 	AllowedIPs        []string
+	InjectBearer      []string
+	InjectHeader      []string
 	UnrestrictedNet   bool
 	NoFSRestrict      bool
 	NoExecRestrict    bool
@@ -32,7 +34,7 @@ type Config struct {
 	Quiet             bool
 	DryRun            bool
 	Auto              bool
-	ConfigFilePaths []string
+	ConfigFilePaths   []string
 	Command           []string
 }
 
@@ -68,6 +70,14 @@ func FromFlags(cmd *cobra.Command) (*Config, error) {
 	if err != nil {
 		return nil, err
 	}
+	injectBearer, err := flags.GetStringSlice("inject-bearer")
+	if err != nil {
+		return nil, err
+	}
+	injectHeader, err := flags.GetStringSlice("inject-header")
+	if err != nil {
+		return nil, err
+	}
 	if len(allow) > 0 {
 		if err := policy.ValidateDomains(allow); err != nil {
 			return nil, err
@@ -123,6 +133,8 @@ func FromFlags(cmd *cobra.Command) (*Config, error) {
 	cfg := &Config{
 		AllowedDomains:   allow,
 		AllowedIPs:       ips,
+		InjectBearer:     injectBearer,
+		InjectHeader:     injectHeader,
 		UnrestrictedNet:  unrestrictedNet,
 		ROPaths:          ro,
 		RWPaths:          rw,
@@ -137,7 +149,7 @@ func FromFlags(cmd *cobra.Command) (*Config, error) {
 		Quiet:            quiet,
 		DryRun:           dryRun,
 		Auto:             auto,
-		Command: cmd.Flags().Args(),
+		Command:          cmd.Flags().Args(),
 	}
 
 	// Wildcard handling: '*' in list flags sets the corresponding escape hatch.
@@ -169,6 +181,8 @@ func MergeEnv(cfg *Config, cmd *cobra.Command) {
 	// List values: always additive, with wildcard detection.
 	cfg.AllowedDomains = appendEnvList(cfg.AllowedDomains, "CURB_DOMAINS")
 	cfg.AllowedIPs = appendEnvList(cfg.AllowedIPs, "CURB_IPS")
+	cfg.InjectBearer = appendEnvList(cfg.InjectBearer, "CURB_INJECT_BEARER")
+	cfg.InjectHeader = appendEnvList(cfg.InjectHeader, "CURB_INJECT_HEADER")
 
 	roEnv := appendEnvList(nil, "CURB_READ")
 	if containsStar(roEnv) {
@@ -273,4 +287,3 @@ func EnvBool(key string) bool {
 	val := os.Getenv(key)
 	return val == "1" || strings.EqualFold(val, "true")
 }
-

config/config_test.go

@@ -22,6 +22,8 @@ func newTestCmd(args []string) *cobra.Command {
 	f.StringSlice("exec", nil, "")
 	f.StringSlice("env", nil, "")
 	f.StringSlice("ips", nil, "")
+	f.StringSlice("inject-bearer", nil, "")
+	f.StringSlice("inject-header", nil, "")
 	f.Bool("unrestricted-net", false, "")
 	f.Bool("allow-unix-sockets", false, "")
 	f.Bool("host-loopback", false, "")
@@ -124,6 +126,28 @@ func TestMergeEnv_ListsAdditive(t *testing.T) {
 	assert.Equal(t, []string{"b.com", "a.com"}, cfg.AllowedDomains)
 }
 
+func TestMergeEnv_InjectBearerAdditive(t *testing.T) {
+	cmd := newTestCmd([]string{"--inject-bearer", "b.com=@B"})
+	cfg, err := FromFlags(cmd)
+	require.NoError(t, err)
+
+	t.Setenv("CURB_INJECT_BEARER", "a.com=@A")
+	MergeEnv(cfg, cmd)
+
+	assert.Equal(t, []string{"b.com=@B", "a.com=@A"}, cfg.InjectBearer)
+}
+
+func TestMergeEnv_InjectHeaderAdditive(t *testing.T) {
+	cmd := newTestCmd([]string{"--inject-header", "b.com=x-tok=@B"})
+	cfg, err := FromFlags(cmd)
+	require.NoError(t, err)
+
+	t.Setenv("CURB_INJECT_HEADER", "a.com=x-api-key=@A")
+	MergeEnv(cfg, cmd)
+
+	assert.Equal(t, []string{"b.com=x-tok=@B", "a.com=x-api-key=@A"}, cfg.InjectHeader)
+}
+
 func TestMergeEnv_CommaSeparatedList(t *testing.T) {
 	cmd := newTestCmd(nil)
 	cfg, err := FromFlags(cmd)

config/configfile.go

@@ -19,6 +19,8 @@ type ConfigFile struct {
 	Profiles         []string `yaml:"profiles"`
 	Domains          []string `yaml:"domains"`
 	IPs              []string `yaml:"ips"`
+	InjectBearer     []string `yaml:"inject-bearer"`
+	InjectHeader     []string `yaml:"inject-header"`
 	Read             pathList `yaml:"read"`
 	Write            pathList `yaml:"write"`
 	Exec             pathList `yaml:"exec"`
@@ -109,6 +111,24 @@ func (cf *ConfigFile) validate() error {
 			return err
 		}
 	}
+	for i, e := range cf.InjectBearer {
+		host, source, ok := strings.Cut(e, "=")
+		if !ok || host == "" || source == "" {
+			return fmt.Errorf("inject-bearer[%d] must be HOST=SOURCE, got %q", i, e)
+		}
+		if err := policy.ValidateDomains([]string{host}); err != nil {
+			return fmt.Errorf("inject-bearer[%d] host %q: %w", i, host, err)
+		}
+	}
+	for i, e := range cf.InjectHeader {
+		parts := strings.SplitN(e, "=", 3)
+		if len(parts) != 3 || parts[0] == "" || parts[1] == "" || parts[2] == "" {
+			return fmt.Errorf("inject-header[%d] must be HOST=HEADER=SOURCE, got %q", i, e)
+		}
+		if err := policy.ValidateDomains([]string{parts[0]}); err != nil {
+			return fmt.Errorf("inject-header[%d] host %q: %w", i, parts[0], err)
+		}
+	}
 	for _, pair := range [...]struct {
 		field string
 		list  pathList
@@ -152,6 +172,8 @@ func FindConfigFile() string {
 func mergeConfigLists(cfg *Config, cf *ConfigFile) {
 	cfg.AllowedDomains = append(cf.Domains, cfg.AllowedDomains...)
 	cfg.AllowedIPs = append(cf.IPs, cfg.AllowedIPs...)
+	cfg.InjectBearer = append(cf.InjectBearer, cfg.InjectBearer...)
+	cfg.InjectHeader = append(cf.InjectHeader, cfg.InjectHeader...)
 	cfg.ROPaths = append(expandEnvPaths([]string(cf.Read), "read"), cfg.ROPaths...)
 	cfg.RWPaths = append(expandEnvPaths([]string(cf.Write), "write"), cfg.RWPaths...)
 	cfg.ExecAllow = append(expandEnvPaths([]string(cf.Exec), "exec"), cfg.ExecAllow...)

config/configfile_test.go

@@ -152,6 +152,58 @@ func TestLoadConfigFile_NotFound(t *testing.T) {
 	require.Error(t, err)
 }
 
+func TestLoadConfigFile_InjectBearer(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, ".curb.yaml")
+	require.NoError(t, os.WriteFile(path, []byte(`
+inject-bearer:
+  - api.github.com=@GH_TOKEN
+`), 0o644))
+
+	cf, err := LoadConfigFile(path)
+	require.NoError(t, err)
+	assert.Equal(t, []string{"api.github.com=@GH_TOKEN"}, cf.InjectBearer)
+}
+
+func TestLoadConfigFile_InjectBearerInvalid(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, ".curb.yaml")
+	require.NoError(t, os.WriteFile(path, []byte(`
+inject-bearer:
+  - missing-source
+`), 0o644))
+
+	_, err := LoadConfigFile(path)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "inject-bearer")
+}
+
+func TestLoadConfigFile_InjectHeader(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, ".curb.yaml")
+	require.NoError(t, os.WriteFile(path, []byte(`
+inject-header:
+  - api.anthropic.com=x-api-key=@ANTHROPIC_API_KEY
+`), 0o644))
+
+	cf, err := LoadConfigFile(path)
+	require.NoError(t, err)
+	assert.Equal(t, []string{"api.anthropic.com=x-api-key=@ANTHROPIC_API_KEY"}, cf.InjectHeader)
+}
+
+func TestLoadConfigFile_InjectHeaderInvalid(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, ".curb.yaml")
+	require.NoError(t, os.WriteFile(path, []byte(`
+inject-header:
+  - api.anthropic.com=x-api-key
+`), 0o644))
+
+	_, err := LoadConfigFile(path)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "inject-header")
+}
+
 func TestFindConfigFile_InCWD(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, ".curb.yaml")
@@ -199,22 +251,26 @@ func TestFindConfigFile_NotFound(t *testing.T) {
 }
 
 func TestMergeConfigFile_ListsPrepend(t *testing.T) {
-	cmd := newTestCmd([]string{"--domains", "cli.com"})
+	cmd := newTestCmd([]string{"--domains", "cli.com", "--inject-bearer", "cli.com=@C", "--inject-header", "cli.com=x-tok=@H"})
 	cfg, err := FromFlags(cmd)
 	require.NoError(t, err)
 
 	cf := &ConfigFile{
-		Domains: []string{"file.com"},
-		IPs:     []string{"10.0.0.1"},
-		Read:    []string{"/opt"},
-		Write:   []string{"/data"},
-		Exec:    []string{"python3"},
-		Env:     []string{"GOPATH", "FOO=bar"},
+		Domains:      []string{"file.com"},
+		IPs:          []string{"10.0.0.1"},
+		InjectBearer: []string{"file.com=@F"},
+		InjectHeader: []string{"file.com=x-api-key=@K"},
+		Read:         []string{"/opt"},
+		Write:        []string{"/data"},
+		Exec:         []string{"python3"},
+		Env:          []string{"GOPATH", "FOO=bar"},
 	}
 	MergeConfigFile(cfg, cf, cmd.Flags())
 
 	assert.Equal(t, []string{"file.com", "cli.com"}, cfg.AllowedDomains)
 	assert.Equal(t, []string{"10.0.0.1"}, cfg.AllowedIPs)
+	assert.Equal(t, []string{"file.com=@F", "cli.com=@C"}, cfg.InjectBearer)
+	assert.Equal(t, []string{"file.com=x-api-key=@K", "cli.com=x-tok=@H"}, cfg.InjectHeader)
 	assert.Equal(t, []string{"/opt"}, cfg.ROPaths)
 	assert.Equal(t, []string{"/data"}, cfg.RWPaths)
 	assert.Equal(t, []string{"python3"}, cfg.ExecAllow)
@@ -363,12 +419,12 @@ func TestMergeConfigFile_ExpandEnvDollarEscape(t *testing.T) {
 
 	cf := &ConfigFile{
 		Read: []string{
-			"/foo$$bar",                  // literal $: "/foo$bar"
-			"/foo$$$$bar",                // literal $$: "/foo$$bar"
-			"$$/$CURB_TEST_DIR",          // literal $ then expansion: "$/tmp/curb-expand-test"
-			"$CURB_TEST_DIR$$tail",       // expansion then literal $: "/tmp/curb-expand-test$tail"
-			"$${CURB_TEST_DIR}",          // escape disarms braces: "${CURB_TEST_DIR}"
-			`\!$$bang`,                   // bang-escape + literal $: "\!$bang"
+			"/foo$$bar",            // literal $: "/foo$bar"
+			"/foo$$$$bar",          // literal $$: "/foo$$bar"
+			"$$/$CURB_TEST_DIR",    // literal $ then expansion: "$/tmp/curb-expand-test"
+			"$CURB_TEST_DIR$$tail", // expansion then literal $: "/tmp/curb-expand-test$tail"
+			"$${CURB_TEST_DIR}",    // escape disarms braces: "${CURB_TEST_DIR}"
+			`\!$$bang`,             // bang-escape + literal $: "\!$bang"
 		},
 	}
 	MergeConfigFile(cfg, cf, cmd.Flags())

config/profile_test.go

@@ -123,6 +123,24 @@ func TestMergeProfiles(t *testing.T) {
 	assert.Contains(t, cfg.EnvPassthrough, "SSH_AUTH_SOCK")
 }
 
+func TestMergeProfiles_ClaudeSealsApiKey(t *testing.T) {
+	cmd := newTestCmd(nil)
+	cfg, err := FromFlags(cmd)
+	require.NoError(t, err)
+
+	_, err = MergeProfiles(cfg, []string{"claude"}, cmd.Flags())
+	require.NoError(t, err)
+
+	assert.Contains(t, cfg.AllowedDomains, "api.anthropic.com")
+
+	// The key is injected as x-api-key, optionally (@?) from the host env var,
+	// and the sandbox gets only a conditional ("?") placeholder.
+	assert.Contains(t, cfg.InjectHeader, "api.anthropic.com=x-api-key=@?ANTHROPIC_API_KEY")
+	assert.Contains(t, cfg.EnvSet, "ANTHROPIC_API_KEY=?curb-sealed-placeholder")
+	// The real key is not passed through (it would defeat the seal).
+	assert.NotContains(t, cfg.EnvPassthrough, "ANTHROPIC_API_KEY")
+}
+
 func TestMergeProfiles_Dedup(t *testing.T) {
 	cmd := newTestCmd(nil)
 	cfg, err := FromFlags(cmd)

config/profiles/claude.yaml

@@ -5,6 +5,15 @@
 #
 # Claude Code's own bwrap sandbox cannot nest inside curb's namespace.
 # Set sandbox.enabled: false in Claude Code settings — curb provides enforcement.
+#
+# Credential sealing (Linux): when ANTHROPIC_API_KEY is set on the host, it is
+# kept out of the sandbox — the process sees only a placeholder, and curb's
+# proxy injects the real key as the x-api-key header on requests to
+# api.anthropic.com. This is conditional (? / @? markers): with no host key set,
+# nothing is injected and OAuth/subscription auth works unchanged. On first run,
+# Claude Code may prompt once to approve the placeholder as a custom API key.
+# Caveat: a custom ANTHROPIC_BASE_URL is not covered (the seal targets
+# api.anthropic.com).
 commands: [claude]
 # Node.js/Bun use AF_UNIX socketpairs internally for child_process.spawn() stdio.
 allow-unix-sockets: true
@@ -44,11 +53,16 @@ exec:
   - /bin
   - /usr/local/bin
   - /opt/homebrew/bin
+# Seal ANTHROPIC_API_KEY: inject the real key (from the host env) as x-api-key,
+# and give the sandbox only a placeholder. Both are conditional on the host
+# having the key set, so OAuth users are unaffected.
+inject-header:
+  - api.anthropic.com=x-api-key=@?ANTHROPIC_API_KEY
 env:
   - HOME
   - SHELL
   - CLAUDE_CODE_TMPDIR=$TMPDIR
-  - ANTHROPIC_API_KEY
+  - ANTHROPIC_API_KEY=?curb-sealed-placeholder
   - ANTHROPIC_BASE_URL
   - CLAUDE_CODE_MAX_TOKENS
   - GIT_AUTHOR_NAME