feat(agent-proxy): add sandboxed local run mode

go.mod

@@ -16,6 +16,7 @@ require (
 	github.com/fatih/semgroup v1.2.0
 	github.com/gitleaks/go-gitdiff v0.9.1
 	github.com/go-mysql-org/go-mysql v1.13.0
+	github.com/gofrs/flock v0.8.1
 	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/google/uuid v1.6.0
 	github.com/h2non/filetype v1.1.3
@@ -111,7 +112,6 @@ require (
 	github.com/go-openapi/swag v0.23.0 // indirect
 	github.com/goccy/go-json v0.10.2 // indirect
 	github.com/godbus/dbus/v5 v5.1.0 // indirect
-	github.com/gofrs/flock v0.8.1 // indirect
 	github.com/gofrs/uuid v4.4.0+incompatible // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/glog v1.2.5 // indirect

packages/agentproxy/ca.go

@@ -27,15 +27,21 @@ const (
 	leafTTL                    = 24 * time.Hour
 	leafReuseMargin            = 1 * time.Hour
 	maxLeafCacheEntries        = 8192
+
+	// localRootTTL bounds the in-memory self-signed local root; just needs to outlast one session.
+	localRootTTL = 7 * 24 * time.Hour
 )
 
 type caManager struct {
 	token func() string
 
+	// local: the intermediate fields hold a self-signed root minted at construction, never re-signed.
+	local bool
+
 	mu                sync.Mutex
-	intermediateKey   *ecdsa.PrivateKey
-	intermediateCert  *x509.Certificate
-	intermediateExp   time.Time
+	signingKey        *ecdsa.PrivateKey
+	signingCert       *x509.Certificate
+	signingExp        time.Time
 	lastResignAttempt time.Time
 	resignGen         atomic.Uint64
 
@@ -55,16 +61,84 @@ func newCaManager(token func() string) *caManager {
 	}
 }
 
-func (c *caManager) ensureIntermediate() error {
+// generateLocalRoot mints a self-signed ECDSA P-256 root (P-256 so rustls-based agents accept it).
+func generateLocalRoot() (*ecdsa.PrivateKey, *x509.Certificate, error) {
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to generate local root CA key: %w", err)
+	}
+	serial, err := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128))
+	if err != nil {
+		return nil, nil, err
+	}
+	template := &x509.Certificate{
+		SerialNumber:          serial,
+		Subject:               pkix.Name{CommonName: "Infisical Agent Proxy Local Root CA"},
+		NotBefore:             time.Now().Add(-1 * time.Minute),
+		NotAfter:              time.Now().Add(localRootTTL),
+		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageDigitalSignature,
+		BasicConstraintsValid: true,
+		IsCA:                  true,
+		MaxPathLenZero:        true,
+	}
+	der, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to self-sign local root CA: %w", err)
+	}
+	cert, err := x509.ParseCertificate(der)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to parse local root CA certificate: %w", err)
+	}
+	return key, cert, nil
+}
+
+// caManagerFromRoot wraps an existing local root key/cert as a caManager.
+func caManagerFromRoot(key *ecdsa.PrivateKey, cert *x509.Certificate) *caManager {
+	return &caManager{
+		local:       true,
+		signingKey:  key,
+		signingCert: cert,
+		signingExp:  cert.NotAfter,
+		leafCache:   make(map[string]*leafEntry),
+	}
+}
+
+// newLocalCaManager builds a fresh in-memory local root. The private key never leaves memory.
+func newLocalCaManager() (*caManager, error) {
+	key, cert, err := generateLocalRoot()
+	if err != nil {
+		return nil, err
+	}
+	return caManagerFromRoot(key, cert), nil
+}
+
+// RootPEM returns the local root's public certificate (nil outside local mode).
+func (c *caManager) RootPEM() []byte {
+	if !c.local {
+		return nil
+	}
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if c.signingCert == nil {
+		return nil
+	}
+	return pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: c.signingCert.Raw})
+}
+
+func (c *caManager) ensureSigningCert() error {
+	// The local root is minted once at construction and is never re-signed.
+	if c.local {
+		return nil
+	}
 	c.mu.Lock()
 	defer c.mu.Unlock()
 
-	remaining := time.Until(c.intermediateExp)
-	if c.intermediateCert != nil && remaining > intermediateRenewThreshold {
+	remaining := time.Until(c.signingExp)
+	if c.signingCert != nil && remaining > intermediateRenewThreshold {
 		return nil
 	}
 
-	canFallBack := c.intermediateCert != nil && remaining > intermediateFallbackMargin
+	canFallBack := c.signingCert != nil && remaining > intermediateFallbackMargin
 	if canFallBack && time.Since(c.lastResignAttempt) < intermediateRetryInterval {
 		return nil
 	}
@@ -109,9 +183,9 @@ func (c *caManager) resignIntermediateLocked() error {
 		return fmt.Errorf("failed to parse intermediate CA certificate: %w", err)
 	}
 
-	c.intermediateKey = key
-	c.intermediateCert = cert
-	c.intermediateExp = cert.NotAfter
+	c.signingKey = key
+	c.signingCert = cert
+	c.signingExp = cert.NotAfter
 	c.resignGen.Add(1)
 	c.leafMu.Lock()
 	c.leafCache = make(map[string]*leafEntry)
@@ -121,7 +195,7 @@ func (c *caManager) resignIntermediateLocked() error {
 }
 
 func (c *caManager) mintLeaf(hostname string) (tls.Certificate, error) {
-	if err := c.ensureIntermediate(); err != nil {
+	if err := c.ensureSigningCert(); err != nil {
 		return tls.Certificate{}, err
 	}
 
@@ -133,8 +207,8 @@ func (c *caManager) mintLeaf(hostname string) (tls.Certificate, error) {
 	c.leafMu.Unlock()
 
 	c.mu.Lock()
-	interKey := c.intermediateKey
-	interCert := c.intermediateCert
+	interKey := c.signingKey
+	interCert := c.signingCert
 	gen := c.resignGen.Load()
 	c.mu.Unlock()
 

packages/agentproxy/ca_test.go

@@ -38,9 +38,9 @@ func installTestIntermediate(t *testing.T, c *caManager, notAfter time.Time) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	c.intermediateKey = key
-	c.intermediateCert = cert
-	c.intermediateExp = cert.NotAfter
+	c.signingKey = key
+	c.signingCert = cert
+	c.signingExp = cert.NotAfter
 }
 
 func TestEnsureIntermediateFallsBackWhenResignFails(t *testing.T) {
@@ -55,7 +55,7 @@ func TestEnsureIntermediateFallsBackWhenResignFails(t *testing.T) {
 	c := newCaManager(func() string { return "test-token" })
 	installTestIntermediate(t, c, time.Now().Add(1*time.Hour))
 
-	if err := c.ensureIntermediate(); err != nil {
+	if err := c.ensureSigningCert(); err != nil {
 		t.Fatalf("expected fallback to the valid intermediate, got error: %v", err)
 	}
 	leaf, err := c.mintLeaf("api.example.com")
@@ -77,7 +77,7 @@ func TestEnsureIntermediateFailsWithoutFallback(t *testing.T) {
 	defer func() { config.INFISICAL_URL = origURL }()
 
 	c := newCaManager(func() string { return "test-token" })
-	if err := c.ensureIntermediate(); err == nil {
+	if err := c.ensureSigningCert(); err == nil {
 		t.Fatal("expected an error when there is no intermediate to fall back to")
 	}
 }

packages/agentproxy/cache.go

@@ -202,8 +202,37 @@ func (a *agentCache) evictIfFullLocked(incoming string) {
 }
 
 func (a *agentCache) resolve(jwt string, scope agentScope) ([]*resolvedService, error) {
-	agentClient := resty.New().SetAuthToken(jwt)
-	listResp, err := api.CallListProxiedServices(agentClient, api.ListProxiedServicesRequest{
+	return resolveServices(scope, resolveParams{
+		discoveryToken:      jwt,
+		valueToken:          a.proxyToken,
+		includeNonProxyable: false,
+		registerDynamic: func(cred api.ProxiedServiceCredential, projectSlug string) *dynamicCredentialRef {
+			key := leaseKey{
+				jwt:        jwt,
+				scope:      scope,
+				secretName: cred.DynamicSecretName,
+				configHash: canonicalConfigHash(cred.DynamicSecretConfig),
+			}
+			a.leases.register(key, leaseSpec{projectSlug: projectSlug, config: cred.DynamicSecretConfig})
+			return &dynamicCredentialRef{key: key, field: cred.DynamicSecretField}
+		},
+	})
+}
+
+// resolveParams holds what differs between the remote (agentCache) and local (localResolver) resolvers.
+type resolveParams struct {
+	discoveryToken      string
+	valueToken          func() string
+	includeNonProxyable bool
+	// registerDynamic maps a dynamic-secret credential to its lease ref, or returns nil to skip it.
+	registerDynamic func(cred api.ProxiedServiceCredential, projectSlug string) *dynamicCredentialRef
+}
+
+// resolveServices lists the proxied services for a scope and attaches credential values. Shared by
+// both resolvers; the differences live in resolveParams.
+func resolveServices(scope agentScope, p resolveParams) ([]*resolvedService, error) {
+	client := resty.New().SetAuthToken(p.discoveryToken)
+	listResp, err := api.CallListProxiedServices(client, api.ListProxiedServicesRequest{
 		ProjectID:   scope.projectID,
 		Environment: scope.environment,
 		SecretPath:  scope.secretPath,
@@ -212,11 +241,11 @@ func (a *agentCache) resolve(jwt string, scope agentScope) ([]*resolvedService,
 		return nil, fmt.Errorf("failed to discover proxied services: %w", err)
 	}
 
-	secretValues := a.fetchSecretValues(scope, referencedStaticKeys(listResp.Services))
+	secretValues := fetchSecretValues(p.valueToken, scope, referencedStaticKeys(listResp.Services, p.includeNonProxyable))
 
 	var services []*resolvedService
 	for _, svc := range listResp.Services {
-		if !svc.CanProxy {
+		if !p.includeNonProxyable && !svc.CanProxy {
 			continue
 		}
 		rs := &resolvedService{
@@ -227,21 +256,18 @@ func (a *agentCache) resolve(jwt string, scope agentScope) ([]*resolvedService,
 		}
 		for _, cred := range svc.Credentials {
 			if cred.DynamicSecretName != "" {
-				key := leaseKey{
-					jwt:        jwt,
-					scope:      scope,
-					secretName: cred.DynamicSecretName,
-					configHash: canonicalConfigHash(cred.DynamicSecretConfig),
+				ref := p.registerDynamic(cred, listResp.ProjectSlug)
+				if ref == nil {
+					continue
 				}
-				a.leases.register(key, leaseSpec{projectSlug: listResp.ProjectSlug, config: cred.DynamicSecretConfig})
 				rs.credentials = append(rs.credentials, resolvedCredential{
 					role:          cred.Role,
 					headerName:    cred.HeaderName,
 					headerPrefix:  cred.HeaderPrefix,
 					headerPurpose: cred.HeaderPurpose,
 					placeholder:   cred.PlaceholderValue,
 					surfaces:      cred.SubstitutionSurfaces,
-					dynamic:       &dynamicCredentialRef{key: key, field: cred.DynamicSecretField},
+					dynamic:       ref,
 				})
 				continue
 			}
@@ -270,11 +296,11 @@ func (a *agentCache) resolve(jwt string, scope agentScope) ([]*resolvedService,
 	return services, nil
 }
 
-func referencedStaticKeys(services []api.ProxiedService) []string {
+func referencedStaticKeys(services []api.ProxiedService, includeNonProxyable bool) []string {
 	seen := make(map[string]struct{})
 	var keys []string
 	for _, svc := range services {
-		if !svc.CanProxy {
+		if !includeNonProxyable && !svc.CanProxy {
 			continue
 		}
 		for _, cred := range svc.Credentials {
@@ -291,12 +317,12 @@ func referencedStaticKeys(services []api.ProxiedService) []string {
 	return keys
 }
 
-// fetchSecretValues resolves referenced static secrets individually so a key the proxy can't read is
-// skipped rather than failing the whole agent.
-func (a *agentCache) fetchSecretValues(scope agentScope, keys []string) map[string]string {
+// fetchSecretValues resolves referenced static secrets individually so a key the value identity can't
+// read is skipped rather than failing the whole agent.
+func fetchSecretValues(token func() string, scope agentScope, keys []string) map[string]string {
 	values := make(map[string]string, len(keys))
 	for _, key := range keys {
-		secret, _, err := util.GetSinglePlainTextSecretByNameV3(a.proxyToken(), scope.projectID, scope.environment, scope.secretPath, key)
+		secret, _, err := util.GetSinglePlainTextSecretByNameV3(token(), scope.projectID, scope.environment, scope.secretPath, key)
 		if err != nil {
 			log.Warn().Err(err).Msgf("agent proxy: skipping static secret %q; proxy identity cannot read it", key)
 			continue
@@ -306,6 +332,13 @@ func (a *agentCache) fetchSecretValues(scope agentScope, keys []string) map[stri
 	return values
 }
 
+// close drops every cached entry so credential values become unreachable. Called at proxy shutdown.
+func (a *agentCache) close() {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	a.entries = make(map[string]*agentEntry)
+}
+
 func (a *agentCache) refreshActive() {
 	type refreshTarget struct {
 		key   string

packages/agentproxy/connect_live_test.go

@@ -46,9 +46,9 @@ func TestConnectTunnelLiveOverTCP(t *testing.T) {
 	upstreamPool := x509.NewCertPool()
 	upstreamPool.AddCert(upstream.Certificate())
 	ps := &proxyServer{
-		opts:  Options{UnmatchedHost: UnmatchedAllow},
-		ca:    ca,
-		cache: cache,
+		opts:     Options{UnmatchedHost: UnmatchedAllow},
+		ca:       ca,
+		resolver: cache,
 		transport: &http.Transport{
 			TLSClientConfig: &tls.Config{RootCAs: upstreamPool},
 			TLSNextProto:    map[string]func(string, *tls.Conn) http.RoundTripper{},

packages/agentproxy/connect_test.go

@@ -20,7 +20,7 @@ import (
 )
 
 // newTestCA builds a caManager with a locally self-signed intermediate so mintLeaf works offline
-// (ensureIntermediate skips the API when an unexpired intermediate is already set). Returns the
+// (ensureSigningCert skips the API when an unexpired intermediate is already set). Returns the
 // intermediate cert so the client can trust the minted leaf chain.
 func newTestCA(t *testing.T) (*caManager, *x509.Certificate) {
 	t.Helper()
@@ -46,10 +46,10 @@ func newTestCA(t *testing.T) (*caManager, *x509.Certificate) {
 		t.Fatal(err)
 	}
 	return &caManager{
-		intermediateKey:  key,
-		intermediateCert: cert,
-		intermediateExp:  cert.NotAfter,
-		leafCache:        make(map[string]*leafEntry),
+		signingKey:  key,
+		signingCert: cert,
+		signingExp:  cert.NotAfter,
+		leafCache:   make(map[string]*leafEntry),
 	}, cert
 }
 
@@ -98,7 +98,7 @@ func TestConnectTunnelInjectsCredentialsAndKeepsAlive(t *testing.T) {
 	ps := &proxyServer{
 		opts:      Options{UnmatchedHost: UnmatchedAllow},
 		ca:        ca,
-		cache:     cache,
+		resolver:  cache,
 		transport: stub,
 	}
 
@@ -175,7 +175,7 @@ func TestConnectRequiresProxyAuth(t *testing.T) {
 	ps := &proxyServer{
 		opts:      Options{UnmatchedHost: UnmatchedAllow},
 		ca:        ca,
-		cache:     cache,
+		resolver:  cache,
 		transport: &stubRoundTripper{},
 	}
 

packages/agentproxy/forward_activity_test.go

@@ -76,7 +76,7 @@ func newRecordingProxy(t *testing.T, unmatchedHost, jwt string, scope agentScope
 	}
 	ps := &proxyServer{
 		opts:      Options{UnmatchedHost: unmatchedHost},
-		cache:     cache,
+		resolver:  cache,
 		leases:    newLeaseStore(func() string { return "" }),
 		transport: &http.Transport{},
 	}
@@ -115,7 +115,7 @@ func TestForwardCapturesIdentityForRecord(t *testing.T) {
 	}
 	ps := &proxyServer{
 		opts:      Options{UnmatchedHost: UnmatchedAllow},
-		cache:     cache,
+		resolver:  cache,
 		leases:    newLeaseStore(func() string { return "" }),
 		transport: reflectingTransport{header: make(http.Header)},
 	}