v0.38.0

This release changes what an agent can read, and where your credentials are kept. Please read before upgrading.

MCP credentials stay out of the session

A remote MCP server's address and credentials now stay in the server. An agent's session gets a local address holding one token that stops working when the turn ends. Before this, most bases wrote the bearer token and the address into a config file in the session, where the agent could read it, and some of those files travel in the checkpoint.

Rotate your MCP tokens if an agent you don't fully trust has run on this instance. Older sessions, checkpoints and their git history keep the copies they already hold, and this release doesn't remove them.

Stored credentials are encrypted at rest on every install

An install with no HR_SECRET_KEY now gets one at its first start, kept in /data/secret-key (root's, mode 600), and records stored in plain text are encrypted at that start. A token or header written on a harness moves to the same store. Thanks to @eric-epsilla (#625).

• This protects a copy of the secret store, not a copy of the whole volume, because the key sits beside the data. To keep them apart, set HR_SECRET_KEY to the value in that file and delete the file.
• Don't set a new value over a generated key. It can't open what's already stored. The log says how many records it can't open.
• Back up /data/secret-key with your volume. Rolling back to an older image needs its value in HR_SECRET_KEY.
• A token left on a harness moves the first time that harness is read, so one nothing reads keeps it until then.

A task can ask you a question

A task can now end by asking: a choice, a confirmation, free text or a secret. The turn ends incomplete with reason input_required, and the answer continues the session. Thanks to @eric-epsilla (#622, closes #476). The console has an answer form, and a secret typed there isn't saved or shown in the conversation. It works on the Claude Code base for now.

This can change what your client sees: a Claude Code task that used to finish with a question in its text can now end incomplete. A normal message on the next task passes the question over.

Every release is now checked for this

Each release runs one task per base with a planted value in every credential, and fails if one reaches a session, the volume or a response. The check is scripts/secret-canary-gate.py.

See What an agent can read for what this does and doesn't cover. During a turn an agent can still use what it's given, and a stdio server's values and a harness's variables stay readable to it.

Full Changelog: v0.37.18...v0.38.0