Make the cloud gate actually gate, and stop exporting credentials

An external improvement review found the cloud lane's central promise was inert,
and it was right.

overlay.sh installs .claude/verify.sh and wires the Stop hook, but verify-gate.sh
refuses to run a repo's verify.sh without a machine-local trust entry, and a
fresh cloud sandbox has none. The gate was installed, wired, and silently
skipping on every Stop — in the one lane that exists for cloud work. My own
overlay test missed it because it asserted the files landed rather than what the
hook decided. That distinction is the lesson.

The sandbox setup line now runs `vstack trust` after bootstrapping. Local
protection is unchanged: an untrusted repo cloned to your laptop still runs
nothing until you type it yourself. This line lives in a file you committed, in a
disposable sandbox, for a repo you deliberately dispatched work to.

The second finding was mine. install.sh sourced secrets.env into .zshenv with
`set -a`, and adding the bash lane extended that to .bashrc and .profile —
widening a credential exposure while fixing something else. One token reached
every child process of every shell. Nothing needed it; every wrapper in bin/
already loads secrets.env itself.

Removing it from the installer only helps new machines, so install.sh now removes
the line it previously wrote, matched exactly and backed up first. It leaves any
other spelling alone: doctor found one on this machine that predates vstack, and
deleting a line from a file you own because it resembles ours would be the same
class of mistake as the destructive bugs earlier in this audit. doctor fails if
vstack's form returns, and notes yours without failing.

Both covered end to end. The cloud case asserts the decision — skip before
arming, block after — and scopes TMPDIR per run, because verify-gate.sh caps
repeated blocks per session id and a test reusing one reads that cap as the gate
having broken.

verify.sh 25/25, falsifiability 26/26, matrix 19/19, doctor and drift green.

Author: itsvedantkumar

bin/doctor

@@ -270,7 +270,28 @@ n=$(ls "$CDIR/agents"/*.md 2>/dev/null | wc -l | tr -d ' ')
 [ "$n" -ge "$WANT_AGENTS" ] && ok "subagents ($n)" || bad "subagents" "$n<$WANT_AGENTS"
 echo "── secrets ──"
 [ -f "$HOME/.config/agents/secrets.env" ] && [ "$(get_perms "$HOME/.config/agents/secrets.env")" = "600" ] && ok "secrets.env (600)" || bad "secrets.env" "missing/perms"
-grep -q 'secrets.env' "$HOME/.zshenv" 2>/dev/null && ok "sourced in .zshenv" || bad "zshenv source" "not sourced"
+# Asserts the opposite of what it used to. Sourcing secrets.env from a shell rc exports every
+# credential to every child process of every shell; the wrappers in bin/ load what they need
+# themselves. An install that puts it back is a regression, so this fails on finding it.
+# Two different things can put this line in an rc file, and they deserve different answers.
+# The `set -a` form is the one install.sh used to write: if it is back, that is a regression in
+# this repo and it fails. Any other spelling is a line the user wrote themselves — still a real
+# exposure worth naming, but not this tool's to fail over or to delete.
+_amb_ours=""; _amb_theirs=""
+for _rc in .zshenv .zshrc .bashrc .profile; do
+  [ -f "$HOME/$_rc" ] || continue
+  if grep -q 'set -a && \. "$HOME/.config/agents/secrets.env" && set +a' "$HOME/$_rc" 2>/dev/null; then
+    _amb_ours="$_amb_ours $_rc"
+  elif grep -q 'agents/secrets.env' "$HOME/$_rc" 2>/dev/null; then
+    _amb_theirs="$_amb_theirs $_rc"
+  fi
+done
+if [ -n "$_amb_ours" ]; then
+  bad "credentials exported to shells" "vstack's own export is back in:$_amb_ours — re-run ./install.sh, which removes it"
+else
+  ok "vstack exports no credentials to shells"
+fi
+[ -n "$_amb_theirs" ] && p "your own secrets sourcing" "note:$_amb_theirs sources secrets.env, so every child process of those shells sees your tokens. The wrappers in ~/.config/agents/bin load what they need on their own, so this line is probably not needed."
 for w in cloudflare-mcp; do [ -x "$HOME/.config/agents/bin/$w" ] && ok "wrapper $w" || bad "wrapper $w" "missing"; done
 echo "── deploy ──"; [ -x "$HOME/.config/agents/bin/deploy-auto.sh" ] && ok "deploy-auto.sh" || bad "deploy-auto.sh" "missing"
 echo "── memory ──"; [ -d "$HOME/.claude-mem" ] && ok "claude-mem store" || bad "claude-mem" "missing"

install.sh

@@ -350,10 +350,36 @@ back "$HOME/.zshenv"
 if [ "$DRY" = 0 ] && ! grep -q '>>> claude-parity env >>>' "$HOME/.zshenv" 2>/dev/null; then
   cat "$SRC/shell/zshenv.snippet" >> "$HOME/.zshenv"
 fi
-if [ "$DRY" = 0 ] && ! grep -q 'agents/secrets.env' "$HOME/.zshenv" 2>/dev/null; then
-  printf '\n[ -f "$HOME/.config/agents/secrets.env" ] && set -a && . "$HOME/.config/agents/secrets.env" && set +a\n' >> "$HOME/.zshenv"
+# Credentials are NOT exported into your shells, and any earlier line that did is removed.
+#
+# Leaving it behind would mean the fix only reached new machines while every existing install
+# kept leaking. vstack wrote that line, so vstack takes it out — matched exactly, backed up
+# first, and only ever the form this installer produced. A line you wrote yourself that happens
+# to mention secrets.env is not touched.
+if [ "$DRY" = 0 ]; then
+  for rc in .zshenv .zshrc .bashrc .profile; do
+    [ -f "$HOME/$rc" ] || continue
+    grep -q 'set -a && \. "$HOME/.config/agents/secrets.env" && set +a' "$HOME/$rc" 2>/dev/null || continue
+    back "$HOME/$rc"
+    tmp=$(mktemp)
+    grep -vF '[ -f "$HOME/.config/agents/secrets.env" ] && set -a && . "$HOME/.config/agents/secrets.env" && set +a' "$HOME/$rc" > "$tmp" && cat "$tmp" > "$HOME/$rc"
+    rm -f "$tmp"
+    say "removed    credential export from ~/$rc (wrappers load their own; backup in $BK)"
+  done
 fi
 
+# Credentials are NOT exported into your shells.
+#
+# This used to source secrets.env with `set -a` into .zshenv, and then — when the bash lane was
+# added — into .bashrc and .profile too, which widened it rather than fixing it. The effect was
+# that filling in a Cloudflare token handed it to every child process of every shell: every
+# script in every repo you cd into, every package postinstall, every tool you try once.
+#
+# Nothing needed it. Every wrapper in bin/ already loads secrets.env itself (see
+# bin/cloudflare-mcp), which is the correct scope: the process that needs the credential reads
+# it, and nothing else sees it. The parity block above stays, because those are CLAUDE_* tuning
+# variables, not secrets.
+
 # bash gets the same environment. The wrapper does not travel — claude-parity.zsh is written
 # in zsh (whence -p, print -r, local -a) and cannot be sourced by bash — but the env snippet
 # and the secrets line are plain POSIX exports, and they are the part that actually changes
@@ -373,9 +399,6 @@ if [ "$DRY" = 0 ]; then
       cat "$SRC/shell/zshenv.snippet" >> "$HOME/$rc"
       SHELL_LANES="$SHELL_LANES, $rc"
     fi
-    if ! grep -q 'agents/secrets.env' "$HOME/$rc" 2>/dev/null; then
-      printf '\n[ -f "$HOME/.config/agents/secrets.env" ] && set -a && . "$HOME/.config/agents/secrets.env" && set +a\n' >> "$HOME/$rc"
-    fi
   done
   case "${SHELL:-}" in
     *zsh) ;;

overlay.sh

@@ -124,8 +124,20 @@ else
 # Cloud workspaces start from a bare Linux sandbox with no ~/.claude, so pull vstack in.
 # Pinned to a reviewed commit so a compromised repo/account cannot push code into every
 # sandbox at once — bump the SHA deliberately when updating vstack.
+#
+# `vstack trust` arms this repo's .claude/verify.sh for the Stop-hook gate. Without it the
+# gate installs and does nothing: verify-gate.sh refuses to execute a repo's verify.sh unless
+# a machine-local trust entry matches its hash, and a fresh sandbox has no such entry. The
+# gate was inert in the one lane that exists for cloud work — installed, wired, and silently
+# skipping on every Stop.
+#
+# Arming it here rather than in verify-gate.sh keeps the local protection intact. Cloning an
+# untrusted repo onto your laptop still runs nothing until you type `vstack trust` yourself.
+# This line is different: it lives in a file you committed, in a disposable sandbox, for a
+# repo you deliberately dispatched work to. That is the consent, and it is visible in the diff.
+#
 # Add this repo's own install step (npm ci, uv sync, ...) to the end of this line.
-setup = "curl -fsSL https://raw.githubusercontent.com/itsvedantkumar/vstack/__PIN__/bootstrap.sh | bash"
+setup = "curl -fsSL https://raw.githubusercontent.com/itsvedantkumar/vstack/__PIN__/bootstrap.sh | bash && \"$HOME/.config/agents/bin/vstack\" trust"
 run_mode = "concurrent"
 
 [scripts.run.verify]

tests/install-matrix.sh

@@ -185,7 +185,11 @@ if want bash-only; then
   out=$(HOME="$H" SHELL=/bin/bash "$SRC/install.sh" 2>&1); rc=$?
   e=""
   grep -q 'ENABLE_PROMPT_CACHING_1H' "$H/.bashrc" 2>/dev/null || e="$e; env snippet missing from .bashrc"
-  grep -q 'agents/secrets.env'       "$H/.bashrc" 2>/dev/null || e="$e; secrets not sourced in .bashrc"
+  # Deliberately the opposite of what this used to assert. The env snippet must reach bash —
+  # that is the tuning that changes behaviour — but credentials must not, because sourcing
+  # secrets.env from an rc file hands every token to every child process of every shell. The
+  # wrappers in bin/ load what they need themselves.
+  grep -q 'agents/secrets.env'       "$H/.bashrc" 2>/dev/null && e="$e; .bashrc exports credentials to every shell"
   printf '%s' "$out" | grep -q 'zsh-only' || e="$e; did not say the wrapper is zsh-only"
   [ "$rc" = 0 ] && [ -z "$e" ] && ok "bash user gets the env lane" || bad "bash user gets the env lane" "exit=$rc$e"
 fi
@@ -558,6 +562,72 @@ if want recover; then
     || bad "re-running converges from a damaged install" "${e#; }"
 fi
 
+# --- the cloud lane's gate must actually gate --------------------------------------------------
+# The overlay case above proves the files land. It did not prove the gate works, and it did not:
+# verify-gate.sh refuses to execute a repo's verify.sh without a machine-local trust entry, and
+# a fresh sandbox has none. So the Stop gate was installed, wired, and silently skipping on every
+# Stop — inert in the one lane that exists for cloud work.
+#
+# This walks the whole sandbox sequence: overlay a repo, install vstack into an empty HOME the
+# way the pinned setup line does, run the trust step that line now performs, break the repo's
+# gate, and require the Stop hook to block. Asserting the decision, not the file list, is the
+# difference between testing that something is installed and testing that it works.
+if want cloud-gate; then
+  if ! command -v git >/dev/null 2>&1 || ! command -v jq >/dev/null 2>&1; then
+    skip "cloud sandbox gate blocks" "git or jq not installed"
+  else
+    T="$ROOT/cloud"; H="$ROOT/cloud-home"; mkdir -p "$T/repo" "$H"
+    git -C "$T/repo" init -q
+    git -C "$T/repo" config user.email t@example.com; git -C "$T/repo" config user.name t
+    printf 'x\n' > "$T/repo/f"; git -C "$T/repo" add -A; git -C "$T/repo" commit -qm init
+    "$SRC/overlay.sh" "$T/repo" >/dev/null 2>&1
+    e=""
+    # TOML escapes the quotes, so the line reads ...bin/vstack\" trust. Match on the command
+    # rather than a quoted fragment.
+    grep -qE 'bin/vstack.*trust' "$T/repo/.conductor/settings.toml" 2>/dev/null \
+      || e="$e; the sandbox setup line does not arm trust"
+    # the sandbox: empty HOME, vstack installed by the pinned bootstrap, then the trust step
+    HOME="$H" "$SRC/install.sh" >/dev/null 2>&1
+    printf '#!/usr/bin/env bash\necho "seeded failure"\nexit 1\n' > "$T/repo/.claude/verify.sh"
+    chmod +x "$T/repo/.claude/verify.sh"
+    # before arming, it must skip — that is the local protection working as designed
+    # TMPDIR is scoped to this run. verify-gate.sh caps repeated blocks per session id in a
+    # counter file under TMPDIR, so a test that reuses an id eventually gets a silent exit 0 —
+    # the loop cap doing its job, read as the gate having stopped working.
+    mkdir -p "$ROOT/cloud-tmp"
+    d0=$(printf '{"session_id":"c0"}' | env HOME="$H" TMPDIR="$ROOT/cloud-tmp" CLAUDE_PROJECT_DIR="$T/repo" \
+         bash "$SRC/claude/hooks/verify-gate.sh" 2>/dev/null | jq -r '.decision // "none"' 2>/dev/null)
+    [ "$d0" = none ] || e="$e; an unarmed repo's gate ran without trust (decision=$d0)"
+    ( cd "$T/repo" && HOME="$H" "$H/.config/agents/bin/vstack" trust >/dev/null 2>&1 )
+    d1=$(printf '{"session_id":"c1"}' | env HOME="$H" TMPDIR="$ROOT/cloud-tmp" CLAUDE_PROJECT_DIR="$T/repo" \
+         bash "$SRC/claude/hooks/verify-gate.sh" 2>/dev/null | jq -r '.decision // "none"' 2>/dev/null)
+    [ "$d1" = block ] || e="$e; after arming, a failing gate did not block (decision=$d1)"
+    [ -z "$e" ] && ok "cloud sandbox gate blocks after the setup line arms it" \
+      || bad "cloud sandbox gate blocks after the setup line arms it" "${e#; }"
+  fi
+fi
+
+# --- credentials must not be ambient ------------------------------------------------------------
+# Filling in one token used to hand it to every child process of every shell: every script in
+# every repo, every package postinstall, every tool you try once. The bash lane made it worse by
+# adding .bashrc and .profile to the list. Every wrapper in bin/ already loads what it needs.
+if want no-ambient-secrets; then
+  H="$ROOT/amb"; mkdir -p "$H"
+  HOME="$H" "$SRC/install.sh" >/dev/null 2>&1
+  e=""
+  for rc in .zshenv .zshrc .bashrc .profile; do
+    [ -f "$H/$rc" ] || continue
+    grep -q 'agents/secrets.env' "$H/$rc" 2>/dev/null && e="$e; $rc exports secrets to every shell"
+  done
+  # the tuning variables are not secrets and must still be there
+  grep -q 'ENABLE_PROMPT_CACHING_1H' "$H/.zshenv" 2>/dev/null || e="$e; the parity env block went missing"
+  # and the wrapper must still be able to reach them itself
+  grep -q 'secrets.env' "$H/.config/agents/bin/cloudflare-mcp" 2>/dev/null \
+    || e="$e; the wrapper no longer loads its own credentials"
+  [ -z "$e" ] && ok "credentials are not exported into shells" \
+    || bad "credentials are not exported into shells" "${e#; }"
+fi
+
 echo
 printf '%d passed, %d failed' "$PASS" "$FAIL"
 [ "$SKIP" -gt 0 ] && printf ', %d skipped' "$SKIP"