feat: introduced an egress proxy for L7 credential injection

api/Dockerfile

@@ -56,7 +56,7 @@
 ARG dify_uid=1001
 ARG NODE_MAJOR=22
 ARG NODE_PACKAGE_VERSION=22.21.0-1nodesource1
 ARG NODESOURCE_KEY_FPR=6F71F525282841EEDAF851B42F59B5F99B1BE0B4
 RUN groupadd -r -g ${dify_uid} dify && \
     useradd -r -u ${dify_uid} -g ${dify_uid} -s /bin/bash dify && \
     chown -R dify:dify /app
@@ -99,10 +99,10 @@
 COPY --from=packages --chown=dify:dify ${VIRTUAL_ENV} ${VIRTUAL_ENV}
 ENV PATH="${VIRTUAL_ENV}/bin:${PATH}"
 
-RUN mkdir -p /usr/local/share/nltk_data \
-    && NLTK_DATA=/usr/local/share/nltk_data python -m nltk.downloader punkt_tab averaged_perceptron_tagger_eng stopwords \
-    && NLTK_DATA=/usr/local/share/nltk_data python -c "import nltk; nltk.data.find('tokenizers/punkt_tab'); nltk.data.find('taggers/averaged_perceptron_tagger_eng'); nltk.data.find('corpora/stopwords')" \
-    && chmod -R 755 /usr/local/share/nltk_data
+# RUN mkdir -p /usr/local/share/nltk_data \
+#     && NLTK_DATA=/usr/local/share/nltk_data python -m nltk.downloader punkt_tab averaged_perceptron_tagger_eng stopwords \
+#     && NLTK_DATA=/usr/local/share/nltk_data python -c "import nltk; nltk.data.find('tokenizers/punkt_tab'); nltk.data.find('taggers/averaged_perceptron_tagger_eng'); nltk.data.find('corpora/stopwords')" \
+#     && chmod -R 755 /usr/local/share/nltk_data
 
 ENV TIKTOKEN_CACHE_DIR=/app/api/.tiktoken_cache
 

dify-agent-runtime/Makefile

@@ -112,6 +112,94 @@ integration-up:
 		fi; \
 		sleep 2; \
 	done
+	@echo "Setting up egress proxy container + echo backend..."
+	$(eval EGRESS_NET := sandbox-rt-egress-net-$(TEST_ID))
+	docker network create $(EGRESS_NET) > /dev/null
+	$(eval ECHO_CONTAINER := echo-backend-$(TEST_ID))
+	docker run -d --name $(ECHO_CONTAINER) \
+		--network $(EGRESS_NET) --network-alias echo-backend \
+		mendhak/http-https-echo:31
+	$(eval EGRESS_CONTAINER_NAME := sandbox-rt-egress-$(TEST_ID))
+	$(eval EGRESS_HOST_PORT := $(shell python3 -c 'import socket; s=socket.socket(); s.bind(("",0)); print(s.getsockname()[1]); s.close()'))
+	$(eval EGRESS_AUTH_TOKEN := test-token-egress-$(TEST_ID))
+	docker run -d --name $(EGRESS_CONTAINER_NAME) \
+		--network $(EGRESS_NET) \
+		-p $(EGRESS_HOST_PORT):5004 \
+		-e SHELLCTL_AUTH_TOKEN=$(EGRESS_AUTH_TOKEN) \
+		-e SHELLCTL_EGRESSPROXY_ENABLED=true \
+		-e HTTP_PROXY=http://127.0.0.1:18080 \
+		-e HTTPS_PROXY=http://127.0.0.1:18080 \
+		-e NO_PROXY=localhost,127.0.0.1 \
+		$(IMAGE_NAME)
+	@echo 'EGRESS_NET=$(EGRESS_NET)' >> $(STATE_FILE)
+	@echo 'ECHO_CONTAINER=$(ECHO_CONTAINER)' >> $(STATE_FILE)
+	@echo 'EGRESS_CONTAINER_NAME=$(EGRESS_CONTAINER_NAME)' >> $(STATE_FILE)
+	@echo 'EGRESS_HOST_PORT=$(EGRESS_HOST_PORT)' >> $(STATE_FILE)
+	@echo 'EGRESS_AUTH_TOKEN=$(EGRESS_AUTH_TOKEN)' >> $(STATE_FILE)
+	@for i in $$(seq 1 30); do \
+		if curl -sf http://localhost:$(EGRESS_HOST_PORT)/healthz > /dev/null 2>&1; then \
+			echo "Egress proxy runtime is ready on port $(EGRESS_HOST_PORT)"; \
+			break; \
+		fi; \
+		if [ "$$i" -eq 30 ]; then \
+			echo "ERROR: egress proxy runtime not ready after 60s" >&2; \
+			docker logs $(EGRESS_CONTAINER_NAME); \
+			docker rm -f $(EGRESS_CONTAINER_NAME) $(ECHO_CONTAINER) 2>/dev/null; \
+			docker network rm $(EGRESS_NET) 2>/dev/null; \
+			exit 1; \
+		fi; \
+		sleep 2; \
+	done
+	@echo "Setting up upstream squid + egress-proxy-with-upstream container..."
+	@echo "  NOTE: an earlier iteration tried to place this runtime container on"
+	@echo "  a network with no direct path to echo-backend (only reachable via"
+	@echo "  squid-upstream bridging two networks), to force a true end-to-end"
+	@echo "  regression test of hostname passthrough mirroring production's"
+	@echo "  local_sandbox/agent_ssrf_proxy/api topology. That approach was"
+	@echo "  reverted: multi-homing squid-upstream across two docker networks"
+	@echo "  via 'docker network connect' hit a Docker/host networking pitfall"
+	@echo "  (squid answered fine on its primary network but not the secondary"
+	@echo "  one -- asymmetric routing / rp_filter in the Docker Desktop VM),"
+	@echo "  which is an environment limitation unrelated to the proxy code."
+	@echo "  Hostname-passthrough itself is covered reliably (no Docker network"
+	@echo "  involved) by TestProxyUpstreamChainingPreservesHostname in"
+	@echo "  internal/egressproxy/proxy_test.go. This test only verifies that"
+	@echo "  upstream chaining + credential injection work end-to-end."
+	$(eval SQUID_CONTAINER := squid-upstream-$(TEST_ID))
+	docker run -d --name $(SQUID_CONTAINER) \
+		--network $(EGRESS_NET) --network-alias squid-upstream \
+		-v $(CURDIR)/tests/squid-test.conf:/etc/squid/squid.conf:ro \
+		ubuntu/squid:latest
+	$(eval EGRESS_UPSTREAM_CONTAINER_NAME := sandbox-rt-egress-upstream-$(TEST_ID))
+	$(eval EGRESS_UPSTREAM_HOST_PORT := $(shell python3 -c 'import socket; s=socket.socket(); s.bind(("",0)); print(s.getsockname()[1]); s.close()'))
+	$(eval EGRESS_UPSTREAM_AUTH_TOKEN := test-token-egress-upstream-$(TEST_ID))
+	docker run -d --name $(EGRESS_UPSTREAM_CONTAINER_NAME) \
+		--network $(EGRESS_NET) \
+		-p $(EGRESS_UPSTREAM_HOST_PORT):5004 \
+		-e SHELLCTL_AUTH_TOKEN=$(EGRESS_UPSTREAM_AUTH_TOKEN) \
+		-e SHELLCTL_EGRESSPROXY_ENABLED=true \
+		-e SHELLCTL_EGRESSPROXY_UPSTREAM=http://squid-upstream:3128 \
+		-e HTTP_PROXY=http://127.0.0.1:18080 \
+		-e HTTPS_PROXY=http://127.0.0.1:18080 \
+		-e NO_PROXY=localhost,127.0.0.1 \
+		$(IMAGE_NAME)
+	@echo 'SQUID_CONTAINER=$(SQUID_CONTAINER)' >> $(STATE_FILE)
+	@echo 'EGRESS_UPSTREAM_CONTAINER_NAME=$(EGRESS_UPSTREAM_CONTAINER_NAME)' >> $(STATE_FILE)
+	@echo 'EGRESS_UPSTREAM_HOST_PORT=$(EGRESS_UPSTREAM_HOST_PORT)' >> $(STATE_FILE)
+	@echo 'EGRESS_UPSTREAM_AUTH_TOKEN=$(EGRESS_UPSTREAM_AUTH_TOKEN)' >> $(STATE_FILE)
+	@for i in $$(seq 1 30); do \
+		if curl -sf http://localhost:$(EGRESS_UPSTREAM_HOST_PORT)/healthz > /dev/null 2>&1; then \
+			echo "Egress-with-upstream runtime is ready on port $(EGRESS_UPSTREAM_HOST_PORT)"; \
+			break; \
+		fi; \
+		if [ "$$i" -eq 30 ]; then \
+			echo "ERROR: egress-with-upstream runtime not ready after 60s" >&2; \
+			docker logs $(EGRESS_UPSTREAM_CONTAINER_NAME); \
+			docker rm -f $(EGRESS_UPSTREAM_CONTAINER_NAME) $(SQUID_CONTAINER) 2>/dev/null; \
+			exit 1; \
+		fi; \
+		sleep 2; \
+	done
 
 integration-test:
 	@test -f $(STATE_FILE) || { echo "ERROR: run 'make integration-up' first" >&2; exit 1; }
@@ -120,6 +208,10 @@ integration-test:
 	SHELLCTL_TEST_TOKEN=$$AUTH_TOKEN \
 	SHELLCTL_GO_URL_NO_ISOLATION=http://localhost:$$HOST_PORT_NOISO \
 	SHELLCTL_TEST_TOKEN_NO_ISOLATION=$$AUTH_TOKEN_NOISO \
+	SHELLCTL_EGRESS_GO_URL=http://localhost:$$EGRESS_HOST_PORT \
+	SHELLCTL_EGRESS_TEST_TOKEN=$$EGRESS_AUTH_TOKEN \
+	SHELLCTL_EGRESS_UPSTREAM_GO_URL=http://localhost:$$EGRESS_UPSTREAM_HOST_PORT \
+	SHELLCTL_EGRESS_UPSTREAM_TEST_TOKEN=$$EGRESS_UPSTREAM_AUTH_TOKEN \
 	go test -tags=integration -v -count=1 -timeout=300s ./tests/...
 
 integration-logs:
@@ -131,6 +223,11 @@ integration-down:
 		. ./$(STATE_FILE); \
 		docker rm -f $$CONTAINER_NAME 2>/dev/null || true; \
 		docker rm -f $$CONTAINER_NAME_NOISO 2>/dev/null || true; \
+		docker rm -f $$EGRESS_CONTAINER_NAME 2>/dev/null || true; \
+		docker rm -f $$EGRESS_UPSTREAM_CONTAINER_NAME 2>/dev/null || true; \
+		docker rm -f $$SQUID_CONTAINER 2>/dev/null || true; \
+		docker rm -f $$ECHO_CONTAINER 2>/dev/null || true; \
+		docker network rm $$EGRESS_NET 2>/dev/null || true; \
 		rm -f $(STATE_FILE); \
 	fi
 

dify-agent-runtime/README.md

@@ -36,6 +36,7 @@ docker build -f dify-agent-runtime/docker/Dockerfile \
 ```
 docker run -d --name dify-agent-runtime \
   -p 15004:5004 \
+  -e SHELLCTL_EGRESSPROXY_ENABLED=true \
   dify-agent-runtime:latest
 ```
 

dify-agent-runtime/cmd/runner/main.go

@@ -67,12 +67,12 @@ func parentMode() {
 	env := os.Environ()
 	// Remove internal shellctl vars from inherited env.
 	env = filterEnv(env, []string{
-		"TMUX",
-		"SHELLCTL_STATE_DIR",
-		"SHELLCTL_RUNTIME_DIR",
-		"SHELLCTL_TMUX_SOCKET",
-		"SHELLCTL_RUNNER",
-		"SHELLCTL_AUTH_TOKEN",
+		envvar.EnvTMUX,
+		envvar.EnvShellctlStateDir,
+		envvar.EnvShellctlRuntimeDir,
+		envvar.EnvShellctlTmuxSocket,
+		envvar.EnvShellctlRunner,
+		envvar.EnvShellctlAuthToken,
 	})
 
 	envOverlay := loadEnvJSON(envPath)
@@ -172,6 +172,13 @@ func childMode() {
 		home := os.Getenv("HOME")
 		jobDir := filepath.Dir(scriptPath)
 		cfg := landlock.ConfigFromEnv(home, cwd, jobDir)
+
+		// Grant read access to the egress proxy CA cert directory, which
+		// lives outside the per-binding HOME that Landlock grants.
+		if caCert := os.Getenv(envvar.EnvSSLCertFile); caCert != "" {
+			cfg.ROPaths = append(cfg.ROPaths, filepath.Dir(caCert))
+		}
+
 		if err := landlock.Restrict(cfg); err != nil {
 			// the landlock is best-effort, so we just log the error whatever it is
 			fmt.Fprintf(os.Stderr, "shellctl-runner: WARNING: %v — running without filesystem isolation\n", err)

dify-agent-runtime/docker/Dockerfile

@@ -73,7 +73,8 @@ COPY --from=go-builder /bin/dify-agent /usr/local/bin/dify-agent
 RUN useradd --create-home --shell /bin/sh dify \
     && mkdir -p /mnt/drive \
     && chown dify:dify /home \
-    && chown -R dify:dify /home/dify /mnt/drive
+    && chown -R dify:dify /home/dify /mnt/drive \
+    && chown -R dify:dify /usr/local/share/ca-certificates /etc/ssl/certs /etc/ca-certificates.conf
 
 USER dify
 WORKDIR /home/dify

dify-agent-runtime/docs/egress-proxy-design.md

@@ -0,0 +1,46 @@
+# Egress Credential Proxy — Demo Guide
+
+This guide demonstrates the multi-tenant egress credential proxy system for Dify Agent's local sandbox. It walks through configuring a system-level credential manifest, understanding the architecture, and verifying that credentials are injected transparently — without ever appearing as plaintext environment variables in the job process.
+
+---
+
+## Architecture
+
+```
+┌─────────────────────────────────────────────────────────────────────┐
+│  local_sandbox container                                            │
+│                                                                     │
+│  ┌──────────────┐    ┌──────────────────────┐    ┌───────────────┐  │
+│  │  Agent Job   │    │  Egress MITM Proxy   │    │  Squid (SSRF) │  │
+│  │  (tmux)      │───▶│  127.0.0.1:18080     │───▶│  agent_ssrf   │  │
+│  │              │    │                      │    │  _proxy:3128  │  │
+│  │  env:        │    │  ┌────────────────┐  │    └──────┬────────┘  │
+│  │  HTTP_PROXY  │    │  │   Resolver     │  │           │           │
+│  │  HTTPS_PROXY │    │  │  system tier   │  │           ▼           │
+│  │  TAVILY_API_ │    │  │  session tier  │  │     ┌──────────┐      │
+│  │  KEY=__secret│    │  │  (per sandbox) │  │     │ Internet │      │
+│  │  :tavily/    │    │  └────────────────┘  │     │  (e.g.   │      │
+│  │  api_key__   │    │                      │     │  tavily) │      │
+│  └──────────────┘    │  1. Inject headers   │     └──────────┘      │
+│                      │  2. Strip Proxy-Auth │                       │
+│                      └──────────────────────┘                       │
+│                                                                     │
+│  system-credentials.yaml ──▶ loaded at startup into system tier     │
+│  (mounted read-only via Docker volume)                              │
+└─────────────────────────────────────────────────────────────────────┘
+```
+
+### Key components
+
+- **System credential manifest** (`system-credentials.yaml`): Mounted into the container via Docker volume. Parsed at startup (YAML or JSON). Credentials enter the Resolver's **system tier** — shared across all sandbox sessions, never mutated at runtime.
+
+- **Session credentials**: Registered per sandbox session via `PUT /v1/prepare` API (with `session_id`). Stored in the Resolver's **session tier** — isolated per sandbox, no cross-session leakage. Session credentials shadow system credentials on key conflict.
+
+- **Egress MITM Proxy** (`127.0.0.1:18080`): Intercepts all outbound HTTP/HTTPS traffic from agent jobs. For HTTPS, it performs TLS interception using a per-container CA (generated fresh at startup, installed into the system trust store). The proxy:
+  1. Extracts `session_id` from the `Proxy-Authorization` header (embedded as Basic-Auth userinfo in the proxy URL).
+  2. **Proactively injects** credential headers based on domain-matching policies (e.g. `Authorization: Bearer <token>` for `api.tavily.com`).
+  3. Strips the `Proxy-Authorization` header before forwarding.
+
+- **Squid SSRF proxy** (`agent_ssrf_proxy:3128`): Upstream of the egress proxy. Enforces network-level egress restrictions (deny private networks, allow public internet).
+
+- **Per-container CA**: Generated at startup by `egressproxy.GenerateCA()`. Installed into the system trust store via `update-ca-certificates` (Dockerfile grants the non-root `dify` user write access to the necessary paths). This means **all** tools — including `apt-get`, `wget`, Java, etc. — trust the MITM proxy's TLS certificates without needing per-tool env vars.

dify-agent-runtime/go.mod

@@ -1,16 +1,20 @@
 module github.com/langgenius/dify/dify-agent-runtime
 
-go 1.26
+go 1.26.5
 
 require (
+	github.com/aws/aws-sdk-go-v2 v1.43.0
+	github.com/elazarl/goproxy v1.8.5
 	github.com/landlock-lsm/go-landlock v0.9.0
 	github.com/spf13/cobra v1.10.2
 	google.golang.org/grpc v1.82.1
 	google.golang.org/protobuf v1.36.11
+	gopkg.in/yaml.v3 v3.0.1
 	modernc.org/sqlite v1.37.1
 )
 
 require (
+	github.com/aws/smithy-go v1.27.3 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
@@ -19,9 +23,9 @@ require (
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/spf13/pflag v1.0.9 // indirect
 	golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 // indirect
-	golang.org/x/net v0.55.0 // indirect
-	golang.org/x/sys v0.45.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
+	golang.org/x/net v0.57.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect
 	kernel.org/pub/linux/libs/security/libcap/psx v1.2.77 // indirect
 	modernc.org/libc v1.65.7 // indirect