feat: profile secrets and templates

[stempler]

Summary

Profiles can now ship credentialed tool configuration. A profile carries a templates/ tree with ${secret:name}/${var:name} placeholders (e.g. a Maven ~/.m2/settings.xml with static proxies/mirrors plus per-user repo auth); secrets resolve on the host from the user's own ~/.config/code-vm/secrets.yaml (a host command like gopass show …, or a literal), variables from config.yaml. Rendered files are pushed agent-owned 0600 into the guest home — only at code-vm start, code-vm profile apply, and boot-causing invocations.

Design: docs/superpowers/specs/2026-08-20-profile-secrets-design.md
Plan: docs/superpowers/plans/2026-08-20-profile-secrets.md

Trust model

The predecessor mechanism was removed because it resolved host commands from an agent-authored workspace file. This design keeps that class closed:

• Profiles only declare secret/var names with an inert suggest: hint. Nothing a profile ships ever executes on the host — the hint is display-only, offered as a copy-paste snippet the user must adopt into their own secrets.yaml.
• Only the user's secrets.yaml executes anything (command:), and it lives in the same mount-guarded, host-trusted tree as config.yaml.
• A mapped secret is readable by the agent (tools read their configs as the agent) — and therefore by every active profile's hook. code-vm secrets and profile add/list surface which secrets a profile declares; profile add prints the trust warning. Exfiltration stays bounded by the egress allowlist and the proxy log.
• suggest/description strings are validated at load to single-line printable text — control chars, C1, and Unicode format/bidi-override characters (Trojan Source, CVE-2021-42574) are rejected, so a bundle can't conceal a different command in the snippet a user pastes.

Delivery

Rendered secrets never travel via mode: data (which persists in lima.yaml) or the world-readable guest profile tree, and root never writes into the agent home. A new install-user-file.sh relays each staged file through a root:AGENT_GID 0640 tmpfs drop to an agent-identity install — the same posture as profile-file installs. Git-identity seeding was migrated onto this relay, closing its former root-into-home write.

New surface

• code-vm secrets — lists declared secrets/vars across active profiles with mapped/unmapped status (names only, never values) and ready-to-paste snippets for unmapped ones.
• secrets.yaml (0600) and vars: in config.yaml.
• templates/ in profile bundles; ${secret:…}/${var:…} placeholders (all other ${…} passes through).

Testing

Unit suites extended across profile, config, session, cli. Full VM integration suite: 117 PASS / 0 FAIL on the branch head — secret/var substitution, 0600 agent-ownership, rotation via profile apply, unmapped-secret failure carrying the snippet, ${env.…} passthrough, and the pre-existing "no workspace-authored credentials" guards all green.

Notes

• Resolution never runs on a plain invocation against a running VM (no pinentry storms); a command needing interactive pinentry/tty is not supported.
• Guest-script changes (the relay) reach a VM on its next start; a VM booted from a pre-branch binary is given an actionable "restart to upgrade" error.
• Rotation: rotate at the source, then restart or code-vm profile apply.

🤖 Generated with Claude Code

[Copilot]

Warning

• Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Pull request overview

Adds host-resolved profile secrets and variables, rendered into guest-home configuration templates.

Changes:

• Adds profile template declarations, rendering, validation, and CLI integration.
• Introduces an agent-owned secure file relay.
• Extends documentation and automated coverage.

Reviewed changes

Copilot reviewed 30 out of 30 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
README.md	Documents credentials and templates.
test-vm-sandbox.sh	Adds VM integration coverage.
internal/session/userfiles.go	Implements user-file delivery.
internal/session/userfiles_test.go	Tests file delivery.
internal/session/stage.go	Extracts shared staging logic.
internal/session/gitidentity.go	Migrates Git identity delivery.
internal/session/gitidentity_test.go	Updates Git identity tests.
internal/profile/template.go	Implements rendering and resolution.
internal/profile/template_test.go	Tests template behavior.
internal/profile/profile.go	Adds template/declaration loading and validation.
internal/profile/profile_test.go	Tests profile validation.
internal/guest/files/scripts/install-user-file.sh	Adds the guest relay.
internal/guest/embed_test.go	Verifies relay embedding.
internal/config/config.go	Adds template variables.
internal/config/config_test.go	Tests variable validation.
internal/cli/start.go	Integrates rendering with startup.
internal/cli/start_test.go	Updates startup tests.
internal/cli/shell.go	Pushes templates after boot.
internal/cli/root.go	Registers the secrets command.
internal/cli/recreate.go	Integrates templates with recreation.
internal/cli/profile.go	Adds profile secret warnings and application.
internal/cli/profile_test.go	Extends profile CLI tests.
internal/cli/mount.go	Refreshes templates after restart.
internal/cli/secrets.go	Excluded from automated review.
internal/config/secrets.go	Excluded from automated review.
internal/cli/secrets_test.go	Excluded from automated review.
internal/config/secrets_test.go	Excluded from automated review.
internal/cli/secrets_push_test.go	Excluded from automated review.
docs/superpowers/plans/2026-08-20-profile-secrets.md	Excluded from automated review.
docs/superpowers/specs/2026-08-20-profile-secrets-design.md	Excluded from automated review.

Files excluded by content exclusion policy (7)

• docs/superpowers/plans/2026-08-20-profile-secrets.md
• docs/superpowers/specs/2026-08-20-profile-secrets-design.md
• internal/cli/secrets.go
• internal/cli/secrets_push_test.go
• internal/cli/secrets_test.go
• internal/config/secrets.go
• internal/config/secrets_test.go

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Warning

• Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Pull request overview

Copilot reviewed 33 out of 33 changed files in this pull request and generated no new comments.

Files excluded by content exclusion policy (7)

• docs/superpowers/plans/2026-08-20-profile-secrets.md
• docs/superpowers/specs/2026-08-20-profile-secrets-design.md
• internal/cli/secrets.go
• internal/cli/secrets_push_test.go
• internal/cli/secrets_test.go
• internal/config/secrets.go
• internal/config/secrets_test.go

Suppressed comments (5)

internal/cli/shell.go:68

• This second status check introduces a TOCTOU gap. If the first check observes Running and the VM stops before ensureRunning checks again, this invocation boots it with rendered == nil, so the required secret resolution and template push are skipped. Use one status decision for both pre-boot resolution and startup (for example, pass the observed status into the startup helper).

	started, err := ensureRunning(ctx, cl, c, profiles)

internal/session/stage.go:67

• A failed or cancelled limactl copy may already have created a partial file at staged, but this path returns before PushUserFile can register its deferred cleanup. For rendered templates, that can leave credential bytes in the guest staging directory indefinitely. Attempt the same independent best-effort cleanup before returning the copy error.

	if err := d.Client.Copy(ctx, tmp.Name(), staged); err != nil {
		return "", err

test-vm-sandbox.sh:633

• The integration assertion never verifies that profile apply exits nonzero. Because this script does not use set -e, an implementation that prints the snippet but succeeds still reaches the grep and passes this test. Branch on the assignment's exit status as well as checking the captured message.
  README.md:310
• This claim is broader than the trust model and contradicts the profile hooks documented above, which do execute profile-provided code in the guest. The security guarantee is specifically that these display strings cannot trigger host execution; state that scope explicitly so readers do not treat profiles as inert.

`description` and `suggest` are inert display strings: a profile can never
make anything execute. Values come only from the user's own mapping:

README.md:138

• templates is a directory in the bundle, not a profile.yaml key. The colon notation suggests a YAML section and conflicts with the templates/ tree shown below.

- Through a profile's `templates:` (see [Credentials](#credentials) under

[stempler]

Addressed all five suppressed comments from the latest review (pushed acf27c9..ff065d9; full VM integration suite 117/0):

• shell.go status TOCTOU (cc68b67): runDefault now takes a single cl.Status observation and passes it into a new ensureRunningWithStatus, so the resolve-gate and the boot decision key off the same read — closing the window where a VM stopping mid-invocation could boot with no templates rendered. start/mount/recreate keep the unchanged ensureRunning wrapper.
• stage.go partial-file leak (ed9bcc8): a failed/cancelled limactl copy could leave partial credential bytes in the guest staging dir before PushUserFile's deferred cleanup registered; stageFile now runs the same best-effort independent-context rm -f on Copy error.
• Suite exit-code assertion (ff065d9): the unmapped-secret check now requires a nonzero exit as well as the snippet, so a "print but succeed" implementation can no longer pass (the suite has no set -e).
• README "inert" overclaim (ff065d9): scoped the guarantee to host execution and made explicit that profile hooks deliberately run guest-side as the agent, so the sentence no longer contradicts the hooks documentation.
• README templates: notation (ff065d9): corrected to the templates/ directory form.