fix: Keep the deploy token out of the agent harness container

[maciaszczykm]

The agent-harness container no longer holds the deploy token. Its Console calls and the agent's AI traffic go through the MCP server sidecar, which adds the token.

• /plural/ext/gql: forwards only the harness's own operations. Run-scoped operations must target this run. UpdateAgentMessage and CreateAgentMessageOutput take message IDs, so Console only checks that the message's run belongs to the cluster. Requests are rebuilt from the checked query and variables. Authenticates with Token <deploy token> and sets the Plural-Client and Plural-Agent-Run headers. The sidecar's token proxies drop Set-Cookie from upstream responses.
• /plural/ext/ai/: forwards model calls to the Console AI proxy. Agents get the sidecar URL and a placeholder key. The streaming OpenAI proxy also swaps in the token.
• scmCreds/pluralCreds move to a new GetAgentRunCredentials query, used only by agent-bootstrap and mcpserver.
• PLRL_DEPLOY_TOKEN moves to a separate <run>-plural Secret, loaded only by agent-bootstrap and mcpserver. Existing run secrets drop it, except while a pod built before this change still reads it. Pods force shareProcessNamespace=false.
• Harness drops --console-url/--deploy-token.
• mcpserver drops --openai-upstream-url/PLRL_OPENAI_UPSTREAM_URL. The streaming proxy now sends the deploy token, so a custom upstream would leak it. It always targets <console>/ext/ai. Nothing we have sets it.

Upgrade the operator and agent-harness images together: the old harness needs the deploy token in its own container.

Test Plan

Test environment: https://console.plrl-dev-aws.onplural.sh/
Test image tag: sha-4e95753

Checklist

• I have added a meaningful title and summary to convey the impact of this PR to a user.
• If required, I have updated the Plural documentation accordingly.
• I have added tests to cover my changes.
• I have deployed the agent to a test environment and verified that it works as expected (required only when changing agent code).

Plural Flow: console

[linear]

PROD-5297

[soffi-ai]

Soffi AI Summary

This PR hardens the security posture of the AI agent harness by removing the Plural deploy token from the agent-harness container entirely. Previously, the harness held the deploy token directly, which was a security risk. Now, all Console API calls and AI (LLM) traffic from the agent harness are routed through the MCP server sidecar, which owns the token and injects it into outbound requests.

Key changes:

• A new /plural/ext/gql sidecar proxy forwards only allowlisted GraphQL operations from the harness to Console, authenticating with Token <deploy_token> and adding Plural-Client/Plural-Agent-Run headers. Requests are rebuilt from validated query + variables to prevent injection.
• A new /plural/ext/ai/ sidecar proxy forwards agent LLM traffic to the Console AI proxy, injecting the deploy token so agents only need a placeholder key.
• SCM and Plural credentials (scmCreds/pluralCreds) are split out of the AgentRunFragment into a dedicated GetAgentRunCredentials query, consumed only by agent-bootstrap and mcpserver (the privileged sidecar components).
• PLRL_DEPLOY_TOKEN moves to a separate <run>-plural Secret, mounted only by agent-bootstrap and mcpserver. Existing run secrets drop the token to avoid leakage to old pods.
• The --console-url/--deploy-token flags are removed from the harness CLI, and --openai-upstream-url/PLRL_OPENAI_UPSTREAM_URL are removed from the MCP server (the streaming proxy always targets the sidecar's ext/ai endpoint to prevent token leakage to custom upstreams).
• shareProcessNamespace is forced to false on agent run pods.
• Upstream Set-Cookie headers are dropped in token proxies to avoid credential leakage.
• A fix for a data race in the console ext proxy tests and a fix to prevent run secrets from colliding across runs are also included.

---

Updated: 2026-10-16 08:29 UTC

Deploy in Soffi

[michaeljguarino]

so i think the agents could still figure this out. What I think we should do is:

1. Have a gh action secret that bakes into both images (and maybe sha's by the hour of build time to salt the secret)
2. use that to auth into the mcp server, which then replaces it with an actual plural token

[maciaszczykm]

@greptileai

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no blocking issues remain from this review.

Summary

Keeps the deploy token in the MCP sidecar and bootstrap container. The harness sends Console and AI requests through the sidecar.

• Bootstrap and the sidecar fetch run credentials separately.
• The harness runs without loading the deploy token.
• Console calls go through a sidecar that checks each operation.
• Agent model calls use the sidecar instead of holding the deploy token.

_{Reviews (3) · Last reviewed commit: "drop upstream cookies in the openai stre..." · Reviewed by Greptile}

[maciaszczykm]

@greptileai

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​golang.org/​x/​tools@​v0.52.0

View full report