[saifsmailbox98]

Description 📣

Adds an opt-in SOCKS5 door to infisical agent-vault proxy, so sandbox providers that tunnel a sandbox's traffic from outside the sandbox (E2B's bring your own proxy) can use Agent Vault. The session token goes in the SOCKS5 password, set on E2B's side, so it never enters the sandbox and the agent sets no proxy env vars.

SOCKS5 door

• --socks5-port turns it on (off by default), always over TLS, listens on all interfaces
• --socks5-tls-name: the proxy mints the port's certificate from its own CA and renews it. Or --socks5-tls-cert/--socks5-tls-key for your own (read once at start, expired cert refused)
• Login is RFC 1929, username ignored, password = session token. Invalid/revoked/expired sessions, a rejected proxy token or a failed resolve are refused at login (01 01). Passwords that aren't shaped like agv_... are refused without asking Infisical
• CONNECT only, everything else gets 0x07. After the reply the connection takes the same path as CONNECT (handleConnect's peek + MITM block moved into serveIntercepted), so policy, injection, session logs and the mid-tunnel 403 are unchanged
• 10s for the client's steps, paused while asking Infisical (its own 15s cap); 512 connection cap; per-connection recover; accept loop backs off on temporary errors like net/http
• Plain SOCKS5 sent to the TLS port logs a rate-limited warning
• Log lines from this door carry door=socks5, login refusals log the remote address and never the username

Private destinations

On the SOCKS5 door only, under the any-host policy, a host no bundle service names can't resolve to a private, loopback, link-local or similar address (cloud metadata, the proxy's own network). It's checked at dial time on the resolved IP (net.Dialer.Control), through a separate transport so it never reuses a connection the unchecked one opened. Same ranges as the backend's ipRange.ts, with zones stripped and IPv4-in-IPv6 unwrapped. --socks5-allow-private-destinations turns it off. The HTTP door is unchanged.

Other

• --listen-host to bind the HTTP port to one interface (host only, the port stays --port)
• every new flag has an INFISICAL_AGENT_VAULT_* env var, telemetry gets socks5, socks5OwnCert, socks5AllowPrivate, customListenHost
• CI now runs the Agent Vault tests in packages/cmd (they never ran before)

Companion PR (CA download API, UI and the E2B guide): Infisical/infisical#9035

Type ✨

• Bug fix
• New feature
• Improvement
• Breaking change
• Documentation

Tests 🛠️

# Here's some code block to paste some code snippets

---

• I have read the contributing guide, agreed and acknowledged the code of conduct. 📝

[infisical-review-police]

💬 Discussion in Slack: #pr-review-cli-471-feat-agent-vault-accept-socks5-over-tls-on-the-proxy

Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel.

[greptile-apps]

Confidence Score: 4/5

[High impact] The PR adds a network-facing entry point into Agent Vault’s credential-brokering path.

The required event metadata loop must be added before merging; no new behavior defect was found.

Findings

1.  Event fields skip required loop ▶

Summary

Adds optional SOCKS5 over TLS to Agent Vault, with session login, private-address checks, certificate options, and CLI settings.

• Sandbox clients can send web traffic through Agent Vault over TLS SOCKS5.
• Unmatched SOCKS5 requests cannot reach private addresses under the any-host policy.
• Operators can choose the HTTP bind host and configure the SOCKS5 listener from flags or environment variables.
• CI now runs the Agent Vault command tests in its CLI test job.

_{Reviews (4) · Last reviewed commit: "fix(agent-vault): count SOCKS5 connectio..." · Reviewed by Greptile}

[claude]

Beyond the inline findings, I also checked whether the SOCKS5 private-destination guard in packages/agentvault/dial_guard.go could be bypassed. The upstream transport sets Proxy: nil, so the net.Dialer.Control hook sees the real resolved destination, not an intermediate proxy. Zone stripping and Unmap() stop IPv4-mapped and zoned IPv6 forms from slipping past the ranges.

Extended reasoning...

The change adds an internet-facing SOCKS5-over-TLS listener whose login is the session token, a dial-time block on private destinations, and new CLI flags, about 1.8k lines across packages/agentvault and packages/cmd. The dial guard is the main defense against SSRF on this listener, so I checked that no environment proxy sits between it and the real destination, and none does.

Findings marked 🟡 are optional suggestions and need no follow-up push.

[linear]

AGE2-176

AGE2-279