Trace Commons: instance-wide enrollment, per-user profiles, and trace inspection

crates/ironclaw_host_runtime/src/egress/sanitize.rs

@@ -9,6 +9,14 @@ pub(super) fn validate_runtime_request(
     request: &RuntimeHttpEgressRequest,
     leak_detector: &LeakDetector,
 ) -> Result<(), RuntimeHttpEgressError> {
+    // Outbound credentials must flow through the staged credential-injection
+    // path (`credential_injections`), never as raw runtime/model-supplied
+    // headers or `user:pass@` URLs — for ALL runtimes, including FirstParty.
+    // `builtin.http` is FirstParty but takes model-supplied headers, so
+    // exempting FirstParty here would let the model smuggle Authorization /
+    // Cookie / x-api-key headers to allowlisted hosts. Host-minted credentials
+    // (e.g. the Trace Commons bearer) are injected AFTER this guard via the
+    // stager + `apply_credential_injections`, so they are not present here.
     if let Some((_name, _)) = request
         .headers
         .iter()
@@ -206,6 +214,72 @@ pub(super) fn sanitize_runtime_response(
 #[cfg(test)]
 mod tests {
     use super::*;
+    use ironclaw_host_api::{
+        CapabilityId, InvocationId, NetworkMethod, NetworkPolicy, ResourceScope, RuntimeKind,
+        UserId,
+    };
+
+    fn request_with_header(runtime: RuntimeKind, header: (&str, &str)) -> RuntimeHttpEgressRequest {
+        RuntimeHttpEgressRequest {
+            runtime,
+            scope: ResourceScope::local_default(UserId::new("user1").unwrap(), InvocationId::new())
+                .unwrap(),
+            capability_id: CapabilityId::new("builtin.http").unwrap(),
+            method: NetworkMethod::Get,
+            url: "https://api.example.test/v1/run".to_string(),
+            headers: vec![(header.0.to_string(), header.1.to_string())],
+            body: Vec::new(),
+            network_policy: NetworkPolicy {
+                allowed_targets: vec![],
+                deny_private_ip_ranges: true,
+                max_egress_bytes: Some(4096),
+            },
+            credential_injections: vec![],
+            response_body_limit: Some(4096),
+            save_body_to: None,
+            timeout_ms: None,
+        }
+    }
+
+    #[test]
+    fn validate_runtime_request_denies_sensitive_header_for_first_party_runtime() {
+        // Regression: FirstParty must NOT be exempt from the sensitive-header
+        // guard. `builtin.http` is FirstParty but takes model-supplied headers,
+        // so exempting it would let the model smuggle Authorization to an
+        // allowlisted host. Host-minted credentials flow through the staged
+        // credential-injection path instead, after this guard.
+        let detector = LeakDetector::new();
+        let request = request_with_header(
+            RuntimeKind::FirstParty,
+            ("authorization", "Bearer attacker"),
+        );
+
+        let error = validate_runtime_request(&request, &detector)
+            .expect_err("first-party sensitive header must be denied");
+
+        assert!(matches!(
+            error,
+            RuntimeHttpEgressError::Request { ref reason, .. }
+                if reason == "sensitive_header_denied"
+        ));
+    }
+
+    #[test]
+    fn validate_runtime_request_denies_manual_url_credentials_for_first_party_runtime() {
+        let detector = LeakDetector::new();
+        let mut request =
+            request_with_header(RuntimeKind::FirstParty, ("accept", "application/json"));
+        request.url = "https://user:pass@api.example.test/v1/run".to_string();
+
+        let error = validate_runtime_request(&request, &detector)
+            .expect_err("first-party manual url credentials must be denied");
+
+        assert!(matches!(
+            error,
+            RuntimeHttpEgressError::Request { ref reason, .. }
+                if reason == "manual_credentials_denied"
+        ));
+    }
 
     #[test]
     fn scan_decoded_url_for_leaks_allows_unparseable_encoded_url() {

crates/ironclaw_host_runtime/src/first_party.rs

@@ -76,6 +76,7 @@ impl FirstPartyCapabilityRequest {
                 filesystem: Arc::new(ironclaw_filesystem::InMemoryBackend::new()),
                 runtime_http_egress,
                 tool_call_http_egress: None,
+                runtime_secret_material_stager: None,
                 process: Arc::new(crate::LocalHostProcessPort::new()),
                 secret_store: None,
                 audit_sink: None,

crates/ironclaw_host_runtime/src/first_party_tools/memory.rs

@@ -566,6 +566,7 @@ mod tests {
                 filesystem: Arc::new(InMemoryBackend::new()),
                 runtime_http_egress: None,
                 tool_call_http_egress: None,
+                runtime_secret_material_stager: None,
                 process: Arc::new(LocalHostProcessPort::new()),
                 secret_store: None,
                 audit_sink: None,

crates/ironclaw_host_runtime/src/first_party_tools/mod.rs

@@ -61,9 +61,9 @@ pub use skill_management::{
 pub use spawn_subagent::SPAWN_SUBAGENT_CAPABILITY_ID;
 pub use time::TIME_CAPABILITY_ID;
 pub use trace_commons::{
-    TRACE_COMMONS_CREDITS_CAPABILITY_ID, TRACE_COMMONS_ONBOARD_CAPABILITY_ID,
-    TRACE_COMMONS_PROFILE_SET_CAPABILITY_ID, TRACE_COMMONS_PROFILE_TOKEN_CAPABILITY_ID,
-    TRACE_COMMONS_STATUS_CAPABILITY_ID,
+    TRACE_COMMONS_ACCOUNT_LOGIN_LINK_CAPABILITY_ID, TRACE_COMMONS_CREDITS_CAPABILITY_ID,
+    TRACE_COMMONS_ONBOARD_CAPABILITY_ID, TRACE_COMMONS_PROFILE_SET_CAPABILITY_ID,
+    TRACE_COMMONS_PROFILE_TOKEN_CAPABILITY_ID, TRACE_COMMONS_STATUS_CAPABILITY_ID,
 };
 #[cfg(any(test, feature = "test-support"))]
 pub use trigger_management::TriggerManagementClock;
@@ -181,6 +181,7 @@ pub fn builtin_first_party_package() -> Result<ExtensionPackage, ExtensionError>
                     trace_commons::credits_manifest()?,
                     trace_commons::profile_token_manifest()?,
                     trace_commons::profile_set_manifest()?,
+                    trace_commons::account_login_link_manifest()?,
                     profile_set::manifest()?,
                 ];
                 capabilities.extend(memory::manifests()?);
@@ -419,6 +420,10 @@ fn builtin_first_party_base_registry() -> Result<FirstPartyCapabilityRegistry, H
         CapabilityId::new(TRACE_COMMONS_PROFILE_SET_CAPABILITY_ID)?,
         handler.clone(),
     );
+    registry.insert_handler(
+        CapabilityId::new(TRACE_COMMONS_ACCOUNT_LOGIN_LINK_CAPABILITY_ID)?,
+        handler.clone(),
+    );
     registry.insert_handler(CapabilityId::new(PROFILE_SET_CAPABILITY_ID)?, handler);
     skill_management::insert_handlers(&mut registry)?;
     Ok(registry)
@@ -538,6 +543,10 @@ impl FirstPartyCapabilityHandler for BuiltinFirstPartyTools {
             TRACE_COMMONS_PROFILE_SET_CAPABILITY_ID => {
                 (trace_commons::dispatch_profile_set(&request).await?, None)
             }
+            TRACE_COMMONS_ACCOUNT_LOGIN_LINK_CAPABILITY_ID => (
+                trace_commons::dispatch_account_login_link(&request).await?,
+                None,
+            ),
             capability_id => {
                 let Some(metadata) = coding_capability_metadata(capability_id) else {
                     return Err(FirstPartyCapabilityError::new(

crates/ironclaw_host_runtime/src/first_party_tools/profile_set.rs

@@ -127,6 +127,7 @@ mod tests {
                 filesystem: Arc::new(InMemoryBackend::new()),
                 runtime_http_egress: None,
                 tool_call_http_egress: None,
+                runtime_secret_material_stager: None,
                 process: Arc::new(LocalHostProcessPort::new()),
                 secret_store: None,
                 audit_sink: None,

crates/ironclaw_host_runtime/src/first_party_tools/schemas.rs

@@ -226,6 +226,16 @@ pub(crate) fn resolve_builtin_input_schema_ref(reference: &str) -> Option<Value>
             },
             "additionalProperties": false
         }),
+        "schemas/builtin/trace_commons-account_login_link.input.v1.json" => json!({
+            "type": "object",
+            "properties": {
+                "confirmed": {
+                    "type": "boolean",
+                    "description": "Must be true only after the user explicitly asked to open a Trace Commons account/profile login link in this conversation (default: false)"
+                }
+            },
+            "additionalProperties": false
+        }),
         "schemas/builtin/trace_commons-profile_set.input.v1.json" => json!({
             "type": "object",
             "properties": {