Credential placeholder model breaks SDKs that validate token format before making network calls
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 38/100
- Issue type
- Feature
- Clarity
- Needs clarification
- Activity status
- Active
- Tech stack
- javascript
- Domain
- authentication, security
Research direction
Start by tracing the placeholder credential model and the L7 credential injection work referenced in issues #112, #538, and #689, then review docs/sandboxes/manage-providers.mdx. Reproduce the pre-network validation behavior in @slack/web-api and @slack/socket-mode; done should address these initialization failures while preserving the documented invariant that sandbox processes never see real credential values.
Written by the indexing model from the issue text.
Description
The placeholder credential model (openshell:resolve:env:*) assumes credentials flow through HTTP requests where the L7 proxy can intercept and substitute real values. This works well for header-based auth, URL path tokens (Telegram), query parameters, and Basic auth.
However, some SDKs validate credential format in-process before making any network call. When the process reads an env var and sees openshell:resolve:env:SLACK_BOT_TOKEN instead of a value matching the expected format (e.g., xoxb-*), the SDK rejects the credential immediately. No HTTP request is made, so the proxy never gets an opportunity to resolve the placeholder.
Concrete case
Slack's @slack/web-api validates the xoxb- prefix on bot tokens and @slack/socket-mode validates the xapp- prefix on app tokens. Both checks happen at initialization, before any network I/O. The placeholder fails validation, and the SDK either throws invalid_auth or silently skips channel initialization.
Scope
This affects any SDK or library that performs client-side credential format validation before its first network call. Slack is the first confirmed case, but the pattern is common — OAuth libraries checking token structure, AWS SDKs validating key format, etc.
Downstream impact
NemoClaw #1569 and #2085 are blocked on this. Slack is one of three messaging channels NemoClaw supports, and it is currently non-functional inside OpenShell sandboxes.
References
- The placeholder model was introduced in #112
- L7 credential injection was generalized in #538 and #689
- OpenShell provider docs state: "The agent process inside the sandbox never sees real credential values" — this invariant is the root of the conflict
- Dominant language
- Rust
- Stars
- 8.7k
- Forks
- 1.3k
- Avg merge
- 2d 7h
- Merged PRs (30d)
- 243
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from NVIDIA/OpenShell
-
area:docs
Difficulty 1/5 Under an hour Newbie friendliness 88/100
-
state:triage-needed
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
area:cli state:validated
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
state:triage-needed
Difficulty 1/5 Under an hour Newbie friendliness 90/100
-
area:build spike state:review-ready state:stale
Difficulty 2/5 Half a day Newbie friendliness 68/100
All issues in NVIDIA/OpenShell
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
kwakseongjae/auto-hwp#319 ·
-
area:cli bug filter-quality good first issue priority:medium
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
Difficulty 1/5 Under an hour Newbie friendliness 72/100
bevyengine/bevy#25861 ·
-
comp-datalake
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
ClickHouse/ClickHouse#121222 ·
-
enhancement remote
Difficulty 2/5 1-3 hours Newbie friendliness 68/100