Summary

Credential rules can now check what a request sends, not only where it goes. The design is the same as the MCP argument conditions from #78.

[[secrets.MAIL_KEY.rules]]
effect = "allow"
hosts = ["api.mail.example"]
methods = ["POST"]
paths = ["/v1/messages"]
body = { send = false, to = ["support@acme.com"] }
allow_fields = ["subject", "text"]

• body on [[secrets.*.rules]] and [[personal_credentials.*.rules]]. It uses the same conditions as MCP arguments: a single value, a list (one of), { min, max }, and { absent = true }. When a matching rule has conditions, the local proxy buffers the body (at most 1 MiB) and checks it strictly (JSON object, no encoding, no duplicate keys) before injecting the credential. It then forwards the exact bytes. An unreadable body fails closed. Requests whose rules have no conditions still stream unchanged.
• allow_fields on HTTP rules and MCP tool_rules. It is strict mode: no fields other than those named are allowed. Allow rules only.
• Denials name the rule and field, never values. The 403 reads like (rule 1: unlisted body.bcc). Audit reasons are allow_condition_failed, unlisted_field, deny_condition_matched and body_unreadable, and work with agent logs --reason.
• [[policy_tests]] accept a JSON body. agent policy test output is now colored.
• Other commands:
  • agent validate rejects malformed conditions and allow_fields on deny rules, and warns about moot or best-effort rules.
  • agent explain reports body-dependent decisions as conditional.
  • agent mcp tools shows allow_fields and warns about undeclared fields.
• --remote sends body and allow_fields to the control plane.
• AgentHttpRule now rejects unknown fields.
• Policy fingerprints now include body and argument conditions. The fingerprint changes once for profiles with HTTP rules or MCP tool rules.
• Docs: docs/agent-profiles/request-conditions.md, plus runnable examples for httpbin and the GitHub REST API.

Depends on

radim10/backend-monorepo#314 must be deployed before this is released. An older backend drops body and allow_fields, so with --remote a conditioned allow would apply to every request.

Release note

Profiles using body or allow_fields require CLI 0.22.0 or newer. Older CLIs ignore these keys and would treat the rules as unconditional allows.

Tests

cargo test: 664 + 25 + 33 pass. Verified live:

• the local proxy against httpbin and the GitHub REST API;
• --remote on staging against GitHub. Create with label, comment and rename were allowed. Extra label, assignees and close were refused with the right field.