Starstruk Logo MarkStarstruk

v0.8.0

Infisical/agent-vaultv0.8.0Apr 19, 2026by github-actions[bot]

AI Summary

This release introduces a KEK/DEK key-wrapping architecture for security, TLS wrapping for the MITM proxy, and passthrough authentication. It also adds HTTPS traffic routing through the MITM proxy by default and support for PaaS deployments via PORT and FLY_APP_NAME environment variables.

Key Highlights

  • Implemented KEK/DEK key-wrapping architecture for enhanced security
  • Added TLS-wrap for MITM proxy listener
  • Added passthrough auth type for allowlisting without credential injection
  • Route vault run child HTTPS through MITM proxy by default
  • Support for PORT env var and FLY_APP_NAME for PaaS deployments

New Features

  • KEK/DEK key-wrapping architecture
  • TLS wrapping for MITM proxy
  • Passthrough authentication type
  • Default HTTPS routing through MITM proxy
  • PORT and FLY_APP_NAME support for PaaS

Full Release Notes

## Changelog
* 191d0ddc078ea946195af4badc3d9355047f7aad docs+test: address passthrough PR #76 review feedback (#77)
* 61eb370615c56577dfab66ea782074c1cfee8cda feat(sdk): add containerConfig for transparent MITM proxy (#80)
* 97dc49ba01ef4c77b8cf51ed652e23ba21d2d8d3 feat: KEK/DEK key-wrapping architecture (#83)
* a4cd92c51ba3d3e0167ee0cac1e20878622f5ba8 feat: SDK container config, NODE_USE_ENV_PROXY, and README quickstart restructure (#81)
* 9b96b80b2cc96a3df81706bf4585b134e69776c6 feat: TLS-wrap the MITM proxy listener (#85)
* c740c57ae31b5b0f31910eac4394520e2e8c0fc1 feat: add passthrough auth type for allowlisting without credential injection (#76)
* a00f184d3100d8855ebf39c31d96cf1d9a4f3f3f feat: route `vault run` child HTTPS through the MITM proxy by default (#75)
* 089394d6d08bcb25539055ca4fed5cccd939b5d0 feat: simplify agent skills to MITM-only + add help hints to proxy errors (#79)
* 4b8265edb1eece2e5a2ed3e8c9a9da492220ff2d feat: support PORT env var and FLY_APP_NAME for PaaS deployments (#82)
* 7462901772986fee0e81fff725ebbe5e397b7fd7 fix: delete CA directory during owner reset (#84)

## Verify

```bash
# Verify checksum
sha256sum --check checksums.txt

# Verify signature (requires cosign)
cosign verify-blob \
  --bundle checksums.txt.bundle \
  --certificate-identity-regexp "github.com/Infisical/agent-vault" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  checksums.txt
```