fix(devbox): remove default infisical secret path

Author: altaywtf

docs/devbox.md

@@ -38,8 +38,8 @@ or 1Password service-account refresh stacks.
 
 For services and agents:
 
-1. Create or choose the correct Infisical project, environment, and folder path
-   for the runtime.
+1. Create or choose the correct Infisical project and environment for the
+   runtime.
 2. Create a machine identity in the same Infisical organization and grant it
    access to that project/path.
 3. Configure the devbox user once with
@@ -69,16 +69,17 @@ One-time setup:
 ```
 
 The helper prompts locally for the Infisical domain, project ID, environment,
-default secret path, machine identity client ID, and machine identity client
+machine identity name, machine identity client ID, and machine identity client
 secret. Humans should source the initial client ID/secret from their secret
 manager, usually 1Password or Infisical, and enter them locally. Do not paste
 them into agent chat.
 
 It writes non-secret selectors to `~/.config/uinaf/devbox.env` and machine
 credentials to `~/.config/uinaf/infisical-machine.env`. Both files must be mode
 `0600`. The helper refuses to continue when the Infisical CLI has an
-authenticated human `user` session, mints a machine token, and verifies the
-machine identity can read the configured secret path before writing config.
+authenticated human `user` session and verifies the machine identity can mint a
+token before writing config. It does not persist a default secret path; paths
+belong at the command boundary.
 
 Routine command-boundary use:
 
@@ -89,7 +90,7 @@ Routine command-boundary use:
     --token "$INFISICAL_TOKEN" \
     --projectId "$INFISICAL_PROJECT_ID" \
     --env "$INFISICAL_ENV" \
-    --path "$INFISICAL_SECRET_PATH" \
+    --path "/example-devbox/openclaw-env" \
     --format dotenv \
     --output-file "$HOME/.openclaw/.env" \
     --silent
@@ -159,10 +160,12 @@ Before treating a devbox as agent-ready:
 4. Verify runtime dotenv files are owner-only and are not workspace symlinks.
 
 `./scripts/verify/devbox-services.sh` checks the Infisical CLI, local
-runtime-file boundary, owner-only config modes, and machine identity access. A
-missing persistent machine identity config fails by default. Set
-`INFISICAL_MACHINE_AUTH_REQUIRED=0` only for repo-local smoke checks on a
-machine that is not acting as an agent devbox.
+runtime-file boundary, owner-only config modes, and machine identity token
+minting. Set `INFISICAL_SECRET_PATH=/some/path` only when you want that check
+to also prove access to a specific command-boundary path. A missing persistent
+machine identity config fails by default. Set `INFISICAL_MACHINE_AUTH_REQUIRED=0`
+only for repo-local smoke checks on a machine that is not acting as an agent
+devbox.
 
 ## Secret Topology
 
@@ -214,7 +217,6 @@ PROCESS_COMPOSE_SOCKET="/Users/example/.local/run/process-compose.sock"
 INFISICAL_DOMAIN=https://eu.infisical.com/api
 INFISICAL_PROJECT_ID=example-project-id
 INFISICAL_ENV=dev
-INFISICAL_SECRET_PATH=/example-devbox/ssh
 ```
 
 The file should be mode `0600`. Persistent machine credentials live separately

scripts/secrets/configure-infisical-devbox.sh

@@ -14,7 +14,7 @@ Usage:
   scripts/secrets/configure-infisical-devbox.sh
 
 Prompts for Infisical machine identity settings, verifies the machine identity
-can read the selected secret path, then writes owner-only local config files.
+can mint a token, then writes owner-only local config files.
 USAGE
 }
 
@@ -109,7 +109,6 @@ write_devbox_config() {
     quote_assignment INFISICAL_DOMAIN "$infisical_domain"
     quote_assignment INFISICAL_PROJECT_ID "$infisical_project_id"
     quote_assignment INFISICAL_ENV "$infisical_env"
-    quote_assignment INFISICAL_SECRET_PATH "$infisical_secret_path"
   } >> "$tmp_path"
 }
 
@@ -147,33 +146,21 @@ printf 'Configuring Infisical devbox machine auth. Press Enter to accept default
 infisical_domain="$(prompt_value "Infisical domain" "${INFISICAL_DOMAIN:-https://eu.infisical.com/api}")"
 infisical_project_id="$(prompt_value "Infisical project ID" "${INFISICAL_PROJECT_ID:-}")"
 infisical_env="$(prompt_value "Infisical env" "${INFISICAL_ENV:-dev}")"
-infisical_secret_path="$(prompt_value "Default secret path" "${INFISICAL_SECRET_PATH:-}")"
 infisical_machine_identity="$(prompt_value "Machine identity name" "${INFISICAL_MACHINE_IDENTITY:-}")"
 infisical_client_id="$(prompt_value "Machine identity client ID" "${INFISICAL_CLIENT_ID:-}")"
 infisical_client_secret="$(prompt_secret "Machine identity client secret")"
 
 [ -n "$infisical_domain" ] || fail "Infisical domain is required"
 [ -n "$infisical_project_id" ] || fail "Infisical project ID is required"
 [ -n "$infisical_env" ] || fail "Infisical env is required"
-[ -n "$infisical_secret_path" ] || fail "Default secret path is required"
 [ -n "$infisical_client_id" ] || fail "Machine identity client ID is required"
 [ -n "$infisical_client_secret" ] || fail "Machine identity client secret is required"
 
 check_no_human_infisical_session "$infisical_domain"
 
-infisical_token="$(infisical_mint_machine_token "$infisical_domain" "$infisical_client_id" "$infisical_client_secret")" \
+infisical_mint_machine_token "$infisical_domain" "$infisical_client_id" "$infisical_client_secret" >/dev/null \
   || fail "could not mint Infisical machine identity token"
 
-infisical export \
-  --domain "$infisical_domain" \
-  --token "$infisical_token" \
-  --projectId "$infisical_project_id" \
-  --env "$infisical_env" \
-  --path "$infisical_secret_path" \
-  --format json \
-  --silent >/dev/null \
-  || fail "machine identity cannot read $infisical_secret_path"
-
 config_dir="$(dirname "$config_path")"
 machine_config_dir="$(dirname "$machine_config_path")"
 mkdir -p "$config_dir"
@@ -183,7 +170,7 @@ chmod 700 "$machine_config_dir"
 
 tmp_config="$(mktemp "${TMPDIR:-/tmp}/uinaf-devbox-env.XXXXXX")"
 tmp_machine="$(mktemp "${TMPDIR:-/tmp}/uinaf-infisical-machine.XXXXXX")"
-trap 'rm -f "$tmp_config" "$tmp_machine"; unset infisical_token infisical_client_secret' EXIT
+trap 'rm -f "$tmp_config" "$tmp_machine"; unset infisical_client_secret' EXIT
 
 write_devbox_config "$tmp_config" "$config_path"
 chmod 600 "$tmp_config"
@@ -195,8 +182,8 @@ chmod 600 "$tmp_machine"
 mv "$tmp_machine" "$machine_config_path"
 chmod 600 "$machine_config_path"
 
-unset infisical_token infisical_client_secret
+unset infisical_client_secret
 
 printf 'wrote %s\n' "$config_path"
 printf 'wrote %s\n' "$machine_config_path"
-printf 'verified machine identity access to %s\n' "$infisical_secret_path"
+printf 'verified machine identity token mint\n'

scripts/secrets/infisical-devbox-run.sh

@@ -95,7 +95,6 @@ fi
 : "${INFISICAL_ENV:=dev}"
 
 [ -n "${INFISICAL_PROJECT_ID:-}" ] || fail "INFISICAL_PROJECT_ID is required in $config_path"
-[ -n "${INFISICAL_SECRET_PATH:-}" ] || fail "INFISICAL_SECRET_PATH is required in $config_path"
 [ -n "${INFISICAL_CLIENT_ID:-}" ] || fail "INFISICAL_CLIENT_ID is required in $machine_config_path"
 [ -n "${INFISICAL_CLIENT_SECRET:-}" ] || fail "INFISICAL_CLIENT_SECRET is required in $machine_config_path"
 
@@ -113,7 +112,6 @@ env \
   INFISICAL_DOMAIN="$INFISICAL_DOMAIN" \
   INFISICAL_PROJECT_ID="$INFISICAL_PROJECT_ID" \
   INFISICAL_ENV="$INFISICAL_ENV" \
-  INFISICAL_SECRET_PATH="$INFISICAL_SECRET_PATH" \
   "$@"
 status=$?
 set -e

scripts/verify/devbox-services.sh

@@ -171,17 +171,24 @@ check_infisical() {
     return
   fi
 
-  if [ -z "$infisical_project_id" ] || [ -z "$infisical_secret_path" ]; then
+  if [ -z "$infisical_project_id" ]; then
     if [ "$machine_auth_required" = "1" ]; then
-      fail "missing INFISICAL_PROJECT_ID or INFISICAL_SECRET_PATH"
+      fail "missing INFISICAL_PROJECT_ID"
     fi
-    printf 'warn skipped Infisical machine identity path proof; set INFISICAL_PROJECT_ID and INFISICAL_SECRET_PATH in %s\n' "$config_path"
+    printf 'warn skipped Infisical machine identity token proof; set INFISICAL_PROJECT_ID in %s\n' "$config_path"
     return
   fi
 
   access_token="$(infisical_mint_machine_token "$infisical_domain" "$INFISICAL_CLIENT_ID" "$INFISICAL_CLIENT_SECRET")" \
     || fail "could not mint Infisical machine identity token"
 
+  printf 'ok Infisical machine identity can mint token for project %s\n' "$infisical_project_id"
+
+  if [ -z "$infisical_secret_path" ]; then
+    printf 'warn skipped Infisical path proof; set INFISICAL_SECRET_PATH for a command-boundary path check\n'
+    return
+  fi
+
   infisical export \
     --domain "$infisical_domain" \
     --token "$access_token" \

scripts/verify/infisical-devbox-auth.sh

@@ -155,7 +155,6 @@ write_file_600 "$custom_config" \
   "INFISICAL_DOMAIN=https://eu.infisical.com/api" \
   "INFISICAL_PROJECT_ID=custom-project" \
   "INFISICAL_ENV=dev" \
-  "INFISICAL_SECRET_PATH=/custom/path" \
   "PROCESS_COMPOSE_ENABLED=0"
 write_file_600 "$machine_config" \
   "INFISICAL_CLIENT_ID=file-client" \
@@ -169,7 +168,7 @@ runner_output="$(
   INFISICAL_MACHINE_CONFIG="$machine_config" \
     "$repo_root/scripts/secrets/infisical-devbox-run.sh" -- sh -c 'printf "%s|%s|%s\n" "$INFISICAL_PROJECT_ID" "$INFISICAL_SECRET_PATH" "${INFISICAL_CLIENT_ID-unset}"'
 )"
-[ "$runner_output" = "custom-project|/custom/path|unset" ] \
+[ "$runner_output" = "custom-project||unset" ] \
   || fail "runner did not honor DEVBOX_CONFIG and strip client credentials: $runner_output"
 printf 'ok runner honors DEVBOX_CONFIG and strips client credentials\n'
 
@@ -252,11 +251,25 @@ required_happy_output="$(
   INFISICAL_FAKE_LOG="$fake_log" \
     "$repo_root/scripts/verify/devbox-services.sh"
 )"
-assert_contains "$required_happy_output" "Infisical machine identity can read /custom/path"
+assert_contains "$required_happy_output" "Infisical machine identity can mint token for project custom-project"
 fake_log_output="$(cat "$fake_log")"
 assert_contains "$fake_log_output" "login client-id=file-client client-secret=file-secret"
+printf 'ok devbox verifier proves machine token mint in required mode\n'
+
+: > "$fake_log"
+path_check_output="$(
+  HOME="$tmp_dir/home" \
+  PATH="$fake_bin:$PATH" \
+  DEVBOX_CONFIG="$custom_config" \
+  INFISICAL_MACHINE_CONFIG="$machine_config" \
+  INFISICAL_SECRET_PATH=/custom/path \
+  INFISICAL_FAKE_LOG="$fake_log" \
+    "$repo_root/scripts/verify/devbox-services.sh"
+)"
+assert_contains "$path_check_output" "Infisical machine identity can read /custom/path"
+fake_log_output="$(cat "$fake_log")"
 assert_contains "$fake_log_output" "export token=fake-token projectId=custom-project env=dev path=/custom/path"
-printf 'ok devbox verifier proves machine token export wiring in required mode\n'
+printf 'ok devbox verifier proves command-boundary path wiring when requested\n'
 
 set +e
 verify_ambient_output="$(