Let agents consume request_secret via Shell (secretRef → env/stdin)

[budres]

Problem

request_secret returns a one-use secretRef, but today the only tool that accepts it is schedule_task webhook signature.secretRef.

Agents (Cursor harness via T3) naturally try to pass secretRef into Shell for things like:

• sudo / NetworkManager (nmcli connection up …)
• one-off API tokens for a single command
• git / gh auth that should not land in chat

That fails: Cursor Shell has no secretRef parameter, and T3 does not expose a secret-consuming shell/exec tool. The private paste card works, then the ref is stranded.

Desired behavior

After request_secret → { status: "saved", secretRef }, an agent should be able to run a host command with the secret injected without the model ever seeing the value, with output redaction.

Concrete sketch (name flexible):

run_with_secret({
  secretRef,
  command: "sudo -S nmcli connection up \"strkan pptp\"",
  inject: "stdin" | { "env": "SUDO_PASSWORD" } | "askpass"
})

Requirements that matter:

1. Consume the one-use secretRef the same way webhook signatures do
2. Never put the secret in argv in a way that shows up in process lists if avoidable (prefer env / stdin / SUDO_ASKPASS)
3. Redact the secret (and common encodings) from stdout/stderr before returning to the model
4. Document it in request_secret (“e.g. run_with_secret / Shell”) and orchestration instructions

Why not only webhook signatures?

Webhook signing is a narrow case. The paste-card UX is already general-purpose; agents hit the gap as soon as they need elevated host actions or short-lived credentials.

Alternatives considered

• Ask the user to run sudo … in a real terminal (works; breaks hands-off agent loops)
• NOPASSWD / polkit for specific commands (works for known commands; not a general secret path)
• Paste secrets into chat (explicitly discouraged by request_secret)

Ask

Is this direction something maintainers would approve for an Ideas → implementation PR? Happy to take a focused MCP tool first (without changing Cursor’s native Shell schema), if that’s the preferred boundary.