Your agent needs a stand-in, not the password: a surrogate-token proxy in Node.js

Meta's Muse gives its agent a stand-in token and swaps the real credential in at the network boundary. After two October incidents around that agent, here is how to build the same boundary for your own stack in a single Node.js file with no dependencies.