viyatb-oai 7d33d0d93f Enable credential masking for remote exec-server commands (#54309) ...

## What changed

Negotiate executor support for `credential_masking` and enable built-in credential brokerage in executor-local network proxies. Supported non-login Bash commands on Linux and macOS receive credential placeholders, with real credentials injected by the proxy for matching destinations.

Retain credential mappings across process launches within the same executor session, scoped by environment, conversation, and broker configuration. Keep credentials and destination context on the executor.

Fall back to unmasked execution for unsupported shells or shell startup, and for configured credential providers. Emit warnings when masking is unavailable, preserving shell profiles and snapshots.

## Testing

Add coverage for capability negotiation, fallback behavior, mapping reuse and isolation, proxy credential injection, and keeping executor credentials out of model-visible request history. Test warning, removal, and rejection modes for credentials left unmasked during preparation.

GitOrigin-RevId: f64e916a5de8350fa0d289d3440ec29761accd75

2026-10-15 14:41:16 +00:00

..

context_snapshot

Add an optional JSON transcript format for Guardian (#51465)

2026-10-06 19:30:57 +00:00

apps_test_server.rs

Keep discovered Apps tools available during startup recovery (#53672)

2026-10-13 13:59:41 +00:00

BUILD.bazel

Unify context snapshots and group requests into windows (#44932)

2026-09-11 22:55:38 +00:00

Cargo.toml

Classify MCP auth and approval outcomes in analytics (#45716)

2026-09-15 15:03:29 +00:00

code_mode_host.rs

Add opt-in gRPC over stdio for the code-mode host (#52723)

2026-10-09 23:26:34 +00:00

context_snapshot.rs

Add opt-in Guardian trust for orchestrator connector identities (#52250)

2026-10-08 20:04:38 +00:00

exec_server.rs

Enable credential masking for remote exec-server commands (#54309)

2026-10-15 14:41:16 +00:00

hooks.rs

Add keyed shell environment policy filters (#34590)

2026-07-21 18:23:26 +00:00

lib.rs

Add opt-in gRPC over stdio for the code-mode host (#52723)

2026-10-09 23:26:34 +00:00

process.rs

feat: close unified_exec at end of turn (#8052)

2025-12-16 12:16:43 +00:00

responses.rs

Add opt-in output token replay for OpenAI requests (#52742)

2026-10-10 01:25:00 +00:00

startup_tests.rs

Harden core test fixture startup assertions (#41194)

2026-08-27 19:58:09 +00:00

startup.rs

Harden core test fixture startup assertions (#41194)

2026-08-27 19:58:09 +00:00

streaming_sse.rs

Preserve Guardian parent response IDs across sampling requests (#45441)

2026-09-14 15:13:13 +00:00

test_codex_exec.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00

test_codex.rs

Bind capability roots to environment selections (#51493)

2026-10-06 22:39:32 +00:00

test_environment_tests.rs

test: branch on target OS instead of runner flavor (#29712)

2026-06-23 14:27:13 -07:00

test_environment.rs

test: branch on target OS instead of runner flavor (#29712)

2026-06-23 14:27:13 -07:00

tracing.rs

feat(core, tracing): create turn spans over websockets (#14632)

2026-03-19 03:41:06 +00:00