Files
codex/codex-rs
viyatb-oai 0003732489 Add scoped executor credential auth for remote exec-server (#54346)
## What changed

- Add `RemoteEnvironmentConfig::with_executor_credential_auth()` for Noise transport, requiring exactly one `Authorization: Bearer <credential>` header without accompanying account credentials.
- Require HTTPS registry URLs except on loopback, and bypass system proxies for loopback HTTP requests.
- Mark credentials as sensitive, suppress registry diagnostics that could echo them, and reject registration responses containing the credential while preserving recognized retry error codes.
- Reject scoped executor credentials for Direct registration and WebSocket connections. Keep legacy authentication as the default.

## Testing

Add tests for invalid credential headers, HTTPS and loopback restrictions, proxy bypass, credential echoes in registry responses, and rejection before Direct transport sends requests.

GitOrigin-RevId: a427d648a0520d2e187dd40ca63268903a949f94
2026-10-15 16:47:55 +00:00
..
…
…