Files
codex/codex-rs
Winston Howes 634ebc1865 Support credential brokering in plaintext HTTP tunnels (#44089)
## Why

Configured HTTP credential destinations need dummy credentials translated inside `CONNECT` and SOCKS5 tunnels, where credential interception previously detected only TLS.

## What changed

- Detect plaintext HTTP for configured credential destinations and proxy requests with URL-scoped credential substitution.
- Keep requests bound to the authorized tunnel destination, rejecting mismatched authorities and nested `CONNECT` requests.
- Support HTTP/2 clients and preserve HTTP upgrades, including `h2c`, and opaque traffic in full mode.
- Enforce limited-mode method restrictions on plaintext HTTP and reject upgrades and opaque traffic.

## Testing

Add end-to-end tests for both tunnel transports covering credential URL scope, request bodies, HTTP/2, destination mismatches, upgrades, lossless opaque forwarding, and limited-mode enforcement.

GitOrigin-RevId: 89262c996ea4ee156c628f9ed8e72b52504b2f6b
2026-09-09 07:06:12 +00:00
..
2026-07-29 13:53:15 +00:00
…
2026-07-29 13:53:15 +00:00
…