swastik-oai 9552906b2b Protect the guardian decisions API key from environment forwarding (#50019) ...

## What changed

Add `CODEX_GUARDIAN_DECISIONS_API_KEY` to the non-inheritable environment variables and the HTTP header environment denylist. Case-insensitive filtering removes it from child process environments, including explicit shell policy and command overrides, and rejects its use through `http/request` header `value_env_var`.

## Testing

Extend regression coverage for inherited and overridden variables, mixed-case names, and HTTP header rejection before any network request is sent.

GitOrigin-RevId: 1adeef814fdccb2d6c77dd68f7a5dfcec0b41cc6

2026-10-01 15:57:53 +00:00

..

tests

Support trusted headers for remote exec WebSockets (#42606)

2026-09-03 20:01:07 +00:00

accepted_tests.rs

Support host-accepted exec-server WebSockets (#39786)

2026-08-20 19:33:48 +00:00

accepted.rs

Honor network policy in remote control and recover remote execution (#47410)

2026-09-23 00:48:53 +00:00

connection_failure.rs

Add renewable EMA HTTP authentication and credential versioning (#49987)

2026-10-01 13:57:48 +00:00

http_client.rs

Decouple exec-server HTTP from reqwest types (#35059)

2026-07-24 00:53:05 +00:00

http_response_body_stream.rs

Add renewable EMA HTTP authentication and credential versioning (#49987)

2026-10-01 13:57:48 +00:00

network_policy_audit.rs

Route executor policy audits through log-only telemetry (#38800)

2026-08-15 19:34:50 +00:00

route_aware_http_client.rs

Protect the guardian decisions API key from environment forwarding (#50019)

2026-10-01 15:57:53 +00:00

rpc_http_client.rs

Resolve selected capability roots without starting executors (#31581)

2026-07-09 11:17:05 +01:00