openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-10-20 17:38:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

Support remote credential masking with Zsh shell snapshots (#54432)

Browse Source 
## Why

Remote credential masking previously supported only Bash commands without login startup or shell snapshots, leaving Zsh commands with unmasked credentials.

## What changed

- Enable masking for Zsh login commands using shell snapshots on Linux and macOS.
- Capture trusted startup profiles per launch, bind the credential broker to the resulting environment, and replace credentials and supported aliases with placeholders before snapshot replay.
- Preserve explicit environment overrides, credential unsets, and launcher-managed proxy settings during replay.
- Warn and fall back to unmasked startup when a snapshot cannot safely replay credentials; stop execution if protected snapshot restoration fails.

## Testing

Extend remote execution tests for inherited and profile-defined credentials, overrides, destination changes, and unsupported-profile fallback. Add a Zsh scenario snapshot showing a credential placeholder in command output.

GitOrigin-RevId: 83193d6cbc05f3deb0d6d0b9ae80974b353ce900
This commit is contained in:
viyatb-oai
2026-10-15 22:25:58 +00:00
committed by copyberry
parent aff92080f2
commit 1c5ca2a979
18 changed files with 895 additions and 177 deletions
Download Patch File Download Diff File Expand all files Collapse all files
codex-rs/exec-server-protocol/src/protocol.rs
+1 -1
View File
@@ -266,7 +266,7 @@ impl EnvironmentInfo {
let shell = codex_shell_command::shell_detect::default_user_shell();
let credential_masking = cfg!(any(target_os = "linux", target_os = "macos"))
&& shell.shell_type == ShellType::Bash;
&& matches!(shell.shell_type, ShellType::Bash | ShellType::Zsh);
Self {
shell: shell.into(),
executor_version: unknown_executor_version(),