Enable credential masking for remote exec-server commands (#54309)

## What changed

Negotiate executor support for `credential_masking` and enable built-in credential brokerage in executor-local network proxies. Supported non-login Bash commands on Linux and macOS receive credential placeholders, with real credentials injected by the proxy for matching destinations.

Retain credential mappings across process launches within the same executor session, scoped by environment, conversation, and broker configuration. Keep credentials and destination context on the executor.

Fall back to unmasked execution for unsupported shells or shell startup, and for configured credential providers. Emit warnings when masking is unavailable, preserving shell profiles and snapshots.

## Testing

Add coverage for capability negotiation, fallback behavior, mapping reuse and isolation, proxy credential injection, and keeping executor credentials out of model-visible request history. Test warning, removal, and rejection modes for credentials left unmasked during preparation.

GitOrigin-RevId: f64e916a5de8350fa0d289d3440ec29761accd75

codex-rs/exec-server-protocol/src/protocol.rs

@@ -13,6 +13,7 @@ use codex_protocol::ThreadId;
 use codex_protocol::capabilities::SelectedCapabilityRoot;
 use codex_protocol::config_types::ShellEnvironmentPolicyInherit;
 use codex_shell_command::shell_detect::DetectedShell;
+use codex_shell_command::shell_detect::ShellType;
 use codex_utils_path_uri::PathUri;
 use serde::Deserialize;
 use serde::Serialize;
@@ -151,6 +152,9 @@ pub struct EnvironmentCapabilities {
     /// Whether `exec` accepts instructions for launching an executor-local network proxy.
     #[serde(default)]
     pub network_proxy_launch: bool,
+    /// Whether the selected shell can mask executor environment credentials.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub credential_masking: bool,
     /// Whether capability discovery applies the filesystem sandbox sent with each root.
     #[serde(default)]
     pub capability_discovery_sandbox: bool,
@@ -260,8 +264,11 @@ impl EnvironmentInfo {
         };
         let temp_dir = normalize_temp_path(std::env::temp_dir().into_os_string());
 
+        let shell = codex_shell_command::shell_detect::default_user_shell();
+        let credential_masking = cfg!(any(target_os = "linux", target_os = "macos"))
+            && shell.shell_type == ShellType::Bash;
         Self {
-            shell: codex_shell_command::shell_detect::default_user_shell().into(),
+            shell: shell.into(),
             executor_version: unknown_executor_version(),
             provider_id: None,
             cwd: cwd.and_then(|cwd| PathUri::from_host_native_path(cwd).ok()),
@@ -278,6 +285,7 @@ impl EnvironmentInfo {
             temp_dir,
             capabilities: EnvironmentCapabilities {
                 network_proxy_launch: true,
+                credential_masking,
                 capability_discovery_sandbox: true,
                 capability_discovery_v2: true,
                 environment_config_read: true,
@@ -1499,6 +1507,7 @@ mod tests {
             capabilities,
             EnvironmentCapabilities {
                 network_proxy_launch: true,
+                credential_masking: false,
                 capability_discovery_sandbox: true,
                 capability_discovery_v2: false,
                 environment_config_read: false,