## What changed
- Add `body_secret_substitution` actions to version 2 MITM configuration, replacing exact opaque placeholders with secrets from environment variables or files within the matching hook's scope.
- Bound body size, expansion, replacement count, and search work. Reject overlapping matches, compressed payloads, trailers, and supplied payload-integrity headers.
- Recompute `Content-Length` and substitute before SigV4 signing so signatures cover the transmitted body.
## Testing
Add coverage for markers split across chunks, expansion limits, invalid payloads, overlapping bindings, secret redaction, and search limits. Add a TLS forwarding test that verifies hook scope and independently checks the signature of the substituted body.
GitOrigin-RevId: fa95c9ae0c8fc8f695e03c0e87a0a4875d8418fd
## What changed
- Expose `aws_sigv4` actions in version 2 MITM permissions configuration and the config schema, rejecting multiple signing actions per hook.
- Give local managed commands placeholder AWS credentials for the selected signing pair, and mask configured credentials in environment values and protected shell snapshots.
- Set `AWS_CA_BUNDLE` to the managed proxy CA bundle when unset, and require `features.credential_masking` for local AWS signing hooks.
- Validate placeholders against every configured signing pair to prevent overlap with real credentials.
## Testing
Extend configuration, signing, and TLS forwarding tests to cover action resolution, invalid signing configuration, credential masking, CA trust, snapshot protection, and exclusion of local AWS defaults from remote environments.
GitOrigin-RevId: 81dfdea30ebde74829882b38891ea41e9737058a
## What changed
Add a test-only MITM CA constructor and local TLS origin fixtures to exercise AWS SigV4 forwarding:
- Check `aoss` payload hashes and credential replacement for GET and POST requests, while preserving unsigned requests and requests using another access key.
- Verify rejection of unsupported HTTP/1.1 framing and signing headers, and check the forwarded body, payload hash, and signed header presence at an HTTP/2 origin.
- Verify that draining signed request bodies releases buffering capacity before response headers arrive, allowing a ninth request to complete while eight responses remain pending.
GitOrigin-RevId: 4da0a77baace31486e77ad97d9581ec9f51bb34e
viyatb-oai