mirror of
https://github.com/openai/codex.git
synced 2026-10-30 19:18:49 +00:00
## What changed - Add `RemoteEnvironmentConfig::with_executor_credential_auth()` for Noise transport, requiring exactly one `Authorization: Bearer <credential>` header without accompanying account credentials. - Require HTTPS registry URLs except on loopback, and bypass system proxies for loopback HTTP requests. - Mark credentials as sensitive, suppress registry diagnostics that could echo them, and reject registration responses containing the credential while preserving recognized retry error codes. - Reject scoped executor credentials for Direct registration and WebSocket connections. Keep legacy authentication as the default. ## Testing Add tests for invalid credential headers, HTTPS and loopback restrictions, proxy bypass, credential echoes in registry responses, and rejection before Direct transport sends requests. GitOrigin-RevId: a427d648a0520d2e187dd40ca63268903a949f94