Winston Howes ed4ca07ba6 Handle credential provider source remapping across config layers (#44241) ...

## What changed

- Let higher-priority providers in `features.network_proxy.credentials` displace lower-priority providers with overlapping `env` sources, including in profiles. Preserve inherited settings when providers swap sources, and compare environment names case-insensitively on Windows.
- Preserve provider definitions across ordered batch remaps and persist displaced-provider removals without overwriting unrelated sibling updates.
- Validate remapped providers using the credential broker's compilation rules before persisting writes, while allowing incomplete drafts and explicit deletions.
- Omit displaced providers from config origins and report writes overridden by another provider's source ownership.
- Build trusted credential-broker configuration before merging managed layers for project discovery, preserving remapped providers' environment protections.

## Testing

Add unit and config RPC regression tests for source precedence, source swaps, ordered edits, concurrent sibling updates, atomic rejection of invalid remaps, persistence, and override reporting. Add a macOS managed-config regression test for remapped provider bindings during project discovery.

GitOrigin-RevId: b7d402727acf4e5b0f25946db1cf18811f5e2679

2026-09-09 17:45:17 +00:00

..

connection_lifecycle

Close active network proxy connections on teardown (#43884)

2026-09-08 18:40:17 +00:00

credential_broker

Handle credential provider source remapping across config layers (#44241)

2026-09-09 17:45:17 +00:00

proxy

Enforce environment network policies for remote execution (#39980)

2026-08-21 17:29:41 +00:00

attribution_tests.rs

Remove the network proxy config wrapper (#31767)

2026-07-09 17:33:37 +01:00

attribution.rs

Add configurable credential providers to the network proxy (#44056)

2026-09-09 04:59:01 +00:00

authorization_path_tests.rs

Harden network proxy MITM authorization (#37211)

2026-08-06 03:57:10 +00:00

authorization_path.rs

Harden network proxy MITM authorization (#37211)

2026-08-06 03:57:10 +00:00

brokered_tunnel_tests.rs

Support credential brokering in plaintext HTTP tunnels (#44089)

2026-09-09 07:06:12 +00:00

brokered_tunnel.rs

Support credential brokering in plaintext HTTP tunnels (#44089)

2026-09-09 07:06:12 +00:00

certs.rs

Honor CARGO_HTTP_CAINFO in managed proxy environments (#34478)

2026-07-21 07:12:28 +00:00

config.rs

Support configured credential providers across shell snapshots (#44072)

2026-09-09 06:04:59 +00:00

connect_policy.rs

Allow explicitly permitted loopback proxy targets (#34603)

2026-07-21 19:50:11 +00:00

credential_broker_tests.rs

Refactor credential-broker tunnel protocol detection (#44077)

2026-09-09 06:26:36 +00:00

credential_broker.rs

Support credential brokering in plaintext HTTP tunnels (#44089)

2026-09-09 07:06:12 +00:00

environment_policy.rs

Enforce environment network policies for remote execution (#39980)

2026-08-21 17:29:41 +00:00

http_proxy.rs

Support credential brokering in plaintext HTTP tunnels (#44089)

2026-09-09 07:06:12 +00:00

lib.rs

Refactor credential-broker tunnel protocol detection (#44077)

2026-09-09 06:26:36 +00:00

mitm_hook.rs

Harden network proxy MITM authorization (#37211)

2026-08-06 03:57:10 +00:00

mitm_tests.rs

Support credential brokering in plaintext HTTP tunnels (#44089)

2026-09-09 07:06:12 +00:00

mitm.rs

Support credential brokering in plaintext HTTP tunnels (#44089)

2026-09-09 07:06:12 +00:00

native_certs.rs

Honor startup custom CA bundles with managed MITM (#29014)

2026-06-22 14:16:48 -07:00

network_policy.rs

Handle pending network reviews after process completion (#42746)

2026-09-04 12:08:02 +00:00

policy.rs

Add configurable credential providers to the network proxy (#44056)

2026-09-09 04:59:01 +00:00

process_log_metadata.rs

Add attributed exec process lifecycle telemetry (#42373)

2026-09-02 21:58:58 +00:00

proxy.rs

Support configured credential providers across shell snapshots (#44072)

2026-09-09 06:04:59 +00:00

reasons.rs

Wire MITM hooks into runtime enforcement (#20659)

2026-05-20 14:08:14 -07:00

remote_config_tests.rs

Handle exec-server network policy requests in the client (#35359)

2026-07-25 16:03:00 +00:00

remote_config.rs

Handle exec-server network policy requests in the client (#35359)

2026-07-25 16:03:00 +00:00

request_cancellation.rs

Handle pending network reviews after process completion (#42746)

2026-09-04 12:08:02 +00:00

request_disconnect_tests.rs

Report network disconnects during approval (#39284)

2026-08-18 21:30:45 +00:00

request_disconnect.rs

Report network disconnects during approval (#39284)

2026-08-18 21:30:45 +00:00

responses.rs

Wire MITM hooks into runtime enforcement (#20659)

2026-05-20 14:08:14 -07:00

runtime.rs

Support credential brokering in plaintext HTTP tunnels (#44089)

2026-09-09 07:06:12 +00:00

socks5.rs

Support credential brokering in plaintext HTTP tunnels (#44089)

2026-09-09 07:06:12 +00:00

state.rs

Harden network proxy credential brokerage (#38049)

2026-08-11 18:21:34 +00:00

upstream_tests.rs

Allow explicitly permitted loopback proxy targets (#34603)

2026-07-21 19:50:11 +00:00

upstream.rs

Allow explicitly permitted loopback proxy targets (#34603)

2026-07-21 19:50:11 +00:00

windows_proxy_ingress_tests.rs

Route Windows sandbox proxy traffic by restricting SID (#34613)

2026-07-21 21:06:04 +00:00

windows_proxy_ingress.rs

Route Windows sandbox proxy traffic by restricting SID (#34613)

2026-07-21 21:06:04 +00:00

windows_tcp_attribution_tests.rs

Route Windows sandbox proxy traffic by restricting SID (#34613)

2026-07-21 21:06:04 +00:00

windows_tcp_attribution.rs

Route Windows sandbox proxy traffic by restricting SID (#34613)

2026-07-21 21:06:04 +00:00