viyatb-oai 65b82cdf96 Prevent brokered credential aliases from bypassing MITM hooks (#52661) ...

## Why

A credential bound to a host with MITM hooks could also be used at an alias without hooks, allowing the proxy to inject the real credential without enforcing hook policy.

## What changed

Reject requests to unhooked aliases when their selected brokered credentials are also bound to a hooked host. Check both HTTP forwarding and MITM requests before replacing dummy credentials, returning `403` with `blocked-by-mitm-hook` for denied requests.

Use the same destination and credential-selection rules for alias checks and injection, including configured URL prefixes, safe paths, equivalent credentials, merged Basic authentication fields, and environment scope.

## Testing

Add regression coverage for built-in and configured provider aliases, IPv6 destinations, credential selection, and unrelated credentials. Add an agent-started proxy test that verifies credential masking and alias denial.

GitOrigin-RevId: 12be41654761cedcf87b170f7661d6566f7a864e

2026-10-09 18:04:48 +00:00

..

common

Add opt-in Guardian trust for orchestrator connector identities (#52250)

2026-10-08 20:04:38 +00:00

remote_env_windows

Bind capability roots to environment selections (#51493)

2026-10-06 22:39:32 +00:00

suite

Prevent brokered credential aliases from bypassing MITM hooks (#52661)

2026-10-09 18:04:48 +00:00

all.rs

[codex] Use expect in integration tests (#28441)

2026-06-15 21:53:47 -07:00

mcp_trace_propagation.rs

Preserve MCP request trace context across transport workers (#47212)

2026-09-22 06:47:07 +00:00

responses_headers.rs

Add capability overrides for custom model providers (#50459)

2026-10-02 23:26:27 +00:00

windows_sandbox.rs

Move Windows sandbox tests into a dedicated integration binary (#51678)

2026-10-07 12:47:04 +00:00