Winston Howes a548463b78 Handle copied credentials in the broker and shell snapshots (#44038) ...

## Why

Shell startup can copy a credential into another variable and unset its original source. These aliases need credential brokering without losing source restrictions or mistaking ordinary shell content for credentials.

## What changed

- Discover supported GitHub and OpenAI credentials embedded in environment values, even without their canonical variables. Preserve source ownership so unbound enterprise tokens cannot acquire a default host binding.
- Redact unregistered supported credentials during text virtualization, distinguish adjacent credentials, and avoid matching unrelated provider prefixes and common hashed paths.
- Expose helpers for checking allowed credential sources and restoring known dummy credentials in trusted text for fail-open execution.
- Render allowed credential aliases as snapshot exports and replace known credential values in shell state, preserving exported functions and credential-shaped function names.

## Testing

Add regression coverage for copied aliases, enterprise host binding, source filtering, adjacent tokens, path false positives, and dummy restoration. Add a Bash snapshot test that preserves exported functions while replacing credentials in heredoc content.

GitOrigin-RevId: f1c3d531405a96ac6bfa3882a11b74643fa6f123

2026-09-09 03:44:58 +00:00

..

src

Handle copied credentials in the broker and shell snapshots (#44038)

2026-09-09 03:44:58 +00:00

BUILD.bazel

Add a fail-closed Tree-sitter PowerShell lowerer (#39213)

2026-08-18 14:59:43 +00:00

Cargo.toml

Move shell snapshot tests into shell-command (#39480)

2026-08-19 12:56:08 +00:00