Winston Howes eea28321ad Harden network proxy credential brokerage (#38049) ...

## What changed

- Bind OpenAI credentials to `api.openai.com` and trusted HTTPS hosts derived from local configuration or `OPENAI_BASE_URL`.
- Support GitHub credentials for `uploads.github.com` and translate Bearer, token, and Basic authorization forms while preserving their schemes.
- Apply credential broker configuration changes without restarting the proxy, including clearing affected credential mappings when trusted OpenAI hosts change.
- Restore brokered credentials in environments and command arguments that intentionally leave managed networking, while preserving user overrides and handling Windows environment keys case-insensitively.
- Keep local credential brokerage out of remote proxy launch configuration and avoid launching a remote proxy when brokerage alone enabled the local proxy.

## Testing

Added coverage for trusted host binding, authorization translation, live reconfiguration, credential restoration, managed-disabled behavior, remote launch configuration, and Windows environment key matching.

GitOrigin-RevId: 8d8bd3aaf6e581849cb622b2faec62cee4e13e52

2026-08-11 18:21:34 +00:00

..

credential_broker

Harden network proxy credential brokerage (#38049)

2026-08-11 18:21:34 +00:00

proxy

Enable network policy callbacks for remote exec (#35652)

2026-07-27 18:07:31 +00:00

attribution_tests.rs

Remove the network proxy config wrapper (#31767)

2026-07-09 17:33:37 +01:00

attribution.rs

fix: attribut network requests to the exact exec on linux (#29697)

2026-07-06 14:51:34 -07:00

authorization_path_tests.rs

Harden network proxy MITM authorization (#37211)

2026-08-06 03:57:10 +00:00

authorization_path.rs

Harden network proxy MITM authorization (#37211)

2026-08-06 03:57:10 +00:00

certs.rs

Honor CARGO_HTTP_CAINFO in managed proxy environments (#34478)

2026-07-21 07:12:28 +00:00

config.rs

Harden network proxy credential brokerage (#38049)

2026-08-11 18:21:34 +00:00

connect_policy.rs

Allow explicitly permitted loopback proxy targets (#34603)

2026-07-21 19:50:11 +00:00

credential_broker_tests.rs

Harden network proxy credential brokerage (#38049)

2026-08-11 18:21:34 +00:00

credential_broker.rs

Harden network proxy credential brokerage (#38049)

2026-08-11 18:21:34 +00:00

http_proxy.rs

Harden network proxy MITM authorization (#37211)

2026-08-06 03:57:10 +00:00

lib.rs

Harden network proxy MITM authorization (#37211)

2026-08-06 03:57:10 +00:00

mitm_hook.rs

Harden network proxy MITM authorization (#37211)

2026-08-06 03:57:10 +00:00

mitm_tests.rs

Harden network proxy MITM authorization (#37211)

2026-08-06 03:57:10 +00:00

mitm.rs

Allow explicitly permitted loopback proxy targets (#34603)

2026-07-21 19:50:11 +00:00

native_certs.rs

Honor startup custom CA bundles with managed MITM (#29014)

2026-06-22 14:16:48 -07:00

network_policy.rs

Stabilize network policy event capture in concurrent tests (#36779)

2026-08-03 18:25:28 +00:00

policy.rs

fix(network-proxy): normalize network proxy host matching (#19995)

2026-04-28 15:50:00 -07:00

proxy.rs

Harden network proxy credential brokerage (#38049)

2026-08-11 18:21:34 +00:00

reasons.rs

Wire MITM hooks into runtime enforcement (#20659)

2026-05-20 14:08:14 -07:00

remote_config_tests.rs

Handle exec-server network policy requests in the client (#35359)

2026-07-25 16:03:00 +00:00

remote_config.rs

Handle exec-server network policy requests in the client (#35359)

2026-07-25 16:03:00 +00:00

responses.rs

Wire MITM hooks into runtime enforcement (#20659)

2026-05-20 14:08:14 -07:00

runtime.rs

Harden network proxy credential brokerage (#38049)

2026-08-11 18:21:34 +00:00

socks5.rs

Route Windows sandbox proxy traffic by restricting SID (#34613)

2026-07-21 21:06:04 +00:00

state.rs

Harden network proxy credential brokerage (#38049)

2026-08-11 18:21:34 +00:00

upstream_tests.rs

Allow explicitly permitted loopback proxy targets (#34603)

2026-07-21 19:50:11 +00:00

upstream.rs

Allow explicitly permitted loopback proxy targets (#34603)

2026-07-21 19:50:11 +00:00

windows_proxy_ingress_tests.rs

Route Windows sandbox proxy traffic by restricting SID (#34613)

2026-07-21 21:06:04 +00:00

windows_proxy_ingress.rs

Route Windows sandbox proxy traffic by restricting SID (#34613)

2026-07-21 21:06:04 +00:00

windows_tcp_attribution_tests.rs

Route Windows sandbox proxy traffic by restricting SID (#34613)

2026-07-21 21:06:04 +00:00

windows_tcp_attribution.rs

Route Windows sandbox proxy traffic by restricting SID (#34613)

2026-07-21 21:06:04 +00:00