Credential Masking: Regex Extract Patterns

• New extract field: a regex with a capture group 1 that identifies the credential value(s) within the file; the proxy substitutes only those captured values
• New onExtractNoMatch option controls what happens when the pattern matches nothing:
• "warn" (default) — logs a warning and leaves the file unprotected
• "deny" — degrades to full-file deny mode (file is blocked from sandbox)
• "error" — throws at initialization, preventing session start with a misconfigured entry
• New maskDuplicates option: also masks occurrences of extracted values found elsewhere in the file outside the capture groups

Example config:

{
  "credentials": {
    "files": [{
      "path": "~/.config/tool/credentials",
      "mode": "mask",
      "extract": "token=([A-Za-z0-9_-]+)",
      "onExtractNoMatch": "deny",
      "maskDuplicates": true
    }]
  }
}