The sandbox.credentials.envVars config now supports decode: "jwt" to handle JWT tokens: the token is replaced with a structurally valid but fake JWT inside the sandbox, with real claim values masked as sentinels injected into requests.
Optional maskClaims: ["sub", "email"] masks specific string claims within the JWT, replacing each with a per-claim sentinel injected at the network layer
If the environment variable is not a valid JWT, the variable is left unprotected and a warning is logged
If maskClaims names a claim that is absent or not a string, that claim is skipped and logged
Replaces the previous extract-regex-only approach, which remains available for non-JWT values
Evidence
JWT masking handler (search for "decode \"jwt\"" or "maskClaims"). Fake token generator (search for "pnu = \"c3J0LWZha2U\"" which is the fake signature base64).
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
