What
Credential file entries used to accept only deny; the settings schema now takes an enum of deny and mask, where masked files are shown to sandboxed commands as a sentinel-substituted copy and the host proxy swaps sentinel for the real secret on egress.
Details
- new sibling keys:
extract(a regex whose capture group 1 is the secret, so .netrc, JSON and YAML files still parse),onExtractNoMatch(warnis the default and fails open,denyfails closed,erroraborts sandbox setup),maskDuplicates, andinjectHosts(defaults to network.allowedDomains) - config validation rejects
maskon a directory path and rejects anextractregex with no capturing group - the sandbox config builder was rewritten for this and now warns on empty injectHosts and on mask entries that degrade to deny
- the schema states mask currently degrades to deny on macOS and Windows
Evidence
extract must contain at least one capturing group —
Strings lifted out of the shipped bundle, so the claim above can be checked against them.