What probably matters to youSection of the release
What
When AWS credentials are masked inside the sandbox, the MITM proxy now recognises SigV4 requests, resolves the sentinel access key to the real key pair, and re-signs the request before forwarding it.
Details
New AWS key-pair registry (getAwsPairRegistry) populated from the configured environment variables.
The TLS-terminating proxy receives planSigv4 and maxSigv4ResignBodyBytes, so re-signing is bounded by a body-size limit.
Streaming, presigned and sigv4a variants cannot be re-signed and default to deny; setting credentials.sigv4.<kind> to "passthrough" is the escape hatch.
A request using a masked credential with no x-amz-date header cannot be re-signed and is refused with an explicit message.
A warning fires if only one of the access-key/secret pair is masked.
Active only when sandbox credentials config is present. Sandbox exec also forwards gitSafeDirectories.
Evidence
maxSigv4ResignBodyBytes, AWS SigV4 request uses a masked credential but carries no x-amz-date header; the proxy cannot re-sign it.
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
