Codex routes agent secrets through a proxy, not a shell

Codex's sandbox now hands its own agent fake credentials. A cluster of pull requests merged September 9 adds credential_providers to the tool's network proxy. The sandboxed process gets a generated dummy secret, and the proxy substitutes the real one at the wire, per the credential-broker PR.

The stakes are what happens after a leak, not whether one occurs. Shell snapshots, logs, and anything else the agent's process can read now contain a placeholder string instead of an API key or token, so a replayed snapshot exposes a dummy value, not a working credential.

Substitution only fires for schemes, hosts, ports and path prefixes the environment explicitly authorizes, and both the credentials and the destination history are scoped per environment. A companion change extends that substitution into plaintext HTTP tunneled through CONNECT and SOCKS5, closing a gap where interception previously worked only on TLS traffic. It also rejects mismatched authorities and nested CONNECT requests, and snapshot redaction strips the dummy values before a shell session gets saved for replay.

Worth separating this from Codex's Touch ID prompt, which authorizes a call. This is a different layer. The agent's shell process never holds a working credential at all. There's no secret sitting in memory or in a log for a compromised sandbox to grab. It doesn't stop a request from firing if the destination is on the approved list, it stops the agent from being able to hand that credential to something else.