feat(secrets): sandbox credential placeholder registry (unwired) - #6689

Merged

henrypark133 merged 14 commits into

mainfrom

sandbox/pr1-credential-placeholder-skeleton

Jul 27, 2026

Commits on Jul 27, 2026

feat(secrets): stable placeholder registry + JIT sessions

henrypark133
and
claude
committed
604e3fe
feat(safety): detect sandbox credential placeholders

henrypark133
and
claude
committed
bdbcadb
fix(secrets): refcount JIT leases and multi-bind placeholder sessions

henrypark133
and
claude
committed
3afe3e7
fix(secrets): close JIT lease reuse race and validate placeholder charset

henrypark133
and
claude
committed
4bcc1ae
fix(secrets): stop echoing raw placeholder tokens and cap parsed length

henrypark133
and
claude
committed
c5c58d0
fix(safety): close word-boundary bypass in placeholder leak pattern

henrypark133
and
claude
committed
a36423c
fix(secrets): close concurrent-first-use race in JIT session minting

henrypark133
and
claude
committed
d24b052
fix(secrets): cap credential session expiry at creation

henrypark133
and
claude
committed
7b39800
fix(secrets): close standing-grant leak when placeholder bind fails

henrypark133
and
claude
committed
4ff93e9
fix(secrets): collapse registry to one lock, tighten docs and length check

henrypark133
and
claude
committed
10f65fa
test(safety): pin placeholder redaction preserves diagnostic context

henrypark133
and
claude
committed
a266ce3
fix(secrets): collapse session-lifecycle mutexes into one lock

henrypark133
and
claude
committed
6623ab7
refactor(secrets): split placeholder tests out, merge redundant case

henrypark133
and
claude
committed
38947f2
fix(secrets): move placeholder tests to conform to test-path convention

henrypark133
and
claude
committed
5d55225

Navigation Menu

feat(secrets): sandbox credential placeholder registry (unwired) - #6689

feat(secrets): sandbox credential placeholder registry (unwired)#6689
henrypark133 merged 14 commits into
mainfrom
sandbox/pr1-credential-placeholder-skeleton

Commits on Jul 27, 2026

feat(secrets): stable placeholder registry + JIT sessions

feat(safety): detect sandbox credential placeholders

fix(secrets): refcount JIT leases and multi-bind placeholder sessions

fix(secrets): close JIT lease reuse race and validate placeholder charset

fix(secrets): stop echoing raw placeholder tokens and cap parsed length

fix(safety): close word-boundary bypass in placeholder leak pattern

fix(secrets): close concurrent-first-use race in JIT session minting

fix(secrets): cap credential session expiry at creation

fix(secrets): close standing-grant leak when placeholder bind fails

fix(secrets): collapse registry to one lock, tighten docs and length check

test(safety): pin placeholder redaction preserves diagnostic context

fix(secrets): collapse session-lifecycle mutexes into one lock

refactor(secrets): split placeholder tests out, merge redundant case

fix(secrets): move placeholder tests to conform to test-path convention