Retrospective coverage for the October 23, 2026 issue.
A coding assistant may need a command to use a credential without needing the credential in its conversation. Those are different permissions. In the Codex Rust source snapshot associated with version 0.164.0, available by October 23, 2026, a remote-executor integration test makes that distinction concrete. Its useful lesson is narrower than “agents cannot see secrets”: model-visible output and command access need separate scrutiny.
The pinned test puts a synthetic credential in a remote executor’s environment and enables unified_exec and credential_masking. In the masking cases, it asks the shell to print the credential variable. The assertions require the follow-up model request to contain a different value with the same length and credential prefix. They also check both complete request bodies for the original credential before snapshot normalization. This specifies a boundary at the transcript, rather than merely hiding a value in a displayed test snapshot; the supplied source is not evidence of a successful test run.
The fallback cases expose the limit. For the configured-provider login-shell case and the executor-startup case using BASH_ENV, the test expects masking to be unavailable. Instead of printing the secret, its command compares the environment value with a fixture file and prints “unmasked fallback.” The login-shell case also checks a warning that the command will run with unmasked credentials. Consequently, the absence of the secret from those request bodies does not establish that fallback output would be sanitized.
Consider a hypothetical developer investigating a failed vendor integration. A credential-bearing command could return useful diagnostics without putting its credential into the assistant’s context. That separation could reduce one exposure route while preserving the workflow. But a changed shell startup could invalidate the masking assumption; treating the feature flag alone as the security boundary would miss the distinction this test explicitly exercises.
The product opportunity is therefore selective disclosure, not credential-free execution. Keeping secret text out of a model transcript can be valuable even while the command retains access to it. That is also the boundary of the evidence here: these tests do not establish protection against credential misuse, arbitrary output transformations or every remote-shell configuration.
