feat(secrets): authenticated egress substitution proxy with destination binding (#123216)

* feat(secrets): add authenticated egress substitution proxy

* feat(secrets): bind egress substitution to hosts

* ci(codeql): classify egress proxy bypass tunnel in network boundary query

* refactor(proxy-capture): use the canonical IP parser instead of node:net

* fix(secrets): compare proxy tokens with a process-keyed MAC

.github/codeql/codeql-network-runtime-boundary-critical-quality.yml

@@ -14,6 +14,7 @@ paths:
   - src/infra/push-apns-http2.ts
   - src/infra/ssh-tunnel.ts
   - src/proxy-capture
+  - src/secrets/egress-proxy
   - extensions/codex/src/app-server/transport-websocket.ts
   - extensions/irc/src
   - extensions/qa-lab/src

.github/codeql/openclaw-boundary/queries/raw-socket-callsite-classification.ql

@@ -73,6 +73,11 @@ predicate allowedRawSocketClientCall(Expr call) {
   or
   allowedOwnerScope(call, "src/proxy-capture/proxy-server.ts", "startDebugProxyServer")
   or
+  // Bypass hosts are blind TLS tunnels for pinned clients: the proxy relays bytes it
+  // deliberately cannot read, so no secret substitution happens on this route. Every
+  // substituting route uses the managed https client, not a raw socket.
+  allowedOwnerScope(call, "src/secrets/egress-proxy/proxy-server.ts", "startSecretEgressProxyServer")
+  or
   allowedOwnerScope(call, "extensions/codex/src/app-server/transport-websocket.ts", "connectCodexAppServerUnixSocket")
   or
   allowedOwnerScope(call, "extensions/irc/src/client.ts", "connectIrcClient")