fix(egress): allow single-layer %2f in raw request path (npm scoped packages)

[Pangjiping]

Summary

_path_is_ambiguous() in the egress credential proxy rejected every request whose raw path contained %2f. npm scoped packages are required by the registry protocol to send /@scope%2fname on the wire, so with Credential Vault active, npm install @scope/pkg in sandboxes was returning 403 (reported in Aone workitem 84550489 for @ali/orion-claude-plugin).

Split the two concerns:

• Raw-request check (request()) — tolerate a single-layer %2f (allow_single_encoded_slash=True). Nested encodings (%252f, %252e%252e), raw backslash \, encoded backslash %5c, and dot-segments still trip the guard.
• New _path_encoded_slash_changes_binding() — re-runs binding path matching against unquote(raw_path). If the encoded slash would move the request across a credential binding boundary, the request is still rejected with 403. Legit /@scope%2fname decodes into the same binding → allowed; a crafted /api/v8/projects/123%2f..%2f456/... decodes into a different scope → rejected (also caught by the pre-existing dot-segment check).
• Post-substitution check (_apply_path_query_substitutions()) — keeps the strict semantics (allow_single_encoded_slash=False), because a %2f injected by the credential proxy itself always shifts the canonical path relative to what the client sent.

Also wire mitmscripts unit tests into egress-test.yml — the tests already existed but weren't being run in CI, so this class of regression had no signal.

Testing

• Unit tests — python -m unittest discover -s components/egress/tests → 34 passed (28 existing + 6 new)

New tests cover:

• npm scoped registry path /@scope%2fname (lowercase and uppercase %2F) receives credential injection.

• Encoded %2f that stays inside a single binding scope is allowed.

• Encoded %2f that spans two bindings (broad vs. narrow) is rejected with 403.

• Double-encoded %252f and encoded backslash %5c remain rejected.

• Integration tests

• e2e / manual verification

Breaking Changes

• None

The credential-proxy 403 semantics only change for a single-layer %2f that does not cross a binding boundary. That path previously always returned 403 and now succeeds — this is the intended fix. All other rejection paths (.., %252f, %5c, \, %2f crossing bindings, substitution introducing %2f) still return 403.

Checklist

• Linked Issue or clearly described motivation
• Added/updated docs (if needed) — behavior change is internal to credential proxy; no user-visible doc surface
• Added/updated tests (if needed)
• Security impact considered — see the "Split the two concerns" section above; the binding-consistency guard preserves the original threat model
• Backward compatibility considered

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4765a68b02

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c5893bf02f

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".