v2.10.1

Credentials beyond Authorization: Bearer

http_request's auth gains optional header and scheme. The default is unchanged — Authorization: Bearer — so every existing call behaves exactly as before.

auth: { secret: "api.acme.io", header: "X-API-Key" }   // key header, no scheme added
auth: { secret: "api.acme.io", scheme: "Basic" }       // another scheme on Authorization
auth: { secret: "api.acme.io", scheme: "" }            // a bare value, no prefix

A custom header gets no scheme unless one is asked for, because X-API-Key: Bearer <key> authenticates nothing.

Why this is a security fix rather than a convenience. Bearer-only was not the neutral simplification it looked like. For any other credential shape the only available route was headers: { "X-API-Key": "<pasted value>" } — which puts the raw credential straight back in the transcript, silently, with no error and nothing in telemetry. The fallback for the unsupported case was the insecure case. Covering the shapes is what makes the vault's guarantee hold rather than usually hold.

The header name and scheme are agent-controlled and land in the request line, so both are validated as RFC 7230 tokens: an unchecked newline there is header injection. Origin binding is unmoved and still runs first, against the resolved entry, so naming a handle rather than a slot is not a way around it.

Cookie authentication is deliberately not covered. React Native has no JS cookie API and the jar is native, so there is nothing to hand http_request in the first place. app_request and network_replay run inside the app, where the native jar attaches the session on its own, with no credential handling at all. Every surface now says so.

Verified end to end against a local server: all four placements arrive correctly, an echoed credential still comes back redacted, and the injection attempt is refused.

Docs

The shipped get_usage_guide network topic, CLAUDE.md, docs/tools.md and README.md all still described a Bearer-only tool. That mattered more than a usual doc lag here — an agent reading the old guide concludes auth cannot express a key header and reaches for headers with the raw value, which is the exact leak this release closes.

Also corrects the headers description, which promised that "an explicit Authorization wins over auth". Precedence is by matching name now, whatever that name is.