changelog.d/5045-credential-allowed-hosts.md

Rama main · réplica de lectura del repositorio original.

- ⚠️ **Behaviour change: credentials can carry human-approved hosts (#5045).** `crewship credential hosts` sets them, and only a signed-in OWNER or ADMIN can change them. A host-bound credential reaches a run only when the crew is restricted and its egress allowlist covers every host. Otherwise it is withheld on the delivery paths listed in the credentials guide and reported by `agent credential-readiness`, including on free-network crews. Routine http steps compare the real target host instead. This does not stop an agent holding a delivered token from sending it to any host the crew allowlist permits. Changes are audited, a tightened list drops the sidecar copy within about a minute and removes `/secrets` files from running crews that no longer qualify (environment variables already in a running process are not recalled), and the check also covers the workspace-default endpoint, the managed connector key, the routine LLM key and code-link tokens.