Open-source HTTPS proxy that swaps placeholder tokens for real API keys so CLI agents never hold raw credentials — praised and picked apart