Implements end-to-end proxy egress isolation with address-family enforcement and closes four real IP-leak paths surfaced by the proxy subsystem audit.
IPv6-only egress:
- Detect proxy family (IPv6/IPv4 literal, or per-account auto/ipv4/ipv6 directive) and pin the connect family (family:6/4 + autoSelectFamily:false) on both ProxyAgent (proxyTls) and a custom SOCKS connector that threads socket_options.family into SocksClient (fetch-socks can't), so Happy Eyeballs cannot pick IPv4 for an IPv6-only policy.
- De-bracket IPv6-literal proxy hosts (socksOptions.host + proxyHealth tcpCheck) — fixes ENOTFOUND on [::1]-style SOCKS proxies and health checks.
- Fail-closed when an IPv6-only hostname proxy has no AAAA (PROXY_FAMILY_UNAVAILABLE) instead of leaking over v4.
- DB migration 099 adds the proxy family column; family is preserved through the resolveProxyForConnection cascade and proxies/upstreamProxy modules.
Leak fixes:
- L1: web TLS clients (grok/claude/chatgpt/perplexity) now fail-closed on proxy-resolution error instead of silently going direct (was the highest-risk asymmetry).
- L2: safeResolveProxy fail-closed by default (PROXY_FAIL_OPEN opt-out).
- L3: API-key usage/quota fetch routed through the connection proxy context.
- L4: NVIDIA validation proxy bypass (#3226) documented.
Tests: 46 TDD unit tests + BDD egress-isolation matrix. typecheck:core + eslint clean.
Gemini 'critical' SOCKS finding verified as a false positive (socks accepts proxy.host; see PR thread).
Integrated into release/v3.8.24.
- Remove internal quality-gate planning docs (PLANO-*, RELATORIO-*),
openspec/superpowers/spec working notes, and a stale fixes doc that
should not ship with the release.
- Drop the getting-started glob from the fumadocs source config.
- Add the [3.8.24] section stub to the 41 i18n CHANGELOG mirrors so the
docs-sync gate is consistent (the EN CHANGELOG already had it).
