Paco Cartones e48ffd38d3 fix(authz): restrict tunnel process routes locally (#11531) ...

Validated in a combined 10-PR batch worktree off release/v3.8.51 tip.
- Focused tests: tests/unit/authz/route-guard-tunnel-processes-local-only.test.ts + tests/unit/authz/spawn-capable-prefixes-client-safe.test.ts — 6+ pass
- typecheck:core, file-size, changelog-integrity, complexity, cognitive-complexity gates — all OK
- Full-repo lint: 503 pre-existing problems confirmed identical on the pure release/v3.8.51 tip — unrelated to this diff

⚠️ base-red inherited: #11449

Thanks for closing the process-spawning tunnel routes to local-only (Hard Rule #15/#17 territory) while preserving authenticated remote read access to status endpoints.

2026-08-25 13:12:34 -03:00

..

capabilities

[defer] fix(routing): keep approximate context estimates advisory (#10162)

2026-08-20 09:49:12 -03:00

pricing

fix(cli): stop pre-filling the secrets the server owns (#11436)

2026-08-24 20:04:11 -03:00

providers

feat(search): add Xquik X search provider (#11370)

2026-08-25 01:39:39 -03:00

sidebarVisibility

Beginner UX: Essentials sidebar preset (#11286)

2026-08-23 19:08:23 -03:00

agentSkills.ts

fix(webhooks): remove 3 declared-but-never-emitted ghost events (#11050)

2026-08-21 20:54:51 -03:00

alibabaProviderRegions.ts

fix(providers): validate bailian-coding-plan against the Token Plan host (#10634)

2026-08-18 05:51:34 -03:00

antigravityClientProfile.ts

refactor(antigravity): align official clients and callable catalog (#8013)

2026-07-22 20:41:19 -03:00

apiKeyPolicyScopes.ts

Release v3.8.43 (#5609)

2026-07-02 10:47:13 -03:00

appConfig.ts

feat(auth): enforce dashboard sessions for management routes

2026-04-17 16:45:27 -03:00

batch.ts

Release v3.8.0 (#2073)

2026-05-10 00:55:06 -03:00

batchEndpoints.ts

chore: apply PR 1495 and update changelog

2026-04-21 21:12:29 -03:00

bodySize.ts

feat(settings): add request body limit setting (#1968)

2026-05-05 09:12:35 -03:00

claudeCodeClient.ts

fix(agentrouter): support Claude and Codex protocols

2026-08-01 12:18:09 -03:00

cliCompatProviders.ts

[Part 1/3]refactor(qwen): replace legacy Qwen Code and remove OAuth provider (#7866)

2026-07-20 17:53:04 -03:00

clientIdentityProfiles.ts

feat(providers): add Muse Code CLI provider preset (#9544) (#9670)

2026-08-10 20:10:42 -03:00

cliTools.ts

feat(cli-tools): add Prime Agent to the CLI agents catalog (#11166)

2026-08-23 09:47:00 -03:00

cliToolsGrokBuild.ts

feat(cli): add Grok Build CLI tool setup (~/.grok/config.toml) (#7241)

2026-07-17 10:40:41 -03:00

codexClient.ts

feat(codex): self-contained codex app-server transport (executor + provider + sign-in) (#11205)

2026-08-23 10:20:06 -03:00

colors.ts

feat(sse): Cheaper Inference provider — chat + native Responses + images, sponsor rail 2nd (#9043)

2026-07-31 07:53:41 -03:00

comboAccess.ts

fix(api-manager): allow empty combo restrictions (#10066)

2026-08-17 07:00:05 -03:00

comboConfigMode.ts

feat: add expert combo configuration mode (#1547)

2026-04-24 09:04:10 -03:00

config.ts

feat(providers): add tabitoken gateway and serve hcnsec's four protocols (#10668)

2026-08-20 20:24:42 -03:00

dashboardCsrf.ts

Release v3.8.42 (#5459)

2026-06-30 06:54:29 -03:00

endpointCategories.ts

feat(api): alias /v1/multimodal-embeddings to /v1/embeddings (#10568)

2026-08-18 10:52:24 -03:00

errorCodes.ts

feat(combo): enforce provider and model family invariants (#8304)

2026-07-24 11:44:00 -03:00

featureFlagDefinitions.ts

feat(codex): self-contained codex app-server transport (executor + provider + sign-in) (#11205)

2026-08-23 10:20:06 -03:00

gitlabDuoSetupMessage.ts

fix(oauth): show GitLab Duo setup before authorize error (#8710)

2026-07-27 17:24:52 -03:00

headers.ts

fix(cache): add latency marker + per-key bypass for semantic cache (#8984)

2026-08-11 09:55:07 -03:00

index.ts

feat: add MCP server mode with --mcp flag for IDE integration

2026-03-03 17:42:24 -03:00

managementScopes.ts

feat: narrow mcp:connect scope + per-key HTTP tool-scope binding (#7895) (#7967)

2026-07-22 02:34:54 -03:00

mcpScopes.ts

feat(search): first-class X Search via SuperGrok x_search (#10988)

2026-08-21 14:16:42 -03:00

mitmToolHosts.ts

fix(oauth): mirror ghe-copilot into the OAuth id map and MITM host list

2026-07-20 06:52:05 -03:00

modal.ts

Release v3.8.43 (#5609)

2026-07-02 10:47:13 -03:00

modalityBridgeDefaults.ts

fix(responses-continuation): recover a real id/output for passthrough and translate-mode replies (#11434)

2026-08-24 19:57:12 -03:00

modelCompat.ts

feat: protocol-scoped model compat (V3)

2026-03-20 22:06:03 +08:00

models.ts

feat(cli): relay-like CLI closure — target manifest, Codex TOML, Gemini launcher, guards

2026-08-18 08:25:16 -03:00

modelSpecs.ts

fix(cli): stop pre-filling the secrets the server owns (#11436)

2026-08-24 20:04:11 -03:00

modelSupportedEndpoints.ts

fix(cli): stop pre-filling the secrets the server owns (#11436)

2026-08-24 20:04:11 -03:00

openRouterPreset.ts

Release v3.8.26 (#3875)

2026-06-16 01:00:40 -03:00

pricing.ts

Release v3.8.41 (#5327)

2026-06-29 16:51:03 -03:00

providers.ts

fix(responses-continuation): recover a real id/output for passthrough and translate-mode replies (#11434)

2026-08-24 19:57:12 -03:00

publicApiRoutes.ts

fix(responses-continuation): recover a real id/output for passthrough and translate-mode replies (#11434)

2026-08-24 19:57:12 -03:00

quotaAutoPing.ts

feat(quota): opt-in auto-ping to keep Codex quota windows warm (#6977) (#6995)

2026-07-17 10:54:56 -03:00

reservedProviderPrefixes.ts

fix(responses-continuation): recover a real id/output for passthrough and translate-mode replies (#11434)

2026-08-24 19:57:12 -03:00

responsesPreviousResponseId.ts

Release v3.8.10 (#3140)

2026-06-04 20:05:38 -03:00

routingStrategies.ts

feat(routing): add prompt-cache affinity (#8008)

2026-07-22 06:43:31 -03:00

selfServiceScopes.ts

Add self-service API key usage status (#2908)

2026-05-29 13:20:08 -03:00

serviceKinds.ts

Release v3.8.44 (#5925)

2026-07-04 13:00:30 -03:00

sidebarGroupVisibility.ts

Release v3.8.27 (#3968)

2026-06-17 02:43:21 -03:00

sidebarVisibility.ts

Beginner UX: Essentials sidebar preset (#11286)

2026-08-23 19:08:23 -03:00

spawnCapablePrefixes.ts

fix(authz): restrict tunnel process routes locally (#11531)

2026-08-25 13:12:34 -03:00

statusColors.ts

Release v3.8.42 (#5459)

2026-06-30 06:54:29 -03:00

upstreamHeaders.ts

fix(responses-continuation): recover a real id/output for passthrough and translate-mode replies (#11434)

2026-08-24 19:57:12 -03:00

visionBridgeDefaults.ts

fix(vision): preserve images for text-only routes (#9037)

2026-08-11 04:30:10 -03:00

visionModels.ts

fix(command-code): enable vision flags for CC models and fix vision-bridge reroute (#9007)

2026-08-05 21:42:27 -03:00