b9c6789560
feat(secrets): authenticated egress substitution proxy with destination binding ( #123216 )
...
* feat(secrets): add authenticated egress substitution proxy
* feat(secrets): bind egress substitution to hosts
* ci(codeql): classify egress proxy bypass tunnel in network boundary query
* refactor(proxy-capture): use the canonical IP parser instead of node:net
* fix(secrets): compare proxy tokens with a process-keyed MAC
2026-08-13 20:49:31 -07:00
faf3dbdda8
fix(ci): classify proxied APNs TLS tunnel ( #110480 )
...
* fix(ci): classify proxied APNs TLS tunnel
* fix(ci): prove network CodeQL contract changes
Co-authored-by: zhang-guiping <zhang.guiping@xydigit.com >
---------
Co-authored-by: Peter Steinberger <steipete@gmail.com >
2026-07-18 16:18:29 +01:00
f94a7dc183
feat(codex): supervise native Codex sessions ( #104045 )
...
* feat(codex): add native session supervision
* fix(codex): harden supervision integration
* fix(codex): preserve locked harness ownership
* fix(codex): fence native session archive
* fix(codex): revalidate archive binding ownership
* feat(codex): integrate supervision runtime
* feat(sessions): preserve harness-owned execution
* feat(sessions): persist harness ownership invariants
* feat(gateway): enforce harness-owned sessions
* feat(setup): enable detected Codex supervision
* feat(mac): expose supervised Codex sessions
* feat(ui): make Codex sessions actionable
* docs(codex): document session supervision
* test(codex): cover integration ownership
* chore(i18n): refresh supervision inventories
* fix(setup): finalize Codex activation atomically
* test(codex): narrow binding store update
* fix(sessions): preserve legacy model locks
* test(macos): serialize Codex catalog fixtures
* fix(sessions): preserve legacy lock admission
* chore(i18n): reconcile supervision metadata
* test(sessions): mark legacy lock fixture
* fix(macos): drain final Codex catalog frame
* docs: leave supervision note to release
* style(macos): satisfy Codex catalog type length
* chore: record session accessor seam owners
* fix(macos): honor configured Codex supervision
* fix(codex): preserve harness-owned model locks
* fix(codex): satisfy supervision lint gates
* chore(i18n): refresh native supervision inventory
* fix(codex): align supervision validation contracts
* fix(codex): close supervision boundary gaps
* fix(codex): preserve supervision activation contracts
* fix(codex): dispose standalone supervision runtime
* fix(codex): pin supervised source connection
* fix(plugins): bind delegated runs to exact session target
* fix(codex): scope supervised sessions to configured agents
* fix(codex): fingerprint effective supervision home
* fix(codex): normalize supervision plugin policy
* fix(codex): keep supervised bindings stable across upgrades
* fix(codex): guard all supervised binding connections
* fix(codex): preserve catalog filters and pending CAS identity
* fix(codex): preserve supervision identity for diagnostics
* fix(codex): bind uncertain commits to supervision connection
* fix(codex): satisfy supervision type boundaries
* fix(macos): reconcile current main validation
* fix(codex): handle absent runtime config in supervision
* fix(doctor): own local audio acceleration check
* fix(codex): satisfy integration lint gates
* fix(codex): satisfy lifecycle safety guards
2026-07-11 00:12:08 -07:00
c4083e32f5
fix(ci): allow jsonl socket boundary helper
2026-07-04 09:34:54 +02:00
9dd3bce549
feat: add codex supervisor extension
...
* feat: add codex supervisor plugin
* fix: restore merged branch checks
* fix: unblock supervisor extension CI
* fix: restore merged agent checks
2026-05-29 03:49:43 +01:00
cf9e9cd119
lint: move managed proxy guard to codeql
2026-05-08 01:18:04 +10:00
dd0a9bf869
lint: replace raw socket guard with codeql
2026-05-08 01:18:04 +10:00
Peter Steinberger