v2 egress: default-allow mitmproxy gateway + account-level managed deploy keys + auth-token/provider reconcile - #345

Merged

kingsleydon merged 43 commits into

mainfrom

integrate/v2-cli-runtime-fixes

Jul 9, 2026

Commits on Jul 8, 2026

Harden hosted runtime MITM ownership
kingsleydon
committed
e571be5
Clean hosted runtime auth token lifecycle
kingsleydon
committed
33804c2
Add transparent MITM sidecar mode
kingsleydon
committed
2b3c79d
Implement hosted invisible gateway wiring
kingsleydon
committed
d7932ad
fix runtime provider projection cleanup
kingsleydon
committed
5b658d8
Fix invisible gateway nftables compatibility
kingsleydon
committed
937ead1
Keep runtime watch bound to manifest URL
kingsleydon
committed
abafca9
Keep Hermes Python managed under runtime home
kingsleydon
committed
7ebf736
Harden invisible gateway egress rules
kingsleydon
committed
79e5d46
Use compatible scoped nft table replacement
kingsleydon
committed
9ee59ae
Harden transparent gateway reconnect paths
kingsleydon
committed
f38d446
Allow Hermes uv release installer through gateway
kingsleydon
committed
209bce0
Keep managed provider key out of hosted agent env
kingsleydon
committed
274b27a
Allow hosted managed placeholder provider env
kingsleydon
committed
ac33aea
Harden invisible gateway reconcile paths
kingsleydon
committed
29709c9
Fix hosted runtime MITM secret assertions
kingsleydon
committed
d3e583f
Clean up invisible gateway runtime contracts
kingsleydon
committed
3f40a06
Remove prelaunch runtime auth token compat
kingsleydon
committed
89465d8
Restore runtime source auth tolerance
kingsleydon
committed
9dffe70
Integrate: hosted runtime auth-token lifecycle (clean)
kingsleydon
committed
581e575
Integrate: provider projection reconcile cleanup
kingsleydon
committed
52753d8
Integrate: invisible gateway CLI runtime
kingsleydon
committed
a8f9c94
Dedup CLAWDI_RUNTIME_MANIFEST_URL after gateway+auth-token merge

kingsleydon
and
claude
committed
11d370e
rework mitm phase 1 remove native sidecar
kingsleydon
committed
b06543b
rework mitm phase 2 add mitmproxy addon
kingsleydon
committed
3ac66a4
rework mitm phase 3 fetch mitmproxy runtime
kingsleydon
committed
8a58615
Replace hosted egress with transparent mitm lifecycle
kingsleydon
committed
ff332d9
rework mitm phase 5 managed provider profiles
kingsleydon
committed
dc37c5b
rework mitm phase 6 channel placeholder rewrite
kingsleydon
committed
05e4644

Commits on Jul 9, 2026

pin mitmproxy downloads artifact
kingsleydon
committed
a17a1d4
keep passthrough-only hosts out of MITM SNI
kingsleydon
committed
7831086
load mitmproxy addon without dataclass module state
kingsleydon
committed
3506dea
project mitm CA bundle before redirect
kingsleydon
committed
de9e5c1
avoid connecting to transparent mitm for readiness
kingsleydon
committed
43165fa
redact rewritten mitm action logs
kingsleydon
committed
4d9b940
Fix provider MITM authority preservation
kingsleydon
committed
e2db554
Add managed platform API keys
kingsleydon
committed
8e9202c
Fix runtime channel lookup for managed deploy keys
kingsleydon
committed
1a1324f
Regenerate OpenAPI client for managed-key channel environment_id param

kingsleydon
and
claude
committed
fd40e49
CI: drop Go mitm-sidecar steps (sidecar removed in mitmproxy rework)

kingsleydon
and
claude
committed
d79de64
docs: correct OSS gateway docs to transparent mitmproxy model

kingsleydon
and
claude
committed
cc68bca
docs: conform clawdi docs to no-date kebab naming + HISTORICAL banner

kingsleydon
and
claude
committed
11b574c
test: mark managed-provider fixture with managed_by:clawdi

kingsleydon
and
claude
committed
e0102d1