- Implemented logging for Codex remote media forwarding start events, including detailed connection and credential metadata.
- Added `formatLogFieldValue` for quoting specific log fields and ensured newline safety in log output.
- Enhanced unit tests to validate log content, escaping, and field inclusion.
- Implemented a TCP proxy for WebRTC candidate tunneling in Codex Live, supporting passive TCP candidates on port 443.
- Restricted tunneling to globally routable public IPs and added safeguards for rejecting unsafe/private targets.
- Added robust validation of STUN BindingRequest frames before forwarding to upstream candidates.
- Includes extensive unit tests for proxying behavior, candidate validation, and tunnel edge cases.
- Added comprehensive diffing for Codex live media relay settings, including support for public IP, UDP port ranges, and ICE server changes.
- Introduced `displayOptionalValue` utility to handle optional values in diff outputs.
- Improved test coverage for config change detection, ensuring no sensitive information leakage.
- Replaced `allow-private-remote-ips` with the new `disable-private-remote-ips` property, adding YAML backward compatibility.
- Updated Codex live handler to differentiate media relay configuration changes and runtime updates.
