- Implemented a TCP proxy for WebRTC candidate tunneling in Codex Live, supporting passive TCP candidates on port 443.
- Restricted tunneling to globally routable public IPs and added safeguards for rejecting unsafe/private targets.
- Added robust validation of STUN BindingRequest frames before forwarding to upstream candidates.
- Includes extensive unit tests for proxying behavior, candidate validation, and tunnel edge cases.
feat(proxy): centralize proxy handling with `proxyutil` package and enhance test coverage
- Added `proxyutil` package to simplify proxy handling across the codebase.
- Refactored various components (`executor`, `cliproxy`, `auth`, etc.) to use `proxyutil` for consistent and reusable proxy logic.
- Introduced support for "direct" proxy mode to explicitly bypass all proxies.
- Updated tests to validate proxy behavior (e.g., `direct`, HTTP/HTTPS, and SOCKS5).
- Enhanced YAML configuration documentation for proxy options.
