fix(security): require localhost for Claude extension /setup when dashboard auth is disabled (#1270) fix(cliproxy): redact AI provider header secrets (#1268) fix(websearch): avoid shell for legacy CLI fallbacks (#1267) fix(security): reject 127-prefixed websocket origins (#1263)