openai/tunnel-client v0.0.12

on GitHub

v0.0.12

v0.0.12 adds narrower runtime artifacts, stronger release verification, and reliability/security hardening for customer-run tunnel deployments.

Highlights

• Added tunnel-client-runtime and tunnel-client-runtime-cloudflared as run-only binaries, archives, and container images. The full tunnel-client remains available for onboarding, administration, Codex, and profile-management commands.
• Added release-specific SPDX 2.3 and license sidecars for each platform ZIP, plus runtime scan manifests, source exports, checksums, and provenance verification.
• Added optional MCP_STARTUP_WAIT_TIMEOUT support for deployments where a local MCP listener starts after tunnel-client; when enabled, it delays the first poll and OAuth discovery until the listener is reachable.

Reliability and security

• Preserved shared stdio MCP sessions after non-initialize response deadlines, safely discarded late responses, and improved startup-probe cleanup.
• Fixed late startup-probe session cleanup and a typed-nil cleanup panic.
• Hardened OAuth discovery and Harpoon target registration, and added an opt-in upstream token-endpoint audience lookup for private_key_jwt.
• Redacted MCP launch secrets, minimized and stripped connection-scoped response headers, and hardened Codex plugin tmux and command-execution paths.

Distribution

• Publishes full-client, runtime, and runtime-with-Cloudflared artifacts for Linux, macOS, and Windows on amd64 and arm64.
• Publishes matching SPDX/license evidence, runtime scan manifests, verified source archives, checksum manifests, and multi-architecture GHCR images with provenance attestations.

Full Changelog: v0.0.11...v0.0.12