fix: carry six small luvs01 fixes (crash guard, Kiro estimate, loopback proxy, OAuth, remote hub docs) - #5598

Merged

lidge-jun merged 33 commits into

devfrom

codex/260923-luvs-l3-small-fixes-b

Sep 23, 2026

Commits on Sep 22, 2026

fix(kiro): avoid mixed-script estimator allocations

luvs01
authored and
lidge-jun
committed
f0226b4
test(kiro): register kiro-wire-estimate in test layout

luvs01
authored and
lidge-jun
committed
d9eb5d7
fix(crash-guard): count unparenthesized JS frames as real throw sites

lidge-jun
and
luvs01
committed
9f128c1
fix(proxy): keep loopback traffic outside inherited SOCKS

luvs01
authored and
lidge-jun
committed
5446f75
fix(proxy): pin non-loopback SOCKS ownership and document the ambient noProxy scope

luvs01
authored and
lidge-jun
committed
688f60d
fix(oauth): preserve hashes in command code callback JSON

luvs01
authored and
lidge-jun
committed
20a65e8
test(oauth): drive Command Code callback JSON through the shared submit path
lidge-jun
committed
60cbb55
docs(remote-hub): warn about shared-host unauthenticated loopback companion

luvs01
authored and
lidge-jun
committed
9567ead
docs(remote-hub): align the loopback warning with the reference and cover the ported form

luvs01
authored and
lidge-jun
committed
47a8128
fix(oauth): drop legacy credential backup on destructive mutations

luvs01
authored and
lidge-jun
committed
390f12c
docs(structure): note legacy backup removal on destructive auth mutations

luvs01
authored and
lidge-jun
committed
b05a544
fix(oauth): only drop the downgrade backup when a credential was actually removed
lidge-jun
committed
b8242f8
fix(oauth): drop the downgrade backup when a provider is deleted

lidge-jun
and
luvs01
committed
2853a8a
fix(crash-guard): log a new hidden throw site inside the benign fold window
lidge-jun
committed
aba89d0
fix(proxy): merge loopback into an inherited lowercase no_proxy
lidge-jun
committed
fa49bea
fix(oauth): keep other providers in the downgrade backup on deletion

lidge-jun
and
luvs01
committed
c0319d5
fix(oauth): check an explicit #state on a raw Command Code paste
lidge-jun
committed
c623e44
test: tighten the carried Kiro estimate and remote-hub warning checks
lidge-jun
committed
373d67b
fix(crash-guard): keep the hidden throw-site read inside the handler
lidge-jun
committed
c86c1a3
fix(oauth): never write the downgrade backup through a link or claim it

lidge-jun
and
luvs01
committed
8c5f4b1
test(kiro): make the pure-CJK estimate case actually zero-Latin
lidge-jun
committed
d3c3cb9
fix(oauth): rewrite the downgrade backup through the shared writer

lidge-jun
and
luvs01
committed
748e7a8
docs(structure): state when an existing OAuth downgrade copy is rewritten
lidge-jun
committed
48215a1
fix(proxy): scope the inherited-proxy loopback bypass to exact hosts
lidge-jun
committed
f6e65bf
fix(proxy): key the loopback bypass on SOCKS precedence
lidge-jun
committed
51585db
fix(proxy): keep 127.0.0.1 off an inherited HTTP proxy without suffix risk
lidge-jun
committed
70384c7
fix(proxy): add bare localhost only when SOCKS is the sole inherited proxy
lidge-jun
committed
e62eebd
fix(proxy): never add a bare localhost to an inherited lowercase no_proxy
lidge-jun
committed
5607c7d
fix(proxy): add only loopback addresses to an inherited lowercase no_proxy
lidge-jun
committed
00e5111
test(oauth): assert a cleared provider set as null, as getAccountSet returns
lidge-jun
committed
1d44ed5
Merge remote-tracking branch 'origin/dev' into codex/260923-luvs-l3-small-fixes-b
lidge-jun
committed
192ad1c

Commits on Sep 23, 2026

fix: bypass inherited HTTP ALL_PROXY for loopback

lidge-jun
and
luvs01
committed
7cabef8
fix: keep localhost direct with mixed inherited proxies

lidge-jun
and
luvs01
committed
4e13ee5

Navigation Menu

fix: carry six small luvs01 fixes (crash guard, Kiro estimate, loopback proxy, OAuth, remote hub docs) - #5598

fix: carry six small luvs01 fixes (crash guard, Kiro estimate, loopback proxy, OAuth, remote hub docs)#5598
lidge-jun merged 33 commits into
devfrom
codex/260923-luvs-l3-small-fixes-b

Commits on Sep 22, 2026

fix(kiro): avoid mixed-script estimator allocations

test(kiro): register kiro-wire-estimate in test layout

fix(crash-guard): count unparenthesized JS frames as real throw sites

fix(proxy): keep loopback traffic outside inherited SOCKS

fix(proxy): pin non-loopback SOCKS ownership and document the ambient noProxy scope

fix(oauth): preserve hashes in command code callback JSON

test(oauth): drive Command Code callback JSON through the shared submit path

docs(remote-hub): warn about shared-host unauthenticated loopback companion

docs(remote-hub): align the loopback warning with the reference and cover the ported form

fix(oauth): drop legacy credential backup on destructive mutations

docs(structure): note legacy backup removal on destructive auth mutations

fix(oauth): only drop the downgrade backup when a credential was actually removed

fix(oauth): drop the downgrade backup when a provider is deleted

fix(crash-guard): log a new hidden throw site inside the benign fold window

fix(proxy): merge loopback into an inherited lowercase no_proxy

fix(oauth): keep other providers in the downgrade backup on deletion

fix(oauth): check an explicit #state on a raw Command Code paste

test: tighten the carried Kiro estimate and remote-hub warning checks

fix(crash-guard): keep the hidden throw-site read inside the handler

fix(oauth): never write the downgrade backup through a link or claim it

test(kiro): make the pure-CJK estimate case actually zero-Latin

fix(oauth): rewrite the downgrade backup through the shared writer

docs(structure): state when an existing OAuth downgrade copy is rewritten

fix(proxy): scope the inherited-proxy loopback bypass to exact hosts

fix(proxy): key the loopback bypass on SOCKS precedence

fix(proxy): keep 127.0.0.1 off an inherited HTTP proxy without suffix risk

fix(proxy): add bare localhost only when SOCKS is the sole inherited proxy

fix(proxy): never add a bare localhost to an inherited lowercase no_proxy

fix(proxy): add only loopback addresses to an inherited lowercase no_proxy

test(oauth): assert a cleared provider set as null, as getAccountSet returns

Merge remote-tracking branch 'origin/dev' into codex/260923-luvs-l3-small-fixes-b

Commits on Sep 23, 2026

fix: bypass inherited HTTP ALL_PROXY for loopback

fix: keep localhost direct with mixed inherited proxies