- Implemented a TCP proxy for WebRTC candidate tunneling in Codex Live, supporting passive TCP candidates on port 443.
- Restricted tunneling to globally routable public IPs and added safeguards for rejecting unsafe/private targets.
- Added robust validation of STUN BindingRequest frames before forwarding to upstream candidates.
- Includes extensive unit tests for proxying behavior, candidate validation, and tunnel edge cases.