openai/tunnel-client v0.0.8--context-conduit-emerald

v0.0.8--context-conduit-emerald

Repository: openai/tunnel-client

Tag: v0.0.8--context-conduit-emerald

Published: 2026-05-07T18:54:27Z

Prerelease: no

Release notes:

tunnel-client v0.0.8 - Context Conduit Emerald

Compared with v0.0.7, this release focuses on enterprise MCP compatibility and supportability. It adds static header support for MCP runtime traffic and discovery probes, improves support exports for Harpoon and header-based configurations, and tightens OAuth/MCP diagnostics without changing the customer distribution shape.

Release Assets

• Combined distribution bundle: all.zip
• Combined tarball: all.tar.gz
• Platform zips: darwin-amd64, darwin-arm64, linux-amd64, linux-arm64, windows-amd64, windows-arm64
• Public URL manifest: PUBLIC_URLS.txt
• Checksums: SHA256SUMS.txt

Public base URL: https://persistent.oaistatic.com/tunnel-client/v0.0.8--context-conduit-emerald/

Public downloads:

• `all.zip`
• `all.tar.gz`
• `darwin-amd64.zip`
• `darwin-arm64.zip`
• `linux-amd64.zip`
• `linux-arm64.zip`
• `windows-amd64.zip`
• `windows-arm64.zip`
• `SHA256SUMS.txt`

Highlights

• Added static MCP runtime headers via --mcp.extra-headers, MCP_EXTRA_HEADERS, and mcp.extra_headers.
• Added static MCP discovery/probe headers via --mcp.discovery-extra-headers, MCP_DISCOVERY_EXTRA_HEADERS, and mcp.discovery_extra_headers.
• Header values can now use env:VARNAME or file:/path/to/secret, keeping secret-bearing headers out of argv and checked-in YAML.
• Static MCP headers are scoped to the configured MCP server origin and are not sent to the OpenAI control plane or unrelated authorization-server hosts.
• Discovery headers apply to OAuth protected-resource metadata discovery, WWW-Authenticate probing, and startup initialize probes.
• Connector-forwarded request headers still win conflicts on runtime requests.

Diagnostics and Support

• Log exports now include Harpoon admin snapshots alongside status, system, and OAuth snapshots.
• Header values are redacted in argv snapshots, environment snapshots, YAML config snapshots, and effective config exports.
• URL path secret redaction was strengthened for support bundles.
• Harpoon call history now records response content type and richer request diagnostics.

Compatibility and Reliability

• Harpoon request forwarding now blocks generic non-forwardable transport headers instead of limiting callers to only a small allowlist.
• OAuth discovery retry handling now preserves the request context correctly.
• Added end-to-end coverage proving static headers are scoped correctly and do not leak to the control plane or unrelated auth-server hosts.