redwoodjs__local-ci/CHANGELOG.md

Changelog

Unreleased

• Hardened the DTU mock server by requiring a cryptographically secure per-run control token for internal seed/start-runner/dump endpoints (including trailing-slash routes), failing closed if secure randomness is unavailable, constraining runner log paths to the real run log root, and removing shell interpolation from compare handling.
• Updated direct and transitive dependencies to remediate security advisories, including replacing the unpatched decompress transitive dependency.
• Added agent-ci run --prewarm-through <workflow:job:step-id> (or AGENT_CI_PREWARM_THROUGH) so a disposable job can warm shared node_modules through an explicit workflow step before parallel jobs begin. Agent CI now warns with an actionable prewarm command when cold parallel install jobs look likely, including a structured diagnostic event in --json mode.
• Hardened opt-in Rust orchestration so matrix legs are keyed by schedule key, matrix needs results are aggregated, reusable workflows and workflow-call outputs are expanded, worker failures preserve sibling outcomes, DTU cleanup/security is enforced, cyclic dependencies error during planning, pull request branch filters use the actual branch, detached pause handling is covered directly, nested ephemeral DTU servers advertise the container IP to sibling runners, nested runner containers join the parent Docker network, Rust cleanup removes nested containers attached to per-job networks, and the Rust smoke parity gate exercises the expanded smoke suite with per-workflow timeouts, duration summaries, heartbeats, status ledgers, failure diagnostics, and timeout cleanup.