What's new
- Added the gb-agent connector settings API for workspace-scoped endpoint configuration and Vault-backed bearer token storage.
- Added safe test-connection checks for draft-only external agent connectors without granting WhatsApp send, opt-out, tag, label, or journey side effects.
Security and operations
- Rejects credential-bearing connector endpoint URLs and query credentials before persistence.
- Blocks localhost, private, link-local, reserved, and documentation IP targets before sending bearer tokens, pins test fetches to the vetted resolved IP, and disables automatic redirects.
- Returns only safe connector status and test metadata; raw provider payloads and bearer tokens are never returned.