GB-Agent connector setup
- Repairs Settings → GB-Agent test connections for Railway-hosted HTTPS services by preserving TLS SNI while still pinning the vetted DNS address before sending the workspace bearer token.
- Requires the configured endpoint to be the exact
/api/agent/draft-runpath with no query string, fragment, or embedded credentials across settings, inbox enqueue, and worker dispatch paths. - Treats endpoints that do not report the
draft_runcapability as failed test connections, so service roots and health checks cannot test green. - Rejects private and special-range DNS results before any connector bearer token is read or sent, including worker dispatch-time revalidation to close DNS-rebinding gaps.
- Clarifies the settings/docs copy to use the full GBCA draft-run endpoint rather than the Railway service root.