v0.1.1

Fixes

• The agent's placeholder token is no longer forwarded to the provider. For targets whose key
  goes in another header (x-api-key for Anthropic, x-goog-api-key for Gemini), the agent's
  Authorization: Bearer OWE_… was copied to the upstream request next to the real key. It is
  now always removed.
• Audio and native inline media no longer count as inspected text. JSON "data" members of
  at least 1 KiB of bare base64 (OpenAI input_audio, Gemini inlineData / inline_data,
  Anthropic base64 image and document sources) are left out of the 1 MiB inspection window,
  like data:image/…;base64,… URIs already were: a voice note or a photo sent in these formats
  got 413 body_too_large. Text beside them is still inspected. One linear pass: 1.6 ms for a
  2 MiB body (Apple Silicon).
• Longer upstream timeouts. 5 min for the provider's response headers (was 60 s, which cut
  non-streaming reasoning and image generations with 502) and 15 min for a whole exchange,
  streamed body included (was 5 min, also the server write timeout).

Docs

• Gemini target example (x-goog-api-key); keys in the query string (?key=) are not injected.

Image: ghcr.io/openwaf-dev/egress:0.1.1 (linux/amd64, linux/arm64). Binaries with SHA256SUMS
attached.