feat: deep-agent canvas, live observability, and multi-environment tooling

Self-hosted platform for building, testing, and shipping LangChain/LangGraph agents. Deep-agent sub-agents on the canvas, a live tracing/observability timeline, auto-provisioned built-in tools with import/export, per-environment tool variables, streamed evaluations, and per-user auth token forwarding.

apps/api/tests/test_clientip.py

@@ -0,0 +1,33 @@
+"""Client-IP trust rule (anti-spoofing): X-Forwarded-For is believed ONLY from a configured
+reverse proxy, so a directly-connected client cannot forge its IP for per-IP rate limits or
+audit logs. Covers both call sites (deps.client_ip and the audit middleware) via the shared
+helper they now both use."""
+
+from forge.util.clientip import resolve_client_ip
+
+
+def test_no_trusted_proxies_ignores_xff():
+    # Default (direct exposure): a client-supplied X-Forwarded-For must be ignored.
+    assert resolve_client_ip("203.0.113.9", "1.2.3.4", []) == "203.0.113.9"
+
+
+def test_trusted_proxy_uses_leftmost_xff():
+    # Behind a configured proxy, the original client is the left-most XFF entry.
+    assert resolve_client_ip("10.0.0.5", "1.2.3.4, 10.0.0.5", ["10.0.0.5"]) == "1.2.3.4"
+
+
+def test_untrusted_peer_ignores_xff():
+    # A peer that is NOT a configured proxy cannot get its XFF believed.
+    assert resolve_client_ip("203.0.113.9", "1.2.3.4", ["10.0.0.5"]) == "203.0.113.9"
+
+
+def test_wildcard_trusts_any_peer():
+    assert resolve_client_ip("203.0.113.9", "1.2.3.4", ["*"]) == "1.2.3.4"
+
+
+def test_no_xff_returns_peer():
+    assert resolve_client_ip("203.0.113.9", None, ["*"]) == "203.0.113.9"
+
+
+def test_no_client_and_no_xff_is_none():
+    assert resolve_client_ip(None, None, []) is None