BareProxy 0.16 adds two tools that live in BareProxy itself rather than as plugins, because both need things a sandboxed plugin can’t do: write to disk before answering, keep a retry schedule across restarts, make their own DNS and TLS connections, and run from the command line in CI.
The webhook inbox saves each webhook to disk before the sender gets its 202, then delivers it to the app with retries for up to three days. It checks GitHub, Shopify, Stripe and plain HMAC signatures and drops a sender’s own repeats. If a crash cuts a delivery short, the resend carries a mark so the app can skip it. In the recorded test, 1,500 webhooks through 15 hard kills lost none and delivered none twice without that mark. The drift watcher checks certificates for expiry, trust and changes, DNS records for edits with the old and new values, nameserver moves, and missing HSTS or CAA. A lookup that fails reads as unchecked, never as clean. It runs once in CI with exit codes, or on a timer inside the server.
An independent review found five bugs, fixed in 0.16.1. The worst two: Go’s HTTP client could quietly resend an inbox delivery with no mark after a broken connection, and a drift check cut off by a config reload saved its state and lost the alert. Case studies came next. One app went down for a one minute deploy and got all 18 webhooks exactly once afterwards. Another took a hard kill mid-delivery without losing an event. A third ran forged signatures, repeats and a bad deploy through the inbox. The last followed a DNS move that went wrong against a local stand-in for DNS and HTTPS, since real lookups weren’t reachable from the test machine. The use examples cover both tools. Binaries are out for Linux, macOS and Windows. The nine plugins note covers the plugin program.