docs: daily update 2026-08-04 — release v4.171.1

[deco-cms]

Summary

Triggered by the studio.released webhook for v4.171.1 (previous release: v4.171.0, compare: v4.171.0...v4.171.1).

Commits covered (range v4.171.0...v4.171.1)

• 58c588156 — fix(connection): block SSRF on CONNECTION_TEST's health-check fetch (fix(connection): block SSRF on CONNECTION_TEST's health-check fetch #5686) — warranted a docs update (see below)

Commits skipped

• e3d522194 — [release]: bump changed workspace versions — version bump only, no content change
• d40303d10 — [chore]: bump homebrew cask to 4.171.0 — cask bump, no user-facing change
• f908ba454 — [chore]: bump homebrew cask to 4.170.9 — cask bump, no user-facing change

Why 58c588156 warranted a docs change

testConnection() (backing the CONNECTION_TEST health check) previously fetched a connection's stored URL with a plain fetch, following redirects and without the private-network guard that create/update and tool-discovery already applied. It now reuses guardAgainstPrivateUrl + a no-redirect fetch, so a connection whose URL resolves to (or redirects to) a private/internal-network or cloud-metadata address is reported unhealthy instead of being probed.

This is a user-visible behavior change: an org member who has a Custom Connection pointing at a private/internal address will now see it fail health checks, where it may have "worked" before. The restriction itself (no private URLs) already existed at connection create/update time but was completely undocumented, so this PR adds a short note about it rather than just describing the fix.

Files changed

• studio/connections.mdx (en + pt-br) — added a Callout type="warning" under "Types of connections" explaining that connection URLs must resolve to public addresses, that this is enforced on create/update and on every subsequent health check, and that a blocked connection is reported unhealthy rather than probed.

Consistency notes

• Checked self-hosting/quickstart.mdx, concepts.mdx, overview.mdx, and store.mdx for references to "Custom Connection" or private/internal URLs — none reference this behavior, so no other file needed a fix.
• Did not find a built-in-tools.mdx file documenting CONNECTION_TEST specifically at the expected path — no change made there; flagging in case a reviewer wants a tool-level note added if that reference exists elsewhere.

pt-br translation was produced by auto-translating the same content (prose/headings translated; code, URLs, and product terms like "connection", "Custom Connection" kept in English per style guide).

Dependency note

This branch is based on the HEAD of docs/auto-update-2026-08-04-release-4.169.0 (PR #5665), the most recently created open docs-automation PR at the time this ran, to avoid merge conflicts. This PR should be merged after #5665.

---

Summary by cubic

Docs update for v4.171.1: adds Task Board reviewers and shipping flow, documents the new hosted claude-code harness, Studio Native coding-agent terminals, and warns that connection health checks now block private URLs.

• New Features

  • Task Board: QA/Code Reviewer, optional auto-merge, and Ship to production; new page and Concepts link.
  • Hosted runs: claude-code harness runs inside the sandbox pod (opt-in per org); Decopilot remains default.
  • Studio Native: pick a coding agent terminal (Claude Code, Codex, OpenCode) for new threads; reclaim local worktree on last-thread archive.
  • Agents: repo picker shows forks; Files and skills warns on >25MB uploads.
  • Agentic CMS: toggle field descriptions to tooltips in blocks forms (per-site setting).
  • Connections: add warning that URLs must be public; create/update and health checks block private/internal addresses and mark the connection unhealthy.
  • Decopilot: clarify Requires action is only set by pending tool calls, not text heuristics.

• Migration

  • Auth (self-hosting): configuration is now AUTH_* env vars only; remove auth-config.json and set providers via env.
  • Kubernetes: sandbox image is ghcr.io/decocms/studio/studio-sandbox-go (no TS/Go switch); optional OTLP metrics from the sandbox daemon (collector ClusterIP + port required).
  • Architecture docs: remove desktop link/desktop sandbox paths; sandboxes are cloud-only; NATS note trimmed to UI streaming.

^{Written for commit 9ccc6da. Summary will update on new commits.}