[dbpolito]

Docker accepts network aliases longer than DNS's 63-byte label limit, but Caddy cannot resolve them and returns 502. Kool constructs these aliases from the project and service names, so the fix belongs in the proxy rather than workspace naming.

• Always use a compact, 21-character kool-<hash> alias derived from the full project/service pair. Docker and Caddy share the same alias; browser hostnames and Compose service names are unchanged.
• Add kool proxy aliases to show configured project/service/network/alias mappings for the current project or workspace without Docker or Caddy. This shows intended configuration, not live state.
• Keep selective route removal compatible with old project/service aliases.
• Cover long names, ambiguous project/service pairs, Docker/Caddy consistency, command output, and legacy route removal with regression tests.
• Build the Docker image with Go 1.26.9 to address critical findings against Kool's binary. The remaining scan findings are inherited from Docker's bundled Compose/Buildx plugins; no exclusions were added.

Migration: aliases change for all proxied services. Run kool start in each project/workspace to recreate containers with the new aliases.

[dbpolito]

Pushed 5cad5d7 to build the image with Go 1.26.9. This removes the critical findings against /usr/local/bin/kool. The image builds and runs locally, and the full test suite passes under Go 1.26.9.

Remaining blockers:

• The image scan still reports CVE-2026-78663 and CVE-2026-56857 exclusively in Compose/Buildx inherited from docker:29-cli (Go 1.26.8; x/net v0.58.0/v0.59.0). Upstream binaries need Go >=1.26.9 and x/net >=v0.60.0. No scan exclusions or relaxed thresholds were added.
• GitHub still requires review approval; no reviews or inline feedback have been posted.

All other checks pass, and the branch includes the latest main.