Xiangzhe 3d4fd88ed7 fix(security): reduce the health payload for anonymous callers ...

GET /api/monitoring/health returned host-fingerprinting detail (app/node
version, pid, memory, provider breaker config, MCP paths) to any anonymous
caller — the common case on a keyless install. A non-management caller now
receives only the liveness verdict (status + setupComplete), which is all a
health / load-balancer probe needs; a management principal still gets the full
payload. REQUIRE_API_KEY stays false by default (local-first) per operator choice.

Reported by @kaimandalic via GHSA-mvf8-qc78-5mxm (information-disclosure portion).

2026-08-21 14:39:45 -03:00

..

_helpers

…

_setup

…

benchmarks

…

boundary

…

e2e

fix(providers): validate bailian-coding-plan against the Token Plan host (#10634)

2026-08-18 05:51:34 -03:00

fixtures

feat(providers): add local ZCode ACP backend (#10184)

2026-08-16 00:13:36 -03:00

golden-set

…

helpers

fix(responses): replace synthetic reasoning keepalive (#10806)

2026-08-20 09:49:55 -03:00

homolog

…

integration

fix(cline): stop generating proxy task ids (#10279)

2026-08-21 02:13:00 -03:00

live

…

llm-security

…

load

…

manual

…

security

…

snapshots

fix(cline): stop generating proxy task ids (#10279)

2026-08-21 02:13:00 -03:00

translator

…

unit

fix(security): reduce the health payload for anonymous callers

2026-08-21 14:39:45 -03:00

_cp_mock_hook.mts

…

_cp_mock_module.mts

…

_run_dns_guard_test.sh

…

e2e-tool-calls.sh

…

theoldllm-stress.test.ts

…