Xiangzhe 7986026e7c fix(security): honor REQUIRE_API_KEY on the /a2a route ...

/a2a is outside the authz proxy matcher, so the REQUIRE_API_KEY posture the
pipeline enforces for /v1 never ran there — the route accepted every caller
whenever OMNIROUTE_API_KEY was unset (the shipped default). authenticate() now
applies the same posture directly: a valid OmniRoute key when REQUIRE_API_KEY is
on, the legacy explicit A2A key otherwise, and keyless local-first only when
nothing is configured (matching /v1). A2A stays off by default.

Reported by @rafaelfiguereod-stack via GHSA-v54m-6rm3-p565.

2026-08-21 14:30:32 -03:00

..

app

fix(security): honor REQUIRE_API_KEY on the /a2a route

2026-08-21 14:30:32 -03:00

domain

fix(domain): treat unreported Antigravity quota fraction as unknown, not exhausted (#10095)

2026-08-20 20:29:38 -03:00

hooks

fix(dashboard): send periodic WS heartbeat pings to stop live-dashboard reconnect churn (#10452)

2026-08-18 10:50:26 -03:00

i18n

feat(providers): Cursor PKCE login with Bearer quota, auto router, and empty-turn errors (#9909)

2026-08-21 10:28:01 -03:00

lib

fix(security): don't auto-adopt an unverified listener on a service port

2026-08-21 14:10:31 -03:00

middleware

Release v3.8.49 (#7076)

2026-07-29 15:18:55 -03:00

mitm

fix(agent-bridge): make the regenerate-cert endpoint actually mint a new cert (#10467) (#10715)

2026-08-20 06:28:41 -03:00

models

Release v3.8.49 (#7076)

2026-07-29 15:18:55 -03:00

scripts

feat(db): consolidate all database settings into SystemStorageTab (closes #1935) (#1947)

2026-05-04 19:25:41 -03:00

server

fix(security): route OAuth auto-import through the LOCAL_ONLY tier

2026-08-21 14:26:41 -03:00

shared

fix(security): route OAuth auto-import through the LOCAL_ONLY tier

2026-08-21 14:26:41 -03:00

sse

fix(resilience): make least-used rotate by recording the use it sorts on (#10945) (#10951)

2026-08-21 08:25:07 -03:00

store

Release v3.8.38 (#5078)

2026-06-27 09:07:12 -03:00

types

maint: follow-up cherry-pick fix-in-place #9510 (fallback resolution) (#9880)

2026-08-09 10:07:10 -03:00

instrumentation-node.ts

feat: combo-lane awareness + activation UX + MCP visibility (Wave 2 of #9654) (#10039)

2026-08-18 11:31:46 -03:00

instrumentation.ts

fix(cli): guarantee non-empty [STARTUP] Fatal log on instrumentation-hook boot throw (#10447)

2026-08-18 10:57:44 -03:00

proxy.ts

fix(security): match client-API aliases case-insensitively in the authz matcher

2026-08-21 13:14:53 -03:00