security: stop returning gateway password to clients#131

Merged

solomon2773 merged 1 commit intomasterfrom

sec/ownership-tail-pass-2026-04-04

Apr 4, 2026

Owner

solomon2773 commented Apr 4, 2026

Summary

remove gateway_token from the /agents/:id/gateway-url response
switch the dashboard 'New Window' action to the existing same-origin embed path instead of constructing a direct password-bearing URL
keep the change bounded to token exposure cleanup and update the agent route regression test

Validation

npm test -- --runInBand tests/agents.test.js


          security: stop returning gateway password to clients

db89daa

solomon2773 merged commit a892a19 into master

2 checks passed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet