Module-level rateLimitTimestamps map is never pruned for inactive IPs

rateLimitTimestamps is a module-level Map that accumulates one entry per unique client IP. On every call to checkRateLimit, the per-IP array is filtered down to recent timestamps and stored back:

rateLimitTimestamps.set(ip, recent);

However, when all timestamps for an IP fall outside the window, recent becomes an empty array and the entry is stored back as [] rather than deleted. For any IP that makes even a single POST and then goes silent, a [] entry remains in the map forever. In a public deployment with many different source IPs (or a scanner sweep), this is an unbounded memory leak.

After the filter, delete the entry when recent is empty instead of setting it back:

if (recent.length === 0) {
  rateLimitTimestamps.delete(ip);
} else {
  rateLimitTimestamps.set(ip, recent);
}

This is a comment left during a code review.
Path: src/gateway/server/events-http.ts
Line: 57-59

Comment:
**Module-level `rateLimitTimestamps` map is never pruned for inactive IPs**

`rateLimitTimestamps` is a module-level `Map` that accumulates one entry per unique client IP. On every call to `checkRateLimit`, the per-IP array is filtered down to recent timestamps and stored back:

```ts
rateLimitTimestamps.set(ip, recent);
```

However, when all timestamps for an IP fall outside the window, `recent` becomes an empty array and the entry is **stored back as `[]`** rather than deleted. For any IP that makes even a single POST and then goes silent, a `[]` entry remains in the map forever. In a public deployment with many different source IPs (or a scanner sweep), this is an unbounded memory leak.

After the `filter`, delete the entry when `recent` is empty instead of setting it back:

```ts
if (recent.length === 0) {
  rateLimitTimestamps.delete(ip);
} else {
  rateLimitTimestamps.set(ip, recent);
}
```

How can I resolve this? If you propose a fix, please make it concise.

Event endpoints lack authentication

handleEventsHttpRequest performs no credential check. Every other handler in server-http.ts that exposes sensitive functionality receives a resolved-auth parameter and enforces it internally (e.g. handleToolsInvokeHttpRequest), but the events handler is invoked without one.

As a result, any unauthenticated client that can reach the gateway can:

• Open a persistent SSE connection on /api/events/stream and receive all events.
• POST arbitrary JSON to /api/events, which the broadcast() function forwards verbatim to every connected SSE subscriber.

The second point is particularly impactful: any network-reachable caller can inject crafted events into the UI of every connected user. This matters most when the gateway is configured for non-loopback exposure (which this PR explicitly documents).

The handler should accept and enforce the gateway auth configuration the same way the other route handlers do.

This is a comment left during a code review.
Path: src/gateway/server/events-http.ts
Line: 170-205

Comment:
**Event endpoints lack authentication**

`handleEventsHttpRequest` performs no credential check. Every other handler in `server-http.ts` that exposes sensitive functionality receives a resolved-auth parameter and enforces it internally (e.g. `handleToolsInvokeHttpRequest`), but the events handler is invoked without one.

As a result, any unauthenticated client that can reach the gateway can:
- Open a persistent SSE connection on `/api/events/stream` and receive all events.
- POST arbitrary JSON to `/api/events`, which the `broadcast()` function forwards verbatim to every connected SSE subscriber.

The second point is particularly impactful: any network-reachable caller can inject crafted events into the UI of every connected user. This matters most when the gateway is configured for non-loopback exposure (which this PR explicitly documents).

The handler should accept and enforce the gateway auth configuration the same way the other route handlers do.

How can I resolve this? If you propose a fix, please make it concise.

Count pending sockets in global WebSocket connection limit

Use wss.clients.size (or another socket-level counter) for the global cap instead of clients.size. clients is only populated after a successful connect handshake (via setClient), so unauthenticated/pending sockets are not counted; an attacker can open many concurrent handshakes (especially across multiple IPs) and bypass MAX_WS_CONNECTIONS, defeating the overload protection this change intends to add.

Useful? React with 👍 / 👎.

Avoid HOSTNAME as the default Vite bind source

Reading process.env.HOSTNAME here makes the fallback to loopback effectively unreachable in many real environments (Linux shells/containers usually export HOSTNAME automatically), so the dev server can bind to an unintended interface/hostname instead of localhost and may even fail to bind if that hostname is not a local listen address. This regresses the stated localhost-by-default behavior and can break local development unexpectedly.

Useful? React with 👍 / 👎.

Align default CORS origin with the default control UI URL

The default CORS allowlist is hardcoded to http://localhost:18790, but the new Vite default host path serves from 127.0.0.1:18790 when no explicit host override is provided. When the UI is opened at that default URL, browser requests with Origin: http://127.0.0.1:18790 will not receive Access-Control-Allow-Origin, so cross-origin API calls are blocked despite both sides using defaults.

Useful? React with 👍 / 👎.

Check /api/events path before enforcing auth

handleEventsHttpRequest authenticates the request before it checks whether the path is /api/events or /api/events/stream, and this handler is invoked for every HTTP request from createGatewayHttpServer; when gateway auth is enabled, unrelated unauthenticated routes (for example Control UI/static routes or public plugin routes) will be short-circuited with a 401 here instead of falling through to their own handlers.

Useful? React with 👍 / 👎.

Restore gateway probe routes before 404 fallback

The request pipeline no longer dispatches /health, /healthz, /ready, or /readyz, so those probe URLs now fall through to the generic 404 response; this breaks liveness/readiness checks that previously succeeded and are used by deployment/monitoring paths.

Useful? React with 👍 / 👎.

Route /v1/models and /v1/embeddings in HTTP handler

The compat routing block now jumps directly to OpenResponses/chat-completions handling, with no call to the models or embeddings HTTP handlers, so /v1/models and /v1/embeddings requests will return 404 even when compat endpoints are enabled, breaking OpenAI-compatible clients that rely on those routes.

Useful? React with 👍 / 👎.

Normalize hook session key to target agent namespace

When dispatching /hooks/agent, the code now forwards sessionKey.value directly; if a request targets one agent but supplies an agent:<other>:... session key, the run is scheduled under the mismatched agent-scoped namespace instead of being rebound to the target agent, which can mix isolation boundaries between agents.

Useful? React with 👍 / 👎.

Unsubscribe session listeners on every WS disconnect

Disconnect cleanup now performs registry teardown only for role === "node"; non-node clients that subscribed to session/session-message events are no longer removed on close, leaving stale connection IDs in subscriber registries and causing unbounded registry growth over time unless clients explicitly unsubscribe before disconnecting.

Useful? React with 👍 / 👎.