Six related fixes from the recent codebase audit:
1. Auth bypass on /v1/chat/completions — guard was 'if (authHeader && !isLocal)'
so any non-local caller that simply omitted the Authorization header skipped
the check entirely. Server binds 0.0.0.0; this exposed the proxy to any LAN
peer. Fix: 'if (!isLocal)' always require a valid Bearer for non-local.
2. Health-check auto-disable conflated network errors with bad keys. Three
transient timeouts (15 min) silently flipped enabled=0 on perfectly valid
keys (burned us this session). Fix:
- validateKey() in OpenAICompatProvider/google/cohere/cloudflare no longer
swallows transport errors — they propagate.
- health.ts catch branch sets status='error' but does NOT increment the
consecutive-failure counter. Only confirmed 401/403 (validateKey returns
false) counts toward auto-disable.
3. Removed Hugging Face / Moonshot / MiniMax direct integrations from the
live surface (PLATFORMS allowlist, providers…
