- Shipped
- September 28, 2026 at 4:52 PM UTC
- Author
- Kamo
- Commit
- 37c0363
**************** matched PathPrefix(`/desktop-ws`) on internal.* and stripped the prefix, so **************** reached ANY SecurityService path from the internet - /api/internal/** and /api/security/internal/** included (the DAV sign-in, the KamoAI credential issue), bypassing APIService's carve-outs (KamoAI master spec 7.13) with a shared secret as the only gate. Checked live before this change: **************** answered SecurityService's 405 and /desktop-ws/actuator/health its 200. The match is now the one socket path, **************** SecurityService serves one WebSocket (/ws/terminal) and both clients (kamo-internal terminalSocket.ts, public route to kamowssecurity-service matches an exact Path(), never a prefix. SP99 final review I-4.