1.6.0

Authenticate before anything: every agent task endpoint checks the api-key before it reads the request body, builds a path or touches the disk — and every refusal looks the same.

Upgrade notes (read before rolling out)

• CONTROL_PLANE_ENABLED=true now requires your own CONTROL_PLANE_TOKEN. The agent refuses to start when it is empty or the published default REPLACE_THIS_TEST_CONTROL_PLANE_TOKEN. With the control plane off nothing changes. The token is now masked in the startup log.
• The config type must match the endpoint (ZIP_ARCHIVE, ZIP_DIRS, SAVE_ARTIFACT, FETCH_URL, JAR, WAR, NODE, DOCKER); another type gets 401. A config without type still works, with a "has no type" warning in the agent log — add the field. Watch for an old node config saved through the operator as JAR. Before upgrading, on each host: grep -H '"type"\|^type:' $CONFIG_DIR/* and compare with the endpoint each command is called through.
• Command names outside 0-9 a-z A-Z . _ - or containing .. get 401 (the operator never created such names).
• zip-dirs: the sub-path segments . and .. are rejected.

Security fixes

• zip-dirs escaped its dir: Jetty 12 passes a raw .. through to the servlet, so /zip-dirs/{name}/.. extracted above dir; a link inside dir could lead out too. Now ./.. are refused and the target must stay inside the canonical dir. Also, an anonymous request created directories under dir — directories are now created only after authorization.
• A key of one command worked on another endpoint: keys belong to a config name and type was never checked, so a save-artifact key could unpack an arbitrary archive through /zip-archive/{same name} into the same dir (likewise jar/war/node).
• Name enumeration and path disclosure: an unknown command name returned 500 with the absolute CONFIG_DIR path; empty or broken configs leaked parser messages. Every refusal — no key, wrong key, unknown command, broken config, another type — is now the same 401 Unauthorized; the reason goes to the agent log only, never a key.
• Control plane behind the published default token let anyone create a command with their own key and deploy through it — see the upgrade note.
• Authorization header: only Basic is accepted (a Bearer value is no longer Base64-decoded), bad Base64 is a 401 instead of a 500, and a password may contain :.

Docs

• The false "a config without apiKeys accepts any request" is gone (the code already refused every request); security, configuration, installation and every command page describe the new checks, and each example config carries its type.

Known issues: #99 (a misspelled type value reads as no type), #100 (Jetty 12 rejects /fetch-url/https://... with 400 — pre-existing).

Full docs: https://evsinev.github.io/dc-agent/

---

What's Changed

• fix(agent)!: authenticate before anything on every task endpoint by @evsinev in #101

Full Changelog: 1.5.0...1.6.0