fix(api): P1 bundle 2026-05-29 — 7 agent-UX hygiene fixes#178

Merged

mastermanas805 merged 12 commits into

fix/p1-api-bundle-2026-05-29

May 29, 2026

Commits on May 29, 2026

fix(middleware): add request_id + agent_action to idempotency 409 envelope (BUG-API-013)

mastermanas805
and
claude
committed
fix(middleware): differentiate 401 cases via error_code sub-field (BUG-API-051)

mastermanas805
and
claude
committed
fix(router,middleware): reject non-allowlisted CORS preflights with 403 (BUG-API-066/067)

mastermanas805
and
claude
committed
fix(auth,router): /auth/logout idempotent on missing/expired creds (BUG-AUTH-005)

mastermanas805
and
claude
committed
fix(handlers): drop hardcoded 64-char cap from name_too_long agent_action (BUG-AUTH-006)

mastermanas805
and
claude
committed
fix(handlers): accept ?token= as fallback for magic-link ?t= (BUG-API-011)

mastermanas805
and
claude
committed
Merge remote-tracking branch 'origin/master' into fix/p1-api-bundle-2026-05-29
mastermanas805
committed
test(cors): cover empty-token continue branches (patch coverage)

mastermanas805
and
claude
committed
Merge branch 'master' of github.com:InstaNode-dev/api into fix/p1-api-bundle-2026-05-29
mastermanas805
committed
test(middleware): cover AuthErrorInvalidClaims branch (patch coverage)

mastermanas805
and
claude
committed
fix(test): use jwt/v4 (matches existing imports), satisfies go.sum

mastermanas805
and
claude
committed
fix(test): drop unused fiber import
mastermanas805
committed