1.) Don't allow agent auth to be disabled if running in prod

2.) fix ssrf in the fetch url
3.) fix path traversal vuln when uploading files
4.) added rate limiting to web socket upgrading (very needed)
5.) make token revocation from 5 seconds to 500 ms.

Overlord-Server/src/server/agent-auth.ts

@@ -17,8 +17,13 @@ export function isAuthorizedAgentRequest(
     String(process.env.OVERLORD_DISABLE_AGENT_AUTH || "").toLowerCase() ===
     "true";
   if (disableAuth) {
-    logger.info("[auth] Agent auth explicitly disabled by OVERLORD_DISABLE_AGENT_AUTH=true");
-    return true;
+    const nodeEnv = String(process.env.NODE_ENV || "development").toLowerCase();
+    if (nodeEnv === "production") {
+      logger.warn("[auth] OVERLORD_DISABLE_AGENT_AUTH is ignored in production mode");
+    } else {
+      logger.info("[auth] Agent auth explicitly disabled by OVERLORD_DISABLE_AGENT_AUTH=true (non-production mode)");
+      return true;
+    }
   }
 
   const token = agentToken?.trim();