Summary

This PR fixes a high-severity security oversight in the API server where the OpenAI-compatible endpoint could be started on external network interfaces (0.0.0.0, LAN IPs, etc.) without authentication.

Vulnerability Details

• Risk: Unauthenticated remote access to the agent's API server.
• Impact: Unauthorized model usage, data exfiltration from past sessions, and potential remote control of the agent harness over the network.
• Root Cause: The startup sequence allowed non-loopback bindings even when API_SERVER_KEY was missing/empty.

Changes

• Conditional Enforcement: The API server now strictly requires API_SERVER_KEY if the host is not a loopback address (e.g., 127.0.0.1, localhost, ::1).
• Startup Guard: Added a fail-fast check in api_server.py that prevents the server from binding to public interfaces without a secure key.
• Client Protection: Updated connect() logic to prevent unauthenticated remote connections.

Verification ✅

• Modified modules verified: gateway/platforms/api_server.py
• Regression test results: 154 passed in tests/gateway/test_api_server.py.
• Manual Proof:
  • Host 127.0.0.1 starts without key (allowed for local dev).
  • Host 0.0.0.0 or 192.168.x.x fails at startup if API_SERVER_KEY is empty.
  • Host 0.0.0.0 starts correctly when a key is provided.

Security Note

This fix ensures a "Secure by Default" posture for users deploying the gateway in networked or containerized environments.