AI-written verify_token() returned early when CALL_SERVER_TOKEN was unset, letting unauthenticated callers list, read, invoke, and unregister agents on the public server.

     BaseModel = object     Field = lambda *args, **kwargs: None

+    +    # Check Authorization header first (Bearer or Basic)+    if authorization:+        if authorization.startswith("Bearer "):+            token = authorization.split(" ")[1]+        elif authorization.startswith("Basic "):+            try:+                import base64+                decoded = base64.b64decode(authorization[6:]).decode("utf-8")+                if ":" in decoded:+                    token = decoded.split(":", 1)[1]  # Use password as token+                else:+                    token = decoded+            except Exception:+                pass+    +    # Check query param as fallback

         Invoke a PraisonAI agent with a message.@@ -150,7 +189,7 @@ async def invoke_agent(             logger.error(f"Agent not found: {agent_id}")             raise HTTPException(                 status_code=404,-                detail=f"Agent '{agent_id}' not found. Available agents: {list_registered_agents()}"+                detail=f"Agent '{agent_id}' not found"             )                  try:@@ -168,8 +207,10 @@ async def invoke_agent(                 # Async agent                 result = await agent.astart(request.message)             elif _supports_sync_start(agent):-                # Sync agent (use start method)-                result = agent.start(request.message)+                # Sync agent - run in thread pool to avoid blocking the event loop+                import asyncio+                loop = asyncio.get_event_loop()+                result = await loop.run_in_executor(None, agent.start, request.message)             else:                 raise AttributeError(f"Agent {agent_id} must provide start() or async astart()")             

+    if not isinstance(file_path, str) or not file_path:+        raise ValueError("file_path must be a non-empty string")+    if (+        "/" in file_path+        or "\\" in file_path+        or "\x00" in file_path+        or file_path.startswith(".")+        or file_path in ("..", ".")+    ):+        raise ValueError(f"invalid file_path: {file_path!r}")+    if not file_path.endswith((".yaml", ".yml")):+        raise ValueError("file_path must be a .yaml or .yml file")+    base = Path.cwd().resolve()+    candidate = (base / file_path).resolve()+    try:+        candidate.relative_to(base)+    except ValueError as exc:+        raise ValueError(f"invalid file_path: {file_path!r}") from exc+    return candidate++ def register_cli_tools() -> None:     """Register CLI-based MCP tools."""     @@ -44,7 +69,8 @@ def workflow_validate(file_path: str) -> str:         """Validate a workflow YAML file."""         try:             import yaml-            with open(file_path, 'r') as f:+            yaml_path = _resolve_cwd_yaml_path(file_path)+            with open(yaml_path, 'r') as f:                 config = yaml.safe_load(f)                          required = ["framework", "topic"]@@ -64,9 +90,10 @@ def workflow_validate(file_path: str) -> str:     def workflow_show(file_path: str) -> str:         """Show workflow configuration."""         try:-            with open(file_path, 'r') as f:-                content = f.read()-            return content+            yaml_path = _resolve_cwd_yaml_path(file_path)+            return yaml_path.read_text()+        except ValueError as e:+            return f"Error: {e}"         except FileNotFoundError:             return f"File not found: {file_path}"         except Exception as e:@@ -417,7 +444,8 @@ def deploy_validate(config_path: str = "deploy.yaml") -> str:         """Validate deployment configuration."""         try:             import yaml-            with open(config_path, 'r') as f:+            yaml_path = _resolve_cwd_yaml_path(config_path)+            with open(yaml_path, 'r') as f:                 config = yaml.safe_load(f)                          required = ["name", "type"]

+    effective_workspace = workspace or os.getcwd()+    if not os.path.isabs(path):+        abs_path = os.path.abspath(os.path.join(effective_workspace, path))     else:         abs_path = os.path.abspath(path)     @@ -73,14 +74,12 @@ def write_file(             'path': path,         } -    # Security check - ensure path is within workspace if specified-    if workspace:-        if not is_path_within_directory(abs_path, workspace):-            return {-                'success': False,-                'error': f"Path '{path}' is outside the workspace",-                'path': path,-            }+    if not is_path_within_directory(abs_path, effective_workspace):+        return {+            'success': False,+            'error': f"Path '{path}' is outside the workspace",+            'path': path,+        }          # Process content     processed_content = content

     request: Request, 

     token = None