PraisonAI added an agent-invocation route without enforcing the configured API key. The repair installs shared authentication middleware on the application.

@@ -289,3 +335,16 @@                     status_code=500,                 )         +        # Add simple /agents/{agent_name} endpoint for n8n compatibility+        @app.post("/agents/{agent_name}")+        async def invoke_single_agent(agent_name: str, request: Request):+            """Invoke a specific agent by name (n8n compatibility endpoint)."""+            try:

+                body = await request.json()+                query = body.get("query", "") or body.get("message", "")+                +                if not query:+                    raise HTTPException(status_code=400, detail="No query or message provided")+                +                # Use the registered agent if available+                try:

@@ -22,5 +39,18 @@+            path = request.url.path+            if path in public or path.startswith("/__praisonai__/"):+                return await call_next(request)+            auth = request.headers.get("Authorization", "")+            header_key = request.headers.get("X-API-Key", "")+            token = auth[7:] if auth.startswith("Bearer ") else header_key+            if not token or not hmac.compare_digest(token, api_key):+                return JSONResponse({"error": "Unauthorized"}, status_code=401)+            return await call_next(request)+

+    app.add_middleware(APIKeyMiddleware)++ class ServeHandler:     """     CLI handler for serve operations.          Commands: