The auth approach switch — from a static API key to session-cookie-based auth via x-forwarded-cookie — is correct and consistent with the established pattern in manageAuth.ts/sessionAuth.ts. One security issue: unlike api-config.ts, this forwards all cookies unfiltered rather than scoping to better-auth cookies only.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ pullfrog.com ｜ 𝕏}

PR Review Summary

(0) Total Issues | Risk: Low

This PR changes the copilot token authentication mechanism from a static API key approach (INKEEP_COPILOT_API_KEY with Bearer header) to session-based authentication via the x-forwarded-cookie header pattern already established throughout the codebase.

Key Observations

✅ Authentication pattern alignment — The x-forwarded-cookie header is already used in sessionAuth.ts, manageAuth.ts, and A2A handlers. This PR correctly adopts the same pattern.

✅ Security improvement — Session-based auth is more secure than static API keys:

• Sessions are tied to specific users with time limits
• Sessions can be revoked at logout
• Static API keys have broader exposure and longer lifespans

✅ Correct middleware flow — The manageBearerOrSessionAuth middleware falls back to sessionAuth() when no Bearer header is present, which reads x-forwarded-cookie and validates the session. This flow is correct.

✅ Proper error handling — The empty cookie check (if (!cookieHeader)) correctly detects missing sessions since getAll().map().join() on an empty array produces an empty string.

✅ Clean code — Moving cookie reading before the fetch (rather than after) is a cleaner approach for authentication-first validation.

Summary: Clean, minimal change that correctly adopts an established authentication pattern in the codebase. The shift from static API key to session-based auth is a security improvement. Ship it! 🚀