The middleware allowlist never included the agent-discovery surfaces, so
every anonymous request to /llms.txt, /llms-full.txt, or /docs/* was
307-bounced to /login on hosted. The llms.txt convention exists for
logged-out crawlers and IDE agents, and /docs is the public API
documentation that the OpenAPI spec and the installable accounted-api
skill link to. openapi.json and /.well-known/* only escaped because the
proxy matcher skips .json and .well-known paths.
Signed-in users fall through to the same content with no redirect.
Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
