[LinuxDevil]

Fixes audit finding (Vercel competitor audit, 2026-10-19).

What was wrong

With LOUSHO_API_TOKEN set, the built server printed the httpChannel 'unauthenticated' warning and then 'http (behind the server auth)'. docs/channels.md still said webhookChannel returns the turn's ExecutionResult.

What changed

• httpChannel warning (and the verify JSDoc) now say: unless the server in front checks auth (built node-server does with LOUSHO_API_TOKEN or auth.ts), anyone who can reach it can use the agent and guess sessionKey values. Still once per instance.
• docs/channels.md webhookChannel row: replies { sessionId, text, finishReason, approval? }, full ExecutionResult with fullResult: true; signature lists fullResult.
• Regenerated llms.txt / llms-full.txt.

Tests

httpChannel.test.ts now asserts the new wording and that it no longer says 'is unauthenticated'. tsc, typecheck:tests, lint, channel tests, fallow (exit 0) pass. Full coverage run: only packages/create-lousho-agent tests fail (unbuilt dist / local pack+install e2e), environment-specific.

Changelog: httpChannel's no-verify warning no longer contradicts the built server's token gate; channels docs show webhookChannel's real reply shape.

🤖 Generated with Claude Code