Fix endpoint visibility, A2A status, and API catalog

[rdself]

Summary

• Add a persisted Appearance setting for the Endpoint ngrok Tunnel panel.
• Skip ngrok status loading and polling when the panel is hidden.
• Honor A2A endpoint enablement in both API behavior and dashboard status, so an OFF service reports disabled/offline instead of open.
• Add an API Catalog error state for failed OpenAPI loads, and keep Next.js assets fresh across PWA service worker updates.
• Update tests, validation schemas, i18n labels, and docs.

Validation

• npm run typecheck:core
• node --import tsx/esm --test tests/unit/settings-api.test.ts tests/unit/settings-schema-routing-strategies.test.ts
• node --import tsx/esm --test tests/unit/a2a-enabled-route.test.ts tests/unit/db-settings-crud.test.ts tests/unit/openapi-spec-route.test.ts
• npx vitest run "src/app/(dashboard)/dashboard/endpoint/tests/EndpointPageClient.test.tsx" "src/app/(dashboard)/dashboard/endpoint/tests/ApiEndpointsTab.test.tsx" --config vitest.config.ts
• npx eslint "src/app/(dashboard)/dashboard/endpoint/page.tsx" "src/app/(dashboard)/dashboard/endpoint/ApiEndpointsTab.tsx" "src/app/api/a2a/status/route.ts" "src/app/a2a/route.ts" "src/app/(dashboard)/dashboard/endpoint/tests/ApiEndpointsTab.test.tsx" "tests/unit/a2a-enabled-route.test.ts" "public/sw.js"
• npm run check:docs-sync
• git diff --check
• npm run test:unit

Browser verification

• Started the local dev server with Node 24 and verified /dashboard/endpoint in the browser.
• Confirmed the A2A tab shows Offline/OFF plus a disabled-service panel when A2A is off.
• Confirmed API Endpoints renders the API Catalog content instead of a blank page.
• Confirmed Appearance exposes the ngrok Tunnel visibility toggle alongside the existing tunnel toggles.
• Stopped the local dev server after verification.

Notes

• Pre-commit was bypassed because check:any-budget:t11 fails on an existing explicit any in open-sse/executors/base.ts, which this change does not touch; the full pre-push unit suite passed.

[gemini-code-assist]

Code Review

This pull request introduces visibility controls for the ngrok tunnel panel on the dashboard, allowing users to show or hide it via the Appearance settings. It updates the corresponding API schemas, client-side state management, and documentation. I have identified an issue regarding the inconsistent handling of the ngrok token state when the panel is hidden, which could lead to data loss compared to the existing Tailscale implementation.

[gemini-code-assist]

When the ngrok tunnel panel is hidden, the ngrokToken state is reset to an empty string. This behavior is inconsistent with the Tailscale implementation, where tailscalePassword is preserved even if its panel is hidden. If a user enters a token but accidentally toggles the visibility in another tab or triggers a settings reload, their input will be lost. Consider preserving the token state to improve user experience.

[rdself]

Fixed in 2371a4f by preserving the ngrok token state when the panel is hidden.

[Copilot]

Pull request overview

Adds a persisted Appearance preference to hide/show the ngrok tunnel panel on the Endpoint page, and tightens A2A enablement behavior so the API and dashboard reflect the service being disabled when toggled OFF.

Changes:

• Persist and apply an “Endpoint tunnel visibility” toggle for the ngrok tunnel panel; skip ngrok loading/polling when hidden.
• Gate A2A status + JSON-RPC behavior on the persisted a2aEnabled setting, and update dashboard UX for disabled state.
• Add an API Catalog error UI state, refresh PWA cache behavior for Next.js assets, and expand tests/docs/i18n accordingly.

Reviewed changes

Copilot reviewed 24 out of 24 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/unit/settings-schema-routing-strategies.test.ts	Verifies settings schemas accept the new tunnel visibility toggles.
tests/unit/settings-api.test.ts	Ensures settings API persists/returns hideEndpointNgrokTunnel.
tests/unit/db-settings-crud.test.ts	Asserts new default settings values for mcpEnabled / a2aEnabled.
tests/unit/a2a-enabled-route.test.ts	New unit tests for A2A disabled/enablement behavior in status + JSON-RPC.
src/types/settings.ts	Extends Settings types with protocol toggles and ngrok visibility flag.
src/shared/validation/settingsSchemas.ts	Adds hideEndpointNgrokTunnel to settings route validation.
src/shared/validation/schemas.ts	Adds endpoint tunnel visibility toggles to shared validation schema.
src/lib/db/settings.ts	Adds defaults for mcpEnabled, a2aEnabled, and hideEndpointNgrokTunnel.
src/i18n/messages/en.json	Adds labels/descriptions for Endpoint tunnel visibility + ngrok toggle.
src/i18n/messages/zh-CN.json	Adds Chinese translations for the new Appearance labels.
src/app/api/a2a/status/route.ts	Returns disabled/offline A2A status when a2aEnabled is false.
src/app/a2a/route.ts	Rejects JSON-RPC calls with 503 when A2A is disabled.
src/app/(dashboard)/dashboard/settings/components/AppearanceTab.tsx	Adds Appearance UI toggle for ngrok tunnel panel visibility.
src/app/(dashboard)/dashboard/endpoint/page.tsx	Updates A2A tab rendering to show a disabled-service panel when OFF.
src/app/(dashboard)/dashboard/endpoint/tests/EndpointPageClient.test.tsx	Ensures ngrok status isn’t fetched when ngrok panel is hidden.
src/app/(dashboard)/dashboard/endpoint/tests/ApiEndpointsTab.test.tsx	New tests for API catalog error state and successful render.
src/app/(dashboard)/dashboard/endpoint/EndpointPageClient.tsx	Skips ngrok status load/polling and clears ngrok state when hidden.
src/app/(dashboard)/dashboard/endpoint/ApiEndpointsTab.tsx	Adds API catalog error state UI when OpenAPI load fails.
public/sw.js	Bumps cache version and adds network-first caching for /_next/* assets.
docs/USER_GUIDE.md	Documents tunnel panel visibility controls in Appearance settings.
docs/FEATURES.md	Updates features list to mention endpoint tunnel visibility controls.
docs/API_REFERENCE.md	Documents /api/tunnels/ngrok endpoints.
docs/A2A-SERVER.md	Documents A2A enablement behavior and disabled error code.
README.md	Updates README to mention tunnel visibility controls and A2A enablement requirement.

Comments suppressed due to low confidence (1)

src/app/a2a/route.ts:124

• rejectIfA2ADisabled() runs before the auth check, which means unauthenticated callers can probe whether A2A is enabled/disabled and will get a 503 instead of the usual unauthorized response when an API key is configured. Consider authenticating first (when OMNIROUTE_API_KEY is set) and only then returning the disabled error to avoid information disclosure and keep error semantics consistent.

export async function POST(req: NextRequest) {
  const disabledResponse = await rejectIfA2ADisabled();
  if (disabledResponse) return disabledResponse;

  // Auth check
  if (!authenticate(req)) {
    return jsonRpcError(null, -32600, "Unauthorized: missing or invalid API key");
  }

[Copilot]

The disabled-response is returned before parsing the request body, so the JSON-RPC response always uses id: null. For well-formed JSON-RPC requests that include an id, clients expect the same id echoed back even for server errors; consider parsing the body (or at least extracting id) before returning the disabled error so callers can correlate responses.

[rdself]

Fixed in 2371a4f by authenticating before the disabled-state check and echoing the JSON-RPC request id in the disabled response.

[diegosouzapw]

Thanks @rdself for this great contribution! 🎉 It's now officially merged into the release/v3.7.6 branch and will be part of the next release. We deeply appreciate your effort!