Let hubs read the OpenAccess descriptor without paying the crawl gate

[ralyodio]

The x402 crawl gateway in middleware refused /.well-known/openaccess.json to fetchers without browser headers, so the descriptor merged in #1015 was never reachable. Adds the path to the gateway's open paths.

🤖 Generated with Claude Code

https://claude.ai/code/session_01SWRffW4ifQPUrGXJtgYWMd

[github-actions]

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.

[github-actions]

ThreatCrush Security Scan

49 finding(s)

HIGH/CRITICAL: 1 | MEDIUM: 14 | LOW: 34

Severity	Rule	Location
HIGH	js-host-header-trust	packages/bots/wechat/src/index.ts:405
MEDIUM	redos-nested-quantifier	packages/actions-fleet-core/src/action-pack/schema.ts:3
MEDIUM	redos-nested-quantifier	packages/core/src/setup-helpers.ts:583
MEDIUM	redos-nested-quantifier	packages/policy/src/rules/bundle-id.ts:3
MEDIUM	sql-string-concatenation	packages/targets/deploy-wordpress/src/index.ts:154
MEDIUM	redos-nested-quantifier	packages/targets/desktop-linux/src/index.ts:19
MEDIUM	redos-nested-quantifier	packages/targets/desktop-mac/src/index.ts:15
MEDIUM	redos-nested-quantifier	packages/targets/desktop-steamos/src/index.ts:28
MEDIUM	redos-nested-quantifier	packages/targets/mobile-android/src/index.ts:9
MEDIUM	redos-nested-quantifier	packages/targets/mobile-ios/src/index.ts:11
MEDIUM	redos-nested-quantifier	packages/targets/tv-androidtv/src/index.ts:14
MEDIUM	redos-nested-quantifier	packages/targets/tv-firetv/src/index.ts:13
MEDIUM	redos-nested-quantifier	packages/targets/tv-tvos/src/index.ts:14
MEDIUM	redos-nested-quantifier	packages/targets/tv-webos/src/index.ts:26
MEDIUM	js-unescaped-html-sink	sites/sh1pt.com/app/blog/[slug]/page.tsx:76
LOW	secret-generic-credential	packages/affiliates/skimlinks/src/index.test.ts:25
LOW	secret-generic-credential	packages/affiliates/skimlinks/src/index.test.ts:71
LOW	secret-generic-api-key	packages/affiliates/sovrn/src/index.ts:28
LOW	secret-generic-credential	packages/agent-providers/opencode/src/__tests__/opencode.test.ts:99
LOW	js-nosql-injection	packages/ai/amazon-bedrock/src/index.test.ts:121
LOW	secret-generic-credential	packages/ai/amazon-bedrock/src/index.ts:9
LOW	secret-generic-credential	packages/ai/amazon-bedrock/src/index.ts:10
LOW	secret-generic-credential	packages/ai/amazon-bedrock/src/index.ts:11
LOW	secret-generic-credential	packages/bridges/matrix/src/index.ts:58
LOW	secret-generic-credential	packages/bridges/matrix/src/index.ts:59
LOW	secret-generic-credential	packages/bridges/slack/src/index.test.ts:259
LOW	secret-generic-credential	packages/captcha/captchasolver/src/index.ts:34
LOW	secret-generic-credential	packages/cli/src/commands/secrets.ts:189
LOW	secret-generic-credential	packages/cloud/linode/src/index.ts:15
LOW	secret-generic-credential	packages/observability/sentry/src/index.ts:15
LOW	secret-generic-credential	packages/outreach/producthunt/src/index.ts:103
LOW	secret-generic-credential	packages/promo/posthog/src/index.ts:23
LOW	secret-generic-credential	packages/scanners/threatcrush/test/scan-output.txt:35
LOW	secret-generic-credential	packages/scanners/threatcrush/test/scan-output.txt:40
LOW	secret-database-url	packages/scanners/threatcrush/test/scan-output.txt:54
LOW	secret-generic-credential	packages/security/snyk/src/index.ts:26
LOW	secret-generic-credential	packages/social/hashnode/src/index.ts:4
LOW	secret-generic-credential	packages/social/linkedin/src/index.ts:3
LOW	secret-generic-credential	packages/social/linkedin/src/index.ts:4
LOW	secret-generic-credential	packages/social/medium/src/index.ts:4
LOW	secret-generic-credential	packages/social/snapchat/src/index.ts:5
LOW	secret-generic-credential	packages/social/tiktok/src/index.ts:5
LOW	secret-generic-credential	packages/targets/plugin-vscode/src/index.test.ts:115
LOW	secret-generic-credential	packages/targets/registry-ans/src/index.test.ts:79
LOW	secret-generic-credential	packages/targets/registry-ans/src/index.ts:49
LOW	secret-generic-credential	packages/targets/sdk-pypi/src/index.test.ts:49
LOW	secret-generic-credential	packages/vcs/gitlab/src/index.test.ts:96
LOW	secret-generic-credential	sites/sh1pt.com/supabase/config.toml:303
LOW	secret-generic-credential	sites/sh1pt.com/supabase/config.toml:335

Snippets are redacted; ThreatCrush never prints matched credential material.