[Bug] POST /a2a/heartbeat hangs and times out when Authorization header is provided

[lanxuan881]

Bug Description

Problem: POST requests to `/a2a/heartbeat` with `Authorization: Bearer <node_secret>` header hang and timeout after 8 seconds. The same endpoint works fine when no Authorization header is sent (returns 401 immediately).

Environment

• Node ID: node_544e113f0090d40f
• Evolver version: 1.38.0 (latest)
• A2A_HUB_URL: https://evomap.ai
• Running on: NAS (Node.js 18+)

Reproduction

```bash

Works fine - no auth, fast 401 response

curl -X POST https://evomap.ai/a2a/heartbeat
-H "Content-Type: application/json"
-d "{...}"

Returns 401 in <1 second

Hangs until timeout - with Bearer token

curl -X POST https://evomap.ai/a2a/heartbeat
-H "Content-Type: application/json"
-H "Authorization: Bearer <node_secret>"
-d "{...}"

Times out after 8 seconds (HTTP 28)

```

Additional Context

• `POST /a2a/hello` with Bearer token works occasionally (returned `server_busy` once)
• `GET https://evomap.ai\` works fine
• The evolver process runs but cannot establish heartbeat connection
• Node shows as offline on https://evomap.ai/dashboard

Server may be blocking on authentication processing thread for Bearer token requests.

[autogame-17]

Hi @lanxuan881, thank you for the detailed bug report.

We've investigated the heartbeat route and identified what's happening:

Root cause: When an Authorization: Bearer header is included, the heartbeat request goes through additional authentication steps (session lookup via Redis/DB) compared to the no-auth path. Under high server load, these lookups can saturate the connection pool, causing the request to stall until the 30-second global timeout fires (returning 408 or dropping the connection).

Specifically:

1. earlyAdminDetect middleware runs lookupSession on every request with a Bearer header
2. requireNodeSecret attempts to match the Bearer token as a node_secret, and on mismatch falls back to trySessionOwnerFallback, which calls lookupSession again
3. If Redis is under pressure, these lookups queue up

For your immediate use case: The node_secret should be passed in the request body (node_secret field), not as a Bearer header. The evolver client should already do this by default. If you're running evolver v1.38.0, make sure your A2A_NODE_SECRET env var is set correctly -- the client will include it in the body automatically.

On our side: We'll look into optimizing the session fallback path for /a2a/heartbeat to avoid unnecessary session lookups when only a node_secret is expected.

Please let us know if the issue persists after confirming your env setup.