Add env-gated local auth bypass for development

[marcusschiesser]

Problem

Local development currently requires a valid Better Auth session before most authenticated routes and pages can be used. This makes it harder to test app behavior locally when OAuth is not configured or when you want to work without signing in through Vercel/GitHub.

Desired behavior

Add a development-only auth bypass that can be explicitly enabled with an environment variable.

When enabled:

• the app should provide a local fallback authenticated user if no Better Auth session exists

When disabled:

• the app should behave exactly as it does today
• no fallback session should be created

Proposed solution

Introduce an env-gated auth bypass, for example:

• AUTH_BYPASS=true enables the fallback session
• AUTH_BYPASS=false or unset keeps the feature off

This branch is implementing such a behavior:

https://github.com/vercel-labs/open-agents/compare/main...marcusschiesser:open-agents:auth-bypass-upstream?expand=1

[shivansh-engineer]

Hi, I'd love to contribute this! I've implemented the fix on my fork: https://github.com/shivansh-engineer/open-agents/tree/feat/auth-bypass-dev

The approach:

• New dev-bypass.ts module that exports DEV_SESSION — active only when AUTH_BYPASS=true and NODE_ENV=development
• One-line early return in both get-server-session.ts and server.ts
• .env.example updated with a 'never use in production' note

Double-gated so there's zero risk of it leaking into production. Happy to open a PR if collaborator access can be granted, or if a maintainer wants to cherry-pick the changes.