7 Commits

Author	SHA1	Message	Date
zeed zhao	6ea364e67d	feat(web): protect launcher dashboard with token and SPA login (#1953) ... Add token-based authentication for the Launcher's embedded Web Dashboard. - Ephemeral token generated in-memory each run (or via PICOCLAW_LAUNCHER_TOKEN env var) - HMAC-SHA256 session cookie (HttpOnly, SameSite=Lax, Secure when HTTPS) - Bearer token support for API/script access - Rate limiting on login (10 attempts/IP/min) - Referrer-Policy: no-referrer on all responses - POST-only logout with JSON content-type (CSRF-safe) - System tray "Copy dashboard token" action - Login page shows contextual help (console/tray/log file path) - Path traversal protection via path.Clean - X-Forwarded-Host/Port/Proto support for reverse proxy deployments - Full i18n support (English, Chinese) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-29 13:11:43 +08:00
Cytown	b646d3b8fe	refactor config and security to simplified the structure (#2068)	2026-03-28 00:03:34 +08:00
lxowalle	6bd8fec87a	Fix security config precedence during migration (#1984) ... * Fix security config precedence during migration * add doc * fix ci * add baidu search	2026-03-25 15:29:43 +08:00
Hoshina	a1f95f02bc	refactor(wecom): rebuild ai bot channel	2026-03-24 20:23:29 +08:00
wenjie	d23c24ce72	fix(config): normalize empty security config before save/load (#1956) ... Normalize missing security sections when attaching, loading, and saving security config so existing config files without `.security.yml` can still be updated safely. This fixes Pico channel setup for legacy/existing configs and adds coverage for the missing security file path and unexported JSON field behavior.	2026-03-24 17:03:28 +08:00
Cytown	310f788f5f	rename security.yml to .security.yml	2026-03-23 11:20:42 +08:00
Cytown	e455eb5e67	refactor: seperate security.yml for store keys	2026-03-22 01:55:00 +08:00