opencode/picoclaw
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
picoclaw/web/backend/api
History
zeed zhao 6ea364e67d
feat(web): protect launcher dashboard with token and SPA login (#1953) 
Add token-based authentication for the Launcher's embedded Web Dashboard.

- Ephemeral token generated in-memory each run (or via PICOCLAW_LAUNCHER_TOKEN env var)
- HMAC-SHA256 session cookie (HttpOnly, SameSite=Lax, Secure when HTTPS)
- Bearer token support for API/script access
- Rate limiting on login (10 attempts/IP/min)
- Referrer-Policy: no-referrer on all responses
- POST-only logout with JSON content-type (CSRF-safe)
- System tray "Copy dashboard token" action
- Login page shows contextual help (console/tray/log file path)
- Path traversal protection via path.Clean
- X-Forwarded-Host/Port/Proto support for reverse proxy deployments
- Full i18n support (English, Chinese)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-29 13:11:43 +08:00
..
auth.go feat(web): protect launcher dashboard with token and SPA login (#1953) 2026-03-29 13:11:43 +08:00
auth_login_limiter.go feat(web): protect launcher dashboard with token and SPA login (#1953) 2026-03-29 13:11:43 +08:00
auth_test.go feat(web): protect launcher dashboard with token and SPA login (#1953) 2026-03-29 13:11:43 +08:00
channels.go refactor(wecom): rebuild ai bot channel 2026-03-24 20:23:29 +08:00
config.go refactor config and security to simplified the structure (#2068) 2026-03-28 00:03:34 +08:00
config_test.go refactor config and security to simplified the structure (#2068) 2026-03-28 00:03:34 +08:00
gateway.go fix: unified restart required (#1978) 2026-03-28 22:13:50 +08:00
gateway_host.go feat(web): protect launcher dashboard with token and SPA login (#1953) 2026-03-29 13:11:43 +08:00
gateway_host_test.go feat(web): protect launcher dashboard with token and SPA login (#1953) 2026-03-29 13:11:43 +08:00
gateway_test.go fix: unified restart required (#1978) 2026-03-28 22:13:50 +08:00
launcher_config.go feat(web): migrate launcher to modular web frontend/backend and improve management UX (#1275) 2026-03-09 19:42:03 +08:00
launcher_config_test.go refactor Config to add Version and migratable 2026-03-12 13:52:55 +08:00
log.go refactor Config to add Version and migratable 2026-03-12 13:52:55 +08:00
model_status.go Merge branch 'main' into version 2026-03-23 15:00:18 +08:00
model_status_test.go Merge branch 'main' into version 2026-03-23 15:00:18 +08:00
models.go feat(models): add extra_body config field in model add/edit UI (#1969) 2026-03-25 11:11:02 +08:00
models_test.go refactor config and security to simplified the structure (#2068) 2026-03-28 00:03:34 +08:00
oauth.go refactor: seperate security.yml for store keys 2026-03-22 01:55:00 +08:00
oauth_test.go refactor config and security to simplified the structure (#2068) 2026-03-28 00:03:34 +08:00
pico.go feat(web): protect launcher dashboard with token and SPA login (#1953) 2026-03-29 13:11:43 +08:00
pico_test.go refactor config and security to simplified the structure (#2068) 2026-03-28 00:03:34 +08:00
router.go feat(web): add WeCom QR binding flow to channel settings (#1994) 2026-03-25 16:15:04 +08:00
session.go refactor Config to add Version and migratable 2026-03-12 13:52:55 +08:00
session_test.go refactor Config to add Version and migratable 2026-03-12 13:52:55 +08:00
skills.go refactor: centralize environment variable key constants (#1730) 2026-03-18 18:03:24 +08:00
skills_test.go refactor Config to add Version and migratable 2026-03-12 13:52:55 +08:00
startup.go feat(web): migrate launcher to modular web frontend/backend and improve management UX (#1275) 2026-03-09 19:42:03 +08:00
startup_test.go feat(web): migrate launcher to modular web frontend/backend and improve management UX (#1275) 2026-03-09 19:42:03 +08:00
tools.go feat(tools): add SpawnStatusTool for reporting subagent statuses (#1540) 2026-03-17 14:41:43 +08:00
tools_test.go refactor Config to add Version and migratable 2026-03-12 13:52:55 +08:00
wecom.go feat(web): add WeCom QR binding flow to channel settings (#1994) 2026-03-25 16:15:04 +08:00
weixin.go feat(web): improve Weixin channel binding flow (#1968) 2026-03-24 20:33:32 +08:00
weixin_test.go refactor config and security to simplified the structure (#2068) 2026-03-28 00:03:34 +08:00