Commit Graph

5 Commits

Author SHA1 Message Date
Brandon Zhang
372e30ff6f Hardcode Python default empty response 2026-03-27 17:54:38 +08:00
009fd039a2 feat: optional Bearer-token authentication via API_TOKEN env var
Disabled by default (empty API_TOKEN). When set:
- All /api/* and /mcp requests require: Authorization: Bearer <token>
- Public exemptions: /, /healthz, /static/*, /auth-check
- Web UI: pre-flight /auth-check on load; shows token modal if required
- Token stored in sessionStorage, sent on every API request
- Mid-session 401s re-trigger the token modal
- MCP clients must pass the header: Authorization: Bearer <token>
Files changed:
- app/config.py: api_token field + API_TOKEN env var
- app/api/auth.py: Starlette BaseHTTPMiddleware for token enforcement
- main.py: register middleware + /auth-check public endpoint
- static/js/api.js: token storage, auth header, 401 handler hook
- static/js/app.js: auth pre-flight, showTokenModal(), bootstrap()
- static/css/components.css: .auth-overlay / .auth-card styles
- README.md: API_TOKEN env var docs + MCP client header example
2026-03-27 04:28:12 +08:00
1cc75afe87 feat: add server.sh bash management script (macOS/Linux)
Equivalent to server.ps1 for bash environments:
- start / stop / restart / status / logs [N|-f]
- Detached background process via nohup
- PID file in logs/ with live-process verification
- Port-based fallback detection via lsof
- Memory reporting (Linux /proc + macOS ps)
- Colour output with ANSI codes
- stderr error highlighting in status view
- Follow mode (-f) for live log tailing
2026-03-27 04:21:40 +08:00
589f45ba32 refactor: remove wait_seconds from get_user_request tool
Wait time is now fully server-controlled via default_wait_seconds setting.
Agents can no longer request a different wait duration - only the user
controls this via the web UI.
- Remove wait_seconds param from get_user_request signature
- Simplify actual_wait to min(cfg.default_wait_seconds, MAX_WAIT)
- Update Settings panel label from 'Min Wait' to 'Wait (sec)'
- Update hint text to explain server-only control
- Update README: input schema, behavior rules, settings description, changelog
2026-03-27 04:16:33 +08:00
86eba27a24 init 2026-03-27 03:58:57 +08:00