diff --git a/apps/cli/src/http/auth.test.ts b/apps/cli/src/http/auth.test.ts
new file mode 100644
index 00000000..766c7250
--- /dev/null
+++ b/apps/cli/src/http/auth.test.ts
@@ -0,0 +1,139 @@
+import { describe, it, beforeEach } from 'node:test'
+import assert from 'node:assert/strict'
+import { setAuthToken, setRequireAuth, authHook } from './auth'
+
+function fakeRequest(url: string, authorization?: string) {
+  return { url, headers: { authorization } } as never
+}
+
+function fakeReply() {
+  let sentCode = 0
+  let sentBody: unknown = null
+  return {
+    code(c: number) {
+      sentCode = c
+      return this
+    },
+    send(body: unknown) {
+      sentBody = body
+    },
+    get statusCode() {
+      return sentCode
+    },
+    get body() {
+      return sentBody
+    },
+  }
+}
+
+const VALID_TOKEN = 'clb_test_token_12345'
+
+describe('authHook — authentication matrix', () => {
+  beforeEach(() => {
+    setAuthToken(VALID_TOKEN)
+    setRequireAuth(false)
+  })
+
+  // ── No token configured: all routes open ──
+
+  it('passes all routes when no token is configured', async () => {
+    setAuthToken('' as never)
+    // Hack: reset internal state — setAuthToken('') won't set null, use the real function
+    // Actually setAuthToken sets cachedToken to the string value. Empty string is falsy → all pass.
+    const reply = fakeReply()
+    await authHook(fakeRequest('/api/v1/status'), reply as never)
+    assert.equal(reply.statusCode, 0, '/api/* should pass without token configured')
+  })
+
+  // ── /api/* always requires auth ──
+
+  it('rejects /api/* without Bearer header', async () => {
+    const reply = fakeReply()
+    await authHook(fakeRequest('/api/v1/status'), reply as never)
+    assert.equal(reply.statusCode, 401)
+  })
+
+  it('rejects /api/* with wrong token', async () => {
+    const reply = fakeReply()
+    await authHook(fakeRequest('/api/v1/status', 'Bearer wrong_token'), reply as never)
+    assert.equal(reply.statusCode, 401)
+  })
+
+  it('allows /api/* with correct token', async () => {
+    const reply = fakeReply()
+    await authHook(fakeRequest('/api/v1/status', `Bearer ${VALID_TOKEN}`), reply as never)
+    assert.equal(reply.statusCode, 0, 'should not send any error')
+  })
+
+  // ── /_web/* default (requireAuth=false): bypass ──
+
+  it('allows /_web/* without auth when requireAuth=false', async () => {
+    const reply = fakeReply()
+    await authHook(fakeRequest('/_web/sessions'), reply as never)
+    assert.equal(reply.statusCode, 0)
+  })
+
+  // ── /_web/* with requireAuth=true: requires token ──
+
+  it('rejects /_web/* without Bearer when requireAuth=true', async () => {
+    setRequireAuth(true)
+    const reply = fakeReply()
+    await authHook(fakeRequest('/_web/sessions'), reply as never)
+    assert.equal(reply.statusCode, 401)
+  })
+
+  it('rejects /_web/* with wrong token when requireAuth=true', async () => {
+    setRequireAuth(true)
+    const reply = fakeReply()
+    await authHook(fakeRequest('/_web/sessions', 'Bearer bad'), reply as never)
+    assert.equal(reply.statusCode, 401)
+  })
+
+  it('allows /_web/* with correct token when requireAuth=true', async () => {
+    setRequireAuth(true)
+    const reply = fakeReply()
+    await authHook(fakeRequest('/_web/sessions', `Bearer ${VALID_TOKEN}`), reply as never)
+    assert.equal(reply.statusCode, 0)
+  })
+
+  // ── Static files / SPA: always public ──
+
+  it('allows static file paths without auth', async () => {
+    const reply = fakeReply()
+    await authHook(fakeRequest('/index.html'), reply as never)
+    assert.equal(reply.statusCode, 0)
+  })
+
+  it('allows static file paths without auth even with requireAuth=true', async () => {
+    setRequireAuth(true)
+    const reply = fakeReply()
+    await authHook(fakeRequest('/assets/main.js'), reply as never)
+    assert.equal(reply.statusCode, 0)
+  })
+
+  // ── Combined: webRoot + requireAuth (the P0 scenario) ──
+
+  it('P0 regression: /_web/* is protected when both webRoot and requireAuth are active', async () => {
+    setRequireAuth(true)
+    const reply = fakeReply()
+    await authHook(fakeRequest('/_web/ai/llm/providers'), reply as never)
+    assert.equal(reply.statusCode, 401, '/_web/* must NOT bypass auth when requireAuth=true')
+  })
+
+  it('P0 regression: /api/* remains protected regardless of requireAuth flag', async () => {
+    setRequireAuth(false)
+    const reply = fakeReply()
+    await authHook(fakeRequest('/api/v1/status'), reply as never)
+    assert.equal(reply.statusCode, 401, '/api/* must always require auth')
+  })
+
+  // ── setRequireAuth reset ──
+
+  it('setRequireAuth(false) properly resets protection on /_web/*', async () => {
+    setRequireAuth(true)
+    setRequireAuth(false)
+    const reply = fakeReply()
+    await authHook(fakeRequest('/_web/sessions'), reply as never)
+    assert.equal(reply.statusCode, 0, '/_web/* should be open after reset')
+  })
+})
diff --git a/apps/cli/src/http/auth.ts b/apps/cli/src/http/auth.ts
index 1a075a5b..c7f24386 100644
--- a/apps/cli/src/http/auth.ts
+++ b/apps/cli/src/http/auth.ts
@@ -5,11 +5,10 @@
  */
 
 import type { FastifyRequest, FastifyReply } from 'fastify'
-import { timingSafeEqual } from 'crypto'
+import { timingSafeEqual, createHmac, randomBytes } from 'crypto'
 import { unauthorized, errorResponse } from './errors'
 
 let cachedToken: string | null = null
-let webModeEnabled = false
 let requireAuthEnabled = false
 
 /**
@@ -19,14 +18,6 @@ export function setAuthToken(token: string): void {
   cachedToken = token
 }
 
-/**
- * Enable web mode: static resources and SPA paths bypass auth.
- * Only `/api/` routes remain protected.
- */
-export function setWebMode(enabled: boolean): void {
-  webModeEnabled = enabled
-}
-
 /**
  * When enabled, /_web/* routes also require Bearer token (same as /api/*).
  * Used for server/headless deployments where same-origin assumption doesn't hold.
@@ -35,23 +26,32 @@ export function setRequireAuth(enabled: boolean): void {
   requireAuthEnabled = enabled
 }
 
+// Compare via HMAC digests (fixed 32-byte length) to avoid leaking token length
+const hmacKey = randomBytes(32)
+
 function safeTokenCompare(a: string, b: string): boolean {
-  const bufA = Buffer.from(a)
-  const bufB = Buffer.from(b)
-  if (bufA.length !== bufB.length) return false
-  return timingSafeEqual(bufA, bufB)
+  const hashA = createHmac('sha256', hmacKey).update(a).digest()
+  const hashB = createHmac('sha256', hmacKey).update(b).digest()
+  return timingSafeEqual(hashA, hashB)
 }
 
 export async function authHook(request: FastifyRequest, reply: FastifyReply): Promise<void> {
   if (!cachedToken) return
 
-  // /_web/ internal API: skip auth unless require_auth is enabled
-  if (request.url.startsWith('/_web/') && !requireAuthEnabled) return
+  const url = request.url
 
-  // Web mode: only /api/ routes require auth; static files and SPA are public
-  if (webModeEnabled && !request.url.startsWith('/api/')) return
+  // /api/* always requires Bearer token
+  if (url.startsWith('/api/')) {
+    return requireBearerToken(request, reply)
+  }
 
-  return requireBearerToken(request, reply)
+  // /_web/* requires Bearer token when requireAuthEnabled
+  if (url.startsWith('/_web/')) {
+    if (requireAuthEnabled) return requireBearerToken(request, reply)
+    return
+  }
+
+  // Static files and SPA fallback are public
 }
 
 function requireBearerToken(request: FastifyRequest, reply: FastifyReply): void {
diff --git a/apps/cli/src/http/index.ts b/apps/cli/src/http/index.ts
index 71f3cb9b..56eb066b 100644
--- a/apps/cli/src/http/index.ts
+++ b/apps/cli/src/http/index.ts
@@ -18,7 +18,7 @@ import {
   verifyCliDataPath,
 } from '@openchatlab/node-runtime'
 import { createServer } from './server'
-import { setAuthToken, setRequireAuth, setWebMode } from './auth'
+import { setAuthToken, setRequireAuth } from './auth'
 import { registerSystemRoutes } from './routes/system'
 import { registerSessionRoutes } from './routes/sessions'
 import { registerWebRoutes } from './routes/web'
@@ -124,9 +124,7 @@ export async function startHttpServer(options?: HttpServerOptions): Promise<{
   initServerAiLogger(pathProvider.getLogsDir())
 
   setAuthToken(token)
-  if (options?.requireAuth ?? config.api.require_auth) {
-    setRequireAuth(true)
-  }
+  setRequireAuth(!!(options?.requireAuth ?? config.api.require_auth))
 
   server = createServer()
 
@@ -145,7 +143,6 @@ export async function startHttpServer(options?: HttpServerOptions): Promise<{
   initSync(server, dbManager, pathProvider, { port, host, token })
 
   if (options?.webRoot && fs.existsSync(options.webRoot)) {
-    setWebMode(true)
     // 注册反向代理：将 /_proxy/chatlab.fun/* 转发至 https://chatlab.fun，
     // 行为与 vite dev proxy 一致，解决浏览器 CORS 问题（见 vite.web.config.mts:138-144）。
     // 必须在 @fastify/static 之前注册，确保显式路由优先于静态文件/SPA fallback。
@@ -186,7 +183,7 @@ export async function stopHttpServer(): Promise<void> {
       dbManager = null
     }
     closeServerAiLogger()
-    setWebMode(false)
+    setRequireAuth(false)
     server = null
   }
 }
diff --git a/package.json b/package.json
index 3b9a5587..5f6a58ce 100644
--- a/package.json
+++ b/package.json
@@ -39,6 +39,7 @@
     "type-check:node": "tsc --noEmit -p apps/desktop/tsconfig.node.json",
     "type-check:all": "pnpm run type-check:web && pnpm run type-check:node",
     "type-check": "vue-tsc --noEmit -p tsconfig.web.json",
+    "test:auth": "tsx --test apps/cli/src/http/auth.test.ts src/services/utils/http.test.ts",
     "test:agent-context": "node --experimental-strip-types --test apps/desktop/main/ai/context/sessionLog.test.mjs",
     "test:e2e:launcher": "node --test tests/e2e/helpers/app-launcher.test.js",
     "test:e2e:smoke": "node tests/e2e/run-smoke.js"
diff --git a/src/App.vue b/src/App.vue
index 7941b8c8..232ed78e 100644
--- a/src/App.vue
+++ b/src/App.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { computed, onMounted, onUnmounted } from 'vue'
+import { computed, onMounted, onUnmounted, ref, watch } from 'vue'
 import { storeToRefs } from 'pinia'
 import { useRoute, useRouter } from 'vue-router'
 import { useI18n } from 'vue-i18n'
@@ -30,7 +30,8 @@ const { isInitialized } = storeToRefs(sessionStore)
 const route = useRoute()
 const router = useRouter()
 
-const isLoginPage = computed(() => route.name === 'login')
+const isLoginPage = computed(() => !IS_ELECTRON && route.name === 'login')
+const initError = ref<string | null>(null)
 
 const tooltip = {
   delayDuration: 100,
@@ -42,6 +43,26 @@ const toaster = {
   duration: 2000,
 }
 
+let initInProgress = false
+
+async function initializeApp() {
+  if (initInProgress || isInitialized.value) return
+  initInProgress = true
+  initError.value = null
+  try {
+    await initServices()
+    await initPreferencesSync()
+    await settingsStore.initLocale()
+    llmStore.init()
+    await sessionStore.loadSessions()
+  } catch (err) {
+    console.error('App initialization failed:', err)
+    initError.value = err instanceof Error ? err.message : String(err)
+  } finally {
+    initInProgress = false
+  }
+}
+
 function handleGlobalKeydown(e: KeyboardEvent) {
   const isMeta = navigator.platform.toLowerCase().includes('mac') ? e.metaKey : e.ctrlKey
   if (isMeta && e.key === ',') {
@@ -53,6 +74,11 @@ function handleGlobalKeydown(e: KeyboardEvent) {
   }
 }
 
+// After login success, route changes from login → app; trigger init
+watch(isLoginPage, (isLogin) => {
+  if (!isLogin) initializeApp()
+})
+
 onMounted(async () => {
   window.addEventListener('keydown', handleGlobalKeydown)
   const platform = navigator.platform.toLowerCase()
@@ -63,25 +89,24 @@ onMounted(async () => {
   }
 
   if (!IS_ELECTRON) {
-    let redirecting = false
+    let redirectingTo401 = false
     const on401 = () => {
-      if (redirecting || router.currentRoute.value.name === 'login') return
-      redirecting = true
+      if (redirectingTo401 || router.currentRoute.value.name === 'login') return
+      redirectingTo401 = true
+      authStore.markRequiresAuth()
+      authStore.logout()
       const currentPath = router.currentRoute.value.fullPath
       const redirect = currentPath.startsWith('/login') ? '/' : currentPath
-      authStore.logout()
-      router.push({ name: 'login', query: { redirect } })
+      router.push({ name: 'login', query: { redirect } }).finally(() => {
+        redirectingTo401 = false
+      })
     }
-    configureHttpClient({ token: authStore.token || undefined, on401 })
+    configureHttpClient({ getToken: () => authStore.token, on401 })
   }
 
   if (isLoginPage.value) return
 
-  await initServices()
-  await initPreferencesSync()
-  await settingsStore.initLocale()
-  llmStore.init()
-  await sessionStore.loadSessions()
+  await initializeApp()
 })
 
 onUnmounted(() => {
@@ -101,7 +126,15 @@ onUnmounted(() => {
         <!-- 主内容区域 -->
         <template v-if="!isInitialized">
           <div class="flex h-full w-full items-center justify-center">
-            <div class="flex flex-col items-center justify-center text-center">
+            <div v-if="initError" class="flex flex-col items-center justify-center gap-3 text-center">
+              <UIcon name="i-heroicons-exclamation-triangle" class="h-8 w-8 text-red-500" />
+              <p class="text-sm text-gray-700 dark:text-gray-300">{{ t('common.initFailed') }}</p>
+              <p class="max-w-sm text-xs text-gray-500">{{ initError }}</p>
+              <UButton size="sm" color="primary" variant="soft" @click="initializeApp">
+                {{ t('common.retry') }}
+              </UButton>
+            </div>
+            <div v-else class="flex flex-col items-center justify-center text-center">
               <UIcon name="i-heroicons-arrow-path" class="h-8 w-8 animate-spin text-pink-500" />
               <p class="mt-2 text-sm text-gray-500">{{ t('common.initializing') }}</p>
             </div>
diff --git a/src/i18n/locales/en-US/common.json b/src/i18n/locales/en-US/common.json
index ce416331..269012ea 100644
--- a/src/i18n/locales/en-US/common.json
+++ b/src/i18n/locales/en-US/common.json
@@ -11,6 +11,7 @@
   "back": "Back",
   "done": "Done",
   "retry": "Retry",
+  "initFailed": "App initialization failed",
   "loading": "Loading...",
   "initializing": "Initializing...",
   "noData": "No data",
@@ -137,10 +138,12 @@
     "tokenLabel": "API Token",
     "tokenPlaceholder": "clb_xxxxxxxx",
     "submit": "Login",
-    "hint": "You can find the token in the chatlab startup log",
+    "hint": "Find the token in the startup log, config.toml, or the --token flag",
     "errorEmpty": "Please enter a token",
     "errorInvalid": "Invalid token, please check and try again",
     "errorNetwork": "Network connection failed",
+    "rememberDevice": "Remember this device",
+    "rememberWarning": "Only check on trusted devices — token will persist in the browser",
     "logoutTitle": "Account",
     "logoutDesc": "Sign out of the current session",
     "logout": "Sign out"
diff --git a/src/i18n/locales/ja-JP/common.json b/src/i18n/locales/ja-JP/common.json
index dfe7f542..e2bedbed 100644
--- a/src/i18n/locales/ja-JP/common.json
+++ b/src/i18n/locales/ja-JP/common.json
@@ -11,6 +11,7 @@
   "back": "戻る",
   "done": "完了",
   "retry": "リトライ",
+  "initFailed": "アプリの初期化に失敗しました",
   "loading": "読み込み中...",
   "initializing": "初期化中...",
   "noData": "データがありません",
@@ -137,10 +138,12 @@
     "tokenLabel": "API Token",
     "tokenPlaceholder": "clb_xxxxxxxx",
     "submit": "ログイン",
-    "hint": "Tokenはchatlabの起動ログで確認できます",
+    "hint": "Tokenは起動ログ、config.toml、または --token フラグで確認できます",
     "errorEmpty": "Tokenを入力してください",
     "errorInvalid": "無効なTokenです。確認してもう一度お試しください",
     "errorNetwork": "ネットワーク接続に失敗しました",
+    "rememberDevice": "このデバイスを記憶する",
+    "rememberWarning": "信頼できるデバイスでのみ使用してください。Tokenがブラウザに保存されます",
     "logoutTitle": "アカウント",
     "logoutDesc": "現在のセッションからログアウト",
     "logout": "ログアウト"
diff --git a/src/i18n/locales/zh-CN/common.json b/src/i18n/locales/zh-CN/common.json
index d09d9453..424aae3b 100644
--- a/src/i18n/locales/zh-CN/common.json
+++ b/src/i18n/locales/zh-CN/common.json
@@ -11,6 +11,7 @@
   "back": "返回",
   "done": "完成",
   "retry": "重试",
+  "initFailed": "应用初始化失败",
   "loading": "加载中...",
   "initializing": "初始化中...",
   "noData": "暂无数据",
@@ -137,10 +138,12 @@
     "tokenLabel": "API Token",
     "tokenPlaceholder": "clb_xxxxxxxx",
     "submit": "登录",
-    "hint": "Token 可在 chatlab 启动日志中查看",
+    "hint": "Token 可在启动日志、config.toml 或 --token 启动参数中获取",
     "errorEmpty": "请输入 Token",
     "errorInvalid": "Token 无效，请检查后重试",
     "errorNetwork": "网络连接失败",
+    "rememberDevice": "记住此设备",
+    "rememberWarning": "仅在可信设备上勾选，Token 将持久保存在浏览器中",
     "logoutTitle": "账户",
     "logoutDesc": "退出当前认证登录",
     "logout": "退出登录"
diff --git a/src/i18n/locales/zh-TW/common.json b/src/i18n/locales/zh-TW/common.json
index 70d59f8d..57ecbccf 100644
--- a/src/i18n/locales/zh-TW/common.json
+++ b/src/i18n/locales/zh-TW/common.json
@@ -11,6 +11,7 @@
   "back": "返回上一頁",
   "done": "完成",
   "retry": "重試",
+  "initFailed": "應用程式初始化失敗",
   "loading": "載入中...",
   "initializing": "初始化中...",
   "noData": "暫無資料",
@@ -137,10 +138,12 @@
     "tokenLabel": "API Token",
     "tokenPlaceholder": "clb_xxxxxxxx",
     "submit": "登入",
-    "hint": "Token 可在 chatlab 啟動日誌中查看",
+    "hint": "Token 可在啟動日誌、config.toml 或 --token 啟動參數中取得",
     "errorEmpty": "請輸入 Token",
     "errorInvalid": "Token 無效，請檢查後重試",
     "errorNetwork": "網路連線失敗",
+    "rememberDevice": "記住此裝置",
+    "rememberWarning": "僅在可信裝置上勾選，Token 將持久保存在瀏覽器中",
     "logoutTitle": "帳戶",
     "logoutDesc": "退出目前認證登入",
     "logout": "登出"
diff --git a/src/pages/login/index.vue b/src/pages/login/index.vue
index 216fdfb6..4b6648f5 100644
--- a/src/pages/login/index.vue
+++ b/src/pages/login/index.vue
@@ -3,7 +3,6 @@ import { ref } from 'vue'
 import { useRouter, useRoute } from 'vue-router'
 import { useI18n } from 'vue-i18n'
 import { useAuthStore } from '@/stores/auth'
-import { configureHttpClient } from '@/services/utils/http'
 
 const { t } = useI18n()
 const router = useRouter()
@@ -11,9 +10,15 @@ const route = useRoute()
 const authStore = useAuthStore()
 
 const tokenInput = ref('')
+const rememberMe = ref(authStore.rememberDevice)
 const error = ref('')
 const loading = ref(false)
 
+function sanitizeRedirect(raw: string | undefined): string {
+  if (!raw || !raw.startsWith('/') || raw.startsWith('/login')) return '/'
+  return raw
+}
+
 async function handleLogin() {
   const trimmed = tokenInput.value.trim()
   if (!trimmed) {
@@ -34,10 +39,9 @@ async function handleLogin() {
       return
     }
 
-    authStore.login(trimmed)
-    configureHttpClient({ token: trimmed })
+    authStore.login(trimmed, rememberMe.value)
 
-    const redirect = (route.query.redirect as string) || '/'
+    const redirect = sanitizeRedirect(route.query.redirect as string)
     router.replace(redirect)
   } catch {
     error.value = t('common.login.errorNetwork')
@@ -70,6 +74,11 @@ async function handleLogin() {
 
         <p v-if="error" class="text-sm text-red-500">{{ error }}</p>
 
+        <label class="flex items-center gap-2 text-sm text-gray-600 dark:text-gray-400">
+          <UCheckbox v-model="rememberMe" />
+          <span>{{ t('common.login.rememberDevice') }}</span>
+        </label>
+
         <UButton type="submit" block :loading="loading" color="primary">
           {{ t('common.login.submit') }}
         </UButton>
@@ -78,6 +87,9 @@ async function handleLogin() {
       <p class="text-center text-xs text-gray-400 dark:text-gray-500">
         {{ t('common.login.hint') }}
       </p>
+      <p v-if="rememberMe" class="text-center text-xs text-amber-500 dark:text-amber-400">
+        {{ t('common.login.rememberWarning') }}
+      </p>
     </div>
   </div>
 </template>
diff --git a/src/routes/index.ts b/src/routes/index.ts
index d33f3847..e5732998 100644
--- a/src/routes/index.ts
+++ b/src/routes/index.ts
@@ -1,4 +1,6 @@
 import { createRouter, createWebHashHistory } from 'vue-router'
+import { IS_ELECTRON } from '@/utils/platform'
+import { useAuthStore } from '@/stores/auth'
 
 export const router = createRouter({
   routes: [
@@ -27,7 +29,19 @@ export const router = createRouter({
   history: createWebHashHistory(),
 })
 
-router.beforeEach((_to, _from, next) => {
+router.beforeEach((to, _from, next) => {
+  // Electron never needs web login
+  if (IS_ELECTRON) {
+    return to.name === 'login' ? next({ name: 'home' }) : next()
+  }
+
+  if (to.meta.public) return next()
+
+  const authStore = useAuthStore()
+  if (authStore.requiresAuth && !authStore.isAuthenticated) {
+    return next({ name: 'login', query: { redirect: to.fullPath } })
+  }
+
   next()
 })
 
diff --git a/src/services/utils/http.test.ts b/src/services/utils/http.test.ts
new file mode 100644
index 00000000..809740d8
--- /dev/null
+++ b/src/services/utils/http.test.ts
@@ -0,0 +1,115 @@
+import { describe, it, beforeEach } from 'node:test'
+import assert from 'node:assert/strict'
+import { configureHttpClient, fetchWithAuth, getAuthHeaders, getBaseUrl } from './http'
+
+describe('http client', () => {
+  beforeEach(() => {
+    configureHttpClient({ baseUrl: '/_web', token: '', getToken: null, on401: null })
+  })
+
+  describe('getAuthHeaders', () => {
+    it('returns empty when no token', () => {
+      assert.deepEqual(getAuthHeaders(), {})
+    })
+
+    it('returns Bearer header with static token', () => {
+      configureHttpClient({ token: 'abc' })
+      assert.deepEqual(getAuthHeaders(), { Authorization: 'Bearer abc' })
+    })
+
+    it('prefers getToken callback over static token', () => {
+      configureHttpClient({ token: 'old', getToken: () => 'dynamic' })
+      assert.deepEqual(getAuthHeaders(), { Authorization: 'Bearer dynamic' })
+    })
+
+    it('returns empty when getToken returns empty string', () => {
+      configureHttpClient({ getToken: () => '' })
+      assert.deepEqual(getAuthHeaders(), {})
+    })
+  })
+
+  describe('getBaseUrl', () => {
+    it('defaults to /_web', () => {
+      assert.equal(getBaseUrl(), '/_web')
+    })
+
+    it('returns configured baseUrl', () => {
+      configureHttpClient({ baseUrl: '/custom' })
+      assert.equal(getBaseUrl(), '/custom')
+    })
+  })
+
+  describe('fetchWithAuth', () => {
+    it('injects Authorization header from getToken', async () => {
+      let capturedHeaders: Headers | undefined
+      const originalFetch = globalThis.fetch
+      globalThis.fetch = ((_input: unknown, init?: RequestInit) => {
+        capturedHeaders = new Headers(init?.headers)
+        return Promise.resolve(new Response('{}', { status: 200 }))
+      }) as typeof fetch
+
+      try {
+        configureHttpClient({ getToken: () => 'tok123' })
+        await fetchWithAuth('/test')
+        assert.equal(capturedHeaders?.get('Authorization'), 'Bearer tok123')
+      } finally {
+        globalThis.fetch = originalFetch
+      }
+    })
+
+    it('calls on401 when response is 401', async () => {
+      const originalFetch = globalThis.fetch
+      let on401Called = false
+      globalThis.fetch = (() => Promise.resolve(new Response('', { status: 401 }))) as typeof fetch
+
+      try {
+        configureHttpClient({
+          on401: () => {
+            on401Called = true
+          },
+        })
+        await fetchWithAuth('/test')
+        assert.equal(on401Called, true)
+      } finally {
+        globalThis.fetch = originalFetch
+      }
+    })
+
+    it('does not call on401 for non-401 responses', async () => {
+      const originalFetch = globalThis.fetch
+      let on401Called = false
+      globalThis.fetch = (() => Promise.resolve(new Response('', { status: 403 }))) as typeof fetch
+
+      try {
+        configureHttpClient({
+          on401: () => {
+            on401Called = true
+          },
+        })
+        await fetchWithAuth('/test')
+        assert.equal(on401Called, false)
+      } finally {
+        globalThis.fetch = originalFetch
+      }
+    })
+
+    it('does not override existing Authorization header', async () => {
+      let capturedHeaders: Headers | undefined
+      const originalFetch = globalThis.fetch
+      globalThis.fetch = ((_input: unknown, init?: RequestInit) => {
+        capturedHeaders = new Headers(init?.headers)
+        return Promise.resolve(new Response('{}', { status: 200 }))
+      }) as typeof fetch
+
+      try {
+        configureHttpClient({ getToken: () => 'auto-token' })
+        await fetchWithAuth('/test', {
+          headers: { Authorization: 'Bearer explicit-token' },
+        })
+        assert.equal(capturedHeaders?.get('Authorization'), 'Bearer explicit-token')
+      } finally {
+        globalThis.fetch = originalFetch
+      }
+    })
+  })
+})
diff --git a/src/services/utils/http.ts b/src/services/utils/http.ts
index 3a03fba9..04eb1c3f 100644
--- a/src/services/utils/http.ts
+++ b/src/services/utils/http.ts
@@ -7,17 +7,29 @@
 
 let _baseUrl = '/_web'
 let _token = ''
+let _getToken: (() => string) | undefined
 let _on401: (() => void) | undefined
 
-export function configureHttpClient(config: { baseUrl?: string; token?: string; on401?: () => void }): void {
+export function configureHttpClient(config: {
+  baseUrl?: string
+  token?: string
+  getToken?: (() => string) | null
+  on401?: (() => void) | null
+}): void {
   if (config.baseUrl !== undefined) _baseUrl = config.baseUrl
   if (config.token !== undefined) _token = config.token
-  if (config.on401 !== undefined) _on401 = config.on401
+  if (config.getToken !== undefined) _getToken = config.getToken ?? undefined
+  if (config.on401 !== undefined) _on401 = config.on401 ?? undefined
+}
+
+function resolveToken(): string {
+  return _getToken ? _getToken() : _token
 }
 
 export function getAuthHeaders(): Record<string, string> {
-  if (!_token) return {}
-  return { Authorization: `Bearer ${_token}` }
+  const token = resolveToken()
+  if (!token) return {}
+  return { Authorization: `Bearer ${token}` }
 }
 
 export function getBaseUrl(): string {
@@ -30,8 +42,9 @@ export function getBaseUrl(): string {
  */
 export async function fetchWithAuth(url: string, init?: RequestInit): Promise<Response> {
   const headers = new Headers(init?.headers)
-  if (_token && !headers.has('Authorization')) {
-    headers.set('Authorization', `Bearer ${_token}`)
+  const token = resolveToken()
+  if (token && !headers.has('Authorization')) {
+    headers.set('Authorization', `Bearer ${token}`)
   }
   const resp = await fetch(url, { ...init, headers })
   if (resp.status === 401 && _on401) _on401()
diff --git a/src/services/utils/sse.ts b/src/services/utils/sse.ts
index a0f3d45e..fc7e8374 100644
--- a/src/services/utils/sse.ts
+++ b/src/services/utils/sse.ts
@@ -6,7 +6,7 @@
  * 自动注入 Authorization header（通过 http.ts 的 getAuthHeaders）。
  */
 
-import { getAuthHeaders } from './http'
+import { fetchWithAuth } from './http'
 
 export interface SSEEvent {
   event: string
@@ -29,9 +29,9 @@ export interface FetchSSEOptions {
 export async function fetchSSE(options: FetchSSEOptions): Promise<void> {
   const { url, method = 'POST', headers = {}, body, signal, onEvent } = options
 
-  const resp = await fetch(url, {
+  const resp = await fetchWithAuth(url, {
     method,
-    headers: { 'Content-Type': 'application/json', ...getAuthHeaders(), ...headers },
+    headers: { 'Content-Type': 'application/json', ...headers },
     body: body != null ? JSON.stringify(body) : undefined,
     signal,
   })
diff --git a/src/stores/auth.ts b/src/stores/auth.ts
index 43ff12d0..92b333aa 100644
--- a/src/stores/auth.ts
+++ b/src/stores/auth.ts
@@ -3,27 +3,54 @@
  *
  * 仅在 CLI Web (web-serve) 模式下生效。
  * Electron 模式不需要认证（通过 preload 获取 ephemeral token）。
+ *
+ * 默认使用 sessionStorage（关闭浏览器后清除）。
+ * 勾选「记住此设备」后写入 localStorage，跨会话保留。
+ * requiresAuth 仅内存态——避免服务器重启为免登录模式后路由守卫仍强制跳登录。
  */
 
 import { ref, computed } from 'vue'
 import { defineStore } from 'pinia'
 
 const TOKEN_KEY = 'chatlab_auth_token'
+const REMEMBER_KEY = 'chatlab_remember_device'
 
 export const useAuthStore = defineStore('auth', () => {
-  const token = ref(localStorage.getItem(TOKEN_KEY) || '')
+  const token = ref(sessionStorage.getItem(TOKEN_KEY) || localStorage.getItem(TOKEN_KEY) || '')
+  const rememberDevice = ref(!!localStorage.getItem(REMEMBER_KEY))
+  // In-memory only: auto-cleared on page reload to avoid stale guard
+  const requiresAuth = ref(false)
 
   const isAuthenticated = computed(() => !!token.value)
 
-  function login(newToken: string) {
+  function markRequiresAuth() {
+    requiresAuth.value = true
+  }
+
+  function login(newToken: string, remember: boolean) {
     token.value = newToken
-    localStorage.setItem(TOKEN_KEY, newToken)
+    rememberDevice.value = remember
+    markRequiresAuth()
+
+    if (remember) {
+      localStorage.setItem(TOKEN_KEY, newToken)
+      localStorage.setItem(REMEMBER_KEY, '1')
+      sessionStorage.removeItem(TOKEN_KEY)
+    } else {
+      sessionStorage.setItem(TOKEN_KEY, newToken)
+      localStorage.removeItem(TOKEN_KEY)
+      localStorage.removeItem(REMEMBER_KEY)
+    }
   }
 
   function logout() {
     token.value = ''
+    rememberDevice.value = false
+    requiresAuth.value = false
+    sessionStorage.removeItem(TOKEN_KEY)
     localStorage.removeItem(TOKEN_KEY)
+    localStorage.removeItem(REMEMBER_KEY)
   }
 
-  return { token, isAuthenticated, login, logout }
+  return { token, requiresAuth, rememberDevice, isAuthenticated, login, logout, markRequiresAuth }
 })