diguaandCursor a75fd0186d feat(cli): add --require-auth flag for /_web/* API protection ...

When enabled, all /_web/* routes require Bearer token authentication,
same as /api/v1/*. This hardens security for server/headless/public
deployments where the same-origin assumption doesn't hold.

- Add `require_auth` field to config schema (default: false)
- Add `setRequireAuth()` to auth hook, conditionally enforce auth on /_web/*
- Support `--require-auth` in both `chatlab start` and `--daemon` mode
- Read from config.api.require_auth or CLI flag override

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-06-02 15:41:21 +08:00

..

cli

feat(cli): add --require-auth flag for /_web/* API protection

2026-06-02 15:41:21 +08:00

desktop

fix(types): use AIMessageRole type for message role params & strengthen conversation test assertion

2026-05-31 16:56:08 +08:00