@clawlabz/clawskin 1.0.0 → 1.0.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawlabz/clawskin",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "type": "module",
   "description": "Pixel Agent Skin Engine \u2014 Procedural 32\u00d732 character generator with scenes, animations & customization",
   "keywords": [

package/public/js/app/ClawSkinApp.js

@@ -177,8 +177,9 @@ class ClawSkinApp {
           if (window._connPanel) {
             window._connPanel.render(this.settings.load());
           }
-          // Use previously saved token if available; never read token from /api/config
-          this.gateway.connect(config.gatewayUrl, saved.token || '');
+          // Use token from local config, fall back to previously saved token
+          const token = config.token || saved.token || '';
+          this.gateway.connect(config.gatewayUrl, token);
           return;
         }
       }

package/serve.cjs

@@ -46,9 +46,9 @@ function getLocalGatewayConfig() {
       const port = gw.port || 18789;
       return {
         gatewayUrl: `ws://localhost:${port}`,
-        // Only expose that auth is token-based, never send the actual token.
-        // The user must enter the token manually in the UI.
-        hasAuth: !!(gw.auth && gw.auth.mode === 'token'),
+        // Safe to expose token on localhost — serve.cjs binds to 127.0.0.1 by default.
+        // The token never leaves the local machine.
+        token: (gw.auth && gw.auth.token) || '',
       };
     } catch { continue; }
   }