@hasna/todos 0.6.0 → 0.6.1

package/dist/cli/index.js

@@ -8353,14 +8353,19 @@ function createFetchHandler(getPort, dashboardDir, dashboardExists) {
     if (path.startsWith("/api/") && !path.startsWith("/api/system/") && !path.startsWith("/api/keys")) {
       const hasKeys = hasAnyApiKeys();
       if (hasKeys) {
-        const authHeader = req.headers.get("authorization");
-        const apiKey = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null;
-        if (!apiKey) {
-          return json({ error: "API key required. Pass via Authorization: Bearer <key>" }, 401, port);
-        }
-        const valid = await validateApiKey(apiKey);
-        if (!valid) {
-          return json({ error: "Invalid or expired API key" }, 403, port);
+        const origin = req.headers.get("origin") || "";
+        const referer = req.headers.get("referer") || "";
+        const isSameOrigin = origin.includes(`localhost:${port}`) || referer.includes(`localhost:${port}`);
+        if (!isSameOrigin) {
+          const authHeader = req.headers.get("authorization");
+          const apiKey = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null;
+          if (!apiKey) {
+            return json({ error: "API key required. Pass via Authorization: Bearer <key>" }, 401, port);
+          }
+          const valid = await validateApiKey(apiKey);
+          if (!valid) {
+            return json({ error: "Invalid or expired API key" }, 403, port);
+          }
         }
       }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/todos",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
   "type": "module",
   "main": "dist/index.js",