@kl-c/matrixos 0.3.54 → 0.3.55

package/dist/cli/index.js

@@ -2163,7 +2163,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@kl-c/matrixos",
-    version: "0.3.54",
+    version: "0.3.55",
     description: "MaTrixOS \u2014 Agentic OS for OpenCode. Personalizable, communicating, self-improving, resilient.",
     main: "./dist/index.js",
     types: "dist/index.d.ts",
@@ -189419,6 +189419,16 @@ function createDashboardServer(dataProvider, config5) {
           if (req.method === "OPTIONS") {
             return new Response(null, { headers: corsHeaders });
           }
+          if (config5.dashboardPassphrase) {
+            const isHealth = path25 === "/api/health";
+            const isGatewayToken = path25 === "/api/gateway/token";
+            if (path25.startsWith("/api/") && !isHealth && !isGatewayToken) {
+              const provided = req.headers.get("x-passphrase");
+              if (!provided || provided !== config5.dashboardPassphrase) {
+                return Response.json({ error: "Unauthorized \u2014 dashboard passphrase required" }, { status: 401, headers: corsHeaders });
+              }
+            }
+          }
           if (path25.startsWith("/api/")) {
             if (path25 === "/api/logs/stream") {
               const headers = new Headers({
@@ -189696,7 +189706,7 @@ async function dashboardCli(options) {
   console.log(`[dashboard] frontend: ${frontendDir}`);
   try {
     const dataProvider = createDataProvider();
-    const server2 = createDashboardServer(dataProvider, { port: port3, host, frontendDir, gatewayPassphrase });
+    const server2 = createDashboardServer(dataProvider, { port: port3, host, frontendDir, gatewayPassphrase, dashboardPassphrase: gatewayPassphrase });
     server2.start();
     console.log(`[dashboard] ready \u2014 http://${host}:${port3}`);
     if (!options.daemon) {

package/dist/cli-node/index.js

@@ -2163,7 +2163,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@kl-c/matrixos",
-    version: "0.3.54",
+    version: "0.3.55",
     description: "MaTrixOS \u2014 Agentic OS for OpenCode. Personalizable, communicating, self-improving, resilient.",
     main: "./dist/index.js",
     types: "dist/index.d.ts",
@@ -189474,6 +189474,16 @@ function createDashboardServer(dataProvider, config5) {
           if (req.method === "OPTIONS") {
             return new Response(null, { headers: corsHeaders });
           }
+          if (config5.dashboardPassphrase) {
+            const isHealth = path25 === "/api/health";
+            const isGatewayToken = path25 === "/api/gateway/token";
+            if (path25.startsWith("/api/") && !isHealth && !isGatewayToken) {
+              const provided = req.headers.get("x-passphrase");
+              if (!provided || provided !== config5.dashboardPassphrase) {
+                return Response.json({ error: "Unauthorized \u2014 dashboard passphrase required" }, { status: 401, headers: corsHeaders });
+              }
+            }
+          }
           if (path25.startsWith("/api/")) {
             if (path25 === "/api/logs/stream") {
               const headers = new Headers({
@@ -189751,7 +189761,7 @@ async function dashboardCli(options) {
   console.log(`[dashboard] frontend: ${frontendDir}`);
   try {
     const dataProvider = createDataProvider();
-    const server2 = createDashboardServer(dataProvider, { port: port3, host, frontendDir, gatewayPassphrase });
+    const server2 = createDashboardServer(dataProvider, { port: port3, host, frontendDir, gatewayPassphrase, dashboardPassphrase: gatewayPassphrase });
     server2.start();
     console.log(`[dashboard] ready \u2014 http://${host}:${port3}`);
     if (!options.daemon) {

package/dist/features/dashboard/frontend/js/api.js

@@ -22,8 +22,20 @@ const API={
   cronRemove:(id)=>fetchJSON(`/cron?id=${encodeURIComponent(id)}`,{method:'DELETE'}),
   gatewayToken:(type,token,passphrase)=>fetch('/api/gateway/token',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({type,token,passphrase})}).then(r=>r.json())
 }
-async function fetchJSON(e,opts){
-  const r=await fetch(`/api${e}`,opts)
-  if(!r.ok)throw new Error(`API ${e}: ${r.status}`)
+async function fetchJSON(e, opts) {
+  opts = opts || {}
+  opts.headers = Object.assign({ "x-passphrase": localStorage.getItem("matrixos_dashboard_passphrase") || "" }, opts.headers || {})
+  const r = await fetch(`/api${e}`, opts)
+  if (r.status === 401) {
+    const tried = localStorage.getItem("matrixos_dashboard_passphrase")
+    if (!tried) {
+      const p = prompt("Dashboard passphrase required:")
+      if (p) {
+        localStorage.setItem("matrixos_dashboard_passphrase", p)
+        return fetchJSON(e, opts)
+      }
+    }
+  }
+  if (!r.ok) throw new Error(`API ${e}: ${r.status}`)
   return r.json()
 }

package/dist/features/dashboard/server.d.ts

@@ -5,6 +5,8 @@ export interface DashboardServerConfig {
     frontendDir: string;
     /** Passphrase required to submit gateway tokens via POST /api/gateway/token */
     gatewayPassphrase?: string;
+    /** Global passphrase required for ALL /api/* routes (except /api/health) when set */
+    dashboardPassphrase?: string;
 }
 export declare function createDashboardServer(dataProvider: DataProvider, config: DashboardServerConfig): {
     start(): void;

package/dist/index.js

@@ -368086,7 +368086,7 @@ function getCachedVersion(options = {}) {
 // package.json
 var package_default = {
   name: "@kl-c/matrixos",
-  version: "0.3.54",
+  version: "0.3.55",
   description: "MaTrixOS \u2014 Agentic OS for OpenCode. Personalizable, communicating, self-improving, resilient.",
   main: "./dist/index.js",
   types: "dist/index.d.ts",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kl-c/matrixos",
-  "version": "0.3.54",
+  "version": "0.3.55",
   "description": "MaTrixOS \u2014 Agentic OS for OpenCode. Personalizable, communicating, self-improving, resilient.",
   "main": "./dist/index.js",
   "types": "dist/index.d.ts",