cc-viewer 1.8.19 → 1.8.20

package/README.md

@@ -191,7 +191,7 @@ By default, remote (LAN) access requires the `?token=` query that ccv prints at
 * Remote devices opening the LAN URL (without a token) are shown a minimal password page; entering the correct password sets an `HttpOnly` cookie and the page refreshes into the app. The existing `?token=` URL keeps working in parallel.
 * An **empty password means no protection at all** — it is allowed, but the admin UI shows a clear security warning.
 * **Global default + per-project override:** by default one password covers every project. From the QR popover the admin can switch between **This project** and **Global** — set a project-specific password that overrides the global default for that project only, or remove the override to inherit the global setting again. (A disabled project override means "no protection for this project", which is different from removing it.)
-* The on/off state and password(s) are persisted alongside your other settings in cc-viewer's `preferences.json` — a global `auth` key plus an optional `authByProject` map (the password is base64-obfuscated, not stored as raw plaintext; file mode `0600`). The login cookie is tied to the per-launch token, so restarting ccv requires remote devices to log in again.
+* The on/off state is persisted alongside your other settings in cc-viewer's `preferences.json` — a global `auth` key plus an optional `authByProject` map (file mode `0600`). The password itself is **not** kept there: it is encrypted at rest (AES-256-GCM) in `credentials.json` under the same data root, with the machine-local key in `master.key` (both mode `0600`). The login cookie is tied to the per-launch token, so restarting ccv requires remote devices to log in again.
 
 ### Container / cloud deployment (remote admin)
 
@@ -205,6 +205,8 @@ cc-viewer works in a single container or on a cloud host where you reach the UI
 * **Security recommendations for a public/cloud deployment:** enable password login (or keep the random `?token=` URL secret), and put the instance behind a reverse proxy that terminates HTTPS. Persist the log/settings directory by mounting a volume at the path pointed to by `CCV_LOG_DIR` (default `~/.claude/cc-viewer`) so your preferences, auth password, and IM credentials survive container restarts.
 * **Reverse-proxy note:** access control is based on the socket peer address (`X-Forwarded-For` is deliberately not trusted, to prevent spoofing). This does not affect remote admins — they authenticate by token/password, not by IP. It only means "same-container" detection relies on a real loopback connection.
 
+* **Design doc:** how local config maps to a cloud database and the cloud-sync model (cloud-authoritative, local read-only fallback) is described in [Config Convergence & Cloud-Sync Advisory](./docs/config-cloud-sync.md) ([中文](./docs/config-cloud-sync.zh.md)). This is a proposal, not yet implemented.
+
 
 ### Model-specific system prompts