claude-code-remote-pilot 0.4.4 → 0.4.5

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.4.5 — 2026-05-06
+
+### Added
+- **Terminal redesign**: input is now embedded inside the terminal box (dark background, monospace font, `❯` prompt) — feels like a real terminal. After sending, focus returns to the input automatically.
+- **Full-height terminal**: terminal fills the viewport height (`calc(100vh - 210px)`) with the output scrolling above the pinned input row.
+- **Password auth**: `web [port] [host] [password]` — if a password is given, the browser shows a login screen. Token is stored in localStorage and sent as `Authorization: Bearer` on all requests (query param for SSE). `POST /api/login` is the only unauthenticated endpoint.
+
+---
+
 ## 0.4.4 — 2026-05-06
 
 ### Added

package/bin/claude-pilot.js

@@ -331,7 +331,7 @@ const HELP = `
   spawn <path> [name]   Start Claude at path (name defaults to dir name)
   list                  Show all sessions
   watch                 Live session monitor  (q to exit)
-  web [port] [host]     Start web dashboard  (default: 3742 127.0.0.1)
+  web [port] [host] [password]  Start web dashboard  (default: 3742 127.0.0.1)
   attach <name>         Open tmux session in this terminal
   kill <name>           Stop a session
   resume [message]      Show or set the message sent after a limit resets
@@ -445,16 +445,18 @@ ${HELP}`);
         case 'web': {
           const port = parseInt(args[0]) || 3742;
           const host = args[1] || '127.0.0.1';
+          const password = args[2] || null;
           let webServer = manager._webServer;
           if (webServer) {
             console.log(`  Web dashboard already running at http://${webServer.host}:${webServer.port}`);
             break;
           }
-          webServer = new WebServer(manager, port, host);
+          webServer = new WebServer(manager, port, host, password);
           manager._webServer = webServer;
           webServer.start();
           const url = `http://${host}:${port}`;
           console.log(`  ✓ Web dashboard started at ${url}`);
+          if (password) console.log(`  Password protected. Enter password in the browser.`);
           const opener = process.platform === 'darwin' ? 'open' : 'xdg-open';
           spawn(opener, [url], { stdio: 'ignore', detached: true }).unref();
           break;

package/lib/WebServer.js

@@ -2,16 +2,19 @@
 const http = require('http');
 const fs = require('fs');
 const path = require('path');
+const crypto = require('crypto');
 const { spawnSync } = require('child_process');
 const config = require('./config');
 
 const STRIP_ANSI = /\x1b\[[0-9;]*[mGKHFABCDJsuhl]|\x1b[()][AB012]/g;
 
 class WebServer {
-  constructor(manager, port = 3742, host = '127.0.0.1') {
+  constructor(manager, port = 3742, host = '127.0.0.1', password = null) {
     this.manager = manager;
     this.port = port;
     this.host = host;
+    this.password = password || null;
+    this._token = password ? crypto.randomBytes(20).toString('hex') : null;
     this.startedAt = new Date();
     this.server = null;
     this._clients = new Set();
@@ -47,7 +50,30 @@ class WebServer {
     });
   }
 
-  _handleApi(req, res, pathname) {
+  // Returns true if authorized (or no password set). Sends 401 and returns false otherwise.
+  _checkAuth(req, res, url) {
+    if (!this.password) return true;
+    const authHeader = req.headers['authorization'];
+    if (authHeader === `Bearer ${this._token}`) return true;
+    if (url && url.searchParams.get('token') === this._token) return true;
+    this._json(res, 401, { error: 'Unauthorized' });
+    return false;
+  }
+
+  _handleApi(req, res, pathname, url) {
+    // POST /api/login — no auth required
+    if (req.method === 'POST' && pathname === '/api/login') {
+      return this._readBody(req, (err, body) => {
+        if (err) return this._json(res, 400, { error: err.message });
+        if (!this.password) return this._json(res, 200, { token: null });
+        if (body.password !== this.password) return this._json(res, 401, { error: 'Wrong password' });
+        return this._json(res, 200, { token: this._token });
+      });
+    }
+
+    // All other API routes require auth
+    if (!this._checkAuth(req, res, url)) return;
+
     // GET /api/sessions
     if (req.method === 'GET' && pathname === '/api/sessions') {
       return this._json(res, 200, this._buildAllSessions());
@@ -141,6 +167,7 @@ class WebServer {
       }
 
       if (pathname === '/events') {
+        if (!this._checkAuth(req, res, url)) return;
         res.writeHead(200, {
           'Content-Type': 'text/event-stream',
           'Cache-Control': 'no-cache',
@@ -153,7 +180,7 @@ class WebServer {
       }
 
       if (pathname.startsWith('/api/')) {
-        return this._handleApi(req, res, pathname);
+        return this._handleApi(req, res, pathname, url);
       }
 
       res.writeHead(404);