claudeck 1.2.0 → 1.3.1

package/server/orchestrator.js

@@ -158,6 +158,7 @@ export async function runOrchestrator({
     abortController,
     maxTurns: 3, // Planner should just think, not use many tools
     executable: execPath,
+    settingSources: ["user", "project", "local"],
   };
 
   if (!useBypass && !usePlan) {

package/server/ws-handler.js

@@ -421,6 +421,7 @@ export async function handleWorkflow(msg, { ws, sessionIds, activeQueries, pendi
       abortController,
       maxTurns: 30,
       executable: execPath,
+      settingSources: ["user", "project", "local"],
     };
 
     if (!useBypass && !usePlan) {
@@ -730,6 +731,7 @@ export async function handleChat(msg, { ws, sessionIds, activeQueries, pendingAp
     abortController,
     executable: execPath,
     stderr: (text) => stderrChunks.push(text),
+    settingSources: ["user", "project", "local"],
   };
   if (effectiveMaxTurns) opts.maxTurns = effectiveMaxTurns;
 

package/server.js

@@ -34,17 +34,28 @@ import worktreesRouter from "./server/routes/worktrees.js";
 import skillsRouter from "./server/routes/skills.js";
 import { setupWebSocket } from "./server/ws-handler.js";
 import { setWss } from "./server/notification-logger.js";
+import { authMiddleware, verifyWsClient, isAuthEnabled, getToken, loginHandler, statusHandler } from "./server/auth.js";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 
 const app = express();
 const server = createServer(app);
-const wss = new WebSocketServer({ server, path: "/ws" });
+const wss = new WebSocketServer({ server, path: "/ws", verifyClient: verifyWsClient });
 
-app.use(express.static(join(__dirname, "public")));
+// ── Middleware ordering: json → auth routes (unauthenticated) → auth middleware → static + API ──
 app.use(express.json());
 
+// Auth endpoints (always accessible)
+app.post("/api/auth/login", loginHandler);
+app.get("/api/auth/status", statusHandler);
+app.get("/login", (_req, res) => res.sendFile(join(__dirname, "public", "login.html")));
+
+// Auth middleware — everything below is protected when auth is enabled
+app.use(authMiddleware);
+
+app.use(express.static(join(__dirname, "public")));
+
 // ── Web Push (VAPID) setup ──────────────────────────────────
 {
   let vapidPublic = process.env.VAPID_PUBLIC_KEY;
@@ -198,7 +209,7 @@ mountPluginRoutes(app, fullStackPluginsDir).then(() => {
   \x1b[1m\x1b[32m➜\x1b[0m  \x1b[1mReady:\x1b[0m   ${url}
   \x1b[2m➜  Port:\x1b[0m    ${PORT}
   \x1b[2m➜  Data:\x1b[0m    ~/.claudeck/
-`);
+${isAuthEnabled() ? `  \x1b[2m➜  Auth:\x1b[0m    \x1b[33menabled\x1b[0m\n  \x1b[2m➜  Token:\x1b[0m   ${getToken()}\n` : ''}`);
   });
 });