vibora 1.0.7 → 1.0.9

package/README.md

@@ -38,10 +38,7 @@ bunx vibora@latest status  # Check if running
 
 ## Configuration
 
-Settings are stored in `.vibora/settings.json`. The vibora directory is resolved in this order:
-1. `VIBORA_DIR` environment variable (explicit override)
-2. `.vibora` in current working directory (per-worktree isolation)
-3. `~/.vibora` (default)
+Settings are stored in `.vibora/settings.json`.
 
 | Setting | Env Var | Default |
 |---------|---------|---------|

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibora",
-  "version": "1.0.7",
+  "version": "1.0.9",
   "description": "The Vibe Engineer's Cockpit",
   "license": "PolyForm-Shield-1.0.0",
   "repository": {

package/server/index.js

@@ -3682,14 +3682,17 @@ function updateNotificationSettings(updates) {
 
 // server/middleware/auth.ts
 var SESSION_COOKIE_NAME = "vibora_session";
-var PUBLIC_PATHS = ["/health", "/api/auth/login", "/api/auth/check"];
+var PUBLIC_API_PATHS = ["/health", "/api/auth/login", "/api/auth/check"];
 var sessionAuthMiddleware = createMiddleware(async (c, next) => {
   const settings = getSettings();
   if (!settings.basicAuthUsername || !settings.basicAuthPassword) {
     return next();
   }
   const path2 = c.req.path;
-  if (PUBLIC_PATHS.some((p) => path2 === p || path2.startsWith(p + "/"))) {
+  if (!path2.startsWith("/api/") && !path2.startsWith("/ws/")) {
+    return next();
+  }
+  if (PUBLIC_API_PATHS.some((p) => path2 === p || path2.startsWith(p + "/"))) {
     return next();
   }
   const secret = getSessionSecret();