mirror of
https://github.com/QwenLM/qwen-code.git
synced 2026-07-22 23:44:11 +00:00
459d17cdb5
getDaemonToken() read the token from the #token= fragment into a module-level cache, and removeDaemonTokenFromUrl() then deliberately stripped it from the URL for history hygiene. Nothing persisted it, so a page refresh loaded with no credential at all — every token-gated API call returned 401 until the user hand-rebuilt the URL (#7301). The first load now writes the URL token to sessionStorage (per-tab, so it clears when the tab closes and never leaks across tabs the way localStorage would), and later loads fall back to that copy when the URL carries no token. A fresh URL token always wins over a stale persisted one, storage failures (privacy modes, storage-disabled embeds) degrade to the old memory-only behavior, and the URL-stripping hygiene is unchanged. Verified with a real-browser E2E (real `qwen serve --token` + Playwright, hard reload in between): before, the reloaded page sends 0 authorized requests and token-gated calls 401; after, all reloaded requests carry the bearer and the probe returns 200. The jsdom refresh regression test fails on the unpatched source. Fixes #7301 Co-authored-by: Claude Fable 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| daemon.test.ts | ||
| daemon.ts | ||