v0.1.3 — 🔒 Dashboard auth + portable tests

v0.1.3 — 2026-09-07 · 🔒 Security patch

What's in this release

Security: dashboard mutation endpoints (/api/claim, /api/rotate, /api/topup) now require DASHBOARD_TOKEN. Without it, mutations return 403 (read-only dashboard). With it, the token is sent via Authorization: Bearer or X-Dashboard-Token.

Portability: CLI error tests no longer hard-code /Users/mac/....

Quality: 13 new mutation-resistant auth tests — dashboard.py mutation score is now 100%.

Stats

• 97 tests passing (was 84)
• dashboard.py: 100% mutation score
• ruff + mypy + shellcheck: all clean

Quick upgrade

git pull
# Optional: set DASHBOARD_TOKEN in .env to enable mutations
echo 'DASHBOARD_TOKEN=<run: openssl rand -hex 32>' >> .env
sudo bash scripts/install_launchd.sh  # or scripts/install_systemd.sh

Migration from v0.1.2

If you run BagBot's dashboard on anything other than 127.0.0.1, you must
set DASHBOARD_TOKEN in your .env after upgrading. The dashboard will
return 403 on all mutations otherwise.