# v0.4.44 (2026-05-15)

## Features
- Add Blackbox provider with `bb` alias (#1143)
- Add Xiaomi token plan provider
- Enhance model select modal UX + modal traffic lights (#1111)
- Default Usage dashboard period to Today (#1141)

## Fixes
- Fix Cowork model selection and Windows CLI packaging (#1129)
- Update provider name retrieval for compatibility provider (#1135)
- Update JWT_SECRET handling

src/app/api/cli-tools/cowork-settings/route.js

@@ -8,8 +8,29 @@ import crypto from "crypto";
 import { DEFAULT_PLUGINS, LOCAL_STDIO_PLUGINS, ALLOWED_MCP_COMMANDS, buildManagedMcpServers } from "@/shared/constants/coworkPlugins";
 import { UPDATER_CONFIG } from "@/shared/constants/config";
 import { DATA_DIR } from "@/lib/dataDir";
+import { getConsistentMachineId } from "@/shared/utils/machineId";
 
 const APP_PORT = UPDATER_CONFIG.appPort;
+const CLI_TOKEN_HEADER = "x-9r-cli-token";
+const CLI_TOKEN_SALT = "9r-cli-auth";
+const LOCAL_MCP_PREFIX = `http://localhost:${APP_PORT}/api/mcp/`;
+
+let cachedCliToken = null;
+const getCliToken = async () => {
+  if (!cachedCliToken) cachedCliToken = await getConsistentMachineId(CLI_TOKEN_SALT);
+  return cachedCliToken;
+};
+
+// Inject CLI token header into entries pointing at our local /api/mcp/ bridge.
+const injectAuthHeaders = async (entries) => {
+  const token = await getCliToken();
+  for (const e of entries) {
+    if (typeof e?.url === "string" && e.url.startsWith(LOCAL_MCP_PREFIX)) {
+      e.headers = { ...(e.headers || {}), [CLI_TOKEN_HEADER]: token };
+    }
+  }
+  return entries;
+};
 
 const PROVIDER = "gateway";
 
@@ -328,8 +349,8 @@ export async function POST(request) {
       } catch { /* ignore */ }
     }
 
-    const bridgeEntries = buildLocalBridgeEntries(localPluginNames);
-    const customEntries = buildCustomEntries(customPluginsArray);
+    const bridgeEntries = await injectAuthHeaders(buildLocalBridgeEntries(localPluginNames));
+    const customEntries = await injectAuthHeaders(buildCustomEntries(customPluginsArray));
     const managedMcpServers = [...buildManagedMcpServers(pluginsArray), ...bridgeEntries, ...customEntries];
 
     const bootstrapped = await bootstrapDeploymentMode();