fix: update the save configuration of the cli tools

src/dashboardGuard.js

@@ -205,8 +205,11 @@ export async function proxy(request) {
   // case, can change privileged system networking. Keep them available only
   // to authenticated dashboard users on the local machine; never allow the
   // shared CLI bearer token to become a remote host-administration credential.
+  // Configuration routes only persist dashboard-user settings in SQLite, so
+  // authenticated remote dashboard users may access them.
   if (pathname === "/api/cli-tools" || pathname.startsWith("/api/cli-tools/")) {
-    if (!isLocalRequest(request)) {
+    const isConfigRoute = pathname.startsWith("/api/cli-tools/config/");
+    if (!isLocalRequest(request) && !isConfigRoute) {
       return NextResponse.json({ error: "CLI Tools are available only from the local machine" }, { status: 403 });
     }
     if (!(await isAuthenticated(request))) {

tests/unit/dashboard-guard.test.js

@@ -292,6 +292,25 @@ describe("dashboard guard CLI Tools access", () => {
     expect(response.body.error).toBe("CLI Tools are available only from the local machine");
   });
 
+  it("allows authenticated remote users to access CLI tool configuration", async () => {
+    const response = await proxy(request("/api/cli-tools/config/claude", {
+      host: "router.example.com",
+    }, "user-token"));
+
+    expect(response).toBe(mocks.nextResponse);
+  });
+
+  it("rejects unauthenticated remote CLI tool configuration access", async () => {
+    mocks.verifyDashboardAuthToken.mockResolvedValue(false);
+
+    const response = await proxy(request("/api/cli-tools/config/claude", {
+      host: "router.example.com",
+    }));
+
+    expect(response.status).toBe(401);
+    expect(response.body.error).toBe("Unauthorized");
+  });
+
   it("allows a local administrator to use CLI Tools", async () => {
     mocks.getUserById.mockResolvedValue({ id: "user-1", isActive: true, role: "admin" });