Require auth on sensitive endpoints, add single-flight task guard, clipboard fallback, and token fingerprinting

[AmrDab]

Motivation

• Protect sensitive/read-only endpoints from unauthenticated access by enforcing the existing Bearer token requirement.
• Avoid leaking full auth tokens to stdout while still giving operators a short reference to connect tools.
• Prevent race conditions from concurrent /task requests by making task execution single-flight per Agent instance.
• Make text typing more robust in environments where the clipboard bridge is unavailable.

Description

• Added requireAuth to several endpoints in src/server.ts including GET /favorites, GET /task-logs, GET /task-logs/current, GET /logs, GET /screenshot, and the POST /action path so mutating and sensitive read routes require the Bearer token.
• Introduced tokenFingerprint() in src/index.ts and replaced full-token logging with a short fingerprint when starting the API and tool servers, while keeping the full token saved to ~/.clawdcursor/token.
• Added a synchronous single-flight guard to Agent.executeTask by introducing taskRunning and checking/setting it around task execution, and moved initial state setup earlier; taskRunning is always cleared in a finally block.
• Updated ActionRouter.handleType to catch clipboard bridge failures and fall back to desktop.typeText(text) instead of failing the entire action.
• Adjusted tests and test configuration: added tsconfig.tests.json, added typecheck and typecheck:tests scripts to package.json, extended vitest.config.ts to include tests/**, and updated tests/smoke.test.ts to use initServerToken() and a withAuth helper for authenticated requests; also tweaked an OCR unit test expectation.

Testing

• Ran unit/integration tests with npm test (Vitest); the test suite including updated smoke tests completed successfully.
• Ran type checks for tests with npm run typecheck:tests (uses tsc --noEmit -p tsconfig.tests.json) and npm run typecheck (tsc --noEmit) locally; both passed.

---

Codex Task