Publish open H5 access recovery release

This release packages the emergency H5 token pause so upgraded users can resume desktop and browser chat without generating or carrying a token. The release notes document the temporary open-access behavior and the verification run used before tagging.

Constraint: v0.2.4 restored startup but token auth can still break chat flows for upgraded users

Rejected: Wait for a full token-auth redesign | users are actively blocked and H5 auth is not critical right now

Confidence: high

Scope-risk: narrow

Directive: Restore H5 token controls only with migration coverage and browser chat E2E

Tested: bun run scripts/release.ts 0.2.5 --dry

Tested: bun run scripts/release.ts 0.2.5

Tested: bun test src/server/__tests__/h5-access-auth.test.ts src/server/middleware/cors.test.ts

Tested: bun run check:server

Tested: bun run check:desktop

desktop/package.json

@@ -1,7 +1,7 @@
 {
   "name": "claude-code-desktop",
   "private": true,
-  "version": "0.2.4",
+  "version": "0.2.5",
   "type": "module",
   "scripts": {
     "dev": "vite",

desktop/src-tauri/Cargo.lock

@@ -482,7 +482,7 @@ dependencies = [
 
 [[package]]
 name = "claude-code-desktop"
-version = "0.2.4"
+version = "0.2.5"
 dependencies = [
  "anyhow",
  "portable-pty",
@@ -3704,13 +3704,13 @@ dependencies = [
 
 [[package]]
 name = "serial2"
-version = "0.2.36"
+version = "0.2.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcdbc46aa3882ec3d48ec2b5abcb4f0d863a13d7599265f3faa6d851f23c12f3"
+checksum = "9eb6ea5562eeaed6936b8b54e086aa0f88b9e5b1bef45beb038e2519fa1185b1"
 dependencies = [
  "cfg-if",
  "libc",
- "winapi",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]

desktop/src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "claude-code-desktop"
-version = "0.2.4"
+version = "0.2.5"
 edition = "2021"
 
 [lib]

desktop/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://raw.githubusercontent.com/nicegui/nicegui/main/nicegui/static/tauri-schema-v2.json",
   "productName": "Claude Code Haha",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "identifier": "com.claude-code-haha.desktop",
   "build": {
     "frontendDist": "../dist",

release-notes/v0.2.5.md

@@ -0,0 +1,30 @@
+# Claude Code Haha v0.2.5
+
+这是一个紧急修复版本，用于临时放行 H5 访问，避免 token 鉴权继续影响聊天使用。
+
+## Highlight
+
+- **临时关闭 H5 token 鉴权**：H5/LAN 访问默认不再要求 `Authorization` header，避免升级后因 token 状态不一致导致聊天或启动失败。
+
+## 问题修复
+
+- 服务端不再因为绑定 `0.0.0.0` 自动开启鉴权；只有显式传入 `--auth-required` 或 `SERVER_AUTH_REQUIRED=1` 时才要求鉴权。
+- 浏览器 H5 启动不再主动读取或校验 H5 token，远程 URL 也会按开放访问路径连接。
+- 设置页先隐藏 H5 启用开关、token 预览/重新生成、允许来源配置，只保留公开 URL 配置和复制入口。
+- CORS 在 H5 token 鉴权暂停期间放行浏览器来源，避免跨来源请求继续卡在预检阶段。
+
+## 验证
+
+- 已新增和更新服务端回归测试，覆盖 REST、WebSocket、CORS 默认无 token 可访问，以及显式鉴权 opt-in 仍然有效。
+- 已更新桌面 H5 启动和设置页测试，覆盖远程 H5 URL 不再要求 token，以及设置页不再展示 token 控件。
+- 已通过 `bun run check:server` 和 `bun run check:desktop`。
+
+## 安装说明
+
+### macOS
+
+首次打开如果提示"已损坏"或"无法验证开发者"，请执行：
+
+```bash
+xattr -cr /Applications/Claude\ Code\ Haha.app
+```