Merge commit from fork

* fix(security): prevent shell injection in WebSocket handler and harden auth

  - Replace hardcoded JWT secret with auto-generated per-installation secret
  - Add database validation to WebSocket authentication
  - Add token expiration (7d) with auto-refresh
  - Validate projectPath and sessionId in shell handler
  - Use cwd instead of shell string interpolation for project paths
  - Add CORS exposedHeaders for token refresh

* fix: small fix on languages

src/i18n/locales/en/chat.json

@@ -6,7 +6,10 @@
   },
   "copyMessage": {
     "copy": "Copy message",
-    "copied": "Message copied"
+    "copied": "Message copied",
+    "selectFormat": "Select copy format",
+    "copyAsMarkdown": "Copy as markdown",
+    "copyAsText": "Copy as text"
   },
   "messageTypes": {
     "user": "U",

src/i18n/locales/ja/chat.json

@@ -6,7 +6,10 @@
   },
   "copyMessage": {
     "copy": "メッセージをコピー",
-    "copied": "メッセージをコピーしました"
+    "copied": "メッセージをコピーしました",
+    "selectFormat": "コピー形式を選択",
+    "copyAsMarkdown": "Markdownとしてコピー",
+    "copyAsText": "テキストとしてコピー"
   },
   "messageTypes": {
     "user": "U",

src/i18n/locales/ko/chat.json

@@ -6,7 +6,10 @@
   },
   "copyMessage": {
     "copy": "메시지 복사",
-    "copied": "메시지 복사됨"
+    "copied": "메시지 복사됨",
+    "selectFormat": "복사 형식 선택",
+    "copyAsMarkdown": "마크다운으로 복사",
+    "copyAsText": "텍스트로 복사"
   },
   "messageTypes": {
     "user": "U",

src/i18n/locales/ru/chat.json

@@ -6,7 +6,10 @@
   },
   "copyMessage": {
     "copy": "Копировать сообщение",
-    "copied": "Сообщение скопировано"
+    "copied": "Сообщение скопировано",
+    "selectFormat": "Выбрать формат копирования",
+    "copyAsMarkdown": "Копировать как Markdown",
+    "copyAsText": "Копировать как текст"
   },
   "messageTypes": {
     "user": "П",

src/i18n/locales/zh-CN/chat.json

@@ -6,7 +6,10 @@
   },
   "copyMessage": {
     "copy": "复制消息",
-    "copied": "消息已复制"
+    "copied": "消息已复制",
+    "selectFormat": "选择复制格式",
+    "copyAsMarkdown": "复制为 Markdown",
+    "copyAsText": "复制为纯文本"
   },
   "messageTypes": {
     "user": "U",

src/utils/api.js

@@ -21,6 +21,12 @@ export const authenticatedFetch = (url, options = {}) => {
       ...defaultHeaders,
       ...options.headers,
     },
+  }).then((response) => {
+    const refreshedToken = response.headers.get('X-Refreshed-Token');
+    if (refreshedToken) {
+      localStorage.setItem('auth-token', refreshedToken);
+    }
+    return response;
   });
 };