Skip to content

AgentsView archive unit with --require-auth; the workstation runs it - #404

Merged
seathatflowsinourveins merged 1 commit into
mainfrom
claude/agentsview-require-auth-20260927
Sep 27, 2026
Merged

AgentsView archive unit with --require-auth; the workstation runs it#404
seathatflowsinourveins merged 1 commit into
mainfrom
claude/agentsview-require-auth-20260927

Conversation

@seathatflowsinourveins

@seathatflowsinourveins seathatflowsinourveins commented Sep 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

What

The adopted AgentsView archive unit now requires a token on its API, and this workstation runs it.

Why. In agentsview v0.43.0, with require_auth off, the auth middleware checks no token on the dashboard's own /api/ routes; only the remote-sync, raw-sync and artifact-exchange routes keep their own authentication (internal/server/auth.go#L110-L161).

  • That API includes POST /sessions/{id}/resume and /open, which start programs (openers.go, exec.Command).
  • It also includes POST /api/v1/config/terminal, which saves a custom terminal binary and argument template for them to start (huma_routes_config.go:19,119-157).
  • Host and Origin checks stop browser pages, not local programs that set those headers, and with WSL mirrored networking, Windows processes share the loopback address.

The upstream --require-auth flag closes this. Static pages stay open, so the interface loads and asks once for the auth_token in the archive's config.toml. Serve never prints the token (main.go:150-156 in both 0.43.0 and 0.44.0).

Changes

  • examples/agentsview-archive.service.example: --require-auth, with the reason.
  • examples/agentsview.toml.example: require_auth = true, because a read without --server starts a detached daemon when none runs (transport.go#L275-L303); that daemon reads the config, not the unit's flags, and it syncs, since NoSync has no config key (config.go#L711). On the workstation the line was appended to ~/.agentsview/config.toml without reading any value.
  • docs/native-dashboards.md: a dated "Token on the archive API" section:
    • the token prompt;
    • the CLI paths: the data-dir form finds the daemon and sends the token, while explicit --server needs --server-token-file;
    • the measured statuses;
    • a direct AGENTSVIEW_NO_DAEMON=1 write is refused while the unit runs (main.go#L1421-L1427);
    • the pricing refresh still reaches raw.githubusercontent.com and openrouter.ai;
    • the workstation archive is the default directory, with no allowlist;
    • the alternatives (no token; a reverse proxy with its own login) and the overturn condition (an upstream release that removes or guards the program-starting routes);
    • a 401 check line in the unit's check block.
  • docs/native-dashboard-data.md and docs/native-dashboard-operations-resolution.md: a dated note after their --server commands, which now return 401 without a token file.
  • recipes/README.md (History and usage) and the manual start in docs/native-dashboards.md: serve with --require-auth too.
    • At 0.43.0, a taken explicit port is not an error. serve_runtime.go:39-48 prints "Port %d in use, using %d", so the recipe's server would otherwise start on another port without a token.
    • A note says the recipe's projects and session search calls send the token themselves.
  • evidence/hosts/…--agentsview--persistence--20260927.json: a receipt from scripts/host_receipts.py record, native_proven, catalog revision a42f0f7f (on main, so a squash merge cannot orphan it).

Evidence (the receipt's own output)

Check Output
Unit state enabled / active / unit_require_auth_flag_present
Archive config archive_config_require_auth_lines=1
No token, the unit (port 17384) root=200 api_ping=401 api_sessions=401
Discriminating control: the identical check on an isolated instance without require_auth (port 17399) root=200 api_ping=200 api_sessions=200, check exit 1, asserted nonzero
Data-dir CLI with the unit running data_dir_form_projects 11
Explicit --server without a token file HTTP 401: Unauthorized

Limitations:

  • no reboot or WSL-restart recovery proof;
  • the browser token prompt was not exercised; entering the token is the operator's step;
  • the transport the data-dir CLI used is not in the output (the docs cite it from source);
  • only the dashboard API is covered, not the machine routes with their own auth;
  • the archive is the host's existing default-directory archive, served --no-sync.

Verification

  • python3 -m unittest on the 26 modules that reference these paths: 1722 run, OK (41 skipped).
  • python3 scripts/validate.py passed; python3 scripts/host_receipts.py validate passed (168 receipts).
  • Rebased on a42f0f7f per the hot-file protocol; the manifest re-registration matched the commit.
  • GPT-6 review of ad779e61: needs_changes (P2 control, P3 wording); both are fixed in 4924d26a, the one repair round.

Coordination

token-efficiency-evidence-cards owns the agentsview 0.44.0 qualification. It holds the pin at 0.43.0 and asked for this to stay a separate PR. It recorded the port constraint for a later re-pin: the unit holds 17384, and 0.44.0 hard-errors on an occupied explicit port (serve_runtime.go:61-65), so recipes/README.md:772 will need --port 0 or the unit's server.

SOTA sources

agentsview v0.43.0 at 9be7745ad1906ee24e04eb05bb86c872ef0939a1:

  • internal/server/auth.go;
  • internal/server/huma_routes_sessions.go:44,47;
  • internal/server/huma_routes_config.go:19;
  • internal/server/openers.go;
  • cmd/agentsview/main.go:150-156;
  • cmd/agentsview/session_sync.go:66-70;
  • cmd/agentsview/serve_runtime.go:39-48;
  • the serve --help and session list --help flags --require-auth and --server-token-file.

v0.44.0: cmd/agentsview/serve_runtime.go:57-65.

🤖 Generated with Claude Code

https://claude.ai/code/session_012qwXNtFyUhY5x2dtrm7tG5

@seathatflowsinourveins seathatflowsinourveins added the lane:foundation Foundation lane: Claude/Codex setup, hosts, memory, RAG, research, workers label Sep 27, 2026
@seathatflowsinourveins
seathatflowsinourveins force-pushed the claude/agentsview-require-auth-20260927 branch from 70c3740 to ad779e6 Compare September 27, 2026 15:00
seathatflowsinourveins pushed a commit that referenced this pull request Sep 27, 2026
Scout @claude
AgentsView #404 repair round: discriminating control, scoped auth wor…
4924d26 
…ding, config-level require_auth

Answers the GPT-6 review of ad779e6 (needs_changes: P2, P3) and the
coordinator's own pre-merge check, in the one repair round.

- P2 (docs/acceptance-evidence-policy.md:42): the persistence receipt now
  runs the identical status check against an isolated instance started
  without require_auth (scratch HOME and data dir, port 17399). It returned
  root=200 api_ping=200 api_sessions=200 and the check exited 1, asserted
  nonzero, next to the passing run on the unit (200/401/401).
- P3: the docs and the unit example no longer say "every token check". v0.43.0
  checks no token on the dashboard's own /api/ routes, while the remote-sync,
  raw-sync and artifact-exchange routes keep their own auth (auth.go#L110-L161).
  Host and Origin checks stop browser pages, not local programs.
- require_auth also goes into the archive's config.toml (examples/
  agentsview.toml.example; on the workstation, appended without reading any
  value): a read without --server starts a detached daemon when none runs
  (transport.go#L275-L303), and that daemon reads the config, not the
  unit's flags, and syncs, since NoSync has no config key (config.go#L711).
- Docs: the data-dir form cites the transport from source; a direct
  NO_DAEMON write is refused while the unit runs (main.go#L1421-L1427); the
  pricing refresh still reaches raw.githubusercontent.com and openrouter.ai;
  the workstation archive is the default directory with no allowlist.
- The receipt's claim stays within its printed output (no transport claim),
  adds the config check, and records at catalog_revision a42f0f7 on main
  rather than the branch commit, which a squash merge would orphan.

Tests: 26 covering modules, 1722 run, OK. validate.py and host_receipts.py
validate (168) passed; git diff --check clean.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_012qwXNtFyUhY5x2dtrm7tG5
@seathatflowsinourveins

seathatflowsinourveins commented Sep 27, 2026

Copy link
Copy Markdown
Collaborator Author

GPT-6 cross-family review of ad779e61: needs_changes. Repair round: 4924d26a. (codex exec -s read-only -m gpt-6-astra, reasoning effort max)

Finding Fix in 4924d26a
P2: no discriminating control (docs/acceptance-evidence-policy.md:42) The receipt runs the identical status check against an isolated instance started without require_auth (scratch HOME and data dir, port 17399): root=200 api_ping=200 api_sessions=200, check exit 1, asserted nonzero, next to the unit's passing 200/401/401.
P3: "every token check" overstated The docs and the unit example now scope it to the dashboard's own /api/ routes; remote-sync, raw-sync and artifact-exchange keep their own auth (auth.go#L110-L161). Host and Origin checks stop browser pages, not local programs.

Also in this round, from the coordinator's pre-merge check:

  • require_auth = true goes in the archive config (examples/agentsview.toml.example). A read without --server starts its own daemon when none runs, and that daemon reads the config, not the unit's flags.
  • The receipt claim stays within its printed output (no transport claim), and adds a value-free config check.
  • catalog_revision is a42f0f7f on main, not the branch commit.
  • The docs note the NO_DAEMON write refusal, the pricing egress and the default-directory archive.
  • The PR body now names the terminal route as POST /api/v1/config/terminal.

Checks: 26 covering modules, 1722 run, OK; validate.py and host_receipts.py validate (168) passed. No further review round (bounded loop); CI verifies the head.

🤖 Generated with Claude Code

Scout @claude
AgentsView archive unit with --require-auth; the workstation runs it
a82827c 
The adopted agentsview-archive.service now passes upstream --require-auth.
Without it, v0.43.0 skips every token check on /api/ (auth.go), and the API
includes session resume/open actions that start programs (openers.go) plus
a terminal setting that picks what they start; with WSL mirrored networking,
Windows processes share the loopback address.

- examples/agentsview-archive.service.example: --require-auth, with the reason.
- docs/native-dashboards.md: a dated "Token on the archive API" section (the
  UI prompts once for config.toml auth_token; the data-dir CLI form finds the
  daemon and sends the token; explicit --server needs --server-token-file),
  a 401 check line, the alternatives and the overturn condition.
- docs/native-dashboard-data.md and native-dashboard-operations-resolution.md:
  a dated note after their --server commands.
- recipes/README.md History and usage, and the manual start in
  docs/native-dashboards.md: serve with --require-auth too (at 0.43.0 an
  explicit port that is taken is not an error, so the recipe's server would
  otherwise start elsewhere without a token).
- evidence/hosts: persistence receipt from scripts/host_receipts.py record
  (native_proven): unit enabled and active with the flag; without a token
  / 200 and /api/ping, /api/v1/sessions 401; data-dir CLI listed 11
  projects; explicit --server without a token file returned HTTP 401.

Tests: 26 covering modules, 1722 run, OK. validate.py and host_receipts.py
validate passed.

Repair round (GPT-6 review of ad779e6: P2 discriminating control, P3 scoped wording):
- P2 (docs/acceptance-evidence-policy.md:42): the persistence receipt now
  runs the identical status check against an isolated instance started
  without require_auth (scratch HOME and data dir, port 17399). It returned
  root=200 api_ping=200 api_sessions=200 and the check exited 1, asserted
  nonzero, next to the passing run on the unit (200/401/401).
- P3: the docs and the unit example no longer say "every token check". v0.43.0
  checks no token on the dashboard's own /api/ routes, while the remote-sync,
  raw-sync and artifact-exchange routes keep their own auth (auth.go#L110-L161).
  Host and Origin checks stop browser pages, not local programs.
- require_auth also goes into the archive's config.toml (examples/
  agentsview.toml.example; on the workstation, appended without reading any
  value): a read without --server starts a detached daemon when none runs
  (transport.go#L275-L303), and that daemon reads the config, not the
  unit's flags, and syncs, since NoSync has no config key (config.go#L711).
- Docs: the data-dir form cites the transport from source; a direct
  NO_DAEMON write is refused while the unit runs (main.go#L1421-L1427); the
  pricing refresh still reaches raw.githubusercontent.com and openrouter.ai;
  the workstation archive is the default directory with no allowlist.
- The receipt's claim stays within its printed output (no transport claim),
  adds the config check, and records at catalog_revision a42f0f7 on main
  rather than the branch commit, which a squash merge would orphan.

Tests: 26 covering modules, 1722 run, OK. validate.py and host_receipts.py
validate passed; git diff --check clean.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
@seathatflowsinourveins
seathatflowsinourveins force-pushed the claude/agentsview-require-auth-20260927 branch from 4924d26 to a82827c Compare September 27, 2026 15:47
@seathatflowsinourveins
seathatflowsinourveins merged commit d59ed28 into main Sep 27, 2026
24 checks passed
@seathatflowsinourveins
seathatflowsinourveins deleted the claude/agentsview-require-auth-20260927 branch September 27, 2026 16:12
@seathatflowsinourveins seathatflowsinourveins mentioned this pull request Sep 27, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

lane:foundation Foundation lane: Claude/Codex setup, hosts, memory, RAG, research, workers

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@seathatflowsinourveins