Hmbown/CodeWhale · error

Codewhale web requires Runtime authentication; remove --inse

Error message

Codewhale web requires Runtime authentication; remove --insecure

What it means

run_http_server refuses the combination of --web and --insecure-no-auth. The web UI always requires Runtime authentication because it is a full remote-control surface; disabling auth on it is not an supported configuration. The check fires before any listener is created, so nothing is exposed when it triggers.

Source

Thrown at crates/tui/src/runtime_api.rs:838

    )?);
    Ok((manager, workshop_activation))
}

/// Start the runtime API server.
pub async fn run_http_server(
    config: Config,
    workspace: PathBuf,
    plugin_discovery: Arc<crate::plugins::PluginDiscoveryContext>,
    options: RuntimeApiOptions,
) -> Result<()> {
    if options.port == 0 {
        bail!("Port must be > 0");
    }
    if options.web && options.host != "127.0.0.1" {
        bail!("Codewhale web is loopback-only and must bind to 127.0.0.1");
    }
    if options.web && options.insecure_no_auth {
        bail!("Codewhale web requires Runtime authentication; remove --insecure");
    }

    let task_cfg = TaskManagerConfig::from_runtime(
        &config,
        workspace.clone(),
        config.default_text_model.clone(),
        Some(options.workers),
    );
    let (runtime_threads, _workshop_activation) = open_runtime_threads_for_server(
        &config,
        workspace.clone(),
        RuntimeThreadManagerConfig::from_task_data_dir(task_cfg.data_dir.clone()),
        plugin_discovery.registry_for_workspace(&workspace),
    )?;
    let task_manager =
        TaskManager::start_with_runtime_manager(task_cfg, config.clone(), runtime_threads.clone())
            .await?;
    let automations = Arc::new(Mutex::new(AutomationManager::default_location()?));

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Remove the insecure flag: run web mode with Runtime authentication enabled and use the generated token.
2. If you were only silencing auth for the local API, turn off --web and keep the two configurations separate.
3. Automate token distribution (write the runtime token to a file your client reads) instead of disabling auth.

Example fix

# before
codewhale serve --web --insecure   # bails: web requires Runtime authentication

# after
codewhale serve --web              # auth on; connect with the runtime token

// Rust: reject the incompatible flag pair before startup
anyhow::ensure!(
    !(options.web && options.insecure_no_auth),
    "--web requires Runtime authentication; drop --insecure"
);
run_http_server(config, workspace, discovery, options).await?;

When it happens

Trigger: Starting the server with options.web == true and options.insecure_no_auth == true; typically a flag combo like 'serve --web --insecure' copied from a local-only API invocation.

Common situations: Developers used to running the headless API with --insecure for local experiments add --web and hit the guard; CI containers try to skip token setup for convenience; documentation examples that predate web mode.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Codewhale web is loopback-only and must bind to 127.0.0.1
• external credential path changed for {}; consent covers {},
• persistent allow rules must be scoped to a workspace
• persistent command allow rules must use exact matching
• persistent allow rules must match an exact command or path

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/798c84e3083d5992. Report an issue: GitHub.