Codewhale web requires Runtime authentication; remove…

Error message

Codewhale web requires Runtime authentication; remove --insecure

What it means

validate_runtime_listener_security: a web Runtime API listener was requested without authentication (--insecure). The web surface serves untrusted browser content over plain HTTP, so unauthenticated non-loopback serving is refused outright rather than started with a known-exposed transport.

Solutions

Remove the `--insecure` flag so Runtime authentication is used
Disable `--web` if you genuinely need unauthenticated access (loopback-only rules still apply)
Configure Runtime auth credentials before enabling web

Example fix

// before
codewhale runtime --web --insecure
// after
codewhale runtime --web

Defensive patterns

Strategy: validation

Validate before calling

if web_enabled && insecure_flag { return Err("--insecure cannot be combined with --web".into()); }

Prevention

Set up Runtime auth before enabling web mode
Use --insecure only for non-web, loopback debugging
Add a lint in wrapper scripts rejecting --web --insecure

When it happens

Trigger: Launching the Runtime API with web enabled and the `--insecure` flag set (options.insecure_no_auth == true).

Common situations: Disabling auth for local debugging and forgetting to drop the web flag; inheriting an --insecure flag from a script that previously ran headless mode.

Understand the failure class

Background: Conflicting config options: "cannot be used together" — configuration validation errors across open-source libraries — this error's family across 162 libraries.

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@73e0f67d83 (2026-09-22). Data as JSON: /api/errors/798c84e3083d5992. Report an issue: GitHub.

Appendix: source

Thrown at crates/tui/src/runtime_api.rs:1110

    .map_err(|e| anyhow!("Runtime API server error: {e}"));
    scheduler_cancel.cancel();
    scheduler_handle.abort();
    task_manager.shutdown_and_wait().await?;
    serve_result
}

/// Mobile control uses plain HTTP only on loopback. It has no TLS or verified
/// overlay transport, so a non-loopback listener would expose the Runtime API
/// to peers that can observe or replay browser traffic.
fn validate_runtime_listener_security(options: &RuntimeApiOptions) -> Result<()> {
    if options.port == 0 {
        bail!("Port must be > 0");
    }
    if options.web && options.host != "127.0.0.1" {
        bail!("Codewhale web is loopback-only and must bind to 127.0.0.1");
    }
    if options.web && options.insecure_no_auth {
        bail!("Codewhale web requires Runtime authentication; remove --insecure");
    }
    if options.mobile && !is_loopback_bind_host(&options.host) {
        bail!(
            "Codewhale mobile is loopback-only without TLS or a verified overlay; bind to 127.0.0.1 or ::1"
        );
    }
    if options.insecure_no_auth && !is_loopback_bind_host(&options.host) {
        bail!(
            "Unauthenticated Runtime access is loopback-only; remove --insecure or bind to 127.0.0.1 or ::1"
        );
    }
    Ok(())
}

fn is_loopback_bind_host(host: &str) -> bool {
    host.parse::<IpAddr>()
        .is_ok_and(|address| address.is_loopback())
}

View on GitHub (pinned to 73e0f67d83)