{"record":{"id":"798c84e3083d5992","repo":"Hmbown/CodeWhale","slug":"codewhale-web-requires-runtime-authentication-rem","errorCode":null,"errorMessage":"Codewhale web requires Runtime authentication; remove --insecure","messagePattern":"Codewhale web requires Runtime authentication; remove --insecure","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/tui/src/runtime_api.rs","lineNumber":838,"sourceCode":"    )?);\n    Ok((manager, workshop_activation))\n}\n\n/// Start the runtime API server.\npub async fn run_http_server(\n    config: Config,\n    workspace: PathBuf,\n    plugin_discovery: Arc<crate::plugins::PluginDiscoveryContext>,\n    options: RuntimeApiOptions,\n) -> Result<()> {\n    if options.port == 0 {\n        bail!(\"Port must be > 0\");\n    }\n    if options.web && options.host != \"127.0.0.1\" {\n        bail!(\"Codewhale web is loopback-only and must bind to 127.0.0.1\");\n    }\n    if options.web && options.insecure_no_auth {\n        bail!(\"Codewhale web requires Runtime authentication; remove --insecure\");\n    }\n\n    let task_cfg = TaskManagerConfig::from_runtime(\n        &config,\n        workspace.clone(),\n        config.default_text_model.clone(),\n        Some(options.workers),\n    );\n    let (runtime_threads, _workshop_activation) = open_runtime_threads_for_server(\n        &config,\n        workspace.clone(),\n        RuntimeThreadManagerConfig::from_task_data_dir(task_cfg.data_dir.clone()),\n        plugin_discovery.registry_for_workspace(&workspace),\n    )?;\n    let task_manager =\n        TaskManager::start_with_runtime_manager(task_cfg, config.clone(), runtime_threads.clone())\n            .await?;\n    let automations = Arc::new(Mutex::new(AutomationManager::default_location()?));","sourceCodeStart":820,"sourceCodeEnd":856,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/0c42157ee52f9d55af2b506d71b46249910f77d3/crates/tui/src/runtime_api.rs#L820-L856","documentation":"run_http_server refuses the combination of --web and --insecure-no-auth. The web UI always requires Runtime authentication because it is a full remote-control surface; disabling auth on it is not an supported configuration. The check fires before any listener is created, so nothing is exposed when it triggers.","triggerScenarios":"Starting the server with options.web == true and options.insecure_no_auth == true; typically a flag combo like 'serve --web --insecure' copied from a local-only API invocation.","commonSituations":"Developers used to running the headless API with --insecure for local experiments add --web and hit the guard; CI containers try to skip token setup for convenience; documentation examples that predate web mode.","solutions":["Remove the insecure flag: run web mode with Runtime authentication enabled and use the generated token.","If you were only silencing auth for the local API, turn off --web and keep the two configurations separate.","Automate token distribution (write the runtime token to a file your client reads) instead of disabling auth."],"exampleFix":"# before\ncodewhale serve --web --insecure   # bails: web requires Runtime authentication\n\n# after\ncodewhale serve --web              # auth on; connect with the runtime token","handlingStrategy":"validation","validationCode":"// Rust: reject the incompatible flag pair before startup\nanyhow::ensure!(\n    !(options.web && options.insecure_no_auth),\n    \"--web requires Runtime authentication; drop --insecure\"\n);\nrun_http_server(config, workspace, discovery, options).await?;","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep web and headless-API launch profiles separate; never combine --web with --insecure.","Automate token provisioning (write the runtime token to a secrets file) instead of disabling auth.","Add a lint/check to deployment scripts that fails on the --web --insecure combination."],"tags":["server","security","authentication","web-ui","rust"],"backgroundTag":"authentication-required","analyzedSha":"0c42157ee52f9d55af2b506d71b46249910f77d3","analyzedAt":"2026-08-20T21:50:45.477Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}