{"record":{"id":"798c84e3083d5992","repo":"Hmbown/CodeWhale","slug":"codewhale-web-requires-runtime-authentication-rem","errorCode":null,"errorMessage":"Codewhale web requires Runtime authentication; remove --insecure","messagePattern":"Codewhale web requires Runtime authentication; remove --insecure","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/tui/src/runtime_api.rs","lineNumber":1110,"sourceCode":"    .map_err(|e| anyhow!(\"Runtime API server error: {e}\"));\n    scheduler_cancel.cancel();\n    scheduler_handle.abort();\n    task_manager.shutdown_and_wait().await?;\n    serve_result\n}\n\n/// Mobile control uses plain HTTP only on loopback. It has no TLS or verified\n/// overlay transport, so a non-loopback listener would expose the Runtime API\n/// to peers that can observe or replay browser traffic.\nfn validate_runtime_listener_security(options: &RuntimeApiOptions) -> Result<()> {\n    if options.port == 0 {\n        bail!(\"Port must be > 0\");\n    }\n    if options.web && options.host != \"127.0.0.1\" {\n        bail!(\"Codewhale web is loopback-only and must bind to 127.0.0.1\");\n    }\n    if options.web && options.insecure_no_auth {\n        bail!(\"Codewhale web requires Runtime authentication; remove --insecure\");\n    }\n    if options.mobile && !is_loopback_bind_host(&options.host) {\n        bail!(\n            \"Codewhale mobile is loopback-only without TLS or a verified overlay; bind to 127.0.0.1 or ::1\"\n        );\n    }\n    if options.insecure_no_auth && !is_loopback_bind_host(&options.host) {\n        bail!(\n            \"Unauthenticated Runtime access is loopback-only; remove --insecure or bind to 127.0.0.1 or ::1\"\n        );\n    }\n    Ok(())\n}\n\nfn is_loopback_bind_host(host: &str) -> bool {\n    host.parse::<IpAddr>()\n        .is_ok_and(|address| address.is_loopback())\n}","sourceCodeStart":1092,"sourceCodeEnd":1128,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/73e0f67d83c59909b571efdfc88c4bc28c309cb1/crates/tui/src/runtime_api.rs#L1092-L1128","documentation":"validate_runtime_listener_security: a web Runtime API listener was requested without authentication (--insecure). The web surface serves untrusted browser content over plain HTTP, so unauthenticated non-loopback serving is refused outright rather than started with a known-exposed transport.","triggerScenarios":"Launching the Runtime API with web enabled and the `--insecure` flag set (options.insecure_no_auth == true).","commonSituations":"Disabling auth for local debugging and forgetting to drop the web flag; inheriting an --insecure flag from a script that previously ran headless mode.","solutions":["Remove the `--insecure` flag so Runtime authentication is used","Disable `--web` if you genuinely need unauthenticated access (loopback-only rules still apply)","Configure Runtime auth credentials before enabling web"],"exampleFix":"// before\ncodewhale runtime --web --insecure\n// after\ncodewhale runtime --web","handlingStrategy":"validation","validationCode":"if web_enabled && insecure_flag { return Err(\"--insecure cannot be combined with --web\".into()); }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set up Runtime auth before enabling web mode","Use --insecure only for non-web, loopback debugging","Add a lint in wrapper scripts rejecting --web --insecure"],"tags":["security","authentication","runtime-api"],"backgroundTag":"conflicting-config-options","analyzedSha":"73e0f67d83c59909b571efdfc88c4bc28c309cb1","analyzedAt":"2026-09-22T01:30:00.501Z","contentChangedAt":"2026-09-22T01:30:00.501Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}