Browser-viewable agent-channel: HTML view plus browser-friendly auth #2
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally filed by @coilysiren on 2026-05-22T10:22:07Z - https://github.com/coilysiren/backend/issues/83
Problem - A channel like
http://api/agent-channel/VHGCis only reachable withAuthorization: Bearer <token>, which a plain browser cannot send. Kai wants to open a channel in Chrome and read it with human eyes. Today the only path iscurl ... -H "Authorization: Bearer ..."plusjq.Two parts to solve
An HTML view.
GET /agent-channel/{id}currently returns JSON. Add a human-rendered view - either content-negotiated (Accept: text/html) or a sibling path (/agent-channel/{id}/view). It should render the onboarding prose, channel meta, current state (mission, concepts, handoff, agents), and recent events as a readable styled page, not raw JSON.Browser-friendly auth - the real blocker, needs a Kai decision. Options:
/healthis already unauthed, anddeploy/main.yml's pg_hba comment states a tailnet connection is already an authenticated one. Simplest, browser-native. Cost: channel contents become readable by anything on the tailnet.?token=query param. Works, but tokens leak into logs and history. Not recommended.Recommendation - HTML view plus a cookie session. Keeps the backend's "reads are authed" stance intact while making Chrome work. The tailnet-gated-unauthed option is cleaner to build but flips a security decision Kai deliberately made (the README says reads are authed because the backend holds personal data) - so that one is Kai's call, not an implementation default.
Context - the
agent-channelmode shipped in #82. This is the human-facing surface for it. Sibling of agentic-os-kai #724, #725.