@kontextmind/kxm 0.7.146 → 0.7.147

package/.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "kxm",
       "source": "./plugins/kxm",
       "description": "Durable workflows, peer agents, and kxm tui",
-      "version": "0.7.146",
+      "version": "0.7.147",
       "category": "development",
       "tags": ["kxm", "multi-agent", "workflows", "mcp"]
     }

package/CHANGELOG.md

@@ -142,6 +142,28 @@ All notable user-facing changes are documented here. The project follows [Semant
 
 ### Changed
 
+- **Docs match the 2026-09-27 Steel and machine-account infrastructure.**
+  Steel (`steel.kontextmind.com`, alias `steel.theneuro.me`) is reached only
+  through Caddy on `kxmd-proxy` (VM 230) and Authentik forward auth. Direct
+  LAN, tailnet, and host-forward access is blocked. Sessions return
+  `websocketUrl` `wss://steel.kontextmind.com/` (previously
+  `ws://steel-browser/`). The CDP path is `/v1/devtools` with an
+  `Authorization` header. Allowed groups are `steel-users`, `kxmd-users`,
+  `kxmd-admins`, and `kxmd-owners`. `STEEL_API_URL` defaults to
+  `https://steel.kontextmind.com`. `STEEL_API_KEY` is deprecated and is not
+  enforced by Steel or Caddy. Migrate to `STEEL_AUTH_HEADER`, then
+  `STEEL_AUTH_BASIC`, then `STEEL_AUTH_USER` and `STEEL_AUTH_TOKEN`; those
+  override the key. The `svc-steel` credential is 1Password vault
+  `kontextmind`, item `Steel (svc-steel)`, field `basic_auth`, read with
+  `op read` and never written to disk. Steel requires `kxm` 0.7.135 or
+  newer. Playwright stays on Obscura ([ADR-0005](docs/adr/ADR-0005-obscura-default-playwright.md)).
+  The Proxmox boot order and VM names are in
+  [Deploy KXM](docs/operations/deploy.md#boot-the-kxmd-proxmox-host).
+  Machine accounts follow
+  [ADR-0006](docs/adr/ADR-0006-machine-account-names.md). The DOKS deployment
+  record is superseded by
+  [ADR-0007](docs/adr/ADR-0007-steel-caddy-authentik.md).
+
 - **Workforce ids use one convention, and old ids still resolve.**
   Role ids stay `planner`, `writer`, `reviewer-arch`, and `reviewer-cli`.
   Agent ids and agent-step ids use those same names. Route ids are
@@ -472,9 +494,10 @@ All notable user-facing changes are documented here. The project follows [Semant
   into `chromium.connectOverCDP`. Obscura stays the default and sends no Steel
   headers. `STEEL_AUTH_HEADER` overrides the value. The CDP URL omits the credential when
   those variables are set. A 302 to the identity provider fails closed and does
-  not follow the login redirect. `STEEL_API_KEY` still sends the legacy
-  `x-steel-api-key` header and `apiKey` query parameter for the temporary proxy
-  shim, and warns once. See
+  not follow the login redirect. `STEEL_API_KEY` is deprecated. Steel and
+  Caddy do not enforce it. `STEEL_AUTH_HEADER`, then `STEEL_AUTH_BASIC`, then
+  `STEEL_AUTH_USER` and `STEEL_AUTH_TOKEN` override it. A client that still
+  has only the legacy key warns once and is not authenticated. See
   [Browser automation](docs/guides/browser-automation.md).
 
 ### Removed

package/docs/README.md

@@ -76,7 +76,7 @@ KXM connects coding agents through a durable, authenticated [hub](glossary.md#hu
 | [Architecture](concepts/architecture.md) | Integrators, maintainers | The components, message and workflow lifecycles, and KXM's limits |
 | [Trust model](concepts/trust-model.md) | Operators, security reviewers | Who holds which credential, project boundaries, and what provenance proves |
 | [Data and storage](concepts/data-and-storage.md) | Operators, security reviewers | What each store holds, where it lives and how long it is kept |
-| [Architecture decision records](adr/README.md) | Maintainers | The decision records: [browser automation](adr/ADR-0002-browser-automation-steel-doks.md), [Obscura for Playwright](adr/ADR-0005-obscura-default-playwright.md), [SQLite-only store](adr/ADR-0003-sqlite-only-store.md), [edge identity](adr/ADR-0004-edge-identity-authentik.md) |
+| [Architecture decision records](adr/README.md) | Maintainers | The decision records: [browser automation](adr/ADR-0002-browser-automation-steel-doks.md), [Steel through Caddy](adr/ADR-0007-steel-caddy-authentik.md), [Obscura for Playwright](adr/ADR-0005-obscura-default-playwright.md), [machine account names](adr/ADR-0006-machine-account-names.md), [SQLite-only store](adr/ADR-0003-sqlite-only-store.md), [edge identity](adr/ADR-0004-edge-identity-authentik.md) |
 | [KXM contract package](contracts/README.md) | Maintainers, reviewers | The normative specifications for the local-first architecture, listed below |
 
 ### Contracts

package/docs/adr/ADR-0002-browser-automation-steel-doks.md

@@ -4,13 +4,13 @@ id: "ADR-0002"
 type: "adr"
 title: "Self-hosted Steel on DOKS for reusable browser automation and human takeover"
 project: "kxm"
-status: "accepted"
+status: "superseded"
 owner: "@operator"
 created: "2026-09-14"
 updated: "2026-09-27"
 authority: "decision"
 confidence: "verified"
-summary: "Adopt self-hosted Steel on DigitalOcean Kubernetes (DOKS) with agent-browser and Playwright as KXM's primary browser automation infrastructure."
+summary: "The 2026-09-14 choice of self-hosted Steel. The DOKS deployment in this record was superseded on 2026-09-27 by ADR-0007. Obscura is the Playwright default (ADR-0005)."
 tags: ["architecture", "decision", "browser", "steel", "doks", "playwright"]
 related: ["docs/guides/browser-automation.md", "docs/guides/agent-skills.md", "docs/adr/ADR-0005-obscura-default-playwright.md"]
 details:
@@ -20,11 +20,15 @@ details:
     - "Provide dual exploratory (agent-browser) and regression (Playwright) interfaces"
     - "Enforce strict credential isolation via pass-cli"
   supersedes: null
-  superseded_by: null
+  superseded_by: "ADR-0007"
 ---
 
 # ADR-0002: Self-hosted Steel on DOKS for reusable browser automation
 
+## Status
+
+Superseded on 2026-09-27 by [ADR-0007](ADR-0007-steel-caddy-authentik.md) for where Steel runs and how clients authenticate. [ADR-0005](ADR-0005-obscura-default-playwright.md) keeps Obscura as the Playwright default. The sections below are the 2026-09-14 decision. They are not the current deployment. Steel and Caddy do not enforce `STEEL_API_KEY`.
+
 ## Context and problem statement
 
 AI coding agents and orchestration workflows in KXM require browser interaction for UI exploration, DOM mapping, bug reproduction, and end-to-end regression testing. Existing approaches suffered from three core issues:
@@ -100,8 +104,7 @@ AI coding agents and orchestration workflows in KXM require browser interaction
 
 - **Verification**: Health endpoint `$STEEL_API_URL/v1/health` verified with HTTP 200 and Let's Encrypt TLS.
 - **Integration Test**: `test/core/browser.test.ts` validates session lifecycle, CDP endpoint formatting, takeover transitions, and secret redaction.
-- **Security Check**: `pass-cli` verified as the authoritative store for Steel credentials in the operators' password manager.
-- **Edge auth (2026-09-27)**: `steel.kontextmind.com` and `steel.theneuro.me`, including the CDP WebSocket, are behind Authentik forward auth. Steel does not check `STEEL_API_KEY`. Clients send `Authorization: Basic`. Unauthenticated requests are redirected to `id.kxmd.dev`. The legacy `x-steel-api-key` header and `apiKey` query parameter remain a temporary proxy shim.
+- **Security Check**: `pass-cli` was the credential store named in this 2026-09-14 decision. Current clients read the `svc-steel` credential with `op read`, as [ADR-0007](ADR-0007-steel-caddy-authentik.md) records.
 
 ## Related
 

package/docs/adr/ADR-0005-obscura-default-playwright.md

@@ -12,7 +12,7 @@ authority: "decision"
 confidence: "verified"
 summary: "Playwright testing and verification connect to pinned Obscura v0.2.3 over CDP. Steel stays the browser for human takeover, MFA, and the live session viewer."
 tags: ["architecture", "decision", "browser", "obscura", "playwright", "cdp"]
-related: ["docs/adr/ADR-0002-browser-automation-steel-doks.md", "docs/guides/browser-automation.md", "docs/kb/how-to-connect-playwright-to-obscura.md"]
+related: ["docs/adr/ADR-0002-browser-automation-steel-doks.md", "docs/adr/ADR-0007-steel-caddy-authentik.md", "docs/guides/browser-automation.md", "docs/kb/how-to-connect-playwright-to-obscura.md"]
 details:
   decision_drivers:
     - "Playwright tests must run without a Steel cluster or a Playwright-managed browser download"
@@ -26,7 +26,7 @@ details:
 
 ## Status
 
-Accepted on 2026-09-27. This record does not supersede [ADR-0002](ADR-0002-browser-automation-steel-doks.md). Steel remains the browser for human takeover, MFA, and the live session viewer.
+Accepted on 2026-09-27. This record does not supersede [ADR-0002](ADR-0002-browser-automation-steel-doks.md). [ADR-0007](ADR-0007-steel-caddy-authentik.md) is the current Steel deployment. Steel remains the browser for remote and hosted sessions, human takeover, MFA, and the live session viewer.
 
 ## Context
 
@@ -79,7 +79,8 @@ Obscura v0.2.3 is a headless Chromium build that speaks the Chrome DevTools Prot
 
 ## Related
 
-- [ADR-0002: Self-hosted Steel on DOKS](ADR-0002-browser-automation-steel-doks.md)
+- [ADR-0002: Self-hosted Steel on DOKS (superseded deployment)](ADR-0002-browser-automation-steel-doks.md)
+- [ADR-0007: Steel through Caddy and Authentik](ADR-0007-steel-caddy-authentik.md)
 - [Browser automation](../guides/browser-automation.md)
 - [How do I connect Playwright to Obscura?](../kb/how-to-connect-playwright-to-obscura.md)
 - [Environment variables and limits](../reference/configuration.md#browser-automation)

package/docs/adr/ADR-0006-machine-account-names.md

@@ -0,0 +1,90 @@
+---
+schema: "kxm.doc.v1"
+id: "ADR-0006"
+type: "adr"
+title: "Machine account names"
+project: "kxm"
+status: "accepted"
+owner: "@operator"
+created: "2026-09-27"
+updated: "2026-09-27"
+authority: "decision"
+confidence: "verified"
+summary: "New machine accounts use svc-<system>-<purpose>, or svc-<tenant>-<system>-<purpose> when they belong to one tenant. Test accounts add a test- prefix and stay out of production groups."
+tags: ["architecture", "decision", "authentik", "accounts"]
+related: ["docs/adr/ADR-0004-edge-identity-authentik.md", "docs/operations/deploy.md", "docs/contributing/operating-rules.md"]
+details:
+  decision_drivers:
+    - "One readable pattern for platform and tenant machine accounts"
+    - "Test and witness accounts must be unable to enter production groups"
+    - "Existing names stay until an approved inventory authorizes a rename"
+  supersedes: null
+  superseded_by: null
+---
+
+# ADR-0006: Machine account names
+
+## Status
+
+Accepted on 2026-09-27.
+
+## Context
+
+Authentik machine accounts were created with local names such as `kxm-agent`, `kxm-witness-*`, `witness9`, `kxmdproof`, `kxm-provisioner`, and `agent-ilo-asus`. Those names do not say whether the account is platform-wide, tenant-scoped, or a test identity. Renaming them without an inventory would drop grants that still point at the old name.
+
+## Decision drivers
+
+1. A reader can tell the scope of an account from its name.
+2. Test, witness, and proof accounts must not sit in production groups.
+3. Authentik's own accounts keep the names Authentik assigns.
+4. A rename of an account that already exists waits for an approved inventory.
+
+## Considered options
+
+1. **`svc-` names, with a `test-` prefix for non-production accounts.**
+2. **Keep creating ad hoc names.**
+3. **Put every machine account under Authentik's `ak-*` prefix.**
+
+### Option 1: `svc-` names (chosen)
+
+- Good, because platform and tenant scope are visible in the name.
+- Good, because a `test-` prefix can be excluded from production groups.
+- Bad, because accounts that already exist keep their old names until an inventory is approved.
+
+### Option 2: ad hoc names (rejected)
+
+- Good, because nothing already issued has to change.
+- Bad, because the next account repeats the same ambiguity.
+
+### Option 3: `ak-*` for every machine account (rejected)
+
+- Good, because one prefix would match Authentik-managed users.
+- Bad, because `ak-*` is Authentik's own namespace for outposts and internal users.
+
+## Decision
+
+Create machine accounts with these shapes. `<tenant>` is the tenant slug.
+
+| Scope | Name |
+|---|---|
+| Platform-wide | `svc-<system>-<purpose>` |
+| Tenant-scoped | `svc-<tenant>-<system>-<purpose>` |
+| Test, witness, or proof | The same shapes with a `test-` prefix |
+
+A `test-` account is never a member of a production group.
+
+Authentik-managed accounts are exempt. That includes outposts and any account whose name starts with `ak-`.
+
+The `svc-steel` credential that reaches the Steel server is the account operators use today. This record does not rename it. Names already recorded in plans and handoffs, including `kxm-agent`, `kxm-witness-*`, `witness9`, `kxmdproof`, `kxm-provisioner`, and `agent-ilo-asus`, stay as written until an approved inventory lists each rename. Do not invent a replacement for a specific account.
+
+## Consequences
+
+- New accounts follow the table above.
+- This repository does not assign new names to the recorded accounts.
+- Group names such as `kxmd-owners` are groups, not machine accounts, and this record does not rename them.
+
+## Related
+
+- [Edge identity](ADR-0004-edge-identity-authentik.md)
+- [Deploy KXM](../operations/deploy.md#name-machine-accounts)
+- [Operating rules](../contributing/operating-rules.md)

package/docs/adr/ADR-0007-steel-caddy-authentik.md

@@ -0,0 +1,97 @@
+---
+schema: "kxm.doc.v1"
+id: "ADR-0007"
+type: "adr"
+title: "Steel is reached only through Caddy and Authentik"
+project: "kxm"
+status: "accepted"
+owner: "@operator"
+created: "2026-09-27"
+updated: "2026-09-27"
+authority: "decision"
+confidence: "verified"
+summary: "The Steel server steel.kontextmind.com is an LXC behind Caddy and Authentik forward auth. Clients use the svc-steel credential. STEEL_API_KEY is not enforced. Playwright stays on Obscura."
+tags: ["architecture", "decision", "browser", "steel", "authentik"]
+related: ["docs/adr/ADR-0002-browser-automation-steel-doks.md", "docs/adr/ADR-0005-obscura-default-playwright.md", "docs/guides/browser-automation.md", "docs/adr/ADR-0006-machine-account-names.md"]
+details:
+  decision_drivers:
+    - "Steel must not be reachable on the LAN, the tailnet, or a host forward"
+    - "Authentik groups are the access list"
+    - "Credentials stay in 1Password and are read into the process only"
+  supersedes: "ADR-0002"
+  superseded_by: null
+---
+
+# ADR-0007: Steel is reached only through Caddy and Authentik
+
+## Status
+
+Accepted on 2026-09-27. This record supersedes the DigitalOcean Kubernetes deployment in [ADR-0002](ADR-0002-browser-automation-steel-doks.md). [ADR-0005](ADR-0005-obscura-default-playwright.md) still makes Obscura the Playwright default. Steel remains the browser for remote and hosted sessions, human takeover, MFA, and the live session viewer.
+
+## Context
+
+Steel now runs as LXC 240 on the Proxmox host, at startup order 40. Its public name is `steel.kontextmind.com`. `steel.theneuro.me` is an alias of that same server. Caddy on VM 230 (`kxmd-proxy`) is the only listener, and it forwards authentication to Authentik. Direct LAN, tailnet, and host-forward access is blocked.
+
+Sessions return `websocketUrl` `wss://steel.kontextmind.com/`. The previous value was `ws://steel-browser/`. Clients connect Chrome DevTools Protocol at `/v1/devtools` and send `Authorization` on the handshake. The URL does not carry a credential.
+
+Steel and Caddy do not enforce `STEEL_API_KEY`. Clients authenticate as the Authentik user `svc-steel`.
+
+## Decision drivers
+
+1. The browser host is not a second network entrance beside the proxy.
+2. Membership in a known Authentik group is the allow list.
+3. The credential is read at runtime and is not written to disk.
+4. Playwright tests keep the Obscura default from ADR-0005.
+
+## Considered options
+
+1. **Caddy plus Authentik forward auth, with direct paths blocked.**
+2. **Keep the DOKS ingress and a Steel API key.**
+3. **Publish the LXC on the tailnet or a host forward.**
+
+### Option 1: Caddy and Authentik only (chosen)
+
+- Good, because one proxy terminates TLS and applies the group check.
+- Good, because a client that still sends `STEEL_API_KEY` does not get a session.
+- Bad, because clients older than `kxm` 0.7.135 still expect `ws://steel-browser/`.
+
+### Option 2: DOKS and `STEEL_API_KEY` (rejected)
+
+- Good, because existing scripts that sent `x-steel-api-key` would keep working.
+- Bad, because that cluster is no longer where Steel runs, and neither Steel nor Caddy checks the key.
+
+### Option 3: tailnet or host-forward access (rejected)
+
+- Good, because an operator on the tailnet could open the API without the proxy.
+- Bad, because it bypasses Authentik and the group check.
+
+## Decision
+
+Reach Steel only at `https://steel.kontextmind.com` (alias `steel.theneuro.me`) through Caddy and Authentik forward auth. `STEEL_API_URL` defaults to `https://steel.kontextmind.com`.
+
+Authenticate with the `svc-steel` credential. Precedence is `STEEL_AUTH_HEADER`, then `STEEL_AUTH_BASIC`, then `STEEL_AUTH_USER` together with `STEEL_AUTH_TOKEN`. Those variables override `STEEL_API_KEY`. `STEEL_API_KEY` is deprecated: Steel and Caddy do not enforce it, and a value in the URL is not accepted. Migrate by setting one of the three Authentik variables and dropping the key from the environment.
+
+Read the credential from 1Password at runtime. The vault is `kontextmind`, the item is `Steel (svc-steel)`, and the field is `basic_auth`. Use `op read`. Do not write the value to disk.
+
+```bash
+export STEEL_AUTH_BASIC="$(op read 'op://kontextmind/Steel (svc-steel)/basic_auth')"
+```
+
+The CDP path is `/v1/devtools` with an `Authorization` header.
+
+These Authentik groups may use the server: `steel-users`, `kxmd-users`, `kxmd-admins`, and `kxmd-owners`.
+
+`kxm` 0.7.135 or newer is required. Playwright testing stays on Obscura unless `KXM_BROWSER=steel`.
+
+## Consequences
+
+- A connection to the LXC by LAN address, tailnet address, or host forward fails.
+- A client that only sets `STEEL_API_KEY` is not authenticated.
+- The `svc-steel` name is the live account. [ADR-0006](ADR-0006-machine-account-names.md) does not rename it ahead of an approved inventory.
+
+## Related
+
+- [ADR-0002](ADR-0002-browser-automation-steel-doks.md)
+- [ADR-0005](ADR-0005-obscura-default-playwright.md)
+- [Browser automation](../guides/browser-automation.md)
+- [Deploy KXM](../operations/deploy.md#boot-the-kxmd-proxmox-host)

package/docs/adr/README.md

@@ -7,10 +7,12 @@ An architecture decision record (ADR) captures one significant decision about KX
 | ADR | Decision | Status | Date |
 |---|---|---|---|
 | [ADR-001](../contracts/architecture.md) | Local Runtime, project authority, and aggregate hub | Accepted target | — |
-| [ADR-0002](ADR-0002-browser-automation-steel-doks.md) | Self-hosted Steel for reusable browser automation and human takeover | Accepted | 2026-09-14 |
+| [ADR-0002](ADR-0002-browser-automation-steel-doks.md) | Self-hosted Steel on DOKS (deployment superseded) | Superseded by ADR-0007 | 2026-09-14 |
 | [ADR-0003](ADR-0003-sqlite-only-store.md) | SQLite as the only store | Accepted | 2026-09-17 |
 | [ADR-0004](ADR-0004-edge-identity-authentik.md) | Edge identity with Authentik; the hub owns no browser identity | Accepted | 2026-09-20 |
 | [ADR-0005](ADR-0005-obscura-default-playwright.md) | Obscura is the default browser for Playwright; Steel stays for takeover | Accepted | 2026-09-27 |
+| [ADR-0006](ADR-0006-machine-account-names.md) | Machine account names (`svc-` shapes, `test-` prefix, Authentik exemptions) | Accepted | 2026-09-27 |
+| [ADR-0007](ADR-0007-steel-caddy-authentik.md) | Steel is reached only through Caddy and Authentik | Accepted | 2026-09-27 |
 
 ADR-001 is the original decision record for the local Runtime. It lives with the contracts in [`docs/contracts/architecture.md`](../contracts/architecture.md) because it is the root of those contracts, and it keeps its original three-digit number. Records in this directory continue the sequence from 0002. There is no ADR-0001.
 

package/docs/contributing/operating-rules.md

@@ -2,7 +2,7 @@
 title: "Operating rules"
 description: "Standing instructions from the operator that every agent session on this repository follows, with the date each was given. Read before planning, dispatching, landing, or editing the roadmap."
 audience: "agents and maintainers"
-updated: "2026-09-26"
+updated: "2026-09-27"
 ---
 
 # Operating rules
@@ -58,6 +58,18 @@ replacement.
   `impl-bg`) retire last, after one real unit has run through the one-step
   workflows. (2026-09-26.)
 
+## Accounts
+
+- **Machine account names follow [ADR-0006](../adr/ADR-0006-machine-account-names.md).**
+  Platform-wide accounts are `svc-<system>-<purpose>`. Tenant-scoped accounts
+  are `svc-<tenant>-<system>-<purpose>`, where `<tenant>` is the tenant slug.
+  Test, witness, and proof accounts use those shapes with a `test-` prefix
+  and are never members of production groups. Authentik-managed accounts
+  (outposts and `ak-*`) are exempt. Recorded names such as `kxm-agent`,
+  `kxm-witness-*`, `witness9`, and `kxmdproof` stay until an approved
+  inventory. Do not invent a replacement for a specific account.
+  (2026-09-27.)
+
 ## Decisions and debt
 
 - **Every option comes with pros and cons and two recommendations**, the

package/docs/guides/agent-skills.md

@@ -68,7 +68,7 @@ Tools map the same way: peer tools to `kxm-peer`, workflow tools to `kxm-workflo
 
 ## Browser automation skills
 
-Playwright testing and verification use Obscura ([ADR-0005](../adr/ADR-0005-obscura-default-playwright.md)). The Steel skills cover human takeover, MFA, and the live session viewer. Those hosts sit behind Authentik forward auth: send `Authorization: Basic` (`STEEL_AUTH_BASIC`, or `STEEL_AUTH_USER` and `STEEL_AUTH_TOKEN`) and keep the credential out of URLs. `kxm-browser-verify` owns `vision`. The other browser skills own no `kxm` command. See [Browser automation](browser-automation.md) and [ADR-0002](../adr/ADR-0002-browser-automation-steel-doks.md).
+Playwright testing and verification use Obscura ([ADR-0005](../adr/ADR-0005-obscura-default-playwright.md)). The Steel skills cover remote and hosted browsing, human takeover, MFA, and the live session viewer. Steel is `https://steel.kontextmind.com`, reached only through Caddy and Authentik ([ADR-0007](../adr/ADR-0007-steel-caddy-authentik.md)). Send `Authorization: Basic` (`STEEL_AUTH_HEADER`, then `STEEL_AUTH_BASIC`, then `STEEL_AUTH_USER` and `STEEL_AUTH_TOKEN`) and keep the credential out of URLs. `STEEL_API_KEY` is deprecated and is not enforced. `kxm` 0.7.135 or newer is required for Steel. `kxm-browser-verify` owns `vision`. The other browser skills own no `kxm` command. See [Browser automation](browser-automation.md).
 
 | Skill | Use it to |
 |---|---|

package/docs/guides/browser-automation.md

@@ -5,9 +5,9 @@ Give agents a real browser without giving them your desktop. Playwright testing
 ## Before you begin
 
 - For Playwright: Node, and `node scripts/obscura.mjs` (it downloads pinned Obscura v0.2.3). [ADR-0005](../adr/ADR-0005-obscura-default-playwright.md) records that default.
-- For takeover: a Steel deployment you operate, reachable over HTTPS, and an Authentik app password when that host is behind forward auth. [ADR-0002](../adr/ADR-0002-browser-automation-steel-doks.md) describes the reference deployment on Kubernetes.
+- For Steel: `kxm` 0.7.135 or newer. [ADR-0007](../adr/ADR-0007-steel-caddy-authentik.md) is the current server. [ADR-0002](../adr/ADR-0002-browser-automation-steel-doks.md) is the superseded Kubernetes deployment.
 - `curl` and `jq`. Optionally `agent-browser` for exploration. Playwright tests use Obscura; do not run `playwright install`.
-- A secret manager for the Authentik app password and site credentials. The bundled skills use `pass-cli`.
+- The 1Password CLI (`op`) for the `svc-steel` credential. Read it at runtime. Do not write it to disk.
 - The `kxm-browser-*` skills from the plugin or Pi package. See [Agent skills](agent-skills.md#browser-automation-skills).
 
 ## Components
@@ -36,33 +36,37 @@ Set `video: "off"` in Playwright. Obscura does not record video. Connect with th
 
 The KXM browser library reads these variables, and the shell procedure below uses the same names so both agree.
 
-KontextMind's Steel hosts (`steel.kontextmind.com` and `steel.theneuro.me`, including the `wss://` CDP endpoint) sit behind Authentik forward auth at the reverse proxy. Steel itself does not check an API key. Unauthenticated requests receive a 302 redirect to the Authentik login at `id.kxmd.dev`. Authentik accepts an app password only as `Authorization: Basic`. A Bearer token is refused.
+The Steel server is `https://steel.kontextmind.com`. `steel.theneuro.me` is an alias of that same server. The only path is Caddy on `kxmd-proxy` (VM 230) with Authentik forward auth. Direct LAN, tailnet, and host-forward connections are blocked. Unauthenticated requests receive a 302 redirect to `id.kxmd.dev`.
+
+Sessions return `websocketUrl` `wss://steel.kontextmind.com/`. The previous value was `ws://steel-browser/`. Connect Chrome DevTools Protocol at `/v1/devtools` and send `Authorization` on the handshake. The URL never carries a credential.
+
+Authentik accepts the `svc-steel` credential as `Authorization: Basic`. A Bearer token is refused. These groups may connect: `steel-users`, `kxmd-users`, `kxmd-admins`, and `kxmd-owners`. Steel needs `kxm` 0.7.135 or newer.
 
 | Variable | Default | Effect |
 |---|---|---|
-| `STEEL_API_URL` | A KontextMind-operated deployment | Base URL of your Steel API. Always set it |
+| `STEEL_API_URL` | `https://steel.kontextmind.com` | Base URL of the Steel API |
 | `STEEL_UI_URL` | `$STEEL_API_URL/ui` | Base URL of the session viewer |
-| `STEEL_AUTH_HEADER` | unset | Full `Authorization` value. Wins over the other auth variables |
-| `STEEL_AUTH_BASIC` | unset | `base64(user:token)`, with or without a leading `Basic` prefix. Sent as `Authorization: Basic` |
-| `STEEL_AUTH_USER` | unset | Authentik username, for example `svc-steel`. Used with `STEEL_AUTH_TOKEN` |
+| `STEEL_AUTH_HEADER` | unset | Full `Authorization` value. First in the precedence below |
+| `STEEL_AUTH_BASIC` | unset | `base64(user:token)`, with or without a leading `Basic` prefix |
+| `STEEL_AUTH_USER` | unset | Authentik username `svc-steel`. Used with `STEEL_AUTH_TOKEN` |
 | `STEEL_AUTH_TOKEN` | unset | Authentik app password. Used with `STEEL_AUTH_USER` |
-| `STEEL_API_KEY` | A `pass-cli` lookup | Deprecated. Sent as `x-steel-api-key` and as `?apiKey=` on the CDP URL, which the proxy still accepts as a temporary shim. The library warns once on stderr |
-| `USE_PASS_CLI` | enabled | Set to `false` to disable the legacy `STEEL_API_KEY` `pass-cli` fallback |
+| `STEEL_API_KEY` | unset | Deprecated. Steel and Caddy do not enforce it. See the migration note |
+| `USE_PASS_CLI` | enabled | Turns the legacy `STEEL_API_KEY` lookup off when set to `false` |
 
-Set one Authentik credential. Precedence is `STEEL_AUTH_HEADER`, then `STEEL_AUTH_BASIC`, then `STEEL_AUTH_USER` together with `STEEL_AUTH_TOKEN`. If only one of the user or token pair is set, configuration fails instead of falling back to the legacy key. When any of those are set, the legacy key is not sent and is not placed in a URL. The `pass-cli` fallback looks up `STEEL_API_KEY` only.
+Set one Authentik credential. Precedence is `STEEL_AUTH_HEADER`, then `STEEL_AUTH_BASIC`, then `STEEL_AUTH_USER` together with `STEEL_AUTH_TOKEN`. Those three override `STEEL_API_KEY`. If only one of the user or token pair is set, configuration fails closed. When any Authentik variable is set, the legacy key is not sent.
 
 > [!WARNING]
-> Set `STEEL_API_URL` and an Authentik credential explicitly. Without them the library falls back to KontextMind's own deployment and vault item, which are not yours to use. Never put the credential in a URL, a prompt, or a log.
+> `STEEL_API_KEY` is deprecated. Steel and Caddy do not enforce it. A client that still sends `x-steel-api-key` or `?apiKey=` is not authenticated. Migrate by setting one Authentik variable above and removing `STEEL_API_KEY`. Read the credential with `op read`. Never write it to disk, a URL, a prompt, or a log.
 
 ```bash
-export STEEL_API_URL="https://steel.example.com"
-# Read the app password from your secret manager; <vault> and <item> are yours.
-export STEEL_AUTH_USER="svc-steel"
-export STEEL_AUTH_TOKEN="$(pass-cli item view --vault-name '<vault>' --item-title '<item>' --field password)"
-export USE_PASS_CLI=false
+# Optional. This is already the default.
+export STEEL_API_URL="https://steel.kontextmind.com"
+# Vault kontextmind, item "Steel (svc-steel)", field basic_auth.
+# The value stays in this process. Do not redirect it to a file.
+export STEEL_AUTH_BASIC="$(op read 'op://kontextmind/Steel (svc-steel)/basic_auth')"
 ```
 
-`STEEL_AUTH_BASIC` is the same pair already encoded: `printf '%s:%s' "$STEEL_AUTH_USER" "$STEEL_AUTH_TOKEN" | base64 | tr -d '\n'`. Prefer the user and token pair, or the pre-encoded value, and keep them in the environment of the process that calls Steel.
+`STEEL_AUTH_USER` is `svc-steel` when you set the user and token pair instead of `STEEL_AUTH_BASIC`. Keep the value in the environment of the process that calls Steel.
 
 | Endpoint | Purpose |
 |---|---|
@@ -70,20 +74,29 @@ export USE_PASS_CLI=false
 | `GET /v1/sessions/<id>` | Inspect one session; `GET /v1/sessions` lists them all |
 | `POST /v1/sessions/<id>/release` | Release a session |
 | `POST /v1/scrape`, `POST /v1/screenshot` | One-shot page fetch or screenshot without a session |
-| `wss://<steel-host>/v1/devtools?sessionId=<id>` | CDP endpoint. Send `Authorization` on the WebSocket handshake; do not add the credential to this URL |
+| `wss://steel.kontextmind.com/v1/devtools?sessionId=<id>` | CDP path. Send `Authorization` on the handshake. The session `websocketUrl` is `wss://steel.kontextmind.com/` |
 | `$STEEL_UI_URL?sessionId=<id>` | Session viewer for human takeover |
 
 ## Run a browser task
 
-1. Define a helper that sends `Authorization` on stdin, so the secret never appears in a process list:
+1. Define a helper that sends `Authorization` on stdin, so the secret never appears in a process list. `STEEL_API_URL` defaults to `https://steel.kontextmind.com` when unset:
 
    ```bash
    steel() {  # usage: steel METHOD PATH [JSON-BODY]
-     local basic
-     local args=(-sS -X "$1" "$STEEL_API_URL$2" -H @- -H 'Content-Type: application/json')
+     local header args
+     args=(-sS -X "$1" "${STEEL_API_URL:-https://steel.kontextmind.com}$2" -H @- -H 'Content-Type: application/json')
      if [ -n "${3:-}" ]; then args+=(-d "$3"); fi
-     basic="$(printf '%s:%s' "$STEEL_AUTH_USER" "$STEEL_AUTH_TOKEN" | base64 | tr -d '\n')"
-     printf 'Authorization: Basic %s\n' "$basic" | curl "${args[@]}"
+     if [ -n "${STEEL_AUTH_HEADER:-}" ]; then
+       header="$STEEL_AUTH_HEADER"
+     elif [ -n "${STEEL_AUTH_BASIC:-}" ]; then
+       case "$STEEL_AUTH_BASIC" in
+         Basic\ *) header="$STEEL_AUTH_BASIC" ;;
+         *) header="Basic $STEEL_AUTH_BASIC" ;;
+       esac
+     else
+       header="Basic $(printf '%s:%s' "$STEEL_AUTH_USER" "$STEEL_AUTH_TOKEN" | base64 | tr -d '\n')"
+     fi
+     printf 'Authorization: %s\n' "$header" | curl "${args[@]}"
    }
    ```
 
@@ -157,16 +170,18 @@ The KXM browser library tracks these states in the process that owns the session
 
 - **Timeouts.** Sessions end on their own when the timeout expires. Set a longer timeout at creation when a person will need time for a login step.
 - **Orphan sweeps.** List sessions with `steel GET /v1/sessions` and release any you do not track. The library flags untracked sessions older than 10 minutes, and tracked ones idle that long unless a human holds them.
-- **Shared memory.** Give Chromium a large `/dev/shm`, or tabs crash. On Kubernetes, mount a memory-backed `emptyDir` there; the reference deployment uses 2 GiB.
+- **Shared memory.** Give Chromium a large `/dev/shm` on Steel LXC 240, or tabs crash.
 - **No shared profiles.** Concurrent sessions must not write to the same browser profile.
 
 ## Troubleshooting
 
 | Symptom | Cause | Fix |
 |---|---|---|
-| `302` to `id.kxmd.dev` | The request had no Authentik app password | Export `STEEL_AUTH_USER` and `STEEL_AUTH_TOKEN`, or `STEEL_AUTH_BASIC`. A Bearer token is not accepted |
-| `401` or `403` | Wrong app password, or a legacy key the shim rejected | Re-export the Authentik credential from your secret manager. Re-export `STEEL_API_KEY` only when that is the credential you still use |
-| Requests go to an unexpected host | `STEEL_API_URL` is unset | Export it before starting the agent |
+| `302` to `id.kxmd.dev` | The request had no Authentik credential | Export `STEEL_AUTH_BASIC` from `op read`, or the user and token pair. A Bearer token is not accepted |
+| `401` or `403` | Wrong `svc-steel` credential, or the account is outside the allowed groups | Re-read `basic_auth` with `op read`. `STEEL_API_KEY` does not authenticate |
+| Connection refused on a LAN, tailnet, or host-forward address | Those paths are blocked | Use `https://steel.kontextmind.com` through Caddy |
+| `websocketUrl` is `ws://steel-browser/` | The client is older than `kxm` 0.7.135 | Upgrade `kxm`. The server returns `wss://steel.kontextmind.com/` |
+| Requests go to an unexpected host | `STEEL_API_URL` points somewhere else | Unset it to use `https://steel.kontextmind.com`, or set that URL |
 | Playwright opens a local browser | The client called `chromium.launch()` or `chromium.connect()` | Use the worker-scoped fixture and `connectOverCDP` against Obscura |
 | Steel CDP connects without auth | `connectOverCDP` was called with only the URL | Call `connectOverCDP(url, { headers })` with the headers from `formatCDPConnect()` or `connectBrowserOverCdp()` |
 | `Access to private/internal IP address` | Obscura was started without `--allow-private-network` | Run `node scripts/obscura.mjs`, which passes that flag |
@@ -199,5 +214,6 @@ The KXM browser library tracks these states in the process that owns the session
 
 - The seven browser skills: [Agent skills](agent-skills.md#browser-automation-skills)
 - Why Obscura is the Playwright default: [ADR-0005](../adr/ADR-0005-obscura-default-playwright.md)
-- Why Steel, and the reference deployment: [ADR-0002](../adr/ADR-0002-browser-automation-steel-doks.md)
+- Where Steel runs now: [ADR-0007](../adr/ADR-0007-steel-caddy-authentik.md)
+- The superseded Kubernetes deployment: [ADR-0002](../adr/ADR-0002-browser-automation-steel-doks.md)
 - Estimate the `browser` mode's prompt footprint: [`kxm explain`](../reference/cli-reference.md#kxm-explain)

package/docs/kb/how-credentials-retrieved-safely.md

@@ -11,7 +11,7 @@ updated: "2026-09-27"
 authority: "instruction"
 confidence: "verified"
 summary: "How the Steel client resolves Authentik Basic auth and how browser work keeps secrets out of model context."
-tags: ["browser", "credentials", "pass-cli", "security"]
+tags: ["browser", "credentials", "1password", "security"]
 related: ["docs/guides/browser-automation.md", "docs/guides/agent-skills.md"]
 ---
 
@@ -28,37 +28,36 @@ secret to disk or to a log:
 
 | Setting | Resolved from |
 |---|---|
-| API URL | An explicit override, then `STEEL_API_URL`, then a built-in default |
+| API URL | An explicit override, then `STEEL_API_URL`, then `https://steel.kontextmind.com` |
 | Authentik `Authorization` | `STEEL_AUTH_HEADER`, then `STEEL_AUTH_BASIC`, then `STEEL_AUTH_USER` and `STEEL_AUTH_TOKEN` |
-| Legacy API key | An explicit override, then `STEEL_API_KEY`, then a `pass-cli` lookup, and only when no Authentik credential is set |
+| Legacy API key | Deprecated. An explicit override, then `STEEL_API_KEY`, then a leftover lookup, and only when no Authentik credential is set. Steel and Caddy do not enforce it |
 | Session viewer URL | An explicit override, then `STEEL_UI_URL`, then `<api-url>/ui` |
 
-KontextMind's Steel hosts are behind Authentik forward auth. The client sends
-`Authorization: Basic` on every HTTP request and on the CDP WebSocket. A Bearer
-token is not accepted. The legacy key is sent as `x-steel-api-key` and as an
-`apiKey` query parameter, which the proxy still accepts as a temporary shim.
-The library writes one deprecation warning to stderr and does not print the
-key. When an Authentik variable is set, the key is not sent and is not placed
-in a URL.
+The Steel server is behind Caddy and Authentik forward auth. The client sends
+`Authorization: Basic` on every HTTP request and on the CDP WebSocket at
+`/v1/devtools`. A Bearer token is refused. A credential in the URL is refused.
+`STEEL_API_KEY` is deprecated. When an Authentik variable is set, that variable
+overrides the key, and the key is not sent.
 
-The built-in default URL and the `pass-cli` lookup point at the maintainers'
-own Steel deployment and vault. The lookup reads `STEEL_API_KEY` only. Set
-`STEEL_API_URL` and an Authentik credential for yours, and set
-`USE_PASS_CLI=false` to turn the lookup off.
+Read the `svc-steel` credential at runtime and do not write it to disk. The
+1Password vault is `kontextmind`, the item is `Steel (svc-steel)`, and the
+field is `basic_auth`:
 
-## Mechanisms
+```bash
+export STEEL_AUTH_BASIC="$(op read 'op://kontextmind/Steel (svc-steel)/basic_auth')"
+```
+
+`kxm` 0.7.135 or newer is required. Sessions return `websocketUrl`
+`wss://steel.kontextmind.com/`.
 
-1. **One secret store.** Keep secrets in a secret manager, for example Proton
-   Pass through `pass-cli`, and load them into the environment of the process
-   that needs them:
+## Mechanisms
 
-   ```bash
-   # Runs the tests with secrets injected for this process only.
-   pass-cli run -- npm test
-   ```
+1. **One secret store.** Keep the Steel credential in 1Password and load it
+   into the environment of the process that needs it, as the `op read` command
+   above. Do not redirect the command into a file.
 
 2. **References, not values.** A prompt receives a credential reference such
-   as `vault: "<vault>", item: "<item>"`, never the secret itself.
+   as `op://kontextmind/Steel (svc-steel)/basic_auth`, never the secret itself.
 3. **Log sanitization.** The KXM browser client redacts `apiKey=` query values,
    `Authorization` header values, `Basic` credentials, `steel_…` keys, and any
    field named like a key, secret, token, auth or password before it logs or

package/docs/kb/how-to-connect-playwright-to-steel.md

@@ -43,16 +43,19 @@ const { url, headers } = formatCDPConnect(
 );
 ```
 
-The URL has this shape:
+The URL has this shape. The session field `websocketUrl` is the origin
+`wss://steel.kontextmind.com/` (it used to be `ws://steel-browser/`). The
+connect path is `/v1/devtools`:
 
 ```text
-wss://<steel-host>/v1/devtools?sessionId=<session-id>
+wss://steel.kontextmind.com/v1/devtools?sessionId=<session-id>
 ```
 
 `headers` is `{ Authorization: "Basic <base64>" }`. Pass that object to
-Playwright. Do not log it. A legacy `STEEL_API_KEY` still appends `apiKey` to
-the URL for the temporary proxy shim; prefer the Authentik variables so the
-credential stays out of the URL.
+Playwright. Do not log it. `STEEL_API_KEY` is deprecated and is not enforced
+by Steel or Caddy. Do not put `apiKey` on the URL. `STEEL_AUTH_HEADER`, then
+`STEEL_AUTH_BASIC`, then `STEEL_AUTH_USER` and `STEEL_AUTH_TOKEN`, override it.
+`kxm` 0.7.135 or newer is required.
 
 ## 2. Connect in Playwright
 

package/docs/kb/how-to-recover-expired-session-or-orphan.md

@@ -22,23 +22,24 @@ browser can keep running on your Steel deployment until its timeout.
 
 ## 1. List active sessions
 
-Load `STEEL_API_URL`, `STEEL_AUTH_USER`, and `STEEL_AUTH_TOKEN` from your secret
-manager first. With `pass-cli`, for example:
+Load the `svc-steel` credential from 1Password into this process. Do not write
+it to disk. `STEEL_API_URL` defaults to `https://steel.kontextmind.com`.
+`STEEL_API_KEY` is deprecated and is not enforced.
 
 ```bash
-export STEEL_API_URL="https://<steel-host>"
-export STEEL_AUTH_USER="svc-steel"
-export STEEL_AUTH_TOKEN="$(pass-cli item view --vault-name "<vault>" --item-title "<item>" --field password)"
-basic="$(printf '%s:%s' "$STEEL_AUTH_USER" "$STEEL_AUTH_TOKEN" | base64 | tr -d '\n')"
-
-printf 'Authorization: Basic %s\n' "$basic" | curl -sS -H @- "$STEEL_API_URL/v1/sessions" | jq .
+export STEEL_AUTH_BASIC="$(op read 'op://kontextmind/Steel (svc-steel)/basic_auth')"
+case "$STEEL_AUTH_BASIC" in
+  Basic\ *) header="$STEEL_AUTH_BASIC" ;;
+  *) header="Basic $STEEL_AUTH_BASIC" ;;
+esac
+printf 'Authorization: %s\n' "$header" | curl -sS -H @- "${STEEL_API_URL:-https://steel.kontextmind.com}/v1/sessions" | jq .
 ```
 
 ## 2. Release an orphaned session
 
 ```bash
-printf 'Authorization: Basic %s\n' "$basic" \
-  | curl -sS -X POST -H @- "$STEEL_API_URL/v1/sessions/<session-id>/release"
+printf 'Authorization: %s\n' "$header" \
+  | curl -sS -X POST -H @- "${STEEL_API_URL:-https://steel.kontextmind.com}/v1/sessions/<session-id>/release"
 ```
 
 ## 3. Sweep orphans with the KXM client

package/docs/kb/why-automation-opened-different-browser.md

@@ -42,6 +42,7 @@ You expected automation to run on Obscura, or on a Steel takeover session, but a
      opens a local browser.
    - **Fix:** use `resolveObscuraCdpEndpoint()` (default
      `http://127.0.0.1:9222`). For a Steel takeover session, set
-     `KXM_BROWSER=steel` and load `STEEL_API_URL` plus `STEEL_AUTH_USER` and
-     `STEEL_AUTH_TOKEN` (or `STEEL_AUTH_BASIC`). A legacy `STEEL_API_KEY` still
-     works through the proxy shim and warns once.
+     `KXM_BROWSER=steel` and load `STEEL_AUTH_BASIC` with `op read` (or
+     `STEEL_AUTH_HEADER`, or `STEEL_AUTH_USER` and `STEEL_AUTH_TOKEN`).
+     `STEEL_API_KEY` is deprecated. Steel and Caddy do not enforce it.
+     `kxm` 0.7.135 or newer is required for Steel.

package/docs/operations/deploy.md

@@ -279,6 +279,35 @@ server {
 }
 ```
 
+## Boot the kxmd Proxmox host
+
+The Proxmox host starts these guests in the order below. The VMID is the Proxmox guest id. `up` is the delay, in seconds, after that guest starts.
+
+| Order | Guest | VMID | Role | up |
+|---|---|---|---|---|
+| 1 | firewall | 200 | Firewall | |
+| 2 | gateway | 201 | Gateway | |
+| 3 | kxmd-pg | 220 | Postgres | 30 |
+| 4 | kxmd-temporal | 221 | Temporal | 40 |
+| 5 | kxmd-services | 300 | `kxm-control` | 30 |
+| 6 | kxmd-studio | 241 | Hub | 20 |
+
+VM 300 is named `kxmd-services`. VM 230 is named `kxmd-proxy` and runs Caddy. Steel is LXC 240 and uses Proxmox startup order 40.
+
+Steel's public name is `steel.kontextmind.com`. `steel.theneuro.me` is an alias of that same server. Clients reach it only through Caddy and Authentik forward auth. Direct LAN, tailnet, and host-forward access is blocked. See [ADR-0007](../adr/ADR-0007-steel-caddy-authentik.md) and [Browser automation](../guides/browser-automation.md).
+
+## Name machine accounts
+
+New Authentik machine accounts follow [ADR-0006](../adr/ADR-0006-machine-account-names.md):
+
+| Scope | Name |
+|---|---|
+| Platform-wide | `svc-<system>-<purpose>` |
+| Tenant-scoped | `svc-<tenant>-<system>-<purpose>` |
+| Test, witness, or proof | The same shapes with a `test-` prefix |
+
+`<tenant>` is the tenant slug. A `test-` account is never in a production group. Outposts and `ak-*` accounts are Authentik-managed and are exempt. Names already in use, including `kxm-agent`, `kxm-witness-*`, `witness9`, and `kxmdproof`, wait for an approved inventory. Do not invent a new name for one of them. The live Steel account remains `svc-steel`.
+
 ## Plan for scale
 
 Measure concurrent agents, request rate, event-loop delay, database size, disk latency and reconnect frequency for your workload. Terminal messages are purged after `KXM_MESSAGE_RETENTION_MS` (7 days by default), and finished workflow runs and their journals after 7 days. Keep free disk space ahead of the database's growth, and include workflow data in privacy reviews: verified evidence snapshots stay in a run after its source messages are purged.
@@ -304,4 +333,6 @@ See [Troubleshoot KXM](troubleshooting.md) for more.
 - Move to a new release: [Upgrade KXM](upgrade.md)
 - Keep run facts flowing to the hub: [Operate Runtime sync and leases](runtime-sync.md)
 - Understand who can do what: [Trust model](../concepts/trust-model.md)
+- Name machine accounts: [ADR-0006](../adr/ADR-0006-machine-account-names.md)
+- Reach Steel: [ADR-0007](../adr/ADR-0007-steel-caddy-authentik.md)
 - Every hub route: [Hub HTTP API reference](../reference/http-api.md)

package/docs/operations/troubleshooting.md

@@ -1,6 +1,6 @@
 # Troubleshoot KXM
 
-This page is a reference of symptoms, causes and fixes, grouped by area. Start with the quick check, then go to the area that matches: install, hub and authentication, Claude Code, peer messaging, Pi workers, workflows, Runtime runs, context and memory, or operations.
+This page is a reference of symptoms, causes and fixes, grouped by area. Start with the quick check, then go to the area that matches: install, hub and authentication, Claude Code, peer messaging, Pi workers, workflows, Runtime runs, context and memory, Steel, or operations.
 
 ## Start with a quick check
 
@@ -239,6 +239,26 @@ See [Context and memory](../guides/context-and-memory.md).
 
 For backup and restore errors such as `backup_no_stores`, see [Back up and restore KXM](backup-and-restore.md#troubleshooting). The dashboard's action keys do not act on runs; see [Monitor KXM](monitoring.md#keys).
 
+## Steel
+
+Steel is `https://steel.kontextmind.com` (`steel.theneuro.me` is an alias). Caddy and Authentik forward auth are the only path. Playwright tests use Obscura. The procedure is [Browser automation](../guides/browser-automation.md). `kxm` 0.7.135 or newer is required.
+
+| Symptom | Cause | Fix |
+|---|---|---|
+| Connection refused or timeout on a LAN, tailnet, or host-forward address | Direct access to LXC 240 is blocked | Use `https://steel.kontextmind.com` |
+| `302` to `id.kxmd.dev` | No Authentik credential on the request | Set `STEEL_AUTH_HEADER`, or `STEEL_AUTH_BASIC`, or `STEEL_AUTH_USER` and `STEEL_AUTH_TOKEN` |
+| `401` or `403` | The `svc-steel` credential is wrong, or the account is outside `steel-users`, `kxmd-users`, `kxmd-admins`, and `kxmd-owners` | Re-read the credential with `op read`. `STEEL_API_KEY` is not enforced |
+| `websocketUrl` is `ws://steel-browser/` | The client predates `kxm` 0.7.135 | Upgrade `kxm`. The server returns `wss://steel.kontextmind.com/` |
+| CDP fails and the URL contains `apiKey` | `STEEL_API_KEY` was placed on `/v1/devtools` | Connect to `/v1/devtools` with an `Authorization` header and no credential in the URL |
+
+Read the credential into the process only:
+
+```bash
+export STEEL_AUTH_BASIC="$(op read 'op://kontextmind/Steel (svc-steel)/basic_auth')"
+```
+
+The vault is `kontextmind`, the item is `Steel (svc-steel)`, and the field is `basic_auth`. Do not write that value to disk.
+
 ## Collect a useful bug report
 
 Include:
@@ -263,4 +283,6 @@ Never attach tokens, private prompts, credentials, raw `pi-agent-*.log` files, o
 - [Monitor KXM](monitoring.md)
 - [Deploy KXM](deploy.md)
 - [CLI reference](../reference/cli-reference.md)
+- [Browser automation](../guides/browser-automation.md)
+- [Steel through Caddy and Authentik](../adr/ADR-0007-steel-caddy-authentik.md)
 - [Claude Code plugin](../../plugins/kxm/README.md)

package/docs/prompts/browser-diagnose-recover.md

@@ -52,5 +52,5 @@ Use this prompt to troubleshoot unresponsive sessions, CDP attachment errors, au
    - For each orphan, invoke `POST /v1/sessions/:id/release`.
 
 4. **Verify WebSocket / CDP Ingress**:
-   - Ensure the reverse proxy or ingress in front of Steel passes WebSocket upgrades through. On Kubernetes with ingress-nginx, that is the `nginx.ingress.kubernetes.io/websocket-services` annotation.
-   - If the response is a 302 to `id.kxmd.dev`, or CDP fails with 401, send `Authorization: Basic` from `STEEL_AUTH_BASIC` or from `STEEL_AUTH_USER` and `STEEL_AUTH_TOKEN`. A Bearer token is not accepted. Do not put the credential in the URL. The legacy `x-steel-api-key` header and `?apiKey=` query parameter remain only for the temporary proxy shim.
+   - Steel is reached only through Caddy and Authentik forward auth. Direct LAN, tailnet, and host-forward connections are blocked. The CDP path is `/v1/devtools` with an `Authorization` header.
+   - If the response is a 302 to `id.kxmd.dev`, or CDP fails with 401 or 403, send `Authorization: Basic` from `STEEL_AUTH_HEADER`, then `STEEL_AUTH_BASIC`, then `STEEL_AUTH_USER` and `STEEL_AUTH_TOKEN`. A Bearer token is not accepted. Do not put the credential in the URL. `STEEL_API_KEY` is deprecated. Steel and Caddy do not enforce it. Sessions return `websocketUrl` `wss://steel.kontextmind.com/`. `kxm` 0.7.135 or newer is required.

package/docs/prompts/browser-start.md

@@ -42,7 +42,7 @@ Use this prompt to initialize a remote browser session on self-hosted Steel for
 ## Instructions for the agent
 
 1. **Verify Credential Reference**:
-   - Resolve the target credentials and the Steel Authentik app password (`STEEL_AUTH_USER` and `STEEL_AUTH_TOKEN`, or `STEEL_AUTH_BASIC`) from the secret manager, for example with `pass-cli`, without logging raw values. A Bearer token is not accepted. Keep the credential in a header, not a URL.
+   - Resolve the `svc-steel` credential with `op read 'op://kontextmind/Steel (svc-steel)/basic_auth'` into `STEEL_AUTH_BASIC` (or set `STEEL_AUTH_HEADER`, or `STEEL_AUTH_USER` and `STEEL_AUTH_TOKEN`). Do not log the value or write it to disk. A Bearer token is not accepted. `STEEL_API_KEY` is deprecated and is not enforced. Keep the credential in a header, not a URL. `STEEL_API_URL` defaults to `https://steel.kontextmind.com`. `kxm` 0.7.135 or newer is required.
    - Do not print credentials to the chat or save them to tracked files.
 
 2. **Launch Remote Steel Session**:

package/docs/reference/configuration.md

@@ -200,21 +200,23 @@ The Runtime supervisor runs `kxm run` workflows and syncs their summaries to the
 
 ## Browser automation
 
-Playwright testing and verification use Obscura. Steel is for human takeover, MFA, and the live session viewer. `resolveBrowserCdpEndpoint()` in `plugins/kxm/src/browser.ts` returns the CDP URL. `resolveBrowserCdpConnect()` returns that URL and the handshake headers, and `connectBrowserOverCdp()` passes them to `chromium.connectOverCDP`. `node scripts/obscura.mjs` downloads pinned Obscura v0.2.3 and serves it. See [Browser automation](../guides/browser-automation.md).
+Playwright testing and verification use Obscura. Steel is for remote and hosted browsing, human takeover, MFA, and the live session viewer. `resolveBrowserCdpEndpoint()` in `plugins/kxm/src/browser.ts` returns the CDP URL. `resolveBrowserCdpConnect()` returns that URL and the handshake headers, and `connectBrowserOverCdp()` passes them to `chromium.connectOverCDP`. `node scripts/obscura.mjs` downloads pinned Obscura v0.2.3 and serves it. Steel needs `kxm` 0.7.135 or newer. See [Browser automation](../guides/browser-automation.md) and [ADR-0007](../adr/ADR-0007-steel-caddy-authentik.md).
 
 | Variable | Default | Effect |
 |---|---|---|
-| `KXM_BROWSER` | `obscura` | `obscura` selects the Obscura CDP URL and sends no Steel headers. `steel` selects `formatCDPConnect()` (the session URL plus `Authorization`, or the legacy API-key header) and requires a session id. Any other value throws |
+| `KXM_BROWSER` | `obscura` | `obscura` selects the Obscura CDP URL and sends no Steel headers. `steel` selects `/v1/devtools` plus `Authorization` and requires a session id. Any other value throws |
 | `OBSCURA_CDP_URL` | `http://127.0.0.1:${OBSCURA_PORT:-9222}` | CDP URL passed to `chromium.connectOverCDP()`. When set, it wins over `OBSCURA_PORT` for that URL |
 | `OBSCURA_PORT` | `9222` | TCP port for `obscura serve`. Used in the default CDP URL when `OBSCURA_CDP_URL` is unset. The launcher refuses to start when this port disagrees with the port in `OBSCURA_CDP_URL` |
-| `STEEL_API_URL` | A KontextMind-operated deployment | Base URL of your Steel API. Set it before using `KXM_BROWSER=steel` |
+| `STEEL_API_URL` | `https://steel.kontextmind.com` | Base URL of the Steel API. `steel.theneuro.me` is an alias of that server |
 | `STEEL_UI_URL` | `$STEEL_API_URL/ui` | Base URL of the Steel session viewer |
-| `STEEL_AUTH_HEADER` | unset | Full `Authorization` value. Wins over the other Steel auth variables |
+| `STEEL_AUTH_HEADER` | unset | Full `Authorization` value. First among the Steel auth variables |
 | `STEEL_AUTH_BASIC` | unset | `base64(user:token)`, with or without a leading `Basic` prefix. Sent as `Authorization: Basic` |
-| `STEEL_AUTH_USER` | unset | Authentik username. Used with `STEEL_AUTH_TOKEN`. An incomplete pair fails closed |
+| `STEEL_AUTH_USER` | unset | Authentik username `svc-steel`. Used with `STEEL_AUTH_TOKEN`. An incomplete pair fails closed |
 | `STEEL_AUTH_TOKEN` | unset | Authentik app password. Used with `STEEL_AUTH_USER` |
-| `STEEL_API_KEY` | A `pass-cli` lookup | Deprecated. Sent as `x-steel-api-key` and as `?apiKey=` on the CDP URL for the temporary proxy shim. The library warns once. Not sent when an Authentik variable is set |
-| `USE_PASS_CLI` | enabled | Set to `false` to disable the legacy `STEEL_API_KEY` `pass-cli` fallback |
+| `STEEL_API_KEY` | unset | Deprecated. Steel and Caddy do not enforce it. The three variables above override it. The library warns once |
+| `USE_PASS_CLI` | enabled | Set to `false` to skip the legacy `STEEL_API_KEY` lookup. That lookup does not authenticate |
+
+`STEEL_AUTH_HEADER`, then `STEEL_AUTH_BASIC`, then `STEEL_AUTH_USER` with `STEEL_AUTH_TOKEN`, override `STEEL_API_KEY`. Load field `basic_auth` from 1Password vault `kontextmind`, item `Steel (svc-steel)`, with `op read` into `STEEL_AUTH_BASIC`. Do not write the value to disk. The CDP path is `/v1/devtools` with an `Authorization` header. Sessions return `websocketUrl` `wss://steel.kontextmind.com/`.
 
 Obscura's own `OBSCURA_TIMEZONE` (default `Europe/Berlin`) and `OBSCURA_CDP_TOKEN` (required only for a non-loopback bind) are read by the Obscura process, not by KXM.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kontextmind/kxm",
-  "version": "0.7.146",
+  "version": "0.7.147",
   "description": "KXM local-first multi-agent orchestration and operator dashboard",
   "type": "module",
   "author": "KontextMind",

package/plugins/kxm/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "kxm",
   "displayName": "KXM",
-  "version": "0.7.146",
+  "version": "0.7.147",
   "description": "Headless multi-agent orchestration, durable workflows, and a live operator dashboard for Pi and Claude Code",
   "author": {
     "name": "KontextMind",

package/plugins/kxm/dist/cli.js

@@ -51929,7 +51929,7 @@ var DEFAULT_MODES_CONFIG = Object.freeze({
     browser: {
       description: "Remote Steel browser sessions and visual testing",
       tools: ["steel_session", "steel_scrape", "steel_screenshot"],
-      promptSnippet: "Use Steel on DOKS for browser automation; invoke takeover on MFA."
+      promptSnippet: "Playwright tests use Obscura. Steel is remote browsing and takeover through Caddy and Authentik; send Authorization, never a credential in the URL."
     }
   }
 });

package/plugins/kxm/dist/mcp-server.js

@@ -17313,7 +17313,7 @@ function sessionTokenFixHint(policy) {
 }
 
 // plugins/kxm/src/mcp-server.ts
-var VERSION = "0.7.146";
+var VERSION = "0.7.147";
 var CONFIGURE_PLUGIN = "/plugin configure kxm@kxm";
 var inbox = /* @__PURE__ */ new Map();
 var notifiedInbox = /* @__PURE__ */ new Set();

package/plugins/kxm/dist/runtime.js

@@ -33751,7 +33751,7 @@ var SteelAuthRedirectError = class extends Error {
     this.host = host;
   }
 };
-var LEGACY_STEEL_AUTH_WARNING = "kxm: STEEL_API_KEY is deprecated for Steel. Authentik forward auth accepts app passwords only as Authorization: Basic. Set STEEL_AUTH_BASIC, or STEEL_AUTH_USER and STEEL_AUTH_TOKEN. The legacy x-steel-api-key header and apiKey query parameter remain for the temporary proxy shim.\n";
+var LEGACY_STEEL_AUTH_WARNING = "kxm: STEEL_API_KEY is deprecated for Steel. Steel and Caddy do not enforce it. Set STEEL_AUTH_HEADER, or STEEL_AUTH_BASIC, or STEEL_AUTH_USER and STEEL_AUTH_TOKEN. Those override STEEL_API_KEY. Send Authorization on the request, not in the URL.\n";
 var legacySteelAuthWarned = false;
 function resetLegacySteelAuthWarningForTests() {
   legacySteelAuthWarned = false;
@@ -34057,7 +34057,7 @@ var SteelClient = class {
     return res;
   }
   /**
-   * Launch a new Steel browser session on DOKS.
+   * Launch a new Steel browser session.
    */
   async createSession(options) {
     const timeoutMs = options?.timeoutMs ?? this.config.timeoutMs ?? 3e5;
@@ -34340,7 +34340,7 @@ var DEFAULT_MODES_CONFIG = Object.freeze({
     browser: {
       description: "Remote Steel browser sessions and visual testing",
       tools: ["steel_session", "steel_scrape", "steel_screenshot"],
-      promptSnippet: "Use Steel on DOKS for browser automation; invoke takeover on MFA."
+      promptSnippet: "Playwright tests use Obscura. Steel is remote browsing and takeover through Caddy and Authentik; send Authorization, never a credential in the URL."
     }
   }
 });

package/plugins/kxm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-plugin",
-  "version": "0.7.146",
+  "version": "0.7.147",
   "private": true,
   "type": "module",
   "engines": {

package/plugins/kxm/skills/kxm-browser-auth/SKILL.md

@@ -1,38 +1,37 @@
 ---
 name: kxm-browser-auth
-description: Retrieve application credentials and manage authenticated browser profiles safely via pass-cli without secret exposure.
+description: Retrieve application credentials and manage authenticated browser profiles without secret exposure. Steel uses the svc-steel credential from 1Password via op read.
 ---
 
 # KXM Browser Credentials & Authenticated Profiles
 
-Use this skill to retrieve target application credentials and manage browser session state securely using `pass-cli` as the sole authoritative store.
+Use this skill to retrieve target application credentials and manage browser session state. The Steel `svc-steel` credential comes from 1Password and is read with `op read`. It is never written to disk.
 
 ## Purpose & Scope
 
-- Enforce `pass-cli` as the single source of truth for credentials and API keys.
+- Read the Steel credential at runtime from 1Password.
 - Prevent secrets from leaking into git repositories, logs, prompts, or model-visible tool outputs.
 - Support safe storage and retrieval of session storage state and authenticated profiles.
 
 ## Credential Retrieval Guidelines
 
-### 1. Authoritative Tool: pass-cli
+### 1. Steel credential: 1Password
 
-Always retrieve credentials and API keys directly from `pass-cli`:
+`STEEL_API_KEY` is deprecated. Steel and Caddy do not enforce it. Authenticate as `svc-steel`. Precedence is `STEEL_AUTH_HEADER`, then `STEEL_AUTH_BASIC`, then `STEEL_AUTH_USER` and `STEEL_AUTH_TOKEN`. Those override `STEEL_API_KEY`. `STEEL_API_URL` defaults to `https://steel.kontextmind.com`. `kxm` 0.7.135 or newer is required.
 
 ```bash
-# Retrieve target login password into an environment variable or piping mechanism
-pass-cli item view --vault-name "<vault>" --item-title "<title>" --field password
-
-# Retrieve the Authentik app password for Steel. The proxy accepts Authorization: Basic.
-# STEEL_AUTH_USER is the Authentik username (for example svc-steel).
-pass-cli item view --vault-name "<vault>" --item-title "<steel-item>" --field password
+# Vault kontextmind, item "Steel (svc-steel)", field basic_auth.
+# Do not redirect this into a file.
+export STEEL_AUTH_BASIC="$(op read 'op://kontextmind/Steel (svc-steel)/basic_auth')"
 ```
 
+`STEEL_AUTH_USER` is `svc-steel` when you use the user and token pair. Send the value as `Authorization` on `/v1/devtools`. Never put it in the URL.
+
 ### 2. Secret Redaction Invariants
 
 - **Never** write plain passwords, session tokens, or API keys into markdown docs, commit messages, or prompts.
 - **Never** pass plain credentials as unredacted command line arguments in shared logs.
-- Use environment variable injection (`pass-cli run`) or direct in-memory pipes.
+- Keep the `op read` result in the environment of the process that calls Steel.
 
 ### 3. Profile & Storage State Management
 

package/plugins/kxm/skills/kxm-browser-diagnostics/SKILL.md

@@ -15,16 +15,17 @@ Use this skill to investigate and resolve connectivity failures, CDP attachment
 - **Diagnosis**:
   - KontextMind Steel is behind Authentik forward auth. Unauthenticated requests redirect to `id.kxmd.dev`. Authentik accepts an app password only as `Authorization: Basic`. A Bearer token is refused.
   - Check that `STEEL_AUTH_BASIC` is set, or that both `STEEL_AUTH_USER` and `STEEL_AUTH_TOKEN` are set (`test -n "$STEEL_AUTH_TOKEN" && echo set`); never print the value.
-  - A legacy `STEEL_API_KEY` still uses `x-steel-api-key` and `?apiKey=` through the temporary proxy shim. Prefer the Authentik variables so the credential stays out of URLs.
-- **Remedy**: Re-export the Authentik app password into the session environment. Do not log it.
+  - `STEEL_API_KEY` is deprecated. Steel and Caddy do not enforce it. Do not put a credential in the URL. Direct LAN, tailnet, and host-forward connections are blocked.
+  - `websocketUrl` `ws://steel-browser/` means the client is older than `kxm` 0.7.135. The server returns `wss://steel.kontextmind.com/`.
+- **Remedy**: Re-read the `svc-steel` field `basic_auth` with `op read 'op://kontextmind/Steel (svc-steel)/basic_auth'` into `STEEL_AUTH_BASIC`. Do not log it or write it to disk. Precedence is `STEEL_AUTH_HEADER`, then `STEEL_AUTH_BASIC`, then `STEEL_AUTH_USER` and `STEEL_AUTH_TOKEN`.
 
 ### 2. CDP WebSocket Attachment Failure
 
 - **Symptom**: `WebSocket connection to wss://... failed: 404/500`.
 - **Diagnosis**:
   - Check if the target session ID has already been released or timed out.
-  - Verify ingress WebSocket headers: ensure `nginx.ingress.kubernetes.io/websocket-services` is enabled.
-- **Remedy**: Query `GET /v1/sessions/<id>`. If status is `released`, launch a fresh session.
+  - The CDP path is `/v1/devtools` on `wss://steel.kontextmind.com/` with an `Authorization` header. Caddy must pass the WebSocket upgrade. A credential in the URL is not accepted.
+- **Remedy**: Query `GET /v1/sessions/<id>` with the same `Authorization` header. If status is `released`, launch a fresh session.
 
 ### 3. Session Timeout & Expiration
 

package/plugins/kxm/skills/kxm-browser-explore/SKILL.md

@@ -21,11 +21,12 @@ Use this skill for exploratory navigation, DOM inspection, scraping, and interac
 Ensure an active Steel session exists and obtain its CDP endpoint:
 
 ```bash
-# CDP URL only. The Authentik credential is an Authorization header, not a query parameter.
-CDP_URL="wss://<steel-host>/v1/devtools?sessionId=<sessionId>"
+# CDP path only. The session websocketUrl is wss://steel.kontextmind.com/.
+# The Authentik credential is an Authorization header, not a query parameter.
+CDP_URL="wss://steel.kontextmind.com/v1/devtools?sessionId=<sessionId>"
 ```
 
-Build that URL with `formatCDPConnect()` so the `Authorization: Basic` header is available for the handshake. `STEEL_AUTH_BASIC`, or `STEEL_AUTH_USER` and `STEEL_AUTH_TOKEN`, supplies it. A Bearer token is not accepted.
+Build that URL with `formatCDPConnect()` so the `Authorization` header is available for the handshake. Precedence is `STEEL_AUTH_HEADER`, then `STEEL_AUTH_BASIC`, then `STEEL_AUTH_USER` and `STEEL_AUTH_TOKEN`. Those override `STEEL_API_KEY`, which Steel and Caddy do not enforce. A Bearer token is not accepted. `kxm` 0.7.135 or newer is required. Read `basic_auth` with `op read` and do not write it to disk.
 
 ### 2. Connect a client that can send the header
 

package/plugins/kxm/skills/kxm-browser-session/SKILL.md

@@ -5,7 +5,7 @@ description: Start, attach to, inspect, and release self-hosted Steel browser se
 
 # KXM Browser Session Management
 
-Use this skill to create, inspect, attach automation tools to, and release isolated browser sessions running on your self-hosted Steel deployment. Set `STEEL_API_URL` (and optionally `STEEL_UI_URL`) to your deployment; KXM does not provide one.
+Use this skill to create, inspect, attach automation tools to, and release isolated browser sessions on the Steel server. `STEEL_API_URL` defaults to `https://steel.kontextmind.com`. `steel.theneuro.me` is an alias of that server. `kxm` 0.7.135 or newer is required.
 
 Playwright testing and verification use Obscura by default (`resolveBrowserCdpEndpoint()`, or `npm run e2e`). Use this skill's Steel session for human takeover, MFA, and the live session viewer. Attach Playwright to that session only when `KXM_BROWSER=steel`.
 
@@ -18,9 +18,9 @@ Playwright testing and verification use Obscura by default (`resolveBrowserCdpEn
 
 ## Prerequisites
 
-1. Your own Steel deployment, with `STEEL_API_URL` set to its base URL (for example `https://steel.example.com`) and `STEEL_UI_URL` set if the viewer lives elsewhere (default `$STEEL_API_URL/ui`).
-2. Authentik app-password auth in the environment. The KontextMind Steel hosts are behind Authentik forward auth, which accepts `Authorization: Basic` and refuses a Bearer token. Export `STEEL_AUTH_USER` and `STEEL_AUTH_TOKEN` (or the pre-encoded `STEEL_AUTH_BASIC`) from your password manager, for example `export STEEL_AUTH_TOKEN="$(pass-cli item view --vault-name '<vault>' --item-title '<item>' --field password)"`. Never paste the token into a prompt. `STEEL_API_KEY` is a deprecated shim (`x-steel-api-key` and `?apiKey=`); do not put credentials in URLs.
-3. Network access to remote CDP endpoints on port 443 / 9223.
+1. `kxm` 0.7.135 or newer. The server is `https://steel.kontextmind.com`. Caddy and Authentik forward auth are the only path. Direct LAN, tailnet, and host-forward access is blocked. Sessions return `websocketUrl` `wss://steel.kontextmind.com/` (previously `ws://steel-browser/`).
+2. The `svc-steel` Authentik credential in the environment. Allowed groups are `steel-users`, `kxmd-users`, `kxmd-admins`, and `kxmd-owners`. Read it at runtime and do not write it to disk: `export STEEL_AUTH_BASIC="$(op read 'op://kontextmind/Steel (svc-steel)/basic_auth')"`. Precedence is `STEEL_AUTH_HEADER`, then `STEEL_AUTH_BASIC`, then `STEEL_AUTH_USER` and `STEEL_AUTH_TOKEN`. Those override `STEEL_API_KEY`. `STEEL_API_KEY` is deprecated. Steel and Caddy do not enforce it. A Bearer token is refused. Never put the credential in a URL.
+3. HTTPS to `steel.kontextmind.com` for the CDP path `/v1/devtools`. Send `Authorization` on the handshake.
 
 ## Session Lifecycle States
 
@@ -48,7 +48,7 @@ Playwright testing and verification use Obscura by default (`resolveBrowserCdpEn
 - **Inputs**: Task ID, target URL, session timeout (default 300s, max 1800s), optional proxy or viewport dimensions.
 - **Outputs**:
   - `sessionId`: Unique session UUID.
-  - `cdpUrl`: Remote CDP WebSocket URL (`wss://<steel-host>/v1/devtools?sessionId=<id>`). Send `Authorization: Basic` on the handshake. The URL has no credential when Authentik auth is configured.
+  - `cdpUrl`: `wss://steel.kontextmind.com/v1/devtools?sessionId=<id>`. Send `Authorization` on the handshake. The URL has no credential. The session `websocketUrl` is `wss://steel.kontextmind.com/`.
   - `sessionViewerUrl`: Interactive web session viewer URL (`$STEEL_UI_URL?sessionId=<id>`).
   - `status`: `live` | `idle` | `released`.
 

package/plugins/kxm/skills/kxm-browser-verify/SKILL.md

@@ -77,7 +77,7 @@ Local pages require the launcher flag `--allow-private-network` (the launcher al
 
 ## Steel, only for takeover
 
-When the case is human takeover, MFA, or the live session viewer, set `KXM_BROWSER=steel` and a session id. `connectBrowserOverCdp()` passes `formatCDPConnect()` headers into `chromium.connectOverCDP`. Closing the Playwright browser disconnects the client and does not release the Steel session.
+When the case is human takeover, MFA, or the live session viewer, set `KXM_BROWSER=steel` and a session id. That path needs `kxm` 0.7.135 or newer. `connectBrowserOverCdp()` passes `formatCDPConnect()` headers into `chromium.connectOverCDP` for `/v1/devtools` on `wss://steel.kontextmind.com/`. The `Authorization` header is the `svc-steel` credential (`STEEL_AUTH_HEADER`, then `STEEL_AUTH_BASIC`, then `STEEL_AUTH_USER` and `STEEL_AUTH_TOKEN`). `STEEL_API_KEY` is deprecated and is not enforced. Closing the Playwright browser disconnects the client and does not release the Steel session.
 
 ```typescript
 import { chromium } from "playwright";

package/plugins/kxm/src/browser.ts

@@ -5,11 +5,12 @@
  * (`resolveBrowserCdpEndpoint()`). Steel remains the client for human
  * takeover, MFA, and the live session viewer (`KXM_BROWSER=steel`).
  * Manages remote Steel sessions, CDP endpoints, human takeover handoffs,
- * pass-cli credential references, and automated cleanup without leaking secrets.
+ * and automated cleanup without leaking secrets.
  *
- * Hosts behind Authentik forward auth (the KontextMind Steel proxies) accept
- * an app password only as `Authorization: Basic`. A Bearer token is refused.
- * `STEEL_API_KEY` remains a legacy shim: `x-steel-api-key` and `?apiKey=`.
+ * steel.kontextmind.com is reached only through Caddy and Authentik forward
+ * auth. Clients send `Authorization: Basic` for the svc-steel credential.
+ * A Bearer token is refused. `STEEL_API_KEY` is deprecated and is not
+ * enforced by Steel or Caddy. Do not put a credential in the URL.
  */
 
 import { execSync } from "node:child_process";
@@ -188,9 +189,9 @@ export class SteelAuthRedirectError extends Error {
 }
 
 const LEGACY_STEEL_AUTH_WARNING =
-  "kxm: STEEL_API_KEY is deprecated for Steel. Authentik forward auth accepts app passwords only as Authorization: Basic. " +
-  "Set STEEL_AUTH_BASIC, or STEEL_AUTH_USER and STEEL_AUTH_TOKEN. " +
-  "The legacy x-steel-api-key header and apiKey query parameter remain for the temporary proxy shim.\n";
+  "kxm: STEEL_API_KEY is deprecated for Steel. Steel and Caddy do not enforce it. " +
+  "Set STEEL_AUTH_HEADER, or STEEL_AUTH_BASIC, or STEEL_AUTH_USER and STEEL_AUTH_TOKEN. " +
+  "Those override STEEL_API_KEY. Send Authorization on the request, not in the URL.\n";
 
 let legacySteelAuthWarned = false;
 
@@ -310,6 +311,7 @@ export function resolvePassCliApiKey(
     }
   }
   try {
+    // Deprecated lookup. The hosted server does not enforce STEEL_API_KEY.
     const output = execFn(
       'pass-cli item view --vault-name "AI Provider Keys" --item-title "Steel Browser (KontextMind DOKS)" --output json',
     );
@@ -325,8 +327,9 @@ export function resolvePassCliApiKey(
 }
 
 /**
- * Resolve Steel configuration from environment or pass-cli.
+ * Resolve Steel configuration from the environment.
  * Does not write secrets to disk or logs.
+ * Authentik Basic auth overrides `STEEL_API_KEY`. Steel and Caddy do not enforce that key.
  *
  * Authentik Basic auth (`STEEL_AUTH_HEADER`, `STEEL_AUTH_BASIC`, or
  * `STEEL_AUTH_USER` + `STEEL_AUTH_TOKEN`) wins over `STEEL_API_KEY`.
@@ -610,7 +613,7 @@ export class SteelClient {
   }
 
   /**
-   * Launch a new Steel browser session on DOKS.
+   * Launch a new Steel browser session.
    */
   async createSession(options?: CreateSessionOptions): Promise<SteelSession> {
     const timeoutMs = options?.timeoutMs ?? this.config.timeoutMs ?? 300000;

package/plugins/kxm/src/mcp-server.ts

@@ -11,7 +11,7 @@ import { deliverInboxNotification } from "./inbox.ts";
 import type { HubEvent, MessageRecord } from "./protocol.ts";
 import { sessionTokenFixHint } from "./session-token-hint.ts";
 
-const VERSION = "0.7.146";
+const VERSION = "0.7.147";
 const CONFIGURE_PLUGIN = "/plugin configure kxm@kxm";
 const inbox = new Map<string, MessageRecord>();
 const notifiedInbox = new Set<string>();

package/plugins/kxm/src/modes.ts

@@ -123,7 +123,7 @@ export const DEFAULT_MODES_CONFIG: ModesConfig = Object.freeze({
     browser: {
       description: "Remote Steel browser sessions and visual testing",
       tools: ["steel_session", "steel_scrape", "steel_screenshot"],
-      promptSnippet: "Use Steel on DOKS for browser automation; invoke takeover on MFA.",
+      promptSnippet: "Playwright tests use Obscura. Steel is remote browsing and takeover through Caddy and Authentik; send Authorization, never a credential in the URL.",
     },
   },
 });