@nanobpm/nano-workforce 0.85.1 → 0.85.2

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+## [0.85.2](https://github.com/nanobpm/nano-workforce/compare/v0.85.1...v0.85.2) (2026-08-18)
+
+
+### Bug Fixes
+
+* **agentic:** open LOCAL channel on trusted LAN, drop unverified capability credential ([#278](https://github.com/nanobpm/nano-workforce/issues/278)) ([dc1e37a](https://github.com/nanobpm/nano-workforce/commit/dc1e37a8771beeb18e7e66b36bcfaffa498ed509))
+
 ## [0.85.1](https://github.com/nanobpm/nano-workforce/compare/v0.85.0...v0.85.1) (2026-08-18)
 
 

package/README.md

@@ -264,7 +264,7 @@ active epic already targets the same custom base. See
 | `NANO_PR_REVIEW_WAIT_TIMEOUT` | `PT20M` | ISO-8601 duration the loop waits for a fresh review before escalating a stalled review (timer arm of the `wait-review` gateway) |
 | `NANO_PR_REVIEW_NUDGE_MINUTES` | `5` | cooldown between the poller's automatic reviewer re-request nudges for one waiting PR (clamped 1–1440) |
 | `NANO_WORKFORCE_BASE_URL` | `http://localhost:3000` | externally-reachable base URL for the capability hooks (`/app/api/hooks/*`). Must resolve from **wherever the agent runs** — set it to the app's LAN address (or console-proxy URL) for a remote fleet. See [Fleet networking](#fleet-networking-remote-workers) |
-| `NANO_AGENTIC_SECRET` | — | enables **secure mode** for the agentic visibility channel (`/agentic`): requires an ADR 0028 identity token + capability credential from every peer. Required to attach agentic visibility from **off-box** workers; unset = on-by-default **LOCAL mode** (well-known token, loopback peers only). Also accepts `NANO_PR_WEBHOOK_SECRET` |
+| `NANO_AGENTIC_SECRET` | — | enables **secure mode** for the agentic visibility channel (`/agentic`): every peer must present the **same** `NANO_AGENTIC_SECRET` value (set the identical env var on the server and every worker box — Tab A → Slot A). Unset = on-by-default **LOCAL mode** — the well-known token is honoured from **any origin** (open on the trusted LAN, matching the engine's posture); exposure is governed by the server bind address, not a shared secret. Also accepts `NANO_PR_WEBHOOK_SECRET` |
 
 ### Fleet networking (remote workers)
 
@@ -280,12 +280,18 @@ machines. Two app surfaces must be reachable from those off-box workers:
   agent's prompt, so changing it later does **not** heal already-running instances — re-seed them to
   pick up the new base.
 - The **agentic visibility channel** — `/agentic` (WebSocket). In on-by-default **LOCAL mode** it is
-  gated only by a *well-known, non-secret* localhost token, so it is enforced **loopback-only**: an
-  off-box peer is refused — as is a **reverse-proxied** peer (a connection carrying an
-  `X-Forwarded-For`/`Forwarded`/`X-Real-IP` header is refused even over loopback, so forwarding
-  `/agentic` through the console proxy cannot smuggle the well-known token off-box). To give remote
-  workers visibility, run the channel in **secure mode** by setting `NANO_AGENTIC_SECRET`. (Fleet
-  coordination itself does not depend on this channel — it is visibility only.)
+  gated only by a *well-known, non-secret* token that the hub honours from **any origin** — so an
+  off-box or reverse-proxied peer appears live with no shared secret, matching the open trusted-LAN
+  posture of the engine itself. Exposure therefore depends on network reachability — the app's
+  **bind address** (below) *and* any reverse proxy or port forwarding in front of it — not on the
+  channel: bound to loopback it stays on-box *unless a same-host proxy forwards `/agentic`*, bound
+  wide it is reachable across the LAN. The startup WARN only reflects what the server can verify about
+  its own bind (it fires when it binds wide in LOCAL mode); it cannot see proxy-forwarded exposure. To
+  *authenticate* the channel
+  instead of leaving it open, run it in **secure mode** by setting `NANO_AGENTIC_SECRET` — the
+  **same** env var name and value on the server and on every worker box (the worker presents it as
+  its identity token, the hub verifies it against its own). (Fleet coordination itself does not
+  depend on this channel — it is visibility only.)
 
 #### Bind the HTTP server
 
@@ -300,11 +306,11 @@ opt-in to all interfaces):
 
 > **Status:** this manifest key is delivered by the Urban runtime in
 > [`nanobpm/nano-ide#235`](https://github.com/nanobpm/nano-ide/issues/235) (add the field to the app
-> schema + plumb the bind host to the node adapter). Until that lands, the runtime binds to all
-> interfaces by default (Node's `listen(port)` default), so a fleet already reaches the hooks — but
-> once the parallel *loopback-by-default* change ships, set `"network": { "bind": "all" }` here to
-> keep nwf reachable. This repo is ready for that flip; nwf already enforces the LOCAL-token
-> loopback-only guard so binding wide never exposes the well-known agentic token off-box.
+> schema + plumb the bind host to the node adapter). This repo already ships
+> `"network": { "bind": "all" }` so a fleet reaches the hooks off-box. The agentic visibility channel
+> is **open on the LAN by default** in LOCAL mode (governed by the bind address, with a startup WARN
+> when bound wide), so no loopback-only guard stands between a wide bind and remote worker visibility —
+> set `NANO_AGENTIC_SECRET` if you want to authenticate that channel instead.
 
 #### Choose a path: direct LAN bind vs console proxy
 

package/app/agentic/README.md

@@ -8,7 +8,7 @@ owns the keystone wiring; siblings H1/H3/H4 extend it **without touching the boo
 - **`channel.ts`** — `mountAgenticChannel(...)`. Stands up the `@nanobpm/agentic` WebSocket channel
   + `AgenticHub` on the app's **own** HTTP server (`app.httpServer`, same port as the pages and
   `/app/api/hooks/*` — no sidecar port), authenticates upgrades on `/agentic` (ADR 0028 identity
-  token + a required capability credential, mirroring the blackboard hook's `?token=…` pattern), and
+  token; the capability credential was removed because it was accept-any friction), and
   mounts every discovered family. Returns a handle whose `teardown()` reverses everything.
 - **`registry.ts`** — the `AgenticFamilyRegistry` seam + the `AgenticFamily` / `AgenticContext`
   contracts. Mounts families on boot, tears them down in **reverse** order on shutdown.
@@ -46,9 +46,18 @@ H0 itself needs no migration.
 
 ## Configuration
 
-- `NANO_AGENTIC_SECRET` (falls back to `NANO_PR_WEBHOOK_SECRET`) — the shared identity secret peers
-  present as `?token=…`. When neither is set, the channel is **not mounted** (logged), so the app
-  never exposes an unauthenticated upgrade.
+The channel has three modes, selected by environment (see `main.ts`):
+
+- **LOCAL mode (default)** — when neither `NANO_AGENTIC_SECRET` nor its fallback
+  `NANO_PR_WEBHOOK_SECRET` is set, the channel **is** mounted with a well-known token: no *shared
+  secret* (and no capability credential) is required — the well-known token is still presented, so
+  peers on the trusted LAN can connect off-box. Exposure depends on network
+  reachability (the server bind plus any reverse proxy/port forwarding); the startup `WARN` fires
+  when the hub sees a non-loopback bind **or** cannot verify the bind at all (`server.address()` is
+  `null`), so it won't flag exposure created by a same-host proxy forwarding `/agentic`.
+- **SECURE mode** — set `NANO_AGENTIC_SECRET` (falls back to `NANO_PR_WEBHOOK_SECRET`) to require a
+  shared identity secret (the same value on the hub and every peer), presented as `?token=…`.
+- **Disabled** — set `NANO_AGENTIC=off` (or `0`/`false`/`no`) to not mount the channel at all.
 
 ## Event-sourced transcripts (#251)
 

package/app/agentic/channel.test.ts

@@ -5,17 +5,13 @@
 // hub is visible via `inspect()`, families mount/tear-down through the seam, and shutdown is clean.
 import { type AddressInfo, createServer, type Server } from "node:http";
 import { test } from "node:test";
-import { AUTH_UNAUTHORIZED } from "@nanobpm/agentic/channel";
 import { createLogger } from "@nanobpm/urban/runtime";
 import { WebSocket } from "ws";
 import { assert, assertEquals } from "#test-assert";
 import { noopLog } from "../../test/log.ts";
 import {
   type AgenticChannelHandle,
-  isForwardedConnection,
-  isLoopbackRemote,
   LOCAL_AGENTIC_TOKEN,
-  loopbackOnly,
   mountAgenticChannel,
 } from "./channel.ts";
 import { type AgenticContext, AgenticFamilyRegistry } from "./registry.ts";
@@ -103,7 +99,7 @@ async function mount(
   });
 }
 
-test("a valid identity token + capability credential upgrades on /agentic", async (t) => {
+test("a valid identity token upgrades on /agentic (capability credential no longer required)", async (t) => {
   const { server, port } = await startHttp();
   const channel = await mount(port, server);
   t.after(async () => {
@@ -131,7 +127,7 @@ test("an invalid identity token is rejected (4401)", async (t) => {
   assertEquals(channel.hub.connectionCount, 0);
 });
 
-test("a missing capability credential is rejected (4403)", async (t) => {
+test("SECURE mode upgrades with NO capability credential (credential requirement ripped out)", async (t) => {
   const { server, port } = await startHttp();
   const channel = await mount(port, server);
   t.after(async () => {
@@ -139,8 +135,12 @@ test("a missing capability credential is rejected (4403)", async (t) => {
     await closeServer(server);
   });
 
-  const closedCode = await rejectionCode(port, `?token=${SECRET}`);
-  assertEquals(closedCode, 4403);
+  // The capability credential was accept-any (never verified), so it is no longer required at all:
+  // a valid identity token alone upgrades. Only the token gates the channel.
+  const ws = await connect(port, `?token=${SECRET}`);
+  assertEquals(ws.readyState, WebSocket.OPEN);
+  assertEquals(channel.hub.connectionCount, 1);
+  ws.close();
 });
 
 test("normal HTTP routes keep working alongside the channel", async (t) => {
@@ -303,7 +303,7 @@ function capturingLog(): { log: ReturnType<typeof noopLog>; records: Array<{ lev
   return { log, records };
 }
 
-test("LOCAL mode warns when the server is bound to a non-loopback interface", async (t) => {
+test("LOCAL mode warns the visibility channel is OPEN on the LAN on a non-loopback bind", async (t) => {
   const server = createServer((_req, res) => res.end());
   await new Promise<void>((resolve) => server.listen(0, "0.0.0.0", resolve));
   const { log, records } = capturingLog();
@@ -319,8 +319,8 @@ test("LOCAL mode warns when the server is bound to a non-loopback interface", as
     await closeServer(server);
   });
 
-  const warned = records.some((r) => r.level === "warn" && r.msg.includes("not bound to loopback"));
-  assert(warned, "LOCAL mode on a non-loopback bind must warn that the well-known token is exposed");
+  const warned = records.some((r) => r.level === "warn" && r.msg.includes("OPEN on the LAN"));
+  assert(warned, "LOCAL mode on a non-loopback bind must warn that the visibility channel is exposed");
 });
 
 test("LOCAL mode warns when the server bind address is unverifiable (not listening)", async (t) => {
@@ -346,7 +346,7 @@ test("LOCAL mode warns when the server bind address is unverifiable (not listeni
   const warned = records.some(
     (r) => r.level === "warn" && r.msg.includes("bind address could not be verified"),
   );
-  assert(warned, "LOCAL mode on an unbound server must warn that the well-known token is unverifiable");
+  assert(warned, "LOCAL mode on an unbound server must warn that exposure is unverifiable");
 });
 
 test("LOCAL mode does NOT warn when the server is bound to loopback", async (t) => {
@@ -364,82 +364,64 @@ test("LOCAL mode does NOT warn when the server is bound to loopback", async (t)
     await closeServer(server);
   });
 
-  const warned = records.some((r) => r.level === "warn" && r.msg.includes("not bound to loopback"));
+  const warned = records.some((r) => r.level === "warn" && r.msg.includes("OPEN on the LAN"));
   assert(!warned, "a loopback-bound LOCAL channel is the expected safe case and must not warn");
 });
 
-// --- Loopback-only enforcement of the LOCAL well-known token (issue #224 / nano-ide#235) ---
+// --- LOCAL mode is trusted-network: the well-known token is honoured from any origin ---
 //
-// The LOCAL token is not a secret, so once the app binds to all interfaces (network.bind: "all") it
-// must never be honoured off-box. `isLoopbackRemote` vets the peer's origin; `loopbackOnly` wraps an
-// authenticator to refuse a non-loopback peer with 4401 while delegating loopback peers to the base.
-
-test("isLoopbackRemote accepts same-host peers and rejects everything else", () => {
-  for (const ok of ["127.0.0.1", "127.0.0.5", "::1", "::ffff:127.0.0.1", "::ffff:127.1.2.3"]) {
-    assert(isLoopbackRemote(ok), `${ok} should be loopback`);
-  }
-  for (const no of [undefined, "", "10.0.0.4", "192.168.1.20", "::ffff:10.0.0.4", "2001:db8::1", "0.0.0.0"]) {
-    assert(!isLoopbackRemote(no), `${String(no)} should NOT be loopback`);
-  }
-});
-
-test("loopbackOnly refuses a non-loopback peer with 4401 and never calls the base authenticator", () => {
-  let baseCalls = 0;
-  const base = () => {
-    baseCalls++;
-    return { ok: true as const, grant: { identity: "peer" } };
-  };
-  const guarded = loopbackOnly(base);
+// The loopback-only enforcement (and its isLoopbackRemote/isForwardedConnection/loopbackOnly guard)
+// was removed: LOCAL mode now matches the unauthenticated engine's trusted-LAN posture, so a
+// non-loopback / reverse-proxied peer that would previously have been refused now upgrades. Exposure
+// is governed by the server bind + the startup WARN, and SECURE mode (NANO_AGENTIC_SECRET) remains
+// the opt-in for a shared secret (the same value on the hub and every peer).
 
-  const remote = guarded({ token: LOCAL_AGENTIC_TOKEN, remote: "10.0.0.4" });
-  assert(!("then" in remote), "authenticator result is synchronous here");
-  assertEquals((remote as { ok: boolean; code?: number }).ok, false);
-  assertEquals((remote as { code?: number }).code, AUTH_UNAUTHORIZED);
-  assertEquals(baseCalls, 0);
-});
-
-test("loopbackOnly delegates a loopback peer to the base authenticator", () => {
-  let baseCalls = 0;
-  const base = () => {
-    baseCalls++;
-    return { ok: true as const, grant: { identity: "peer" } };
-  };
-  const guarded = loopbackOnly(base);
-
-  const local = guarded({ token: LOCAL_AGENTIC_TOKEN, remote: "127.0.0.1" });
-  assertEquals((local as { ok: boolean }).ok, true);
-  assertEquals(baseCalls, 1);
-});
-
-// A reverse proxy that connects to the app over loopback makes an off-box client appear same-host to
-// `req.remote`. `isForwardedConnection` detects the relay from proxy-forwarding headers, so
-// `loopbackOnly` fails closed on a proxied peer even when `req.remote` itself is loopback.
-
-test("isForwardedConnection detects proxy-forwarding headers and ignores absent/empty ones", () => {
-  assert(isForwardedConnection({ "x-forwarded-for": "10.0.0.4" }), "x-forwarded-for marks a relay");
-  assert(isForwardedConnection({ forwarded: "for=10.0.0.4" }), "forwarded marks a relay");
-  assert(isForwardedConnection({ "x-real-ip": "10.0.0.4" }), "x-real-ip marks a relay");
-
-  assert(!isForwardedConnection(undefined), "no headers is a direct connection");
-  assert(!isForwardedConnection({}), "empty headers is a direct connection");
-  assert(!isForwardedConnection({ "x-forwarded-for": "   " }), "whitespace value is treated as absent");
-  assert(!isForwardedConnection({ "content-type": "application/json" }), "unrelated headers are ignored");
-});
-
-test("loopbackOnly refuses a reverse-proxied peer (loopback remote + forwarding header) with 4401", () => {
-  let baseCalls = 0;
-  const base = () => {
-    baseCalls++;
-    return { ok: true as const, grant: { identity: "peer" } };
-  };
-  const guarded = loopbackOnly(base);
+test("LOCAL mode upgrades a reverse-proxied / forwarded peer (loopback-only guard removed)", async (t) => {
+  const { server, port } = await startHttp();
+  const channel = await mountAgenticChannel({
+    server,
+    secret: "",
+    secure: false,
+    data: undefined,
+    log: noopLog(),
+  });
+  t.after(async () => {
+    await channel.teardown();
+    await closeServer(server);
+  });
 
-  const proxied = guarded({
-    token: LOCAL_AGENTIC_TOKEN,
-    remote: "127.0.0.1",
-    headers: { "x-forwarded-for": "203.0.113.7" },
+  // A proxy-forwarding header used to fail LOCAL mode closed (a reverse-proxied peer was refused).
+  // With the guard gone the well-known token alone upgrades this forwarded/reverse-proxied
+  // connection (still to 127.0.0.1, now carrying an x-forwarded-for header).
+  const ws = new WebSocket(`ws://127.0.0.1:${port}/agentic?token=${LOCAL_AGENTIC_TOKEN}`, {
+    headers: { "x-forwarded-for": "10.0.0.4" },
+  });
+  await new Promise<void>((resolve, reject) => {
+    // Bound the wait so a stalled handshake fails fast instead of hanging CI forever.
+    const timer = setTimeout(() => {
+      // Terminate the still-pending socket so a stalled handshake can't keep the
+      // event loop alive after we reject.
+      ws.terminate();
+      reject(new Error("upgrade neither opened nor closed in time"));
+    }, REJECTION_TIMEOUT_MS);
+    timer.unref?.();
+    ws.on("open", () => {
+      clearTimeout(timer);
+      resolve();
+    });
+    // This test expects OPEN, so a transport error (which may arrive without a paired close)
+    // must reject rather than hang the promise forever.
+    ws.on("error", (err) => {
+      clearTimeout(timer);
+      ws.terminate();
+      reject(err);
+    });
+    ws.on("close", (code, reason) => {
+      clearTimeout(timer);
+      reject(new Error(`closed ${code}: ${reason.toString()}`));
+    });
   });
-  assertEquals((proxied as { ok: boolean; code?: number }).ok, false);
-  assertEquals((proxied as { code?: number }).code, AUTH_UNAUTHORIZED);
-  assertEquals(baseCalls, 0);
+  assertEquals(ws.readyState, WebSocket.OPEN);
+  assertEquals(channel.hub.connectionCount, 1);
+  ws.close();
 });

package/app/agentic/channel.ts

@@ -2,8 +2,8 @@
 //
 // This is the keystone of the agentic-visibility epic (#142): it stands up the WebSocket channel +
 // hub on the app's OWN HTTP server (same port as the pages and `/app/api/hooks/*` — no sidecar
-// port), authenticates each upgrade (ADR 0028 identity token + a capability credential, mirroring
-// the `?token=…` pattern the blackboard hook uses), and mounts every registered family module
+// port), authenticates each upgrade (ADR 0028 identity token; the capability credential was removed
+// as it was accept-any friction), and mounts every registered family module
 // through the {@link AgenticFamilyRegistry} seam.
 //
 // `main.ts` calls {@link mountAgenticChannel} once after `runFromEnv` and calls the returned
@@ -17,8 +17,6 @@ import type { Server } from "node:http";
 import type { AddressInfo } from "node:net";
 import {
   AgenticHub,
-  AUTH_UNAUTHORIZED,
-  type Authenticator,
   sharedSecretAuthenticator,
   WebSocketChannelTransport,
 } from "@nanobpm/agentic/channel";
@@ -30,12 +28,15 @@ import { AgenticFamilyRegistry } from "./registry.ts";
 export const AGENTIC_PATH = "/agentic";
 
 /**
- * The well-known identity token used in LOCAL mode (security opt-in). Nano is local-first: on a
- * developer's own machine the visibility channel is on by default with no credential friction, so
- * the hub and the `nano work` worker agree on this constant, well-known localhost token. It is NOT
- * a secret — it only gates same-machine dev traffic. In secure mode (`secure: true` + a real
- * `NANO_AGENTIC_SECRET`) this constant is never used and a real ADR 0028 verifier applies. Keep in
- * lock-step with the worker constant in jwulf/c8ctl-plugin-nano (`c8ctl-plugin.js` LOCAL_AGENTIC_TOKEN).
+ * The well-known identity token used in LOCAL mode (the default). Nano is trusted-network-first: the
+ * visibility channel is on by default with no credential friction, so the hub and the `nano work`
+ * worker agree on this constant, well-known token. It is NOT a secret — LOCAL mode is designed for a
+ * trusted LAN and the token is honoured from ANY origin (the same trust posture the unauthenticated
+ * engine already relies on); a non-loopback bind therefore leaves the visibility channel OPEN on the
+ * LAN, which the startup WARN surfaces. Set `NANO_AGENTIC_SECRET` (SECURE mode) to require a shared
+ * secret (the same value on the hub and every peer) instead. Keep in lock-step with the worker
+ * constant in jwulf/c8ctl-plugin-nano
+ * (`c8ctl-plugin.js` LOCAL_AGENTIC_TOKEN).
  */
 export const LOCAL_AGENTIC_TOKEN = "nano-local";
 
@@ -55,96 +56,28 @@ function isLoopbackBind(addr: string | AddressInfo | null): boolean {
   return host === "::1" || host === "::ffff:127.0.0.1" || host.startsWith("127.");
 }
 
-/**
- * True if a peer's remote address (`req.remote`, i.e. `socket.remoteAddress`) is a same-host /
- * loopback peer. This is the per-connection counterpart to {@link isLoopbackBind}: while that vets
- * the *server's* bind, this vets the *client's* origin, so LOCAL mode can be honoured off a
- * wildcard/all-interfaces bind (`network.bind: "all"`, issue #224) yet still refuse the well-known
- * {@link LOCAL_AGENTIC_TOKEN} to anything but a same-machine peer. Loopback is `127.0.0.0/8`, `::1`,
- * or the IPv6-mapped IPv4 forms Node reports on a dual-stack listener (`::ffff:127.x`). An
- * absent/unparseable remote is NOT provably same-host, so it is treated as non-loopback
- * (fail-closed), matching the `isLoopbackBind(null) === false` posture.
- */
-export function isLoopbackRemote(remote: string | undefined): boolean {
-  if (!remote) return false;
-  return (
-    remote === "::1" ||
-    remote === "::ffff:127.0.0.1" ||
-    remote.startsWith("127.") ||
-    remote.startsWith("::ffff:127.")
-  );
-}
-
-/**
- * Proxy-forwarding request headers. Their presence means the connection was relayed through a
- * reverse proxy, so `req.remote` is the *proxy's* address (typically loopback for an embedded/console
- * proxy) rather than the true client — a loopback `remote` no longer proves a same-host peer. A
- * genuine same-machine loopback peer connects directly and never carries one of these.
- */
-const FORWARDING_HEADERS: readonly string[] = ["x-forwarded-for", "forwarded", "x-real-ip"];
-
-/**
- * True if the handshake carries a proxy-forwarding header — i.e. the connection reached us through a
- * reverse proxy, so `req.remote` is the proxy, not the originating client. Used to fail LOCAL mode
- * closed: a relayed connection can present a loopback `remote` (the proxy) while the real client is
- * off-box, so the well-known token must never be honoured for it (see {@link loopbackOnly}). Headers
- * are lower-cased by the transport ({@link HandshakeRequest.headers}); an empty/whitespace value is
- * treated as absent.
- */
-export function isForwardedConnection(headers: Readonly<Record<string, string>> | undefined): boolean {
-  if (!headers) return false;
-  return FORWARDING_HEADERS.some((h) => {
-    const value = headers[h];
-    return typeof value === "string" && value.trim() !== "";
-  });
-}
-
-/**
- * Wrap `base` so a peer is admitted ONLY from a direct, same-host loopback connection. LOCAL mode
- * gates purely on the well-known {@link LOCAL_AGENTIC_TOKEN}, which is not a secret — so once the app
- * is exposed on the LAN (`network.bind: "all"`, issue #224) that token must never be honoured
- * off-box. This enforces the invariant per-connection (any other peer is closed `4401`), independent
- * of the server's bind, closing the interplay the bind-to-all setting exposes (nano-ide#235).
- *
- * Two ways a peer can fail to be a same-host loopback client, both refused:
- *  - a non-loopback `req.remote` (a direct off-box connection); or
- *  - a proxy-forwarding header ({@link isForwardedConnection}) — the connection was relayed, so a
- *    loopback `req.remote` is the *proxy*, not the client. Refusing any forwarded connection keeps
- *    the guard robust even if `/agentic` is inadvertently reverse-proxied over loopback (the
- *    embedded/console-proxy topology), where the off-box client would otherwise appear same-host.
- *
- * Note this guards ONLY the agentic visibility channel: the capability HTTP hooks
- * (`/app/api/hooks/*`) carry their own unguessable per-request tokens and stay reachable off-box
- * (including through the console proxy), which is what a remote fleet needs. To attach agentic
- * visibility from off-box — directly or via a proxy — run the channel in SECURE mode instead.
- */
-export function loopbackOnly(base: Authenticator): Authenticator {
-  return (req) => {
-    if (isForwardedConnection(req.headers) || !isLoopbackRemote(req.remote)) {
-      return {
-        ok: false,
-        code: AUTH_UNAUTHORIZED,
-        reason:
-          "LOCAL-mode agentic channel is loopback-only and refuses reverse-proxied peers; use secure mode (NANO_AGENTIC_SECRET) for off-box or proxied peers",
-      };
-    }
-    return base(req);
-  };
-}
+// LOCAL mode honours the well-known token from ANY origin: exposure depends on network reachability
+// — the server bind (loopback by default) plus any reverse proxy/port forwarding in front of it —
+// matching the trusted-network posture the unauthenticated engine already relies on. The startup
+// WARN below only reflects what the server can verify about its own bind (it fires on a wide bind,
+// or when the bind can't be verified — `server.address()` is `null`); it cannot detect a same-host
+// proxy forwarding /agentic. Set NANO_AGENTIC_SECRET (SECURE mode) to
+// require a shared secret (the same value on the hub and every peer) instead.
 
 export interface MountAgenticChannelOptions {
   /** The app's own `node:http` server (share its port; `app.httpServer` narrowed to `Server`). */
   readonly server: Server;
-  /** The shared-secret ADR 0028 identity token every valid peer must present as `?token=…`. In LOCAL
-   * mode (`secure: false`) this may be empty — the hub substitutes {@link LOCAL_AGENTIC_TOKEN}. */
+  /** The shared-secret ADR 0028 identity token every valid peer must present as `?token=…` (the same
+   * value on the hub and every peer). In LOCAL mode (`secure: false`) this may be empty — {@link
+   * mountAgenticChannel} substitutes {@link LOCAL_AGENTIC_TOKEN} via its local `secret` assignment. */
   readonly secret: string;
   /**
-   * Security mode. Nano is local-first, so this defaults to `true` (strict) at the library level to
-   * keep the fail-closed contract for any caller that doesn't opt in — but `main.ts` passes
+   * Security mode. Defaults to `true` (strict) at the library level — fail-closed for any caller
+   * that doesn't explicitly opt in — but `main.ts` passes
    * `secure: false` whenever no `NANO_AGENTIC_SECRET` is configured, mounting an on-by-default LOCAL
-   * channel: a well-known localhost token ({@link LOCAL_AGENTIC_TOKEN}) and NO required capability
-   * credential. Set `secure: true` (with a real secret) to require an ADR 0028 identity token AND a
-   * capability credential on every upgrade.
+   * channel: a well-known token ({@link LOCAL_AGENTIC_TOKEN}) honoured from any origin, with NO
+   * capability credential. Set `secure: true` (with a real secret) to require an ADR 0028 identity
+   * token on every upgrade.
    */
   readonly secure?: boolean;
   /** The app's SQLite data layer, threaded to family modules (may be absent when data isn't mounted). */
@@ -195,44 +128,44 @@ export async function mountAgenticChannel(
   }
 
   const transport = new WebSocketChannelTransport({ server, path: AGENTIC_PATH });
-  // LOCAL mode gates only on the well-known localhost token, so it must be honoured only for a
-  // same-machine peer: wrap the authenticator to refuse any non-loopback remote (see loopbackOnly).
-  // Secure mode presents a real ADR 0028 identity token + capability credential, so it is safe from
-  // any origin and needs no such guard.
-  const baseAuthenticator = sharedSecretAuthenticator({ secret, requireCredential: secure });
+  // Identity-token-only auth in both modes: SECURE verifies the token against the real
+  // NANO_AGENTIC_SECRET; LOCAL accepts the well-known token from any origin. The capability
+  // credential is intentionally NOT required — nano-workforce never verified it (accept-any), so it
+  // was pure configuration friction; a real ADR 0028 capability check can reintroduce it later by
+  // passing a verifier.
+  const authenticator = sharedSecretAuthenticator({ secret, requireCredential: false });
   const hub = new AgenticHub({
     transport,
-    // Secure mode: a valid identity token PLUS a required capability credential upgrades; either
-    // missing/invalid is rejected (4401 / 4403). Swap in a real ADR 0028 verifier later by passing an
-    // Authenticator. LOCAL mode: token-only (the well-known localhost token), loopback peers only.
-    authenticator: secure ? baseAuthenticator : loopbackOnly(baseAuthenticator),
+    // A valid identity token upgrades (4401 on mismatch). SECURE mode's token is the real secret;
+    // LOCAL mode's is the well-known token, honoured from any origin (trusted-LAN posture).
+    authenticator,
     onError: (err, connectionId) =>
       log.warn("agentic hub error", { connectionId, err: String(err) }),
   });
   // Share the app's port: the transport rode the existing server, so it is already listening.
   await transport.ready();
 
-  // LOCAL mode is now enforced loopback-only per connection (see loopbackOnly), so the well-known
-  // token can never be honoured off-box even on a wildcard/all-interfaces bind. A non-loopback bind
-  // is still worth surfacing though: it means off-box agentic peers are REFUSED, so a remote worker
-  // fleet gets no visibility until the channel runs in secure mode. Warn so the operator makes the
-  // deliberate choice. A `null` address (server not listening yet) is unverifiable — warn too.
+  // LOCAL mode honours the well-known token (not a secret) from any origin. On a loopback bind that
+  // only reaches same-host peers; on a non-loopback bind the visibility channel is OPEN on the LAN —
+  // anyone who can reach this port can attach and watch worker presence/terminals. That is the
+  // intended trusted-network posture, but it must never be silent, so warn. A `null` address (server
+  // not listening yet) is unverifiable — warn too, since it may be exposed.
   if (!secure) {
     const addr = server.address();
     if (addr === null) {
       log.warn(
         "agentic channel is in LOCAL mode but the server bind address could not be verified " +
-          "(the server is not listening yet) — the loopback-only enforcement for the well-known " +
-          "LOCAL_AGENTIC_TOKEN cannot be confirmed. Mount the channel after the server is listening, " +
-          "set NANO_AGENTIC_SECRET for secure mode, or bind the server to 127.0.0.1.",
+          "(the server is not listening yet) — if it is bound off-box the visibility channel is " +
+          "OPEN on the LAN with the well-known token. Mount the channel after the server is " +
+          "listening, set NANO_AGENTIC_SECRET to require a secret, or NANO_AGENTIC=off to disable.",
         { mode: "local", bind: null },
       );
     } else if (!isLoopbackBind(addr)) {
       log.warn(
-        "agentic channel is in LOCAL mode but the server is not bound to loopback — off-box peers " +
-          "are refused the channel (the well-known LOCAL_AGENTIC_TOKEN is enforced loopback-only), " +
-          "so a remote worker fleet cannot attach visibility. Set NANO_AGENTIC_SECRET for secure " +
-          "mode to serve remote peers, or bind the server to 127.0.0.1.",
+        "agentic channel is in LOCAL mode and the server is not bound to loopback — the visibility " +
+          "channel is OPEN on the LAN: any peer that can reach this port can attach with the " +
+          "well-known token and watch worker presence/terminals. Set NANO_AGENTIC_SECRET to require " +
+          "a secret, or NANO_AGENTIC=off to disable.",
         { mode: "local", bind: typeof addr === "object" ? addr.address : String(addr) },
       );
     }

package/main.ts

@@ -47,11 +47,13 @@ const app = await runFromEnv({ engine, host, port: PORT, handleSignals: false })
 // shares the app port (no sidecar). This is the ONLY main.ts wiring for the whole epic — sibling
 // slices (H1/H3/H4) extend it by dropping a family module under `app/agentic/families/`, never here.
 //
-// Local-first (security opt-in): Nano is designed for local use, so the channel is ON BY DEFAULT.
-//   - No secret configured  -> LOCAL mode: well-known localhost token, no credential required, so a
-//     `nano work` worker appears live with zero configuration.
-//   - `NANO_AGENTIC_SECRET` (or `NANO_PR_WEBHOOK_SECRET`) set -> SECURE mode: ADR 0028 identity token
-//     + capability credential required on every upgrade.
+// Trusted-LAN by default (security opt-in): Nano runs on a trusted network, so the channel is ON BY DEFAULT.
+//   - No secret configured  -> LOCAL mode: well-known token, no credential required, honoured from
+//     any origin, so a `nano work` worker appears live with zero configuration (trusted-LAN posture;
+//     a WARN surfaces the exposure on a non-loopback bind).
+//   - `NANO_AGENTIC_SECRET` (or `NANO_PR_WEBHOOK_SECRET`) set -> SECURE mode: a shared-secret ADR 0028
+//     identity token (the same value on the hub and every peer) required on every upgrade (no
+//     capability credential — that was accept-any friction).
 //   - `NANO_AGENTIC=off` (or 0/false/no) -> disabled entirely.
 // `app.httpServer` is a `node:http` Server once started (undefined on hosts that don't surface one,
 // e.g. Deno).
@@ -73,9 +75,12 @@ if (httpServer instanceof Server) {
     });
     if (!secure) {
       app.log.info(
-        "agentic channel mounted in LOCAL mode (on by default, token-only — a well-known localhost " +
-          "token, no capability credential). Set NANO_AGENTIC_SECRET for secure mode, or " +
-          "NANO_AGENTIC=off to disable.",
+        "agentic channel mounted in LOCAL mode (on by default, token-only — a well-known token, no " +
+          "capability credential). Honoured from any origin, so on a non-loopback bind it is reachable " +
+          "off-box on the trusted LAN (a WARN surfaces a provably wide bind; it cannot detect exposure " +
+          "created by a same-host reverse proxy forwarding /agentic while the app stays loopback-bound). " +
+          "Set NANO_AGENTIC_SECRET to require a shared secret (the same value on the hub and every peer), " +
+          "or NANO_AGENTIC=off to disable.",
       );
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.85.1",
+  "version": "0.85.2",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",

package/pages/cockpit/mount.js

@@ -587,11 +587,15 @@ export function mountCockpit(host, opts = {}) {
 /**
  * Derive the channel WebSocket URL from the current origin (path `/agentic`).
  *
- * The agentic hub authenticates upgrades with `sharedSecretAuthenticator({ requireCredential: true })`,
- * so a bare `ws(s)://host/agentic` is rejected (4401/4403). When a `token` (and optional `capability`)
- * are supplied, they are appended as the `?token=…&capability=…` query the hub requires; without them
- * the default URL cannot authenticate and drill-in will be refused — pass credentials (or an explicit
- * `relayUrl`) for secured deployments.
+ * The agentic hub authenticates upgrades with an identity token only
+ * (`sharedSecretAuthenticator({ requireCredential: false })`) — no capability credential is required.
+ * In SECURE mode a bare `ws(s)://host/agentic` is rejected (4401) until a valid `token` is supplied;
+ * in LOCAL mode the hub still requires a `token` query param, but it is a well-known, non-secret
+ * value the hub accepts from any origin. Auth is token-only — a `capability` is legacy and ignored
+ * by the current hub (`requireCredential: false`); it is still appended to the query when supplied
+ * (`?token=…&capability=…`) for backward compatibility but plays no part in authenticating the
+ * upgrade. Without a token neither mode can authenticate and drill-in will be refused — pass a
+ * token (or an explicit `relayUrl`) for secured deployments.
  */
 function defaultRelayUrl(token, capability) {
   const proto = location.protocol === "https:" ? "wss:" : "ws:";

package/renovate.json

@@ -1,21 +1,19 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": ["config:recommended"],
-  "customManagers": [
-    {
-    "customType": "regex",
-    "description": "Keep the @nanobpm/urban pin in deno.json's import map in sync with the npm registry (the npm manager only sees package.json, so without this deno.json would drift).",
-    "fileMatch": ["^deno\\.jsonc?$"],
-    "matchStrings": [
-      ],
-      "datasourceTemplate": "npm"
-    }
-  ],
   "packageRules": [
     {
-      "description": "Land the package.json and deno.json bumps for @nanobpm/urban in a single PR so the two pins can never diverge.",
-      "matchPackageNames": ["@nanobpm/urban"],
-      "groupName": "@nanobpm/urban"
+      "description": "Auto-merge non-major @nanobpm/* updates once CI is green. These are first-party packages we publish from nano-ide; CI (typecheck + test) is the gate. For 0.x pins a caret range locks the minor, so Renovate's range bump is what actually pulls a new minor through; automerging it keeps nwf on the latest urban without manual PRs. platformAutomerge is off because main is unprotected, so Renovate waits for its own green branch status before merging.",
+      "matchPackageNames": ["/^@nanobpm//"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "automerge": true,
+      "platformAutomerge": false
+    },
+    {
+      "description": "Major @nanobpm/* updates may be breaking - require a human to review and merge.",
+      "matchPackageNames": ["/^@nanobpm//"],
+      "matchUpdateTypes": ["major"],
+      "automerge": false
     }
   ]
 }