agentgui 1.0.968 → 1.0.969

package/AGENTS.md

@@ -1,5 +1,9 @@
 # AgentGUI — Agent Notes
 
+## CRITICAL — `authedFetch` must NOT set `Authorization: Bearer` behind an nginx Basic-Auth proxy (2026-06-18)
+
+Witnessed on the boxone.off.l-inc.co.za/gm deploy: the page HTML/JS/CSS loaded (browser sends its cached HTTP Basic creds) but every app `fetch()` (`/gm/health`, `/gm/v1/history/sessions`, `/api/*`) returned **401 from nginx**, and the user saw a repeating Basic-Auth prompt. Root cause: `site/app/js/backend.js` `authedFetch` set `Authorization: Bearer <window.__WS_TOKEN>`, which **overwrites** the browser's cached `Authorization: Basic` credentials. nginx `auth_basic` only accepts `Basic`, so a `Bearer` header is rejected at the proxy before it ever reaches agentgui. The WS survived because it auths via `?token=` query on an `auth_basic off` path. Fix: thread the token via the **`?token=` query param** (`withToken()`, exactly like the WS / EventSource / image / download URLs) and never override `Authorization` — the query param coexists with the upstream Basic auth, and agentgui accepts `?token=` on every HTTP route. Rule: **same-origin app auth must never use the `Authorization` header when an upstream proxy may own Basic auth** — use the query param + the `agentgui_token` cookie. boxone runs the published `agentgui@latest`, so this reaches it only after an npm publish + service restart (or via the gmweb nginx `auth_basic off` mitigation on the agentgui-proxied API paths).
+
 ## UX-craft sweep + empirical-witness-first (2026-06-11) — twelfth run
 
 Two-track run: EMPIRICAL baseline witnessing of the live page found 18 shipped janks BEFORE theorizing, then a fresh hunt workflow `.claude/workflows/gui-ux-craft.js` (6 lenses the 11 prior sweeps never used: typography-rhythm, copy-tone, perceived-performance, kit-DX, light-theme-contrast, interaction-density; 46 agents -> 40 confirmed, `PUNCHLIST-UX.md`). ALL 58 implemented. Server on this env runs `PORT=3009` (3000 owned by another app).
@@ -257,3 +261,5 @@ GUI source keeps typographic product characters — the middot separator `·`, t
 
 **`index.html` loads the DS kit from the local `./vendor/anentrypoint-design/247420.{js,css}`, NOT unpkg.** The prior "moved to unpkg @latest" note described a transient state that was reverted: the kit was re-vendored (with `AgentChat`) in `eb1eab3` and witnessed loading from `./vendor/` again (2026-06-04 and 2026-06-05 runs). The vendored copy IS the shipped UI — predictable, no upstream-publish drift. Update flow: edit the kit at `c:\dev\anentrypoint-design`, `node scripts/build.mjs`, copy `dist/247420.{js,css}` into `site/app/vendor/anentrypoint-design/`, browser-witness, then push the kit so unpkg stays in sync for other consumers. (The markdown stack marked/dompurify/prismjs still fetches from jsdelivr on first chat render.)
 
+
+@.gm/next-step.md

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentgui",
-  "version": "1.0.968",
+  "version": "1.0.969",
   "description": "Multi-agent ACP client with real-time communication",
   "type": "module",
   "main": "electron/main.js",

package/site/app/js/backend.js

@@ -14,11 +14,16 @@ function authToken() {
 }
 
 function authedFetch(url, opts = {}) {
-  const tok = authToken();
-  if (!tok) return fetch(url, opts);
-  const h = new Headers(opts.headers || {});
-  h.set('Authorization', 'Bearer ' + tok);
-  return fetch(url, { ...opts, headers: h });
+  // Thread the agentgui token via the ?token= query param (exactly like the WS,
+  // EventSource, and image/download URLs) rather than an `Authorization: Bearer`
+  // header. A Bearer header OVERWRITES the browser's cached HTTP Basic Auth
+  // credentials, so behind an nginx `auth_basic` proxy (e.g. the boxone /gm
+  // deploy) every app fetch is rejected with 401 at the proxy before it ever
+  // reaches agentgui - the page HTML/JS load (browser sends Basic creds) but
+  // /health, /v1/history/*, and /api/* all 401. The query param coexists with
+  // Basic auth; agentgui accepts ?token= on every HTTP route. credentials are
+  // kept same-origin so the agentgui_token cookie also flows.
+  return fetch(withToken(url), { credentials: 'same-origin', ...opts });
 }
 
 function withToken(url) {