taskchef 5.11.1 → 5.11.2

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "taskchef",
-  "version": "5.11.1",
+  "version": "5.11.2",
   "description": "Dispatch work from a data-only workspace to visible Codex project tasks.",
   "author": {
     "name": "Favo Yang",

package/README.md

@@ -174,10 +174,9 @@ executors report results:
 taskchef dashboard
 ```
 
-Open the printed capability URL, which starts with `http://127.0.0.1:3210` and
-contains a one-time launch token. Do not share it: the browser exchanges it for
-a local session cookie before loading task data, then removes the token from the
-address bar. Use `--port <number>` to choose another port and `--workspace
+Open the printed local URL, which is `http://127.0.0.1:3210/` by default. The
+same server can be open in the Codex in-app browser and an external browser at
+the same time. Use `--port <number>` to choose another port and `--workspace
 <path>` to override the normal workspace resolution. Press Ctrl+C in the
 terminal to stop the server.
 
@@ -191,10 +190,14 @@ The dashboard:
 - opens the recorded task directly in Codex when it has a supported UUID thread
   ID, with a project-opening fallback for unresolved or legacy identities.
 
-The server binds only to the numeric IPv4 loopback interface, requires the
-unguessable launch capability before serving instructions or results, validates
-the same task schema as the CLI, retains its last valid snapshot if the log
-becomes invalid, and never writes dispatcher-workspace files. It limits event
+The server binds only to the numeric IPv4 loopback interface and rejects
+non-loopback configuration. It intentionally does not authenticate browser
+sessions, so any local process or browser that can reach the port can read the
+dashboard data. Keep the server running only while needed and do not expose it
+through a proxy or tunnel. State-changing actions still require an exact Host
+and same-origin request. The server validates the same task schema as the CLI,
+retains its last valid snapshot if the log becomes invalid, and never writes
+dispatcher-workspace files. It limits event
 streams and disconnects slow clients instead of buffering snapshots without
 bound. It watches the workspace directory
 so TaskChef's atomic log replacement remains visible, uses a low-frequency file

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "taskchef",
-  "version": "5.11.1",
+  "version": "5.11.2",
   "description": "A non-blocking interactive dispatcher for visible Codex tasks.",
   "license": "MIT",
   "author": "Favo Yang",

package/src/dashboard.js

@@ -1,4 +1,3 @@
-import { randomBytes } from "node:crypto";
 import { EventEmitter } from "node:events";
 import { constants, watch } from "node:fs";
 import { open, readFile, realpath, stat } from "node:fs/promises";
@@ -383,14 +382,6 @@ export function createSseClient(response, {
   return client;
 }
 
-function requestSessionCookie(request, cookieName) {
-  return request.headers.cookie
-    ?.split(";")
-    .map((part) => part.trim())
-    .find((part) => part.startsWith(`${cookieName}=`))
-    ?.slice(cookieName.length + 1) ?? null;
-}
-
 function publicMonitorError() {
   return {
     message: "The task log is temporarily unavailable. Showing the last valid snapshot.",
@@ -418,10 +409,6 @@ export async function createDashboardServer({
   const monitor = new DashboardMonitor(workspace, monitorOptions);
   await monitor.start();
   const clients = new Set();
-  const capabilityToken = randomBytes(32).toString("base64url");
-  let launchToken = capabilityToken;
-  const sessionToken = randomBytes(32).toString("base64url");
-  const sessionCookieName = `taskchef_session_${randomBytes(12).toString("hex")}`;
   let allowedAuthority;
   let allowedOrigin;
 
@@ -447,26 +434,6 @@ export async function createDashboardServer({
       sendJson(response, 421, { message: "Misdirected request." });
       return;
     }
-    const authenticated = requestSessionCookie(request, sessionCookieName) === sessionToken;
-    if (
-      (method === "GET" || method === "HEAD")
-      && launchToken !== null
-      && url.pathname === "/"
-      && url.searchParams.get("token") === launchToken
-    ) {
-      launchToken = null;
-      response.writeHead(303, {
-        ...securityHeaders("text/plain; charset=utf-8"),
-        Location: "/",
-        "Set-Cookie": `${sessionCookieName}=${sessionToken}; HttpOnly; SameSite=Strict; Path=/`,
-      });
-      response.end("Opening TaskChef dashboard.\n");
-      return;
-    }
-    if (!authenticated) {
-      sendJson(response, 401, { message: "Dashboard launch capability required." });
-      return;
-    }
     if (method !== "GET" && method !== "HEAD" && method !== "POST") {
       response.writeHead(405, { Allow: "GET, HEAD, POST" });
       response.end();
@@ -514,7 +481,7 @@ export async function createDashboardServer({
     const taskMatch = url.pathname.match(/^\/api\/tasks\/([a-zA-Z0-9._-]+)\/open-codex$/);
     if (taskMatch && method === "POST") {
       if (request.headers.origin !== allowedOrigin) {
-        sendJson(response, 403, { message: "Dashboard session validation failed." });
+        sendJson(response, 403, { message: "Dashboard origin validation failed." });
         return;
       }
       const task = monitor.tasks.find((candidate) => candidate.id === taskMatch[1]);
@@ -600,7 +567,7 @@ export async function createDashboardServer({
     host,
     port: boundPort,
     origin: allowedOrigin,
-    url: `${allowedOrigin}/?token=${encodeURIComponent(capabilityToken)}`,
+    url: `${allowedOrigin}/`,
     monitor,
     get eventClientCount() { return clients.size; },
     async close() {