bernstein 3.8.0__tar.gz → 3.8.2__tar.gz

{bernstein-3.8.0 → bernstein-3.8.2}/.clusterfuzzlite/Dockerfile

@@ -10,7 +10,7 @@
 # property-test suite in tests/ remains the primary fuzzing surface
 # for the rest of bernstein's input handling.
 # Ref: https://google.github.io/clusterfuzzlite/build-integration/python-lang/
-FROM gcr.io/oss-fuzz-base/base-builder-python@sha256:a5e01ec9a7fb6004fd6f5df7cdc5e5ca9d732a48f4b0e34b1d1fe91fe5c9a018
+FROM gcr.io/oss-fuzz-base/base-builder-python@sha256:d4ef5a787f3e1a420721da74823202185dc04e2e792984671c31a67d7ce66832
 
 COPY . /src/bernstein
 WORKDIR /src/bernstein

bernstein-3.8.2/.coverage-baseline.json

@@ -0,0 +1,5 @@
+{
+  "diff_coverage_floor_percent": 85,
+  "total_coverage_percent": 81.49,
+  "updated_at": "2026-07-20T06:11:48+00:00"
+}

{bernstein-3.8.0 → bernstein-3.8.2}/.plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "bernstein",
-  "version": "3.8.0",
+  "version": "3.8.2",
   "description": "Multi-agent orchestration for CLI coding agents. Spawn parallel agents, verify their work, and merge results.",
   "author": {
     "name": "chernistry",

{bernstein-3.8.0 → bernstein-3.8.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bernstein
-Version: 3.8.0
+Version: 3.8.2
 Summary: Deterministic, verifiable orchestration for CLI coding agents (Claude Code, Codex, Gemini CLI, and 40+ more): reproducible parallel runs in git worktrees, always-on lineage and replay journal, opt-in HMAC-chained audit log, air-gap install profile.
 Project-URL: Homepage, https://bernstein.run
 Project-URL: Documentation, https://bernstein.readthedocs.io
@@ -50,6 +50,7 @@ Requires-Dist: openai>=2.36.0
 Requires-Dist: opentelemetry-api>=1.41.1
 Requires-Dist: opentelemetry-exporter-otlp>=1.41.1
 Requires-Dist: opentelemetry-sdk>=1.41.1
+Requires-Dist: packaging>=24
 Requires-Dist: pillow>=12.3.0
 Requires-Dist: pluggy>=1.5
 Requires-Dist: prometheus-client>=0.21

{bernstein-3.8.0 → bernstein-3.8.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "bernstein"
-version = "3.8.0"
+version = "3.8.2"
 description = "Deterministic, verifiable orchestration for CLI coding agents (Claude Code, Codex, Gemini CLI, and 40+ more): reproducible parallel runs in git worktrees, always-on lineage and replay journal, opt-in HMAC-chained audit log, air-gap install profile."
 readme = "README.md"
 requires-python = ">=3.12"
@@ -118,6 +118,15 @@ dependencies = [
     # stay above the CVE-2026-45409 floor regardless of which transitive
     # owner resolves first; pip-audit gates the production closure on this.
     "idna>=3.15",
+    # PEP 440 version parsing/comparison. Imported directly at runtime by the
+    # ``bernstein doctor`` last-green advisory (``cli/commands/doctor_cmd.py``)
+    # and the adapter security-floor / advisory gates
+    # (``adapters/security_floor.py``, ``adapters/advisories.py``). Only ever
+    # pulled into the lockfile transitively by dev/test tooling (pytest,
+    # pip-audit, e2b, ...), so a clean ``uv tool install`` shipped without it
+    # and ``bernstein doctor`` crashed with ModuleNotFoundError. Promoted to a
+    # direct dependency so the resolver always installs it. Pure-Python.
+    "packaging>=24",
 ]
 
 [project.urls]

{bernstein-3.8.0 → bernstein-3.8.2}/server.json

@@ -6,19 +6,19 @@
     "url": "https://github.com/sipyourdrink-ltd/bernstein",
     "source": "github"
   },
-  "version": "3.8.0",
+  "version": "3.8.2",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "bernstein",
-      "version": "3.8.0",
+      "version": "3.8.2",
       "transport": {
         "type": "stdio"
       }
     },
     {
       "registryType": "oci",
-      "identifier": "ghcr.io/sipyourdrink-ltd/bernstein:3.8.0",
+      "identifier": "ghcr.io/sipyourdrink-ltd/bernstein:3.8.2",
       "transport": {
         "type": "stdio"
       }

{bernstein-3.8.0 → bernstein-3.8.2}/src/bernstein/cli/display/splash.py

@@ -28,6 +28,46 @@ def _detect_terminal_width(console: Console) -> int:
         return 80
 
 
+def _block_logo_lines() -> list[str]:
+    """The multi-line block-art BERNSTEIN logo, or ``[]`` when unavailable.
+
+    Reuses the same packaged asset the premium splash renders so both tiers
+    show the identical wordmark. ``_load_logo`` returns a single-line text
+    fallback (``["  BERNSTEIN"]``) when the asset is missing; only the real
+    multi-line art is worth drawing here, so a shorter result yields ``[]``.
+    """
+    try:
+        from bernstein.cli.display.splash_v2 import _load_logo
+
+        lines = _load_logo()
+    except Exception:
+        return []
+    return lines if len(lines) > 1 else []
+
+
+def _print_block_logo(console: Console, width: int) -> None:
+    """Draw the block-art logo when the terminal can actually show it.
+
+    Gated on an interactive terminal wide enough to hold the art: non-TTY
+    output (CI logs, pipes) and narrow terminals keep the dense one-liner so
+    scrollback and captured logs stay compact.
+    """
+    if not console.is_terminal:
+        return
+    lines = _block_logo_lines()
+    if not lines:
+        return
+    logo_w = max(len(line) for line in lines)
+    if width < logo_w + 2:
+        return
+
+    from rich.text import Text
+
+    pad = max(0, (min(width, 80) - logo_w) // 2)
+    for line in lines:
+        console.print(Text(" " * pad + line, style="bold cyan"))
+
+
 def _print_agents_block(
     console: Console,
     agents: list[dict[str, Any]],
@@ -90,6 +130,7 @@ def splash(
 
     sep = f"[dim]{_SEP_CHAR}[/dim]" * min(56, width - 2)
     console.print(sep)
+    _print_block_logo(console, width)
     ver = f" v{version}" if version else ""
     console.print(f"  [bold blue]BERNSTEIN[/bold blue][dim]{ver}  declarative agent orchestration[/dim]")
     console.print(sep)

{bernstein-3.8.0 → bernstein-3.8.2}/src/bernstein/cli/display/splash_screen.py

@@ -660,7 +660,7 @@ def splash(
     budget: float = 0.0,
     task_count: int = 0,
     skip_animation: bool = False,
-) -> None:
+) -> bool:
     """Show the startup splash, falling back to compact on any error.
 
     The bare ``except Exception`` below is load-bearing: any renderer crash
@@ -668,6 +668,13 @@ def splash(
     where the premium splash silently turns into the compact one (the
     "where is my banner" class of bug).  Set ``BERNSTEIN_DEBUG_SPLASH=1``
     to surface the underlying error to stderr instead of swallowing it.
+
+    Returns ``True`` when a banner was emitted (premium or compact fallback)
+    and ``False`` when the splash is disabled (``visual.splash=false`` /
+    ``BERNSTEIN_NO_SPLASH``) so nothing was rendered.  The bare ``cli()``
+    entry point uses this to decide whether the durable box banner still
+    needs printing -- a disabled splash must not leave the operator with no
+    startup banner at all.
     """
     try:
         from pathlib import Path
@@ -687,7 +694,7 @@ def splash(
         else:
             config = resolve_visual_config(None)
 
-        render_startup_splash(
+        return render_startup_splash(
             console,
             version=version,
             agents=agents,
@@ -719,3 +726,5 @@ def splash(
             budget=budget,
             task_count=task_count,
         )
+        # The compact fallback emitted a banner, so report success.
+        return True

{bernstein-3.8.0 → bernstein-3.8.2}/src/bernstein/cli/display/splash_v2.py

@@ -73,9 +73,17 @@ class SplashRenderer:
         self._skip = skip_animation
         self._config = config or VisualConfig()
 
-    def render(self, context: SplashContext | None = None) -> None:
+    def render(self, context: SplashContext | None = None) -> bool:
+        """Render the startup splash.
+
+        Returns ``True`` when a banner was actually emitted, ``False`` when
+        the splash is disabled (``visual.splash=false`` / ``BERNSTEIN_NO_SPLASH``)
+        and nothing was written. Callers use the return value to decide whether
+        a durable fallback banner still needs printing, so a disabled splash
+        does not silently leave the user with no startup banner at all.
+        """
         if not self._config.splash:
-            return
+            return False
         ctx = context or SplashContext()
         tier = self._select_tier()
         if self._skip or os.environ.get("CI"):
@@ -86,6 +94,7 @@ class SplashRenderer:
             self._render_tier2(ctx)
         else:
             self._render_tier3(ctx)
+        return True
 
     def _select_tier(self) -> str:
         if self._config.splash_tier != "auto":
@@ -275,10 +284,15 @@ def render_startup_splash(
     task_count: int = 0,
     skip_animation: bool = False,
     config: VisualConfig | None = None,
-) -> None:
-    """Compatibility entrypoint for main.py and splash_screen.py."""
+) -> bool:
+    """Compatibility entrypoint for main.py and splash_screen.py.
+
+    Returns ``True`` when a banner was emitted and ``False`` when the splash
+    is disabled (nothing rendered), so the caller can fall back to the
+    durable box banner instead of showing no startup banner at all.
+    """
     renderer = SplashRenderer(console, skip_animation=skip_animation, config=config)
-    renderer.render(
+    return renderer.render(
         SplashContext(
             version=version,
             agents=[a.copy() for a in (agents or [])],

{bernstein-3.8.0 → bernstein-3.8.2}/src/bernstein/cli/helpers.py

@@ -74,6 +74,29 @@ def print_banner() -> None:
     console.print(f"[blue]{BANNER}[/blue]")
 
 
+def print_startup_banner() -> None:
+    """Show the program-load banner: the block-art ASCII wordmark on an
+    interactive terminal, the compact box banner otherwise.
+
+    The compact splash renders the full block-art logo on a real TTY; on
+    non-interactive output (CI, pipes, captured test output) it collapses to a
+    dense one-liner, so we fall through to the box banner there. That keeps CI
+    logs terse and preserves the ``Agent Orchestra`` marker the run-banner
+    regression guard asserts, while interactive operators get the wordmark back
+    at ``bernstein run`` time (the premium splash only fires on the bare
+    ``bernstein`` invocation).
+    """
+    if console.is_terminal:
+        try:
+            from bernstein.cli.display.splash import splash as _compact_splash
+
+            _compact_splash(console, skip_animation=True)
+            return
+        except Exception:
+            pass
+    print_banner()
+
+
 def auth_headers() -> dict[str, str]:
     """Return Authorization header dict if BERNSTEIN_AUTH_TOKEN is set."""
     token = os.environ.get("BERNSTEIN_AUTH_TOKEN")

{bernstein-3.8.0 → bernstein-3.8.2}/src/bernstein/cli/main.py

@@ -779,7 +779,7 @@ def cli(
     _splash_future = executor.submit(_background_startup, workdir)
 
     # Show splash immediately (gradient + logo) - no agent data needed for visuals.
-    splash(
+    banner_shown = splash(
         console,
         version="",
         agents=[],
@@ -788,9 +788,15 @@ def cli(
         budget=budget,
         task_count=0,
     )
-    # Mark that the premium splash has been shown so the inner ``run`` callback
-    # invoked below does not also print the compact banner (double-banner).
-    ctx.obj["_BANNER_PRINTED"] = True
+    # Mark that a startup banner has already been shown so the inner ``run``
+    # callback invoked below does not also print the compact box banner
+    # (double-banner). When the splash is disabled (``visual.splash=false`` /
+    # ``BERNSTEIN_NO_SPLASH``) it renders nothing and returns ``False`` -- in
+    # that case we must leave the flag unset so the durable box banner still
+    # prints. Otherwise the bare ``bernstein`` invocation showed no startup
+    # banner at all while ``bernstein run`` still did (regression).
+    if banner_shown:
+        ctx.obj["_BANNER_PRINTED"] = True
 
     # Show immediate feedback while background finishes - no black screen.
     console.print("[dim]Preparing...[/dim]", end="\r")

{bernstein-3.8.0 → bernstein-3.8.2}/src/bernstein/cli/run_bootstrap.py

@@ -25,6 +25,7 @@ from bernstein.cli.helpers import (
     console,
     find_seed_file,
     print_banner,
+    print_startup_banner,
     server_get,
 )
 from bernstein.cli.run_preflight import (
@@ -1708,7 +1709,7 @@ def _run_impl(
     # for subcommand invocations, so `bernstein run` lost the banner entirely.
     ctx = click.get_current_context(silent=True)
     if ctx is None or not (ctx.obj and ctx.obj.get("_BANNER_PRINTED")):
-        print_banner()
+        print_startup_banner()
 
     # Set process title so orchestrator is visible in Activity Monitor / ps
     with suppress(ImportError):

{bernstein-3.8.0 → bernstein-3.8.2}/src/bernstein/core/config/seed_config.py

@@ -22,14 +22,29 @@ from bernstein.core.models import (
 
 logger = logging.getLogger(__name__)
 
+#: Preflight hints already surfaced this process, so repeated seed parses
+#: (bootstrap, ``create_app`` CORS read, the app-startup seed reload) do not
+#: re-log the same notice. ``bernstein gui serve`` parses the seed twice, which
+#: used to print the internal-LLM notice twice; dedupe on the hint text.
+_emitted_internal_llm_hints: set[str] = set()
+
+
+def reset_internal_llm_preflight_cache() -> None:
+    """Clear the per-process preflight-dedup memory (test helper)."""
+    _emitted_internal_llm_hints.clear()
+
 
 def check_internal_llm_preflight(provider: str) -> str | None:
-    """Return a migration hint if ``provider`` needs env vars that are missing.
+    """Return a heads-up if ``provider`` needs env vars that are missing.
 
-    a fresh clone with ``internal_llm_provider: openrouter_free``
-    but no ``OPENROUTER_API_KEY_FREE`` / ``OPENROUTER_API_KEY_PAID`` crashes
-    on the first LLM call. Callers (seed parser, orchestrator bootstrap) can
-    invoke this to emit the hint early and suggest switching to ``'none'``.
+    A fresh clone with ``internal_llm_provider: openrouter_free`` but no
+    ``OPENROUTER_API_KEY_FREE`` / ``OPENROUTER_API_KEY_PAID`` cannot reach the
+    internal model, so evolution and auto_decompose stay unavailable. Callers
+    (seed parser, orchestrator bootstrap) can invoke this to surface the notice
+    early and suggest switching to ``'none'``.
+
+    This function is pure -- it never logs. Use
+    :func:`warn_internal_llm_preflight_once` for the deduped emission.
 
     Args:
         provider: The configured ``internal_llm_provider`` value.
@@ -41,15 +56,34 @@ def check_internal_llm_preflight(provider: str) -> str | None:
         os.environ.get("OPENROUTER_API_KEY_FREE") or os.environ.get("OPENROUTER_API_KEY_PAID")
     ):
         return (
-            "internal_llm_provider='openrouter_free' requires "
-            "OPENROUTER_API_KEY_FREE or OPENROUTER_API_KEY_PAID in the "
-            "environment. Either export one of those variables or set "
-            "'internal_llm_provider: none' in bernstein.yaml to disable "
-            "evolution and auto_decompose gracefully."
+            "internal_llm_provider is set to 'openrouter_free' but neither "
+            "OPENROUTER_API_KEY_FREE nor OPENROUTER_API_KEY_PAID is set. "
+            "Evolution and auto_decompose stay disabled until you export one "
+            "of those keys, or set 'internal_llm_provider: none' in "
+            "bernstein.yaml to run without them."
         )
     return None
 
 
+def warn_internal_llm_preflight_once(provider: str) -> str | None:
+    """Log the internal-LLM preflight notice at most once per process.
+
+    The seed is parsed several times per process, and each ``SeedConfig``
+    construction used to log the notice -- so ``bernstein gui serve`` emitted
+    it twice (once when ``create_app`` reads CORS, once during the
+    app-startup seed reload). Dedupe on the hint text so the operator sees it
+    at most once. Returns the hint (whether or not it was newly logged) so
+    callers can still react to it.
+    """
+    hint = check_internal_llm_preflight(provider)
+    if hint is None:
+        return None
+    if hint not in _emitted_internal_llm_hints:
+        _emitted_internal_llm_hints.add(hint)
+        logger.warning("preflight: %s", hint)
+    return hint
+
+
 if TYPE_CHECKING:
     from bernstein.agents.catalog import CatalogRegistry
     from bernstein.core.compliance import ComplianceConfig
@@ -421,7 +455,5 @@ class SeedConfig:
     mcp_signing_mode: Literal["warn", "strict", "off"] = "warn"
 
     def __post_init__(self) -> None:
-        """Emit preflight warnings for provider/env mismatches."""
-        hint = check_internal_llm_preflight(self.internal_llm_provider)
-        if hint is not None:
-            logger.warning(" preflight: %s", hint)
+        """Emit preflight warnings for provider/env mismatches (once/process)."""
+        warn_internal_llm_preflight_once(self.internal_llm_provider)

{bernstein-3.8.0 → bernstein-3.8.2}/src/bernstein/core/orchestration/orchestrator.py

@@ -5238,6 +5238,35 @@ def _collect_smtp_targets(seed: Any, targets: list[NotificationTarget]) -> None:
     )
 
 
+def _resolve_spawner_adapter_name(
+    explicit_adapter: str | None,
+    seed_cli: str | None,
+) -> str | None:
+    """Resolve the orchestrator's adapter with explicit-override precedence.
+
+    An adapter supplied out-of-band -- the ``--adapter`` flag or the
+    ``BERNSTEIN_ADAPTER`` env var, both surfaced here as ``explicit_adapter``
+    -- always wins over the seed's ``cli`` field. The seed value is only a
+    fallback for when no adapter was passed explicitly.
+
+    This mirrors the run-model precedence (``args.model or seed.model``) and
+    is load-bearing for ``bernstein run --idle``: that mode exports
+    ``BERNSTEIN_ADAPTER=mock`` precisely so the orchestrator never spawns real
+    Claude agents (and burns tokens / 401s) when the resolved
+    ``bernstein.yaml`` leaves ``cli`` at its ``auto`` default. Letting the
+    seed's ``cli`` clobber an explicit adapter silently defeats that contract.
+
+    Returns ``None`` only when neither source configured an adapter, which the
+    caller treats as a fatal misconfiguration (Bernstein never defaults to
+    Claude).
+    """
+    explicit = (explicit_adapter or "").strip()
+    if explicit:
+        return explicit
+    seed_value = (seed_cli or "").strip()
+    return seed_value or None
+
+
 if __name__ == "__main__":
     import argparse
     import sys
@@ -5387,7 +5416,12 @@ if __name__ == "__main__":
             )
             try:
                 seed = parse_seed(seed_path)
-                adapter_name = getattr(seed, "cli", adapter_name)
+                # An explicit --adapter / BERNSTEIN_ADAPTER wins over the
+                # seed's ``cli`` (which defaults to ``auto``); the seed value
+                # is only a fallback. Without this, ``bernstein run --idle``
+                # (which exports BERNSTEIN_ADAPTER=mock) is silently overridden
+                # by the seed default and spawns real Claude agents.
+                adapter_name = _resolve_spawner_adapter_name(args.adapter, getattr(seed, "cli", None))
                 _seed_role_model_policy = getattr(seed, "role_model_policy", None)
                 if not _seed_role_model_policy:
                     print(

{bernstein-3.8.0 → bernstein-3.8.2}/src/bernstein/gui/cli.py

@@ -207,6 +207,126 @@ def _enforce_dashboard_posture(host: str, workdir: Path) -> None:
     )
 
 
+def _effective_api_token() -> str:
+    """Return the bearer the SPA must present to the SSO-gated ``/api/v1`` surface.
+
+    Mirrors :func:`bernstein.core.server.server_app.create_app`'s
+    ``effective_token`` resolution: on a bare local ``serve`` the only
+    operator-presentable credential the *general* API accepts is
+    ``BERNSTEIN_AUTH_TOKEN``. (SSO JWTs and per-agent identity JWTs are not
+    hand-issued, and a #2366 dashboard scoped token only unlocks the
+    ``/api/v1/dashboard/*`` mirror - not the ``/api/v1/agents`` /
+    ``/api/v1/tasks`` routes the SPA's panels poll.) Returns an empty string
+    when unset.
+    """
+    return os.environ.get("BERNSTEIN_AUTH_TOKEN", "").strip()
+
+
+def _ensure_loopback_api_token(host: str) -> str | None:
+    """Mint + export an ephemeral operator bearer on an unconfigured loopback bind.
+
+    Closes the local-dashboard lockout: the SPA's data panels poll the
+    SSO-gated *general* API (``/api/v1/agents`` / ``/api/v1/tasks`` / ...),
+    which accepts only the process ``BERNSTEIN_AUTH_TOKEN`` bearer. A #2366
+    dashboard scoped token (or ``BERNSTEIN_DASHBOARD_PASSWORD``) unlocks the
+    ``/api/v1/dashboard/*`` mirror but *not* those general routes, so an
+    operator who configured dashboard auth yet left ``BERNSTEIN_AUTH_TOKEN``
+    unset hit a 401 wall on every panel.
+
+    On a loopback bind with no bearer supplied, this mints a fresh URL-safe
+    token (the same primitive the tunnel onboarding uses), exports it into
+    ``BERNSTEIN_AUTH_TOKEN`` so a subsequent :func:`create_app` resolves it as
+    the general-API bearer, and returns it so the caller can seed the operator's
+    own browser with the identical token. The token is a standalone process
+    credential - it is deliberately *not* written to the #2366 dashboard token
+    journal, so an already-configured install's signed grant count is untouched.
+
+    Posture is preserved, not weakened:
+
+    * A **non-loopback** bind never auto-mints (returns ``None``) - a routable
+      interface still refuses to start without operator-configured auth
+      (enforced upstream in :func:`_enforce_dashboard_posture`), and a bearer
+      is never conjured for it.
+    * When ``BERNSTEIN_AUTH_TOKEN`` is **already supplied**, it is respected
+      verbatim (returns ``None``; no fresh mint).
+    * When auth is **explicitly disabled** (``BERNSTEIN_AUTH_DISABLED``) there
+      is no gate to satisfy, so nothing is minted (returns ``None``).
+
+    Args:
+        host: Bind host the server is about to listen on.
+
+    Returns:
+        The freshly minted bearer when one was exported, else ``None``.
+    """
+    from bernstein.core.security.auth_middleware import auth_disabled_via_opt_out
+    from bernstein.core.server.dashboard_tokens import is_loopback_host
+    from bernstein.gui import pwa
+
+    if not is_loopback_host(host):
+        return None
+    if _effective_api_token():
+        return None
+    if auth_disabled_via_opt_out():
+        return None
+    token = pwa.new_auth_token()
+    os.environ["BERNSTEIN_AUTH_TOKEN"] = token
+    return token
+
+
+def _resolve_local_open_url(*, host: str, port: int, echo: Callable[[str], object] | None = None) -> str:
+    """Choose the URL the local (non-tunnel) browser auto-open should target.
+
+    The bug this closes: a bare ``bernstein gui serve`` on loopback opened
+    ``/ui/`` with no credential, so the SPA shell loaded (200) but every
+    ``/api/v1`` XHR 401'd - the operator had no in-browser way to authenticate.
+
+    When an API bearer is present (``BERNSTEIN_AUTH_TOKEN`` - operator-supplied,
+    or minted for this loopback serve by :func:`_ensure_loopback_api_token`) and
+    the bind is loopback, the SPA is seeded through the existing onboarding-
+    fragment mechanism (:func:`bernstein.gui.pwa.compose_onboarding_url`) so its
+    XHRs carry the bearer and stop 401-ing. The token is used verbatim, and it
+    travels only in the opened browser's URL fragment (which the SPA scrubs from
+    the address bar after capture); the console URL printed above stays bare, so
+    the token never lands in a terminal log or an access log. A short positive
+    line confirms the browser was authenticated automatically.
+
+    When no token is present the bare ``/ui/`` URL is returned together with an
+    operator hint - this path is now reached only on a routable bind or when
+    auth is explicitly disabled, since loopback binds auto-mint a bearer
+    upstream. Posture is untouched either way - this only changes which URL the
+    operator's own browser is pointed at; an external, tokenless request still
+    401s at the auth middleware exactly as before.
+
+    Args:
+        host: Bind host the server is listening on.
+        port: Bind port.
+        echo: Sink for the operator hint (defaults to :func:`click.echo`).
+
+    Returns:
+        The URL the browser should open: seeded with ``#t=<token>`` on a
+        configured loopback bind, otherwise the bare ``/ui/`` URL.
+    """
+    from bernstein.core.server.dashboard_tokens import is_loopback_host
+    from bernstein.gui import pwa
+
+    emit = echo if echo is not None else click.echo
+    local_url = f"http://{host}:{port}/ui/"
+    token = _effective_api_token()
+    if token and is_loopback_host(host):
+        # Reuse the onboarding fragment the SPA already parses on boot so the
+        # bearer reaches localStorage without a new login surface.
+        emit(f"Dashboard ready at {local_url} (browser authenticated automatically).")
+        return pwa.compose_onboarding_url(f"http://{host}:{port}", token)
+    if not token:
+        emit(
+            "Dashboard data panels call the authenticated /api/v1 surface. "
+            "Set BERNSTEIN_AUTH_TOKEN before `gui serve` so the browser can "
+            "authenticate (or BERNSTEIN_AUTH_DISABLED=1 for a dev-only open "
+            "bind); otherwise the panels will show an auth error."
+        )
+    return local_url
+
+
 # ---------------------------------------------------------------------------
 # Click surface
 # ---------------------------------------------------------------------------
@@ -290,6 +410,18 @@ def serve(
     # operator token issued and printed once.
     _enforce_dashboard_posture(host, Path.cwd())
 
+    # We auto-open (and seed) the operator's own browser only on a plain local
+    # serve - never with --no-open / --dev / --tunnel, which have their own
+    # onboarding story. The loopback bearer mint is coupled to that path: an
+    # auto-minted token is only useful when it is actually delivered to a
+    # browser via the opened URL, so mint only when we will open one. Export it
+    # BEFORE create_app() so the general /api/v1 surface the SPA's panels poll
+    # accepts it; _resolve_local_open_url below seeds the identical token into
+    # the opened URL. No-op on routable binds and when a bearer already exists.
+    auto_open = not no_open and not dev and not tunnel
+    if auto_open:
+        _ensure_loopback_api_token(host)
+
     if minimal:
         app = FastAPI(title="Bernstein", description="Operator GUI (minimal)")
     else:
@@ -335,11 +467,14 @@ def serve(
         click.echo(f"Tunnel ({handle.provider}) up: {handle.public_url}")
         _print_onboarding(onboarding_url, issue.passphrase)
 
-    if not no_open and not dev and not tunnel:
+    if auto_open:
+        # Seed the SPA on loopback so its /api/v1 XHRs authenticate; the token
+        # rides the browser URL fragment only, never the console URL above.
+        open_url = _resolve_local_open_url(host=host, port=port)
         with contextlib.suppress(Exception):
             import webbrowser
 
-            webbrowser.open(local_url)
+            webbrowser.open(open_url)
 
     try:
         uvicorn.run(app, host=host, port=port, log_level="info")