codecortex 0.4.0__tar.gz → 0.6.0__tar.gz

{codecortex-0.4.0/src/codecortex.egg-info → codecortex-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codecortex
-Version: 0.4.0
+Version: 0.6.0
 Summary: Local-first, MCP-native code-intelligence server — graph, LSP, and semantic search behind one safe code.query tool for coding agents.
 Author: Shammai Hamilton
 License-Expression: MIT
@@ -189,6 +189,7 @@ Full system docs live in [`docs/`](docs/) — start with the index:
 | `codeintel doctor [project_root] [--deep] [--json]` | Diagnose per-engine health + repo index status, with a fix for each gap |
 | `codeintel map [project_root]` | Generate the `CODE_INTEL.md` orientation file |
 | `codeintel reset [project_root] [--all] [--yes]` | Clear the semantic index (this repo, or `--all`) to recover from a corrupt/stale DB |
+| `codeintel gen-token` | Print a secure random bearer token (for `serve-http` / RBAC `auth.toml`) |
 
 Human-facing commands (`doctor`, `status`, `query`, `setup`, `reset`) honor `--no-color` / `NO_COLOR` and `--ascii`, and auto-degrade to plain text when piped.
 
@@ -213,6 +214,7 @@ Config is **validated on load** — an out-of-range number, a misspelled enum, o
 | Variable | Effect |
 |---|---|
 | `CODEINTEL_HTTP_TOKEN` | Bearer token required by `serve-http` (equivalent to `--token`) |
+| `CODEINTEL_AUTH_CONFIG` | Path to an RBAC token→role config (default `~/.codeintel/auth.toml`) — per-token roles + op scopes |
 | `CODEINTEL_LOG_LEVEL` | `DEBUG`\|`INFO`\|`WARNING`(default)\|`ERROR` for the server logger |
 | `CODEINTEL_LOG_FORMAT=json` | Structured (JSON-per-line) logs for ELK / Splunk / Datadog |
 | `CODEINTEL_HTTP_ACCESS_LOG=1` | One log line per HTTP request (method, path, status, latency) |
@@ -286,9 +288,9 @@ Running codeintel as a shared service? It ships with what ops teams expect:
 | `GET /readyz` | none | Readiness — `200` once the gateway is up (`readinessProbe`) |
 | `GET /metrics` | token | Prometheus exposition — request counts, latency, in-flight, build info |
 
-Plus **bearer-token auth**, **structured JSON logs** (`CODEINTEL_LOG_FORMAT=json`) with optional per-request access logs, **graceful `SIGTERM`** shutdown, a bounded connection pool, and a non-root **Dockerfile** with a healthcheck.
+Plus **bearer-token auth** — or **RBAC** (per-token roles + op scopes via `auth.toml`; a disallowed op returns `403`, and the role is server-authoritative so a client can't escalate) — **structured JSON logs** (`CODEINTEL_LOG_FORMAT=json`) with optional per-request access logs, **graceful `SIGTERM`** shutdown, a bounded connection pool, and a non-root **Dockerfile** with a healthcheck.
 
-**Full guide → [docs/deploy.md](docs/deploy.md)**: systemd, Docker / Compose, Kubernetes (liveness + readiness probes, token from a Secret), reverse-proxy TLS, a Prometheus scrape config, and a security checklist.
+**Full guide → [docs/deploy.md](docs/deploy.md)**: systemd, Docker / Compose, Kubernetes (liveness + readiness probes, token from a Secret), reverse-proxy TLS, **RBAC + SSO-via-auth-proxy**, a Prometheus scrape config, and a security checklist.
 
 ```bash
 docker build -t codeintel . && docker run -p 127.0.0.1:8766:8766 \

{codecortex-0.4.0 → codecortex-0.6.0}/README.md

@@ -156,6 +156,7 @@ Full system docs live in [`docs/`](docs/) — start with the index:
 | `codeintel doctor [project_root] [--deep] [--json]` | Diagnose per-engine health + repo index status, with a fix for each gap |
 | `codeintel map [project_root]` | Generate the `CODE_INTEL.md` orientation file |
 | `codeintel reset [project_root] [--all] [--yes]` | Clear the semantic index (this repo, or `--all`) to recover from a corrupt/stale DB |
+| `codeintel gen-token` | Print a secure random bearer token (for `serve-http` / RBAC `auth.toml`) |
 
 Human-facing commands (`doctor`, `status`, `query`, `setup`, `reset`) honor `--no-color` / `NO_COLOR` and `--ascii`, and auto-degrade to plain text when piped.
 
@@ -180,6 +181,7 @@ Config is **validated on load** — an out-of-range number, a misspelled enum, o
 | Variable | Effect |
 |---|---|
 | `CODEINTEL_HTTP_TOKEN` | Bearer token required by `serve-http` (equivalent to `--token`) |
+| `CODEINTEL_AUTH_CONFIG` | Path to an RBAC token→role config (default `~/.codeintel/auth.toml`) — per-token roles + op scopes |
 | `CODEINTEL_LOG_LEVEL` | `DEBUG`\|`INFO`\|`WARNING`(default)\|`ERROR` for the server logger |
 | `CODEINTEL_LOG_FORMAT=json` | Structured (JSON-per-line) logs for ELK / Splunk / Datadog |
 | `CODEINTEL_HTTP_ACCESS_LOG=1` | One log line per HTTP request (method, path, status, latency) |
@@ -253,9 +255,9 @@ Running codeintel as a shared service? It ships with what ops teams expect:
 | `GET /readyz` | none | Readiness — `200` once the gateway is up (`readinessProbe`) |
 | `GET /metrics` | token | Prometheus exposition — request counts, latency, in-flight, build info |
 
-Plus **bearer-token auth**, **structured JSON logs** (`CODEINTEL_LOG_FORMAT=json`) with optional per-request access logs, **graceful `SIGTERM`** shutdown, a bounded connection pool, and a non-root **Dockerfile** with a healthcheck.
+Plus **bearer-token auth** — or **RBAC** (per-token roles + op scopes via `auth.toml`; a disallowed op returns `403`, and the role is server-authoritative so a client can't escalate) — **structured JSON logs** (`CODEINTEL_LOG_FORMAT=json`) with optional per-request access logs, **graceful `SIGTERM`** shutdown, a bounded connection pool, and a non-root **Dockerfile** with a healthcheck.
 
-**Full guide → [docs/deploy.md](docs/deploy.md)**: systemd, Docker / Compose, Kubernetes (liveness + readiness probes, token from a Secret), reverse-proxy TLS, a Prometheus scrape config, and a security checklist.
+**Full guide → [docs/deploy.md](docs/deploy.md)**: systemd, Docker / Compose, Kubernetes (liveness + readiness probes, token from a Secret), reverse-proxy TLS, **RBAC + SSO-via-auth-proxy**, a Prometheus scrape config, and a security checklist.
 
 ```bash
 docker build -t codeintel . && docker run -p 127.0.0.1:8766:8766 \

{codecortex-0.4.0 → codecortex-0.6.0/src/codecortex.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codecortex
-Version: 0.4.0
+Version: 0.6.0
 Summary: Local-first, MCP-native code-intelligence server — graph, LSP, and semantic search behind one safe code.query tool for coding agents.
 Author: Shammai Hamilton
 License-Expression: MIT
@@ -189,6 +189,7 @@ Full system docs live in [`docs/`](docs/) — start with the index:
 | `codeintel doctor [project_root] [--deep] [--json]` | Diagnose per-engine health + repo index status, with a fix for each gap |
 | `codeintel map [project_root]` | Generate the `CODE_INTEL.md` orientation file |
 | `codeintel reset [project_root] [--all] [--yes]` | Clear the semantic index (this repo, or `--all`) to recover from a corrupt/stale DB |
+| `codeintel gen-token` | Print a secure random bearer token (for `serve-http` / RBAC `auth.toml`) |
 
 Human-facing commands (`doctor`, `status`, `query`, `setup`, `reset`) honor `--no-color` / `NO_COLOR` and `--ascii`, and auto-degrade to plain text when piped.
 
@@ -213,6 +214,7 @@ Config is **validated on load** — an out-of-range number, a misspelled enum, o
 | Variable | Effect |
 |---|---|
 | `CODEINTEL_HTTP_TOKEN` | Bearer token required by `serve-http` (equivalent to `--token`) |
+| `CODEINTEL_AUTH_CONFIG` | Path to an RBAC token→role config (default `~/.codeintel/auth.toml`) — per-token roles + op scopes |
 | `CODEINTEL_LOG_LEVEL` | `DEBUG`\|`INFO`\|`WARNING`(default)\|`ERROR` for the server logger |
 | `CODEINTEL_LOG_FORMAT=json` | Structured (JSON-per-line) logs for ELK / Splunk / Datadog |
 | `CODEINTEL_HTTP_ACCESS_LOG=1` | One log line per HTTP request (method, path, status, latency) |
@@ -286,9 +288,9 @@ Running codeintel as a shared service? It ships with what ops teams expect:
 | `GET /readyz` | none | Readiness — `200` once the gateway is up (`readinessProbe`) |
 | `GET /metrics` | token | Prometheus exposition — request counts, latency, in-flight, build info |
 
-Plus **bearer-token auth**, **structured JSON logs** (`CODEINTEL_LOG_FORMAT=json`) with optional per-request access logs, **graceful `SIGTERM`** shutdown, a bounded connection pool, and a non-root **Dockerfile** with a healthcheck.
+Plus **bearer-token auth** — or **RBAC** (per-token roles + op scopes via `auth.toml`; a disallowed op returns `403`, and the role is server-authoritative so a client can't escalate) — **structured JSON logs** (`CODEINTEL_LOG_FORMAT=json`) with optional per-request access logs, **graceful `SIGTERM`** shutdown, a bounded connection pool, and a non-root **Dockerfile** with a healthcheck.
 
-**Full guide → [docs/deploy.md](docs/deploy.md)**: systemd, Docker / Compose, Kubernetes (liveness + readiness probes, token from a Secret), reverse-proxy TLS, a Prometheus scrape config, and a security checklist.
+**Full guide → [docs/deploy.md](docs/deploy.md)**: systemd, Docker / Compose, Kubernetes (liveness + readiness probes, token from a Secret), reverse-proxy TLS, **RBAC + SSO-via-auth-proxy**, a Prometheus scrape config, and a security checklist.
 
 ```bash
 docker build -t codeintel . && docker run -p 127.0.0.1:8766:8766 \

{codecortex-0.4.0 → codecortex-0.6.0}/src/codecortex.egg-info/SOURCES.txt

@@ -9,6 +9,7 @@ src/codecortex.egg-info/requires.txt
 src/codecortex.egg-info/top_level.txt
 src/codeintel/__init__.py
 src/codeintel/__main__.py
+src/codeintel/auth.py
 src/codeintel/cache.py
 src/codeintel/config.py
 src/codeintel/doctor.py
@@ -35,6 +36,7 @@ src/codeintel/providers/lsp.py
 src/codeintel/providers/none.py
 src/codeintel/providers/semantic.py
 tests/test_cache.py
+tests/test_chunking.py
 tests/test_config.py
 tests/test_doctor.py
 tests/test_e2e.py
@@ -52,6 +54,7 @@ tests/test_lsp_real.py
 tests/test_mapper.py
 tests/test_never_raise.py
 tests/test_onboarding.py
+tests/test_rbac.py
 tests/test_reindexer.py
 tests/test_reset.py
 tests/test_semantic_provider.py

codecortex-0.6.0/src/codeintel/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.6.0"

{codecortex-0.4.0 → codecortex-0.6.0}/src/codeintel/__main__.py

@@ -90,6 +90,8 @@ def main() -> None:
     reset_parser.add_argument("--yes", "-y", action="store_true", help="Skip the confirmation prompt")
     reset_parser.add_argument("--json", action="store_true", help="Emit the structured JSON report")
 
+    subparsers.add_parser("gen-token", help="Print a secure random bearer token (for serve-http / RBAC auth.toml)")
+
     args = parser.parse_args()
 
     from codeintel import term
@@ -122,6 +124,7 @@ def main() -> None:
                 stride=int(cfg.get("stride", 10)),
                 max_chunks=int(cfg.get("max_chunks", 500)),
                 max_total_chunks=int(cfg.get("max_total_chunks", 100000)),
+                chunk_strategy=str(cfg.get("chunk_strategy", "syntax")),
             ).index(project_root)
             if count > 0:
                 print(f"Indexed {count} chunks")
@@ -355,6 +358,11 @@ def main() -> None:
 
         sys.exit(0 if any_ok else 1)
 
+    elif args.command == "gen-token":
+        import secrets
+        print(secrets.token_urlsafe(32))
+        sys.exit(0)
+
     else:
         parser.print_help()
         sys.exit(0)

codecortex-0.6.0/src/codeintel/auth.py

@@ -0,0 +1,120 @@
+"""Token→role authentication and RBAC for the HTTP transport.
+
+An optional auth config (``~/.codeintel/auth.toml`` or ``$CODEINTEL_AUTH_CONFIG``) maps bearer
+tokens to roles and roles to the operations they may run. The role is derived **server-side from
+the authenticated token** — a client can never escalate by claiming a role in the request body.
+
+Example ``auth.toml``::
+
+    [roles]
+    admin    = ["*"]                       # ["*"] (or omitted) = every op
+    reader   = ["search", "symbol", "overview", "callers", "callees", "impact", "chain", "context"]
+    searcher = ["search", "context"]
+
+    [tokens]                               # token = role  (store this file mode 0600)
+    "s3cret-admin-value"      = "admin"
+    "sha256:<hex-of-a-token>" = "reader"   # pre-hashed form, so plaintext need not be at rest
+
+SSO: put an OIDC auth proxy (e.g. oauth2-proxy) in front and have it present a per-role bearer
+token to codeintel — codeintel never speaks to the IdP itself (local-first, no per-query network).
+"""
+from __future__ import annotations
+
+import hashlib
+import logging
+import os
+import pathlib
+import tomllib  # stdlib on Python 3.11+ (the project's minimum)
+from typing import Dict, List, Optional
+
+from codeintel.policy import TieringPolicy
+
+logger = logging.getLogger("codeintel")
+
+_ALL = "*"
+_SHA_PREFIX = "sha256:"
+
+
+class TokenAuth:
+    """Resolves a bearer token to a role and builds the matching op policy. Tokens are held as
+    sha256 hashes; a presented token is hashed and looked up in O(1). Immutable; thread-safe."""
+
+    def __init__(self, token_hash_to_role: Dict[str, str], role_ops: Dict[str, List[str]]) -> None:
+        self._tokens = token_hash_to_role
+        self._role_ops = role_ops
+
+    @property
+    def enabled(self) -> bool:
+        return bool(self._tokens)
+
+    def role_for(self, presented_token: str) -> Optional[str]:
+        """The role for a presented token, or None if it isn't a known token."""
+        if not presented_token:
+            return None
+        h = hashlib.sha256(presented_token.encode("utf-8")).hexdigest()
+        return self._tokens.get(h)
+
+    def build_policy(self) -> TieringPolicy:
+        """A role with ops ``["*"]`` (or none) is unrestricted → omit it from the rules, since
+        TieringPolicy treats a role absent from its rules as full-access. Every other role maps to
+        its explicit op allowlist (an empty list = deny all ops, a fail-safe default)."""
+        rules: Dict[str, List[str]] = {}
+        for role, ops in self._role_ops.items():
+            if _ALL in ops:
+                continue  # unrestricted
+            rules[role] = list(ops)
+        return TieringPolicy(enabled=bool(rules), rules=rules)
+
+
+def _auth_config_path() -> Optional[pathlib.Path]:
+    env = os.environ.get("CODEINTEL_AUTH_CONFIG", "").strip()
+    if env:
+        p = pathlib.Path(env)
+        return p if p.is_file() else None
+    default = pathlib.Path.home() / ".codeintel" / "auth.toml"
+    return default if default.is_file() else None
+
+
+def load_auth() -> TokenAuth:
+    """Load the token→role config if present. Never raises — a missing or malformed file yields an
+    empty (disabled) TokenAuth, and the caller falls back to single-token / no-auth."""
+    path = _auth_config_path()
+    if path is None:
+        return TokenAuth({}, {})
+    try:
+        with path.open("rb") as fh:
+            data = tomllib.load(fh)
+    except Exception as exc:
+        logger.warning("auth: %s could not be parsed (%s) — RBAC is OFF", path, type(exc).__name__)
+        return TokenAuth({}, {})
+
+    raw_roles = data.get("roles") if isinstance(data.get("roles"), dict) else {}
+    role_ops: Dict[str, List[str]] = {}
+    for role, ops in raw_roles.items():
+        if isinstance(ops, list):
+            role_ops[str(role)] = [str(o) for o in ops]
+        else:
+            # Fail CLOSED: a non-list ops value (the missing-brackets typo `reader = "search"`) must
+            # never silently become full access — deny all ops for that role instead.
+            logger.warning("auth: role %r ops must be a list (got %r) — denying all ops for it", role, ops)
+            role_ops[str(role)] = []
+
+    raw_tokens = data.get("tokens") if isinstance(data.get("tokens"), dict) else {}
+    token_hash_to_role: Dict[str, str] = {}
+    for tok, role in raw_tokens.items():
+        role = str(role)
+        # A token mapped to an undefined role fails safe: define it as deny-all (empty op list).
+        if role not in role_ops:
+            role_ops[role] = []
+        tok = str(tok)
+        if tok[:len(_SHA_PREFIX)].lower() == _SHA_PREFIX:  # case-insensitive `sha256:` prefix
+            h = tok[len(_SHA_PREFIX):].strip().lower()
+        else:
+            h = hashlib.sha256(tok.encode("utf-8")).hexdigest()
+        if h:
+            token_hash_to_role[h] = role
+
+    if not token_hash_to_role:
+        logger.warning("auth: %s defines no usable [tokens] — RBAC is OFF (no token→role mapping)", path)
+
+    return TokenAuth(token_hash_to_role, role_ops)

{codecortex-0.4.0 → codecortex-0.6.0}/src/codeintel/config.py

@@ -24,6 +24,7 @@ _DEFAULTS: dict = {
     "max_total_chunks": 100000,  # safety ceiling on chunks embedded in one index pass
     "cosine_floor": 0.25,
     "model": "BAAI/bge-small-en-v1.5",
+    "chunk_strategy": "syntax",  # syntax-aware (def/class boundaries) vs fixed line windows
 }
 
 # Values restricted to a fixed set — anything else falls back to the default.
@@ -31,6 +32,7 @@ _ENUMS: dict = {
     "backend": {"auto", "graph", "lsp", "semantic"},
     "semantic": {"on", "off"},
     "reindex": {"on-demand", "never"},
+    "chunk_strategy": {"syntax", "lines"},
 }
 _POSITIVE_INTS = ("window", "stride", "max_chunks", "max_total_chunks")
 

{codecortex-0.4.0 → codecortex-0.6.0}/src/codeintel/gateway.py

@@ -132,6 +132,14 @@ class Gateway:
             log_swallowed(f"Gateway._dispatch_single[{engine_str}.{op_str}]", exc)
             return safe_null_result(op_str, target_str, engine=engine_str, reason="provider-error")
 
+    def allows(self, role: str, op: str) -> bool:
+        """Whether *role* may run *op* under the current policy (True when no policy is configured).
+        Lets non-query handlers (e.g. doctor) share the same RBAC gate as query()."""
+        try:
+            return self._policy is None or self._policy.is_allowed(role, op)
+        except Exception:
+            return True
+
     def query(
         self,
         op=None,
@@ -142,16 +150,25 @@ class Gateway:
         project_root=None,
     ) -> Result:
         try:
-            try:
-                self._reindexer.maybe_reindex(str(project_root or ""))
-            except Exception:
-                pass
-
             op_str = str(op or "")
             target_str = str(target or "")
             engine_str = str(engine or "").strip() or "auto"
             was_auto = engine_str == "auto"
 
+            # Policy check FIRST — a role denied for this op does NO work (no reindex, no dispatch,
+            # no cache lookup). Applies to the modern provider path; the legacy list path has none.
+            if (
+                self._legacy_providers is None
+                and self._policy is not None
+                and not self._policy.is_allowed(role, op_str)
+            ):
+                return safe_null_result(op_str, target_str, reason="op-not-allowed-for-role")
+
+            try:
+                self._reindexer.maybe_reindex(str(project_root or ""))
+            except Exception:
+                pass
+
             # Legacy list-based path (backward compat with pre-Phase-2 tests)
             if self._legacy_providers is not None:
                 for p in self._legacy_providers:
@@ -164,10 +181,6 @@ class Gateway:
                 reason = "engine-unavailable" if engine is not None else "no-result"
                 return safe_null_result(op_str, target_str, reason=reason)
 
-            # Policy check — before cache lookup
-            if self._policy is not None and not self._policy.is_allowed(role, op_str):
-                return safe_null_result(op_str, target_str, reason="op-not-allowed-for-role")
-
             # Unknown engine — reject immediately
             if engine_str not in _KNOWN_ENGINES:
                 return safe_null_result(op_str, target_str, reason="unknown-engine")

{codecortex-0.4.0 → codecortex-0.6.0}/src/codeintel/http_server.py

@@ -81,24 +81,30 @@ class _Handler(BaseHTTPRequestHandler):
         self.wfile.write(body)
         self._observe(status)
 
-    def _authorized(self) -> bool:
-        """When the server was started with a token, require ``Authorization: Bearer <token>``
-        (constant-time compare). No token configured → auth is disabled (the loopback default)."""
-        token = getattr(self.server, "auth_token", None)
-        if not token:
-            return True
+    def _bearer(self) -> str:
         header = self.headers.get("Authorization", "")
         prefix = "Bearer "
-        if not header.startswith(prefix):
-            return False
-        presented = header[len(prefix):].strip()
-        # Compare as UTF-8 bytes: hmac.compare_digest raises TypeError on a non-ASCII str, so a
-        # malformed header (e.g. `Bearer résumé`) would otherwise crash the handler thread. Encoding
-        # is always safe and keeps the comparison constant-time.
-        return hmac.compare_digest(presented.encode("utf-8"), token.encode("utf-8"))
+        return header[len(prefix):].strip() if header.startswith(prefix) else ""
+
+    def _resolve_role(self) -> tuple[bool, str]:
+        """Authenticate the request and return ``(authorized, role)``. The role is
+        **server-authoritative** — derived from the token, never from the request body. RBAC (a
+        token→role auth config) takes precedence; else a single shared token; else no auth (the
+        loopback default). Bytes-compare so a non-ASCII header can't crash ``hmac.compare_digest``."""
+        auth = getattr(self.server, "token_auth", None)
+        if auth is not None and auth.enabled:
+            role = auth.role_for(self._bearer())
+            return (role is not None, role or "")
+        token = getattr(self.server, "auth_token", None)
+        if not token:
+            return (True, "")  # auth disabled → full access, no role
+        presented = self._bearer()
+        ok = bool(presented) and hmac.compare_digest(presented.encode("utf-8"), token.encode("utf-8"))
+        return (ok, "")
 
     def do_POST(self) -> None:
-        if not self._authorized():
+        ok, role = self._resolve_role()
+        if not ok:
             self._send_json(401, {"error": "unauthorized"})
             return
         if self.path not in ("/code/query", "/code/doctor"):
@@ -122,11 +128,14 @@ class _Handler(BaseHTTPRequestHandler):
         if not isinstance(parsed, dict):
             self._send_json(400, {"error": "bad-request"})
             return
+        parsed["role"] = role  # server-authoritative — overrides any client-supplied role (no escalation)
         if self.path == "/code/doctor":
             result = code_doctor_handler(parsed)
         else:
             result = code_query_handler(parsed)
-        self._send_json(200, result)
+        # An RBAC denial (query OR doctor) comes back as a safe-null with this reason — 403 it.
+        status = 403 if result.get("reason") == "op-not-allowed-for-role" else 200
+        self._send_json(status, result)
 
     def do_GET(self) -> None:
         parsed = urlparse(self.path)
@@ -147,9 +156,10 @@ class _Handler(BaseHTTPRequestHandler):
                 self._send_json(503, {"status": "not-ready"})
             return
 
-        # Everything else is auth-gated when a token is configured (metrics can reveal usage
-        # patterns; status reveals engine/index state).
-        if not self._authorized():
+        # Everything else is auth-gated when auth is configured (metrics can reveal usage patterns;
+        # status reveals engine/index state). Any valid token/role may read these operational views.
+        ok, _ = self._resolve_role()
+        if not ok:
             self._send_json(401, {"error": "unauthorized"})
             return
 
@@ -175,7 +185,8 @@ class CodeIntelHTTPServer(ThreadingHTTPServer):
     # lock-guarded (query cache, reindexer, LSP sessions, graph project cache) and the semantic
     # engine is thread-confined with WAL, so concurrent requests are safe.
     daemon_threads = True
-    auth_token: str | None = None  # set by run() when a token is provided
+    auth_token: str | None = None  # set by run() when a single shared token is provided
+    token_auth = None              # set by run(): a TokenAuth for RBAC (token->role), if configured
 
     def __init__(self, *args, **kwargs) -> None:
         super().__init__(*args, **kwargs)
@@ -246,27 +257,36 @@ def run(
     token: str | None = None,
 ) -> None:
     configure_logging()
+    from codeintel.auth import load_auth
+    token_auth = load_auth()                          # RBAC (token→role), if an auth config exists
     server_token = (token or "").strip() or None
+    authenticated = bool(server_token) or token_auth.enabled
     if not _is_loopback(host):
         if not allow_remote:
             print(f"refusing to bind non-loopback host {host!r} without --allow-remote — this would "
                   f"expose a code-intel endpoint (your indexed repo) to the network", file=sys.stderr)
             raise SystemExit(2)
-        if not server_token and not _no_auth_override():
+        if not authenticated and not _no_auth_override():
             # Fail closed: never serve an UNAUTHENTICATED endpoint on the network by accident (a
-            # containerized `serve-http --host 0.0.0.0` with no token stops here unless overridden).
-            print(f"refusing to serve on {host}:{port} with NO authentication — set --token or "
-                  f"CODEINTEL_HTTP_TOKEN (recommended), or set CODEINTEL_ALLOW_NO_AUTH=1 to override "
-                  f"for a trusted network", file=sys.stderr)
+            # containerized `serve-http --host 0.0.0.0` with no auth stops here unless overridden).
+            print(f"refusing to serve on {host}:{port} with NO authentication — set --token / "
+                  f"CODEINTEL_HTTP_TOKEN, configure an RBAC auth.toml, or set CODEINTEL_ALLOW_NO_AUTH=1 "
+                  f"to override for a trusted network", file=sys.stderr)
             raise SystemExit(2)
 
     server = CodeIntelHTTPServer((host, port), _Handler)
     server.auth_token = server_token
-    if not _is_loopback(host) and not server_token:
+    server.token_auth = token_auth
+    if not _is_loopback(host) and not authenticated:
         print(f"WARNING: serving codeintel on {host}:{port} with NO authentication "
               f"(CODEINTEL_ALLOW_NO_AUTH set) — anyone who can reach this port can read your "
               f"indexed repo", file=sys.stderr)
-    auth_note = "  (bearer-token auth required)" if server_token else ""
+    if token_auth.enabled:
+        auth_note = "  (RBAC: token→role auth)"
+    elif server_token:
+        auth_note = "  (bearer-token auth required)"
+    else:
+        auth_note = ""
     print(f"Listening on http://{host}:{port}{auth_note}")
 
     def _graceful(signum, frame) -> None: