nerdit 0.9.0__tar.gz → 0.9.2__tar.gz

{nerdit-0.9.0 → nerdit-0.9.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: nerdit
-Version: 0.9.0
+Version: 0.9.2
 Summary: The local AI PaaS — deploy and operate apps on your own hardware, with first-class local AI
 Project-URL: Homepage, https://github.com/nerdit-ai/nerdit
 Project-URL: Repository, https://github.com/nerdit-ai/nerdit
@@ -160,10 +160,10 @@ token.
 
 ### Claude on the web or desktop (remote, through Nerdit Cloud)
 
-Link the machine with `nerdit link`. Then open **Connect** in
+Link the machine with `nerdit link`. Then open **Agents** in
 [app.nerdit.ai](https://app.nerdit.ai) and add the connection URL it shows as a
 custom connector in Claude. You approve which machines or projects the
-assistant can reach. No token leaves your machine. See the
+agent can reach. No token leaves your machine. See the
 [guide](https://docs.nerdit.ai/app/connect-assistant).
 
 ### Over HTTP
@@ -272,10 +272,10 @@ Questions or feedback: [feedback@nerdit.ai](mailto:feedback@nerdit.ai).
 
 ## License
 
-Apache-2.0, see [LICENSE](https://github.com/nerdit-ai/nerdit/blob/v0.9.0/LICENSE). "Nerdit" and the logo are trademarks and
-are not covered by the code license, see [NOTICE](https://github.com/nerdit-ai/nerdit/blob/v0.9.0/NOTICE).
+Apache-2.0, see [LICENSE](https://github.com/nerdit-ai/nerdit/blob/v0.9.2/LICENSE). "Nerdit" and the logo are trademarks and
+are not covered by the code license, see [NOTICE](https://github.com/nerdit-ai/nerdit/blob/v0.9.2/NOTICE).
 
 ## Contributing
 
-Issues and pull requests are welcome. [CONTRIBUTING.md](https://github.com/nerdit-ai/nerdit/blob/v0.9.0/CONTRIBUTING.md)
+Issues and pull requests are welcome. [CONTRIBUTING.md](https://github.com/nerdit-ai/nerdit/blob/v0.9.2/CONTRIBUTING.md)
 explains how contributions land in releases.

{nerdit-0.9.0 → nerdit-0.9.2}/README.md

@@ -101,10 +101,10 @@ token.
 
 ### Claude on the web or desktop (remote, through Nerdit Cloud)
 
-Link the machine with `nerdit link`. Then open **Connect** in
+Link the machine with `nerdit link`. Then open **Agents** in
 [app.nerdit.ai](https://app.nerdit.ai) and add the connection URL it shows as a
 custom connector in Claude. You approve which machines or projects the
-assistant can reach. No token leaves your machine. See the
+agent can reach. No token leaves your machine. See the
 [guide](https://docs.nerdit.ai/app/connect-assistant).
 
 ### Over HTTP
@@ -213,10 +213,10 @@ Questions or feedback: [feedback@nerdit.ai](mailto:feedback@nerdit.ai).
 
 ## License
 
-Apache-2.0, see [LICENSE](https://github.com/nerdit-ai/nerdit/blob/v0.9.0/LICENSE). "Nerdit" and the logo are trademarks and
-are not covered by the code license, see [NOTICE](https://github.com/nerdit-ai/nerdit/blob/v0.9.0/NOTICE).
+Apache-2.0, see [LICENSE](https://github.com/nerdit-ai/nerdit/blob/v0.9.2/LICENSE). "Nerdit" and the logo are trademarks and
+are not covered by the code license, see [NOTICE](https://github.com/nerdit-ai/nerdit/blob/v0.9.2/NOTICE).
 
 ## Contributing
 
-Issues and pull requests are welcome. [CONTRIBUTING.md](https://github.com/nerdit-ai/nerdit/blob/v0.9.0/CONTRIBUTING.md)
+Issues and pull requests are welcome. [CONTRIBUTING.md](https://github.com/nerdit-ai/nerdit/blob/v0.9.2/CONTRIBUTING.md)
 explains how contributions land in releases.

{nerdit-0.9.0 → nerdit-0.9.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "nerdit"
-version = "0.9.0"
+version = "0.9.2"
 description = "The local AI PaaS — deploy and operate apps on your own hardware, with first-class local AI"
 readme = "README.md"
 license = "Apache-2.0"

{nerdit-0.9.0 → nerdit-0.9.2}/src/nerdit/__init__.py

@@ -1,3 +1,3 @@
 """Nerdit — Le moteur de l'IA locale."""
 
-__version__ = "0.9.0"
+__version__ = "0.9.2"

{nerdit-0.9.0 → nerdit-0.9.2}/src/nerdit/cli/commands/apply.py

@@ -19,6 +19,7 @@ import typer
 from nerdit.cli.commands.deploy import (
     _git_name_default,
     _maybe_wait,
+    _note_skipped_excluded,
     _note_skipped_secrets,
     _render_dry_run,
 )
@@ -130,8 +131,10 @@ def _folder_source(path: str | None, max_bytes: int) -> tuple[str, bytes]:
         raise _fail(_plain(str(exc))) from exc
     console.print(f"[dim]Creating archive of {directory}...[/dim]")
     skipped_secrets: list[str] = []
-    zip_bytes = create_dir_zip(directory, skipped_secrets)
+    skipped_excluded: list[str] = []
+    zip_bytes = create_dir_zip(directory, skipped_secrets, skipped_excluded)
     _note_skipped_secrets(skipped_secrets)
+    _note_skipped_excluded(skipped_excluded)
     try:
         check_upload_size(zip_bytes, max_bytes)
     except ValueError as exc:

{nerdit-0.9.0 → nerdit-0.9.2}/src/nerdit/cli/commands/deploy.py

@@ -23,6 +23,7 @@ from nerdit.cli.display import (
     render_client_error,
     wait_exit_code,
 )
+from nerdit.config.project import _DISPLAY_UNSAFE_RE
 
 
 def parse_env_pairs(items: list[str]) -> dict[str, str]:
@@ -159,6 +160,15 @@ def _note_skipped_secrets(skipped: list[str]) -> None:
         )
 
 
+def _note_skipped_excluded(skipped: list[str]) -> None:
+    """Name the default-excluded paths left out of the archive, capped at ten."""
+    if skipped:
+        # Names come from the deployed tree: strip terminal and bidi controls.
+        shown = ", ".join(_plain(_DISPLAY_UNSAFE_RE.sub("?", p)) for p in skipped[:10])
+        more = f" (+{len(skipped) - 10} more)" if len(skipped) > 10 else ""
+        console.print(f"[dim]Not uploaded (excluded by default): {shown}{more}[/dim]")
+
+
 def _git_name_default(repo_url: str, subdir: str | None) -> str:
     """Derive a service name from a Git deploy: subdir basename, else repo slug.
 
@@ -420,8 +430,10 @@ async def _deploy_async(
 
     console.print(f"[dim]Creating archive of {directory}...[/dim]")
     skipped_secrets: list[str] = []
-    zip_bytes = create_dir_zip(directory, skipped_secrets)
+    skipped_excluded: list[str] = []
+    zip_bytes = create_dir_zip(directory, skipped_secrets, skipped_excluded)
     _note_skipped_secrets(skipped_secrets)
+    _note_skipped_excluded(skipped_excluded)
 
     try:
         # Ask the daemon for its cap only past the local default: an archive

{nerdit-0.9.0 → nerdit-0.9.2}/src/nerdit/cli/upload.py

@@ -57,11 +57,26 @@ def should_exclude(rel_path: str) -> bool:
     return matches_exclude_pattern(Path(rel_path).parts)
 
 
-def create_dir_zip(directory: str | Path, skipped_secrets: list[str] | None = None) -> bytes:
+def _excluded_top(rel: str) -> str:
+    """Return the shortest excluded prefix of *rel*, ``dir/`` for a directory."""
+    parts = Path(rel).parts
+    for i, part in enumerate(parts):
+        if matches_exclude_pattern((part,)):
+            return "/".join(parts[: i + 1]) + ("/" if i < len(parts) - 1 else "")
+    return rel  # only the symlink target matched
+
+
+def create_dir_zip(
+    directory: str | Path,
+    skipped_secrets: list[str] | None = None,
+    skipped_excluded: list[str] | None = None,
+) -> bytes:
     """Create a ZIP archive of a whole directory.
 
     Zips the directory contents recursively for `nerdit deploy`. Arcnames are
-    relative to the directory root and `ZIP_EXCLUDE_PATTERNS` apply. Symlinks
+    relative to the directory root and `ZIP_EXCLUDE_PATTERNS` apply; the top
+    excluded component of each dropped path (e.g. ``node_modules/``) is
+    appended once to *skipped_excluded* when given. Symlinks
     resolving outside the directory are dropped (they would upload their
     target), and so are `.env` / `.env.*` files, which would be baked into the
     image; their relative paths are appended to *skipped_secrets* when given.
@@ -81,6 +96,10 @@ def create_dir_zip(directory: str | Path, skipped_secrets: list[str] | None = No
             # path must pass the same filters as the link's own name.
             target_rel = str(target.relative_to(base_dir))
             if should_exclude(rel) or should_exclude(target_rel):
+                if skipped_excluded is not None:
+                    top = _excluded_top(rel)
+                    if top not in skipped_excluded:
+                        skipped_excluded.append(top)
                 continue
             if is_secret_basename(rel) or is_secret_basename(target_rel):
                 if skipped_secrets is not None:

{nerdit-0.9.0 → nerdit-0.9.2}/src/nerdit/config/app_config.py

@@ -59,6 +59,7 @@ def validate_deploy_fields(
     # blob (a ZIP's nerdit.toml table, a PUT body value, or a persisted config
     # key) and EdgeAuthConfig is the thing that decides whether it is one.
     edge_auth: Any = None,
+    forward_authorization: bool | None = None,
 ) -> DeployConfig:
     """Validate effective deployment fields with DeployConfig.
 
@@ -81,6 +82,7 @@ def validate_deploy_fields(
             cutover=cutover,
             auto_deploy=auto_deploy,
             edge_auth=edge_auth,
+            forward_authorization=forward_authorization,
         )
     except ValidationError as exc:
         raise NerditError(
@@ -96,7 +98,8 @@ def validate_deploy_fields(
                 "release a single-line command (<=4096 chars); "
                 "cutover/auto_deploy booleans (null = daemon default); "
                 "edge_auth = {user = '<name>', password = '${secrets.KEY}'} "
-                "(a secret reference, never a literal password)."
+                "(a secret reference, never a literal password); "
+                "forward_authorization a boolean, not combined with edge_auth."
             ),
         ) from exc
 
@@ -320,6 +323,7 @@ async def validate_app_config(
         cutover=deploy.get("cutover"),
         auto_deploy=deploy.get("auto_deploy"),
         edge_auth=deploy.get("edge_auth"),
+        forward_authorization=deploy.get("forward_authorization"),
     )
     ai_section = effective_doc.get("ai")
     bindings: dict[str, AiBindingConfig] | None = None

{nerdit-0.9.0 → nerdit-0.9.2}/src/nerdit/config/build.py

@@ -148,7 +148,10 @@ class BuildSettings(BaseModel):
                 raise ValueError(
                     "public_env values must be single lines of at most 4096 characters."
                 )
-            if "${secrets." in item or "${vars." in item or "${github." in item:
+            # Deferred: config.project imports this module.
+            from nerdit.config.project import ENV_REF_PREFIXES
+
+            if any(p in item for p in ENV_REF_PREFIXES):
                 raise ValueError(
                     "public_env values are embedded in public build output; secret references "
                     "are not allowed."

{nerdit-0.9.0 → nerdit-0.9.2}/src/nerdit/config/defaults.py

@@ -153,7 +153,7 @@ DEFAULT_LINK_RENEW_MARGIN_S = 120
 DEFAULT_UPLOAD_DIR = Path("~/.nerdit/uploads")
 DEFAULT_MAX_UPLOAD_BYTES = 500 * 1024 * 1024  # 500 MB
 UPLOAD_WARNING_BYTES = 100 * 1024 * 1024  # 100 MB
-ZIP_EXCLUDE_PATTERNS = {".git", "data/", "*.pyc", "__pycache__", ".venv", "node_modules"}
+ZIP_EXCLUDE_PATTERNS = {".git", "*.pyc", "__pycache__", ".venv", "node_modules"}
 
 
 def matches_exclude_pattern(parts: Sequence[str], *, casefold: bool = False) -> bool:

{nerdit-0.9.0 → nerdit-0.9.2}/src/nerdit/config/project.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 import os
 import re
 import tomllib
+from collections.abc import Mapping
 from pathlib import Path
 from typing import Literal
 from urllib.parse import urlsplit
@@ -73,6 +74,34 @@ def rewrite_vars_ref(value: str | None) -> str | None:
     return value
 
 
+#: Reserved `${…}` namespaces: a value containing one is a platform reference,
+#: never text an app may receive (ordinary `${VAR:-x}` templates stay untouched).
+ENV_REF_PREFIXES = ("${secrets.", "${vars.", "${github.")
+
+
+def env_ref_problem(env: Mapping[str, str | None] | None) -> str | None:
+    """Return why an app env map holds a malformed reserved reference, else `None`.
+
+    A value using a reserved namespace must be exactly one
+    `${secrets[.shared].KEY}` (or `${vars…}`) reference. The message names the
+    env key only, never its value.
+    """
+    for key, value in (env or {}).items():
+        if value is None or not any(p in value for p in ENV_REF_PREFIXES):
+            continue
+        if "${github." in value:
+            return (
+                f"env {key}: ${{github.installation}} is only valid as a git token_ref, "
+                "not as an app env value."
+            )
+        if not SECRET_REF_RE.fullmatch(rewrite_vars_ref(value) or ""):
+            return (
+                f"env {key}: a ${{secrets.*}} reference must be the whole value: "
+                "${secrets.KEY} or ${secrets.shared.KEY}."
+            )
+    return None
+
+
 # [hooks.<name>] grammar (inbound webhooks). The name maps to the
 # NERDIT_HOOK_<NAME>_SECRET / _URL keys: no '_', so the '-' -> '_' fold is injective.
 HOOK_SENDERS = ("stripe", "github", "slack", "hmac", "none")
@@ -374,6 +403,20 @@ class DeployConfig(BaseModel):
     # Like other non-form deployment fields, auth carries forward when omitted.
     # Only an explicit edge_auth=null removes protection; no container restart needed.
     edge_auth: EdgeAuthConfig | None = None
+    # Hand the browser's Authorization to the app on its hosted and cloud custom
+    # domain URLs (the cloud ships it in a carrier header the tunnel mux renames).
+    # Carries forward like cutover; clear it with deploy forward_authorization=null.
+    forward_authorization: bool | None = None
+
+    @model_validator(mode="after")
+    def _check_forward_authorization(self) -> DeployConfig:
+        """Refuse forward_authorization alongside edge_auth, which owns Authorization."""
+        if self.forward_authorization and self.edge_auth is not None:
+            raise ValueError(
+                "Invalid [deploy] forward_authorization: cannot be combined with "
+                "edge_auth, which owns the Authorization header on the local proxy path."
+            )
+        return self
 
     @field_validator("name")
     @classmethod

{nerdit-0.9.0 → nerdit-0.9.2}/src/nerdit/core/app_build.py

@@ -22,11 +22,13 @@ from __future__ import annotations
 import asyncio
 import json
 import logging
+import os
 import shutil
 from datetime import UTC, datetime
 from typing import TYPE_CHECKING
 
 from nerdit.core.deploy_state import record_deploy_settled, stamp_last_deploy
+from nerdit.core.eventlog import record_job_event
 from nerdit.core.jobconfig import parse_job_config
 from nerdit.core.launch import (
     _SCRUB_MIN_VALUE_LEN,
@@ -175,6 +177,8 @@ def _sensitive_env_values(resolved: "ResolvedLaunchEnv") -> set[str]:
     # Empty values are dropped here rather than downstream: a "" target would
     # splice `***` between every character of every line.
     values = {value for value in resolved.secret_env.values() if value}
+    # A resolved `${secrets…}` env ref is a declared secret under any key name.
+    values.update(v for k in resolved.ref_env_keys if (v := resolved.env.get(k)))
     for key, value in resolved.env.items():
         if value and len(value) >= _SCRUB_MIN_VALUE_LEN and _is_credential_key(key):
             values.add(value)
@@ -270,6 +274,17 @@ class AppImageBuilder:
         # must keep intercepting this predicate.
         if await self._c._needs_build(job):
             if not self._task_in_flight(job.id):
+                cfg = parse_job_config(job, warn=True)
+                if not os.path.isdir(str(cfg["build_context_dir"])):
+                    # `build` removes the context on either outcome, so this
+                    # generation already built and its image went missing
+                    # afterwards (a woken box restores images after boot).
+                    # Rebuilding from nothing fails the app, and launching burns
+                    # the restart budget into crash_loop: hold until it returns.
+                    await self._c._log_secret_wait(
+                        job, f"Waiting for image {cfg['image']} to be present locally"
+                    )
+                    return True
                 # Boot touch-up: a row stuck at phase "building" with
                 # no live build task (e.g. a daemon restart mid-build) regresses
                 # to "queued" — the freshly spawned build re-stamps "building"
@@ -424,6 +439,7 @@ class AppImageBuilder:
         # The build context is only needed for the build itself; drop it on EITHER
         # outcome (success or a failed build) so successive deploys never leak
         # extracted upload dirs.
+        cancelled = False
         try:
             try:
                 # Hold the global build semaphore only for the actual image
@@ -499,8 +515,14 @@ class AppImageBuilder:
             if not await self._run_release(job, image):
                 return
             await self._c._prune_old_images(job)
+        except asyncio.CancelledError:
+            # Shutdown cancelled the build: keep the context so the next boot
+            # rebuilds. A missing context means the build ran (`ensure_built`).
+            cancelled = True
+            raise
         finally:
-            await self.cleanup_context(job, cleanup_dir)
+            if not cancelled:
+                await self.cleanup_context(job, cleanup_dir)
 
     async def _run_release(self, job: Job, image: str) -> bool:
         """Run the built generation's release and contain unexpected task failures.
@@ -1201,6 +1223,7 @@ class AppImageBuilder:
         # never fire on a newer generation's behalf. The crash-loop sibling in
         # `services.py` settles a DIFFERENT, deliberately
         # unguarded scenario and is untouched here.
+        prior_ld = parse_job_config(job).get("last_deploy")
         if not await self._write_terminal_settle(
             job.id,
             target_version=target_version,
@@ -1222,6 +1245,7 @@ class AppImageBuilder:
         # Fixed action on the terminal branch (never `audit_action`): a fresh
         # deploy that never came up is a `service.failed`, whatever killed it.
         await _audit_outcome("service.failed")
+        await self._record_healthy_generation_failed(job, prior_ld, reason, error_class)
         logger.warning("%s for service %s: %s", label, job.service_name or job.id, message)
         # NOT reclaimable — the one branch that keeps the build markers. The
         # row still carries `build_context_dir`, so removing the tag would
@@ -1231,6 +1255,24 @@ class AppImageBuilder:
         # tag keeps layer 3 in charge: it re-settles the restart instead.
         return False
 
+    async def _record_healthy_generation_failed(
+        self, job: Job, prior_ld: object, reason: str, error_class: ErrorClass
+    ) -> None:
+        """Put a terminal settle of an already-healthy generation on the event feed.
+
+        The phase writer emits only a generation's first terminal settle, so a
+        healthy generation failed later (a rebuild on wake) would leave the feed
+        silent. Fixed tokens only, never the failure message.
+        """
+        if isinstance(prior_ld, dict) and prior_ld.get("phase") == "healthy":
+            await record_job_event(
+                self._c._events,
+                "service.failed",
+                job,
+                reason=reason,
+                data={"error_class": error_class.value},
+            )
+
     async def _emit_bypass_settle(self, job: Job, blob: dict) -> None:
         """Emit the terminal deploy event for branches that bypass the phase writer.
 

{nerdit-0.9.0 → nerdit-0.9.2}/src/nerdit/core/deploy_state.py

@@ -82,7 +82,14 @@ async def stamp_last_deploy(
         and getattr(row.kind, "value", row.kind) == "service"
     ):
         new_ld["remediation_code"] = settle_remediation_code(cfg, new_ld)
-    if not await queries.patch_job_config(job_id, {"last_deploy": new_ld}):
+    # The version match is re-checked at write time: a redeploy landing between
+    # the read and the write owns the row and must not get this stamp.
+    expect = ld.get("version") if require_version_match else None
+    if not await queries.patch_job_config(
+        job_id,
+        {"last_deploy": new_ld},
+        expect_build_version=expect if isinstance(expect, int) else None,
+    ):
         return False
 
     # Durable settle event — STRICTLY after the real write, past

{nerdit-0.9.0 → nerdit-0.9.2}/src/nerdit/core/link/apps.py

@@ -16,7 +16,7 @@ logger = logging.getLogger("nerdit.link.apps")
 class ShareLookup(Protocol):
     """Atomic hosted routing query used by both stream admission and revocation."""
 
-    def resolve_shared_app(
+    def resolve_shared_app(  # noqa: PLR0913 - the routing facts of one stream
         self,
         node_id: str,
         service_name: str,
@@ -24,8 +24,9 @@ class ShareLookup(Protocol):
         job_id: str | None,
         access: str | None,
         legacy_host: str | None,
-    ) -> Awaitable[tuple[str, int, str] | None]:
-        """Return the current job, live port and admitted audience, or refuse."""
+        nodes_domain: str | None,
+    ) -> Awaitable[tuple[str, int, str, bool] | None]:
+        """Return the current job, live port, admitted audience and opt-in, or refuse."""
 
 
 class AppStreamResolver:
@@ -86,12 +87,14 @@ class AppStreamResolver:
             else None
         )
         result = await self._queries.resolve_shared_app(
-            self._node_id, service_name, authority, job_id, access, legacy_host
+            self._node_id, service_name, authority, job_id, access, legacy_host, self._domain
         )
         if result is None:
             return None
-        admitted_job, port, audience = result
-        return AppTarget(service_name, port, authority, admitted_job, audience)
+        admitted_job, port, audience, forward_authorization = result
+        return AppTarget(
+            service_name, port, authority, admitted_job, audience, forward_authorization
+        )
 
 
 __all__ = ["AppStreamResolver", "ShareLookup"]

{nerdit-0.9.0 → nerdit-0.9.2}/src/nerdit/core/link/client.py

@@ -670,6 +670,8 @@ class AppTarget:
     host: str
     job_id: str | None = None
     access: str | None = None
+    #: The app's `[deploy].forward_authorization` opt-in, re-read per stream.
+    forward_authorization: bool = False
 
 
 @dataclass(frozen=True, slots=True)

{nerdit-0.9.0 → nerdit-0.9.2}/src/nerdit/core/link/mux.py

@@ -109,6 +109,10 @@ _REQUEST_DROPPED = frozenset({"host", "content-length"})
 APP_HEADER = "x-nerdit-app"
 APP_JOB_HEADER = "x-nerdit-app-job"
 APP_ACCESS_HEADER = "x-nerdit-app-access"
+#: The browser's own Authorization, renamed by the cloud because `authorization`
+#: carries the relay capability on node-link/v1. Consumed here and handed to the
+#: app as `authorization` only when it opted in (`[deploy].forward_authorization`).
+APP_AUTHORIZATION_HEADER = "x-nerdit-app-authorization"
 
 #: The cloud's control-plane carrier (P32 D-P32-2) — the header that marks a
 #: stream as framed by the cloud's own server-side code rather than by a user,
@@ -147,6 +151,7 @@ _APP_REQUEST_DROPPED = frozenset(
         APP_HEADER,
         APP_JOB_HEADER,
         APP_ACCESS_HEADER,
+        APP_AUTHORIZATION_HEADER,
         "x-forwarded-host",
         "forwarded",
         CLOUD_CONTROL_HEADER,
@@ -217,16 +222,29 @@ _SUBMITTER = "submitter"
 
 _BEARER_PREFIX = "Bearer "
 
+#: `nerdit.daemon.auth.TOKEN_PREFIX`, mirrored because `core` must not import `daemon`.
+_DAEMON_TOKEN_PREFIX = "nrd_"
+
 
 def _app_request(
-    frame: OpenStream, target: AppTarget, admission: HookAdmission | None
+    frame: OpenStream,
+    target: AppTarget,
+    admission: HookAdmission | None,
+    authorization: str | None = None,
 ) -> tuple[str, list[Header]]:
-    """The loopback URL and filtered headers an admitted app stream is dialled with."""
+    """Build the loopback URL and filtered headers an admitted app stream is dialled with.
+
+    Args:
+        authorization: The browser credential to hand the app as `authorization`,
+            already vetted by `StreamMux._app_authorization`.
+    """
     headers = [
         (name, value)
         for name, value in frame.headers
         if name.lower() not in HOP_BY_HOP and name.lower() not in _APP_REQUEST_DROPPED
     ]
+    if authorization is not None:
+        headers.append(("authorization", authorization))
     # httpx honours an explicit `Host` over the URL authority
     # (`Request._prepare` uses `setdefault`), so the app sees the name
     # the browser typed while the socket still goes to loopback.
@@ -548,6 +566,25 @@ class StreamMux:
             return False
         return bool(self._ctx.validate_capability(token, _SUBMITTER))
 
+    def _app_authorization(self, frame: OpenStream, target: AppTarget) -> str | None:
+        """Return the browser Authorization an opted-in app may receive, else None.
+
+        A daemon token or this link's capability is never handed to an app, even
+        when the cloud relays one in the carrier.
+        """
+        value = frame.header(APP_AUTHORIZATION_HEADER)
+        if not target.forward_authorization or value is None:
+            return None
+        # Whatever the scheme: the bare value and the credential after it.
+        candidates = (value.strip(), value.strip().partition(" ")[2].strip())
+        if any(
+            c.startswith(_DAEMON_TOKEN_PREFIX) or self._ctx.validate_capability(c, _SUBMITTER)
+            for c in candidates
+            if c
+        ):
+            return None
+        return value
+
     # -- serving -------------------------------------------------------------
 
     async def _serve(self, stream: _Stream) -> None:
@@ -672,6 +709,7 @@ class StreamMux:
             APP_HEADER,
             APP_JOB_HEADER,
             APP_ACCESS_HEADER,
+            APP_AUTHORIZATION_HEADER,
             "x-forwarded-host",
             HOOK_HEADER,
             DELIVERY_HEADER,
@@ -703,7 +741,9 @@ class StreamMux:
             await self._send_refusal(frame, *_HOOK_REFUSALS[503 if admission else 404])
             return
 
-        url, headers = _app_request(frame, target, admission)
+        url, headers = _app_request(
+            frame, target, admission, self._app_authorization(frame, target)
+        )
 
         async def validate_connected_target(event: str, _info: dict[str, object]) -> None:
             # httpcore is pinned: this boundary is AFTER socket acquisition but