taskops-cli 0.5.0__tar.gz → 0.5.1__tar.gz

{taskops_cli-0.5.0 → taskops_cli-0.5.1}/ARCHITECTURE.md

@@ -1508,7 +1508,10 @@ construction and never sniffed per request** (`Mounts(repo=…)`,
 The `/ui/` column arrived later, and it is the same `repo` deciding both — see
 "API ONLY is now literal" below. Both cells of the `serve` row are narrowed a
 second time by "The hosted window" below: a board that DECLARED a forge may be
-answered from a bare read-only mirror of it, and only then.
+answered from a bare read-only mirror of it, and only then. And the page's ADDRESS moved
+one notch after that: on a serve-mode host the last column is the board's own
+`/<board>/`, with `/<board>/ui/` kept as an alias — "The board's own address IS
+the page" at the end of this section.
 
 A viewer meets that gap whenever this clone cannot answer — a ref not fetched
 yet, a shallow checkout, a commit from before this repo had the branch — and
@@ -1823,6 +1826,98 @@ starts from the server's real shape, and `null` (fewer than two ready cards,
 nothing to decide) is deliberately a different state from absent (a board older
 than the wave).
 
+### A bare `Bearer` is NO credential, not an unknown one (2026-08-31)
+
+The hosted window shipped on 2026-08-30 and was unusable the next morning for
+the exact reader it was built for: a PUBLIC board, opened from its own hosted
+page, answered *"unknown credential — run: taskops join"*. Nothing about
+visibility was wrong. The page simply had no token, so the browser sent
+`Authorization: Bearer ` with an empty value; `auth.token_in`'s `removeprefix`
+did not match the header without its space-and-value, and it returned the
+literal string `Bearer` as if that were somebody's token. `creds.check` then did
+its job perfectly on a token nobody ever minted.
+
+So the fault was never in the visibility rule and never in the client. It was in
+the one place that decides what a header MEANS:
+
+> **An `Authorization` header that carries no value is the ABSENCE of a
+> credential, identical to sending no header at all. A header that carries a
+> value is a claim, and a claim that does not check out is refused with the
+> sentence it has always used.**
+
+Both halves are load-bearing, and the second is why this is not the tempting
+one-line generalisation. "Treat anything unparseable as anonymous" would make a
+typo'd token read a private board as far as its visibility allows and, worse,
+would turn an expired credential into a silent downgrade instead of the loud
+`unknown credential` it has always been. Empty is not wrong; wrong is wrong —
+and the two refusals stay different sentences: a caller who presented NOTHING to
+a private board is told how to join, a caller who presented something unknown is
+told it is unknown.
+
+It lives in ONE extractor (`http/auth.py::token_in`) because every door — `rpc`,
+`feed`, `git`, the static page — asks that function and nothing else. A second
+door with its own opinion about a header is how the fleet ends up with two
+credential rules, which is the failure mode §19 exists to prevent. `taskops
+ui`'s window never saw this: it mints a token before it opens a tab, so the only
+client that sends an empty bearer is the hosted page, and the hosted page is
+younger than the extractor.
+
+The lesson generalises past auth: **anonymous worked only because no client
+existed**. Every test that pinned "no header reads a public board" sent no
+header, because the only readers were `curl` and the MCP client. A browser
+cannot express "no header" through a fetch wrapper that always sets one — so a
+contract that is only ever exercised by hand-written clients is not pinned,
+it is merely unvisited. `tests/test_topology.py` now sends the bare header
+alongside the absent one, on a public board AND a private one, which is the pair
+that says which of the two rules above is being tested.
+
+### The board's own address IS the page (2026-08-31)
+
+The same report carried a second complaint, and it is a design one: the page was
+at `/<board>/ui/`. A board host serves exactly one thing to a human, and it had
+been given a sub-path — so the URL a person pastes says `ui` twice over (once in
+the product's name for the thing, once in the path) and the shortest address on
+the host, `/<board>/`, answered 404. Whatever a host serves to people belongs at
+its own address; a prefix is for the doors people never type.
+
+> **A board's page is served at `/<board>/` (and `/<board>`, bare). The MACHINE
+> doors move under `/<board>/api/…` — `rpc`, `git/…`, `feed`, `invite/redeem`.**
+
+Two facts make that router unambiguous rather than a guess per request. The
+prefix is stripped ONCE, in `http/routes.py::split`, shared by GET and POST, so
+`/<board>/api/rpc` IS `/<board>/rpc` — same handler, same credential, same
+words, and no door can drift from the other spelling. And the page's own
+relative links (`./app.js`, `./style.css` off `index.html`) now arrive as board
+tails, which the router separates from doors by a CLOSED SET: `static.py::asset`
+asks the packaged bundle what files it actually ships, flat, with a suffix in
+`TYPES`. None is named `rpc`, `git`, `feed`, `ui` or `api`, so an asset can
+never shadow a door and a door never shadows an asset — and a bundle that grows
+a font ships without a router edit. The host's own one-segment doors (`/login`,
+`/rpc`, `/healthz`) are untouched, because the strip lives in the TAIL and never
+sees them; a board literally named `api` still answers at `/api/…`.
+
+**The 0.5.0 spellings are kept, not deprecated** — `/<board>/ui/`,
+`/<board>/rpc`, `/<board>/git/…`, `/<board>/feed` all answer, unprefixed and
+without a redirect. Not out of politeness: links to them were pasted the day
+they existed, `.mcp.json` files and agents are configured against them, four
+legacy-bearer production boards speak them, and `taskops ui`'s upstream forward
+builds them. A redirect would have been the tidier story and would have broken
+every POST that follows one badly. So the rule this chapter adds about old
+addresses is the one it also obeys: **an address that ever worked keeps
+answering, and the new one is where the page POINTS people.** `ui/src/client.ts`
+derives its base from the page's own location (`baseOf`) precisely so the page
+never hardcodes which of the two it was loaded from.
+
+**Both faults are pinned live, not only in the suite.** `smoke.sh` at the repo
+root is the re-runnable list — every assertion in it is one of these two reports
+or something 0.5.0 already promised, read-only, and it exits on the first
+failure:
+
+```sh
+sh smoke.sh                                   # taskops.bernardocastro.dev, taskops-v2
+sh smoke.sh <host> <board> <private-board>
+```
+
 ---
 
 ## 17. Deployed — taskops.bernardocastro.dev is v2 (2026-08-08)

{taskops_cli-0.5.0 → taskops_cli-0.5.1}/CHANGELOG.md

@@ -3,6 +3,40 @@
 The source of truth for release notes — GitHub Releases are extracted from
 here, never written twice.
 
+## 0.5.1 — the hosted window, actually usable
+
+0.5.0 shipped a window nobody could use. Both faults were reported the next
+morning against the live host, and both were contract-level: the URL people
+paste, and the credential rule every door shares.
+
+- **A public board was unreadable from its own hosted page.** The client sends
+  `Authorization: "Bearer " + token()`; with no token that header arrives as
+  `Bearer`, and `auth.token_in`'s `removeprefix("Bearer ")` did not match — so
+  the literal string `"Bearer"` came back AS the token and the reader was told
+  "unknown credential — run: taskops join". Anonymous reads worked only when NO
+  Authorization header was sent at all, which no browser client does: the
+  anonymous path was only ever green because nothing but curl had walked it.
+  Scheme and value are now parsed as separate fields, the scheme
+  case-insensitive per RFC 7235, and a bearer scheme with no value is the
+  ABSENCE of a credential. Deliberately narrow: a header carrying any actual
+  value — wrong, expired, or under a scheme this server never spoke — is a
+  credential that WAS presented and still refuses exactly as before.
+  "Unparseable" is not "anonymous".
+- **The board's own address IS the page.** `https://<host>/<board>/` (and
+  `/<board>`) serves the dashboard, with `app.js` and `style.css` beside it; the
+  machine doors also answer under `/<board>/api/{rpc,git,feed}`, stripped once
+  in `http/routes.py::split` so no door can drift from another. A sub-path was
+  wrong for the primary thing a board host serves.
+- **Nothing that worked in 0.5.0 stopped working.** `/<board>/ui/`,
+  `/<board>/rpc`, `/<board>/git/…` and `/<board>/feed` all still answer — agents,
+  the MCP client, `taskops ui`'s forward and the legacy production boards speak
+  them, and a link somebody already pasted is a contract, not a legacy.
+- **`smoke.sh`** — the live, read-only smoke for a board host: the page at the
+  board root, a bare `Bearer` reading a public board, a private board still
+  refusing, a card branch's diff rendered from the forge mirror. Every line is
+  there because it failed once in production, and each says which report it
+  came from.
+
 ## 0.5.0 — the hosted window
 
 - **A board can be READ without a clone.** Until now the dashboard was only ever

{taskops_cli-0.5.0 → taskops_cli-0.5.1}/CLAUDE.md

@@ -228,6 +228,17 @@ what it exists to report, not a fault.
 - One card rebuilds the bundle at the end of a wave. N cards rebuilding it is
   N-1 conflicts by construction.
 
+**The hosted page is at the board's OWN address** — `https://<host>/<board>/`
+(and `/<board>`), its assets beside it, the machine doors under
+`/<board>/api/{rpc,git,feed}`. 0.5.0's spellings (`/<board>/ui/`,
+`/<board>/rpc`, `/<board>/git/…`, `/<board>/feed`) still answer and are a
+contract, not a legacy — ARCHITECTURE §16, "The board's own address IS the
+page". The page derives its base from its own location
+(`ui/src/client.ts::baseOf`) and hardcodes neither. `sh smoke.sh` re-derives all
+of it against the live host, plus the credential rule a browser exposed:
+**an `Authorization` header with no value is the ABSENCE of a credential, a
+header with a wrong value still refuses loudly** (`http/auth.py::token_in`).
+
 ## Never re-introduce
 
 Each has its line in ARCHITECTURE.md §11 saying what it cost and where it is

{taskops_cli-0.5.0 → taskops_cli-0.5.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: taskops-cli
-Version: 0.5.0
+Version: 0.5.1
 Summary: A shared work board for teams of coding agents, with a human who decides.
 Project-URL: Repository, https://github.com/bernatch22/taskops
 License-Expression: MIT
@@ -70,7 +70,7 @@ importable leaves commits un-stamped, silently.
 taskops init                              a local board in this repo
 taskops join [<name>] [--invite <id>]     join a board, install the hooks
 taskops remote add <url>                  the host this checkout operates, like git's origin
-taskops serve                             host boards — /ui and /git open per declared forge
+taskops serve                             host boards — the page and /git open per declared forge
 taskops server init                       bootstrap THIS host: its owner and their ssh key
 taskops board create|ls|push|pull|rm      the boards on a host
 taskops board visibility|forge            who may read one · which repo's team is enrolled
@@ -389,6 +389,26 @@ never asks the server for the bytes. A host running `taskops serve` answers
 hosted window, for the reader with no clone. A board that never declared one
 refuses with a sentence naming `taskops board forge <owner>/<repo>`.
 
+**The hosted page is at the board's OWN address.** `https://<host>/<board>/`
+IS the dashboard — not a sub-path under it — and the machine doors sit under a
+prefix that can never collide with a page asset:
+
+```
+https://<host>/<board>/            the page          (also /<board>, no slash)
+https://<host>/<board>/app.js      its assets        style.css, index.html
+https://<host>/<board>/api/rpc     the verbs         also /<board>/rpc
+https://<host>/<board>/api/git/…   diffs from the mirror   also /<board>/git/…
+https://<host>/<board>/api/feed    the live feed     also /<board>/feed
+https://<host>/healthz             the host itself
+```
+
+The right-hand spellings are 0.5.0's and they keep answering, unprefixed and
+un-redirected — including `/<board>/ui/`, which was the page's address for one
+day. Links were pasted, agents and the MCP client are configured against them,
+and `taskops ui`'s upstream forward speaks them, so they are a contract now
+rather than a legacy. Re-derivable at any time with `sh smoke.sh <host>
+<board>`.
+
 **Reading one, from the other side.** Everything above is the author's half; a
 reader needs no ceremony at all. Three doors onto the same bytes:
 

{taskops_cli-0.5.0 → taskops_cli-0.5.1}/README.md

@@ -58,7 +58,7 @@ importable leaves commits un-stamped, silently.
 taskops init                              a local board in this repo
 taskops join [<name>] [--invite <id>]     join a board, install the hooks
 taskops remote add <url>                  the host this checkout operates, like git's origin
-taskops serve                             host boards — /ui and /git open per declared forge
+taskops serve                             host boards — the page and /git open per declared forge
 taskops server init                       bootstrap THIS host: its owner and their ssh key
 taskops board create|ls|push|pull|rm      the boards on a host
 taskops board visibility|forge            who may read one · which repo's team is enrolled
@@ -377,6 +377,26 @@ never asks the server for the bytes. A host running `taskops serve` answers
 hosted window, for the reader with no clone. A board that never declared one
 refuses with a sentence naming `taskops board forge <owner>/<repo>`.
 
+**The hosted page is at the board's OWN address.** `https://<host>/<board>/`
+IS the dashboard — not a sub-path under it — and the machine doors sit under a
+prefix that can never collide with a page asset:
+
+```
+https://<host>/<board>/            the page          (also /<board>, no slash)
+https://<host>/<board>/app.js      its assets        style.css, index.html
+https://<host>/<board>/api/rpc     the verbs         also /<board>/rpc
+https://<host>/<board>/api/git/…   diffs from the mirror   also /<board>/git/…
+https://<host>/<board>/api/feed    the live feed     also /<board>/feed
+https://<host>/healthz             the host itself
+```
+
+The right-hand spellings are 0.5.0's and they keep answering, unprefixed and
+un-redirected — including `/<board>/ui/`, which was the page's address for one
+day. Links were pasted, agents and the MCP client are configured against them,
+and `taskops ui`'s upstream forward speaks them, so they are a contract now
+rather than a legacy. Re-derivable at any time with `sh smoke.sh <host>
+<board>`.
+
 **Reading one, from the other side.** Everything above is the author's half; a
 reader needs no ceremony at all. Three doors onto the same bytes:
 

taskops_cli-0.5.1/smoke.sh

@@ -0,0 +1,164 @@
+#!/bin/sh
+# The live smoke for a taskops board HOST. Read-only, no credential, no state:
+# every request below is a GET or a `board` read, so it is safe to run against
+# production at any time, including from a laptop that never joined the board.
+#
+#   sh smoke.sh                                  # the author's host, defaults below
+#   sh smoke.sh <host> <public-board> <private-board> <card-branch>
+#
+# Every assertion is here because it FAILED once, in production, against a real
+# reader — the comment above each one says which report it comes from. Nothing
+# is asserted because it seemed prudent: a smoke list that grows by taste stops
+# being read, and a green line that never could have gone red is a lie about
+# coverage. It exits non-zero on the FIRST failure, so the first red line is the
+# whole diagnosis.
+#
+# `pass` prints what was actually observed, never just OK — a smoke you cannot
+# read the evidence out of is a smoke you end up re-running by hand anyway.
+
+set -eu
+
+HOST=${1:-taskops.bernardocastro.dev}
+BOARD=${2:-taskops-v2}
+PRIVATE=${3:-axion}
+BRANCH=${4:-tk-32d2ba}
+
+BASE="https://$HOST"
+C="curl -sS -m 15"
+
+fail() { printf '\nFAIL  %s\n      %s\n' "$1" "$2" >&2; exit 1; }
+pass() { printf 'ok    %s\n        %s\n' "$1" "$2"; }
+head_ln() { printf '\n-- %s\n' "$1"; }
+
+# ── (e) the host itself ───────────────────────────────────────────────────────
+# First, because every failure below is ambiguous until this one is green: a
+# 502 from the proxy and a broken board answer the same shape of nothing.
+head_ln "healthz — the host is up"
+body=$($C "$BASE/healthz") || fail "GET /healthz" "no answer from $BASE"
+case $body in
+  *'"ok": true'*|*'"ok":true'*) pass "GET /healthz" "$body" ;;
+  *) fail "GET /healthz" "$body" ;;
+esac
+
+# ── (a) the board's own address IS the page ───────────────────────────────────
+# Reported 2026-08-31: the page was at /<board>/ui/ and /<board>/ was a 404 —
+# the shortest address on the host, the one a person types, answered nothing.
+# Asserted on the BARE path too: /<board> without the trailing slash is what
+# gets pasted into Slack, and a router that only handles one of the two looks
+# fine in a browser (it follows the redirect) and breaks every copied link.
+head_ln "the page at the board's own address"
+for path in "/$BOARD/" "/$BOARD"; do
+  page=$($C "$BASE$path") || fail "GET $path" "no answer"
+  case $page in
+    *'app.js'*) pass "GET $path" "html referencing app.js ($(printf %s "$page" | wc -c | tr -d ' ') bytes)" ;;
+    *) fail "GET $path" "not the page: $(printf %s "$page" | head -c 200)" ;;
+  esac
+done
+# And its assets resolve from that address: the page's own links are relative
+# (./app.js off index.html), so they arrive as board TAILS and the router has to
+# tell them from the machine doors. If this 404s, the page loads unstyled and
+# blank with nothing in the server log to say why.
+for asset in app.js style.css; do
+  code=$($C -o /dev/null -w '%{http_code} %{content_type}' "$BASE/$BOARD/$asset") \
+    || fail "GET /$BOARD/$asset" "no answer"
+  case $code in
+    200*) pass "GET /$BOARD/$asset" "$code" ;;
+    *) fail "GET /$BOARD/$asset" "$code" ;;
+  esac
+done
+
+# ── (b) a bare `Bearer` reads a PUBLIC board ──────────────────────────────────
+# THE fault of this chapter, shipped in 0.5.0 and reported 2026-08-31: the page
+# sends `Authorization: "Bearer " + token()`, so with no token the header
+# arrives as `Bearer`, and the old extractor returned the literal string
+# "Bearer" as somebody's token — "unknown credential — run: taskops join" to a
+# reader who presented nothing. Anonymous reads worked only with NO header at
+# all, which no browser client can express. Both shapes are asserted: the
+# no-header stranger (what the suite always tested) and the bare bearer (what
+# every browser actually sends).
+head_ln "a bare Bearer is no credential — public board reads"
+rpc() { # rpc <path> [<authorization value>]
+  if [ $# -gt 1 ]; then
+    $C -o /dev/null -w '%{http_code}' -X POST "$BASE$1" \
+      -H 'Content-Type: application/json' -H "Authorization: $2" \
+      -d '{"verb": "board", "args": {}}'
+  else
+    $C -o /dev/null -w '%{http_code}' -X POST "$BASE$1" \
+      -H 'Content-Type: application/json' -d '{"verb": "board", "args": {}}'
+  fi
+}
+code=$(rpc "/$BOARD/api/rpc" "Bearer") || fail "POST /$BOARD/api/rpc (bare Bearer)" "no answer"
+[ "$code" = 200 ] || fail "POST /$BOARD/api/rpc (bare Bearer)" "HTTP $code — the 0.5.0 fault is back"
+pass "POST /$BOARD/api/rpc  Authorization: Bearer" "HTTP 200"
+code=$(rpc "/$BOARD/api/rpc") || fail "POST /$BOARD/api/rpc (no header)" "no answer"
+[ "$code" = 200 ] || fail "POST /$BOARD/api/rpc (no header)" "HTTP $code"
+pass "POST /$BOARD/api/rpc  no Authorization" "HTTP 200"
+# The other half of that fix, and the reason it is not a one-line
+# generalisation: a credential that WAS presented and does not check out still
+# refuses loudly. "Unparseable is anonymous" would turn an expired token into a
+# silent read-only downgrade instead of a sentence naming the way back in.
+body=$($C -X POST "$BASE/$BOARD/api/rpc" -H 'Content-Type: application/json' \
+  -H 'Authorization: Bearer not-a-token' -d '{"verb": "board", "args": {}}') \
+  || fail "POST with a wrong token" "no answer"
+case $body in
+  *'unknown credential'*) pass "POST /$BOARD/api/rpc  Bearer not-a-token" "refused: unknown credential" ;;
+  *) fail "POST with a wrong token" "$body" ;;
+esac
+
+# ── (c) a PRIVATE board still refuses ─────────────────────────────────────────
+# The wall moved for public boards; it must not have moved here. And the
+# SENTENCE matters as much as the status: somebody who presented nothing is told
+# how to join, which is a different answer from "unknown credential".
+head_ln "a private board still refuses the same stranger"
+body=$($C -X POST "$BASE/$PRIVATE/api/rpc" -H 'Content-Type: application/json' \
+  -H 'Authorization: Bearer' -d '{"verb": "board", "args": {}}') \
+  || fail "POST /$PRIVATE/api/rpc" "no answer"
+# Grepped for `no credential` and NOT for `taskops join`: both refusals name
+# that command, so the looser grep passes on the 0.5.0 fault itself — where a
+# private board answered `unknown credential` to a stranger who presented
+# nothing. The whole point is WHICH sentence comes back.
+case $body in
+  *'no credential'*) pass "POST /$PRIVATE/api/rpc  Authorization: Bearer" "refused: no credential — run: taskops join" ;;
+  *) fail "POST /$PRIVATE/api/rpc" "expected the no-credential refusal, got: $body" ;;
+esac
+
+# ── (d) a card branch renders a diff from the forge mirror ────────────────────
+# The hosted window's whole point: a reader with NO clone. Before the mirror,
+# every diff fell through the UI's cascade to a forge link — a blank presented
+# as the window. A tk-* branch on purpose: `master` is fetched by any clone, and
+# the failure this catches is a mirror whose on-demand fetch never ran, which
+# only shows on a ref the mirror did not have at clone time.
+head_ln "a card branch diffs from the mirror"
+body=$($C "$BASE/$BOARD/api/git/commit/$BRANCH") || fail "GET git/commit/$BRANCH" "no answer"
+case $body in
+  *'"patch"'*) pass "GET /$BOARD/api/git/commit/$BRANCH" "a diff ($(printf %s "$body" | wc -c | tr -d ' ') bytes)" ;;
+  *) fail "GET git/commit/$BRANCH" "no diff: $(printf %s "$body" | head -c 300)" ;;
+esac
+
+# ── (f) every 0.5.0 address still answers ─────────────────────────────────────
+# Links were pasted the day they existed, .mcp.json files are configured against
+# them, four legacy-bearer production boards speak them, and `taskops ui`'s
+# upstream forward builds them. An old address that 404s in silence is this
+# chapter's own rule broken.
+head_ln "the 0.5.0 addresses, unprefixed"
+code=$($C -o /dev/null -w '%{http_code}' "$BASE/$BOARD/ui/") || fail "GET /$BOARD/ui/" "no answer"
+[ "$code" = 200 ] || fail "GET /$BOARD/ui/" "HTTP $code"
+pass "GET /$BOARD/ui/" "HTTP 200"
+code=$(rpc "/$BOARD/rpc" "Bearer") || fail "POST /$BOARD/rpc" "no answer"
+[ "$code" = 200 ] || fail "POST /$BOARD/rpc" "HTTP $code"
+pass "POST /$BOARD/rpc" "HTTP 200"
+code=$($C -o /dev/null -w '%{http_code}' "$BASE/$BOARD/git/commit/$BRANCH") \
+  || fail "GET /$BOARD/git/commit/$BRANCH" "no answer"
+[ "$code" = 200 ] || fail "GET /$BOARD/git/commit/$BRANCH" "HTTP $code"
+pass "GET /$BOARD/git/commit/$BRANCH" "HTTP 200"
+# /feed is a stream that never ends by design, so this reads the HEADERS and
+# hangs up. curl's own timeout is therefore EXPECTED here and not a failure —
+# what is asserted is the content type, which is what tells an SSE client it may
+# start reading.
+headers=$(curl -sS -m 3 -D - -o /dev/null "$BASE/$BOARD/feed" 2>/dev/null || true)
+case $headers in
+  *event-stream*) pass "GET /$BOARD/feed" "text/event-stream" ;;
+  *) fail "GET /$BOARD/feed" "no event-stream header: $(printf %s "$headers" | tr '\r\n' '  ')" ;;
+esac
+
+printf '\nall green — %s, board %s\n' "$HOST" "$BOARD"

{taskops_cli-0.5.0 → taskops_cli-0.5.1}/src/taskops/_version.py

@@ -1,4 +1,4 @@
 from __future__ import annotations
 
 __title__ = "taskops"
-__version__ = "0.5.0"  # single source of truth; pyproject reads it dynamically
+__version__ = "0.5.1"  # single source of truth; pyproject reads it dynamically

{taskops_cli-0.5.0 → taskops_cli-0.5.1}/src/taskops/http/auth.py

@@ -52,8 +52,26 @@ def token_in(header: str, path: str) -> str:
     agent's client sends a header, a browser follows a link (`?token=`), and a
     newcomer redeems an invite (`?invite=`). One extractor, so a door added
     later — /feed, /git — cannot accidentally invent a second way in.
+
+    POST-MORTEM (shipped broken in 0.5.0, reported 2026-08-31): this used to be
+    `header.removeprefix("Bearer ").strip()`, and that one line made every
+    PUBLIC board unreadable from its own hosted page. The page's client sends
+    `Authorization: "Bearer " + token()` — with no token, the header reaches
+    the server as `Bearer` (the trailing space stripped in transit), the prefix
+    `"Bearer "` does not match, and the LITERAL STRING "Bearer" came back as
+    the token. `creds.check` then answered "unknown credential — run: taskops
+    join" to a reader who presented nothing at all. Anonymous reads worked only
+    when NO Authorization header was sent — which no browser client does. So:
+    scheme and value are parsed as separate whitespace-delimited fields, the
+    scheme case-insensitive per RFC 7235, and a bearer scheme with NO value is
+    NO credential presented — the query-string fallback and, behind it, the
+    anonymous gate still run. This is deliberately narrow: a header that
+    carries any actual value — wrong, expired, or under a scheme this server
+    never spoke — is a credential that WAS presented, and it refuses exactly as
+    it always has. "Unparseable" is not "anonymous".
     """
-    token = header.removeprefix("Bearer ").strip()
+    scheme, _, value = header.strip().partition(" ")
+    token = value.strip() if scheme.lower() == "bearer" else header.strip()
     if token:
         return token
     for part in path.partition("?")[2].split("&"):

{taskops_cli-0.5.0 → taskops_cli-0.5.1}/src/taskops/http/handler.py

@@ -1,7 +1,7 @@
 """The request handler — one method per door, split out of `server.py` so the
 router (the class) and the server's lifecycle (`BoardServer`, `serve`) each
-have room. What each route MEANS is `server.py`'s docstring; this file is only
-how one request travels through it.
+have room. What each route MEANS is `server.py`'s docstring; this file is
+only how one request travels through it (`routes.py` reads the path).
 """
 
 from __future__ import annotations
@@ -13,6 +13,8 @@ from http.server import BaseHTTPRequestHandler
 from . import rpc, feed, admin, login, static, gitdoor
 from .. import _clock
 from .auth import Credential, token_in, anonymous
+from .mounts import NAME
+from .routes import split
 from .._errors import BadRequest, TaskopsError
 from .._version import __version__
 
@@ -67,7 +69,10 @@ class Handler(BaseHTTPRequestHandler):
         elif tail.startswith("git/"):
             self._git(board, tail[4:])
         elif tail.startswith("ui"):
-            self._static(board, tail[2:])
+            self._static(board, tail[2:])  # 0.5.0's address, kept — links were pasted
+        elif self.mounts.ui is None and NAME.match(board) and (not tail or static.asset(tail)):
+            # the page at the board's OWN address; assets are a CLOSED set
+            self._static(board, tail)
         elif (page := static.at_root(self.mounts.ui, self.path)) is not None:
             self._send(200, *page)  # a WINDOW serves its page at the ROOT
         else:
@@ -129,8 +134,10 @@ class Handler(BaseHTTPRequestHandler):
         return gitdoor.answer(repo, rest, self.path.partition("?")[2], mirrored=mirrored)
 
     def _static(self, board: str, rest: str) -> None:
-        """The /ui door. A WINDOW serves its bundle to whoever reaches the port,
-        unchanged. A serve-mode HOST serves the SAME packaged bundle for a board
+        """The page — at the board's own root since tk-32d2ba, and still at
+        /ui/, the 0.5.0 address (kept: links were pasted). A WINDOW serves
+        its bundle to whoever reaches the port, unchanged. A serve-mode HOST
+        serves the SAME packaged bundle for a board
         whose owner declared a forge (`repos.backed` — the fact, never a clone),
         behind the credential /rpc asks for: public board, anonymous READ;
         private board, the join refusal. The 410 comes BEFORE the credential on
@@ -191,9 +198,3 @@ class Handler(BaseHTTPRequestHandler):
 
     def _fail(self, status: int, err: TaskopsError) -> None:
         self._json(status, rpc.failure(err))
-
-
-def split(path: str) -> tuple[str, str]:
-    clean = path.partition("?")[0].strip("/")
-    board, _, tail = clean.partition("/")
-    return board, tail

taskops_cli-0.5.1/src/taskops/http/routes.py

@@ -0,0 +1,32 @@
+"""Where a request path splits into `(board, tail)` — ONE function, shared by
+GET and POST so the two methods cannot disagree about what a path names. Split
+out of `handler.py` at the seam that owns no HTTP at all (this module sees
+strings, never sockets), because the handler sits on the ≤200-line budget
+`tests/test_architecture.py` enforces.
+
+`api/` is stripped HERE, once. Since the board's own address became the page
+(tk-32d2ba), the machine doors — rpc, git, feed, invite/redeem — also answer
+under `/<board>/api/…`, which is the spelling the page uses from now on.
+Stripping in the split rather than per door means every door gets both
+spellings and none can drift: `/<board>/api/rpc` IS `/<board>/rpc` — same
+handler, same credential, same words. The 0.5.0 spellings stay, unprefixed,
+because agents, the MCP client, `taskops ui`'s upstream forward and four
+legacy production boards speak them today.
+
+The prefix cannot shadow a page asset: the packaged bundle's filenames are a
+CLOSED SET and none of them is named `api` (`static.asset` argues the same
+fact from the router's other side). And the ROOT is untouched — `/login`,
+`/rpc` and `/healthz` are one segment, so the strip, which lives in the TAIL,
+never sees them; a board named `api` still answers at `/api/…` because the
+strip runs after the board segment is taken.
+"""
+
+from __future__ import annotations
+
+
+def split(path: str) -> tuple[str, str]:
+    clean = path.partition("?")[0].strip("/")
+    board, _, tail = clean.partition("/")
+    if tail.startswith("api/"):
+        tail = tail[4:]
+    return board, tail

{taskops_cli-0.5.0 → taskops_cli-0.5.1}/src/taskops/http/static.py

@@ -86,6 +86,25 @@ def resolve(root: Path, rest: str) -> Path | None:
     return fallback if fallback.is_file() else None
 
 
+def asset(rest: str) -> bool:
+    """Is this tail a file the packaged bundle actually ships?
+
+    Since tk-32d2ba the page lives at the board's OWN address, so its relative
+    links — `./style.css`, `./app.js` off `index.html` — arrive as
+    `/<board>/style.css` and the router must tell the page's tails from a
+    board's machine doors. It can, deterministically: the bundle's filenames
+    are a CLOSED SET — whatever `ui/build.mjs` wrote into the wheel, flat,
+    every suffix in `TYPES` — and none of them is `rpc`, `git`, `feed`, `ui`
+    or `api`, so an asset can never shadow a door and a door never shadows an
+    asset. Checked against the real files rather than a hardcoded list, so a
+    bundle that grows a font ships without a router edit; a nested or
+    dot-leading tail is refused before disk is asked, which also keeps `..`
+    out without a resolve."""
+    if not rest or "/" in rest or rest.startswith(".") or Path(rest).suffix not in TYPES:
+        return False
+    return (PACKAGED / rest).is_file()
+
+
 def content_type(path: Path) -> str:
     return TYPES.get(path.suffix, "application/octet-stream")