archipelagoandClaude Fable 5
58cdea5e79
Demo images / Build & push demo images (push) Successful in 3m33s
Some apps carry a complete account system and are broken by an upstream challenge: git clients speak basic-auth (not browser cookies), and a BTCPay checkout link handed to a customer must open for that customer. Both were behind the gate's login page — the "non-browser clients need an access token" gap disclosed in five consecutive releases. - New manifest port policy `auth: open`: the daemon still fronts the port exactly like `gated` (loopback pin, external binds, frame-header fixes, app-down retry page, Tor upstream) but serves it without the login challenge. Requires auth_rationale, same burden of proof as `none`. Gitea 3001 and BTCPay 23000 declare it. - Runtime operator override per app (security.set-app-gate → app-configs/ <id>.json "gateEnabled"), surfaced as Settings → app → Access control. Wins over the manifest in both directions and applies on the next request — no restart, and it works today on catalog-covered apps whose signed manifest still says `gated`. - The gate resolves policy per-request from the live port map, so a toggle takes effect without waiting for the 60s rebind sweep. "Off" never releases the port: gated apps are loopback-pinned, so releasing would strand them, not open them. - security.app-gate-status now reports gate_enabled + any override. - New guard test pins the `auth: open` set (both entries reviewed); the `auth: none` count moves 25 → 26, absorbing pre-existing drift from the phoenixd onboarding (loopback JSON API with its own generated password). - Docs: the manifest spec's ports row documented only host/container/ protocol — bind, auth, auth_rationale and session_passthrough were undocumented. Added a full "Ports & the app gate" section plus a developer-guide entry telling app authors to enforce their own auth regardless, since the operator can flip the gate either way. Verified live on archi-dev-box from an external address: gated → 401 gate page; override off → Gitea 200 own page, BTCPay 302 to its own login, git-over-HTTP info/refs 200; override on → 401 again; clear → default. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>