fix(gui): renew loopback dashboard sessions silently instead of prompting

Since the management/data credential split, an expired GUI session (5-minute
TTL) or one invalidated by a proxy restart fell through to a window.prompt
demanding the admin token — a credential the default loopback user never
chose or even knows exists (it is auto-generated under ~/.opencodex).

The dashboard fetch wrapper now re-bootstraps the session from a freshly
served document before any prompt: the server already mints short-lived
loopback sessions into the HTML meta tags on every page load, so renewal is
silent and needs no user interaction. Origin and token-prefix validation is
unchanged, and the prompt remains only as the operator fallback on
non-loopback binds, where the server refuses to mint sessions at all.

Security posture is unchanged: the server still decides when to issue
sessions, tokens stay memory-only, and nothing new crosses the origin
boundary.

Author: lidge-jun

docs-site/src/content/docs/guides/web-dashboard.md

@@ -21,6 +21,14 @@ ocx start
 bun run dev:gui
 ```
 
+## Sign-in
+
+On the default loopback bind (`localhost` / `127.0.0.1`) the dashboard never asks for a token:
+the proxy mints short-lived GUI sessions into the served page and renews them silently when
+they expire or the proxy restarts. Only a dashboard bound to a non-loopback hostname requires
+the admin token (`OPENCODEX_ADMIN_AUTH_TOKEN`, or the auto-generated
+`~/.opencodex/admin-api-token` file).
+
 ## What you can do
 
 | Area | What it does |

gui/src/api.ts

@@ -1,13 +1,19 @@
 let installed = false;
 /** Shared 401 refresh gate — concurrent waiters join one prompt / token resolution. */
-let promptInFlight: Promise<string | null> | null = null;
+let resolutionInFlight: Promise<string | null> | null = null;
+/** Unwrapped fetch captured at install time — used for session re-bootstrap so the
+ *  bootstrap document request itself never enters the 401 handling path. */
+let rawFetch: typeof fetch | null = null;
 /**
  * After the user cancels (or submits blank) once, suppress further prompts for this page
  * lifetime so a staggered 401 fan-out does not reopen the dialog N times (#647 / Codex).
  * A full reload clears module state and allows prompting again.
  */
 let promptCancelled = false;
 
+/** Document path re-fetched to mint a fresh loopback GUI session (server injects meta tags). */
+const SESSION_REBOOTSTRAP_PATH = "/";
+
 function needsApiAuth(input: RequestInfo | URL): boolean {
   try {
     const raw = input instanceof Request ? input.url : String(input);
@@ -53,17 +59,58 @@ function loadInjectedSession(): void {
   const token = takeMetaContent("opencodex-session-token");
   const csrfToken = takeMetaContent("opencodex-session-csrf");
   const origin = takeMetaContent("opencodex-session-origin");
-  if (!token?.startsWith("ocx_session_") || !csrfToken || origin !== window.location.origin) return;
-  memoryToken = token;
-  memoryCsrfToken = csrfToken;
-  memorySessionOrigin = origin;
+  storeSession(token, csrfToken, origin);
 }
 
 /** Clear memory only when it still holds `expected` (avoid wiping a newer concurrent store). */
 function clearTokenIfCurrent(expected: string | null): void {
   if (expected != null && readToken() === expected) clearToken();
 }
 
+/** Validate and store a server-minted GUI session; rejects anything bound to another origin. */
+function storeSession(token: string | null, csrfToken: string | null, origin: string | null): boolean {
+  if (!token?.startsWith("ocx_session_") || !csrfToken || origin !== window.location.origin) return false;
+  memoryToken = token;
+  memoryCsrfToken = csrfToken;
+  memorySessionOrigin = origin;
+  return true;
+}
+
+/** Read one named meta tag out of a served HTML document (attribute order varies). */
+function metaContentFromHtml(html: string, name: string): string | null {
+  for (const tag of html.match(/<meta\b[^>]*>/gi) ?? []) {
+    const nameMatch = tag.match(/\bname="([^"]+)"/i);
+    if (nameMatch?.[1] !== name) continue;
+    const contentMatch = tag.match(/\bcontent="([^"]*)"/i);
+    return contentMatch?.[1]?.trim() || null;
+  }
+  return null;
+}
+
+/**
+ * Silently renew the GUI session from a freshly served document. Loopback servers mint
+ * short-lived sessions into the HTML on every page load, so an expired session (5-minute
+ * TTL) or one invalidated by a proxy restart is replaced without ever asking the user for
+ * a token. Returns null when the server refuses to mint sessions (non-loopback operator
+ * dashboards), where the manual admin-token prompt remains the fallback.
+ */
+async function reBootstrapSessionToken(): Promise<string | null> {
+  if (!rawFetch) return null;
+  try {
+    const response = await rawFetch(SESSION_REBOOTSTRAP_PATH, { cache: "no-store" });
+    if (!response.ok) return null;
+    const html = await response.text();
+    const stored = storeSession(
+      metaContentFromHtml(html, "opencodex-session-token"),
+      metaContentFromHtml(html, "opencodex-session-csrf"),
+      metaContentFromHtml(html, "opencodex-session-origin"),
+    );
+    return stored ? readToken() : null;
+  } catch {
+    return null;
+  }
+}
+
 function clearLegacySessionToken(): void {
   try {
     sessionStorage.removeItem(LEGACY_TOKEN_KEY);
@@ -93,25 +140,28 @@ function withToken(input: RequestInfo | URL, init: RequestInit | undefined, toke
  */
 async function resolveTokenAfter401(failedToken: string | null): Promise<string | null> {
   if (promptCancelled) return null;
-  if (promptInFlight) return promptInFlight;
+  if (resolutionInFlight) return resolutionInFlight;
 
-  promptInFlight = (async () => {
+  resolutionInFlight = (async () => {
     if (promptCancelled) return null;
     const current = readToken();
     if (current && current !== failedToken) return current;
 
-    const prompted = window.prompt("OpenCodex API token")?.trim() || null;
+    const renewed = await reBootstrapSessionToken();
+    if (renewed) return renewed;
+
+    const prompted = window.prompt("OpenCodex admin token (OPENCODEX_ADMIN_AUTH_TOKEN)")?.trim() || null;
     if (prompted) {
       storeToken(prompted);
       return prompted;
     }
     promptCancelled = true;
     return null;
   })().finally(() => {
-    promptInFlight = null;
+    resolutionInFlight = null;
   });
 
-  return promptInFlight;
+  return resolutionInFlight;
 }
 
 export function installApiAuthFetch(): void {
@@ -121,6 +171,7 @@ export function installApiAuthFetch(): void {
   clearLegacySessionToken();
   loadInjectedSession();
   const originalFetch = window.fetch.bind(window);
+  rawFetch = originalFetch;
   window.fetch = async (input: RequestInfo | URL, init?: RequestInit) => {
     if (!needsApiAuth(input)) return originalFetch(input, init);
 
@@ -156,6 +207,7 @@ export function resetApiAuthFetchForTests(): void {
   memoryToken = null;
   memoryCsrfToken = null;
   memorySessionOrigin = null;
-  promptInFlight = null;
+  resolutionInFlight = null;
+  rawFetch = null;
   promptCancelled = false;
 }

gui/tests/api-auth-memory.test.ts

@@ -122,6 +122,11 @@ test("concurrent 401s share one token prompt and all retry with the stored token
   const release401: Array<() => void> = [];
   const mockFetch = (async (_input: RequestInfo | URL, init?: RequestInit) => {
     const headers = new Headers(init?.headers);
+    // Session re-bootstrap probe: this fixture never mints sessions, so fail it fast
+    // instead of letting it join the release queue below.
+    if (new URL(_input instanceof Request ? _input.url : String(_input), "http://localhost/").pathname === "/") {
+      return new Response("unauthorized", { status: 401 });
+    }
     if (headers.get("X-OpenCodex-API-Key") === "shared-token") {
       return new Response("{}", { status: 200 });
     }
@@ -240,6 +245,9 @@ test("canceling the token prompt once does not reopen it for the rest of the 401
   const release401: Array<() => void> = [];
   const mockFetch = (async (_input: RequestInfo | URL, init?: RequestInit) => {
     const headers = new Headers(init?.headers);
+    if (new URL(_input instanceof Request ? _input.url : String(_input), "http://localhost/").pathname === "/") {
+      return new Response("unauthorized", { status: 401 });
+    }
     if (headers.get("X-OpenCodex-API-Key")) {
       return new Response("{}", { status: 200 });
     }
@@ -310,3 +318,98 @@ test("data-plane requests never receive the management token or prompt", async (
   expect(seenHeaders).toEqual([null]);
   expect(promptCalls).toBe(beforeCrossPrompts);
 });
+
+function injectSessionMeta(token: string, csrf: string, origin: string): void {
+  for (const [name, content] of [
+    ["opencodex-session-token", token],
+    ["opencodex-session-csrf", csrf],
+    ["opencodex-session-origin", origin],
+  ] as const) {
+    const meta = document.createElement("meta");
+    meta.setAttribute("name", name);
+    meta.setAttribute("content", content);
+    document.head.appendChild(meta);
+  }
+}
+
+function sessionDocumentHtml(token: string, csrf: string, origin: string): string {
+  return [
+    "<!doctype html><html><head>",
+    `<meta name="opencodex-session-token" content="${token}">`,
+    `<meta name="opencodex-session-csrf" content="${csrf}">`,
+    `<meta name="opencodex-session-origin" content="${origin}">`,
+    "</head><body></body></html>",
+  ].join("");
+}
+
+test("expired session silently re-bootstraps from the served document without prompting", async () => {
+  // Regression for the post-security-hardening UX bug: loopback sessions expire after the
+  // 5-minute TTL (or die on proxy restart), and the dashboard used to demand an admin token
+  // the user never chose. The fetch wrapper must renew the session from a freshly served
+  // document instead — token entry is not part of the default loopback experience.
+  injectSessionMeta("ocx_session_stale", "stale-csrf", "http://localhost");
+
+  let promptCalls = 0;
+  let bootstrapFetches = 0;
+  const seenApiKeys: Array<string | null> = [];
+  const seenGuiOrigins: Array<string | null> = [];
+  const mockFetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
+    const raw = input instanceof Request ? input.url : String(input);
+    const url = new URL(raw, "http://localhost/");
+    const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined));
+    if (url.pathname === "/") {
+      bootstrapFetches += 1;
+      return new Response(sessionDocumentHtml("ocx_session_fresh", "fresh-csrf", "http://localhost"), {
+        status: 200,
+        headers: { "Content-Type": "text/html" },
+      });
+    }
+    seenApiKeys.push(headers.get("X-OpenCodex-API-Key"));
+    seenGuiOrigins.push(headers.get("X-OpenCodex-GUI-Origin"));
+    if (headers.get("X-OpenCodex-API-Key") === "ocx_session_fresh"
+      && headers.get("X-OpenCodex-GUI-Origin") === "http://localhost") {
+      return new Response("{}", { status: 200 });
+    }
+    return new Response("unauthorized", { status: 401 });
+  }) as typeof fetch;
+  window.prompt = () => {
+    promptCalls += 1;
+    return null;
+  };
+  await installMockAuthFetch(mockFetch);
+
+  const res = await fetch("/api/config");
+  expect(res.status).toBe(200);
+  expect(promptCalls).toBe(0);
+  expect(bootstrapFetches).toBe(1);
+  expect(seenApiKeys).toEqual(["ocx_session_stale", "ocx_session_fresh"]);
+  expect(seenGuiOrigins).toEqual(["http://localhost", "http://localhost"]);
+});
+
+test("a session minted for another origin is rejected and the prompt fallback stays", async () => {
+  // Non-loopback dashboards never get server-minted sessions; a re-bootstrap document whose
+  // origin does not match must not be trusted, and the operator-only prompt remains.
+  let promptCalls = 0;
+  const mockFetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
+    const raw = input instanceof Request ? input.url : String(input);
+    const url = new URL(raw, "http://localhost/");
+    const headers = new Headers(init?.headers);
+    if (url.pathname === "/") {
+      return new Response(sessionDocumentHtml("ocx_session_foreign", "foreign-csrf", "http://192.0.2.10:10100"), {
+        status: 200,
+        headers: { "Content-Type": "text/html" },
+      });
+    }
+    if (headers.get("X-OpenCodex-API-Key") === "manual-admin-token") return new Response("{}", { status: 200 });
+    return new Response("unauthorized", { status: 401 });
+  }) as typeof fetch;
+  window.prompt = () => {
+    promptCalls += 1;
+    return "manual-admin-token";
+  };
+  await installMockAuthFetch(mockFetch);
+
+  const res = await fetch("/api/config");
+  expect(res.status).toBe(200);
+  expect(promptCalls).toBe(1);
+});