ai/byre
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 9 Wiki Activity

Audit of fab6ce5

Browse Source
This commit is contained in:
Ian Gulliver
2026-10-21 10:53:43 -07:00
parent 761b9ced6a
commit d7c49a3fb8
3 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+1 -1
View File
@@ -20,7 +20,7 @@ A server and macOS app for running many coding agents (Claude Code, Codex and An
## Requirements
macOS and a [Tailscale](https://tailscale.com) tailnet with MagicDNS and HTTPS certificates turned on. byre and the app each join it as their own node, so no Mac needs the Tailscale app. Identity comes from Tailscale: byre serves only the tailnet's users, as its node identifies them.
macOS and a [Tailscale](https://tailscale.com) tailnet with MagicDNS and HTTPS certificates turned on. byre and the app each join it as their own node, so no Mac needs the Tailscale app. Remote access uses Tailscale identity: byre serves the tailnet's users, as its node identifies them. Local scripts use a bearer token to check server status and run commands on connected Macs (see [docs/operations.md](docs/operations.md#tailnet)).
The Mac that runs the server needs `git` and at least one agent CLI: Claude Code (`claude`), Codex (`codex`) or Antigravity (`agy`, for Gemini models; `brew install --cask antigravity-cli`, signed in once by running `agy`). Browser tools also need Node.js (agents' Playwright tools run through `npx`) and Google Chrome (`brew install git node --cask google-chrome`).
cmd/byre/serve.go
+1 -1
View File
@@ -37,7 +37,7 @@ func serveCmd(args []string) {
flags := flag.NewFlagSet("serve", flag.ExitOnError)
dataDir := flags.String("data", filepath.Join(configDir, "byre"), "directory holding byre's database, worktrees, leads and blobs")
listenAddr := flags.String("listen", defaultListen, "loopback address serving GET /api/tailnet")
listenAddr := flags.String("listen", defaultListen, "loopback address for server status and client commands")
ports := flags.Int("ports", store.DefaultPortFirst, "first port of the tasks' port blocks")
hostname := flags.String("ts-hostname", "byre-"+macSlug(), "hostname of byre's tailnet node")
flags.Parse(args)
docs/operations.md
+2 -2
View File
@@ -20,11 +20,11 @@ The service always runs from the app: `/Applications/Byre.app/Contents/Helpers/b
## Tailnet
byre runs its own tailnet node with `tsnet`; it doesn't use the Tailscale app. The API is served only there, at the root of the node's `ts.net` name on 443, not under a path: the API uses absolute paths and the app takes an origin with no path. There is no way to call the API other than as a tailnet user; a tagged node gets 403.
byre runs its own tailnet node with `tsnet`; it doesn't use the Tailscale app. The app connects at the root of the node's `ts.net` name on 443, not under a path: the API uses absolute paths and the app takes an origin with no path. Tailnet access requires a user identity; a tagged node gets 403. Local scripts can also check server status and run client commands through the authenticated loopback address.
Tailscale identifies the connecting Mac, including requests from a web page opened there; network identity alone doesn't establish the user's intent. Cross-origin browser requests must not be allowed to change state through that identity. Native app and CLI access remains intentional.
The local status endpoint requires the bearer credential in `<data>/loopback-token`, regenerated on service startup. Loopback is reachable by other OS accounts, so it cannot protect the node’s sign-in URL by itself.
Loopback access requires the bearer credential in `<data>/loopback-token`, regenerated on service startup. It grants both server status (including the node's sign-in URL) and command execution on connected client Macs. Keep it private: loopback is reachable by other OS accounts, so the address alone provides no protection.
A new node needs signing in: `curl -H "Authorization: Bearer $(cat "$HOME/Library/Application Support/byre/loopback-token")" <loopback>/api/tailnet` (`byre check` prints the loopback address) shows `NeedsLogin` and the `auth_url`, and the app on the same Mac shows it as **Sign in to Tailscale**. The tailnet must have MagicDNS and HTTPS certificates turned on (the DNS page of Tailscale's admin console); without certificates byre logs `tailnet has no https certificates` and serves only the loopback address until it is restarted.