Problem
The HITL approval UI (pasu-ui) serves approve/deny with no authentication, and the egress admin socket accepts any local caller. Fine for a localhost pilot; not acceptable once the UI is reachable by more than the operator — an unauthenticated party could approve a held tool call or edit the live allowlist.
Proposal
- Minimal bearer-token auth: token from env/file, required on all UI routes and (optionally) as a prefix line on the admin socket protocol.
- Constant-time comparison; no token → serve nothing (fail-closed, consistent with the project rule).
- TLS stays out of scope (terminate at a reverse proxy); document that.
Notes
Keep the mechanism dependency-light — this guards a small self-hosted surface, not a multi-tenant product.
Problem
The HITL approval UI (
pasu-ui) serves approve/deny with no authentication, and the egress admin socket accepts any local caller. Fine for a localhost pilot; not acceptable once the UI is reachable by more than the operator — an unauthenticated party could approve a held tool call or edit the live allowlist.Proposal
Notes
Keep the mechanism dependency-light — this guards a small self-hosted surface, not a multi-tenant product.