Dashboard: automatic browser access, no token entry

.env.example

@@ -45,8 +45,11 @@ ENGRAPHIS_SERVICE_MODE=customer
 
 # Optional local API bearer. If set, supported protected routes accept
 # Authorization: Bearer <token>. Use a strong, independently revocable value and do not
-# reuse a hosted Engraphis credential here.
+# reuse a hosted Engraphis credential here. Browsers open the dashboard automatically;
+# they never type this value. Set ENGRAPHIS_BROWSER_AUTO_SESSION=0 to require one-time
+# sign-in links (`engraphis-dashboard --link`) instead.
 ENGRAPHIS_API_TOKEN=
+# ENGRAPHIS_BROWSER_AUTO_SESSION=1
 
 # ── Storage ─────────────────────────────────────────────────────────────────
 # SQLite database override. Leave commented to use <repo>/engraphis.db from a source

CHANGELOG.md

@@ -5,6 +5,15 @@ All notable changes to Engraphis are documented here. Format loosely follows
 
 ## [Unreleased]
 
+- Browsers no longer enter a token. The dashboard opens automatically for any browser that
+  can reach it; the deployment's network reachability is the dashboard boundary. Session
+  issuance still requires the same-origin custom header and a published Host, and only an
+  operator-declared forwarding proxy may supply proxy headers. Machine clients and `/mcp`
+  continue to require `Authorization: Bearer ENGRAPHIS_API_TOKEN`. Set
+  `ENGRAPHIS_BROWSER_AUTO_SESSION=0` for a hardened deployment, where
+  `engraphis-dashboard --link` (or `POST /api/auth/link`) issues a single-use, 15-minute
+  sign-in link that opens a 12-hour browser session.
+
 ## [1.7.12] - 2026-10-30
 
 Candidate package version: **1.7.12**. Publication and hosted-service qualification remain separate.

SECURITY.md

@@ -58,13 +58,17 @@ DOMPurify at all render sites. Verified against payloads with `onerror` handlers
 - **Loopback by default** (`ENGRAPHIS_HOST=127.0.0.1`)
 - **Optional bearer token** (`ENGRAPHIS_API_TOKEN`): constant-time comparison (single
   shared implementation in the local customer runtime)
-- **Automatic local dashboard access:** the browser on this computer obtains its
-  HttpOnly, SameSite session without entering an API token. Session issuance requires
-  a literal loopback peer, a loopback/localhost Host, an exact same-origin POST, and
-  the dashboard's custom browser header. Forwarding headers, nonlocal peers, DNS
-  hostnames, cross-site requests, and configured LAN-trust exceptions cannot mint it.
-  Existing browser confirmations and CSRF checks still govern reviewed writes.
-  Local programs already able to act as this user remain inside the local trust boundary.
+- **Automatic dashboard access (default):** a browser that can reach the dashboard opens it
+  without entering a credential. Session issuance requires a same-origin POST carrying the
+  dashboard's custom browser header and an Origin that exactly matches a published Host
+  (loopback, a literal address, a single-label/mDNS name, or the configured
+  `ENGRAPHIS_DASHBOARD_URL`). Forwarding headers are honored only from a proxy listed in
+  `ENGRAPHIS_FORWARDED_ALLOW_IPS`, so another website cannot drive a browser into this
+  server through DNS rebinding. Existing browser confirmations and CSRF checks still govern
+  reviewed writes. **The deployment's network reachability is the dashboard's boundary:**
+  anyone who can open that origin has full access to this node's memories. Set
+  `ENGRAPHIS_BROWSER_AUTO_SESSION=0` to require one-time sign-in links instead. Remote API
+  and MCP clients always need `Authorization: Bearer`.
 - Pro and Team account sign-in belongs to optional hosted services; it does not gate
   opening the local dashboard. Remote API and operator access still require credentials.
 - **No local Team identity service:** the public dashboard is single-user. Team logins,

docs/AGENT_CONNECT.md

@@ -21,9 +21,14 @@ legacy client pins direct tool names, configure `engraphis-mcp-classic` instead.
 Use `ENGRAPHIS_API_TOKEN` only when protecting a local HTTP surface; it is not a Team identity or
 seat credential.
 
-The dashboard on the same computer opens automatically without an account or token entry.
-Its browser session is established locally while remote API clients still supply their bearer
-credential. Pro and Team account connection is a separate, optional hosted-service flow.
+The dashboard opens automatically for any browser that can reach it. Its browser session is
+established by a same-origin request; nobody signs in and nobody types the deployment token. The
+deployment's network reachability is therefore the dashboard's boundary. Remote API and MCP
+clients still supply their bearer credential. For a dashboard exposed to a network you do not
+trust, set `ENGRAPHIS_BROWSER_AUTO_SESSION=0` and hand out one-time sign-in links instead: run
+`engraphis-dashboard --link` on the server (single use, 15 minutes) and open the printed link;
+it exchanges itself for a 12-hour browser session. Pro and Team account connection is a
+separate, optional hosted-service flow.
 
 ## Local MCP over HTTP
 

docs/CONFIGURATION.md

@@ -16,7 +16,8 @@ control-plane, relay, compute, and worker implementations are private services.
 | `ENGRAPHIS_HOST` | `127.0.0.1` | Server bind address |
 | `ENGRAPHIS_PORT` | `8700` | Dashboard port. A platform-injected `$PORT` (Railway/Fly/Heroku) takes precedence over this value for the dashboard bind; Compose pins both to `ENGRAPHIS_COMPOSE_PORT` so the mapping stays in sync |
 | `ENGRAPHIS_SERVICE_MODE` | `customer` | The public package supports only `customer`; hosted vendor, relay, compute, and worker roles are not distributed here |
-| `ENGRAPHIS_API_TOKEN` | Not set | Optional bearer credential for remote API/operator access to this single-user node; never reuse a hosted credential. The dashboard on the same computer opens automatically, including when this token is set; local users do not enter it. |
+| `ENGRAPHIS_API_TOKEN` | Not set | Optional bearer credential for remote API/operator access to this single-user node; never reuse a hosted credential. Machine clients and `/mcp` present it as `Authorization: Bearer`. Browsers never type it: the dashboard opens automatically, or with a one-time link when `ENGRAPHIS_BROWSER_AUTO_SESSION=0`. |
+| `ENGRAPHIS_BROWSER_AUTO_SESSION` | `true` | A browser that reaches the dashboard opens it without a credential, so the deployment's network reachability is the dashboard's boundary. Set to `false` to require a one-time sign-in link (`engraphis-dashboard --link`, or `POST /api/auth/link` with the bearer): single use, 15 minutes, 12-hour session. |
 | `ENGRAPHIS_CORS_ORIGINS` | loopback on `ENGRAPHIS_PORT` | Comma-separated REST CORS allow-list; defaults to `127.0.0.1` and `localhost` on the configured port |
 | `ENGRAPHIS_INDEX_ROOTS` | Working, home, and temporary directories | Optional path-separator-delimited absolute-path allow-list that replaces the default roots accepted by local code indexing |
 | `ENGRAPHIS_HTTP_INDEX_ROOT` | First `ENGRAPHIS_INDEX_ROOTS` entry, or current directory | Single root for dashboard and REST `POST /api/code/index`; submitted paths resolve beneath it. An explicit root (or fallback entry) must be absolute; an explicit HTTP root is included in the engine-approved set. MCP and CLI indexing continue to use `ENGRAPHIS_INDEX_ROOTS`. |

docs/DOCKER.md

@@ -65,6 +65,20 @@ without `ENGRAPHIS_API_TOKEN`; it replaces the loopback port mapping with an all
 After this opt-in, other machines on the LAN can use
 `http://<host-LAN-IP>:8700`.
 
+Any browser that can reach the dashboard opens it: no token, no link. The port's network
+reachability is the dashboard's boundary, while API and MCP clients still present
+`Authorization: Bearer <ENGRAPHIS_API_TOKEN>`. If the LAN itself is not trusted, set
+`ENGRAPHIS_BROWSER_AUTO_SESSION=0` and hand out one-time links instead:
+
+```bash
+docker compose exec engraphis engraphis-dashboard --link
+```
+
+Open the printed link in the browser (it is single use and expires in 15 minutes; the resulting
+browser session lasts 12 hours). The link is built from `ENGRAPHIS_DASHBOARD_URL` when set, so
+configure that to the address clients actually use. Links are bound to the running process:
+restarting the container invalidates any link that has not been used yet.
+
 The Docker image includes the streamable HTTP MCP endpoint at `/mcp/` (the `/mcp` path redirects
 there). Configure `ENGRAPHIS_DASHBOARD_URL` to the exact LAN IP or hostname clients use so MCP's
 DNS-rebinding protection accepts the request. For example, use

docs/HOSTING_RAILWAY.md

@@ -37,6 +37,22 @@ loosening its host/origin allow-list. If you attach a custom domain, override it
 canonical HTTPS URL after Railway has activated the domain; do not use an internal Railway domain
 or a URL containing credentials.
 
+A browser opens the dashboard automatically once it can reach the public URL. The URL's
+reachability is therefore the dashboard boundary; API and MCP clients still use
+`Authorization: Bearer <ENGRAPHIS_API_TOKEN>`.
+
+> **Public exposure:** a Railway service on a public domain is reachable by anyone who learns
+> the URL, and by default that browser opens the dashboard with full access to this node's
+> memories. For a public deployment, set `ENGRAPHIS_BROWSER_AUTO_SESSION=0` and use one-time
+> links:
+
+```bash
+railway run engraphis-dashboard --link
+```
+
+> The printed link is single use and expires in 15 minutes; it is built from
+> `ENGRAPHIS_DASHBOARD_URL` and opens a 12-hour browser session.
+
 Do not add Resend (or any other email-provider) credentials to this customer node. The public
 runtime has no transactional-email sender, verification, invitation, or billing-email service;
 those systems remain in the official hosted control plane.

engraphis/config.py

@@ -910,6 +910,10 @@ class Settings:
     # Optional bearer token. When non-empty, the REST API requires
     # `Authorization: Bearer <token>` on protected routes; health and the page shell stay public.
     api_token: str = field(default_factory=lambda: _env("ENGRAPHIS_API_TOKEN", ""))
+    # A browser that can reach the dashboard opens it without a credential. Set this to
+    # off to require the one-time sign-in link instead (hardened public deployments).
+    browser_auto_session: bool = field(
+        default_factory=lambda: _env_bool("ENGRAPHIS_BROWSER_AUTO_SESSION", True))
     # Comma-separated CORS allow-list. Defaults to loopback only (local-first).
     cors_origins: list = field(
         default_factory=lambda: _parse_origins(_env("ENGRAPHIS_CORS_ORIGINS", ""),