feat: in-app cross-device LAN reachability (circle key + LAN toggle)#89
Merged
Conversation
Add an opt-in LAN-exposure marker (LanExposurePath / LanExposureEnabled / SetLanExposure). When set, Ensure binds the managed daemon to 0.0.0.0 with --allow-lan + a token file instead of the 127.0.0.1 --no-auth loopback default, so circle peers can reach the read-only A2A endpoints. Security invariant (unit-tested): a non-loopback bind is NEVER --no-auth and always carries a token, so code-executing endpoints stay bearer-gated against the network; only the circle-key read-only endpoints are LAN-reachable. Default off — loopback/no-auth behaviour is byte-for-byte unchanged. Foundation only: enabling still needs the app toggle + a loopback-trust middleware tweak so local consumers keep working without a token.
…umers When the daemon is LAN-exposed (--allow-lan, token enforced), requests originating from loopback (127.0.0.1/::1) now bypass the token — the machine is still its own trust boundary, so codex / claude-code / gemini keep reaching the daemon over loopback with no token and no reprovisioning. LAN callers still need the bearer token (code-exec) or circle key (read-only enumeration). Gated on AllowLAN, so relay / explicit token-only deployments are unchanged (loopback still requires the token there). Unit-tested: loopback bypass, LAN token enforcement, and the no-trust path.
Wraps daemon.SetLanExposure + a daemon restart so Ensure rebinds: `on` exposes the daemon to LAN circle peers (0.0.0.0 + token; loopback stays token-free), `off` returns it to loopback. `status` prints on/off for the desktop app to read. The first `on` boot installs the platform firewall rules via serve's --allow-lan hook.
The Network → Cross-device card gains a "Reachable on your LAN" switch alongside the circle key. Flipping it on runs `daemon lan on` (rebinds the daemon to 0.0.0.0 + token, loopback stays token-free, firewall auto-prompt on first enable) so circle peers can read this device's agent list; off returns to loopback. Backed by LanStatus/LanEnable/LanDisable App methods. Completes the in-app cross-device flow: shared circle key (trust) + LAN reachability (transport), no CLI.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Makes cross-device peering work end-to-end from the desktop app — no CLI. Two layers, both now one-click in Network → Cross-device:
0.0.0.0with--allow-lan+ token auth so circle peers can read this device's agent list.Security model
--no-authand always carries a token (unit-tested invariant). Code-executing endpoints stay bearer-only; only the read-only circle endpoints are LAN-reachable, gated by the circle key.127.0.0.1/::1bypass the token, so local consumers (codex / claude-code / gemini) keep working with no token and no reprovisioning. LAN callers still need the token (full) or circle key (read-only). Gated on--allow-lan, so relay / explicit token-only deployments are unchanged.--allow-lanhook (Windows UAC; macOS no-op).Changes
internal/daemon:LanExposurePath/Enabled/SetLanExposure+ config-drivendaemonServeArgs(pure, tested).internal/server:trustLoopbackinauthMiddleware/circleOrBearer+isLoopbackRequest(tested).internal/cli:clawtool daemon lan <on|off|status>.cmd/clawtool-installer:LanStatus/LanEnable/LanDisable+ the Network card LAN toggle.Test plan
make ci-fast(fmt/vet/build/version-sync/test -race) greenisLoopbackRequest, LAN toggle,daemonServeArgs