Pearl th-6dd202: th code sends the local token — fixes 401 on every connect#281
Merged
Conversation
…onnect th code called connect_async with NO auth while the daemon runs the operator's strict-auth local flavor, so every session died on 401 Unauthorized and the error misdirected to `Run: th up` for an already-running server. Verified against the live daemon: no-auth=401, Authorization: Bearer=401 (the upgrade path doesn't consult headers), ?token=<correct>=101 Switching Protocols, ?token=WRONG=401. Resolve the token exactly as the daemon does (SMOOTH_LOCAL_TOKEN -> ~/.smooth/operator-token, read-only since the daemon provisions it) and pass it as ?token=, percent-encoded so & / # / space can't truncate the query. 401 now explains the token mismatch. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TwUg6nyMqXHzFDsibzTKmp
🦋 Changeset detectedLatest commit: d57ed29 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
brentrager
enabled auto-merge (squash)
July 26, 2026 21:00
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The bug
th codewas completely unusable against a normal Big Smooth:th codecalledconnect_async(&ws_url)with no authentication whatsoever, while the daemon runs the operator's strict-auth local flavor (strict_auth(true)) which rejects unauthenticated upgrades rather than degrading to anonymous. And the error told you toth up— a server that was already running — sending you after the wrong thing.Verified empirically (live daemon on :4400, not guessed)
th codedid)Authorization: Bearer <token>?token=<correct>?token=WRONGFix
SMOOTH_LOCAL_TOKEN→~/.smooth/operator-token. Read-only — the daemon provisions the token; a client minting its own would only send a value the server never accepts. No token anywhere → connect unauthenticated (correct for a non-strict server).?token=, percent-encoded so a user-suppliedSMOOTH_LOCAL_TOKENcontaining&,#, or a space can't silently truncate the query into a baffling 401.th up.Tests
token_is_percent_encoded_for_the_query_string(hex passes through, unreserved preserved, metacharacters escaped) andlocal_token_prefers_env_and_trims(env wins, whitespace trimmed, blank env doesn't resolve to an empty token). Serialized on a mutex since they mutate process-global env and cargo runs tests in parallel threads. Full crate suite green: 252 passed.🤖 Generated with Claude Code