GUI cannot authenticate to remote daemon #84

Arbor Version

20260316.01

Operating System

macOS 15 (Sequoia)

OS Version Details

15.7.3

Architecture

Apple Silicon (M1/M2/M3/M4)

Installation Method

Homebrew Cask

Description

Summary

When connecting the Arbor GUI to a remote ‎arbor-httpd that has ‎[daemon].auth_token configured, the GUI consistently fails with HTTP 401, even when launched from an environment that has both ‎ARBOR_DAEMON_URL and ‎ARBOR_DAEMON_AUTH_TOKEN set.

The same daemon, using the same token, works correctly via the browser-based web UI.

This suggests the GUI is not attaching the bearer token from ‎ARBOR_DAEMON_AUTH_TOKEN to its HTTP requests, even though other clients do.

Steps to Reproduce

1. On the machine running ‎arbor-httpd, configure a daemon auth token:# ~/.config/arbor/config.toml (remote daemon host)

[daemon]
auth_token = "REDACTED_TOKEN"

Start or restart ‎arbor-httpd so it binds remotely with auth enabled.

2. On the macOS client, configure the GUI to talk to that daemon:# ~/.config/arbor/config.toml (local client)

daemon_url = "http://REMOTE-DOMAIN-OR-HOST:8787"

3. In a terminal on the macOS client, set the environment variables:

export ARBOR_DAEMON_URL="http://REMOTE-DOMAIN-OR-HOST:8787"
export ARBOR_DAEMON_AUTH_TOKEN="REDACTED_TOKEN"

4. From that same shell, launch the GUI from the cask bundle:/Applications/Arbor.app/Contents/MacOS/Arbor

5. Once the GUI opens, let it try to connect to the daemon and list terminals.

6. In parallel, visit the same daemon URL in a browser (e.g. ‎http://REMOTE-DOMAIN-OR-HOST:8787), enter the same token when prompted, and confirm that the web UI works and can open a terminal session.

Expected Behavior

• The GUI should behave like other Arbor clients:

  • Read ARBOR_DAEMON_URL and ARBOR_DAEMON_AUTH_TOKEN from the environment when present.
  • Attach an Authorization: Bearer REDACTED_TOKEN header to all non‑loopback HTTP requests to the daemon.

• With a valid token:

  • The GUI should be able to list terminals and connect to the remote daemon without 401 errors.
  • Behavior should match the web UI (which succeeds with the same token) and the documented behavior of arbor-cli / arbor-mcp using ARBOR_DAEMON_URL and ARBOR_DAEMON_AUTH_TOKEN.

Actual Behavior

• When the GUI starts, it shows an error like:

  failed to list terminal sessions from daemon at http://REMOTE-DOMAIN-OR-HOST:8787: daemon request failed with status 401 (expected 200): daemon request failed

• The same daemon and token work correctly through the browser-based web UI:

  • Navigate to the daemon URL in a browser.
  • Enter the same token when prompted.
  • The web UI loads and remote terminal sessions work as expected.

• The GUI is launched from a shell where:

  echo "$ARBOR_DAEMON_URL"        # -> http://REMOTE-DOMAIN-OR-HOST:8787
  echo "$ARBOR_DAEMON_AUTH_TOKEN" # -> REDACTED_TOKEN

so the environment variables are definitely set for the GUI process, but the daemon still responds with 401 when the GUI tries to list terminals.

Logs / Screenshots

• GUI toast:failed to list terminal sessions from daemon at ‎http://REMOTE-DOMAIN-OR-HOST:8787: daemon request failed with status 401 (expected 200)

• This is specifically about the GUI installed via Homebrew Cask on macOS.

• The daemon-side behavior is consistent with the docs: when ‎[daemon].auth_token is configured, non‑loopback callers must send ‎Authorization: Bearer <token>.

• In this setup, the web UI confirms that daemon auth is working correctly; only the GUI fails with 401, which suggests the token from ‎ARBOR_DAEMON_AUTH_TOKEN is not being applied on the GUI’s HTTP requests.