Skip to content

Open the local workspace without accounts and drop Docker deployment - #24

Merged
erickkkyt merged 5 commits into
mainfrom
codex/local-no-login
Oct 23, 2026
Merged

erickkkyt merged 5 commits into
mainfrom
codex/local-no-login

Conversation

@erickkkyt

@erickkkyt erickkkyt commented Oct 23, 2026 •

Copy link
Copy Markdown
Contributor

What changes

  • No accounts in the local edition. Opening http://localhost:3140 goes straight into the workspace. Registration, login, password reset and invitations are disabled in local mode.
  • Existing data is kept. On first open, the server reuses the single existing local user and organization, or creates one if the database is empty. It refuses to take over a database that has several users.
  • Security without a login. Every request must come from this computer's configured loopback address. Proxy headers, cross-origin and cross-site requests are refused, and a session is only issued for a top-level, same-origin browser navigation. The dev and production servers bind to 127.0.0.1.
  • Docker deployment removed. Local storage is the bundled PostgreSQL. The CLI keeps doctor, init and start around the local scripts. MCP and the API keep their own key-based authentication.
  • Brought up to date with main: it keeps the restyled dashboard, the demo video and the translations.

Checks

  • Biome lint and type checks pass in every package.
  • Unit tests: web 618, lib 716, config 119, cli 31, deployment 52.
  • scripts/local-runtime.test.mjs has one test that fails on Node 22 only, because the environment check correctly asks for Node 24. CI runs on Node 24.

First-run test from a fresh clone (Node 24.22.1)

A fresh clone of this branch, following only the README, found two blockers. Both are fixed in this PR:

  • First visit returned 500. The server runtime's Request cannot be copied with new Request(request, …), so the session bootstrap crashed. The request is now rebuilt from its URL, method and headers, with a regression test.
  • The page never hydrated on a fresh checkout. The dev-server warmup added in Operate the local GEO workflow through MCP and the shared dashboard #23 held Vite's first dependency bundle open. The warmup is removed.

After the fixes, on the fresh clone:

  • / opens the workspace directly, with session cookies set and no login.
  • The brand was created, 12 starter questions were saved without an API key, and "Start tracking" worked.
  • After a restart, the brand and its 12 questions are still there.
  • Cross-origin POST, a foreign Host header, cross-site and proxy-header requests all get 403.
  • Collections were refused safely with BROWSER_VERSION_MISMATCH: an older 1.3.2 bridge was running on the test machine.

Local mode creates or reuses the single local owner and opens the dashboard
directly; account pages and endpoints are disabled, and every request must come
from this computer's own address and origin. The CLI now wraps the bundled
local setup (doctor, init, start) instead of Docker Compose.
# Conflicts:
#	README.de.md
#	README.ja.md
#	README.ko.md
#	README.md
#	README.zh-CN.md
#	apps/web/src/components/app-sidebar.tsx
#	apps/web/src/lib/i18n/zh.json
#	scripts/start-local.mjs
…erge

The local Workspace and Learn groups move into a helper so the sidebar stays
within the complexity limit, and the dev server keeps its loopback host and
dashboard warmup in a single server block.
The runtime's own Request cannot be copied with the Request constructor, so
the first browser visit crashed with a 500 before any session cookie existed.
The forwarded request is now rebuilt from its URL, method and headers.
On a fresh checkout the warmup held Vite's first dependency bundle open, so
the page never hydrated and forms did nothing.
@erickkkyt
erickkkyt merged commit da1d6b3 into main Oct 23, 2026
3 checks passed
@erickkkyt
erickkkyt deleted the codex/local-no-login branch October 23, 2026 08:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant