feat(config): make local dashboard authentication optional

Author: PsiACE

.env.example

@@ -34,7 +34,8 @@ POWERCONTEXT_SERVER_ACCESS_DEPLOYMENT_ID=powercontext
 # POWERCONTEXT_SERVER_ACCESS_BACKGROUND_PRINCIPAL_DESCRIPTION=Scheduled processing
 
 # Dashboard -------------------------------------------------------------------
-# Personal/demo viewer. Enabling requires ACCESS_MODE=enforced and a static AUTH_TOKEN.
+# Personal/demo viewer. Local access needs no token with ACCESS_MODE=disabled.
+# To require a token, set ACCESS_MODE=enforced and AUTH_TOKEN.
 # Injected authentication or authorization Providers are not supported by the Dashboard.
 POWERCONTEXT_SERVER_DASHBOARD_ENABLED=false
 

docs/en/development/dashboard.md

@@ -1,6 +1,6 @@
 # Dashboard design principles
 
-The Dashboard is a content viewer for personal use and demonstrations, authenticated by a static token and disabled by default. This document helps developers and reviewers decide what a page should show, how to organize reading, and whether a change preserves the behavior users need. The API contract in `openapi/powercontext.yaml` and the service implementation define the available capabilities.
+The Dashboard is a content viewer for personal use and demonstrations, disabled by default. It shares the Server access mode: local access can be anonymous, while enforced access requires a static token. This document helps developers and reviewers decide what a page should show, how to organize reading, and whether a change preserves the behavior users need. The API contract in `openapi/powercontext.yaml` and the service implementation define the available capabilities.
 
 ## What the Dashboard helps users do
 
@@ -96,9 +96,10 @@ Chinese, English, light and dark settings apply across the Dashboard, including
 
 Pages show actual readable data, and actions correspond to existing capabilities. If one section fails, other independently readable content remains visible. Read errors, insufficient permissions and missing generation configuration have different meanings and must not collapse into an empty state.
 
-The Dashboard supports the built-in static Bearer identity, with the same permissions for every token holder. Enabling it
-requires `POWERCONTEXT_SERVER_DASHBOARD_ENABLED=true`, `ACCESS_MODE=enforced`, and `AUTH_TOKEN`. Team deployments that
-inject authentication or authorization Providers must disable it. Pages reuse the existing API and its access checks;
+Enable Dashboard with `POWERCONTEXT_SERVER_DASHBOARD_ENABLED=true`. Local `ACCESS_MODE=disabled` opens directly without
+a token. With `ACCESS_MODE=enforced`, it requires `AUTH_TOKEN` and uses the built-in static Bearer identity, with the
+same permissions for every token holder. Team deployments that inject authentication or authorization Providers must
+disable it. Pages reuse the existing API and follow the Server access mode;
 they add no data endpoints or member and role management. See [Install and run](../docs/get-started/install-and-run.md)
 for personal setup.
 

docs/en/docs/get-started/configure-server-environment.md

@@ -23,8 +23,8 @@ then asks about Dashboard and access settings and only the model connections nee
 memory uses explicit Agent-saved memories and full-text recall without a separate model API; automatic processing
 and semantic retrieval require their respective model settings. Existing files can be reused or adjusted by module.
 
-A fresh local setup leaves Dashboard and authentication disabled. Enable Dashboard to opt into authenticated
-access, or set `POWERCONTEXT_SERVER_ACCESS_MODE=enforced` and `POWERCONTEXT_SERVER_AUTH_TOKEN` explicitly.
+A fresh local setup leaves Dashboard and authentication disabled. Enabling Dashboard does not require authentication.
+For manual authentication setup, set `POWERCONTEXT_SERVER_ACCESS_MODE=enforced` and `POWERCONTEXT_SERVER_AUTH_TOKEN`.
 Remote setup enables authentication. Existing Dashboard and authentication settings are preserved when accepting defaults.
 
 Agent configuration selects one Agent at a time and can then add another; configured choices are removed from the
@@ -57,6 +57,24 @@ hidden wizard prompts, your environment, or a secret manager, not in command-lin
 Windows support is `experimental`. Before using the file for a personal service, restrict its ACL as described in
 [Deploy the Server](../operate/deploy-server.md).
 
+### Local Dashboard and optional authentication
+
+When enabling Dashboard in a new local setup, the wizard offers optional authentication, disabled by default.
+Accepting the default generates no Server token: the browser opens directly, and HTTP API and MCP requests need no
+Authorization header. The minimal settings are:
+
+```dotenv
+POWERCONTEXT_SERVER_HTTP_HOST=127.0.0.1
+POWERCONTEXT_SERVER_DASHBOARD_ENABLED=true
+POWERCONTEXT_SERVER_ACCESS_MODE=disabled
+```
+
+To require authentication, select it when enabling Dashboard. The wizard generates a token and writes
+credentials for the selected Agents. For manual configuration, set `POWERCONTEXT_SERVER_ACCESS_MODE=enforced` and
+`POWERCONTEXT_SERVER_AUTH_TOKEN`. Dashboard, HTTP API, and MCP share this setting. Remote scenarios still enable authentication.
+
+Existing authenticated configurations retain their token and access mode.
+
 ### Choose or change the Web / Server port
 
 Dashboard, HTTP API, and MCP share one Server listener; there is no separate Dashboard port.
@@ -130,7 +148,7 @@ powercontext ready
 powercontext capabilities
 ```
 
-This supplies the client address and Server Token without loading model API keys into the client environment.
+This supplies the client address and, when authentication is enabled, the Server token. Local unauthenticated configurations need no token.
 Follow `.env.next-steps.md` to create Scopes and install plugins, then verify real memory using the [quickstart](quickstart.md).
 
 For every variable, default, and precedence rule, see [Configuration](../operate/configuration.md).

docs/en/docs/get-started/install-and-run.md

@@ -75,26 +75,30 @@ Without environment variables or an environment file, the Server:
 `Ctrl-C` performs a clean shutdown. Restarting the command reopens the same database.
 
 The Dashboard is an optional content viewer for personal use and demonstrations. It is disabled by default and needs
-no separate frontend installation or model configuration. To enable it, put these settings in a protected environment
-file and replace the token example with your own long random credential:
+no separate frontend installation or model configuration. To enable it locally without a token, save these settings
+in an environment file:
 
 ```dotenv
+POWERCONTEXT_SERVER_HTTP_HOST=127.0.0.1
 POWERCONTEXT_SERVER_DASHBOARD_ENABLED=true
-POWERCONTEXT_SERVER_ACCESS_MODE=enforced
-POWERCONTEXT_SERVER_AUTH_TOKEN=replace-with-your-random-token
+POWERCONTEXT_SERVER_ACCESS_MODE=disabled
 ```
 
+To require authentication, set `POWERCONTEXT_SERVER_ACCESS_MODE=enforced` and set `POWERCONTEXT_SERVER_AUTH_TOKEN` to
+your own long random credential. The [configuration wizard](configure-server-environment.md#local-dashboard-and-optional-authentication)
+also offers this choice when enabling Dashboard locally.
+
 ```bash
 chmod 600 /path/to/powercontext.env
 powercontext config validate --env-file /path/to/powercontext.env
 powercontext server run --env-file /path/to/powercontext.env
 ```
 
-Open `http://127.0.0.1:8000/dashboard/home` and enter the same token. Use the actual port if you change it.
-The token also protects the Server API and MCP, so connected Agents need it too. The CLI does not automatically load
-a directory's `.env` file.
+Open `http://127.0.0.1:8000/dashboard/home`, using the actual port if you change it. With authentication disabled, the
+page opens directly. When enabled, sign in with the Server token and configure connected Agents to use it for API
+and MCP requests. The CLI does not automatically load a directory's `.env` file.
 
-The first sign-in selects the Server default Scope. Pages are empty until content is saved. Save a Memory through an
+The first visit selects the Server default Scope. Pages are empty until content is saved. Save a Memory through an
 Agent or public API, then refresh Memories in the same Scope. Experiences, skills, handoffs, and usage also come from
 saved records. The Dashboard does not capture sessions, run generation, or approve candidates. The Dashboard and Agent
 must use the same Server and Scope.
@@ -104,8 +108,9 @@ revision does not change the current profile. In **Handoff**, use **Export Markd
 detail page to download that exact revision, including its full text, omissions, and citations. If sign-in expires,
 sign in again to return to the selected detail, then repeat the download.
 
-All token holders use one identity. Multi-user RBAC deployments should leave the Dashboard disabled and use the API,
-MCP, or host integrations. See [Deploy the Server](../operate/deploy-server.md) for network and credential configuration.
+When authentication is enabled, all token holders use one identity. Multi-user RBAC deployments should leave the
+Dashboard disabled and use the API, MCP, or host integrations. See [Deploy the Server](../operate/deploy-server.md)
+for network and credential configuration.
 
 This minimal launch does not enable model-backed extraction or vector search. To generate and validate one explicit
 environment file for those capabilities, continue with the
@@ -170,7 +175,7 @@ tag-table constraints during Server startup to support Topic Memory tags. Stop t
 one upgraded instance first so the schema upgrade completes before other instances connect. Databases from before
 1.0.0 also need the [Artifact processing migration](../operate/artifact-processing-migration.md) if it has not already
 been completed. Upgrade the Server, clients, and Agent integrations together.
-The Dashboard must be explicitly enabled with static Bearer authentication; see
+The Dashboard must be explicitly enabled; static Bearer authentication is optional for local use. See
 [Deploy the Server](../operate/deploy-server.md). Remote plaintext HTTP connections require explicit client consent;
 see [Connect to a remote Server](../operate/connect-remote-server.md).
 

docs/en/docs/get-started/quickstart.md

@@ -29,7 +29,7 @@ For a first local installation:
 1. **Storage**: SQLite works without another database dependency. To try embedded seekdb, select it and approve the background dependency installation.
 2. **Usage scenario**: choose “Only on this machine” when your Agent, browser, and Server share a machine. For a remote Server, first read [Connect to a remote Server](../operate/connect-remote-server.md).
 3. **Memory capabilities**: select full memory and enter Generation and Embedding API details. See [Configure models](configure-models.md) for protocols and dimensions.
-4. **Dashboard**: enable it to inspect Sources and memories. The wizard creates or reuses a Server token.
+4. **Dashboard**: enable it to inspect Sources and memories. Local authentication defaults to off; enable it if you want to require a token. See [optional authentication](configure-server-environment.md#local-dashboard-and-optional-authentication).
 5. **Background processing**: start with the recommended schedule for each Artifact. An inspection interval is not a completion deadline; model processing takes additional time.
 6. **Agent**: select Codex and plan a new isolated Scope. Select Claude Code next if needed, then choose “Finish Agent configuration”.
 7. Review and save.
@@ -38,11 +38,12 @@ The wizard writes:
 
 | File | Purpose |
 | --- | --- |
-| `.env` | Server, client, Agent, database, and model settings, including credentials and the Server token |
+| `.env` | Server, client, Agent, database, and model settings, including any configured credentials |
 | `.env.next-steps.md` | Startup, Scope creation, plugin connection, and checks for your choices |
 
-The final screen shows the Dashboard URL, a newly generated token, and the SSH command when selected. Later, look up
-`POWERCONTEXT_SERVER_AUTH_TOKEN` in `.env`. These files contain credentials; do not commit them.
+The final screen shows the Dashboard URL and the SSH command when selected. If authentication is enabled, it also
+shows a newly generated Server token once; later, look up `POWERCONTEXT_SERVER_AUTH_TOKEN` in `.env`.
+These files can contain credentials; do not commit them.
 If seekdb is still installing, the wizard waits with an activity indicator. Complete any reported dependency recovery
 before starting the Server. Saving files or installing dependencies does not start the Server.
 
@@ -56,7 +57,8 @@ powercontext server run --env-file .env
 ```
 
 Keep the terminal running. Open the Dashboard URL printed by the wizard, using the port saved as
-`POWERCONTEXT_SERVER_HTTP_PORT` in `.env`. Sign in with the **Server token**, not a model API key.
+`POWERCONTEXT_SERVER_HTTP_PORT` in `.env`. With authentication disabled, the page opens directly. Otherwise, sign in
+with the **Server token**, not a model API key.
 An empty Dashboard is expected before you capture data. For operation after closing the terminal, stop the foreground
 Server and install a [persistent personal service](../operate/deploy-server.md#run-a-persistent-personal-server)
 with `powercontext service install --env-file .env` to reuse the same configuration.
@@ -101,11 +103,11 @@ codex
 
 Confirm that the PowerContext Hook and MCP have both loaded in Codex. For a non-default address, follow the Codex
 connection instructions in `.env.next-steps.md`: the installed plugin's `.mcp.json` must use the same Server as the Hook,
-and read Authorization from `POWERCONTEXT_CODEX_AUTHORIZATION`. Installing the plugin does not start the Server.
+with credentials configured when authentication is enabled. Installing the plugin does not start the Server.
 
 These commands use Codex CLI. A desktop app may not inherit terminal environment variables. Before testing in the
-desktop app, verify that both its Hook and MCP receive the same URL, token, and Scope. See
-[Codex](../integrations/codex.md) and [Claude Code](../integrations/claude-code.md) for host-specific behavior.
+desktop app, verify that both its Hook and MCP receive the same URL and Scope, and credentials when authentication
+is enabled. See [Codex](../integrations/codex.md) and [Claude Code](../integrations/claude-code.md) for host-specific behavior.
 
 Full memory also needs a generation policy for this real Scope to use Profile. Follow the
 [Profile policy steps](configure-models.md#enable-a-profile-policy-for-the-scope) to read its current version and update it;

docs/en/docs/integrations/codex.md

@@ -99,8 +99,8 @@ This adds inference latency to each prompt and is not the normal interactive set
 
 ## Connect to an authenticated local Server
 
-Local Server authentication is disabled by default. Enable it when needed; enabling Dashboard also requires
-authenticated access. A fresh local configuration wizard leaves Dashboard off unless you select it.
+Local Server authentication is disabled by default and can be enabled independently of Dashboard.
+A fresh local configuration wizard leaves Dashboard off unless you select it; selecting it does not require a token.
 
 Load one token from your local secret manager, then start the Server with authentication enabled:
 

docs/en/docs/operate/configuration.md

@@ -49,7 +49,7 @@ Server settings use the `POWERCONTEXT_SERVER_` prefix.
 | `POWERCONTEXT_SERVER_WORKSPACE` | Server startup directory | Resolution root for local project Agent Skill folders |
 | `POWERCONTEXT_SERVER_MCP_ENABLED` | `true` | Enable Streamable HTTP MCP |
 | `POWERCONTEXT_SERVER_MCP_PATH` | `/mcp` | MCP path |
-| `POWERCONTEXT_SERVER_DASHBOARD_ENABLED` | `false` | Personal and demonstration Dashboard; requires static Bearer authentication and does not support injected authentication or authorization Providers |
+| `POWERCONTEXT_SERVER_DASHBOARD_ENABLED` | `false` | Personal and demonstration Dashboard; local `ACCESS_MODE=disabled` needs no token, while `enforced` requires a static Bearer token; injected authentication or authorization Providers are unsupported |
 | `POWERCONTEXT_SERVER_AUTH_ENABLED` | `false` | Legacy static bearer switch; `true` maps to `ACCESS_MODE=enforced` and requires `AUTH_TOKEN` |
 | `POWERCONTEXT_SERVER_AUTH_TOKEN` | unset | Legacy static bearer token; used as compatibility authentication and mapped to the built-in administrator when no Authentication Provider is injected |
 | `POWERCONTEXT_SERVER_ACCESS_MODE` | `disabled` | The only supported Access switch: `disabled` or `enforced` |

docs/en/docs/operate/deploy-server.md

@@ -164,8 +164,9 @@ orchestrator can probe them. API, MCP, metrics, and `/openapi.json` require auth
 public, but requests made from the interactive reference require authentication.
 
 Personal or demonstration deployments can additionally set `POWERCONTEXT_SERVER_DASHBOARD_ENABLED=true` to expose
-`/dashboard/home` on the same port. It requires the static Bearer configuration above; startup fails clearly without a
-token. Browser sign-in uses the Server token, not a model API key. Credentials are stored in an HttpOnly,
+`/dashboard/home` on the same port. With `ACCESS_MODE=enforced`, it requires the static Bearer configuration above;
+startup fails clearly without a token. Local deployments using `ACCESS_MODE=disabled` can open Dashboard without
+sign-in. When authentication is enabled, browser sign-in uses the Server token, not a model API key. Credentials are stored in an HttpOnly,
 SameSite=Strict Cookie restricted to `/dashboard`, for up to eight hours. HTTPS sets Secure. Reverse proxies must
 preserve the external scheme and host for the sign-in same-origin check.
 

docs/en/docs/operate/troubleshoot.md

@@ -182,10 +182,8 @@ See [Server authentication and permissions](configuration.md#server) for Princip
 ## Local tracing examples and existing Server configuration
 
 The local Phoenix and Langfuse tracing examples are written for an isolated test instance and default to loopback
-addresses. Whether the Dashboard is enabled depends on the installed version and effective configuration. In newer
-versions, a personal Dashboard requires `ACCESS_MODE=enforced` and a valid `AUTH_TOKEN`; if startup reports
-`DASHBOARD_ENABLED requires ACCESS_MODE=enforced and AUTH_TOKEN`, complete the authentication configuration or disable
-the Dashboard in the isolated local test instance.
+addresses. Dashboard follows the Server access mode: local access with `ACCESS_MODE=disabled` requires no token and
+leaves `AUTH_TOKEN` unset; `ACCESS_MODE=enforced` requires a valid static token.
 
 When an existing Server already uses static Bearer authentication, keep its authentication configuration while adding
 tracing. If you also enable the Dashboard, use the same static Bearer configuration:

docs/en/docs/workflows/review-candidates.md

@@ -71,7 +71,8 @@ evidence against the current Candidate version and reviewer permissions; an unav
 Omitting `memory_citations` or setting it to null on revision retains them; the HTTP request
 can explicitly replace them, and `[]` clears them. Approved Experience revisions preserve these citations in their lineage.
 
-Dashboard is an opt-in personal content viewer using static Bearer authentication. It displays approved Experiences and
+Dashboard is an opt-in personal content viewer sharing the Server access mode; enforced access uses a static Bearer token.
+It displays approved Experiences and
 Skills, with exact references linking to historical Memory entries. Dream creation, Run inspection, and Candidate review
 use the CLI, Client, or HTTP API. See [Install and run](../get-started/install-and-run.md) to enable personal access.