Tools & Auth Panel¶

The dashboard runs as a systemctl --user service. When the chat panel spawns claude --print, the subprocess inherits the service's minimal environment — not your interactive login shell. That means gh, az, aws, kubectl, gcloud, and git push over SSH may silently fail in chat even though they work in your terminal.

The Tools & Auth panel diagnoses this and one-click-fixes it.

Opening the panel¶

Click the wrench icon in the topbar (between the system-memory chip and the Settings cog). The panel slides in from the right; full-screen on mobile.

In dev mode (cargo run, no systemd) the wrench is dimmed and the panel renders a "host integration requires systemd-user" hint instead of a tool list. The fix is to install Agentic as a user-service via bash systemd/install.sh.

Probed tools¶

The panel renders one card per CLI:

Tool	Auth probe
`gh`	`gh auth status`
`az`	`az account show`
`aws`	`aws sts get-caller-identity`
`kubectl`	`kubectl auth whoami`
`gcloud`	`gcloud auth list`
`git`	SSH connectivity to `github.com`
`claude`	`claude --version` (also flags missing `CLAUDE_CONFIG_DIR` setup)

Probes run in parallel with a 2 s per-tool timeout (5 s total), so a slow CLI never hangs the panel. A 30 s in-memory cache avoids re-running probes on every panel open; pass ?fresh=1 (or click the per-card retest icon) to force a fresh probe.

Status pills¶

Pill	Meaning
✓ auth	Tool is on PATH, version detected, auth probe succeeded
⚠ ej auth	Installed but not logged in — copy the suggested `… login` command
⚠ ej på service-PATH	On your shell PATH but invisible to the systemd service — click Aktivera
– ej installerad	Binary not found anywhere — copy the install hint

Each card also shows the detected version, the authenticated user (where applicable), a retest icon, and copy-command shortcuts (navigator.clipboard.writeText with a fallback for older browsers).

Secret scrubbing¶

stdout/stderr from probes is scrubbed for token-shaped secrets (PAT, JWT, AKIA-prefixed keys, long base64 blobs) before logging or returning to the client. A leaked token in the diagnostic UI is the kind of bug we never want to ship.

One-click fix: Aktivera¶

Clicking the Aktivera button on the panel writes two files (atomic, idempotent — re-running on already-correct files is a no-op that preserves mtime):

File	Purpose
`~/.config/systemd/user/craft-easy-agentic.service.d/passenv.conf`	Adds `PassEnvironment=PATH HOME USER LANG SSH_AUTH_SOCK SSH_AGENT_PID DBUS_SESSION_BUS_ADDRESS XDG_RUNTIME_DIR GH_TOKEN GITHUB_TOKEN AZURE_CONFIG_DIR AWS_PROFILE AWS_REGION KUBECONFIG`
`~/.bashrc.d/craft-easy-agentic.sh`	Sources `systemctl --user import-environment …` so each new bash login pushes the freshest env into the user-manager

After writing, Agentic runs systemctl --user import-environment, then daemon-reload, and schedules a self-restart 2 s after the HTTP response leaves (via setsid sh -c 'sleep 2 && systemctl --user restart …'). Your browser's WebSocket reconnects within a few seconds and the panel re-probes — tools that were missing from the service PATH now resolve, and git push over SSH succeeds because SSH_AUTH_SOCK is forwarded.

A confirmation banner "Aktiverat: gh, az, aws nu tillgängliga" stays visible for 10 s after a successful enable, derived from a before/after diff of the probe results.

Path-allow-listed writes¶

The enable() Rust function is one of the few places in Agentic that writes outside the user's project. It's locked down with a path-allow-list using canonicalize() against the systemd drop-in directory and ~/.bashrc.d/ — any attempt to write elsewhere returns an error.

Disabling / undoing¶

There is no "Disable" button on purpose — it would just be systemctl --user revert craft-easy-agentic plus a manual file delete. To roll back manually:

rm -f ~/.config/systemd/user/craft-easy-agentic.service.d/passenv.conf
rm -f ~/.bashrc.d/craft-easy-agentic.sh
systemctl --user daemon-reload
systemctl --user restart craft-easy-agentic

If passenv.conf was the only file in the drop-in directory, you can rmdir it for full cleanliness.

Other shells (zsh, fish)¶

The bashrc snippet ships only for bash (Fedora's ~/.bashrc.d/ convention). Zsh and fish users should add an equivalent snippet manually:

# ~/.zshenv  or  ~/.config/fish/conf.d/craft-easy-agentic.fish
systemctl --user import-environment PATH HOME USER LANG SSH_AUTH_SOCK \
    SSH_AGENT_PID DBUS_SESSION_BUS_ADDRESS XDG_RUNTIME_DIR GH_TOKEN \
    GITHUB_TOKEN AZURE_CONFIG_DIR AWS_PROFILE AWS_REGION KUBECONFIG \
    2>/dev/null || true

The passenv.conf drop-in is shell-agnostic and applies regardless of which shell you use.

API reference¶

Method	Path	Description
`GET`	`/api/system/cli-tools[?fresh=1]`	Returns `Vec<CliToolStatus>`, one row per supported CLI
`POST`	`/api/system/cli-tools/enable-host-integration`	Origin-checked. Returns `{ written_files, restarted, before, after, warning }`

Both require bearer-token auth and return 503 outside systemd-user (dev mode).