Skip to content
vops

Local app and security

The dashboard is a local application even when it looks like a normal website. Its browser origin, session token and relationship to the terminal determine how it should be operated.

Loopback and session

vops ui binds only to 127.0.0.1. The printed URL proves possession of a profile-specific session token, and the local API rejects unauthenticated /api requests.

Do not:

  • replace 127.0.0.1 with 0.0.0.0;
  • publish the local port through a router or tunnel;
  • paste the session-bearing URL into chat or issue reports.

The token protects the local API from casual access by another browser origin. It does not turn a compromised operating-system account into a safe machine.

Vault behavior

An interactive vops ui start tries to unlock a sealed vault in the terminal. If it remains locked, the dashboard still starts and credential-free pages can work. Credential-backed pages show a locked state.

The browser cannot display a secure terminal passphrase prompt. Unlock and retry:

Terminal window
vops keyring unlock

Lock early when finished:

Terminal window
vops keyring lock

Install as a desktop app

Chrome and Edge can install the dashboard as a local desktop application. The installed app is tied to the origin, including port 7788.

If the default port is occupied and vops falls back to another port, that run is a different browser origin and the installed app cannot reach it.

Keep it running at login

On macOS:

Terminal window
vops ui --install
vops ui --status
vops ui --uninstall

The background service starts the loopback UI at login. It does not make the API remote. On Linux, the CLI currently points users toward an explicit user-level service running vops ui --no-open; vops does not install that service automatically.

Offline and reconnect states

When the terminal process or background service stops, the dashboard cannot operate independently. The browser shows an offline/reconnect state and polls the local origin. When the service returns on the same origin, the page reloads.

An installed app with no background service is therefore only a launcher; it does not contain its own execution backend.

Reporting a UI problem

Include:

  • vops version;
  • operating system and browser;
  • current view;
  • whether the profile is locked;
  • the equivalent CLI command and its redacted --json result.

Do not include the session-bearing URL, provider tokens, private keys or revealed application credentials.