Bitter Frontier What coding agents just made possible, where the bottleneck moved, and what deserves attention.

Signals

2026-09-21 / temporal-agent-harness

The approvals server binds every interface and asks for no login

Edited by Michael Ruescher

Control Plane

At 0.4.0 (commit e4bde4be, the PyPI wheel) the packaged serve command defaults to host 0.0.0.0, and its FastAPI app registers GET /api/sessions, POST /api/approve, POST /api/callback-result and POST /api/operator-commands with no authentication. The approvals operator command accepts skip, which sets the dangerously_skip_all policy. In the coding example, OpenCode's "always" posts remember=true, which allow-lists the tool by name, so one "always" on bash covers every later bash command. Main adds wildcard CORS.

What this changes for operators

  • Run serve with --host 127.0.0.1 or behind an authenticating proxy. Anyone who can reach the port can list sessions, approve calls and switch a session to skip all approvals.
  • Do not answer always to a bash prompt in the coding example; it approves the tool, not the command shown.
  • Evidence that would settle residual: a release that binds loopback by default or adds authentication; #137 on main removes the operator-command channel but is in no tag.

Primary sources

Signal metadata

Confidence
medium

Source findings

Featured in

Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0

Schema: bitter.frontier_signals.v0 / ID: 2026-09-21-temporal-approvals-server-has-no-login

Research evidence and publication history are open in the repository.