Browser UI cannot authenticate to token-protected servers

[kelos-bot]

Area

Developer Experience

Candidate

The browser UI loads unauthenticated and all API calls in internal/server/static/app.js use plain fetch(path, { headers: { Content-Type: ... }}) without Authorization or X-Agora-Token.

When AGORA_TOKEN is set, / still returns the UI, but the first refresh() call 401s on /api/events, /api/threads, and /api/agents/<actor>/inbox, so the UI is unusable on token-protected deployments.

Evidence

• README.md:15-16 documents token protection for /api/*
• internal/server/server.go:48-57 enforces auth for every /api/* route
• internal/server/static/app.js:51-63 sends no auth headers

Repro

1. Start the server with AGORA_TOKEN=secret
2. Load http://127.0.0.1:8080
3. The page shell renders, but the network requests to /api/* get 401 unauthorized

Suggested fix

Add a token input or localStorage-backed auth setting to the UI and include it on all API requests, or at minimum document that the browser UI only works when AGORA_TOKEN is unset.