One self-hosting flaw Xingyao and I identified. Raising here for consideration, but NOT something we want to fix ahead of MVP If I install on a VM and host at

<http://canvas.rbren.io|canvas.rbren.io>

, when I set up the frontend it's only set up on one device. If I connect from my phone, I have to re-add each backend. This is important, because as far as we know

<http://canvas.rbren.io|canvas.rbren.io>

is unauthenticated--if we auto-connect to the backend, you're vulnerable We could potentially add an option that lets the user assert "I have secured this backend" (e.g. using nginx with basic auth), and then somehow share the credentials across devices (e.g. by hosting them at /credentials.json) Again, nothing to fix for MVP. But open to ideas

I’m a bit confused, are you not using a session API key?

If you add another backend on your laptop, then load from your phone, is the new backend available?

I don’t have two local backends, is there a reason I’d need two?

or if you connect to cloud

I have played with this ^, when my agent was in vscode extension: like, a dropdown to add possible "servers". Remote was reasonable, AH Cloud used to be a bit wonky though, at least that's my agent complained about 😅

Yeah, I guess the idea is that you’d run the agent canvas on your laptop and then connect to an agent on the laptop and a desktop/server dev machine? The “connect to my laptop through a mobile” didn’t make as much sense to me since laptops tend not to have static IPs, so it’d be tricky to maintain a connection to it. Going back to the original question — I still am not very sure what the issue is though. Don’t you have a session API key set up that blocks access to the backend if you don’t have the session API key?

laptops tend not to have static IPs, so it’d be tricky to maintain a connection to it.

Sometimes, it depends though; mine has static IP, and also, FWIW I use Tailscale to keep a connection between my devices, iPad, iPhone, MacBook With or without Tailscale, I do connect very often from the iPad to the MacBook, tbh

Yeah, I use ngrok, so you could possibly have a static URL through that also.

I'm specifically talking about the case where you host Agent Canvas on a VM, behind a domain like canvas.rbren.io

Is the problem that you’re trying to solve that it’s too much work to maintain a list of URLs and session API keys for your various backends?

I think I have a sense for what to do here already, mostly just flagging the current limitation 🙂