Auth

This page says which commands use an account, how rb signs a machine in, where the credential lives, and what an agent must leave alone.

Only three commands use an account: rb login, rb sync, and rb logout, which undoes the first. Everything else in rb, recording, rb status, rb show, rb page and rb export, needs no account and no network.

rabbitbrain.ai

Anyone can make an account at rabbitbrain.ai/signin: an email address, a code sent to it in place of a password, and a handle. On a machine not signed in yet, rb sync says so and sends nothing:

$ rb sync
rb sync: No credential for rabbitbrain.ai on this machine.
  → Run rb login once per machine, or set RB_HUB_TOKEN for CI.

How rb calls a hub

rb calls rabbitbrain.ai, or another hub named with --hub <address> or RB_HUB_URL, as follows.

rb login signs this machine in with a device flow:

1. The terminal shows a short code, and where to approve it:

   $ rb login
   
     First, this terminal gets a code:
   
         RRVX-JZ5V
   
     Open https://rabbitbrain.ai/link?code=RRVX-JZ5V on any device; it signs you in first if needed, and approve the code.

2. The person approves it at the hub’s /link page, on any device where they are signed in. Since the person approves it, the credential is theirs, whoever started rb login. While rb waits for the approval, it asks again when a check’s connection drops or times out, three in a row at most; after that it says the hub could not be reached and stores nothing.

3. The token arrives once. rb stores it with mode 0600 in ~/.config/rabbit-brain/credentials.json, or under $RB_CONFIG_DIR: outside the repository and outside the environment.

rb logout revokes the credential on the hub and removes it from this machine. For CI, RB_HUB_TOKEN overrides the file. With no credential stored, rb logout changes nothing:

$ rb logout
Nothing stored for https://rabbitbrain.ai; nothing to do.

rb sync exports the record’s page as rb export writes it, and uploads it as a private copy in the account. rb sync --with-record sends the record too, which keeps who made each write and the words the user gave, and rb says so. rb sync --watch looks every 30 seconds and syncs again when the record or its page changed, at most once a minute, until Ctrl-C.

A hub’s refusal comes back as E_HUB_REFUSED, with its reason. A hub rb cannot reach is E_HUB_UNREACHABLE. Either way, nothing on this machine changed.

For an agent

An agent can run rb login for the user: the user approves the code in their own browser. Beyond that:

• Never read the credentials file, and never print, copy or commit a token.
• Never set or unset RB_HUB_TOKEN or RB_ACTOR.
• Keep tokens out of chat, logs, commits and files.
• Plain rb sync sends the record’s page; rb sync --with-record sends the record too. Send the record only when the user asks for it.