rune ui

Open the embedded Rune dashboard in your browser, signed in with your CLI session.

rune ui [--url <base-url>] [--no-open]

rune ui opens the embedded web dashboard in your browser, signed in with your current CLI session. The CLI hands a one-time code to the server, which mints a fresh browser-scoped session as an HttpOnly cookie — your CLI token is never exposed to the browser.

By default it tunnels the dashboard over your authenticated gRPC connection and opens it on a loopback address: no exposed port, no SSH, and it satisfies the server's default require_tls (the browser hits localhost). The command stays running while you use the dashboard — press Ctrl-C to stop.

Examples

# Default: tunnel the dashboard and open it on localhost
rune ui
 
# You're pointed at a remote server first
rune login --server prod.example.com
rune ui
 
# TLS-fronted deployment with a real domain — skip the tunnel, hand off directly
rune ui --url https://rune.example.com
 
# Print the sign-in URL instead of opening a browser (headless / over SSH)
rune ui --no-open

Flags

Flag	Default	Notes
`--url <base>`	tunnel	Reachable dashboard base URL (e.g. `https://rune.example.com`). Skips the tunnel, does a one-shot handoff, exits.
`--no-open`	false	Print the sign-in URL instead of launching a browser.

How it works

The dashboard is served by runed's HTTP listener (default :7861), separate from the gRPC API (:7863). Reaching it remotely is awkward — the port may be firewalled, and require_tls refuses plaintext on a non-loopback address.

rune ui sidesteps both:

It opens a control-plane port-forward over your existing authenticated (and TLS, if configured) gRPC stream, pointed at runed's own HTTP listener.
It binds a random 127.0.0.1:<port> locally and forwards it through that stream.
It mints the handoff against http://127.0.0.1:<port> and opens the browser there.

Because the browser origin is loopback, the strict default CSP and require_tls are satisfied and nothing is exposed on the network. The tunnel rides the same RBAC as any port-forward — the port-forward verb on services.

Use --url when the dashboard is already directly reachable over TLS: you get the real, bookmarkable URL and the command exits immediately instead of holding a tunnel open.

Prerequisites

An active CLI session (rune login).
The dashboard enabled on the server (ui.enabled: true, the default).