Repository navigation
fix(host): explain the channel service's 401 like the directory's - #559
Merged
Merged
Conversation
Every team-service refusal now goes through refusal(), which hands a 401 to rejection(): a wrong ACE_SECRET, a tailnet mismatch, or a service without TAILNET. Creating, moving, deleting, and backing up hosted channels said only "The hosting service refused (HTTP 401)". Refs #541
This was referenced Oct 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Creating, moving, deleting, or backing up a hosted channel with a wrong secret said only "The hosting service refused (HTTP 401): Unauthorized." (gap g6 in the onboarding map). The directory and cloud compute already explained a 401 through
rejection(). Nowrefusal(), which only team services' answers go through, hands every 401 torejection()(moved next to it inhttp.ts), so the channel service names a wrongACE_SECRET, a tailnet mismatch, or a missingTAILNETin the directory's words. Compute's separate 401 check goes away; the directory keeps its own so its "Check the URL." suffix stays off 401s.Smoke-tested
ace new --hostedfrom a source host against a localwrangler devchannel service:The hosting service refused (HTTP 401): Unauthorized. The channel was not created.The hosting service rejected this host's ACE_SECRET. Ask whoever set it up for the team's secret. The channel was not created.The hosting service serves the other.ts.net tailnet, but this Mac is on tail49836a.ts.net. Switch tailnets, or use services deployed for this one. The channel was not created.Not covered: a hosted channel's WebSocket upgrade refused with 401 still reads "Cannot reach " (see the
hostedSocketnote).Part of #541 (the Settings half is a separate PR). Onboarding meta: #550.
Built in Ace
No. Claude Code made this outside Ace, unattended while the user was away, so there was no Ace session to work in. Tracked under dogfooding: #5