API

Weft exposes two API surfaces over the same backend :

• gRPC — the canonical contract, defined in weft-proto. Every CLI command, every driver plugin, every dashboard call ultimately speaks gRPC against a weft agent.
• REST (OpenAPI 3.1) — generated by huma inside weft-webui ; consumed by the Svelte dashboard via openapi-fetch. The spec lives at weft-webui/web/openapi.json, committed alongside its generated TypeScript client (api.gen.ts).

Authentication

OIDC tokens issued by dex. The dashboard runs an OIDC handler ; the CLI acquires tokens via weft login and caches them under $XDG_CONFIG_HOME/weft/credentials.json.

Live events

weft events --vm <name> (CLI) and the dashboard's per-VM activity feed both subscribe to the same NATS event bus. Subjects are scoped per-VM ; the agent forwards them over a gRPC streaming RPC, no direct NATS exposure to clients.

OpenAPI spec

The committed spec is weft-webui/web/openapi.json (~277 kB ; tracked as linguist-generated=true). Regenerate with task gen-api after changing any huma op.