feat: odek serve token auth + TUI polish pass#7
Merged
Conversation
Current odek serve protects its WS and REST APIs with a per-instance token printed at startup. Resolve it in order: --token flag, ?token= in the attach --url, the stderr banner of a spawned server (scanned live via a passthrough writer), then a legacy cookie/probe fallback for odek versions that predate enforced auth. The token is sent as X-Odek-Ws-Token on every REST request and on the WS handshake.
- /clear and ctrl+l now reset session telemetry (turns, tools, tokens, age) so /stats and the header gauge start fresh - keep the viewport height stable when the taller approval panel opens/closes, so the footer never jumps - cache the finalized transcript prefix; re-render only the streaming tail on spinner ticks (invalidate on finalize, resize, resume, clear) - busy refresh no longer yanks the reader out of scrollback - gauge fill glyphs now switch on the same 75%/90% bands as its colors - replace emoji sandbox badge with width-stable monochrome glyphs - live elapsed badge ticks in whole seconds (tenths flickered at 12fps) - guard truncate() against zero/negative budgets on narrow terminals - human() promotes to M at the 999.5k rounding seam - restyle /help as a pre-styled brand card; tint the destructive session-delete hint red; brighten faint body text
Cover the remaining gaps across server, tokens, and tui: - server: Connect attach-not-ready and port-allocation errors, spawn start failure, Stop's kill fallback for SIGINT-ignoring children (extracts the hardcoded 8s kill wait into a stopTimeout var, mirroring readyTimeout), splitTokenURL's unparseable-URL return, legacyToken's probe error, and freePort under fd starvation (unix-only test) - tokens: concurrent Set/Get/Delete smoke test under -race - tui: shortenHome arms, welcome cwd line, resource glyphs, /stats conditional arms, esc/^R/^O keys, error-event fallback, disconnect log-path hint, thinking-enabled submit, step-glyph dedup/cap, fetchModels cmd, relayout-not-ready, syncAC query reuse and 6-file trim, elapsed minutes, multibyte capThinking, ctxGauge clamps, gaugeColor bands, acPopup cmd mode/narrow floor, footer gap floor The three remaining uncovered blocks are verified-unreachable defensive branches (json.MarshalIndent of map[string]string, glamour Render with its fixed config, and a pad guard that cannot fire by construction). Also gitignore the coverage.out written by `make cover`.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Token auth — current
odek serveprotects its WebSocket and REST APIs with a per-instance token printed at startup. bodek now resolves it in order:--tokenflag (explicit)?token=…in the attach--url(paste the URL odek serve printed; query is stripped)The token is sent as
X-Odek-Ws-Tokenon every REST request and on the WS handshake. README and--helpexamples updated.TUI polish:
/clearandctrl+lreset session telemetry (turns, tools, tokens, age) so/statsand the header gauge start fresh● sandboxed/▲ host access)truncate()guarded against zero/negative budgets on very narrow terminalshuman()promotes to M at the 999.5k rounding seam/helprestyled as a pre-styled brand card; session-delete hint tinted red; faint body text brightened for readabilityTest plan
go build ./...go test ./...— all packages pass, including new tests for token URL splitting, stderr token scanning, legacy fallback, guarded stand-in server (with/without enforcement), telemetry reset on clear, approval-panel layout stability, transcript prefix caching, busy-scroll preservation, and gauge glyph bands