feat(#4): implement HTTP callback server for permission responses - #11
Merged
Conversation
- Add /health endpoint (GET, returns 200 OK) - Add /callback endpoint (POST, validates nonce and response) - Integrate with nonces.js for single-use authentication - Return 401 for invalid/expired nonces, 400 for invalid response values - Add 21 tests in test_callback.bash covering all endpoints
- Validate response value before consuming nonce (prevents burning nonces) - Add null checks for missing nonce/response query params - Add server error handler for listen failures - Add test for missing params
github-actions Bot
pushed a commit
that referenced
this pull request
Jan 6, 2026
# 1.0.0 (2026-01-06) ### Bug Fixes * **#30:** add proxy to enable Open Session button ([ff4957a](ff4957a)), closes [#30](#30) [#30](#30) [#27](#27) [#30](#30) * **#34:** remove named export to prevent plugin double-loading ([#44](#44)) ([c57c28b](c57c28b)), closes [#34](#34) * **#36:** use correct OpenCode API endpoint for sending messages ([1d89536](1d89536)), closes [#36](#36) * **#37:** remove new session page - OpenCode API limitation ([f62bf3e](f62bf3e)), closes [#37](#37) * **#40:** use dvh units and visualViewport API for mobile keyboard handling ([3df7f8e](3df7f8e)), closes [#40](#40) [#40](#40) * **#41:** add reconnection mechanism for permission notifications ([#51](#51)) ([810a640](810a640)), closes [#41](#41) * **#45:** add missing API proxy routes for agent and model selection ([038af90](038af90)), closes [#45](#45) * **#48:** limit to 20 messages for performance, fix horizontal scroll ([e2b2484](e2b2484)) * **#48:** pin header, session title, and input box while messages scroll ([ac242de](ac242de)), closes [#48](#48) * **#48:** revert to simple layout with scroll to bottom ([d332bbc](d332bbc)), closes [#48](#48) * **#48:** skip tool-only messages and fix scroll timing ([311fe15](311fe15)) * **#48:** use column-reverse layout so newest message appears at bottom without scrolling ([cb47ecc](cb47ecc)), closes [#48](#48) * **#48:** use longer delay for scroll to ensure DOM is rendered ([8308925](8308925)), closes [#48](#48) * **#50:** add notification deduplication to prevent duplicate notifications ([9c09871](9c09871)), closes [#50](#50) * **#50:** verify session ownership to prevent duplicate notifications ([#58](#58)) ([b89cdcc](b89cdcc)), closes [#50](#50) * add npm install to CI test job for httpxy dependency ([3565f13](3565f13)) * add push-to and create-branch params for direct push ([#23](#23)) ([1c1b190](1c1b190)) * **ci:** remove registry-url from setup-node to avoid conflicting .npmrc ([81e3aa2](81e3aa2)) * **ci:** use npx semantic-release instead of action for OIDC support ([2bb747e](2bb747e)) * **ci:** use semantic-release-action to capture release outputs ([57074fd](57074fd)) * correct bats installation in devcontainer ([1180a74](1180a74)) * default max_concurrent to 1 for local execution ([48cb89b](48cb89b)) * escape backticks in markdown regex to avoid template literal syntax error ([9d54e45](9d54e45)) * filter issues by repo when polling ([a9788a6](a9788a6)) * find service dir in both dev and homebrew installs ([3b9675b](3b9675b)) * handle slow OpenCode API response in mobile UI ([5255698](5255698)) * improve mobile UI message display ([cb81b32](cb81b32)) * remove bash integration tests from CI, fix hostname.js ([4896ddc](4896ddc)), closes [#63](#63) * run ocdc from repo directory instead of --repo flag ([98a8d32](98a8d32)) * show repo name with branch in devcontainer clone notifications ([67409b5](67409b5)) * spawn opencode run detached so polling doesn't block ([3e6c0b8](3e6c0b8)) * status reads config file and integration tests use temp HOME ([#24](#24)) ([9db9db3](9db9db3)) * suppress notifications on cancel and remove console output ([#20](#20)) ([3ebdad1](3ebdad1)) * **test:** relax timing assertion for CI environments ([d570a6e](d570a6e)) * **test:** update service test for opencode-pilot rename ([869f768](869f768)) * treat breaking changes as minor bumps in 0.x ([8f82c73](8f82c73)) * **ui:** add padding to bottom of messages list ([079808c](079808c)) * **ui:** fix scroll jumping and tool call status display ([82aafad](82aafad)) * **ui:** group consecutive messages by role to reduce visual clutter ([6e8c71a](6e8c71a)) * **ui:** include 'all' mode agents in mobile UI selector ([5ae2092](5ae2092)) * **ui:** prevent double-send by checking input after send completes ([3ff164e](3ff164e)) * **ui:** properly hide header on keyboard open and adjust spacing ([701f1ee](701f1ee)) * **ui:** reduce vertical spacing in markdown lists ([2e27722](2e27722)) * **ui:** strip trailing colon when tool calls are hidden ([fdde8a2](fdde8a2)) * **ui:** synchronize input clear, button text, and button state ([e6eb12e](e6eb12e)) * update config path from opencode-ntfy to opencode-pilot ([5109238](5109238)) * update homebrew formula name in CI workflow ([bdb553b](bdb553b)) * update remaining opencode-ntfy references to opencode-pilot ([2fce9fe](2fce9fe)) * use cwd instead of -d flag for opencode run ([e80eb25](e80eb25)) * use extra_plugins to install @semantic-release/npm v13 for trusted publishing ([a30c29a](a30c29a)) * use Node.js 22 (required by semantic-release) ([f23f249](f23f249)) * use npm install instead of npm ci (no package-lock.json) ([#26](#26)) ([c2c4908](c2c4908)) * use opencode run for local action (non-interactive) ([f7883a1](f7883a1)) * use opencode run for non-interactive execution ([693fe06](693fe06)) * use realpath for main module detection in service ([b9d7f3f](b9d7f3f)) * use sessionID (capital ID) from OpenCode events ([2f3847a](2f3847a)) ### Features * **#13:** separate callback server as brew service ([e8dcfcb](e8dcfcb)), closes [#13](#13) [#13](#13) [#13](#13) [#13](#13) [#13](#13) [#13](#13) [#13](#13) [#13](#13) [#13](#13) * **#1:** add project scaffolding and CI workflows ([1afcebd](1afcebd)), closes [#1](#1) * **#27:** add Open Session action button to idle notifications ([#28](#28)) ([5948aa4](5948aa4)), closes [#27](#27) [#27](#27) [#27](#27) * **#29:** add optional debug logging to plugin ([#68](#68)) ([a0c4056](a0c4056)), closes [#29](#29) * **#2:** add config parsing and idle notifications ([2b19d94](2b19d94)), closes [#2](#2) * **#30:** mobile session UI with new session page and HTTPS ([#33](#33)) ([f0428f1](f0428f1)), closes [#30](#30) [#30](#30) [#30](#30) * **#3:** implement ntfy HTTP client with all notification types ([#10](#10)) ([e81d087](e81d087)), closes [#3](#3) [#3](#3) [#3](#3) [#3](#3) * **#45:** add agent and model selection to conversation UI ([3616559](3616559)), closes [#45](#45) * **#45:** add agent and model selection to conversation UI ([#59](#59)) ([3cae588](3cae588)), closes [#45](#45) [#45](#45) [#45](#45) * **#46:** track idle state per conversation, not globally ([#47](#47)) ([d4b707a](d4b707a)), closes [#46](#46) * **#48:** add session title and conversation history to mobile UI ([#49](#49)) ([16e2711](16e2711)), closes [#48](#48) [#48](#48) [#48](#48) * **#4:** implement HTTP callback server for permission responses ([#11](#11)) ([a9325e2](a9325e2)), closes [#4](#4) [#4](#4) [#4](#4) * **#53:** backup opencode.json before modification in setup ([#57](#57)) ([e49defd](e49defd)), closes [#53](#53) * **#54:** add polling system for automated issue/PR processing ([999e24c](999e24c)), closes [#54](#54) * **#66:** add default sources when none specified ([84490db](84490db)), closes [#66](#66) * **#6:** add config file support and callback host configuration ([#12](#12)) ([0b459b4](0b459b4)), closes [#6](#6) [#6](#6) [#6](#6) [#6](#6) [#6](#6) * **#7:** add error and retry notification handlers ([2e4a432](2e4a432)), closes [#7](#7) [#7](#7) [#17](#17) * add CLI start command and plugin auto-start ([38d91f4](38d91f4)) * add CLI with setup and status commands ([#19](#19)) ([369eeb5](369eeb5)) * add opt-in debug logging to poll-service (PILOT_DEBUG=true) ([1a11bc0](1a11bc0)) * add polling for real-time updates in mobile UI ([49a8793](49a8793)) * add session link to error notifications ([9d4634a](9d4634a)) * add workflow to update Homebrew formula on release ([#22](#22)) ([4fdb01c](4fdb01c)) * **config:** add idleNotify option to disable idle notifications ([db74c1d](db74c1d)) * improve notification content for clarity and context ([#17](#17)) ([17bcc65](17bcc65)) * install opencode CLI in devcontainer ([dca4355](dca4355)) * migrate from Homebrew to npm distribution ([71b6c0a](71b6c0a)) * start opencode session inside devcontainer ([c0c45a8](c0c45a8)) * **ui:** display tool calls with status indicators ([5ea883d](5ea883d)) * **ui:** hide header on scroll and allow message queuing ([b6a5f6d](b6a5f6d)) * use view actions for private callbacks over Tailscale ([#21](#21)) ([eeaf4d2](eeaf4d2)) ### Performance Improvements * make debug logger async to avoid blocking render thread ([f5c0867](f5c0867))
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
plugin/callback.jswith/healthand/callbackendpointsnonces.jsfor single-use authentication (validates and consumes nonces)test/test_callback.bashcovering all endpoints and edge casesCloses #4