ZSDev/obsidian-connor
Watch
3
0
Fork
You've already forked obsidian-connor
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Card 463 is ready to ship. (+47/−10, +0 mod, tests +1 test files(ts) +3 prose(ts)) #25

Merged
Connor merged 1 commit from build/725549e9 into main 2026-10-25 21:50:51 +00:00
Conversation 1 Commits 1 Files changed 11 +260 -19
Connor commented 2026-10-25 21:49:15 +00:00
Owner
Copy link

What changed

code: 4 source files in src/; 6 test files in test/; README.md (+260/−19)

build/725549e9 → main — 11 file(s), +260/−19.

  • source: 4 file(s), +47/−10

  • tests: 6 file(s), +186/−8

  • docs: 1 file(s), +27/−1

  • README.md

  • src/lib/auth.ts

  • src/link.ts

  • src/main.ts

  • src/settings.ts

  • test/api.test.ts

  • test/auth.test.ts

  • test/settings.test.ts

  • test/stubs/obsidian.ts

  • test/stubs/plugin.ts

  • test/vaultlink.test.ts

Growth

  • source: +47/−10 (net +37; budget +600)
  • modules: +0/−0 (budget +1)
  • test files added: 1; migrations: 0; evidence (screenshot/capture, not source): 0; not counted: 0
  • test shape (advisory): tests +1 test files(ts) +3 prose(ts)
  • within budget

Why

Card 463 is ready to ship. I found that the plugin already had most of the token path, so I filled in the gaps instead of building it again: a one-time notice when a token is refused, the "Connor plugin token" label, tests for the header and for redialing after a restart, and README steps. The whole gate passed: npm run gate, 293 tests (286 before my change).

Most of the token path was already there

The brief said the plugin only uses the sign-in cookie, but this copy already has a per-vault token, stored as registrationToken. It is a masked czv_… setting that drops a pasted Bearer prefix. When it is set, every request and every dial and redial of the held vault link sends Authorization: Bearer …. With no token, it falls back to the cookie exactly as before. A 401 then reads "token rejected or revoked" on the status bar and in the panel's toolbar. The MCP address's path token is separate and I didn't touch it.

What was missing: no notice, a different label, no tests on the real request path or on redialing, and no README steps for minting a token.

What I changed […]

Gate

npm run gate ran 293 tests in 4.5s and exited 0 — green.

Flow engine

⚠ Not reviewed by the flow engine. The engine errored, so this change took the direct path: no flow engine command is set (flow.route_command)

Built by Connor's frontend backburner (dispatch 725549e9) in an isolated clone; shipped deterministically by ship.py. The full build notes were spoken in conversation and stored in memory (agent-dispatch:725549e9). Review is the gate.

The brief this build was given

Kept for provenance. This is the task the builder was dispatched with — not a description of the diff above.

Requested: Card 463. Finish the client half of item #744 / plan f4abceca. Connor's server already accepts per-vault plugin tokens sent as Authorization: Bearer czv_… (minted from the signed-in web UI for one vault), bypassing the Pocket ID cookie. Today the plugin authenticates only with the sign-in cookie, so every server restart or session expiry drops the vault link with 401s. First read the plugin's current connection/auth code and confirm no bearer-token path already exists. Then: add a per-vault "Connor plugin token" setting (masked input) in the settings tab; when set, send it as a Bearer header on every HTTP request and on the held-link connect AND every reconnect, preferring it over the cookie; keep the cookie path as fallback when no token is set. Do not confuse it with the existing MCP path token — leave that untouched. On a 401 with a token set, show a clear notice saying the token was rejected and to mint a new one from Connor's web UI. Add tests for header attachment and for reconnect-after-restart using the token. Update README with how to mint and paste the token. Done when tests pass and the change is ready to ship as a PR.

### What changed code: 4 source files in src/; 6 test files in test/; README.md (+260/−19) `build/725549e9` → `main` — 11 file(s), +260/−19. - **source**: 4 file(s), +47/−10 - **tests**: 6 file(s), +186/−8 - **docs**: 1 file(s), +27/−1 - `README.md` - `src/lib/auth.ts` - `src/link.ts` - `src/main.ts` - `src/settings.ts` - `test/api.test.ts` - `test/auth.test.ts` - `test/settings.test.ts` - `test/stubs/obsidian.ts` - `test/stubs/plugin.ts` - `test/vaultlink.test.ts` ### Growth - source: +47/−10 (net +37; budget +600) - modules: +0/−0 (budget +1) - test files added: 1; migrations: 0; evidence (screenshot/capture, not source): 0; not counted: 0 - test shape (advisory): tests +1 test files(ts) +3 prose(ts) - within budget ### Why Card 463 is ready to ship. I found that the plugin already had most of the token path, so I filled in the gaps instead of building it again: a one-time notice when a token is refused, the "Connor plugin token" label, tests for the header and for redialing after a restart, and README steps. The whole gate passed: `npm run gate`, 293 tests (286 before my change). ## Most of the token path was already there The brief said the plugin only uses the sign-in cookie, but this copy already has a per-vault token, stored as `registrationToken`. It is a masked `czv_…` setting that drops a pasted `Bearer ` prefix. When it is set, every request and every dial and redial of the held vault link sends `Authorization: Bearer …`. With no token, it falls back to the cookie exactly as before. A 401 then reads "token rejected or revoked" on the status bar and in the panel's toolbar. The MCP address's path token is separate and I didn't touch it. What was missing: no notice, a different label, no tests on the real request path or on redialing, and no README steps for minting a token. ## What I changed […] ### Gate `npm run gate` ran 293 tests in 4.5s and exited 0 — green. ### Flow engine > ⚠ **Not reviewed by the flow engine.** The engine errored, so this change took the direct path: no flow engine command is set (flow.route_command) Built by Connor's frontend backburner (dispatch `725549e9`) in an isolated clone; shipped deterministically by `ship.py`. The full build notes were spoken in conversation and stored in memory (`agent-dispatch:725549e9`). Review is the gate. --- ### The brief this build was given _Kept for provenance. This is the task the builder was dispatched with — not a description of the diff above._ > Requested: Card 463. Finish the client half of item #744 / plan f4abceca. Connor's server already accepts per-vault plugin tokens sent as `Authorization: Bearer czv_…` (minted from the signed-in web UI for one vault), bypassing the Pocket ID cookie. Today the plugin authenticates only with the sign-in cookie, so every server restart or session expiry drops the vault link with 401s. First read the plugin's current connection/auth code and confirm no bearer-token path already exists. Then: add a per-vault "Connor plugin token" setting (masked input) in the settings tab; when set, send it as a Bearer header on every HTTP request and on the held-link connect AND every reconnect, preferring it over the cookie; keep the cookie path as fallback when no token is set. Do not confuse it with the existing MCP path token — leave that untouched. On a 401 with a token set, show a clear notice saying the token was rejected and to mint a new one from Connor's web UI. Add tests for header attachment and for reconnect-after-restart using the token. Update README with how to mint and paste the token. Done when tests pass and the change is ready to ship as a PR.
build: Card 463. Finish the client half of item #744 / plan f4abceca.…
All checks were successful
connor/growth lines 5,360 · headroom 163 of 400
gate / gate (pull_request) Successful in 10s
Details
8296002631 
Card 463. Finish the client half of item #744 / plan f4abceca. Connor's server already accepts per-vault plugin tokens sent as `Authorization: Bearer czv_…` (minted from the signed-in web UI for one vault), bypassing the Pocket ID cookie. Today the plugin authenticates only with the sign-in cookie, so every server restart or session expiry drops the vault link with 401s. First read the plugin's current connection/auth code and confirm no bearer-token path already exists. Then: add a per-vault "Connor plugin token" setting (masked input) in the settings tab; when set, send it as a Bearer header on every HTTP request and on the held-link connect AND every reconnect, preferring it over the cookie; keep the cookie path as fallback when no token is set. Do not confuse it with the existing MCP path token — leave that untouched. On a 401 with a token set, show a clear notice saying the token was rejected and to mint a new one from Connor's web UI. Add tests for header attachment and for reconnect-after-restart using the token. Update README with how to mint and paste the token. Done when tests pass and the change is ready to ship as a PR.

Built by my frontend backburner (dispatch 725549e9), diff verified by git; shipped by ship.py. Nothing merges without review.
reviewer-bot approved these changes 2026-10-25 21:50:40 +00:00
reviewer-bot left a comment
Copy link

Independent review — reviewer-bot (local model qwen2.5-coder:14b)

The PR adds functionality for using a per-vault token for authentication, including updating the README, modifying existing files, and adding new test files. The changes seem to match the stated intent.

Suggestions (non-blocking)

  • suggestion src/lib/auth.ts:41 — Consider adding more detailed logging for token refusal events to aid in debugging.
  • suggestion src/main.ts:287 — The Notice is shown with a timeout of 15 seconds. Consider making this configurable or providing more context about why the token was rejected.
**Independent review — reviewer-bot (local model `qwen2.5-coder:14b`)** The PR adds functionality for using a per-vault token for authentication, including updating the README, modifying existing files, and adding new test files. The changes seem to match the stated intent. ### Suggestions (non-blocking) - suggestion `src/lib/auth.ts:41` — Consider adding more detailed logging for token refusal events to aid in debugging. - suggestion `src/main.ts:287` — The Notice is shown with a timeout of 15 seconds. Consider making this configurable or providing more context about why the token was rejected.
Connor merged commit 2327811e0d into main 2026-10-25 21:50:51 +00:00
Connor deleted branch build/725549e9 2026-10-25 21:50:52 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
reviewer-bot
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
Joel
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
ZSDev/obsidian-connor!25
No description provided.