+41 -6

tools/covibe/flake-module.nix

View file Reviewed

··· 35 35 # account, and a teammate's message from the browser executes in this 36 36 # TUI. 37 37 # 38 38 - # First use per machine opens a browser for the pocket-id login; the 39 39 - # session JWT is cached in ~/.omnigent/auth_tokens.json afterwards. 40 40 - # Arguments go through to omp, e.g. `covibe --continue`; `covibe --resume` 41 41 - # (no value) opens omnigent's session picker. 38 38 + # Auth is the pocket-id login, but *only a browser* has to see pocket-id — 39 39 + # the machine running the agent only needs to reach the server. omnigent's 40 40 + # cli-ticket flow (POST /auth/cli-login, then poll /auth/cli-poll for five 41 41 + # minutes) prints a URL that any device with your passkey can complete, so 42 42 + # this works over ssh on a box with no display: run `covibe login`, open 43 43 + # the printed link on a laptop or phone, done. The session JWT is then 44 44 + # cached in ~/.omnigent/auth_tokens.json for the server's configured TTL. 45 45 + # Other arguments go through to omp, e.g. `covibe --continue`; 46 46 + # `covibe --resume` (no value) opens omnigent's session picker. 42 47 packages.covibe = 43 48 (pkgs.writeShellApplication { 44 49 name = "covibe"; ··· 52 57 text = '' 53 58 server=${server} 54 59 tokens="$HOME/.omnigent/auth_tokens.json" 60 60 + 61 61 + # `webbrowser.open` walks a candidate list that includes terminal 62 62 + # browsers; on a headless box one of those can seize the tty we are 63 63 + # about to hand to omp's TUI. With no display, make the "open" a 64 64 + # no-op — the URL is printed either way. 65 65 + if [ -z "''${DISPLAY:-}" ] && [ -z "''${WAYLAND_DISPLAY:-}" ]; then 66 66 + export BROWSER=''${BROWSER:-echo} 67 67 + fi 68 68 + 69 69 + login() { 70 70 + echo "covibe: authenticating against $server" >&2 71 71 + echo "covibe: open the link below on any device that has your pocket-id passkey" >&2 72 72 + omnigent login "$server" 73 73 + } 74 74 + 75 75 + case "''${1:-}" in 76 76 + login) 77 77 + login 78 78 + exit 0 79 79 + ;; 80 80 + host) 81 81 + # Register this machine so sessions can also be STARTED from the 82 82 + # browser (New Chat → this host → the `omp` agent). That path runs 83 83 + # `omp acp` from the runner's PATH, which only has omp when the 84 84 + # daemon was spawned with it — as it is here. Runs in the 85 85 + # foreground; ^C stops hosting. 86 86 + shift 87 87 + exec omnigent host "$server" "$@" 88 88 + ;; 89 89 + esac 90 90 + 55 91 # The cached session is a JWT with a server-side TTL 56 92 # (OMNIGENT_OIDC_SESSION_TTL_HOURS), so "a token exists" is not the 57 93 # same as "we are logged in": a stale entry makes omnigent fail with ··· 61 97 if ! jq -e --arg s "$server" \ 62 98 '((.[$s].expires_at // 0) > (now + 60)) and ((.[$s].token // "") != "")' \ 63 99 "$tokens" >/dev/null 2>&1; then 64 64 - echo "covibe: no valid session for $server, logging in" >&2 65 65 - omnigent login "$server" 100 100 + login 66 101 fi 67 102 exec omnigent pi --server "$server" "$@" 68 103 '';

+3

tools/covibe/usage.kdl

View file Reviewed

··· 1 1 bin "covibe" 2 2 about "Run omp's TUI as a shared session on the omni.lassul.us omnigent dashboard (transcript, diff view and read-only/read-write sharing live on the server)" 3 3 4 4 + cmd "login" help="Authenticate this machine against omni.lassul.us; prints a link to open on any device with your pocket-id passkey" 5 5 + cmd "host" help="Keep this machine registered as a host so sessions can also be started from the browser" 6 6 + 4 7 flag "-c --continue" help="Continue the previous omp session in this directory" 5 8 flag "-r --resume" help="Resume an omnigent session (no value opens the picker)" 6 9 arg "[omp-args...]" help="Arguments passed through to omp"