feat: support odek serve per-instance WS token auth

Current odek serve protects its WS and REST APIs with a per-instance
token printed at startup. Resolve it in order: --token flag, ?token= in
the attach --url, the stderr banner of a spawned server (scanned live
via a passthrough writer), then a legacy cookie/probe fallback for odek
versions that predate enforced auth. The token is sent as
X-Odek-Ws-Token on every REST request and on the WS handshake.

Author: jkyberneees

README.md

@@ -69,13 +69,21 @@ bodek looks for `odek` on your `PATH`. To point at a specific binary use
 ## Usage
 
 ```bash
-bodek                                 # launch odek serve and start chatting
-bodek --sandbox                       # run tool calls inside odek's Docker sandbox
-bodek --url http://127.0.0.1:8080     # attach to an already-running odek serve
-bodek --odek-bin ./odek               # use a specific odek binary
-bodek -- --prompt-caching             # pass extra flags through to `odek serve`
+bodek                                             # launch odek serve and start chatting
+bodek --sandbox                                   # run tool calls inside odek's Docker sandbox
+bodek --url 'http://127.0.0.1:8080/?token=…'      # attach with the token URL odek serve printed
+bodek --url http://127.0.0.1:8080 --token d3adb33f  # attach with an explicit token
+bodek --odek-bin ./odek                           # use a specific odek binary
+bodek -- --prompt-caching                         # pass extra flags through to `odek serve`
 ```
 
+`odek serve` protects its WebSocket and REST APIs with a per-instance token it
+prints to stderr at startup (`odek serve ⚡  http://…/?token=…`). When bodek
+spawns the server it picks the token up automatically; when you attach to one
+that's already running, paste the token URL into `--url` or pass the token
+itself via `--token`. Older odek versions without token enforcement are
+detected and connected to as before.
+
 Configuration (model, base URL, API key, MCP servers, memory, skills) is read
 by `odek serve` from its usual chain — `~/.odek/config.json` → `./odek.json` →
 `ODEK_*` env vars — so bodek inherits whatever you've already set up.

cmd/bodek/main.go

@@ -28,7 +28,8 @@ func main() {
 
 func run() error {
 	var (
-		url     = flag.String("url", "", "attach to an already-running odek serve URL (e.g. http://127.0.0.1:8080)")
+		url     = flag.String("url", "", "attach to an already-running odek serve URL (e.g. http://127.0.0.1:8080/?token=…)")
+		token   = flag.String("token", "", "WS auth token for an attached odek serve (as printed at its startup)")
 		sandbox = flag.Bool("sandbox", false, "run tool calls inside odek's Docker sandbox")
 		bin     = flag.String("odek-bin", "", "path to the odek binary to spawn (default: odek on PATH)")
 	)
@@ -38,10 +39,11 @@ func run() error {
 		fmt.Fprintf(os.Stderr, "Options:\n")
 		flag.PrintDefaults()
 		fmt.Fprintf(os.Stderr, "\nExamples:\n")
-		fmt.Fprintf(os.Stderr, "  bodek                               # spawn odek serve and start chatting\n")
-		fmt.Fprintf(os.Stderr, "  bodek --sandbox                     # spawn odek serve with Docker sandbox\n")
-		fmt.Fprintf(os.Stderr, "  bodek --url http://127.0.0.1:8080   # attach to a running odek serve\n")
-		fmt.Fprintf(os.Stderr, "  bodek -- --prompt-caching           # pass extra flags to odek serve\n")
+		fmt.Fprintf(os.Stderr, "  bodek                                             # spawn odek serve and start chatting\n")
+		fmt.Fprintf(os.Stderr, "  bodek --sandbox                                   # spawn odek serve with Docker sandbox\n")
+		fmt.Fprintf(os.Stderr, "  bodek --url 'http://127.0.0.1:8080/?token=…'      # attach with the token URL odek serve printed\n")
+		fmt.Fprintf(os.Stderr, "  bodek --url http://127.0.0.1:8080 --token d3adb33f  # attach with an explicit token\n")
+		fmt.Fprintf(os.Stderr, "  bodek -- --prompt-caching                         # pass extra flags to odek serve\n")
 	}
 	flag.Parse()
 
@@ -74,6 +76,7 @@ func run() error {
 	// Spawn or attach to the odek serve backend.
 	srv, err := server.Connect(server.Options{
 		URL:       *url,
+		Token:     *token,
 		Bin:       *bin,
 		Sandbox:   *sandbox,
 		ExtraArgs: extraArgs,

internal/client/client.go

@@ -78,16 +78,18 @@ type Resource struct {
 
 // Client is a connected odek serve session.
 type Client struct {
-	conn    *ws.Conn
-	baseURL string
-	http    *http.Client
-	Events  chan Event
+	conn       *ws.Conn
+	baseURL    string
+	serveToken string
+	http       *http.Client
+	Events     chan Event
 }
 
 // Dial connects to an odek serve WebSocket. wsURL is the ws:// endpoint,
 // origin is an http://localhost-based origin accepted by the server, baseURL is
-// the http:// root (used for the resource-search API), and token is the
-// per-instance CSRF token (obtained from a GET / Set-Cookie header).
+// the http:// root (used for the REST APIs), and token is the per-instance
+// CSRF token resolved by server.Connect (token URL, stderr banner, or legacy
+// cookie). It is sent on the WS handshake and on every REST request.
 func Dial(wsURL, origin, baseURL, token string) (*Client, error) {
 	cfg, err := ws.NewConfig(wsURL, origin)
 	if err != nil {
@@ -101,10 +103,11 @@ func Dial(wsURL, origin, baseURL, token string) (*Client, error) {
 	}
 
 	c := &Client{
-		conn:    conn,
-		baseURL: baseURL,
-		http:    &http.Client{Timeout: 3 * time.Second},
-		Events:  make(chan Event, 256),
+		conn:       conn,
+		baseURL:    baseURL,
+		serveToken: token,
+		http:       &http.Client{Timeout: 3 * time.Second},
+		Events:     make(chan Event, 256),
 	}
 	go c.readLoop()
 	return c, nil
@@ -114,7 +117,7 @@ func Dial(wsURL, origin, baseURL, token string) (*Client, error) {
 func (c *Client) Resources(query string, limit int) ([]Resource, error) {
 	u := fmt.Sprintf("%s/api/resources?q=%s&limit=%d",
 		c.baseURL, url.QueryEscape(query), limit)
-	resp, err := c.http.Get(u)
+	resp, err := c.do(http.MethodGet, u, "")
 	if err != nil {
 		return nil, err
 	}

internal/client/client_ws_test.go

@@ -5,6 +5,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 
@@ -201,6 +202,61 @@ func TestRESTEndpoints(t *testing.T) {
 	}
 }
 
+func TestRESTCarriesServeToken(t *testing.T) {
+	// Every REST request must carry the per-instance serve token, mirroring
+	// odek serve's requireServeToken (cookie or X-Odek-Ws-Token header).
+	var seen []string
+	var mu sync.Mutex
+	record := func(w http.ResponseWriter, r *http.Request) {
+		mu.Lock()
+		seen = append(seen, r.URL.Path+":"+r.Header.Get("X-Odek-Ws-Token"))
+		mu.Unlock()
+	}
+	mux := http.NewServeMux()
+	mux.Handle("/ws", ws.Handler(func(c *ws.Conn) { _, _ = c.Write(nil) }))
+	mux.HandleFunc("/api/sessions", func(w http.ResponseWriter, r *http.Request) {
+		record(w, r)
+		json.NewEncoder(w).Encode([]Session{})
+	})
+	mux.HandleFunc("/api/models", func(w http.ResponseWriter, r *http.Request) {
+		record(w, r)
+		json.NewEncoder(w).Encode([]ModelInfo{})
+	})
+	mux.HandleFunc("/api/resources", func(w http.ResponseWriter, r *http.Request) {
+		record(w, r)
+		json.NewEncoder(w).Encode([]Resource{})
+	})
+	mux.HandleFunc("/api/cancel", func(w http.ResponseWriter, r *http.Request) {
+		record(w, r)
+		w.WriteHeader(http.StatusNoContent)
+	})
+	cl, _ := newTestServer(t, mux)
+
+	if _, err := cl.Sessions(); err != nil {
+		t.Fatalf("Sessions: %v", err)
+	}
+	if _, err := cl.Models(); err != nil {
+		t.Fatalf("Models: %v", err)
+	}
+	if _, err := cl.Resources("x", 1); err != nil {
+		t.Fatalf("Resources: %v", err)
+	}
+	if err := cl.Cancel("s1", "tok"); err != nil {
+		t.Fatalf("Cancel: %v", err)
+	}
+
+	mu.Lock()
+	defer mu.Unlock()
+	if len(seen) != 4 {
+		t.Fatalf("expected 4 API calls, got %v", seen)
+	}
+	for _, s := range seen {
+		if !strings.HasSuffix(s, ":test-token") {
+			t.Errorf("request missing serve token header: %q", s)
+		}
+	}
+}
+
 func TestRESTErrorStatuses(t *testing.T) {
 	mux := http.NewServeMux()
 	mux.Handle("/ws", ws.Handler(func(c *ws.Conn) {}))

internal/client/rest.go

@@ -110,6 +110,9 @@ func (c *Client) do(method, u, sessionToken string) (*http.Response, error) {
 	if err != nil {
 		return nil, err
 	}
+	if c.serveToken != "" {
+		req.Header.Set("X-Odek-Ws-Token", c.serveToken)
+	}
 	if sessionToken != "" {
 		req.Header.Set("X-Session-Token", sessionToken)
 	}