Skip to content

Show T3 questions live without polling - #1

Merged
beastyrabbit merged 3 commits into
mainfrom
t3code/stream-deck-input-alerts
Sep 9, 2026
Merged

Show T3 questions live without polling#1
beastyrabbit merged 3 commits into
mainfrom
t3code/stream-deck-input-alerts

Conversation

@beastyrabbit

Copy link
Copy Markdown
Owner

Note

🤖 Codex responding on behalf of beastyrabbit

Pending questions need immediate attention on the deck, while periodic reads of T3's Chromium cache are fragile and delay updates. This switches the plugin to T3's existing read-only pairing and live shell stream, with combined, threads-only, and questions-only key displays. Input, approval, and plan-review requests trigger blinking alerts.

Users now paste a read-only pairing link into the key settings for each environment. Connections are shared across keys, credentials stay outside OpenDeck profiles, and reconnects load a fresh snapshot before showing live totals. T3's current authorization lasts about 30 days: an uninterrupted stream may continue longer, but reconnecting after expiry requires a fresh pairing link. This does not add automatic token renewal or a narrower upstream status-only permission.

Verified with pnpm verify (223 tests, types, lint, build), pnpm package, secret scanning, and browser automation using local T3/OpenDeck fixtures. Covered pairing, live questions, per-key modes, reconnects, expiry/re-pairing, removal, and keeping credentials out of profile settings and inspector responses. The new connection flow still needs validation against a real T3 server and physical deck; it uses T3's first-party, unversioned interface.

Settings panel and actual emitted key images below use synthetic test data. The animation shows a pending question appear, blink, and clear.

Pairing and per-key display settings

Live question alerts on simulated OpenDeck keys

@github-actions

github-actions Bot commented Sep 9, 2026

Copy link
Copy Markdown

OpenGrep

Scan complete

Commit: dc14d3e · Engine: 1.30.0 · Rules: 34b6db9e42b5 · Profile: all
Files scanned: 22 · New findings: 86 · Technical errors: 0
Reporting only. Findings do not enforce a merge restriction.

  • ERROR rules_lgpl_javascript_eval_rule-eval-nodejs: src/t3-live-client.ts:272
  • INFO raptor-bad-words: plugin/property-inspector/index.html:45
  • INFO raptor-bad-words: plugin/property-inspector/index.html:46
  • INFO raptor-bad-words: plugin/property-inspector/property-inspector.js:346
  • INFO raptor-bad-words: plugin/property-inspector/property-inspector.js:347
  • INFO raptor-bad-words: plugin/property-inspector/property-inspector.js:348
  • INFO raptor-bad-words: plugin/property-inspector/property-inspector.js:352
  • INFO raptor-bad-words: plugin/property-inspector/styles.css:71
  • INFO raptor-bad-words: README.md:17
  • INFO raptor-bad-words: README.md:117
  • INFO raptor-bad-words: README.md:119
  • INFO raptor-bad-words: README.md:119
  • INFO raptor-bad-words: src/connection-store.ts:12
  • INFO raptor-bad-words: src/connection-store.ts:24
  • INFO raptor-bad-words: src/connection-store.ts:55
  • INFO raptor-bad-words: src/controller.ts:80
  • INFO raptor-bad-words: src/controller.ts:81
  • INFO raptor-bad-words: src/t3-error.ts:3
  • INFO raptor-bad-words: src/t3-live-client.ts:43
  • INFO raptor-bad-words: src/t3-live-client.ts:44
  • INFO raptor-bad-words: src/t3-live-client.ts:45
  • INFO raptor-bad-words: src/t3-live-client.ts:46
  • INFO raptor-bad-words: src/t3-live-client.ts:47
  • INFO raptor-bad-words: src/t3-live-client.ts:48
  • INFO raptor-bad-words: src/t3-live-client.ts:49
  • INFO raptor-bad-words: src/t3-live-client.ts:50
  • INFO raptor-bad-words: src/t3-live-client.ts:51
  • INFO raptor-bad-words: src/t3-live-client.ts:52
  • INFO raptor-bad-words: src/t3-live-client.ts:53
  • INFO raptor-bad-words: src/t3-live-client.ts:55
  • INFO raptor-bad-words: src/t3-live-client.ts:68
  • INFO raptor-bad-words: src/t3-live-client.ts:77
  • INFO raptor-bad-words: src/t3-live-client.ts:87
  • INFO raptor-bad-words: src/t3-live-client.ts:114
  • INFO raptor-bad-words: src/t3-live-client.ts:118
  • INFO raptor-bad-words: src/t3-live-client.ts:119
  • INFO raptor-bad-words: src/t3-live-client.ts:120
  • INFO raptor-bad-words: src/t3-live-client.ts:120
  • INFO raptor-bad-words: src/t3-live-client.ts:121
  • INFO raptor-bad-words: src/t3-live-client.ts:121
  • INFO raptor-bad-words: src/t3-live-client.ts:121
  • INFO raptor-bad-words: src/t3-live-client.ts:128
  • INFO raptor-bad-words: src/t3-live-client.ts:129
  • INFO raptor-bad-words: src/t3-live-client.ts:141
  • INFO raptor-bad-words: src/t3-live-client.ts:141
  • INFO raptor-bad-words: src/t3-live-client.ts:146
  • INFO raptor-bad-words: src/t3-live-client.ts:252
  • INFO raptor-bad-words: src/t3-live-client.ts:266
  • INFO raptor-bad-words: src/t3-live-client.ts:281
  • INFO raptor-bad-words: src/t3-live-client.ts:306
    36 more findings in the report artifact.

Full report and run

Comment thread src/t3-live-client.ts
Comment thread plugin/property-inspector/index.html
Comment thread plugin/property-inspector/index.html
Comment thread plugin/property-inspector/property-inspector.js
Comment thread plugin/property-inspector/property-inspector.js
Comment thread src/controller.ts
Comment thread src/controller.ts
Comment thread src/t3-error.ts
Comment thread src/t3-live-client.ts
Comment thread src/t3-live-client.ts
@beastyrabbit

Copy link
Copy Markdown
Owner Author

Note

🤖 Codex responding on behalf of beastyrabbit

Checked all 86 OpenGrep findings against commit dc14d3eff3ea and the rule definitions. None requires a code change:

  • The JavaScript eval rule flags the reconnect delay calculation at src/t3-live-client.ts:272. The delay is numeric arithmetic capped at 30,000 ms; setTimeout receives a function callback. No string is evaluated as code.
  • All 85 raptor-bad-words matches are keyword matches in TypeScript private declarations, auth field names, password-input markup, error messages, security documentation, CSS overflow-wrap, or explicit test fixtures. They identify no embedded live credential or executable vulnerability. The credential flow and owner-only storage checks were reviewed, and the outgoing commits passed secret scanning.

Resolving the corresponding inline threads on that basis. OpenGrep completed with zero technical errors; its report remains neutral because it retains these audit matches.

@beastyrabbit
beastyrabbit merged commit 53d1e91 into main Sep 9, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant