Repository navigation
fix(clipper): sign in, or use your API token, not only an import webhook's - #406
Merged
Merged
Conversation
…ook's The web clipper only took import webhook tokens (lih_...): pasting an API token (la_...) failed with "Lens didn't recognise this token: make a new import webhook and paste its token". - Lens: POST /api/v1/hooks/import also takes the person's own token (an API token with write access, an app's, or the web app's), with ?namespace= naming one they can import into (default: their only one). Audited as import.push, by the person. GET /api/v1/hooks/import says where a token's pushes go. 401s say which kind of token Lens didn't know; the address form still takes hook tokens only. - Clipper: Sign in in the options (OAuth with PKCE, the side panel's own sign-in, shared with it), or paste an API token or a hook token, told apart by their prefix. The popup offers each namespace the person can add to. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NZxdXgdzoJfnSLju6B6Ygz
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NZxdXgdzoJfnSLju6B6Ygz
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NZxdXgdzoJfnSLju6B6Ygz
…-ylh3hl # Conflicts: # CHANGELOG.md # threat-model.yaml
…-ylh3hl # Conflicts: # CHANGELOG.md
Owner
Author
|
Clicks and keystrokes per feature failed on Generated by Claude Code |
…-ylh3hl # Conflicts: # CHANGELOG.md # nextjs-frontend/openapi.json # threat-model.yaml
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NZxdXgdzoJfnSLju6B6Ygz
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NZxdXgdzoJfnSLju6B6Ygz
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NZxdXgdzoJfnSLju6B6Ygz
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NZxdXgdzoJfnSLju6B6Ygz
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NZxdXgdzoJfnSLju6B6Ygz
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NZxdXgdzoJfnSLju6B6Ygz
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NZxdXgdzoJfnSLju6B6Ygz
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NZxdXgdzoJfnSLju6B6Ygz
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NZxdXgdzoJfnSLju6B6Ygz
This was referenced Oct 17, 2026
adeelahmad
pushed a commit
that referenced
this pull request
Oct 18, 2026
…ay and clipper sign-in as built Since the last README refresh, #474, #484, #510, #511, #497, #495, #406, #516, #517 and #491 merged. The README's built list now says a conversation exports as Markdown, PDF or JSON and its answers, questions and code copy; a Tools chip picks an answer's tools, limit and namespaces; sandbox runs open under the answer with downloads, and Settings starts the gateway; deep research plans, runs and returns a cited report; ready-made MCP servers (the browser, GitHub) and the optional containers start from the web app; and the web clipper signs in or takes an API token. Each has its checks in docs/requirements.md. In progress drops the merged PRs and lists the open feature PRs; the Planned proof item keeps only the Raspberry Pi timing (#481 and #482 are closed); the docs index links requirements and checks, and published feeds. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HDx7PPUauyjMn1LZs8JAsS
adeelahmad
pushed a commit
that referenced
this pull request
Oct 18, 2026
…ay and clipper sign-in as built Since the last README refresh, #474, #484, #510, #511, #497, #495, #406, #516, #517, #491, #400 and #506 merged. The README's built list now says the assistant answers questions about Lens itself; a conversation exports as Markdown, PDF or JSON and its answers, questions and code copy; a Tools chip picks an answer's tools, limit and namespaces; sandbox runs open under the answer with downloads, and Settings starts the gateway; deep research plans, runs and returns a cited report; ready-made MCP servers, the MCP servers page and the optional containers start from the web app; and the web clipper signs in or takes an API token. Each has its checks in docs/requirements.md. In progress lists only open PRs; the Nebula mesh (#546, merged, partly built) moves to Planned with what's next; the Planned proof item keeps only the Raspberry Pi timing; the docs index links requirements and checks, and published feeds. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HDx7PPUauyjMn1LZs8JAsS
adeelahmad
added a commit
that referenced
this pull request
Oct 18, 2026
…ay and clipper sign-in as built (#536) Since the last README refresh, #474, #484, #510, #511, #497, #495, #406, #516, #517, #491, #400 and #506 merged. The README's built list now says the assistant answers questions about Lens itself; a conversation exports as Markdown, PDF or JSON and its answers, questions and code copy; a Tools chip picks an answer's tools, limit and namespaces; sandbox runs open under the answer with downloads, and Settings starts the gateway; deep research plans, runs and returns a cited report; ready-made MCP servers, the MCP servers page and the optional containers start from the web app; and the web clipper signs in or takes an API token. Each has its checks in docs/requirements.md. In progress lists only open PRs; the Nebula mesh (#546, merged, partly built) moves to Planned with what's next; the Planned proof item keeps only the Raspberry Pi timing; the docs index links requirements and checks, and published feeds. Claude-Session: https://claude.ai/code/session_01HDx7PPUauyjMn1LZs8JAsS Co-authored-by: Adeel Ahmad <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Adeel · project thread
Description
Before: the web clipper took only an import webhook's token (
lih_…). Pasting an API token (la_…) was refused with "Lens didn't recognise this token: make a new import webhook and paste its token", becausePOST /api/v1/hooks/importknew only hook tokens.After: the clipper's options lead with Sign in. You enter the Lens address and press Enter, Lens asks you to allow the clipper (OAuth with PKCE, the same sign-in the side panel already had, now shared with it), and clips go into the namespace you pick. The popup offers every namespace you can add to. Use a token instead takes an API token with write access or a hook's token, told apart by prefix. When Lens refuses one, the clipper says why: unknown or revoked, read-only, a sign-in that ended, or a Lens too old to take API tokens.
How:
POST /api/v1/hooks/importalso takes the person's own token (an API token with write scope, an OAuth app's, or the web app's session), with?namespace=naming one where they have theimportpermission. Without it, their only such namespace is used, and if there are several the 400 lists them. These pushes are audited asimport.pushby the person and aren't counted on any hook. A newGET /api/v1/hooks/importsays where a token's pushes go (kind,namespace,namespaces,write), and the clipper's Check uses it. Against an older Lens (405) it falls back to the old empty-push check. A 401 now says which kind of token Lens didn't know. The address form/hooks/import/{token}still takes hook tokens only, so a person's token never ends up in a logged path.Motivation and Context
Adeel's clipper rejected his API token. Agents and scripts acting as a person can now use the same push address with their own token.
Types of changes
Checklist:
tests/api/test_import_hooks.py(API token, web session, OAuth app with and without write scope, namespace choice, read-only, path form refused, 401 wording per kind);extensions/browser/test/lens.test.js(namespace in the push, error wording, check via GET and the old-Lens fallback, popup choices).docs/web-clipper.md(Setting it up),docs/api.md(Import webhooks),threat-model.md(new entry-point row), extension README.Done questions (AGENTS.md)
POST /api/v1/hooks/import?namespace=;GETthere says where. No MCP import tool exists yet (refine later).tokens.oauth_enabled); nothing new to install.importpermission and are header-only. Threat model row added.make openapitooling regeneratedopenapi.jsonand the client).🤖 Generated with Claude Code
https://claude.ai/code/session_01NZxdXgdzoJfnSLju6B6Ygz
Generated by Claude Code