::jwt::verify -json embedded payload/header as nested rl_json objects, so `json get $res payload` returned non-re-parsable Tcl-dict form — an undocumented footgun. Not yet in production; deliberate breaking redesign.

- -json: header/payload now raw JSON *string* values (re-parsable). Read claims in two steps: `set c [json get $res payload]; json get $c exp`. verify without -json unchanged (boolean, signature only). - -claims: opt-in RFC 7519 exp/nbf check (default stays signature only). Adds `reason` field to -json (ok|signature|notbefore| expired|payload), only when -claims given. - -leeway sec: opt-in clock-skew tolerance for -claims (default 0, no-op without -claims).

jwt.tcl is in SCRIPT_SOURCES (compiled into script.h via make). New src/tests/jwt.test (24 cases). Baseline unchanged (470: 465 passed, 5 skipped, 0 failed); full suite 494/489/5/0. SKILL.md: new "JWT (jwt.tcl)" section. leaf check-in: d9c28bbfee user: alex tags: trunk

mod_websh.so loaded fine when started via `httpd -X` from /opt/homebrew/etc/httpd, but failed under the LaunchAgent (CWD=/) with no error_log entry — dyld could not resolve the bare-name LC_LOAD_DYLIB for libwebsh.

Root cause: libwebsh.dylib was linked without -install_name, so its LC_ID_DYLIB was just the bare filename. mod_websh.so inherited that bare reference in its LC_LOAD_DYLIB. All other dependencies (APR, APR-util, Tcl framework, libSystem) had absolute paths and worked.

Fix: on Darwin, link libwebsh with -Wl,-install_name,$(pkgdir)/$(web_LIB_FILE) so the embedded install_name is the configured install location. mod_websh picks this up automatically at link time. No post-build install_name_tool or -headerpad_max_install_names dance required. The path is prefix-relative and resolved at build time, so it follows --prefix / --with-tcl correctly.

Implemented as SHLIB_INSTALL_NAME, appended to MAKE_LIB / MAKE_SHARED_LIB. Empty on non-Darwin platforms — Linux uses SONAME + ldconfig and is unaffected. check-in: 95cdb054ae user: alex tags: trunk

Make the build work on macOS (Apple Silicon, Homebrew) without manual configure flags. ./configure --enable-apache, make, make test, and sudo make install all work out of the box.

C23 compatibility (clang on macOS now defaults to -std=gnu23):

* url.c: rename `int bool` to `int boolVal` — `bool` is a reserved type keyword in C23. * tclAppInit.c: convert K&R-style `int main(argc, argv)` to ANSI `int main(int argc, char **argv)` — K&R declarations were removed in C23.

Both changes also compile cleanly under C99/C11/C17, so Linux builds are unaffected.

Build system (configure.ac, Makefile.in):

* Auto-detect APR/APU link flags via `apr-1-config --link-ld --libs` and `apu-1-config --link-ld --libs`, with Homebrew fallbacks. Previously only the headers were auto-detected; the libraries required explicit --with-apr= / --with-apu=. On macOS, mod_websh.so is a bundle linked with -bundle_loader against the httpd binary, which does not export APR symbols (Homebrew httpd loads APR as shared libs at runtime), so explicit -lapr-1 / -laprutil-1 are required.

* Introduce SHLIB_EXT (.dylib on Darwin, .so elsewhere) so the unversioned install symlink (libwebsh.dylib / libwebsh.so) and the SHARED_LIB_SUFFIX match the platform's actual library extension. pkgIndex.tcl already uses [info sharedlibextension] and is unchanged.

* Rename SYSTEMCTL_APACHE to RESTART_APACHE and default it to ":" (no-op) so the install rule is syntactically valid on platforms without an Apache restart hook. LDCONFIG gets the same default. The recipe lines are now `@$(LDCONFIG)` / `@$(RESTART_APACHE)`.

* Add a Darwin case that sets RESTART_APACHE to `brew services restart httpd` when Homebrew httpd is installed. When invoked via sudo, the command runs as the original user via `sudo -u "$SUDO_USER"` so brew does not chown httpd paths to root:admin (which breaks future `brew upgrade httpd`).

* `make clean` now also removes libwebsh*.dylib.

Tests pass on macOS 26.4 (Apple Silicon, Tcl 8.6 framework, Homebrew httpd/apr/apr-util): 470 total, 465 passed, 5 skipped, 0 failed. check-in: 166114797f user: alex tags: trunk

Tcl's -translation binary implicitly sets -encoding binary as a side effect. In parseMultipartFormData this caused text field values to be stored as raw byte sequences rather than decoded Unicode strings: UTF-8 bytes C3 A4 (ä) were kept as two separate chars U+00C3 and U+00A4 instead of the single char U+00E4. On output through a UTF-8 response channel those chars were re-encoded, producing the double-encoded sequence C3 83 C2 A4 (ä) visible in the browser.

Fix: after setting -translation binary, explicitly restore the channel encoding to its saved value so that multi-byte sequences in text fields are decoded correctly during parsing.

websh-test.ws3: switch page charset to utf-8 to match the server's channel encoding and modern browser form submission behaviour; set Content-Type response header explicitly via web::response -set. check-in: 56cc68ed13 user: alex tags: trunk

configure.ac detects /sbin/ldconfig on Linux and sets LDCONFIG accordingly. When Apache support is enabled it also probes for the apache2 or httpd systemd service via "systemctl cat" and sets SYSTEMCTL_APACHE to "systemctl restart <service>". Both variables are empty on non-Linux platforms so the install targets remain portable.

install-binaries runs $(LDCONFIG) after placing the shared library. install-libraries runs $(SYSTEMCTL_APACHE) after installing the Apache module. Both calls are guarded with "test -z" so an empty variable is a silent no-op; the leading "-" prevents a failed restart from aborting the install.

The clean target now additionally removes versioned build artifacts via shell globs (websh[0-9]*, libwebsh[0-9]*.so, mod_websh[0-9]*.so) so that old binaries are cleaned up even after a version bump and reconfigure. check-in: 730c03e21c user: alex tags: trunk

install-binaries now installs the Tcl package into lib/websh<VERSION>/ (pkgdir) with pkgIndex.tcl and creates relative symlinks lib/libwebsh<VERSION>.so and lib/libwebsh.so pointing into pkgdir — matching the layout expected by the Tcl package loader and previously handled manually by the ./b script.

install-libraries (Apache only, guarded by INSTALL_APACHE) installs mod_websh<VERSION>.so to lib/httpd/modules/ with mod_websh.so and libwebsh<VERSION>.so symlinks. install-dirs no longer creates the Apache module directory; install-libraries does that itself so the directory is only created when Apache support is enabled.

All ln -s calls changed to ln -sf so repeated installs are idempotent.

The clean target now also removes versioned artifacts via shell globs (websh[0-9]*, libwebsh[0-9]*.so, mod_websh[0-9]*.so) so that old build products are cleaned up even after a version bump and reconfigure. check-in: a7fea1fbef user: alex tags: trunk

Compiler warnings (-Wunused-but-set-variable, dangerous function): - nca_d.c: remove unused keyBytes in Web_DecryptD - formdata.c: remove unused bytesWritten; use (void)readAndDumpBody() - log.c: replace silent ires assignments with proper TCL_OK checks for all four registerLogPlugIn() calls; fixes a logtocmd/logtosyslog WebAssertData typo as a side effect - request.c: replace tempnam() (TOCTOU-unsafe linker warning) with mkstemp() + immediate unlink() + P_tmpdir fallback for missing dirs; add <unistd.h> - interpool.c: check return values of Tcl_Init() and Websh_Init(), log failures via ap_log_error() and return NULL on error

Runtime crash (SIGSEGV in rawReadPostData): - formdata.c: guard CONTENT_TYPE hash lookup against NULL before passing to Tcl_GetString / Tcl_StringCaseMatch; fix cJSON_Delete() call to execute on all code paths; guard cmdTag NULL dereference

Encoding handling (web::getContent, CONTENT_ENCODING): - formdata.c rawReadPostData: derive CONTENT_ENCODING from charset= in the Content-Type header; fall back to iso8859-1 (HTTP/1.1 default) instead of the channel's system locale encoding - webutils.tcl web::getContent: resolve encoding in priority order — charset= from Content-Type, then CONTENT_ENCODING, then utf-8 — so JSON/XML bodies without an explicit charset= are decoded correctly

Missing header: - web.h: add #include "randombytes.h" to fix implicit declaration of randombytes_Init() in web.c check-in: d11b978e8c user: alex tags: trunk

Replace the Scriptics-era SC_* macro build system with the standard TEA (Tcl Extension Architecture) 3.13 framework.

- Add configure.ac (replaces configure.in) using TEA_* macros - Add tclconfig/ with tcl.m4 (TEA 3.13), install-sh, and support files - Add pkgIndex.tcl.in template for package registration - Update aclocal.m4 to include tclconfig/tcl.m4 - Remove obsolete configure.in and standalone tcl.m4 - Update Makefile.in for TEA compatibility: - Apache module build made optional via APACHE_TARGET / INSTALL_APACHE substitution variables; default: auto-detect, --disable-apache skips mod_websh, --enable-apache requires it - Override TEA's MAKE_LIB to preserve websh's $($@_OBJECTS) link pattern - Keep web_LIB_FILE as compatibility alias for PKG_LIB_FILE - Fix LD_LIBRARY_PATH order in test target so the freshly built library takes precedence over any installed version - Auto-detect APR/APU include paths via apr-1-config / apu-1-config; add Homebrew prefix search on macOS (Intel and Apple Silicon) check-in: 26dd4f11e4 user: alex tags: trunk

Introduce real-time Server-Sent Events streaming for mod_websh:

- webout.h: add ResponseFlushHandler typedef and flushHandler pointer to ResponseObj (analogous to existing headerHandler) - weboutint.c: initialise flushHandler to NULL in createResponseObj - webout.c: implement web::response -flush — calls Tcl_Flush on the response channel, then invokes flushHandler if set - response_ap.c: add apFlushHandler (calls ap_rflush) and wire it into createDefaultResponseObj_AP; without this ap_rwrite fills the APR bucket chain but never pushes data to the network until request end - webutils.tcl: web::sseStart sets -buffering none -buffersize 0 instead of -buffering line

Without ap_rflush, SSE events were buffered by Apache and only delivered after the command completed. Tcl_Flush alone is insufficient because it drains Tcl's internal buffer via outputProc but does not call flushProc from Tcl_ChannelType (that is only invoked on channel close). check-in: 40063bce69 user: alex tags: trunk