fix: drop stale turn-end approvals and nil-panic guards

internal/tokens/tokens.go

@@ -35,6 +35,12 @@ func Open() *Store {
 	s.path = filepath.Join(home, ".bodek", "sessions.json")
 	if data, err := os.ReadFile(s.path); err == nil {
 		_ = json.Unmarshal(data, &s.m)
+		// JSON null unmarshals into a nil map; keep an empty map so Set
+		// cannot panic on assignment. Corrupt JSON still leaves the
+		// in-memory-empty store Open already constructed.
+		if s.m == nil {
+			s.m = map[string]string{}
+		}
 	}
 	return s
 }

internal/tokens/tokens_test.go

@@ -171,3 +171,30 @@ func TestOpenWithCorruptFile(t *testing.T) {
 		t.Error("set after corrupt-open did not persist")
 	}
 }
+
+// TestOpenWithJSONNull pins that a store file whose contents are the JSON
+// literal null (encoding/json unmarshals that into a nil map) must still
+// behave as an empty store. Set after Open used to panic: assignment to
+// entry in nil map.
+func TestOpenWithJSONNull(t *testing.T) {
+	dir := t.TempDir()
+	t.Setenv("HOME", dir)
+	t.Setenv("USERPROFILE", dir)
+	if err := os.MkdirAll(filepath.Join(dir, ".bodek"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, ".bodek", "sessions.json"), []byte("null"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	s := Open()
+	if s.Get("anything") != "" {
+		t.Error("null file should yield empty store")
+	}
+	s.Set("k", "v") // must not panic
+	if s.Get("k") != "v" {
+		t.Error("set after null-open did not stick in memory")
+	}
+	if Open().Get("k") != "v" {
+		t.Error("set after null-open did not persist")
+	}
+}

internal/tui/approval_test.go

@@ -192,3 +192,45 @@ func TestApprovalScrollWhilePending(t *testing.T) {
 		t.Error("scrolling must not answer the approval")
 	}
 }
+
+// A turn that ends (done / error) while an approval is still queued must
+// drop the form the same way disconnect already does. Leaving it armed
+// captures the keyboard (and the footer) after the engine has moved on,
+// so ⏎ never sends the next prompt.
+func TestTurnEndClearsStaleApprovals(t *testing.T) {
+	for _, end := range []struct {
+		name string
+		ev   client.Event
+		want string
+	}{
+		{"done", client.Event{Type: "done", Latency: 1}, "ready"},
+		{"error", client.Event{Type: "error", Message: "boom"}, "error"},
+		{"cancel", client.Event{Type: "error", Message: "context canceled"}, "ready"},
+	} {
+		t.Run(end.name, func(t *testing.T) {
+			m := newTestModel()
+			busyTurn(m)
+			m.handleEvent(client.Event{Type: "approval_request", ID: "apr-1",
+				Risk: "shell_exec", Command: "rm x"})
+			if m.curApproval() == nil {
+				t.Fatal("precondition: approval_request must arm the queue")
+			}
+
+			m.handleEvent(end.ev)
+
+			if m.curApproval() != nil {
+				t.Fatal("turn end must drop stale approvals")
+			}
+			if len(m.apprDeadlines) != 0 {
+				t.Fatalf("turn end left %d approval deadlines", len(m.apprDeadlines))
+			}
+			if m.status != end.want {
+				t.Errorf("status = %q, want %q", m.status, end.want)
+			}
+			foot := plain(m.footer())
+			if strings.Contains(foot, "pprove") || strings.Contains(foot, "eny") {
+				t.Errorf("footer still shows approval hints after %s: %q", end.name, foot)
+			}
+		})
+	}
+}

internal/tui/events.go

@@ -213,6 +213,12 @@ func (m *Model) handleEvent(ev client.Event) (tea.Model, tea.Cmd) {
 		m.busy = false
 		m.lastTool = ""
 		m.lastArg = ""
+		// Pending approvals die with the turn — the same contract disconnect
+		// documents. Leaving them armed captures the keyboard after the
+		// engine has moved on, so ⏎ never sends the next prompt.
+		m.approvals = nil
+		m.apprDeadlines = nil
+		m.resetApprovalInput()
 		m.status = "ready"
 		m.sessCtxTok = ev.SessionContextTokens
 		m.sessOutTok = ev.SessionOutputTokens
@@ -309,6 +315,9 @@ func (m *Model) handleEvent(ev client.Event) (tea.Model, tea.Cmd) {
 		m.busy = false
 		m.lastTool = ""
 		m.lastArg = ""
+		m.approvals = nil
+		m.apprDeadlines = nil
+		m.resetApprovalInput()
 		if cancelled {
 			m.status = "ready"
 		} else {

internal/tui/reconnect.go

@@ -71,7 +71,11 @@ func (m *Model) handleReconnect(msg reconnectMsg) (tea.Model, tea.Cmd) {
 		return m, m.scheduleReconnect(msg.attempt + 1)
 	}
 	m.status = "disconnected"
-	m.addNote("reconnect failed — " + msg.err.Error() + " · press ⏎ to retry")
+	reason := "no client"
+	if msg.err != nil {
+		reason = msg.err.Error()
+	}
+	m.addNote("reconnect failed — " + reason + " · press ⏎ to retry")
 	if m.opts.LogPath != "" {
 		m.addNote("server log · " + m.opts.LogPath)
 	}

internal/tui/reconnect_test.go

@@ -104,6 +104,41 @@ func TestReconnectRetriesThenGivesUp(t *testing.T) {
 	}
 }
 
+// A hook that returns (nil, nil) is a failed redial — success requires a
+// live client. The give-up path used to deref msg.err unconditionally and
+// panic when the hook reported neither a client nor an error.
+func TestReconnectNilClientNoPanic(t *testing.T) {
+	m := newTestModel()
+	m.disconn = true
+	m.opts.Reconnect = func() (*client.Client, error) { return nil, nil }
+
+	defer func() {
+		if r := recover(); r != nil {
+			t.Fatalf("reconnect (nil, nil) panicked: %v", r)
+		}
+	}()
+	_, cmd := m.Update(reconnectMsg{attempt: maxReconnectAttempts - 1})
+	if cmd != nil {
+		t.Error("no more attempts once the budget is spent")
+	}
+	if m.status != "disconnected" {
+		t.Errorf("status = %q, want disconnected", m.status)
+	}
+	if !m.disconn {
+		t.Error("input must stay blocked after giving up")
+	}
+	found := false
+	for _, n := range m.notices {
+		if strings.Contains(n, "reconnect failed") {
+			found = true
+			break
+		}
+	}
+	if !found {
+		t.Errorf("expected a reconnect-failed note, got %v", m.notices)
+	}
+}
+
 // A reconnect result arriving after the disconnect was already resolved is
 // dropped, not applied.
 func TestReconnectStaleResultIgnored(t *testing.T) {