mirror of
https://github.com/stablyai/orca.git
synced 2026-11-13 09:27:29 +00:00
Neil
ddd3a071c3
* feat(pairing): a browser's saved device key retires the pairing link it came from When a browser signs in for the first time with a saved device key forked from a ticket row, the row's link token is replaced by a value nobody holds (the row stays as the fork's anchor; orchestration fingerprint pinned). Session-only keys re-register from the link on every page load, so they never retire it. Links from older builds are untouched. * fix(pairing): a browser key retires a link only during pairing and only if nobody claimed it A saved browser key now retires its link only when it was registered within the pairing window of the link's first sign-in, and only when no other client already proposed its own token for it (that first claim wins, so the desktop that proposed first is never locked out). * test(pairing): the web key migration wire test expects a fresh link to be single use * fix(web): say a refused pairing link may already have been used A browser opening a single-use link after another device used it is refused as unauthorized; the message now names that case and asks for a new pairing link from Orca.