Files
orca/mobile/src
buf0-bot[bot]andorca-bot 57d095bf6f fix: pr-bug-scan findings from #1475 (#1562)
host-store: write AsyncStorage metadata before SecureStore token to avoid orphaned keychain tokens on crash. mobile IPC: coalesce repeated getPairingQR calls onto a single pending device token via new DeviceRegistry.getOrCreatePendingDevice.

Findings addressed:
- [high] mobile/src/transport/host-store.ts — saveHost orders Keychain write before AsyncStorage — orphaned tokens on crash
- [low] src/main/ipc/mobile.ts:84-95 — getPairingQR creates a device token on every call, leaking pre-paired entries

Rebased onto current main to resolve conflicts; preserved tokenCache.set added on main.

Co-authored-by: orca-bot <bot@stably.ai>
2026-05-07 23:11:03 -07:00
..