mirror of
https://github.com/stablyai/orca.git
synced 2026-11-01 17:47:40 +00:00
OrcaWinandm4air
fee083fa47
* feat(runtime): session-only browser keys and an opt-in for pairing from plain-http pages (host) - pairing.registerDeviceKey accepts ephemeral: true (advertised as pairing.device-key-ephemeral.v1). Such keyed rows are dropped when the host restarts and after 12 hours with no live socket; a sweep removes them and cuts any socket still bound to them, so later key auth gets device_revoked. - The WebSocket upgrade Origin is recorded per socket. A first pairing (a never-used pairing code) from an http:// page on another machine is refused with a sealed insecure_origin error unless the operator sets ORCA_ALLOW_INSECURE_WEB_PAIRING=1. Already-paired browsers, https and loopback pages, and native clients are unchanged. - Registry file reading moved to device-registry-file-read.ts to keep the registry under the size cap. * fix(runtime): gate first pairings only for the marked web client, never phones React Native sends an http Origin on every LAN WebSocket, so the Origin alone refused first-time QR pairing from released phones. The web bundle now marks its upgrade with ?orca-client=web; only a marked socket from an http page on another machine is gated. Released hosts ignore the query string. --------- Co-authored-by: m4air <m4air@Mac.localdomain>
17 lines
868 B
TypeScript
17 lines
868 B
TypeScript
// Why dependency-free: protocol-version.ts reaches the terminal daemon's bundle, and the relocated
|
|
// Windows daemon-host cannot resolve crypto packages; the proof code lives in device-key-proof.ts.
|
|
|
|
// Why: an older host refuses the key-auth shape with bad_auth and has no
|
|
// pairing.registerDeviceKey; clients migrate or present a key only when this is advertised.
|
|
export const DEVICE_KEY_RUNTIME_CAPABILITY = 'pairing.device-key.v1' as const
|
|
|
|
// Why: registerDeviceKey's params are strict on older hosts, so `ephemeral` is sent only when advertised.
|
|
export const DEVICE_KEY_EPHEMERAL_RUNTIME_CAPABILITY = 'pairing.device-key-ephemeral.v1' as const
|
|
|
|
export const DEVICE_KEY_RUNTIME_CAPABILITIES = [
|
|
DEVICE_KEY_RUNTIME_CAPABILITY,
|
|
DEVICE_KEY_EPHEMERAL_RUNTIME_CAPABILITY
|
|
] as const
|
|
|
|
export const REGISTER_DEVICE_KEY_METHOD = 'pairing.registerDeviceKey' as const
|