mirror of
https://github.com/stablyai/orca.git
synced 2026-10-31 00:57:45 +00:00
Neil
76fc1e5acd
Partially reverts #27540 and the plain-http part of #27552, which broke web pairing on upgrade for 1.4.227 users who open Orca at a LAN or Tailscale address: - The host no longer refuses a first pairing from a plain-http page on another machine (insecure_origin, ORCA_ALLOW_INSECURE_WEB_PAIRING). - Such a page keeps its pairing code in local storage and signs in with it, as in 1.4.227, so reloads, new tabs and bookmarks stay paired; no notice. - Session-only browser keys (pairing.device-key-ephemeral.v1, the idle sweep) stay for browsers without Ed25519. - A web client whose credentials are refused shows the host's reason instead of an empty workspace and "Session restore failed".
20 lines
895 B
TypeScript
20 lines
895 B
TypeScript
// Why kept: hosts from v1.4.225 to v1.4.228 refuse a first pairing from a plain-http page on another
|
|
// machine with this sealed code, and the browser still explains it when paired to one.
|
|
export const INSECURE_WEB_ORIGIN_AUTH_CODE = 'insecure_origin' as const
|
|
|
|
// Why a marker: React Native phones also send an http Origin on LAN sockets, so the Origin alone
|
|
// cannot say "browser". Only the web bundle adds this query to its upgrade URL; hosts ignore the
|
|
// query string, so the marked upgrade connects to every host.
|
|
export const WEB_CLIENT_UPGRADE_PARAM = 'orca-client' as const
|
|
export const WEB_CLIENT_UPGRADE_VALUE = 'web' as const
|
|
|
|
export function withWebClientUpgradeMarker(endpoint: string): string {
|
|
try {
|
|
const url = new URL(endpoint)
|
|
url.searchParams.set(WEB_CLIENT_UPGRADE_PARAM, WEB_CLIENT_UPGRADE_VALUE)
|
|
return url.toString()
|
|
} catch {
|
|
return endpoint
|
|
}
|
|
}
|