Skip to content

LAN T1: independent encrypted phone pairing, DM and revocation #2599

New issue
New issue
Open
Open
LAN T1: independent encrypted phone pairing, DM and revocation#2599
Labels
agent:activeOne or more coding-agent tasks currently claim this issue; see claim comments for task IDsarea:fullstackEnd-to-end Host and Client implementationfeature:connectTrusted Host connectivity, pairing, routes and revocationready-for-agentFully specified, ready for an AFK agentscope:tracerHuman-testable implementation slice
Milestone
v2.0

Description

@DoodleBears
DoodleBears
opened on Oct 22, 2026

Part of #2598 — encrypted LAN phone access, automatic route recovery and pairing upgrades.

User-visible slice

A Human explicitly enables phone LAN access on the computer, scans its trusted QR with the installed phone app, approves that phone's key once, reads the real Host Feed and exchanges a DM over the encrypted local route. Revoking the phone closes access. No Connect account, Tailscale, manually installed certificate, typed IP or router configuration is required.

Acceptance

  • LAN starts disabled; an explicit enable control with clear notice and matching CLI opens only a restricted encrypted-device entry. A separate disable control closes it. Updating the plugin alone never enables LAN.
  • Preserve the loopback DSH operator boundary and canonical Device Pairing authority. Reuse the merged pinned-Host-key Noise channel (feat(connect): encrypt paired-device traffic with pinned Noise XK #2547), with explicit LAN admission, no raw fallback and lifecycle cleanup; document any necessary same-listener ADR refinement.
  • The existing pairing chooser/Host management flow supports LAN. A trusted QR binds the intended Host key and expiring offer; the Host approves the exact phone key. Reused/expired/rejected offers and wrong keys fail with stable reasons. Host credentials stay on the Host.
  • Native phone reads real Host state without Internet access. Separately verify real DM send/reply with an available model; external model reachability is not LAN reachability.
  • Existing Tailscale and Connect paths continue to work under their existing trust contracts. A paired phone retains valid trust across ordinary restart; unsupported/legacy LAN trust refuses clearly until the later upgrade slice.
  • Revocation terminates admitted encrypted connections and refuses later requests; disablement releases LAN resources. Host/phone failures cannot accidentally publish the full Web Client or operator API.
  • Ship CLI parity for every added/changed Host command/route, protected handling of enrollment material, bounded secret-free lifecycle diagnostics and bilingual CLI/release documentation.
  • Focused automated tests run through the real pairing owner/encrypted gateway and Host client seam, including wire confidentiality, identity/refusal, lifecycle and CLI behavior. Update feature journeys and native platform configuration deliberately; no broad cleartext exception as a shortcut.
  • Provide a runnable isolated Host plus native phone path, capture required redacted UI evidence and obtain Human feedback before expanding the next slice. Follow the shared device QA lanes. Record each platform's actual verification result separately; one platform's success does not qualify the other.

Boundaries and sequencing

This is the first end-to-end PR in #2598. Healthy-route proactive switching, offline changed-address rediscovery and transactional legacy pairing upgrade are subsequent slices, not disconnected prerequisites to this slice. The final spec still requires iOS and Android qualification; first feedback uses one available reserved native QA combination.

Respect existing pairing UX work (#2517/#2581), CLI authority (#2098) and encrypted transport (#2547). Implement in an isolated issue branch; inspect active claims before changing shared surfaces. Keep specification requirements and its test plan authoritative. A backend listener or UI mock alone does not complete this ticket.

Activity

  1. DoodleBears
    added
    ready-for-agentFully specified, ready for an AFK agent
    area:fullstackEnd-to-end Host and Client implementation
    scope:tracerHuman-testable implementation slice
    on Oct 22, 2026
  2. DoodleBears
    added a parent issue on Oct 22, 2026

  3. DoodleBears commented on Oct 22, 2026

    @DoodleBears
    DoodleBears
    on Oct 22, 2026
    ContributorAuthor

    Agent work claim

  4. DoodleBears
    added
    agent:activeOne or more coding-agent tasks currently claim this issue; see claim comments for task IDs
    on Oct 22, 2026

  5. DoodleBears commented on Oct 22, 2026

    @DoodleBears
    DoodleBears
    on Oct 22, 2026
    ContributorAuthor

    Agent implementation progress

    • Task: codex/local/01a1639d-a211-7a30-a976-b6f6416ca9b1
    • Source submitted: Draft PR feat(devices): opt-in encrypted LAN phone pairing (#2599) #2600, head 013bf12ab51ad5d9e2fbf150ebf494f097f1625f.
    • Implemented T1: default-off restricted LAN entry; canonical Noise/pairing and exact phone-key approval; mobile Wi-Fi pairing; scoped Android/iOS carriers; revocation and LAN disable; CLI parity; bilingual docs and lifecycle diagnostics.
    • Two-axis source review findings fixed and re-reviewed. Focused 83 tests, typecheck, lint, format and build passed. Full Windows suite has failures (including cleanup EPERM and timeouts); reduced-concurrency rerun is in progress. Full CI requested.
    • Android source is submitted to the shared queue, not yet cut. Native compilation, actual QR scan, real offline Host Feed, separate model DM/reply, live CLI proof, screenshots and Human feedback remain unqualified. iOS requires separate qualification.
    • LAN T1: independent encrypted phone pairing, DM and revocation #2599 and parent Spec: encrypted LAN phone access with automatic route recovery and pairing upgrades #2598 remain open. No later slice has been started; first native feedback precedes T2 expansion. No QA device, Host, Metro or lease was acquired by this source task.
  6. DoodleBears
    added 2 commits that reference this issue on Oct 22, 2026

    fix(mobile): compile LAN DNS adapter and align Expo types

    2a2ee20

    fix(cli): expose device fingerprint before pairing approval

    bac5bf9

  7. DoodleBears commented on Oct 22, 2026

    @DoodleBears
    DoodleBears
    on Oct 22, 2026
    ContributorAuthor

    Agent work outcome

    • Task: codex/local/01a1639d-a211-7a30-a976-b6f6416ca9b1
    • State: handed-off for queued native acceptance; implementation goal blocked on the shared QA allocation and required first-slice Human feedback, not completed.
    • Draft PR: feat(devices): opt-in encrypted LAN phone pairing (#2599) #2600 at bac5bf9d7bc461f4d5bea33aff020dc6236f331e. Source branch is clean and pushed.
    • Current-head CI: static checks/build, mobile verification, Android native module tests, docs build, isolated DSH Host smoke and full-test shards 2/3 passed. Shard 1 was still running at handoff; no full current-head green claim. Run: https://github.com/BotHarness/DeepSeekBot/actions/runs/39828163347 . Recheck it before resuming. Windows full suite remains non-green; the interrupted rerun is invalid evidence.
    • T1 source includes restricted opt-in LAN, pinned encrypted pairing, exact phone-key approval, native carriers, revocation, disablement, CLI parity, bilingual documentation and regression coverage. The latest follow-up exposes the pairing CLI's public fingerprint before approval; 14 focused regressions and two independent source reviews passed.
    • Shared Windows queue contains the exact head and a prepared runner worksheet. No batch has been cut for this request. No Host, Metro, device lease or native build was started by this source task. Actual native QR pairing, fresh offline Host Feed, separate real-model DM, live device CLI, restart/revocation, matched UI evidence and Human feedback remain unverified. Android CI compilation/unit tests are not native phone acceptance; iOS is independently untested.
    • Resume after the queue owner allocates the first native combination. Preserve the existing profile/app state, run the recorded acceptance matrix, fix findings in this PR, then obtain first-slice feedback. Subsequent route recovery/discovery and legacy upgrade slices remain in Spec: encrypted LAN phone access with automatic route recovery and pairing upgrades #2598 and have not been implemented. Neither issue is complete.
    • Review HTML is exact-head and locally inspected at narrow/desktop widths; it is available in the task conversation, not as a public reviewer-accessible attachment. Preserve that sharing limitation.
  8. DoodleBears
    removed
    agent:activeOne or more coding-agent tasks currently claim this issue; see claim comments for task IDs
    on Oct 22, 2026
  9. DoodleBears
    added a commit that references this issue on Oct 22, 2026

    Merge pull request #2600 from BotHarness/codex/2599-lan-pairing

    9cd926c

  10. DoodleBears commented on Oct 22, 2026

    @DoodleBears
    DoodleBears
    on Oct 22, 2026
    ContributorAuthor

    Merged; native acceptance remains open

    • Task: codex/local/01a1639d-a211-7a30-a976-b6f6416ca9b1
    • The Human merged PR #2600 at 9cd926c0b3e34a376c0d7f715712f77bb6ce9770 on 2026-10-22 18:50:57 UTC.
    • All applicable source-head CI jobs passed, including all three full-test shards, Android native module tests, mobile verification and isolated Host smoke. Real-model scenarios were skipped. CI does not establish native LAN acceptance.
    • The Android testing center has been notified to test a recorded main/batch revision containing the merge and publish the pending redacted UI evidence. The existing queue request now records the merge. Acceptance/scheduling is not yet confirmed by the center.
    • Keep LAN T1: independent encrypted phone pairing, DM and revocation #2599 open for actual native QR pairing, offline live Host Feed, separate DM/reply, restart, revocation/disablement, CLI proof, UI evidence and first-slice Human feedback. iOS needs its own qualification. Spec: encrypted LAN phone access with automatic route recovery and pairing upgrades #2598 still includes the subsequent route recovery/discovery and legacy pairing upgrades; merge does not complete the parent objective.

  11. DoodleBears commented on Oct 22, 2026

    @DoodleBears
    DoodleBears
    on Oct 22, 2026
    ContributorAuthor

    Agent work claim — Release lint follow-up

    • Agent: Codex
    • Task: codex/local/01a1639d-a211-7a30-a976-b6f6416ca9b1
    • Issue scope: LAN T1: independent encrypted phone pairing, DM and revocation #2599 Android Release build blocker reported by the shared QA center: explicitly set includeSubdomains="false" on the four existing network-security domains and extend the source regression assertion.
    • Branch: codex/2599-lan-release-lint, based on current main bdcc996a1ae1fa6d83439647bda4e4643b2b21ae
    • State: active, source-only. No generated native edits, native build, device operations or heavy local checks; the center allocates verification separately.
  12. DoodleBears
    added
    agent:activeOne or more coding-agent tasks currently claim this issue; see claim comments for task IDs
    on Oct 22, 2026
  13. DoodleBears
    added a commit that references this issue on Oct 22, 2026

    Merge pull request #2605 from BotHarness/codex/2599-lan-release-lint

    843d84b

  14. DoodleBears commented on Oct 22, 2026

    @DoodleBears
    DoodleBears
    on Oct 22, 2026
    ContributorAuthor

    Android QA continuation on fixed main 843d84b1c304a6dfac4c405c1da70ebfe2512ed1:

    • Installation passed: designated POCO/Android16 arm64, audited Release installed with data-preserving replacement. Pullback SHA256 matches 9018D62C4CD5B3EDC79C8BE9DF0EFB49BF873F9B0C5AE85B0D7FC628EC928E44; signer matches the previous development package. Cold startup shows the native LAN chooser; existing settings/notification choice/reverse mappings remain unchanged. No uninstall or data clear.
    • Dedicated Host and real CLI LAN passed: default-off and missing-confirmation refusal; UI opt-in; full fingerprint comparison against the exact receipt/key; encrypted LAN Host Feed; revocation followed by device-revoked; ordinary HTTP paths return404; same-Profile restart preserves Host identity/opt-in/port; disable releases the port. Operator remains loopback-bound. No Host/LAN ADB reverse was used.
    • Native LAN remains untested: the Web Client lost its shell twice while preparing the QR. Diagnostics retain both failures; temporary recovery after reload is not a fix or causal attribution. A separate local page displayed an official CLI offer, but it expired without a pending phone key or admitted phone. Camera/native Feed/restart/revoke/WAN-unavailable matrix and iOS are not qualified.
    • Real DM blocked: canonical QA Session failure reports 429 GoUsageLimitError / QUOTA. Transport success does not qualify a model reply.
    • Cleanup complete: test CLI device revoked, LAN disabled, dedicated Host and temporary QR service stopped, owned ports closed, device lease released. The audited843d Release remains installed; phone data was preserved. Private evidence was retained locally; no raw QR, token or unredacted screenshot is published.

    Task: codex/local/01a16542-d757-7b72-83ab-e75facdf3e0c. This is partial Android acceptance, not completion of #2599.

  15. jishi7
    added 3 commits that reference this issue on Oct 24, 2026

    feat(devices): add opt-in encrypted LAN phone pairing

    d33c188

    fix(devices): bound LAN frames and preserve route recovery

    013bf12

    fix(mobile): declare exact LAN network security domains

    e7fcdc2
  16. DoodleBears
    added
    feature:connectTrusted Host connectivity, pairing, routes and revocation
    on Oct 24, 2026
  17. DoodleBears
    added this to the v2.0 milestone on Oct 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    agent:activeOne or more coding-agent tasks currently claim this issue; see claim comments for task IDsarea:fullstackEnd-to-end Host and Client implementationfeature:connectTrusted Host connectivity, pairing, routes and revocationready-for-agentFully specified, ready for an AFK agentscope:tracerHuman-testable implementation slice

    Type

    No type

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions