Repository navigation
fix(connect): refuse secret entry and retire the phone full client - #2546
Merged
Merged
Conversation
Remote messages now go through ChannelMessageBody. A RemoteMessageHost context gives the cards Host-scoped actions over the paired Host client, loads attachments with the device credential, and replaces the local open-channel guard with the remote chat's own. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RkE8f7sBeoRLEF79cccPAV
…to codex/2541-connect-secret-safety
Issue: #2541 Agent-Task: codex/local/01a15fc3-2dc9-7e13-a9c5-8ca7f162d141
DoodleBears
added
the
ci:full
|
Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configuration
⛔ Files ignored due to path filters: 19
📒 Files selected for processing: 71
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
Author
|
Historical preview — superseded by the current handoff. This image explains Track A head The image’s “Track B remains ADR-only / approval pending” statement is stale: Vain approved the complete Noise XK implementation and stacked delivery, now in Draft #2547. Full phone WebView removal remains in Track A. Native, real-network and Human QA remain unrun; neither PR is merged or deployed. The local Chinese HTML was refreshed to the current Track A head, links to #2547, and was checked at desktop/narrow widths. Interactive HTML remains local, so shared HTML delivery is not claimed. See #2547 for current code, seven verified GitHub-rendered screenshots and the two-axis review handoff. Historical static preview (review aid, not runtime evidence):
|
Issue: #2541 Agent-Task: codex/local/01a15fc3-2dc9-7e13-a9c5-8ca7f162d141
This was referenced Oct 21, 2026
Closed
Issue: #2541 Agent-Task: codex/local/01a15fc3-2dc9-7e13-a9c5-8ca7f162d141
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Vain. Refs #2541, #2542. The superseded #2533 adapter has been replaced by the canonical source-Host message implementation merged in #2538. Current main integration preserves that owner and the Track A secret refusal.
Track A claim · Track B original ADR claim · Audit · Proposed ADR-0244
Why the change
Connect currently exposes plaintext at Cloudflare, so this change prevents supported clients from sending known credential-entry methods, refuses them at the Host gateway, and removes the phone's full Host WebView as requested by Vain.
Special things to note
eb93f673b0c2; merged asf267b7022951. Stacked feat(connect): encrypt paired-device traffic with pinned Noise XK #2547 contains real Cloudflare/iOS password and pairing evidence. Physical-device, Android native, deployed account enrollment and full release qualification remain separate; merge does not authorize deployment. Historical checks below retain their original revisions.Change outline
Native DSH 0.2.1-rc.2: all eight marked methods refused on unary and mux at the real local Connect origin; roster unary/stream allowed; loopback credential set/unset allowed; removed full-client route returns 404. CLI private-input submission through stdin accepted a synthetic value and canonical status became configured. Phone-web daily routine edit/pause/resume/run/history/delete/create/preview passed. Remote card has zero password fields, disabled submit, and no page errors. Carrier mapping is synthetic local QA, not a live Cloudflare/Tailscale test. Model-created card used
deepseek-official/deepseek-flash(DeepSeek-V4.1-Flash).Earlier broad local testing observed a source-policy timeout, docs public-surface build failure, and a daylight assertion also reproduced on the baseline; it was stopped without a full-suite pass. Full CI 39659766544 passed for prior head
b842d3ce0750b5085106defef21c4d4eb0112f81. Evidence provenance and remaining journeys.Remote private input — cropped 1280 × 800 browser viewport
Before: editable password field. After: field absent, submission disabled, Host/Tailscale guidance. Real Web Client; synthetic hostname mapped to the actual isolated Connect origin.
Light — before / after
Dark — before / after
Phone settings — Expo Web 390 × 844, scale 3
The full-client entry is removed. These are phone-web captures, not native-device evidence.
Light — before / after
Dark — before / after
Advanced routine — Expo Web 390 × 844, scale 3
The full-client edit action is removed; the Host-client notice remains. These are phone-web captures, not native-device evidence.
Light — before / after
Dark — before / after
Native screenshots for chat/create/Activity entrances, private-input guidance, old full-client links and Browser/Computer are pending because the shared device queue is paused by the Human for combined acceptance. Review path: Settings → chat overflow/private input → Activity request → create menu → daily/advanced routines → old
/full-clientlink, in both themes.Agent trace: implementation
codex/local/01a15f6b-a5c1-7db2-b5b1-a33a1153fbc6; continuation, integration and evidencecodex/local/01a15fc3-2dc9-7e13-a9c5-8ca7f162d141.