@agentprojectcontext/apx 1.77.1 → 1.77.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentprojectcontext/apx",
-  "version": "1.77.1",
+  "version": "1.77.3",
   "description": "APX — unified CLI + daemon for the Agent Project Context (APC) standard.",
   "publishConfig": {
     "access": "public"

package/src/host/daemon/api/pairing.js

@@ -20,7 +20,10 @@
 import { randomUUID } from "node:crypto";
 import os from "node:os";
 
-const PAIRING_TTL_MS = 90_000;
+// 90s was not enough for the real sequence: pick up the phone, unlock it,
+// open the camera, scan, wait for the browser. Five minutes is still short
+// enough that a nonce left on screen is not a standing invitation.
+const PAIRING_TTL_MS = 5 * 60_000;
 
 // Reachable base URLs a device on the LAN can hit. When the daemon binds to
 // the wildcard (0.0.0.0/::) we enumerate non-internal IPv4s; when it binds to

package/src/interfaces/cli/commands/panel.js

@@ -8,9 +8,7 @@
 // the local network. Loopback stays the default, sharing is always explicit,
 // and the daemon's auth is untouched — the URL carries the token because
 // /admin/web-token is loopback-only by design, so a phone cannot fetch it.
-import fs from "node:fs";
 import { readConfig, writeConfig, effectivePort, effectiveHost } from "#core/config/index.js";
-import { TOKEN_PATH } from "#core/config/paths.js";
 import { detectLanAddresses, validateBindHost, isLoopback, isWildcard } from "#core/net/lan.js";
 
 export const PANEL_USAGE = {
@@ -19,21 +17,6 @@ export const PANEL_USAGE = {
   unshare: "apx panel unshare",
 };
 
-function readToken() {
-  try {
-    return fs.readFileSync(TOKEN_PATH, "utf8").trim();
-  } catch {
-    return "";
-  }
-}
-
-function panelUrl(host, port, token) {
-  // /admin/web-token refuses anything that is not loopback, so the panel on a
-  // phone can only authenticate from the fragment. The fragment never reaches
-  // the server or a proxy log — that is why it is a fragment and not a query.
-  return `http://${host}:${port}/` + (token ? `#token=${token}` : "");
-}
-
 export async function cmdPanelStatus() {
   const cfg = readConfig();
   const host = effectiveHost(cfg);
@@ -92,18 +75,27 @@ export async function cmdPanelShare(args) {
   cfg.host = host;
   writeConfig(cfg);
 
-  const token = readToken();
   const iface = candidates.find((c) => c.address === host)?.iface;
 
   console.log(`panel shared on ${host}:${port}${iface ? ` (${iface})` : ""}`);
   console.log("");
-  console.log("  Open this on your phone — the token is in the URL:");
-  console.log(`  ${panelUrl(host, port, token)}`);
+  console.log(`  URL for the other device:  http://${host}:${port}/`);
+  console.log("");
+  // Deliberately NOT the daemon's master token. Handing that to a phone gives
+  // it the same power as the CLI, cannot be revoked without rotating the token
+  // every local tool depends on, and leaves no record the device exists —
+  // which is the exact thing pairing was built to avoid (see token-store.js).
+  // It would not even last: the master token is regenerated on every restart.
+  console.log("  Authorise the device by PAIRING it, not by copying a token:");
+  console.log("    the panel → Settings → Devices → Pair device, then scan the QR.");
+  console.log("");
+  console.log("  Pairing gives that device its OWN token, which survives restarts,");
+  console.log("  shows up under Paired devices, and can be revoked on its own without");
+  console.log("  disturbing anything else.");
   console.log("");
   // Say plainly what changed. A LAN can be a café or a coworking space.
   console.log("  What this means: anyone on this network can now REACH the panel.");
-  console.log("  They still need the token above, which is not guessable — treat that");
-  console.log("  URL like a password, and run `apx panel unshare` when you are done.");
+  console.log("  They cannot use it without pairing. Run `apx panel unshare` when done.");
   if (candidates.length > 1) {
     const others = candidates.filter((c) => c.address !== host).map((c) => `${c.address} (${c.iface})`);
     console.log(`  Other addresses on this machine: ${others.join(", ")}`);