@byokit/pair 0.10.1 → 0.10.3

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## Unreleased
 
+## 0.10.3 (2026-10-17)
+
+- FIX: A pairing code that runs out while the computer's person has not answered now tells the device "That pairing code has run out" instead of "Your computer said no to this device". `confirm` gets a second argument, `{ signal }`, that aborts when the code runs out so the computer's prompt can close; a yes that comes later grants nothing.
+
+## 0.10.2 (2026-10-17)
+
+- FIX: a busy host that answers a ping late no longer has its live link dropped. `DeviceLink` now counts any pong up to the latest ping, a reply to one of its own waiting requests, or a frame on one of its own streams as hearing from the host, and counts silence from its first ping rather than from the connect, so a host that answers even that first ping late stays online. A host that goes silent is still dropped after two silent ping rounds (`2 × pingMs`, checked once a round). Host events and broadcasts alone still do not keep a link up: they show only that the host can talk, not that it hears the device, so only an answer to something the device sent proves the round trip.
+
 ## 0.10.1 (2026-10-16)
 
 - FIX: the browser pairing test opens the pairing page over the test browser's own private CDP pipe once Chromium answers there, not from the launch command line. On a slow first start Chromium's network service quits after 15 s unanswered and took the launch page's request with it, so the test silently sat out its 180 s deadline; the page now loads after Chromium restarts the service, and a page Chromium cannot open fails at once with Chromium's own navigation error.

package/README.md

@@ -498,7 +498,9 @@ late approval and expiry never create a grant. Malicious routing can still deny
 a code by forwarding a live attempt. Anyone who photographs the full code can race to pair with
 the real host, so **both screens still show the same two words and host approval defaults to No**.
 Only an explicit affirmative response after matching words should return `true` from `confirm`.
-The kit has no approval UI; exceptions and confirmation timeouts decline.
+The kit has no approval UI; exceptions decline. A confirmation still pending when the code runs out is refused as
+`expired` (the device says the code ran out), and `confirm`'s `signal` aborts then so the prompt can close; a yes
+that arrives later grants nothing.
 
 For relay discovery, display the separate six-character `RelayClient.code()` lookup alongside
 the full `host.shortCode()` pairing code. The device calls `findHost(relay, lookup)` from

package/dist/device.d.ts

@@ -150,6 +150,9 @@ export declare class DeviceLink {
      *  A tick that fires long after it was due means this device's own timers were frozen (an app in the background,
      *  a hidden tab), not that the host went quiet: no ping went out, so none came back. */
     private ping;
+    /** Whether `m` answers something this device sent: any pong so far (a busy host answers late), a reply to a waiting
+     *  request, or a frame on one of its streams. Only those prove the host hears this device; its events alone do not. */
+    private answers;
     private sendPending;
     private settle;
     private again;

package/dist/device.js

@@ -320,7 +320,7 @@ export class DeviceLink {
                     let active;
                     const l = await dial(url, keyPairFrom(unb64url(secret)), { key: unb64url(this.grant.host) }, { t: 'auth', session: this.session, ack: this.ack, fresh: this.fresh }, this.o, {
                         message: (m) => { if (this.conn === active) {
-                            if (m.t === 'pong' && m.n === this.pingId)
+                            if (this.answers(m))
                                 this.heard = Date.now();
                             this.message(m);
                         } },
@@ -396,8 +396,9 @@ export class DeviceLink {
             if (this.conn !== l)
                 return;
             const now = Date.now();
-            // Count the silence from now; a socket that is really dead still misses the pings that follow.
-            if (now - due > every / 2)
+            // Count the silence from now; a socket that is really dead still misses the pings that follow. Before the first
+            // ping nothing was asked, so a host that answers it late is not silent either.
+            if (now - due > every / 2 || !this.pingId)
                 this.heard = now;
             else if (now - this.heard > 2 * every) {
                 l.close();
@@ -412,6 +413,11 @@ export class DeviceLink {
         };
         later(every, tick);
     }
+    /** Whether `m` answers something this device sent: any pong so far (a busy host answers late), a reply to a waiting
+     *  request, or a frame on one of its streams. Only those prove the host hears this device; its events alone do not. */
+    answers(m) {
+        return (m.t === 'pong' && m.n <= this.pingId) || (m.t === 'res' && this.pending.has(m.id)) || !!this.streams?.has(m.s);
+    }
     sendPending(l, id, p) {
         try {
             l.send(p.msg);

package/dist/host.d.ts

@@ -64,8 +64,11 @@ export type HostOptions = {
     name: string;
     /** Answers a device's request. Runs on the host, with the host's credentials; the device only gets the answer. */
     handle: (req: LinkRequest, device: Grant) => unknown;
-    /** Asks the person at the host whether this device may join; nothing is stored until it says yes. */
-    confirm: (p: PairRequest) => boolean | Promise<boolean>;
+    /** Asks the person at the host whether this device may join; nothing is stored until it says yes. `signal` aborts
+     *  when the pairing code runs out, so the app can close its prompt; a yes that comes later grants nothing. */
+    confirm: (p: PairRequest, o: {
+        signal: AbortSignal;
+    }) => boolean | Promise<boolean>;
     /** Takes a stream a device opened with `link.stream(op, args)` (a terminal pane, a tunnelled connection, a call):
      *  set `onData` and `onEnd`, `write`, `end`. The stream opens before this handler runs; a thrown
      *  `PublicLinkError` ends it with a message for the device, while other errors go to `onError` and end it with

package/dist/host.js

@@ -434,14 +434,22 @@ export class Host {
             clearTimeout(timer);
             const req = { name: cleanName(name, 'Device'), role: p.role, words: hs.words, how,
                 ...(p.kind === undefined ? {} : { kind: p.kind }), ...(p.lifetime ? { lifetime: p.lifetime } : {}), ...(p.meta === undefined ? {} : { meta: p.meta }) };
+            const ask = new AbortController();
+            let runOut;
             const yes = await Promise.race([
-                Promise.resolve().then(() => this.opts.confirm(req)).catch(() => false),
-                new Promise((r) => later(this.pairMs, () => r(false))),
+                Promise.resolve().then(() => this.opts.confirm(req, { signal: ask.signal })).catch(() => false),
+                new Promise((r) => { runOut = later(this.pairMs, () => { ask.abort(); r('expired'); }); }),
             ]);
+            clearTimeout(runOut);
             // A device that said it kept a pending grant resumes from it after being killed while the person decided, so
             // its yes outlives the socket; any other gone device could never use the grant, so it gets none.
             if (gone && kept !== 1)
                 return;
+            if (yes === 'expired') {
+                if (!gone)
+                    refuse('expired');
+                return;
+            } // a yes that comes later is ignored: no grant
             if (!yes) {
                 if (!gone)
                     refuse('declined');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@byokit/pair",
-  "version": "0.10.1",
+  "version": "0.10.3",
   "description": "Scan a code to pair a phone or browser with the home computer over one encrypted link (Noise IK over WebSocket).",
   "license": "Apache-2.0",
   "type": "module",