@makerbi/remodex 1.5.0 → 1.5.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@makerbi/remodex",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "description": "Local bridge between Codex and the Remodex mobile app. Run `remodex up` to start.",
   "repository": {
     "type": "git",

package/src/secure-device-state.js

@@ -14,6 +14,7 @@ const DEFAULT_STORE_DIR = path.join(os.homedir(), ".remodex");
 const DEFAULT_STORE_FILE = path.join(DEFAULT_STORE_DIR, "device-state.json");
 const KEYCHAIN_SERVICE = "com.remodex.bridge.device-state";
 const KEYCHAIN_ACCOUNT = "default";
+const UUID_V4_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 let hasLoggedKeychainMismatch = false;
 
 // Loads the canonical bridge state or bootstraps a fresh one when no trusted state exists yet.
@@ -22,8 +23,11 @@ function loadOrCreateBridgeDeviceState() {
   const keychainRecord = readKeychainStateRecord();
 
   if (fileRecord.state) {
-    reconcileLegacyKeychainMirror(fileRecord.state, keychainRecord);
-    return fileRecord.state;
+    const canonicalState = recoverBridgeDeviceIdentity(fileRecord.state, {
+      fallbackState: keychainRecord.state,
+    });
+    reconcileLegacyKeychainMirror(canonicalState, keychainRecord);
+    return canonicalState;
   }
 
   if (fileRecord.error) {
@@ -31,8 +35,9 @@ function loadOrCreateBridgeDeviceState() {
       warnOnce(
         "[remodex] Recovering the canonical device-state.json from the legacy Keychain pairing mirror."
       );
-      writeBridgeDeviceState(keychainRecord.state);
-      return keychainRecord.state;
+      const recoveredState = recoverBridgeDeviceIdentity(keychainRecord.state);
+      writeBridgeDeviceState(recoveredState);
+      return recoveredState;
     }
     throw corruptedStateError("device-state.json", fileRecord.error);
   }
@@ -47,8 +52,9 @@ function loadOrCreateBridgeDeviceState() {
   }
 
   if (keychainRecord.state) {
-    writeBridgeDeviceState(keychainRecord.state);
-    return keychainRecord.state;
+    const recoveredState = recoverBridgeDeviceIdentity(keychainRecord.state);
+    writeBridgeDeviceState(recoveredState);
+    return recoveredState;
   }
 
   const nextState = createBridgeDeviceState();
@@ -382,10 +388,32 @@ function normalizeBridgeDeviceState(rawState) {
   };
 }
 
+function recoverBridgeDeviceIdentity(state, { fallbackState = null } = {}) {
+  if (isValidBridgeDeviceId(state?.macDeviceId)) {
+    return state;
+  }
+
+  if (fallbackState && isValidBridgeDeviceId(fallbackState.macDeviceId)) {
+    warnOnce("[remodex] Recovering an invalid saved bridge device identity from the legacy Keychain mirror.");
+    writeBridgeDeviceState(fallbackState);
+    return fallbackState;
+  }
+
+  warnOnce("[remodex] Rotating an invalid saved bridge device identity; scan the fresh QR to pair again.");
+  const nextState = createBridgeDeviceState();
+  nextState.lastSeenPhoneAppVersion = state?.lastSeenPhoneAppVersion || null;
+  writeBridgeDeviceState(nextState);
+  return nextState;
+}
+
 function bridgeStatesEqual(left, right) {
   return JSON.stringify(left) === JSON.stringify(right);
 }
 
+function isValidBridgeDeviceId(value) {
+  return UUID_V4_PATTERN.test(normalizeNonEmptyString(value));
+}
+
 function normalizeNonEmptyString(value) {
   if (typeof value !== "string") {
     return "";