@puddle-code/cli 0.2.0 → 0.2.2

package/CHANGELOG.md

@@ -7,33 +7,22 @@ Past releases: see docs/changelogs/.
 
 # Changelog
 
-## [0.2.0] — 2026-09-21
+## [0.2.2] — 2026-09-21
 
 ### Added
 
-- Add Settings → Remote access in local and SSH desktop cockpits for enablement, status, QR/link pairing, browser approval/revocation, disablement and host identity recovery; add authenticated cockpit controls in protocol 18.1.
-- Add self-hosted mobile access with Google/GitHub login, optional authenticator MFA, independently supervised host connectors and QR/link browser pairing.
-- Add a single-terminal phone view, native multiline prompt composer, visible terminal keys and read-only text/change review without rewriting desktop layouts.
-- Add remote administration and recovery commands, deployment images and isolated relay/browser acceptance suites.
-- Add lightweight built-process and loopback OpenSSH authentication suites, with separate manual browser and desktop acceptance.
+- Add a five-minute browser-approved account registration handoff with one-use private verifiers, origin checks and replay protection (daemon/cockpit protocol 20.0; encrypted remote protocol remains 2).
+- Add confirmed registration deletion to desktop Remote access settings, with browser revocation and local/SSH-only control (daemon/cockpit protocol 19.1; remote protocol remains 2).
 
 ### Changed
 
-- Open remote account registration to every verified Google/GitHub identity; remove the signup allowlist and registration switch while retaining account isolation and explicit host approval.
-
-### Removed
-
-- Remove the TLS contact email setting from the Caddy deployment and environment example.
-- Remove email/password login, verification/reset email delivery, SMTP configuration and Nodemailer; require Google and/or GitHub OAuth, retain verified-email admission and optional authenticator MFA, and retire legacy passwords/sessions. Bump remote protocol to 2 and daemon/cockpit protocol to 19.0 for the changed pairing contract.
+- Distil remote access into Puddle’s shared project cards and dialogues, with host-grouped projects, host disconnection in settings, a compact session rail, Files/Terminals views, custom-path browsing and direct terminal typing with touch keys.
+- Render pairing QR codes as sharp SVGs with rounded white surfaces and Puddle foreground ink, and match pairing links to the theme's text colour.
+- Start remote registration from desktop browser sign-in, with editable default origins and in-place connection settings instead of a second form or copied registration code.
+- Combine remote access and settings sync under Remote & Sync, preserving existing settings links.
+- Replace native disclosure triangles throughout the UI with Puddle chevrons.
 
 ### Fixed
 
-- Reject incomplete remote-origin input without throwing during registration form rendering.
-- Preserve browser login, terminal snapshots and refresh correlation across cockpit replacement and upstream recovery; retain desktop routes when the origin moves.
-
-### Security
-
-- Require exact browser approval at the host, pinned Noise XX transport, bounded forwarding and fresh browser participation in the existing host leases; keep remote protocol 2 independent of the protocol-18 host lease foundation.
-- Persist device revocation and offline remote disable, isolate application delivery from the relay origin, and deny unreviewed remote routes and executable previews.
-- Replace distributed master credentials with private host control, short-lived renewable connection leases and single-use browser invitations; migrate to protocol 18.0 and require existing tabs to run `puddle launch` once.
-- Isolate forwarded applications on a separate loopback origin, bind proxy grants to browser authorisation and revoke active streams when their authority expires.
+- Keep remote status polling quiet so controls, registration fields and button labels no longer blink during background refreshes.
+- Initialise remote service volumes with private directory permissions to prevent startup failures and ingress 502 responses.

package/dist/host-control.mjs

@@ -15887,19 +15887,25 @@ var remoteChunkSchema = external_exports.object({
 }).strict();
 
 // ../shared/src/api/cockpit-remote.ts
-var cockpitRemoteRequestSchema = external_exports.union([
+var connectorLocalRequestSchema = external_exports.union([
   remoteAdminRequestSchema,
+  external_exports.object({ t: external_exports.literal("delete_registration") }).strict()
+]);
+var cockpitRemoteRequestSchema = external_exports.union([
+  connectorLocalRequestSchema,
   external_exports.object({
     t: external_exports.literal("enable"),
     registration: external_exports.object({ service: remoteOriginSchema, app: remoteOriginSchema, code: remoteSecretSchema }).strict().optional()
   }).strict(),
   external_exports.object({ t: external_exports.literal("reset") }).strict()
 ]);
+var cockpitRegistrationCheckSchema = external_exports.object({ service: remoteOriginSchema, code: remoteSecretSchema }).strict();
 var cockpitRemoteStatusSchema = external_exports.object({
   availability: external_exports.enum(["ready", "not_installed", "upgrade_required"]),
   configured: external_exports.boolean(),
   enabled: external_exports.boolean(),
   connected: external_exports.boolean(),
+  canDeleteRegistration: external_exports.boolean().optional(),
   supervisor: external_exports.enum(["systemd", "launchd"]).nullable(),
   host: remoteIdSchema.optional(),
   peer: remotePeerSchema.optional(),
@@ -16012,6 +16018,14 @@ var remoteLoginStateSchema = external_exports.object({
 var registerHostRequestSchema = external_exports.object({ label: remoteLabelSchema }).strict();
 var registrationResponseSchema = external_exports.object({ host: remoteIdSchema, code: remoteSecretSchema, expires: external_exports.number() }).strict();
 var redeemRegistrationSchema = external_exports.object({ code: remoteSecretSchema }).strict();
+var desktopRegistrationSchema = external_exports.object({
+  challenge: remoteSecretSchema,
+  label: remoteLabelSchema,
+  service: remoteOriginSchema,
+  app: remoteOriginSchema,
+  expires: external_exports.number().int().positive()
+}).strict();
+var registrationStatusSchema = external_exports.object({ ready: external_exports.boolean() }).strict();
 var connectorRegistrationSchema = external_exports.object({
   host: remoteIdSchema,
   account: remoteAccountSchema,
@@ -16043,6 +16057,9 @@ import { createHash, randomBytes } from "node:crypto";
 import {
   chmodSync,
   closeSync,
+  constants,
+  fchmodSync,
+  fstatSync,
   fsyncSync,
   lstatSync,
   mkdirSync,
@@ -16053,7 +16070,7 @@ import {
   rmSync,
   writeFileSync
 } from "node:fs";
-import { dirname, join } from "node:path";
+import { dirname, join, resolve } from "node:path";
 var digest = (value) => createHash("sha256").update(value).digest("hex");
 function privatePath(path, directory = false) {
   const st = lstatSync(path);
@@ -16065,8 +16082,29 @@ function privateDirectory(path) {
   mkdirSync(path, { recursive: true, mode: 448 });
   privatePath(path, true);
 }
+function initialisePrivateHome(home) {
+  const path = resolve(home);
+  mkdirSync(path, { recursive: true, mode: 448 });
+  if (process.platform === "win32") {
+    privatePath(path, true);
+    return;
+  }
+  const fd = openSync(path, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+  try {
+    const st = fstatSync(fd);
+    if (!st.isDirectory() || st.uid !== process.getuid() || (st.mode & 18) !== 0) {
+      throw new Error(
+        `Puddle home must be owned by the current user and not writable by other users: ${path}`
+      );
+    }
+    if ((st.mode & 63) !== 0) fchmodSync(fd, 448);
+  } finally {
+    closeSync(fd);
+  }
+  privatePath(path, true);
+}
 function ipcPath(home, scope) {
-  privateDirectory(home);
+  initialisePrivateHome(home);
   const key = digest(`${realpathSync(home)}\0${scope}`).slice(0, 24);
   if (process.platform === "win32") return `\\\\.\\pipe\\puddle-${key}`;
   const dir = join("/tmp", `puddle-${process.getuid()}-${key}`);
@@ -16189,7 +16227,7 @@ async function inspectHostLocally(home) {
   }
   const socket = connect(path);
   try {
-    const grant = await new Promise((resolve, reject) => {
+    const grant = await new Promise((resolve2, reject) => {
       socket.setTimeout(5e3, () => socket.destroy(new Error("Host inspection timed out")));
       socket.once("error", reject);
       socket.once("close", () => reject(new Error("Host control closed")));
@@ -16199,7 +16237,7 @@ async function inspectHostLocally(home) {
           const message = controlResponseSchema.parse(value);
           if (message.t !== "authority" || !message.token)
             throw new Error("Host authority unavailable");
-          resolve(message);
+          resolve2(message);
         },
         () => socket.destroy(new Error("Invalid host control response"))
       );