npm - @sandprivacy/sandgate - Versions diffs - 0.1.2 → 0.1.5 - Mend

@sandprivacy/sandgate 0.1.2 → 0.1.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (4) hide show

package/dist/index.js +9 -2
package/dist/relay/pwa-page.js +299 -105
package/dist/relay/server.js +21 -4
package/package.json +1 -1

package/dist/index.js CHANGED Viewed

@@ -315,21 +315,28 @@ async function cmdPair(relayUrl) {
     qrcode.generate(pairLink, { small: true });
     console.log("\nWaiting for the phone to subscribe (2 min)…");
     const deadline = Date.now() + 120_000;
+    let seenAnnounced = false;
     while (Date.now() < deadline) {
         try {
             const res = await fetch(`${base}/api/pair-status?pairId=${encodeURIComponent(pairing.pairId)}`);
             const status = (await res.json());
             if (status.subscribed) {
-                console.log("Paired! The PWA now takes over approvals (Telegram becomes the fallback). Try: sandgate test-approval");
+                console.log("Paired, push notifications on. The PWA now takes over approvals (Telegram becomes the fallback). Try: sandgate test-approval");
                 return;
             }
+            if (status.seen && !seenAnnounced) {
+                seenAnnounced = true;
+                console.log('Phone connected. For notifications with the app closed, tap "Enable notifications" in the app (on iPhone: install to home screen first)…');
+            }
         }
         catch {
             // relay not reachable yet; keep trying
         }
         await new Promise((r) => setTimeout(r, 3000));
     }
-    console.log("No subscription yet — the pairing is saved anyway. Open the link on the phone, then check with: sandgate test-approval");
+    console.log(seenAnnounced
+        ? "Paired (no push yet — the app works while open; enable notifications in it when you can)."
+        : "No phone yet — the pairing is saved anyway. Open the link on the phone, then check with: sandgate test-approval");
 }
 async function cmdTestApproval() {
     const prompter = new Prompter();

package/dist/relay/pwa-page.js CHANGED Viewed

@@ -13,18 +13,28 @@ import { GLYPH_SVG_RECTS } from "./icons.js";
  * (copy → install → paste); Android installs in place via
  * beforeinstallprompt and shares storage with the browser.
  */
-export const PWA_MANIFEST = JSON.stringify({
-    name: "sandgate",
-    short_name: "sandgate",
-    start_url: "/",
-    display: "standalone",
-    background_color: "#141210",
-    theme_color: "#141210",
-    icons: [
-        { src: "/icon-192.png", sizes: "192x192", type: "image/png" },
-        { src: "/icon-512.png", sizes: "512x512", type: "image/png" },
-    ],
-});
+/**
+ * Two manifests on purpose. Chrome requires start_url for installability
+ * and shares storage with the installed app, so Android gets "/". iOS home
+ * -screen apps have isolated storage, but WITHOUT a manifest start_url iOS
+ * captures the CURRENT page URL — fragment included. The page keeps the
+ * pairing link in the address bar on iOS Safari, so Add to Home Screen
+ * produces an app that opens already paired. No copy-paste.
+ */
+export function pwaManifest(opts) {
+    return JSON.stringify({
+        name: "sandgate",
+        short_name: "sandgate",
+        ...(opts.includeStartUrl ? { start_url: "/" } : {}),
+        display: "standalone",
+        background_color: "#141210",
+        theme_color: "#141210",
+        icons: [
+            { src: "/icon-192.png", sizes: "192x192", type: "image/png" },
+            { src: "/icon-512.png", sizes: "512x512", type: "image/png" },
+        ],
+    });
+}
 export const PWA_SW = `
 self.addEventListener("install", function () { self.skipWaiting(); });
 self.addEventListener("activate", function (e) { e.waitUntil(self.clients.claim()); });
@@ -186,6 +196,16 @@ export const PWA_HTML = `<!doctype html>
     color: var(--ink); font: 14px ui-monospace, monospace;
   }
   .setup input:focus { outline: 2px solid var(--accent); outline-offset: -1px; }
+  .hist { margin-top: 30px; }
+  .hist h3 { font-size: 11px; letter-spacing: .08em; text-transform: uppercase; color: var(--soft); margin: 0 0 8px; }
+  .hrow { display: flex; gap: 10px; align-items: baseline; padding: 8px 0; border-bottom: 1px solid var(--line); font-size: 13.5px; }
+  .hrow .time { color: var(--soft); font-variant-numeric: tabular-nums; font-size: 12px; min-width: 74px; }
+  .hrow .t { flex: 1; color: #cfc6b2; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+  .hrow .d { font-weight: 650; font-size: 10.5px; letter-spacing: .05em; text-transform: uppercase; }
+  .d.approved { color: #7fbf9a; }
+  .d.denied { color: #d98a76; }
+  .d.expired { color: var(--soft); }
 </style>
 </head>
 <body>
@@ -197,7 +217,7 @@ export const PWA_HTML = `<!doctype html>
   </div>
   <div class="pill warn" id="status">starting</div>
 </header>
-<main><div id="banner"></div><div id="list"></div></main>
+<main><div id="banner"></div><div id="list"></div><div id="hist"></div></main>
 <script>
 (function () {
   var PAIR_KEY = "sandgate_pair";
@@ -237,15 +257,52 @@ export const PWA_HTML = `<!doctype html>
     var mm = String(text).match(/p=([A-Za-z0-9_-]{8,64})&s=([A-Za-z0-9_-]{8,})/);
     return mm ? { pairId: mm[1], secret: mm[2] } : null;
   }
-  var pair = parsePairing(location.hash);
-  if (pair) {
-    try { localStorage.setItem(PAIR_KEY, JSON.stringify(pair)); } catch (e) {}
-    history.replaceState(null, "", location.pathname);
-  } else {
-    try { pair = JSON.parse(localStorage.getItem(PAIR_KEY)); } catch (e) {}
+  // Several vaults can pair with this device (your laptop, your server…):
+  // pairings are a list, requests from all of them show together.
+  var PAIRS_KEY = "sandgate_pairs";
+  function loadPairs() {
+    try {
+      var list = JSON.parse(localStorage.getItem(PAIRS_KEY));
+      if (Array.isArray(list) && list.length) return list;
+    } catch (e) {}
+    // Migrate the single-pairing storage of earlier versions.
+    try {
+      var old = JSON.parse(localStorage.getItem(PAIR_KEY));
+      if (old && old.pairId) {
+        var migrated = [{ name: "Vault 1", pairId: old.pairId, secret: old.secret }];
+        localStorage.setItem(PAIRS_KEY, JSON.stringify(migrated));
+        localStorage.removeItem(PAIR_KEY);
+        return migrated;
+      }
+    } catch (e) {}
+    return [];
+  }
+  var pairs = loadPairs();
+  function savePairs() {
+    try { localStorage.setItem(PAIRS_KEY, JSON.stringify(pairs)); } catch (e) {}
+  }
+  function addPairing(parsed) {
+    for (var i = 0; i < pairs.length; i++) {
+      if (pairs[i].pairId === parsed.pairId) return false;
+    }
+    pairs.push({ name: "Vault " + (pairs.length + 1), pairId: parsed.pairId, secret: parsed.secret });
+    savePairs();
+    return true;
   }
-  if (!pair) {
+  var candidate = parsePairing(location.hash);
+  if (candidate) {
+    addPairing(candidate);
+    // iOS Safari (not installed): KEEP the pairing link in the address bar.
+    // With no start_url in the Apple manifest, Add to Home Screen captures
+    // this exact URL — fragment included — so the installed app opens
+    // already paired despite iOS's isolated storage.
+    if (!(isIOS && !standalone)) {
+      history.replaceState(null, "", location.pathname);
+    }
+  }
+  if (!pairs.length) {
     setStatus("not paired", "err");
     var setup = document.createElement("div");
     setup.className = "setup";
@@ -258,15 +315,13 @@ export const PWA_HTML = `<!doctype html>
     document.getElementById("pasteLink").addEventListener("input", function (e) {
       var parsed = parsePairing(e.target.value);
       if (parsed) {
-        try { localStorage.setItem(PAIR_KEY, JSON.stringify(parsed)); } catch (err) {}
+        addPairing(parsed);
         location.replace(location.pathname);
       }
     });
     return;
   }
-  var pairLink = location.origin + "/#p=" + pair.pairId + "&s=" + pair.secret;
   // --- install guidance (mobile browser, not yet installed) ---------------
   var deferredInstall = null;
   window.addEventListener("beforeinstallprompt", function (e) {
@@ -282,16 +337,10 @@ export const PWA_HTML = `<!doctype html>
     if (isIOS) {
       b.innerHTML =
         '<h2>Install sandgate to get push notifications</h2>' +
-        '<ol><li>Tap the button below to copy your pairing link</li>' +
-        '<li>Tap Share, then "Add to Home Screen"</li>' +
-        '<li>Open sandgate from your home screen and paste the link</li></ol>' +
-        '<button class="act" id="copyLink">Copy pairing link</button>';
+        '<ol><li>Tap Share (the square with an arrow)</li>' +
+        '<li>Choose "Add to Home Screen"</li>' +
+        '<li>Open sandgate from your home screen — your pairing carries over</li></ol>';
       bannerEl.textContent = ""; bannerEl.appendChild(b);
-      document.getElementById("copyLink").addEventListener("click", function () {
-        navigator.clipboard.writeText(pairLink).then(function () {
-          document.getElementById("copyLink").textContent = "Copied — now: Share → Add to Home Screen";
-        });
-      });
     } else {
       b.innerHTML =
         '<h2>Install sandgate to get push notifications</h2>' +
@@ -306,20 +355,26 @@ export const PWA_HTML = `<!doctype html>
   }
   renderBanner();
-  // --- crypto (mirror of pwacrypto.ts) ------------------------------------
-  var keyPromise = (async function () {
-    var raw = await crypto.subtle.importKey("raw", b64uToBytes(pair.secret), "HKDF", false, ["deriveKey"]);
-    return crypto.subtle.deriveKey(
-      { name: "HKDF", hash: "SHA-256", salt: enc.encode("sandgate-pwa-v1"), info: enc.encode("approval-channel") },
-      raw,
-      { name: "AES-GCM", length: 256 },
-      false,
-      ["encrypt", "decrypt"]
-    );
-  })();
+  // --- crypto (mirror of pwacrypto.ts), one derived key per vault ----------
+  var keyCache = {};
+  function keyFor(p) {
+    if (!keyCache[p.pairId]) {
+      keyCache[p.pairId] = (async function () {
+        var raw = await crypto.subtle.importKey("raw", b64uToBytes(p.secret), "HKDF", false, ["deriveKey"]);
+        return crypto.subtle.deriveKey(
+          { name: "HKDF", hash: "SHA-256", salt: enc.encode("sandgate-pwa-v1"), info: enc.encode("approval-channel") },
+          raw,
+          { name: "AES-GCM", length: 256 },
+          false,
+          ["encrypt", "decrypt"]
+        );
+      })();
+    }
+    return keyCache[p.pairId];
+  }
-  async function openSealed(sealed, aad) {
-    var key = await keyPromise;
+  async function openSealed(p, sealed, aad) {
+    var key = await keyFor(p);
     var pt = await crypto.subtle.decrypt(
       { name: "AES-GCM", iv: b64uToBytes(sealed.iv), additionalData: enc.encode(aad) },
       key,
@@ -327,8 +382,8 @@ export const PWA_HTML = `<!doctype html>
     );
     return JSON.parse(dec.decode(pt));
   }
-  async function sealPayload(payload, aad) {
-    var key = await keyPromise;
+  async function sealPayload(p, payload, aad) {
+    var key = await keyFor(p);
     var iv = crypto.getRandomValues(new Uint8Array(12));
     var ct = await crypto.subtle.encrypt(
       { name: "AES-GCM", iv: iv, additionalData: enc.encode(aad) },
@@ -338,60 +393,139 @@ export const PWA_HTML = `<!doctype html>
     return { iv: bytesToB64u(iv), ct: bytesToB64u(ct) };
   }
-  // --- push subscription ---------------------------------------------------
+  // --- presence + push subscription ---------------------------------------
+  // Announce this page to the relay immediately (push or not), so the
+  // "sandgate pair" command can report "phone connected" without waiting
+  // on notification permission.
+  pairs.forEach(function (p) {
+    fetch("/api/hello", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ pairId: p.pairId }),
+    }).catch(function () {});
+  });
   var pushOn = false;
-  (async function () {
-    try {
-      if ("serviceWorker" in navigator) {
-        var reg = await navigator.serviceWorker.register("/sw.js");
+  var swRegPromise = "serviceWorker" in navigator
+    ? navigator.serviceWorker.register("/sw.js").then(function (reg) {
         navigator.serviceWorker.addEventListener("message", function (e) {
           if (e.data === "refresh") fetchPending();
         });
-        if ("PushManager" in window && (standalone || !isIOS)) {
-          var perm = await Notification.requestPermission();
-          if (perm === "granted") {
-            var vapid = await (await fetch("/api/vapid")).json();
-            var sub = await reg.pushManager.subscribe({
-              userVisibleOnly: true,
-              applicationServerKey: b64uToBytes(vapid.publicKey),
-            });
-            await fetch("/api/subscribe", {
-              method: "POST",
-              headers: { "Content-Type": "application/json" },
-              body: JSON.stringify({ pairId: pair.pairId, subscription: sub }),
-            });
-            pushOn = true;
-            setStatus("push on");
-            return;
-          }
-        }
-      }
-    } catch (e) { /* fall through to live/polling status */ }
-    if (!pushOn) setStatus(sseOn ? "live" : "polling", "warn");
-  })();
+        return reg;
+      })
+    : Promise.resolve(null);
+  async function enablePush() {
+    var reg = await swRegPromise;
+    if (!reg || !("PushManager" in window)) return false;
+    // iOS only shows the permission prompt inside a user gesture, and only
+    // in the installed app — never in Safari tabs.
+    var perm = await Notification.requestPermission();
+    if (perm !== "granted") return false;
+    var vapid = await (await fetch("/api/vapid")).json();
+    var sub = await reg.pushManager.subscribe({
+      userVisibleOnly: true,
+      applicationServerKey: b64uToBytes(vapid.publicKey),
+    });
+    // One device subscription, registered for every paired vault.
+    await Promise.all(pairs.map(function (p) {
+      return fetch("/api/subscribe", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ pairId: p.pairId, subscription: sub }),
+      });
+    }));
+    pushOn = true;
+    setStatus("push on");
+    var btn = document.getElementById("pushBtn");
+    if (btn) btn.parentElement.remove();
+    return true;
+  }
+  function offerPush() {
+    if (!("Notification" in window) || !("PushManager" in window)) return;
+    if (isIOS && !standalone) return; // impossible in Safari tabs; banner handles install
+    if (Notification.permission === "granted") {
+      enablePush().catch(function () {});
+      return;
+    }
+    if (Notification.permission === "denied") return;
+    var b = document.createElement("div");
+    b.className = "banner";
+    b.innerHTML =
+      '<h2>One tap left: notifications</h2>' +
+      '<button class="act" id="pushBtn">Enable notifications</button>';
+    bannerEl.appendChild(b);
+    document.getElementById("pushBtn").addEventListener("click", function () {
+      enablePush().catch(function () {});
+    });
+  }
+  offerPush();
   // --- live updates: SSE with a slow safety poll ---------------------------
   var sseOn = false;
   function connectEvents() {
     if (!("EventSource" in window)) return;
-    var es = new EventSource("/api/events?pairId=" + encodeURIComponent(pair.pairId));
-    es.addEventListener("request", fetchPending);
-    es.addEventListener("decision", fetchPending);
-    es.onopen = function () {
-      sseOn = true;
-      if (!pushOn) setStatus("live");
-    };
-    es.onerror = function () {
-      sseOn = false;
-      if (!pushOn) setStatus("polling", "warn");
-      // EventSource reconnects on its own (retry: 3000).
-    };
+    pairs.forEach(function (p) {
+      var es = new EventSource("/api/events?pairId=" + encodeURIComponent(p.pairId));
+      es.addEventListener("request", fetchPending);
+      es.addEventListener("decision", fetchPending);
+      es.onopen = function () {
+        sseOn = true;
+        if (!pushOn) setStatus("live");
+      };
+      es.onerror = function () {
+        // EventSource reconnects on its own (retry: 3000).
+        if (!pushOn) setStatus("polling", "warn");
+      };
+    });
   }
   connectEvents();
   setInterval(function () { if (!document.hidden && !sseOn) fetchPending(); }, 8000);
   setInterval(function () { if (!document.hidden) fetchPending(); }, 45000); // safety net
   document.addEventListener("visibilitychange", function () { if (!document.hidden) fetchPending(); });
+  // --- local decision history (on-device only; synced history is a paid
+  // --- gateway feature, not the PWA's business) ----------------------------
+  var HIST_KEY = "sandgate_history";
+  var histEl = document.getElementById("hist");
+  function loadHist() {
+    try { return JSON.parse(localStorage.getItem(HIST_KEY)) || []; } catch (e) { return []; }
+  }
+  function recordHist(title, decision) {
+    var entries = loadHist();
+    entries.unshift({ t: title, d: decision, ts: Date.now() });
+    entries = entries.slice(0, 30);
+    try { localStorage.setItem(HIST_KEY, JSON.stringify(entries)); } catch (e) {}
+    renderHist();
+  }
+  function histTime(ts) {
+    var d = new Date(ts), now = new Date();
+    var hm = ("0" + d.getHours()).slice(-2) + ":" + ("0" + d.getMinutes()).slice(-2);
+    if (d.toDateString() === now.toDateString()) return hm;
+    return ("0" + d.getDate()).slice(-2) + "/" + ("0" + (d.getMonth() + 1)).slice(-2) + " " + hm;
+  }
+  function renderHist() {
+    var entries = loadHist();
+    histEl.textContent = "";
+    if (!entries.length) return;
+    var section = document.createElement("div");
+    section.className = "hist";
+    var h = document.createElement("h3");
+    h.textContent = "Recent — this device";
+    section.appendChild(h);
+    entries.forEach(function (entry) {
+      var row = document.createElement("div"); row.className = "hrow";
+      var time = document.createElement("span"); time.className = "time"; time.textContent = histTime(entry.ts);
+      var t = document.createElement("span"); t.className = "t"; t.textContent = entry.t;
+      var d = document.createElement("span"); d.className = "d " + entry.d; d.textContent = entry.d;
+      row.appendChild(time); row.appendChild(t); row.appendChild(d);
+      section.appendChild(row);
+    });
+    histEl.appendChild(section);
+  }
+  renderHist();
   // --- approval cards: stable DOM, in-place countdowns ---------------------
   var cards = {}; // requestId -> {el, leftEl, fillEl, barEl, rowEl, req, done}
   var emptyEl = null;
@@ -409,32 +543,35 @@ export const PWA_HTML = `<!doctype html>
   }
   async function fetchPending() {
-    var raw;
-    try {
-      raw = await (await fetch("/api/pending?pairId=" + encodeURIComponent(pair.pairId))).json();
-    } catch (e) { return; }
     var seen = {};
-    for (var i = 0; i < raw.length; i++) {
-      var id = raw[i].requestId;
-      seen[id] = true;
-      if (cards[id]) continue;
+    await Promise.all(pairs.map(async function (p) {
+      var raw;
       try {
-        var req = await openSealed(raw[i].payload, "req:" + id);
-        addCard(id, req);
-      } catch (e) { /* not ours / tampered */ }
-    }
+        raw = await (await fetch("/api/pending?pairId=" + encodeURIComponent(p.pairId))).json();
+      } catch (e) { return; }
+      for (var i = 0; i < raw.length; i++) {
+        var key = p.pairId + ":" + raw[i].requestId;
+        seen[key] = true;
+        if (cards[key]) continue;
+        try {
+          var req = await openSealed(p, raw[i].payload, "req:" + raw[i].requestId);
+          addCard(key, p, raw[i].requestId, req);
+        } catch (e) { /* not ours / tampered */ }
+      }
+    }));
     for (var cid in cards) {
       if (!seen[cid]) { cards[cid].el.remove(); delete cards[cid]; }
     }
     ensureEmpty(Object.keys(cards).length === 0);
   }
-  function addCard(id, req) {
+  function addCard(id, p, requestId, req) {
     var card = document.createElement("div");
     card.className = "card";
     var who = document.createElement("div"); who.className = "who";
-    who.textContent = "agent · approval request"; card.appendChild(who);
+    who.textContent = (pairs.length > 1 ? p.name + " · " : "") + "agent · approval request";
+    card.appendChild(who);
     var h = document.createElement("h2"); h.textContent = req.title; card.appendChild(h);
     if (req.body) { var p = document.createElement("p"); p.textContent = req.body; card.appendChild(p); }
@@ -452,7 +589,7 @@ export const PWA_HTML = `<!doctype html>
     ensureEmpty(false);
     listEl.appendChild(card);
-    cards[id] = { el: card, leftEl: left, fillEl: fill, barEl: bar, rowEl: row, req: req, done: false };
+    cards[id] = { el: card, leftEl: left, fillEl: fill, barEl: bar, rowEl: row, req: req, pair: p, requestId: requestId, done: false };
     tickOne(cards[id]);
   }
@@ -466,6 +603,7 @@ export const PWA_HTML = `<!doctype html>
         c.rowEl.remove();
         c.leftEl.textContent = "expired — denied";
         c.fillEl.style.width = "0%";
+        recordHist(histLabel(c), "expired");
       }
       return;
     }
@@ -487,20 +625,76 @@ export const PWA_HTML = `<!doctype html>
       if (!c || c.done) return;
       b.disabled = true;
       var payload = await sealPayload(
-        { requestId: id, approved: cls === "ok", ts: Date.now() },
-        "dec:" + id
+        c.pair,
+        { requestId: c.requestId, approved: cls === "ok", ts: Date.now() },
+        "dec:" + c.requestId
       );
       await fetch("/api/decision", {
         method: "POST",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ pairId: pair.pairId, requestId: id, payload: payload }),
+        body: JSON.stringify({ pairId: c.pair.pairId, requestId: c.requestId, payload: payload }),
       });
-      if (cards[id]) { cards[id].el.remove(); delete cards[id]; }
+      if (cards[id]) {
+        recordHist(histLabel(c), cls === "ok" ? "approved" : "denied");
+        cards[id].el.remove();
+        delete cards[id];
+      }
       ensureEmpty(Object.keys(cards).length === 0);
     };
     return b;
   }
+  function histLabel(c) {
+    return (pairs.length > 1 ? c.pair.name + ": " : "") + c.req.title;
+  }
+  // --- vault manager -------------------------------------------------------
+  var vaultsEl = document.createElement("div");
+  histEl.parentElement.appendChild(vaultsEl);
+  function renderVaults() {
+    vaultsEl.textContent = "";
+    var section = document.createElement("div");
+    section.className = "hist";
+    var h = document.createElement("h3");
+    h.textContent = "Vaults";
+    section.appendChild(h);
+    pairs.forEach(function (p, idx) {
+      var row = document.createElement("div"); row.className = "hrow";
+      var t = document.createElement("span"); t.className = "t"; t.textContent = p.name;
+      var x = document.createElement("span"); x.className = "d denied"; x.textContent = "remove";
+      x.style.cursor = "pointer";
+      x.onclick = function () {
+        if (!confirm("Remove " + p.name + " from this device?")) return;
+        pairs.splice(idx, 1);
+        savePairs();
+        location.reload();
+      };
+      row.appendChild(t); row.appendChild(x);
+      section.appendChild(row);
+    });
+    var addRow = document.createElement("div"); addRow.className = "hrow";
+    var add = document.createElement("span"); add.className = "d approved"; add.textContent = "+ add a vault";
+    add.style.cursor = "pointer";
+    add.onclick = function () {
+      if (document.getElementById("addPaste")) return;
+      var input = document.createElement("input");
+      input.id = "addPaste";
+      input.placeholder = "Paste a pairing link (sandgate pair)";
+      input.autocomplete = "off";
+      input.style.cssText = "width:100%;padding:10px 12px;margin-top:8px;background:var(--panel);border:1px solid var(--line);border-radius:8px;color:var(--ink);font:13px ui-monospace,monospace;";
+      input.addEventListener("input", function (e) {
+        var parsed = parsePairing(e.target.value);
+        if (parsed && addPairing(parsed)) location.reload();
+      });
+      section.appendChild(input);
+      input.focus();
+    };
+    addRow.appendChild(add);
+    section.appendChild(addRow);
+    vaultsEl.appendChild(section);
+  }
+  renderVaults();
   fetchPending();
 })();
 </script>

package/dist/relay/server.js CHANGED Viewed

@@ -2,7 +2,7 @@ import { createServer } from "node:http";
 import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import webpush from "web-push";
-import { PWA_HTML, PWA_SW, PWA_MANIFEST } from "./pwa-page.js";
+import { PWA_HTML, PWA_SW, pwaManifest } from "./pwa-page.js";
 import { ICON_SVG, iconPng } from "./icons.js";
 const MAX_BODY = 64 * 1024;
 const REQUEST_TTL_MS = 30 * 60 * 1000;
@@ -91,8 +91,12 @@ export async function startRelay(opts) {
                 return res.end(PWA_SW);
             }
             if (req.method === "GET" && url.pathname === "/manifest.webmanifest") {
-                res.writeHead(200, { "Content-Type": "application/manifest+json" });
-                return res.end(PWA_MANIFEST);
+                const isApple = /iPhone|iPad|iPod/.test(req.headers["user-agent"] ?? "");
+                res.writeHead(200, {
+                    "Content-Type": "application/manifest+json",
+                    Vary: "User-Agent",
+                });
+                return res.end(pwaManifest({ includeStartUrl: !isApple }));
             }
             if (req.method === "GET" && url.pathname === "/icon.svg") {
                 res.writeHead(200, { "Content-Type": "image/svg+xml", "Cache-Control": "max-age=86400" });
@@ -131,11 +135,24 @@ export async function startRelay(opts) {
                 persist();
                 return json(res, 200, { ok: true });
             }
+            // The page announces itself on load, push or not — this is what lets
+            // `sandgate pair` say "phone connected" even before notifications.
+            if (req.method === "POST" && url.pathname === "/api/hello") {
+                const body = await readBody(req);
+                if (!validId(body.pairId))
+                    return json(res, 400, { error: "bad pairId" });
+                getPairing(body.pairId).lastSeen = Date.now();
+                return json(res, 200, { ok: true });
+            }
             if (req.method === "GET" && url.pathname === "/api/pair-status") {
                 const pairId = url.searchParams.get("pairId") ?? "";
                 if (!validId(pairId))
                     return json(res, 400, { error: "bad pairId" });
-                return json(res, 200, { subscribed: !!getPairing(pairId).subscription });
+                const pairing = getPairing(pairId);
+                return json(res, 200, {
+                    subscribed: !!pairing.subscription,
+                    seen: !!pairing.lastSeen || !!pairing.subscription,
+                });
             }
             if (req.method === "POST" && url.pathname === "/api/request") {
                 const body = await readBody(req);

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@sandprivacy/sandgate",
-  "version": "0.1.2",
+  "version": "0.1.5",
   "description": "The human gateway for AI agents — approvals, 2FA codes and email verification, self-hosted. Your agent asks; you decide; secrets never touch the LLM.",
   "license": "AGPL-3.0-only",
   "type": "module",