@yefengr/pi-reach 0.0.1 → 0.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +1 -0
- package/README.md +6 -2
- package/package.json +1 -1
package/LICENSE
CHANGED
package/README.md
CHANGED
|
@@ -30,13 +30,15 @@ Open Pi in the project you want to control. When the session starts, the Extensi
|
|
|
30
30
|
/pi-reach pair
|
|
31
31
|
```
|
|
32
32
|
|
|
33
|
-
|
|
33
|
+
Open the public [Pi Reach PWA](https://pi-reach.yefengr.cn/app) on your phone or another browser, scan the QR code or type the 8-character pairing code, then pick an online Pi and send a prompt. Each computer only needs to be paired once, and pairings are local to the computer that creates them:
|
|
34
34
|
|
|
35
35
|
```text
|
|
36
36
|
/pi-reach devices
|
|
37
37
|
/pi-reach revoke <shortid>
|
|
38
38
|
```
|
|
39
39
|
|
|
40
|
+
The public PWA and the default Relay are run by the maintainer. For sensitive work, self-host both; see [Self-hosting](../README.en.md#self-hosting) and [Pairing and security](#pairing-and-security).
|
|
41
|
+
|
|
40
42
|
## Commands
|
|
41
43
|
|
|
42
44
|
| Command | Description |
|
|
@@ -58,7 +60,7 @@ The effective Relay URL resolves in this order:
|
|
|
58
60
|
|
|
59
61
|
1. `PI_REACH_RELAY`
|
|
60
62
|
2. `~/.pi/pi-reach/config.json`
|
|
61
|
-
3. `https://pi-reach-relay.yefengr.cn`
|
|
63
|
+
3. `https://pi-reach-relay.yefengr.cn` (the public Relay run by the maintainer)
|
|
62
64
|
|
|
63
65
|
Set and inspect it from Pi:
|
|
64
66
|
|
|
@@ -71,6 +73,8 @@ Only `http://` and `https://` are accepted at the command boundary; WebSocket co
|
|
|
71
73
|
|
|
72
74
|
## Pairing and security
|
|
73
75
|
|
|
76
|
+
- There is no application-layer end-to-end encryption, so the Relay is fully trusted. Its operator can read every conversation and, because Owner identity comes only from the Relay-injected `source_owner_id`, could impersonate a paired browser and send prompts that Pi executes on your computer.
|
|
77
|
+
- Report vulnerabilities privately through GitHub's [private vulnerability reporting](https://github.com/yefengr/pi-reach/security/advisories/new); see the [security policy](https://github.com/yefengr/pi-reach/blob/main/SECURITY.md).
|
|
74
78
|
- `device_id` is the Host Ed25519 public key in canonical Base64 form.
|
|
75
79
|
- Owner messages are trusted only through the Relay-injected `source_owner_id`.
|
|
76
80
|
- Pairing and revocation update the Relay endpoint ACL with `authorized_owner_ids`.
|