pairling 0.2.0 → 0.2.2

package/README.md

@@ -69,4 +69,4 @@ notarized, and hash-pinned by this package's integrity manifest.
 
 - Product: https://pairling.dev
 - Get started: https://pairling.dev/start
-- Source mirror & publish pipeline: https://github.com/mergimg0/pairling-helper
+- Source mirror & publish pipeline: https://pairling.dev

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pairling",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Pair your iPhone with the AI coding agents running on your Mac. CLI and local runtime installer for the Pairling iOS app.",
   "keywords": [
     "pairling",
@@ -13,11 +13,11 @@
   ],
   "homepage": "https://pairling.dev",
   "bugs": {
-    "url": "https://github.com/mergimg0/pairling-helper/issues"
+    "url": "https://pairling.dev/support"
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/mergimg0/pairling-helper.git"
+    "url": "https://pairling.dev"
   },
   "license": "UNLICENSED",
   "author": "Pairling (https://pairling.dev)",
@@ -40,7 +40,7 @@
     "access": "public"
   },
   "optionalDependencies": {
-    "@pairling/runtime-darwin-arm64": "0.2.0",
-    "@pairling/runtime-darwin-x64": "0.2.0"
+    "@pairling/runtime-darwin-arm64": "0.2.2",
+    "@pairling/runtime-darwin-x64": "0.2.2"
   }
 }

package/payload/mac/SOURCE_BRANCH

@@ -1 +1 @@
-HEAD
+feat/onestream-pairling-integration

package/payload/mac/SOURCE_REVISION

@@ -1 +1 @@
-58288e6
+a1eaa1ac

package/payload/mac/VERSION

@@ -1 +1 @@
-2026.05.07.1
+0.2.2

package/payload/mac/companiond/app_attest_lan.py

@@ -0,0 +1,87 @@
+#!/usr/bin/env python3
+"""WS2: direct-LAN Apple App Attest verification for /pair/claim.
+
+Reuses the canonical AppleAppAttestValidator (relay/app_attest_validator.py) so
+the intricate attestation crypto (CBOR parse, X.509 chain to Apple's App Attest
+root, nonce binding, counter) lives in exactly one place.
+
+Purpose: turning this gate on stops the trivial "published 30-line PoC" LAN
+race — a non-genuine client cannot produce a valid Apple attestation. The
+clientData canonical binds the attestation to (pair_id, attest_challenge), so a
+MITM cannot swap the challenge for one it pre-attested against (Blocker #6).
+
+Fail-closed: when required but the validator/root cert is unavailable, callers
+treat a verification error as a rejected claim.
+"""
+
+from __future__ import annotations
+
+import os
+import sys
+from pathlib import Path
+
+LAN_CANONICAL_PREFIX = "pair.lan.claim.v1"
+
+
+def direct_attest_required() -> bool:
+    return os.environ.get("PAIRLING_DIRECT_ATTEST_REQUIRED", "").strip().lower() in {"1", "true", "yes", "on"}
+
+
+def canonical(pair_id: str, attest_challenge: str) -> str:
+    """The frozen clientData string the iOS app hashes and the Mac re-derives.
+    Binds the attestation to this specific pairing invitation."""
+    return f"{LAN_CANONICAL_PREFIX}\n{pair_id}\n{attest_challenge}"
+
+
+def _team_id() -> str:
+    return os.environ.get("PAIRLING_APP_ATTEST_TEAM_ID", "965AVD34A3").strip()
+
+
+def _bundle_id() -> str:
+    return os.environ.get("PAIRLING_APP_ATTEST_BUNDLE_ID", "dev.pairling.ios").strip()
+
+
+_validator = None
+_validator_error: Exception | None = None
+
+
+def _load_validator():
+    global _validator, _validator_error
+    if _validator is not None:
+        return _validator
+    if _validator_error is not None:
+        return None
+    try:
+        try:
+            from app_attest_validator import AppleAppAttestValidator  # staged copy
+        except Exception:
+            relay_dir = Path(__file__).resolve().parents[2] / "relay"
+            if str(relay_dir) not in sys.path:
+                sys.path.insert(0, str(relay_dir))
+            from app_attest_validator import AppleAppAttestValidator
+        root_path = os.environ.get("PAIRLING_APP_ATTEST_ROOT_CERT")
+        if not root_path:
+            local = Path(__file__).resolve().parent / "apple-app-attest-root-ca.pem"
+            root_path = str(local) if local.exists() else None
+        _validator = AppleAppAttestValidator(root_cert_path=root_path)
+        return _validator
+    except Exception as exc:  # missing cryptography, missing root cert, etc.
+        _validator_error = exc
+        return None
+
+
+def verify_attestation(*, attestation: dict, pair_id: str, attest_challenge: str, key_id: str, environment: str) -> bool:
+    """Raise on any failure; return True only on a fully-valid Apple attestation
+    bound to this invitation. Fail-closed when the validator is unavailable."""
+    validator = _load_validator()
+    if validator is None:
+        raise RuntimeError(f"app attest validator unavailable: {_validator_error}")
+    validator.validate_attestation(
+        attestation=attestation,
+        challenge=canonical(pair_id, attest_challenge),
+        key_id=key_id,
+        bundle_id=_bundle_id(),
+        team_id=_team_id(),
+        environment=(environment or "production"),
+    )
+    return True

package/payload/mac/companiond/codex_approval.py

@@ -0,0 +1,69 @@
+from __future__ import annotations
+
+import re
+from typing import Any
+
+
+_APPROVAL_HEADER = re.compile(r"would you like to run|allow .* to run|run the following command", re.I)
+_CMD_LINE = re.compile(r"^\s*\$\s+(?P<cmd>.+?)\s*$")
+_RAW_YES = re.compile(r"(?:^|\s|[>›])1[.)]\s*Yes(?:,\s*)?\s*proceed\b|Yes,\s*proceed", re.I)
+_PATCH_HINT = re.compile(r"\b(apply_patch|patch|modify|edit|write)\b", re.I)
+
+
+def classify_codex_approval(pending: dict[str, Any] | None, rows: list[str], *, screen_key: str = "") -> dict[str, Any] | None:
+    if pending and pending.get("state") not in {None, "awaiting_selection"}:
+        return None
+    rows = [str(row or "") for row in rows]
+    choices = (pending or {}).get("choices") or []
+    if not isinstance(choices, list):
+        choices = []
+    has_yes = any(_choice_is_yes_proceed(choice) for choice in choices if isinstance(choice, dict))
+    raw_yes = any(_RAW_YES.search(row) for row in rows)
+    if not has_yes:
+        has_yes = raw_yes
+    if not has_yes:
+        return None
+
+    header = any(_APPROVAL_HEADER.search(row) for row in rows)
+    command = _extract_command(rows)
+    patch_hint = any(_PATCH_HINT.search(row) for row in rows)
+    if not header and not command and not patch_hint:
+        return None
+
+    summary = command or _approval_summary(rows, pending) or "codex approval"
+    return {
+        "command": command,
+        "summary": summary[:300],
+        "kind": "codex_exec_approval",
+        "choices": choices,
+        "dialog_key": screen_key,
+    }
+
+
+def _choice_is_yes_proceed(choice: dict[str, Any]) -> bool:
+    label = str(choice.get("label") or "").strip().lower()
+    choice_id = str(choice.get("id") or "").strip()
+    return label.startswith("yes") and ("proceed" in label or choice_id == "1")
+
+
+def _extract_command(rows: list[str]) -> str | None:
+    for row in rows:
+        match = _CMD_LINE.match(row or "")
+        if match:
+            command = match.group("cmd").strip()
+            if command:
+                return command[:300]
+    return None
+
+
+def _approval_summary(rows: list[str], pending: dict[str, Any] | None) -> str | None:
+    prompt = str((pending or {}).get("prompt") or "").strip()
+    if prompt:
+        return prompt[:300]
+    for row in rows:
+        text = str(row or "").strip()
+        if not text:
+            continue
+        if _APPROVAL_HEADER.search(text) or _PATCH_HINT.search(text):
+            return text[:300]
+    return None

package/payload/mac/companiond/pairling_devices.py

@@ -171,6 +171,10 @@ class DeviceRegistry:
             "device_display_name": "ALTER TABLE devices ADD COLUMN device_display_name TEXT",
             "superseded_by_device_id": "ALTER TABLE devices ADD COLUMN superseded_by_device_id TEXT",
             "proof_secret": "ALTER TABLE devices ADD COLUMN proof_secret TEXT",
+            # WS4: base64 X9.63 (uncompressed P-256 point) of the device's
+            # Secure-Enclave public key, registered at first pair. Used to
+            # verify zero-interaction re-pair challenge signatures.
+            "se_public_key_der": "ALTER TABLE devices ADD COLUMN se_public_key_der TEXT",
         }
         for column, statement in additive_columns.items():
             if column not in existing:
@@ -422,6 +426,37 @@ class DeviceRegistry:
             )
             return token
 
+    def register_se_pubkey(self, device_id: str, se_public_key_der: str) -> bool:
+        """WS4: store the device's Secure-Enclave public key (base64 X9.63)."""
+        if not se_public_key_der:
+            return False
+        with self.connect() as conn:
+            cur = conn.execute(
+                "UPDATE devices SET se_public_key_der = ? WHERE device_id = ?",
+                (se_public_key_der, device_id),
+            )
+            ok = cur.rowcount > 0
+            self.record_audit(
+                "device.register_se_pubkey",
+                device_id=device_id,
+                outcome="ok" if ok else "not_found",
+                conn=conn,
+            )
+            return ok
+
+    def get_se_pubkey(self, device_id: str) -> str | None:
+        """The registered SE public key for an ACTIVE device. Revoked devices
+        return None, so revocation also blocks zero-interaction re-pair."""
+        with self.connect() as conn:
+            row = conn.execute(
+                "SELECT se_public_key_der FROM devices WHERE device_id = ? AND revoked_at IS NULL",
+                (device_id,),
+            ).fetchone()
+        if row is None:
+            return None
+        value = row["se_public_key_der"]
+        return value if value else None
+
     def record_audit(
         self,
         event: str,