pairling 0.2.10 → 0.2.12

package/README.md

@@ -27,11 +27,9 @@ Then open Pairling on your iPhone and scan the QR code that `setup` prints.
 - Stages the runtime under `~/Library/Application Support/Pairling/runtime/`
   (versioned releases, atomic `current` symlink flip, `pairling rollback`).
 - Installs user-domain LaunchAgents (`dev.pairling.companiond`,
-  `dev.pairling.connectd`). No root. The optional power guardian is a separate,
-  explicit, sudo-gated step.
-- Verifies the payload against the package's integrity manifest and verifies
-  the Developer ID signature of the bundled `pairling-connectd` binary before
-  staging — fail closed.
+  `dev.pairling.connectd`, `dev.pairling.ptybroker`). No root helper is installed.
+- Verifies the package payload manifest and the Developer ID signature of the
+  bundled `pairling-connectd` binary before staging — fail closed.
 
 ## Commands
 
@@ -54,8 +52,9 @@ pairling uninstall [--yes]
 - **Readable payload:** the runtime is Python/bash source plus one signed Go
   binary (`pairling-connectd`); inspect it with `npm pack pairling --dry-run`.
 - **Integrity chain:** CI records SHA-256 of every payload file in
-  `payload-manifest.json`; `pairling setup` re-verifies before staging;
-  `pairling doctor` re-verifies the staged runtime and the binary signature.
+  `payload-manifest.json`; `pairling setup` verifies that manifest and the
+  binary signature before staging; `pairling doctor` re-verifies the staged
+  runtime and the binary signature.
 - **Local-first:** the daemon serves your devices with per-device scoped bearer
   tokens. npm being down can never affect an installed Mac.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pairling",
-  "version": "0.2.10",
+  "version": "0.2.12",
   "description": "Pair your iPhone with the AI coding agents running on your Mac. CLI and local runtime installer for the Pairling iOS app.",
   "keywords": [
     "pairling",
@@ -40,7 +40,7 @@
     "url": "https://github.com/mergimg0/pairling-helper"
   },
   "optionalDependencies": {
-    "@pairling/runtime-darwin-arm64": "0.2.10",
-    "@pairling/runtime-darwin-x64": "0.2.10"
+    "@pairling/runtime-darwin-arm64": "0.2.12",
+    "@pairling/runtime-darwin-x64": "0.2.12"
   }
 }

package/payload/mac/SOURCE_REVISION

@@ -1 +1 @@
-0d3be68
+71ea638dd7f9fe82a505448f437113380eec83aa

package/payload/mac/VERSION

@@ -1 +1 @@
-0.2.10
+0.2.12

package/payload/mac/companiond/pairling_pairing.py

@@ -358,6 +358,7 @@ class PairingStore:
         relay_device_id: str | None = None,
         relay_required: bool = False,
         relay_claim_verifier=None,
+        require_direct_attest: bool = False,
     ) -> PairClaim:
         with self._claim_lock:
             record, path, now = self._precheck_claim(pair_id)
@@ -384,6 +385,7 @@ class PairingStore:
                 attested_claim_ticket=attested_claim_ticket,
                 relay_device_id=relay_device_id, relay_required=relay_required,
                 relay_claim_verifier=relay_claim_verifier,
+                require_direct_attest=require_direct_attest,
             )
 
     def _precheck_claim(self, pair_id: str) -> tuple[dict, Path, float]:
@@ -460,6 +462,7 @@ class PairingStore:
         relay_required: bool,
         relay_claim_verifier,
         funnel_origin: bool = False,
+        require_direct_attest: bool = False,
         attestation_verified: bool | None = None,
     ) -> PairClaim:
         """Post-authentication finalize, shared by legacy and PSK claims. The
@@ -475,7 +478,8 @@ class PairingStore:
             attestation_verified = self._verify_claim_attestation(
                 pair_id=pair_id, record=record, attest_object=attest_object,
                 attest_key_id=attest_key_id, attest_environment=attest_environment,
-                require=funnel_origin, force_production=funnel_origin,
+                require=funnel_origin or require_direct_attest,
+                force_production=funnel_origin or require_direct_attest,
             )
         relay_status = "none"
         verified_relay_device_id = relay_device_id
@@ -569,6 +573,7 @@ class PairingStore:
         relay_required: bool = False,
         relay_claim_verifier=None,
         funnel_origin: bool = False,
+        require_direct_attest: bool = False,
     ) -> tuple[PairClaim, bytes, bytes, bytes]:
         """WS3 PSK-authenticated ECDH claim. The secret is NEVER received; the
         caller proves knowledge of it by completing the authenticated key
@@ -584,14 +589,14 @@ class PairingStore:
             raise PairingError("psk_bad_key", 400, "invalid psk material")
         with self._claim_lock:
             attestation_verified = None
-            if funnel_origin:
-                # Funnel claims prove a genuine device BEFORE the attempt counter
+            if funnel_origin or require_direct_attest:
+                # Public network claims prove a genuine device BEFORE the attempt counter
                 # and the ECDH derive, so an un-attested spray cannot lock out a
-                # live invitation or force crypto work. Fail-closed regardless of
+                # live invitation or force crypto work. Fail closed regardless of
                 # the env default, with the environment pinned to production.
-                funnel_record, _ = self._load_record(pair_id)
+                hard_attest_record, _ = self._load_record(pair_id)
                 attestation_verified = self._verify_claim_attestation(
-                    pair_id=pair_id, record=funnel_record, attest_object=attest_object,
+                    pair_id=pair_id, record=hard_attest_record, attest_object=attest_object,
                     attest_key_id=attest_key_id, attest_environment=attest_environment,
                     require=True, force_production=True,
                 )
@@ -624,7 +629,8 @@ class PairingStore:
                 attested_claim_ticket=attested_claim_ticket,
                 relay_device_id=relay_device_id, relay_required=relay_required,
                 relay_claim_verifier=relay_claim_verifier,
-                funnel_origin=funnel_origin, attestation_verified=attestation_verified,
+                funnel_origin=funnel_origin, require_direct_attest=require_direct_attest,
+                attestation_verified=attestation_verified,
             )
             aad = _psk.transcript(pair_id, a_pub, b_pub)
             mac_confirm = _psk.confirm_tag(k_confirm, _psk.CONFIRM_MAC, pair_id, a_pub, b_pub)