pairling 0.2.3 → 0.2.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pairling",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "Pair your iPhone with the AI coding agents running on your Mac. CLI and local runtime installer for the Pairling iOS app.",
   "keywords": [
     "pairling",
@@ -17,7 +17,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://pairling.dev"
+    "url": "https://github.com/mergimg0/pairling-helper"
   },
   "license": "UNLICENSED",
   "author": "Pairling (https://pairling.dev)",
@@ -40,7 +40,7 @@
     "access": "public"
   },
   "optionalDependencies": {
-    "@pairling/runtime-darwin-arm64": "0.2.3",
-    "@pairling/runtime-darwin-x64": "0.2.3"
+    "@pairling/runtime-darwin-arm64": "0.2.4",
+    "@pairling/runtime-darwin-x64": "0.2.4"
   }
 }

package/payload/mac/SOURCE_BRANCH

@@ -1 +1 @@
-feat/onestream-pairling-integration
+HEAD

package/payload/mac/SOURCE_REVISION

@@ -1 +1 @@
-6d905a33
+7f88c1b

package/payload/mac/VERSION

@@ -1 +1 @@
-0.2.3
+0.2.4

package/payload/mac/companiond/runtime_manifest.py

@@ -165,7 +165,7 @@ def build_manifest_payload(
             },
         },
         "endpoints": {
-            "public": ["/health", "/manifest", "/pair/start", "/pair/claim"],
+            "public": ["/health", "/manifest", "/pair/start", "/pair/claim", "/pair/psk-claim"],
             "authenticated": [
                 "/manifest",
                 "/sessions",

package/payload/mac/connectd/internal/gateway/proxy.go

@@ -235,7 +235,7 @@ func (h *Handler) allowedForAnyMethod(path string, header http.Header) bool {
 }
 
 func (h *Handler) requestBodyLimit(method, path string) int64 {
-	if method == http.MethodPost && path == "/pair/claim" && (h.mode == ExposureModePrePair || h.mode == ExposureModePairlingConnect) {
+	if method == http.MethodPost && isPrePairClaimPath(path) && (h.mode == ExposureModePrePair || h.mode == ExposureModePairlingConnect) {
 		if h.maxBodyBytes <= 0 || prePairMaxBodyBytes < h.maxBodyBytes {
 			return prePairMaxBodyBytes
 		}
@@ -259,7 +259,7 @@ func (h *Handler) requestBodyLimit(method, path string) int64 {
 }
 
 func (h *Handler) rateLimitPath(method, path string) bool {
-	return method == http.MethodPost && path == "/pair/claim" && (h.mode == ExposureModePrePair || h.mode == ExposureModePairlingConnect)
+	return method == http.MethodPost && isPrePairClaimPath(path) && (h.mode == ExposureModePrePair || h.mode == ExposureModePairlingConnect)
 }
 
 func prePairAllowed(method, path string) bool {
@@ -273,6 +273,10 @@ func prePairAllowed(method, path string) bool {
 	}
 }
 
+func isPrePairClaimPath(path string) bool {
+	return path == "/pair/claim" || path == "/pair/psk-claim"
+}
+
 func hasBearer(header http.Header) bool {
 	return strings.HasPrefix(header.Get("Authorization"), "Bearer ")
 }
@@ -491,6 +495,7 @@ var postPaths = map[string]bool{
 	"/open":                                  true,
 	"/orchestrations":                        true,
 	"/pair/claim":                            true,
+	"/pair/psk-claim":                        true,
 	"/pair/revoke":                           true,
 	"/pair/rotate-token":                     true,
 	"/pair/start":                            true,
@@ -524,11 +529,13 @@ var prePairGetPaths = map[string]bool{
 	"/health":   true,
 	"/healthz":  true,
 	"/readyz":   true,
+	"/routez":   true,
 	"/manifest": true,
 }
 
 var prePairPostPaths = map[string]bool{
-	"/pair/claim": true,
+	"/pair/claim":     true,
+	"/pair/psk-claim": true,
 }
 
 type MemoryRateLimiter struct {

package/payload/mac/connectd/internal/gateway/proxy_test.go

@@ -308,7 +308,7 @@ func TestNewHandlerAcceptsLoopbackUpstream(t *testing.T) {
 	}
 }
 
-func TestPrePairModeOnlyAllowsHealthManifestAndClaim(t *testing.T) {
+func TestPrePairModeOnlyAllowsHealthManifestRoutezAndClaims(t *testing.T) {
 	var forwarded []string
 	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		forwarded = append(forwarded, r.Method+" "+r.URL.Path)
@@ -324,8 +324,10 @@ func TestPrePairModeOnlyAllowsHealthManifestAndClaim(t *testing.T) {
 	}{
 		{http.MethodGet, "/health"},
 		{http.MethodGet, "/healthz"},
+		{http.MethodGet, "/routez"},
 		{http.MethodGet, "/manifest"},
 		{http.MethodPost, "/pair/claim"},
+		{http.MethodPost, "/pair/psk-claim"},
 	}
 	for _, tc := range allowed {
 		t.Run("allows "+tc.method+" "+tc.path, func(t *testing.T) {
@@ -407,7 +409,13 @@ func TestPairlingConnectModeRequiresBearerForPostPairEndpointsAndRejectsRemotePa
 		t.Fatalf("pre-pair claim status = %d body = %s", rec.Code, rec.Body.String())
 	}
 
-	if fmt.Sprintf("%+v", forwarded) != "[POST /send-text POST /pair/claim]" {
+	rec = httptest.NewRecorder()
+	handler.ServeHTTP(rec, httptest.NewRequest(http.MethodPost, "http://pairling-connect.local/pair/psk-claim", strings.NewReader(`{}`)))
+	if rec.Code != http.StatusOK {
+		t.Fatalf("pre-pair PSK claim status = %d body = %s", rec.Code, rec.Body.String())
+	}
+
+	if fmt.Sprintf("%+v", forwarded) != "[POST /send-text POST /pair/claim POST /pair/psk-claim]" {
 		t.Fatalf("forwarded = %+v", forwarded)
 	}
 }
@@ -442,44 +450,48 @@ func TestPairlingConnectModeMatchesEndpointContract(t *testing.T) {
 	}
 }
 
-func TestPrePairClaimIsRateLimitedAndBodyLimited(t *testing.T) {
-	var upstreamCalls int
-	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		upstreamCalls++
-		w.WriteHeader(http.StatusOK)
-	}))
-	defer upstream.Close()
-	limiter := NewMemoryRateLimiter(1, time.Minute)
-	handler := newTestHandlerWithMode(t, upstream.URL, defaultMaxBodyBytes, nil, ExposureModePrePair, limiter)
-
-	req := httptest.NewRequest(http.MethodPost, "http://pairling-connect.local/pair/claim", strings.NewReader(`{}`))
-	req.RemoteAddr = "100.64.0.8:12345"
-	rec := httptest.NewRecorder()
-	handler.ServeHTTP(rec, req)
-	if rec.Code != http.StatusOK {
-		t.Fatalf("first claim status = %d body = %s", rec.Code, rec.Body.String())
-	}
+func TestPrePairClaimsAreRateLimitedAndBodyLimited(t *testing.T) {
+	for _, path := range []string{"/pair/claim", "/pair/psk-claim"} {
+		t.Run(path, func(t *testing.T) {
+			var upstreamCalls int
+			upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				upstreamCalls++
+				w.WriteHeader(http.StatusOK)
+			}))
+			defer upstream.Close()
+			limiter := NewMemoryRateLimiter(1, time.Minute)
+			handler := newTestHandlerWithMode(t, upstream.URL, defaultMaxBodyBytes, nil, ExposureModePrePair, limiter)
+
+			req := httptest.NewRequest(http.MethodPost, "http://pairling-connect.local"+path, strings.NewReader(`{}`))
+			req.RemoteAddr = "100.64.0.8:12345"
+			rec := httptest.NewRecorder()
+			handler.ServeHTTP(rec, req)
+			if rec.Code != http.StatusOK {
+				t.Fatalf("first claim status = %d body = %s", rec.Code, rec.Body.String())
+			}
 
-	req = httptest.NewRequest(http.MethodPost, "http://pairling-connect.local/pair/claim", strings.NewReader(`{}`))
-	req.RemoteAddr = "100.64.0.8:12345"
-	rec = httptest.NewRecorder()
-	handler.ServeHTTP(rec, req)
-	if rec.Code != http.StatusTooManyRequests {
-		t.Fatalf("second claim status = %d body = %s", rec.Code, rec.Body.String())
-	}
+			req = httptest.NewRequest(http.MethodPost, "http://pairling-connect.local"+path, strings.NewReader(`{}`))
+			req.RemoteAddr = "100.64.0.8:12345"
+			rec = httptest.NewRecorder()
+			handler.ServeHTTP(rec, req)
+			if rec.Code != http.StatusTooManyRequests {
+				t.Fatalf("second claim status = %d body = %s", rec.Code, rec.Body.String())
+			}
 
-	largeBody := strings.NewReader(strings.Repeat("x", int(prePairMaxBodyBytes)+1))
-	req = httptest.NewRequest(http.MethodPost, "http://pairling-connect.local/pair/claim", largeBody)
-	req.RemoteAddr = "100.64.0.9:12345"
-	req.ContentLength = prePairMaxBodyBytes + 1
-	rec = httptest.NewRecorder()
-	handler.ServeHTTP(rec, req)
-	if rec.Code != http.StatusRequestEntityTooLarge {
-		t.Fatalf("large claim status = %d body = %s", rec.Code, rec.Body.String())
-	}
+			largeBody := strings.NewReader(strings.Repeat("x", int(prePairMaxBodyBytes)+1))
+			req = httptest.NewRequest(http.MethodPost, "http://pairling-connect.local"+path, largeBody)
+			req.RemoteAddr = "100.64.0.9:12345"
+			req.ContentLength = prePairMaxBodyBytes + 1
+			rec = httptest.NewRecorder()
+			handler.ServeHTTP(rec, req)
+			if rec.Code != http.StatusRequestEntityTooLarge {
+				t.Fatalf("large claim status = %d body = %s", rec.Code, rec.Body.String())
+			}
 
-	if upstreamCalls != 1 {
-		t.Fatalf("upstream calls = %d, want 1", upstreamCalls)
+			if upstreamCalls != 1 {
+				t.Fatalf("upstream calls = %d, want 1", upstreamCalls)
+			}
+		})
 	}
 }
 

package/payload/mac/install/install-runtime.sh

@@ -1151,6 +1151,7 @@ pair_runtime() {
   payload_file="$(mktemp)"
   if python3 - "$PAIRLING_RUNTIME_PORT" "$ttl" "$REPO_ROOT" >"$payload_file" <<'PY'
 import json
+import ipaddress
 import os
 import socket
 import subprocess
@@ -1219,6 +1220,37 @@ mac_name = str(((payload.get("pair_service") or {}).get("txt") or {}).get("mac_n
 # plaintext claim, so this field is the bridge that actually makes WS3 engage.
 mac_ake_pub = str(payload.get("mac_ake_pub") or (payload.get("claim") or {}).get("mac_ake_pub") or "")
 
+def is_ats_local_ipv4(value: str) -> bool:
+    try:
+        addr = ipaddress.ip_address(value)
+    except ValueError:
+        return False
+    if addr.version != 4 or addr.is_loopback or addr.is_link_local:
+        return False
+    return (
+        value.startswith("10.")
+        or value.startswith("192.168.")
+        or any(value.startswith(f"172.{i}.") for i in range(16, 32))
+    )
+
+def detected_lan_ip() -> str:
+    override = os.environ.get("PAIRLING_TEST_LAN_IP")
+    if override is not None:
+        value = override.strip()
+        return value if is_ats_local_ipv4(value) else ""
+    if os.environ.get("PAIRLING_DISABLE_LAN") == "1" or os.environ.get("PAIRLING_TEST_DISABLE_LAN") == "1":
+        return ""
+    try:
+        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+        try:
+            sock.connect(("8.8.8.8", 80))
+            ip = sock.getsockname()[0]
+        finally:
+            sock.close()
+        return ip if is_ats_local_ipv4(ip) else ""
+    except Exception:
+        return ""
+
 def detected_tailnet_ip() -> str:
     override = os.environ.get("PAIRLING_TEST_TAILSCALE_IP")
     if override is not None:
@@ -1241,6 +1273,16 @@ def default_pair_route(port_number: int) -> dict:
         value = os.environ.get(key)
         if value:
             return {"base_url": value, "source": "explicit_override", "status": "override"}
+    # First-pair QR claims go through iOS URLSession before any persisted
+    # Pairling Connect route exists. TestFlight builds allow local HTTP via
+    # NSAllowsLocalNetworking, but ATS blocks plain HTTP to 100.64/10 tailnet
+    # addresses. Prefer ATS-local LAN/Bonjour bases for bootstrap; remote
+    # tailnet routes are validated and promoted after the claim.
+    lan_ip = detected_lan_ip()
+    if lan_ip:
+        return {"base_url": f"http://{lan_ip}:{port_number}", "source": "lan", "status": "fallback", "kind": "lan"}
+    if os.environ.get("PAIRLING_DISABLE_BONJOUR") != "1" and os.environ.get("PAIRLING_TEST_DISABLE_BONJOUR") != "1":
+        return {"base_url": f"http://{socket.gethostname()}.local:{port_number}", "source": "bonjour", "status": "fallback", "kind": "bonjour"}
     connect_routes = advertised_pairling_connect_routes(fetch_connectd_status(timeout_seconds=0.7))
     if connect_routes:
         route = connect_routes[0]
@@ -1253,17 +1295,6 @@ def default_pair_route(port_number: int) -> dict:
     tailnet_ip = detected_tailnet_ip()
     if tailnet_ip:
         return {"base_url": f"http://{tailnet_ip}:{port_number}", "source": "standalone_tailnet", "status": "fallback"}
-    try:
-        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
-        try:
-            sock.connect(("8.8.8.8", 80))
-            ip = sock.getsockname()[0]
-        finally:
-            sock.close()
-        if ip and not ip.startswith(("127.", "169.254.")):
-            return {"base_url": f"http://{ip}:{port_number}", "source": "lan", "status": "fallback"}
-    except Exception:
-        pass
     return {"base_url": f"http://{socket.gethostname()}.local:{port_number}", "source": "bonjour", "status": "fallback"}
 
 pair_route = default_pair_route(int(port))

package/payload-manifest.json

@@ -1,18 +1,18 @@
 {
   "connectd": {
     "darwin-arm64": {
-      "sha256": "4a1ec43865486a1958c11a253f9955542354da58ab81dedfc1828727ff691050",
+      "sha256": "d77d7299f92da3a72d38981dd8f31f7b5935cd297a29b0231a2b79b8b37ef7f4",
       "team_id": "965AVD34A3"
     },
     "darwin-x64": {
-      "sha256": "05da872d33362df876e3fbca2d527f8acd33225917a774068bd3894fe2cbec84",
+      "sha256": "393c95dcd6128699614423d6414a21962d796a2baf8f249789d98d247668248e",
       "team_id": "965AVD34A3"
     }
   },
   "files": [
     {
       "path": "payload/mac/SOURCE_BRANCH",
-      "sha256": "b7cda4715ebe6bb92ec69b85df0e99668564bde99f03d6e04109b399538000b2"
+      "sha256": "34d6a94dacb895403529caac12a19aed745c6caca7a8d0f4ed631999044f76e8"
     },
     {
       "path": "payload/mac/SOURCE_DIRTY",
@@ -20,11 +20,11 @@
     },
     {
       "path": "payload/mac/SOURCE_REVISION",
-      "sha256": "fbe59df8b5637ce46090bf962b4c7be19a18596f93dc3963f228836be332e593"
+      "sha256": "e88a4e5e02bc17d75bd064d71908ab84750f877613ce56e1efb4be3d453a5a81"
     },
     {
       "path": "payload/mac/VERSION",
-      "sha256": "3ab94c04d24986f3af288ba1cda2c0bbddbc5a89dff097182805f54578e1ea75"
+      "sha256": "1725bfa6524c5265e7c171cf06568417d39b947fff49c242f03859479c82334b"
     },
     {
       "path": "payload/mac/companiond/app_attest_lan.py",
@@ -152,7 +152,7 @@
     },
     {
       "path": "payload/mac/companiond/runtime_manifest.py",
-      "sha256": "92c8c04def5e166a41926cf97de5dbb285a586f67e0f15eeef873c9f0337cb46"
+      "sha256": "72d61833a74e8171157784bee252f3e0f0bb15d77b740c2ffb2d82214d3b4933"
     },
     {
       "path": "payload/mac/companiond/runtime_paths.py",
@@ -212,11 +212,11 @@
     },
     {
       "path": "payload/mac/connectd/internal/gateway/proxy.go",
-      "sha256": "ce827d08826492193b025738322ae72e3d806604968f4e7d19e3d37c78dce313"
+      "sha256": "5da0f96ec8c364d90a7c07e4e968df6e9bd7bfeadf6cbe25d0bb743cdba3a91a"
     },
     {
       "path": "payload/mac/connectd/internal/gateway/proxy_test.go",
-      "sha256": "f45c74df51939f688bc3b3bb326d9fa103c2b39f81eb589b1e6be06731de9f3a"
+      "sha256": "1eefdfc331e97033d124cd627dd6e456f6de71e3a28b8d05aa6ede9faa3ff663"
     },
     {
       "path": "payload/mac/connectd/internal/runtime/config.go",
@@ -252,7 +252,7 @@
     },
     {
       "path": "payload/mac/install/install-runtime.sh",
-      "sha256": "45c0295ad0f6e610c0cbf10057fd341754967ffaa5eee403ad1aaa1ea1954a5c"
+      "sha256": "29e3e3ffd11d1dc5de96a29d5724752c4651168c5cf15b6ab8e5797e85e6a1ee"
     },
     {
       "path": "payload/mac/install/psk_dependency_check.py",
@@ -276,8 +276,8 @@
     }
   ],
   "package": "pairling",
-  "package_version": "0.2.3",
+  "package_version": "0.2.4",
   "schema_version": 1,
   "source_dirty": false,
-  "source_revision": "6d905a33"
+  "source_revision": "7f88c1b"
 }