pairling 0.2.7 → 0.2.9

package/README.md

@@ -27,11 +27,11 @@ Then open Pairling on your iPhone and scan the QR code that `setup` prints.
 - Stages the runtime under `~/Library/Application Support/Pairling/runtime/`
   (versioned releases, atomic `current` symlink flip, `pairling rollback`).
 - Installs user-domain LaunchAgents (`dev.pairling.companiond`,
-  `dev.pairling.connectd`). No root. The optional power guardian and the
-  optional silent-join mint broker are separate, explicit, sudo-gated steps.
+  `dev.pairling.connectd`). No root. The optional power guardian is a separate,
+  explicit, sudo-gated step.
 - Verifies the payload against the package's integrity manifest and verifies
-  the Developer ID signature of the bundled `pairling-connectd` and
-  `pairling-tailnet-mintd` binaries before staging — fail closed.
+  the Developer ID signature of the bundled `pairling-connectd` binary before
+  staging — fail closed.
 
 ## Commands
 
@@ -51,9 +51,8 @@ pairling uninstall [--yes]
   appears in a published manifest.
 - **Provenance:** releases are published via npm Trusted Publishing (OIDC) with
   provenance attestations. Verify with `npm audit signatures`.
-- **Readable payload:** the runtime is Python/bash source plus two signed Go
-  binaries (`pairling-connectd` and the `pairling-tailnet-mintd` broker);
-  inspect it with `npm pack pairling --dry-run`.
+- **Readable payload:** the runtime is Python/bash source plus one signed Go
+  binary (`pairling-connectd`); inspect it with `npm pack pairling --dry-run`.
 - **Integrity chain:** CI records SHA-256 of every payload file in
   `payload-manifest.json`; `pairling setup` re-verifies before staging;
   `pairling doctor` re-verifies the staged runtime and the binary signature.
@@ -62,10 +61,10 @@ pairling uninstall [--yes]
 
 ## Platform packages
 
-The compiled runtime binaries (`pairling-connectd` and the optional
-`pairling-tailnet-mintd` silent-join broker) ship as platform-filtered optional
-dependencies: `@pairling/runtime-darwin-arm64` and `@pairling/runtime-darwin-x64`
-— signed, notarized, and hash-pinned by each package's integrity manifest.
+The compiled runtime binary (`pairling-connectd`) ships via platform-filtered
+optional dependencies: `@pairling/runtime-darwin-arm64` and
+`@pairling/runtime-darwin-x64` — signed, notarized, and hash-pinned by each
+package's integrity manifest.
 
 ## Links
 

package/bin/pairling.mjs

@@ -92,7 +92,6 @@ function detectRosetta() {
 function shimEnv() {
   const runtimeDir = runtimePackageDir();
   const connectd = runtimeDir ? join(runtimeDir, "bin", "pairling-connectd") : null;
-  const mintd = runtimeDir ? join(runtimeDir, "bin", "pairling-tailnet-mintd") : null;
   const vendoredPython = runtimeDir ? join(runtimeDir, "python", "bin", "python3") : null;
   return {
     packageRoot,
@@ -101,7 +100,6 @@ function shimEnv() {
     payloadRoot,
     runtimePackageDir: runtimeDir,
     connectdPath: connectd && existsSync(connectd) ? connectd : null,
-    mintdPath: mintd && existsSync(mintd) ? mintd : null,
     vendoredPython: vendoredPython && existsSync(vendoredPython) ? vendoredPython : null,
     stagedCli: stagedCliPath(),
     stagedRuntimeVersion: stagedRuntimeVersion(),
@@ -189,7 +187,7 @@ function main() {
 
   if (existsSync(payloadCli)) {
     const env = shimEnv();
-    if (!env.runtimePackageDir || !env.connectdPath || !env.mintdPath) {
+    if (!env.runtimePackageDir || !env.connectdPath) {
       process.stderr.write(
         [
           "pairling: the platform runtime package is missing or incomplete.",
@@ -208,7 +206,6 @@ function main() {
     delegate(payloadCli, args, {
       PAIRLING_REPO_ROOT: join(payloadRoot, "."),
       PAIRLING_CONNECTD_PREBUILT: env.connectdPath,
-      PAIRLING_MINTD_PREBUILT: env.mintdPath,
       PAIRLING_DAEMON_PYTHON: env.vendoredPython,
     });
     return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pairling",
-  "version": "0.2.7",
+  "version": "0.2.9",
   "description": "Pair your iPhone with the AI coding agents running on your Mac. CLI and local runtime installer for the Pairling iOS app.",
   "keywords": [
     "pairling",
@@ -40,7 +40,7 @@
     "url": "https://github.com/mergimg0/pairling-helper"
   },
   "optionalDependencies": {
-    "@pairling/runtime-darwin-arm64": "0.2.7",
-    "@pairling/runtime-darwin-x64": "0.2.7"
+    "@pairling/runtime-darwin-arm64": "0.2.9",
+    "@pairling/runtime-darwin-x64": "0.2.9"
   }
 }

package/payload/mac/SOURCE_REVISION

@@ -1 +1 @@
-102b7cf
+c97bbab

package/payload/mac/VERSION

@@ -1 +1 @@
-0.2.7
+0.2.9

package/payload/mac/companiond/pairlingd.py

@@ -300,8 +300,6 @@ os.environ["PATH"] = (
 
 PORT = RUNTIME_PORT
 HOME = Path.home()
-MINT_SOCKET_PATH = "/Library/Application Support/Pairling/run/mintd/mintd.sock"
-MINT_ALERT_PATH = Path("/Library/Application Support/Pairling/run/mintd/alerts.jsonl")
 DEFAULT_COORDINATOR_HOST = (
     os.environ.get("PAIRLING_HOSTNAME")
     or os.environ.get("COMPANION_COORDINATOR_HOST")
@@ -730,6 +728,7 @@ POST_ONLY_ENDPOINTS = {
     "/pair/reauth-claim",
     "/pair/revoke",
     "/pair/rotate-token",
+    "/pair/bind-node",
     "/aperture-cli/open",
     "/open",
     "/inject",
@@ -813,6 +812,12 @@ PROOF_REQUIRED_ENDPOINTS = HIGH_RISK_ENDPOINTS | {
     "/phone-tools/availability",
     "/phone-tools/next",
     "/phone-tools/result",
+    # Minimal proof-required POST whose only purpose is to trip the interactive
+    # provenance bind in _maybe_persist_tailnet_node_id. The iOS post-pair proof
+    # probes the embedded route with GET (never proof-required), so the bind for
+    # an untagged D2 interactive node never fired. A proof-required POST here
+    # reaches proof_verified=True and binds the device's tailnet_node_id.
+    "/pair/bind-node",
 }
 
 MAX_REQUEST_BODY_BYTES = 1_000_000
@@ -1048,7 +1053,31 @@ def _connectd_peer_node_id(headers) -> str:
     return value
 
 
-def _maybe_persist_tailnet_node_id(headers, client_address, auth_result) -> bool:
+def _connectd_peer_provenance(headers):
+    """Parse the connectd-injected X-Pairling-Peer-Provenance header strictly.
+
+    connectd strips any client-supplied copy first, so when this header is
+    present it is trustworthy. Three outcomes, kept deliberately distinct:
+
+    * header ABSENT -> return None. Legacy-eligible: an old connectd that sends
+      X-Pairling-Peer-Node but no provenance keeps the bearer-only bind.
+    * header EXACTLY "tagged" (tag:pairling-phone minted node) or "interactive"
+      (untagged Pairling iOS D2 node) -> return that exact value.
+    * header PRESENT but any other value (including empty) -> return "" as an
+      invalid sentinel. Distinct from None so a present-but-invalid value is
+      rejected, never silently downgraded to the legacy path.
+    """
+    getter = headers.get if hasattr(headers, "get") else lambda key, default=None: default
+    raw = getter("X-Pairling-Peer-Provenance", None)
+    if raw is None:
+        return None
+    value = str(raw).strip()
+    if value in ("tagged", "interactive"):
+        return value
+    return ""
+
+
+def _maybe_persist_tailnet_node_id(headers, client_address, auth_result, proof_verified=False) -> bool:
     if DEVICE_REGISTRY is None or auth_result is None or not getattr(auth_result, "ok", False):
         return False
     device_id = str(getattr(auth_result, "device_id", "") or "").strip()
@@ -1058,9 +1087,26 @@ def _maybe_persist_tailnet_node_id(headers, client_address, auth_result) -> bool
         return False
     if not _pairdrop_gateway_provenance_ok(headers, client_address):
         return False
+    provenance = _connectd_peer_provenance(headers)
     node_id = _connectd_peer_node_id(headers)
     if not node_id:
         return False
+    if provenance is None:
+        # Legacy: an old connectd sent a peer-node header but no provenance.
+        # Bind after bearer auth, preserving the pre-Stage-2 behavior.
+        pass
+    elif provenance == "tagged":
+        # tag:pairling-phone minted node: bearer auth is sufficient to bind.
+        pass
+    elif provenance == "interactive":
+        # Untagged, less-trusted Pairling iOS D2 node: bind only after the
+        # request also passed request-proof, never on bearer auth alone.
+        if not proof_verified:
+            return False
+    else:
+        # Present-but-invalid provenance value: reject. Do NOT downgrade to the
+        # legacy path just because the value is unrecognized.
+        return False
     try:
         return bool(DEVICE_REGISTRY.set_tailnet_node_id_if_absent(device_id, node_id))
     except Exception:
@@ -2141,81 +2187,6 @@ def _lan_ips(power_state: dict | None = None) -> list[str]:
     return _cached_probe("lan_ips", _HEALTH_PROBE_CACHE_SECONDS, _probe_lan_ips)
 
 
-def _mint_phone_authkey(pair_id: str) -> dict | None:
-    if not _pairling_mint_enabled():
-        return None
-    path = os.environ.get("PAIRLING_MINT_SOCKET") or MINT_SOCKET_PATH
-    try:
-        with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as sock:
-            sock.settimeout(float(os.environ.get("PAIRLING_MINT_TIMEOUT_SECONDS", "0.8")))
-            sock.connect(path)
-            sock.sendall(json.dumps({"op": "mint_phone_key", "pair_id": pair_id}).encode("utf-8") + b"\n")
-            with sock.makefile("rb") as fh:
-                raw = fh.readline(8192)
-        payload = json.loads(raw.decode("utf-8"))
-    except Exception:
-        return None
-    if not isinstance(payload, dict) or not payload.get("ok"):
-        return None
-    key = str(payload.get("authkey") or "")
-    if not key:
-        return None
-    try:
-        expires_at = int(payload.get("expires_at") or 0)
-    except (TypeError, ValueError):
-        expires_at = 0
-    return {
-        "authkey": key,
-        "key_id": payload.get("key_id"),
-        "expires_at": expires_at,
-    }
-
-
-def _pairling_mint_enabled() -> bool:
-    return os.environ.get("PAIRLING_MINT_ENABLED", "").strip().lower() in {"1", "true", "yes"}
-
-
-def _silent_join_capability(mint_enabled: bool, connectd_status: dict | None) -> tuple[bool, str]:
-    """D1: whether a cellular/funnel phone can complete a silent join. Minting must
-    be enabled, and the tailnet must not be under network lock (mintd refuses to
-    mint under lock, mintd.go:165-171). Pure, so the phone is told up front."""
-    if not mint_enabled:
-        return False, "mint_disabled"
-    if connectd_status and connectd_status.get("tailnet_lock_enabled"):
-        return False, "tailnet_lock"
-    return True, ""
-
-
-def _mintd_alert_snapshot(limit: int = 5) -> list[dict]:
-    path = Path(os.environ.get("PAIRLING_MINT_ALERT_PATH") or MINT_ALERT_PATH)
-    try:
-        lines = path.read_text().splitlines()
-    except Exception:
-        return []
-    allowed = {"event", "ts", "pair_id", "key_id", "uid", "window"}
-    alerts: list[dict] = []
-    for line in lines[-max(1, limit):]:
-        try:
-            item = json.loads(line)
-        except Exception:
-            continue
-        if not isinstance(item, dict):
-            continue
-        sanitized = {key: item[key] for key in allowed if key in item}
-        if sanitized:
-            alerts.append(sanitized)
-    return alerts
-
-
-def _attach_mintd_alerts(coordinator: dict) -> dict:
-    alerts = _mintd_alert_snapshot()
-    if not alerts:
-        return coordinator
-    out = dict(coordinator)
-    out["mintd_alerts"] = alerts
-    return out
-
-
 def _guardian_listener_entries(power_state: dict | None) -> list[str]:
     if not isinstance(power_state, dict):
         return []
@@ -2592,7 +2563,6 @@ def _health_payload(full_power: bool = False, authenticated: bool = False, auth_
     if connect.get("summary") is not None:
         coordinator = dict(coordinator)
         coordinator["pairling_connect"] = connect["summary"]
-    coordinator = _attach_mintd_alerts(coordinator)
     routes = _health_routes(coordinator, power_state)
     ok = coordinator.get("posture") in ("ready", "warning")
     runtime_info = _runtime_info_snapshot()
@@ -2658,7 +2628,6 @@ def _mac_health_alert_snapshot() -> dict:
     coordinator = _apply_pairling_connect_posture(
         coordinator, _normalize_guardian_state(state), _pairling_connect_health()
     )
-    coordinator = _attach_mintd_alerts(coordinator)
     return {
         "ok": coordinator.get("posture") in ("ready", "warning"),
         "schema_version": 1,
@@ -7476,6 +7445,7 @@ class Handler(BaseHTTPRequestHandler):
             self.send_error(405, "POST required")
             return
 
+        proof_verified = False
         if (
             self.pairling_auth is not None
             and _requires_request_proof(u.path, self.command)
@@ -7511,9 +7481,15 @@ class Handler(BaseHTTPRequestHandler):
                     },
                 }, status=proof_result.status)
                 return
+            proof_verified = True
 
         if self.pairling_auth is not None:
-            _maybe_persist_tailnet_node_id(self.headers, self.client_address, self.pairling_auth)
+            _maybe_persist_tailnet_node_id(
+                self.headers,
+                self.client_address,
+                self.pairling_auth,
+                proof_verified=proof_verified,
+            )
 
         if self.pairling_auth is not None and _is_high_risk_endpoint(u.path) and DEVICE_REGISTRY is not None:
             max_per_min = _rate_limit_for_high_risk_endpoint(u.path)
@@ -7569,6 +7545,8 @@ class Handler(BaseHTTPRequestHandler):
                 self._handle_pair_revoke(q)
             elif u.path == "/pair/rotate-token":
                 self._handle_pair_rotate_token(q)
+            elif u.path == "/pair/bind-node":
+                self._handle_pair_bind_node(q)
             elif u.path == "/healthz":
                 self._handle_healthz(q)
             elif u.path == "/power-state":
@@ -8236,15 +8214,6 @@ class Handler(BaseHTTPRequestHandler):
                 else {"ok": False, "reason": "advertiser_unavailable"}
             )
             pairling_connect_routes = self._pairling_connect_routes()
-            connectd_status = {}
-            if fetch_connectd_status is not None:
-                try:
-                    connectd_status = fetch_connectd_status(timeout_seconds=0.7) or {}
-                except Exception:
-                    connectd_status = {}
-            silent_join_available, silent_join_reason = _silent_join_capability(
-                _pairling_mint_enabled(), connectd_status
-            )
         except ValueError as exc:
             self._send_json({"ok": False, "error": {"code": "bad_request", "message": str(exc)}}, status=400)
             return
@@ -8271,9 +8240,7 @@ class Handler(BaseHTTPRequestHandler):
                 "pairing_nonce": started.pairing_nonce,
                 "attest_challenge": started.attest_challenge,
                 "mac_ake_pub": started.mac_ake_pub,
-                "pv": "3" if started.mac_ake_pub and _pairling_mint_enabled() else "2" if started.mac_ake_pub else "1",
-                "silent_join_available": silent_join_available,
-                "silent_join_unavailable_reason": silent_join_reason,
+                "pv": "2" if started.mac_ake_pub else "1",
             },
         })
 
@@ -8393,55 +8360,6 @@ class Handler(BaseHTTPRequestHandler):
                 proof_secret_nonce, enc_proof_secret = PAIRING_STORE.seal_psk_token(
                     k_token, claim.device.proof_secret, proof_secret_aad
                 )
-            try:
-                protocol_version = int(payload.get("pv") or 0)
-            except (TypeError, ValueError):
-                protocol_version = 0
-            # Increment 5: validate pv to the known set and gate the mint. A
-            # funnel-origin claim mints only with a verified App Attest, so a
-            # script holding a stolen secret cannot obtain a tagged auth key.
-            if protocol_version not in (1, 2, 3):
-                protocol_version = 0
-            mint_allowed = protocol_version >= 3 and (
-                not funnel_origin or claim.direct_attestation_verified
-            )
-            tailnet_authkey = _mint_phone_authkey(str(payload.get("pair_id") or "")) if mint_allowed else None
-            authkey_nonce = None
-            enc_authkey = None
-            if tailnet_authkey:
-                authkey_aad = aad + b"\npairling.psk.enc_authkey.v1"
-                authkey_nonce, enc_authkey = PAIRING_STORE.seal_psk_token(
-                    k_token,
-                    str(tailnet_authkey.get("authkey") or ""),
-                    authkey_aad,
-                )
-                if funnel_origin:
-                    # Operator visibility: a remote, funnel-origin join has no
-                    # proximity backstop, so make it loud and auditable, and push a
-                    # revoke prompt to the already-paired devices (D4).
-                    try:
-                        import sys as _sys
-                        _sys.stderr.write(
-                            "PAIRLING FUNNEL JOIN: a remote device paired over Funnel "
-                            f"(device_id={claim.device.device_id}); no proximity backstop, "
-                            "review and revoke if unexpected.\n"
-                        )
-                        _sys.stderr.flush()
-                    except Exception:
-                        pass
-                    if PUSH_DISPATCHER is not None:
-                        try:
-                            PUSH_DISPATCHER.broadcast_alert(
-                                exclude_device_id=claim.device.device_id,
-                                event_id=f"funnel_join:{claim.device.device_id}",
-                                kind="remote_join",
-                                route="pairling-connect",
-                                title="New device paired remotely",
-                                body="A device joined your Mac over the internet. Tap to review or revoke.",
-                                pairling_extra={"device_id": claim.device.device_id, "revoke_path": "/pair/revoke"},
-                            )
-                        except Exception:
-                            pass
             if PAIRING_ADVERTISER is not None:
                 PAIRING_ADVERTISER.stop()
         except PairingError as exc:
@@ -8481,9 +8399,6 @@ class Handler(BaseHTTPRequestHandler):
                 "routes": runtime_routes,
             },
         }
-        if authkey_nonce and enc_authkey:
-            response["enc_authkey"] = base64.b64encode(enc_authkey).decode("ascii")
-            response["authkey_nonce"] = base64.b64encode(authkey_nonce).decode("ascii")
         self._send_json(response)
 
     def _handle_pair_reauth_challenge(self, q):
@@ -8572,6 +8487,28 @@ class Handler(BaseHTTPRequestHandler):
             return
         self._send_json({"ok": True, "device_id": device_id, "token": token})
 
+    def _handle_pair_bind_node(self, q):
+        # Minimal proof-required POST whose sole purpose is to trip the
+        # interactive provenance bind. The bind itself already ran in
+        # _maybe_persist_tailnet_node_id BEFORE routing (it fires only when this
+        # request was bearer-authed AND passed request-proof, which a POST to a
+        # PROOF_REQUIRED_ENDPOINTS path is). Here we only report whether the
+        # device now carries a tailnet_node_id. NO other side effects.
+        if self.pairling_auth is None:
+            self._send_json({
+                "ok": False,
+                "error": {
+                    "code": "missing_token",
+                    "message": "Authorization: Bearer token required",
+                },
+            }, status=401)
+            return
+        bound = bool(
+            DEVICE_REGISTRY
+            and DEVICE_REGISTRY.tailnet_node_id(self.pairling_auth.device_id)
+        )
+        self._send_json({"ok": True, "tailnet_node_id_bound": bound})
+
     def _handle_power_state(self, q):
         self._send_json(_cached_health_payload(
             full_power=True,

package/payload/mac/connectd/cmd/pairling-connectd/main.go

@@ -484,35 +484,59 @@ type tailscalePeerNodeResolver struct {
 	localClient func() (whoIsClient, error)
 }
 
-func (r tailscalePeerNodeResolver) PeerNodeID(ctx context.Context, remoteAddr string) (string, bool) {
+func (r tailscalePeerNodeResolver) PeerNodeID(ctx context.Context, remoteAddr string) (string, string, bool) {
 	if r.localClient == nil {
-		return "", false
+		return "", "", false
 	}
 	lc, err := r.localClient()
 	if err != nil || lc == nil {
-		return "", false
+		return "", "", false
 	}
 	who, err := lc.WhoIs(ctx, remoteAddr)
 	if err != nil {
-		return "", false
+		return "", "", false
 	}
 	return peerNodeIDFromWhoIs(who)
 }
 
-func peerNodeIDFromWhoIs(who *apitype.WhoIsResponse) (string, bool) {
+// peerNodeIDFromWhoIs resolves a peer's tailnet node ID and its provenance from
+// a WhoIs response. The node ID is always the WhoIs StableID; it is never
+// derived from any client-controlled value. Two provenance paths are admitted:
+//
+//   - "tagged": the old minted path, where the node carries tag:pairling-phone.
+//   - "interactive": an untagged, user-owned Pairling iOS node from the D2
+//     sign-in path, identified by a WhoIs hostname with the pairling-ios- prefix.
+//
+// connectd's hostname gate here is defense-in-depth; pairlingd performs the real
+// bearer + request-proof gate. As a guard against a non-iOS node spoofing the
+// pairling-ios- hostname, an untagged node is rejected when its Hostinfo reports
+// a non-empty OS that is not iOS.
+func peerNodeIDFromWhoIs(who *apitype.WhoIsResponse) (string, string, bool) {
 	if who == nil || who.Node == nil {
-		return "", false
+		return "", "", false
 	}
 	nodeID := strings.TrimSpace(string(who.Node.StableID))
 	if nodeID == "" {
-		return "", false
+		return "", "", false
 	}
 	for _, tag := range who.Node.Tags {
 		if tag == "tag:pairling-phone" {
-			return nodeID, true
+			return nodeID, "tagged", true
 		}
 	}
-	return "", false
+	hostname := who.Node.ComputedName
+	if hostname == "" && who.Node.Hostinfo.Valid() {
+		hostname = who.Node.Hostinfo.Hostname()
+	}
+	if strings.HasPrefix(strings.ToLower(hostname), "pairling-ios-") {
+		if who.Node.Hostinfo.Valid() {
+			if os := who.Node.Hostinfo.OS(); os != "" && !strings.EqualFold(os, "iOS") {
+				return "", "", false
+			}
+		}
+		return nodeID, "interactive", true
+	}
+	return "", "", false
 }
 
 func nodeIdentityFromStatus(st *ipnstate.Status) NodeIdentity {