talon-agent 5.14.0 → 5.18.2

package/src/core/mesh/credentials/store.ts

@@ -0,0 +1,443 @@
+/**
+ * DeviceCredentialStore — per-device bearer credentials for the mesh.
+ *
+ * Persists `{id, deviceId, tokenHash, scopes, …}` rows to a 0600 sidecar
+ * next to the device registry (~/.talon/mesh-credentials.json). Plaintext
+ * tokens are returned exactly once, from `mint`, and never stored.
+ *
+ * Lifecycle of a credential:
+ *
+ *   mint ──► (unbound: first device id it names binds it; expires unbound)
+ *        ──► active ──► superseded (new one minted; revoked on the new one's
+ *                       first use, so a lost reply never locks a device out)
+ *                   ──► rotation requested (grace window, then expires)
+ *                   ──► revoked (listeners drop that credential's live
+ *                       sessions immediately)
+ *
+ * `authenticate` is synchronous — it runs on every bridge request — so the
+ * store must be `load()`ed before the bridge starts serving (MeshService.load
+ * does it). Until then it knows no credentials and every token fails closed.
+ */
+
+import { resolve } from "node:path";
+import { dirs } from "../../../util/paths.js";
+import { log, logWarn } from "../../../util/log.js";
+import { TalonError } from "../../errors.js";
+import { readArray, writePrivateJson } from "../persist.js";
+import {
+  credentialIdOf,
+  digestsEqual,
+  hashCredentialToken,
+  mintCredentialToken,
+} from "./token.js";
+import {
+  normalizeScopes,
+  type CredentialOrigin,
+  type DeviceCredential,
+  type DeviceCredentialRecord,
+  type MeshScope,
+} from "./types.js";
+
+const DEFAULT_FILE = resolve(dirs.root, "mesh-credentials.json");
+const DAY_MS = 24 * 60 * 60 * 1000;
+/** A pairing link or installer that is never used stops being a credential. */
+const UNBOUND_TTL_MS = 7 * DAY_MS;
+/** How long a device has to pick up a requested rotation before it expires. */
+const ROTATION_GRACE_MS = 7 * DAY_MS;
+/** Revoked rows are kept this long for `talon mesh` / audit, then pruned. */
+const REVOKED_RETENTION_MS = 30 * DAY_MS;
+/** Hard cap on stored rows — the sidecar is rewritten on every change. */
+const MAX_RECORDS = 512;
+/** lastUsedAt is kept in memory per request, persisted at most this often. */
+const TOUCH_PERSIST_MS = 60_000;
+/** Same bound the registry applies to device ids. */
+const MAX_DEVICE_ID_CHARS = 128;
+
+export type RevocationListener = (credentialIds: readonly string[]) => void;
+
+export type MintInput = {
+  /** Bind now, or null to bind on first use (pairing / installer). */
+  deviceId: string | null;
+  scopes: readonly MeshScope[];
+  origin: CredentialOrigin;
+};
+
+export type BindResult =
+  { ok: true; credential: DeviceCredential } | { ok: false; error: string };
+
+export class DeviceCredentialStore {
+  private records = new Map<string, DeviceCredentialRecord>();
+  private loading: Promise<void> | null = null;
+  private readonly listeners = new Set<RevocationListener>();
+  /** Device ids seen authenticating with the shared token (this run). */
+  private readonly legacy = new Map<string, number>();
+  private lastPersist = 0;
+
+  constructor(
+    private readonly file: string = DEFAULT_FILE,
+    private readonly now: () => number = Date.now,
+  ) {}
+
+  /** Hydrate from disk. Idempotent: the first caller reads, the rest share it. */
+  load(): Promise<void> {
+    this.loading ??= readArray<DeviceCredentialRecord>(this.file).then(
+      (rows) => {
+        for (const row of rows) {
+          if (isRecord(row)) {
+            this.records.set(row.id, {
+              ...row,
+              scopes: normalizeScopes(row.scopes),
+            });
+          }
+        }
+        this.prune();
+      },
+    );
+    return this.loading;
+  }
+
+  /**
+   * Mint a credential and wait until it is on disk — the path for handing a
+   * device a token it will replace its old one with (a crash between reply
+   * and write would otherwise strand the device on a token nobody knows).
+   * Minting for a device that already holds one marks the old one
+   * superseded: it keeps working until the new token is first presented,
+   * then it is revoked.
+   */
+  async mint(
+    input: MintInput,
+  ): Promise<{ token: string; credential: DeviceCredential }> {
+    await this.load();
+    const minted = this.create(input);
+    await this.persist();
+    return minted;
+  }
+
+  /**
+   * Mint synchronously, persisting in the background — for pairing links
+   * and installers, whose worst case on a crash is a link that no longer
+   * works (the device never switched away from anything).
+   */
+  mintNow(input: MintInput): { token: string; credential: DeviceCredential } {
+    const minted = this.create(input);
+    this.persistSoon();
+    return minted;
+  }
+
+  /**
+   * Resolve a presented token to its credential, or null when it is not a
+   * live credential (unknown, wrong secret, revoked, expired). The first use
+   * of a replacement credential revokes the one it superseded.
+   */
+  authenticate(token: string): DeviceCredential | null {
+    const id = credentialIdOf(token);
+    const record = id ? this.records.get(id) : undefined;
+    if (!record || !digestsEqual(record.tokenHash, hashCredentialToken(token)))
+      return null;
+    if (!this.isActive(record)) return null;
+    const firstUse = record.lastUsedAt === undefined;
+    this.touch(record);
+    if (firstUse) this.retireSuperseded(record.id);
+    return publicView(record);
+  }
+
+  /**
+   * Bind an unbound credential to the device id it just named. Refused when
+   * another live credential already holds that id — a pairing link can add
+   * a device, never take one over.
+   */
+  bind(credentialId: string, deviceId: string): BindResult {
+    const record = this.records.get(credentialId);
+    if (!record || !this.isActive(record)) {
+      return { ok: false, error: "Credential is no longer valid" };
+    }
+    if (record.deviceId !== null) {
+      return record.deviceId === deviceId
+        ? { ok: true, credential: publicView(record) }
+        : { ok: false, error: `Credential is bound to ${record.deviceId}` };
+    }
+    const id = deviceId.trim();
+    if (!id || id.length > MAX_DEVICE_ID_CHARS) {
+      return { ok: false, error: "Invalid device id" };
+    }
+    if (this.activeRecordsFor(id).length > 0) {
+      return {
+        ok: false,
+        error: `Device ${id} already has a credential — revoke it first (talon mesh revoke ${id})`,
+      };
+    }
+    record.deviceId = id;
+    delete record.expiresAt;
+    log("mesh", `Credential ${record.id} bound to device ${id}`);
+    this.persistSoon();
+    return { ok: true, credential: publicView(record) };
+  }
+
+  /** True when the operator asked for this credential to be replaced. */
+  rotationDue(credentialId: string): boolean {
+    const record = this.records.get(credentialId);
+    return Boolean(record?.rotateRequestedAt && !record.supersededBy);
+  }
+
+  /** Every stored credential (live and recently revoked), newest first. */
+  list(): DeviceCredential[] {
+    return [...this.records.values()]
+      .sort((a, b) => b.createdAt - a.createdAt)
+      .map(publicView);
+  }
+
+  /** Live credentials acting as `deviceId`. */
+  activeFor(deviceId: string): DeviceCredential[] {
+    return this.activeRecordsFor(deviceId).map(publicView);
+  }
+
+  /** Revoke every live credential of a device; returns what was revoked. */
+  async revokeDevice(
+    deviceId: string,
+    reason: string,
+  ): Promise<DeviceCredential[]> {
+    await this.load();
+    return this.revokeRecords(this.activeRecordsFor(deviceId), reason);
+  }
+
+  /** Revoke one credential by id. */
+  async revokeCredential(
+    credentialId: string,
+    reason: string,
+  ): Promise<DeviceCredential[]> {
+    await this.load();
+    const record = this.records.get(credentialId);
+    return record && this.isActive(record)
+      ? this.revokeRecords([record], reason)
+      : [];
+  }
+
+  /**
+   * Ask a device to replace its credential. It picks the request up on its
+   * next heartbeat and swaps in-band; the old credential expires after a
+   * grace window whether or not it did.
+   */
+  async requestRotation(deviceId: string): Promise<DeviceCredential[]> {
+    await this.load();
+    const at = this.now();
+    const records = this.activeRecordsFor(deviceId);
+    for (const record of records) {
+      record.rotateRequestedAt = at;
+      record.expiresAt = Math.min(
+        record.expiresAt ?? Infinity,
+        at + ROTATION_GRACE_MS,
+      );
+    }
+    if (records.length > 0) await this.persist();
+    return records.map(publicView);
+  }
+
+  /**
+   * Replace a device's scopes. Live sessions are dropped (through the
+   * revocation listeners) so nothing keeps streaming under the old grant;
+   * the device reconnects with the same token and the new scopes.
+   */
+  async setScopes(
+    deviceId: string,
+    scopes: readonly MeshScope[],
+  ): Promise<DeviceCredential[]> {
+    await this.load();
+    const next = normalizeScopes(scopes);
+    if (next.length === 0) {
+      throw new TalonError("At least one scope is required", {
+        reason: "bad_request",
+      });
+    }
+    const records = this.activeRecordsFor(deviceId);
+    for (const record of records) record.scopes = next;
+    if (records.length > 0) {
+      await this.persist();
+      this.emit(records.map((r) => r.id));
+    }
+    return records.map(publicView);
+  }
+
+  /** Subscribe to revocations (the bridge drops matching sessions). */
+  onRevoked(listener: RevocationListener): () => void {
+    this.listeners.add(listener);
+    return () => this.listeners.delete(listener);
+  }
+
+  /**
+   * Record that `deviceId` is still authenticating with the shared token.
+   * Warns the first time per device per run; returns true that time.
+   */
+  noteLegacy(deviceId: string): boolean {
+    const first = !this.legacy.has(deviceId);
+    this.legacy.set(deviceId, this.now());
+    if (first) {
+      logWarn(
+        "mesh",
+        `Device ${deviceId} is authenticating with the shared native.token (legacy). ` +
+          `Current companions and talon-node swap it for a per-device credential automatically; ` +
+          `run \`talon mesh\` to see which devices are still on the shared token.`,
+      );
+    }
+    return first;
+  }
+
+  /** Devices seen on the shared token this run that hold no live credential. */
+  legacyDevices(): { deviceId: string; lastSeen: number }[] {
+    return [...this.legacy]
+      .filter(([deviceId]) => this.activeRecordsFor(deviceId).length === 0)
+      .map(([deviceId, lastSeen]) => ({ deviceId, lastSeen }));
+  }
+
+  // ── Internals ─────────────────────────────────────────────────────────────
+
+  private create(input: MintInput): {
+    token: string;
+    credential: DeviceCredential;
+  } {
+    const scopes = normalizeScopes(input.scopes);
+    if (scopes.length === 0) {
+      throw new TalonError("A credential needs a scope", {
+        reason: "bad_request",
+      });
+    }
+    this.prune();
+    if (this.records.size >= MAX_RECORDS) {
+      throw new TalonError(
+        `Credential store is full (${MAX_RECORDS}) — revoke unused devices first`,
+        { reason: "forbidden", status: 409 },
+      );
+    }
+    const minted = mintCredentialToken();
+    const at = this.now();
+    const record: DeviceCredentialRecord = {
+      id: minted.id,
+      deviceId: input.deviceId,
+      tokenHash: minted.tokenHash,
+      scopes,
+      origin: input.origin,
+      createdAt: at,
+      ...(input.deviceId === null ? { expiresAt: at + UNBOUND_TTL_MS } : {}),
+    };
+    if (input.deviceId !== null) this.supersede(input.deviceId, record.id, at);
+    this.records.set(record.id, record);
+    return { token: minted.token, credential: publicView(record) };
+  }
+
+  private isActive(record: DeviceCredentialRecord): boolean {
+    if (record.revokedAt !== undefined) return false;
+    return record.expiresAt === undefined || this.now() < record.expiresAt;
+  }
+
+  private activeRecordsFor(deviceId: string): DeviceCredentialRecord[] {
+    return [...this.records.values()].filter(
+      (r) => r.deviceId === deviceId && this.isActive(r),
+    );
+  }
+
+  /**
+   * A new credential for `deviceId` supersedes its live ones. One the device
+   * has used stays valid until the replacement's first use (lost-reply
+   * safety); one it never used was never adopted — a retried upgrade — and
+   * is revoked outright, so retries cannot pile up live credentials. No
+   * session can exist for a never-used credential, so nothing to drop.
+   */
+  private supersede(deviceId: string, replacementId: string, at: number): void {
+    for (const old of this.activeRecordsFor(deviceId)) {
+      if (old.lastUsedAt === undefined) {
+        old.revokedAt = at;
+        old.revokeReason = `never used; replaced by ${replacementId}`;
+      } else {
+        old.supersededBy = replacementId;
+      }
+    }
+  }
+
+  private touch(record: DeviceCredentialRecord): void {
+    record.lastUsedAt = this.now();
+    if (record.lastUsedAt - this.lastPersist >= TOUCH_PERSIST_MS) {
+      this.persistSoon();
+    }
+  }
+
+  private retireSuperseded(replacementId: string): void {
+    const old = [...this.records.values()].filter(
+      (r) => r.supersededBy === replacementId && this.isActive(r),
+    );
+    if (old.length === 0) return;
+    void this.revokeRecords(old, `replaced by ${replacementId}`).catch(
+      (err: unknown) =>
+        logWarn("mesh", `Could not retire superseded credential: ${err}`),
+    );
+  }
+
+  private async revokeRecords(
+    records: DeviceCredentialRecord[],
+    reason: string,
+  ): Promise<DeviceCredential[]> {
+    if (records.length === 0) return [];
+    const at = this.now();
+    for (const record of records) {
+      record.revokedAt = at;
+      record.revokeReason = reason.slice(0, 200);
+      log(
+        "mesh",
+        `Revoked credential ${record.id} (device ${record.deviceId ?? "unbound"}): ${record.revokeReason}`,
+      );
+    }
+    // Drop sessions before the disk write: revocation must bite now, not
+    // after an fsync.
+    this.emit(records.map((r) => r.id));
+    await this.persist();
+    return records.map(publicView);
+  }
+
+  private emit(ids: readonly string[]): void {
+    for (const listener of this.listeners) {
+      try {
+        listener(ids);
+      } catch (err) {
+        logWarn("mesh", `Credential revocation listener threw: ${err}`);
+      }
+    }
+  }
+
+  /** Drop long-revoked and long-expired rows. */
+  private prune(): void {
+    const cutoff = this.now() - REVOKED_RETENTION_MS;
+    for (const [id, record] of this.records) {
+      const endedAt = record.revokedAt ?? record.expiresAt;
+      if (endedAt !== undefined && endedAt < cutoff) this.records.delete(id);
+    }
+  }
+
+  private persistSoon(): void {
+    void this.persist().catch((err: unknown) =>
+      logWarn("mesh", `Could not persist mesh credentials: ${err}`),
+    );
+  }
+
+  private async persist(): Promise<void> {
+    this.lastPersist = this.now();
+    await writePrivateJson(this.file, [...this.records.values()]);
+  }
+}
+
+function publicView(record: DeviceCredentialRecord): DeviceCredential {
+  const { tokenHash: _hash, ...rest } = record;
+  return { ...rest, scopes: [...rest.scopes] };
+}
+
+/** Reject hand-edited or corrupt rows rather than trusting them. */
+function isRecord(value: unknown): value is DeviceCredentialRecord {
+  if (typeof value !== "object" || value === null) return false;
+  const row = value as Record<string, unknown>;
+  return (
+    typeof row.id === "string" &&
+    /^[0-9a-f]{16}$/.test(row.id) &&
+    typeof row.tokenHash === "string" &&
+    /^[0-9a-f]{64}$/.test(row.tokenHash) &&
+    (row.deviceId === null || typeof row.deviceId === "string") &&
+    typeof row.createdAt === "number" &&
+    normalizeScopes(row.scopes).length > 0
+  );
+}

package/src/core/mesh/credentials/token.ts

@@ -0,0 +1,45 @@
+/**
+ * The per-device credential token format.
+ *
+ *   tdc1.<id: 16 hex>.<secret: 32 random bytes, base64url>
+ *
+ * The id lets the daemon find the row without a table scan and is safe to
+ * log; the secret is 256 bits, so a plain SHA-256 is the right hash (a slow
+ * KDF buys nothing against a secret that was never guessable). The prefix
+ * makes the credential kind self-describing: clients use it to tell a
+ * per-device credential from the shared legacy token without asking.
+ */
+
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+
+const PREFIX = "tdc1";
+const TOKEN_RE = /^tdc1\.([0-9a-f]{16})\.[A-Za-z0-9_-]{43}$/;
+
+export type MintedToken = { id: string; token: string; tokenHash: string };
+
+export function mintCredentialToken(): MintedToken {
+  const id = randomBytes(8).toString("hex");
+  const token = `${PREFIX}.${id}.${randomBytes(32).toString("base64url")}`;
+  return { id, token, tokenHash: hashCredentialToken(token) };
+}
+
+/** The credential id a well-formed token names, or null for anything else. */
+export function credentialIdOf(token: string): string | null {
+  return TOKEN_RE.exec(token)?.[1] ?? null;
+}
+
+/** True when `token` has the per-device credential shape (not the shared token). */
+export function isDeviceCredentialToken(token: string): boolean {
+  return TOKEN_RE.test(token);
+}
+
+export function hashCredentialToken(token: string): string {
+  return createHash("sha256").update(token).digest("hex");
+}
+
+/** Constant-time comparison of two hex digests of equal length. */
+export function digestsEqual(a: string, b: string): boolean {
+  const left = Buffer.from(a, "hex");
+  const right = Buffer.from(b, "hex");
+  return left.length === right.length && timingSafeEqual(left, right);
+}

package/src/core/mesh/credentials/types.ts

@@ -0,0 +1,83 @@
+/**
+ * Per-device mesh credentials — the shapes.
+ *
+ * A credential is a bearer secret the daemon mints for ONE device (or, for a
+ * pairing link that has not been redeemed yet, for whichever device first
+ * names itself with it) and a set of scopes. The daemon keeps only a hash of
+ * the secret plus the metadata below; the plaintext exists once, in the reply
+ * or link that hands it to the device.
+ *
+ * Scopes (least privilege — see docs/mesh-credentials.md):
+ *
+ *   device    register/heartbeat/report as ITSELF, receive and answer its
+ *             own commands, move the files the daemon asked it to move.
+ *   client    the chat UI: chats, history, search, sending, non-secret
+ *             settings reads, the device list.
+ *   operator  config and extension writes, daemon control, logs.
+ *
+ * The shared `native.token` (legacy) and an open loopback bridge carry every
+ * scope — that is what they meant before per-device credentials existed.
+ */
+
+const MESH_SCOPES = ["device", "client", "operator"] as const;
+export type MeshScope = (typeof MESH_SCOPES)[number];
+
+/** What a paired or upgraded companion gets unless the operator widens it. */
+export const DEFAULT_COMPANION_SCOPES: readonly MeshScope[] = [
+  "device",
+  "client",
+];
+
+/** A headless talon-node is a device and nothing else. */
+export const NODE_SCOPES: readonly MeshScope[] = ["device"];
+
+/** How a credential came to exist — for the audit trail and `talon mesh`. */
+export type CredentialOrigin =
+  /** Minted into a companion pairing link. */
+  | "pair"
+  /** Minted into a talon-node installer. */
+  | "install"
+  /** Swapped in-band for the shared legacy token. */
+  | "upgrade"
+  /** Re-issued to a device that already held a per-device credential. */
+  | "rotate";
+
+/** The persisted row. `tokenHash` never leaves the store. */
+export type DeviceCredentialRecord = {
+  /** Public id — the middle segment of the token; safe to log and show. */
+  id: string;
+  /**
+   * The device this credential acts as. Null until a pairing/installer
+   * credential is first used: the first device id it names binds it for
+   * good (and an id another live credential already holds is refused).
+   */
+  deviceId: string | null;
+  /** Hex SHA-256 of the whole token. */
+  tokenHash: string;
+  scopes: MeshScope[];
+  origin: CredentialOrigin;
+  createdAt: number;
+  lastUsedAt?: number;
+  /** Hard stop: an unbound credential's bind deadline, or a rotation's grace. */
+  expiresAt?: number;
+  /** Operator asked (`talon mesh rotate`) for this credential to be replaced. */
+  rotateRequestedAt?: number;
+  /**
+   * The credential that replaces this one. It stays valid until the
+   * replacement is first used — so a device that never received its new
+   * token (a dropped reply) is not locked out — and is revoked then.
+   */
+  supersededBy?: string;
+  revokedAt?: number;
+  revokeReason?: string;
+};
+
+/** The view everything outside the store sees. */
+export type DeviceCredential = Omit<DeviceCredentialRecord, "tokenHash">;
+
+/** Parse an untrusted scope list: known names only, canonical order, no dupes. */
+export function normalizeScopes(value: unknown): MeshScope[] {
+  if (!Array.isArray(value)) return [];
+  const wanted = new Set(value.filter((v) => typeof v === "string"));
+  return MESH_SCOPES.filter((scope) => wanted.has(scope));
+}

package/src/core/mesh/devices/service.ts

@@ -50,6 +50,10 @@ import {
   type NodeBinaryResolver,
 } from "../links/node-binaries.js";
 import { MeshRegistry } from "./registry.js";
+import {
+  DeviceCredentialStore,
+  type CredentialAdminContext,
+} from "../credentials/index.js";
 import type {
   DeviceCommand,
   DeviceCommandResult,
@@ -89,6 +93,12 @@ export type MeshServiceOptions = {
   presenceWatchIntervalMs?: number;
   /** Node-binary resolver override (tests — the real one builds/downloads). */
   nodeBinaryResolver?: NodeBinaryResolver;
+  /**
+   * Per-device credential store. With one, pairing links and installers
+   * carry a device's own credential and removing a device revokes it;
+   * without one (tests, embedders) links carry the shared bridge token.
+   */
+  credentials?: DeviceCredentialStore;
 };
 
 export type { MeshBridgeInfo } from "../links/bridge-links.js";
@@ -135,6 +145,10 @@ export class MeshService {
   private readonly commandTimeoutMs: number;
   private readonly presenceWatchIntervalMs: number;
   private loading: Promise<void> | null = null;
+  /** Per-device credentials (null = shared-token-only mesh). */
+  readonly credentials: DeviceCredentialStore | null;
+  /** `native.legacySharedToken` as the bridge last reported it. */
+  private legacySharedToken = true;
 
   constructor(
     private readonly registry = new MeshRegistry(),
@@ -156,18 +170,47 @@ export class MeshService {
       commandTimeoutMs: this.commandTimeoutMs,
       resolveNode: this.resolveNode,
     });
-    this.links = new BridgeLinks(this.resolveNode);
+    this.credentials = options.credentials ?? null;
+    const store = this.credentials;
+    this.links = new BridgeLinks(
+      this.resolveNode,
+      store
+        ? (scopes, origin) =>
+            store.mintNow({ deviceId: null, scopes, origin }).token
+        : undefined,
+    );
   }
 
   /** The native bridge reports its reachable identity here (null on stop). */
   setBridgeInfo(info: MeshBridgeInfo | null): void {
     this.links.setBridgeInfo(info);
+    this.legacySharedToken = info?.legacySharedToken ?? true;
+  }
+
+  /**
+   * What `talon mesh` operates on, or null for a shared-token-only mesh.
+   * Resolves registry names to ids, so callers should `load()` first.
+   */
+  credentialAdminContext(): CredentialAdminContext | null {
+    const store = this.credentials;
+    if (!store) return null;
+    return {
+      store,
+      resolveDeviceId: (query) => {
+        const resolved = this.resolveDevice(query);
+        return "error" in resolved ? undefined : resolved.target.id;
+      },
+      legacySharedToken: () => this.legacySharedToken,
+    };
   }
 
   /** Hydrate persisted devices/locations. Idempotent — safe to await from
    *  every entry point; the first caller does the read, the rest share it. */
   load(): Promise<void> {
-    this.loading ??= this.registry.load();
+    this.loading ??= Promise.all([
+      this.registry.load(),
+      this.credentials?.load(),
+    ]).then(() => undefined);
     return this.loading;
   }
 
@@ -463,13 +506,20 @@ export class MeshService {
     if (!removed) {
       return { ok: false, text: this.noSuchDevice(query).text };
     }
+    // A removed device keeps no way back in: its own credential dies with
+    // the registry entry (its live sessions drop with it).
+    const revoked =
+      (await this.credentials?.revokeDevice(removed.id, "device removed")) ??
+      [];
     return {
       ok: true,
       text:
         `Removed ${removed.name} [id: ${removed.id}] (${removed.platform}, last seen ${age(Date.now() - removed.lastSeen)}) from the mesh registry.` +
-        (target.online
-          ? " Note: it was still online — a connected companion re-registers within ~60s, so quit the app first if it keeps coming back."
-          : ""),
+        (revoked.length > 0
+          ? ` Revoked its ${revoked.length} per-device credential(s); it must be paired again to rejoin.`
+          : target.online
+            ? " Note: it was still online — a connected companion re-registers within ~60s, so quit the app first if it keeps coming back."
+            : ""),
     };
   }
 
@@ -1086,7 +1136,9 @@ let instance: MeshService | null = null;
 
 /** The daemon's shared mesh service (lazily created). */
 export function getMeshService(): MeshService {
-  instance ??= new MeshService();
+  instance ??= new MeshService(undefined, {
+    credentials: new DeviceCredentialStore(),
+  });
   return instance;
 }