viveworker 0.1.2 → 0.1.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "viveworker",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Local iPhone companion for Codex Desktop approvals, plan checks, questions, and notifications on your LAN.",
   "author": "Yuta Hoshino <hoshino.lireneo@gmail.com>",
   "license": "MIT",

package/scripts/viveworker-bridge.mjs

@@ -4409,6 +4409,7 @@ function readSession(req, config, state) {
     pairedAtMs: Number(payload.pairedAtMs) || 0,
     expiresAtMs: Number(payload.expiresAtMs) || 0,
     deviceId,
+    temporaryPairing: payload?.temporaryPairing === true,
   };
 }
 
@@ -4466,6 +4467,22 @@ function setSessionCookie(res, config) {
   }));
 }
 
+function setTemporarySessionCookie(res, config) {
+  const secure = config.nativeApprovalPublicBaseUrl.startsWith("https://");
+  const now = Date.now();
+  const token = signSessionPayload({
+    sessionId: crypto.randomUUID(),
+    pairedAtMs: now,
+    expiresAtMs: now + config.sessionTtlMs,
+    temporaryPairing: true,
+  }, config.sessionSecret);
+  res.setHeader("Set-Cookie", buildSetCookieHeader({
+    value: token,
+    maxAgeSecs: Math.max(1, Math.floor(config.sessionTtlMs / 1000)),
+    secure,
+  }));
+}
+
 function clearSessionCookie(res, config) {
   const secure = config.nativeApprovalPublicBaseUrl.startsWith("https://");
   res.setHeader("Set-Cookie", buildSetCookieHeader({ value: "", maxAgeSecs: 0, secure }));
@@ -4623,15 +4640,27 @@ function pairingCredentialConsumed(config, state) {
 }
 
 function isPairingAvailableForState(config, state) {
-  return isPairingAvailable(config) && !pairingCredentialConsumed(config, state);
+  return isPairingAvailable(config) && !pairingCodeConsumed(config, state);
 }
 
-function markPairingConsumed(state, config, now = Date.now()) {
-  const current = currentPairingCredential(config);
+function pairingCodeConsumed(config, state) {
+  const code = cleanText(config?.pairingCode ?? "").toUpperCase();
+  if (!code) {
+    return false;
+  }
+  const consumedAtMs = Number(state?.pairingConsumedAt) || 0;
+  const consumedCredential = cleanText(state?.pairingConsumedCredential ?? "");
+  return consumedAtMs > 0 && consumedCredential === `code:${code}`;
+}
+
+function markPairingConsumed(state, credential, now = Date.now()) {
+  const current = cleanText(credential || "");
   if (!current) {
     return false;
   }
-  if (pairingCredentialConsumed(config, state)) {
+  const consumedAtMs = Number(state?.pairingConsumedAt) || 0;
+  const consumedCredential = cleanText(state?.pairingConsumedCredential ?? "");
+  if (consumedAtMs > 0 && consumedCredential === current) {
     return false;
   }
   state.pairingConsumedAt = now;
@@ -4643,7 +4672,7 @@ function validatePairingPayload(payload, config, state) {
   if (!config.authRequired) {
     return { ok: true };
   }
-  if (!isPairingAvailableForState(config, state)) {
+  if (!isPairingAvailable(config)) {
     return { ok: false, error: "pairing-unavailable" };
   }
 
@@ -4651,10 +4680,16 @@ function validatePairingPayload(payload, config, state) {
   const token = cleanText(payload?.token ?? "");
   const matchesCode = code && cleanText(config.pairingCode).toUpperCase() === code;
   const matchesToken = token && cleanText(config.pairingToken) === token;
-  if (!matchesCode && !matchesToken) {
-    return { ok: false, error: "invalid-pairing-credentials" };
+  if (matchesToken) {
+    return { ok: true, credential: `token:${token}` };
   }
-  return { ok: true };
+  if (matchesCode) {
+    if (pairingCodeConsumed(config, state)) {
+      return { ok: false, error: "pairing-unavailable" };
+    }
+    return { ok: true, credential: `code:${code}` };
+  }
+  return { ok: false, error: "invalid-pairing-credentials" };
 }
 
 function readRemoteAddress(req) {
@@ -5707,7 +5742,7 @@ function resolveManifestPairingToken({ config, state, requestedToken }) {
   if (!token) {
     return "";
   }
-  if (!isPairingAvailableForState(config, state)) {
+  if (!isPairingAvailable(config)) {
     return "";
   }
   return cleanText(config.pairingToken) === token ? token : "";
@@ -5860,6 +5895,7 @@ function createNativeApprovalServer({ config, runtime, state }) {
           httpsEnabled: config.nativeApprovalPublicBaseUrl.startsWith("https://"),
           appVersion: appPackageVersion,
           deviceId: session.deviceId || null,
+          temporaryPairing: session.temporaryPairing === true,
           ...buildSessionLocalePayload(config, state, session.deviceId),
         });
       }
@@ -5884,6 +5920,17 @@ function createNativeApprovalServer({ config, runtime, state }) {
           return writeJson(res, 400, { error: validation.error });
         }
 
+        if (payload?.temporary === true && cleanText(payload?.token || "")) {
+          clearPairingFailures(runtime, remoteAddress);
+          setTemporarySessionCookie(res, config);
+          return writeJson(res, 200, {
+            ok: true,
+            authenticated: true,
+            pairingAvailable: isPairingAvailableForState(config, state),
+            temporaryPairing: true,
+          });
+        }
+
         const pairedDeviceId = readDeviceId(req, config) || crypto.randomUUID();
         if ("detectedLocale" in payload) {
           upsertDetectedDeviceLocale(state, pairedDeviceId, payload.detectedLocale);
@@ -5898,7 +5945,9 @@ function createNativeApprovalServer({ config, runtime, state }) {
             lastLocale: normalizeSupportedLocale(payload?.detectedLocale),
           }
         );
-        markPairingConsumed(state, config);
+        if (String(validation.credential || "").startsWith("code:")) {
+          markPairingConsumed(state, validation.credential);
+        }
         clearPairingFailures(runtime, remoteAddress);
         await saveState(config.stateFile, state);
         setPairingCookies(res, config, pairedDeviceId);

package/scripts/viveworker.mjs

@@ -265,7 +265,7 @@ async function runSetup(cliOptions) {
   if (allowInsecureHttpLan) {
     console.log(t(locale, "cli.setup.warning.insecureHttpLan"));
   }
-  if (canShowCaDownload && !cliOptions.installMkcert) {
+  if (canShowCaDownload && !cliOptions.installMkcert && !cliOptions.pair) {
     console.log(t(locale, "cli.setup.caDownloadLocal", { url: caDownloadLocalUrl }));
     console.log(t(locale, "cli.setup.caDownloadIp", { url: caDownloadIpUrl }));
   }
@@ -280,7 +280,7 @@ async function runSetup(cliOptions) {
   console.log("");
   console.log(t(locale, "cli.setup.qrPairing"));
   await printQrCode(`${publicBaseUrl}${pairPath}`);
-  if (canShowCaDownload && !cliOptions.installMkcert) {
+  if (canShowCaDownload && !cliOptions.installMkcert && !cliOptions.pair) {
     console.log("");
     console.log(t(locale, "cli.setup.qrCaDownload"));
     await printQrCode(caDownloadIpUrl);

package/web/app.js

@@ -89,7 +89,10 @@ async function boot() {
 
   if (!state.session?.authenticated && initialPairToken && shouldAutoPairFromBootstrapToken()) {
     try {
-      await pair({ token: initialPairToken });
+      await pair({
+        token: initialPairToken,
+        temporary: shouldUseTemporaryBootstrapPairing(),
+      });
     } catch (error) {
       state.pairError = error.message || String(error);
     }
@@ -532,7 +535,9 @@ function renderPair() {
 
 async function pair(payload) {
   const result = await apiPost("/api/session/pair", payload);
-  syncPairingTokenState("");
+  if (result?.temporaryPairing !== true) {
+    syncPairingTokenState("");
+  }
   return result;
 }
 
@@ -4069,7 +4074,7 @@ function syncPairingTokenState(pairToken) {
 }
 
 function desiredBootstrapPairingToken() {
-  if (state.session?.authenticated) {
+  if (state.session?.authenticated && !state.session?.temporaryPairing) {
     return "";
   }
   return initialPairToken;
@@ -4079,15 +4084,13 @@ function shouldAutoPairFromBootstrapToken() {
   if (!initialPairToken) {
     return false;
   }
-  if (isStandaloneMode()) {
-    return true;
-  }
-  if (isProbablySafari()) {
-    return false;
-  }
   return true;
 }
 
+function shouldUseTemporaryBootstrapPairing() {
+  return Boolean(initialPairToken) && !isStandaloneMode() && isProbablySafari();
+}
+
 function urlBase64ToUint8Array(base64String) {
   const padding = "=".repeat((4 - (base64String.length % 4)) % 4);
   const normalized = `${base64String}${padding}`.replace(/-/gu, "+").replace(/_/gu, "/");

package/web/sw.js

@@ -1,4 +1,4 @@
-const CACHE_NAME = "viveworker-v4";
+const CACHE_NAME = "viveworker-v5";
 const APP_ASSETS = ["/app.css", "/app.js", "/i18n.js"];
 const APP_ROUTES = new Set(["/", "/app", "/app/"]);
 const CACHED_PATHS = new Set(APP_ASSETS);