Repository navigation
fix(mold): open secure pairing links across mobile apps - #48
Merged
Merged
Conversation
11 of 13 tasks
jamesbrink
added a commit
to utensils/mold
that referenced
this pull request
Oct 11, 2026
Remote machines could report offline even when nearby, while long-lived Lambda proxy calls saturated concurrency and exposed request bodies to the relay. This replaces the remote protocol with host-pinned Noise sessions, per-device pairing, verified direct LAN routing, and shared secure HTTP/media adapters across native apps, Studio, Tauri, CLI, MCP and headless hosts. This is a coordinated hard cutover: existing remote clients must upgrade and redeem a fresh invitation from their host. The old plaintext forwarding and shared bearer admission implementations are removed. Lambda handles admission and opaque routing; bounded ciphertext batches use private S3 objects. Host/device keys and application credentials remain at the endpoints. Each device has an independently revocable, host-owned grant. Its opaque identifier lets the host add principal and scope policies later without changing the encrypted carrier; separate user accounts and role management remain future work. RunPod provisioning now delivers an owner-created identity and client grant through an atomic bootstrap, preserves existing-volume authority, and records ambiguous create outcomes before any paid retry. Forget removes aliases and pending recovery credentials. Provider responses discard environment secrets before CLI or desktop output, and diagnostics omit provider bodies and values that could echo bootstrap credentials. Lambda Labs deployments retain their verified SSH transport across the cutover. Validation and delivery: - [x] Rust protocol vectors, malicious-peer tests, revocation/restart, real headless server and normal CLI pairing/status/queue/library workflows. - [x] Bounded ciphertext objects, immutable PUT/checksum verification, lost-ACK recovery, cleanup and large-transfer flow control. - [x] Isolated real Lambda/S3 200 MiB download: exact bytes, 313.599 seconds, 25.6 MB maximum RSS with debug binaries. About 94.4% of payload used S3. Cost evidence and its measurement boundaries are in `docs/plans/relay-cost-evidence.md`. - [x] Real browser cloud 3 MiB upload/echo in 8.83 seconds, Range/206 and live events; over 90% S3 transport coverage in both directions. Browser Service Worker HEAD/Range/video seeking and actual Tauri private-LAN pairing/relaunch also passed. - [x] Latest complete frontend run: 2,543 Studio, 2,215 web and 7,627 desktop tests; architecture checks and both production builds passed. - [x] Trusted app links deployed through utensils/utensils.github.io#48. - [x] Optimized 20 MiB download: 30.233 seconds, 0.662 MiB/s and 24.85 MB peak RSS. Larger ciphertext batches retain the one-MiB aggregate budget, reduce S3 uploads from 80 to 39 and Lambda invocations from 524 to 400; small requests and parallel reads passed. - [x] Final native cloud interoperability: 3 MiB + 13 bytes exact echo, 192 KiB Range/206 and four SSE events in 12.064 seconds; S3 upload coverage 97.37%, download 96.43%. AVPlayer decoded the 12-second clip, sought to eight seconds and verified its exact file in 18.187 seconds. Shared Swift: 1,390 tests; native iOS: 260 tests; native Mac with the shipping Metal engine: 1,082 tests. - [x] Desktop/mobile startup remains visible while secure storage is blocked or fails; four failing-first regressions passed. - [x] Forget fences pending connections, identity reads, requests and encrypted storage writes, including other browser tabs; 40 focused regressions and actual browser access-removal UAT passed. - [x] Exact final-head CI and independent review on `6917688a478f72a89a64ea59a7b7cfcd4baee8ee`, including executed Windows private-file ACL/concurrent-creation tests, native Apple builds, Android APK and exact Linux/browser crypto reproduction. - [ ] Matching signed/native distributions, trusted Studio, headless CLI and exact-digest container images available before the old cloud path is removed. - [ ] Production host/cloud cutover, verification, legacy-state removal and staging cleanup. Infrastructure: urandomio/infra#2. Design and cutover procedure: `docs/plans/secure-relay-transport.md`, `relay/aws/SECURE-PROTOCOL.md`, and `docs/plans/relay-cutover-checklist.md`. Production remains on the old transport until the coordinated release gates pass. Simulator proof is not physical-device proof.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Mold's secure pairing QR uses an HTTPS fragment, but Android had no verified association and the Tauri iOS bundle was missing from Apple's record. Add the production Android release certificate and Tauri iOS app ID while retaining the native Companion association.
The Android SHA-256 fingerprint was extracted from the published Mold v0.34.0 APK signing block and independently printed by OpenSSL. Both JSON records parse successfully. The existing build/deploy workflow includes hidden
.well-knownfiles; verify their live HTTPS responses after deployment.Related transport cutover: utensils/mold#1867