Repository navigation
Web console: naming, trust, activity, onboarding and identity - #316
Merged
Merged
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
A petname is this viewer's own label for a device, kept in the console's own storage and never gossiped. A self display name is read from the agent/self entry of a verified advert, the key agent-comms and the public hub's advert policy already carry, and this console publishes its own through the same entry. The convention is implemented once in peer-names.ts and reached through a context by the conversation list, the connection directory and the discovered-peers table.
…trip control characters from it PeerName and the conversation labels rendered only the stranger-chosen name, so two peers claiming one name could not be told apart. cleanName now drops control and bidirectional formatting characters and truncates by code point.
… and surface publish failures
…d surface name storage failures
…nd trim a name after the length cut A self name is shown in italics under a 'calls itself' marker and flagged when it equals a petname the viewer holds for any device. cleanName trims after truncating so a cut after a space leaves no trailing space, and the Save button compares the draft with its cleaned form.
…es context ConnectionPanel now reads peer names through PeerNamesProvider, so the local-network explanation test, written before names existed, has to mount the panel the way the app does.
…how peer provenance An address that carries certificate pins is assessed against the certificate memory before it is dialled: nothing remembered asks the user to trust the presented certificate, a disjoint remembered set raises a change warning that must be accepted, and an overlapping set (a rotation) connects silently. A node that later announces certificates sharing nothing with the remembered ones is reported rather than overwritten silently. Each discovered-peer row names the connection whose directory gossiped it and, when known, the node that vouched for that connection.
The connection panel shows what happened on a connection as sentences (connected, handshake, pairing established, relayed messages, peers seen, certificate changes) derived from the session's state changes and frames, with the raw frame log behind a toggle. Health is measured without a button press: a ping probes the node when the connection comes up and on an interval, each pong becoming a sample in an RTT sparkline and each unanswered probe a recorded loss; a node that never answers is left alone. A dropped connection shows when the next attempt is due and how many remain, from the same reconnect policy the session uses, and the directory shows when each peer was last seen.
…aced double hyphen
…ned-address end-to-end specs
…in the reconnect specs
…of interval timing
…e request The header joined raw device-ids and the message request named the requester by device-id, bypassing the naming convention every other peer-bearing surface uses.
…th peer tables A device that has not dismissed it sees a walkthrough of connecting, the directory, why discovered peers wait for an explicit connect and what works offline, reopenable from the header. Search matches every term case-insensitively across the messages and readable notices of all conversations, newest first and bounded, and opens the conversation a result belongs to. On a phone-width viewport each peer table row stacks into a labelled card instead of a row of columns. An end-to-end spec checks the intro persists across a reload and that the directory stacks on a phone and keeps its columns on a desktop.
The backup is a JSON file holding the private key as a standard P-256 JWK with the public key and device-id it derives, checked on restore so a file whose key, public key and device-id disagree is refused. Restoring replaces the stored identity, which loads the next time the console does.
…red across token checks The identity panel shows the device-id and offers the key backup behind a warning and explicit acknowledgement. The grants panel lists the grants this device holds and has issued, each judged afresh by core's verifier, mints grants with mintCapabilityToken (delegations may only narrow their parent), adds a grant from its copied grant code, and revokes issued grants with mintRevocationEntry after a confirmation. Revocations minted here or announced by a connected node are verified, persisted and consulted by every token check in the console, replacing the check that treated every token as unrevoked. Tokens received by a join are recorded as held and tokens an accepted join issues as issued.
… show gossiped device identity as a claim An address presenting one remembered certificate beside others was dialled with all of them, so the address could add a pin the console had never approved. confirmAddress now returns the address to dial, narrowed to the remembered pins. A request for the same node and certificates shares one prompt, pending prompts are refused and dials skipped once the console is closed, and the device a gossiping node claimed for an address is shown as a claim and forgotten once its dial is settled.
A ping given up on at its timeout and a ping cut short by a dropped connection both rejected with a plain Error, so a caller counting unanswered pings could only tell them apart by message text.
… short by a dropped connection
…have, without dash separators
A session's reconnect timer outlived the console, so a late redial could construct a socket after the console was gone.
…be loaded as the stored key pair
… counts and show a failed mint
…nd discardable instead of refusing to start
… render grants through the stacked table
…t connects, and claim no device for a shared address
… clear its pending entries
…in the claim tests
…e stale-prompt test
…hout dash separators
… conversation header and search results
…ted room token A room token stored for reloads was re-verified with a check that never reported a revocation, so a token its issuer revoked while the console was closed came back as valid and was used again. The persisted-token store now verifies against the console's real revocation view, and a revoked token is dropped and deleted from storage on read.
…he hooks now take The app harness renders App with the room storage it requires, and the ConnectionPanel, certificate-trust and relay messaging tests pass the clock, reconnect policy, certificate changes and room storage their subjects now read. App no longer imports DeviceId twice.
Mearman
force-pushed
the
feat/console-identity
branch
from
October 1, 2026 09:38
5da6776 to
dc3c077
Compare
Mearman
changed the title
This was referenced Oct 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This carries the whole web-console stack as one linear branch of atomic commits, so it goes through a single CI cycle against a main that other sessions keep moving (wire-mesh requires an up-to-date branch, and every merge produces a release commit that puts the next PR behind). It covers peer naming with petnames and signed self names (#295), first-use certificate trust and change warnings (#296), the humanised activity view and connection health (#297), first-run intro, search and phone layout (#298), and the identity and grants panels with revocations honoured across token checks (#299). PRs 305, 306, 307 and 310 hold the same commits as stacked views and are closed in favour of this one when it merges.
Rebasing over concurrent work on main (persistent room keys and tokens, the local-network block explanation) needed changes beyond a textual merge. A room token restored from storage was verified with a check that never reported a revocation, so a token its issuer revoked while the console was closed would come back as valid; the persisted-token store now verifies against the console's revocation view and deletes a revoked token on read, with a test.
useRoomMessagingtakes both the room storage and the capability services, and every stored token is recorded in the grants ledger as well as persisted. The shared App test harness, and the ConnectionPanel, certificate-trust and relay tests, were brought up to the props those hooks now read.Fixes #295
Fixes #296
Fixes #297
Fixes #298
Fixes #299