Repository navigation
Skip pairing approval for verified same-account LAN clients - #171
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Signed-in clients authorized to the receiving browser's current UOA account connect over LAN HTTP/MCP without the Allow dialog. A hidden, source-bound challenge and narrow UOA proof authorize an in-memory grant; every request rechecks live UOA authority and the native account session, expiry and local revocation.
Apple and Android share the same behavior. The CLI supports existing session/ticket providers and sends account credentials only to UOA over TLS. Compact MCP browser control tries account authorization automatically while callers without account authorization retain explicit pairing. Existing manual approvals and socket-pinned tokens remain supported. The CLI reference retains its command index and moves storage/device details into its existing documentation folder to meet the 1,000-line limit.
UOA authority endpoints are merged and deployed in UnlikeOtherAI/UnlikeOtherAuthenticator#95. Production health/contracts passed and unauthenticated requests correctly return generic HTTP 401 with no-store headers.
Validation: CLI lint/build and 626 tests passed on Maxis (64 native integration tests skipped); full Android Gradle build passed on Ubuntu (one unrelated cancellation test failed once and passed on focused/full reruns); Swift lint, both Apple builds and 22 focused tests per Apple platform passed on dictator. iOS Settings UI test passed with screenshot inspected; rebuilt Mac app launch/health passed. Existing Apple project/dependency warnings remain. Sixteen UOA database integration cases passed on Minis. Production native LAN pairing and signed published installation are not yet verified.
Release versions: macOS 0.1.32/build 26, iOS 0.1.17, Android 0.1.16/code 16, CLI 0.1.20, shared protocol 0.1.8. Native publication requires the existing Android signing configuration and Apple's interactive signing session.