Repository navigation
fix(pairing): pairing with this same Orca profile is refused - #27166
Conversation
Every add/re-pair path goes through the environment store; it now compares the offer's public key with this profile's own runtime key before saving. Co-Authored-By: s546126 <s546126@users.noreply.github.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Priority: ⬇️ Low Severity of issue fixed: Low Merge Risk: ⚪ Minimal · up to Pairing codes generated by the same Orca profile are now rejected with a clear message, while codes from other computers continue to pair. No merge-blocking risk was identified. Pre-merge checks |
  |
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Docstring Coverage |  |
Docstring coverage is 14.29% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 5 files. | Write docstrings for the functions missing them to satisfy the coverage threshold. |
✅ Passed checks (4 passed)
-
Check name Status Explanation Title check The title clearly and concisely describes the main change: refusing pairing attempts for the same Orca profile. Description check The description is complete and aligned with the template. It explains the user impact, mechanism, rationale, linked issue, testing, visual proof, compatibility considerations, and checklist status. Linked Issues check Issue #17549requires rejection of self-pairing with runtime and UI coverage.parseRemotePairingCodecompares the pairing offer public key with the profile key. BothaddEnvironmentFromPairingCode…Out of Scope Changes check The changed key-file constants, bounded public-key reader, comparison helper, environment-store guard, and focused tests all support issue #17549. The changes do not show unrelated behavior or unrelat…
- Fix all pre-merge checks with AI
✨ Finishing Touches 💡 1
-
📝 Generate docstrings 💡
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
ELI5
Orca can connect to Orca running on another computer by pasting a pairing code. Nothing stopped you from pasting a code that this same Orca made, so Orca saved "itself" as a remote server, which can never work properly. Now Orca recognises its own code and says so instead of saving a broken entry.
What Changed
orca environment add, or the ephemeral-VM flow) saved a remote server entry that points back at this same Orca.Mechanism: every pairing code carries the issuing server's encryption public key. All add and re-pair paths go through one function in the environment store (
addEnvironmentFromPairingCode/updateEnvironmentFromPairingCode), which now reads this profile's own public key fromorca-e2ee-keypair.json(read-only, never created) and refuses when the two keys are equal. The key-file name and size limit moved to a small shared module so the main-process keypair loader and the store use the same definitions.Why
The key is the only reliable signal: an address cannot tell "this machine" from "another machine behind a tunnel or on the LAN", so address checks would both miss real self-pairs and block legitimate ones. Putting the check in the store covers the desktop UI, the CLI, and the ephemeral-VM path at once, with no wire or protocol change. If the profile has no key file (or it cannot be read), there is no server on this profile that could have issued the code, so pairing proceeds as before. Detecting copied or reinstalled servers is out of scope here and follows separately.
Reimplements the guard from #9137 (credit @s546126).
Linked Issue
Fixes #17549
Visual Proof
N/A — the only visible change is an error message in the existing add-server error slot; no layout change.
Testing
src/shared/runtime-environment-store.test.ts: refuses a code this profile issued (add and re-pair); still pairs a different key at a loopback address. The two refusal tests fail onorigin/main(store file restored from main) and pass with this change.pnpm tc, oxlint, andcheck:code-quality:changedpass.Review
P0/P1 review: own review plus an independent review.
Agent skill upstream boundary
Notes
Security: no secret material is read beyond the public key field; the file is read with a size bound. Cross-platform: path joins only. SSH/remote: the check runs where the environment store lives (the client); a remote server's key differs from the client's, so remote pairing is unaffected. Backward compatible: no stored-data or wire change.
Checklist
N/Awith reasonpnpm lint,pnpm typecheck,pnpm test, andpnpm buildpass (or CI will cover; local preferred)