Repository navigation
refactor(remote): clients connect through a paired-connection handle, not a pairing offer - #27533
Merged
Merged
Conversation
OrcaWin
force-pushed
the
np/d2b-handshake-core
branch
2 times, most recently
from
October 11, 2026 18:56
de51381 to
1eb704a
Compare
OrcaWin
marked this pull request as ready for review
October 11, 2026 18:57
OrcaWin
force-pushed
the
np/d2b-connection-handle
branch
from
October 11, 2026 18:57
8766bff to
6c02776
Compare
OrcaWin
force-pushed
the
np/d2b-connection-handle
branch
from
October 11, 2026 19:15
6c02776 to
69eb366
Compare
Contributor
|
Important Review skippedReview was skipped as selected files did not have any reviewable changes. ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Priority: ➖ Normal Merge Risk: ⚪ Minimal · up to This refactor changes how remote connection call sites receive their connection data, and the reported behavior is unchanged. No concrete merge-blocking risk was found in the supplied context. Pre-merge checks |
  |
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Docstring Coverage |  |
Docstring coverage is 11.54% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 52 functions across 50 files. (48 skipped… | Write docstrings for the functions missing them to satisfy the coverage threshold. |
✅ Passed checks (4 passed)
-
-
-
Check name Status Explanation Title check The title clearly and concisely describes the primary change: replacing pairing offers with paired-connection handles for remote clients. Description check The description is complete and aligned with the template. It explains the change, motivation, scope, linked issues, visual impact, testing, platform considerations, and checklist status. The missing … Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request.
-
-
Full details: Docstring Coverage
-
-
-
Explanation
Docstring coverage is 11.54% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 52 functions across 50 files. (48 skipped: 48 over the file limit.)
-
-
✨ Finishing Touches 💡 2
-
-
-
📝 Generate docstrings 💡
-
-
-
-
- Commit to this branch
- Create a new PR
-
-
-
🛠️ Fix failing CI checks 💡
-
-
-
- Commit to this branch
- Create a new PR
-
-
-
-
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
OrcaWin
force-pushed
the
np/d2b-connection-handle
branch
from
October 11, 2026 19:42
69eb366 to
bb54fd8
Compare
… not a pairing offer Desktop, CLI, web and runtime transports now take a PairedRuntimeConnection (endpoint, pinned host key, credential) instead of a PairingOffer. Offers stay on the pairing input path (codes, QR, links, environment add) and are converted with pairedRuntimeConnectionFromOffer. The credential is token-only today; request envelopes still carry the same deviceToken, so the wire is unchanged. This lets device-key and ticket credentials replace the token later without touching every connect call site again.
OrcaWin
force-pushed
the
np/d2b-connection-handle
branch
from
October 11, 2026 20:20
bb54fd8 to
1e289ba
Compare
This was referenced Oct 11, 2026
6 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ELI5
To talk to a paired Orca host, every client used to carry around the whole "pairing offer", the thing you scan or paste once when you pair. This PR gives clients a small "connection" object instead: where the host is, which host key to expect, and the credential to prove who you are. Pairing offers are still read when you pair; after that, everything connects with the connection object. Nothing changes for users, and nothing changes on the wire.
What Changed
src/shared/paired-runtime-connection.tswithPairedRuntimeConnection = { endpoint, hostPublicKeyB64, credential, pairedDeviceId? }. The credential is the shared handshake'sPairedE2EEAuthCredential, which is{ kind: 'token', deviceToken }today.pairedRuntimeConnectionFromOffer(offer)converts at the pairing boundary.getPreferredPairedRuntimeConnection(environment)next togetPreferredPairingOffer. The web client hasgetPreferredWebRuntimeConnection.PairingOffer.PairedRuntimeConnection. Every place that sends the token readsconnection.credential.deviceToken, so request envelopes and the auth frame carry the same bytes as before.PairingOffer(by design):orca environment addand the environment stores, which persist what was paired;verifiedPairingis nowverifiedConnection.Why
The next pairing steps replace the token with a per-device key (browser first, then desktop and CLI) and add single-use tickets. If every connect call site still took a pairing offer, each of those steps would edit about 50 files and mix a mechanical change with a security change. Moving to a handle first keeps those later PRs small: they change what goes in
credential, not every caller.The alternative was to add optional credential fields to
PairingOffer. That type is also the pairing wire format and the stored record, so widening it would leak client-only state into what hosts and old clients parse.Linked Issue
Part of #17394 / #17399 (preparation). No user-visible fix on its own.
Visual Proof
N/A: a type-level refactor with no UI or behaviour change.
Testing
src/shared/paired-runtime-connection.test.ts(written first): offer to handle, the token accessor, and the environment's preferred endpoint.Updated every transport, IPC, SSH, browser and web test that passed an offer to a connect path; test servers now hand out a connection (and the offer where a test re-encodes a code).
pnpm tc, focused vitest oversrc/shared,src/cli,src/main/{ipc,ssh,browser,runtime},src/renderer/src/{web,runtime}, oxlint,pnpm run check:code-quality:changed,pnpm lint.No cross-version test added: nothing on the wire changes. The B2 cross-version suite (stacked below) still covers the handshake bytes.
Automated tests added/updated
Agent skill upstream boundary
Notes
Stacked on #27523. SSH: managed-server probes and tunnel identity checks connect through the handle; the tunnel endpoint override is applied to the handle exactly as it was to the offer. Windows/Linux/macOS: no platform code.
Checklist
N/Afor visuals, with reason