Val Alexander
|
36df0d93b9
|
fix: repair iOS LAN pairing
Fix iOS LAN/setup-code pairing policy for #47887.
- Allow explicit private LAN and .local plaintext ws:// setup/manual connects where policy allows it.
- Keep public hosts, .ts.net, and Tailscale CGNAT plaintext fail-closed.
- Prefer explicit passwords over stale bootstrap tokens in Swift and TypeScript gateway clients.
- Update setup-code/device-pair coverage, docs, and changelog with source credit for #65185.
Verification:
- pnpm install
- git diff --check origin/main..HEAD
- pnpm exec oxfmt --check --threads=1 src/gateway/client.ts src/gateway/client.test.ts src/pairing/setup-code.ts src/pairing/setup-code.test.ts extensions/device-pair/index.ts extensions/device-pair/index.test.ts
- pnpm format:docs:check
- pnpm test src/gateway/client.test.ts src/pairing/setup-code.test.ts extensions/device-pair/index.test.ts
- cd apps/shared/OpenClawKit && swift test --filter 'DeepLinksSecurityTests|GatewayNodeSessionTests'
- pnpm lint:swift passes with the existing TalkModeRuntime.swift type-body-length warning
Blocked locally:
- iOS app-target xcodebuild tests require unavailable watchOS 26.4 runtime here.
- Testbox check:changed previously failed because the image lacks swiftlint; local swiftlint passes.
|
2026-05-05 21:07:19 -05:00 |
|
Nimrod Gutman
|
69fe999373
|
fix(pairing): restore qr bootstrap onboarding handoff (#58382) (thanks @ngutman)
* fix(pairing): restore qr bootstrap onboarding handoff
* fix(pairing): tighten bootstrap handoff follow-ups
* fix(pairing): migrate legacy gateway device auth
* fix(pairing): narrow qr bootstrap handoff scope
* fix(pairing): clear ios tls trust on onboarding reset
* fix(pairing): restore qr bootstrap onboarding handoff (#58382) (thanks @ngutman)
|
2026-03-31 21:11:35 +03:00 |
|
Peter Steinberger
|
8553d22428
|
refactor(tests): dedupe ios gateway and deeplink fixtures
|
2026-03-02 09:55:46 +00:00 |
|
Mariano Belinky
|
d06d8701fd
|
iOS: normalize watch quick actions and fix test signing
|
2026-02-24 15:16:11 +00:00 |
|
Mariano
|
fe3215092c
|
test(ios): cover IPv4-mapped IPv6 loopback in manual TLS policy (#22045)
Merged via /review-pr -> /prepare-pr -> /merge-pr.
Prepared head SHA: ec952f0a80
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Reviewed-by: @mbelinky
|
2026-02-20 17:23:33 +00:00 |
|
Mariano
|
8fa46d709a
|
fix(ios): force tls for non-loopback manual gateway hosts (#21969)
Merged via /review-pr -> /prepare-pr -> /merge-pr.
Prepared head SHA: 9fb39f566e
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Co-authored-by: mbelinky <132747814+mbelinky@users.noreply.github.com>
Reviewed-by: @mbelinky
|
2026-02-20 16:28:47 +00:00 |
|
Peter Steinberger
|
054366dea4
|
fix(security): require explicit trust for first-time TLS pins
|
2026-02-14 17:55:20 +01:00 |
|
Peter Steinberger
|
d583782ee3
|
fix(security): harden discovery routing and TLS pins
|
2026-02-14 17:18:14 +01:00 |
|