[deymosh]

The bridge's web page, signed in from a paired phone, and the phone's list of the browsers signed in. Rebased onto the terminal (#142).

What

• Protocol — web-sign-in {code} (phone → bridge) and web-sign-in-result {code, signedIn}; web-browsers-request and web-browser-sign-out {id} (phone → bridge) answered with web-browsers {browsers} to the asking client only (a sign-out is answered with the fresh list). A browser's id is the page's short public id, never its key or cookie. Corpus fixtures for all.
• Bridge — a web page on the direct link's wss:// port: the same listener and certificate, with a WebSocket upgrade still going to the direct link. Plain http:// redirects to https://; the onion listener serves no page. Sign-in uses a code plus a QR (codedeck://web-sign-in?machine=<npub>&code=) confirmed from a paired phone. The engine (engine/web.rs) matches each code once, within 5 minutes; the page withdraws a code it stops showing (WebSignInWithdrawn).
• Tabs:
  • Overview — the heartbeat: bridge, direct link, agents and credential status, sessions.
  • Usage — per agent: sessions, what runs or waits, transcript size, models; then each session's context fill. All of it comes from the heartbeat, with no new request.
  • Browsers — the signed-in browsers, each with Sign out.
  • Devices — the paired phones, read-only.
  • Settings — the safe set the user chose (machine name, relays, direct link addresses, transcripts kept, admin tokens write-only). Everything else is read-only: workspace roots, Tor proxy, node and agent-host paths, listeners. A stolen cookie must not be able to run a program, drop Tor or widen file access.
• Hardening — a Host allowlist; an Origin check on every POST; CSP, no-store, nosniff and frame-deny on every response; a __Host- cookie (Secure, HttpOnly, SameSite=Strict, 30 days) whose SHA-256, never the token itself, is what web-sessions.json (0600) keeps across restarts; sign-in starts rate-limited per address (IPv6 per /64); caps on pending codes (the engine's own count), on sessions (64) and on request sizes.
• No cost to the phones' links — the bridge runs on one thread shared with the relays, the engine and the direct links. Page file writes run on their own thread, and a config write on the blocking pool. At most 16 page requests are served at once (503 past that), and one host may hold at most 8 of the listener's 64 connections.
• Phone — the WebSignIn / ClearWebSignIn / RequestWebBrowsers / SignOutWebBrowser intents and the UI view's webSignIn and webBrowsers. A machine's page gets a "Web page" group (its https addresses) and a "Browsers" page: scan the QR in the app's own scanner, or type the code; then the browsers signed in now, each signed out after a confirmation. A QR naming another machine is refused, and there is deliberately no deep link. It is wired in the shell and in Settings, with snapshots.
• Docs — PROTOCOL.md (the wire), BRIDGE.md (the page, its hardening, its files), CLIENT.md (the phone page), README.

Traffic cost

Two small command-class events per sign-in, and nothing while no one signs in. The browser list costs one request and one answer when the phone's Browsers page opens (and after a sign-in from it), one sign-out and one answer per sign-out; never polled. The page polls the bridge over HTTPS: every 2 s while a code is pending, every 5 s on the dashboard. None of that is Nostr traffic.

Breaking

New protocol messages, no migration.

Verified

• ./codedeck check green; cargo doc --workspace --no-deps and clippy with -D warnings; bindings regenerated with no drift.
• Android test verifyPaparazziDebug lintDebug: 203 tests, "No issues found". New snapshots: the Browsers page with its list, while asking, and with none; the machine page with the Terminal and the Web page groups together.
• The development switch CODEDECK_WEB_NO_SIGN_IN is removed (bridge, page banner, compose file).
• Earlier bug hunts' findings all fixed; one more runs on the browsers list. Still owed: a sign-in and the tabs on the maintainer's own device and browser.

🤖 Generated with Claude Code