feat(desktop): add secure Continue on phone - #71579

Open

joelbrilliant wants to merge 30 commits into

NousResearch:mainfrom

joelbrilliant:feat/dashboard-qr-handoff

Commits on Aug 2, 2026

feat(dashboard): single-use scoped handoff ticket + gated consume for phone handoff
joelbrilliant
committed
6956c09
fix(dashboard): resume-scoped default-deny authz for phone handoff
joelbrilliant
committed
404b445
fix(dashboard): close handoff WS bind, exact /chat consume, exact resume scopes
joelbrilliant
committed
e2d61c4
fix(dashboard): handoff consume authz ignores X-Forwarded-Prefix
joelbrilliant
committed
70da47c
fix(dashboard): require ASGI raw_path b"/chat" for handoff consume
joelbrilliant
committed
fd1a84e
feat(desktop): add secure continue-on-phone handoff
joelbrilliant
committed
e6512d2
fix(desktop): close continue-on-phone review findings

joelbrilliant
and
claude
committed
ac8137d
feat(dashboard): bind phone handoff PTY resume
joelbrilliant
committed
54803fa
test(desktop): reconcile phone handoff rebase
joelbrilliant
committed
71cb132
fix(dashboard): bind resume event channels
joelbrilliant
committed
c107053
test(dashboard): pin the gated-SPA no-token invariant (phone/remote access)

joelbrilliant
and
claude
committed
27c5148
test(dashboard): make the gated-SPA invariant test seam-independent
joelbrilliant
committed
027f66c
test(dashboard): S4 private runtime proof for phone handoff
joelbrilliant
committed
c71ee56
docs+test(dashboard): S5 handoff TTL, tunnel log risk, browser buildWsUrl
joelbrilliant
committed
8512a2d
fix(tests): don't fail S5 handoff tests when the SPA isn't built
joelbrilliant
committed
807fc98
fix(dashboard): gate public proxy handoffs
joelbrilliant
committed
0ebcdb4
fix(dashboard): keep phone handoff secrets out of request URLs
joelbrilliant
committed
e33becb
Merge remote-tracking branch 'origin/main' into feat/dashboard-qr-handoff
joelbrilliant
committed
40d4f6c
feat(desktop): expire phone handoff codes
joelbrilliant
committed
a773fb4
fix(desktop): bound phone code lifetime
joelbrilliant
committed
c6ad007
feat(dashboard): persist linked phone devices
joelbrilliant
committed
957324c
feat(desktop): manage linked phone devices
joelbrilliant
committed
816f38a
fix(dashboard): remove temporary handoff identity
joelbrilliant
committed
3bf1e88
fix(dashboard): harden persistent linked devices
joelbrilliant
committed
6abe3f9
Merge remote-tracking branch 'origin/main' into feat/dashboard-qr-handoff-focused
joelbrilliant
committed
94a0035

Navigation Menu

feat(desktop): add secure Continue on phone - #71579

feat(desktop): add secure Continue on phone#71579
joelbrilliant wants to merge 30 commits into
NousResearch:mainfrom
joelbrilliant:feat/dashboard-qr-handoff

Commits on Aug 2, 2026

feat(dashboard): single-use scoped handoff ticket + gated consume for phone handoff

fix(dashboard): resume-scoped default-deny authz for phone handoff

fix(dashboard): close handoff WS bind, exact /chat consume, exact resume scopes

fix(dashboard): handoff consume authz ignores X-Forwarded-Prefix

fix(dashboard): require ASGI raw_path b"/chat" for handoff consume

feat(desktop): add secure continue-on-phone handoff

fix(desktop): close continue-on-phone review findings

feat(dashboard): bind phone handoff PTY resume

test(desktop): reconcile phone handoff rebase

fix(dashboard): bind resume event channels

test(dashboard): pin the gated-SPA no-token invariant (phone/remote access)

test(dashboard): make the gated-SPA invariant test seam-independent

test(dashboard): S4 private runtime proof for phone handoff

docs+test(dashboard): S5 handoff TTL, tunnel log risk, browser buildWsUrl

fix(tests): don't fail S5 handoff tests when the SPA isn't built

fix(dashboard): gate public proxy handoffs

fix(dashboard): keep phone handoff secrets out of request URLs

Merge remote-tracking branch 'origin/main' into feat/dashboard-qr-handoff

feat(desktop): expire phone handoff codes

fix(desktop): bound phone code lifetime

feat(dashboard): persist linked phone devices

feat(desktop): manage linked phone devices

fix(dashboard): remove temporary handoff identity

fix(dashboard): harden persistent linked devices

Merge remote-tracking branch 'origin/main' into feat/dashboard-qr-handoff-focused

Commits on Aug 3, 2026

fix(desktop): share phone handoff tickets across local processes

fix(desktop): keep linked-phone backend loopback-only

feat(web): render linked phones as chat-only clients

fix(dashboard): harden cross-process phone handoff

feat(desktop): surface phone remote control