Repository navigation
feat(mobile): require a desktop PIN for internet pairing - #426
Merged
Merged
Conversation
Wi-Fi can connect on scan, but a public tunnel URL can leak, so the phone must enter a 6-digit password shown only on the computer. Co-authored-by: Cursor <cursoragent@cursor.com>
隧道入口也落在 127.0.0.1，只认转发地址会把 PIN 漏到公网；Windows 覆盖长效 PIN 前先删旧文件。 Co-authored-by: Cursor <cursoragent@cursor.com>
The overlay covered the composer. Keep the field in place when the hint is hidden. Co-authored-by: Cursor <cursoragent@cursor.com>
Fairy-happy
force-pushed
the
feat/mobile-pairing-pin
branch
from
September 17, 2026 10:21
7b1ef87 to
31d6656
Compare
Co-authored-by: Cursor <cursoragent@cursor.com>
Tunnel requests can share loopback sockets and spoof Host, so PIN visibility now requires a one-time bootstrap token exchanged for an HttpOnly desktop cookie. Same-IP cookie promotion is LAN-only. Co-authored-by: Cursor <cursoragent@cursor.com>
yaojin3616
pushed a commit
that referenced
this pull request
Sep 21, 2026
* 修复上传与回答中的文档预览 (#434) * 修复上传与回答中的文档预览：走附件真实路径，失败则本机打开 官方已支持输入框拖文件、回形针和默认工作区，不再重复实现。预览统一通过 fileHostPath 打开右侧面板，插件关闭或渲染失败时回退系统应用。 Co-authored-by: Cursor <cursoragent@cursor.com> * fix(preview): match Windows attachment names without case and keep images if aliasing fails Explorer treats names as case-insensitive, and a failed hard-link should not block opening the original image path. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: fairy <3054158379@qq.com> Co-authored-by: Cursor <cursoragent@cursor.com> * feat: built-in image generation plugin (#447) * feat: add shared OpenAI and ByteDance image generation plugin * fix: align image settings and support Electron image writer * fix: use Seedream single-image contract and retain provider diagnostics * feat(image-generation): streamline calls and preview generated images * fix(image-generation): use shared dropdown menus * fix(image-generation): complete Seedream model presets * fix(image): resolve Harness session IDs for conversation previews * test(image): align migration with current session format * test(image): scope credential mode assertion to POSIX * fix(release): type rollout configuration tests * docs: refresh main migration evidence * fix(runtime): await failed Harness shutdown * ci: retry Windows verification * 加固生图插件：未配置时禁止引导调用，并隔离 sharp 启动风险 Co-authored-by: Cursor <cursoragent@cursor.com> * fix(image-generation): fail closed on unread settings and buffer Host GET routes Credential read failures must not look like an empty revision-0 store, and exact GET routes need a buffered body so Host preview and settings reach the plugin. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Jianghan <58623049+SuperstructureJH@users.noreply.github.com> Co-authored-by: fairy <3054158379@qq.com> Co-authored-by: Cursor <cursoragent@cursor.com> * feat(mobile): require a desktop PIN for internet pairing (#426) * feat(mobile): require a desktop PIN for internet pairing Wi-Fi can connect on scan, but a public tunnel URL can leak, so the phone must enter a 6-digit password shown only on the computer. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(mobile): 桌面 PIN 仅对本机 socket 可见 隧道入口也落在 127.0.0.1，只认转发地址会把 PIN 漏到公网；Windows 覆盖长效 PIN 前先删旧文件。 Co-authored-by: Cursor <cursoragent@cursor.com> * fix(mobile): dock the Pinggy expiry hint below the input The overlay covered the composer. Keep the field in place when the hint is hidden. Co-authored-by: Cursor <cursoragent@cursor.com> * chore: add agents-standards-review.zh.md to .gitignore * fix(mobile): center the Pinggy expiry hint Co-authored-by: Cursor <cursoragent@cursor.com> * fix(mobile): bind desktop PIN routes to a session cookie Tunnel requests can share loopback sockets and spoof Host, so PIN visibility now requires a one-time bootstrap token exchanged for an HttpOnly desktop cookie. Same-IP cookie promotion is LAN-only. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: fairy <3054158379@qq.com> Co-authored-by: Cursor <cursoragent@cursor.com> * fix(diagnostics): 停用 unclean-exit 误报弹窗 (#448) 覆盖安装、强杀和首启未就绪会留下同版本 session marker，反复弹出故障报告；不再采集此类报告，已入队的也静默丢弃。 Co-authored-by: fairy <3054158379@qq.com> * fix(ppt): keep template previews inside gallery cells (#449) Selection borders and focus outlines overflowed the grid. Keep the 2px border inside each cell, drop the default gray inset, and disable native image dragging so Electron does not pull a ghost thumbnail. Co-authored-by: fairy <3054158379@qq.com> * fix(ppt): validate literal newline escapes before export (#453) * fix(ppt): keep template previews inside gallery cells Selection borders and focus outlines overflowed the grid. Keep the 2px border inside each cell, drop the default gray inset, and disable native image dragging so Electron does not pull a ghost thumbnail. * fix(ppt): validate literal newline escapes before export Block leftover \n/\r in text and table cells so slides no longer show escape residue, while real YAML line breaks still export. --------- Co-authored-by: fairy <3054158379@qq.com> * 修复 Windows CI 清理临时目录时的 EBUSY 误报 存储测试在异步 flush 后立刻删除目录，GitHub Windows runner 上文件句柄尚未释放会导致 rmdir 失败。对锁定错误做短重试，避免测试本身已通过却被清理拖垮。 Co-authored-by: Cursor <cursoragent@cursor.com> * feat(ppt): 在 V0.9.1 上加入 Green Pulse 可编辑配图模板 (#465) * feat(ppt): 在 V0.9.1 上加入个人模板上传与复用 基于最新 V0.9.1 重做个人模板能力，保留画廊预览与换行导出修复，并限制上传体积、按页返回审查预览。 * fix(ppt): accept OOXML that undeclares unused namespace prefixes WPS and PowerPoint emit xmlns:foo="", which JSDOM's well-formed outerHTML rejects during personal-template conversion. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(ppt): ship Green Pulse as a bundled editable image template Give the catalog a reviewed 22-page PPTD project with hashed copy, image-slot contracts, and chart export fixes so image-assisted decks do not depend on personal uploads. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ppt): load personal-template limits from the packed runtime in tests Avoid Vite parsing the CLI bundle via a source import, which fails Windows CI with a SyntaxError before any test runs. Co-authored-by: Cursor <cursoragent@cursor.com> * 修复 Windows CI 清理 startup-failure 临时目录时的 EBUSY 误报 Harness 子进程刚退出后立刻 rmdir，GitHub Windows runner 上句柄未释放会拖垮已通过的测试。对锁定错误做短重试。 --------- Co-authored-by: fairy <3054158379@qq.com> * fix(patch): 修正合入 main 后 dsh 补丁 hunk 行数 Git 自动合并把生图与 log-bridge 依赖拼进同一 hunk，却仍写 +12，patch-package 在 Windows 上会直接解析失败。 Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: fairy <3054158379@qq.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Jianghan <58623049+SuperstructureJH@users.noreply.github.com>
yaojin3616
added a commit
that referenced
this pull request
Sep 22, 2026
* 修复上传与回答中的文档预览 (#434) * 修复上传与回答中的文档预览：走附件真实路径，失败则本机打开 官方已支持输入框拖文件、回形针和默认工作区，不再重复实现。预览统一通过 fileHostPath 打开右侧面板，插件关闭或渲染失败时回退系统应用。 Co-authored-by: Cursor <cursoragent@cursor.com> * fix(preview): match Windows attachment names without case and keep images if aliasing fails Explorer treats names as case-insensitive, and a failed hard-link should not block opening the original image path. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: fairy <3054158379@qq.com> Co-authored-by: Cursor <cursoragent@cursor.com> * feat: built-in image generation plugin (#447) * feat: add shared OpenAI and ByteDance image generation plugin * fix: align image settings and support Electron image writer * fix: use Seedream single-image contract and retain provider diagnostics * feat(image-generation): streamline calls and preview generated images * fix(image-generation): use shared dropdown menus * fix(image-generation): complete Seedream model presets * fix(image): resolve Harness session IDs for conversation previews * test(image): align migration with current session format * test(image): scope credential mode assertion to POSIX * fix(release): type rollout configuration tests * docs: refresh main migration evidence * fix(runtime): await failed Harness shutdown * ci: retry Windows verification * 加固生图插件：未配置时禁止引导调用，并隔离 sharp 启动风险 Co-authored-by: Cursor <cursoragent@cursor.com> * fix(image-generation): fail closed on unread settings and buffer Host GET routes Credential read failures must not look like an empty revision-0 store, and exact GET routes need a buffered body so Host preview and settings reach the plugin. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Jianghan <58623049+SuperstructureJH@users.noreply.github.com> Co-authored-by: fairy <3054158379@qq.com> Co-authored-by: Cursor <cursoragent@cursor.com> * feat(mobile): require a desktop PIN for internet pairing (#426) * feat(mobile): require a desktop PIN for internet pairing Wi-Fi can connect on scan, but a public tunnel URL can leak, so the phone must enter a 6-digit password shown only on the computer. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(mobile): 桌面 PIN 仅对本机 socket 可见 隧道入口也落在 127.0.0.1，只认转发地址会把 PIN 漏到公网；Windows 覆盖长效 PIN 前先删旧文件。 Co-authored-by: Cursor <cursoragent@cursor.com> * fix(mobile): dock the Pinggy expiry hint below the input The overlay covered the composer. Keep the field in place when the hint is hidden. Co-authored-by: Cursor <cursoragent@cursor.com> * chore: add agents-standards-review.zh.md to .gitignore * fix(mobile): center the Pinggy expiry hint Co-authored-by: Cursor <cursoragent@cursor.com> * fix(mobile): bind desktop PIN routes to a session cookie Tunnel requests can share loopback sockets and spoof Host, so PIN visibility now requires a one-time bootstrap token exchanged for an HttpOnly desktop cookie. Same-IP cookie promotion is LAN-only. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: fairy <3054158379@qq.com> Co-authored-by: Cursor <cursoragent@cursor.com> * fix(diagnostics): 停用 unclean-exit 误报弹窗 (#448) 覆盖安装、强杀和首启未就绪会留下同版本 session marker，反复弹出故障报告；不再采集此类报告，已入队的也静默丢弃。 Co-authored-by: fairy <3054158379@qq.com> * fix(ppt): keep template previews inside gallery cells (#449) Selection borders and focus outlines overflowed the grid. Keep the 2px border inside each cell, drop the default gray inset, and disable native image dragging so Electron does not pull a ghost thumbnail. Co-authored-by: fairy <3054158379@qq.com> * fix(ppt): validate literal newline escapes before export (#453) * fix(ppt): keep template previews inside gallery cells Selection borders and focus outlines overflowed the grid. Keep the 2px border inside each cell, drop the default gray inset, and disable native image dragging so Electron does not pull a ghost thumbnail. * fix(ppt): validate literal newline escapes before export Block leftover \n/\r in text and table cells so slides no longer show escape residue, while real YAML line breaks still export. --------- Co-authored-by: fairy <3054158379@qq.com> * 修复 Windows CI 清理临时目录时的 EBUSY 误报 存储测试在异步 flush 后立刻删除目录，GitHub Windows runner 上文件句柄尚未释放会导致 rmdir 失败。对锁定错误做短重试，避免测试本身已通过却被清理拖垮。 Co-authored-by: Cursor <cursoragent@cursor.com> * feat(ppt): 在 V0.9.1 上加入 Green Pulse 可编辑配图模板 (#465) * feat(ppt): 在 V0.9.1 上加入个人模板上传与复用 基于最新 V0.9.1 重做个人模板能力，保留画廊预览与换行导出修复，并限制上传体积、按页返回审查预览。 * fix(ppt): accept OOXML that undeclares unused namespace prefixes WPS and PowerPoint emit xmlns:foo="", which JSDOM's well-formed outerHTML rejects during personal-template conversion. Co-authored-by: Cursor <cursoragent@cursor.com> * feat(ppt): ship Green Pulse as a bundled editable image template Give the catalog a reviewed 22-page PPTD project with hashed copy, image-slot contracts, and chart export fixes so image-assisted decks do not depend on personal uploads. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ppt): load personal-template limits from the packed runtime in tests Avoid Vite parsing the CLI bundle via a source import, which fails Windows CI with a SyntaxError before any test runs. Co-authored-by: Cursor <cursoragent@cursor.com> * 修复 Windows CI 清理 startup-failure 临时目录时的 EBUSY 误报 Harness 子进程刚退出后立刻 rmdir，GitHub Windows runner 上句柄未释放会拖垮已通过的测试。对锁定错误做短重试。 --------- Co-authored-by: fairy <3054158379@qq.com> * feat(enterprise): add BiSheng gateway login on 0.9.1 without sending … (#457) * feat(enterprise): add BiSheng gateway login on 0.9.1 without sending tokens into Harness Keep market 1.45.1, migration protocol 6, and safe-mode inspect-only; chat goes through a main-process SSE proxy. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(enterprise): normalize CRLF before matching the desktop patch Windows checkout turns the YAML into CRLF, so the inject assertion must not depend on LF-only line endings. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(enterprise): wait for the model catalog after login in Windows CI commitSession publishes connected before models sync, so assertions must wait for modelsAvailable. Also match the desktop patch without depending on LF-only regex groups. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(enterprise): wait for per-model usage after login modelsAvailable flips true before GET /usage finishes, so the PKCE test must wait for bisheng:42 used tokens. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(enterprise): defer connected until per-model usage sync completes Keep phase as refreshing after commitSession so settings keep polling until syncCatalog finishes usage, avoiding the empty first-load model usage state. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(enterprise): publish models before usage and sync the chat adapter on settings reads Existing sessions missed the enterprise catalog after login because revision waited on usage and the idle adapter poll was too slow. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(enterprise): follow the product locale for settings and known chat errors The enterprise settings page ignored Settings -> General language changes, and desktop-owned chat failures stayed English. Register the settings copy with the locale service and localize known adapter fallbacks without rewriting platform messages. --------- Co-authored-by: fairy <3054158379@qq.com> * fix(patch): 修正合入 main 后 dsh 补丁 hunk 行数 Git 自动合并把生图与 log-bridge 依赖拼进同一 hunk，却仍写 +12，patch-package 在 Windows 上会直接解析失败。 Co-authored-by: Cursor <cursoragent@cursor.com> * feat(enterprise): 展示视觉模型标识并精简 Token 用量 (#484) * feat(enterprise): show managed vision and compact model usage * feat(settings): polish enterprise account UI and align section titles Add a pill Learn about Enterprise control, refresh enterprise copy, and match settings page titles to the plugins heading style. * feat(enterprise): reframe intranet HTTP confirmation around a trusted source Ask users to confirm the cleartext service URL comes from a trusted origin before login. --------- Co-authored-by: Jianghan <58623049+SuperstructureJH@users.noreply.github.com> Co-authored-by: fairy <3054158379@qq.com> * fix(enterprise): 补齐登录元数据、桌面唤回与旧设置迁移 (#494) 从 #492 干净重投登录版本字段、登录后唤回桌面和旧预览设置清理，并加固迁移失败路径，避免把 0.9.1 历史或 #484 已合内容带进 V0.9.2。 Co-authored-by: fairy <3054158379@qq.com> * fix(models): show display names in model switch notices (#482) * fix(enterprise): keep the Learn more pill readable in dark theme The hardcoded white background hid the label after the host switched text color. Use theme tokens and tidy the settings client so the control follows light and dark modes. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(enterprise): drop account from the English nav label The settings sidebar should read Enterprise, matching the shorter product name. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(enterprise): 将了解企业版链接改为官网企业部署页 (#495) Co-authored-by: fairy <3054158379@qq.com> * feat(enterprise): 在 V0.9.2 加入企业插件市场 (#519) * feat(enterprise): add managed plugin market on V0.9.2 * fix(enterprise): enforce market runtime and lifecycle contracts * test(enterprise): support signed test builds with desktop minimum 0.9.1 * feat(enterprise): 优化企业账号与模型列表布局 (#527) * feat(enterprise): simplify account and model settings layout * fix(enterprise): label displayed identity as current account * fix(enterprise): point Learn more at the deployment page Co-authored-by: Cursor <cursoragent@cursor.com> * fix(test): drop the enterprise packer shebang so Windows CI can load it Vite's SSR transform only strips LF hashbangs. A CRLF checkout leaves #! in the module and fails enterprise-market tests with a syntax error. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(startup): make recovery independent of profile links (#504) * fix(ppt): avoid duplicate profile and desktop composition * fix(startup): establish market baseline and isolate recovery boot * fix(recovery): resolve agent presets from host installation * fix(startup): resolve linked plugin host peers * fix(startup): retry stale host peer subpaths and keep the original failure Field crash reports show the host peer fallback missing its main case: a plugin resolving an older copy of a @deepseek-ai package from the shared Profile tree fails with ERR_PACKAGE_PATH_NOT_EXPORTED, not not-found. The retry is safe because it only succeeds when the installation really exports that subpath. Reports also lose `code` to the loader's wrapper, so the first failure's "imported from <plugin>" is all that still names the faulty plugin; the host retry now augments that error instead of replacing it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(startup): keep recovery proportional to the fault it found Two startup faults sent users to Safe Mode with no way out of it. A bundle declared in the manifest but no longer installed fails the boot preflight, and Safe Mode cannot clear it: disabling a plugin writes a patch row, while the fault lives in dsh.profile.bundles. Startup now drops those third-party declarations once and re-checks before giving up, and carries the failing package name through so Safe Mode lists it. Core bundles, host packages, package files, user patch rows and plugin data are never touched; pnpm-lock.yaml is dropped so the next install re-resolves. This is a narrow, declaration-only exception to "startup leaves destructive repair to recovery", recorded in the module docstring and the architecture notes. A market baseline that cannot be installed no longer blocks the boot on its own. pnpm fetch failures, 404s and EPERM are ordinary on restricted networks and account for roughly 130 field reports; startup only enters Safe Mode when the market already in the profile is absent, unreadable or still owned by a generation. The pending marker keeps the repair queued for the next launch, and an unreadable marker no longer throws the boot away either. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * chore: guard the client anchor lookup and the fallback's packaging The client-modules patch dereferenced ctx.loader without the optional chain its paired agent-presets patch uses. host-module-fallback.mjs is a top-level import of the Harness entry, so leaving it out of extraResources would stop the entry loading rather than degrade the fallback; assert it is packaged. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * fix(enterprise): hide the trusted-source prompt after sign-in Returning from the browser reopened the confirmation under an already connected account. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: fairy <3054158379@qq.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: Jianghan <58623049+SuperstructureJH@users.noreply.github.com> Co-authored-by: 姚劲 <yaoj.alex@gmail.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Wi-Fi can connect on scan, but a public tunnel URL can leak, so the phone must enter a 6-digit password shown only on the computer.