feat(node): accept a device link request before the proof (MNP 6.3)

A new device of a known account holds no identity the node pinned, so it
cannot complete a handshake until a pinned device approves it: it now files
device_add_request in the pre-proof window, as the desktop app's case
already required. The request stays inert until countersigned; at most 10
are pending per account, the oldest dropped. A 6.2 node answers it
"Handshake required", which a client reads as "cannot link here".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2 files changed, 133 insertions, 85 deletions

diff --git a/packages/meshbay-node/tests/golden/dispatch.json b/packages/meshbay-node/tests/golden/dispatch.json
index 384c38f..f478ee0 100644
--- a/packages/meshbay-node/tests/golden/dispatch.json
+++ b/packages/meshbay-node/tests/golden/dispatch.json
@@ -2036,7 +2036,7 @@
      "subject": "x",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -2359,7 +2359,7 @@
      "subject": "gggggggggggggggggggggggggggggggg",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -2378,7 +2378,7 @@
      "subject": "['x']",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -2397,7 +2397,7 @@
      "subject": "7",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -2416,7 +2416,7 @@
      "subject": "x",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -2686,7 +2686,7 @@
      "messages": [],
      "req_id": 4242,
      "type": "chat_hist_resp",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -2700,7 +2700,7 @@
      "messages": [],
      "req_id": 4242,
      "type": "chat_hist_resp",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -2714,7 +2714,7 @@
      "messages": [],
      "req_id": 4242,
      "type": "chat_hist_resp",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -2728,7 +2728,7 @@
      "messages": [],
      "req_id": 4242,
      "type": "chat_hist_resp",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -2742,7 +2742,7 @@
      "messages": [],
      "req_id": 4242,
      "type": "chat_hist_resp",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -2756,7 +2756,7 @@
      "messages": [],
      "req_id": 4242,
      "type": "chat_hist_resp",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -2770,7 +2770,7 @@
      "messages": [],
      "req_id": 4242,
      "type": "chat_hist_resp",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -2784,7 +2784,7 @@
      "messages": [],
      "req_id": 4242,
      "type": "chat_hist_resp",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -3999,7 +3999,7 @@
      "subject": "gggggggggggggggggggggggggggggggg",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -4018,7 +4018,7 @@
      "subject": "gggggggggggggggggggggggggggggggg",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -4037,7 +4037,7 @@
      "subject": "gggggggggggggggggggggggggggggggg",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -4056,7 +4056,7 @@
      "subject": "gggggggggggggggggggggggggggggggg",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -4700,50 +4700,34 @@
   "device_add_request | challenged | bare": {
    "audit": [],
    "log": [],
-   "sent": [
-    {
-     "detail": "Handshake required",
-     "req_id": 4242,
-     "type": "error"
-    }
-   ],
-   "spawned": []
+   "sent": [],
+   "spawned": [
+    "_do_device_request"
+   ]
   },
   "device_add_request | challenged | lists": {
    "audit": [],
    "log": [],
-   "sent": [
-    {
-     "detail": "Handshake required",
-     "req_id": 4242,
-     "type": "error"
-    }
-   ],
-   "spawned": []
+   "sent": [],
+   "spawned": [
+    "_do_device_request"
+   ]
   },
   "device_add_request | challenged | numbers": {
    "audit": [],
    "log": [],
-   "sent": [
-    {
-     "detail": "Handshake required",
-     "req_id": 4242,
-     "type": "error"
-    }
-   ],
-   "spawned": []
+   "sent": [],
+   "spawned": [
+    "_do_device_request"
+   ]
   },
   "device_add_request | challenged | strings": {
    "audit": [],
    "log": [],
-   "sent": [
-    {
-     "detail": "Handshake required",
-     "req_id": 4242,
-     "type": "error"
-    }
-   ],
-   "spawned": []
+   "sent": [],
+   "spawned": [
+    "_do_device_request"
+   ]
   },
   "device_add_request | fresh | bare": {
    "audit": [],
@@ -10175,7 +10159,7 @@
      "subject": "link:gggggggggggggggggggggggggggggggg",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -12274,7 +12258,7 @@
      "subject": "['x']",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -12293,7 +12277,7 @@
      "subject": "7",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -12312,7 +12296,7 @@
      "subject": "x",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -13413,7 +13397,7 @@
      "req_id": 4242,
      "token": null,
      "type": "pong",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -13428,7 +13412,7 @@
       "x"
      ],
      "type": "pong",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -13441,7 +13425,7 @@
      "req_id": 4242,
      "token": 7,
      "type": "pong",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -13454,7 +13438,7 @@
      "req_id": 4242,
      "token": "x",
      "type": "pong",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -13467,7 +13451,7 @@
      "req_id": 4242,
      "token": null,
      "type": "pong",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -13482,7 +13466,7 @@
       "x"
      ],
      "type": "pong",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -13495,7 +13479,7 @@
      "req_id": 4242,
      "token": 7,
      "type": "pong",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -13508,7 +13492,7 @@
      "req_id": 4242,
      "token": "x",
      "type": "pong",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -13843,7 +13827,7 @@
      "subject": "['x']",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -13862,7 +13846,7 @@
      "subject": "7",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -13881,7 +13865,7 @@
      "subject": "x",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -14216,7 +14200,7 @@
      "subject": "['x']",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -14235,7 +14219,7 @@
      "subject": "7",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -14254,7 +14238,7 @@
      "subject": "x",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -14589,7 +14573,7 @@
      "subject": "['x']",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -14608,7 +14592,7 @@
      "subject": "7",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -14627,7 +14611,7 @@
      "subject": "x",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -14962,7 +14946,7 @@
      "subject": "['x']",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -14981,7 +14965,7 @@
      "subject": "7",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -15000,7 +14984,7 @@
      "subject": "x",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -15335,7 +15319,7 @@
      "subject": "['x']",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -15354,7 +15338,7 @@
      "subject": "7",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -15373,7 +15357,7 @@
      "subject": "x",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -18000,7 +17984,7 @@
      "subject": "{\"language\":null,\"token\":null}",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
@@ -18043,7 +18027,7 @@
      "subject": "{\"language\":\"x\",\"token\":\"sha256:2d711642b726b04401627ca9fbac32f5c8530fb1903cc4db02258717921a4881\"}",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "6.2"
+     "v": "6.3"
     }
    ],
    "spawned": []
diff --git a/packages/meshbay-node/tests/test_device_linking.py b/packages/meshbay-node/tests/test_device_linking.py
index 344c252..7f67b66 100644
--- a/packages/meshbay-node/tests/test_device_linking.py
+++ b/packages/meshbay-node/tests/test_device_linking.py
@@ -76,6 +76,7 @@ async def _session(tmp_path: Path, roster, user_id: str = "alice"):
     session._pinned_pk = ""
     session._uploads = {}
     session._nonce_node = NONCE
+    session._gek_challenge = None
     session._remote_ip = ""
     session.sent = []
     session._send = session.sent.append
@@ -85,19 +86,18 @@ async def _session(tmp_path: Path, roster, user_id: str = "alice"):
 
 async def test_device_messages_need_an_authenticated_session(tmp_path, roster):
     """
-    Filing a device is not a pre-proof message, and must not become one.
+    Every device message but the request is answered on an authenticated session
+    only, and the request needs at least a challenge outstanding.
 
-    The pre-proof window exists for what a peer needs *in order to* prove
-    possession of the group key, and adding a device is not that: the request is
-    countersigned later by a device already pinned, so nothing is lost by
-    requiring the caller to finish its own handshake first. Left in the window it
-    would be a second thing a hub that forges a JWT could reach.
+    Looking up, approving, listing, revoking and saying hello are things a device
+    already pinned does, so it can finish its own handshake first and nothing is
+    lost. Filing is the exception (`test_a_new_device_files_before_the_proof`).
 
     Driven through the real dispatcher, because this is a property of the order
     of its branches and of nothing else.
     """
     session = await _session(tmp_path, roster)
-    session._user_id = None            # challenged, has not proved anything yet
+    session._user_id = None            # has not proved anything yet
     _sk, pk_ed, pk_x = _keys()
 
     for mtype in ("device_add_request", "device_hello", "device_lookup",
@@ -108,6 +108,70 @@ async def test_device_messages_need_an_authenticated_session(tmp_path, roster):
         assert _last(session) == {"type": "error",
                                   "detail": "Handshake required"}, mtype
 
+    session._gek_challenge = b"challenge outstanding"
+    for mtype in ("device_hello", "device_lookup", "device_add", "device_list",
+                  "device_revoke"):
+        session.sent.clear()
+        session._dispatch_message({"type": mtype, "pk_ed25519": pk_ed,
+                                   "pk_x25519": pk_x})
+        assert _last(session) == {"type": "error",
+                                  "detail": "Handshake required"}, mtype
+
+
+async def test_a_new_device_files_before_the_proof(tmp_path, roster):
+    """
+    A machine with no key on this node cannot prove the group key — the key is
+    wrapped for a pinned identity, and it has none — so the request that will
+    give it one is served in the pre-proof window, for the account the token
+    names. Filing admits nothing: the approval below is what does.
+    """
+    import asyncio
+    sk_old, pk_old_ed, pk_old_x = _keys()
+    await roster.pin_identity("alice", "alice", pk_old_ed, pk_old_x, "code")
+    sk_new, pk_new_ed, pk_new_x = _keys()
+
+    session = await _session(tmp_path, roster)
+    session._user_id = None
+    session._username = None
+    session._pending_sub = "alice"
+    session._pending_username = "alice"
+    session._gek_challenge = b"challenge outstanding"
+    spawned = []
+    session._spawn = lambda coro: spawned.append(asyncio.ensure_future(coro))
+    session._audit_join = lambda *a, **k: None
+
+    code = generate_code()
+    code_hash = device_code_hash(normalize_code(code), pk_new_ed, pk_new_x)
+    ts = int(time.time())
+    transcript = device_request_transcript(
+        node_pk_b64=session._node_pk_b64(), user_id="alice", pk_ed25519_b64=pk_new_ed,
+        pk_x25519_b64=pk_new_x, code_hash=code_hash, nonce_node=NONCE, ts=ts)
+    session._dispatch_message({
+        "type": "device_add_request", "pk_ed25519": pk_new_ed, "pk_x25519": pk_new_x,
+        "code_hash": code_hash, "ts": ts,
+        "sig": base64.b64encode(sk_new.sign(transcript)).decode()})
+    await asyncio.gather(*spawned)
+    assert _last(session)["type"] == MNP.DEVICE_REQUEST_ACK
+
+    # Inert until a pinned device countersigns.
+    assert await roster.find_device("alice", pk_new_ed) is None
+    pending = await roster.list_device_requests("alice")
+    assert [r["pk_ed25519"] for r in pending] == [pk_new_ed]
+
+
+async def test_pending_device_requests_are_bounded_per_account(tmp_path, roster):
+    """Filing needs only a token, so the table it writes has a ceiling."""
+    sk_old, pk_old_ed, pk_old_x = _keys()
+    await roster.pin_identity("alice", "alice", pk_old_ed, pk_old_x, "code")
+    filed = []
+    for i in range(roster.MAX_PENDING_DEVICE_REQUESTS + 3):
+        _sk, pk_ed, pk_x = _keys()
+        await roster.file_device_request("alice", "alice", pk_ed, pk_x, f"hash-{i:02d}")
+        filed.append(f"hash-{i:02d}")
+    kept = {r["code_hash"] for r in await roster.list_device_requests("alice")}
+    # The oldest make room — filed within the same second, so by filing order.
+    assert kept == set(filed[-roster.MAX_PENDING_DEVICE_REQUESTS:])
+
 
 def _last(session):
     return session.sent[-1] if session.sent else {}