From 6d167392f6f8ede37e2794a68a3738f8ba03131d Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Wed, 30 Sep 2026 16:58:31 +0200 Subject: feat(client): the desktop application keeps M and every node identity in its main process keyring.js derives, opens, mints, seals, signs and agrees there; the page gets public keys and a handle. Argon2 comes from the page's own WebAssembly build (Electron's crypto has none). Without OS key storage the page keeps its keys as a browser does. A node's bundle is settled after connecting, re-sealed when the key changed. Co-Authored-By: Claude Opus 5.5 --- .../src/meshbay_hub/static/transport-rewrap.js | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) (limited to 'packages/meshbay-hub/src/meshbay_hub/static/transport-rewrap.js') diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport-rewrap.js b/packages/meshbay-hub/src/meshbay_hub/static/transport-rewrap.js index e0ae0fe..8bf884c 100644 --- a/packages/meshbay-hub/src/meshbay_hub/static/transport-rewrap.js +++ b/packages/meshbay-hub/src/meshbay_hub/static/transport-rewrap.js @@ -101,6 +101,22 @@ async function rewrapAllNodes(o) { tp.connect(n.node_id, o.token, g.id, null, null, oldKey, o.username, o.userId, null, recoveryKey, undefined, n.pk_node), 30000, 'connect'); + if (tp.identity && tp.identity.native) { + // The desktop application holds this identity: it seals, and only + // for an account with browser access — without it, nothing of the + // identity is on the node to re-seal. + const P = window.MeshBayPlatform.keys; + if (await P.browserAccess(o.userId)) { + const sealed = await P.sealBundle(o.userId, tp.nodePk, + { pending: Boolean(o.newBundleKey && o.newBundleKey.pending) }); + const rec = o.recoveryKey + ? await P.sealRecovery(o.userId, tp.nodePk, o.recoveryKey, o.username) : null; + await tp.storeKeypairBundle(sealed.bundle, rec); + await P.markSealed(o.userId, tp.nodePk, sealed.fingerprint); + } + anyOk = true; + continue; + } if (tp.newNodeBundle) { // No identity existed on this node — connect just minted one under // the old key. Don't persist it: the next time this group is opened -- cgit v1.2.3