From 28c88908b88c58cba4de08710f6bb268ede02d57 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Wed, 14 Oct 2026 22:20:15 +0200 Subject: feat(node): accept a device link request before the proof (MNP 6.3) A new device of a known account holds no identity the node pinned, so it cannot complete a handshake until a pinned device approves it: it now files device_add_request in the pre-proof window, as the desktop app's case already required. The request stays inert until countersigned; at most 10 are pending per account, the oldest dropped. A 6.2 node answers it "Handshake required", which a client reads as "cannot link here". Co-Authored-By: Claude Opus 5.5 --- packages/meshbay-node/src/meshbay_node/transport/webrtc/dispatch.py | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'packages/meshbay-node/src/meshbay_node/transport/webrtc/dispatch.py') diff --git a/packages/meshbay-node/src/meshbay_node/transport/webrtc/dispatch.py b/packages/meshbay-node/src/meshbay_node/transport/webrtc/dispatch.py index 0ceefb5..7452f42 100644 --- a/packages/meshbay-node/src/meshbay_node/transport/webrtc/dispatch.py +++ b/packages/meshbay-node/src/meshbay_node/transport/webrtc/dispatch.py @@ -120,6 +120,12 @@ class DispatchMixin: self._spawn(self._do_gek_bundle_fetch()) else: self._spawn(self._do_keypair_bundle_fetch()) + elif mtype == MNP.DEVICE_REQUEST and self._gek_challenge is not None: + # A machine with no key on this node cannot prove the group key — + # filing is how it gets one. Inert: nothing is admitted until a + # device already pinned countersigns, the code is bound to the + # keys, and the device budget bounds it (MNP 6.3). + self._spawn(self._do_device_request(msg)) elif mtype == MNP.JOIN_REQUEST and self._nonce_node: # Valid both before the GEK proof (a new member has no GEK to prove # with) and after it (an operator pairing a browser is already -- cgit v1.2.3