feat(federation): remote-window UX guardrails + encrypted-transport & messaging plans - #872
Merged
huntharo merged 3 commits intoJun 22, 2026
Conversation
…e windows Three dogfood UX fixes for the instance-federation MVP (#735): - Block new-thread creation in a remote window instead of silently creating a LOCAL thread on the client instance. createThread and materializeDirectoryLaunchpad now bail with a clear message when a renderer federation target is active; the launchpad path throws so the composer preserves the typed prompt. - Add RemoteWindowBadge in the sidebar masthead so remote windows are visually distinct from local ones. - Surface peer reachability via a connection-status dot on the badge (connected / pending / offline), polling federation health. Reuses existing theme tokens; the brand-token contract test still passes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Two follow-up plans for the instance-federation MVP (#735): - Encrypted, identity-bound direct/LAN transport: a Noise_IK channel over the existing WebSocket reusing the pinned instance identity, closing the post-auth cleartext read/inject exposure when not behind Cloudflare. - Messaging -> remote-thread routing: wires the currently-dead federated messaging helpers into a reachable end-to-end path (browse surfacing, bind stamping, bridge routing, remote event delivery) behind a default-off messaging_route capability. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add the missing coverage flagged in review of #872: - useThreadNavigation: createThread and materializeDirectoryLaunchpad no-op (set error / reject) in a remote window and never touch the local backend (ensureDirectoryLaunchpad / materializeDirectoryLaunchpad). - RemoteWindowBadge: connecting peer renders the pending status dot. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
huntharo
added a commit
that referenced
this pull request
Jul 2, 2026
Federation feature collapsed onto current main as a single linear commit (developed across #735/#872/#892 with interim merge commits). Rebuilt via one 3-way squash of the tested branch tip onto main; the only conflict was an additive preload import list, resolved by keeping both. Includes: - Instance federation MVP: authenticated WebSocket control plane; peer enrollment / identity / policy / store; router + RPC backend bridge; remote window targets; federated search; Settings -> Federation; messaging federated-thread bindings. - Remote-window UX guardrails: block remote-window thread creation (no silent local thread), RemoteWindowBadge with live peer connection status. - Encrypted, mutually-authenticated transport: hand-written Noise_IK on Node's built-in crypto (locked to the official Noise test vectors), per-frame AEAD, gateway static key pinned via the invite, Ed25519 identity proof channel-bound to the handshake hash. Encrypted by construction (no plaintext LAN path). - Plans: encrypted-LAN-transport and messaging-routing follow-ups. Federation ships disabled by default; encrypted when enabled. Verified: shared+desktop typecheck, lint:boundaries, lint:sql, and the federation + merge-sensitive suites (196 tests) green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
huntharo
added a commit
that referenced
this pull request
Jul 2, 2026
Federation feature collapsed onto current main as a single linear commit (developed across #735/#872/#892 with interim merge commits). Rebuilt via one 3-way squash of the tested branch tip onto main; the only conflict was an additive preload import list, resolved by keeping both. Includes: - Instance federation MVP: authenticated WebSocket control plane; peer enrollment / identity / policy / store; router + RPC backend bridge; remote window targets; federated search; Settings -> Federation; messaging federated-thread bindings. - Remote-window UX guardrails: block remote-window thread creation (no silent local thread), RemoteWindowBadge with live peer connection status. - Encrypted, mutually-authenticated transport: hand-written Noise_IK on Node's built-in crypto (locked to the official Noise test vectors), per-frame AEAD, gateway static key pinned via the invite, Ed25519 identity proof channel-bound to the handshake hash. Encrypted by construction (no plaintext LAN path). - Plans: encrypted-LAN-transport and messaging-routing follow-ups. Federation ships disabled by default; encrypted when enabled. Verified: shared+desktop typecheck, lint:boundaries, lint:sql, and the federation + merge-sensitive suites (196 tests) green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
huntharo
added a commit
that referenced
this pull request
Jul 5, 2026
Federation feature collapsed onto current main as a single linear commit (developed across #735/#872/#892 with interim merge commits). Rebuilt via one 3-way squash of the tested branch tip onto main; the only conflict was an additive preload import list, resolved by keeping both. Includes: - Instance federation MVP: authenticated WebSocket control plane; peer enrollment / identity / policy / store; router + RPC backend bridge; remote window targets; federated search; Settings -> Federation; messaging federated-thread bindings. - Remote-window UX guardrails: block remote-window thread creation (no silent local thread), RemoteWindowBadge with live peer connection status. - Encrypted, mutually-authenticated transport: hand-written Noise_IK on Node's built-in crypto (locked to the official Noise test vectors), per-frame AEAD, gateway static key pinned via the invite, Ed25519 identity proof channel-bound to the handshake hash. Encrypted by construction (no plaintext LAN path). - Plans: encrypted-LAN-transport and messaging-routing follow-ups. Federation ships disabled by default; encrypted when enabled. Verified: shared+desktop typecheck, lint:boundaries, lint:sql, and the federation + merge-sensitive suites (196 tests) green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up stacked on #735 (instance federation MVP). Ships verified dogfood UX guardrails for remote windows and lands two follow-up plans. Targets the federation feature branch so it stacks cleanly.
Shipped (code, verified)
createThreadandmaterializeDirectoryLaunchpadbail with a clear message when a renderer federation target is active; the launchpad path throws so the composer preserves the typed prompt.RemoteWindowBadgein the sidebar masthead makes remote windows visually distinct (● Remote · <peer label>).All using existing theme tokens; the brand-token contract test still passes.
Plans (docs)
docs/plans/2026-06-21-001-feat-federation-encrypted-lan-transport-plan.md. ssh-like Noise_IK channel over the existing WebSocket, reusing the pinned identity, closing the post-auth cleartext read/inject exposure when not behind a Cloudflare tunnel. This is the deferred "local-only transport" from the original plan.docs/plans/2026-06-21-002-feat-federation-messaging-routing-plan.md. Wires the currently-dead federated messaging helpers into a reachable end-to-end path behind a default-offmessaging_routecapability.Why these UX fixes
#735 is a genuinely working remote-thread control plane (auth handshake, real backend data, startTurn/steer over the wire). The gaps that made it unpleasant to dogfood were: silent wrong-instance thread creation, no way to tell a remote window apart, and no peer-offline signal. These three fixes address exactly those.
Verification
pnpm --filter @pwragent/desktop typecheck— cleanpnpm lint:boundaries— 0 violationsRemoteWindowBadgetests — 4/4Not included (deliberately)
The messaging→remote routing implementation is held for its own PR — recon showed it's a feature, not a wiring (bindings never stamp
federatedThread, browse never surfaces remote threads), with a security fork (remote agent control via messaging). It's fully specced in the plan doc above.🤖 Generated with Claude Code