Repository navigation
Remove the dor remote command and its control methods - #1530
Merged
Merged
Conversation
Nothing needs it. Settings -> Remote control lists phones, revokes one, and reads the access log on the same machine, and the webview's control router answers these verbs, so they could not work without the UI anyway. Pocket's revoke is coming with a presence proof (#1528). Keeping the control methods would let any process in a Dormouse terminal cut off a phone or read the access log, and let an attached phone session revoke with no proof. The control socket now carries nothing of the Burrow, and security-local.md says so. An unknown remote.* method gets the Wall's usual unsupported-method refusal. The command never shipped (v1.3.0 predates it), so there is no shim. The requester only distinguished dor from Settings, so a closed set of one read through a function that always answered settings had no job left. RevocationRequester is now a plain type, and revokeDevice takes no `by` and logs settings itself, so a webview message cannot name a requester. Settings' revokeDevice, pairedDevices, accessLog and deviceIdFor stay. A persisted log entry with any other `by` keeps reading as plain "revoked". Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Deploying mouseterm with
|
| Latest commit: |
ec11c7f
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://0dfefa89.mouseterm.pages.dev |
| Branch Preview URL: | https://remove-dor-remote.mouseterm.pages.dev |
dormouse-bot
approved these changes
Nov 3, 2026
#1527 added the Relay requester on top of the dor verbs this branch removes. Keep the Relay's: RevocationRequester is 'settings' | 'relay', and the service names it, so no message can. Drop COMMAND_REQUESTERS, revocationRequester, and REVOKED_BY's dor copy, and the dor remote mentions #1527 added to the specs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
S300 audited revocationRequester, which this branch removes, so it now names what holds the rule: #revokeDevice takes no requester from a message and logs settings. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
dormouse-bot
approved these changes
Nov 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Removes
dor remoteand itsremote.*control methods. It never shipped (v1.3.0 predates it), so there is no deprecation or shim.Nothing needs it. Settings -> Remote control lists phones, revokes one, and reads the access log on the same machine, and the webview's control router answers these verbs, so they could not work without the UI anyway. Pocket's revoke is coming with a presence proof (#1528).
Keeping the control methods would let any process in a Dormouse terminal cut off a phone or read the access log, and let an attached phone session revoke with no proof. The control socket now carries nothing of the Burrow, and
security-local.mdsays so. An unknownremote.*method gets the Wall's usual unsupported-method refusal; that was read in the code, not tested.RevocationRequesteris now a plain type, andrevokeDevicetakes nobyand logssettingsitself, so a webview message cannot name a requester.revokeDevice,pairedDevices,accessLog, anddeviceIdForstay for Settings. A persisted log entry with any otherbykeeps reading as plain "revoked", which a new Settings test pins.Specs:
dor-cli.md's section is gone, and its budget drops from 5650 to 5500.remote-security-model.mdand its rationale,security-remote.md(theS293clause and Guarantee row),security-local.md,security.md, andpairing.mdxfollow. No rule ID is retired, and no audit prompt or canary changed.Verified:
dortests; lib's wall router,host/remote,remote/burrow, andRemoteControlSection(977); vscode-extburrow.test;tscin lib, standalone, and vscode-ext; the specs, md, public-docs, e2e, outbound, and loopback lints;test:audit(197);test:checks; the website's generated docs. Two mutations went red. Not run: the live app.Merged with #1527: that PR added a Relay requester on top of the verbs removed here, so
RevocationRequesteris'settings' | 'relay', the service names it, and no message can.S300now cites#revokeDeviceinstead of the removedrevocationRequester. #1528 gets main merged in after this lands.Refs #331.
🤖 Generated with Claude Code