docs: session sharing — SECURITY.md, BETA.md, checklist (G1f) - #105
Conversation
SECURITY.md gains a Session sharing section whose claims match the G1 spec's threat analysis exactly — read-only is a pane mirror bounded by screen content, read-write is arbitrary code execution as the agent user with consent-side mitigations only, revocation is agent-local with the 24 h cap as backstop, the relay learns nothing new, grants are guest-bound and non-transferable. BETA.md moves sharing into "what works" and lists the v2 gaps (follow-active mirroring, offline revocation reach, phone minting). README gets the one-line hook, the beta checklist a share step, and `mir join` now prints the attach hint G1d had to hold back. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KeiotDVE94wEzvc7wcvm1y
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fd4b9ff62c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| return err | ||
| } | ||
| fmt.Fprintf(a.out, "✓ joined %q as a guest — %s access until %s\n", info.Name, modeWord(sg.Mode), time.Unix(sg.NA, 0).Format("15:04")) | ||
| fmt.Fprintf(a.out, " open it: %s attach %s (or the web app)\n", a.binary, info.Name) |
There was a problem hiding this comment.
When an inviter supplies a valid machine name containing shell syntax, such as box; evil-command, this copyable instruction executes that syntax on the guest's machine because info.Name is emitted verbatim. agent.ValidMachineName permits spaces and other non-control characters, including shell metacharacters, so quote the name safely for the target shell or print a non-name identifier instead.
Useful? React with 👍 / 👎.
| return err | ||
| } | ||
| fmt.Fprintf(a.out, "✓ joined %q as a guest — %s access until %s\n", info.Name, modeWord(sg.Mode), time.Unix(sg.NA, 0).Format("15:04")) | ||
| fmt.Fprintf(a.out, " open it: %s attach %s (or the web app)\n", a.binary, info.Name) |
There was a problem hiding this comment.
After a guest claims the one-time invite with mir join, the machine and grant are saved only under the CLI's --dir; the browser's guest store is populated only when the browser itself claims the invite. Consequently, selecting the web app after this message will not show or authorize the share, and the already-consumed invite cannot be claimed there again. Remove this parenthetical or tell users to open the original invite in the web app instead of using mir join.
Useful? React with 👍 / 👎.
| **The relay learns nothing new:** one opaque pair room and ordinary attach | ||
| metadata for the machine — identical to today's traffic. Suppressing traffic | ||
| denies service (already true); it never grants access. |
There was a problem hiding this comment.
During a guest attach, relayLocator.Dial sends the guest's unencrypted BindingJSON through SignalMsg.Binding; that record contains the stable guest wallet, device ID, and X25519 key. Although the relay does not currently interpret it, it can parse the record and correlate the guest with the owner's shared machine, so this is new observable metadata rather than traffic identical to an owner attach. Document that exposure or encrypt the binding before claiming the relay learns nothing new.
AGENTS.md reference: AGENTS.md:L9-L9
Useful? React with 👍 / 👎.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
1 participant
The docs slice of guest sharing, with the slice table's acceptance rule as law: claims match spec §5 exactly — no softer, no harder. Part of #55.
mir joinnow prints the attach hint ("open it:mir attach <name>(or the web app)") — true since G1c/G1d landed; G1d had to hold it back.Docs + that one copy line only; no behavior changes.
go test ./...cli green,gofmt -lempty, web 167/167 (no doc-pinning test touched — README's Install section untouched).🤖 Generated with Claude Code
https://claude.ai/code/session_01KeiotDVE94wEzvc7wcvm1y