Files
paseo/packages/app
Mohamed Boudra eaf38b6eb2 Fix protected relay security review findings
Relay channel:
- Validate a record header against the bytes received before allocating
  the assembly buffer.
- Client record failures close with 4003 (browser-safe) instead of 1011,
  which a browser WebSocket.close rejects and leaves the socket open.
- A present but malformed protected ready fails the handshake instead of
  falling through to a later legacy ready.
- A hello buffered while the ready send is in flight is answered: an
  identical retry gets the same ready, a changed hello closes 1008.
- Cipher-state nonce exhaustion is tested in both directions.

Client:
- DaemonClient and the Node host connector raise their endpoint security
  floor to protected once a daemon negotiates it, so a reconnect cannot be
  answered in legacy mode.
- The relay E2EE transport reports a channel-decided close synchronously
  and no longer forwards channel errors ahead of it; the client was
  reconnecting on the error before it saw the 4002 close.
- Module-mocked transport tests are replaced with real secure-channel
  tests through an in-memory link and a real ws server.

App:
- The protected pin belongs to the daemon identity: every relay route to
  the same key is pinned, and a new relay address for a pinned key
  inherits the pin.

Docs: relay URI parameter is security=protected; enabling the flag
protects new admissions only, so restart or disconnect sessions to finish
enforcement; SECURITY.md scopes confidentiality, forgery and replay
claims per mode.
2026-10-21 14:51:08 +02:00
..
2026-06-09 10:00:33 +07:00
2026-10-17 20:07:37 +02:00
2025-11-24 22:31:41 +01:00

Welcome to your Expo app 👋

This is an Expo project created with create-expo-app.

Get started

  1. Install dependencies

    npm install
    
  2. Start the app

    npx expo start
    

In the output, you'll find options to open the app in a

You can start developing by editing the files inside the app directory. This project uses file-based routing.

Get a fresh project

When you're ready, run:

npm run reset-project

This command will move the starter code to the app-example directory and create a blank app directory where you can start developing.

Learn more

To learn more about developing your project with Expo, look at the following resources:

Join the community

Join our community of developers creating universal apps.

Dictation debugging

Set EXPO_PUBLIC_ENABLE_AUDIO_DEBUG=1 before running npx expo start to render the in-app audio debug card. Pair it with the server-side STT_DEBUG_AUDIO_DIR flag so every dictation includes a copyable path to the saved raw audio file.