Skip to content

session-peer v1.0.0-alpha.1

Pre-release
Pre-release

Choose a tag to compare

View all tags
@abruption abruption released this 19 Sep 15:19
v1.0.0-alpha.1
fe82fb9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

session-peer v1.0.0-alpha.1

The first opt-in 1.0 alpha adds an authenticated public relay path while
preserving the dependency-free local and SSH workflows from v0.9.0.

Highlights

  • Pair devices through pinned inner TLS 1.3 and send over direct TCP or blind
    public WSS. The relay sees routing metadata but cannot decrypt application
    messages.
  • Sign in with verified GitHub or Google OAuth, authorize the native CLI with a
    browser device code, and bind every relay admission to the enrolled device key.
  • Rotate device keys with old/new-key proof, durable operation receipts and
    recovery after an unknown response. Revocation closes active managed
    connections.
  • Persist spent tickets and public-state revision high-water marks across
    restart. The KR deployment includes coordinated boot, watchdog recovery and
    encrypted recovery snapshots.
  • Support Claude, Codex and Antigravity native delivery. Submission, duplicate
    suppression and independently observed agent acknowledgement remain distinct
    result states.
  • Offer verified public signup without invitations or a user-count cap. An
    operator can close new signup without evicting committed identities, and an
    operator-only aggregate metrics page exposes no user or device identifiers.

Install the alpha

Python package managers do not normally select prereleases. Opt in explicitly:

pipx install 'session-peer[relay]==1.0.0a1'
# or
uv tool install 'session-peer[relay]==1.0.0a1'

Use the same package version on both paired endpoints. The core still supports
Python 3.9+; the optional relay runtime requires Unix and Python 3.11+.

The hosted guide is available in Korean, English, Japanese and Simplified Chinese. Relay operators can open aggregate service metrics from https://admin.abruption.dev/session-peer; both the portal and relay apply independent authorization checks.

Operator deployment note: use the route-wrapped admin portal snippet merged in #103, which preserves Authelia forward_auth before the redirect. The tagged application runtime is unchanged.

Alpha boundaries

  • This is a prerelease for explicit testers. Normal stable upgrades continue to
    select v0.9.0.
  • Public relay availability and OAuth provider policy are operational services,
    separate from installing the package.
  • Google OAuth may remain limited by the provider's testing/publication policy.
  • Pairing and OAuth never grant native agent access by themselves. The receiving
    endpoint still enforces its local policy and the user verifies the actual agent
    response.
  • The completed evidence covers independent Linux/macOS tests, actual public WSS
    pairing, replay rejection, live revocation, real agent ACKs, watchdog recovery,
    a KR reboot and an isolated backup restore. The interrupted soak is not claimed
    as a 24-hour pass.
  • Windows retains local and SSH support; the optional receiver/relay runtime is
    Unix-only.

Report bugs through GitHub issues and security problems through the repository's
private advisory channel. Do not include tokens, device keys, certificates,
session IDs or conversation content in reports.

Assets 2
Loading