Security: the 0.23.1 findings — the view, the hook secret, and discovery
Security-Model:
- the browser view bullet becomes two: the URL is a credential and IS the join token when one
is set (so a leaked view link is a leaked join link, /token new revokes it and /kick does
not), and read-only is real as of 0.23.1 — earlier versions rested it on ttyd's own default,
which is version-dependent, and ttyd honours a resize even when it refuses input, so a
viewer could shrink the host's live pane from anywhere.
- a new section on the third secret and the registry: what the hook secret authenticates, why
session.json's lower-case "secret" was the one shape the pattern masker ignored, that holding
it alone was sufficient, and why the fix is a registry with two tests as the forcing function
rather than a fourth hand-threaded needle. Invite secrets are excluded, with the reason.
- the mDNS section gains the direction it never covered: find does not authenticate anybody,
anybody on the network can publish a look-alike advertisement, and what changed (no printed
--token, address leads, the warning line, invite links as the safe path).
Joining-a-Jam: the example listing updated to the new column order and the new footer, why the
address comes first, and the token row now points at an invite link as the better answer.
Remote-Access: the same two facts about the view URL, at the place people actually turn it on.
Security Model + Joining: authenticate before answering anything about the roster (0.22.1)
Until 0.22.0 a hello naming somebody already in the jam was refused by name and closed
4409 BEFORE any admission, so the roster was enumerable name by name with no token —
unlimited, since the close happened above the pending set. Measured: probing Roy, Dana
and Nobody returned 4409, 4409 and a pending knock.
The page now states the fix as what it is — ordering, not silence. A token or invite
holder is still told at once. A knocker is not told at all, and their clash is settled
at admission: they join as Dana-2 and are told so. The host IS told, on the frame they
approve from, because otherwise a stranger could make the approval bar read a name that
is in the room.
Plus the one behaviour change: `name already connected` was the only one of the five
invite refusal reasons that closed the socket rather than falling through to a knock.
It now falls through like the other four, so reconnecting on your own link while your
stale socket is still in the roster is no longer a lockout.
the release gate's doc check: five shipped features the entry page called unbuilt
Home.md's "Not built yet" list was never revisited after the first commit, so the entry
page — the one an agent reads first — was telling people that LAN discovery, join/knock
sounds, /nudge, `--uploads auto` and guest-side scrollback do not exist. All five have
shipped and all five have a page here. What remains genuinely unbuilt is Windows, and
Linux is honest about being thinly proven rather than silently fine.
Hosting-a-Jam: the flag table was missing `--history` and `--peer-tasks`, and then
claimed `--help` prints the same list. It does not, in either direction — the table also
carries four flags `--help` deliberately leaves out. Say what is actually true.
Architecture: 283 tests -> 389, two lints -> four, thirteen smokes -> eighteen, and it
quoted a SPEC.md heading ("Running the thirteen end-to-end smokes") that has never
existed under that name.
Joining-a-Jam: /peer and /peers were missing from the only command list a guest gets,
on the release that ships them. Verified every form against parseClientLine.
Security-Model: the mDNS example record still advertised v0.18.0.
wiki: how to look further back, and which of the three limits you just hit
Joining-a-Jam gains a "Scrolling back" section — PgUp/PgDn through the host's
REAL pane history, Shift+arrows a line, End/G/Esc back to live, the held-frame
count, and /history for the transcript. Guests get all of it: it is a read of a
screen they are already watching.
Troubleshooting leads with the complaint in the words people use it in ("I can
only see very little of this conversation") and a table that separates the
three limits behind it — what you were shown (--replay), what the jam still
keeps (--history, reached with /history), and how far the host pane's own
scrollback goes (2000 lines). Plus the honest ones: why the wheel does nothing
unless your terminal already sends wheel events, why a re-read page can be two
seconds stale, and that F2 no longer eats your scrollback.
wiki: sounds, nudges, and the upload policy that only removes the prompt
- Files-and-Export: the three upload policies in a table, the list of
protections that do NOT move with them (and the note that smoke-nudge proves
each one still refuses while the policy is auto), the 40-file/200 MB session
quota and why the fallback line exists, and export's own separate toggle.
- Hosting-a-Jam: the four new flags in the flag table; a 'Hearing what needs
you' section with the two arrival sounds, why they differ, the once-only
knock repeat, and the three toggles.
- Joining-a-Jam: /ping and /sound in the command table, and a full section on
nudges — what the addressee sees, what the room sees, why it is never queued,
the rate limit, the once-only escalation, what idle actually reports, and the
opt-in phone config with the topic warning.
- Security-Model: a new section, 'The ntfy topic stays on your machine' — the
topic is a bearer credential, it lives only in the recipient's config, their
own client posts it, and it is never in a frame, an invite link, the
protocol or a log. Plus three new entries under 'What to assume': the upload
policy is a prompt setting and not a protection, export is separate and stays
ask, and a nudge is deliberately not on the approval ladder.
wiki: finding a jam on your network, and what announcing tells the room
Joining-a-Jam leads with finding one, because on the same wifi that is now the
easiest way in — the find/join commands, a real listing, and a table of what
each `access` value still requires of you. It also answers the three ordinary
reasons a jam is not in the list (the host used --no-announce, you are not on
that network, this machine has no mDNS tool), none of which is a fault.
Security-Model gets the privacy note as a section of its own: the six fields
that go on the wire and why each is safe, the list of what is never in it and
the fact that this is enforced by an allow-list rather than a redaction pass,
and the two consequences worth thinking about — that a jam name is a project
name and the default is the directory's, and that on an untrusted network you
should turn it off. Plus the point that discovery does not bypass any gate on
that page, and the one it would be easy to get wrong: --no-announce hides the
name, not the port. That is a bind and a firewall question.
Hosting-a-Jam gets the two flags, told apart from --tmux (which is the
identifier, not the label), and a short section pointing at the full note.
wiki: the ten pages — install, agent-install, hosting, joining, remote, files, security, architecture, troubleshooting
Written against what actually shipped (README/MANUAL/SPEC 'what shipped' notes and
the real flags in the source). Everything specced but not built — LAN discovery,
sounds, nudges, upload auto-allow, guest scrollback, peer tasks, Windows — is listed
on Home under 'Not built yet' and described nowhere else.
Agent-Install is the page another person's agent is pointed at: the never-do list
first, then numbered non-interactive commands with a verification after each, the
steps that need a human called out, and a self-test whose expected output was
recorded from a real run on 2026-08-29.