GitView v0.1.11

Host administration moves off signals and direct file edits onto a proper control socket, and legacy
bare-token authentication is removed.

⚠️ Read this before upgrading a bridge

Every device still holding a pre-0.1.8 token stops working and must pair again. Those tokens carried
no identity, could not be revoked individually, and sat in tokens.json in plaintext — the one thing the
hashed store exists to prevent. They are no longer accepted.

You do not have to guess whether this affects you. On start-up the bridge counts them and says so:

WARNING: /var/lib/gitview-bridge/tokens.json holds 6 pre-0.1.8 token(s), which are NO LONGER ACCEPTED.
         6 device(s) must pair again: gitview-bridgectl pair
         They are dropped from the store on its next write.

Recovery is one command per device — sudo gitview-bridgectl pair, then enter the code in the app.
Nothing restores the old tokens; a tokens.json from a backup is ignored just the same. Upgrade when
you can reach the affected devices, not before.

Devices paired since 0.1.8 are unaffected and need no action.

Host administration over a unix socket

gitview-bridgectl no longer edits tokens.json or signals the process. It sends named commands to the
bridge over /run/gitview-bridge/control.sock (0600, created by systemd's RuntimeDirectory), and the
bridge is the single writer of the store. What changes for you:

• revoke no longer invalidates a pairing code you just minted. A signal carries no payload, so the
  old handler had to mint a code and reload on every ring — meaning revoking a lost phone burned the
  code you had just generated to re-pair a good one.
• pair prints the code from the bridge's reply instead of grepping the journal for a line it had
  just caused to be printed.
• devices shows CONNECTED — live socket state, which a file-reading CLI could never know.
• revoke reports what actually happened (— 1 credential, 1 connection(s) closed) rather than
  assuming its own write worked.

The cost, stated plainly: a stopped bridge has no socket, so these commands now fail with "bridge is not
running" instead of quietly editing the file. Hand-editing tokens.json remains the break-glass path.

A revoked device now says so

Revoking a connected device closes its live socket with 4401. The app previously handled only HTTP
401, so it treated that close as an ordinary network blip and reconnected forever — showing
"Connection lost — reconnecting…" indefinitely, never telling you access had been withdrawn. It now drops
the token and offers to pair again. An ordinary disconnect still reconnects silently and keeps its token.

If you are upgrading a bridge with pre-0.1.8 tokens, this is the fix that makes those six devices tell
you what happened instead of spinning.

Also

• devices / revoke / pair are documented in SETUP for the first time; the old advice to restart the
  bridge for a fresh code is gone (it dropped every connection).
• A second bridge can no longer steal a live control socket from the first.

Artifacts

Bridge 0.1.11 (.deb, all), app 0.1.9 (versionCode 10). Verify the APK signature against the
cert SHA-256 in the README before installing.