GitView v0.1.8

GitView v0.1.8

Both components changed this cycle, so both are released: bridge 0.1.8 and app 0.1.8
(versionCode 9).

Device authentication is now per-device (ADR-035)

The bridge used to hold a flat list of interchangeable bearer tokens. It now keeps a record per device,
which makes three things possible that weren't before.

• See what's paired — GET /v1/devices lists each device with its name, when it was last seen, and
  whether it's connected right now. The app surfaces this at Repos ⋮ → "Paired devices…", and devices
  arrive named (your phone reports its model at pairing time) rather than as an anonymous entry.
• Revoke one device without touching the others — previously the only remedy for a lost phone was
  wiping every token and re-pairing everything.
• Revocation takes effect immediately. A WebSocket authenticates once when it connects, so a revoked
  device would otherwise keep streaming until it happened to disconnect. Revoking now closes that device's
  live connections (4401) and kills any shells it had open.

Secrets are no longer stored in a readable form: the bridge keeps only a SHA-256 of each token, so the
state file grants nothing if it leaves the host — a backup, a synced dotfile, a bad chmod. Note the
bound: this protects the file in transit, not against someone who already has shell access on the host,
who can run commands regardless. Token lookup also drops from a scan of every token to a direct lookup.

Audit entries now name the device that acted, instead of logging every write from every device as the
same anonymous app.

Upgrading — nothing to re-pair

Tokens issued before this release keep working. They appear together as one "unknown legacy device(s)"
entry, because they carry no identity and genuinely can't be told apart; revoking that entry drops all of
them at once. Re-pair a device to give it its own identity and individual revoke.

Two behaviours worth knowing: a device cannot revoke itself (un-pair from the device instead), and a
client still holding a pre-upgrade token is the legacy group, so it can't clear that group — re-pair it
first. Any paired device may revoke any other; pairing is the only privilege boundary.

Also fixed

• The diff no longer flickers while a build runs. The file watcher was announcing changes for
  gitignored paths (build/, dist/, node_modules/), so the app kept refreshing a view that couldn't
  have changed. Ignored paths are now filtered out — and if the check ever fails, it errs toward
  announcing rather than swallowing a real change.
• A body-less DELETE sent with Content-Type: application/json returned 500 instead of working.
  Affected any client that sets the header globally.
• Concurrent writes to the device store are serialized, so an overlapping pair/revoke can't lose an
  update or fail on a temp-file collision.
• The device list is scoped to its own bridge — connecting to a second bridge no longer carries the first
  one's device identity across.

Install

Bridge — sudo dpkg -i gitview-bridge_0.1.8_all.deb (Debian/Ubuntu, Architecture: all; needs
Node.js ≥ 20 on the host). The service restarts itself; your config and tokens are preserved.

App — install gitview-0.1.8.apk. It upgrades 0.1.7 in place.

Verify

sha256sum -c SHA256SUMS
apksigner verify --print-certs gitview-0.1.8.apk   # cert SHA-256 must match the README