peach-browser / history

f17d073716b4

diag: mesh-propagation round 2 — five tagged lines at every silent rejection path in applyVerifiedPeerManifest (v4.7.7)

Live verification failed: after v4.7.4+v4.7.5, Firefox still does not appear in Chrome's paired-devices list after a sync. Manifest exchange is proven to run on every sync (incl. no-change), so the drop is inside applyVerifiedPeerManifest — every rejection path there has been silent since the v4.7.4 diag strip. Prime suspect from reading: deriveManifestMeshRoute returns null when the manifest entry lacks relayUrl (Android omits null fields in its canonical map), and a new device with no route is silently skipped. Five [Peach diag] lines cover: issuer-gate reason, signature rejection on both keys, issuerDeviceId mismatch, verified-manifest contents (device ids + relayUrls — answers whether the phone's manifest contains Firefox at all), and per-entry decision inputs. Also deletes the dead empty if/else block the v4.7.4 strip left behind. Temporary; strip once root cause is confirmed. Gates: tsc RC=0, sync-vault-adapter 31/31, build clean, dist/ at 4.7.7.

time
2026-08-01 16:48 UTC · 2 months ago
machine
koh2
parent
ec56ceb632a1

↓ peach-browser-f17d0737.tar.gzatlas at this save

files changed4 files manifest.firefox.json+1 −1manifest.json+1 −1package.json+1 −1src/background/sync-vault-adapter.ts+37 −5
manifest.firefox.json+1 −1 
@@ -1,7 +1,7 @@11 {22   "manifest_version": 3,33   "name": "Peach Password Manager",4-  "version": "4.7.6",4+  "version": "4.7.7",55   "description": "Zero-knowledge password manager",66   "browser_specific_settings": {77     "gecko": {

view file

manifest.json+1 −1 
@@ -2,7 +2,7 @@22   "manifest_version": 3,33   "minimum_chrome_version": "116",44   "name": "Peach Password Manager",5-  "version": "4.7.6",5+  "version": "4.7.7",66   "description": "Zero-knowledge password manager",77   "action": {88     "default_popup": "src/popup/index.html",

view file

package.json+1 −1 
@@ -1,6 +1,6 @@11 {22   "name": "peach",3-  "version": "4.7.6",3+  "version": "4.7.7",44   "description": "Zero-knowledge password manager",55   "license": "GPL-3.0-only",66   "type": "module",

view file

src/background/sync-vault-adapter.ts+37 −5 
@@ -292,6 +292,15 @@292292     !issuer.signingPublicKeyHex ||293293     !/^[0-9a-f]{64}$/.test(issuer.signingPublicKeyHex)294294   ) {295+    // ponytail: temporary mesh-propagation diagnostic — strip once root cause is confirmed296+    console.info("[Peach diag] issuer gate rejected", {297+      authenticatedPubkeyHex,298+      claimedIssuerId: issuerId,299+      found: !!issuer,300+      foundId: issuer?.deviceId,301+      trustSource: issuer?.trustSource,302+      hasSigningKey: !!issuer?.signingPublicKeyHex,303+    });295304     return;296305   }297306 @@ -315,12 +324,31 @@315324       );316325       body = await verifyDeviceManifest(manifest, derived.publicKeyRaw);317326     } catch (derivedError) {327+      // ponytail: temporary mesh-propagation diagnostic — strip once root cause is confirmed328+      console.info("[Peach diag] manifest signature rejected (stored + derived)", {329+        issuerId: issuer.deviceId,330+        storedError: String(storedError),331+        derivedError: String(derivedError),332+      });318333       return;319334     } finally {320335       masterForIssuer.fill(0);321336     }322337   }323-  if (body.issuerDeviceId !== issuer.deviceId) { return; }338+  if (body.issuerDeviceId !== issuer.deviceId) {339+    // ponytail: temporary mesh-propagation diagnostic — strip once root cause is confirmed340+    console.info("[Peach diag] issuerDeviceId mismatch", {341+      body: body.issuerDeviceId,342+      expected: issuer.deviceId,343+    });344+    return;345+  }346+  // ponytail: temporary mesh-propagation diagnostic — strip once root cause is confirmed347+  console.info("[Peach diag] manifest verified", {348+    issuer: issuer.deviceId,349+    devices: body.devices.map((d) => ({ id: d.deviceId, relayUrl: d.relayUrl ?? null })),350+    revoked: body.revoked.map((r) => r.deviceId),351+  });324352 325353   const ourDeviceId = await getOrCreateDeviceId();326354   const masterKey = requireMasterKey();@@ -366,10 +394,14 @@366394         localKeys.publicKey,367395         entry,368396       );369-      if (existing) {370-      } else if (!meshRoute) {371-      } else {372-      }397+      // ponytail: temporary mesh-propagation diagnostic — strip once root cause is confirmed398+      console.info("[Peach diag] entry", {399+        deviceId: entry.deviceId,400+        hasRelayUrl: !!entry.relayUrl,401+        revoked: await isDeviceRevoked(entry.deviceId, entry.longTermPublicKeyHex),402+        existing: !!existing,403+        hasMeshRoute: !!meshRoute,404+      });373405 374406       // A v3 manifest from an admitted, KK-authenticated issuer proves375407       // same-vault membership and carries enough route material for the two

view file