Mobile Device Pairing

Mobile Device <--[encrypted]--> Relay Server <--[encrypted]--> Desktop

// Generate ephemeral ECDH P-256 keypair
let private_key = SigningKey::random(&mut OsRng);
let public_key = private_key.verifying_key();

// Export public key as SPKI DER, base64-encoded
let spki_der = public_key.to_encoded_point(false).as_bytes();
let dh_pubkey_base64 = base64::encode(spki_der);

// After receiving mobile's public key:
let shared_secret = ecdh::diffie_hellman(
    private_key.as_nonzero_scalar(),
    mobile_pubkey.as_affine()
);

// Derive AES-256 key: SHA-256(raw_secret_bytes)
let aes_key = Sha256::digest(shared_secret.raw_secret_bytes());

import { p256 } from '@noble/curves/nist.js';
import { gcm } from '@noble/ciphers/aes.js';
import { sha256 } from '@noble/hashes/sha2.js';
import { getRandomBytes } from 'expo-crypto';

// Generate ephemeral ECDH P-256 private key
const seed = getRandomBytes(48);
const privateKey = p256.utils.randomSecretKey(seed);

// Get public key as uncompressed point, wrap in SPKI DER
const myRawPub = p256.getPublicKey(privateKey, false);
const mySpki = rawPointToSpki(myRawPub);
const myPubkeyBase64 = toBase64(mySpki);

// Parse desktop's SPKI DER public key
const desktopSpki = fromBase64(desktopDhPubkeyBase64);
const desktopRawPub = spkiToRawPoint(desktopSpki);

// ECDH: compute shared secret (x-coordinate only, 32 bytes)
const sharedPoint = p256.getSharedSecret(privateKey, desktopRawPub, false);
const rawSecret = sharedPoint.slice(1, 33);

// SHA-256 hash → AES key
const aesKey = sha256(rawSecret);

async function encrypt(plaintext: string): Promise<{ iv: string; ct: string }> {
  const iv = getRandomBytes(12);
  const encoded = new TextEncoder().encode(plaintext);
  const cipher = gcm(aesKey, iv);
  const ciphertext = cipher.encrypt(encoded);
  return {
    iv: toBase64(iv),
    ct: toBase64(ciphertext),
  };
}

async function decrypt(ivB64: string, ctB64: string): Promise<string> {
  const iv = fromBase64(ivB64);
  const ct = fromBase64(ctB64);
  const cipher = gcm(aesKey, iv);
  const plaintext = cipher.decrypt(ct);
  return new TextDecoder().decode(plaintext);
}

use aes_gcm::{Aes256Gcm, KeyInit, Nonce};
use aes_gcm::aead::Aead;

let cipher = Aes256Gcm::new(GenericArray::from_slice(&aes_key));
let nonce = Nonce::from_slice(&rand::random::<[u8; 12]>());
let ciphertext = cipher.encrypt(nonce, plaintext.as_bytes())?;

// Encode as base64
let iv_b64 = base64::encode(nonce);
let ct_b64 = base64::encode(ciphertext);

let cipher = Aes256Gcm::new(GenericArray::from_slice(&aes_key));
let nonce = Nonce::from_slice(&base64::decode(iv_b64)?);
let plaintext = cipher.decrypt(nonce, base64::decode(ct_b64)?.as_slice())?;

import { TerminalWebView } from './TerminalWebView';
import { RelayConnection } from '../lib/relay-connection';

function CodeTerminal() {
  const [conn] = useState(() => createRelayConnection('relay'));

  const handleConnect = (pairingData: string) => {
    conn.connect(pairingData, {
      onOutput: (data) => terminalRef.current?.write(data),
      onStatusChange: (status, msg) => setStatus({ status, message: msg }),
      onError: (error) => console.error(error),
    });
  };

  return (
    <TerminalWebView
      ref={terminalRef}
      onData={(data) => conn.sendInput(data)}
      onResize={(cols, rows) => conn.sendResize(cols, rows)}
    />
  );
}

type ConnectionStatus = 'disconnected' | 'connecting' | 'connected' | 'error';

// Status transitions:
// disconnected -> connecting (user scans QR)
// connecting -> connected (encryption established)
// connected -> connecting (connection lost, auto-reconnect)
// connecting -> error (fatal error)

interface PaneInfo {
  id: number;
  kind: string;  // "terminal" | "skill" | ...
  title: string;
}

// Desktop sends pane list:
{
  "type": "pane_list",
  "panes": [
    { "id": 1, "kind": "terminal", "title": "zsh" },
    { "id": 2, "kind": "skill", "title": "code-review" }
  ],
  "focused_id": 1
}

// Mobile switches active pane:
conn.setActivePane(2);

[relay]
url = "wss://jarvis-relay-363598788638.us-central1.run.app/ws"
auto_connect = false

// Desktop (Rust)
use jarvis_app::actions::Action;

// Trigger pairing
app.handle_action(Action::PairMobile);
// QR code displayed in terminal

// Mobile connects, key exchange happens automatically

// Send PTY output to mobile
if let Some(output) = pty.read() {
    mobile_tx.send(ServerMessage::PtyOutput {
        pane_id: 1,
        data: output,
    });
}

// Receive input from mobile
if let Ok(cmd) = mobile_rx.try_recv() {
    match cmd {
        ClientCommand::PtyInput { data, .. } => {
            pty.write_all(data.as_bytes())?;
        }
        ClientCommand::PtyResize { cols, rows, .. } => {
            pty.resize(cols, rows)?;
        }
    }
}

// Mobile (TypeScript)
import { RelayConnection } from './lib/relay-connection';
import { scanQRCode } from './lib/qr-scanner';

// Scan QR code
const qrData = await scanQRCode();
// qrData: "jarvis://pair?relay=wss://...&session=...&dhpub=..."

// Connect
const conn = new RelayConnection();
conn.connect(qrData, {
  onOutput: (data) => terminal.write(data),
  onStatusChange: (status, msg) => {
    if (status === 'connected') {
      console.log('Paired and encrypted!');
    }
  },
  onError: (err) => console.error(err),
});

// Send input
terminal.onData((data) => conn.sendInput(data));

// Handle resize
terminal.onResize(({ cols, rows }) => conn.sendResize(cols, rows));