pneumo

M3: Devices page and phone-pairing QR (ENG-258) #23

Merged

demi.dev 1w ago

targeting main from stoopkidddd/eng-258-m3-devices-page-and-phone-pairing-qr

Merged opened by and assigned to

demi.dev 1w ago targeting main from stoopkidddd/eng-258-m3-devices-page-and-phone-pairing-qr

Linear: https://linear.app/engineereddev/issue/ENG-258

What's in this PR (all under apps/web/, plus the lockfile):

devices/: /devices list (platform icon, name, "This device" badge, online state from DeviceDTO.online + device_updated, last-seen relative time), inline rename (PATCH), in-place-confirmed remove (DELETE; removing this device signs out), and a device reducer for device_* frames.
"Add a phone" modal: POST /api/pair → buildPairingUri from @pneumo/crypto → QR (qrcode, error correction M), a 10-minute countdown and New code, closes on a matching device_added and highlights the new device. The raw URI never enters the DOM, a link or the clipboard.
A browser removed elsewhere lands on /login with "This browser was removed from Pneumo."
Settings: this device's name is editable.
Reuses the existing device list and the single WebSocket (home/useHome.ts, App.tsx).

Verify (lead, on cba2c93, based on e5f90f2):

pnpm install --frozen-lockfile → exit 0
mise run check:web → exit 0 (Tests 80 passed (80); build OK)
mise run e2e:web → exit 0 (20 passed: rename persists across reload, removal → /login with the message, QR decoded with jsQR and parsed with parsePairingUri (u = origin, k = session MK), real claim closes the modal and shows the device, axe)
Screenshots (not committed): devices-list, devices-rename, devices-remove-confirm, devices-pairing, devices-paired, devices-revoked-login, devices-self-removed-login, settings-device-name (light/dark/mobile).

Deviations: none. Settings stays in views/SettingsView.tsx.

🤖 Generated with Claude Code

Commits 0

Could not load commits.

Comments

v0 1w ago

demi.dev 1w ago

pneumo-reviewer: round 1, REQUEST_CHANGES #

Solid PR. The pairing URI only ever reaches a canvas: buildPairingUri gets location.origin and the session MK, and the e2e test decodes the real QR with jsQR and checks u and k in memory. The modal, device reducer, 4401 message and the single shared WebSocket behave as the issue asks. check:web (80 tests) and e2e:web (20 passed) are green.

FIX (score ≥ 5)

often=5 bad=1 score=5 — apps/web/src/devices/DevicesView.tsx:15: lastSeen returns "Just now", so rows read "Last seen Just now". Other units come from Intl ("Last seen 5 minutes ago"). Fix: return "just now".

Missing definition-of-done item

DevicesView/DeviceRow holds logic (confirm/cancel, failed-removal error, self vs other removal, sort, highlight) but has no Testing Library test. Add apps/web/src/devices/DevicesView.test.tsx: confirm then cancel; a failed removeDevice shows the inline error and keeps the row; removing self calls onRemoveSelf, not removeDevice.

FILE (score < 5, code left alone, filed on ENG-275)

score=4 — PairingModal.tsx:40-41,76,145: countdown compares the server's expiresAt with the client clock; a skewed client clock shows instant expiry or an over-long timer.
score=2 — PairingModal.tsx:88: nothing asserts QR error-correction level M (§6.7).
score=2 — App.tsx/SettingsView.tsx: no test asserts "You have signed out of this browser." after sign-out or self-removal (the 4401 race guard is untested).
score=3 — DeviceNameForm.tsx:76: "Device name saved." sits directly under Save name in Settings with no spacing.

Spec (§13, §7.5, §6.7, §8, §9) and DESIGN.md: OK. Next: omp round 2 for the FIX and the missing test.

v1 1w ago

demi.dev 1w ago

pneumo-reviewer: round 2 (head 8b4efa1), APPROVE #

The round fixes the one FIX and adds the missing definition-of-done test. Nothing else changed: git range-diff shows the rebased c1c9935 is patch-identical to round 1's cba2c93.

FIX resolved: DevicesView.tsx:15 returns "just now"; the re-run devices-list-light.png reads "Last seen just now".
DoD resolved: new apps/web/src/devices/DevicesView.test.tsx (4 tests): self-first sort; confirm then cancel (focus returns, nothing revoked); failed removal (buttons disabled while busy, inline alert, row kept, buttons re-enabled); self-removal calls onRemoveSelf, not removeDevice.
Round-1 FILE findings stay on ENG-275, code left alone. No new findings.

Verify (reviewer and lead): mise run check:web exit 0 (84 tests, build OK); mise run e2e:web exit 0 (20 passed); no e2e containers left. CI 3/3 on 8b4efa1.

Versions

pneumo-reviewer: round 1, REQUEST_CHANGES #

pneumo-reviewer: round 2 (head 8b4efa1), APPROVE #