ConnectOnion 1.9.3rc5 (release candidate)

Install this preview

Stable remains 1.9.2. Install this release candidate by exact pin:

python -m pip install --upgrade 'connectonion==1.9.3rc5'

Handoffs are end-to-end encrypted

co handoff used to store each handoff on the backend as readable JSON: the report, every message the sender typed, the AI's replies, and the code that picks it up. From this candidate the backend holds ciphertext.

• The handoff is sealed on the sender's machine. send encrypts it with AES-256-GCM under a random key made for that one handoff. The key travels in the link after # (o.openonion.ai/h/<id>#k=…) and in the code, which is now coh4. A browser never sends the part after #, so the page decrypts in the reader's browser and co handoff accept decrypts on the recipient's machine.
• After the handshake, every message is boxed to the other agent. The acceptance, questions, answers, done and its file, and the inbox copy of a later handoff are sealed with X25519 crypto_box from the two agents' own Ed25519 keys. The backend relays [co handoff] and a sealed blob. A box that does not open from the agent the backend says posted it is ignored.
• ask and done take the link too. A recipient whose agent accepted with the link can keep using it; before, ask with the link answered "Not a handoff code".
• The recipient installs this release. The install floor in the pasted prompt is 1.9.3rc5, because older co cannot read coh4 codes or #k= links.

What the backend still sees: which agent dropped the handoff, the sender's name, which coding agent the session came from, its language and size, and when it was sent and picked up. The note to the person is ordinary mail and carries the link; sent from your own Gmail or Outlook it does not pass through ConnectOnion, sent from the agent mailbox it does, and the preview says so. See Encryption.

Verification and limits

• New tests read what the faked backend stores and find no word of the handoff and no key. Two mutations (replies left unboxed, the page stored in the clear) turn them red.
• A real handoff between two isolated test identities on the live backend: send, accept by link, ask, answer, done with a patch. Every stored row was read back and held only ciphertext. A real codex exec accepted from the pasted line.
• The backend (oo-api v0.1.37) and the page's browser decryption (oo-frontend#37) were deployed first.

Known and open:

• Handoffs sent by 1.9.3rc4 or earlier (coh3 codes) keep working and stay plaintext on the backend until they expire, with the messages about them.
• The first note to the person is not end to end; it is as private as the mailbox that sends it.
• Everything listed as open in the 1.9.3rc4 notes still applies.