Device keypair minting and registration for cowork remote sessions is built, but nothing here turns the flow on.
What
A new subsystem mints a P-256 keypair per account, stores it in secure storage, and registers it with your organization so a remote session can be tied to the specific machine that started it. It signs a binding payload when creating a session. Nothing in this build was found to switch the cowork remote-device flow on, so whether you ever reach it is decided elsewhere.
Details
- Registration POSTs
display_name,platformandpublic_key; the platform value is hardcoded to "linux" regardless of the host operating system. - Failures are typed: key not persisted, request failed, not sent, HTTP error, revoked key, registration unavailable, and
cowork_remote_device_limit_reached. - Revoked or unreadable keys are retired and a new one is minted on the next attempt.
- Telemetry:
device_registry_registersuccess and failure counters, plustengu_device_bind_skipped,tengu_device_bind_failedandtengu_device_bind_prepared. - If the server accepts a session but does not bind it to this device, Claude retries unbound and reports
silent_drop.
Evidence
deviceRegistry: device key revoked server-side; a new key will be minted on the next registration, /api/organizations/:orgUUID/cowork/remote_devices
Strings lifted out of the shipped bundle, so the claim above can be checked against them.