Requirement
The AP password must remain editable in Bridged mode. Disabling/hiding the field is not acceptable. Editing the password while Bridged must take effect immediately and survive a later revert/boot.
(Supersedes the original proposal to disable the field. The earlier write-up framed disabling as the "simplest" guard — rejected: the operator must be able to change the AP password regardless of integration mode.)
Why it needs work (current gap)
While Bridged, NM drops the in-file psk, so the device-side stash (/var/lib/halos/ap-bridge/psk) is the recovery source of truth, and it's written only by the enter-Bridged switch flow. A plain password edit doesn't update the stash, so:
- the change may not take effect on the running bridged AP, and
- the next revert/boot restores the old password from the stale stash, silently locking out clients provisioned with the new one.
Fix direction
On a psk change saved while the AP is Bridged:
- Re-key the live AP with the new psk via the existing bridged-safe activation (the watchdog
up / passwd-file path), so it takes effect immediately.
- Re-sync the stash to the new psk by re-running the existing
stash capture (reads the psk from the keyfile — no psk on argv, reusing the verified machinery), so revert/boot restore the new password.
Reuse the existing stash and up watchdog modes — do not invent a new psk-transport, and never pass the psk on argv/log.
Open verification
- Confirm the keyfile transiently holds the newly-saved psk after a Bridged D-Bus save, so the
stash re-capture can read it. If NM drops it too fast, route the new psk to the stash via another no-argv path (e.g. a 0600 passwd-file the dialog writes) instead.
- On-device: edit the password while Bridged → confirm a connected client must re-auth with the new psk, then revert → confirm the AP comes back on the new password (not the old).
Relates to the psk-stash design (cnm-halos#20) and the AP integration-mode feature (#79).
Requirement
The AP password must remain editable in Bridged mode. Disabling/hiding the field is not acceptable. Editing the password while Bridged must take effect immediately and survive a later revert/boot.
(Supersedes the original proposal to disable the field. The earlier write-up framed disabling as the "simplest" guard — rejected: the operator must be able to change the AP password regardless of integration mode.)
Why it needs work (current gap)
While Bridged, NM drops the in-file psk, so the device-side stash (
/var/lib/halos/ap-bridge/psk) is the recovery source of truth, and it's written only by the enter-Bridged switch flow. A plain password edit doesn't update the stash, so:Fix direction
On a psk change saved while the AP is Bridged:
up/ passwd-file path), so it takes effect immediately.stashcapture (reads the psk from the keyfile — no psk on argv, reusing the verified machinery), so revert/boot restore the new password.Reuse the existing
stashandupwatchdog modes — do not invent a new psk-transport, and never pass the psk on argv/log.Open verification
stashre-capture can read it. If NM drops it too fast, route the new psk to the stash via another no-argv path (e.g. a 0600 passwd-file the dialog writes) instead.Relates to the psk-stash design (cnm-halos#20) and the AP integration-mode feature (#79).