feat(trust): add fileless device pairing

README.md

@@ -81,23 +81,24 @@ yoop clipboard sync --device "My-Mac"
 
 # First-time pairing over VPN
 # Device A:
-yoop clipboard sync
-# → Code: A7K9
+yoop trust pair --listen
 
 # Device B:
-yoop clipboard sync --host 100.103.164.32 A7K9
-# After successful connection, Device B is trusted
+yoop trust pair --host 100.103.164.32
+# Or scan Tailscale peers with pairing listeners:
+yoop trust pair
 
 # Subsequent connections (automatic):
 yoop clipboard sync --device "Device-A"
 ```
 
 **How it works:**
 
-1. **First connection**: Use `--host IP[:PORT]` with a share code
-2. **Trusted pairing**: After connection, devices are added to trust store with stored IP
-3. **Future connections**: Use `--device <name>` for codeless connections
-4. **Auto-fallback**: If discovery fails, automatically tries stored IP addresses
+1. **Pairing listener**: One device runs `yoop trust pair --listen`
+2. **Device discovery**: The other runs `yoop trust pair` to scan LAN and Tailscale peers, or `--host IP[:PORT]`
+3. **Trusted pairing**: Both devices exchange signed Ed25519 identities and store trusted addresses
+4. **Future connections**: Use `--device <name>` for codeless connections
+5. **Auto-fallback**: If discovery fails, automatically tries stored IP addresses
 
 **Supported on all commands:**
 
@@ -296,6 +297,13 @@ Send files directly to trusted devices without share codes:
 yoop share file.txt
 # After accepting, you'll be prompted to trust the device
 
+# Pair without transferring files
+# Device A:
+yoop trust pair --listen
+# Device B:
+yoop trust pair                    # Scan LAN + Tailscale for pairing listeners
+yoop trust pair --host 192.168.1.100
+
 # Subsequent transfers: Direct send (no code needed)
 yoop send "Device-Name" file.txt
 

crates/yoop-cli/src/commands/mod.rs

@@ -286,6 +286,41 @@ pub enum TrustAction {
     /// List trusted devices
     List,
 
+    /// Pair with another device without transferring files
+    Pair {
+        /// Listen for one incoming pairing request
+        #[arg(long)]
+        listen: bool,
+
+        /// Pair directly with a host IP or IP:PORT
+        #[arg(long, value_name = "IP[:PORT]")]
+        host: Option<String>,
+
+        /// Duration to scan for pairing listeners
+        #[arg(long, default_value = "5s")]
+        scan: String,
+
+        /// TCP port used for the pairing handshake
+        #[arg(long, default_value_t = yoop_core::DEFAULT_PAIRING_PORT)]
+        port: u16,
+
+        /// TCP port to store for future trusted connections
+        #[arg(long, default_value_t = yoop_core::DEFAULT_TRANSFER_PORT_START)]
+        trust_port: u16,
+
+        /// Trust level to store (full, ask). Defaults to full in non-interactive mode.
+        #[arg(long)]
+        level: Option<String>,
+
+        /// Accept prompts automatically
+        #[arg(short = 'y', long)]
+        yes: bool,
+
+        /// Output machine-readable JSON
+        #[arg(long)]
+        json: bool,
+    },
+
     /// Remove a trusted device
     Remove {
         /// Device name or ID