@aiworker/web 1.22.0 → 1.23.0

package/server/lib/changelog/update-notes.js

@@ -0,0 +1,82 @@
+// Release notes for the update dialog.
+//
+// The repo publishes `changelog/index.json` on `main`: one object per release,
+// newest first, with the app notes grouped as New / Improvements / Fixes /
+// Misc. This module fetches it and renders the releases between the installed
+// version (exclusive) and the offered one (inclusive) as the Markdown the
+// dialog already understands: a `## [x.y.z] - YYYY-MM-DD` header per release,
+// the release title in bold, the intro, then the groups.
+//
+// Any failure (network, 404, unexpected shape) yields null: the update is
+// still offered, only without notes.
+
+export const CHANGELOG_INDEX_URL = 'https://raw.githubusercontent.com/openchamber/openchamber/main/changelog/index.json';
+
+const GROUPS = [
+  ['new', 'New'],
+  ['improvements', 'Improvements'],
+  ['fixes', 'Fixes'],
+  ['misc', 'Misc'],
+];
+
+const VERSION_PATTERN = /^\d+\.\d+\.\d+$/;
+const DATE_PATTERN = /^\d{4}-\d{2}-\d{2}$/;
+
+// The file crosses a network boundary with no schema library on this side, so
+// each field is coerced into its domain shape here; a release without a valid
+// version and date is dropped.
+const text = (value) => (value === null || value === undefined ? null : String(value).trim() || null);
+const bulletList = (value) => (Array.isArray(value) ? value.map((item) => String(item)) : []);
+
+const parseRelease = (entry) => {
+  if (entry === null || entry === undefined) return null;
+  const version = text(entry.version);
+  const date = text(entry.date);
+  if (!version || !VERSION_PATTERN.test(version) || !date || !DATE_PATTERN.test(date)) return null;
+  const app = entry.app ?? {};
+  return {
+    version,
+    date,
+    title: text(entry.title),
+    intro: text(entry.intro),
+    groups: GROUPS.map(([key, heading]) => ({ heading, bullets: bulletList(app[key]) })),
+  };
+};
+
+const renderRelease = (release) => {
+  const lines = [`## [${release.version}] - ${release.date}`, ''];
+  if (release.title) lines.push(`**${release.title}**`, '');
+  if (release.intro) lines.push(release.intro, '');
+  for (const { heading, bullets } of release.groups) {
+    if (bullets.length === 0) continue;
+    lines.push(`### ${heading}`, '', ...bullets.map((bullet) => `- ${bullet}`), '');
+  }
+  return lines.join('\n').trim();
+};
+
+/**
+ * Markdown for the releases in (fromVersion, toVersion], newest first, or
+ * null when the index holds none of them.
+ */
+export function renderUpdateNotes(index, fromVersion, toVersion, compareVersions) {
+  if (!Array.isArray(index)) return null;
+  const relevant = index
+    .map(parseRelease)
+    .filter((release) => release !== null)
+    .filter((release) => compareVersions(release.version, fromVersion) > 0 && compareVersions(release.version, toVersion) <= 0)
+    .sort((a, b) => compareVersions(b.version, a.version));
+  if (relevant.length === 0) return null;
+  return relevant.map(renderRelease).join('\n\n');
+}
+
+/** Fetch the index and render the notes for one update; null on any failure. */
+export async function fetchUpdateNotes(fromVersion, toVersion, compareVersions, options = {}) {
+  const fetchImpl = options.fetch ?? fetch;
+  try {
+    const response = await fetchImpl(CHANGELOG_INDEX_URL, { signal: AbortSignal.timeout(options.timeoutMs ?? 10_000) });
+    if (!response.ok) return null;
+    return renderUpdateNotes(await response.json(), fromVersion, toVersion, compareVersions);
+  } catch {
+    return null;
+  }
+}

package/server/lib/changelog/update-notes.test.js

@@ -0,0 +1,59 @@
+import { describe, expect, it } from 'vitest';
+import { fetchUpdateNotes, renderUpdateNotes } from './update-notes.js';
+
+const compare = (a, b) => {
+  const pa = a.split('.').map(Number);
+  const pb = b.split('.').map(Number);
+  for (let i = 0; i < 3; i += 1) if (pa[i] !== pb[i]) return pa[i] - pb[i];
+  return 0;
+};
+
+const index = [
+  { version: '1.2.3', date: '2026-03-03', title: 'Comments everywhere', intro: 'A short intro.', app: { new: ['**Comments:** on code.'], improvements: [], fixes: ['Chat: no freeze.'], misc: [] }, vscode: null },
+  { version: '1.2.2', date: '2026-03-02', title: null, intro: null, app: { new: [], improvements: ['Faster.'], fixes: [], misc: [] }, vscode: null },
+  { version: '1.2.1', date: '2026-03-01', title: 'Old', intro: null, app: { new: ['Older.'], improvements: [], fixes: [], misc: [] }, vscode: null },
+];
+
+describe('renderUpdateNotes', () => {
+  it('renders the releases after the installed version up to the offered one, newest first', () => {
+    expect(renderUpdateNotes(index, '1.2.1', '1.2.3', compare)).toBe(`## [1.2.3] - 2026-03-03
+
+**Comments everywhere**
+
+A short intro.
+
+### New
+
+- **Comments:** on code.
+
+### Fixes
+
+- Chat: no freeze.
+
+## [1.2.2] - 2026-03-02
+
+### Improvements
+
+- Faster.`);
+  });
+
+  it('returns null when nothing lies in the range or the payload is not an index', () => {
+    expect(renderUpdateNotes(index, '1.2.3', '1.2.3', compare)).toBe(null);
+    expect(renderUpdateNotes({ entries: [] }, '1.0.0', '9.9.9', compare)).toBe(null);
+    expect(renderUpdateNotes([{ version: 'nope' }, { version: '1.2.2', date: '2026' }], '1.0.0', '9.9.9', compare)).toBe(null);
+  });
+});
+
+describe('fetchUpdateNotes', () => {
+  it('turns a failed request or a thrown fetch into null', async () => {
+    const notFound = async () => ({ ok: false });
+    expect(await fetchUpdateNotes('1.0.0', '2.0.0', compare, { fetch: notFound })).toBe(null);
+    const throwing = async () => { throw new Error('offline'); };
+    expect(await fetchUpdateNotes('1.0.0', '2.0.0', compare, { fetch: throwing })).toBe(null);
+  });
+
+  it('renders a successful response', async () => {
+    const ok = async () => ({ ok: true, json: async () => index });
+    expect(await fetchUpdateNotes('1.2.2', '1.2.3', compare, { fetch: ok })).toMatch(/^## \[1\.2\.3\] - 2026-03-03\n\n\*\*Comments everywhere\*\*/);
+  });
+});

package/server/lib/client-auth/remote-clients.test.js

@@ -86,15 +86,15 @@ describe('remote client auth runtime', () => {
   it('keeps the replaced record label on a dedupe re-mint without an explicit label', async () => {
     const { dir, runtime } = await createRuntime();
     try {
-      await runtime.createClient({ label: 'Iryna iPhone', dedupeKey: 'mobile:device-1', fallbackLabel: 'OpenChamber Mobile' });
-      const remint = await runtime.createClient({ dedupeKey: 'mobile:device-1', fallbackLabel: 'OpenChamber Mobile' });
+      await runtime.createClient({ label: 'Iryna iPhone', dedupeKey: 'mobile:device-1', fallbackLabel: 'AiWorker Mobile' });
+      const remint = await runtime.createClient({ dedupeKey: 'mobile:device-1', fallbackLabel: 'AiWorker Mobile' });
       expect(remint.client.label).toBe('Iryna iPhone');
 
-      const renamed = await runtime.createClient({ label: 'Work phone', dedupeKey: 'mobile:device-1', fallbackLabel: 'OpenChamber Mobile' });
+      const renamed = await runtime.createClient({ label: 'Work phone', dedupeKey: 'mobile:device-1', fallbackLabel: 'AiWorker Mobile' });
       expect(renamed.client.label).toBe('Work phone');
 
-      const fresh = await runtime.createClient({ dedupeKey: 'mobile:device-2', fallbackLabel: 'OpenChamber Mobile' });
-      expect(fresh.client.label).toBe('OpenChamber Mobile');
+      const fresh = await runtime.createClient({ dedupeKey: 'mobile:device-2', fallbackLabel: 'AiWorker Mobile' });
+      expect(fresh.client.label).toBe('AiWorker Mobile');
     } finally {
       await fs.rm(dir, { recursive: true, force: true });
     }

package/server/lib/context-obligatory/runtime.js

@@ -5,15 +5,15 @@ const isRecord = (value) => Boolean(value && typeof value === 'object' && !Array
 
 const readContextState = (session) => {
   const metadata = isRecord(session?.metadata) ? session.metadata : {};
-  const openchamber = isRecord(metadata.openchamber) ? metadata.openchamber : {};
-  const messages = Array.isArray(openchamber.context_obligatory_messages)
-    ? openchamber.context_obligatory_messages.filter((item) =>
+  const aiworker = isRecord(metadata.aiworker) ? metadata.aiworker : {};
+  const messages = Array.isArray(aiworker.context_obligatory_messages)
+    ? aiworker.context_obligatory_messages.filter((item) =>
       isRecord(item)
       && typeof item.id === 'string'
       && typeof item.createdAt === 'number'
       && (item.role === 'user' || item.role === 'assistant'))
     : [];
-  return { metadata, openchamber, messages };
+  return { metadata, aiworker, messages };
 };
 
 const buildContextPrompt = (entries) => {
@@ -89,7 +89,7 @@ export const createContextObligatoryRuntime = ({
     const summary = recent.toReversed().find((message) =>
       message?.info?.role === 'assistant' && message.info.summary === true)?.info;
     if (!summary?.id || !summary?.time?.completed) return;
-    if (state.openchamber.context_obligatory_last_compaction_message_id === summary.id) return;
+    if (state.aiworker.context_obligatory_last_compaction_message_id === summary.id) return;
 
     const fetched = await Promise.allSettled(state.messages.map(async (pinned) => {
       const message = await openCodeFetch(
@@ -138,8 +138,8 @@ export const createContextObligatoryRuntime = ({
       body: {
         metadata: {
           ...freshState.metadata,
-          openchamber: {
-            ...freshState.openchamber,
+          aiworker: {
+            ...freshState.aiworker,
             context_obligatory_last_compaction_message_id: summary.id,
             // Recorded together with the cursor: the session now carries this
             // knowledge again, so the next send must not repeat it.

package/server/lib/context-obligatory/runtime.test.js

@@ -23,7 +23,7 @@ describe('context obligatory runtime', () => {
         sessionReads += 1;
         return json({
           id: 'ses_1',
-          metadata: { openchamber: { context_obligatory_messages: [
+          metadata: { aiworker: { context_obligatory_messages: [
             { id: 'msg_2', createdAt: 20, role: 'assistant' },
             { id: 'msg_1', createdAt: 10, role: 'user' },
           ] } },
@@ -58,7 +58,7 @@ describe('context obligatory runtime', () => {
     expect(payload.parts[0].text).toContain('Only if no tasks or next steps remain');
     expect(payload.parts[0].text).toContain('no more than one short paragraph');
     const patch = requests.find((request) => request.method === 'PATCH');
-    expect(JSON.parse(patch.body).metadata.openchamber.context_obligatory_last_compaction_message_id).toBe('msg_summary');
+    expect(JSON.parse(patch.body).metadata.aiworker.context_obligatory_last_compaction_message_id).toBe('msg_summary');
     expect(sessionReads).toBe(2);
     runtime.stop();
   });
@@ -75,7 +75,7 @@ describe('context obligatory runtime', () => {
       if (url.pathname === '/session/ses_1' && init.method === 'PATCH') return json({});
       if (url.pathname === '/session/ses_1') return json({
         id: 'ses_1',
-        metadata: { openchamber: { knowledge_context_delivered: 'sig-before-compaction' } },
+        metadata: { aiworker: { knowledge_context_delivered: 'sig-before-compaction' } },
       });
       if (url.pathname === '/session/ses_1/message') return json([
         { info: { id: 'msg_agent', role: 'assistant', providerID: 'provider', modelID: 'model', agent: 'build' } },
@@ -112,7 +112,7 @@ describe('context obligatory runtime', () => {
     expect(JSON.parse(prompt.body).parts[0].text).toContain('Remember this.');
     const patch = requests.find((request) => request.method === 'PATCH');
     // Recorded with the cursor, so the next ordinary send does not repeat it.
-    expect(JSON.parse(patch.body).metadata.openchamber.knowledge_context_delivered).toBe('sig-1');
+    expect(JSON.parse(patch.body).metadata.aiworker.knowledge_context_delivered).toBe('sig-1');
   });
 
   it('sends pinned messages and project knowledge as one message', async () => {
@@ -123,7 +123,7 @@ describe('context obligatory runtime', () => {
       if (url.pathname === '/session/ses_1' && init.method === 'PATCH') return json({});
       if (url.pathname === '/session/ses_1') return json({
         id: 'ses_1',
-        metadata: { openchamber: { context_obligatory_messages: [{ id: 'msg_1', createdAt: 10, role: 'user' }] } },
+        metadata: { aiworker: { context_obligatory_messages: [{ id: 'msg_1', createdAt: 10, role: 'user' }] } },
       });
       if (url.pathname === '/session/ses_1/message') return json([
         { info: { id: 'msg_agent', role: 'assistant', providerID: 'provider', modelID: 'model', agent: 'build' } },

package/server/lib/data-dir-migration.js

@@ -0,0 +1,40 @@
+// One-time copy of the user-authored folders into a custom data directory.
+//
+// `AIWORKER_DATA_DIR` is documented as "the AiWorker data directory",
+// but for a long time only the flat files (settings, auth, push tokens)
+// followed it while `projects/`, `themes/`, and `speech-models/` stayed under
+// `~/.config/openchamber`. Now every folder hangs off the data directory, so an
+// instance that already ran with a custom directory finds those folders in
+// the old place. This copies each one over once: only when the new location
+// does not exist yet and the old one does. It copies rather than moves
+// because a second instance on the same machine (a custom directory next to
+// the default one) must not strip the default instance of its projects.
+
+const USER_DIR_ENTRIES = Object.freeze(['projects', 'themes', 'speech-models']);
+
+const exists = async (fsPromises, target) => fsPromises.access(target).then(() => true, () => false);
+
+/**
+ * Copy the user folders from `legacyRoot` into `dataDir`. Returns the entries
+ * copied. A no-op when the two roots are the same directory. A folder whose
+ * copy fails is reported through `warn` and its partial copy removed; the
+ * server keeps starting, reading the (empty) new location.
+ */
+export const migrateLegacyUserDirs = async ({ fsPromises, path, dataDir, legacyRoot, warn = () => {}, entries = USER_DIR_ENTRIES }) => {
+  if (path.resolve(dataDir) === path.resolve(legacyRoot)) return [];
+  const moved = [];
+  for (const entry of entries) {
+    const from = path.join(legacyRoot, entry);
+    const to = path.join(dataDir, entry);
+    if (await exists(fsPromises, to) || !(await exists(fsPromises, from))) continue;
+    try {
+      await fsPromises.mkdir(dataDir, { recursive: true });
+      await fsPromises.cp(from, to, { recursive: true, errorOnExist: true, force: false });
+      moved.push(entry);
+    } catch (error) {
+      await fsPromises.rm(to, { recursive: true, force: true }).catch(() => {});
+      warn(`Failed to copy ${from} to ${to}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  return moved;
+};

package/server/lib/data-dir-migration.test.js

@@ -0,0 +1,59 @@
+import { describe, expect, it } from 'vitest';
+import os from 'os';
+import path from 'path';
+import fsPromises from 'fs/promises';
+
+import { migrateLegacyUserDirs } from './data-dir-migration.js';
+
+const setup = async () => {
+  const root = await fsPromises.mkdtemp(path.join(os.tmpdir(), 'oc-data-dir-'));
+  const legacyRoot = path.join(root, 'legacy');
+  const dataDir = path.join(root, 'custom');
+  await fsPromises.mkdir(path.join(legacyRoot, 'projects'), { recursive: true });
+  await fsPromises.writeFile(path.join(legacyRoot, 'projects', 'p.json'), '{"a":1}');
+  await fsPromises.mkdir(path.join(legacyRoot, 'themes'), { recursive: true });
+  return { root, legacyRoot, dataDir, cleanup: () => fsPromises.rm(root, { recursive: true, force: true }) };
+};
+
+describe('migrateLegacyUserDirs', () => {
+  it('copies the user folders once into a custom data dir and leaves the originals', async () => {
+    const { legacyRoot, dataDir, cleanup } = await setup();
+    try {
+      const warnings = [];
+      const moved = await migrateLegacyUserDirs({ fsPromises, path, dataDir, legacyRoot, warn: (message) => warnings.push(message) });
+      expect(moved).toEqual(['projects', 'themes']);
+      expect(warnings).toEqual([]);
+      expect(await fsPromises.readFile(path.join(dataDir, 'projects', 'p.json'), 'utf8')).toBe('{"a":1}');
+      // The default instance keeps its own copy: a second instance must not strip it.
+      expect(await fsPromises.readFile(path.join(legacyRoot, 'projects', 'p.json'), 'utf8')).toBe('{"a":1}');
+      // A second start copies nothing more.
+      expect(await migrateLegacyUserDirs({ fsPromises, path, dataDir, legacyRoot })).toEqual([]);
+    } finally {
+      await cleanup();
+    }
+  });
+
+  it('never merges into a folder that already exists in the data dir', async () => {
+    const { legacyRoot, dataDir, cleanup } = await setup();
+    try {
+      await fsPromises.mkdir(path.join(dataDir, 'projects'), { recursive: true });
+      await fsPromises.writeFile(path.join(dataDir, 'projects', 'q.json'), '{}');
+      const moved = await migrateLegacyUserDirs({ fsPromises, path, dataDir, legacyRoot });
+      expect(moved).toEqual(['themes']);
+      expect(await fsPromises.readdir(path.join(dataDir, 'projects'))).toEqual(['q.json']);
+      expect(await fsPromises.readdir(path.join(legacyRoot, 'projects'))).toEqual(['p.json']);
+    } finally {
+      await cleanup();
+    }
+  });
+
+  it('is a no-op when the data dir is the default root', async () => {
+    const { legacyRoot, cleanup } = await setup();
+    try {
+      expect(await migrateLegacyUserDirs({ fsPromises, path, dataDir: legacyRoot, legacyRoot })).toEqual([]);
+      expect(await fsPromises.readdir(path.join(legacyRoot, 'projects'))).toEqual(['p.json']);
+    } finally {
+      await cleanup();
+    }
+  });
+});

package/server/lib/dev-servers/parse.js

@@ -143,7 +143,7 @@ export const parseNetstatListeners = (output) => {
 /**
  * Narrows raw listeners to the ones worth offering as a preview target.
  *
- * `ownPorts` removes OpenChamber's own listeners — offering the user a preview
+ * `ownPorts` removes AiWorker's own listeners — offering the user a preview
  * of the app they are already looking at is pure noise.
  */
 export const selectDevServerCandidates = (listeners, { ownPorts = [], ownPids = [] } = {}) => {
@@ -169,7 +169,7 @@ const PROC_LOOPBACK_ADDRESSES = new Set(['0100007F', '00000000000000000000000001
  * Parses `/proc/net/tcp` and `/proc/net/tcp6`.
  *
  * The fallback for hosts without `lsof`, which is most containers — and a
- * deployed OpenChamber is exactly where a dev server needs discovering. Reads a
+ * deployed AiWorker is exactly where a dev server needs discovering. Reads a
  * kernel file rather than shelling out, so it cannot be defeated by a missing
  * binary or a stripped PATH.
  *

package/server/lib/dev-servers/parse.test.js

@@ -100,11 +100,11 @@ describe('candidate selection', () => {
   const listeners = [
     { port: 5173, pid: 10, command: 'node' },
     { port: 5432, pid: 11, command: 'postgres' },
-    { port: 4096, pid: 12, command: 'openchamber' },
+    { port: 4096, pid: 12, command: 'aiworker' },
     { port: 3000, pid: 13, command: 'node' },
   ];
 
-  test('drops OpenChamber own ports so the app never offers itself', () => {
+  test('drops AiWorker own ports so the app never offers itself', () => {
     const ports = selectDevServerCandidates(listeners, { ownPorts: [4096] }).map((entry) => entry.port);
     expect(ports).toEqual([5173, 3000]);
   });

package/server/lib/dev-servers/routes.js

@@ -50,7 +50,7 @@ const runCommand = (spawn, command, args, timeoutMs) => new Promise((resolve) =>
 
 /**
  * Reads the kernel's socket tables. Containers routinely ship without `lsof`,
- * and a deployed OpenChamber is precisely where discovery has to work, so this
+ * and a deployed AiWorker is precisely where discovery has to work, so this
  * is tried whenever the command is unavailable.
  */
 const readProcListeners = async (readFile) => {

package/server/lib/dev-tunnel/DOCUMENTATION.md

@@ -20,7 +20,13 @@ and what made it fragile per framework.
 - `client.js` is the local end: it binds a loopback listener on the user's
   machine and pipes each accepted connection through one WebSocket. It lives in
   this package because it needs a WebSocket client the package already depends
-  on; the desktop shell drives it over IPC.
+  on; the desktop shell drives it over IPC for directly reachable HTTP(S)
+  runtimes.
+- Relay-only runtimes use `packages/electron/relay-dev-tunnel.mjs` for the local
+  listener. Each accepted connection gets an Electron `MessagePort`; the trusted
+  renderer carries its bytes through the active E2EE relay. This keeps relay
+  credentials and encryption in their existing renderer owner instead of
+  duplicating them in Electron main.
 - Port discovery is not owned here. `runtime.js` is given the reachable set by
   the same dev-server discovery the user's own list is built from.
 - The browser panel decides when to tunnel; this module never chooses a target.
@@ -40,9 +46,12 @@ and what made it fragile per framework.
     usual origin allowlist applies unchanged. That check is a CSRF defence: a
     hostile page can make a browser open a WebSocket carrying ambient cookies,
     and the origin is what exposes it.
-  - With no `Origin` the request must carry client-token auth. A browser cannot
-    reach this path — the WebSocket API always sends an origin and never lets a
-    page set an `Authorization` header — so this case is the desktop shell.
+  - With no `Origin` the request must carry client-token auth or a short-lived
+    URL token. The bearer case is the desktop main process. The URL-token case
+    is the trusted renderer carrying the socket through the E2EE relay.
+  - Through the E2EE relay, the trusted renderer mints a short-lived URL token
+    and includes it in the virtual WebSocket URL. The relay host and URL-token
+    allowlists accept exactly `/api/dev-tunnel`, not subpaths.
 - Concurrency is capped per host, not per page, because one page load opens
   many sockets.
 - A connection that cannot be established fails the socket rather than holding

package/server/lib/dev-tunnel/client.js

@@ -2,7 +2,7 @@
  * Local end of the dev-server tunnel.
  *
  * Binds a loopback listener on this machine and pipes every connection to a
- * dev server on the OpenChamber host. The point of binding a real local port —
+ * dev server on the AiWorker host. The point of binding a real local port —
  * rather than serving the remote page under a path on some other origin — is
  * that the page then has its own origin at the root of its own host. Absolute
  * URLs resolve, cookies scope correctly, HMR sockets connect, and nothing has

package/server/lib/dev-tunnel/runtime.js

@@ -1,5 +1,5 @@
 /**
- * Raw byte tunnel to a dev server running on the OpenChamber host.
+ * Raw byte tunnel to a dev server running on the AiWorker host.
  *
  * This is what lets a desktop client preview a dev server that lives on another
  * machine without rewriting anything. The client binds its own local port and
@@ -20,9 +20,9 @@
  *
  * - With an `Origin` header, the request came from a browser context and the
  *   usual origin check applies unchanged.
- * - With no `Origin`, the request must carry client-token auth. A browser
- *   cannot reach this path: the WebSocket API always sends an origin and never
- *   lets a page set an `Authorization` header.
+ * - With no `Origin`, the request must carry client-token auth or a short-lived
+ *   URL token. The URL-token case is used only by the trusted renderer through
+ *   the E2EE relay; the UI-auth allowlist limits it to this exact path.
  */
 import net from 'node:net';
 import { WebSocketServer } from 'ws';
@@ -133,7 +133,7 @@ export function createDevTunnelRuntime({
     void (async () => {
       try {
         if (uiAuthController?.enabled) {
-          const auth = await uiAuthController.resolveAuthContext(req, null, { allowUrlToken: false });
+          const auth = await uiAuthController.resolveAuthContext(req, null, { allowUrlToken: true });
           if (!auth) {
             rejectWebSocketUpgrade(socket, 401, 'UI authentication required');
             return;

package/server/lib/dev-tunnel/tunnel.test.js

@@ -1,12 +1,13 @@
 import { afterEach, describe, expect, test } from 'bun:test';
 import http from 'node:http';
 import net from 'node:net';
+import WebSocket from 'ws';
 
 import { createDevTunnelClient } from './client.js';
 import { createDevTunnelRuntime, isDevTunnelPath } from './runtime.js';
 
 /**
- * These exercise the real socket path end to end: a dev server, an OpenChamber
+ * These exercise the real socket path end to end: a dev server, an AiWorker
  * host tunnelling to it, and a client binding a local port. Anything less would
  * not prove the thing that matters — that a page loads over the tunnel exactly
  * as it does locally.
@@ -228,6 +229,12 @@ describe('dev tunnel authentication', () => {
     enabled: true,
     resolveAuthContext: async () => ({ type: 'session' }),
   };
+  const urlTokenAuth = {
+    enabled: true,
+    resolveAuthContext: async (req, _res, options) => (
+      options?.allowUrlToken === true && req.url.includes('oc_url_token=good') ? { type: 'client', token: 'url:authenticated' } : null
+    ),
+  };
 
   test('accepts a bearer-authenticated client that sends no origin', async () => {
     const devPort = await startDevServer((_req, res) => res.end('ok'));
@@ -243,6 +250,19 @@ describe('dev tunnel authentication', () => {
     expect((await httpGet(localPort, '/')).body).toBe('ok');
   });
 
+  test('accepts a URL-token client carried by the E2EE relay', async () => {
+    const devPort = await startDevServer((_req, res) => res.end('relay-ok'));
+    const host = await startHost({ allowedPorts: [devPort], auth: urlTokenAuth });
+
+    const body = await new Promise((resolve, reject) => {
+      const socket = new WebSocket(`ws://127.0.0.1:${host.port}/api/dev-tunnel?port=${devPort}&oc_url_token=good`);
+      socket.on('open', () => socket.send('GET / HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n'));
+      socket.on('message', (data) => resolve(Buffer.from(data).toString()));
+      socket.on('error', reject);
+    });
+    expect(body).toContain('relay-ok');
+  });
+
   test('rejects a client with no credentials', async () => {
     const devPort = await startDevServer((_req, res) => res.end('ok'));
     const host = await startHost({ allowedPorts: [devPort], auth: clientAuth });

package/server/lib/dictation/local/model-catalog.js

@@ -1,7 +1,7 @@
 /**
  * Catalog of local sherpa-onnx STT models available for dictation.
  * Models are downloaded on demand from the k2-fsa GitHub releases and
- * extracted under the OpenChamber speech-models directory.
+ * extracted under the AiWorker speech-models directory.
  *
  * `type` selects the recognizer construction path in the worker:
  * - 'nemo_transducer': encoder/decoder/joiner transducer (Parakeet)

package/server/lib/dictation/local/worker-process.js

@@ -2,7 +2,7 @@
  * Dictation local-speech worker process.
  *
  * Hosts the sherpa-onnx native inference (Parakeet STT) in a separate process
- * so ONNX decoding never blocks the main OpenChamber server. Communicates
+ * so ONNX decoding never blocks the main AiWorker server. Communicates
  * with the parent over child_process IPC (advanced serialization, so Buffers
  * survive the trip as Uint8Array).
  *
@@ -24,7 +24,7 @@ import { getLocalSttModelDir, getLocalSttModelSpec } from './model-catalog.js';
 import { pcm16ToWav } from '../audio.js';
 import path from 'path';
 
-process.title = 'OpenChamber Dictation';
+process.title = 'AiWorker Dictation';
 
 const engines = new Map();
 const ttsEngines = new Map();

package/server/lib/event-stream/directory-ws-bridge.js

@@ -56,7 +56,7 @@ export function acceptDirectoryMessageStreamWsConnection({
       return;
     }
 
-    sendMessageStreamWsEvent(socket, { type: 'openchamber:heartbeat', timestamp: Date.now() }, { directory: 'global' });
+    sendMessageStreamWsEvent(socket, { type: 'aiworker:heartbeat', timestamp: Date.now() }, { directory: 'global' });
   }, heartbeatIntervalMs);
 
   socket.on('close', () => {

package/server/lib/event-stream/global-ws-bridge.js

@@ -177,7 +177,7 @@ export function createGlobalMessageStreamWsBridge({
         return;
       }
 
-      sendMessageStreamWsEvent(socket, { type: 'openchamber:heartbeat', timestamp: Date.now() }, { directory: 'global' });
+      sendMessageStreamWsEvent(socket, { type: 'aiworker:heartbeat', timestamp: Date.now() }, { directory: 'global' });
     }, heartbeatIntervalMs);
 
     socket.on('close', () => {

package/server/lib/event-stream/protocol.test.js

@@ -32,14 +32,14 @@ describe('event stream protocol helpers', () => {
 
   it('derives directory from payload properties when not wrapped', () => {
     const envelope = parseSseEventEnvelope(
-      'data: {"type":"openchamber:notification","properties":{"directory":"/tmp/project"}}\n'
+      'data: {"type":"aiworker:notification","properties":{"directory":"/tmp/project"}}\n'
     );
 
     expect(envelope).toEqual({
       eventId: null,
       directory: '/tmp/project',
       payload: {
-        type: 'openchamber:notification',
+        type: 'aiworker:notification',
         properties: { directory: '/tmp/project' },
       },
     });
@@ -167,14 +167,14 @@ describe('event stream protocol helpers', () => {
 
     const sent = sendMessageStreamWsEvent(
       socket,
-      { type: 'openchamber:heartbeat', timestamp: 1 },
+      { type: 'aiworker:heartbeat', timestamp: 1 },
       { eventId: 'evt-2', directory: '/tmp/project' }
     );
 
     expect(sent).toBe(true);
     expect(JSON.parse(rawPayload)).toEqual({
       type: 'event',
-      payload: { type: 'openchamber:heartbeat', timestamp: 1 },
+      payload: { type: 'aiworker:heartbeat', timestamp: 1 },
       eventId: 'evt-2',
       directory: '/tmp/project',
     });