@khanglvm/relay 0.13.8 → 0.14.0

package/README.md

@@ -43,7 +43,7 @@ step, leaving any boards you have open untouched.
 relay also runs as an **MCP App** ([SEP-1865](https://modelcontextprotocol.io/seps/1865-mcp-apps-interactive-user-interfaces-for-mcp))
 — so the same board renders **inline, right in the conversation**, on Claude
 desktop **and mobile** and in Codex, no browser tab. `rly mcp` is a
-zero-dependency stdio MCP server; register it once and the agent gets two tools,
+stdio MCP server with no npm runtime dependencies; register it once and the agent gets two tools,
 `relay_ask` (collect decisions/feedback with real form controls) and
 `relay_show` (present a plan, diagram, diff, table, or prototype):
 
@@ -81,16 +81,18 @@ unchanged; pick whichever surface fits.
 | Feedback = another wall of text | Click any chart point, diagram node, table cell, or sentence to comment — the agent replies and the thread grows on the board |
 
 Everything autosaves in real time (drafts survive timeouts), multiple boards
-run at once, and the package has **zero runtime dependencies** — plain
-Node ≥ 18; Chart.js / Mermaid / Graphviz are vendored and lazy-loaded offline.
+run at once, and the package has **zero npm runtime dependencies** — plain
+Node ≥ 18. Browser-side Chart.js, Mermaid, and Viz.js assets are vendored in
+the package and lazy-loaded offline when a board actually needs them.
 
 ## Learn more
 
 | | |
 |---|---|
 | `rly help` | every command at a glance |
-| `rly git pick` / `rly git cherry-pick` | choose commit actions and rank the order directly on a board |
+| `rly git pick` / `rly git cherry-pick` | choose commit actions and rank the order directly on a board; add `--code` to cherry-pick with split code review and per-hunk Apply/Skip/Hold |
 | `rly git conflict [files…]` | auto-detect unmerged conflict files, or open specific local paths, and return resolved content in `result.blockEdits` |
+| `rly share <board-id>` | activate/list/revoke same-Wi-Fi reviewer or collaborator links for a running browser board |
 | `rly view <file.md> …` | open a quick read-only board that renders local markdown file(s), data files, or PDFs — library-free; great for plans, READMEs, reports, quotes |
 | `rly install --target <agent>` | write relay's rules into an agent's instruction file — `claude` `codex` `cursor` `copilot` `kiro` `windsurf` `cline` `gemini` `opencode` `droid` `agents`; `--all`, `--scope`, `--print`, `--list` |
 | `rly upgrade` | update the CLI **and** refresh the skill in one step (safe around open boards; `--dry-run`, `--cli-only`, `--skill-only`) |
@@ -102,14 +104,14 @@ Node ≥ 18; Chart.js / Mermaid / Graphviz are vendored and lazy-loaded offline.
 ## Development
 
 ```sh
-npm test     # zero-dep smoke tests (spawns real servers, fake-submits)
+npm test     # smoke tests with no external services (spawns real servers, fake-submits)
 ```
 
 ## Changelog
 
 ### 0.11.0 — render inline inside the Claude & Codex apps (MCP App)
 - **`rly mcp` — relay as an MCP App** ([SEP-1865](https://modelcontextprotocol.io/seps/1865-mcp-apps-interactive-user-interfaces-for-mcp),
-  extension `io.modelcontextprotocol/ui`). A zero-dependency stdio MCP server
+  extension `io.modelcontextprotocol/ui`). A stdio MCP server with no npm runtime dependencies
   that declares a `ui://relay/board` resource (`text/html;profile=mcp-app`) and
   two tools, **`relay_ask`** and **`relay_show`**, linked to it via
   `_meta.ui.resourceUri` (plus `openai/outputTemplate` for ChatGPT/Codex). The
@@ -172,7 +174,8 @@ npm test     # zero-dep smoke tests (spawns real servers, fake-submits)
 - **Durable drafts / rescue** — every autosave mirrors to `localStorage`; a
   board whose connection drops blocks further input instead of losing it, and
   `rly rescue <id>` re-serves on the same port so an open tab reconnects.
-- Still **zero runtime dependencies**, offline, and cross-platform.
+- Still **zero npm runtime dependencies**, offline, and cross-platform. Vendored
+  browser libraries are loaded only for boards that need them.
 
 ### 0.9.1
 - The board **intro renders as markdown** (bold/italic/code/links/lists).

package/docs/AGENT.md

@@ -71,6 +71,28 @@ Answers **autosave in real time** as the user fills the board — a page reload
 restores them, and a draft survives timeouts/cancellation (included in those
 results), so partial input is never lost.
 
+## Same-Wi-Fi sharing
+
+Browser boards are local-owner only by default. A same-Wi-Fi phone/tablet/other
+laptop gets a locked page until sharing is explicitly activated. The owner can
+click **Share** at the bottom of the board, or you can manage the same links for
+the user:
+
+```sh
+rly share b-xxxxx                         # list active share roles
+rly share b-xxxxx --role review           # reviewer: add comments only
+rly share b-xxxxx --role collab           # collaborator: edit/comment/submit
+rly share b-xxxxx --role review --revoke  # revoke one role
+rly share b-xxxxx --revoke --all          # revoke all active links
+```
+
+Use `review` unless the user explicitly wants the other device to submit as the
+owner. Reviewers cannot change answers, submit, edit comments, or delete
+comments; their autosaves merge new comments into the existing draft.
+Collaborators can edit answers, comment, open allowed local file links, and
+submit. Shared viewers refresh from the live draft when another viewer saves,
+deferred while someone is typing/commenting.
+
 ## Inline mode — relay as an MCP App (Claude & Codex apps)
 
 Everything above is the **CLI** surface (you run `rly` in a terminal and read
@@ -166,6 +188,7 @@ Pick/cherry-pick commits or resolve conflicts on a board:
 ```sh
 rly git pick --limit 20               # checklist: pick/cherry-pick/drop + rank order
 rly git cherry-pick main..feature     # checklist: cherry-pick/skip/hold + rank order
+rly git cherry-pick --code main..feature # adds split code review with Apply/Skip/Hold per hunk
 rly git conflict                      # auto-detect unmerged files with conflict markers
 rly git conflict src/app.js           # resolve a specific conflicted file
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@khanglvm/relay",
-  "version": "0.13.8",
+  "version": "0.14.0",
   "description": "Question boards with rich blocks (markdown, charts, mermaid, tables, code, diffs, video, sandboxed HTML), clickable local file-links, and element-level annotations for AI coding agents (Claude Code, Codex, …): ask users structured questions, present interactive visuals, collect inline comments, read answers as JSON — in a local browser board OR rendered INLINE inside the Claude & Codex apps as an MCP App (SEP-1865).",
   "keywords": [
     "ai-agents",

package/skills/relay/SKILL.md

@@ -46,7 +46,7 @@ at — show it in a relay board instead of printing it.**
 | Gather requirements / plan approval / feedback round | **rly** |
 | Architecture or flow that benefits from a diagram | **rly** (mermaid block) |
 | "Show me the diff" / git diff / code changes / before-after | **rly** (`diff` block — run `git diff`, render it; never dump it in the terminal) |
-| Pick/cherry-pick commits or resolve conflict files | **rly git** (`rly git pick`, `rly git cherry-pick`, `rly git conflict`) |
+| Pick/cherry-pick commits or resolve conflict files | **rly git** (`rly git pick`, `rly git cherry-pick --code`, `rly git conflict`) |
 | A demo, screen recording or walkthrough | **rly** (`video` block) |
 | Point the user at a file to open (log, capture, report) | **rly** (a clickable local file-link in markdown) |
 | Let the user read a markdown file (README, plan, report) | **rly view file.md** (or a `markdown` block with `mdFile`) — never dump the file into the terminal |
@@ -174,6 +174,28 @@ Exit codes: 0 submitted · 2 timeout · 3 cancelled · 5 not found. On
 timeout/cancel the result still contains the autosaved `draft` of partial
 answers and any annotations written so far.
 
+## Same-Wi-Fi sharing
+
+Browser boards are local-owner only by default. A phone/tablet/other laptop on
+the same Wi-Fi gets a locked page until sharing is explicitly activated. The
+owner can click **Share** at the bottom of the board, or an agent can manage the
+same links with `rly share`:
+
+```sh
+rly share b-xxxxx                         # list active share roles
+rly share b-xxxxx --role review           # activate a reviewer link
+rly share b-xxxxx --role collab           # activate a collaborator link
+rly share b-xxxxx --role review --revoke  # revoke one role
+rly share b-xxxxx --revoke --all          # revoke all active share links
+```
+
+Use `review` when the other device should add comments only. Reviewers cannot
+change answers, submit, edit comments, or delete comments; their autosaves merge
+new comments into the existing draft. Use `collab` only when the user explicitly
+wants that device to act as the owner: collaborators can edit answers, comment,
+open allowed local file links, and submit. Shared viewers refresh from the live
+draft when another viewer saves, deferred while someone is typing/commenting.
+
 ## Minimal spec
 
 ```json
@@ -347,8 +369,9 @@ the option (and stays annotatable); the label row selects. Use per-option
 blocks whenever a question's choices have visual/example context; skip them
 for plainly textual options.
 
-Chart.js, Mermaid, and Graphviz are **vendored and lazy-loaded** — the base board
-stays dependency-free. PlantUML uses the public plantuml.com server by default;
+Chart.js, Mermaid, and Graphviz are **vendored and lazy-loaded** — the package
+has no npm runtime dependencies, but these browser assets are bundled for rich
+blocks. PlantUML uses the public plantuml.com server by default;
 pass `"server"` for a self-hosted instance. Legacy `"html"` / `"htmlFile"` /
 `"htmlHeight"` on root or questions are still accepted and normalised automatically.
 

package/src/cli.js

@@ -33,7 +33,7 @@ const VALUED_FLAGS = new Set([
   'file', 'html', 'html-file', 'title', 'intro', 'timeout', 'port',
   'submit-label', 'height', 'limit', 'target', 'id', 'replies',
   'on-result', 'notify-cmd', 'idle-grace', 'scope', 'range',
-  'host', 'token', 'allow-origin',
+  'host', 'token', 'allow-origin', 'role',
 ]);
 
 function camel(key) {
@@ -313,6 +313,19 @@ function gitCommitRows(range, limit) {
     .filter((r) => r.sha && r.short);
 }
 
+function gitCommitDiff(commit) {
+  return runGit([
+    '--no-pager',
+    'show',
+    '--format=',
+    '--patch',
+    '--find-renames',
+    '--find-copies',
+    '--no-ext-diff',
+    commit,
+  ], `git show ${commit} failed`).trimEnd();
+}
+
 async function cmdGit(rest) {
   const args = parseArgs(rest);
   const modes = new Set(['pick', 'cherry-pick', 'cherrypick', 'conflict', 'conflicts', 'resolve']);
@@ -323,11 +336,13 @@ async function cmdGit(rest) {
 
   const blocks = [];
   const questions = [];
+  let reviewDiffCount = 0;
 
   if (mode === 'pick' || mode === 'cherry-pick') {
     const range = args.range || args._[0] || '';
     const commits = gitCommitRows(range, args.limit);
     if (!commits.length) throw new CliError(`git log${range ? ` ${range}` : ''} produced no commits to show.`);
+    const withCode = args.code === true || args.patch === true || args.diff === true;
     blocks.push({
       type: 'table',
       columns: ['short', 'date', 'author', 'subject'],
@@ -351,13 +366,32 @@ async function cmdGit(rest) {
         ? [{ value: 'cherry-pick', label: 'Cherry-pick', tone: 'ok' }, { value: 'skip', label: 'Skip', tone: 'muted' }, { value: 'hold', label: 'Hold', tone: 'warn' }]
         : [{ value: 'pick', label: 'Pick', tone: 'ok' }, { value: 'cherry-pick', label: 'Cherry-pick', tone: 'warn' }, { value: 'drop', label: 'Drop', tone: 'bad' }],
     });
-    questions.push({
-      id: 'commit_order',
-      type: 'rank',
-      label: mode === 'cherry-pick' ? 'Cherry-pick order' : 'Preferred commit order',
-      description: 'Drag or move commits into the order the agent should apply them.',
-      options,
-    });
+    if (options.length > 1) {
+      questions.push({
+        id: 'commit_order',
+        type: 'rank',
+        label: mode === 'cherry-pick' ? 'Cherry-pick order' : 'Preferred commit order',
+        description: 'Drag or move commits into the order the agent should apply them.',
+        options,
+      });
+    }
+    if (withCode) {
+      for (const c of commits) {
+        const diff = gitCommitDiff(c.sha);
+        if (!diff.trim()) continue;
+        blocks.push({
+          type: 'diff',
+          title: `${c.short} ${c.subject}`,
+          filename: `${c.short} ${c.subject}`,
+          commit: c.sha,
+          reviewKind: mode,
+          review: true,
+          view: 'split',
+          diff,
+        });
+        reviewDiffCount++;
+      }
+    }
   }
 
   const paths = mode === 'conflict' ? gitConflictPaths(args._) : gitConflictPaths([]);
@@ -381,7 +415,9 @@ async function cmdGit(rest) {
     : mode === 'cherry-pick' ? 'Cherry-pick commits' : 'Pick commits');
   const intro = args.intro || (conflictCount
     ? 'Resolve each conflict on the board. The submitted result includes result.blockEdits with per-hunk choices and a full resolved file preview for every conflict block.'
-    : 'Pick commit actions and order on the board. Submit returns the selected actions and rank order as JSON.');
+    : reviewDiffCount
+      ? 'Review commit code hunks on the board. Apply, skip, or hold each hunk; submit returns commit actions plus diff-review hunk choices as JSON.'
+      : 'Pick commit actions and order on the board. Submit returns the selected actions and rank order as JSON.');
   const spec = normalizeSpec({ title, intro, blocks, questions, submitLabel: 'Submit git choices' });
   await assertSpecReady(spec);
   const record = createBoard(spec);
@@ -743,6 +779,45 @@ async function cmdResult(args) {
   return 5;
 }
 
+async function cmdShare(args) {
+  const record = mustLoad(args._[0]);
+  const running = loadRunning(record.id);
+  if (!running || !isAlive(running.pid)) {
+    throw new CliError(`board "${record.id}" is not running. Use \`rly reopen ${record.id} --detach\` first.`, 5);
+  }
+  const role = args.all ? 'all' : args.role;
+  if (role !== undefined && !['collab', 'review', 'all'].includes(role)) {
+    throw new CliError('--role must be collab or review.', 4);
+  }
+  const shareUrl = new URL('/api/share', running.url);
+  let res;
+  try {
+    if (args.revoke) {
+      res = await fetch(shareUrl, {
+        method: 'DELETE',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ role: role || 'all' }),
+      });
+    } else if (role && role !== 'all') {
+      res = await fetch(shareUrl, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ role }),
+      });
+    } else {
+      res = await fetch(shareUrl, { method: 'GET' });
+    }
+  } catch (err) {
+    throw new CliError(`could not reach board "${record.id}" at ${running.url}: ${String((err && err.message) || err)}`, 5);
+  }
+  const body = await res.json().catch(() => null);
+  if (!res.ok) {
+    throw new CliError((body && body.error) || `share request failed with HTTP ${res.status}`, res.status === 400 ? 4 : 5);
+  }
+  printJson({ status: args.revoke ? 'revoked' : role && role !== 'all' ? 'active' : 'shares', boardId: record.id, ...body });
+  return 0;
+}
+
 function cmdList(args) {
   const running = listRunning();
   if (args.json) {
@@ -1020,6 +1095,10 @@ the user should view — put it in relay instead of printing it.**
 - Point the user at a file with a clickable local path in a markdown block; embed a
   screen recording with a \`video\` block; when answer choices are visual, give each
   option its own visual (\`options[].blocks\`) so the user picks by looking.
+- Same-Wi-Fi sharing is locked by default. When the user wants another device to
+  review or co-fill a running board, manage explicit links with \`rly share <id>\`:
+  \`--role review\` creates a comments-only reviewer link, \`--role collab\` creates
+  an edit/comment/submit link, and \`--revoke\` disables active links.
 - **There's a purpose-built component for most content — use the MOST SPECIFIC one,
   never plain prose when a block fits.** Blocks: \`table\` (sortable/filterable/CSV,
   load from .csv/.json), \`chart\`, \`kpi\` (stat cards), \`mermaid\`/\`graphviz\`/\`plantuml\`,
@@ -1515,6 +1594,7 @@ USAGE
                                       --title; other args pass to git: rly diff --staged | HEAD~1 | -- path)
   rly git pick [range]                board for choosing pick/cherry-pick/drop actions plus commit order
   rly git cherry-pick [range]         board for choosing commits and cherry-pick order
+                                      add --code for split code view with per-hunk Apply/Skip/Hold
   rly git conflict [files…]           board for resolving conflict-marker files; with no files, auto-detects
                                       unmerged git files and returns resolved content in result.blockEdits
   rly wait <id> [--timeout 3600]      block until board finishes, print result JSON
@@ -1524,6 +1604,11 @@ USAGE
                                       NB: also writes the FULL result to "resultFile" (first field) —
                                         read that file if your shell truncates stdout; never pipe to head/tail
   rly result <id>                     result/status now (includes live autosaved draft + presence while open)
+  rly share <id>                      list active same-Wi-Fi share links for a running board
+  rly share <id> --role review        activate a reviewer link (comments only)
+  rly share <id> --role collab        activate a collaborator link (edit/comment/submit)
+  rly share <id> --role review --revoke
+                                      revoke one share role; use --revoke --all to disable all roles
   rly list [--json]                   running boards
   rly open [id]                       re-open the browser tab of a running board
   rly reopen <id> [--replies f.json]  serve a saved board again, prefilled with saved answers
@@ -1607,6 +1692,8 @@ export async function main(argv) {
         return await cmdWait(parseArgs(rest));
       case 'result':
         return await cmdResult(parseArgs(rest));
+      case 'share':
+        return await cmdShare(parseArgs(rest));
       case 'list':
         return cmdList(parseArgs(rest));
       case 'open':

package/src/mcp.js

@@ -1,8 +1,9 @@
 // mcp.js — relay as an MCP App (SEP-1865, extension "io.modelcontextprotocol/ui").
 //
-// `rly mcp` starts a zero-dependency MCP server over stdio. Register it with a
-// host that supports MCP Apps (Claude desktop/mobile, Codex, …) and relay's
-// boards render INLINE in the conversation instead of opening a browser tab:
+// `rly mcp` starts an MCP server over stdio with no npm runtime dependencies.
+// Register it with a host that supports MCP Apps (Claude desktop/mobile, Codex,
+// …) and relay's boards render INLINE in the conversation instead of opening a
+// browser tab:
 //
 //   • the server declares a UI resource  ui://relay/board  (text/html;profile=mcp-app)
 //   • the tools `relay_ask` / `relay_show` link to it via _meta.ui.resourceUri