@nordbyte/nordrelay 0.6.0 → 0.8.0

package/dist/channel-turn-lifecycle.js

@@ -0,0 +1,73 @@
+import { randomUUID } from "node:crypto";
+export function createChannelTurnLifecycle(promptDescription) {
+    const startedAt = Date.now();
+    const turnId = randomUUID().slice(0, 12);
+    const progress = {
+        status: "running",
+        promptDescription,
+        startedAt,
+        updatedAt: startedAt,
+        toolCounts: new Map(),
+        textCharacters: 0,
+    };
+    const touch = () => {
+        progress.updatedAt = Date.now();
+    };
+    return {
+        turnId,
+        startedAt,
+        progress,
+        touch,
+        recordTextDelta: (characters) => {
+            progress.textCharacters += Math.max(0, characters);
+            touch();
+        },
+        recordToolStart: (toolName) => {
+            progress.currentTool = toolName;
+            progress.lastTool = toolName;
+            progress.toolCounts.set(toolName, (progress.toolCounts.get(toolName) ?? 0) + 1);
+            touch();
+        },
+        recordToolUpdate: touch,
+        recordToolEnd: () => {
+            progress.currentTool = undefined;
+            touch();
+        },
+        recordCompleted: () => {
+            progress.status = "completed";
+            progress.completedAt = Date.now();
+            progress.updatedAt = progress.completedAt;
+        },
+        recordFailed: (error) => {
+            progress.status = "failed";
+            progress.error = error;
+            progress.completedAt = Date.now();
+            progress.updatedAt = progress.completedAt;
+        },
+    };
+}
+export function createChannelTypingLoop(options) {
+    let timer;
+    let running = false;
+    const sendTyping = () => {
+        void options.sendTyping().catch(() => { });
+    };
+    return {
+        start: () => {
+            if (running) {
+                return;
+            }
+            running = true;
+            timer = setInterval(sendTyping, options.intervalMs);
+            timer.unref?.();
+            sendTyping();
+        },
+        stop: () => {
+            running = false;
+            if (timer) {
+                clearInterval(timer);
+                timer = undefined;
+            }
+        },
+    };
+}

package/dist/codex-state.js

@@ -1,6 +1,8 @@
-import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { closeSync, existsSync, openSync, readFileSync, readSync, readdirSync, statSync } from "node:fs";
 import path from "node:path";
 import { isCodexApprovalPolicy, isCodexSandboxMode, } from "./codex-launch.js";
+const ROLLOUT_CACHE_MAX_EVENTS = 200;
+const rolloutSnapshotCache = new Map();
 export const FALLBACK_MODELS = [
     { slug: "gpt-5.5", displayName: "GPT-5.5" },
     { slug: "gpt-5.4", displayName: "GPT-5.4" },
@@ -74,31 +76,7 @@ export function getThreadUsage(id) {
     }
 }
 export function getThreadActivity(id, options = {}) {
-    const rolloutPath = getThreadRolloutPath(id);
-    if (!rolloutPath || !existsSync(rolloutPath)) {
-        return null;
-    }
-    try {
-        const parsed = parseActivityFromRollout(id, rolloutPath, readFileSync(rolloutPath, "utf8"));
-        const fileModifiedAtMs = statSync(rolloutPath).mtimeMs;
-        const updatedAtMs = Math.max(parsed.updatedAt?.getTime() ?? 0, fileModifiedAtMs);
-        const updatedAt = updatedAtMs > 0 ? new Date(updatedAtMs) : parsed.updatedAt;
-        const staleAfterMs = options.staleAfterMs ?? 5 * 60 * 1000;
-        const nowMs = options.nowMs ?? Date.now();
-        const stale = Boolean(parsed.active &&
-            updatedAt &&
-            staleAfterMs > 0 &&
-            nowMs - updatedAt.getTime() > staleAfterMs);
-        return {
-            ...parsed,
-            updatedAt,
-            stale,
-            active: parsed.active && !stale,
-        };
-    }
-    catch {
-        return null;
-    }
+    return getThreadRolloutSnapshot(id, { ...options, maxEvents: 0 })?.activity ?? null;
 }
 export function getThreadRolloutSnapshot(id, options = {}) {
     const rolloutPath = getThreadRolloutPath(id);
@@ -106,8 +84,9 @@ export function getThreadRolloutSnapshot(id, options = {}) {
         return null;
     }
     try {
-        const parsed = parseRolloutSnapshot(id, rolloutPath, readFileSync(rolloutPath, "utf8"));
-        return finalizeRolloutSnapshot(parsed, statSync(rolloutPath).mtimeMs, options);
+        const fileModifiedAtMs = statSync(rolloutPath).mtimeMs;
+        const parsed = readCachedRolloutSnapshot(id, rolloutPath);
+        return finalizeRolloutSnapshot(parsed, fileModifiedAtMs, options);
     }
     catch {
         return null;
@@ -167,13 +146,7 @@ export function getThreadRolloutPath(id) {
     }) ?? null);
 }
 function parseUsageFromRollout(contents) {
-    let contextWindow = null;
-    let contextUsedPercent = null;
-    let lastTokenUsage = null;
-    let totalTokenUsage = null;
-    let rateLimits = null;
-    let updatedAt = null;
-    for (const line of contents.split(/\r?\n/)) {
+    for (const line of iterateLinesReverse(contents)) {
         if (!line.includes('"token_count"')) {
             continue;
         }
@@ -188,6 +161,7 @@ function parseUsageFromRollout(contents) {
         if (payload?.type !== "token_count") {
             continue;
         }
+        let updatedAt = null;
         const timestamp = readString(readObject(event)?.timestamp);
         if (timestamp) {
             const parsedTimestamp = new Date(timestamp);
@@ -196,54 +170,116 @@ function parseUsageFromRollout(contents) {
             }
         }
         const info = readObject(payload.info);
-        const parsedTotal = parseTokenUsage(readObject(info?.total_token_usage));
-        const parsedLast = parseTokenUsage(readObject(info?.last_token_usage));
+        const totalTokenUsage = parseTokenUsage(readObject(info?.total_token_usage));
+        const lastTokenUsage = parseTokenUsage(readObject(info?.last_token_usage));
         const parsedContextWindow = readNumber(info?.model_context_window);
-        if (parsedTotal) {
-            totalTokenUsage = parsedTotal;
+        const contextWindow = parsedContextWindow !== null && parsedContextWindow > 0
+            ? parsedContextWindow
+            : null;
+        const contextUsedPercent = lastTokenUsage && contextWindow
+            ? Math.min(100, (lastTokenUsage.totalTokens / contextWindow) * 100)
+            : null;
+        const rateLimits = parseRateLimits(readObject(payload.rate_limits));
+        if (!lastTokenUsage && !totalTokenUsage && !rateLimits) {
+            continue;
         }
-        if (parsedLast) {
-            lastTokenUsage = parsedLast;
+        return {
+            contextWindow,
+            contextUsedPercent,
+            lastTokenUsage,
+            totalTokenUsage,
+            rateLimits,
+            updatedAt,
+        };
+    }
+    return null;
+}
+function readCachedRolloutSnapshot(threadId, rolloutPath) {
+    const size = statSync(rolloutPath).size;
+    const cached = rolloutSnapshotCache.get(rolloutPath);
+    if (cached && size >= cached.byteOffset) {
+        const suffix = size > cached.byteOffset
+            ? readFileRangeUtf8(rolloutPath, cached.byteOffset, size - cached.byteOffset)
+            : "";
+        if (!suffix.trim()) {
+            return cached.parsed;
         }
-        if (parsedContextWindow !== null && parsedContextWindow > 0) {
-            contextWindow = parsedContextWindow;
+        const parsed = parseRolloutSnapshot(threadId, rolloutPath, suffix, {
+            base: cached.parsed,
+            maxEvents: ROLLOUT_CACHE_MAX_EVENTS,
+        });
+        rolloutSnapshotCache.set(rolloutPath, { byteOffset: size, parsed });
+        return parsed;
+    }
+    const contents = readFileSync(rolloutPath, "utf8");
+    const parsed = parseRolloutSnapshot(threadId, rolloutPath, contents, {
+        maxEvents: ROLLOUT_CACHE_MAX_EVENTS,
+    });
+    rolloutSnapshotCache.set(rolloutPath, {
+        byteOffset: Buffer.byteLength(contents),
+        parsed,
+    });
+    return parsed;
+}
+function readFileRangeUtf8(filePath, position, length) {
+    if (length <= 0) {
+        return "";
+    }
+    const fd = openSync(filePath, "r");
+    try {
+        const buffer = Buffer.allocUnsafe(length);
+        const bytesRead = readSync(fd, buffer, 0, length, position);
+        return buffer.subarray(0, bytesRead).toString("utf8");
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+function* iterateLinesReverse(contents) {
+    let end = contents.length;
+    while (end > 0) {
+        let start = contents.lastIndexOf("\n", end - 1);
+        const lineStart = start === -1 ? 0 : start + 1;
+        let line = contents.slice(lineStart, end);
+        if (line.endsWith("\r")) {
+            line = line.slice(0, -1);
         }
-        if (lastTokenUsage && contextWindow) {
-            contextUsedPercent = Math.min(100, (lastTokenUsage.totalTokens / contextWindow) * 100);
+        if (line.trim()) {
+            yield line;
         }
-        const parsedRateLimits = parseRateLimits(readObject(payload.rate_limits));
-        if (parsedRateLimits) {
-            rateLimits = parsedRateLimits;
+        if (start === -1) {
+            break;
         }
+        end = start;
     }
-    if (!lastTokenUsage && !totalTokenUsage && !rateLimits) {
-        return null;
-    }
-    return {
-        contextWindow,
-        contextUsedPercent,
-        lastTokenUsage,
-        totalTokenUsage,
-        rateLimits,
-        updatedAt,
-    };
 }
-function parseActivityFromRollout(threadId, rolloutPath, contents) {
-    return parseRolloutSnapshot(threadId, rolloutPath, contents).activity;
-}
-function parseRolloutSnapshot(threadId, rolloutPath, contents) {
-    let activeTurnId = null;
-    let startedAt = null;
-    let updatedAt = null;
-    let latestAgentMessage = null;
-    let latestUserMessage = null;
-    let latestToolName = null;
-    const events = [];
+function parseRolloutSnapshot(threadId, rolloutPath, contents, options = {}) {
+    let activeTurnId = options.base?.activity.active ? options.base.activity.turnId : null;
+    let startedAt = options.base?.activity.active ? options.base.activity.startedAt : null;
+    let updatedAt = options.base?.activity.updatedAt ?? null;
+    let latestAgentMessage = options.base?.latestAgentMessage ?? null;
+    let latestUserMessage = options.base?.latestUserMessage ?? null;
+    let latestToolName = options.base?.latestToolName ?? null;
+    const events = [...(options.base?.events ?? [])];
     const lines = contents.split(/\r?\n/);
+    const lineNumberOffset = options.base?.lineCount ?? 0;
+    let lineCount = lineNumberOffset;
+    const afterLine = options.afterLine ?? 0;
+    const maxEvents = options.maxEvents ?? Number.POSITIVE_INFINITY;
+    const pushEvent = (event) => {
+        if (maxEvents <= 0 || event.lineNumber <= afterLine) {
+            return;
+        }
+        events.push(event);
+        if (Number.isFinite(maxEvents) && events.length > maxEvents) {
+            events.splice(0, events.length - maxEvents);
+        }
+    };
     for (const [index, line] of lines.entries()) {
         if (!line.trim()) {
             continue;
         }
+        lineCount += 1;
         if (!line.includes('"task_') &&
             !line.includes('"turn_') &&
             !line.includes('"user_message"') &&
@@ -262,7 +298,7 @@ function parseRolloutSnapshot(threadId, rolloutPath, contents) {
         const eventObject = readObject(event);
         const payload = readObject(eventObject?.payload);
         const eventTimestamp = parseTimestamp(readString(eventObject?.timestamp));
-        const lineNumber = index + 1;
+        const lineNumber = lineNumberOffset + index + 1;
         if (activeTurnId && eventTimestamp) {
             updatedAt = eventTimestamp;
         }
@@ -274,7 +310,7 @@ function parseRolloutSnapshot(threadId, rolloutPath, contents) {
             activeTurnId = readString(payload?.turn_id);
             startedAt = parseUnixSeconds(readNumber(payload?.started_at)) ?? eventTimestamp;
             updatedAt = eventTimestamp ?? startedAt;
-            events.push({
+            pushEvent({
                 lineNumber,
                 kind: "task",
                 timestamp: eventTimestamp,
@@ -289,7 +325,7 @@ function parseRolloutSnapshot(threadId, rolloutPath, contents) {
         }
         if (isTaskTerminalEvent(type)) {
             const turnId = readString(payload?.turn_id);
-            events.push({
+            pushEvent({
                 lineNumber,
                 kind: "task",
                 timestamp: eventTimestamp,
@@ -309,7 +345,7 @@ function parseRolloutSnapshot(threadId, rolloutPath, contents) {
         }
         if (type === "user_message") {
             latestUserMessage = readString(payload?.message);
-            events.push({
+            pushEvent({
                 lineNumber,
                 kind: "user",
                 timestamp: eventTimestamp,
@@ -324,7 +360,7 @@ function parseRolloutSnapshot(threadId, rolloutPath, contents) {
         }
         if (type === "agent_message") {
             latestAgentMessage = readString(payload?.message);
-            events.push({
+            pushEvent({
                 lineNumber,
                 kind: "agent",
                 timestamp: eventTimestamp,
@@ -339,7 +375,7 @@ function parseRolloutSnapshot(threadId, rolloutPath, contents) {
         }
         if (type === "function_call") {
             latestToolName = readString(payload?.name);
-            events.push({
+            pushEvent({
                 lineNumber,
                 kind: "tool",
                 timestamp: eventTimestamp,
@@ -353,7 +389,7 @@ function parseRolloutSnapshot(threadId, rolloutPath, contents) {
             continue;
         }
         if (type === "function_call_output") {
-            events.push({
+            pushEvent({
                 lineNumber,
                 kind: "tool",
                 timestamp: eventTimestamp,
@@ -369,7 +405,7 @@ function parseRolloutSnapshot(threadId, rolloutPath, contents) {
     return {
         threadId,
         rolloutPath,
-        lineCount: lines.filter((line) => line.trim()).length,
+        lineCount,
         activity: {
             threadId,
             rolloutPath,

package/dist/config-metadata.js

@@ -1,6 +1,9 @@
 export const SECRET_KEYS = new Set([
     "TELEGRAM_BOT_TOKEN",
     "DISCORD_BOT_TOKEN",
+    "SLACK_BOT_TOKEN",
+    "SLACK_APP_TOKEN",
+    "SLACK_SIGNING_SECRET",
     "CODEX_API_KEY",
     "HERMES_API_KEY",
     "OPENCLAW_GATEWAY_TOKEN",
@@ -24,15 +27,34 @@ const DISCORD_SETTING_HELP = {
     DISCORD_QUIET_HOURS: "Use a local-time range like 22-7, off, or blank to inherit the channel-neutral quiet-hours setting.",
     DISCORD_AUTO_SEND_ARTIFACTS: "Overrides automatic artifact upload behavior for Discord only. Leave blank to use NORDRELAY_AUTO_SEND_ARTIFACTS.",
 };
+const SLACK_SETTING_HELP = {
+    SLACK_ENABLED: "Create a Slack app, install it into the workspace, then set bot/app tokens before enabling Slack.",
+    SLACK_BOT_TOKEN: "Slack app OAuth & Permissions: copy the bot token that starts with xoxb-.",
+    SLACK_APP_TOKEN: "Slack app Basic Information: create an app-level token with connections:write. Required for Socket Mode.",
+    SLACK_SIGNING_SECRET: "Slack app Basic Information: copy Signing Secret. Required only when Socket Mode is disabled.",
+    SLACK_ALLOWED_TEAM_IDS: "Optional workspace allow-list. Copy Team IDs from Slack event payloads or app diagnostics.",
+    SLACK_ALLOWED_CHANNEL_IDS: "Optional channel allow-list before NordRelay user/group checks. Copy channel IDs from Slack channel details.",
+    SLACK_COMMAND: "Slash command configured in the Slack app. Defaults to /nordrelay.",
+};
+const TELEGRAM_SETTING_HELP = {
+    TELEGRAM_ENABLED: "Enable this only after the BotFather token is configured and NordRelay users/chats are allowed through the user management system.",
+    TELEGRAM_BOT_TOKEN: "Telegram BotFather: open @BotFather, create a bot with /newbot, then paste only the token value.",
+    TELEGRAM_TRANSPORT: "Use polling for the simplest setup. Use webhook only when this NordRelay instance is reachable from Telegram through public HTTPS.",
+    TELEGRAM_WEBHOOK_URL: "Public HTTPS base URL for Telegram webhook delivery, for example https://relay.example.com.",
+    TELEGRAM_WEBHOOK_HOST: "Local interface where NordRelay binds the webhook listener. Use 127.0.0.1 behind a reverse proxy or 0.0.0.0 only when the endpoint is protected.",
+    TELEGRAM_WEBHOOK_PORT: "Local port for the Telegram webhook listener.",
+    TELEGRAM_WEBHOOK_PATH: "Webhook request path registered with Telegram. It must start with /.",
+    TELEGRAM_WEBHOOK_SECRET: "Optional secret token Telegram sends in X-Telegram-Bot-Api-Secret-Token. Use a random value for webhook mode.",
+};
 export const SETTING_DEFINITIONS = [
-    setting("TELEGRAM_ENABLED", "Enable Telegram", "Telegram", "boolean", "Start the Telegram bot adapter.", true),
-    setting("TELEGRAM_BOT_TOKEN", "Telegram bot token", "Telegram", "secret", "BotFather token.", true),
-    setting("TELEGRAM_TRANSPORT", "Telegram transport", "Telegram", "string", "polling or webhook.", true, ["polling", "webhook"]),
-    setting("TELEGRAM_WEBHOOK_URL", "Webhook public URL", "Telegram", "string", "Public base URL for webhook mode.", true),
-    setting("TELEGRAM_WEBHOOK_HOST", "Webhook bind host", "Telegram", "string", "Local webhook bind host.", true),
-    setting("TELEGRAM_WEBHOOK_PORT", "Webhook bind port", "Telegram", "number", "Local webhook bind port.", true),
-    setting("TELEGRAM_WEBHOOK_PATH", "Webhook path", "Telegram", "string", "Webhook request path.", true),
-    setting("TELEGRAM_WEBHOOK_SECRET", "Webhook secret", "Telegram", "secret", "Optional Telegram webhook secret token.", true),
+    telegramSetting("TELEGRAM_ENABLED", "Enable Telegram", "boolean", "Start the Telegram bot adapter.", true),
+    telegramSetting("TELEGRAM_BOT_TOKEN", "Telegram bot token", "secret", "BotFather token.", true),
+    telegramSetting("TELEGRAM_TRANSPORT", "Telegram transport", "string", "polling or webhook.", true, ["polling", "webhook"]),
+    telegramSetting("TELEGRAM_WEBHOOK_URL", "Webhook public URL", "string", "Public base URL for webhook mode.", true),
+    telegramSetting("TELEGRAM_WEBHOOK_HOST", "Webhook bind host", "string", "Local webhook bind host.", true),
+    telegramSetting("TELEGRAM_WEBHOOK_PORT", "Webhook bind port", "number", "Local webhook bind port.", true),
+    telegramSetting("TELEGRAM_WEBHOOK_PATH", "Webhook path", "string", "Webhook request path.", true),
+    telegramSetting("TELEGRAM_WEBHOOK_SECRET", "Webhook secret", "secret", "Optional Telegram webhook secret token.", true),
     discordSetting("DISCORD_ENABLED", "Enable Discord", "boolean", "Start the Discord bot adapter.", true),
     discordSetting("DISCORD_BOT_TOKEN", "Discord bot token", "secret", "Discord bot token.", true),
     discordSetting("DISCORD_CLIENT_ID", "Discord client ID", "string", "Discord application/client id used for slash command registration.", true),
@@ -47,6 +69,21 @@ export const SETTING_DEFINITIONS = [
     discordSetting("DISCORD_NOTIFY_MODE", "Discord notify override", "string", "Optional Discord override for completion notifications.", false, ["off", "minimal", "all"]),
     discordSetting("DISCORD_QUIET_HOURS", "Discord quiet hours override", "string", "Optional Discord quiet hours override. Use HH-HH, off, or leave blank for default.", false),
     discordSetting("DISCORD_AUTO_SEND_ARTIFACTS", "Discord auto-send artifacts override", "boolean", "Optional Discord override for automatic artifact summaries/uploads.", false),
+    slackSetting("SLACK_ENABLED", "Enable Slack", "boolean", "Start the Slack bot adapter.", true),
+    slackSetting("SLACK_BOT_TOKEN", "Slack bot token", "secret", "Slack bot token.", true),
+    slackSetting("SLACK_APP_TOKEN", "Slack app token", "secret", "Slack app-level token for Socket Mode.", true),
+    slackSetting("SLACK_SIGNING_SECRET", "Slack signing secret", "secret", "Slack signing secret for HTTP Events mode.", true),
+    slackSetting("SLACK_SOCKET_MODE", "Slack Socket Mode", "boolean", "Use Slack Socket Mode instead of an HTTP events receiver.", true),
+    slackSetting("SLACK_PORT", "Slack HTTP port", "number", "HTTP port used when Slack Socket Mode is disabled.", true),
+    slackSetting("SLACK_ALLOWED_TEAM_IDS", "Allowed Slack teams", "list", "Optional comma-separated Slack team/workspace allow-list.", true),
+    slackSetting("SLACK_ALLOWED_CHANNEL_IDS", "Allowed Slack channels", "list", "Optional comma-separated Slack channel allow-list before user/group checks.", true),
+    slackSetting("SLACK_MESSAGE_CONTENT_ENABLED", "Slack message content", "boolean", "Read regular Slack text messages as prompts.", true),
+    slackSetting("SLACK_COMMAND", "Slack Slash command", "string", "Slash command configured in Slack.", true),
+    slackSetting("SLACK_CLI_MIRROR_MODE", "Slack mirror override", "string", "Optional Slack override for CLI mirror mode. Uses the NordRelay default when unset.", false, ["off", "status", "final", "full"]),
+    slackSetting("SLACK_CLI_MIRROR_MIN_UPDATE_MS", "Slack mirror update override", "number", "Optional Slack override for mirrored edit interval.", true),
+    slackSetting("SLACK_NOTIFY_MODE", "Slack notify override", "string", "Optional Slack override for completion notifications.", false, ["off", "minimal", "all"]),
+    slackSetting("SLACK_QUIET_HOURS", "Slack quiet hours override", "string", "Optional Slack quiet hours override. Use HH-HH, off, or leave blank for default.", false),
+    slackSetting("SLACK_AUTO_SEND_ARTIFACTS", "Slack auto-send artifacts override", "boolean", "Optional Slack override for automatic artifact summaries/uploads.", false),
     setting("NORDRELAY_CODEX_ENABLED", "Enable Codex", "Agents", "boolean", "Allow Codex sessions.", true),
     setting("NORDRELAY_PI_ENABLED", "Enable Pi", "Agents", "boolean", "Allow Pi sessions.", true),
     setting("NORDRELAY_HERMES_ENABLED", "Enable Hermes", "Agents", "boolean", "Allow Hermes sessions through the Hermes API Server.", true),
@@ -128,6 +165,13 @@ export const SETTING_DEFINITIONS = [
     setting("NORDRELAY_UNIFIED_JOB_MAX_ITEMS", "Unified job history", "Workspace", "number", "Maximum persisted unified jobs retained for the WebUI jobs view.", true),
     setting("NORDRELAY_VERSION_CACHE_TTL_MS", "Version cache TTL", "Workspace", "number", "NPM version cache TTL.", true),
     setting("NORDRELAY_CLI_VERSION_CACHE_TTL_MS", "CLI version cache TTL", "Workspace", "number", "Installed agent CLI version cache TTL.", true),
+    setting("NORDRELAY_PEER_ENABLED", "Enable peer server", "Peers", "boolean", "Expose the dedicated authenticated NordRelay peer API.", true),
+    setting("NORDRELAY_PEER_NAME", "Peer display name", "Peers", "string", "Human-readable name shown to paired NordRelay instances.", true),
+    setting("NORDRELAY_PEER_HOST", "Peer bind host", "Peers", "string", "Bind host for the peer API. Use 127.0.0.1 for local-only or a LAN/interface IP when explicitly exposing peers.", true),
+    setting("NORDRELAY_PEER_PORT", "Peer port", "Peers", "number", "Port for the peer API.", true),
+    setting("NORDRELAY_PEER_PUBLIC_URL", "Peer public URL", "Peers", "string", "Optional public URL other instances should use for this node.", true),
+    setting("NORDRELAY_PEER_TLS_ENABLED", "Peer TLS enabled", "Peers", "boolean", "Serve the peer API over HTTPS with an automatically generated local certificate.", true),
+    setting("NORDRELAY_PEER_REQUIRE_TLS", "Require peer TLS", "Peers", "boolean", "Reject plaintext peer serving on non-loopback hosts.", true),
     setting("OPENAI_API_KEY", "OpenAI API key", "Voice", "secret", "Whisper fallback API key.", true),
     setting("VOICE_PREFERRED_BACKEND", "Voice backend", "Voice", "string", "auto, parakeet, faster-whisper, or openai.", false, ["auto", "parakeet", "faster-whisper", "openai"]),
     setting("VOICE_DEFAULT_LANGUAGE", "Voice language", "Voice", "string", "Default transcription language.", false),
@@ -159,6 +203,21 @@ const EXAMPLE_VALUES = {
     "DISCORD_NOTIFY_MODE": "",
     "DISCORD_QUIET_HOURS": "",
     "DISCORD_AUTO_SEND_ARTIFACTS": "",
+    "SLACK_ENABLED": "false",
+    "SLACK_BOT_TOKEN": "",
+    "SLACK_APP_TOKEN": "",
+    "SLACK_SIGNING_SECRET": "",
+    "SLACK_SOCKET_MODE": "true",
+    "SLACK_PORT": "3000",
+    "SLACK_ALLOWED_TEAM_IDS": "",
+    "SLACK_ALLOWED_CHANNEL_IDS": "",
+    "SLACK_MESSAGE_CONTENT_ENABLED": "true",
+    "SLACK_COMMAND": "/nordrelay",
+    "SLACK_CLI_MIRROR_MODE": "",
+    "SLACK_CLI_MIRROR_MIN_UPDATE_MS": "",
+    "SLACK_NOTIFY_MODE": "",
+    "SLACK_QUIET_HOURS": "",
+    "SLACK_AUTO_SEND_ARTIFACTS": "",
     "NORDRELAY_CODEX_ENABLED": "true",
     "NORDRELAY_PI_ENABLED": "false",
     "NORDRELAY_HERMES_ENABLED": "false",
@@ -243,6 +302,13 @@ const EXAMPLE_VALUES = {
     "NORDRELAY_UNIFIED_JOB_MAX_ITEMS": "1000",
     "NORDRELAY_VERSION_CACHE_TTL_MS": "3600000",
     "NORDRELAY_CLI_VERSION_CACHE_TTL_MS": "60000",
+    "NORDRELAY_PEER_ENABLED": "false",
+    "NORDRELAY_PEER_NAME": "",
+    "NORDRELAY_PEER_HOST": "127.0.0.1",
+    "NORDRELAY_PEER_PORT": "31979",
+    "NORDRELAY_PEER_PUBLIC_URL": "",
+    "NORDRELAY_PEER_TLS_ENABLED": "true",
+    "NORDRELAY_PEER_REQUIRE_TLS": "true",
     "NORDRELAY_DASHBOARD_HOST": "127.0.0.1",
     "NORDRELAY_DASHBOARD_PORT": "31878",
     "NORDRELAY_ENV_FILE": "",
@@ -262,6 +328,7 @@ const EXAMPLE_VALUES = {
 const GROUP_INTROS = {
     Telegram: "Telegram bot and transport settings.",
     Discord: "Discord bot settings. Discord is opt-in and uses the same NordRelay users, groups, and permissions as Telegram.",
+    Slack: "Slack bot settings. Slack is opt-in and uses the same NordRelay users, groups, and permissions as Telegram and Discord.",
     Agents: "Agent access. Codex is enabled by default; Pi, Hermes, OpenClaw, and Claude Code are opt-in.",
     Codex: "Codex defaults for newly created or reattached sessions.",
     Pi: "Pi coding agent defaults.",
@@ -271,6 +338,7 @@ const GROUP_INTROS = {
     Operations: "Runtime output, logging, update, and Telegram behavior controls.",
     Artifacts: "File, artifact, and retention controls.",
     Workspace: "State and workspace guardrails.",
+    Peers: "Optional NordRelay-to-NordRelay federation. Pairing is explicit, authenticated, scoped, and TLS-protected.",
     Voice: "Optional voice transcription settings.",
     Dashboard: "Local WebUI dashboard. User login is required for every page, API route, SSE stream, artifact download, and health endpoint.",
 };
@@ -303,3 +371,9 @@ function setting(key, label, group, kind, description, restartRequired, options,
 function discordSetting(key, label, kind, description, restartRequired, options) {
     return setting(key, label, "Discord", kind, description, restartRequired, options, DISCORD_SETTING_HELP[key]);
 }
+function telegramSetting(key, label, kind, description, restartRequired, options) {
+    return setting(key, label, "Telegram", kind, description, restartRequired, options, TELEGRAM_SETTING_HELP[key]);
+}
+function slackSetting(key, label, kind, description, restartRequired, options) {
+    return setting(key, label, "Slack", kind, description, restartRequired, options, SLACK_SETTING_HELP[key]);
+}