@nordbyte/nordrelay 0.8.1 → 0.8.3

package/dist/{peer-types.js → peers/peer-types.js}

@@ -13,9 +13,11 @@ export const DEFAULT_PEER_SCOPES = [
     "logs.read",
 ];
 export function publicPeer(record) {
+    const trust = peerTrust(record);
     return {
         id: record.id,
         name: record.name,
+        group: record.group,
         url: record.url,
         nodeId: record.nodeId,
         fingerprint: record.fingerprint,
@@ -34,12 +36,38 @@ export function publicPeer(record) {
         remoteVersion: record.remoteVersion,
         remoteStatus: record.remoteStatus,
         lastError: record.lastError,
+        healthHistory: record.healthHistory?.map((sample) => ({ ...sample })),
+        trustStatus: trust.status,
+        trustWarnings: trust.warnings,
+        effectiveAccess: {
+            scopes: [...record.scopes],
+            allowedAgents: [...record.allowedAgents],
+            allowedWorkspaceRoots: [...record.allowedWorkspaceRoots],
+            workspaceAliases: { ...record.workspaceAliases },
+        },
     };
 }
+function peerTrust(record) {
+    const warnings = [];
+    if (!record.enabled) {
+        warnings.push("Peer is disabled.");
+        return { status: "disabled", warnings };
+    }
+    if (record.lastError) {
+        warnings.push(record.lastError);
+        return { status: "error", warnings };
+    }
+    if (record.url?.startsWith("https://") && !record.tlsFingerprint) {
+        warnings.push("TLS fingerprint is not pinned yet. Probe or re-pin this peer before using it over untrusted networks.");
+        return { status: "tls-unpinned", warnings };
+    }
+    return { status: "trusted", warnings };
+}
 export function publicInvitation(record) {
     return {
         id: record.id,
         name: record.name,
+        group: record.group,
         expiresAt: record.expiresAt,
         createdAt: record.createdAt,
         scopes: [...record.scopes],

package/dist/peers/peer-web-proxy-contract.js

@@ -0,0 +1,129 @@
+import { WEB_API_ROUTE_DEFINITIONS } from "../web/web-api-contract.js";
+const LOCAL_ONLY_ROUTE_PATHS = new Set([
+    "/api/auth/me",
+    "/api/dashboard/logout",
+    "/api/permissions",
+    "/api/settings",
+    "/api/settings/wizard/test",
+    "/api/peers",
+    "/api/peers/invite",
+    "/api/peers/pair",
+    "/api/peers/probe",
+    "/api/peers/discover",
+    "/api/peers/discovery-jobs",
+    "/api/peers/discovery-jobs/:id",
+    "/api/peers/discovery-jobs/:id/cancel",
+    "/api/peers/discovery-jobs/:id/log",
+    "/api/peers/identity/backup",
+    "/api/peers/identity/restore",
+    "/api/peers/invitations/:id",
+    "/api/peers/:id",
+    "/api/peers/:id/repin",
+    "/api/peers/:id/rotate",
+    "/api/peers/:id/health",
+    "/api/peers/:id/proxy",
+    "/api/peers/:id/events",
+    "/api/peers/global-sessions",
+    "/api/users",
+    "/api/users/:id",
+    "/api/users/:id/password",
+    "/api/users/:id/sessions",
+    "/api/users/:id/sessions/:sessionId",
+    "/api/users/:id/telegram",
+    "/api/users/:id/telegram/:identityId",
+    "/api/users/:id/discord",
+    "/api/users/:id/discord/:identityId",
+    "/api/users/:id/slack",
+    "/api/users/:id/slack/:identityId",
+    "/api/groups",
+    "/api/groups/:id",
+    "/api/telegram-chats",
+    "/api/telegram-chats/:id",
+    "/api/discord-channels",
+    "/api/discord-channels/:id",
+    "/api/slack-channels",
+    "/api/slack-channels/:id",
+    "/api/audit",
+]);
+const IMPLEMENTED_ROUTE_PATHS = new Set([
+    "/api/bootstrap",
+    "/api/health",
+    "/api/snapshot",
+    "/api/tasks",
+    "/api/progress",
+    "/api/metrics",
+    "/api/jobs",
+    "/api/trace",
+    "/api/jobs/:id/log",
+    "/api/jobs/:id/action",
+    "/api/active-sessions",
+    "/api/version",
+    "/api/update",
+    "/api/agent-updates",
+    "/api/agent-update",
+    "/api/agent-update/:id/log",
+    "/api/agent-update/:id/input",
+    "/api/agent-update/:id/cancel",
+    "/api/adapters/health",
+    "/api/adapters/conformance",
+    "/api/locks",
+    "/api/auth/status",
+    "/api/auth/login",
+    "/api/auth/logout",
+    "/api/control-options",
+    "/api/sessions",
+    "/api/sessions/new",
+    "/api/sessions/switch",
+    "/api/sessions/attach",
+    "/api/sessions/detail",
+    "/api/agent",
+    "/api/models",
+    "/api/session/model",
+    "/api/session/reasoning",
+    "/api/session/fast",
+    "/api/session/launch",
+    "/api/prompt",
+    "/api/prompt/upload",
+    "/api/abort",
+    "/api/stop",
+    "/api/handback",
+    "/api/retry",
+    "/api/sync",
+    "/api/queue",
+    "/api/chat/history",
+    "/api/chat/mirror",
+    "/api/activity",
+    "/api/artifacts",
+    "/api/artifacts/bulk",
+    "/api/artifacts/zip",
+    "/api/artifacts/file",
+    "/api/artifacts/preview",
+    "/api/logs",
+    "/api/logs/clear",
+    "/api/diagnostics",
+    "/api/diagnostics/bundle",
+    "/api/runtime/restart",
+]);
+export function peerProxyCoverage() {
+    const implemented = [];
+    const localOnly = [];
+    const missing = [];
+    for (const route of WEB_API_ROUTE_DEFINITIONS) {
+        for (const method of route.methods) {
+            const key = { method, path: route.path };
+            if (IMPLEMENTED_ROUTE_PATHS.has(route.path)) {
+                implemented.push(key);
+            }
+            else if (LOCAL_ONLY_ROUTE_PATHS.has(route.path)) {
+                localOnly.push(key);
+            }
+            else {
+                missing.push(key);
+            }
+        }
+    }
+    return { implemented, localOnly, missing };
+}
+export function isPeerProxyLocalOnlyPath(path) {
+    return LOCAL_ONLY_ROUTE_PATHS.has(path);
+}

package/dist/{metrics.js → runtime/metrics.js}

@@ -1,7 +1,8 @@
 import { monitorEventLoopDelay } from "node:perf_hooks";
-import { getDiscordRateLimitMetrics } from "./discord-rate-limit.js";
-import { getSlackRateLimitMetrics } from "./slack-rate-limit.js";
-import { getTelegramRateLimitMetrics } from "./telegram-rate-limit.js";
+import { getDiscordRateLimitMetrics } from "../channels/discord/discord-rate-limit.js";
+import { getSlackRateLimitMetrics } from "../channels/slack/slack-rate-limit.js";
+import { getTelegramRateLimitMetrics } from "../channels/telegram/telegram-rate-limit.js";
+import { getWebApiPerformanceMetrics } from "../web/web-performance.js";
 const startedAt = Date.now();
 const eventLoopDelay = monitorEventLoopDelay({ resolution: 20 });
 eventLoopDelay.enable();
@@ -38,6 +39,7 @@ export function buildRuntimeMetrics(input) {
             discord: getDiscordRateLimitMetrics(),
             slack: getSlackRateLimitMetrics(),
         },
+        web: getWebApiPerformanceMetrics(),
     };
 }
 function processMetrics() {

package/dist/{relay-artifact-service.js → runtime/relay-artifact-service.js}

@@ -1,6 +1,6 @@
 import { readFile } from "node:fs/promises";
 import path from "node:path";
-import { collectRecentWorkspaceArtifacts, createArtifactZipBundle, getArtifactTurnReport, listRecentArtifactReports, persistWorkspaceArtifactReport, removeArtifactTurn, totalArtifactSize, } from "./artifacts.js";
+import { collectRecentWorkspaceArtifacts, createArtifactZipBundle, getArtifactTurnReport, listRecentArtifactReports, persistWorkspaceArtifactReport, removeArtifactTurn, totalArtifactSize, } from "../artifacts/artifacts.js";
 const MAX_TEXT_PREVIEW_BYTES = 256 * 1024;
 export class RelayArtifactService {
     config;

package/dist/runtime/relay-auth-service.js

@@ -0,0 +1,63 @@
+import { checkClaudeCodeAuthStatus, startClaudeCodeLogin, startClaudeCodeLogout } from "../agents/claude-code/claude-code-auth.js";
+import { checkAuthStatus, startLogin as startCodexLogin, startLogout as startCodexLogout } from "../agents/codex/codex-auth.js";
+import { checkHermesAuthStatus, startHermesLogin, startHermesLogout } from "../agents/hermes/hermes-auth.js";
+import { checkOpenClawAuthStatus } from "../agents/openclaw/openclaw-auth.js";
+import { checkPiAuthStatus } from "../agents/pi/pi-auth.js";
+export class RelayAuthService {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    async check(info) {
+        if (info.agentId === "pi") {
+            return checkPiAuthStatus(info.model);
+        }
+        if (info.agentId === "hermes") {
+            return checkHermesAuthStatus({
+                baseUrl: this.config.hermesApiBaseUrl,
+                apiKey: this.config.hermesApiKey,
+            });
+        }
+        if (info.agentId === "openclaw") {
+            return checkOpenClawAuthStatus({
+                gatewayUrl: this.config.openClawGatewayUrl,
+                token: this.config.openClawGatewayToken,
+                password: this.config.openClawGatewayPassword,
+            });
+        }
+        if (info.agentId === "claude-code") {
+            return checkClaudeCodeAuthStatus(this.config.claudeCodeCliPath);
+        }
+        return checkAuthStatus(this.config.codexApiKey);
+    }
+    async startLogin(info) {
+        if (info.agentId === "hermes") {
+            return startHermesLogin(this.config.hermesCliPath);
+        }
+        if (info.agentId === "claude-code") {
+            return startClaudeCodeLogin(this.config.claudeCodeCliPath);
+        }
+        if (info.agentId === "codex") {
+            return startCodexLogin();
+        }
+        return {
+            success: false,
+            message: `${info.agentLabel} login is not managed by NordRelay. Run the agent login flow on the host.`,
+        };
+    }
+    async startLogout(info) {
+        if (info.agentId === "hermes") {
+            return startHermesLogout(this.config.hermesCliPath);
+        }
+        if (info.agentId === "claude-code") {
+            return startClaudeCodeLogout(this.config.claudeCodeCliPath);
+        }
+        if (info.agentId === "codex") {
+            return startCodexLogout();
+        }
+        return {
+            success: false,
+            message: `${info.agentLabel} logout is not managed by NordRelay. Run the agent logout flow on the host.`,
+        };
+    }
+}

package/dist/runtime/relay-dashboard-service.js

@@ -0,0 +1,139 @@
+import { enabledAgents } from "../agents/shared/agent-factory.js";
+import { listAgentAdapterDescriptors } from "../agents/shared/agent-adapter.js";
+import { friendlyErrorText } from "../core/error-messages.js";
+import { getAgentDiagnostics } from "../agents/shared/agent-activity.js";
+import { getConnectorHealth, getVersionChecks, readConnectorState } from "../support/operations.js";
+import { collectSlackDiagnostics } from "../channels/slack/slack-diagnostics.js";
+import { getSlackRateLimitMetrics } from "../channels/slack/slack-rate-limit.js";
+import { cliHealthForAgent, versionCheckForAgent } from "./relay-runtime-helpers.js";
+export class RelayDashboardService {
+    options;
+    keys = ["version", "adapterHealth", "diagnostics"];
+    warmTimer;
+    constructor(options) {
+        this.options = options;
+        options.cache.register("version", () => this.produceVersion());
+        options.cache.register("adapterHealth", () => this.produceAdapterHealth());
+        options.cache.register("diagnostics", () => this.produceDiagnostics());
+    }
+    startBackgroundRefresh() {
+        this.options.cache.warm(this.keys);
+        const ttlMs = this.options.config.dashboardCacheTtlMs;
+        if (ttlMs <= 0 || this.warmTimer) {
+            return;
+        }
+        const intervalMs = Math.max(5_000, ttlMs);
+        this.warmTimer = setInterval(() => this.options.cache.warm(this.keys), intervalMs);
+        this.warmTimer.unref?.();
+    }
+    stopBackgroundRefresh() {
+        if (!this.warmTimer) {
+            return;
+        }
+        clearInterval(this.warmTimer);
+        this.warmTimer = undefined;
+    }
+    async version() {
+        return this.cached("version");
+    }
+    async diagnostics() {
+        return this.cached("diagnostics");
+    }
+    async adapterHealth() {
+        return this.cached("adapterHealth");
+    }
+    invalidate(key) {
+        this.options.cache.invalidate(key);
+        if (key) {
+            this.options.cache.warm([key]);
+            return;
+        }
+        this.options.cache.warm(this.keys);
+    }
+    async cached(key) {
+        return (await this.options.cache.get(key, this.options.config.dashboardCacheTtlMs)).value;
+    }
+    async produceVersion() {
+        const cliOptions = this.options.cliPathOptions();
+        const [health, state, versionChecks] = await Promise.all([
+            getConnectorHealth(cliOptions),
+            readConnectorState(),
+            getVersionChecks(cliOptions),
+        ]);
+        return {
+            health,
+            state,
+            versionChecks,
+        };
+    }
+    async produceDiagnostics() {
+        const cliOptions = this.options.cliPathOptions();
+        const [health, versionChecks, snapshot, session] = await Promise.all([
+            getConnectorHealth(cliOptions),
+            getVersionChecks(cliOptions),
+            this.options.snapshot(),
+            this.options.getSession(),
+        ]);
+        return {
+            health,
+            versionChecks,
+            snapshot,
+            runtime: {
+                stateBackend: this.options.config.stateBackend,
+                sourceWorkspace: this.options.config.workspace,
+                queuePaused: this.options.queuePaused(),
+                externalMirror: this.options.externalMirror(),
+                agentDiagnostics: getAgentDiagnostics(session, this.options.config),
+                slackDiagnostics: await collectSlackDiagnostics({
+                    config: this.options.config,
+                    timeoutMs: 2_500,
+                    rateLimit: getSlackRateLimitMetrics(),
+                }),
+            },
+        };
+    }
+    async produceAdapterHealth() {
+        const cliOptions = this.options.cliPathOptions();
+        const [health, versions] = await Promise.all([
+            getConnectorHealth(cliOptions),
+            getVersionChecks(cliOptions),
+        ]);
+        return Promise.all(listAgentAdapterDescriptors().map(async (descriptor) => {
+            const enabled = enabledAgents(this.options.config).includes(descriptor.id);
+            const auth = descriptor.capabilities.auth && enabled
+                ? await this.options.authStatus(descriptor.id).catch((error) => ({
+                    agentId: descriptor.id,
+                    agentLabel: descriptor.label,
+                    supported: descriptor.capabilities.auth,
+                    authenticated: false,
+                    detail: friendlyErrorText(error),
+                    loginSupported: descriptor.capabilities.login,
+                    logoutSupported: descriptor.capabilities.logout,
+                }))
+                : null;
+            const cli = cliHealthForAgent(descriptor.id, health);
+            const version = versionCheckForAgent(descriptor.id, versions);
+            return {
+                id: descriptor.id,
+                label: descriptor.label,
+                enabled,
+                status: descriptor.status === "available" ? (enabled ? "enabled" : "disabled") : "planned",
+                auth: {
+                    supported: descriptor.capabilities.auth,
+                    authenticated: auth ? auth.authenticated : null,
+                    method: auth?.method,
+                    detail: auth?.detail,
+                },
+                cli,
+                version: {
+                    installed: version.installedLabel,
+                    latest: version.latestVersion,
+                    status: version.status,
+                    detail: version.detail,
+                },
+                capabilities: descriptor.capabilities,
+                notes: descriptor.notes,
+            };
+        }));
+    }
+}