@nordbyte/nordrelay 0.8.2 → 0.8.3

package/README.md

@@ -22,6 +22,8 @@ nordrelay doctor
 nordrelay start
 ```
 
+If `nordrelay` is not found after a global npm install, the npm global bin directory is not in your shell `PATH`. New installs run a postinstall check and print the exact command to add the bin directory to your shell profile.
+
 Open the dashboard:
 
 ```bash
@@ -78,6 +80,8 @@ nordrelay doctor
 nordrelay web
 nordrelay restart
 nordrelay update
+nordrelay service install
+nordrelay service status
 ```
 
 Chat adapters share the core command set:

package/dist/access/audit-log.js

@@ -1,5 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { auditCategoryForAction, } from "../core/activity-events.js";
+import { cursorPage, normalizeCursorLimit } from "../core/pagination.js";
 import { createDocumentStore } from "../state/state-backend.js";
 export class AuditLogStore {
     store;
@@ -31,20 +32,36 @@ export class AuditLogStore {
     }
     list(options = 20) {
         const resolved = typeof options === "number" ? { limit: options } : options;
-        const limit = Math.max(1, Math.min(500, resolved.limit ?? 20));
-        const since = normalizeSince(resolved.since);
+        return this.listPage(resolved).items;
+    }
+    listPage(options = {}) {
+        const limit = normalizeCursorLimit(options.limit, 20, 500);
+        const events = this.filteredEvents(options)
+            .sort((left, right) => Date.parse(right.timestamp) - Date.parse(left.timestamp));
+        return cursorPage(events, options.cursor, limit, (event) => event.id);
+    }
+    findByCorrelationId(correlationId, limit = 100) {
+        const needle = correlationId.trim();
+        if (!needle) {
+            return [];
+        }
+        return this.readPayload().events
+            .filter((event) => event.correlationId === needle)
+            .sort((left, right) => Date.parse(left.timestamp) - Date.parse(right.timestamp))
+            .slice(-Math.max(1, Math.min(500, limit)));
+    }
+    filteredEvents(options) {
+        const since = normalizeSince(options.since);
         return this.readPayload().events
-            .filter((event) => !resolved.channelId || resolved.channelId === "all" || event.channelId === resolved.channelId)
-            .filter((event) => !resolved.status || resolved.status === "all" || event.status === resolved.status)
-            .filter((event) => !resolved.action || resolved.action === "all" || event.action === resolved.action)
-            .filter((event) => !resolved.category || resolved.category === "all" || (event.category ?? auditCategoryForAction(event.action)) === resolved.category)
-            .filter((event) => !resolved.agentId || resolved.agentId === "all" || event.agentId === resolved.agentId)
-            .filter((event) => !resolved.threadId || event.threadId === resolved.threadId)
-            .filter((event) => !resolved.workspace || event.workspace === resolved.workspace)
-            .filter((event) => !resolved.actor || auditActorMatches(event, resolved.actor))
-            .filter((event) => !since || Date.parse(event.timestamp) >= since)
-            .slice(-limit)
-            .reverse();
+            .filter((event) => !options.channelId || options.channelId === "all" || event.channelId === options.channelId)
+            .filter((event) => !options.status || options.status === "all" || event.status === options.status)
+            .filter((event) => !options.action || options.action === "all" || event.action === options.action)
+            .filter((event) => !options.category || options.category === "all" || (event.category ?? auditCategoryForAction(event.action)) === options.category)
+            .filter((event) => !options.agentId || options.agentId === "all" || event.agentId === options.agentId)
+            .filter((event) => !options.threadId || event.threadId === options.threadId)
+            .filter((event) => !options.workspace || event.workspace === options.workspace)
+            .filter((event) => !options.actor || auditActorMatches(event, options.actor))
+            .filter((event) => !since || Date.parse(event.timestamp) >= since);
     }
     readPayload() {
         const payload = this.store.read();

package/dist/channels/discord/discord-bot.js

@@ -18,6 +18,7 @@ import { createSharedChannelCommandDispatcher } from "../shared/channel-command-
 import { ChannelCommandService } from "../shared/channel-command-service.js";
 import { discordHelpCommandList } from "../shared/channel-command-catalog.js";
 import { createChannelPromptEngine } from "../shared/channel-prompt-engine.js";
+import { queueChannelPromptIfBusy } from "../shared/channel-prompt-queue.js";
 import { runChannelPeerPrompt } from "../shared/channel-peer-prompt.js";
 import { deliverChannelAction } from "../shared/channel-runtime.js";
 import { deliverChannelCliArtifacts } from "../shared/channel-cli-artifacts.js";
@@ -304,30 +305,17 @@ export function createDiscordBridge(config, registry) {
         if (!options.fromQueue && await denyIfLocked(request)) {
             return;
         }
-        const busy = getBusyReason(request.contextKey);
-        if (busy.busy) {
-            const item = options.fromQueue && isQueuedPrompt(envelope)
-                ? envelope
-                : promptStore.enqueue(request.contextKey, envelope);
-            const position = promptStore.list(request.contextKey).findIndex((queued) => queued.id === item.id) + 1;
-            const text = busy.kind === "external"
-                ? `Queued prompt ${item.id} at position ${position}. The ${busy.agentLabel} session is still active and is processing a previous task.`
-                : `Queued prompt ${item.id} at position ${position}.`;
-            await reply(request, text, {
-                buttons: [[{ label: "Cancel queued message", action: `discord_queue_cancel:${request.contextKey}:${item.id}` }]],
-            });
-            appendActivity(request, {
-                status: "queued",
-                type: "prompt_queued",
-                prompt: item.description,
-                detail: text,
-            });
-            audit(request, {
-                action: "prompt_queued",
-                status: "ok",
-                promptId: item.id,
-                description: item.description,
-            });
+        if (await queueChannelPromptIfBusy({
+            request,
+            envelope,
+            fromQueue: options.fromQueue,
+            promptStore,
+            busy: getBusyReason(request.contextKey),
+            actionPrefix: "discord",
+            reply,
+            appendActivity,
+            audit,
+        })) {
             return;
         }
         const busyState = getBusyState(request.contextKey);
@@ -1580,6 +1568,3 @@ function inferMimeType(name) {
         return "audio/webm";
     return "application/octet-stream";
 }
-function isQueuedPrompt(value) {
-    return Boolean(value && typeof value === "object" && "id" in value && "contextKey" in value);
-}

package/dist/channels/shared/channel-bridge-controller.js

@@ -42,7 +42,7 @@ export function createChannelQueueStatusController(options) {
 }
 export function createChannelActivityRecorder(options) {
     return (request, input) => {
-        options.activityStore.append({
+        return options.activityStore.append({
             source: options.source,
             contextKey: request.contextKey,
             actor: input.actor ?? options.actorFor(request),

package/dist/channels/shared/channel-prompt-queue.js

@@ -0,0 +1,37 @@
+export async function queueChannelPromptIfBusy(options) {
+    if (!options.busy.busy) {
+        return false;
+    }
+    const item = options.fromQueue && isQueuedPrompt(options.envelope)
+        ? options.envelope
+        : options.promptStore.enqueue(options.request.contextKey, options.envelope);
+    const position = options.promptStore.list(options.request.contextKey).findIndex((queued) => queued.id === item.id) + 1;
+    const text = options.busy.kind === "external"
+        ? `Queued prompt ${item.id} at position ${position}. The ${options.busy.agentLabel} session is still active and is processing a previous task.`
+        : `Queued prompt ${item.id} at position ${position}.`;
+    await options.reply(options.request, text, {
+        buttons: [[{ label: "Cancel queued message", action: `${options.actionPrefix}_queue_cancel:${options.request.contextKey}:${item.id}` }]],
+    });
+    options.appendActivity(options.request, {
+        status: "queued",
+        type: "prompt_queued",
+        prompt: item.description,
+        detail: text,
+        correlationId: item.correlationId,
+    });
+    options.audit(options.request, {
+        action: "prompt_queued",
+        status: "ok",
+        promptId: item.id,
+        correlationId: item.correlationId,
+        description: item.description,
+    });
+    return true;
+}
+function isQueuedPrompt(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return false;
+    }
+    const candidate = value;
+    return typeof candidate.id === "string" && typeof candidate.createdAt === "number" && typeof candidate.description === "string";
+}

package/dist/channels/shared/channel-turn-service.js

@@ -17,12 +17,14 @@ export class ChannelTurnService {
             }
         }
         const turnId = randomUUID().slice(0, 12);
+        const correlationId = envelope.correlationId ?? turnId;
         const startedMs = Date.now();
         this.options.setCurrentTurn(turnId, startedMs, "");
         this.options.setCurrentProgress({
             id: turnId,
             source: this.options.source,
             status: "running",
+            correlationId,
             prompt: envelope.description,
             agentId: info.agentId,
             agentLabel: info.agentLabel,
@@ -42,6 +44,7 @@ export class ChannelTurnService {
             role: "user",
             text: envelope.description,
             source: this.options.source,
+            correlationId,
             turnId,
             timestamp: startedAt,
         });
@@ -53,6 +56,7 @@ export class ChannelTurnService {
             workspace: info.workspace,
             agentId: info.agentId,
             actor,
+            correlationId,
             prompt: envelope.description,
         });
         this.options.appendAudit({
@@ -63,9 +67,10 @@ export class ChannelTurnService {
             threadId: info.threadId,
             workspace: info.workspace,
             actor,
+            correlationId,
             description: envelope.description,
         });
-        this.options.broadcast({ type: "turn_start", id: turnId, prompt: envelope.description, at: startedAt, source: this.options.source });
+        this.options.broadcast({ type: "turn_start", id: turnId, prompt: envelope.description, at: startedAt, source: this.options.source, correlationId });
         try {
             await session.prompt(envelope.input, this.callbacks(turnId, info, envelope, actor));
             this.options.updateSession(session);
@@ -77,6 +82,7 @@ export class ChannelTurnService {
                     role: "agent",
                     text,
                     source: this.options.source,
+                    correlationId,
                     turnId,
                 });
             }
@@ -88,6 +94,7 @@ export class ChannelTurnService {
                 workspace: info.workspace,
                 agentId: info.agentId,
                 actor,
+                correlationId,
                 prompt: envelope.description,
                 durationMs: Date.now() - this.options.getCurrentTurnStartedAt(),
             });
@@ -99,10 +106,11 @@ export class ChannelTurnService {
                 threadId: info.threadId,
                 workspace: info.workspace,
                 actor,
+                correlationId,
                 description: envelope.description,
             });
             this.updateCurrentProgress({ status: "completed" });
-            this.options.broadcast({ type: "turn_complete", id: turnId, at: new Date().toISOString() });
+            this.options.broadcast({ type: "turn_complete", id: turnId, at: new Date().toISOString(), correlationId });
             this.options.broadcast({ type: "chat_history", messages: await this.options.chatHistory() });
         }
         catch (error) {
@@ -112,6 +120,7 @@ export class ChannelTurnService {
                 role: "system",
                 text: `Error: ${errorText}`,
                 source: this.options.source,
+                correlationId,
                 turnId,
             });
             this.options.appendActivity({
@@ -122,6 +131,7 @@ export class ChannelTurnService {
                 workspace: info.workspace,
                 agentId: info.agentId,
                 actor,
+                correlationId,
                 prompt: envelope.description,
                 detail: errorText,
                 durationMs: Date.now() - this.options.getCurrentTurnStartedAt(),
@@ -134,11 +144,12 @@ export class ChannelTurnService {
                 threadId: info.threadId,
                 workspace: info.workspace,
                 actor,
+                correlationId,
                 description: envelope.description,
                 detail: errorText,
             });
             this.updateCurrentProgress({ status: "failed", detail: errorText });
-            this.options.broadcast({ type: "turn_error", id: turnId, error: errorText, at: new Date().toISOString() });
+            this.options.broadcast({ type: "turn_error", id: turnId, error: errorText, at: new Date().toISOString(), correlationId });
             this.options.broadcast({ type: "chat_history", messages: await this.options.chatHistory() });
             throw error;
         }
@@ -152,12 +163,13 @@ export class ChannelTurnService {
         }
     }
     callbacks(turnId, info, envelope, actor) {
+        const correlationId = envelope.correlationId ?? turnId;
         return {
             onTextDelta: (delta) => {
                 const nextText = this.options.getAccumulatedText() + delta;
                 this.options.setAccumulatedText(nextText);
                 this.updateCurrentProgress({ outputChars: nextText.length });
-                this.options.broadcast({ type: "text_delta", id: turnId, delta });
+                this.options.broadcast({ type: "text_delta", id: turnId, delta, correlationId });
             },
             onToolStart: (toolName, toolCallId) => {
                 this.addCurrentTool(toolName);
@@ -169,14 +181,15 @@ export class ChannelTurnService {
                     workspace: info.workspace,
                     agentId: info.agentId,
                     actor,
+                    correlationId,
                     prompt: envelope.description,
                     detail: toolName,
                 });
-                this.options.broadcast({ type: "tool_start", id: turnId, toolCallId, toolName });
+                this.options.broadcast({ type: "tool_start", id: turnId, toolCallId, toolName, correlationId });
             },
             onToolUpdate: (toolCallId, partialResult) => {
                 this.updateCurrentProgress();
-                this.options.broadcast({ type: "tool_update", id: turnId, toolCallId, partialResult });
+                this.options.broadcast({ type: "tool_update", id: turnId, toolCallId, partialResult, correlationId });
             },
             onToolEnd: (toolCallId, isError) => {
                 const progress = this.options.getCurrentProgress();
@@ -190,17 +203,18 @@ export class ChannelTurnService {
                     workspace: info.workspace,
                     agentId: info.agentId,
                     actor,
+                    correlationId,
                     prompt: envelope.description,
                     detail: toolName,
                 });
-                this.options.broadcast({ type: "tool_end", id: turnId, toolCallId, isError });
+                this.options.broadcast({ type: "tool_end", id: turnId, toolCallId, isError, correlationId });
             },
             onTodoUpdate: (items) => {
                 this.updateCurrentProgress({ detail: `Plan: ${items.filter((item) => item.completed).length}/${items.length} done` });
-                this.options.broadcast({ type: "todo_update", id: turnId, items });
+                this.options.broadcast({ type: "todo_update", id: turnId, items, correlationId });
             },
             onTurnComplete: () => { },
-            onAgentEnd: () => this.options.broadcast({ type: "turn_complete", id: turnId, at: new Date().toISOString() }),
+            onAgentEnd: () => this.options.broadcast({ type: "turn_complete", id: turnId, at: new Date().toISOString(), correlationId }),
         };
     }
     updateCurrentProgress(patch = {}) {

package/dist/channels/slack/slack-bot.js

@@ -18,6 +18,7 @@ import { createSharedChannelCommandDispatcher } from "../shared/channel-command-
 import { slackHelpCommandList } from "../shared/channel-command-catalog.js";
 import { ChannelCommandService } from "../shared/channel-command-service.js";
 import { createChannelPromptEngine } from "../shared/channel-prompt-engine.js";
+import { queueChannelPromptIfBusy } from "../shared/channel-prompt-queue.js";
 import { runChannelPeerPrompt } from "../shared/channel-peer-prompt.js";
 import { deliverChannelAction } from "../shared/channel-runtime.js";
 import { deliverChannelCliArtifacts } from "../shared/channel-cli-artifacts.js";
@@ -284,18 +285,17 @@ export function createSlackBridge(config, registry) {
         if (!options.fromQueue && await denyIfLocked(request)) {
             return;
         }
-        const busy = getBusyReason(request.contextKey);
-        if (busy.busy) {
-            const item = options.fromQueue && isQueuedPrompt(envelope) ? envelope : promptStore.enqueue(request.contextKey, envelope);
-            const position = promptStore.list(request.contextKey).findIndex((queued) => queued.id === item.id) + 1;
-            const text = busy.kind === "external"
-                ? `Queued prompt ${item.id} at position ${position}. The ${busy.agentLabel} session is still active and is processing a previous task.`
-                : `Queued prompt ${item.id} at position ${position}.`;
-            await reply(request, text, {
-                buttons: [[{ label: "Cancel queued message", action: `slack_queue_cancel:${request.contextKey}:${item.id}` }]],
-            });
-            appendActivity(request, { status: "queued", type: "prompt_queued", prompt: item.description, detail: text });
-            audit(request, { action: "prompt_queued", status: "ok", promptId: item.id, description: item.description });
+        if (await queueChannelPromptIfBusy({
+            request,
+            envelope,
+            fromQueue: options.fromQueue,
+            promptStore,
+            busy: getBusyReason(request.contextKey),
+            actionPrefix: "slack",
+            reply,
+            appendActivity,
+            audit,
+        })) {
             return;
         }
         const busyState = getBusyState(request.contextKey);
@@ -1321,6 +1321,3 @@ function inferMimeType(name) {
         return "audio/webm";
     return "application/octet-stream";
 }
-function isQueuedPrompt(value) {
-    return Boolean(value && typeof value === "object" && "id" in value && "contextKey" in value);
-}

package/dist/channels/telegram/bot.js

@@ -11,7 +11,7 @@ import { AuditLogStore } from "../../access/audit-log.js";
 import { formatSessionLabel } from "./bot-ui.js";
 import { BotPreferencesStore, isQuietNow, } from "../../state/bot-preferences.js";
 import { renderAgentUpdateJobAction } from "../shared/channel-actions.js";
-import { createChannelBusyStore } from "../shared/channel-bridge-controller.js";
+import { createChannelActivityRecorder, createChannelBusyStore } from "../shared/channel-bridge-controller.js";
 import { ChannelCommandService } from "../shared/channel-command-service.js";
 import { runChannelPeerPrompt } from "../shared/channel-peer-prompt.js";
 import { deliverChannelAction } from "../shared/channel-runtime.js";
@@ -585,17 +585,31 @@ export function createBot(config, registry) {
     function appendActivity(input) {
         return activityStore.append(input);
     }
+    const appendTelegramBridgeActivity = createChannelActivityRecorder({
+        source: "telegram",
+        workspace: config.workspace,
+        activityStore,
+        actorFor: (request) => telegramActivityActor(request.ctx),
+    });
     function appendTelegramActivity(ctx, contextKey, session, input) {
         const info = session.getInfo();
-        return appendActivity({
-            source: "telegram",
+        const event = appendTelegramBridgeActivity({
             contextKey,
+            context: telegramChannelContextFromCtx(ctx) ?? {
+                channelId: "telegram",
+                chatId: String(ctx.chat?.id ?? contextKey),
+                userId: ctx.from?.id !== undefined ? String(ctx.from.id) : undefined,
+                username: ctx.from?.username,
+            },
+            authUser: getAuthenticatedUser(ctx) ?? undefined,
+            ctx,
+        }, {
             ...input,
             threadId: input.threadId ?? info.threadId,
             workspace: input.workspace ?? info.workspace,
             agentId: input.agentId ?? idOf(info),
-            actor: input.actor ?? telegramActivityActor(ctx),
         });
+        return event;
     }
     function recordTelegramAgentUpdateLifecycle(job) {
         const previous = agentUpdateStates.get(job.id);

package/dist/core/pagination.js

@@ -0,0 +1,22 @@
+export function normalizeCursorLimit(value, fallback = 100, max = 500) {
+    const parsed = typeof value === "number" ? value : Number.parseInt(String(value ?? ""), 10);
+    const selected = Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+    return Math.max(1, Math.min(max, selected));
+}
+export function cursorPage(items, cursor, limit, cursorOf) {
+    const normalizedLimit = normalizeCursorLimit(limit, limit);
+    const startIndex = cursor ? Math.max(0, items.findIndex((item) => cursorOf(item) === cursor) + 1) : 0;
+    const window = items.slice(startIndex, startIndex + normalizedLimit + 1);
+    const pageItems = window.slice(0, normalizedLimit);
+    const hasNext = window.length > normalizedLimit;
+    const last = pageItems.at(-1);
+    return {
+        items: pageItems,
+        pagination: {
+            limit: normalizedLimit,
+            nextCursor: hasNext && last ? cursorOf(last) ?? null : null,
+            hasNext,
+            total: items.length,
+        },
+    };
+}

package/dist/peers/peer-store.js

@@ -61,6 +61,22 @@ export class PeerStore {
         });
         return { invitation: publicInvitation(invitation), code };
     }
+    createRotationInvitation(id, options = {}) {
+        const peer = this.get(id);
+        if (!peer) {
+            throw new Error("Peer not found.");
+        }
+        const created = this.createInvitation({
+            name: `${peer.name} rotation`,
+            group: peer.group,
+            expiresInMs: options.expiresInMs,
+            scopes: peer.scopes,
+            allowedAgents: peer.allowedAgents,
+            allowedWorkspaceRoots: peer.allowedWorkspaceRoots,
+            workspaceAliases: peer.workspaceAliases,
+        });
+        return { peer: publicPeer(peer), ...created };
+    }
     consumeInvitation(code, usedByNodeId) {
         const trimmed = code.trim();
         if (!trimmed) {

package/dist/peers/peer-types.js

@@ -13,6 +13,7 @@ export const DEFAULT_PEER_SCOPES = [
     "logs.read",
 ];
 export function publicPeer(record) {
+    const trust = peerTrust(record);
     return {
         id: record.id,
         name: record.name,
@@ -36,6 +37,8 @@ export function publicPeer(record) {
         remoteStatus: record.remoteStatus,
         lastError: record.lastError,
         healthHistory: record.healthHistory?.map((sample) => ({ ...sample })),
+        trustStatus: trust.status,
+        trustWarnings: trust.warnings,
         effectiveAccess: {
             scopes: [...record.scopes],
             allowedAgents: [...record.allowedAgents],
@@ -44,6 +47,22 @@ export function publicPeer(record) {
         },
     };
 }
+function peerTrust(record) {
+    const warnings = [];
+    if (!record.enabled) {
+        warnings.push("Peer is disabled.");
+        return { status: "disabled", warnings };
+    }
+    if (record.lastError) {
+        warnings.push(record.lastError);
+        return { status: "error", warnings };
+    }
+    if (record.url?.startsWith("https://") && !record.tlsFingerprint) {
+        warnings.push("TLS fingerprint is not pinned yet. Probe or re-pin this peer before using it over untrusted networks.");
+        return { status: "tls-unpinned", warnings };
+    }
+    return { status: "trusted", warnings };
+}
 export function publicInvitation(record) {
     return {
         id: record.id,

package/dist/peers/peer-web-proxy-contract.js

@@ -19,6 +19,7 @@ const LOCAL_ONLY_ROUTE_PATHS = new Set([
     "/api/peers/invitations/:id",
     "/api/peers/:id",
     "/api/peers/:id/repin",
+    "/api/peers/:id/rotate",
     "/api/peers/:id/health",
     "/api/peers/:id/proxy",
     "/api/peers/:id/events",
@@ -52,6 +53,7 @@ const IMPLEMENTED_ROUTE_PATHS = new Set([
     "/api/progress",
     "/api/metrics",
     "/api/jobs",
+    "/api/trace",
     "/api/jobs/:id/log",
     "/api/jobs/:id/action",
     "/api/active-sessions",

package/dist/runtime/relay-external-activity-monitor.js

@@ -127,6 +127,7 @@ export class RelayExternalActivityMonitor {
                     role: "agent",
                     text: finalText,
                     source: "cli",
+                    correlationId: externalCorrelationId(snapshot),
                     turnId: terminalEvent.turnId ?? undefined,
                     key: externalMessageKey("final", snapshot, terminalEvent.lineNumber),
                 });
@@ -138,6 +139,7 @@ export class RelayExternalActivityMonitor {
                     type: "turn_complete",
                     id: terminalEvent.turnId ?? "cli",
                     at: terminalEvent.timestamp?.toISOString() ?? new Date().toISOString(),
+                    correlationId: externalCorrelationId(snapshot),
                 });
             }
             this.options.appendActivity({
@@ -148,6 +150,7 @@ export class RelayExternalActivityMonitor {
                 workspace: info.workspace,
                 agentId: info.agentId,
                 actor: CLI_ACTIVITY_ACTOR,
+                correlationId: externalCorrelationId(snapshot),
                 prompt: snapshot.latestUserMessage ?? undefined,
                 detail: `${snapshot.agentLabel} CLI task ${terminalEvent.status ?? "finished"}.`,
                 durationMs: durationFromDates(externalStartedAt, terminalEvent.timestamp),
@@ -176,6 +179,7 @@ export class RelayExternalActivityMonitor {
                 role: "system",
                 text: `Working on ${trimLine(prompt, 500)}`,
                 source: "cli",
+                correlationId: externalCorrelationId(snapshot),
                 turnId: snapshot.activity.turnId ?? undefined,
                 timestamp: snapshot.activity.startedAt?.toISOString(),
                 key: externalMessageKey("working", snapshot),
@@ -193,6 +197,7 @@ export class RelayExternalActivityMonitor {
             workspace: info.workspace,
             agentId: info.agentId,
             actor: CLI_ACTIVITY_ACTOR,
+            correlationId: externalCorrelationId(snapshot),
             prompt,
             detail: `${snapshot.sourceLabel}: ${snapshot.sourcePath}`,
         });
@@ -206,6 +211,7 @@ export class RelayExternalActivityMonitor {
                         id: snapshot.activity.turnId ?? "cli",
                         toolCallId: `cli-${event.lineNumber}`,
                         toolName: event.toolName ?? "tool",
+                        correlationId: externalCorrelationId(snapshot),
                     });
                 }
                 this.options.appendActivity({
@@ -216,6 +222,7 @@ export class RelayExternalActivityMonitor {
                     workspace: info.workspace,
                     agentId: info.agentId,
                     actor: CLI_ACTIVITY_ACTOR,
+                    correlationId: externalCorrelationId(snapshot),
                     detail: event.toolName ?? "tool",
                 });
             }
@@ -226,6 +233,7 @@ export class RelayExternalActivityMonitor {
                         id: snapshot.activity.turnId ?? "cli",
                         toolCallId: `cli-${event.lineNumber}`,
                         isError: false,
+                        correlationId: externalCorrelationId(snapshot),
                     });
                 }
                 this.options.appendActivity({
@@ -236,6 +244,7 @@ export class RelayExternalActivityMonitor {
                     workspace: info.workspace,
                     agentId: info.agentId,
                     actor: CLI_ACTIVITY_ACTOR,
+                    correlationId: externalCorrelationId(snapshot),
                     detail: event.toolName ?? "tool",
                 });
             }
@@ -246,6 +255,7 @@ export class RelayExternalActivityMonitor {
                         id: snapshot.activity.turnId ?? "cli",
                         toolCallId: `cli-${event.lineNumber}`,
                         isError: true,
+                        correlationId: externalCorrelationId(snapshot),
                     });
                 }
                 this.options.appendActivity({
@@ -276,6 +286,7 @@ export class RelayExternalActivityMonitor {
                 role: event.kind === "tool" ? "tool" : "system",
                 text: rendered.plain,
                 source: "cli",
+                correlationId: externalCorrelationId(snapshot),
                 turnId: event.turnId ?? snapshot.activity.turnId ?? undefined,
                 timestamp: event.timestamp?.toISOString(),
                 key: externalMessageKey("event", snapshot, event.lineNumber),
@@ -298,6 +309,7 @@ export class RelayExternalActivityMonitor {
             role: "system",
             text: text ?? renderExternalMirrorStatus(snapshot, this.options.queueLength()).plain,
             source: "cli",
+            correlationId: externalCorrelationId(snapshot),
             turnId: snapshot.activity.turnId ?? undefined,
             key: externalMessageKey("status", snapshot),
         });
@@ -318,6 +330,9 @@ function externalMessageKey(kind, snapshot, lineNumber) {
         lineNumber ?? "",
     ].join(":");
 }
+function externalCorrelationId(snapshot) {
+    return `cli:${snapshot.agentId}:${snapshot.activity.turnId ?? snapshot.threadId}`;
+}
 function externalStatusLine(snapshot, queueLength) {
     const elapsed = snapshot.activity.startedAt
         ? formatDuration((Date.now() - snapshot.activity.startedAt.getTime()) / 1000)

package/dist/runtime/relay-queue-service.js

@@ -60,6 +60,7 @@ export function queueItemDto(item) {
         description: item.description,
         createdAt: new Date(item.createdAt).toISOString(),
         attempts: item.attempts ?? 0,
+        correlationId: item.correlationId,
         notBefore: item.notBefore ? new Date(item.notBefore).toISOString() : undefined,
         lastError: item.lastError,
     };

package/dist/runtime/relay-runtime-dashboard.js

@@ -111,6 +111,9 @@ export async function relayRuntimeMetrics(runtime) {
 export function relayRuntimeAudit(runtime, options = 50) {
     return runtime.auditStore.list(options);
 }
+export function relayRuntimeAuditPage(runtime, options = {}) {
+    return runtime.auditStore.listPage(options);
+}
 export async function relayRuntimeSupportBundle(runtime, actor) {
     const bundle = await createSupportBundle({
         config: runtime.config,