npm - @openchambery/web - Versions diffs - 1.19.4 → 1.19.5-beta.10 - Mend

@openchambery/web 1.19.4 → 1.19.5-beta.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (172) hide show

package/dist/index.html CHANGED Viewed

@@ -552,25 +552,25 @@
         opacity: 0.72;
       }
     </style>
-    <script type="module" crossorigin src="/assets/main-OM6EVqFo.js"></script>
+    <script type="module" crossorigin src="/assets/main-CQLsl_QE.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-C0FnF6B9.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-base-ui-CnHfUmDN.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-zustand-B4dlGEM2.js">
-    <link rel="modulepreload" crossorigin href="/assets/useUIStore-DOxLVeGb.js">
+    <link rel="modulepreload" crossorigin href="/assets/useUIStore-BXjMQrel.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-pathe-vBmvQE8f.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-react-DLPElpoQ.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-tanstack-query-core-BWz0ose6.js">
-    <link rel="modulepreload" crossorigin href="/assets/persistence-DE9RnVcA.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-BrrYPqKq.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-DR60DATT.js">
+    <link rel="modulepreload" crossorigin href="/assets/persistence-CLUawIlm.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-DceeVBky.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-B0MRdR5y.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-opencode-sdk-C07HQypa.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-aparajita-capacitor-secure-storage-CjQdwfjS.js">
-    <link rel="modulepreload" crossorigin href="/assets/platform-MjT8iqKB.js">
-    <link rel="modulepreload" crossorigin href="/assets/terminalApi-Bnx0KvaV.js">
+    <link rel="modulepreload" crossorigin href="/assets/platform-BrncW9ab.js">
+    <link rel="modulepreload" crossorigin href="/assets/terminalApi-D2OzR0I3.js">
     <link rel="modulepreload" crossorigin href="/assets/types-BuiqMmh_.js">
     <link rel="modulepreload" crossorigin href="/assets/capgoAdapter-DCowZ2ab.js">
-    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-C2Vygqku.js">
-    <link rel="stylesheet" crossorigin href="/assets/src-eGuNWxHc.css">
+    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-BGuiq1aJ.js">
+    <link rel="stylesheet" crossorigin href="/assets/src-D-LxNwlu.css">
   </head>
   <body class="h-full bg-background text-foreground">
     <!-- Keep the startup layer outside #root. React replaces every child of

package/dist/mini-chat.html CHANGED Viewed

@@ -74,25 +74,25 @@
       }
     </style>
-    <script type="module" crossorigin src="/assets/miniChat-CWJejsNH.js"></script>
+    <script type="module" crossorigin src="/assets/miniChat-w-S3l9bR.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-C0FnF6B9.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-base-ui-CnHfUmDN.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-zustand-B4dlGEM2.js">
-    <link rel="modulepreload" crossorigin href="/assets/useUIStore-DOxLVeGb.js">
+    <link rel="modulepreload" crossorigin href="/assets/useUIStore-BXjMQrel.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-pathe-vBmvQE8f.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-react-DLPElpoQ.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-tanstack-query-core-BWz0ose6.js">
-    <link rel="modulepreload" crossorigin href="/assets/persistence-DE9RnVcA.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-BrrYPqKq.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-DR60DATT.js">
+    <link rel="modulepreload" crossorigin href="/assets/persistence-CLUawIlm.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-DceeVBky.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-B0MRdR5y.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-opencode-sdk-C07HQypa.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-aparajita-capacitor-secure-storage-CjQdwfjS.js">
-    <link rel="modulepreload" crossorigin href="/assets/platform-MjT8iqKB.js">
-    <link rel="modulepreload" crossorigin href="/assets/terminalApi-Bnx0KvaV.js">
+    <link rel="modulepreload" crossorigin href="/assets/platform-BrncW9ab.js">
+    <link rel="modulepreload" crossorigin href="/assets/terminalApi-D2OzR0I3.js">
     <link rel="modulepreload" crossorigin href="/assets/types-BuiqMmh_.js">
     <link rel="modulepreload" crossorigin href="/assets/capgoAdapter-DCowZ2ab.js">
-    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-C2Vygqku.js">
-    <link rel="stylesheet" crossorigin href="/assets/src-eGuNWxHc.css">
+    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-BGuiq1aJ.js">
+    <link rel="stylesheet" crossorigin href="/assets/src-D-LxNwlu.css">
   </head>
   <body class="h-full bg-background text-foreground">
     <div id="root" class="h-full">

package/dist/mobile.html CHANGED Viewed

@@ -63,25 +63,25 @@
       })();
     </script>
-    <script type="module" crossorigin src="/assets/mobile-D-ubuubW.js"></script>
+    <script type="module" crossorigin src="/assets/mobile-CHDToW-w.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-C0FnF6B9.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-base-ui-CnHfUmDN.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-zustand-B4dlGEM2.js">
-    <link rel="modulepreload" crossorigin href="/assets/useUIStore-DOxLVeGb.js">
+    <link rel="modulepreload" crossorigin href="/assets/useUIStore-BXjMQrel.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-pathe-vBmvQE8f.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-react-DLPElpoQ.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-tanstack-query-core-BWz0ose6.js">
-    <link rel="modulepreload" crossorigin href="/assets/persistence-DE9RnVcA.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-BrrYPqKq.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-DR60DATT.js">
+    <link rel="modulepreload" crossorigin href="/assets/persistence-CLUawIlm.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-DceeVBky.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-B0MRdR5y.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-opencode-sdk-C07HQypa.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-aparajita-capacitor-secure-storage-CjQdwfjS.js">
-    <link rel="modulepreload" crossorigin href="/assets/platform-MjT8iqKB.js">
-    <link rel="modulepreload" crossorigin href="/assets/terminalApi-Bnx0KvaV.js">
+    <link rel="modulepreload" crossorigin href="/assets/platform-BrncW9ab.js">
+    <link rel="modulepreload" crossorigin href="/assets/terminalApi-D2OzR0I3.js">
     <link rel="modulepreload" crossorigin href="/assets/types-BuiqMmh_.js">
     <link rel="modulepreload" crossorigin href="/assets/capgoAdapter-DCowZ2ab.js">
-    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-C2Vygqku.js">
-    <link rel="stylesheet" crossorigin href="/assets/src-eGuNWxHc.css">
+    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-BGuiq1aJ.js">
+    <link rel="stylesheet" crossorigin href="/assets/src-D-LxNwlu.css">
   </head>
   <body class="h-full bg-background text-foreground">
     <div id="root" class="h-full"></div>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@openchambery/web",
-  "version": "1.19.4",
+  "version": "1.19.5-beta.10",
   "private": false,
   "type": "module",
   "main": "./server/index.js",

package/server/index.js CHANGED Viewed

@@ -342,8 +342,6 @@ const updateUiVisibility = (token, visible, platform) => {
   if (visible === true) clearPendingPushBadge();
   return pushRuntime.updateUiVisibility(token, visible, platform);
 };
-const isAnyUiVisible = (...args) => pushRuntime.isAnyUiVisible(...args);
-const isAnyInteractiveClientVisible = (...args) => pushRuntime.isAnyInteractiveClientVisible(...args);
 const isUiVisible = (...args) => pushRuntime.isUiVisible(...args);
 const ensurePushInitialized = (...args) => pushRuntime.ensurePushInitialized(...args);
 const setPushInitialized = (...args) => pushRuntime.setPushInitialized(...args);
@@ -664,7 +662,6 @@ const notificationTriggerRuntime = createNotificationTriggerRuntime({
   sendPushToAllUiSessions,
   sendApnsToAllUiSessions,
   sendLiveActivityEnd,
-  isAnyInteractiveClientVisible,
   buildOpenCodeUrl,
   getOpenCodeAuthHeaders,
 });
@@ -1419,6 +1416,29 @@ async function main(options = {}) {
     // Re-evaluate the relay lifecycle after pairing/device changes (a revoked or
     // redeemed device can flip relay demand on or off).
     reconcileRelay: () => (relayServiceInstance ? relayServiceInstance.reconcile() : Promise.resolve()),
+    // Canonical endpoints the host relay currently uses (primary first).
+    // Pairing-session requests from paired desktop clients may carry a relayUrl
+    // only when it matches one of these (an echo of an advertised endpoint,
+    // never a re-point or an extension).
+    getEffectiveRelayUrls: async () => {
+      if (!relayServiceInstance) return [];
+      try {
+        const status = await relayServiceInstance.getStatus();
+        return Array.isArray(status?.relayUrls) ? status.relayUrls : [];
+      } catch {
+        return [];
+      }
+    },
+    // Every configured relay endpoint as a pairing candidate (multi-relay),
+    // for the connection-candidates refresh.
+    getRelayPairingCandidates: async () => {
+      if (!relayServiceInstance) return [];
+      try {
+        return await relayServiceInstance.getPairingCandidates();
+      } catch {
+        return [];
+      }
+    },
     getPairingTransports: async (req) => {
       const transports = resolvePairingTransports(req);
       if (!relayServiceInstance || !transports.relayAvailable) return transports;
@@ -1426,6 +1446,7 @@ async function main(options = {}) {
       return {
         ...transports,
         relayUrl: relay.relayUrl,
+        relayUrls: relay.relayUrls,
         relayUrlLocked: relay.relayUrlLocked,
       };
     },
@@ -1516,6 +1537,22 @@ async function main(options = {}) {
     onRelayUrlChanged: async () => {
       await apnsRuntime.reRegisterAllTokens();
     },
+    // Owner gate for relay-endpoint management: UI session or the local desktop
+    // shell. Paired remote clients (desktops included) are NOT endpoint owners
+    // — adding/removing endpoints is the same trust boundary as re-pointing
+    // the primary endpoint.
+    isOwnerRequest: async (req, res) => {
+      if (typeof uiAuthController?.resolveAuthContext !== 'function') return false;
+      try {
+        const context = await uiAuthController.resolveAuthContext(req, res, { allowClientAuth: true, allowUrlToken: false });
+        if (context?.type === 'session') return true;
+        if (context?.type === 'client') {
+          return context.client?.clientKind === 'desktop-local';
+        }
+      } catch {
+      }
+      return false;
+    },
   });
   relayServiceInstance = relayService;
   relayService.registerRoutes(app);

package/server/lib/notifications/DOCUMENTATION.md CHANGED Viewed

@@ -52,7 +52,7 @@ This module provides notification message preparation utilities for the web serv
   - session meta cache for child-session and small-model suppression
   - template resolution and fallback behavior
   - native notification fanout and web push payload fanout
-  - push suppression while any fresh UI visibility heartbeat reports a focused client
+  - push always fans out to every subscribed surface; another client's visibility never suppresses delivery
 ### Push runtime API (push-runtime.js)
 - `createPushRuntime(dependencies)`: creates runtime for web push and UI visibility state.
@@ -62,7 +62,7 @@ This module provides notification message preparation utilities for the web serv
   - `setPushInitialized(value)`
   - `addOrUpdatePushSubscription(uiSessionToken, subscription, userAgent)`
   - `removePushSubscription(uiSessionToken, endpoint)`
-  - `sendPushToAllUiSessions(payload, options?)`
+  - `sendPushToAllUiSessions(payload)`
   - `updateUiVisibility(token, visible)`
   - `isAnyUiVisible()`
   - `isUiVisible(token)`

package/server/lib/notifications/push-runtime.js CHANGED Viewed

@@ -221,8 +221,7 @@ export const createPushRuntime = (deps) => {
     }
   };
-  const sendPushToAllUiSessions = async (payload, options = {}) => {
-    const requireNoSse = options.requireNoSse === true;
+  const sendPushToAllUiSessions = async (payload) => {
     const store = await readPushSubscriptionsFromDisk();
     const sessions = store.subscriptionsBySession || {};
     const subscriptionsByEndpoint = new Map();
@@ -239,14 +238,6 @@ export const createPushRuntime = (deps) => {
     }
     await Promise.all(Array.from(subscriptionsByEndpoint.values()).map(async (sub) => {
-      if (requireNoSse) {
-        // Mobile PWA subscriptions follow the same presence model as native push: suppress only
-        // when an interactive (desktop/web) client is visible. The phone PWA's own foreground is
-        // handled in the service worker (focused-client check), so it won't double-notify.
-        // Non-mobile (desktop/web) subscriptions keep the existing any-visible gate.
-        const suppressed = isMobilePlatform(sub.platform) ? isAnyInteractiveClientVisible() : isAnyUiVisible();
-        if (suppressed) return;
-      }
       await sendPushToSubscription(sub, payload);
     }));
   };
@@ -278,10 +269,9 @@ export const createPushRuntime = (deps) => {
     return false;
   };
-  // True when at least one NON-mobile client (desktop/web/vscode) is currently visible. Used to
-  // suppress native push to the phone: an active desktop already shows the notification, so the
-  // phone doesn't need it. Deliberately based on the desktop's visibility (reliable), never the
-  // phone's own (a backgrounded WKWebView can't report "hidden" before iOS suspends it).
+  // True when at least one NON-mobile client (desktop/web/vscode) is currently visible.
+  // Not a push gate — delivery always fans out. Kept as a visibility query for tests and
+  // diagnostics. Deliberately based on the desktop's visibility, never the phone's own.
   const isAnyInteractiveClientVisible = () => {
     const now = Date.now();
     pruneUiVisibility(now);

package/server/lib/notifications/runtime.js CHANGED Viewed

@@ -12,7 +12,6 @@ export const createNotificationTriggerRuntime = (deps) => {
     sendPushToAllUiSessions,
     sendApnsToAllUiSessions,
     sendLiveActivityEnd,
-    isAnyInteractiveClientVisible,
     buildOpenCodeUrl,
     getOpenCodeAuthHeaders,
   } = deps;
@@ -68,25 +67,17 @@ export const createNotificationTriggerRuntime = (deps) => {
   };
   // Fan a notification out to every delivery channel: browser web-push (full templated
-  // payload) and native iOS APNs (generic model-based text). Both share the dedup tag and
-  // `requireNoSse` focus gate; a failure in one channel must not block the other.
-  const fanoutPush = (payload, options) => {
-    // Presence-aware routing: if any interactive (non-mobile) client — desktop/web/vscode — is
-    // currently visible, it already shows the in-app notification, so skip the native push to the
-    // phone. Gated on the desktop's visibility (reliable), never the phone's own. When we skip we
-    // also skip toApnsGenericPayload, so the badge isn't incremented for an undelivered push.
-    const interactiveVisible = isAnyInteractiveClientVisible?.() === true;
-    return Promise.all([
-      Promise.resolve(sendPushToAllUiSessions?.(payload, options)).catch((error) => {
-        console.warn('[Push] web-push fanout failed:', error?.message ?? error);
-      }),
-      interactiveVisible
-        ? Promise.resolve()
-        : Promise.resolve(sendApnsToAllUiSessions?.(toApnsGenericPayload(payload), options)).catch((error) => {
-            console.warn('[APNs] fanout failed:', error?.message ?? error);
-          }),
-    ]);
-  };
+  // payload) and native iOS APNs (generic model-based text). Both share the dedup tag;
+  // a failure in one channel must not block the other. Visibility on any other client
+  // never suppresses delivery — every subscribed surface gets the push.
+  const fanoutPush = (payload, options) => Promise.all([
+    Promise.resolve(sendPushToAllUiSessions?.(payload, options)).catch((error) => {
+      console.warn('[Push] web-push fanout failed:', error?.message ?? error);
+    }),
+    Promise.resolve(sendApnsToAllUiSessions?.(toApnsGenericPayload(payload), options)).catch((error) => {
+      console.warn('[APNs] fanout failed:', error?.message ?? error);
+    }),
+  ]);
   let getIsWindowFocused = typeof deps.getIsWindowFocused === 'function'
     ? deps.getIsWindowFocused

package/server/lib/notifications/runtime.test.js CHANGED Viewed

@@ -28,7 +28,6 @@ const createRuntime = (overrides = {}) => {
     sendPushToAllUiSessions,
     sendApnsToAllUiSessions,
     sendLiveActivityEnd,
-    isAnyInteractiveClientVisible: () => false,
     buildOpenCodeUrl: (path) => `http://opencode.test${path}`,
     getOpenCodeAuthHeaders: () => ({}),
     getIsWindowFocused: () => false,
@@ -224,14 +223,13 @@ describe('notification trigger live activity end', () => {
     expect(sendApnsToAllUiSessions).not.toHaveBeenCalled();
   });
-  it('ends the live activity even when an interactive client is visible', async () => {
+  it('still sends native push when another client is visible', async () => {
     vi.stubGlobal('fetch', vi.fn(async () => rootSessionResponse()));
-    const { runtime, sendLiveActivityEnd, sendApnsToAllUiSessions } = createRuntime({
-      isAnyInteractiveClientVisible: () => true,
-    });
+    const { runtime, sendLiveActivityEnd, sendApnsToAllUiSessions, sendPushToAllUiSessions } = createRuntime();
     await runtime.maybeSendPushForTrigger(completionPayload());
     expect(sendLiveActivityEnd).toHaveBeenCalledWith({ sessionId: 'ses_root', status: 'complete' });
-    expect(sendApnsToAllUiSessions).not.toHaveBeenCalled();
+    expect(sendPushToAllUiSessions).toHaveBeenCalledTimes(1);
+    expect(sendApnsToAllUiSessions).toHaveBeenCalledTimes(1);
   });
   it('suppresses live activity end for child and small-model sessions', async () => {

package/server/lib/opencode/core-routes.js CHANGED Viewed

@@ -390,6 +390,16 @@ export const registerAuthAndAccessRoutes = (app, dependencies) => {
     // hostEncPubJwk, priority }) when the host relay is enabled, else null.
     // Injected lazily because the relay service is constructed after these routes.
     getRelayPairingCandidate = async () => null,
+    // All configured relay endpoints (canonical ws(s)://…), primary first, or
+    // [] when relay status is unavailable. Gates remote-bearer pairing requests
+    // that carry a relayUrl: paired desktops may only use an endpoint the host
+    // already has (echo of any configured endpoint, never a re-point).
+    getEffectiveRelayUrls = async () => [],
+    // Candidates for EVERY configured relay endpoint (multi-relay), or null /
+    // a non-array when only the single-endpoint accessor is available. Feeds
+    // the connection-candidates refresh so paired devices learn the full
+    // reachable endpoint set.
+    getRelayPairingCandidates = async () => null,
     // Re-evaluate the relay lifecycle after pairing/device changes.
     reconcileRelay = async () => {},
     // Returns { local, lan, relayAvailable } — the direct transport URLs the
@@ -424,6 +434,15 @@ export const registerAuthAndAccessRoutes = (app, dependencies) => {
     }
   };
+  // Which paired clients may act as operators of this server's device fleet:
+  // create pairing links, list every device, and revoke other devices. The
+  // desktop shell's local client is the in-process operator; a paired `desktop`
+  // client is granted the same trust at pairing time (parity with the SSH
+  // attach flow, where the connecting desktop authenticates as the operator).
+  // Mobile (and any other) paired clients stay scoped to their own record.
+  const canManageRemoteClients = (client) =>
+    client?.clientKind === 'desktop-local' || client?.clientKind === 'desktop';
   const runWithClientManagementAuth = async (req, res, next, handler) => {
     try {
       if (typeof uiAuthController.resolveAuthContext === 'function') {
@@ -458,7 +477,7 @@ export const registerAuthAndAccessRoutes = (app, dependencies) => {
         }
         if (context?.type === 'client') {
           const client = await clientRecordFromAuthContext(context);
-          if (client?.clientKind === 'desktop-local') {
+          if (canManageRemoteClients(client)) {
             await handler({ ...context, client });
             return;
           }
@@ -779,10 +798,10 @@ export const registerAuthAndAccessRoutes = (app, dependencies) => {
     await runWithClientManagementAuth(req, res, next, async (authContext) => {
       if (authContext.type === 'client') {
         const client = await clientRecordFromAuthContext(authContext);
-        // The desktop shell's local client is the trusted operator of this
-        // server; it manages devices just like a browser UI session. Every
-        // other client token is scoped to its own record.
-        if (client?.clientKind !== 'desktop-local') {
+        // Operator clients (local desktop shell, paired desktops) manage the
+        // whole device fleet; every other client token is scoped to its own
+        // record.
+        if (!canManageRemoteClients(client)) {
           return res.json({ clients: client ? [client] : [] });
         }
       }
@@ -807,9 +826,9 @@ export const registerAuthAndAccessRoutes = (app, dependencies) => {
     await runWithClientManagementAuth(req, res, next, async (authContext) => {
       if (authContext.type === 'client') {
         const actingClient = await clientRecordFromAuthContext(authContext);
-        // The desktop shell's local client manages every device; other client
-        // tokens may only revoke themselves.
-        if (actingClient?.clientKind !== 'desktop-local') {
+        // Operator clients (local desktop shell, paired desktops) may revoke
+        // any device; other client tokens may only revoke themselves.
+        if (!canManageRemoteClients(actingClient)) {
           const clientId = clientIdFromAuthContext(authContext);
           if (!clientId || clientId !== req.params?.id) {
             return res.status(403).json({ revoked: false, error: 'Client tokens can only revoke themselves' });
@@ -829,9 +848,10 @@ export const registerAuthAndAccessRoutes = (app, dependencies) => {
     await runWithClientManagementAuth(req, res, next, async (authContext) => {
       if (authContext.type === 'client') {
         const actingClient = await clientRecordFromAuthContext(authContext);
-        // Purging revoked devices is a whole-server management action; only the
-        // trusted desktop shell client (or a UI session) may do it.
-        if (actingClient?.clientKind !== 'desktop-local') {
+        // Purging revoked devices is a whole-server management action; only
+        // operator clients (local desktop shell, paired desktops) or a UI
+        // session may do it.
+        if (!canManageRemoteClients(actingClient)) {
           return res.status(403).json({ purged: 0, error: 'Client tokens cannot purge revoked devices' });
         }
       }
@@ -843,22 +863,25 @@ export const registerAuthAndAccessRoutes = (app, dependencies) => {
   app.post('/api/client-auth/pairing/sessions', express.json({ limit: '64kb' }), async (req, res, next) => {
     await runWithClientCreateAuth(req, res, next, async (authContext) => {
-      // Changing the Host Relay endpoint is an owner-UI or local desktop-shell
-      // action. Paired remote clients never reach this handler (create-auth only
-      // admits session + desktop-local); keep the kind check so a future auth
-      // widening cannot re-point the Host relay from a remote bearer.
-      if (req.body?.relayUrl !== undefined && authContext?.type === 'client') {
-        const actingClient = authContext.client || await clientRecordFromAuthContext(authContext);
-        if (actingClient?.clientKind !== 'desktop-local') {
-          return res.status(403).json({ error: 'Only the owner UI session can set a custom Relay endpoint' });
-        }
-      }
       const requestedRelayUrl = req.body?.relayUrl === undefined
         ? undefined
         : normalizeRequestedRelayUrl(req.body.relayUrl);
       if (req.body?.relayUrl !== undefined && !requestedRelayUrl) {
         return res.status(400).json({ error: 'Relay URL must use ws:// or wss://' });
       }
+      // Changing the Host Relay endpoint set is an owner-UI or local
+      // desktop-shell action. Paired desktop operators reach this handler too,
+      // but may only name an endpoint the host already uses — anything else
+      // would re-point (or extend) the Host relay from a remote bearer.
+      if (requestedRelayUrl !== undefined && authContext?.type === 'client') {
+        const actingClient = authContext.client || await clientRecordFromAuthContext(authContext);
+        if (actingClient?.clientKind !== 'desktop-local') {
+          const effectiveRelayUrls = await getEffectiveRelayUrls();
+          if (!Array.isArray(effectiveRelayUrls) || !effectiveRelayUrls.includes(requestedRelayUrl)) {
+            return res.status(403).json({ error: 'Only the owner UI session can set a custom Relay endpoint' });
+          }
+        }
+      }
       const candidates = await pairingServerCandidates(req, {
         preferredServerUrl: req.body?.serverUrl,
         includeRelay: typeof req.body?.includeRelay === 'boolean' ? req.body.includeRelay : undefined,
@@ -906,8 +929,18 @@ export const registerAuthAndAccessRoutes = (app, dependencies) => {
         if (normalized) candidates.push({ type: 'lan', url: normalized, priority: 10 });
       }
       try {
-        const relayCandidate = await getRelayPairingCandidate({ ensureEnabled: false });
-        if (relayCandidate) candidates.push(relayCandidate);
+        // Multi-relay: a paired device learns EVERY configured endpoint so a
+        // lost/expensive domain can fall back to the other (the client still
+        // keeps its per-connection instance identity — serverId + relayUrl).
+        const relayCandidates = await getRelayPairingCandidates();
+        if (Array.isArray(relayCandidates)) {
+          for (const relayCandidate of relayCandidates) {
+            if (relayCandidate) candidates.push(relayCandidate);
+          }
+        } else {
+          const relayCandidate = await getRelayPairingCandidate({ ensureEnabled: false });
+          if (relayCandidate) candidates.push(relayCandidate);
+        }
       } catch {
         // Relay status failure must not break the direct-candidate refresh.
       }