@platys/relay 0.0.0-stage → 0.8.0-alpha.11

package/out/node/maintenance.js

@@ -0,0 +1,82 @@
+import { mkdirSync, writeFileSync, readFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { loadConnection } from './state.js';
+import { Remote } from './client.js';
+import { receiveArtifact, sha } from './artifacts.js';
+export async function backupProject(state) {
+    const remote = new Remote(loadConnection(state.dir)), snapshot = await remote.call('snapshot');
+    const events = [];
+    let cursor = 0;
+    while (true) {
+        const page = await remote.events(cursor);
+        events.push(...page.events);
+        if (page.events.length)
+            cursor = page.events.at(-1).seq;
+        if (page.events.length < 200)
+            break;
+    }
+    const artifacts = [];
+    for (const artifact of (await remote.call('artifacts')).artifacts) {
+        if (!artifact.sealed)
+            continue;
+        const received = await receiveArtifact(state, artifact.id);
+        artifacts.push({ manifest: artifact, payload: readFileSync(received.file, 'utf8') });
+    }
+    const data = JSON.stringify({ version: 1, at: new Date().toISOString(), projectId: loadConnection(state.dir).projectId, snapshot, events, artifacts, cursor, coverage: 'Point-in-time paginated export; concurrent writes may follow this cursor. No membership tokens or provider credentials.' });
+    const dir = join(state.dir, 'backups');
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const file = join(dir, new Date().toISOString().replace(/[:.]/g, '-') + '.json');
+    writeFileSync(file, data, { mode: 0o600 });
+    writeFileSync(file + '.sha256', sha(data), { mode: 0o600 });
+    return { file, sha256: sha(data), events: events.length, artifacts: artifacts.length, cursor };
+}
+export async function pruneArtifacts(state, sessionId, backupFile, days = 7) {
+    if (!Number.isInteger(days) || days < 1)
+        throw new Error('Retention must be at least one day');
+    const data = readFileSync(backupFile, 'utf8');
+    if (!existsSync(backupFile + '.sha256') || sha(data) !== readFileSync(backupFile + '.sha256', 'utf8'))
+        throw new Error('Backup integrity check failed');
+    const saved = JSON.parse(data), config = loadConnection(state.dir);
+    if (saved.projectId !== config.projectId)
+        throw new Error('Backup belongs to another project');
+    const remote = new Remote(config);
+    const current = await remote.call('snapshot');
+    const referenced = new Set();
+    let cursor = 0;
+    while (true) {
+        const page = await remote.events(cursor);
+        for (const e of page.events) {
+            if (e.artifactId && e.kind !== 'artifact')
+                referenced.add(e.artifactId);
+        }
+        if (page.events.length)
+            cursor = page.events.at(-1).seq;
+        if (page.events.length < 200)
+            break;
+    }
+    if (current.acceptedRevision?.artifactId)
+        referenced.add(current.acceptedRevision.artifactId);
+    const removed = [];
+    for (const item of saved.artifacts) {
+        if (referenced.has(item.manifest.id) || Date.parse(item.manifest.createdAt) > Date.now() - days * 86400000)
+            continue;
+        if (sha(item.payload) !== item.manifest.sha256)
+            throw new Error('Archived artifact is corrupt');
+        await remote.call('artifacts', { operation: 'delete', sessionId, id: item.manifest.id, archivedHash: item.manifest.sha256 });
+        removed.push(item.manifest.id);
+    }
+    const archivedTasks = [];
+    for (const task of saved.snapshot.tasks ?? []) {
+        if (!['complete', 'released'].includes(task.status) || Date.parse(task.updatedAt) > Date.now() - days * 86400000)
+            continue;
+        try {
+            await remote.call('taskarchive', { id: task.id, archivedTask: task });
+            archivedTasks.push(task.id);
+        }
+        catch (error) {
+            if (error.status !== 409)
+                throw error;
+        }
+    }
+    return { removed, archivedTasks, preserved: 'Referenced artifacts, current accepted integration, and recent artifacts. Event history is retained.' };
+}

package/out/node/network-cli.js

@@ -0,0 +1,279 @@
+import { existsSync, readFileSync, writeFileSync, openSync, closeSync, unlinkSync, realpathSync, linkSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { hostname } from 'node:os';
+import { spawn } from 'node:child_process';
+import { loadConnection, saveConnection, State } from './state.js';
+import { api, Remote, serverURL } from './client.js';
+import { Connector } from './connector.js';
+import { nativeDelivery } from './adapters.js';
+import { handleHook } from './hooks.js';
+import { callRelayTool, serveMcp } from './tools.js';
+import { applyNetworkInstall, planNetworkInstall } from './network-install.js';
+import { networkDir, sharedWorkspace } from './network-state.js';
+import { VERSION } from '../core/version.js';
+import { runtimeNode } from './network-runtime.js';
+const alive = (pid) => { try {
+    process.kill(pid, 0);
+    return true;
+}
+catch {
+    return false;
+} };
+function connectorRunning(dir) {
+    try {
+        const lock = JSON.parse(readFileSync(join(dir, 'connector.lock'), 'utf8'));
+        return typeof lock.pid === 'number' && alive(lock.pid);
+    }
+    catch {
+        return false;
+    }
+}
+export async function startNetwork(dir, cli, explicit = false) {
+    const stop = join(dir, 'stop');
+    if (existsSync(stop)) {
+        if (!explicit)
+            return;
+        unlinkSync(stop);
+    }
+    if (connectorRunning(dir)) {
+        const current = JSON.parse(readFileSync(join(dir, 'connector.lock'), 'utf8'));
+        if (current.version === VERSION && current.cli === cli)
+            return;
+        writeFileSync(stop, 'upgrade');
+        for (let i = 0; i < 50 && connectorRunning(dir); i++)
+            await new Promise(r => setTimeout(r, 100));
+        if (connectorRunning(dir))
+            throw new Error('Network connector has not stopped for upgrade; retry after it exits');
+        if (existsSync(stop))
+            unlinkSync(stop);
+    }
+    const fd = openSync(join(dir, 'connector.log'), 'a', 0o600);
+    try {
+        const child = spawn(runtimeNode(cli), [cli, 'run', '--global', '--dir', dir], { cwd: dir, windowsHide: true, detached: true, stdio: ['ignore', fd, fd], env: { ...process.env, RELAY_CREATE_KEY: undefined } });
+        child.on('error', error => console.error(`Relay Network could not start: ${error.message}`));
+        child.unref();
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+export async function runNetwork(dir, cli) {
+    const config = loadConnection(dir);
+    if (config.mode !== 'network')
+        throw new Error('This is not a network connection');
+    const lock = join(dir, 'connector.lock');
+    if (existsSync(lock)) {
+        if (connectorRunning(dir))
+            throw new Error('Relay Network connector is already running');
+        unlinkSync(lock);
+    }
+    // Publish a complete record atomically, while retaining exclusive acquisition.
+    // Opening the public lock with wx first briefly exposed an empty file to other sessions.
+    const pending = join(dir, `connector-${crypto.randomUUID()}.pending`);
+    writeFileSync(pending, JSON.stringify({ pid: process.pid, startedAt: new Date().toISOString(), version: VERSION, cli }), { flag: 'wx', mode: 0o600 });
+    try {
+        linkSync(pending, lock);
+    }
+    finally {
+        unlinkSync(pending);
+    }
+    const state = new State(dir);
+    state.set('mode', 'network');
+    const connector = new Connector(state, new Remote(config), nativeDelivery(dir));
+    try {
+        connector.start();
+        await new Promise(done => {
+            const stop = () => { clearInterval(timer); process.off('SIGINT', stop); process.off('SIGTERM', stop); done(); };
+            const timer = setInterval(() => { if (existsSync(join(dir, 'stop')))
+                stop(); }, 500);
+            process.once('SIGINT', stop);
+            process.once('SIGTERM', stop);
+        });
+    }
+    finally {
+        await connector.stop();
+        state.close();
+        unlinkSync(lock);
+    }
+}
+export function changeSharing(state, workspace, all, share) {
+    const previous = state.get('sharing') ?? { all: false, roots: [] };
+    let policy;
+    if (all)
+        policy = { all: share, roots: [], excluded: [] };
+    else {
+        if (!workspace)
+            throw new Error('Choose --repo PATH or --all-workspaces');
+        const path = realpathSync(workspace);
+        policy = { ...previous, roots: share ? [...new Set([...previous.roots, path])] : previous.roots.filter(r => r !== path), excluded: share ? (previous.excluded ?? []).filter(r => r !== path) : [...new Set([...(previous.excluded ?? []), path])] };
+    }
+    state.set('sharing', policy);
+    for (const binding of state.bindings())
+        if (binding.workspace && !sharedWorkspace(state, binding.workspace))
+            state.bind({ ...binding, state: 'closed', updatedAt: new Date().toISOString() });
+    return policy;
+}
+export async function networkMain(cmd, values, cli) {
+    const option = (name) => typeof values[name] === 'string' ? values[name] : undefined;
+    const dir = resolve(option('dir') ?? networkDir());
+    if (cmd === 'hook') {
+        let data = '';
+        for await (const chunk of process.stdin) {
+            data += chunk;
+            if (data.length > 1_000_000)
+                throw new Error('Hook input too large');
+        }
+        try {
+            const input = JSON.parse(data);
+            const provider = option('provider');
+            if (provider !== 'codex' && provider !== 'claude')
+                throw new Error('Unknown provider');
+            const result = handleHook(String(input.cwd ?? process.cwd()), provider, input, process.env, dir);
+            if (input.hook_event_name === 'SessionStart')
+                try {
+                    await startNetwork(dir, cli);
+                }
+                catch (error) {
+                    console.error(`Relay Network connector unavailable: ${error.message}`);
+                }
+            console.log(JSON.stringify(result));
+        }
+        catch (error) {
+            console.error(`Relay Network hook unavailable: ${error.message}`);
+            console.log('{}');
+        }
+        return;
+    }
+    if (cmd === 'connect') {
+        const provider = option('provider') ?? 'both';
+        if (!['codex', 'claude', 'both'].includes(provider))
+            throw new Error('Provider must be codex, claude or both');
+        const plans = values['no-install'] ? [] : (provider === 'both' ? ['codex', 'claude'] : [provider]).map(p => planNetworkInstall(p, cli, dir, undefined, runtimeNode(cli)));
+        let config;
+        if (existsSync(join(dir, 'connection.json'))) {
+            if (option('invite') || option('server'))
+                throw new Error('A network is already connected. Re-run without --server/--invite to update the installation.');
+            config = loadConnection(dir);
+            if (config.mode !== 'network')
+                throw new Error('Directory belongs to a repository connection');
+        }
+        else {
+            const name = option('name') ?? hostname();
+            let projectId = crypto.randomUUID(), server, identity = 'relay-network';
+            let credentials;
+            if (option('invite')) {
+                const encoded = option('invite');
+                if (!encoded.startsWith('relay:network:v1:'))
+                    throw new Error('Use a Relay Network invitation, not a repository invitation');
+                const invitation = JSON.parse(Buffer.from(encoded.slice('relay:network:v1:'.length), 'base64url').toString('utf8'));
+                server = serverURL(invitation.server);
+                projectId = invitation.projectId;
+                identity = invitation.repository;
+                const joined = await api(server, projectId, '', 'join', { code: invitation.code, name, repository: identity });
+                if (joined.project?.mode !== 'network')
+                    throw new Error('The service does not support this network. Upgrade Relay first.');
+                credentials = { token: joined.token, memberId: joined.memberId };
+            }
+            else {
+                const url = option('server') ?? process.env.RELAY_SERVER_URL;
+                if (!url)
+                    throw new Error('Supply --server HTTPS_URL or --invite CODE');
+                const key = option('create-key') ?? process.env.RELAY_CREATE_KEY;
+                if (!key)
+                    throw new Error('Network creation requires RELAY_CREATE_KEY; friends join using --invite');
+                server = serverURL(url);
+                identity = 'network:' + projectId;
+                credentials = await api(server, projectId, key, 'create', { name: `${name}'s network`.slice(0, 80), ownerName: name, repository: identity, mode: 'network' });
+                const info = await api(server, projectId, credentials.token, 'snapshot');
+                if (info.project.mode !== 'network')
+                    throw new Error('The service does not support networks. Upgrade Relay first.');
+            }
+            config = { ...credentials, server, projectId, repository: identity, name, repo: dir, mode: 'network' };
+            saveConnection(dir, config);
+        }
+        const state = new State(dir);
+        try {
+            state.set('mode', 'network');
+            if (values['all-workspaces'])
+                changeSharing(state, undefined, true, true);
+            else if (option('repo'))
+                changeSharing(state, option('repo'), false, true);
+            else if (!state.get('sharing'))
+                changeSharing(state, undefined, true, true);
+        }
+        finally {
+            state.close();
+        }
+        for (const plan of plans)
+            applyNetworkInstall(plan, dir);
+        if (!values['no-start'])
+            await startNetwork(dir, cli, true);
+        if (!values.quiet)
+            console.log(`Relay Network connected for ${config.name}. Resume your coding clients once and review their MCP/hooks.\nYour agent sessions register automatically. Use relay-next invite --global to add a friend.`);
+        return;
+    }
+    const config = loadConnection(dir);
+    if (config.mode !== 'network')
+        throw new Error('This is not a network connection');
+    if (cmd === 'run') {
+        if (existsSync(join(dir, 'stop')))
+            unlinkSync(join(dir, 'stop'));
+        await runNetwork(dir, cli);
+        return;
+    }
+    if (cmd === 'stop') {
+        writeFileSync(join(dir, 'stop'), 'stop');
+        console.log('Relay Network stopped until connect --global or run --global resumes it.');
+        return;
+    }
+    if (cmd === 'budget-refresh') {
+        console.log(JSON.stringify(await new Remote(config).refreshBudget(), null, 2));
+        return;
+    }
+    if (cmd === 'invite') {
+        const invitation = await new Remote(config).call('invite', {});
+        const code = 'relay:network:v1:' + Buffer.from(JSON.stringify({ server: config.server, projectId: config.projectId, repository: config.repository, code: invitation.code })).toString('base64url');
+        console.log(`Single-use network invitation; expires ${new Date(invitation.expiresAt).toISOString()}:\n${code}\n\nFriend: relay setup --invite ${code}`);
+        return;
+    }
+    if (cmd === 'members') {
+        console.log(JSON.stringify((await new Remote(config).call('snapshot')).members, null, 2));
+        return;
+    }
+    if (cmd === 'revoke') {
+        if (!option('member'))
+            throw new Error('Supply --member ID');
+        console.log(JSON.stringify(await new Remote(config).call('revoke', { memberId: option('member') })));
+        return;
+    }
+    const state = new State(dir);
+    state.set('mode', 'network');
+    try {
+        if (cmd === 'share' || cmd === 'unshare') {
+            console.log(JSON.stringify(changeSharing(state, option('repo'), values['all-workspaces'] === true, cmd === 'share'), null, 2));
+            await startNetwork(dir, cli);
+            return;
+        }
+        if (cmd === 'mcp') {
+            await startNetwork(dir, cli);
+            await serveMcp(state);
+            return;
+        }
+        if (cmd === 'doctor' || cmd === 'status') {
+            console.log(JSON.stringify({ mode: 'network', name: config.name, connectorRunning: connectorRunning(dir), paused: existsSync(join(dir, 'stop')), sharing: state.get('sharing'), localSessions: state.bindings().map(b => ({ id: b.id, provider: b.provider, state: b.state, task: b.task })), lastSync: state.get('lastSync') ?? null, syncError: state.get('syncError') ?? null, snapshot: state.get('snapshot') ?? null, pendingUploads: state.pending().length }, null, 2));
+            return;
+        }
+        const sessionId = option('session') ?? option('from');
+        if (!sessionId)
+            throw new Error('Supply --session ID from relay-next status --global');
+        const tool = { discover: 'relay_discover', context: 'relay_context', ask: 'relay_ask', reply: 'relay_reply', presence: 'relay_presence' }[cmd];
+        if (!tool)
+            throw new Error('Unknown network command; use connect, invite, members, revoke, share, unshare, status, doctor, run, stop, discover, context, ask, reply or presence');
+        const args = { ...(option('args') ? JSON.parse(option('args')) : {}), session_id: sessionId, ...(cmd === 'discover' ? { ...(option('name') ? { person: option('name') } : {}), ...(option('query') ? { topic: option('query') } : {}) } : {}), ...(cmd === 'context' && option('query') ? { query: option('query') } : {}), ...(cmd === 'ask' ? { target_session_id: option('to'), question: option('message') } : {}), ...(cmd === 'presence' && option('message') ? { task: option('message') } : {}), ...(cmd === 'reply' ? { question_id: option('id'), answer: option('message') } : {}) };
+        console.log(JSON.stringify(await callRelayTool(state, tool, { ...args, session_key: state.binding(sessionId).sessionKey }), null, 2));
+        await startNetwork(dir, cli);
+    }
+    finally {
+        state.close();
+    }
+}

package/out/node/network-install.js

@@ -0,0 +1,56 @@
+import { existsSync, lstatSync, readFileSync } from 'node:fs';
+import { join, dirname, resolve } from 'node:path';
+import { homedir } from 'node:os';
+import { quote, writeConfig } from './install.js';
+export function planNetworkInstall(provider, cli, dir, home = homedir(), node = process.execPath, codexHome = process.env.CODEX_HOME ?? join(home, '.codex'), claudeHome = process.env.CLAUDE_CONFIG_DIR ?? join(home, '.claude')) {
+    const hookPath = provider === 'codex' ? join(codexHome, 'hooks.json') : join(claudeHome, 'settings.json');
+    const customClaude = !!process.env.CLAUDE_CONFIG_DIR || resolve(claudeHome) !== resolve(join(home, '.claude'));
+    const mcpPath = provider === 'codex' ? join(codexHome, 'config.toml') : join(customClaude ? claudeHome : home, '.claude.json');
+    for (const target of [home, codexHome, claudeHome, dir, join(dir, 'config-backups'), hookPath, mcpPath]) {
+        let current = target;
+        while (true) {
+            if (existsSync(current) && lstatSync(current).isSymbolicLink())
+                throw new Error(`Relay will not install through a symlink: ${current}`);
+            const parent = dirname(current);
+            if (parent === current)
+                break;
+            current = parent;
+        }
+    }
+    const config = existsSync(hookPath) ? JSON.parse(readFileSync(hookPath, 'utf8')) : {};
+    config.hooks ??= {};
+    const command = `${quote(node)} ${quote(cli)} hook --global --dir ${quote(dir)} --provider ${provider} --relay-network-hook-v1`;
+    for (const event of ['SessionStart', 'UserPromptSubmit', 'PreToolUse', 'PostToolUse', 'PermissionRequest', 'Stop', 'SessionEnd']) {
+        config.hooks[event] = (config.hooks[event] ?? []).map((group) => ({ ...group, hooks: (group.hooks ?? []).filter((hook) => !hook.command?.includes('--relay-network-hook-v1')) })).filter((group) => group.hooks.length);
+        config.hooks[event].push({ hooks: [{ type: 'command', command, timeout: event === 'SessionEnd' ? 3 : 10 }] });
+    }
+    let mcpText;
+    if (provider === 'codex') {
+        const old = existsSync(mcpPath) ? readFileSync(mcpPath, 'utf8') : '';
+        const clean = old.replace(/\n?# BEGIN RELAY NETWORK[\s\S]*?# END RELAY NETWORK\n?/g, '');
+        if (/^\s*\[mcp_servers\.(?:relay_network|"relay_network"|'relay_network')(?:\.|\])/m.test(clean))
+            throw new Error('Existing relay_network MCP entry needs review');
+        mcpText = clean.trimEnd() + `\n\n# BEGIN RELAY NETWORK\n[mcp_servers.relay_network]\ncommand = ${JSON.stringify(node)}\nargs = ${JSON.stringify([cli, 'mcp', '--global', '--dir', dir])}\n# END RELAY NETWORK\n`;
+    }
+    else {
+        const mcp = existsSync(mcpPath) ? JSON.parse(readFileSync(mcpPath, 'utf8')) : {};
+        mcp.mcpServers ??= {};
+        const previous = mcp.mcpServers.relay_network;
+        if (previous && !(previous.args?.includes('--global') && previous.args?.includes('mcp') && previous.args?.some((arg) => typeof arg === 'string' && arg.replaceAll('\\', '/').endsWith('/out/node/cli.js'))))
+            throw new Error('Existing relay_network MCP entry needs review');
+        mcp.mcpServers.relay_network = { type: 'stdio', command: node, args: [cli, 'mcp', '--global', '--dir', dir] };
+        mcpText = JSON.stringify(mcp, null, 2) + '\n';
+    }
+    return { provider, updates: [{ path: hookPath, text: JSON.stringify(config, null, 2) + '\n' }, { path: mcpPath, text: mcpText }] };
+}
+export function applyNetworkInstall(plan, dir) {
+    for (const update of plan.updates) {
+        if (existsSync(update.path) && readFileSync(update.path, 'utf8') === update.text)
+            continue;
+        writeConfig(update.path, update.text, join(dir, 'config-backups'));
+    }
+    return { provider: plan.provider, files: plan.updates.map(update => update.path), next: 'Resume the coding client and review its Relay Network MCP/hook trust prompts.' };
+}
+export function installNetwork(...args) {
+    return applyNetworkInstall(planNetworkInstall(...args), args[2]);
+}

package/out/node/network-runtime.js

@@ -0,0 +1,90 @@
+import { createHash } from 'node:crypto';
+import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, writeFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname, join, resolve } from 'node:path';
+export function assertRealPath(path) {
+    let current = resolve(path);
+    while (true) {
+        if (existsSync(current) && lstatSync(current).isSymbolicLink())
+            throw new Error(`Relay will not install through a symlink: ${current}`);
+        const parent = dirname(current);
+        if (parent === current)
+            return;
+        current = parent;
+    }
+}
+export function runtimeNode(cli) {
+    const bundled = resolve(dirname(cli), '../../engine', process.platform === 'win32' ? 'node.exe' : 'node');
+    return existsSync(bundled) ? bundled : process.execPath;
+}
+// Keep the installed MCP independent of npx caches, extracted tarballs, and checkouts.
+// Desktop bundles carry Node too; npm installs reuse the user's installed runtime.
+export function installRuntime(cli, dir) {
+    const source = resolve(dirname(cli), '../..');
+    const pkg = JSON.parse(readFileSync(join(source, 'package.json'), 'utf8'));
+    if (!['@platys/relay', '@relay-workspace/cli'].includes(pkg.name) || !/^\d+\.\d+\.\d+[a-zA-Z0-9.+-]*$/.test(pkg.version))
+        throw new Error('Not a Relay package');
+    const files = new Map();
+    const collect = (folder, target) => {
+        for (const item of readdirSync(folder, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+            const path = join(folder, item.name), relative = target + '/' + item.name;
+            if (item.isSymbolicLink())
+                throw new Error('Relay runtime contains a symlink');
+            if (item.isDirectory())
+                collect(path, relative);
+            else if (item.isFile())
+                files.set(relative, readFileSync(path));
+        }
+    };
+    collect(join(source, 'out', 'core'), 'out/core');
+    collect(join(source, 'out', 'node'), 'out/node');
+    const bundledNode = join(source, 'engine', process.platform === 'win32' ? 'node.exe' : 'node');
+    if (existsSync(bundledNode))
+        collect(join(source, 'engine'), 'engine');
+    // Resolve each runtime dependency from the package being installed, including transitive deps.
+    const dependencies = new Map();
+    const collectDependencies = (manifest, from) => {
+        for (const name of Object.keys(manifest.dependencies ?? {}).sort()) {
+            const path = createRequire(join(from, 'package.json')).resolve(name + '/package.json');
+            const dependency = JSON.parse(readFileSync(path, 'utf8'));
+            if (dependencies.has(name)) {
+                if (dependencies.get(name) !== dependency.version)
+                    throw new Error('Relay runtime needs nested dependency packaging: ' + name);
+                continue;
+            }
+            dependencies.set(name, dependency.version);
+            collect(dirname(path), 'node_modules/' + name);
+            collectDependencies(dependency, dirname(path));
+        }
+    };
+    collectDependencies(pkg, source);
+    files.set('package.json', Buffer.from(JSON.stringify({ name: pkg.name, version: pkg.version, type: 'module', private: true, dependencies: pkg.dependencies })));
+    const hash = createHash('sha256');
+    for (const [name, data] of [...files].sort(([a], [b]) => a.localeCompare(b)))
+        hash.update(name + '\0' + data.length + '\0').update(data);
+    const base = join(resolve(dir), 'runtime'), target = join(base, pkg.version + '-' + hash.digest('hex'));
+    assertRealPath(target);
+    const verify = () => { for (const [name, data] of files) {
+        const path = join(target, name);
+        assertRealPath(path);
+        if (!existsSync(path) || !readFileSync(path).equals(data))
+            throw new Error('Installed Relay runtime is incomplete or changed; remove its version directory and run setup again');
+    } };
+    if (existsSync(target)) {
+        verify();
+        return join(target, 'out', 'node', 'cli.js');
+    }
+    mkdirSync(base, { recursive: true, mode: 0o700 });
+    const stage = join(base, '.install-' + crypto.randomUUID());
+    mkdirSync(stage, { mode: 0o700 });
+    for (const [name, data] of files) {
+        const path = join(stage, name);
+        mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+        writeFileSync(path, data, { mode: 0o600 });
+    }
+    if (process.platform !== 'win32' && files.has('engine/node'))
+        chmodSync(join(stage, 'engine', 'node'), 0o700);
+    renameSync(stage, target);
+    verify();
+    return join(target, 'out', 'node', 'cli.js');
+}

package/out/node/network-setup.js

@@ -0,0 +1,121 @@
+import { existsSync, realpathSync, statSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { homedir, userInfo } from 'node:os';
+import { createInterface } from 'node:readline/promises';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { networkDir } from './network-state.js';
+import { networkMain } from './network-cli.js';
+import { planNetworkInstall } from './network-install.js';
+import { assertRealPath, installRuntime, runtimeNode } from './network-runtime.js';
+import { loadConnection } from './state.js';
+import { serverURL } from './client.js';
+import { VERSION } from '../core/version.js';
+export function detectClients(home = homedir(), env = process.env, platform = process.platform) {
+    const onPath = (name) => (env.PATH ?? env.Path ?? '').split(platform === 'win32' ? ';' : ':').filter(Boolean).some(folder => (platform === 'win32' ? ['.exe', '.cmd', '.bat', ''] : ['']).some(ext => {
+        try {
+            return statSync(join(folder.replace(/^"|"$/g, ''), name + ext)).isFile();
+        }
+        catch {
+            return false;
+        }
+    }));
+    return ['codex', 'claude'].filter(provider => existsSync(provider === 'codex' ? (env.CODEX_HOME ?? join(home, '.codex')) : (env.CLAUDE_CONFIG_DIR ?? join(home, '.claude'))) ||
+        (provider === 'claude' && !env.CLAUDE_CONFIG_DIR && existsSync(join(home, '.claude.json'))) || onPath(provider));
+}
+export function parseNetworkInvitation(value) {
+    try {
+        if (!/^relay:network:v1:[A-Za-z0-9_-]{1,12000}$/.test(value))
+            throw new Error();
+        const parsed = JSON.parse(Buffer.from(value.slice('relay:network:v1:'.length), 'base64url').toString('utf8'));
+        if (typeof parsed.server !== 'string' || parsed.server.length > 2048 || typeof parsed.projectId !== 'string' || !/^[A-Za-z0-9_-]{1,100}$/.test(parsed.projectId) ||
+            typeof parsed.repository !== 'string' || !parsed.repository.length || parsed.repository.length > 500 || typeof parsed.code !== 'string' || !parsed.code.length || parsed.code.length > 512)
+            throw new Error();
+        return { server: serverURL(parsed.server), projectId: parsed.projectId, repository: parsed.repository, code: parsed.code };
+    }
+    catch {
+        throw new Error('That invitation is not valid. Paste the complete Relay Network invitation from your friend.');
+    }
+}
+export async function setupNetwork(values, cli, io) {
+    let reader;
+    const ui = io ?? { interactive: !!process.stdin.isTTY && !!process.stdout.isTTY, log: console.log,
+        ask: async (question, fallback) => {
+            reader ??= createInterface({ input: process.stdin, output: process.stdout });
+            return (await reader.question(`${question}${fallback ? ` [${fallback}]` : ''}: `)).trim() || fallback || '';
+        } };
+    try {
+        const settings = { ...values }, option = (name) => typeof settings[name] === 'string' ? settings[name] : undefined;
+        const dir = resolve(option('dir') ?? networkDir());
+        assertRealPath(dir);
+        const existing = existsSync(join(dir, 'connection.json')) ? loadConnection(dir) : undefined;
+        if (existing && existing.mode !== 'network')
+            throw new Error('This directory belongs to a repository connection. Choose a different --dir.');
+        if (settings['no-install'])
+            throw new Error('Setup installs your client integration. For a transport-only connection, use connect --global --no-install.');
+        if (option('repo') && settings['all-workspaces'])
+            throw new Error('Choose --repo PATH or --all-workspaces, not both.');
+        let providers;
+        const requested = option('provider') ?? 'auto';
+        if (!['auto', 'codex', 'claude', 'both'].includes(requested))
+            throw new Error('Choose --provider auto, codex, claude or both.');
+        providers = requested === 'auto' ? detectClients() : requested === 'both' ? ['codex', 'claude'] : [requested];
+        if (!providers.length && ui.interactive) {
+            const choice = (await ui.ask('Which coding client do you use? codex, claude, or both')).toLowerCase();
+            if (!['codex', 'claude', 'both'].includes(choice))
+                throw new Error('Run setup again with --provider codex, claude or both.');
+            providers = choice === 'both' ? ['codex', 'claude'] : [choice];
+        }
+        if (!providers.length)
+            throw new Error('No coding client detected. Install Codex or Claude Code, or specify --provider codex, claude or both.');
+        settings.provider = providers.length === 2 ? 'both' : providers[0];
+        ui.log(`Relay setup\nClients: ${providers.map(p => p === 'codex' ? 'Codex' : 'Claude Code').join(' + ')}`);
+        if (existing) {
+            if (option('invite')) {
+                const invite = parseNetworkInvitation(option('invite'));
+                if (invite.server !== serverURL(existing.server) || invite.projectId !== existing.projectId || invite.repository !== existing.repository)
+                    throw new Error('Already connected to a different network. Setup will not replace it.');
+                delete settings.invite; // Retrying setup never consumes the single-use invitation again.
+            }
+            if (option('server') && serverURL(option('server')) !== serverURL(existing.server))
+                throw new Error('Already connected to a different service.');
+            delete settings.server;
+            ui.log(`Updating the installation for ${existing.name}; keeping your connection and sharing settings.`);
+        }
+        else {
+            if (!option('invite') && !option('server') && !process.env.RELAY_SERVER_URL) {
+                if (!ui.interactive)
+                    throw new Error('Run relay setup in a terminal to paste an invitation, or supply --invite CODE.');
+                settings.invite = await ui.ask('Paste your friend\'s Relay invitation');
+            }
+            if (option('invite'))
+                parseNetworkInvitation(option('invite'));
+            else if (!(option('create-key') ?? process.env.RELAY_CREATE_KEY))
+                throw new Error('To join, use your friend\'s invitation. Creating a network requires an operator key.');
+            if (!option('name'))
+                settings.name = ui.interactive ? await ui.ask('Your display name', userInfo().username) : userInfo().username;
+            if (!option('name')?.trim() || option('name').length > 80)
+                throw new Error('Choose a display name between 1 and 80 characters.');
+        }
+        if (option('repo'))
+            settings.repo = realpathSync(option('repo'));
+        // Preflight all clients before consuming an invitation or modifying any client config.
+        for (const provider of providers)
+            planNetworkInstall(provider, cli, dir);
+        const installed = installRuntime(cli, dir);
+        const node = runtimeNode(installed);
+        for (const provider of providers)
+            planNetworkInstall(provider, installed, dir, undefined, node);
+        const probe = await promisify(execFile)(node, [installed, '--version'], { windowsHide: true, timeout: 10000 });
+        if (probe.stdout.trim() !== VERSION)
+            throw new Error('The installed Relay runtime did not pass its startup check.');
+        await networkMain('connect', { ...settings, dir, quiet: true }, installed);
+        ui.log(`\nRelay is configured for ${providers.map(p => p === 'codex' ? 'Codex' : 'Claude Code').join(' + ')}.\nOpen or resume your coding client once and accept its Relay trust prompt if shown.\nThen say: "Find my friend\'s agent on Relay."\n\nNo per-project setup or separate terminal is needed. Incoming delivery is confirmed only after the receiving agent acknowledges it.`);
+        if (settings['no-start'])
+            ui.log('Background receiver startup was skipped (--no-start).');
+        return { dir, cli: installed, providers };
+    }
+    finally {
+        reader?.close();
+    }
+}