codex-relay 1.4.5 → 1.4.6

package/dist/paths.js

@@ -92,6 +92,7 @@ function createQueryableDatabase(executor) {
 }
 //#endregion
 //#region src/pairing-store.ts
+const permanentClientSessionExpiresAt = Date.parse("9999-12-31T23:59:59.999Z");
 async function createTursoPairingSessionStore(path) {
 	if (path !== ":memory:") await mkdir(dirname(path), { recursive: true });
 	const db = await connect(path);
@@ -134,8 +135,8 @@ async function createTursoPairingSessionStore(path) {
     );
   `);
 	await ensurePairingSessionColumns();
-	async function countActive(now) {
-		const row = await db.prepare("SELECT COUNT(DISTINCT COALESCE(client_session_id, token_hash)) AS count FROM pairing_sessions WHERE expires_at > ?").get(now);
+	async function countActive() {
+		const row = await db.prepare("SELECT COUNT(DISTINCT COALESCE(client_session_id, token_hash)) AS count FROM pairing_sessions").get();
 		return Number(row?.count ?? 0);
 	}
 	async function deleteSession(tokenHash) {
@@ -238,8 +239,8 @@ async function createTursoPairingSessionStore(path) {
              created_at,
              updated_at
            )
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(tokenHash, session.clientSessionId ?? null, session.clientName ?? null, session.expiresAt, secure?.keyEpoch ?? null, secure?.mobileToServerKey ?? null, secure?.serverToMobileKey ?? null, secure?.lastMobileCounter ?? null, secure?.nextServerCounter ?? null, now, now);
-			return countActive(now);
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(tokenHash, session.clientSessionId ?? null, session.clientName ?? null, session.expiresAt ?? permanentClientSessionExpiresAt, secure?.keyEpoch ?? null, secure?.mobileToServerKey ?? null, secure?.serverToMobileKey ?? null, secure?.lastMobileCounter ?? null, secure?.nextServerCounter ?? null, now, now);
+			return countActive();
 		},
 		deleteSession,
 		deletePendingPairing,
@@ -254,7 +255,7 @@ async function createTursoPairingSessionStore(path) {
            WHERE client_session_id = ?`).get(clientSessionId);
 			return row ? pushNotificationSubscriptionFromRow(row) : void 0;
 		},
-		async getValidSession(tokenHash, now) {
+		async getValidSession(tokenHash) {
 			const row = await db.prepare(`SELECT client_name AS clientName,
                   client_session_id AS clientSessionId,
                   expires_at AS expiresAt,
@@ -266,19 +267,14 @@ async function createTursoPairingSessionStore(path) {
            FROM pairing_sessions
            WHERE token_hash = ?`).get(tokenHash);
 			if (!row) return;
-			const expiresAt = Number(row.expiresAt);
-			if (now > expiresAt) {
-				await deleteSession(tokenHash);
-				return;
-			}
 			return {
 				clientSessionId: typeof row.clientSessionId === "string" ? row.clientSessionId : void 0,
 				clientName: typeof row.clientName === "string" ? row.clientName : void 0,
-				expiresAt,
+				expiresAt: Number(row.expiresAt),
 				secureSession: decodeSecureSession(row)
 			};
 		},
-		async listActivePushNotificationSubscriptions(now) {
+		async listActivePushNotificationSubscriptions() {
 			return resultRows(await db.prepare(`SELECT subscriptions.client_session_id AS clientSessionId,
                   subscriptions.expo_push_token AS expoPushToken,
                   subscriptions.platform,
@@ -287,14 +283,12 @@ async function createTursoPairingSessionStore(path) {
            FROM push_notification_subscriptions AS subscriptions
            INNER JOIN pairing_sessions AS sessions
              ON sessions.client_session_id = subscriptions.client_session_id
-           WHERE sessions.expires_at > ?
-           GROUP BY subscriptions.client_session_id`).all(now)).flatMap((row) => {
+           GROUP BY subscriptions.client_session_id`).all()).flatMap((row) => {
 				const subscription = pushNotificationSubscriptionFromRow(row);
 				return subscription ? [subscription] : [];
 			});
 		},
-		async pruneExpired(now) {
-			await db.prepare("DELETE FROM pairing_sessions WHERE expires_at <= ?").run(now);
+		async pruneExpiredPendingPairings(now) {
 			await db.prepare("DELETE FROM pending_pairings WHERE expires_at <= ?").run(now);
 			await db.prepare(`DELETE FROM push_notification_subscriptions
            WHERE NOT EXISTS (
@@ -325,9 +319,9 @@ async function createTursoPairingSessionStore(path) {
                created_at,
                updated_at
              )
-             VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(newTokenHash, session.clientSessionId ?? null, session.clientName ?? null, session.expiresAt, secure?.keyEpoch ?? null, secure?.mobileToServerKey ?? null, secure?.serverToMobileKey ?? null, secure?.lastMobileCounter ?? null, secure?.nextServerCounter ?? null, now, now);
+             VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(newTokenHash, session.clientSessionId ?? null, session.clientName ?? null, session.expiresAt ?? permanentClientSessionExpiresAt, secure?.keyEpoch ?? null, secure?.mobileToServerKey ?? null, secure?.serverToMobileKey ?? null, secure?.lastMobileCounter ?? null, secure?.nextServerCounter ?? null, now, now);
 			})();
-			return countActive(now);
+			return countActive();
 		},
 		async updateSecureSession(tokenHash, secureSession) {
 			const secure = encodeSecureSession(secureSession);
@@ -601,4 +595,4 @@ function defaultCodexRelayHome() {
 	}
 }
 //#endregion
-export { getConnectUrlCandidates as a, createPairingQrPayload as i, codexRelayHome as n, getConnectUrlGuidance as o, legacyCodexRelayDataPath as r, createTursoPairingSessionStore as s, codexRelayDataPath as t };
+export { getConnectUrlCandidates as a, permanentClientSessionExpiresAt as c, createPairingQrPayload as i, codexRelayHome as n, getConnectUrlGuidance as o, legacyCodexRelayDataPath as r, createTursoPairingSessionStore as s, codexRelayDataPath as t };

package/dist/src.js

@@ -1,5 +1,5 @@
 import { $ as ResolveApprovalResponseSchema, A as PairRequestSchema, At as WorkspaceChangesResponseSchema, Bt as WorkspaceTailscaleServeResponseSchema, C as ListModelsResponseSchema, Ct as UpdateRuntimePreferencesRequestSchema, D as ListWorkspaceDirectoriesResponseSchema, E as ListThreadsResponseSchema, Et as VersionResponseSchema, Gt as WorkspaceTerminalSessionResponseSchema, H as PushNotificationSettingsResponseSchema, J as ReasoningEffortSchema, Jt as chatMessageDetailsFromPromptContext, Kt as WorkspaceTerminalStartRequestSchema, Mt as WorkspaceFileContentResponseSchema, O as ListWorkspaceFilesResponseSchema, Pt as WorkspaceGitActionResponseSchema, Q as ResolveApprovalRequestSchema, Qt as promptMarkdownWithSkills, S as KnownReasoningEffortSchema, St as ThreadSummarySchema, T as ListSkillsResponseSchema, Tt as UpdateWorkspaceFileContentRequestSchema, U as QueuedThreadInputActionResponseSchema, Ut as WorkspaceTerminalOutputResponseSchema, Vt as WorkspaceTerminalInputRequestSchema, Wt as WorkspaceTerminalResizeRequestSchema, X as RenameThreadRequestSchema, Y as RegisterPushNotificationRequestSchema, Yt as createOpenApiDocument, Z as RenameThreadResponseSchema, Zt as normalizePromptContext, _ as EncryptedPayloadSchema, _t as ThreadGoalStatusSchema, a as ArchiveThreadResponseSchema, at as RuntimePreferencesResponseSchema, b as InterruptThreadRunResponseSchema, ct as StatusResponseSchema, d as CheckoutWorkspaceBranchRequestSchema, dt as SubmitThreadInputResponseSchema, et as RewindThreadRequestSchema, gt as ThreadGoalSchema, h as CreateThreadRequestSchema, ht as ThreadGoalResponseSchema, j as PairResponseSchema, l as ChatMessageSchema, lt as StreamThreadRunEventSchema, m as ContextWindowUsageSchema, mt as ThreadDetailResponseSchema, ot as RuntimePreferencesSchema, p as CommitPushWorkspaceRequestSchema, pt as ThreadContextWindowResponseSchema, q as RateLimitsResponseSchema, qt as apiPaths, rn as stripPromptSkillMentions, tt as RunThreadRequestSchema, ut as StreamThreadRunRequestSchema, vt as ThreadMessageDetailFieldSchema, w as ListQueuedThreadInputsResponseSchema, wt as UpdateThreadGoalRequestSchema, y as ImageAttachmentUploadResponseSchema, yt as ThreadMessageDetailResponseSchema, zt as WorkspaceTailscaleServeRequestSchema } from "./api-schema2.js";
-import { a as getConnectUrlCandidates, i as createPairingQrPayload, o as getConnectUrlGuidance, r as legacyCodexRelayDataPath, s as createTursoPairingSessionStore, t as codexRelayDataPath } from "./paths.js";
+import { a as getConnectUrlCandidates, c as permanentClientSessionExpiresAt, i as createPairingQrPayload, o as getConnectUrlGuidance, r as legacyCodexRelayDataPath, s as createTursoPairingSessionStore, t as codexRelayDataPath } from "./paths.js";
 import { createRequire } from "node:module";
 import qrcode from "qrcode-terminal";
 import { execFile, spawn } from "node:child_process";
@@ -872,7 +872,7 @@ function createExpoPushNotificationSender(fetchImpl = fetch) {
 }
 function createPushNotificationDispatcher(input) {
 	return { async dispatch(event) {
-		const subscriptions = await input.sessions.listActivePushNotificationSubscriptions(Date.now());
+		const subscriptions = await input.sessions.listActivePushNotificationSubscriptions();
 		const selectedTokens = new Set(subscriptions.filter((subscription) => notificationEnabled(subscription, event.intent)).map((subscription) => subscription.expoPushToken));
 		if (selectedTokens.size === 0) return;
 		const delivery = await input.sender.send([...selectedTokens].map((expoPushToken) => notificationForEvent(expoPushToken, event)));
@@ -1536,7 +1536,7 @@ function createApp(options = {}) {
 		}
 		const token = parseBearerToken(c.req.header("authorization"));
 		const tokenHash = token ? options.pairing.hashClientToken(token) : void 0;
-		const validSession = tokenHash ? await options.pairing.sessions.getValidSession(tokenHash, Date.now()) : void 0;
+		const validSession = tokenHash ? await options.pairing.sessions.getValidSession(tokenHash) : void 0;
 		if (!tokenHash || !validSession) return c.json(apiError("unauthorized", "Pair this device with the Codex Relay server."), 401);
 		if (options.pairing.serverIdentity && !secureSessionsByTokenHash.has(tokenHash)) if (validSession.secureSession) secureSessionsByTokenHash.set(tokenHash, validSession.secureSession);
 		else return c.json(apiError("secure_session_required", "Secure session expired. Pair this device again."), 401);
@@ -1557,7 +1557,7 @@ function createApp(options = {}) {
 		const parsed = await parsePlainJson(c.req.raw, PairRequestSchema);
 		if (!parsed.success) return c.json(validationError(parsed.error), 400);
 		if (!parsed.data.secure || !options.pairing.serverIdentity) return c.json(apiError("secure_pairing_required", "Pairing requires the secure QR approval flow."), 400);
-		await options.pairing.sessions.pruneExpired(Date.now());
+		await options.pairing.sessions.pruneExpiredPendingPairings(Date.now());
 		const approvalCode = await createApprovalCode(options.pairing.sessions);
 		const expiresAt = Date.now() + (options.pairing.approvalTtlMs ?? 300 * 1e3);
 		const requestOrigin = externalRequestOrigin(c.req.url, (name) => c.req.header(name));
@@ -1595,11 +1595,10 @@ function createApp(options = {}) {
 			approvalCode,
 			approvalExpiresAt: new Date(pending.expiresAt).toISOString()
 		}), 202);
-		await options.pairing.sessions.pruneExpired(Date.now());
+		await options.pairing.sessions.pruneExpiredPendingPairings(Date.now());
 		const clientToken = options.pairing.createClientToken();
-		const expiresAt = Date.now() + options.pairing.tokenTtlMs;
 		const tokenHash = options.pairing.hashClientToken(clientToken);
-		const clientTokenExpiresAt = new Date(expiresAt).toISOString();
+		const clientTokenExpiresAt = new Date(permanentClientSessionExpiresAt).toISOString();
 		const pairing = createSecurePairing({
 			approvalCode,
 			clientEphemeralPublicKey: pending.clientEphemeralPublicKey,
@@ -1613,7 +1612,6 @@ function createApp(options = {}) {
 		const tokenCount = await options.pairing.sessions.createSession(tokenHash, {
 			clientSessionId: pending.clientSessionId,
 			clientName: pending.clientName,
-			expiresAt,
 			secureSession: pairing.session
 		});
 		await options.pairing.sessions.deletePendingPairing(approvalCode);
@@ -1656,14 +1654,12 @@ function createApp(options = {}) {
 		const oldSession = oldToken ? await getValidClientSession(options.pairing, oldToken) : void 0;
 		if (!oldToken || !oldSession) return c.json(apiError("unauthorized", "Pair this device with the Codex Relay server."), 401);
 		const clientToken = options.pairing.createClientToken();
-		const expiresAt = Date.now() + options.pairing.tokenTtlMs;
 		const oldTokenHash = options.pairing.hashClientToken(oldToken);
 		const newTokenHash = options.pairing.hashClientToken(clientToken);
 		const clientSessionId = normalizeClientSessionId(c.req.header("x-codex-relay-client-session-id")) ?? oldSession.clientSessionId;
 		const tokenCount = await options.pairing.sessions.rotateSession(oldTokenHash, newTokenHash, {
 			clientSessionId,
 			clientName: oldSession.clientName,
-			expiresAt,
 			secureSession: secureSessionsByTokenHash.get(oldTokenHash) ?? oldSession.secureSession
 		});
 		const secureSession = secureSessionsByTokenHash.get(oldTokenHash) ?? oldSession.secureSession;
@@ -1674,7 +1670,7 @@ function createApp(options = {}) {
 		});
 		const response = PairResponseSchema.parse({
 			clientToken,
-			clientTokenExpiresAt: new Date(expiresAt).toISOString()
+			clientTokenExpiresAt: new Date(permanentClientSessionExpiresAt).toISOString()
 		});
 		const jsonResponse = await secureJson(c, options.pairing, secureSessionsByTokenHash, response, 201);
 		if (secureSession) {
@@ -2855,7 +2851,7 @@ async function pairedClientSessionIdForAuthorization(authorization, pairing) {
 	if (!pairing) return;
 	const token = parseBearerToken(authorization);
 	if (!token) return;
-	return (await pairing.sessions.getValidSession(pairing.hashClientToken(token), Date.now()))?.clientSessionId;
+	return (await pairing.sessions.getValidSession(pairing.hashClientToken(token)))?.clientSessionId;
 }
 function defaultPushNotificationPreferences() {
 	return {
@@ -2897,7 +2893,7 @@ async function createApprovalCode(sessions) {
 	throw new Error("Unable to allocate a pairing approval code.");
 }
 async function getValidClientSession(pairing, token) {
-	return pairing.sessions.getValidSession(pairing.hashClientToken(token), Date.now());
+	return pairing.sessions.getValidSession(pairing.hashClientToken(token));
 }
 function externalRequestOrigin(requestUrl, header) {
 	const request = new URL(requestUrl);
@@ -6970,7 +6966,6 @@ function errorMessage(error) {
 //#region src/index.ts
 const port = Number(process.env.PORT ?? 8787);
 const hostname$1 = process.env.HOST ?? "0.0.0.0";
-const clientTokenTtlMs = 10080 * 60 * 1e3;
 const dangerouslyAutoApprove = process.env.CODEX_RELAY_DANGEROUSLY_AUTO_APPROVE === "1";
 const serverIdentity = await getServerIdentity();
 const approvalSecret = await getApprovalSecret();
@@ -7018,7 +7013,6 @@ serve({
 			createClientToken: () => randomBytes(32).toString("base64url"),
 			hashClientToken,
 			sessions: sessionStore,
-			tokenTtlMs: clientTokenTtlMs,
 			onPaired: ({ clientName, tokenCount }) => {
 				logRuntimeEvent("Paired", `Mobile client connected${clientName ? ` from ${clientName}` : ""}; ${formatClientCount(tokenCount)} active.`);
 			},

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-relay",
-  "version": "1.4.5",
+  "version": "1.4.6",
   "description": "Local Codex Relay CLI bridge for the Codex Relay mobile app.",
   "license": "Apache-2.0",
   "repository": {