orionfold-relay 0.15.1 → 0.15.3

package/dist/cli.js

@@ -27,18 +27,37 @@ var __copyProps = (to, from, except, desc16) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/lib/utils/app-root.ts
-import { existsSync as existsSync2 } from "fs";
-import { join as join2 } from "path";
+import { existsSync as existsSync2, readFileSync } from "fs";
+import { join as join2, dirname as dirname2 } from "path";
 function getAppRoot(metaDirname, depth) {
   if (metaDirname) {
     const candidate = join2(metaDirname, ...Array(depth).fill(".."));
-    if (existsSync2(join2(candidate, "package.json"))) return candidate;
+    if (isPackageRoot(candidate)) return candidate;
+    let dir = metaDirname;
+    while (true) {
+      if (isPackageRoot(dir)) return dir;
+      const parent = dirname2(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
   }
   return process.cwd();
 }
+function isPackageRoot(dir) {
+  const pkgPath = join2(dir, "package.json");
+  if (!existsSync2(pkgPath)) return false;
+  try {
+    const pkg2 = JSON.parse(readFileSync(pkgPath, "utf-8"));
+    return pkg2.name === PKG_NAME;
+  } catch {
+    return false;
+  }
+}
+var PKG_NAME;
 var init_app_root = __esm({
   "src/lib/utils/app-root.ts"() {
     "use strict";
+    PKG_NAME = "orionfold-relay";
   }
 });
 
@@ -1203,7 +1222,7 @@ var init_types = __esm({
 
 // src/lib/environment/parsers/utils.ts
 import { createHash } from "crypto";
-import { readFileSync as readFileSync2, statSync } from "fs";
+import { readFileSync as readFileSync3, statSync } from "fs";
 function computeHash(content) {
   const truncated = content.slice(0, MAX_HASH_BYTES);
   return createHash("sha256").update(truncated).digest("hex");
@@ -1220,7 +1239,7 @@ function safeStat(path19) {
 }
 function safeReadFile(path19) {
   try {
-    return readFileSync2(path19, "utf-8");
+    return readFileSync3(path19, "utf-8");
   } catch {
     return null;
   }
@@ -5744,7 +5763,7 @@ __export(crypto_exports, {
   getOrCreateKeyfile: () => getOrCreateKeyfile
 });
 import { randomBytes, createCipheriv, createDecipheriv } from "crypto";
-import { readFileSync as readFileSync3, writeFileSync, existsSync as existsSync5, mkdirSync as mkdirSync2, chmodSync } from "fs";
+import { readFileSync as readFileSync4, writeFileSync, existsSync as existsSync5, mkdirSync as mkdirSync2, chmodSync } from "fs";
 import { join as join7 } from "path";
 function getKeyfilePath() {
   return join7(dataDir(), ".keyfile");
@@ -5752,7 +5771,7 @@ function getKeyfilePath() {
 function getOrCreateKeyfile() {
   const keyfilePath = getKeyfilePath();
   if (existsSync5(keyfilePath)) {
-    const key2 = readFileSync3(keyfilePath);
+    const key2 = readFileSync4(keyfilePath);
     if (key2.length !== KEY_LENGTH) {
       throw new Error(`Invalid keyfile: expected ${KEY_LENGTH} bytes, got ${key2.length}`);
     }
@@ -6718,7 +6737,7 @@ __export(workspace_context_exports, {
   getLaunchCwd: () => getLaunchCwd,
   getWorkspaceContext: () => getWorkspaceContext
 });
-import { basename, dirname as dirname2 } from "path";
+import { basename, dirname as dirname3 } from "path";
 import { homedir as homedir4 } from "os";
 import { execFileSync as execFileSync2 } from "child_process";
 import { statSync as statSync2 } from "fs";
@@ -6730,7 +6749,7 @@ function getWorkspaceContext() {
   const cwd = getLaunchCwd();
   const home = homedir4();
   const folderName = basename(cwd);
-  const parent = dirname2(cwd);
+  const parent = dirname3(cwd);
   const parentPath = parent.startsWith(home) ? "~" + parent.slice(home.length) : parent;
   let gitBranch = null;
   try {
@@ -12811,7 +12830,7 @@ var list_fused_profiles_exports = {};
 __export(list_fused_profiles_exports, {
   listFusedProfiles: () => listFusedProfiles
 });
-import { readdirSync, readFileSync as readFileSync4, statSync as statSync3, existsSync as existsSync6 } from "fs";
+import { readdirSync, readFileSync as readFileSync5, statSync as statSync3, existsSync as existsSync6 } from "fs";
 import { join as join11 } from "path";
 import { homedir as homedir5 } from "os";
 function parseFrontmatter2(content) {
@@ -12836,7 +12855,7 @@ function loadFilesystemSkills(skillsDir, origin, projectRootDir) {
       if (!statSync3(skillPath).isDirectory()) continue;
       const skillMdPath = join11(skillPath, "SKILL.md");
       if (!existsSync6(skillMdPath)) continue;
-      const content = readFileSync4(skillMdPath, "utf8");
+      const content = readFileSync5(skillMdPath, "utf8");
       const fm = parseFrontmatter2(content);
       if (!fm || !fm.name) {
         console.warn(
@@ -15552,7 +15571,7 @@ var init_active_skills = __esm({
 });
 
 // src/lib/environment/parsers/skill.ts
-import { readdirSync as readdirSync2, readFileSync as readFileSync5 } from "fs";
+import { readdirSync as readdirSync2, readFileSync as readFileSync6 } from "fs";
 import { join as join12, basename as basename3 } from "path";
 function parseSkillDir(dirPath, tool, scope, baseDir) {
   const stat2 = safeStat(dirPath);
@@ -15566,7 +15585,7 @@ function parseSkillDir(dirPath, tool, scope, baseDir) {
     const skillFile = files.find((f) => f === "SKILL.md") || files.find((f) => f.endsWith(".md")) || files[0];
     if (skillFile) {
       mainFile = join12(dirPath, skillFile);
-      content = readFileSync5(mainFile, "utf-8");
+      content = readFileSync6(mainFile, "utf-8");
     }
   } catch {
     return null;
@@ -16202,7 +16221,7 @@ __export(list_skills_exports, {
   listSkills: () => listSkills,
   listSkillsEnriched: () => listSkillsEnriched
 });
-import { readFileSync as readFileSync6, readdirSync as readdirSync6, statSync as statSync4 } from "fs";
+import { readFileSync as readFileSync7, readdirSync as readdirSync6, statSync as statSync4 } from "fs";
 import { join as join17 } from "path";
 function listSkills(options = {}) {
   const projectDir = options.projectDir ?? getLaunchCwd();
@@ -16227,7 +16246,7 @@ function getSkill(id, options = {}) {
   const filePath = resolveSkillFile(hit.absPath);
   if (!filePath) return null;
   try {
-    const content = readFileSync6(filePath, "utf8");
+    const content = readFileSync7(filePath, "utf8");
     return { ...hit, content };
   } catch {
     return null;
@@ -19151,7 +19170,7 @@ var init_codex_app_server_client = __esm({
 
 // src/lib/agents/runtime/openai-codex-auth.ts
 import { mkdir as mkdir2, readFile as readFile7, rm, writeFile } from "fs/promises";
-import { dirname as dirname3 } from "path";
+import { dirname as dirname4 } from "path";
 function parseRateLimitWindow(value) {
   if (!value || typeof value !== "object") return null;
   return {
@@ -19211,7 +19230,7 @@ async function ensureCodexHomeConfig() {
   const codexDir = getAinativeCodexDir();
   const configPath = getAinativeCodexConfigPath();
   await mkdir2(codexDir, { recursive: true });
-  await mkdir2(dirname3(configPath), { recursive: true });
+  await mkdir2(dirname4(configPath), { recursive: true });
   let current = "";
   try {
     current = await readFile7(configPath, "utf8");
@@ -25183,6 +25202,9 @@ import { execFileSync as execFileSync3 } from "child_process";
 import yaml12 from "js-yaml";
 import semver from "semver";
 function relayCoreVersion() {
+  if (semver.valid("0.15.3")) {
+    return "0.15.3";
+  }
   try {
     const root = getAppRoot(import.meta.dirname, 3);
     const pkg2 = JSON.parse(
@@ -25551,13 +25573,13 @@ var init_cli = __esm({
 
 // bin/cli.ts
 import { program } from "commander";
-import { basename as basename5, dirname as dirname4, join as join20 } from "path";
+import { basename as basename5, dirname as dirname5, join as join20 } from "path";
 import { homedir as homedir8 } from "os";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import {
   mkdirSync as mkdirSync5,
   existsSync as existsSync12,
-  readFileSync as readFileSync7,
+  readFileSync as readFileSync8,
   writeFileSync as writeFileSync5,
   cpSync as cpSync2,
   unlinkSync as unlinkSync2
@@ -25623,20 +25645,26 @@ function buildNextLaunchArgs({
 function buildSidecarUrl(port, host = SIDECAR_LOOPBACK_HOST) {
   return `http://${host}:${port}`;
 }
+function isNonLoopbackHost(host) {
+  const h = host.trim().toLowerCase();
+  if (h === "localhost" || h === "::1") return false;
+  if (/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(h)) return false;
+  return true;
+}
 
 // bin/cli.ts
 init_ainative_paths();
 init_bootstrap();
 
 // src/lib/utils/migrate-to-ainative.ts
-import { existsSync as existsSync3, renameSync, cpSync, rmSync, readFileSync } from "fs";
+import { existsSync as existsSync3, renameSync, cpSync, rmSync, readFileSync as readFileSync2 } from "fs";
 import { join as join5 } from "path";
 import { homedir as homedir2 } from "os";
 import Database from "better-sqlite3";
 function hasSqliteHeader(path19) {
   const SQLITE_MAGIC = "SQLite format 3\0";
   try {
-    const header = readFileSync(path19, { encoding: null });
+    const header = readFileSync2(path19, { encoding: null });
     return header.length >= 16 && header.subarray(0, 16).toString("binary") === SQLITE_MAGIC;
   } catch {
     return false;
@@ -25758,7 +25786,7 @@ async function migrateLegacyData(options = {}) {
 
 // bin/cli.ts
 init_detect();
-var __dirname = dirname4(fileURLToPath3(import.meta.url));
+var __dirname = dirname5(fileURLToPath3(import.meta.url));
 var appDir = join20(__dirname, "..");
 var launchCwd2 = process.cwd();
 var _envLocalPath = join20(launchCwd2, ".env.local");
@@ -25766,18 +25794,31 @@ var _firstRunNeedsEnv = !existsSync12(_envLocalPath) && !process.env.RELAY_DATA_
 if (_firstRunNeedsEnv) {
   const folderName = basename5(launchCwd2);
   const autoDataDir = join20(homedir8(), `.${folderName}`);
-  writeFileSync5(
-    _envLocalPath,
-    `# Auto-created by orionfold-relay on first run.
+  try {
+    writeFileSync5(
+      _envLocalPath,
+      `# Auto-created by orionfold-relay on first run.
 # Points this folder's install at an isolated data directory.
 RELAY_DATA_DIR=${autoDataDir}
 `,
-    "utf-8"
-  );
-  console.log(`First run \u2014 wrote ${_envLocalPath} (RELAY_DATA_DIR=${autoDataDir}).`);
+      "utf-8"
+    );
+    console.log(`First run \u2014 wrote ${_envLocalPath} (RELAY_DATA_DIR=${autoDataDir}).`);
+  } catch (e) {
+    const reason = e instanceof Error ? e.message : String(e);
+    console.warn(
+      `Warning: could not write ${_envLocalPath} (${reason}).
+Continuing with the default data directory (~/.relay). This folder will not get an isolated database.`
+    );
+    if (/^([A-Za-z]:)?[\\/]Windows([\\/]|$)/.test(launchCwd2)) {
+      console.warn(
+        `It looks like you launched from a Windows UNC path under WSL, so the working directory defaulted to "${launchCwd2}". Run relay from your Linux filesystem instead \u2014 e.g. \`cd ~\` first, or run it from a WSL home directory rather than a \\\\wsl.localhost\\... path.`
+      );
+    }
+  }
 }
 if (existsSync12(_envLocalPath)) {
-  for (const line of readFileSync7(_envLocalPath, "utf-8").split("\n")) {
+  for (const line of readFileSync8(_envLocalPath, "utf-8").split("\n")) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
     const eqIdx = trimmed.indexOf("=");
@@ -25789,7 +25830,7 @@ if (existsSync12(_envLocalPath)) {
     }
   }
 }
-var pkg = JSON.parse(readFileSync7(join20(appDir, "package.json"), "utf-8"));
+var pkg = JSON.parse(readFileSync8(join20(appDir, "package.json"), "utf-8"));
 function getHelpText() {
   const dir = getAinativeDataDir();
   const db3 = getAinativeDbPath();
@@ -25807,6 +25848,7 @@ Environment variables:
 
 Examples:
   node dist/cli.js --port 3210 --no-open
+  node dist/cli.js --hostname 0.0.0.0 --port 3000    # expose on the LAN (see warning)
   node dist/cli.js --data-dir ~/.relay-dogfood --port 3100
   node dist/cli.js plugin dry-run my-plugin    # print confinement policy
   node dist/cli.js pack add ./my-pack          # install a Relay pack (folder or git url)
@@ -25814,7 +25856,11 @@ Examples:
   node dist/cli.js pack remove my-pack         # uninstall a pack
 `;
 }
-program.name("relay").description("Orionfold Relay \u2014 a local-first, multi-agent orchestration runtime and builder scaffold for AI-native work.").version(pkg.version).addHelpText("after", getHelpText).option("-p, --port <number>", "port to start on", "3000").option("--data-dir <path>", "custom data directory (overrides RELAY_DATA_DIR)").option("--reset", "delete the local database before starting").option("--no-open", "don't auto-open browser").option("--safe-mode", "disable Kind-1 plugin MCP servers; Kind-5 primitives bundles still load");
+program.name("relay").description("Orionfold Relay \u2014 a local-first, multi-agent orchestration runtime and builder scaffold for AI-native work.").version(pkg.version).addHelpText("after", getHelpText).option("-p, --port <number>", "port to start on", "3000").option(
+  "--hostname <host>",
+  "host to bind to (default 127.0.0.1; use 0.0.0.0 to expose on the network)",
+  "127.0.0.1"
+).option("--data-dir <path>", "custom data directory (overrides RELAY_DATA_DIR)").option("--reset", "delete the local database before starting").option("--no-open", "don't auto-open browser").option("--safe-mode", "disable Kind-1 plugin MCP servers; Kind-5 primitives bundles still load");
 var firstArg = process.argv[2];
 var isPluginSubcommand = firstArg === "plugin";
 var isPackSubcommand = firstArg === "pack";
@@ -25910,8 +25956,8 @@ async function main() {
   let effectiveCwd = appDir;
   const localNm = join20(appDir, "node_modules");
   if (!existsSync12(join20(localNm, "next", "package.json"))) {
-    let searchDir = dirname4(appDir);
-    while (searchDir !== dirname4(searchDir)) {
+    let searchDir = dirname5(appDir);
+    while (searchDir !== dirname5(searchDir)) {
       const candidate = join20(searchDir, "node_modules", "next", "package.json");
       if (existsSync12(candidate)) {
         const hoistedRoot = searchDir;
@@ -25933,22 +25979,29 @@ async function main() {
           const dest = join20(hoistedRoot, name);
           const src = join20(appDir, name);
           if (!existsSync12(dest) && existsSync12(src)) {
-            writeFileSync5(dest, readFileSync7(src));
+            writeFileSync5(dest, readFileSync8(src));
           }
         }
         effectiveCwd = hoistedRoot;
         break;
       }
-      searchDir = dirname4(searchDir);
+      searchDir = dirname5(searchDir);
     }
   }
   const nextEntrypoint = resolveNextEntrypoint(effectiveCwd);
   const isPrebuilt = existsSync12(join20(effectiveCwd, ".next", "BUILD_ID"));
+  const bindHost = opts.hostname || "127.0.0.1";
+  if (isNonLoopbackHost(bindHost)) {
+    console.warn(
+      `\u26A0 Binding to ${bindHost} \u2014 Relay will be reachable from other machines on the network. It is designed for local-first, single-user use and has no network authentication. Only do this on a trusted network, and put a reverse proxy with auth in front if exposing it more broadly.`
+    );
+  }
   const nextArgs = buildNextLaunchArgs({
     isPrebuilt,
-    port: actualPort
+    port: actualPort,
+    host: bindHost
   });
-  const sidecarUrl = buildSidecarUrl(actualPort);
+  const sidecarUrl = buildSidecarUrl(actualPort, bindHost);
   console.log(`Orionfold Relay ${pkg.version} \u2014 Community Edition`);
   console.log(`Data dir: ${DATA_DIR}`);
   console.log(`Mode: ${isPrebuilt ? "production" : "development"}`);
@@ -25967,10 +26020,11 @@ async function main() {
     }
   });
   if (opts.open !== false) {
+    const openUrl = isNonLoopbackHost(bindHost) ? buildSidecarUrl(actualPort, "127.0.0.1") : sidecarUrl;
     setTimeout(async () => {
       try {
         const open = (await import("open")).default;
-        await open(sidecarUrl);
+        await open(openUrl);
       } catch {
       }
     }, 3e3);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orionfold-relay",
-  "version": "0.15.1",
+  "version": "0.15.3",
   "description": "Orionfold Relay — a local-first, multi-agent orchestration runtime and builder scaffold for AI-native work.",
   "keywords": [
     "ai",

package/src/app/api/projects/route.ts

@@ -13,6 +13,7 @@ export async function GET() {
       name: projects.name,
       description: projects.description,
       workingDirectory: projects.workingDirectory,
+      customerId: projects.customerId,
       status: projects.status,
       createdAt: projects.createdAt,
       updatedAt: projects.updatedAt,
@@ -42,6 +43,7 @@ export async function POST(req: NextRequest) {
     name: parsed.data.name,
     description: parsed.data.description ?? null,
     workingDirectory: parsed.data.workingDirectory ?? null,
+    customerId: parsed.data.customerId ?? null,
     status: "active",
     createdAt: now,
     updatedAt: now,

package/src/app/projects/page.tsx

@@ -13,6 +13,7 @@ export default async function ProjectsPage() {
       name: projects.name,
       description: projects.description,
       workingDirectory: projects.workingDirectory,
+      customerId: projects.customerId,
       status: projects.status,
       createdAt: projects.createdAt,
       updatedAt: projects.updatedAt,

package/src/components/projects/project-form-sheet.tsx

@@ -19,7 +19,7 @@ import {
   SelectTrigger,
   SelectValue,
 } from "@/components/ui/select";
-import { FolderOpen, AlignLeft, FolderCode, Trash2, Paperclip, Plus, X } from "lucide-react";
+import { FolderOpen, AlignLeft, FolderCode, Trash2, Paperclip, Plus, X, Building2 } from "lucide-react";
 import { toast } from "sonner";
 import { Badge } from "@/components/ui/badge";
 import { ConfirmDialog } from "@/components/shared/confirm-dialog";
@@ -31,9 +31,18 @@ interface Project {
   name: string;
   description: string | null;
   workingDirectory: string | null;
+  customerId: string | null;
   status: string;
 }
 
+interface CustomerOption {
+  id: string;
+  name: string;
+}
+
+// Radix Select cannot use an empty-string value; this sentinel maps to null.
+const NO_CUSTOMER = "__none__";
+
 interface ProjectFormSheetProps {
   mode: "create" | "edit";
   project?: Project | null;
@@ -53,6 +62,8 @@ export function ProjectFormSheet({
   const [description, setDescription] = useState("");
   const [workingDirectory, setWorkingDirectory] = useState("");
   const [status, setStatus] = useState("active");
+  const [customerId, setCustomerId] = useState<string>(NO_CUSTOMER);
+  const [customers, setCustomers] = useState<CustomerOption[]>([]);
   const [loading, setLoading] = useState(false);
   const [error, setError] = useState<string | null>(null);
   const [confirmDelete, setConfirmDelete] = useState(false);
@@ -60,6 +71,17 @@ export function ProjectFormSheet({
   const [selectedDocs, setSelectedDocs] = useState<Array<{ id: string; originalName: string; mimeType: string; size: number }>>([]);
   const [pickerOpen, setPickerOpen] = useState(false);
 
+  // Load selectable customers whenever the sheet opens
+  useEffect(() => {
+    if (!open) return;
+    fetch("/api/customers")
+      .then((r) => r.json())
+      .then((rows: Array<{ id: string; name: string }>) => {
+        setCustomers(rows.map((c) => ({ id: c.id, name: c.name })));
+      })
+      .catch(() => setCustomers([]));
+  }, [open]);
+
   // Pre-fill form in edit mode
   useEffect(() => {
     if (mode === "edit" && project) {
@@ -67,6 +89,7 @@ export function ProjectFormSheet({
       setDescription(project.description ?? "");
       setWorkingDirectory(project.workingDirectory ?? "");
       setStatus(project.status);
+      setCustomerId(project.customerId ?? NO_CUSTOMER);
       // Load existing default documents
       fetch(`/api/projects/${project.id}/documents`)
         .then((r) => r.json())
@@ -91,6 +114,7 @@ export function ProjectFormSheet({
       setDescription("");
       setWorkingDirectory("");
       setStatus("active");
+      setCustomerId(NO_CUSTOMER);
       setSelectedDocIds(new Set());
       setSelectedDocs([]);
     }
@@ -120,6 +144,7 @@ export function ProjectFormSheet({
             name: name.trim(),
             description: description.trim() || undefined,
             workingDirectory: workingDirectory.trim() || undefined,
+            customerId: customerId === NO_CUSTOMER ? null : customerId,
             documentIds: selectedDocIds.size > 0 ? [...selectedDocIds] : undefined,
           }),
         });
@@ -140,6 +165,7 @@ export function ProjectFormSheet({
             description: description.trim() || undefined,
             workingDirectory: workingDirectory.trim() || undefined,
             status,
+            customerId: customerId === NO_CUSTOMER ? null : customerId,
             documentIds: [...selectedDocIds],
           }),
         });
@@ -241,6 +267,33 @@ export function ProjectFormSheet({
                 </p>
               </div>
 
+              <div className="space-y-2">
+                <Label htmlFor="proj-customer" className="flex items-center gap-1.5">
+                  <Building2 className="h-3.5 w-3.5 text-muted-foreground" />
+                  Customer
+                </Label>
+                <Select value={customerId} onValueChange={setCustomerId}>
+                  <SelectTrigger id="proj-customer">
+                    <SelectValue placeholder="No customer" />
+                  </SelectTrigger>
+                  <SelectContent>
+                    <SelectItem value={NO_CUSTOMER}>
+                      <span className="text-muted-foreground">No customer</span>
+                    </SelectItem>
+                    {customers.map((c) => (
+                      <SelectItem key={c.id} value={c.id}>
+                        {c.name}
+                      </SelectItem>
+                    ))}
+                  </SelectContent>
+                </Select>
+                <p className="text-xs text-muted-foreground">
+                  {customers.length === 0
+                    ? "No customers yet — create one to attribute this project's AI spend."
+                    : "Link to a customer so this project's AI spend rolls up per customer."}
+                </p>
+              </div>
+
               {isEdit && (
                 <div className="space-y-2">
                   <Label htmlFor="proj-status">Status</Label>

package/src/components/projects/project-list.tsx

@@ -14,6 +14,7 @@ interface Project {
   name: string;
   description: string | null;
   workingDirectory: string | null;
+  customerId: string | null;
   status: string;
   taskCount: number;
   docCount: number;

package/src/instrumentation-node.ts

@@ -3,6 +3,22 @@ export async function registerNodeInstrumentation() {
     const { migrateLegacyData } = await import("@/lib/utils/migrate-to-ainative");
     await migrateLegacyData();
 
+    // ainative→relay hop: the runtime now publishes chat/compose tools as
+    // mcp__relay__* (engine.ts server key), so previously-saved allow-lists and
+    // "Always Allow" records — matched by exact string — must be rewritten too.
+    // Runs against the live DB; idempotent, never throws.
+    const { migrateMcpNamespace } = await import("@/lib/utils/migrate-mcp-namespace");
+    const { sqlite } = await import("@/lib/db");
+    const nsReport = migrateMcpNamespace(sqlite);
+    if (nsReport.profilesUpdated > 0 || nsReport.permissionsUpdated > 0) {
+      console.log(
+        `[migrate] mcp namespace ainative→relay: ${nsReport.profilesUpdated} profile(s), ${nsReport.permissionsUpdated} permission set(s)`,
+      );
+    }
+    for (const err of nsReport.errors) {
+      console.error(`[migrate] mcp namespace: ${err}`);
+    }
+
     // Instance bootstrap — creates local branch, handles dev-mode gates, consent flow.
     // Runs BEFORE other startup so instance config is available downstream.
     // Safe in the canonical Relay dev repo thanks to RELAY_DEV_MODE=true

package/src/lib/chat/engine.ts

@@ -505,7 +505,10 @@ export async function* sendMessage(
           // Keep only last 50 chunks to avoid unbounded memory
           if (stderrChunks.length > 50) stderrChunks.shift();
         },
-        mcpServers: { ainative: ainativeServer, ...browserServers, ...externalServers },
+        // Server key = tool namespace: the Agent SDK derives `mcp__<key>__*`
+        // from THIS map key. Must be `relay` so published tools match the
+        // allow-list (:510) and the auto-allow gate (:533) below.
+        mcpServers: { relay: ainativeServer, ...browserServers, ...externalServers },
         allowedTools: [
           "mcp__relay__*",
           ...browserToolPatterns,

package/src/lib/desktop/sidecar-launch.ts

@@ -83,3 +83,21 @@ export function buildNextLaunchArgs({
 export function buildSidecarUrl(port: number, host = SIDECAR_LOOPBACK_HOST): string {
   return `http://${host}:${port}`;
 }
+
+/**
+ * True when `host` is NOT a loopback address — i.e. binding to it exposes the
+ * server beyond the local machine. Relay is local-first with light auth, so the
+ * CLI warns before binding to such a host (`--hostname 0.0.0.0`, a LAN IP, a
+ * hostname, etc.). This is an advisory gate, not access control, so it errs
+ * toward warning: anything not provably loopback returns true.
+ *
+ * Loopback = `localhost`, IPv6 `::1`, or any `127.0.0.0/8` address (Linux lets
+ * you bind e.g. `127.0.0.5`). `0.0.0.0` / `::` are INADDR_ANY ("all
+ * interfaces") — the most exposing choice — and are treated as non-loopback.
+ */
+export function isNonLoopbackHost(host: string): boolean {
+  const h = host.trim().toLowerCase();
+  if (h === "localhost" || h === "::1") return false;
+  if (/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(h)) return false;
+  return true;
+}

package/src/lib/packs/install.ts

@@ -19,14 +19,28 @@ import {
   type ResolvedPackFile,
 } from "./format";
 
-// The current relay-core version. Sourced from package.json at module load.
-// Kept here (not inlined) so the compat gate has a single point of truth.
+// Compile-time core version, embedded by tsup's `define` (see tsup.config.ts).
+// Present ONLY in the bundled CLI; `undefined` in dev/test/Next.js builds,
+// where the runtime lookup below takes over. Declared as a global so the
+// reference type-checks in the non-bundled builds where it doesn't exist.
+declare const __RELAY_CORE_VERSION__: string | undefined;
+
+// The current relay-core version. Kept here (not inlined) so the compat gate
+// has a single point of truth.
 function relayCoreVersion(): string {
-  // Resolve the app root via getAppRoot (NOT process.cwd() — under npx that is
-  // the user's launch dir, not the app, which would read the wrong
-  // package.json; see npx-process-cwd.test.ts). install.ts lives at
-  // src/lib/packs/, so the app root is 3 levels up from this file's dir —
-  // same depth ainative-paths.ts uses.
+  // 1. Bundle path: the version baked in at build time. This eliminates the
+  //    runtime package.json lookup entirely in the shipped CLI — the source of
+  //    the "0.0.0" bug, where the flattened dist/ layout broke the depth-based
+  //    getAppRoot resolution and fell back to the user's launch dir.
+  if (typeof __RELAY_CORE_VERSION__ === "string" && semver.valid(__RELAY_CORE_VERSION__)) {
+    return __RELAY_CORE_VERSION__;
+  }
+
+  // 2. Dev/test/Next.js path: resolve the app root via getAppRoot (NOT
+  //    process.cwd() — under npx that is the user's launch dir; see
+  //    npx-process-cwd.test.ts) and read package.json. getAppRoot is now
+  //    bundle-aware (walks up to the orionfold-relay package.json), so this
+  //    path is also correct in the bundle even if the define is ever dropped.
   try {
     const root = getAppRoot(import.meta.dirname, 3);
     const pkg = JSON.parse(

package/src/lib/utils/app-root.ts

@@ -1,11 +1,30 @@
-import { existsSync } from "node:fs";
-import { join } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+import { join, dirname } from "node:path";
+
+const PKG_NAME = "orionfold-relay";
 
 /**
  * Resolve the app root directory.
  * - import.meta.dirname works under npx (real path to installed package)
  * - Turbopack compiles it to /ROOT/... (virtual, doesn't exist) → fall back to process.cwd()
  *
+ * Two layouts must resolve correctly:
+ *   1. Source tree — the `depth` a caller passes lands exactly on the repo
+ *      root (e.g. src/lib/packs/ → depth 3). This is the fast path and stays
+ *      byte-identical to the original behavior.
+ *   2. Bundled dist/cli.js — tsup flattens every module into one file, so
+ *      `import.meta.dirname` is `dist/` for ALL callers regardless of the
+ *      depth they pass (a source-tree assumption). Depth then overshoots and
+ *      the depth candidate misses. Rather than fix depth math at every call
+ *      site (fragile — 5 sites, different depths), we walk UP from the caller
+ *      until we find the `orionfold-relay` package.json. This makes the passed
+ *      `depth` a hint, not a hard requirement, so all call sites resolve in the
+ *      bundle without per-site changes.
+ *
+ * The upward walk verifies `name === "orionfold-relay"` (not just any
+ * package.json) so that under npx it anchors to OUR package, never a foreign
+ * package.json in the user's launch dir.
+ *
  * Uses static `node:` built-in imports. These resolve natively in every
  * server context that consumes this helper — Next.js server modules, the
  * instrumentation hook, and the tsup ESM CLI bundle. (An earlier version used
@@ -17,8 +36,30 @@ import { join } from "node:path";
  */
 export function getAppRoot(metaDirname: string | undefined, depth: number): string {
   if (metaDirname) {
+    // Fast path — source tree: the passed depth lands on the package root.
     const candidate = join(metaDirname, ...Array(depth).fill(".."));
-    if (existsSync(join(candidate, "package.json"))) return candidate;
+    if (isPackageRoot(candidate)) return candidate;
+
+    // Bundle fallback: walk up until we hit the orionfold-relay package root.
+    let dir = metaDirname;
+    while (true) {
+      if (isPackageRoot(dir)) return dir;
+      const parent = dirname(dir);
+      if (parent === dir) break; // reached filesystem root
+      dir = parent;
+    }
   }
   return process.cwd();
 }
+
+/** True if `dir` holds the orionfold-relay package.json. */
+function isPackageRoot(dir: string): boolean {
+  const pkgPath = join(dir, "package.json");
+  if (!existsSync(pkgPath)) return false;
+  try {
+    const pkg = JSON.parse(readFileSync(pkgPath, "utf-8")) as { name?: string };
+    return pkg.name === PKG_NAME;
+  } catch {
+    return false;
+  }
+}

package/src/lib/utils/migrate-mcp-namespace.ts

@@ -0,0 +1,94 @@
+import type Database from "better-sqlite3";
+
+const OLD_PREFIX = "mcp__ainative__";
+const NEW_PREFIX = "mcp__relay__";
+
+export interface McpNamespaceMigrationReport {
+  /** Rows in agent_profiles whose allowed_tools were rewritten. */
+  profilesUpdated: number;
+  /** 1 if the permissions.allow settings row was rewritten, else 0. */
+  permissionsUpdated: number;
+  errors: string[];
+}
+
+/**
+ * Rewrites the chat/compose MCP tool namespace from the legacy `mcp__ainative__`
+ * prefix to `mcp__relay__` in persisted data. Companion to the `engine.ts`
+ * server-key flip: that change makes the runtime *publish* tools as
+ * `mcp__relay__*`; this migration makes previously-saved allow-lists and
+ * "Always Allow" records match the new names, which are compared by exact
+ * string (see `permissions.ts:matchesPermission`).
+ *
+ * Backing stores rewritten:
+ *   1. `settings` row `key='permissions.allow'` — a JSON array stored as a
+ *      string. This is the store that actually carries the namespace today
+ *      (saved "Always Allow" records). A string-level REPLACE is safe: it
+ *      rewrites the substring inside the serialized array without parsing it.
+ *   2. `agent_profiles.allowed_tools` — a JSON array column. NOTE: in current
+ *      Relay, profiles are file-based (profile.yaml on disk) and there is no
+ *      `agent_profiles` table, so this branch is a defensive no-op (guarded by
+ *      a table-exists check). It is kept so that if a DB-backed profile store
+ *      is ever reintroduced, the namespace hop is already covered. Shipped
+ *      profile files carry no `mcp__ainative__` strings (verified), so no file
+ *      rewrite is needed.
+ *
+ * Idempotent (a second run matches nothing) and never throws — a missing
+ * table (fresh/partial schema) is an expected no-op, not an error. Any real
+ * SQL failure is collected in `report.errors` so boot continues visibly.
+ *
+ * Takes the DB handle explicitly so it can be unit-tested against an in-memory
+ * database; production passes the live `sqlite` export.
+ */
+export function migrateMcpNamespace(
+  db: Database.Database,
+): McpNamespaceMigrationReport {
+  const report: McpNamespaceMigrationReport = {
+    profilesUpdated: 0,
+    permissionsUpdated: 0,
+    errors: [],
+  };
+
+  if (!tableExists(db, "agent_profiles")) {
+    // Fresh install — nothing to migrate.
+  } else {
+    try {
+      const r = db
+        .prepare(
+          `UPDATE agent_profiles
+             SET allowed_tools = REPLACE(allowed_tools, ?, ?)
+           WHERE allowed_tools LIKE '%' || ? || '%'`,
+        )
+        .run(OLD_PREFIX, NEW_PREFIX, OLD_PREFIX);
+      report.profilesUpdated = r.changes;
+    } catch (err) {
+      // allowed_tools column may be absent in an older schema — record, don't crash.
+      report.errors.push(`agent_profiles rewrite failed: ${String(err)}`);
+    }
+  }
+
+  if (!tableExists(db, "settings")) {
+    // Fresh install — no saved permissions yet.
+  } else {
+    try {
+      const r = db
+        .prepare(
+          `UPDATE settings
+             SET value = REPLACE(value, ?, ?)
+           WHERE key = 'permissions.allow' AND value LIKE '%' || ? || '%'`,
+        )
+        .run(OLD_PREFIX, NEW_PREFIX, OLD_PREFIX);
+      report.permissionsUpdated = r.changes;
+    } catch (err) {
+      report.errors.push(`settings permissions.allow rewrite failed: ${String(err)}`);
+    }
+  }
+
+  return report;
+}
+
+function tableExists(db: Database.Database, name: string): boolean {
+  const row = db
+    .prepare("SELECT name FROM sqlite_master WHERE type='table' AND name = ?")
+    .get(name);
+  return row !== undefined;
+}

package/src/lib/validators/project.ts

@@ -4,6 +4,8 @@ export const createProjectSchema = z.object({
   name: z.string().min(1, "Name is required").max(100),
   description: z.string().max(500).optional(),
   workingDirectory: z.string().max(500).optional(),
+  // FK to customers.id; null/absent = unlinked. Attributes AI spend to a customer.
+  customerId: z.string().min(1).nullish(),
 });
 
 export const updateProjectSchema = z.object({
@@ -11,6 +13,8 @@ export const updateProjectSchema = z.object({
   description: z.string().max(500).optional(),
   workingDirectory: z.string().max(500).optional(),
   status: z.enum(["active", "paused", "completed"]).optional(),
+  // FK to customers.id; null clears the link, absent leaves it unchanged.
+  customerId: z.string().min(1).nullish(),
 });
 
 export type CreateProjectInput = z.infer<typeof createProjectSchema>;