orionfold-relay 0.15.4 → 0.15.5

package/dist/cli.js

@@ -25235,8 +25235,8 @@ import { execFileSync as execFileSync3 } from "child_process";
 import yaml12 from "js-yaml";
 import semver from "semver";
 function relayCoreVersion() {
-  if (semver.valid("0.15.4")) {
-    return "0.15.4";
+  if (semver.valid("0.15.5")) {
+    return "0.15.5";
   }
   try {
     const root = getAppRoot(import.meta.dirname, 3);
@@ -26049,7 +26049,13 @@ async function main() {
       RELAY_DATA_DIR: DATA_DIR,
       RELAY_LAUNCH_CWD: launchCwd2,
       PORT: String(actualPort),
-      ...opts.safeMode ? { RELAY_SAFE_MODE: "true" } : {}
+      ...opts.safeMode ? { RELAY_SAFE_MODE: "true" } : {},
+      // In dev mode, Next blocks cross-origin /_next/* dev-asset requests from
+      // the LAN client's IP, breaking the app over the network (issue #13).
+      // When the operator has opted into non-loopback binding, tell next.config
+      // to allow any dev origin. Mirrors the same trust decision as the warning
+      // above; harmless for the prebuilt `next start` path (no dev-origin gate).
+      ...isNonLoopbackHost(bindHost) ? { RELAY_ALLOW_LAN_ORIGINS: "true" } : {}
     }
   });
   if (opts.open !== false) {

package/next.config.mjs

@@ -1,8 +1,28 @@
+// When the operator opts into LAN binding (`--hostname` to a non-loopback host,
+// see bin/cli.ts), the CLI sets RELAY_ALLOW_LAN_ORIGINS=true. In dev mode Next
+// otherwise blocks cross-origin requests to /_next/* dev assets from the LAN
+// client's IP — which silently breaks the whole app over the network (issue
+// #13). The client IP is unknowable at config-load time (the bind host is
+// 0.0.0.0 = "all interfaces"), and Next's matcher explicitly rejects a bare
+// "*"/"**" catch-all, so we allow every RFC1918 private-network range instead.
+// This matches the "trusted network" assumption the --hostname warning already
+// states, while still blocking public origins. (Prod `next start` has no such
+// gate; this only affects the dev-mode npx path.)
+const RFC1918_DEV_ORIGINS = [
+  "10.*.*.*",
+  "192.168.*.*",
+  // 172.16.0.0/12 — Next's matcher globs per-octet, so enumerate 16–31.
+  ...Array.from({ length: 16 }, (_, i) => `172.${16 + i}.*.*`),
+];
+const allowLanDevOrigins = process.env.RELAY_ALLOW_LAN_ORIGINS === "true";
+
 /** @type {import('next').NextConfig} */
 const nextConfig = {
   serverExternalPackages: ["better-sqlite3", "pdf-parse", "pdfjs-dist"],
   devIndicators: false,
-  allowedDevOrigins: ["127.0.0.1"],
+  allowedDevOrigins: allowLanDevOrigins
+    ? ["127.0.0.1", ...RFC1918_DEV_ORIGINS]
+    : ["127.0.0.1"],
   // The in-app kindle reader was removed; the book lives at ainative.business.
   // Redirect legacy /book links (and any chapter-anchored deep links) there.
   async redirects() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orionfold-relay",
-  "version": "0.15.4",
+  "version": "0.15.5",
   "description": "Orionfold Relay — a local-first, multi-agent orchestration runtime and builder scaffold for AI-native work.",
   "keywords": [
     "ai",

package/src/app/layout.tsx

@@ -68,7 +68,13 @@ const CRITICAL_THEME_CSS = `
     --surface-2: oklch(0.16 0.02 250);
     --border: oklch(0.26 0.015 250);
   }
-  html { background: var(--background); font-size: 14px; }
+  /* Root rem base. Fixed 14px left the whole rem-based design tiny on high-res
+     4K displays (issue #4) — text stayed 14px regardless of viewport, forcing
+     browser zoom. This clamp holds a flat 14px through 1920px-wide viewports
+     (unchanged for existing laptop/desktop users) and only ramps up on QHD/4K:
+     ~16px at 2560px, capped at 18px from 3200px+. Type and spacing grow
+     proportionally (the design is rem-based) with no component changes. */
+  html { background: var(--background); font-size: clamp(14px, 0.35vw + 7.3px, 18px); }
 `.replace(/\s+/g, " ").trim();
 
 export default async function RootLayout({

package/src/components/instance/instance-section.tsx

@@ -187,7 +187,7 @@ export function InstanceSection() {
           Running on the main dev repo. Instance upgrade features are disabled.
           Set{" "}
           <code className="font-mono text-[11px] px-1 py-0.5 rounded bg-muted">
-            AINATIVE_INSTANCE_MODE=true
+            RELAY_INSTANCE_MODE=true
           </code>{" "}
           to test.
         </p>

package/src/components/settings/providers-runtimes-section.tsx

@@ -2,6 +2,7 @@
 
 import { useCallback, useEffect, useRef, useState } from "react";
 import {
+  AlertTriangle,
   ChevronDown,
   ChevronRight,
   Network,
@@ -286,6 +287,7 @@ function ProviderRow({
 export function ProvidersAndRuntimesSection() {
   const [data, setData] = useState<ProvidersPayload | null>(null);
   const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
   const [anthropicOpen, setAnthropicOpen] = useState(false);
   const [openAIOpen, setOpenAIOpen] = useState(false);
   const [openAILoginState, setOpenAILoginState] = useState<OpenAILoginState | null>(null);
@@ -298,8 +300,20 @@ export function ProvidersAndRuntimesSection() {
       if (res.ok) {
         const json = (await res.json()) as ProvidersPayload;
         setData(json);
+        setError(null);
         return json;
       }
+      // A non-OK response left the section spinning forever (issue #9): the
+      // render guard is `loading || !data`, so `data` staying null on error
+      // meant a permanent "Loading…" card with no visible failure. Surface it.
+      setError(`Failed to load provider configuration (HTTP ${res.status}).`);
+      return null;
+    } catch (err) {
+      setError(
+        err instanceof Error
+          ? `Failed to load provider configuration: ${err.message}`
+          : "Failed to load provider configuration.",
+      );
       return null;
     } finally {
       setLoading(false);
@@ -630,7 +644,7 @@ export function ProvidersAndRuntimesSection() {
 
   // ── Render ───────────────────────────────────────────────────────
 
-  if (loading || !data) {
+  if (loading) {
     return (
       <Card className="surface-card">
         <CardHeader>
@@ -644,6 +658,38 @@ export function ProvidersAndRuntimesSection() {
     );
   }
 
+  // Fetch finished but produced no data (non-OK response or thrown error).
+  // Show an actionable error with a retry instead of an endless spinner —
+  // the previous `loading || !data` guard silently hung here (issue #9).
+  if (!data) {
+    return (
+      <Card className="surface-card">
+        <CardHeader>
+          <CardTitle className="flex items-center gap-2">
+            <AlertTriangle className="h-5 w-5 text-destructive" />
+            Providers &amp; Runtimes
+          </CardTitle>
+          <CardDescription>
+            {error ?? "Failed to load provider configuration."}
+          </CardDescription>
+        </CardHeader>
+        <CardContent>
+          <button
+            type="button"
+            onClick={() => {
+              setLoading(true);
+              setError(null);
+              void fetchData();
+            }}
+            className="rounded-md border border-input bg-background px-3 py-1.5 text-sm font-medium hover:bg-accent hover:text-accent-foreground"
+          >
+            Retry
+          </button>
+        </CardContent>
+      </Card>
+    );
+  }
+
   const { providers, routingPreference, configuredProviderCount } = data;
   const openAIProvider: ProviderState = {
     ...providers.openai,