relay-companion 0.1.418 → 0.1.419

package/bootstrap/relay-setup.cjs

@@ -822,6 +822,70 @@ function stopPreviousWindowsRuntime({ platform = process.platform, spawnImpl = s
   };
 }
 
+const SETUP_COMPATIBILITY_VALUE_FLAGS = new Set([
+  "--code",
+  "--api",
+  "--web",
+  "--open-relay",
+  "--host",
+]);
+const SAFE_SETUP_TOKEN = /^[A-Za-z0-9_-]{4,256}$/;
+
+/**
+ * The signed-in website still emits the pre-pill setup contract while the
+ * installer migration is in flight. Keep that compatibility surface narrow:
+ * only the website's value-bearing arguments may cross the thin bootstrap into
+ * the already-verified runtime, and endpoint overrides must be secure origins.
+ */
+function validateSetupCompatibilityArgs(argv = []) {
+  if (!Array.isArray(argv) || argv.length === 0) return [];
+  const args = argv.map((value) => String(value));
+  const values = new Map();
+  for (let index = 0; index < args.length; index += 2) {
+    const flag = args[index];
+    const value = args[index + 1];
+    if (!SETUP_COMPATIBILITY_VALUE_FLAGS.has(flag)) {
+      fail("Relay setup received an unsupported compatibility option.");
+    }
+    if (!value || value.startsWith("--")) {
+      fail("Relay setup received an incomplete compatibility option.");
+    }
+    if (values.has(flag)) fail("Relay setup received a duplicate compatibility option.");
+    values.set(flag, value);
+  }
+
+  const code = values.get("--code");
+  if (!code || !SAFE_SETUP_TOKEN.test(code)) fail("Relay setup received an invalid pairing code.");
+  const openRelay = values.get("--open-relay");
+  if (openRelay && !SAFE_SETUP_TOKEN.test(openRelay)) fail("Relay setup received an invalid relay token.");
+  const host = values.get("--host");
+  if (host && !openRelay) fail("Relay setup received a host without a relay token.");
+  if (host && host !== "claude" && host !== "codex") fail("Relay setup received an invalid agent host.");
+
+  for (const flag of ["--api", "--web"]) {
+    const value = values.get(flag);
+    if (!value) continue;
+    let url;
+    try {
+      url = new URL(value);
+    } catch {
+      fail("Relay setup received an invalid service origin.");
+    }
+    const loopbackHttp = url.protocol === "http:" && ["localhost", "127.0.0.1", "::1"].includes(url.hostname);
+    if (
+      (url.protocol !== "https:" && !loopbackHttp) ||
+      url.username ||
+      url.password ||
+      url.pathname !== "/" ||
+      url.search ||
+      url.hash
+    ) {
+      fail("Relay setup requires a secure service origin.");
+    }
+  }
+  return args;
+}
+
 async function activateRuntime(layout, runtime, version, {
   platform = process.platform,
   homeDir = os.homedir(),
@@ -838,6 +902,7 @@ async function activateRuntime(layout, runtime, version, {
   activateMacServices = activateMacRuntimeServices,
   activationDeadlineMs = 90_000,
   now = Date.now,
+  setupCompatibilityArgs = [],
 } = {}) {
   let previous = null;
   try { previous = JSON.parse(readFileSync(layout.pointerPath, "utf8")); } catch {}
@@ -944,7 +1009,7 @@ async function activateRuntime(layout, runtime, version, {
   // On macOS/Linux setup owns registration, but the shared activation state
   // machine owns service restart. This keeps first-install MCP/autostart creation
   // in the candidate while bootstrap and the updater use the same exact-root handoff.
-  const setupArgs = [runtime.bin, "setup", "--no-trampoline", "--claim"];
+  const setupArgs = [runtime.bin, "setup", "--no-trampoline", "--claim", ...setupCompatibilityArgs];
   if (platform === "darwin" || platform === "linux") setupArgs.push("--no-restart");
   const result = spawnImpl(candidate.node, setupArgs, {
     stdio: "inherit",
@@ -1013,16 +1078,21 @@ async function activateRuntime(layout, runtime, version, {
   return { candidate, cliLauncher };
 }
 
-async function setup() {
+async function setup(argv = []) {
   assertCompatibleNode();
+  const setupCompatibilityArgs = validateSetupCompatibilityArgs(argv);
   const version = exactVersion(packageJson.version);
   const platformKey = releasePlatform();
   const layout = runtimeLayout(version, platformKey);
   const lock = acquireCanonicalLock(layout.lockPath);
   try {
     const runtime = await stageVerifiedRuntime({ version, platformKey, destination: layout.releaseRoot });
-    const activated = await activateRuntime(layout, runtime, version);
-    console.log(`Relay ${version} is installed. The Relay pill is open; sign in there to finish.`);
+    const activated = await activateRuntime(layout, runtime, version, { setupCompatibilityArgs });
+    if (setupCompatibilityArgs.includes("--code")) {
+      console.log(`Relay ${version} is installed and paired. The Relay pill is open.`);
+    } else {
+      console.log(`Relay ${version} is installed. The Relay pill is open; sign in there to finish.`);
+    }
     if (activated?.cliLauncher && !activated.cliLauncher.pathAvailable) {
       console.log(`Relay's command is installed at ${activated.cliLauncher.shimPath}. Open a new login session to add ~/.local/bin to PATH.`);
     }
@@ -1077,9 +1147,8 @@ async function main() {
       return;
     }
   }
-  if (process.argv.includes("--code")) fail("New Relay setup never accepts a pairing code. Sign in from the Relay pill after installation.");
   if (command === "version" || process.argv.includes("--version")) return console.log(packageJson.version);
-  if (command === "setup") return setup();
+  if (command === "setup") return setup(process.argv.slice(3));
   console.log([
     "Relay secure setup",
     "",
@@ -1108,6 +1177,7 @@ module.exports = {
   stageVerifiedRuntime,
   stableNodePath,
   tarInvocation,
+  validateSetupCompatibilityArgs,
   validateArchiveEntries,
   verifyExtractedRuntime,
   waitForRuntimeHealth,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "relay-companion",
-  "version": "0.1.418",
+  "version": "0.1.419",
   "description": "Install Relay for Claude Code, Cowork, and Codex, then sign in from the Relay pill.",
   "homepage": "https://sendrelays.com/get-started",
   "repository": {
@@ -28,25 +28,11 @@
   ],
   "type": "module",
   "bin": {
-    "relay": "bin/relay.js"
-  },
-  "main": "bin/relay.js",
-  "scripts": {
-    "mcp": "node src/mcp.js",
-    "daemon": "node src/task-daemon.js"
-  },
-  "dependencies": {
-    "@anthropic-ai/claude-agent-sdk": "0.3.195",
-    "@modelcontextprotocol/sdk": "1.30.0",
-    "@noble/ciphers": "2.1.1",
-    "@noble/curves": "2.0.1",
-    "@noble/hashes": "2.0.1",
-    "acme-client": "5.4.0",
-    "electron": "43.4.1",
-    "ts-mls": "1.6.2",
-    "undici": "7.29.0",
-    "ws": "8.21.0"
+    "relay": "bootstrap/relay-setup.cjs"
   },
+  "main": "bootstrap/relay-setup.cjs",
+  "scripts": {},
+  "dependencies": {},
   "devDependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.3.195",
     "@modelcontextprotocol/sdk": "1.30.0",
@@ -63,13 +49,7 @@
     "ws": "8.21.0"
   },
   "files": [
-    "bin",
-    "bootstrap",
-    "src",
-    "overlay",
-    "THIRD_PARTY_NOTICES.md",
-    "licenses",
-    "npm-shrinkwrap.json"
+    "bootstrap"
   ],
-  "relayDistribution": "bridge-runtime"
+  "relayDistribution": "thin-installer"
 }

package/THIRD_PARTY_NOTICES.md

@@ -1,49 +0,0 @@
-# Third-party notices
-
-The Relay preview preload embeds the following open-source software in
-`overlay/preview-preload.cjs`.
-
-## markdown-it 14.3.0
-
-Copyright (c) 2014 Vitaly Puzrin, Alex Kocharin.
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
-## DOMPurify 3.4.13
-
-Copyright (c) Cure53 and other contributors.
-
-DOMPurify is distributed under the Apache License 2.0 or the Mozilla Public
-License 2.0. Relay distributes its embedded copy under the Apache License 2.0.
-The complete terms are included in [`licenses/Apache-2.0.txt`](licenses/Apache-2.0.txt).
-
-## E2EE runtime libraries (MIT)
-
-The Companion uses the following packages for its RFC 9420 one-to-one text
-implementation. Each npm package includes its own complete MIT license text.
-
-- `ts-mls` 1.6.2 — Copyright Luka Jacobowitz and contributors.
-- `@hpke/core` 1.8.0 — Copyright hpke-js contributors.
-- `@noble/hashes` 2.0.1 — Copyright Paul Miller and contributors.
-- `@noble/ciphers` 2.1.1 — Copyright Paul Miller and contributors.
-- `@noble/curves` 2.0.1 — Copyright Paul Miller and contributors.
-
-`ts-mls` states that it has not undergone a formal security audit. Relay's own
-architecture documentation treats independent cryptographic and application
-review as a prerequisite for a public production E2EE claim.

package/bin/relay-hook.js

@@ -1,18 +0,0 @@
-#!/usr/bin/env node
-
-// Dedicated hook entrypoint: unlike the user-facing CLI, this does not import
-// setup, updater, Electron, MCP, or daemon modules on every agent event.
-const hook = process.argv[2];
-
-try {
-  if (hook === "claude-hook") {
-    const { runClaudeHook } = await import("../src/claude-hook.js");
-    await runClaudeHook();
-  } else if (hook === "codex-hook") {
-    const { runCodexHook } = await import("../src/codex-hook.js");
-    await runCodexHook();
-  }
-} catch {
-  // Hook context is advisory. It must never block or visibly break the host.
-  process.exitCode = 0;
-}