relay-companion 0.1.548 → 0.1.549

package/bootstrap/application-release.cjs

@@ -10,6 +10,10 @@ function applicationReleaseBase(channel = "stable") {
   return `${CHANNEL_ORIGINS[channel]}/v1/application-releases${channel === "stable" ? "" : `/${channel}`}`;
 }
 
+function applicationManifestUrl(channel = "stable") {
+  return `${applicationReleaseBase(channel)}/${channel === "stable" ? "stable-v3/" : ""}manifest.json`;
+}
+
 function validateApplicationRelease(payload, { version, sourceSha, channel } = {}) {
   if (![1, 2].includes(payload?.schema) || payload.product !== "Relay Application" || payload.version !== version
     || payload.sourceSha !== sourceSha || !/^\d+\.\d+\.\d+$/.test(version || "") || !/^[a-f0-9]{40}$/.test(sourceSha || "")
@@ -59,4 +63,4 @@ async function verifyApplicationArtifact(file, artifact) {
   return true;
 }
 
-module.exports = { PLATFORMS, CHANNEL_ORIGINS, applicationReleaseBase, validateApplicationRelease, verifyApplicationRelease, verifyApplicationArtifact };
+module.exports = { PLATFORMS, CHANNEL_ORIGINS, applicationReleaseBase, applicationManifestUrl, validateApplicationRelease, verifyApplicationRelease, verifyApplicationArtifact };

package/bootstrap/application-rollout.cjs

@@ -2,4 +2,4 @@
 // Capability only. Every background handoff additionally requires a fresh,
 // signed channel-specific policy. An empty device list migrates nobody.
 module.exports = Object.freeze({ enabled: true,
-  manifestUrl: "https://api.sendrelays.com/v1/application-releases/stable/manifest.json" });
+  manifestUrl: require("./application-release.cjs").applicationManifestUrl("stable") });

package/bootstrap/application-update.cjs

@@ -11,7 +11,7 @@ const rollout = require("./application-rollout.cjs");
 const CHECK_MS = 6 * 60 * 60_000;
 
 async function readOffer({ fetchImpl = globalThis.fetch, trustStore = trust, channel = "stable" } = {}) {
-  const response = await fetchImpl(`${release.applicationReleaseBase(channel)}/${channel === "stable" ? "stable/" : ""}manifest.json`, { redirect: "error", signal: AbortSignal.timeout(15_000), headers: { "Cache-Control": "no-cache" } });
+  const response = await fetchImpl(release.applicationManifestUrl(channel), { redirect: "error", signal: AbortSignal.timeout(15_000), headers: { "Cache-Control": "no-cache" } });
   if (response.status === 404) return null;
   if (!response.ok) throw new Error(`Native application offer unavailable (${response.status})`);
   let bytes = 0; const chunks = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "relay-companion",
-  "version": "0.1.548",
+  "version": "0.1.549",
   "description": "Install Relay for Claude Code, Cowork, and Codex, then sign in from the Relay pill.",
   "homepage": "https://sendrelays.com/get-started",
   "repository": {

package/skill/manifest.json

@@ -1,9 +1,9 @@
 {
   "schemaVersion": 1,
   "name": "relay",
-  "version": "1.1.66",
+  "version": "1.1.67",
   "consentVersion": 2,
-  "baseUrl": "https://sendrelays.com/skills/relay/v1.1.66",
+  "baseUrl": "https://sendrelays.com/skills/relay/v1.1.67",
   "files": [
     {
       "path": "SKILL.md",
@@ -21,7 +21,7 @@
     },
     {
       "path": "scripts/relay-protocol.mjs",
-      "sha256": "2fcf0a459c079cdce025efd4bd8e495f5c3b8ce320f617ec04b540adf6f2f51e"
+      "sha256": "bfbc56ecaf202f77002da7eec4a33c5bfc7f3c6574df3dd385766684eb5458a3"
     },
     {
       "path": "scripts/relay-local.mjs",

package/skill/relay/scripts/relay-protocol.mjs

@@ -22,6 +22,7 @@ let transport = "auto";
 let lastTransport = "";
 const DIRECT_RECOVERY = "To renew browser approval, use connect-start <approved-api-origin> <invite-token> codex|claude_code, approve the returned URL in your browser, then connect-finish. Your own invitation from the Relay website can be used; no Companion or device enrollment is needed.";
 const SAFE_GET = [
+  /^\/v1\/share-links\/[A-Za-z0-9_-]+\/stats(?:\?.*)?$/,
   /^\/v1\/contact-groups$/,
   /^\/v1\/chats(?:\?.*)?$/,
   /^\/v1\/chats\/[A-Za-z0-9_-]+(?:\?.*)?$/,
@@ -35,6 +36,7 @@ const SAFE_GET = [
   /^\/v1\/share-links\/[A-Za-z0-9_-]+$/,
 ];
 const SAFE_POST = [
+  /^\/v1\/share-links\/[A-Za-z0-9_-]+\/placements$/,
   /^\/v1\/relays$/,
   /^\/v1\/relays\/[A-Za-z0-9_-]+\/forward$/,
   /^\/v1\/relays\/[A-Za-z0-9_-]+\/read$/,
@@ -45,6 +47,7 @@ const SAFE_POST = [
 // A person may correct a message they sent, or take back a link they minted
 // or a message they sent, from the same conversation. Both are sender-only on
 // the server and converge on an exact retry.
+const SAFE_PUT = [/^\/v1\/share-links\/[A-Za-z0-9_-]+\/placements\/[A-Za-z0-9_-]+\/snapshot$/];
 const SAFE_PATCH = [
   /^\/v1\/messages\/[A-Za-z0-9_-]+$/,
 ];
@@ -217,7 +220,7 @@ async function readStdin() {
 }
 
 function allowed(method, requestPath) {
-  const list = method === "GET" ? SAFE_GET : method === "POST" ? SAFE_POST : method === "PATCH" ? SAFE_PATCH : method === "DELETE" ? SAFE_DELETE : [];
+  const list = method === "PUT" ? SAFE_PUT : method === "GET" ? SAFE_GET : method === "POST" ? SAFE_POST : method === "PATCH" ? SAFE_PATCH : method === "DELETE" ? SAFE_DELETE : [];
   return list.some((pattern) => pattern.test(requestPath));
 }
 
@@ -691,6 +694,9 @@ const DIRECT_TOOLS = {
   relay_chat_fetch: directTool("Read a page of one chat without receipts. Defaults to the newest 25, oldest first. HTTPS requires chatId. Continue with nextBeforeCursor or nextAfterCursor; a page is not the full history.", { chatId: idField, limit: { type: "integer", minimum: 1, maximum: 200 }, beforeCursor: { type: "string" }, afterCursor: { type: "string" } }, ["chatId"], { full: true }),
   relay_thread_fetch: directTool("Read related Relays by their internal threadId without receipts.", { threadId: idField }, ["threadId"]),
   relay_inbox_list: directTool("Read recent inbox metadata, or up to 20 exact Relay packet envelopes in items [{relayId, ...response}]. Does not send receipts. Todo queries require Companion.", { relayIds: { type: "array", items: idField, minItems: 1, maxItems: 20 } }),
+  relay_share_stats: directTool("Read owner-only share statistics. Separates legacy opens, estimated external browsers, button attempts, successful copies, agent fetches and account outcomes. Does not mark read. Browser estimates are not people; owner/test events are excluded. Optional from/to are ISO timestamps.", {"relayId": {"type": "string", "minLength": 1}, "from": {"type": "string"}, "to": {"type": "string"}}, ["relayId"], { full: true, readOnly: true }),
+  relay_share_placement: directTool("Create an attributed URL for an existing share link. This sends nothing. Use separate placements for X replies and internal previews; test=true excludes that placement from acquisition. Reuse the same idempotency key on retries.", {"relayId": {"type": "string", "minLength": 1}, "idempotencyKey": {"type": "string", "minLength": 8}, "label": {"type": "string", "maxLength": 120}, "source": {"type": "string", "enum": ["x", "relay", "internal", "other"]}, "postId": {"type": "string", "pattern": "^[0-9]{1,30}$"}, "test": {"type": "boolean"}}, ["relayId", "idempotencyKey", "label", "source"], { full: true, readOnly: false }),
+  relay_share_snapshot: directTool("Save a manually observed X analytics snapshot for an X placement. Keep X aggregate impressions and link clicks separate from Relay visits; never infer unique people or subtract guessed self clicks.", {"relayId": {"type": "string", "minLength": 1}, "placementId": {"type": "string"}, "observedAt": {"type": "string"}, "impressions": {"type": "integer", "minimum": 0}, "linkClicks": {"type": "integer", "minimum": 0}}, ["relayId", "placementId", "observedAt", "impressions", "linkClicks"], { full: true, readOnly: false }),
   relay_sent_list: directTool("Read sent history. Optional recipient matches a name or address.", { recipient: stringField, limit: { type: "integer", minimum: 1, maximum: 100 } }),
   relay_mark_read: directTool("Send a read receipt only when the person requested reading this exact Relay and you present it.", { relayId: idField, idempotencyKey: stringField }, ["relayId", "idempotencyKey"], { readOnly: false }),
   relay_send: directTool("Send authorized correspondence or a Task using a resolved recipient, a title and both documents. Preserve the exact body and idempotency key on retry. HTTPS cannot send to unresolved names or email addresses; resolve an existing contact first or mint a link.", {
@@ -772,6 +778,15 @@ async function directToolCommand(command, body, config) {
       for (const relayId of new Set(args.relayIds)) items.push({ relayId, ...await request("GET", `/v1/relays/${relayId}`) });
       value = { items, readStateChanged: false, readReceiptsSent: false };
     } else value = await request("GET", "/v1/inbox?view=summary");
+  } else if (name === "relay_share_stats") {
+    const query = new URLSearchParams(Object.entries({ from: args.from, to: args.to }).filter(([, v]) => v !== undefined));
+    value = await request("GET", `/v1/share-links/${encodeURIComponent(args.relayId)}/stats?${query}`);
+  } else if (name === "relay_share_placement") {
+    const { relayId, ...body } = args;
+    value = await request("POST", `/v1/share-links/${encodeURIComponent(relayId)}/placements`, body);
+  } else if (name === "relay_share_snapshot") {
+    const { relayId, placementId, ...body } = args;
+    value = await request("PUT", `/v1/share-links/${encodeURIComponent(relayId)}/placements/${encodeURIComponent(placementId)}/snapshot`, body);
   } else if (name === "relay_sent_list") {
     const result = await request("GET", "/v1/sent?limit=100");
     const needle = String(args.recipient || "").toLowerCase();