relay-companion 0.1.71 → 0.1.72

package/bin/relay.js

@@ -28,6 +28,7 @@ import { pillStatusPath, waitForPillReady } from "../src/pill-control.js";
 import { liveToolRequirement, requiredLiveHosts, shouldRequireLiveTools } from "../src/setup-activation.js";
 import { openRelay, openTask } from "../src/materializer.js";
 import { runClaudeHook } from "../src/claude-hook.js";
+import { normalizePairingCode, persistPairedAccount } from "../src/account.js";
 import { resetCompanionStateForAccount } from "../src/notifications.js";
 import { finishSetupOpenRelay, normalizeSetupHost, setupOpenRelayToken, setupOpenStatus } from "../src/setup-open.js";
 
@@ -95,8 +96,10 @@ async function cmdPair(flags, { promptForDefaults = true } = {}) {
   }
   writeConfig({ apiUrl: url, webUrl: appUrl });
   const client = new RelayClient({ url });
-  const res = await client.registerDevice({ pairingCode: code, name, platform: process.platform });
-  writeConfig({ apiUrl: url, webUrl: appUrl, deviceToken: res.deviceToken, deviceId: res.deviceId, user: res.user });
+  const res = await client.registerDevice({ pairingCode: normalizePairingCode(code), name, platform: process.platform });
+  // The same persistence the pill's Settings tab uses (src/account.js), so the
+  // stored credential shape can never drift between the two pairing surfaces.
+  persistPairedAccount({ apiUrl: url, webUrl: appUrl, deviceName: name, registration: res });
   resetCompanionStateForAccount({ user: res.user, deviceId: res.deviceId });
   console.log(`Paired as ${res.user.name} <${res.user.email}>. This device is now connected to Relay.`);
 }

package/overlay/inbox.html

@@ -647,6 +647,62 @@
   }
   .sent-chip.read { background:rgba(46,160,67,.14); color:#1a7f37; border:1px solid rgba(46,160,67,.28); }
   .sent-chip.unread { background:transparent; color:var(--muted-2); border:1px solid rgba(31,26,23,.18); }
+
+  /* ---- Settings tab ---- */
+  /* The account block is flat content on the sheet, like rows: serif identity,
+     sans metadata, a tinted avatar disc. Depth only ever comes from tint and
+     the reused .open-actions light-built panel — never from borders. */
+  .sv-head { display:flex; align-items:center; justify-content:space-between; padding:10px 16px 8px; }
+  .sv-title { font-family:var(--serif); font-size:16px; font-weight:500; color:var(--ink); }
+  .sv-account { display:flex; align-items:center; gap:12px; padding:4px 16px 0; }
+  .sv-avatar {
+    flex:0 0 auto; width:38px; height:38px; border-radius:50%;
+    background:var(--accent-soft); color:var(--accent);
+    font-size:13px; font-weight:600; letter-spacing:.02em;
+    display:flex; align-items:center; justify-content:center;
+  }
+  .sv-id { min-width:0; display:flex; flex-direction:column; }
+  .sv-name { font-family:var(--serif); font-size:16px; font-weight:500; color:var(--ink); line-height:1.25; white-space:nowrap; overflow:hidden; text-overflow:ellipsis; }
+  .sv-email { font-size:11.5px; color:var(--muted); margin-top:1px; white-space:nowrap; overflow:hidden; text-overflow:ellipsis; }
+  .sv-device { font-size:11px; color:var(--muted-2); margin-top:2px; white-space:nowrap; overflow:hidden; text-overflow:ellipsis; }
+  .sv-copy { padding:2px 16px 0; font-size:12px; line-height:1.5; color:var(--muted); }
+  .sv-actions { margin:14px 12px 0; }
+  /* armed sign-out: the same flat menu row, flipped to the danger ink */
+  .oa-item.sv-signout-armed { color:#b4332a; }
+  .oa-item.sv-signout-armed:hover { background:rgba(180,51,42,.07); }
+  .oa-item.sv-signout-armed:active { background:rgba(180,51,42,.12); }
+  /* inline pairing-code entry: mono, tracked, uppercase — the code is the content */
+  .sv-pair { display:flex; gap:8px; margin:12px 16px 0; align-items:center; }
+  .sv-code {
+    flex:1 1 auto; min-width:0; appearance:none;
+    border:1px solid rgba(31,26,23,.14); border-radius:9px; padding:8px 11px;
+    font-family:var(--mono); font-size:13px; letter-spacing:.14em; text-transform:uppercase;
+    color:var(--ink); background:#fff; outline:none;
+    transition:border-color .15s var(--settle), box-shadow .15s var(--settle);
+  }
+  .sv-code::placeholder { font-family:var(--sans); letter-spacing:0; text-transform:none; color:var(--muted-3); }
+  .sv-code:focus { border-color:rgba(48,85,102,.42); box-shadow:0 0 0 3px rgba(48,85,102,.08); }
+  .sv-connect {
+    flex:0 0 auto; appearance:none; border:0; background:var(--accent); color:#fff;
+    font-family:var(--sans); font-size:12.5px; font-weight:600; padding:8px 15px; border-radius:9px;
+    cursor:pointer; transition:opacity .2s var(--settle);
+  }
+  .sv-connect:hover { opacity:.9; }
+  .sv-connect:disabled { opacity:.4; cursor:default; }
+  .sv-hint { padding:7px 16px 0; font-size:11px; line-height:1.45; color:var(--muted-2); }
+  .sv-err { margin-top:8px; padding:0 16px; }
+  .sv-note { padding:10px 16px 0; font-size:11.5px; color:#1a7f37; line-height:1.4; }
+  .sv-version { padding:20px 16px 12px; font-family:var(--mono); font-size:10.5px; color:var(--muted-3); }
+  /* signed-out call-to-action on the Relays empty state — quiet filled pill (th-count language) */
+  .sv-signin-banner {
+    appearance:none; border:0; cursor:pointer; margin-top:2px;
+    font-family:var(--sans); font-size:12px; font-weight:600; letter-spacing:.01em;
+    color:var(--accent); background:color-mix(in srgb, var(--accent) 9%, transparent);
+    box-shadow:inset 0 0 0 0.5px color-mix(in srgb, var(--accent) 14%, transparent);
+    border-radius:999px; padding:7px 15px;
+    transition:background-color .2s var(--settle);
+  }
+  .sv-signin-banner:hover { background:color-mix(in srgb, var(--accent) 15%, transparent); }
 </style>
 </head>
 <body>
@@ -684,6 +740,7 @@
       </button>
       <button class="tab" type="button" data-view="sent">Sent</button>
       <button class="tab" type="button" data-view="contacts">Contacts</button>
+      <button class="tab" type="button" data-view="settings">Settings</button>
       <button class="mark-all-read gone" id="markAllRead" type="button">Mark all as read</button>
     </nav>
 
@@ -697,6 +754,7 @@
           </svg>
           <div class="t1">No relays yet</div>
           <div class="t2">Questions, results, and notices will land here.</div>
+          <button class="sv-signin-banner gone" id="signInBanner" type="button">Sign in to Relay</button>
         </div>
       </section>
 
@@ -767,6 +825,9 @@
         <div class="cv-list" id="cvList"></div>
         <div id="contactsEmpty" class="cv-empty gone">No contacts yet.<br>Add someone, or your agent saves them as you relay.</div>
       </section>
+
+      <!-- Settings view (account card + sign-out / switch-account; rendered by JS) -->
+      <section class="view hidden" id="settingsView"></section>
     </div>
   </div>
 
@@ -811,6 +872,8 @@
   const thBackEl = document.getElementById("thBack");
   const thDetailNameEl = document.getElementById("thDetailName");
   const thHistoryEl = document.getElementById("thHistory");
+  const settingsViewEl = document.getElementById("settingsView");
+  const signInBannerEl = document.getElementById("signInBanner");
 
   const REDUCED = window.matchMedia("(prefers-reduced-motion: reduce)").matches;
   const EXPANDED = { w: 344, h: 524 };
@@ -2582,6 +2645,201 @@
     applyView();
   }
 
+  // ---------- Settings view ----------
+  // The account card + sign-out / switch-account lifecycle. Renders from its own
+  // relay:accountInfo load (like Contacts), never from inbox pushes, so a typed
+  // pairing code is never rebuilt away mid-entry. Switch/sign-out succeed by
+  // RESTARTING the pill into the new account, so the success note is brief.
+  let settingsInfo = null;      // last relay:accountInfo payload (null while loading)
+  let settingsLoadSeq = 0;
+  let svPairOpen = false;       // inline code-entry row revealed
+  let svDraft = "";             // pairing-code text preserved across re-renders
+  let svBusy = false;           // pair / sign-out in flight
+  let svNote = "";              // success note while the pill restarts
+  let svError = "";
+  let svSignOutArmed = false;
+  let svSignOutTimer = null;
+  let svFocusCodeOnce = false;
+
+  function resetSignOutArm() {
+    svSignOutArmed = false;
+    if (svSignOutTimer) { clearTimeout(svSignOutTimer); svSignOutTimer = null; }
+  }
+  function svPairRowHtml() {
+    return `
+      <div class="sv-pair" data-stop="1">
+        <input class="sv-code" id="svCode" type="text" inputmode="text" autocomplete="off" spellcheck="false"
+          maxlength="16" placeholder="Pairing code" value="${esc(svDraft)}" ${svBusy ? "disabled" : ""} />
+        <button class="sv-connect" type="button" id="svConnect" ${svBusy ? "disabled" : ""}>${svBusy ? "Connecting…" : "Connect"}</button>
+      </div>
+      <div class="sv-hint">Your browser opened the Relay setup page — paste the pairing code it shows.</div>`;
+  }
+  function renderSettings() {
+    if (activeView !== "settings") return;
+    const info = settingsInfo;
+    if (!info) {
+      settingsViewEl.innerHTML = '<div class="td-quiet">Loading account…</div>';
+      return;
+    }
+    let html = "";
+    if (info.paired) {
+      const name = info.name || info.email || "Relay account";
+      html += `
+        <div class="sv-head"><span class="sv-title">Your account.</span></div>
+        <div class="sv-account">
+          <span class="sv-avatar">${esc(cvInitials(info.name, info.email))}</span>
+          <span class="sv-id">
+            <span class="sv-name">${esc(name)}</span>
+            ${info.email ? `<span class="sv-email">${esc(info.email)}</span>` : ""}
+            <span class="sv-device">This device · ${esc(info.deviceName || "")}</span>
+          </span>
+        </div>
+        <div class="open-actions sv-actions" data-stop="1" role="menu">
+          <button class="oa-item oa-primary" type="button" role="menuitem" id="svSwitch" ${svBusy ? "disabled" : ""}>Switch Account…</button>
+          <div class="oa-sep" role="separator"></div>
+          <button class="oa-item${svSignOutArmed ? " sv-signout-armed" : ""}" type="button" role="menuitem" id="svSignOut" ${svBusy ? "disabled" : ""}>${svSignOutArmed ? "Sign Out — click again to confirm" : "Sign Out"}</button>
+        </div>`;
+    } else {
+      html += `
+        <div class="sv-head"><span class="sv-title">Sign in to Relay.</span></div>
+        <div class="sv-copy">This device isn’t connected to an account yet. Sign in from your browser, then enter the pairing code here.</div>
+        <div class="open-actions sv-actions" data-stop="1" role="menu">
+          <button class="oa-item oa-primary" type="button" role="menuitem" id="svSwitch" ${svBusy ? "disabled" : ""}>Sign In to Relay</button>
+        </div>`;
+    }
+    if (svPairOpen) html += svPairRowHtml();
+    if (svNote) html += `<div class="sv-note">${esc(svNote)}</div>`;
+    html += `<div class="row-err sv-err" id="svErr">${esc(svError)}</div>`;
+    html += `<div class="sv-version">${esc(info.version ? `Relay ${info.version}` : "Relay")}</div>`;
+    settingsViewEl.innerHTML = html;
+    wireSettings();
+  }
+  function wireSettings() {
+    for (const z of settingsViewEl.querySelectorAll('[data-stop="1"]')) {
+      z.addEventListener("click", (e) => e.stopPropagation());
+    }
+    const switchEl = document.getElementById("svSwitch");
+    if (switchEl) switchEl.addEventListener("click", beginPairFlow);
+    const signOutEl = document.getElementById("svSignOut");
+    if (signOutEl) signOutEl.addEventListener("click", onSignOutClick);
+    const connectEl = document.getElementById("svConnect");
+    if (connectEl) connectEl.addEventListener("click", submitPairCode);
+    const codeEl = document.getElementById("svCode");
+    if (codeEl) {
+      // Same focusability contract as the contact form / quick reply: the window
+      // may take keyboard focus only while a text field needs it.
+      codeEl.addEventListener("focus", () => { if (window.relay.setFocusable) window.relay.setFocusable(true); });
+      codeEl.addEventListener("blur", () => { if (activeView !== "contacts" && window.relay.setFocusable) window.relay.setFocusable(false); });
+      codeEl.addEventListener("mousedown", () => setInteractive(true));
+      codeEl.addEventListener("input", () => {
+        svDraft = codeEl.value;
+        svError = "";
+        const errEl = document.getElementById("svErr");
+        if (errEl) errEl.textContent = ""; // clear inline, no rebuild mid-typing
+      });
+      codeEl.addEventListener("keydown", (ev) => {
+        if (ev.key === "Enter") { ev.preventDefault(); submitPairCode(); }
+      });
+      if (svFocusCodeOnce) {
+        svFocusCodeOnce = false;
+        if (window.relay.setFocusable) window.relay.setFocusable(true);
+        setTimeout(() => codeEl.focus(), 30);
+      }
+    }
+  }
+  // Switch account / sign in: open the pairing page in the browser and reveal
+  // the inline code-entry row in the same motion.
+  function beginPairFlow() {
+    if (svBusy) return;
+    resetSignOutArm();
+    svError = "";
+    svNote = "";
+    svPairOpen = true;
+    svFocusCodeOnce = true;
+    if (window.relay.openUrl) window.relay.openUrl((settingsInfo && settingsInfo.setupPath) || "/app/setup");
+    renderSettings();
+  }
+  async function submitPairCode() {
+    if (svBusy) return;
+    const codeEl = document.getElementById("svCode");
+    const code = (codeEl ? codeEl.value : svDraft).trim();
+    if (!code) {
+      svError = "Enter the pairing code from your browser.";
+      renderSettings();
+      return;
+    }
+    svBusy = true;
+    svError = "";
+    renderSettings();
+    let res = null;
+    try {
+      res = await window.relay.pairWithCode({ code });
+    } catch (err) {
+      res = { ok: false, error: (err && err.message) || "Could not connect this device." };
+    }
+    svBusy = false;
+    if (res && res.ok) {
+      svDraft = "";
+      svPairOpen = false;
+      svNote = res.email ? `Connected as ${res.email} — restarting Relay…` : "Connected — restarting Relay…";
+    } else {
+      svError = (res && res.error) || "Could not connect this device.";
+    }
+    renderSettings();
+  }
+  // Sign out is destructive-ish (this device stops receiving relays), so the
+  // button arms on the first click and only a second click within 4s commits.
+  async function onSignOutClick() {
+    if (svBusy) return;
+    if (!svSignOutArmed) {
+      svSignOutArmed = true;
+      if (svSignOutTimer) clearTimeout(svSignOutTimer);
+      svSignOutTimer = setTimeout(() => {
+        svSignOutTimer = null;
+        svSignOutArmed = false;
+        renderSettings();
+      }, 4000);
+      renderSettings();
+      return;
+    }
+    resetSignOutArm();
+    svBusy = true;
+    svError = "";
+    svNote = "";
+    renderSettings();
+    let res = null;
+    try {
+      res = await window.relay.signOut();
+    } catch (err) {
+      res = { ok: false, error: (err && err.message) || "Could not sign out." };
+    }
+    svBusy = false;
+    if (res && res.ok) svNote = "Signed out — restarting Relay…";
+    else svError = (res && res.error) || "Could not sign out.";
+    renderSettings();
+  }
+  async function loadSettings() {
+    const seq = ++settingsLoadSeq;
+    let info = null;
+    try {
+      info = window.relay.accountInfo ? await window.relay.accountInfo() : null;
+    } catch {}
+    if (seq !== settingsLoadSeq) return; // navigated / reloaded while fetching
+    const prevSig = JSON.stringify(settingsInfo);
+    settingsInfo = info && info.ok !== false ? info : { paired: false, name: "", email: "", deviceName: "", version: "" };
+    // Unchanged info: leave the DOM alone so a focused code input (and its
+    // caret) survives the refresh that happens on every visit to the tab.
+    if (JSON.stringify(settingsInfo) !== prevSig) renderSettings();
+  }
+  if (signInBannerEl) signInBannerEl.addEventListener("click", (e) => {
+    e.stopPropagation();
+    activeView = "settings";
+    syncTabs();
+    applyView();
+    renderAll();
+    beginPairFlow(); // the banner IS the sign-in affordance: browser + code row
+  });
+
   // ---------- views / tabs ----------
   function syncTabs() {
     // taskDetail belongs to Sent; the thread-detail view belongs to Relays —
@@ -2595,6 +2853,13 @@
     sentViewEl.classList.toggle("hidden", activeView !== "sent");
     taskDetailViewEl.classList.toggle("hidden", activeView !== "taskDetail");
     contactsViewEl.classList.toggle("hidden", activeView !== "contacts");
+    settingsViewEl.classList.toggle("hidden", activeView !== "settings");
+    if (activeView === "settings") {
+      renderSettings(); // paint immediately from the last known info…
+      loadSettings();   // …then refresh it from config
+    } else {
+      resetSignOutArm(); // leaving the view disarms the confirm state
+    }
     if (activeView === "threads") {
       // Entered only by clicking a conversation row (threadDetailId set there).
       renderThreads();
@@ -2630,6 +2895,10 @@
 
   function renderAll() {
     syncDismissControl();
+    // Signed out: the Relays empty state carries a slim sign-in affordance.
+    if (signInBannerEl) {
+      signInBannerEl.classList.toggle("gone", !payload.account || payload.account.paired !== false);
+    }
     // Relays badge/count reflect only the items that show in the Relays tab
     // (the clean split keeps task_request / share_approval out of this count).
     const unread = (payload.relays || []).filter((r) => r.unread && isRelayListKind(r)).length;

package/overlay/main.cjs

@@ -228,6 +228,24 @@ function loadRelayModules() {
   return relayModulesPromise;
 }
 
+// Account lifecycle deps (ESM, lazy like the modules above): src/account.js is
+// the shared pair/sign-out config persistence, src/notifications.js owns the
+// packet-store reset that re-stages the new account's inbox cleanly.
+let accountModulesPromise = null;
+function loadAccountModules() {
+  if (!accountModulesPromise) {
+    const accountUrl = pathToFileURL(path.join(__dirname, "..", "src", "account.js")).href;
+    const notificationsUrl = pathToFileURL(path.join(__dirname, "..", "src", "notifications.js")).href;
+    accountModulesPromise = Promise.all([import(accountUrl), import(notificationsUrl)])
+      .then(([account, notifications]) => ({ account, notifications }))
+      .catch((error) => {
+        accountModulesPromise = null;
+        throw error;
+      });
+  }
+  return accountModulesPromise;
+}
+
 let sentStagerPromise = null;
 function loadSentStager() {
   if (!sentStagerPromise) {
@@ -332,6 +350,118 @@ function account() {
   };
 }
 
+function pillVersion() {
+  try {
+    return String(require("../package.json").version || "");
+  } catch {
+    return "";
+  }
+}
+
+// The Settings account card: who this pill is signed in as, on which device,
+// running which build. deviceName is remembered from pairing when available.
+function accountInfo() {
+  const cfg = readConfigFile();
+  const user = cfg.user || {};
+  return {
+    ok: true,
+    paired: Boolean(deviceToken()),
+    name: user.name || "",
+    email: user.email || "",
+    deviceName: String(cfg.deviceName || "").trim() || os.hostname(),
+    version: pillVersion(),
+    setupPath: "/app/setup",
+  };
+}
+
+// After an account change the daemon must restart into the new credentials, or
+// it keeps polling (and staging) as the OLD account until its next launch.
+function restartCompanionDaemon() {
+  try {
+    let cmd = null;
+    let args = null;
+    if (process.platform === "darwin") {
+      const uid = typeof process.getuid === "function" ? process.getuid() : 501;
+      cmd = "/bin/launchctl";
+      args = ["kickstart", "-k", `gui/${uid}/work.relay.companion`];
+    } else if (process.platform === "win32") {
+      cmd = "cmd";
+      args = ["/c", 'schtasks /End /TN "Relay Companion Daemon" & schtasks /Run /TN "Relay Companion Daemon"'];
+    }
+    if (!cmd) return;
+    const child = spawn(cmd, args, { detached: true, stdio: "ignore" });
+    child.on("error", (error) => console.error("[overlay] daemon restart spawn failed:", error && error.message));
+    child.unref();
+  } catch (error) {
+    console.error("[overlay] daemon restart failed:", error && error.message);
+  }
+}
+
+// Relaunch the pill itself so every cache (sent, contacts, attention queue,
+// renderer state) is rebuilt from the new account. launchd / the Scheduled Task
+// respawns it; app.relaunch() covers a bare `relay pill` run. Delayed a beat so
+// the invoking IPC reply reaches the renderer first.
+function relaunchPillSoon() {
+  setTimeout(() => {
+    try {
+      app.relaunch();
+    } catch (error) {
+      console.error("[overlay] relaunch failed:", error && error.message);
+    }
+    app.exit(0);
+  }, 600);
+}
+
+// Switch account: register this device against the pairing code, persist the
+// fresh credentials with the SAME shape `relay pair` writes, wipe the local
+// packet store for the new account, then restart the daemon and the pill.
+async function pairWithCode(input) {
+  try {
+    const raw = input && typeof input === "object" ? input.code : input;
+    const [{ account: accountMod, notifications }, { RelayClient }] = await Promise.all([
+      loadAccountModules(),
+      loadRelayModules(),
+    ]);
+    const code = accountMod.normalizePairingCode(raw);
+    if (!code) return { ok: false, error: "Enter the pairing code from your browser." };
+    const deviceName = accountMod.deviceNameForPairing(readConfigFile());
+    const client = new RelayClient();
+    const res = await client.registerDevice({ pairingCode: code, name: deviceName, platform: process.platform });
+    accountMod.persistPairedAccount({ deviceName, registration: res });
+    notifications.resetCompanionStateForAccount(
+      { user: res.user, deviceId: res.deviceId, force: true },
+      { statePath: STATE_PATH },
+    );
+    restartCompanionDaemon();
+    relaunchPillSoon();
+    return { ok: true, email: (res.user && res.user.email) || "" };
+  } catch (error) {
+    const message = error && error.message ? error.message : String(error);
+    console.error("[overlay] pair with code failed:", message);
+    return { ok: false, error: message };
+  }
+}
+
+// Sign out: drop the credentials (keeping URLs + device name), wipe the local
+// packet store, then restart the daemon and the pill into the signed-out state.
+async function signOutAccount() {
+  try {
+    const { account: accountMod, notifications } = await loadAccountModules();
+    accountMod.persistSignedOutAccount();
+    notifications.resetCompanionStateForAccount(
+      { user: null, deviceId: "", force: true },
+      { statePath: STATE_PATH },
+    );
+    restartCompanionDaemon();
+    relaunchPillSoon();
+    return { ok: true };
+  } catch (error) {
+    const message = error && error.message ? error.message : String(error);
+    console.error("[overlay] sign out failed:", message);
+    return { ok: false, error: message };
+  }
+}
+
 // Turn an actionUrl (absolute https, or a relative path) into an absolute URL.
 function absoluteUrl(pathOrUrl) {
   const value = String(pathOrUrl || "").trim();
@@ -546,6 +676,7 @@ async function markAllVisibleRelaysRead() {
 let sentCache = [];
 let sentLoadedOnce = null;
 async function refreshSent() {
+  if (!deviceToken()) return sentCache; // signed out: nothing to fetch, no 401 log storm
   try {
     const client = await relayClient();
     const res = await client.sent();
@@ -569,6 +700,7 @@ async function refreshTasks() {
     tasksCache = [];
     return tasksCache;
   }
+  if (!deviceToken()) return tasksCache; // signed out: skip the poll entirely
   try {
     const client = await relayClient();
     const res = await client.listTasks();
@@ -594,6 +726,7 @@ function ensureTasksLoaded() {
 let contactsCache = [];
 let contactsLoadedOnce = null;
 async function refreshContacts() {
+  if (!deviceToken()) return contactsCache; // signed out: skip the poll entirely
   try {
     const client = await relayClient();
     const res = await client.listContacts();
@@ -1817,6 +1950,12 @@ function openUrlTarget(url) {
     return;
   }
   const target = absoluteUrl(url);
+  // Sandboxed harness runs must never pop the user's real browser (the same
+  // contract that keeps them from launching Claude/Codex).
+  if (process.env.RELAY_OVERLAY_TEST_NO_HOST_OPEN === "1") {
+    console.error("[overlay] test seam: suppressed external open:", target);
+    return;
+  }
   shell.openExternal(target).catch((error) => console.error("[overlay] open failed:", error && error.message));
 }
 
@@ -1825,7 +1964,21 @@ function openUrlTarget(url) {
 function anchorTopRight() {
   const display = screen.getDisplayNearestPoint(screen.getCursorScreenPoint()) || screen.getPrimaryDisplay();
   const wa = display.workArea;
-  return { x: wa.x + wa.width - WIN.width - MARGIN, y: wa.y + MARGIN, width: WIN.width, height: WIN.height };
+  const anchor = { x: wa.x + wa.width - WIN.width - MARGIN, y: wa.y + MARGIN, width: WIN.width, height: WIN.height };
+  if (process.env.RELAY_OVERLAY_TEST === "1") {
+    // Sandboxed harness runs must never materialize under the user's parked
+    // cursor: a pointer resting on the card holds notifications open BY DESIGN
+    // (macOS banners do the same), which would wedge every dwell-based scenario
+    // when the mouse happens to sit in the top-right corner. Flip the sandbox
+    // window to the opposite edge instead. Production placement is unchanged.
+    try {
+      const p = screen.getCursorScreenPoint();
+      const overlaps =
+        p.x >= anchor.x && p.x < anchor.x + anchor.width && p.y >= anchor.y && p.y < anchor.y + anchor.height;
+      if (overlaps) anchor.x = wa.x + MARGIN;
+    } catch {}
+  }
+  return anchor;
 }
 
 // Show the overlay window. Electron's forwarded-mousemove stream (the thing that
@@ -1955,6 +2108,12 @@ let hitTimer = null;
 let hitIgnoring = true; // mirrors the last setIgnoreMouseEvents call
 let hitHover = false;
 let lastHostProbeAt = 0;
+// Harness seam: a sandboxed e2e run shares the screen with the user's REAL
+// mouse, and a pointer that happens to rest on the card rect legitimately
+// holds notifications open (the macOS-banner rule) — wedging every dwell-based
+// scenario. The harness drives only synthetic input, so in this mode the hit
+// test ignores the physical cursor entirely. Never set outside the harness.
+const HIT_TEST_POINTER_BLIND = process.env.RELAY_OVERLAY_TEST_IGNORE_POINTER === "1";
 
 function applyIgnore(next) {
   if (next === hitIgnoring) return;
@@ -1995,6 +2154,14 @@ function scheduleHit(ms) {
 function hitTick() {
   hitTimer = null;
   if (!win || win.isDestroyed()) return;
+  if (HIT_TEST_POINTER_BLIND) {
+    // Interactive everywhere, hover never asserted: synthetic-input runs must
+    // not have their dwell/fold behavior steered by the user's parked mouse.
+    applyIgnore(false);
+    applyHover(false);
+    scheduleHit(POLL_HIDDEN_MS);
+    return;
+  }
   if (!win.isVisible()) {
     // A hidden window must never hold clicks, and must not cost a cursor read.
     applyIgnore(true);
@@ -2415,6 +2582,11 @@ ipcMain.handle("relay:contacts", () => readContacts());
 ipcMain.handle("relay:contactSave", (_e, input) => saveContact(input));
 ipcMain.handle("relay:contactDelete", (_e, input) => deleteContactFromBook(input));
 
+// Settings tab: account card + the sign-out / switch-account lifecycle.
+ipcMain.handle("relay:accountInfo", () => accountInfo());
+ipcMain.handle("relay:pairWithCode", (_e, input) => pairWithCode(input));
+ipcMain.handle("relay:signOut", () => signOutAccount());
+
 // The overlay is normally focusable:false so it never steals keyboard focus from
 // Claude/Codex. Text fields (the contact form, quick reply) need focus, so the renderer
 // asks us to grant it while a field is open and revoke it the moment the form closes.

package/overlay/preload.cjs

@@ -46,6 +46,11 @@ contextBridge.exposeInMainWorld("relay", {
   contactSave: (input) => ipcRenderer.invoke("relay:contactSave", input),
   contactDelete: (input) => ipcRenderer.invoke("relay:contactDelete", input),
 
+  // settings / account (switch + sign-out relaunch the pill on success)
+  accountInfo: () => ipcRenderer.invoke("relay:accountInfo"),
+  pairWithCode: (input) => ipcRenderer.invoke("relay:pairWithCode", input),
+  signOut: () => ipcRenderer.invoke("relay:signOut"),
+
 
   // window plumbing
   setFocusable: (v) => ipcRenderer.send("relay:setFocusable", v),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "relay-companion",
-  "version": "0.1.71",
+  "version": "0.1.72",
   "description": "Relay companion for ordinary messages, with dormant coordination features available only by explicit opt-in.",
   "type": "module",
   "bin": {

package/src/account.js

@@ -0,0 +1,65 @@
+import os from "node:os";
+import { readConfig, writeConfigObject } from "./config.js";
+
+/**
+ * Account lifecycle for the companion: the ONE config-write shape shared by
+ * `relay pair` (bin/relay.js cmdPair) and the pill's Settings tab, so switching
+ * accounts from either surface persists identical credentials. The pure shapes
+ * are exported separately from the fs-touching persist helpers for unit tests.
+ */
+
+/**
+ * Pairing codes are 8 chars from an unambiguous uppercase alphabet
+ * (services/devices.ts). The server only trims + uppercases, so typed
+ * "abcd-efgh" / "ABCD EFGH" variants are folded here before the request.
+ */
+export function normalizePairingCode(raw) {
+  return String(raw ?? "")
+    .replace(/[\s-]+/g, "")
+    .toUpperCase();
+}
+
+/** The device name a re-pair should register: the remembered one, else the hostname. */
+export function deviceNameForPairing(config = readConfig()) {
+  const stored = String((config && config.deviceName) || "").trim();
+  return stored || os.hostname();
+}
+
+/**
+ * The post-registration config: everything the old config had, plus the fresh
+ * credentials. apiUrl/webUrl/deviceName are only written when explicitly given
+ * (the pill switches accounts without touching the URLs it was launched with).
+ */
+export function pairedAccountConfig(existing, { apiUrl, webUrl, deviceName, registration } = {}) {
+  const res = registration || {};
+  return {
+    ...(existing || {}),
+    ...(apiUrl ? { apiUrl } : {}),
+    ...(webUrl ? { webUrl } : {}),
+    ...(deviceName ? { deviceName } : {}),
+    deviceToken: res.deviceToken || "",
+    deviceId: res.deviceId || "",
+    user: res.user || null,
+  };
+}
+
+/**
+ * Sign-out clears the credential set — user, deviceToken, and the deviceId that
+ * belongs to that token — while preserving apiUrl/webUrl, the device name, the
+ * companion mode, and any other settings on the file.
+ */
+export function signedOutAccountConfig(existing) {
+  const next = { ...(existing || {}) };
+  delete next.user;
+  delete next.deviceToken;
+  delete next.deviceId;
+  return next;
+}
+
+export function persistPairedAccount({ apiUrl, webUrl, deviceName, registration } = {}) {
+  return writeConfigObject(pairedAccountConfig(readConfig(), { apiUrl, webUrl, deviceName, registration }));
+}
+
+export function persistSignedOutAccount() {
+  return writeConfigObject(signedOutAccountConfig(readConfig()));
+}

package/src/config.js

@@ -23,7 +23,9 @@ export function configDir() {
 }
 
 export function configPath() {
-  return path.join(configDir(), "config.json");
+  // RELAY_CONFIG (a full file path) matches the overlay's readConfigFile
+  // resolution, so a sandboxed pill and these helpers agree on ONE file.
+  return process.env.RELAY_CONFIG || path.join(configDir(), "config.json");
 }
 
 export function readConfig() {
@@ -51,19 +53,25 @@ export function readConfig() {
   }
 }
 
-export function writeConfig(patch) {
-  const dir = configDir();
-  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-  const next = { ...readConfig(), ...patch };
+/**
+ * Replace config.json with exactly `next` (no merge). This is the primitive that
+ * lets sign-out REMOVE keys — writeConfig's patch merge can only add or overwrite.
+ */
+export function writeConfigObject(next) {
+  const file = configPath();
+  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
   // Atomic write: a crash mid-write must not truncate config.json and wipe the
   // device token (which would put the daemon into a launchd crash loop).
-  const file = configPath();
   const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
   fs.writeFileSync(tmp, JSON.stringify(next, null, 2), { mode: 0o600 });
   fs.renameSync(tmp, file);
   return next;
 }
 
+export function writeConfig(patch) {
+  return writeConfigObject({ ...readConfig(), ...patch });
+}
+
 export function apiUrl() {
   return (
     process.env.RELAY_API_URL ||