remote-codex 0.11.22 → 0.11.24

package/apps/relay-server/dist/index.js

@@ -183,7 +183,7 @@ var RelayStore = class _RelayStore {
     if (!device || device.ownerUserId !== ownerUserId) {
       throw new RelayStoreError(404, "not_found", "Device was not found.");
     }
-    const target = this.getUserByUsername(input.targetUsername);
+    const target = this.getUserByIdentifier(input.targetIdentifier);
     if (!target || !target.enabled) {
       throw new RelayStoreError(404, "not_found", "Target user was not found.");
     }
@@ -203,7 +203,13 @@ var RelayStore = class _RelayStore {
       ).get(ownerUserId, target.id, input.deviceId, input.threadId)
     );
     if (existing) {
-      return existing;
+      return this.updateShareRecord(existing.id, {
+        label: input.label?.trim() || null,
+        workspaceId: input.workspaceId?.trim() || null,
+        threadAccess: normalizeThreadAccess(input.threadAccess),
+        workspaceAccess: normalizeWorkspaceAccess(input.workspaceAccess),
+        expiresAt: normalizeExpiresAt(input.expiresAt)
+      });
     }
     const share = {
       id: crypto.randomUUID(),
@@ -214,13 +220,37 @@ var RelayStore = class _RelayStore {
       deviceId: input.deviceId,
       deviceName: device.name,
       threadId: input.threadId,
+      workspaceId: input.workspaceId?.trim() || null,
       label: input.label?.trim() || null,
+      threadAccess: normalizeThreadAccess(input.threadAccess),
+      workspaceAccess: normalizeWorkspaceAccess(input.workspaceAccess),
       createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-      revokedAt: null
+      revokedAt: null,
+      expiresAt: normalizeExpiresAt(input.expiresAt),
+      lastAccessedAt: null,
+      lastAccessedByUsername: null,
+      accessEvents: []
     };
     this.insertShare(share);
     return share;
   }
+  updateShare(userId, shareId, input) {
+    const share = this.rowToShare(
+      this.sqlite.prepare("SELECT * FROM relay_shares WHERE id = ? AND owner_user_id = ? AND revoked_at IS NULL").get(shareId, userId)
+    );
+    if (!share) {
+      throw new RelayStoreError(404, "not_found", "Share was not found.");
+    }
+    return this.publicShare(
+      this.updateShareRecord(shareId, {
+        label: input.label !== void 0 ? input.label?.trim() || null : share.label,
+        workspaceId: input.workspaceId !== void 0 ? input.workspaceId?.trim() || null : share.workspaceId,
+        threadAccess: input.threadAccess !== void 0 ? normalizeThreadAccess(input.threadAccess) : share.threadAccess,
+        workspaceAccess: input.workspaceAccess !== void 0 ? normalizeWorkspaceAccess(input.workspaceAccess) : share.workspaceAccess,
+        expiresAt: input.expiresAt !== void 0 ? normalizeExpiresAt(input.expiresAt) : share.expiresAt
+      })
+    );
+  }
   revokeShare(userId, shareId) {
     const share = this.rowToShare(
       this.sqlite.prepare("SELECT * FROM relay_shares WHERE id = ? AND owner_user_id = ?").get(shareId, userId)
@@ -232,24 +262,83 @@ var RelayStore = class _RelayStore {
     this.sqlite.prepare("UPDATE relay_shares SET revoked_at = ? WHERE id = ?").run(revokedAt, shareId);
     return { ...share, revokedAt };
   }
-  canAccessDevice(userId, deviceId, threadId) {
+  effectiveAccess(userId, deviceId, scope = {}) {
     const owned = this.sqlite.prepare("SELECT 1 FROM relay_devices WHERE id = ? AND owner_user_id = ?").get(deviceId, userId);
     if (owned) {
-      return true;
-    }
-    if (!threadId) {
-      return false;
+      return {
+        kind: "owner",
+        share: null,
+        threadAccess: "control",
+        workspaceAccess: "write",
+        workspaceId: null
+      };
+    }
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    if (scope.threadId) {
+      const share = this.rowToShare(
+        this.sqlite.prepare(
+          `
+              SELECT * FROM relay_shares
+              WHERE target_user_id = ?
+                AND device_id = ?
+                AND thread_id = ?
+                AND revoked_at IS NULL
+                AND (expires_at IS NULL OR expires_at > ?)
+              ORDER BY created_at DESC
+              LIMIT 1
+            `
+        ).get(userId, deviceId, scope.threadId, now)
+      );
+      if (!share) {
+        return null;
+      }
+      if (scope.workspaceId && (!share.workspaceId || share.workspaceId !== scope.workspaceId || share.workspaceAccess === "none")) {
+        return null;
+      }
+      return {
+        kind: "shared",
+        share,
+        threadAccess: share.threadAccess,
+        workspaceAccess: share.workspaceAccess,
+        workspaceId: share.workspaceId
+      };
+    }
+    if (scope.workspaceId) {
+      const share = this.rowToShare(
+        this.sqlite.prepare(
+          `
+              SELECT * FROM relay_shares
+              WHERE target_user_id = ?
+                AND device_id = ?
+                AND workspace_id = ?
+                AND workspace_access <> 'none'
+                AND revoked_at IS NULL
+                AND (expires_at IS NULL OR expires_at > ?)
+              ORDER BY
+                CASE workspace_access WHEN 'write' THEN 2 WHEN 'read' THEN 1 ELSE 0 END DESC,
+                created_at DESC
+              LIMIT 1
+            `
+        ).get(userId, deviceId, scope.workspaceId, now)
+      );
+      if (!share) {
+        return null;
+      }
+      return {
+        kind: "shared",
+        share,
+        threadAccess: share.threadAccess,
+        workspaceAccess: share.workspaceAccess,
+        workspaceId: share.workspaceId
+      };
     }
+    return null;
+  }
+  canAccessDevice(userId, deviceId, threadId) {
     return Boolean(
-      this.sqlite.prepare(
-        `
-            SELECT 1 FROM relay_shares
-            WHERE target_user_id = ?
-              AND device_id = ?
-              AND thread_id = ?
-              AND revoked_at IS NULL
-          `
-      ).get(userId, deviceId, threadId)
+      this.effectiveAccess(userId, deviceId, {
+        threadId: threadId ?? null
+      })
     );
   }
   portalSummary(userId, connectedDevices) {
@@ -335,15 +424,33 @@ var RelayStore = class _RelayStore {
       createdAt: device.createdAt
     };
   }
+  recordShareAccess(share, user) {
+    if (share.revokedAt || share.expiresAt && share.expiresAt <= (/* @__PURE__ */ new Date()).toISOString()) {
+      return;
+    }
+    const accessedAt = (/* @__PURE__ */ new Date()).toISOString();
+    this.sqlite.prepare(
+      `
+          INSERT INTO relay_share_access_events (
+            id, share_id, user_id, username, accessed_at
+          ) VALUES (?, ?, ?, ?, ?)
+        `
+    ).run(crypto.randomUUID(), share.id, user.id, user.username, accessedAt);
+  }
   publicShare(share) {
     const owner = this.getUser(share.ownerUserId);
     const target = this.getUser(share.targetUserId);
     const device = this.getDevice(share.deviceId);
+    const accessEvents = this.getShareAccessEvents(share.id);
+    const lastAccess = accessEvents[0] ?? null;
     return {
       ...share,
       ownerUsername: share.ownerUsername ?? owner?.username ?? "unknown",
       targetUsername: share.targetUsername ?? target?.username ?? "unknown",
-      deviceName: share.deviceName ?? device?.name ?? "Remote Codex device"
+      deviceName: share.deviceName ?? device?.name ?? "Remote Codex device",
+      lastAccessedAt: lastAccess?.accessedAt ?? null,
+      lastAccessedByUsername: lastAccess?.username ?? null,
+      accessEvents
     };
   }
   migrate() {
@@ -385,16 +492,34 @@ var RelayStore = class _RelayStore {
         device_id TEXT NOT NULL REFERENCES relay_devices(id) ON DELETE CASCADE,
         device_name TEXT,
         thread_id TEXT NOT NULL,
+        workspace_id TEXT,
         label TEXT,
+        thread_access TEXT NOT NULL DEFAULT 'control',
+        workspace_access TEXT NOT NULL DEFAULT 'none',
         created_at TEXT NOT NULL,
-        revoked_at TEXT
+        revoked_at TEXT,
+        expires_at TEXT
       );
 
       CREATE INDEX IF NOT EXISTS relay_shares_owner_idx ON relay_shares(owner_user_id);
       CREATE INDEX IF NOT EXISTS relay_shares_target_idx ON relay_shares(target_user_id);
       CREATE INDEX IF NOT EXISTS relay_shares_device_thread_idx ON relay_shares(device_id, thread_id);
+
+      CREATE TABLE IF NOT EXISTS relay_share_access_events (
+        id TEXT PRIMARY KEY,
+        share_id TEXT NOT NULL REFERENCES relay_shares(id) ON DELETE CASCADE,
+        user_id TEXT NOT NULL REFERENCES relay_users(id) ON DELETE CASCADE,
+        username TEXT NOT NULL,
+        accessed_at TEXT NOT NULL
+      );
+
+      CREATE INDEX IF NOT EXISTS relay_share_access_events_share_idx ON relay_share_access_events(share_id, accessed_at DESC);
     `);
     this.ensureColumn("relay_devices", "token", "TEXT");
+    this.ensureColumn("relay_shares", "workspace_id", "TEXT");
+    this.ensureColumn("relay_shares", "thread_access", "TEXT NOT NULL DEFAULT 'control'");
+    this.ensureColumn("relay_shares", "workspace_access", "TEXT NOT NULL DEFAULT 'none'");
+    this.ensureColumn("relay_shares", "expires_at", "TEXT");
   }
   ensureColumn(table, column, definition) {
     const columns = this.sqlite.prepare(`PRAGMA table_info(${table})`).all();
@@ -573,8 +698,9 @@ var RelayStore = class _RelayStore {
       `
           INSERT INTO relay_shares (
             id, owner_user_id, owner_username, target_user_id, target_username,
-            device_id, device_name, thread_id, label, created_at, revoked_at
-          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+            device_id, device_name, thread_id, workspace_id, label,
+            thread_access, workspace_access, created_at, revoked_at, expires_at
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
         `
     ).run(
       share.id,
@@ -585,9 +711,52 @@ var RelayStore = class _RelayStore {
       share.deviceId,
       share.deviceName,
       share.threadId,
+      share.workspaceId,
       share.label,
+      share.threadAccess,
+      share.workspaceAccess,
       share.createdAt,
-      share.revokedAt
+      share.revokedAt,
+      share.expiresAt
+    );
+  }
+  getShareAccessEvents(shareId) {
+    return this.sqlite.prepare(
+      `
+            SELECT * FROM relay_share_access_events
+            WHERE share_id = ?
+            ORDER BY accessed_at DESC
+            LIMIT 8
+          `
+    ).all(shareId).map((row) => ({
+      id: row.id,
+      shareId: row.share_id,
+      userId: row.user_id,
+      username: row.username,
+      accessedAt: row.accessed_at
+    }));
+  }
+  updateShareRecord(shareId, input) {
+    this.sqlite.prepare(
+      `
+          UPDATE relay_shares
+          SET label = ?,
+              workspace_id = ?,
+              thread_access = ?,
+              workspace_access = ?,
+              expires_at = ?
+          WHERE id = ?
+        `
+    ).run(
+      input.label,
+      input.workspaceId,
+      input.threadAccess,
+      input.workspaceAccess,
+      input.expiresAt,
+      shareId
+    );
+    return this.rowToShare(
+      this.sqlite.prepare("SELECT * FROM relay_shares WHERE id = ?").get(shareId)
     );
   }
   getUser(id) {
@@ -616,10 +785,10 @@ var RelayStore = class _RelayStore {
     return this.sqlite.prepare("SELECT * FROM relay_devices WHERE owner_user_id = ? ORDER BY created_at ASC").all(ownerUserId).map((row) => this.rowToDevice(row)).filter((device) => Boolean(device));
   }
   getSharesByOwner(ownerUserId) {
-    return this.sqlite.prepare("SELECT * FROM relay_shares WHERE owner_user_id = ? AND revoked_at IS NULL ORDER BY created_at ASC").all(ownerUserId).map((row) => this.rowToShare(row)).filter((share) => Boolean(share));
+    return this.sqlite.prepare("SELECT * FROM relay_shares WHERE owner_user_id = ? AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > ?) ORDER BY created_at ASC").all(ownerUserId, (/* @__PURE__ */ new Date()).toISOString()).map((row) => this.rowToShare(row)).filter((share) => Boolean(share));
   }
   getSharesByTarget(targetUserId) {
-    return this.sqlite.prepare("SELECT * FROM relay_shares WHERE target_user_id = ? AND revoked_at IS NULL ORDER BY created_at ASC").all(targetUserId).map((row) => this.rowToShare(row)).filter((share) => Boolean(share));
+    return this.sqlite.prepare("SELECT * FROM relay_shares WHERE target_user_id = ? AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > ?) ORDER BY created_at ASC").all(targetUserId, (/* @__PURE__ */ new Date()).toISOString()).map((row) => this.rowToShare(row)).filter((share) => Boolean(share));
   }
   rowToUser(row) {
     if (!row) return null;
@@ -657,9 +826,16 @@ var RelayStore = class _RelayStore {
       deviceId: row.device_id,
       deviceName: row.device_name ?? "Remote Codex device",
       threadId: row.thread_id,
+      workspaceId: row.workspace_id ?? null,
       label: row.label,
+      threadAccess: normalizeThreadAccess(row.thread_access),
+      workspaceAccess: normalizeWorkspaceAccess(row.workspace_access),
       createdAt: row.created_at,
-      revokedAt: row.revoked_at
+      revokedAt: row.revoked_at,
+      expiresAt: row.expires_at ?? null,
+      lastAccessedAt: null,
+      lastAccessedByUsername: null,
+      accessEvents: []
     };
   }
 };
@@ -675,6 +851,22 @@ var RelayStoreError = class extends Error {
 function normalizeUsername(value) {
   return value.trim().toLowerCase().replace(/[^a-z0-9_-]/g, "");
 }
+function normalizeThreadAccess(value) {
+  return value === "read" ? "read" : "control";
+}
+function normalizeWorkspaceAccess(value) {
+  if (value === "read" || value === "write") {
+    return value;
+  }
+  return "none";
+}
+function normalizeExpiresAt(value) {
+  if (!value) {
+    return null;
+  }
+  const timestamp = Date.parse(value);
+  return Number.isNaN(timestamp) ? null : new Date(timestamp).toISOString();
+}
 function hashSecret(secret, salt) {
   return crypto.scryptSync(secret, salt, 32).toString("base64url");
 }
@@ -700,7 +892,8 @@ function safeEqual(left, right) {
 var RELAY_REQUEST_TIMEOUT_MS = 3e4;
 var WEBSOCKET_OPEN = 1;
 var RELAY_COOKIE_NAME = "remote_codex_relay_session";
-var THREAD_SHARED_HTTP_METHODS = /* @__PURE__ */ new Set(["GET", "POST", "PATCH"]);
+var threadAccessSchema = z.enum(["read", "control"]);
+var workspaceAccessSchema = z.enum(["none", "read", "write"]);
 var loginSchema = z.object({
   identifier: z.string().trim().min(1),
   password: z.string().min(1)
@@ -715,10 +908,25 @@ var createDeviceSchema = z.object({
   name: z.string().trim().min(1).max(120)
 });
 var createShareSchema = z.object({
-  targetUsername: z.string().trim().min(3),
+  targetIdentifier: z.string().trim().min(1).optional(),
+  targetUsername: z.string().trim().min(3).optional(),
   deviceId: z.string().uuid(),
   threadId: z.string().trim().min(1),
-  label: z.string().trim().min(1).max(160).optional()
+  workspaceId: z.string().uuid().nullable().optional(),
+  label: z.string().trim().min(1).max(160).nullable().optional(),
+  threadAccess: threadAccessSchema.default("control"),
+  workspaceAccess: workspaceAccessSchema.default("none"),
+  expiresAt: z.string().datetime().nullable().optional()
+}).refine((input) => input.targetIdentifier || input.targetUsername, {
+  message: "targetIdentifier is required.",
+  path: ["targetIdentifier"]
+});
+var updateShareSchema = z.object({
+  workspaceId: z.string().uuid().nullable().optional(),
+  label: z.string().trim().min(1).max(160).nullable().optional(),
+  threadAccess: threadAccessSchema.optional(),
+  workspaceAccess: workspaceAccessSchema.optional(),
+  expiresAt: z.string().datetime().nullable().optional()
 });
 var setEnabledSchema = z.object({
   enabled: z.boolean()
@@ -730,6 +938,11 @@ var updatePasswordSchema = z.object({
   currentPassword: z.string().min(1),
   newPassword: z.string().min(8)
 });
+var relayAccessQuerySchema = z.object({
+  deviceId: z.string().uuid(),
+  threadId: z.string().trim().min(1).optional(),
+  workspaceId: z.string().uuid().optional()
+});
 var DEFAULT_WEBVIEW_CORS_ORIGINS = /* @__PURE__ */ new Set([
   "null",
   "capacitor://localhost",
@@ -749,6 +962,58 @@ var WEBVIEW_CORS_ALLOW_METHODS = [
   "DELETE",
   "OPTIONS"
 ].join(", ");
+var RELAY_REQUEST_HEADER_BLOCKLIST = /* @__PURE__ */ new Set([
+  "authorization",
+  "connection",
+  "content-length",
+  "cookie",
+  "expect",
+  "forwarded",
+  "host",
+  "keep-alive",
+  "origin",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "proxy-connection",
+  "referer",
+  "referrer",
+  "set-cookie",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade",
+  "via",
+  "x-client-ip",
+  "x-forwarded-for",
+  "x-forwarded-host",
+  "x-forwarded-port",
+  "x-forwarded-proto",
+  "x-forwarded-protocol",
+  "x-forwarded-scheme",
+  "x-real-ip",
+  "x-remote-codex-relay-forwarded"
+]);
+var RELAY_RESPONSE_HEADER_BLOCKLIST = /* @__PURE__ */ new Set([
+  "access-control-allow-credentials",
+  "access-control-allow-headers",
+  "access-control-allow-methods",
+  "access-control-allow-origin",
+  "access-control-expose-headers",
+  "access-control-max-age",
+  "access-control-request-headers",
+  "access-control-request-method",
+  "connection",
+  "content-length",
+  "keep-alive",
+  "location",
+  "proxy-authenticate",
+  "refresh",
+  "set-cookie",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade"
+]);
 function buildRelayServer(config2, options = {}) {
   const app2 = Fastify({ logger: false });
   app2.addContentTypeParser("*", { parseAs: "buffer" }, (_request, body, done) => {
@@ -846,6 +1111,25 @@ function buildRelayServer(config2, options = {}) {
     }
     return store.portalSummary(user.id, connectionStatus(state));
   });
+  app2.get("/relay/access", async (request, reply) => {
+    const user = requireRelayUser(request, reply, store);
+    if (!user) {
+      return;
+    }
+    const query = relayAccessQuerySchema.parse(request.query ?? {});
+    const access = store.effectiveAccess(user.id, query.deviceId, {
+      threadId: query.threadId ?? null,
+      workspaceId: query.workspaceId ?? null
+    });
+    if (!access) {
+      reply.status(403).send({
+        code: "forbidden",
+        message: "Device access is not allowed."
+      });
+      return;
+    }
+    return relayAccessDto(access);
+  });
   app2.post("/relay/devices", async (request, reply) => {
     const user = requireRelayUser(request, reply, store);
     if (!user) {
@@ -870,12 +1154,25 @@ function buildRelayServer(config2, options = {}) {
     }
     const body = createShareSchema.parse(request.body ?? {});
     return store.createShare(user.id, {
-      targetUsername: body.targetUsername,
+      targetIdentifier: body.targetIdentifier ?? body.targetUsername,
       deviceId: body.deviceId,
       threadId: body.threadId,
-      label: body.label ?? null
+      workspaceId: body.workspaceId ?? null,
+      label: body.label ?? null,
+      threadAccess: body.threadAccess,
+      workspaceAccess: body.workspaceAccess,
+      expiresAt: body.expiresAt ?? null
     });
   });
+  app2.patch("/relay/shares/:shareId", async (request, reply) => {
+    const user = requireRelayUser(request, reply, store);
+    if (!user) {
+      return;
+    }
+    const { shareId } = z.object({ shareId: z.string().uuid() }).parse(request.params);
+    const body = updateShareSchema.parse(request.body ?? {});
+    return store.updateShare(user.id, shareId, body);
+  });
   app2.delete("/relay/shares/:shareId", async (request, reply) => {
     const user = requireRelayUser(request, reply, store);
     if (!user) {
@@ -1059,7 +1356,8 @@ function buildRelayServer(config2, options = {}) {
           socket.close(1008, "Relay login is required.");
           return;
         }
-        if (!store.canAccessDevice(session.user.id, deviceId, threadId)) {
+        const access = store.effectiveAccess(session.user.id, deviceId, { threadId });
+        if (!access) {
           socket.close(1008, "Device access is not allowed.");
           return;
         }
@@ -1068,7 +1366,10 @@ function buildRelayServer(config2, options = {}) {
           socket.close(1013, "No supervisor is connected for this device.");
           return;
         }
-        connectRelayWebsocket(supervisor, socket, threadId);
+        if (access.kind === "shared") {
+          store.recordShareAccess(access.share, session.user);
+        }
+        connectRelayWebsocket(supervisor, socket, threadId, access);
       }
     });
     realtimeApp.route({
@@ -1089,11 +1390,19 @@ function buildRelayServer(config2, options = {}) {
         const threadId = queryString(request.query, "threadId");
         const deviceId = firstAccessibleConnectedDevice(state, store, session.user.id, threadId);
         const supervisor = deviceId ? state.supervisors.get(deviceId) : null;
+        const access = deviceId ? store.effectiveAccess(session.user.id, deviceId, { threadId }) : null;
         if (!deviceId || !supervisor || supervisor.socket.readyState !== WEBSOCKET_OPEN) {
           socket.close(1013, "No accessible supervisor is connected to this relay.");
           return;
         }
-        connectRelayWebsocket(supervisor, socket, threadId);
+        if (!access) {
+          socket.close(1008, "Device access is not allowed.");
+          return;
+        }
+        if (access.kind === "shared") {
+          store.recordShareAccess(access.share, session.user);
+        }
+        connectRelayWebsocket(supervisor, socket, threadId, access);
       }
     });
   });
@@ -1141,20 +1450,35 @@ function applyWebViewCorsHeaders(reply, origin) {
 }
 async function forwardRelayHttp(input) {
   const threadId = threadIdFromPath(input.targetPath);
-  if (!input.store.canAccessDevice(input.user.id, input.deviceId, threadId)) {
+  const workspaceId = workspaceIdFromPath(input.targetPath);
+  const access = input.store.effectiveAccess(input.user.id, input.deviceId, {
+    threadId,
+    workspaceId
+  });
+  if (!access) {
     input.reply.status(403).send({
       code: "forbidden",
       message: "Device access is not allowed."
     });
     return;
   }
-  if (!isAllowedForRelayUser(input.store, input.user.id, input.deviceId, input.request.method, input.targetPath)) {
+  if (!isAllowedRelayTarget(input.targetPath)) {
+    input.reply.status(403).send({
+      code: "forbidden",
+      message: "This relay path is not allowed."
+    });
+    return;
+  }
+  if (!isAllowedForRelayAccess(access, input.request.method, input.targetPath)) {
     input.reply.status(403).send({
       code: "forbidden",
       message: "This shared session does not allow that operation."
     });
     return;
   }
+  if (access.kind === "shared") {
+    input.store.recordShareAccess(access.share, input.user);
+  }
   const supervisor = input.state.supervisors.get(input.deviceId);
   if (!supervisor || supervisor.socket.readyState !== WEBSOCKET_OPEN) {
     input.reply.status(503).send({
@@ -1163,13 +1487,6 @@ async function forwardRelayHttp(input) {
     });
     return;
   }
-  if (!isAllowedRelayTarget(input.targetPath)) {
-    input.reply.status(403).send({
-      code: "forbidden",
-      message: "This relay path is not allowed."
-    });
-    return;
-  }
   try {
     const requestId = randomUUID();
     const requestBody = relayRequestBody(input.request.body);
@@ -1206,9 +1523,9 @@ function relayResponseBody(response) {
   }
   return response.body;
 }
-function connectRelayWebsocket(supervisor, socket, threadId) {
+function connectRelayWebsocket(supervisor, socket, threadId, access) {
   const clientId = randomUUID();
-  supervisor.clientSockets.set(clientId, { socket, threadId });
+  supervisor.clientSockets.set(clientId, { socket, threadId, access });
   sendToSupervisor(supervisor, {
     type: "relay.client.connected",
     timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -1221,6 +1538,10 @@ function connectRelayWebsocket(supervisor, socket, threadId) {
     } catch {
       return;
     }
+    if (access.kind === "shared" && access.threadAccess !== "control") {
+      socket.close(1008, "Shared read-only session cannot control supervisor.");
+      return;
+    }
     sendToSupervisor(supervisor, {
       type: "relay.client.message",
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -1361,6 +1682,15 @@ function connectionStatus(state) {
   }
   return statuses;
 }
+function relayAccessDto(access) {
+  return {
+    kind: access.kind,
+    shareId: access.share?.id ?? null,
+    threadAccess: access.threadAccess,
+    workspaceAccess: access.workspaceAccess,
+    workspaceId: access.workspaceId
+  };
+}
 function firstAccessibleConnectedDevice(state, store, userId, threadId) {
   for (const deviceId of state.supervisors.keys()) {
     if (store.canAccessDevice(userId, deviceId, threadId)) {
@@ -1378,33 +1708,91 @@ function threadIdFromPath(pathValue) {
   const match = /^\/api\/threads\/([^/?#]+)/.exec(pathname);
   return match ? decodeURIComponent(match[1]) : null;
 }
-function isAllowedForRelayUser(store, userId, deviceId, method, pathValue) {
-  if (store.canAccessDevice(userId, deviceId, null)) {
+function workspaceIdFromPath(pathValue) {
+  const pathname = new URL(pathValue, "http://relay.local").pathname;
+  const match = /^\/api\/workspaces\/([^/?#]+)/.exec(pathname);
+  return match ? decodeURIComponent(match[1]) : null;
+}
+function isAllowedForRelayAccess(access, method, pathValue) {
+  if (access.kind === "owner") {
     return true;
   }
   const pathname = new URL(pathValue, "http://relay.local").pathname;
+  const methodName = method.toUpperCase();
   const threadId = threadIdFromPath(pathValue);
-  if (!threadId || !store.canAccessDevice(userId, deviceId, threadId)) {
-    return false;
+  if (threadId) {
+    return isAllowedSharedThreadPath(access, methodName, pathname, threadId);
+  }
+  const workspaceId = workspaceIdFromPath(pathValue);
+  if (workspaceId) {
+    return isAllowedSharedWorkspacePath(access, methodName, pathname, workspaceId);
   }
-  if (!THREAD_SHARED_HTTP_METHODS.has(method.toUpperCase())) {
+  return false;
+}
+function isAllowedSharedThreadPath(access, methodName, pathname, threadId) {
+  if (access.kind !== "shared" || access.share.threadId !== threadId) {
     return false;
   }
   const escapedThreadId = escapeRegExp(encodeURIComponent(threadId));
-  const allowed = [
+  const readPatterns = [
     new RegExp(`^/api/threads/${escapedThreadId}$`),
     new RegExp(`^/api/threads/${escapedThreadId}/items/[^/]+/detail$`),
     new RegExp(`^/api/threads/${escapedThreadId}/export-turns$`),
+    new RegExp(`^/api/threads/${escapedThreadId}/exports/pdf$`),
+    new RegExp(`^/api/threads/${escapedThreadId}/assets/image$`),
     new RegExp(`^/api/threads/${escapedThreadId}/goal$`),
     new RegExp(`^/api/threads/${escapedThreadId}/skills$`),
     new RegExp(`^/api/threads/${escapedThreadId}/mcp-servers$`),
-    new RegExp(`^/api/threads/${escapedThreadId}/hooks$`),
+    new RegExp(`^/api/threads/${escapedThreadId}/hooks$`)
+  ];
+  if (methodName === "GET" && readPatterns.some((pattern) => pattern.test(pathname))) {
+    return true;
+  }
+  if (access.threadAccess !== "control") {
+    return false;
+  }
+  const controlPatterns = [
+    new RegExp(`^/api/threads/${escapedThreadId}/goal$`),
     new RegExp(`^/api/threads/${escapedThreadId}/resume$`),
     new RegExp(`^/api/threads/${escapedThreadId}/prompt$`),
     new RegExp(`^/api/threads/${escapedThreadId}/interrupt$`),
     new RegExp(`^/api/threads/${escapedThreadId}/requests/[^/]+/respond$`)
   ];
-  return allowed.some((pattern) => pattern.test(pathname));
+  if (methodName === "PATCH") {
+    return new RegExp(`^/api/threads/${escapedThreadId}/goal$`).test(pathname);
+  }
+  if (methodName === "POST") {
+    return controlPatterns.some((pattern) => pattern.test(pathname));
+  }
+  return false;
+}
+function isAllowedSharedWorkspacePath(access, methodName, pathname, workspaceId) {
+  if (access.kind !== "shared" || access.workspaceAccess === "none" || access.workspaceId !== workspaceId) {
+    return false;
+  }
+  const escapedWorkspaceId = escapeRegExp(encodeURIComponent(workspaceId));
+  const readPatterns = [
+    new RegExp(`^/api/workspaces/${escapedWorkspaceId}$`),
+    new RegExp(`^/api/workspaces/${escapedWorkspaceId}/files/tree$`),
+    new RegExp(`^/api/workspaces/${escapedWorkspaceId}/files/preview$`),
+    new RegExp(`^/api/workspaces/${escapedWorkspaceId}/files/raw$`),
+    new RegExp(`^/api/workspaces/${escapedWorkspaceId}/files/download$`),
+    new RegExp(`^/api/workspaces/${escapedWorkspaceId}/artifacts$`),
+    new RegExp(`^/api/workspaces/${escapedWorkspaceId}/artifacts/[^/]+$`),
+    new RegExp(`^/api/workspaces/${escapedWorkspaceId}/artifacts/[^/]+/download$`)
+  ];
+  if (methodName === "GET" && readPatterns.some((pattern) => pattern.test(pathname))) {
+    return true;
+  }
+  if (access.workspaceAccess !== "write") {
+    return false;
+  }
+  const writePatterns = [
+    new RegExp(`^/api/workspaces/${escapedWorkspaceId}/files$`),
+    new RegExp(`^/api/workspaces/${escapedWorkspaceId}/files/upload$`),
+    new RegExp(`^/api/workspaces/${escapedWorkspaceId}/files/move$`)
+  ];
+  return ["POST", "PUT", "PATCH", "DELETE"].includes(methodName) && writePatterns.some((pattern) => pattern.test(pathname));
 }
 function shouldForwardSocketEvent(event, threadId) {
   if (!threadId) {
@@ -1434,7 +1822,7 @@ function relayRequestHeaders(headers) {
   const output = {};
   for (const [name, value] of Object.entries(headers)) {
     const lower = name.toLowerCase();
-    if (lower === "authorization" || lower === "content-length" || lower === "transfer-encoding") {
+    if (RELAY_REQUEST_HEADER_BLOCKLIST.has(lower) || lower.startsWith("x-forwarded-")) {
       continue;
     }
     if (Array.isArray(value)) {
@@ -1447,7 +1835,7 @@ function relayRequestHeaders(headers) {
 }
 function canForwardResponseHeader(name) {
   const lower = name.toLowerCase();
-  return lower !== "content-length" && lower !== "transfer-encoding";
+  return !RELAY_RESPONSE_HEADER_BLOCKLIST.has(lower);
 }
 function bearerToken(value) {
   const match = /^Bearer\s+(.+)$/i.exec(value ?? "");