remote-codex 0.11.23 → 0.11.24

package/apps/relay-server/dist/index.js

@@ -203,7 +203,7 @@ var RelayStore = class _RelayStore {
       ).get(ownerUserId, target.id, input.deviceId, input.threadId)
     );
     if (existing) {
-      return this.updateShare(existing.id, {
+      return this.updateShareRecord(existing.id, {
         label: input.label?.trim() || null,
         workspaceId: input.workspaceId?.trim() || null,
         threadAccess: normalizeThreadAccess(input.threadAccess),
@@ -226,11 +226,31 @@ var RelayStore = class _RelayStore {
       workspaceAccess: normalizeWorkspaceAccess(input.workspaceAccess),
       createdAt: (/* @__PURE__ */ new Date()).toISOString(),
       revokedAt: null,
-      expiresAt: normalizeExpiresAt(input.expiresAt)
+      expiresAt: normalizeExpiresAt(input.expiresAt),
+      lastAccessedAt: null,
+      lastAccessedByUsername: null,
+      accessEvents: []
     };
     this.insertShare(share);
     return share;
   }
+  updateShare(userId, shareId, input) {
+    const share = this.rowToShare(
+      this.sqlite.prepare("SELECT * FROM relay_shares WHERE id = ? AND owner_user_id = ? AND revoked_at IS NULL").get(shareId, userId)
+    );
+    if (!share) {
+      throw new RelayStoreError(404, "not_found", "Share was not found.");
+    }
+    return this.publicShare(
+      this.updateShareRecord(shareId, {
+        label: input.label !== void 0 ? input.label?.trim() || null : share.label,
+        workspaceId: input.workspaceId !== void 0 ? input.workspaceId?.trim() || null : share.workspaceId,
+        threadAccess: input.threadAccess !== void 0 ? normalizeThreadAccess(input.threadAccess) : share.threadAccess,
+        workspaceAccess: input.workspaceAccess !== void 0 ? normalizeWorkspaceAccess(input.workspaceAccess) : share.workspaceAccess,
+        expiresAt: input.expiresAt !== void 0 ? normalizeExpiresAt(input.expiresAt) : share.expiresAt
+      })
+    );
+  }
   revokeShare(userId, shareId) {
     const share = this.rowToShare(
       this.sqlite.prepare("SELECT * FROM relay_shares WHERE id = ? AND owner_user_id = ?").get(shareId, userId)
@@ -404,15 +424,33 @@ var RelayStore = class _RelayStore {
       createdAt: device.createdAt
     };
   }
+  recordShareAccess(share, user) {
+    if (share.revokedAt || share.expiresAt && share.expiresAt <= (/* @__PURE__ */ new Date()).toISOString()) {
+      return;
+    }
+    const accessedAt = (/* @__PURE__ */ new Date()).toISOString();
+    this.sqlite.prepare(
+      `
+          INSERT INTO relay_share_access_events (
+            id, share_id, user_id, username, accessed_at
+          ) VALUES (?, ?, ?, ?, ?)
+        `
+    ).run(crypto.randomUUID(), share.id, user.id, user.username, accessedAt);
+  }
   publicShare(share) {
     const owner = this.getUser(share.ownerUserId);
     const target = this.getUser(share.targetUserId);
     const device = this.getDevice(share.deviceId);
+    const accessEvents = this.getShareAccessEvents(share.id);
+    const lastAccess = accessEvents[0] ?? null;
     return {
       ...share,
       ownerUsername: share.ownerUsername ?? owner?.username ?? "unknown",
       targetUsername: share.targetUsername ?? target?.username ?? "unknown",
-      deviceName: share.deviceName ?? device?.name ?? "Remote Codex device"
+      deviceName: share.deviceName ?? device?.name ?? "Remote Codex device",
+      lastAccessedAt: lastAccess?.accessedAt ?? null,
+      lastAccessedByUsername: lastAccess?.username ?? null,
+      accessEvents
     };
   }
   migrate() {
@@ -466,6 +504,16 @@ var RelayStore = class _RelayStore {
       CREATE INDEX IF NOT EXISTS relay_shares_owner_idx ON relay_shares(owner_user_id);
       CREATE INDEX IF NOT EXISTS relay_shares_target_idx ON relay_shares(target_user_id);
       CREATE INDEX IF NOT EXISTS relay_shares_device_thread_idx ON relay_shares(device_id, thread_id);
+
+      CREATE TABLE IF NOT EXISTS relay_share_access_events (
+        id TEXT PRIMARY KEY,
+        share_id TEXT NOT NULL REFERENCES relay_shares(id) ON DELETE CASCADE,
+        user_id TEXT NOT NULL REFERENCES relay_users(id) ON DELETE CASCADE,
+        username TEXT NOT NULL,
+        accessed_at TEXT NOT NULL
+      );
+
+      CREATE INDEX IF NOT EXISTS relay_share_access_events_share_idx ON relay_share_access_events(share_id, accessed_at DESC);
     `);
     this.ensureColumn("relay_devices", "token", "TEXT");
     this.ensureColumn("relay_shares", "workspace_id", "TEXT");
@@ -672,7 +720,23 @@ var RelayStore = class _RelayStore {
       share.expiresAt
     );
   }
-  updateShare(shareId, input) {
+  getShareAccessEvents(shareId) {
+    return this.sqlite.prepare(
+      `
+            SELECT * FROM relay_share_access_events
+            WHERE share_id = ?
+            ORDER BY accessed_at DESC
+            LIMIT 8
+          `
+    ).all(shareId).map((row) => ({
+      id: row.id,
+      shareId: row.share_id,
+      userId: row.user_id,
+      username: row.username,
+      accessedAt: row.accessed_at
+    }));
+  }
+  updateShareRecord(shareId, input) {
     this.sqlite.prepare(
       `
           UPDATE relay_shares
@@ -768,7 +832,10 @@ var RelayStore = class _RelayStore {
       workspaceAccess: normalizeWorkspaceAccess(row.workspace_access),
       createdAt: row.created_at,
       revokedAt: row.revoked_at,
-      expiresAt: row.expires_at ?? null
+      expiresAt: row.expires_at ?? null,
+      lastAccessedAt: null,
+      lastAccessedByUsername: null,
+      accessEvents: []
     };
   }
 };
@@ -854,6 +921,13 @@ var createShareSchema = z.object({
   message: "targetIdentifier is required.",
   path: ["targetIdentifier"]
 });
+var updateShareSchema = z.object({
+  workspaceId: z.string().uuid().nullable().optional(),
+  label: z.string().trim().min(1).max(160).nullable().optional(),
+  threadAccess: threadAccessSchema.optional(),
+  workspaceAccess: workspaceAccessSchema.optional(),
+  expiresAt: z.string().datetime().nullable().optional()
+});
 var setEnabledSchema = z.object({
   enabled: z.boolean()
 });
@@ -888,6 +962,58 @@ var WEBVIEW_CORS_ALLOW_METHODS = [
   "DELETE",
   "OPTIONS"
 ].join(", ");
+var RELAY_REQUEST_HEADER_BLOCKLIST = /* @__PURE__ */ new Set([
+  "authorization",
+  "connection",
+  "content-length",
+  "cookie",
+  "expect",
+  "forwarded",
+  "host",
+  "keep-alive",
+  "origin",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "proxy-connection",
+  "referer",
+  "referrer",
+  "set-cookie",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade",
+  "via",
+  "x-client-ip",
+  "x-forwarded-for",
+  "x-forwarded-host",
+  "x-forwarded-port",
+  "x-forwarded-proto",
+  "x-forwarded-protocol",
+  "x-forwarded-scheme",
+  "x-real-ip",
+  "x-remote-codex-relay-forwarded"
+]);
+var RELAY_RESPONSE_HEADER_BLOCKLIST = /* @__PURE__ */ new Set([
+  "access-control-allow-credentials",
+  "access-control-allow-headers",
+  "access-control-allow-methods",
+  "access-control-allow-origin",
+  "access-control-expose-headers",
+  "access-control-max-age",
+  "access-control-request-headers",
+  "access-control-request-method",
+  "connection",
+  "content-length",
+  "keep-alive",
+  "location",
+  "proxy-authenticate",
+  "refresh",
+  "set-cookie",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade"
+]);
 function buildRelayServer(config2, options = {}) {
   const app2 = Fastify({ logger: false });
   app2.addContentTypeParser("*", { parseAs: "buffer" }, (_request, body, done) => {
@@ -1038,6 +1164,15 @@ function buildRelayServer(config2, options = {}) {
       expiresAt: body.expiresAt ?? null
     });
   });
+  app2.patch("/relay/shares/:shareId", async (request, reply) => {
+    const user = requireRelayUser(request, reply, store);
+    if (!user) {
+      return;
+    }
+    const { shareId } = z.object({ shareId: z.string().uuid() }).parse(request.params);
+    const body = updateShareSchema.parse(request.body ?? {});
+    return store.updateShare(user.id, shareId, body);
+  });
   app2.delete("/relay/shares/:shareId", async (request, reply) => {
     const user = requireRelayUser(request, reply, store);
     if (!user) {
@@ -1231,6 +1366,9 @@ function buildRelayServer(config2, options = {}) {
           socket.close(1013, "No supervisor is connected for this device.");
           return;
         }
+        if (access.kind === "shared") {
+          store.recordShareAccess(access.share, session.user);
+        }
         connectRelayWebsocket(supervisor, socket, threadId, access);
       }
     });
@@ -1261,6 +1399,9 @@ function buildRelayServer(config2, options = {}) {
           socket.close(1008, "Device access is not allowed.");
           return;
         }
+        if (access.kind === "shared") {
+          store.recordShareAccess(access.share, session.user);
+        }
         connectRelayWebsocket(supervisor, socket, threadId, access);
       }
     });
@@ -1335,6 +1476,9 @@ async function forwardRelayHttp(input) {
     });
     return;
   }
+  if (access.kind === "shared") {
+    input.store.recordShareAccess(access.share, input.user);
+  }
   const supervisor = input.state.supervisors.get(input.deviceId);
   if (!supervisor || supervisor.socket.readyState !== WEBSOCKET_OPEN) {
     input.reply.status(503).send({
@@ -1678,7 +1822,7 @@ function relayRequestHeaders(headers) {
   const output = {};
   for (const [name, value] of Object.entries(headers)) {
     const lower = name.toLowerCase();
-    if (lower === "authorization" || lower === "content-length" || lower === "transfer-encoding") {
+    if (RELAY_REQUEST_HEADER_BLOCKLIST.has(lower) || lower.startsWith("x-forwarded-")) {
       continue;
     }
     if (Array.isArray(value)) {
@@ -1691,7 +1835,7 @@ function relayRequestHeaders(headers) {
 }
 function canForwardResponseHeader(name) {
   const lower = name.toLowerCase();
-  return lower !== "content-length" && lower !== "transfer-encoding";
+  return !RELAY_RESPONSE_HEADER_BLOCKLIST.has(lower);
 }
 function bearerToken(value) {
   const match = /^Bearer\s+(.+)$/i.exec(value ?? "");

package/apps/supervisor-api/dist/index.js

@@ -27428,6 +27428,7 @@ function constantTimeEqual(left, right) {
 
 // src/relay-tunnel-client.ts
 var RELAY_HEARTBEAT_INTERVAL_MS = 3e4;
+var RELAY_CONNECT_TIMEOUT_MS = 15e3;
 var RELAY_RECONNECT_INITIAL_DELAY_MS = 1e3;
 var RELAY_RECONNECT_MAX_DELAY_MS = 3e4;
 var RelayTunnelClient = class {
@@ -27443,6 +27444,7 @@ var RelayTunnelClient = class {
   handleClientMessage;
   socket = null;
   heartbeatHandle = null;
+  connectTimeoutHandle = null;
   reconnectHandle = null;
   reconnectDelayMs = RELAY_RECONNECT_INITIAL_DELAY_MS;
   stopped = false;
@@ -27464,42 +27466,50 @@ var RelayTunnelClient = class {
     const url = new URL("/supervisor/tunnel", this.config.serverUrl ?? void 0);
     url.searchParams.set("token", this.config.agentToken ?? "");
     url.searchParams.set("deviceToken", this.config.agentToken ?? "");
-    this.socket = new WebSocket(url);
-    this.socket.addEventListener("open", () => {
+    const socket = new WebSocket(url);
+    this.socket = socket;
+    this.connectTimeoutHandle = setTimeout(() => {
+      if (this.socket === socket && socket.readyState !== WebSocket.OPEN) {
+        this.closeAndReconnect(socket);
+      }
+    }, RELAY_CONNECT_TIMEOUT_MS);
+    socket.addEventListener("open", () => {
+      this.clearConnectTimeout();
       this.reconnectDelayMs = RELAY_RECONNECT_INITIAL_DELAY_MS;
       this.sendHeartbeat();
+      this.clearHeartbeat();
       this.heartbeatHandle = setInterval(() => {
         this.sendHeartbeat();
       }, RELAY_HEARTBEAT_INTERVAL_MS);
     });
-    this.socket.addEventListener("close", () => {
-      this.clearHeartbeat();
-      this.cleanupRelayClients();
-      this.socket = null;
-      this.scheduleReconnect();
+    socket.addEventListener("close", () => {
+      this.closeAndReconnect(socket);
+    });
+    socket.addEventListener("error", () => {
+      this.closeAndReconnect(socket);
     });
-    this.socket.addEventListener("message", (event) => {
+    socket.addEventListener("message", (event) => {
       void this.handleMessage(String(event.data));
     });
   }
   stop() {
     this.stopped = true;
     this.clearHeartbeat();
+    this.clearConnectTimeout();
     this.clearReconnect();
     this.cleanupRelayClients();
     this.socket?.close();
     this.socket = null;
   }
   sendHeartbeat() {
-    if (this.socket?.readyState !== WebSocket.OPEN) {
+    const socket = this.socket;
+    if (socket?.readyState !== WebSocket.OPEN) {
       return;
     }
-    this.socket.send(
-      JSON.stringify({
-        type: "relay.heartbeat",
-        timestamp: (/* @__PURE__ */ new Date()).toISOString()
-      })
-    );
+    this.sendEnvelope(socket, {
+      type: "relay.heartbeat",
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    });
   }
   async handleMessage(rawMessage) {
     let parsed;
@@ -27530,27 +27540,52 @@ var RelayTunnelClient = class {
       return;
     }
     const response = await this.handleRequest(parsed.payload);
-    this.socket?.send(
-      JSON.stringify({
+    const socket = this.socket;
+    if (socket?.readyState !== WebSocket.OPEN) {
+      return;
+    }
+    this.sendEnvelope(
+      socket,
+      {
         type: "relay.response",
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         requestId: parsed.requestId,
         payload: response
-      })
+      }
     );
   }
   sendClientMessage(clientId, message) {
-    if (this.socket?.readyState !== WebSocket.OPEN) {
+    const socket = this.socket;
+    if (socket?.readyState !== WebSocket.OPEN) {
       return;
     }
-    this.socket.send(
-      JSON.stringify({
-        type: "relay.server.message",
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        clientId,
-        payload: message
-      })
-    );
+    this.sendEnvelope(socket, {
+      type: "relay.server.message",
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      clientId,
+      payload: message
+    });
+  }
+  sendEnvelope(socket, message) {
+    try {
+      socket.send(JSON.stringify(message));
+    } catch {
+      this.closeAndReconnect(socket);
+    }
+  }
+  closeAndReconnect(socket) {
+    if (this.socket !== socket) {
+      return;
+    }
+    this.clearHeartbeat();
+    this.clearConnectTimeout();
+    this.cleanupRelayClients();
+    this.socket = null;
+    try {
+      socket.close();
+    } catch {
+    }
+    this.scheduleReconnect();
   }
   clearHeartbeat() {
     if (this.heartbeatHandle) {
@@ -27558,6 +27593,12 @@ var RelayTunnelClient = class {
       this.heartbeatHandle = null;
     }
   }
+  clearConnectTimeout() {
+    if (this.connectTimeoutHandle) {
+      clearTimeout(this.connectTimeoutHandle);
+      this.connectTimeoutHandle = null;
+    }
+  }
   scheduleReconnect() {
     if (this.stopped || this.reconnectHandle) {
       return;