remote-codex 0.11.24 → 0.11.26

package/apps/relay-server/dist/index.js

@@ -18,16 +18,17 @@ var RelayRequestBroker = class {
   }
   timeoutMs;
   pendingRequests = /* @__PURE__ */ new Map();
-  forward(socket, message) {
+  forward(socket, message, options) {
     return new Promise((resolve, reject) => {
       if (message.type !== "relay.request") {
         reject(new Error("Only relay.request messages can be forwarded."));
         return;
       }
+      const timeoutMs = options?.timeoutMs ?? this.timeoutMs;
       const timeout = setTimeout(() => {
         this.pendingRequests.delete(message.requestId);
         reject(new Error("Supervisor relay request timed out."));
-      }, this.timeoutMs);
+      }, timeoutMs);
       this.pendingRequests.set(message.requestId, {
         resolve,
         reject,
@@ -115,6 +116,53 @@ var RelayStore = class _RelayStore {
     this.insertUser(user);
     return this.createLoginResult(user);
   }
+  requestRegistrationApproval(input) {
+    if (!this.registrationEnabled()) {
+      throw new RelayStoreError(403, "forbidden", "Registration is currently disabled.");
+    }
+    const email = input.email.trim().toLowerCase();
+    const username = normalizeUsername(input.username);
+    if (!email.includes("@")) {
+      throw new RelayStoreError(400, "bad_request", "A valid email address is required.");
+    }
+    if (username.length < 3) {
+      throw new RelayStoreError(400, "bad_request", "Username must be at least 3 characters.");
+    }
+    if (input.password.length < 8) {
+      throw new RelayStoreError(400, "bad_request", "Password must be at least 8 characters.");
+    }
+    if (this.getUserByIdentifier(email) || this.getUserByUsername(username)) {
+      throw new RelayStoreError(409, "conflict", "A user with that email or username already exists.");
+    }
+    const existing = this.rowToPendingRegistration(
+      this.sqlite.prepare(
+        `
+            SELECT * FROM relay_pending_registrations
+            WHERE status = 'pending'
+              AND (email = ? OR username = ?)
+            ORDER BY created_at DESC
+            LIMIT 1
+          `
+      ).get(email, username)
+    );
+    if (existing) {
+      return this.publicPendingRegistration(existing);
+    }
+    const passwordSalt = crypto.randomBytes(16).toString("base64url");
+    const record = {
+      id: crypto.randomUUID(),
+      email,
+      username,
+      passwordSalt,
+      passwordHash: hashSecret(input.password, passwordSalt),
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      status: "pending",
+      reviewedAt: null,
+      reviewedByUserId: null
+    };
+    this.insertPendingRegistration(record);
+    return this.publicPendingRegistration(record);
+  }
   login(input) {
     const normalizedIdentifier = input.identifier.trim().toLowerCase();
     const user = this.getUserByIdentifier(normalizedIdentifier);
@@ -220,7 +268,9 @@ var RelayStore = class _RelayStore {
       deviceId: input.deviceId,
       deviceName: device.name,
       threadId: input.threadId,
+      threadTitle: null,
       workspaceId: input.workspaceId?.trim() || null,
+      workspaceLabel: null,
       label: input.label?.trim() || null,
       threadAccess: normalizeThreadAccess(input.threadAccess),
       workspaceAccess: normalizeWorkspaceAccess(input.workspaceAccess),
@@ -353,12 +403,35 @@ var RelayStore = class _RelayStore {
       sharedByMe: sharedByMe.map((share) => this.publicShare(share))
     };
   }
-  adminSummary(connectedDevices) {
+  sharedThreadsForDevice(userId, deviceId) {
+    return this.getSharesByTarget(userId).filter((share) => share.deviceId === deviceId).map((share) => this.publicShare(share));
+  }
+  adminSummary(connectedDevices, options = {}) {
+    const conversationWindowDays = normalizeConversationWindowDays(options.conversationWindowDays);
+    const users = this.getUsers();
+    const devices = this.getDevices();
+    const deviceCounts = /* @__PURE__ */ new Map();
+    for (const device of devices) {
+      deviceCounts.set(device.ownerUserId, (deviceCounts.get(device.ownerUserId) ?? 0) + 1);
+    }
+    const conversationCounts = this.conversationCountsByUser(conversationWindowDays);
     return {
-      users: this.getUsers().map((user) => this.publicUser(user)),
-      devices: this.getDevices().map(
-        (device) => this.publicDevice(device, connectedDevices.get(device.id) ?? null)
+      users: users.map(
+        (user) => this.publicAdminUser(user, deviceCounts.get(user.id) ?? 0, conversationCounts.get(user.id) ?? 0)
       ),
+      devices: devices.map((device) => {
+        const owner = users.find((user) => user.id === device.ownerUserId);
+        return this.publicAdminDevice(
+          device,
+          connectedDevices.get(device.id) ?? null,
+          owner,
+          options.metadata
+        );
+      }),
+      shares: this.getShares({ includeRevoked: true }).map((share) => this.publicShare(share)),
+      pendingRegistrations: this.pendingRegistrations(),
+      settings: this.registrationSettings(),
+      conversationWindowDays,
       registrationEnabled: this.registrationEnabled()
     };
   }
@@ -366,6 +439,95 @@ var RelayStore = class _RelayStore {
     this.setSetting("registrationEnabled", enabled ? "true" : "false");
     return enabled;
   }
+  registrationSettings() {
+    return {
+      enabled: this.registrationEnabled(),
+      registrationPassword: this.getSetting("registrationPassword"),
+      approvalRequired: this.getSetting("registrationApprovalRequired") === "true"
+    };
+  }
+  updateRegistrationSettings(input) {
+    if (input.enabled !== void 0) {
+      this.setRegistrationEnabled(input.enabled);
+    }
+    if (input.registrationPassword !== void 0) {
+      const password = input.registrationPassword?.trim() || null;
+      if (password !== null && password.length < 8) {
+        throw new RelayStoreError(400, "bad_request", "Registration password must be at least 8 characters.");
+      }
+      if (password === null) {
+        this.deleteSetting("registrationPassword");
+      } else {
+        this.setSetting("registrationPassword", password);
+      }
+    }
+    if (input.approvalRequired !== void 0) {
+      this.setSetting("registrationApprovalRequired", input.approvalRequired ? "true" : "false");
+    }
+    return this.registrationSettings();
+  }
+  ensureRegistrationPassword(password) {
+    if (!password || this.getSetting("registrationPassword") !== null) {
+      return;
+    }
+    this.setSetting("registrationPassword", password);
+  }
+  approvePendingRegistration(adminUserId, requestId) {
+    const record = this.requirePendingRegistration(requestId);
+    const user = {
+      id: crypto.randomUUID(),
+      email: record.email,
+      username: record.username,
+      role: "user",
+      enabled: true,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      lastSeenAt: null,
+      passwordSalt: record.passwordSalt,
+      passwordHash: record.passwordHash
+    };
+    const approve = this.sqlite.transaction(() => {
+      this.insertUser(user);
+      this.sqlite.prepare(
+        `
+            UPDATE relay_pending_registrations
+            SET status = 'approved', reviewed_at = ?, reviewed_by_user_id = ?
+            WHERE id = ?
+          `
+      ).run((/* @__PURE__ */ new Date()).toISOString(), adminUserId, requestId);
+    });
+    approve();
+    return this.publicUser(user);
+  }
+  rejectPendingRegistration(adminUserId, requestId) {
+    this.requirePendingRegistration(requestId);
+    this.sqlite.prepare(
+      `
+          UPDATE relay_pending_registrations
+          SET status = 'rejected', reviewed_at = ?, reviewed_by_user_id = ?
+          WHERE id = ?
+        `
+    ).run((/* @__PURE__ */ new Date()).toISOString(), adminUserId, requestId);
+    return { id: requestId };
+  }
+  recordUserSeen(userId, at = (/* @__PURE__ */ new Date()).toISOString()) {
+    this.sqlite.prepare("UPDATE relay_users SET last_seen_at = ? WHERE id = ?").run(at, userId);
+  }
+  recordConversationEvent(input) {
+    this.sqlite.prepare(
+      `
+          INSERT INTO relay_conversation_events (
+            id, user_id, device_id, thread_id, workspace_id, occurred_at
+          ) VALUES (?, ?, ?, ?, ?, ?)
+        `
+    ).run(
+      crypto.randomUUID(),
+      input.userId,
+      input.deviceId,
+      input.threadId,
+      input.workspaceId,
+      (/* @__PURE__ */ new Date()).toISOString()
+    );
+  }
   setUserEnabled(userId, enabled) {
     const user = this.requireUser(userId);
     if (user.role === "admin" && !enabled) {
@@ -374,6 +536,30 @@ var RelayStore = class _RelayStore {
     this.sqlite.prepare("UPDATE relay_users SET enabled = ? WHERE id = ?").run(enabled ? 1 : 0, userId);
     return this.publicUser({ ...user, enabled });
   }
+  deleteUser(userId) {
+    const user = this.requireUser(userId);
+    if (user.role === "admin") {
+      throw new RelayStoreError(400, "bad_request", "The admin user cannot be deleted.");
+    }
+    this.sqlite.prepare("DELETE FROM relay_users WHERE id = ?").run(userId);
+  }
+  adminResetUserPassword(userId, password) {
+    const user = this.requireUser(userId);
+    if (user.role === "admin") {
+      throw new RelayStoreError(400, "bad_request", "The admin user password cannot be reset here.");
+    }
+    if (password.length < 8) {
+      throw new RelayStoreError(400, "bad_request", "Password must be at least 8 characters.");
+    }
+    const passwordSalt = crypto.randomBytes(16).toString("base64url");
+    const passwordHash = hashSecret(password, passwordSalt);
+    this.sqlite.prepare("UPDATE relay_users SET password_salt = ?, password_hash = ? WHERE id = ?").run(passwordSalt, passwordHash, user.id);
+    return this.publicUser({
+      ...user,
+      passwordSalt,
+      passwordHash
+    });
+  }
   updateAccount(userId, input) {
     const user = this.requireUser(userId);
     const username = input.username !== void 0 ? normalizeUsername(input.username) : user.username;
@@ -424,6 +610,24 @@ var RelayStore = class _RelayStore {
       createdAt: device.createdAt
     };
   }
+  publicAdminUser(user, deviceCount, conversationCount) {
+    return {
+      ...this.publicUser(user),
+      lastSeenAt: user.lastSeenAt,
+      deviceCount,
+      conversationCount
+    };
+  }
+  publicAdminDevice(device, status, owner, metadata) {
+    return {
+      ...this.publicDevice(device, status),
+      ownerUsername: owner?.username ?? "unknown",
+      ownerEmail: owner?.email ?? "unknown",
+      ipAddress: status?.ipAddress ?? null,
+      workspaces: metadata?.workspacesByDeviceId?.get(device.id) ?? [],
+      threads: metadata?.threadsByDeviceId?.get(device.id) ?? []
+    };
+  }
   recordShareAccess(share, user) {
     if (share.revokedAt || share.expiresAt && share.expiresAt <= (/* @__PURE__ */ new Date()).toISOString()) {
       return;
@@ -466,6 +670,7 @@ var RelayStore = class _RelayStore {
         username TEXT NOT NULL UNIQUE,
         role TEXT NOT NULL CHECK (role IN ('admin', 'user')),
         enabled INTEGER NOT NULL DEFAULT 1,
+        last_seen_at TEXT,
         created_at TEXT NOT NULL,
         password_salt TEXT NOT NULL,
         password_hash TEXT NOT NULL
@@ -514,7 +719,33 @@ var RelayStore = class _RelayStore {
       );
 
       CREATE INDEX IF NOT EXISTS relay_share_access_events_share_idx ON relay_share_access_events(share_id, accessed_at DESC);
+
+      CREATE TABLE IF NOT EXISTS relay_conversation_events (
+        id TEXT PRIMARY KEY,
+        user_id TEXT NOT NULL REFERENCES relay_users(id) ON DELETE CASCADE,
+        device_id TEXT NOT NULL REFERENCES relay_devices(id) ON DELETE CASCADE,
+        thread_id TEXT,
+        workspace_id TEXT,
+        occurred_at TEXT NOT NULL
+      );
+
+      CREATE INDEX IF NOT EXISTS relay_conversation_events_user_time_idx ON relay_conversation_events(user_id, occurred_at DESC);
+
+      CREATE TABLE IF NOT EXISTS relay_pending_registrations (
+        id TEXT PRIMARY KEY,
+        email TEXT NOT NULL,
+        username TEXT NOT NULL,
+        password_salt TEXT NOT NULL,
+        password_hash TEXT NOT NULL,
+        created_at TEXT NOT NULL,
+        status TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending', 'approved', 'rejected')),
+        reviewed_at TEXT,
+        reviewed_by_user_id TEXT
+      );
+
+      CREATE INDEX IF NOT EXISTS relay_pending_registrations_status_idx ON relay_pending_registrations(status, created_at DESC);
     `);
+    this.ensureColumn("relay_users", "last_seen_at", "TEXT");
     this.ensureColumn("relay_devices", "token", "TEXT");
     this.ensureColumn("relay_shares", "workspace_id", "TEXT");
     this.ensureColumn("relay_shares", "thread_access", "TEXT NOT NULL DEFAULT 'control'");
@@ -574,6 +805,9 @@ var RelayStore = class _RelayStore {
   setSetting(key, value) {
     this.sqlite.prepare("INSERT INTO relay_settings (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value").run(key, value);
   }
+  deleteSetting(key) {
+    this.sqlite.prepare("DELETE FROM relay_settings WHERE key = ?").run(key);
+  }
   createStoredUser(input) {
     const email = input.email.trim().toLowerCase();
     const username = normalizeUsername(input.username);
@@ -597,6 +831,7 @@ var RelayStore = class _RelayStore {
       role: input.role,
       enabled: true,
       createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      lastSeenAt: null,
       passwordSalt,
       passwordHash: hashSecret(input.password, passwordSalt)
     };
@@ -662,8 +897,8 @@ var RelayStore = class _RelayStore {
     this.sqlite.prepare(
       `
           INSERT INTO relay_users (
-            id, email, username, role, enabled, created_at, password_salt, password_hash
-          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+            id, email, username, role, enabled, last_seen_at, created_at, password_salt, password_hash
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
         `
     ).run(
       user.id,
@@ -671,6 +906,7 @@ var RelayStore = class _RelayStore {
       user.username,
       user.role,
       user.enabled ? 1 : 0,
+      user.lastSeenAt,
       user.createdAt,
       user.passwordSalt,
       user.passwordHash
@@ -790,6 +1026,72 @@ var RelayStore = class _RelayStore {
   getSharesByTarget(targetUserId) {
     return this.sqlite.prepare("SELECT * FROM relay_shares WHERE target_user_id = ? AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > ?) ORDER BY created_at ASC").all(targetUserId, (/* @__PURE__ */ new Date()).toISOString()).map((row) => this.rowToShare(row)).filter((share) => Boolean(share));
   }
+  getShares(options = {}) {
+    const sql = options.includeRevoked ? "SELECT * FROM relay_shares ORDER BY created_at DESC" : "SELECT * FROM relay_shares WHERE revoked_at IS NULL AND (expires_at IS NULL OR expires_at > ?) ORDER BY created_at DESC";
+    const rows = options.includeRevoked ? this.sqlite.prepare(sql).all() : this.sqlite.prepare(sql).all((/* @__PURE__ */ new Date()).toISOString());
+    return rows.map((row) => this.rowToShare(row)).filter((share) => Boolean(share));
+  }
+  conversationCountsByUser(days) {
+    const since = new Date(Date.now() - days * 24 * 60 * 60 * 1e3).toISOString();
+    const rows = this.sqlite.prepare(
+      `
+          SELECT user_id, COUNT(*) AS count
+          FROM relay_conversation_events
+          WHERE occurred_at >= ?
+          GROUP BY user_id
+        `
+    ).all(since);
+    return new Map(rows.map((row) => [row.user_id, row.count]));
+  }
+  pendingRegistrations() {
+    return this.sqlite.prepare(
+      `
+          SELECT * FROM relay_pending_registrations
+          WHERE status = 'pending'
+          ORDER BY created_at ASC
+        `
+    ).all().map((row) => this.rowToPendingRegistration(row)).filter((record) => Boolean(record)).map((record) => this.publicPendingRegistration(record));
+  }
+  requirePendingRegistration(id) {
+    const record = this.rowToPendingRegistration(
+      this.sqlite.prepare("SELECT * FROM relay_pending_registrations WHERE id = ? AND status = 'pending'").get(id)
+    );
+    if (!record) {
+      throw new RelayStoreError(404, "not_found", "Pending registration was not found.");
+    }
+    if (this.getUserByIdentifier(record.email) || this.getUserByUsername(record.username)) {
+      throw new RelayStoreError(409, "conflict", "A user with that email or username already exists.");
+    }
+    return record;
+  }
+  publicPendingRegistration(record) {
+    return {
+      id: record.id,
+      email: record.email,
+      username: record.username,
+      createdAt: record.createdAt
+    };
+  }
+  insertPendingRegistration(record) {
+    this.sqlite.prepare(
+      `
+          INSERT INTO relay_pending_registrations (
+            id, email, username, password_salt, password_hash,
+            created_at, status, reviewed_at, reviewed_by_user_id
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+        `
+    ).run(
+      record.id,
+      record.email,
+      record.username,
+      record.passwordSalt,
+      record.passwordHash,
+      record.createdAt,
+      record.status,
+      record.reviewedAt,
+      record.reviewedByUserId
+    );
+  }
   rowToUser(row) {
     if (!row) return null;
     return {
@@ -799,6 +1101,7 @@ var RelayStore = class _RelayStore {
       role: row.role,
       enabled: Boolean(row.enabled),
       createdAt: row.created_at,
+      lastSeenAt: row.last_seen_at ?? null,
       passwordSalt: row.password_salt,
       passwordHash: row.password_hash
     };
@@ -826,7 +1129,9 @@ var RelayStore = class _RelayStore {
       deviceId: row.device_id,
       deviceName: row.device_name ?? "Remote Codex device",
       threadId: row.thread_id,
+      threadTitle: null,
       workspaceId: row.workspace_id ?? null,
+      workspaceLabel: null,
       label: row.label,
       threadAccess: normalizeThreadAccess(row.thread_access),
       workspaceAccess: normalizeWorkspaceAccess(row.workspace_access),
@@ -838,6 +1143,20 @@ var RelayStore = class _RelayStore {
       accessEvents: []
     };
   }
+  rowToPendingRegistration(row) {
+    if (!row) return null;
+    return {
+      id: row.id,
+      email: row.email,
+      username: row.username,
+      passwordSalt: row.password_salt,
+      passwordHash: row.password_hash,
+      createdAt: row.created_at,
+      status: row.status,
+      reviewedAt: row.reviewed_at ?? null,
+      reviewedByUserId: row.reviewed_by_user_id ?? null
+    };
+  }
 };
 var RelayStoreError = class extends Error {
   constructor(statusCode, code, message) {
@@ -867,6 +1186,12 @@ function normalizeExpiresAt(value) {
   const timestamp = Date.parse(value);
   return Number.isNaN(timestamp) ? null : new Date(timestamp).toISOString();
 }
+function normalizeConversationWindowDays(value) {
+  if (!Number.isFinite(value ?? NaN)) {
+    return 7;
+  }
+  return Math.min(365, Math.max(1, Math.floor(value)));
+}
 function hashSecret(secret, salt) {
   return crypto.scryptSync(secret, salt, 32).toString("base64url");
 }
@@ -890,6 +1215,7 @@ function safeEqual(left, right) {
 
 // src/app.ts
 var RELAY_REQUEST_TIMEOUT_MS = 3e4;
+var RELAY_PORTAL_METADATA_TIMEOUT_MS = 900;
 var WEBSOCKET_OPEN = 1;
 var RELAY_COOKIE_NAME = "remote_codex_relay_session";
 var threadAccessSchema = z.enum(["read", "control"]);
@@ -931,6 +1257,17 @@ var updateShareSchema = z.object({
 var setEnabledSchema = z.object({
   enabled: z.boolean()
 });
+var adminResetPasswordSchema = z.object({
+  password: z.string().min(8)
+});
+var adminQuerySchema = z.object({
+  days: z.coerce.number().int().positive().max(365).optional()
+});
+var updateRegistrationSettingsSchema = z.object({
+  enabled: z.boolean().optional(),
+  registrationPassword: z.string().nullable().optional(),
+  approvalRequired: z.boolean().optional()
+});
 var updateAccountSchema = z.object({
   username: z.string().trim().min(3).optional()
 });
@@ -1027,6 +1364,7 @@ function buildRelayServer(config2, options = {}) {
   if (config2.registrationEnabledConfigured) {
     store.setRegistrationEnabled(config2.registrationEnabled);
   }
+  store.ensureRegistrationPassword(config2.registrationPassword);
   store.seedAdmin({
     username: config2.adminUsername,
     email: config2.adminEmail,
@@ -1064,21 +1402,35 @@ function buildRelayServer(config2, options = {}) {
   });
   app2.post("/relay/auth/register", async (request, reply) => {
     const body = registerSchema.parse(request.body ?? {});
-    if (config2.registrationPassword && body.registrationPassword !== config2.registrationPassword) {
+    const settings = store.registrationSettings();
+    if (settings.registrationPassword && body.registrationPassword !== settings.registrationPassword) {
       reply.status(403).send({
         code: "forbidden",
         message: "Invalid registration password."
       });
       return;
     }
-    const { registrationPassword: _registrationPassword, ...registerInput } = body;
+    const registerInput = {
+      email: body.email,
+      username: body.username,
+      password: body.password
+    };
+    if (settings.approvalRequired) {
+      reply.status(202);
+      return {
+        pendingApproval: true,
+        request: store.requestRegistrationApproval(registerInput)
+      };
+    }
     const result = store.register(registerInput);
+    store.recordUserSeen(result.session.user.id);
     attachRelayCookie(reply, result.token);
     return result;
   });
   app2.post("/relay/auth/login", async (request, reply) => {
     const body = loginSchema.parse(request.body ?? {});
     const result = store.login(body);
+    store.recordUserSeen(result.session.user.id);
     attachRelayCookie(reply, result.token);
     return result;
   });
@@ -1109,7 +1461,7 @@ function buildRelayServer(config2, options = {}) {
     if (!user) {
       return;
     }
-    return store.portalSummary(user.id, connectionStatus(state));
+    return enrichPortalSummary(store.portalSummary(user.id, connectionStatus(state)), state);
   });
   app2.get("/relay/access", async (request, reply) => {
     const user = requireRelayUser(request, reply, store);
@@ -1186,15 +1538,27 @@ function buildRelayServer(config2, options = {}) {
     if (!user) {
       return;
     }
-    return store.adminSummary(connectionStatus(state));
+    const query = adminQuerySchema.parse(request.query ?? {});
+    const baseSummary = store.adminSummary(connectionStatus(state), {
+      ...query.days !== void 0 ? { conversationWindowDays: query.days } : {}
+    });
+    return enrichAdminSummary(baseSummary, state, store, query.days);
   });
   app2.patch("/relay/admin/settings/registration", async (request, reply) => {
     const user = requireRelayUser(request, reply, store, { admin: true });
     if (!user) {
       return;
     }
-    const body = setEnabledSchema.parse(request.body ?? {});
-    return { registrationEnabled: store.setRegistrationEnabled(body.enabled) };
+    const body = updateRegistrationSettingsSchema.parse(request.body ?? {});
+    const settings = store.updateRegistrationSettings({
+      ...body.enabled !== void 0 ? { enabled: body.enabled } : {},
+      ...body.registrationPassword !== void 0 ? { registrationPassword: body.registrationPassword } : {},
+      ...body.approvalRequired !== void 0 ? { approvalRequired: body.approvalRequired } : {}
+    });
+    return {
+      registrationEnabled: settings.enabled,
+      settings
+    };
   });
   app2.patch("/relay/admin/users/:userId", async (request, reply) => {
     const user = requireRelayUser(request, reply, store, { admin: true });
@@ -1205,6 +1569,40 @@ function buildRelayServer(config2, options = {}) {
     const body = setEnabledSchema.parse(request.body ?? {});
     return store.setUserEnabled(userId, body.enabled);
   });
+  app2.delete("/relay/admin/users/:userId", async (request, reply) => {
+    const user = requireRelayUser(request, reply, store, { admin: true });
+    if (!user) {
+      return;
+    }
+    const { userId } = z.object({ userId: z.string().uuid() }).parse(request.params);
+    store.deleteUser(userId);
+    return { id: userId };
+  });
+  app2.post("/relay/admin/users/:userId/reset-password", async (request, reply) => {
+    const user = requireRelayUser(request, reply, store, { admin: true });
+    if (!user) {
+      return;
+    }
+    const { userId } = z.object({ userId: z.string().uuid() }).parse(request.params);
+    const body = adminResetPasswordSchema.parse(request.body ?? {});
+    return store.adminResetUserPassword(userId, body.password);
+  });
+  app2.post("/relay/admin/registrations/:requestId/approve", async (request, reply) => {
+    const user = requireRelayUser(request, reply, store, { admin: true });
+    if (!user) {
+      return;
+    }
+    const { requestId } = z.object({ requestId: z.string().uuid() }).parse(request.params);
+    return store.approvePendingRegistration(user.id, requestId);
+  });
+  app2.post("/relay/admin/registrations/:requestId/reject", async (request, reply) => {
+    const user = requireRelayUser(request, reply, store, { admin: true });
+    if (!user) {
+      return;
+    }
+    const { requestId } = z.object({ requestId: z.string().uuid() }).parse(request.params);
+    return store.rejectPendingRegistration(user.id, requestId);
+  });
   app2.all("/relay/devices/:deviceId/api/*", async (request, reply) => {
     const user = requireRelayUser(request, reply, store);
     if (!user) {
@@ -1297,7 +1695,8 @@ function buildRelayServer(config2, options = {}) {
           clientSockets: /* @__PURE__ */ new Map(),
           connected: true,
           connectedAt,
-          lastHeartbeatAt: connectedAt
+          lastHeartbeatAt: connectedAt,
+          ipAddress: relayClientIp(request)
         };
         state.supervisors.set(deviceId, connection);
         socket.send(
@@ -1451,16 +1850,40 @@ function applyWebViewCorsHeaders(reply, origin) {
 async function forwardRelayHttp(input) {
   const threadId = threadIdFromPath(input.targetPath);
   const workspaceId = workspaceIdFromPath(input.targetPath);
+  const targetUrl = new URL(input.targetPath, "http://relay.local");
+  const sharedThreadListRequest = input.request.method.toUpperCase() === "GET" && targetUrl.pathname === "/api/threads";
+  const sharedRuntimeMetadataRequest = isAllowedSharedRuntimeMetadataRequest(
+    input.request.method,
+    targetUrl.pathname
+  );
   const access = input.store.effectiveAccess(input.user.id, input.deviceId, {
     threadId,
     workspaceId
   });
+  let allowSharedRuntimeMetadata = false;
   if (!access) {
-    input.reply.status(403).send({
-      code: "forbidden",
-      message: "Device access is not allowed."
-    });
-    return;
+    const shares = sharedThreadListRequest || sharedRuntimeMetadataRequest ? input.store.sharedThreadsForDevice(input.user.id, input.deviceId) : [];
+    if (sharedThreadListRequest) {
+      if (shares.length > 0) {
+        await forwardSharedThreadList({
+          reply: input.reply,
+          state: input.state,
+          store: input.store,
+          user: input.user,
+          deviceId: input.deviceId,
+          shares
+        });
+        return;
+      }
+    }
+    allowSharedRuntimeMetadata = sharedRuntimeMetadataRequest && shares.length > 0;
+    if (!allowSharedRuntimeMetadata) {
+      input.reply.status(403).send({
+        code: "forbidden",
+        message: "Device access is not allowed."
+      });
+      return;
+    }
   }
   if (!isAllowedRelayTarget(input.targetPath)) {
     input.reply.status(403).send({
@@ -1469,16 +1892,29 @@ async function forwardRelayHttp(input) {
     });
     return;
   }
-  if (!isAllowedForRelayAccess(access, input.request.method, input.targetPath)) {
+  if (access && !isAllowedForRelayAccess(access, input.request.method, input.targetPath)) {
     input.reply.status(403).send({
       code: "forbidden",
       message: "This shared session does not allow that operation."
     });
     return;
   }
-  if (access.kind === "shared") {
+  if (access?.kind === "shared") {
     input.store.recordShareAccess(access.share, input.user);
   }
+  const conversationEvent = conversationEventFromRequest(
+    input.request.method,
+    input.targetPath,
+    input.request.body
+  );
+  if (conversationEvent) {
+    input.store.recordConversationEvent({
+      userId: input.user.id,
+      deviceId: input.deviceId,
+      threadId: conversationEvent.threadId,
+      workspaceId: conversationEvent.workspaceId
+    });
+  }
   const supervisor = input.state.supervisors.get(input.deviceId);
   if (!supervisor || supervisor.socket.readyState !== WEBSOCKET_OPEN) {
     input.reply.status(503).send({
@@ -1517,6 +1953,30 @@ async function forwardRelayHttp(input) {
     });
   }
 }
+async function forwardSharedThreadList(input) {
+  const supervisor = input.state.supervisors.get(input.deviceId);
+  if (!supervisor || supervisor.socket.readyState !== WEBSOCKET_OPEN) {
+    input.reply.status(503).send({
+      code: "service_unavailable",
+      message: "No supervisor is connected for this device."
+    });
+    return;
+  }
+  const threads = await Promise.all(
+    input.shares.map(async (share) => {
+      input.store.recordShareAccess(share, input.user);
+      const payload = await forwardSupervisorJson(
+        supervisor,
+        input.deviceId,
+        `/api/threads/${encodeURIComponent(share.threadId)}?limit=1`,
+        { timeoutMs: RELAY_REQUEST_TIMEOUT_MS }
+      );
+      const thread = isObject(payload) && isObject(payload.thread) ? payload.thread : payload;
+      return isObject(thread) ? thread : null;
+    })
+  );
+  input.reply.send(threads.filter((thread) => Boolean(thread)));
+}
 function relayResponseBody(response) {
   if (response.bodyEncoding === "base64") {
     return Buffer.from(response.body, "base64");
@@ -1653,6 +2113,14 @@ function requireRelayUser(request, reply, store, options = {}) {
     });
     return null;
   }
+  if (!options.admin && session.user.role === "admin") {
+    reply.status(403).send({
+      code: "forbidden",
+      message: "Use the relay admin panel for this account."
+    });
+    return null;
+  }
+  store.recordUserSeen(session.user.id);
   request.relayUser = session.user;
   return session.user;
 }
@@ -1677,11 +2145,199 @@ function connectionStatus(state) {
     statuses.set(deviceId, {
       connected: true,
       connectedAt: supervisor.connectedAt,
-      lastHeartbeatAt: supervisor.lastHeartbeatAt
+      lastHeartbeatAt: supervisor.lastHeartbeatAt,
+      ipAddress: supervisor.ipAddress ?? null
     });
   }
   return statuses;
 }
+async function enrichAdminSummary(summary, state, store, conversationWindowDays) {
+  const workspacesByDeviceId = /* @__PURE__ */ new Map();
+  const threadsByDeviceId = /* @__PURE__ */ new Map();
+  await Promise.all(
+    summary.devices.map(async (device) => {
+      const supervisor = state.supervisors.get(device.id);
+      if (!supervisor || supervisor.socket.readyState !== WEBSOCKET_OPEN) {
+        return;
+      }
+      const [workspaces, threads] = await Promise.all([
+        fetchRelayWorkspaces(supervisor, device.id),
+        fetchRelayThreads(supervisor, device.id)
+      ]);
+      workspacesByDeviceId.set(device.id, workspaces);
+      const workspaceLabelById = new Map(workspaces.map((workspace) => [workspace.id, workspace.label]));
+      threadsByDeviceId.set(
+        device.id,
+        threads.map((thread) => ({
+          ...thread,
+          workspaceLabel: thread.workspaceId ? workspaceLabelById.get(thread.workspaceId) ?? thread.workspaceLabel : null
+        }))
+      );
+    })
+  );
+  const enriched = store.adminSummary(connectionStatus(state), {
+    metadata: {
+      workspacesByDeviceId,
+      threadsByDeviceId
+    },
+    ...conversationWindowDays !== void 0 ? { conversationWindowDays } : {}
+  });
+  return {
+    ...enriched,
+    shares: enriched.shares.map((share) => {
+      const thread = threadsByDeviceId.get(share.deviceId)?.find((item) => item.id === share.threadId);
+      const workspace = share.workspaceId ? workspacesByDeviceId.get(share.deviceId)?.find((item) => item.id === share.workspaceId) : null;
+      return {
+        ...share,
+        threadTitle: thread?.title ?? share.threadTitle,
+        workspaceLabel: workspace?.label ?? thread?.workspaceLabel ?? share.workspaceLabel
+      };
+    })
+  };
+}
+async function fetchRelayWorkspaces(supervisor, deviceId) {
+  const payload = await forwardSupervisorJson(supervisor, deviceId, "/api/workspaces");
+  const rows = Array.isArray(payload) ? payload : [];
+  const workspaces = [];
+  for (const workspace of rows.filter(isObject)) {
+    const id = stringField(workspace, "id");
+    const label = stringField(workspace, "label");
+    if (!id || !label) {
+      continue;
+    }
+    workspaces.push({
+      id,
+      label,
+      absPath: stringField(workspace, "absPath")
+    });
+  }
+  return workspaces.slice(0, 50);
+}
+async function fetchRelayThreads(supervisor, deviceId) {
+  const payload = await forwardSupervisorJson(supervisor, deviceId, "/api/threads");
+  const rows = Array.isArray(payload) ? payload : [];
+  const threads = [];
+  for (const thread of rows.filter(isObject)) {
+    const id = stringField(thread, "id");
+    if (!id) {
+      continue;
+    }
+    threads.push({
+      id,
+      title: stringField(thread, "title") ?? "Untitled thread",
+      workspaceId: stringField(thread, "workspaceId"),
+      workspaceLabel: null,
+      status: stringField(thread, "status"),
+      updatedAt: stringField(thread, "updatedAt") ?? stringField(thread, "createdAt")
+    });
+  }
+  return threads.slice(0, 80);
+}
+async function enrichPortalSummary(portal, state) {
+  const threadCache = /* @__PURE__ */ new Map();
+  const workspaceCache = /* @__PURE__ */ new Map();
+  const enrichShare = async (share) => {
+    const supervisor = state.supervisors.get(share.deviceId);
+    if (!supervisor || supervisor.socket.readyState !== WEBSOCKET_OPEN) {
+      return share;
+    }
+    const threadCacheKey = `${share.deviceId}:${share.threadId}`;
+    let threadTitlePromise = threadCache.get(threadCacheKey);
+    if (!threadTitlePromise) {
+      threadTitlePromise = fetchRelayThreadTitle(supervisor, share.deviceId, share.threadId);
+      threadCache.set(threadCacheKey, threadTitlePromise);
+    }
+    let workspaceLabelPromise = Promise.resolve(null);
+    if (share.workspaceId) {
+      const workspaceCacheKey = `${share.deviceId}:${share.workspaceId}`;
+      const cached = workspaceCache.get(workspaceCacheKey);
+      if (cached) {
+        workspaceLabelPromise = cached;
+      } else {
+        workspaceLabelPromise = fetchRelayWorkspaceLabel(
+          supervisor,
+          share.deviceId,
+          share.workspaceId
+        );
+        workspaceCache.set(workspaceCacheKey, workspaceLabelPromise);
+      }
+    }
+    const [threadTitle, workspaceLabel] = await Promise.all([
+      threadTitlePromise,
+      workspaceLabelPromise
+    ]);
+    return {
+      ...share,
+      threadTitle,
+      workspaceLabel
+    };
+  };
+  const [sharedWithMe, sharedByMe] = await Promise.all([
+    Promise.all(portal.sharedWithMe.map(enrichShare)),
+    Promise.all(portal.sharedByMe.map(enrichShare))
+  ]);
+  return {
+    ...portal,
+    sharedWithMe,
+    sharedByMe
+  };
+}
+async function fetchRelayThreadTitle(supervisor, deviceId, threadId) {
+  const payload = await forwardSupervisorJson(
+    supervisor,
+    deviceId,
+    `/api/threads/${encodeURIComponent(threadId)}?limit=1`
+  );
+  const thread = isObject(payload) && isObject(payload.thread) ? payload.thread : payload;
+  return stringField(thread, "title");
+}
+async function fetchRelayWorkspaceLabel(supervisor, deviceId, workspaceId) {
+  const payload = await forwardSupervisorJson(supervisor, deviceId, `/api/workspaces/${encodeURIComponent(workspaceId)}`);
+  return stringField(payload, "label");
+}
+async function forwardSupervisorJson(supervisor, deviceId, targetPath, options = {}) {
+  try {
+    const response = await supervisor.requestBroker.forward(
+      supervisor.socket,
+      {
+        type: "relay.request",
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        requestId: randomUUID(),
+        deviceId,
+        payload: {
+          method: "GET",
+          path: targetPath,
+          headers: {},
+          body: null
+        }
+      },
+      { timeoutMs: options.timeoutMs ?? RELAY_PORTAL_METADATA_TIMEOUT_MS }
+    );
+    if (response.statusCode < 200 || response.statusCode >= 300) {
+      return null;
+    }
+    const body = relayJsonBody(response);
+    return JSON.parse(body);
+  } catch {
+    return null;
+  }
+}
+function relayJsonBody(response) {
+  if (response.bodyEncoding === "base64") {
+    return Buffer.from(response.body, "base64").toString("utf8");
+  }
+  return response.body;
+}
+function isObject(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function stringField(value, field) {
+  if (!isObject(value)) {
+    return null;
+  }
+  const fieldValue = value[field];
+  return typeof fieldValue === "string" && fieldValue.trim().length > 0 ? fieldValue : null;
+}
 function relayAccessDto(access) {
   return {
     kind: access.kind,
@@ -1703,6 +2359,15 @@ function isAllowedRelayTarget(pathValue) {
   const pathname = new URL(pathValue, "http://relay.local").pathname;
   return pathname === "/healthz" || pathname.startsWith("/api/");
 }
+function isAllowedSharedRuntimeMetadataRequest(method, pathname) {
+  if (method.toUpperCase() !== "GET") {
+    return false;
+  }
+  if (pathname === "/api/agent-runtimes") {
+    return true;
+  }
+  return /^\/api\/agent-runtimes\/[^/]+\/(?:status|models)$/.test(pathname);
+}
 function threadIdFromPath(pathValue) {
   const pathname = new URL(pathValue, "http://relay.local").pathname;
   const match = /^\/api\/threads\/([^/?#]+)/.exec(pathname);
@@ -1713,6 +2378,39 @@ function workspaceIdFromPath(pathValue) {
   const match = /^\/api\/workspaces\/([^/?#]+)/.exec(pathname);
   return match ? decodeURIComponent(match[1]) : null;
 }
+function conversationEventFromRequest(method, pathValue, body) {
+  if (method.toUpperCase() !== "POST") {
+    return null;
+  }
+  const pathname = new URL(pathValue, "http://relay.local").pathname;
+  if (pathname === "/api/threads/start") {
+    return {
+      threadId: null,
+      workspaceId: isObject(body) && typeof body.workspaceId === "string" ? body.workspaceId : null
+    };
+  }
+  const promptMatch = /^\/api\/threads\/([^/?#]+)\/prompt$/.exec(pathname);
+  if (promptMatch) {
+    return {
+      threadId: decodeURIComponent(promptMatch[1]),
+      workspaceId: null
+    };
+  }
+  return null;
+}
+function relayClientIp(request) {
+  const forwarded = firstHeaderValue(request.headers["cf-connecting-ip"]) ?? firstHeaderValue(request.headers["x-real-ip"]) ?? firstHeaderValue(request.headers["x-forwarded-for"]);
+  if (forwarded) {
+    return forwarded.split(",")[0]?.trim() || forwarded;
+  }
+  return request.ip || null;
+}
+function firstHeaderValue(value) {
+  if (Array.isArray(value)) {
+    return value[0];
+  }
+  return value;
+}
 function isAllowedForRelayAccess(access, method, pathValue) {
   if (access.kind === "owner") {
     return true;
@@ -1751,16 +2449,36 @@ function isAllowedSharedThreadPath(access, methodName, pathname, threadId) {
   if (access.threadAccess !== "control") {
     return false;
   }
+  const controlReadPatterns = [
+    new RegExp(`^/api/threads/${escapedThreadId}/fork-turns$`)
+  ];
+  if (methodName === "GET") {
+    return controlReadPatterns.some((pattern) => pattern.test(pathname));
+  }
   const controlPatterns = [
     new RegExp(`^/api/threads/${escapedThreadId}/goal$`),
     new RegExp(`^/api/threads/${escapedThreadId}/resume$`),
     new RegExp(`^/api/threads/${escapedThreadId}/prompt$`),
     new RegExp(`^/api/threads/${escapedThreadId}/interrupt$`),
+    new RegExp(`^/api/threads/${escapedThreadId}/compact$`),
+    new RegExp(`^/api/threads/${escapedThreadId}/fork$`),
+    new RegExp(`^/api/threads/${escapedThreadId}/hooks$`),
+    new RegExp(`^/api/threads/${escapedThreadId}/hooks/trust$`),
+    new RegExp(`^/api/threads/${escapedThreadId}/hooks/untrust$`),
     new RegExp(`^/api/threads/${escapedThreadId}/requests/[^/]+/respond$`)
   ];
   if (methodName === "PATCH") {
+    return [
+      new RegExp(`^/api/threads/${escapedThreadId}/goal$`),
+      new RegExp(`^/api/threads/${escapedThreadId}/settings$`)
+    ].some((pattern) => pattern.test(pathname));
+  }
+  if (methodName === "DELETE") {
     return new RegExp(`^/api/threads/${escapedThreadId}/goal$`).test(pathname);
   }
+  if (methodName === "PUT") {
+    return new RegExp(`^/api/threads/${escapedThreadId}/hooks$`).test(pathname);
+  }
   if (methodName === "POST") {
     return controlPatterns.some((pattern) => pattern.test(pathname));
   }