remote-codex 0.11.29 → 0.11.31

package/apps/relay-server/dist/index.js

@@ -284,6 +284,82 @@ var RelayStore = class _RelayStore {
     this.insertShare(share);
     return share;
   }
+  createGrant(ownerUserId, input) {
+    const owner = this.requireUser(ownerUserId);
+    const device = this.getDevice(input.deviceId);
+    if (!device || device.ownerUserId !== ownerUserId) {
+      throw new RelayStoreError(404, "not_found", "Device was not found.");
+    }
+    const target = this.getUserByIdentifier(input.targetIdentifier);
+    if (!target || !target.enabled) {
+      throw new RelayStoreError(404, "not_found", "Target user was not found.");
+    }
+    if (target.id === ownerUserId) {
+      throw new RelayStoreError(400, "bad_request", "You cannot share access with yourself.");
+    }
+    const scope = normalizeShareScope(input.scope);
+    const threadId = scope === "thread" ? input.threadId?.trim() || null : null;
+    const workspaceId = scope === "workspace" ? input.workspaceId?.trim() || null : null;
+    if (scope === "thread" && !threadId) {
+      throw new RelayStoreError(400, "bad_request", "threadId is required for thread grants.");
+    }
+    if (scope === "workspace" && !workspaceId) {
+      throw new RelayStoreError(400, "bad_request", "workspaceId is required for workspace grants.");
+    }
+    const existing = this.rowToGrant(
+      this.sqlite.prepare(
+        `
+            SELECT * FROM relay_access_grants
+            WHERE owner_user_id = ?
+              AND target_user_id = ?
+              AND device_id = ?
+              AND scope = ?
+              AND COALESCE(thread_id, '') = COALESCE(?, '')
+              AND COALESCE(workspace_id, '') = COALESCE(?, '')
+              AND revoked_at IS NULL
+          `
+      ).get(ownerUserId, target.id, input.deviceId, scope, threadId, workspaceId)
+    );
+    if (existing) {
+      return this.updateGrantRecord(existing.id, {
+        label: input.label?.trim() || null,
+        workspaceScope: normalizeWorkspaceScope(input.workspaceScope),
+        workspaceIds: normalizeWorkspaceIds(input.workspaceIds),
+        threadAccess: normalizeThreadAccess(input.threadAccess),
+        workspaceAccess: normalizeWorkspaceAccess(input.workspaceAccess),
+        canCreateThreads: Boolean(input.canCreateThreads),
+        expiresAt: normalizeExpiresAt(input.expiresAt)
+      });
+    }
+    const grant = {
+      id: crypto.randomUUID(),
+      ownerUserId,
+      ownerUsername: owner.username,
+      targetUserId: target.id,
+      targetUsername: target.username,
+      deviceId: input.deviceId,
+      deviceName: device.name,
+      scope,
+      threadId,
+      threadTitle: null,
+      workspaceId,
+      workspaceLabel: null,
+      workspaceScope: normalizeWorkspaceScope(input.workspaceScope),
+      workspaceIds: normalizeWorkspaceIds(input.workspaceIds),
+      label: input.label?.trim() || null,
+      threadAccess: normalizeThreadAccess(input.threadAccess),
+      workspaceAccess: normalizeWorkspaceAccess(input.workspaceAccess),
+      canCreateThreads: Boolean(input.canCreateThreads),
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      revokedAt: null,
+      expiresAt: normalizeExpiresAt(input.expiresAt),
+      lastAccessedAt: null,
+      lastAccessedByUsername: null,
+      accessEvents: []
+    };
+    this.insertGrant(grant);
+    return grant;
+  }
   updateShare(userId, shareId, input) {
     const share = this.rowToShare(
       this.sqlite.prepare("SELECT * FROM relay_shares WHERE id = ? AND owner_user_id = ? AND revoked_at IS NULL").get(shareId, userId)
@@ -312,15 +388,49 @@ var RelayStore = class _RelayStore {
     this.sqlite.prepare("UPDATE relay_shares SET revoked_at = ? WHERE id = ?").run(revokedAt, shareId);
     return { ...share, revokedAt };
   }
+  updateGrant(userId, grantId, input) {
+    const grant = this.rowToGrant(
+      this.sqlite.prepare("SELECT * FROM relay_access_grants WHERE id = ? AND owner_user_id = ? AND revoked_at IS NULL").get(grantId, userId)
+    );
+    if (!grant) {
+      throw new RelayStoreError(404, "not_found", "Grant was not found.");
+    }
+    return this.publicGrant(
+      this.updateGrantRecord(grantId, {
+        label: input.label !== void 0 ? input.label?.trim() || null : grant.label,
+        workspaceScope: input.workspaceScope !== void 0 ? normalizeWorkspaceScope(input.workspaceScope) : grant.workspaceScope,
+        workspaceIds: input.workspaceIds !== void 0 ? normalizeWorkspaceIds(input.workspaceIds) : grant.workspaceIds,
+        threadAccess: input.threadAccess !== void 0 ? normalizeThreadAccess(input.threadAccess) : grant.threadAccess,
+        workspaceAccess: input.workspaceAccess !== void 0 ? normalizeWorkspaceAccess(input.workspaceAccess) : grant.workspaceAccess,
+        canCreateThreads: input.canCreateThreads !== void 0 ? Boolean(input.canCreateThreads) : grant.canCreateThreads,
+        expiresAt: input.expiresAt !== void 0 ? normalizeExpiresAt(input.expiresAt) : grant.expiresAt
+      })
+    );
+  }
+  revokeGrant(userId, grantId) {
+    const grant = this.rowToGrant(
+      this.sqlite.prepare("SELECT * FROM relay_access_grants WHERE id = ? AND owner_user_id = ?").get(grantId, userId)
+    );
+    if (!grant) {
+      throw new RelayStoreError(404, "not_found", "Grant was not found.");
+    }
+    const revokedAt = (/* @__PURE__ */ new Date()).toISOString();
+    this.sqlite.prepare("UPDATE relay_access_grants SET revoked_at = ? WHERE id = ?").run(revokedAt, grantId);
+    return { ...grant, revokedAt };
+  }
   effectiveAccess(userId, deviceId, scope = {}) {
     const owned = this.sqlite.prepare("SELECT 1 FROM relay_devices WHERE id = ? AND owner_user_id = ?").get(deviceId, userId);
     if (owned) {
       return {
         kind: "owner",
         share: null,
+        grant: null,
+        scope: "owner",
         threadAccess: "control",
         workspaceAccess: "write",
-        workspaceId: null
+        workspaceId: null,
+        workspaceScope: null,
+        canCreateThreads: true
       };
     }
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -339,19 +449,25 @@ var RelayStore = class _RelayStore {
             `
         ).get(userId, deviceId, scope.threadId, now)
       );
-      if (!share) {
-        return null;
-      }
-      if (scope.workspaceId && (!share.workspaceId || share.workspaceId !== scope.workspaceId || share.workspaceAccess === "none")) {
-        return null;
+      if (share) {
+        if (scope.workspaceId && (!share.workspaceId || share.workspaceId !== scope.workspaceId || share.workspaceAccess === "none")) {
+          const grant3 = this.findBestGrant(userId, deviceId, scope);
+          return grant3 ? this.accessFromGrant(grant3) : null;
+        }
+        return {
+          kind: "shared",
+          share,
+          grant: this.grantFromShare(share),
+          scope: "thread",
+          threadAccess: share.threadAccess,
+          workspaceAccess: share.workspaceAccess,
+          workspaceId: share.workspaceId,
+          workspaceScope: "selected",
+          canCreateThreads: false
+        };
       }
-      return {
-        kind: "shared",
-        share,
-        threadAccess: share.threadAccess,
-        workspaceAccess: share.workspaceAccess,
-        workspaceId: share.workspaceId
-      };
+      const grant2 = this.findBestGrant(userId, deviceId, scope);
+      return grant2 ? this.accessFromGrant(grant2) : null;
     }
     if (scope.workspaceId) {
       const share = this.rowToShare(
@@ -371,18 +487,24 @@ var RelayStore = class _RelayStore {
             `
         ).get(userId, deviceId, scope.workspaceId, now)
       );
-      if (!share) {
-        return null;
+      if (share) {
+        return {
+          kind: "shared",
+          share,
+          grant: this.grantFromShare(share),
+          scope: "thread",
+          threadAccess: share.threadAccess,
+          workspaceAccess: share.workspaceAccess,
+          workspaceId: share.workspaceId,
+          workspaceScope: "selected",
+          canCreateThreads: false
+        };
       }
-      return {
-        kind: "shared",
-        share,
-        threadAccess: share.threadAccess,
-        workspaceAccess: share.workspaceAccess,
-        workspaceId: share.workspaceId
-      };
+      const grant2 = this.findBestGrant(userId, deviceId, scope);
+      return grant2 ? this.accessFromGrant(grant2) : null;
     }
-    return null;
+    const grant = this.findBestGrant(userId, deviceId, scope);
+    return grant ? this.accessFromGrant(grant) : null;
   }
   canAccessDevice(userId, deviceId, threadId) {
     return Boolean(
@@ -396,11 +518,22 @@ var RelayStore = class _RelayStore {
     const devices = this.getDevicesByOwner(userId);
     const sharedWithMe = this.getSharesByTarget(userId);
     const sharedByMe = this.getSharesByOwner(userId);
+    const grantsWithMe = this.getGrantsByTarget(userId);
+    const grantsByMe = this.getGrantsByOwner(userId);
     return {
       user: this.publicUser(user),
       devices: devices.map((device) => this.publicDevice(device, connectedDevices.get(device.id) ?? null)),
       sharedWithMe: sharedWithMe.map((share) => this.publicShare(share)),
-      sharedByMe: sharedByMe.map((share) => this.publicShare(share))
+      sharedByMe: sharedByMe.map((share) => this.publicShare(share)),
+      sharedDevicesWithMe: grantsWithMe.filter((grant) => grant.scope === "device").map((grant) => this.publicGrant(grant)),
+      sharedThreadsWithMe: [
+        ...sharedWithMe.map((share) => this.publicGrant(this.grantFromShare(share))),
+        ...grantsWithMe.filter((grant) => grant.scope !== "device").map((grant) => this.publicGrant(grant))
+      ],
+      grantsByMe: [
+        ...sharedByMe.map((share) => this.publicGrant(this.grantFromShare(share))),
+        ...grantsByMe.map((grant) => this.publicGrant(grant))
+      ]
     };
   }
   sharedThreadsForDevice(userId, deviceId) {
@@ -628,7 +761,7 @@ var RelayStore = class _RelayStore {
       threads: metadata?.threadsByDeviceId?.get(device.id) ?? []
     };
   }
-  recordShareAccess(share, user) {
+  recordShareAccess(share, user, kind = "access") {
     if (share.revokedAt || share.expiresAt && share.expiresAt <= (/* @__PURE__ */ new Date()).toISOString()) {
       return;
     }
@@ -636,10 +769,23 @@ var RelayStore = class _RelayStore {
     this.sqlite.prepare(
       `
           INSERT INTO relay_share_access_events (
-            id, share_id, user_id, username, accessed_at
-          ) VALUES (?, ?, ?, ?, ?)
+            id, share_id, user_id, username, kind, accessed_at
+          ) VALUES (?, ?, ?, ?, ?, ?)
         `
-    ).run(crypto.randomUUID(), share.id, user.id, user.username, accessedAt);
+    ).run(crypto.randomUUID(), share.id, user.id, user.username, kind, accessedAt);
+  }
+  recordGrantAccess(grant, user, kind = "access") {
+    if (grant.revokedAt || grant.expiresAt && grant.expiresAt <= (/* @__PURE__ */ new Date()).toISOString()) {
+      return;
+    }
+    const accessedAt = (/* @__PURE__ */ new Date()).toISOString();
+    this.sqlite.prepare(
+      `
+          INSERT INTO relay_access_grant_events (
+            id, grant_id, user_id, username, kind, accessed_at
+          ) VALUES (?, ?, ?, ?, ?, ?)
+        `
+    ).run(crypto.randomUUID(), grant.id, user.id, user.username, kind, accessedAt);
   }
   publicShare(share) {
     const owner = this.getUser(share.ownerUserId);
@@ -657,6 +803,22 @@ var RelayStore = class _RelayStore {
       accessEvents
     };
   }
+  publicGrant(grant) {
+    const owner = this.getUser(grant.ownerUserId);
+    const target = this.getUser(grant.targetUserId);
+    const device = this.getDevice(grant.deviceId);
+    const accessEvents = this.getGrantAccessEvents(grant.id);
+    const lastAccess = accessEvents[0] ?? null;
+    return {
+      ...grant,
+      ownerUsername: grant.ownerUsername ?? owner?.username ?? "unknown",
+      targetUsername: grant.targetUsername ?? target?.username ?? "unknown",
+      deviceName: grant.deviceName ?? device?.name ?? "Remote Codex device",
+      lastAccessedAt: lastAccess?.accessedAt ?? null,
+      lastAccessedByUsername: lastAccess?.username ?? null,
+      accessEvents
+    };
+  }
   migrate() {
     this.sqlite.exec(`
       CREATE TABLE IF NOT EXISTS relay_settings (
@@ -717,11 +879,51 @@ var RelayStore = class _RelayStore {
         share_id TEXT NOT NULL REFERENCES relay_shares(id) ON DELETE CASCADE,
         user_id TEXT NOT NULL REFERENCES relay_users(id) ON DELETE CASCADE,
         username TEXT NOT NULL,
+        kind TEXT NOT NULL DEFAULT 'access',
         accessed_at TEXT NOT NULL
       );
 
       CREATE INDEX IF NOT EXISTS relay_share_access_events_share_idx ON relay_share_access_events(share_id, accessed_at DESC);
 
+      CREATE TABLE IF NOT EXISTS relay_access_grants (
+        id TEXT PRIMARY KEY,
+        owner_user_id TEXT NOT NULL REFERENCES relay_users(id) ON DELETE CASCADE,
+        owner_username TEXT,
+        target_user_id TEXT NOT NULL REFERENCES relay_users(id) ON DELETE CASCADE,
+        target_username TEXT,
+        device_id TEXT NOT NULL REFERENCES relay_devices(id) ON DELETE CASCADE,
+        device_name TEXT,
+        scope TEXT NOT NULL CHECK (scope IN ('thread', 'workspace', 'device')),
+        thread_id TEXT,
+        thread_title TEXT,
+        workspace_id TEXT,
+        workspace_label TEXT,
+        workspace_scope TEXT NOT NULL DEFAULT 'all',
+        workspace_ids TEXT NOT NULL DEFAULT '[]',
+        label TEXT,
+        thread_access TEXT NOT NULL DEFAULT 'control',
+        workspace_access TEXT NOT NULL DEFAULT 'none',
+        can_create_threads INTEGER NOT NULL DEFAULT 0,
+        created_at TEXT NOT NULL,
+        revoked_at TEXT,
+        expires_at TEXT
+      );
+
+      CREATE INDEX IF NOT EXISTS relay_access_grants_owner_idx ON relay_access_grants(owner_user_id);
+      CREATE INDEX IF NOT EXISTS relay_access_grants_target_idx ON relay_access_grants(target_user_id);
+      CREATE INDEX IF NOT EXISTS relay_access_grants_device_scope_idx ON relay_access_grants(device_id, scope);
+
+      CREATE TABLE IF NOT EXISTS relay_access_grant_events (
+        id TEXT PRIMARY KEY,
+        grant_id TEXT NOT NULL REFERENCES relay_access_grants(id) ON DELETE CASCADE,
+        user_id TEXT NOT NULL REFERENCES relay_users(id) ON DELETE CASCADE,
+        username TEXT NOT NULL,
+        kind TEXT NOT NULL DEFAULT 'access',
+        accessed_at TEXT NOT NULL
+      );
+
+      CREATE INDEX IF NOT EXISTS relay_access_grant_events_grant_idx ON relay_access_grant_events(grant_id, accessed_at DESC);
+
       CREATE TABLE IF NOT EXISTS relay_conversation_events (
         id TEXT PRIMARY KEY,
         user_id TEXT NOT NULL REFERENCES relay_users(id) ON DELETE CASCADE,
@@ -755,6 +957,11 @@ var RelayStore = class _RelayStore {
     this.ensureColumn("relay_shares", "thread_access", "TEXT NOT NULL DEFAULT 'control'");
     this.ensureColumn("relay_shares", "workspace_access", "TEXT NOT NULL DEFAULT 'none'");
     this.ensureColumn("relay_shares", "expires_at", "TEXT");
+    this.ensureColumn("relay_access_grants", "workspace_scope", "TEXT NOT NULL DEFAULT 'all'");
+    this.ensureColumn("relay_access_grants", "workspace_ids", "TEXT NOT NULL DEFAULT '[]'");
+    this.ensureColumn("relay_access_grants", "can_create_threads", "INTEGER NOT NULL DEFAULT 0");
+    this.ensureColumn("relay_share_access_events", "kind", "TEXT NOT NULL DEFAULT 'access'");
+    this.ensureColumn("relay_access_grant_events", "kind", "TEXT NOT NULL DEFAULT 'access'");
   }
   ensureColumn(table, column, definition) {
     const columns = this.sqlite.prepare(`PRAGMA table_info(${table})`).all();
@@ -962,6 +1169,40 @@ var RelayStore = class _RelayStore {
       share.expiresAt
     );
   }
+  insertGrant(grant) {
+    this.sqlite.prepare(
+      `
+          INSERT INTO relay_access_grants (
+            id, owner_user_id, owner_username, target_user_id, target_username,
+            device_id, device_name, scope, thread_id, thread_title, workspace_id,
+            workspace_label, workspace_scope, workspace_ids, label, thread_access,
+            workspace_access, can_create_threads, created_at, revoked_at, expires_at
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        `
+    ).run(
+      grant.id,
+      grant.ownerUserId,
+      grant.ownerUsername,
+      grant.targetUserId,
+      grant.targetUsername,
+      grant.deviceId,
+      grant.deviceName,
+      grant.scope,
+      grant.threadId,
+      grant.threadTitle,
+      grant.workspaceId,
+      grant.workspaceLabel,
+      grant.workspaceScope,
+      JSON.stringify(grant.workspaceIds),
+      grant.label,
+      grant.threadAccess,
+      grant.workspaceAccess,
+      grant.canCreateThreads ? 1 : 0,
+      grant.createdAt,
+      grant.revokedAt,
+      grant.expiresAt
+    );
+  }
   updateShareMetadata(shareId, input) {
     const threadTitle = normalizeOptionalMetadata(input.threadTitle);
     const workspaceLabel = normalizeOptionalMetadata(input.workspaceLabel);
@@ -995,6 +1236,24 @@ var RelayStore = class _RelayStore {
       shareId: row.share_id,
       userId: row.user_id,
       username: row.username,
+      kind: normalizeAccessEventKind(row.kind),
+      accessedAt: row.accessed_at
+    }));
+  }
+  getGrantAccessEvents(grantId) {
+    return this.sqlite.prepare(
+      `
+            SELECT * FROM relay_access_grant_events
+            WHERE grant_id = ?
+            ORDER BY accessed_at DESC
+            LIMIT 8
+          `
+    ).all(grantId).map((row) => ({
+      id: row.id,
+      grantId: row.grant_id,
+      userId: row.user_id,
+      username: row.username,
+      kind: normalizeAccessEventKind(row.kind),
       accessedAt: row.accessed_at
     }));
   }
@@ -1021,6 +1280,33 @@ var RelayStore = class _RelayStore {
       this.sqlite.prepare("SELECT * FROM relay_shares WHERE id = ?").get(shareId)
     );
   }
+  updateGrantRecord(grantId, input) {
+    this.sqlite.prepare(
+      `
+          UPDATE relay_access_grants
+          SET label = ?,
+              workspace_scope = ?,
+              workspace_ids = ?,
+              thread_access = ?,
+              workspace_access = ?,
+              can_create_threads = ?,
+              expires_at = ?
+          WHERE id = ?
+        `
+    ).run(
+      input.label,
+      input.workspaceScope,
+      JSON.stringify(input.workspaceIds),
+      input.threadAccess,
+      input.workspaceAccess,
+      input.canCreateThreads ? 1 : 0,
+      input.expiresAt,
+      grantId
+    );
+    return this.rowToGrant(
+      this.sqlite.prepare("SELECT * FROM relay_access_grants WHERE id = ?").get(grantId)
+    );
+  }
   getUser(id) {
     return this.rowToUser(this.sqlite.prepare("SELECT * FROM relay_users WHERE id = ?").get(id));
   }
@@ -1057,6 +1343,107 @@ var RelayStore = class _RelayStore {
     const rows = options.includeRevoked ? this.sqlite.prepare(sql).all() : this.sqlite.prepare(sql).all((/* @__PURE__ */ new Date()).toISOString());
     return rows.map((row) => this.rowToShare(row)).filter((share) => Boolean(share));
   }
+  getGrantsByOwner(ownerUserId) {
+    return this.sqlite.prepare("SELECT * FROM relay_access_grants WHERE owner_user_id = ? AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > ?) ORDER BY created_at ASC").all(ownerUserId, (/* @__PURE__ */ new Date()).toISOString()).map((row) => this.rowToGrant(row)).filter((grant) => Boolean(grant));
+  }
+  getGrantsByTarget(targetUserId) {
+    return this.sqlite.prepare("SELECT * FROM relay_access_grants WHERE target_user_id = ? AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > ?) ORDER BY created_at ASC").all(targetUserId, (/* @__PURE__ */ new Date()).toISOString()).map((row) => this.rowToGrant(row)).filter((grant) => Boolean(grant));
+  }
+  findBestGrant(userId, deviceId, scope) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const rows = this.sqlite.prepare(
+      `
+          SELECT * FROM relay_access_grants
+          WHERE target_user_id = ?
+            AND device_id = ?
+            AND revoked_at IS NULL
+            AND (expires_at IS NULL OR expires_at > ?)
+          ORDER BY
+            CASE scope
+              WHEN 'thread' THEN 3
+              WHEN 'workspace' THEN 2
+              WHEN 'device' THEN 1
+              ELSE 0
+            END DESC,
+            CASE thread_access WHEN 'control' THEN 2 WHEN 'read' THEN 1 ELSE 0 END DESC,
+            CASE workspace_access WHEN 'write' THEN 2 WHEN 'read' THEN 1 ELSE 0 END DESC,
+            can_create_threads DESC,
+            created_at DESC
+        `
+    ).all(userId, deviceId, now);
+    const grants = rows.map((row) => this.rowToGrant(row)).filter((grant) => Boolean(grant));
+    const matchingGrants = grants.filter((grant) => this.grantMatchesScope(grant, scope));
+    return matchingGrants.length > 0 ? mergeMatchingGrants(matchingGrants, scope) : null;
+  }
+  grantMatchesScope(grant, scope) {
+    if (grant.scope === "thread") {
+      if (!scope.threadId || grant.threadId !== scope.threadId) {
+        return false;
+      }
+      return true;
+    }
+    if (grant.scope === "workspace") {
+      if (!scope.workspaceId || grant.workspaceId !== scope.workspaceId || grant.workspaceAccess === "none") {
+        return false;
+      }
+      return true;
+    }
+    if (grant.scope === "device") {
+      if (scope.workspaceId && grant.workspaceAccess === "none") {
+        return false;
+      }
+      return true;
+    }
+    return false;
+  }
+  accessFromGrant(grant) {
+    return {
+      kind: "shared",
+      share: null,
+      grant,
+      scope: grant.scope,
+      threadAccess: grant.threadAccess,
+      workspaceAccess: grant.workspaceAccess,
+      workspaceId: grant.workspaceId,
+      workspaceScope: grant.workspaceScope,
+      canCreateThreads: grant.canCreateThreads
+    };
+  }
+  grantFromShare(share) {
+    return {
+      id: share.id,
+      ownerUserId: share.ownerUserId,
+      ownerUsername: share.ownerUsername,
+      targetUserId: share.targetUserId,
+      targetUsername: share.targetUsername,
+      deviceId: share.deviceId,
+      deviceName: share.deviceName,
+      scope: "thread",
+      threadId: share.threadId,
+      threadTitle: share.threadTitle,
+      workspaceId: share.workspaceId,
+      workspaceLabel: share.workspaceLabel,
+      workspaceScope: "selected",
+      workspaceIds: share.workspaceId ? [share.workspaceId] : [],
+      label: share.label,
+      threadAccess: share.threadAccess,
+      workspaceAccess: share.workspaceAccess,
+      canCreateThreads: false,
+      createdAt: share.createdAt,
+      revokedAt: share.revokedAt,
+      expiresAt: share.expiresAt,
+      lastAccessedAt: share.lastAccessedAt,
+      lastAccessedByUsername: share.lastAccessedByUsername,
+      accessEvents: share.accessEvents.map((event) => ({
+        id: event.id,
+        grantId: event.shareId,
+        userId: event.userId,
+        username: event.username,
+        kind: event.kind,
+        accessedAt: event.accessedAt
+      }))
+    };
+  }
   conversationCountsByUser(days) {
     const since = new Date(Date.now() - days * 24 * 60 * 60 * 1e3).toISOString();
     const rows = this.sqlite.prepare(
@@ -1169,6 +1556,35 @@ var RelayStore = class _RelayStore {
       accessEvents: []
     };
   }
+  rowToGrant(row) {
+    if (!row) return null;
+    return {
+      id: row.id,
+      ownerUserId: row.owner_user_id,
+      ownerUsername: row.owner_username ?? "unknown",
+      targetUserId: row.target_user_id,
+      targetUsername: row.target_username ?? "unknown",
+      deviceId: row.device_id,
+      deviceName: row.device_name ?? "Remote Codex device",
+      scope: normalizeShareScope(row.scope),
+      threadId: row.thread_id ?? null,
+      threadTitle: row.thread_title ?? null,
+      workspaceId: row.workspace_id ?? null,
+      workspaceLabel: row.workspace_label ?? null,
+      workspaceScope: normalizeWorkspaceScope(row.workspace_scope),
+      workspaceIds: parseWorkspaceIds(row.workspace_ids),
+      label: row.label,
+      threadAccess: normalizeThreadAccess(row.thread_access),
+      workspaceAccess: normalizeWorkspaceAccess(row.workspace_access),
+      canCreateThreads: Boolean(row.can_create_threads),
+      createdAt: row.created_at,
+      revokedAt: row.revoked_at,
+      expiresAt: row.expires_at ?? null,
+      lastAccessedAt: null,
+      lastAccessedByUsername: null,
+      accessEvents: []
+    };
+  }
   rowToPendingRegistration(row) {
     if (!row) return null;
     return {
@@ -1205,6 +1621,100 @@ function normalizeWorkspaceAccess(value) {
   }
   return "none";
 }
+function normalizeShareScope(value) {
+  if (value === "workspace" || value === "device") {
+    return value;
+  }
+  return "thread";
+}
+function normalizeWorkspaceScope(value) {
+  return value === "selected" ? "selected" : "all";
+}
+function normalizeWorkspaceIds(values) {
+  if (!Array.isArray(values)) {
+    return [];
+  }
+  return Array.from(new Set(values.map((value) => value.trim()).filter(Boolean))).sort();
+}
+function mergeMatchingGrants(grants, scope) {
+  const sorted = [...grants].sort(compareGrantCapability);
+  const grantScope = mergedGrantScope(sorted);
+  const representative = sorted.find((grant) => grant.scope === grantScope) ?? sorted[0];
+  const threadAccess = sorted.reduce(
+    (best, grant) => maxThreadAccess(best, grant.threadAccess),
+    "read"
+  );
+  const workspaceAccess = sorted.reduce(
+    (best, grant) => maxWorkspaceAccess(best, grant.workspaceAccess),
+    "none"
+  );
+  return {
+    ...representative,
+    scope: grantScope,
+    threadId: grantScope === "thread" ? scope.threadId ?? representative.threadId : null,
+    workspaceId: grantScope === "workspace" ? scope.workspaceId ?? representative.workspaceId : null,
+    threadAccess,
+    workspaceAccess,
+    canCreateThreads: sorted.some((grant) => grant.canCreateThreads)
+  };
+}
+function mergedGrantScope(grants) {
+  if (grants.some((grant) => grant.scope === "device")) {
+    return "device";
+  }
+  if (grants.some((grant) => grant.scope === "workspace")) {
+    return "workspace";
+  }
+  return "thread";
+}
+function maxThreadAccess(left, right) {
+  return threadAccessScore(right) > threadAccessScore(left) ? right : left;
+}
+function maxWorkspaceAccess(left, right) {
+  return workspaceAccessScore(right) > workspaceAccessScore(left) ? right : left;
+}
+function compareGrantCapability(left, right) {
+  return threadAccessScore(right.threadAccess) - threadAccessScore(left.threadAccess) || workspaceAccessScore(right.workspaceAccess) - workspaceAccessScore(left.workspaceAccess) || Number(right.canCreateThreads) - Number(left.canCreateThreads) || grantScopeScore(right.scope) - grantScopeScore(left.scope) || right.createdAt.localeCompare(left.createdAt);
+}
+function threadAccessScore(value) {
+  return value === "control" ? 2 : value === "read" ? 1 : 0;
+}
+function workspaceAccessScore(value) {
+  return value === "write" ? 2 : value === "read" ? 1 : 0;
+}
+function grantScopeScore(value) {
+  if (value === "thread") {
+    return 3;
+  }
+  if (value === "workspace") {
+    return 2;
+  }
+  return 1;
+}
+function normalizeAccessEventKind(value) {
+  switch (value) {
+    case "open_device":
+    case "open_thread":
+    case "create_thread":
+    case "send_prompt":
+    case "read_workspace_file":
+    case "write_workspace_file":
+      return value;
+    default:
+      return "access";
+  }
+}
+function parseWorkspaceIds(value) {
+  if (!value) {
+    return [];
+  }
+  try {
+    const parsed = JSON.parse(value);
+    return normalizeWorkspaceIds(Array.isArray(parsed) ? parsed.filter((item) => typeof item === "string") : []);
+  } catch {
+    return [];
+  }
+}
 function normalizeExpiresAt(value) {
   if (!value) {
     return null;
@@ -1252,6 +1762,8 @@ var WEBSOCKET_OPEN = 1;
 var RELAY_COOKIE_NAME = "remote_codex_relay_session";
 var threadAccessSchema = z.enum(["read", "control"]);
 var workspaceAccessSchema = z.enum(["none", "read", "write"]);
+var grantScopeSchema = z.enum(["thread", "workspace", "device"]);
+var workspaceScopeSchema = z.enum(["all", "selected"]);
 var loginSchema = z.object({
   identifier: z.string().trim().min(1),
   password: z.string().min(1)
@@ -1286,6 +1798,40 @@ var updateShareSchema = z.object({
   workspaceAccess: workspaceAccessSchema.optional(),
   expiresAt: z.string().datetime().nullable().optional()
 });
+var createGrantSchema = z.object({
+  targetIdentifier: z.string().trim().min(1).optional(),
+  targetUsername: z.string().trim().min(3).optional(),
+  deviceId: z.string().uuid(),
+  scope: grantScopeSchema,
+  threadId: z.string().trim().min(1).nullable().optional(),
+  workspaceId: z.string().uuid().nullable().optional(),
+  workspaceScope: workspaceScopeSchema.default("all"),
+  workspaceIds: z.array(z.string().uuid()).default([]),
+  label: z.string().trim().min(1).max(160).nullable().optional(),
+  threadAccess: threadAccessSchema.default("control"),
+  workspaceAccess: workspaceAccessSchema.default("none"),
+  canCreateThreads: z.boolean().optional(),
+  expiresAt: z.string().datetime().nullable().optional()
+}).refine((input) => input.targetIdentifier || input.targetUsername, {
+  message: "targetIdentifier is required.",
+  path: ["targetIdentifier"]
+}).refine((input) => input.scope !== "thread" || Boolean(input.threadId), {
+  message: "threadId is required for thread grants.",
+  path: ["threadId"]
+}).refine((input) => input.scope !== "workspace" || Boolean(input.workspaceId), {
+  message: "workspaceId is required for workspace grants.",
+  path: ["workspaceId"]
+});
+var updateGrantSchema = z.object({
+  workspaceId: z.string().uuid().nullable().optional(),
+  workspaceScope: workspaceScopeSchema.optional(),
+  workspaceIds: z.array(z.string().uuid()).optional(),
+  label: z.string().trim().min(1).max(160).nullable().optional(),
+  threadAccess: threadAccessSchema.optional(),
+  workspaceAccess: workspaceAccessSchema.optional(),
+  canCreateThreads: z.boolean().optional(),
+  expiresAt: z.string().datetime().nullable().optional()
+});
 var setEnabledSchema = z.object({
   enabled: z.boolean()
 });
@@ -1565,6 +2111,44 @@ function buildRelayServer(config2, options = {}) {
     const { shareId } = z.object({ shareId: z.string().uuid() }).parse(request.params);
     return store.revokeShare(user.id, shareId);
   });
+  app2.post("/relay/grants", async (request, reply) => {
+    const user = requireRelayUser(request, reply, store);
+    if (!user) {
+      return;
+    }
+    const body = createGrantSchema.parse(request.body ?? {});
+    return store.createGrant(user.id, {
+      targetIdentifier: body.targetIdentifier ?? body.targetUsername,
+      deviceId: body.deviceId,
+      scope: body.scope,
+      threadId: body.threadId ?? null,
+      workspaceId: body.workspaceId ?? null,
+      workspaceScope: body.workspaceScope,
+      workspaceIds: body.workspaceIds,
+      label: body.label ?? null,
+      threadAccess: body.threadAccess,
+      workspaceAccess: body.workspaceAccess,
+      canCreateThreads: body.canCreateThreads ?? false,
+      expiresAt: body.expiresAt ?? null
+    });
+  });
+  app2.patch("/relay/grants/:grantId", async (request, reply) => {
+    const user = requireRelayUser(request, reply, store);
+    if (!user) {
+      return;
+    }
+    const { grantId } = z.object({ grantId: z.string().uuid() }).parse(request.params);
+    const body = updateGrantSchema.parse(request.body ?? {});
+    return store.updateGrant(user.id, grantId, body);
+  });
+  app2.delete("/relay/grants/:grantId", async (request, reply) => {
+    const user = requireRelayUser(request, reply, store);
+    if (!user) {
+      return;
+    }
+    const { grantId } = z.object({ grantId: z.string().uuid() }).parse(request.params);
+    return store.revokeGrant(user.id, grantId);
+  });
   app2.get("/relay/admin", async (request, reply) => {
     const user = requireRelayUser(request, reply, store, { admin: true });
     if (!user) {
@@ -1751,6 +2335,18 @@ function buildRelayServer(config2, options = {}) {
           }
           if (parsed.type === "relay.server.message") {
             const clientConnection = connection.clientSockets.get(parsed.clientId);
+            if (clientConnection) {
+              const eventThreadId = threadIdFromSocketPayload(parsed.payload);
+              const freshAccess = store.effectiveAccess(clientConnection.user.id, clientConnection.deviceId, {
+                threadId: clientConnection.threadId ?? eventThreadId
+              });
+              if (!freshAccess) {
+                connection.clientSockets.delete(parsed.clientId);
+                clientConnection.socket.close(1008, "Shared access is no longer allowed.");
+                return;
+              }
+              clientConnection.access = freshAccess;
+            }
             if (clientConnection && clientConnection.socket.readyState === WEBSOCKET_OPEN && shouldForwardSocketEvent(parsed.payload, clientConnection.threadId)) {
               clientConnection.socket.send(JSON.stringify(parsed.payload));
             }
@@ -1798,9 +2394,9 @@ function buildRelayServer(config2, options = {}) {
           return;
         }
         if (access.kind === "shared") {
-          store.recordShareAccess(access.share, session.user);
+          recordRelayAccess(store, access, session.user, threadId ? "open_thread" : "open_device");
         }
-        connectRelayWebsocket(supervisor, socket, threadId, access);
+        connectRelayWebsocket(supervisor, socket, store, session.user, deviceId, threadId, access);
       }
     });
     realtimeApp.route({
@@ -1831,9 +2427,9 @@ function buildRelayServer(config2, options = {}) {
           return;
         }
         if (access.kind === "shared") {
-          store.recordShareAccess(access.share, session.user);
+          recordRelayAccess(store, access, session.user, threadId ? "open_thread" : "open_device");
         }
-        connectRelayWebsocket(supervisor, socket, threadId, access);
+        connectRelayWebsocket(supervisor, socket, store, session.user, deviceId, threadId, access);
       }
     });
   });
@@ -1932,7 +2528,13 @@ async function forwardRelayHttp(input) {
     return;
   }
   if (access?.kind === "shared") {
-    input.store.recordShareAccess(access.share, input.user);
+    const accessEventKind = relayAccessEventKindFromRequest(
+      input.request.method,
+      input.targetPath
+    );
+    if (accessEventKind) {
+      recordRelayAccess(input.store, access, input.user, accessEventKind);
+    }
   }
   const conversationEvent = conversationEventFromRequest(
     input.request.method,
@@ -2015,9 +2617,9 @@ function relayResponseBody(response) {
   }
   return response.body;
 }
-function connectRelayWebsocket(supervisor, socket, threadId, access) {
+function connectRelayWebsocket(supervisor, socket, store, user, deviceId, threadId, access) {
   const clientId = randomUUID();
-  supervisor.clientSockets.set(clientId, { socket, threadId, access });
+  supervisor.clientSockets.set(clientId, { socket, threadId, deviceId, user, access });
   sendToSupervisor(supervisor, {
     type: "relay.client.connected",
     timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -2030,7 +2632,19 @@ function connectRelayWebsocket(supervisor, socket, threadId, access) {
     } catch {
       return;
     }
-    if (access.kind === "shared" && access.threadAccess !== "control") {
+    const freshAccess = store.effectiveAccess(user.id, deviceId, {
+      threadId: threadId ?? threadIdFromSocketPayload(payload)
+    });
+    if (!freshAccess) {
+      supervisor.clientSockets.delete(clientId);
+      socket.close(1008, "Shared access is no longer allowed.");
+      return;
+    }
+    const clientConnection = supervisor.clientSockets.get(clientId);
+    if (clientConnection) {
+      clientConnection.access = freshAccess;
+    }
+    if (freshAccess.kind === "shared" && freshAccess.threadAccess !== "control") {
       socket.close(1008, "Shared read-only session cannot control supervisor.");
       return;
     }
@@ -2050,6 +2664,9 @@ function connectRelayWebsocket(supervisor, socket, threadId, access) {
     });
   });
 }
+function threadIdFromSocketPayload(payload) {
+  return isObject(payload) && typeof payload.threadId === "string" ? payload.threadId : null;
+}
 function sendToSupervisor(supervisor, message) {
   if (supervisor.socket.readyState === WEBSOCKET_OPEN) {
     supervisor.socket.send(JSON.stringify(message));
@@ -2390,12 +3007,26 @@ function stringField(value, field) {
 function relayAccessDto(access) {
   return {
     kind: access.kind,
+    grantId: access.grant?.id ?? null,
     shareId: access.share?.id ?? null,
+    scope: access.scope,
     threadAccess: access.threadAccess,
     workspaceAccess: access.workspaceAccess,
-    workspaceId: access.workspaceId
+    workspaceId: access.workspaceId,
+    workspaceScope: access.workspaceScope,
+    canCreateThreads: access.canCreateThreads
   };
 }
+function recordRelayAccess(store, access, user, kind) {
+  if (access.kind !== "shared") {
+    return;
+  }
+  if (access.share) {
+    store.recordShareAccess(access.share, user, kind);
+    return;
+  }
+  store.recordGrantAccess(access.grant, user, kind);
+}
 function firstAccessibleConnectedDevice(state, store, userId, threadId) {
   for (const deviceId of state.supervisors.keys()) {
     if (store.canAccessDevice(userId, deviceId, threadId)) {
@@ -2415,6 +3046,9 @@ function isAllowedSharedRuntimeMetadataRequest(method, pathname) {
   if (pathname === "/api/agent-runtimes") {
     return true;
   }
+  if (pathname === "/api/plugins") {
+    return true;
+  }
   return /^\/api\/agent-runtimes\/[^/]+\/(?:status|models)$/.test(pathname);
 }
 function threadIdFromPath(pathValue) {
@@ -2447,6 +3081,29 @@ function conversationEventFromRequest(method, pathValue, body) {
   }
   return null;
 }
+function relayAccessEventKindFromRequest(method, pathValue) {
+  const methodName = method.toUpperCase();
+  const pathname = new URL(pathValue, "http://relay.local").pathname;
+  if (methodName === "POST" && pathname === "/api/threads/start") {
+    return "create_thread";
+  }
+  if (methodName === "POST" && /^\/api\/threads\/[^/]+\/prompt$/.test(pathname)) {
+    return "send_prompt";
+  }
+  if (methodName === "GET" && /^\/api\/threads\/[^/]+$/.test(pathname)) {
+    return "open_thread";
+  }
+  if (methodName === "GET" && /^\/api\/workspaces\/[^/]+$/.test(pathname)) {
+    return "open_device";
+  }
+  if (methodName === "GET" && /^\/api\/workspaces\/[^/]+\/(?:files\/(?:tree|preview|raw|download)|artifacts(?:\/[^/]+(?:\/download)?)?)$/.test(pathname)) {
+    return "read_workspace_file";
+  }
+  if (["POST", "PUT", "PATCH", "DELETE"].includes(methodName) && /^\/api\/workspaces\/[^/]+\/files(?:\/(?:upload|move))?$/.test(pathname)) {
+    return "write_workspace_file";
+  }
+  return null;
+}
 function relayClientIp(request) {
   const forwarded = firstHeaderValue(request.headers["cf-connecting-ip"]) ?? firstHeaderValue(request.headers["x-real-ip"]) ?? firstHeaderValue(request.headers["x-forwarded-for"]);
   if (forwarded) {
@@ -2466,6 +3123,12 @@ function isAllowedForRelayAccess(access, method, pathValue) {
   }
   const pathname = new URL(pathValue, "http://relay.local").pathname;
   const methodName = method.toUpperCase();
+  if (isAllowedSharedRuntimeMetadataRequest(methodName, pathname)) {
+    return true;
+  }
+  if (access.scope === "device" && methodName === "POST" && pathname === "/api/threads/start") {
+    return access.canCreateThreads && access.threadAccess === "control";
+  }
   const threadId = threadIdFromPath(pathValue);
   if (threadId) {
     return isAllowedSharedThreadPath(access, methodName, pathname, threadId);
@@ -2474,10 +3137,18 @@ function isAllowedForRelayAccess(access, method, pathValue) {
   if (workspaceId) {
     return isAllowedSharedWorkspacePath(access, methodName, pathname, workspaceId);
   }
+  if (access.scope === "device") {
+    if (methodName === "GET" && (pathname === "/api/threads" || pathname === "/api/workspaces")) {
+      return true;
+    }
+  }
   return false;
 }
 function isAllowedSharedThreadPath(access, methodName, pathname, threadId) {
-  if (access.kind !== "shared" || access.share.threadId !== threadId) {
+  if (access.kind !== "shared") {
+    return false;
+  }
+  if (access.scope !== "device" && access.grant.threadId !== threadId) {
     return false;
   }
   const escapedThreadId = escapeRegExp(encodeURIComponent(threadId));
@@ -2534,7 +3205,10 @@ function isAllowedSharedThreadPath(access, methodName, pathname, threadId) {
   return false;
 }
 function isAllowedSharedWorkspacePath(access, methodName, pathname, workspaceId) {
-  if (access.kind !== "shared" || access.workspaceAccess === "none" || access.workspaceId !== workspaceId) {
+  if (access.kind !== "shared" || access.workspaceAccess === "none") {
+    return false;
+  }
+  if (access.scope !== "device" && access.workspaceId !== workspaceId) {
     return false;
   }
   const escapedWorkspaceId = escapeRegExp(encodeURIComponent(workspaceId));