yaver-feedback-react-native 0.8.10 → 0.8.12

package/dist/BlackBox.d.ts

@@ -53,6 +53,7 @@ export type CommandHandler = (cmd: BlackBoxCommand) => void;
 export declare class BlackBox {
     private static baseUrl;
     private static authToken;
+    private static relayPassword;
     private static deviceId;
     private static appName;
     private static buffer;

package/dist/BlackBox.js

@@ -18,6 +18,7 @@ class BlackBox {
         }
         BlackBox.baseUrl = feedbackConfig.agentUrl.replace(/\/$/, '');
         BlackBox.authToken = feedbackConfig.authToken ?? null;
+        BlackBox.relayPassword = feedbackConfig.relayPassword ?? '';
         BlackBox.deviceId = config?.deviceId ?? BlackBox.generateDeviceId();
         BlackBox.appName = config?.appName ?? '';
         BlackBox.flushInterval = config?.flushInterval ?? 2000;
@@ -252,15 +253,19 @@ class BlackBox {
         BlackBox.sseAbortController = controller;
         const url = `${BlackBox.baseUrl}/blackbox/command-stream?device=${encodeURIComponent(BlackBox.deviceId)}`;
         try {
+            const sseHeaders = {
+                Authorization: `Bearer ${BlackBox.authToken}`,
+                'X-Device-ID': BlackBox.deviceId,
+                'X-Platform': react_native_1.Platform.OS,
+                'X-App-Name': BlackBox.appName,
+                Accept: 'text/event-stream',
+            };
+            if (BlackBox.relayPassword) {
+                sseHeaders['X-Relay-Password'] = BlackBox.relayPassword;
+            }
             const response = await fetch(url, {
                 method: 'GET',
-                headers: {
-                    Authorization: `Bearer ${BlackBox.authToken}`,
-                    'X-Device-ID': BlackBox.deviceId,
-                    'X-Platform': react_native_1.Platform.OS,
-                    'X-App-Name': BlackBox.appName,
-                    Accept: 'text/event-stream',
-                },
+                headers: sseHeaders,
                 // @ts-ignore — React Native supports signal on fetch
                 signal: controller.signal,
             });
@@ -354,15 +359,19 @@ class BlackBox {
         const events = BlackBox.buffer;
         BlackBox.buffer = [];
         try {
+            const flushHeaders = {
+                Authorization: `Bearer ${BlackBox.authToken}`,
+                'Content-Type': 'application/json',
+                'X-Device-ID': BlackBox.deviceId,
+                'X-Platform': react_native_1.Platform.OS,
+                'X-App-Name': BlackBox.appName,
+            };
+            if (BlackBox.relayPassword) {
+                flushHeaders['X-Relay-Password'] = BlackBox.relayPassword;
+            }
             await fetch(`${BlackBox.baseUrl}/blackbox/events`, {
                 method: 'POST',
-                headers: {
-                    Authorization: `Bearer ${BlackBox.authToken}`,
-                    'Content-Type': 'application/json',
-                    'X-Device-ID': BlackBox.deviceId,
-                    'X-Platform': react_native_1.Platform.OS,
-                    'X-App-Name': BlackBox.appName,
-                },
+                headers: flushHeaders,
                 body: JSON.stringify(events),
             });
         }
@@ -380,6 +389,12 @@ class BlackBox {
 exports.BlackBox = BlackBox;
 BlackBox.baseUrl = null;
 BlackBox.authToken = null;
+// Mirror of the user's relay password — required for EVERY request that
+// crosses the relay (`https://public.yaver.io/d/<id>/...`). Without it
+// the relay rejects with HTTP 401 "invalid relay password" and the
+// event stream silently fails. Set on start() from YaverFeedback's
+// resolved relay password (same source the P2PClient uses).
+BlackBox.relayPassword = '';
 BlackBox.deviceId = '';
 BlackBox.appName = '';
 BlackBox.buffer = [];

package/dist/Discovery.js

@@ -257,15 +257,21 @@ class YaverDiscovery {
      */
     static async discoverViaRelay(convexUrl, authToken, deviceId) {
         try {
-            const settingsRes = await fetch(`${convexUrl}/auth/validate`, {
+            // /settings returns {ok, settings: {relayUrl, relayPassword, ...}}
+            // — `/auth/validate` only returns the user record. Using the
+            // wrong endpoint historically meant relayPassword stayed
+            // undefined and every relay-routed probe rejected with 401
+            // "invalid relay password" (relay/server.go:957).
+            const settingsRes = await fetch(`${convexUrl}/settings`, {
                 headers: { Authorization: `Bearer ${authToken}` },
             });
             let relayUrl;
             let relayPassword;
             if (settingsRes.ok) {
                 const settingsData = await settingsRes.json();
-                relayUrl = settingsData.relayUrl;
-                relayPassword = settingsData.relayPassword;
+                const inner = settingsData?.settings;
+                relayUrl = inner?.relayUrl ?? settingsData?.relayUrl;
+                relayPassword = inner?.relayPassword ?? settingsData?.relayPassword;
             }
             if (!relayUrl) {
                 const configRes = await fetch(`${convexUrl}/platform-config?key=relay_servers`);

package/dist/FeedbackModal.js

@@ -376,7 +376,7 @@ const FeedbackModal = () => {
             return;
         }
         try {
-            const uploaded = await (0, upload_1.uploadFeedback)(config.agentUrl, config.authToken ?? '', bundle);
+            const uploaded = await (0, upload_1.uploadFeedback)(config.agentUrl, config.authToken ?? '', bundle, YaverFeedback_1.YaverFeedback.getRelayPassword());
             // The agent returns the new report id as `id` (see
             // feedback_http.go::ReceiveFeedback). Trigger the fix loop if we got
             // one back; otherwise just ack the upload.

package/dist/P2PClient.js

@@ -291,11 +291,12 @@ class P2PClient {
                 name: 'voice_note.m4a',
             });
         }
+        // Use authHeaders() so a relay-routed baseUrl carries
+        // X-Relay-Password — without it the relay rejects with 401
+        // "invalid relay password" before the agent ever sees the form.
         const response = await fetch(`${this.baseUrl}/feedback`, {
             method: 'POST',
-            headers: {
-                Authorization: `Bearer ${this.authToken}`,
-            },
+            headers: this.authHeaders(),
             body: formData,
         });
         if (!response.ok) {
@@ -313,10 +314,7 @@ class P2PClient {
         for await (const event of events) {
             const response = await fetch(`${this.baseUrl}/feedback/stream`, {
                 method: 'POST',
-                headers: {
-                    Authorization: `Bearer ${this.authToken}`,
-                    'Content-Type': 'application/json',
-                },
+                headers: this.authHeaders({ 'Content-Type': 'application/json' }),
                 body: JSON.stringify(event),
             });
             if (!response.ok) {
@@ -335,10 +333,7 @@ class P2PClient {
     async startBuild(platform) {
         const response = await fetch(`${this.baseUrl}/builds`, {
             method: 'POST',
-            headers: {
-                Authorization: `Bearer ${this.authToken}`,
-                'Content-Type': 'application/json',
-            },
+            headers: this.authHeaders({ "Content-Type": "application/json" }),
             body: JSON.stringify({ platform }),
         });
         if (!response.ok) {
@@ -378,9 +373,7 @@ class P2PClient {
         });
         const response = await fetch(`${this.baseUrl}/voice/transcribe`, {
             method: 'POST',
-            headers: {
-                Authorization: `Bearer ${this.authToken}`,
-            },
+            headers: this.authHeaders(),
             body: formData,
         });
         if (!response.ok) {
@@ -420,7 +413,7 @@ class P2PClient {
         if (mode === 'dev') {
             const primary = await fetch(`${this.baseUrl}/dev/reload`, {
                 method: 'POST',
-                headers: { Authorization: `Bearer ${this.authToken}` },
+                headers: this.authHeaders(),
             });
             if (primary.ok) {
                 const payload = await primary.json().catch(() => ({}));
@@ -451,10 +444,7 @@ class P2PClient {
         const identity = resolveAppIdentity(opts);
         const res = await fetch(`${this.baseUrl}/dev/reload-app`, {
             method: 'POST',
-            headers: {
-                Authorization: `Bearer ${this.authToken}`,
-                'Content-Type': 'application/json',
-            },
+            headers: this.authHeaders({ "Content-Type": "application/json" }),
             body: JSON.stringify({
                 mode: 'bundle',
                 ...identity,
@@ -498,10 +488,7 @@ class P2PClient {
         const identity = resolveAppIdentity(opts);
         const response = await fetch(`${this.baseUrl}/vibing/execute`, {
             method: 'POST',
-            headers: {
-                Authorization: `Bearer ${this.authToken}`,
-                'Content-Type': 'application/json',
-            },
+            headers: this.authHeaders({ "Content-Type": "application/json" }),
             body: JSON.stringify({
                 prompt,
                 projectPath: identity.projectPath ?? opts?.projectPath ?? '',
@@ -529,7 +516,7 @@ class P2PClient {
         }
         const response = await fetch(`${this.baseUrl}/vibing/eligibility?${params.toString()}`, {
             method: 'GET',
-            headers: { Authorization: `Bearer ${this.authToken}` },
+            headers: this.authHeaders(),
         });
         if (!response.ok) {
             const text = await response.text().catch(() => '');
@@ -546,7 +533,7 @@ class P2PClient {
     async triggerFix(feedbackId) {
         const response = await fetch(`${this.baseUrl}/feedback/${encodeURIComponent(feedbackId)}/fix`, {
             method: 'POST',
-            headers: { Authorization: `Bearer ${this.authToken}` },
+            headers: this.authHeaders(),
         });
         if (!response.ok) {
             const text = await response.text().catch(() => '');
@@ -567,10 +554,7 @@ class P2PClient {
     async startTestSession() {
         const response = await fetch(`${this.baseUrl}/test-app/start`, {
             method: 'POST',
-            headers: {
-                Authorization: `Bearer ${this.authToken}`,
-                'Content-Type': 'application/json',
-            },
+            headers: this.authHeaders({ "Content-Type": "application/json" }),
             body: JSON.stringify({ source: 'feedback-sdk' }),
         });
         if (!response.ok) {
@@ -583,7 +567,7 @@ class P2PClient {
     async stopTestSession() {
         await fetch(`${this.baseUrl}/test-app/stop`, {
             method: 'POST',
-            headers: { Authorization: `Bearer ${this.authToken}` },
+            headers: this.authHeaders(),
         });
     }
     /** Get the current test session status and list of fixes. */
@@ -599,10 +583,7 @@ class P2PClient {
     async rotateToken() {
         const response = await fetch(`${this.baseUrl}/sdk/token/rotate`, {
             method: 'POST',
-            headers: {
-                Authorization: `Bearer ${this.authToken}`,
-                'Content-Type': 'application/json',
-            },
+            headers: this.authHeaders({ "Content-Type": "application/json" }),
         });
         if (!response.ok) {
             const text = await response.text().catch(() => '');
@@ -621,7 +602,7 @@ class P2PClient {
      * for 30s in getFlagsCached().
      */
     async flagsEvaluate(userId = 'anonymous') {
-        const res = await fetch(`${this.baseUrl}/flags/eval?userId=${encodeURIComponent(userId)}`, { headers: { Authorization: `Bearer ${this.authToken}` } });
+        const res = await fetch(`${this.baseUrl}/flags/eval?userId=${encodeURIComponent(userId)}`, { headers: this.authHeaders() });
         if (!res.ok)
             return {};
         const data = await res.json();
@@ -629,7 +610,7 @@ class P2PClient {
     }
     /** Evaluate a single flag by key — shortcut when you only need one. */
     async flagsEvaluateOne(key, userId = 'anonymous') {
-        const res = await fetch(`${this.baseUrl}/flags/eval?userId=${encodeURIComponent(userId)}&flag=${encodeURIComponent(key)}`, { headers: { Authorization: `Bearer ${this.authToken}` } });
+        const res = await fetch(`${this.baseUrl}/flags/eval?userId=${encodeURIComponent(userId)}&flag=${encodeURIComponent(key)}`, { headers: this.authHeaders() });
         if (!res.ok)
             return undefined;
         const data = await res.json();
@@ -647,7 +628,7 @@ class P2PClient {
         if (deviceId)
             params.set('device', deviceId);
         const res = await fetch(`${this.baseUrl}/releases/latest?${params.toString()}`, {
-            headers: { Authorization: `Bearer ${this.authToken}` },
+            headers: this.authHeaders(),
         });
         if (!res.ok)
             return null;
@@ -657,7 +638,7 @@ class P2PClient {
     async releasesDownload(channel, semver) {
         const params = new URLSearchParams({ channel, semver });
         const res = await fetch(`${this.baseUrl}/releases/bundle?${params.toString()}`, {
-            headers: { Authorization: `Bearer ${this.authToken}` },
+            headers: this.authHeaders(),
         });
         if (!res.ok)
             return null;
@@ -673,10 +654,7 @@ class P2PClient {
         try {
             const res = await fetch(`${this.baseUrl}/analytics/ingest`, {
                 method: 'POST',
-                headers: {
-                    Authorization: `Bearer ${this.authToken}`,
-                    'Content-Type': 'application/json',
-                },
+                headers: this.authHeaders({ "Content-Type": "application/json" }),
                 body: JSON.stringify({
                     name,
                     props,

package/dist/YaverFeedback.d.ts

@@ -116,6 +116,13 @@ export declare class YaverFeedback {
     static isEnabled(): boolean;
     /** Returns the current config, or null if not initialized. */
     static getConfig(): FeedbackConfig | null;
+    /** Returns the resolved relay password the SDK is currently using.
+     *  Empty string when no relay routing is in play (direct LAN agent
+     *  URLs need no password). Callers attaching it to relay-routed
+     *  HTTP requests must check for empty before setting the header,
+     *  since "X-Relay-Password: " is treated as invalid by the relay
+     *  and would 401 the request. */
+    static getRelayPassword(): string;
     /**
      * Manually attach an error with optional metadata.
      * Use this in catch blocks to give the agent extra context.

package/dist/YaverFeedback.js

@@ -135,7 +135,50 @@ let enabled = false;
 let p2pClient = null;
 let shakeDetector = null;
 let p2pAuthToken = null;
+let p2pRelayPassword = '';
 let reportLaunchInFlight = false;
+/** Resolve the user's relay password by validating their auth token
+ *  against Convex. Used whenever we (re)build the P2PClient so a
+ *  relay-routed agentUrl carries a valid X-Relay-Password — without
+ *  this, every relay-tunneled request rejects with HTTP 401
+ *  "invalid relay password" (relay/server.go:957).
+ *
+ *  Cached on `p2pRelayPassword` so we only round-trip Convex when the
+ *  user's auth token actually changes. Returns "" on any failure so
+ *  direct LAN agentUrls (which need no password) keep working.
+ */
+async function resolveRelayPassword(authToken, convexUrl) {
+    const trimmed = (authToken || '').trim();
+    if (!trimmed) {
+        p2pRelayPassword = '';
+        return '';
+    }
+    const url = (convexUrl || config?.convexUrl || auth_1.DEFAULT_CONVEX_SITE_URL).replace(/\/+$/, '');
+    try {
+        // /settings returns {ok, settings: {relayPassword, relayUrl, ...}}
+        // Older accounts may flatten relayPassword to the top — match the
+        // tolerance the web shell already uses (route.ts:77).
+        const res = await fetch(`${url}/settings`, {
+            headers: { Authorization: `Bearer ${trimmed}` },
+        });
+        if (!res.ok)
+            return p2pRelayPassword;
+        const data = await res.json().catch(() => ({}));
+        const settings = data?.settings;
+        const pw = (typeof settings?.relayPassword === 'string' && settings.relayPassword) ||
+            (typeof data?.relayPassword === 'string'
+                ? data.relayPassword
+                : '') ||
+            '';
+        p2pRelayPassword = pw;
+        return pw;
+    }
+    catch {
+        // Network failure on a passive Convex round-trip shouldn't break
+        // direct-LAN flows. Fall through with whatever we already cached.
+        return p2pRelayPassword;
+    }
+}
 /** Ring buffer of captured errors. */
 let errorBuffer = [];
 let maxErrors = 5;
@@ -192,7 +235,8 @@ class YaverFeedback {
             return;
         }
         p2pAuthToken = token;
-        p2pClient = new P2PClient_1.P2PClient(effectiveUrl, token);
+        const rp = await resolveRelayPassword(token);
+        p2pClient = new P2PClient_1.P2PClient(effectiveUrl, token, rp);
     }
     /**
      * Initialize the feedback SDK with the given configuration.
@@ -271,7 +315,12 @@ class YaverFeedback {
         // Create P2P client if we have a URL
         if (config.agentUrl) {
             p2pAuthToken = config.authToken ?? null;
-            p2pClient = new P2PClient_1.P2PClient(config.agentUrl, config.authToken ?? '');
+            // Initial construction uses the cached p2pRelayPassword (empty on
+            // first init). rebuildP2PClient below resolves the real password
+            // from Convex and replaces this client — but only when authToken
+            // is set, so set a placeholder header here that won't 401 a
+            // direct-LAN url and will be overwritten before any relay hop.
+            p2pClient = new P2PClient_1.P2PClient(config.agentUrl, config.authToken ?? '', p2pRelayPassword);
             if (config.authToken) {
                 void YaverFeedback.rebuildP2PClient(config.agentUrl);
             }
@@ -732,6 +781,15 @@ class YaverFeedback {
     static getConfig() {
         return config;
     }
+    /** Returns the resolved relay password the SDK is currently using.
+     *  Empty string when no relay routing is in play (direct LAN agent
+     *  URLs need no password). Callers attaching it to relay-routed
+     *  HTTP requests must check for empty before setting the header,
+     *  since "X-Relay-Password: " is treated as invalid by the relay
+     *  and would 401 the request. */
+    static getRelayPassword() {
+        return p2pRelayPassword;
+    }
     /**
      * Manually attach an error with optional metadata.
      * Use this in catch blocks to give the agent extra context.
@@ -900,7 +958,8 @@ class YaverFeedback {
                 });
                 if (result) {
                     config.agentUrl = result.url;
-                    p2pClient = new P2PClient_1.P2PClient(result.url, config.authToken ?? '');
+                    const rp = await resolveRelayPassword(config.authToken ?? '');
+                    p2pClient = new P2PClient_1.P2PClient(result.url, config.authToken ?? '', rp);
                 }
             }
             catch { }
@@ -938,7 +997,7 @@ class YaverFeedback {
                 screenshots: screenshotPath ? [screenshotPath] : [],
                 errors: errorBuffer.length > 0 ? [...errorBuffer] : undefined,
             };
-            await uploadFeedback(config.agentUrl, config.authToken ?? '', bundle);
+            await uploadFeedback(config.agentUrl, config.authToken ?? '', bundle, p2pRelayPassword);
             console.log('[YaverFeedback] Auto-report sent');
         }
         catch (err) {

package/dist/upload.d.ts

@@ -12,7 +12,7 @@ import { FeedbackBundle } from './types';
  * Callers can inspect `.id` / `.reportId` to drive a follow-up
  * `/feedback/{id}/fix` kick.
  */
-export declare function uploadFeedback(agentUrl: string, authToken: string, bundle: FeedbackBundle): Promise<{
+export declare function uploadFeedback(agentUrl: string, authToken: string, bundle: FeedbackBundle, relayPassword?: string): Promise<{
     id?: string;
     reportId?: string;
     [k: string]: unknown;

package/dist/upload.js

@@ -15,7 +15,7 @@ const react_native_1 = require("react-native");
  * Callers can inspect `.id` / `.reportId` to drive a follow-up
  * `/feedback/{id}/fix` kick.
  */
-async function uploadFeedback(agentUrl, authToken, bundle) {
+async function uploadFeedback(agentUrl, authToken, bundle, relayPassword = '') {
     const formData = new FormData();
     // Attach metadata as JSON
     formData.append('metadata', JSON.stringify(bundle.metadata));
@@ -44,11 +44,15 @@ async function uploadFeedback(agentUrl, authToken, bundle) {
         });
     }
     const url = agentUrl.replace(/\/$/, '') + '/feedback';
+    const headers = {
+        Authorization: `Bearer ${authToken}`,
+    };
+    if (relayPassword) {
+        headers['X-Relay-Password'] = relayPassword;
+    }
     const response = await fetch(url, {
         method: 'POST',
-        headers: {
-            Authorization: `Bearer ${authToken}`,
-        },
+        headers,
         body: formData,
     });
     if (!response.ok) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yaver-feedback-react-native",
-  "version": "0.8.10",
+  "version": "0.8.12",
   "description": "Visual feedback SDK for Yaver \u2014 bug reports, screen recording, voice annotations, and local-first developer workflows",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/BlackBox.ts

@@ -69,6 +69,12 @@ export type CommandHandler = (cmd: BlackBoxCommand) => void;
 export class BlackBox {
   private static baseUrl: string | null = null;
   private static authToken: string | null = null;
+  // Mirror of the user's relay password — required for EVERY request that
+  // crosses the relay (`https://public.yaver.io/d/<id>/...`). Without it
+  // the relay rejects with HTTP 401 "invalid relay password" and the
+  // event stream silently fails. Set on start() from YaverFeedback's
+  // resolved relay password (same source the P2PClient uses).
+  private static relayPassword: string = '';
   private static deviceId: string = '';
   private static appName: string = '';
   private static buffer: BlackBoxEvent[] = [];
@@ -103,6 +109,7 @@ export class BlackBox {
 
     BlackBox.baseUrl = feedbackConfig.agentUrl.replace(/\/$/, '');
     BlackBox.authToken = feedbackConfig.authToken ?? null;
+    BlackBox.relayPassword = (feedbackConfig as { relayPassword?: string }).relayPassword ?? '';
     BlackBox.deviceId = config?.deviceId ?? BlackBox.generateDeviceId();
     BlackBox.appName = config?.appName ?? '';
     BlackBox.flushInterval = config?.flushInterval ?? 2000;
@@ -375,15 +382,19 @@ export class BlackBox {
     const url = `${BlackBox.baseUrl}/blackbox/command-stream?device=${encodeURIComponent(BlackBox.deviceId)}`;
 
     try {
+      const sseHeaders: Record<string, string> = {
+        Authorization: `Bearer ${BlackBox.authToken}`,
+        'X-Device-ID': BlackBox.deviceId,
+        'X-Platform': Platform.OS,
+        'X-App-Name': BlackBox.appName,
+        Accept: 'text/event-stream',
+      };
+      if (BlackBox.relayPassword) {
+        sseHeaders['X-Relay-Password'] = BlackBox.relayPassword;
+      }
       const response = await fetch(url, {
         method: 'GET',
-        headers: {
-          Authorization: `Bearer ${BlackBox.authToken}`,
-          'X-Device-ID': BlackBox.deviceId,
-          'X-Platform': Platform.OS,
-          'X-App-Name': BlackBox.appName,
-          Accept: 'text/event-stream',
-        },
+        headers: sseHeaders,
         // @ts-ignore — React Native supports signal on fetch
         signal: controller.signal,
       });
@@ -479,15 +490,19 @@ export class BlackBox {
     BlackBox.buffer = [];
 
     try {
+      const flushHeaders: Record<string, string> = {
+        Authorization: `Bearer ${BlackBox.authToken}`,
+        'Content-Type': 'application/json',
+        'X-Device-ID': BlackBox.deviceId,
+        'X-Platform': Platform.OS,
+        'X-App-Name': BlackBox.appName,
+      };
+      if (BlackBox.relayPassword) {
+        flushHeaders['X-Relay-Password'] = BlackBox.relayPassword;
+      }
       await fetch(`${BlackBox.baseUrl}/blackbox/events`, {
         method: 'POST',
-        headers: {
-          Authorization: `Bearer ${BlackBox.authToken}`,
-          'Content-Type': 'application/json',
-          'X-Device-ID': BlackBox.deviceId,
-          'X-Platform': Platform.OS,
-          'X-App-Name': BlackBox.appName,
-        },
+        headers: flushHeaders,
         body: JSON.stringify(events),
       });
     } catch {

package/src/Discovery.ts

@@ -283,7 +283,12 @@ export class YaverDiscovery {
     deviceId: string,
   ): Promise<DiscoveryResult | null> {
     try {
-      const settingsRes = await fetch(`${convexUrl}/auth/validate`, {
+      // /settings returns {ok, settings: {relayUrl, relayPassword, ...}}
+      // — `/auth/validate` only returns the user record. Using the
+      // wrong endpoint historically meant relayPassword stayed
+      // undefined and every relay-routed probe rejected with 401
+      // "invalid relay password" (relay/server.go:957).
+      const settingsRes = await fetch(`${convexUrl}/settings`, {
         headers: { Authorization: `Bearer ${authToken}` },
       });
       let relayUrl: string | undefined;
@@ -291,8 +296,9 @@ export class YaverDiscovery {
 
       if (settingsRes.ok) {
         const settingsData = await settingsRes.json();
-        relayUrl = settingsData.relayUrl;
-        relayPassword = settingsData.relayPassword;
+        const inner = settingsData?.settings;
+        relayUrl = inner?.relayUrl ?? settingsData?.relayUrl;
+        relayPassword = inner?.relayPassword ?? settingsData?.relayPassword;
       }
 
       if (!relayUrl) {

package/src/FeedbackModal.tsx

@@ -415,6 +415,7 @@ export const FeedbackModal: React.FC = () => {
         config.agentUrl,
         config.authToken ?? '',
         bundle,
+        YaverFeedback.getRelayPassword(),
       );
       // The agent returns the new report id as `id` (see
       // feedback_http.go::ReceiveFeedback). Trigger the fix loop if we got

package/src/P2PClient.ts

@@ -346,11 +346,12 @@ export class P2PClient {
       } as any);
     }
 
+    // Use authHeaders() so a relay-routed baseUrl carries
+    // X-Relay-Password — without it the relay rejects with 401
+    // "invalid relay password" before the agent ever sees the form.
     const response = await fetch(`${this.baseUrl}/feedback`, {
       method: 'POST',
-      headers: {
-        Authorization: `Bearer ${this.authToken}`,
-      },
+      headers: this.authHeaders(),
       body: formData,
     });
 
@@ -371,10 +372,7 @@ export class P2PClient {
     for await (const event of events) {
       const response = await fetch(`${this.baseUrl}/feedback/stream`, {
         method: 'POST',
-        headers: {
-          Authorization: `Bearer ${this.authToken}`,
-          'Content-Type': 'application/json',
-        },
+        headers: this.authHeaders({ 'Content-Type': 'application/json' }),
         body: JSON.stringify(event),
       });
 
@@ -398,10 +396,7 @@ export class P2PClient {
   async startBuild(platform: string): Promise<any> {
     const response = await fetch(`${this.baseUrl}/builds`, {
       method: 'POST',
-      headers: {
-        Authorization: `Bearer ${this.authToken}`,
-        'Content-Type': 'application/json',
-      },
+      headers: this.authHeaders({ "Content-Type": "application/json" }),
       body: JSON.stringify({ platform }),
     });
 
@@ -446,9 +441,7 @@ export class P2PClient {
 
     const response = await fetch(`${this.baseUrl}/voice/transcribe`, {
       method: 'POST',
-      headers: {
-        Authorization: `Bearer ${this.authToken}`,
-      },
+      headers: this.authHeaders(),
       body: formData,
     });
 
@@ -494,7 +487,7 @@ export class P2PClient {
     if (mode === 'dev') {
       const primary = await fetch(`${this.baseUrl}/dev/reload`, {
         method: 'POST',
-        headers: { Authorization: `Bearer ${this.authToken}` },
+        headers: this.authHeaders(),
       });
       if (primary.ok) {
         const payload = await primary.json().catch(() => ({} as Record<string, unknown>));
@@ -528,10 +521,7 @@ export class P2PClient {
 
     const res = await fetch(`${this.baseUrl}/dev/reload-app`, {
       method: 'POST',
-      headers: {
-        Authorization: `Bearer ${this.authToken}`,
-        'Content-Type': 'application/json',
-      },
+      headers: this.authHeaders({ "Content-Type": "application/json" }),
       body: JSON.stringify({
         mode: 'bundle',
         ...identity,
@@ -581,10 +571,7 @@ export class P2PClient {
     const identity = resolveAppIdentity(opts);
     const response = await fetch(`${this.baseUrl}/vibing/execute`, {
       method: 'POST',
-      headers: {
-        Authorization: `Bearer ${this.authToken}`,
-        'Content-Type': 'application/json',
-      },
+      headers: this.authHeaders({ "Content-Type": "application/json" }),
       body: JSON.stringify({
         prompt,
         projectPath: identity.projectPath ?? opts?.projectPath ?? '',
@@ -623,7 +610,7 @@ export class P2PClient {
     }
     const response = await fetch(`${this.baseUrl}/vibing/eligibility?${params.toString()}`, {
       method: 'GET',
-      headers: { Authorization: `Bearer ${this.authToken}` },
+      headers: this.authHeaders(),
     });
     if (!response.ok) {
       const text = await response.text().catch(() => '');
@@ -641,7 +628,7 @@ export class P2PClient {
   async triggerFix(feedbackId: string): Promise<{ taskId: string; prompt: string }> {
     const response = await fetch(`${this.baseUrl}/feedback/${encodeURIComponent(feedbackId)}/fix`, {
       method: 'POST',
-      headers: { Authorization: `Bearer ${this.authToken}` },
+      headers: this.authHeaders(),
     });
     if (!response.ok) {
       const text = await response.text().catch(() => '');
@@ -664,10 +651,7 @@ export class P2PClient {
   async startTestSession(): Promise<{ sessionId: string }> {
     const response = await fetch(`${this.baseUrl}/test-app/start`, {
       method: 'POST',
-      headers: {
-        Authorization: `Bearer ${this.authToken}`,
-        'Content-Type': 'application/json',
-      },
+      headers: this.authHeaders({ "Content-Type": "application/json" }),
       body: JSON.stringify({ source: 'feedback-sdk' }),
     });
 
@@ -683,7 +667,7 @@ export class P2PClient {
   async stopTestSession(): Promise<void> {
     await fetch(`${this.baseUrl}/test-app/stop`, {
       method: 'POST',
-      headers: { Authorization: `Bearer ${this.authToken}` },
+      headers: this.authHeaders(),
     });
   }
 
@@ -701,10 +685,7 @@ export class P2PClient {
   async rotateToken(): Promise<{ token: string; expiresAt: number }> {
     const response = await fetch(`${this.baseUrl}/sdk/token/rotate`, {
       method: 'POST',
-      headers: {
-        Authorization: `Bearer ${this.authToken}`,
-        'Content-Type': 'application/json',
-      },
+      headers: this.authHeaders({ "Content-Type": "application/json" }),
     });
 
     if (!response.ok) {
@@ -729,7 +710,7 @@ export class P2PClient {
   async flagsEvaluate(userId: string = 'anonymous'): Promise<Record<string, unknown>> {
     const res = await fetch(
       `${this.baseUrl}/flags/eval?userId=${encodeURIComponent(userId)}`,
-      { headers: { Authorization: `Bearer ${this.authToken}` } },
+      { headers: this.authHeaders() },
     );
     if (!res.ok) return {};
     const data = await res.json();
@@ -743,7 +724,7 @@ export class P2PClient {
   ): Promise<T | undefined> {
     const res = await fetch(
       `${this.baseUrl}/flags/eval?userId=${encodeURIComponent(userId)}&flag=${encodeURIComponent(key)}`,
-      { headers: { Authorization: `Bearer ${this.authToken}` } },
+      { headers: this.authHeaders() },
     );
     if (!res.ok) return undefined;
     const data = await res.json();
@@ -776,7 +757,7 @@ export class P2PClient {
     const params = new URLSearchParams({ channel });
     if (deviceId) params.set('device', deviceId);
     const res = await fetch(`${this.baseUrl}/releases/latest?${params.toString()}`, {
-      headers: { Authorization: `Bearer ${this.authToken}` },
+      headers: this.authHeaders(),
     });
     if (!res.ok) return null;
     return res.json();
@@ -789,7 +770,7 @@ export class P2PClient {
   ): Promise<ArrayBuffer | null> {
     const params = new URLSearchParams({ channel, semver });
     const res = await fetch(`${this.baseUrl}/releases/bundle?${params.toString()}`, {
-      headers: { Authorization: `Bearer ${this.authToken}` },
+      headers: this.authHeaders(),
     });
     if (!res.ok) return null;
     return res.arrayBuffer();
@@ -810,10 +791,7 @@ export class P2PClient {
     try {
       const res = await fetch(`${this.baseUrl}/analytics/ingest`, {
         method: 'POST',
-        headers: {
-          Authorization: `Bearer ${this.authToken}`,
-          'Content-Type': 'application/json',
-        },
+        headers: this.authHeaders({ "Content-Type": "application/json" }),
         body: JSON.stringify({
           name,
           props,

package/src/YaverFeedback.ts

@@ -148,8 +148,51 @@ let enabled = false;
 let p2pClient: P2PClient | null = null;
 let shakeDetector: ShakeDetector | null = null;
 let p2pAuthToken: string | null = null;
+let p2pRelayPassword: string = '';
 let reportLaunchInFlight = false;
 
+/** Resolve the user's relay password by validating their auth token
+ *  against Convex. Used whenever we (re)build the P2PClient so a
+ *  relay-routed agentUrl carries a valid X-Relay-Password — without
+ *  this, every relay-tunneled request rejects with HTTP 401
+ *  "invalid relay password" (relay/server.go:957).
+ *
+ *  Cached on `p2pRelayPassword` so we only round-trip Convex when the
+ *  user's auth token actually changes. Returns "" on any failure so
+ *  direct LAN agentUrls (which need no password) keep working.
+ */
+async function resolveRelayPassword(authToken: string, convexUrl?: string): Promise<string> {
+  const trimmed = (authToken || '').trim();
+  if (!trimmed) {
+    p2pRelayPassword = '';
+    return '';
+  }
+  const url = (convexUrl || config?.convexUrl || DEFAULT_CONVEX_SITE_URL).replace(/\/+$/, '');
+  try {
+    // /settings returns {ok, settings: {relayPassword, relayUrl, ...}}
+    // Older accounts may flatten relayPassword to the top — match the
+    // tolerance the web shell already uses (route.ts:77).
+    const res = await fetch(`${url}/settings`, {
+      headers: { Authorization: `Bearer ${trimmed}` },
+    });
+    if (!res.ok) return p2pRelayPassword;
+    const data = await res.json().catch(() => ({} as Record<string, unknown>));
+    const settings = (data as { settings?: { relayPassword?: string } })?.settings;
+    const pw =
+      (typeof settings?.relayPassword === 'string' && settings.relayPassword) ||
+      (typeof (data as { relayPassword?: string })?.relayPassword === 'string'
+        ? (data as { relayPassword?: string }).relayPassword
+        : '') ||
+      '';
+    p2pRelayPassword = pw;
+    return pw;
+  } catch {
+    // Network failure on a passive Convex round-trip shouldn't break
+    // direct-LAN flows. Fall through with whatever we already cached.
+    return p2pRelayPassword;
+  }
+}
+
 /** Ring buffer of captured errors. */
 let errorBuffer: CapturedError[] = [];
 let maxErrors = 5;
@@ -212,7 +255,8 @@ export class YaverFeedback {
       return;
     }
     p2pAuthToken = token;
-    p2pClient = new P2PClient(effectiveUrl, token);
+    const rp = await resolveRelayPassword(token);
+    p2pClient = new P2PClient(effectiveUrl, token, rp);
   }
 
   /**
@@ -295,7 +339,12 @@ export class YaverFeedback {
     // Create P2P client if we have a URL
     if (config.agentUrl) {
       p2pAuthToken = config.authToken ?? null;
-      p2pClient = new P2PClient(config.agentUrl, config.authToken ?? '');
+      // Initial construction uses the cached p2pRelayPassword (empty on
+      // first init). rebuildP2PClient below resolves the real password
+      // from Convex and replaces this client — but only when authToken
+      // is set, so set a placeholder header here that won't 401 a
+      // direct-LAN url and will be overwritten before any relay hop.
+      p2pClient = new P2PClient(config.agentUrl, config.authToken ?? '', p2pRelayPassword);
       if (config.authToken) {
         void YaverFeedback.rebuildP2PClient(config.agentUrl);
       }
@@ -766,6 +815,16 @@ export class YaverFeedback {
     return config;
   }
 
+  /** Returns the resolved relay password the SDK is currently using.
+   *  Empty string when no relay routing is in play (direct LAN agent
+   *  URLs need no password). Callers attaching it to relay-routed
+   *  HTTP requests must check for empty before setting the header,
+   *  since "X-Relay-Password: " is treated as invalid by the relay
+   *  and would 401 the request. */
+  static getRelayPassword(): string {
+    return p2pRelayPassword;
+  }
+
   /**
    * Manually attach an error with optional metadata.
    * Use this in catch blocks to give the agent extra context.
@@ -949,7 +1008,8 @@ export class YaverFeedback {
         });
         if (result) {
           config.agentUrl = result.url;
-          p2pClient = new P2PClient(result.url, config.authToken ?? '');
+          const rp = await resolveRelayPassword(config.authToken ?? '');
+          p2pClient = new P2PClient(result.url, config.authToken ?? '', rp);
         }
       } catch {}
     }
@@ -990,7 +1050,7 @@ export class YaverFeedback {
         errors: errorBuffer.length > 0 ? [...errorBuffer] : undefined,
       };
 
-      await uploadFeedback(config.agentUrl, config.authToken ?? '', bundle);
+      await uploadFeedback(config.agentUrl, config.authToken ?? '', bundle, p2pRelayPassword);
       console.log('[YaverFeedback] Auto-report sent');
     } catch (err) {
       console.warn('[YaverFeedback] Auto-report failed:', err);

package/src/upload.ts

@@ -18,6 +18,7 @@ export async function uploadFeedback(
   agentUrl: string,
   authToken: string,
   bundle: FeedbackBundle,
+  relayPassword: string = '',
 ): Promise<{ id?: string; reportId?: string; [k: string]: unknown }> {
   const formData = new FormData();
 
@@ -54,11 +55,15 @@ export async function uploadFeedback(
 
   const url = agentUrl.replace(/\/$/, '') + '/feedback';
 
+  const headers: Record<string, string> = {
+    Authorization: `Bearer ${authToken}`,
+  };
+  if (relayPassword) {
+    headers['X-Relay-Password'] = relayPassword;
+  }
   const response = await fetch(url, {
     method: 'POST',
-    headers: {
-      Authorization: `Bearer ${authToken}`,
-    },
+    headers,
     body: formData,
   });