Skip to content

Make relay opt-in when pairing devices - #2706

Merged
boudra merged 16 commits into
mainfrom
daemon-default-relay-off-pair-prompt
Jul 31, 2026
Merged

Make relay opt-in when pairing devices#2706
boudra merged 16 commits into
mainfrom
daemon-default-relay-off-pair-prompt

Conversation

@boudra

@boudra boudra commented Jul 31, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • default new daemon homes to relay disabled while preserving existing explicit settings
  • prompt before enabling relay in the CLI and desktop pairing flows, with live persisted configuration and version capability gating
  • move Pair Device into its own host settings section while keeping the home entry point on the same dialog
  • document relay encryption, configuration precedence, and direct TCP/Tailscale/VPN alternatives

Verification

  • npm run typecheck
  • npm run lint
  • npx vitest run packages/cli/src/commands/daemon/pair.test.ts packages/cli/src/run.test.ts packages/server/src/server/config-relay.test.ts packages/server/src/server/daemon-config-store.test.ts packages/server/src/server/persisted-config.test.ts packages/server/src/server/relay-runtime.test.ts packages/server/src/server/session/daemon/daemon-session.test.ts --bail=1 (99 tests)
  • npm run test:e2e -- e2e/pair-device-relay.spec.ts --workers=1 (all scenarios passed; the retry assertion was then tightened and rerun independently)
  • npm run test:e2e -- e2e/pair-device-relay.spec.ts --workers=1 --grep "launch override"
  • npx vitest run packages/app/src/utils/host-routes.test.ts --bail=1

Risk

The behavior change is limited to new homes. Existing saved relay choices and explicit environment/CLI overrides remain authoritative.

@greptile-apps

greptile-apps Bot commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

Greptile Summary

The PR makes relay use opt-in during device pairing.

  • Defaults relay to disabled for new daemon homes while preserving persisted choices and launch overrides.
  • Adds capability-gated relay consent to CLI and desktop pairing flows with live configuration updates.
  • Adds reconnect invalidation for cached pairing offers and reorganizes host pairing settings.
  • Updates tests and documentation for relay security, configuration precedence, and direct-connect alternatives.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains; the legacy-daemon behavior follows the repository’s explicit capability-gating policy, and the pairing-offer query now uses the same owned key included in reconnect invalidation.

Important Files Changed

Filename Overview
packages/app/src/data/push-router.ts Adds the owned pairing-offer query key to per-host reconnect invalidation, completing the previously requested stale-offer repair.
packages/app/src/desktop/components/pair-device-section.tsx Implements capability-gated relay consent and refreshes the pairing offer after relay configuration changes.
packages/cli/src/commands/daemon/pair.ts Gates daemon-backed pairing and relay configuration on advertised capabilities while providing update guidance for unsupported daemons.
packages/server/src/server/daemon-config-store.ts Persists mutable relay configuration and coordinates field-change handlers with rollback on failure.
packages/server/src/server/relay-runtime.ts Adds live relay transport enablement and disablement driven by persisted daemon configuration.
packages/server/src/server/session/daemon/daemon-session.ts Serves pairing offers from the daemon’s current runtime relay configuration.

Sequence Diagram

sequenceDiagram
  participant U as User
  participant C as CLI/Desktop
  participant D as Daemon
  participant R as Relay
  C->>D: Request pairing offer
  D-->>C: Relay disabled
  C->>U: Ask whether to enable relay
  alt User consents
    C->>D: "Persist relay.enabled=true"
    D->>R: Start relay transport
    C->>D: Request fresh pairing offer
    D-->>C: Relay pairing URL
  else User declines
    C-->>U: Show direct TCP/VPN alternatives
  end
Loading

Reviews (16): Last reviewed commit: "fix(cli): pair from persisted relay stat..." | Re-trigger Greptile

Comment thread packages/cli/src/commands/daemon/pair.ts Outdated
Comment thread packages/app/src/desktop/components/pair-device-section.tsx

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 86e6f02627

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread packages/server/src/server/daemon-config-store.ts Outdated
Comment thread packages/app/src/desktop/components/pair-device-section.tsx Outdated
Comment thread packages/app/src/screens/settings/host-page.tsx Outdated
Comment thread packages/cli/src/commands/daemon/local-daemon.ts

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a4b3455152

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread packages/app/src/desktop/components/pair-device-section.tsx
Comment thread packages/cli/src/commands/daemon/status.ts

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4ac2461a79

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread packages/server/src/server/websocket-server.ts
Comment thread packages/cli/src/commands/onboard.ts

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f4e4731106

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread packages/server/src/server/relay-runtime.ts Outdated

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 90dc36dd13

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread packages/app/src/desktop/components/pair-device-section.tsx
Comment thread docs/architecture.md

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

if (!state.running) {
return {
connectedDaemon: "reachable",
daemonVersion: statusPayload.version ?? daemonVersion,
daemonNodeOverride: statusPayload.nodePath,
daemonProviders,

P2 Badge Use live relay status when the PID file is absent

When the PID file is missing or stale but the configured WebSocket target is reachable, this early return omits relayStatus, so applyProbeToStatus retains the persisted value even though statusPayload.relay contains the authoritative runtime state. A daemon manually launched with --relay, for example, is therefore reported as disabled; fresh evidence beyond the earlier status finding is this separate !state.running branch added to the live probe path.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread packages/cli/src/commands/daemon/pair.test.ts Outdated

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 59f279955a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread packages/server/src/server/bootstrap.ts Outdated
@boudra

boudra commented Jul 31, 2026

Copy link
Copy Markdown
Collaborator Author

Addressed the latest status review in 3b1838c. A reachable daemon now supplies authoritative live relay state even when no local PID file exists. The real CLI IPC test removes the PID file and verifies the stopped-local/reachable-daemon combination still reports the live relay.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3b1838c022

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread packages/server/src/server/config.ts Outdated
Comment thread packages/app/src/screens/settings-screen.tsx Outdated

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 86eb068efd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread packages/app/src/screens/settings/host-page.tsx Outdated
@boudra
boudra force-pushed the daemon-default-relay-off-pair-prompt branch from 86eb068 to 383d286 Compare July 31, 2026 17:58

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: da05b01521

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread packages/cli/src/commands/daemon/pair.test.ts Outdated
Keep Pair Device host-relative through the existing settings and daemon RPC flow. Route CLI output through an injected adapter so workflow tests do not mutate process globals.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d6d76a98ac

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread packages/app/src/screens/settings-screen.tsx
Comment thread packages/cli/src/commands/daemon/pair.ts Outdated
Expose the host-relative Pair Device flow on every supported app platform. Reject a reachable daemon whose identity does not match the requested Paseo home before reading or mutating its pairing state.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3dfd7ab0ca

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread packages/app/src/desktop/components/pair-device-section.tsx Outdated
Comment thread packages/cli/src/commands/daemon/pair.ts
Generate SVG text without DOM or canvas and render it through the existing cross-platform SVG stack.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8947935b2a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread packages/cli/src/commands/daemon/pair.ts Outdated
Allow explicit relay pairing while the daemon is stopped when relay is already enabled in persisted configuration.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9b9c09f333

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread packages/cli/src/run.ts
@boudra
boudra merged commit d2de309 into main Jul 31, 2026
24 checks passed
@boudra
boudra deleted the daemon-default-relay-off-pair-prompt branch July 31, 2026 20:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant