feat(plugin): add trusted Relay rooms and Relayfile access#3
feat(plugin): add trusted Relay rooms and Relayfile access#3khaliqgant wants to merge 5 commits into
Conversation
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
📝 WalkthroughWalkthroughRelay Room is added as a plugin pane with dedicated configuration, documented invitation and command flows, private state rules, Relayfile integration behavior, and extensive tests covering routing, sessions, mounts, credentials, and safety. ChangesRelay Room
Estimated code review effort: 3 (Moderate) | ~25 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
plugins/agent-relay/test/room.test.mjs (1)
229-248: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winMissing test coverage for
apiUrlschema/forwarding rules.Workspace-binding validation is well covered here, but README documents
apiUrlHTTPS/loopback constraints and a hard boundary ("never forwards an API URL to Relayfile"). No test in this file exercisesRoomConfigSchemaaccepting/rejectingapiUrl, or verifies--api-urlis forwarded toagent-relaycommands but withheld fromrelayfilecalls (e.g. in the "uses Relayfile live catalog..." or "setup reuses Agent Relay Cloud login..." tests at lines 745-821, which construct executions without assertingapiUrlisolation).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@plugins/agent-relay/test/room.test.mjs` around lines 229 - 248, The tests need coverage for apiUrl validation and forwarding isolation. Extend RoomConfigSchema tests near the existing workspaceId assertions to accept HTTPS/allowed loopback URLs and reject disallowed protocols or hosts, then update the relevant agent-relay execution tests (such as the live catalog or Cloud login cases) to verify --api-url reaches agent-relay commands but is omitted from relayfile invocations.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@plugins/agent-relay/test/room.test.mjs`:
- Around line 229-248: The tests need coverage for apiUrl validation and
forwarding isolation. Extend RoomConfigSchema tests near the existing
workspaceId assertions to accept HTTPS/allowed loopback URLs and reject
disallowed protocols or hosts, then update the relevant agent-relay execution
tests (such as the live catalog or Cloud login cases) to verify --api-url
reaches agent-relay commands but is omitted from relayfile invocations.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 0be08762-4cdf-4c46-848d-b76cb63714ca
⛔ Files ignored due to path filters (9)
plugins/agent-relay/dist/command-runner.mjsis excluded by!**/dist/**plugins/agent-relay/dist/config.mjsis excluded by!**/dist/**plugins/agent-relay/dist/room-cli.mjsis excluded by!**/dist/**plugins/agent-relay/dist/room-client.mjsis excluded by!**/dist/**plugins/agent-relay/dist/room-commands.mjsis excluded by!**/dist/**plugins/agent-relay/dist/room-events.mjsis excluded by!**/dist/**plugins/agent-relay/dist/room-sdk.mjsis excluded by!**/dist/**plugins/agent-relay/dist/room.mjsis excluded by!**/dist/**plugins/agent-relay/dist/state.mjsis excluded by!**/dist/**
📒 Files selected for processing (4)
plugins/agent-relay/README.mdplugins/agent-relay/herdr-plugin.tomlplugins/agent-relay/room.config.example.jsonplugins/agent-relay/test/room.test.mjs
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0187aff069
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const owned = | ||
| existingMount?.checkoutPath === checkoutPath && | ||
| existingMount?.mountPath === mountPath; |
There was a problem hiding this comment.
When a previously stopped mount remains in state, deleting and recreating .integrations with unrelated files still makes owned true because only the two path strings are compared. A later integration setup therefore bypasses the non-empty-directory guard and lets Relayfile mount over a directory the plugin never created, risking hidden or modified user data. Persist and compare the directory identity, or reject non-empty directories after the original directory is replaced.
Useful? React with 👍 / 👎.
| } else if (character === '\\') { | ||
| escaped = true; |
There was a problem hiding this comment.
For quoted message text containing a literal backslash, such as message send #general "Use C:\temp", this branch consumes the backslash and silently sends Use C:temp. The same corruption affects threads, DMs, regexes, and code snippets; quoted text should preserve backslashes unless they escape the active quote or another backslash.
Useful? React with 👍 / 👎.
1 participant
Summary
relay_room_inv_wire contract shared by Cloud, Relay, and HerdrWhy this PR exists
Herdr #2 was merged into its already-landed feature base (
feat/agent-relay-sdk) rather thanmaster, so its changes are not present on the default branch. This PR replays the same five reviewed commits directly onto currentmaster; it adds no new product behavior.Validation
npm ci --omit=devnpm test— 34/34 passingSummary by cubic
Add a trusted Relay Room to the Agent Relay plugin with a new pane for managing rooms, messaging, presence, and Relayfile-backed write access. Keeps the existing bridge unchanged while adding secure invite handling and public workspace binding.
New Features
relay_room_inv_…invites and binds via publicrw_…or UUID workspace IDs; separateroom.config.example.jsonconfig.@agent-relay/sdkwrapper and event deduper.Bug Fixes
Written for commit 0187aff. Summary will update on new commits.