.env.example | 12 + .github/workflows/deploy-relay.yml | 59 + .github/workflows/release.yml | 83 +- .gitignore | 6 + .vscode/settings.json | 1 + AGENTS.md | 18 +- README.md | 8 + apps/desktop/scripts/dev-electron.mjs | 30 +- apps/desktop/scripts/electron-launcher.mjs | 172 +- apps/desktop/src/app/DesktopApp.ts | 5 +- apps/desktop/src/app/DesktopAppIdentity.test.ts | 3 + apps/desktop/src/app/DesktopCloudAuth.test.ts | 302 +++ apps/desktop/src/app/DesktopCloudAuth.ts | 330 +++ apps/desktop/src/app/DesktopCloudAuthTokenStore.test.ts | 96 + apps/desktop/src/app/DesktopCloudAuthTokenStore.ts | 155 ++ apps/desktop/src/app/DesktopConfig.ts | 1 + apps/desktop/src/app/DesktopEnvironment.test.ts | 14 + apps/desktop/src/app/DesktopEnvironment.ts | 4 +- apps/desktop/src/electron/ElectronApp.test.ts | 9 + apps/desktop/src/electron/ElectronApp.ts | 17 + apps/desktop/src/ipc/DesktopIpcHandlers.ts | 13 +- apps/desktop/src/ipc/channels.ts | 6 + apps/desktop/src/ipc/methods/cloudAuth.test.ts | 105 + apps/desktop/src/ipc/methods/cloudAuth.ts | 154 ++ apps/desktop/src/main.ts | 4 + apps/desktop/src/preload.ts | 17 + apps/desktop/src/settings/DesktopSavedEnvironments.ts | 26 +- apps/desktop/src/window/DesktopApplicationMenu.test.ts | 3 + apps/desktop/src/window/DesktopWindow.test.ts | 80 +- apps/desktop/src/window/DesktopWindow.ts | 34 +- apps/desktop/tsconfig.json | 2 +- apps/desktop/vite.config.ts | 10 + apps/mobile/README.md | 8 + apps/mobile/app.config.ts | 40 +- apps/mobile/clerk-theme.json | 39 + apps/mobile/global.css | 2 + apps/mobile/package.json | 8 + apps/mobile/src/app/_layout.tsx | 37 +- apps/mobile/src/app/connections/_layout.tsx | 8 +- apps/mobile/src/app/connections/index.tsx | 26 +- apps/mobile/src/app/connections/new.tsx | 37 +- apps/mobile/src/app/index.tsx | 18 +- apps/mobile/src/app/new/_layout.tsx | 30 +- apps/mobile/src/app/new/add-project/_layout.tsx | 17 - apps/mobile/src/app/new/add-project/destination.tsx | 9 +- apps/mobile/src/app/new/add-project/index.tsx | 9 +- apps/mobile/src/app/new/add-project/local.tsx | 9 +- apps/mobile/src/app/new/add-project/repository.tsx | 15 +- apps/mobile/src/app/new/draft.tsx | 7 +- apps/mobile/src/app/new/index.tsx | 70 +- apps/mobile/src/app/settings/_layout.tsx | 41 + apps/mobile/src/app/settings/environment-new.tsx | 1 + apps/mobile/src/app/settings/environments.tsx | 275 +++ apps/mobile/src/app/settings/index.tsx | 451 ++++ apps/mobile/src/app/settings/waitlist.tsx | 38 + apps/mobile/src/app/threads/[environmentId]/[threadId]/_layout.tsx | 1 + apps/mobile/src/components/ComposerToolbarTrigger.tsx | 247 ++ apps/mobile/src/components/LoadingScreen.tsx | 13 +- apps/mobile/src/features/agent-awareness/liveActivityPreferences.test.ts | 122 + apps/mobile/src/features/agent-awareness/liveActivityPreferences.ts | 34 + apps/mobile/src/features/agent-awareness/notificationNavigation.test.ts | 106 + apps/mobile/src/features/agent-awareness/notificationNavigation.ts | 35 + apps/mobile/src/features/agent-awareness/notificationPayload.ts | 106 + apps/mobile/src/features/agent-awareness/notificationPermissions.ts | 44 + apps/mobile/src/features/agent-awareness/registrationPayload.ts | 33 + apps/mobile/src/features/agent-awareness/remoteRegistration.test.ts | 444 ++++ apps/mobile/src/features/agent-awareness/remoteRegistration.ts | 523 +++++ apps/mobile/src/features/cloud/CloudAuthProvider.tsx | 87 + apps/mobile/src/features/cloud/CloudWaitlistEnrollment.tsx | 208 ++ apps/mobile/src/features/cloud/dpop.test.ts | 166 ++ apps/mobile/src/features/cloud/dpop.ts | 270 +++ apps/mobile/src/features/cloud/linkEnvironment.test.ts | 1107 +++++++++ apps/mobile/src/features/cloud/linkEnvironment.ts | 582 +++++ apps/mobile/src/features/cloud/managedRelayLayer.ts | 42 + apps/mobile/src/features/cloud/managedRelayState.ts | 88 + apps/mobile/src/features/cloud/publicConfig.test.ts | 47 + apps/mobile/src/features/cloud/publicConfig.ts | 41 + apps/mobile/src/features/cloud/useNativeClerkAuthModal.ts | 134 ++ apps/mobile/src/features/connection/ConnectionEnvironmentRow.tsx | 102 +- apps/mobile/src/features/projects/AddProjectScreen.tsx | 29 +- apps/mobile/src/features/review/ReviewCommentComposerSheet.tsx | 7 +- apps/mobile/src/features/terminal/ThreadTerminalRouteScreen.tsx | 282 +-- apps/mobile/src/features/threads/NewTaskDraftScreen.tsx | 229 +- apps/mobile/src/features/threads/NewTaskSheetHeader.tsx | 46 - apps/mobile/src/features/threads/ThreadComposer.tsx | 117 +- apps/mobile/src/features/threads/ThreadDetailScreen.tsx | 22 +- apps/mobile/src/features/threads/ThreadFeed.tsx | 4 - apps/mobile/src/features/threads/ThreadRouteScreen.tsx | 28 +- apps/mobile/src/features/threads/new-task-flow-provider.tsx | 83 +- apps/mobile/src/lib/authClientMetadata.ts | 10 + apps/mobile/src/lib/connection.test.ts | 36 +- apps/mobile/src/lib/connection.ts | 62 +- apps/mobile/src/lib/runtime.ts | 21 +- apps/mobile/src/lib/storage.test.ts | 72 + apps/mobile/src/lib/storage.ts | 48 +- apps/mobile/src/state/remote-runtime-types.ts | 1 + apps/mobile/src/state/use-composer-drafts.ts | 243 ++ apps/mobile/src/state/use-remote-environment-registry.test.ts | 430 ++++ apps/mobile/src/state/use-remote-environment-registry.ts | 576 +++-- apps/mobile/src/state/use-thread-composer-state.ts | 131 +- apps/mobile/src/widgets/AgentActivity.test.ts | 49 + apps/mobile/src/widgets/AgentActivity.tsx | 321 +++ apps/server/integration/OrchestrationEngineHarness.integration.ts | 9 +- apps/server/src/auth/EnvironmentAuth.ts | 71 +- apps/server/src/auth/EnvironmentAuthPolicy.ts | 2 +- apps/server/src/auth/PairingGrantStore.test.ts | 23 + apps/server/src/auth/PairingGrantStore.ts | 39 +- apps/server/src/auth/ServerSecretStore.ts | 15 +- apps/server/src/auth/SessionStore.ts | 9 +- apps/server/src/auth/dpop.test.ts | 33 + apps/server/src/auth/dpop.ts | 92 + apps/server/src/auth/http.ts | 47 +- apps/server/src/auth/utils.ts | 9 +- apps/server/src/bin.test.ts | 125 +- apps/server/src/bin.ts | 42 +- apps/server/src/checkpointing/Errors.ts | 4 +- apps/server/src/cli/cloud.test.ts | 102 + apps/server/src/cli/cloud.ts | 425 ++++ apps/server/src/cli/project.ts | 8 +- apps/server/src/cloud/CliState.test.ts | 58 + apps/server/src/cloud/CliState.ts | 49 + apps/server/src/cloud/CliTokenManager.ts | 236 ++ apps/server/src/cloud/ManagedEndpointRuntime.test.ts | 362 +++ apps/server/src/cloud/ManagedEndpointRuntime.ts | 283 +++ apps/server/src/cloud/config.ts | 18 + apps/server/src/cloud/environmentKeys.test.ts | 87 + apps/server/src/cloud/environmentKeys.ts | 100 + apps/server/src/cloud/http.test.ts | 119 + apps/server/src/cloud/http.ts | 944 ++++++++ apps/server/src/cloud/publicConfig.test.ts | 85 + apps/server/src/cloud/publicConfig.ts | 110 + apps/server/src/diagnostics/ProcessDiagnostics.ts | 2 +- apps/server/src/http.ts | 18 +- apps/server/src/httpCors.ts | 1 + apps/server/src/orchestration/Errors.ts | 12 +- apps/server/src/orchestration/Layers/OrchestrationReactor.test.ts | 11 + apps/server/src/orchestration/Layers/OrchestrationReactor.ts | 3 + apps/server/src/persistence/Errors.ts | 8 +- apps/server/src/persistence/Layers/AuthPairingLinks.ts | 11 +- apps/server/src/persistence/Migrations.ts | 2 + apps/server/src/persistence/Migrations/032_AuthPairingProofKeyThumbprint.ts | 16 + apps/server/src/persistence/Services/AuthPairingLinks.ts | 3 + apps/server/src/provider/Errors.ts | 22 +- apps/server/src/relay/AgentAwarenessRelay.test.ts | 662 ++++++ apps/server/src/relay/AgentAwarenessRelay.ts | 503 +++++ apps/server/src/server.test.ts | 2458 +++++++++++++++++--- apps/server/src/server.ts | 53 + apps/server/src/serverRuntimeStartup.ts | 7 +- apps/server/src/sourceControl/AzureDevOpsCli.ts | 2 +- apps/server/src/sourceControl/BitbucketApi.ts | 2 +- apps/server/src/sourceControl/GitHubCli.ts | 2 +- apps/server/src/sourceControl/GitLabCli.ts | 2 +- apps/server/src/telemetry/Identify.ts | 2 +- apps/server/src/terminal/Layers/Manager.ts | 4 +- apps/server/src/terminal/Services/PTY.ts | 2 +- apps/server/src/workspace/Services/WorkspaceEntries.ts | 4 +- apps/server/src/workspace/Services/WorkspaceFileSystem.ts | 2 +- apps/server/src/ws.ts | 40 + apps/server/vite.config.ts | 12 + apps/web/package.json | 4 + apps/web/src/clientPersistenceStorage.ts | 16 +- apps/web/src/cloud/desktopAuth.test.ts | 59 + apps/web/src/cloud/desktopAuth.ts | 144 ++ apps/web/src/cloud/desktopClerk.tsx | 322 +++ apps/web/src/cloud/desktopClerkExternalAccounts.test.ts | 78 + apps/web/src/cloud/desktopClerkExternalAccounts.ts | 112 + apps/web/src/cloud/dpop.test.ts | 32 + apps/web/src/cloud/dpop.ts | 188 ++ apps/web/src/cloud/linkEnvironment.test.ts | 903 ++++++++ apps/web/src/cloud/linkEnvironment.ts | 715 ++++++ apps/web/src/cloud/managedAuth.tsx | 35 + apps/web/src/cloud/managedRelayLayer.ts | 62 + apps/web/src/cloud/managedRelayState.ts | 83 + apps/web/src/cloud/primaryCloudLinkState.ts | 67 + apps/web/src/cloud/publicConfig.test.ts | 33 + apps/web/src/cloud/publicConfig.ts | 37 + apps/web/src/cloud/relayClientInstallDialog.test.ts | 70 + apps/web/src/cloud/relayClientInstallDialog.ts | 100 + apps/web/src/components/clerk/DesktopClerkCard.tsx | 137 ++ apps/web/src/components/clerk/DesktopClerkSignIn.browser.tsx | 71 + apps/web/src/components/clerk/DesktopClerkSignIn.tsx | 150 ++ apps/web/src/components/clerk/DesktopClerkWaitlist.tsx | 106 + apps/web/src/components/clerk/useDesktopClerkSignIn.ts | 199 ++ apps/web/src/components/cloud/RelayClientInstallDialog.browser.tsx | 47 + apps/web/src/components/cloud/RelayClientInstallDialog.tsx | 123 + apps/web/src/components/settings/CloudSettings.tsx | 197 ++ apps/web/src/components/settings/ConnectionsSettings.tsx | 278 ++- apps/web/src/components/settings/SettingsPanels.browser.tsx | 25 +- apps/web/src/components/settings/SettingsSidebarNav.tsx | 15 +- apps/web/src/environments/primary/auth.ts | 3 +- apps/web/src/environments/primary/index.ts | 6 +- apps/web/src/environments/primary/requestInit.ts | 7 + apps/web/src/environments/runtime/catalog.test.ts | 43 + apps/web/src/environments/runtime/catalog.ts | 49 + apps/web/src/environments/runtime/index.ts | 1 + apps/web/src/environments/runtime/service.addSavedEnvironment.test.ts | 178 +- apps/web/src/environments/runtime/service.savedEnvironments.test.ts | 9 +- apps/web/src/environments/runtime/service.threadSubscriptions.test.ts | 13 +- apps/web/src/environments/runtime/service.ts | 273 ++- apps/web/src/hooks/useTheme.ts | 2 +- apps/web/src/hostedPairing.ts | 2 +- apps/web/src/lib/runtime.ts | 25 +- apps/web/src/localApi.test.ts | 12 + apps/web/src/main.tsx | 23 +- apps/web/src/routeTree.gen.ts | 21 + apps/web/src/routes/__root.tsx | 2 + apps/web/src/routes/_chat.index.tsx | 15 +- apps/web/src/routes/settings.cloud.tsx | 13 + apps/web/src/vite-env.d.ts | 2 + apps/web/tsconfig.json | 2 +- apps/web/vite.config.ts | 11 + docs/relay-observability.md | 42 + docs/release.md | 63 +- docs/t3-cloud-clerk.md | 174 ++ docs/t3-code-cloud-auth-flow.html | 1160 ++++++++++ infra/relay/.env.example | 26 + infra/relay/README.md | 166 ++ infra/relay/alchemy.run.ts | 42 + infra/relay/migrations/postgres/20260527044716_baseline/migration.sql | 104 + infra/relay/migrations/postgres/20260527044716_baseline/snapshot.json | 1267 +++++++++++ infra/relay/migrations/postgres/20260601225421_add_mobile_device_label/migration.sql | 1 + infra/relay/migrations/postgres/20260601225421_add_mobile_device_label/snapshot.json | 1280 +++++++++++ infra/relay/migrations/postgres/20260603035812_managed_endpoint_allocations/migration.sql | 15 + infra/relay/migrations/postgres/20260603035812_managed_endpoint_allocations/snapshot.json | 1453 ++++++++++++ infra/relay/package.json | 29 + infra/relay/scripts/deploy.test.ts | 52 + infra/relay/scripts/deploy.ts | 212 ++ infra/relay/src/Config.ts | 32 + infra/relay/src/agentActivity/AgentActivityPublisher.test.ts | 627 ++++++ infra/relay/src/agentActivity/AgentActivityPublisher.ts | 230 ++ infra/relay/src/agentActivity/AgentActivityRows.ts | 158 ++ infra/relay/src/agentActivity/ApnsClient.test.ts | 140 ++ infra/relay/src/agentActivity/ApnsClient.ts | 320 +++ infra/relay/src/agentActivity/ApnsDeliveries.test.ts | 1128 ++++++++++ infra/relay/src/agentActivity/ApnsDeliveries.ts | 795 +++++++ infra/relay/src/agentActivity/ApnsDeliveryQueue.ts | 163 ++ infra/relay/src/agentActivity/DeliveryAttempts.test.ts | 323 +++ infra/relay/src/agentActivity/DeliveryAttempts.ts | 203 ++ infra/relay/src/agentActivity/Devices.test.ts | 220 ++ infra/relay/src/agentActivity/Devices.ts | 181 ++ infra/relay/src/agentActivity/LiveActivities.test.ts | 196 ++ infra/relay/src/agentActivity/LiveActivities.ts | 373 +++ infra/relay/src/agentActivity/MobileRegistrations.test.ts | 464 ++++ infra/relay/src/agentActivity/MobileRegistrations.ts | 93 + infra/relay/src/agentActivity/agentActivityPayloads.ts | 63 + infra/relay/src/agentActivity/apnsDeliveryJobs.test.ts | 221 ++ infra/relay/src/agentActivity/apnsDeliveryJobs.ts | 196 ++ infra/relay/src/auth/DpopProofs.test.ts | 95 + infra/relay/src/auth/DpopProofs.ts | 128 ++ infra/relay/src/auth/DpopProofs.verifyAndConsume.test.ts | 217 ++ infra/relay/src/auth/RelayTokens.test.ts | 188 ++ infra/relay/src/auth/RelayTokens.ts | 220 ++ infra/relay/src/db.ts | 68 + infra/relay/src/dbConfig.test.ts | 11 + infra/relay/src/dbConfig.ts | 5 + infra/relay/src/deploymentConfig.test.ts | 96 + infra/relay/src/deploymentConfig.ts | 104 + infra/relay/src/environments/EnvironmentConnector.test.ts | 720 ++++++ infra/relay/src/environments/EnvironmentConnector.ts | 430 ++++ infra/relay/src/environments/EnvironmentCredentials.test.ts | 158 ++ infra/relay/src/environments/EnvironmentCredentials.ts | 188 ++ infra/relay/src/environments/EnvironmentLinker.test.ts | 206 ++ infra/relay/src/environments/EnvironmentLinker.ts | 264 +++ infra/relay/src/environments/EnvironmentLinks.test.ts | 91 + infra/relay/src/environments/EnvironmentLinks.ts | 345 +++ infra/relay/src/environments/EnvironmentPublishSignatures.test.ts | 166 ++ infra/relay/src/environments/EnvironmentPublishSignatures.ts | 164 ++ infra/relay/src/environments/ManagedEndpointAllocations.ts | 200 ++ infra/relay/src/environments/ManagedEndpointProvider.test.ts | 760 +++++++ infra/relay/src/environments/ManagedEndpointProvider.ts | 498 ++++ infra/relay/src/http/Api.test.ts | 232 ++ infra/relay/src/http/Api.ts | 1109 +++++++++ infra/relay/src/observability.ts | 76 + infra/relay/src/persistence/schema.ts | 184 ++ infra/relay/src/queues.ts | 7 + infra/relay/src/worker.ts | 283 +++ infra/relay/src/zone.ts | 66 + infra/relay/tsconfig.json | 9 + packages/client-runtime/src/index.ts | 2 + packages/client-runtime/src/managedRelay.test.ts | 185 ++ packages/client-runtime/src/managedRelay.ts | 510 +++++ packages/client-runtime/src/managedRelayState.test.ts | 155 ++ packages/client-runtime/src/managedRelayState.ts | 289 +++ packages/client-runtime/src/remote.test.ts | 139 +- packages/client-runtime/src/remote.ts | 121 +- packages/client-runtime/src/transportError.test.ts | 8 + packages/client-runtime/src/transportError.ts | 1 + packages/client-runtime/src/wsRpcClient.ts | 28 + packages/client-runtime/src/wsTransport.test.ts | 4 +- packages/contracts/package.json | 4 + packages/contracts/src/auth.ts | 5 +- packages/contracts/src/editor.ts | 2 +- packages/contracts/src/environmentHttp.ts | 184 +- packages/contracts/src/filesystem.ts | 2 +- packages/contracts/src/git.ts | 6 +- packages/contracts/src/index.ts | 1 + packages/contracts/src/ipc.ts | 28 + packages/contracts/src/keybindings.ts | 2 +- packages/contracts/src/orchestration.ts | 10 +- packages/contracts/src/project.ts | 4 +- packages/contracts/src/relay.test.ts | 16 + packages/contracts/src/relay.ts | 971 ++++++++ packages/contracts/src/relayClient.ts | 63 + packages/contracts/src/rpc.ts | 24 + packages/contracts/src/server.ts | 2 +- packages/contracts/src/settings.ts | 2 +- packages/contracts/src/sourceControl.ts | 4 +- packages/contracts/src/terminal.ts | 4 +- packages/contracts/src/vcs.ts | 6 +- packages/effect-acp/src/errors.ts | 8 +- packages/effect-codex-app-server/scripts/generate.ts | 2 +- packages/effect-codex-app-server/src/errors.ts | 8 +- packages/shared/package.json | 35 + packages/shared/src/agentAwareness.test.ts | 128 ++ packages/shared/src/agentAwareness.ts | 142 ++ packages/shared/src/dpop.test.ts | 205 ++ packages/shared/src/dpop.ts | 200 ++ packages/shared/src/dpopCommon.ts | 20 + packages/shared/src/oauthScope.ts | 12 +- packages/shared/src/relayAuth.test.ts | 26 + packages/shared/src/relayAuth.ts | 30 + packages/shared/src/relayClient.test.ts | 273 +++ packages/shared/src/relayClient.ts | 502 +++++ packages/shared/src/relayJwt.ts | 69 + packages/shared/src/relaySigning.test.ts | 18 + packages/shared/src/relaySigning.ts | 17 + packages/shared/src/relayUrl.test.ts | 26 + packages/shared/src/relayUrl.ts | 22 + packages/ssh/src/tunnel.test.ts | 2 +- patches/effect@4.0.0-beta.73.patch | 291 --- patches/effect@4.0.0-beta.78.patch | 291 +++ pnpm-lock.yaml | 3864 ++++++++++++++++++++++++++++---- pnpm-workspace.yaml | 33 +- scripts/build-desktop-artifact.ts | 6 + scripts/dev-runner.ts | 4 + scripts/lib/public-config.test.ts | 104 + scripts/lib/public-config.ts | 96 + scripts/release-smoke.ts | 1 + vite.config.ts | 7 + 339 files changed, 49266 insertions(+), 2353 deletions(-)