mirror of
https://github.com/NeuralNomadsAI/CodeNomad.git
synced 2026-10-21 13:54:39 +00:00
9dd4b3f059
Adds Remote Control alongside direct/LAN access. A phone or another computer pairs with CodeNomad and continues its sessions from anywhere, without an inbound port. The transport is OpenTunnel, the blind TLS relay used by OpenCode: TLS ends inside the CodeNomad backend, and nothing has to be deployed. - packages/remote-tunnel wraps @opentunnel/client. The server build bundles it with its own Effect 4.0.x, so the published server has no runtime dependency on a private workspace package. CodeNomad claims its own route on the device's shared identity and never deletes it. - A remote-only loopback ingress marks its sockets as remote, so local privileges come from isLocalRequest(), never the peer address. The gate runs before CORS, auth and routing: - exact tunnel Host, and the public Origin on mutations; - stripped forwarding headers; - origin-form targets only, judged as routed (decoded, cut at ';'); - host-only paths denied; - a paired device required, except for the public UI bundle. - Host-owned pairing: a single-use five-minute code, hashed device credentials with 30-day idle expiry, and a __Host- cookie. Revocation or eviction closes live streams. A revoked device is asked to pair again, keeping drafts. - The Cloudflare Worker/Durable Object relay, the custom E2EE protocol and the browser transport shims are removed. Electron and Tauri keep the backend alive after the last window only while Remote Control is enabled. Validation: - the real createHttpServer is exercised through the ingress, plus raw-socket canonicalization tests and device registry tests; - recovery unit and browser tests; - an opt-in end-to-end run through the hosted relay; - a packaged smoke import of the bundled runtime; - five gatekeeper rounds to zero findings, and green CI on all desktop targets. |
||
|---|---|---|
| .. | ||
| agent | ||
| commands | ||
| skills | ||