Implement host-scoped relay tunneling with DB-backed auth and shared transport (Vibe Kanban) (#2898)

* Relay

* feat(auth): add trusted-key-auth crate

* fix(relay-test-client): tolerate exchange landing 404 and list workspaces

* feat(relay-auth): add PAKE enrollment and signed relay request enforcement

* Add end-to-end relay integrity for HTTP and WebSocket traffic

* Refactor terminal websocket to use signed transport wrapper

* Migrate remaining websocket routes to signed transport wrapper

* Unify relay HTTP request auth on PAKE-derived MAC

* Cleanup script changes for workspace 10a2f52b-0c94-4fa7-9225-f90fa490415c

* Use enum for relay WS message type in signed envelopes

* Sign and verify WebSocket control frames in relay wrapper

* Refactor relay HTTP path classification and require OriginalUri

* Move relay-auth outside signed middleware and simplify URI canonicalization

* Use ed25519 signing for relay messages

* Refactor relay signature validation and WS signing input

* drop unused direction

* Cleanup script changes for workspace 10a2f52b-0c94-4fa7-9225-f90fa490415c

* Relay lifecycle and trusted pub keys persistence

* Add relay settings frontend

* Upsert host on relay registration

* clippy

* db

* Add login button

* Skip origin validation for relayed messages

* Expose relay headers

* fmt

* i18n

* fix test client redirect

* Louis/relay feedback (#2931)

* tunnel

* restructure tunnel

* inline dbg

* cleanups

* headers

* signing session deployment

* session get

* fmt

* trusted key auth getters

* cleanup errors

* persist single server key

* key assets

* cleanup re-exports

* remove redundant host endpoints

* update readme

* Implement remote web relay PAKE pairing flow (#2932)

* feat(types): share relay SPAKE2 enrollment responses with web-core

* refactor(web-core): split relay backend client from remote API

* refactor(relay): move settings pairing fetch flow into relay backend API

* share relay SPAKE2 enrollment request types across rust and web

* Lint

* start and stop relay when relay_enabled config toggles

* Harden approvals websocket with relay frame signing

* Add relay api base to pre-release env

* On remote web, the user should see a list of hosts in their `AppBar.tsx` , where the workspaces (vibe-kanban) (#2936)

* Add relay host statuses to remote AppBar and unpaired pairing shortcut

* Refine AppBar host section with divider and top status badge

* Right-align host status badges in AppBar

* Simplify AppBar host status indicators to consistent right-aligned circles

* Add relay client identities and paired-client management (Vibe Kanban) (#2937)

* Add relay client identity metadata and paired-client management

* Relay settings: auto-check paired clients every 10s with spinner

* Relay settings: simplify paired-client checking copy

* Relay settings: add remote-control docs links in local and remote cards

* Add remove action for paired relay hosts in remote settings (#2940)

* Implement secure relay auth/transport and AppBar settings-host UX updates (Vibe Kanban) (#2939)

* Add settings action to AppBar user dropdown

* Update AppBar user menu settings label and visibility

* We added a relay tunnel feature and infra for that in the few commits. we then changed routing to (vibe-kanban cd08780d-bede-48e6-b34a-eeb50b3ed3ef)

* chore: bump relay-tunnel version to 0.1.1

* Remove unused RELAY_BASE_DOMAIN

* We added a relay tunnel feature and infra for that in the few commits. we then changed routing to (vibe-kanban cd08780d-bede-48e6-b34a-eeb50b3ed3ef)

* update cargo lock

* chore: bump relay-tunnel version to 0.1.2

* cargo lock

* Update remote cargo lock when relay deploy

* Cargo lock

* Revert lock update

* chore: bump relay-tunnel version to 0.1.3

* Demote relay logs

* Enable remote workspaces over relay host tunnels with signed WS transport (Vibe Kanban) (#2942)

* feat(remote-web): load workspaces through selected relay host tunnel

* Enable remote workspaces UI via relay-backed local API transport

* Handle signed relay WebSocket envelopes in remote web

* Update Cargo.lock

* Fix remote relay session base URL typing in relay host API

* Invalidate the hosts hook tanstack query when we pair a host in remote web (vibe-kanban dddeb1e2-bebf-47f5-80d8-7672e845b257)

* Remove local-web TerminalProvider re-export indirection

* Cleanup script changes for workspace 665fa68e-b167-4194-826d-563f0a75e281

* Fix relay multipart signature/body mismatch

* format, add remote-web:format

* Fix missing UserSystem provider on remote project workspace routes (Vibe Kanban) (#2944)

* remote-web: provide user system context on project workspace routes

* remote-web: tunnel local API calls on project workspace routes

* consolidate web public assets into packages/public for local and remote (#2945)

* bump migration

---------

Co-authored-by: Louis Knight-Webb <louis@bloop.ai>
Co-authored-by: GitHub Action <action@github.com>

Author: 3 people

.github/workflows/pre-release.yml

@@ -328,6 +328,7 @@ jobs:
           POSTHOG_API_KEY: ${{ secrets.POSTHOG_API_KEY }}
           POSTHOG_API_ENDPOINT: ${{ secrets.POSTHOG_API_ENDPOINT }}
           VK_SHARED_API_BASE: ${{ secrets.VK_SHARED_API_BASE }}
+          VK_SHARED_RELAY_API_BASE: ${{ secrets.VK_SHARED_RELAY_API_BASE }}
           SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
 
       - name: Build backend (macOS)
@@ -343,6 +344,7 @@ jobs:
           POSTHOG_API_KEY: ${{ secrets.POSTHOG_API_KEY }}
           POSTHOG_API_ENDPOINT: ${{ secrets.POSTHOG_API_ENDPOINT }}
           VK_SHARED_API_BASE: ${{ secrets.VK_SHARED_API_BASE }}
+          VK_SHARED_RELAY_API_BASE: ${{ secrets.VK_SHARED_RELAY_API_BASE }}
           SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
 
       - name: Build backend (Windows)
@@ -361,6 +363,7 @@ jobs:
           POSTHOG_API_KEY: ${{ secrets.POSTHOG_API_KEY }}
           POSTHOG_API_ENDPOINT: ${{ secrets.POSTHOG_API_ENDPOINT }}
           VK_SHARED_API_BASE: ${{ secrets.VK_SHARED_API_BASE }}
+          VK_SHARED_RELAY_API_BASE: ${{ secrets.VK_SHARED_RELAY_API_BASE }}
           SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
           # Avoid aws-lc-sys CMake failures when Rust's `release` profile includes debug info.
           # Without this, cmake-rs selects RelWithDebInfo and CMake fails when ASM is enabled.

.github/workflows/relay-deploy-prod.yml

@@ -75,10 +75,8 @@ jobs:
           # Update version in crates/relay-tunnel/Cargo.toml
           cd crates/relay-tunnel
           cargo set-version "$new_version"
-          cd ../..
-
-          # Update workspace Cargo.lock
           cargo update relay-tunnel
+          cd ../..
 
           echo "New version: $new_version"
           echo "New tag: $new_tag"
@@ -90,7 +88,7 @@ jobs:
         run: |
           git config --local user.email "action@github.com"
           git config --local user.name "GitHub Action"
-          git add crates/relay-tunnel/Cargo.toml Cargo.lock
+          git add crates/relay-tunnel/Cargo.toml crates/relay-tunnel/Cargo.lock
           git commit -m "chore: bump relay-tunnel version to ${{ steps.version.outputs.new_version }}"
           git tag -a ${{ steps.version.outputs.new_tag }} -m "Relay release ${{ steps.version.outputs.new_tag }}"
           git push