[AbirAbbas]

Why

The privacy terms for the hosted relay are not finished. Until they are, the hosted relay must not keep anyone's chats or files, not even encrypted. People should still be able to pair their computers and reach one from another while both are on. Relay storage becomes something a person asks for, and we switch it on per account.

What changes

Hosted relay (relay/hosted)

• Off by default. Every write into relay storage refuses with 403 storage_off, unless the account has been approved or CAF_LIMITS sets storageOpen. It refuses before anything is written and before any quota changes. All such writes go through one place, and a structural test fails if a new one appears.
• Unchanged: reads, frames already stored, pairing, the device list, presence, the live tunnel behind --at, erasure and rotation.
• Approval. POST /v1/admin/storage takes an approval signed with an operator key listed in CAF_ADMIN_KEYS. It is bound to the relay host it was sent to, valid for ten minutes, and ordered by its timestamp, so it cannot be replayed or reordered. The public key is committed in wrangler.toml; the private key is not in the repository.
• Stats now say whether the calling account has storage: storage: "on" | "off".
• Rotation keeps an approval. A separate, device-signed POST /v1/store/handoff lets the device that froze an identity pass its approval to exactly one successor. The successor proves it holds the successor key. Only on is ever copied, and never over a record the successor already has.
• Untouched: the shared coordination state machine (internal/clusterstate) and the committed rotation command are byte-identical to dev.

Client

• Refusal. storage_off is its own refusal, with one plain sentence pointing at Settings.

• No uploads while off. The client keeps the relay's last answer beside the saved relay and makes no store writes while that answer is off. Chats keep saving on the computer.

• Discovering approval.

  • One refresher per process (the chat window, codeaf serve, the engine) asks at start, after /status, and every ten minutes while storage is off.
  • It asks nothing while storage is on, and asks a relay that reports no storage state once per process.
  • A chat waiting on storage retries against the local answer at most once a minute, so an approval starts sync within about a minute and needs no restart.

• Settings → Devices gets a "sync storage" row, named after the "sync service" the Devices tab already shows. When storage is off, enter opens a pre-filled GitHub issue carrying the request code (the account id). The panel also shows the code and the link, for when no browser opens. The row is absent for a relay that reports no storage state, such as the self-hosted one.

• /status says sync storage off.

• Quit receipt. Quitting after a revoke says the turn stays on this computer, rather than blaming the relay's reachability.

• Sync sentences reach the window. On the default road the chat lives in the engine process. The drive's sentences (storage off, storage full, removed, replaced, clock skew, displacement) used to be said on a desk there that no window reads, which was already true on dev. They now travel on each conversation's own notice road, which the engine already forwards to every attached window. A new window is told only a refusal that is still in force.

• Continuing a chat while storage is off. This is the ordinary road after any --at session, because live access moves the chat's hold to the other computer. The road depends on whether this computer has turns of its own:

  • None: the unchanged path downloads the stored history. Reading needs no approval.
  • Its turns extend the recorded head: it continues in place with no upload, and sends at once.
  • Its turns diverged: it refuses in one sentence and keeps every turn.

  After a later approval, this computer's own expired hold re-acquires and publishes the kept turns.

• Closing one chat whose turns are saved here says so, instead of "could not be saved".

• Rotation sends the same freeze bytes as before to every relay. It sends the handoff only to a relay that reports storage. A rotation with storage off finishes with no store writes.

• codeaf-relay-admin has approve, revoke and public-key. It is a separate program, not part of any release archive or installer.

Your own relay (codeaf relay) is unaffected: storage stays on, with no request step.

Manual. Every section that said chats, keys, teams or task copies travel between paired computers automatically now says this waits for approval on the hosted relay. A new section answers how to request it. The system prompt is unchanged from dev; the manual carries all of this.

Validation

• Focused tests for every contract item, all passing:

  • the relay's own tests through the real Worker, including the two-device handoff race and live tunnel bytes with storage off;
  • the client gate, refresher, waiter, rotation and handoff;
  • the old freeze bytes against the unchanged strict decoder;
  • the Settings frames, through both the tab and the search, with a failing browser opener;
  • the quit receipt;
  • the manual probes.

• Measured cost: with storage off, 2–3 local file reads a minute whatever the number of open chats. With storage on, or on a self-hosted relay, nothing.

• Hand test of the real bin/codeaf against a local copy of the hosted relay, in tmux, with throwaway homes, a throwaway admin key and a keyless model stub:

  • pairing and --at work with storage off, with no store writes;
  • the Settings row, request link and /status line appear;
  • approving without a restart uploads the pending turns, and a headless serve home finds the approval at startup;
  • revoke, replay, wrong key and wrong host are refused;
  • storageOpen opens storage for everyone, and the self-hosted relay is unaffected;
  • rotation of approved and unapproved accounts works;
  • a 10-turn session with quit and relaunch was stable.

• A real macOS hand check of this branch on a Mac, against a local wrangler dev copy of the hosted relay, on the default engine road. The storage gate held. It found two real bugs and four small ones, all fixed in this branch:

  • the storage-off sentence never reached the window;
  • "continue here" failed after a revoke;
  • closing a chat said it could not be saved;
  • the first /status after pairing lacked the line;
  • the search offered "request access" while storage was on;
  • an open window missed a pairing.

  Mac recheck on the final head 6e031be20: passed.

  • Storage-off continue here after --at asks once, then never again across idle periods.
  • The storage-off sentence shows once per window.
  • No store write succeeds while off.
  • A computer missing newer turns from the other one still asks.
  • Approval publishes the kept turns.
  • Storage-on turns upload normally.
  • make test-touched on macOS attributes nothing to this branch.
  • The relay's own tests pass, 262 of 262.

  An earlier recheck at e91f33289 found one more bug: the continue question returned every few minutes for a chat with turns past the last stored one. It is fixed in 6e031be20.

• Five read-only reviews. Their findings were fixed in this branch, except the follow-ups listed below.

• make pr-ready passes. Along the way it caught a lock without defer, an environment read outside internal/env, the device pages' vocabulary law, two contract changes in existing tests (team sharing needs storage; a revoked serving home makes one request), and a refresher check that could outlive its caller. All are fixed here.

Two problems found during the hand test reproduce on dev without this change:

• continuing a chat on another computer fails on a missing .cell/meta.json;
• GET /v2/cluster/control can answer 503 to a newly paired identity once several identities are active on a local Worker, until it restarts.

Neither is fixed here.

Known limits, left as follow-ups:

• Tools in a storage-off chat do not check who holds it. A turn already running on one computer can keep running tools after another computer takes the chat. This was already true for any storage-off chat before this change, and fixing it needs a new check at the tool boundary.
• Messages from the final save after a chat closes never reach the window. As on dev, the engine stops delivering them before that last save.
• Local wrangler dev on macOS needs two workarounds, both already on dev: Node 22 or newer, and a [build] hook that reads the Linux-only /proc/pressure/io.

Before merging

Merging to dev redeploys the dev relay, which then stores nothing for accounts that are not approved, including dev and local builds. Approve the accounts that should keep syncing with codeaf-relay-admin approve <id> --relay dev right after the deploy. Production relay deploys stay off.

🤖 Generated with Claude Code