fix(relay): forward HTTP to a host's chat-v3 tRPC endpoint

Merged
HA
1mo ago
+276-18

Summary

The relay forwards HTTP only for /hosts/:id/trpc/*. Chat-v3 commands (/chat-v3/trpc) sent through the relay get 426 "WebSocket upgrade required". So a client that reaches a host through the relay, like mobile with a machine's workspace, can open a chat's stream but can't send a prompt, answer an approval, or list sessions.

This sends /hosts/:id/chat-v3/trpc/* through the same handler as /trpc/*.

Why it is safe

  • Auth is unchanged. authMiddleware already covers /hosts/:hostId/*.
  • The host tunnel already forwards any path with the host secret, and host-service's wsAuth on /chat-v3/* accepts it. No host change is needed, so released hosts work as soon as this deploys.

Why separate

Mobile chat support (#8157) is stacked on #8150. This is the only part that has to be on main before mobile can use chats on a machine's workspace, since the relay deploys from main.

Testing

  • The same change in #8157 typechecks in apps/relay.
  • apps/relay bun test has the same 4 http-exchange failures with and without this change. That suite doesn't cover routes.
  • Not yet checked end to end through a deployed relay.

Summary by cubic

Fixes relay proxying so clients reaching a host through the relay can call chat-v3 commands instead of failing with 426 "WebSocket upgrade required".

Routes /hosts/:hostId/chat-v3/trpc/* through the same HTTP handler as /trpc/*. Auth is unchanged, and the host tunnel already forwards any path, so no host-side change or rollout is needed. A single HOST_TRPC_ROUTERS table now drives route registration, auth-denial matching, and error encoding: relay-written errors are plain JSON on chat-v3 paths (the chat router has no transformer) and superjson on the main router, and /trpcfoo no longer matches /trpc.

Auth middleware now rejects any forwarded path not starting with a single /, covering all host routes and closing the percent-encoded host-id leak into stream paths. Adds relay tests for chat-v3 forwarding, auth errors, path rejection, and error encoding, plus a test script so relay suites run in CI.

Summary by CodeRabbit

  • Bug Fixes
    • Chat-v3 tRPC requests now receive the same proxy handling, authentication checks, and host availability checks as standard tRPC requests.
    • Invalid host paths are rejected, including invalid paths on WebSocket requests.
    • When host access or availability fails, tRPC errors now use the response format expected by the requested route: plain JSON for chat-v3 and the existing serialized format for standard tRPC.