feat: promote dev foundation and launch prep to main by icanvardar · Pull Request #1 · heycupola/wrapper

icanvardar · 2026-06-19T10:29:45Z

Summary

Backend, CLI, relay, and web onboarding foundation with Better Auth device flow
Relay transport, Fly deploy hardening, and ops runbook
CLI release automation + shared Homebrew tap sync
Host-attach happy-path e2e test wired into CI full lane
Horizontal landing page with hero demo video and copyable install
apps/mobile git submodule (wrapper-mobile)

Note

High Risk
Large greenfield surface area spanning shell rc patching, session relay/auth, and production deploy/release automation; regressions could affect user shells, remote access, or shipping broken binaries.

Overview
This PR replaces the Turborepo starter with the Wrapper product monorepo and lands the end-to-end foundation described in the PR title: CLI, backend hooks, relay integration points, and launch-prep automation.

CLI runtime (apps/cli) adds the full host/viewer loop: rc install/uninstall, guarded shell-host (PTY, local WebSocket broker, session registry), attach with registry picker plus Convex-backed authorization for local attach and relay tickets for remote attach, device auth login/whoami/logout, prefix shortcuts for share/unshare, relay host bridge, HUD/feedback helpers, and Bun tests including a host→WS→shell e2e path.

Tooling & onboarding switches the repo to oxlint + oxfmt (with shared configs), adds workspace .env.example, rewrites the root README, registers apps/mobile as a git submodule, and moves apps/docs from Next.js to Mintlify (architecture, onboarding, mobile contract MDX).

CI & release adds a two-lane CI (lint/format/types, then tests, web/Cloudflare builds, optional Convex deploy dry-run, relay smoke), Fly deploy for apps/relay, CLI release (multi-arch bun build --compile, GitHub release + checksums), Homebrew tap formula updates, and a release dry-run workflow for PR validation.

^{Reviewed by Cursor Bugbot for commit abd3faf. Bugbot is set up for automated code reviews on this repo. Configure here.}

…mn support

…indings

Gate host relay tickets behind Autumn feature checks, and tighten Fly deployment with explicit relay config, smoke verification, and updated operational runbook details.

Introduce persistent onboarding progress in Convex and wire a guarded web onboarding route so authenticated users complete first-run checklist steps before normal app flow.

Keep host HUD behavior on by default and add WRAPPER_HUD controls so users can disable title and notification updates when they prefer a quieter terminal.

Introduce fast/full CI lanes, automated multi-platform CLI release assets, and reusable workflow-driven updates for wrapper.rb in the shared heycupola/homebrew-tap repository.

Reorganize docs navigation around onboarding and operations, add troubleshooting and release-channel guidance, and document the mobile-phase boundary while app development is deferred.

Adopt a Relic-inspired section wrapper pattern and redesign the landing page as horizontal snap-scrolling panels, while polishing onboarding completion UX and progress feedback.

Introduce release dry-run archive verification, add relay incident/rollback runbook guidance, and cover health plus unauthenticated websocket rejection with relay smoke e2e tests.

Document the backend/auth/relay contract for future mobile clients and include the page in Mintlify navigation so implementation assumptions stay explicit before mobile build starts.

greptile-apps

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.

icanvardar · 2026-06-19T11:03:14Z

@cursoragent do your job

cursor · 2026-06-19T11:03:17Z

Please finish setting up background agents. Go to Cursor

icanvardar · 2026-06-19T11:04:22Z

@cursoragent do your job

cursor · 2026-06-19T11:04:30Z

Done. I pushed two commits to dev:

Hardened Better Auth secret handling and documented BETTER_AUTH_SECRET.
Fixed relay WebSocket auth race by queuing messages until ticket authorization completes.
Bumped CLI release version to 0.1.0.
Aligned Bun pins/docs/workflows to 1.3.5.
Added CI web production + Cloudflare bundle build checks.
Added Convex deploy dry-run step when CONVEX_DEPLOY_KEY is configured; it warns/skips when the secret is missing.
Cleaned stale CLI PTY docs.

Validation passed locally:

bun run format:check
bun run lint
bun run check-types
bunx turbo run test
apps/web production build
apps/web OpenNext Cloudflare build
CLI Linux standalone build

Remote GitHub Actions are green on the latest push; only Cursor Bugbot was still in progress when checked. Working tree is clean.

Note: Bun was missing from this Cloud Agent image, so I installed Bun 1.3.5 and ran bun install. For future agents, set up the environment from Cursor web with a prompt like: “Install Bun 1.3.5 in the cloud agent image and run bun install for the wrapper monorepo so CI-equivalent checks can run locally.”

Co-authored-by: Can Vardar <me@icanvardar.com>

…ss-findings # Conflicts: # apps/relay/src/index.ts # packages/backend/convex/auth.ts

fix: resolve security and correctness findings

fix: cli and relay correctness/security bugs

cursor

Cursor Bugbot has reviewed your changes using high effort and found 4 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit abd3faf. Configure here.}

cursor · 2026-06-19T12:54:13Z

+    if (!closed) {
+      log.warn("relay host disconnected", { sessionId: opts.sessionId });
+    }
+  });


Relay drop leaves stale bridge

Medium Severity

The relay WebSocket's close event handler doesn't call the internal close() function when the socket closes unexpectedly. This leaves PTY listeners active, sending output to a dead socket and preventing remote re-attachment.

^{Reviewed by Cursor Bugbot for commit abd3faf. Configure here.}

cursor · 2026-06-19T12:54:13Z

+    const message = normalizeAttachAuthorizationError(error);
+    process.stderr.write(`[wrapper] attach authorization failed: ${message}\n`);
+    return false;
+  }


Local attach needs backend record

Medium Severity

If session:open fails while the host keeps running, wrapper attach still calls session:authorizeAttach for local WebSocket attach and fails with “session not found,” even though the session is live in the local registry and listening on 127.0.0.1.

Additional Locations (1)

apps/cli/commands/shell-host.ts#L164-L178

^{Reviewed by Cursor Bugbot for commit abd3faf. Configure here.}

cursor · 2026-06-19T12:54:13Z

+  if (backend.status === "missing_auth") {
+    process.stderr.write("[wrapper] backend auth required. Run `wrapper auth login` first.\n");
+    return false;
+  }


Convex URL blocks local attach

Medium Severity

With WRAPPER_CONVEX_URL set but no saved login, shell-host runs and registers sessions, yet wrapper attach refuses local attach and tells the user to log in—even for same-machine 127.0.0.1 sessions that never touch the relay.

Additional Locations (1)

apps/cli/commands/shell-host.ts#L178-L181

^{Reviewed by Cursor Bugbot for commit abd3faf. Configure here.}

cursor · 2026-06-19T12:54:13Z

+
+  const client = new ConvexHttpClient(convexUrl);
+  client.setAuth(stored.sessionToken);
+  return { status: "ready", client, convexUrl };


Env URL overrides stored token

Medium Severity

resolveAuthedConvexClient builds the Convex client from WRAPPER_CONVEX_URL/CONVEX_URL when set, but still applies the saved session token from a potentially different deployment URL. Auth and attach calls can fail or hit the wrong backend after an env change without re-login.

^{Reviewed by Cursor Bugbot for commit abd3faf. Configure here.}

icanvardar added 30 commits April 3, 2026 21:36

feat(web): add announcement homepage

c2ac3f5

feat(web): add Cloudflare deployment config

47b3f90

chore(tooling): migrate workspace to oxlint and oxfmt

770874b

feat(core): add cli runtime and shared terminal packages

afb59f2

chore(tsconfig): add shared bundler preset

fd0d5aa

docs(roadmap): add backend blueprint and phase tracking

a6a6a6d

docs(docs): migrate docs app to mintlify introduction scaffold

2111c2e

fix(cli): avoid failing turbo dev by using explicit host dev command

2524112

feat(backend): add convex backend foundation with middleware and autu…

af8ea3a

…mn support

ci: add turbo lint and format check workflow

8ee539f

feat(backend): add better-auth device authorization flow

64898dc

refactor(backend): simplify better-auth static options wiring

30de715

feat(cli): add device auth login, whoami, and logout commands

917dff3

feat(session): add backend lifecycle, attach auth, and stale cleanup

ef9d26c

feat(relay): add authenticated relay transport and lifecycle hardening

ce105d1

docs(relay): add deployment and setup runbooks before mobile phase

31d6198

chore(env): add environment templates and refresh generated backend b…

e7d058b

…indings

chore(cli): format readme

ea3c46f

chore(relay): decouple runtime deps and align Fly config

7233c7e

refactor(env): standardize runtime mode on NODE_ENV

c54e203

feat(auth): wire better-auth web approval flow end to end

d29b48b

feat(relay): enforce share entitlement and harden Fly deploy path

7e63bb7

Gate host relay tickets behind Autumn feature checks, and tighten Fly deployment with explicit relay config, smoke verification, and updated operational runbook details.

feat(onboarding): add backend state model and web onboarding flow

bfe31d8

Introduce persistent onboarding progress in Convex and wire a guarded web onboarding route so authenticated users complete first-run checklist steps before normal app flow.

feat(cli): enable default shell-host HUD with explicit opt-out

4fca3e0

Keep host HUD behavior on by default and add WRAPPER_HUD controls so users can disable title and notification updates when they prefer a quieter terminal.

ci(release): add CLI release pipeline and shared Homebrew sync

1f3de27

Introduce fast/full CI lanes, automated multi-platform CLI release assets, and reusable workflow-driven updates for wrapper.rb in the shared heycupola/homebrew-tap repository.

docs(onboarding): restructure Mintlify docs for launch and support

a11b062

Reorganize docs navigation around onboarding and operations, add troubleshooting and release-channel guidance, and document the mobile-phase boundary while app development is deferred.

Merge branch 'feat/foundation-onboarding-release' into dev

f4450de

feat(web): switch landing flow to horizontal section narrative

7dd6ff7

Adopt a Relic-inspired section wrapper pattern and redesign the landing page as horizontal snap-scrolling panels, while polishing onboarding completion UX and progress feedback.

ci(relay): add dry-run release validation and relay operations runbook

24e0930

Introduce release dry-run archive verification, add relay incident/rollback runbook guidance, and cover health plus unauthenticated websocket rejection with relay smoke e2e tests.

docs(mobile): add integration contract and wire navigation

730dbb8

Document the backend/auth/relay contract for future mobile clients and include the page in Mintlify navigation so implementation assumptions stay explicit before mobile build starts.

greptile-apps Bot reviewed Jun 19, 2026

View reviewed changes

cursoragent and others added 2 commits June 19, 2026 11:11

chore: harden launch readiness gates

575e949

Co-authored-by: Can Vardar <me@icanvardar.com>

ci: skip convex dry run without deploy key

50bb156

Co-authored-by: Can Vardar <me@icanvardar.com>

cursor Bot reviewed Jun 19, 2026

View reviewed changes

Comment thread apps/cli/index.ts

Comment thread apps/cli/commands/attach.ts

Comment thread apps/cli/commands/shell-host.ts

Comment thread .github/workflows/fly-deploy.yml Outdated

Comment thread apps/cli/registry/sessions.ts

Comment thread apps/cli/client/attach-client.ts

icanvardar added 10 commits June 19, 2026 14:47

fix(relay): buffer pre-auth frames to prevent socket close race

f059413

fix(cli): handle pty spawn failure without hanging shell-host

8d37cb4

fix(backend): avoid known default better-auth secret outside dev

8d219bf

feat(backend): rate-limit unauthenticated device-auth endpoints

9ad6927

fix(cli): verify release archive checksum during install

9af72a0

test(relay): guard protocol copy against repo protocol drift

f5fb843

chore(backend): refresh generated convex bindings and widen fmt ignore

dec34e7

Merge remote-tracking branch 'origin/dev' into fix/security-correctne…

b1f1fbd

…ss-findings # Conflicts: # apps/relay/src/index.ts # packages/backend/convex/auth.ts

chore(backend): regenerate convex bindings after dev merge

3521fa7

Merge pull request #2 from heycupola/fix/security-correctness-findings

bee317e

fix: resolve security and correctness findings

cursor Bot reviewed Jun 19, 2026

View reviewed changes

Comment thread apps/cli/index.ts

Comment thread apps/cli/shell/prefix.ts Outdated

Comment thread apps/cli/scripts/install.sh Outdated

icanvardar added 9 commits June 19, 2026 15:39

fix(cli): re-emit prefix byte on armed timeout

3ad45b8

fix(relay): complete attach and close viewers when session ends

a38ae6f

fix(cli): authorize port-only attach and lock session registry

13b83b5

fix(cli): sync shared state before issuing relay ticket

fa4c96f

fix(cli): install into ~/.wrapper without nested bin dir

9e19922

fix(logger): default telemetry off until explicit consent

33f9a46

fix(cli): read cli version from package.json

9119303

ci(relay): set explicit concurrency mapping for fly deploy

72a0e29

Merge pull request #3 from heycupola/fix/security-correctness-findings

abd3faf

fix: cli and relay correctness/security bugs

icanvardar merged commit 1c0f05f into main Jun 19, 2026
10 checks passed

cursor Bot reviewed Jun 19, 2026

View reviewed changes

Uh oh!

Conversation

icanvardar commented Jun 19, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

greptile-apps Bot left a comment

Choose a reason for hiding this comment

Uh oh!

icanvardar commented Jun 19, 2026

Uh oh!

cursor Bot commented Jun 19, 2026

Uh oh!

icanvardar commented Jun 19, 2026

Uh oh!

cursor Bot commented Jun 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Jun 19, 2026

Choose a reason for hiding this comment

Relay drop leaves stale bridge

Uh oh!

cursor Bot Jun 19, 2026

Choose a reason for hiding this comment

Local attach needs backend record

Uh oh!

cursor Bot Jun 19, 2026

Choose a reason for hiding this comment

Convex URL blocks local attach

Uh oh!

cursor Bot Jun 19, 2026

Choose a reason for hiding this comment

Env URL overrides stored token

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

icanvardar commented Jun 19, 2026 •

edited by cursor Bot

Loading

cursor Bot commented Jun 19, 2026 •

edited

Loading