Releases · Avaya02/Relay

relayrun 0.3.0

The agent now runs in a sandbox, so a session link can't be used to reach the rest of the host's machine.

Sandboxed agent commands. Every shell command the agent runs goes through the Agent SDK's OS-level sandbox (Seatbelt on macOS, bubblewrap on Linux). Commands still run without approval prompts, so npm test, builds and installs work as before. The sandbox stops them from:
- writing anywhere outside the session's clone;
- reading credential locations (~/.ssh, ~/.aws, ~/.npmrc, ~/.config/gh, the macOS Keychain and others);
- reading the host's own checkout, where gitignored .env files live;
- seeing environment variables with secret-looking names (*_TOKEN, *_KEY, *_SECRET, DATABASE_URL, …);
- reaching hosts other than package registries and GitHub.
File access outside the session folder is refused.
--no-sandbox restores unrestricted access, for sessions where everyone with the link is trusted.
--allow-domain <list> lets commands reach extra hosts.

Stopped runs now end cleanly. Pressing Stop, or the host's machine disconnecting mid-run, closes the turn with "Stopped by …" or "the host's agent disconnected". Before, the next answer appeared under the previous prompt.
API errors are reported once. A failed run (auth failure, rate limit, usage cap) shows a single error with the reason, not a "done, $0.00" line plus an error.
Package installs work inside the sandbox. npm, pnpm, yarn, pip and Go caches go to a per-session folder outside the clone, so they never show up as session changes.

macOS: works out of the box.
Linux: needs bubblewrap and socat (sudo apt-get install bubblewrap socat). relayrun refuses to start without them.
Windows: run inside WSL2, or pass --no-sandbox.

Tests that start their own local server (for example supertest) fail inside the sandbox on macOS.
Docker, git over SSH, and browser-based logins don't work inside the sandbox.
--api-key currently bills the machine's Claude Code login instead of the given key.

Upgrade: npx relayrun@0.3.0