feat: CLI backend auth and same-account iroh auto-trust

.env.example

@@ -15,3 +15,9 @@ VITE_AUTH_ENABLE_ANONYMOUS=false
 # Show app download links/banners in the web UI (set to "true" for internal testing deployments)
 # When enabled, desktop users see a sidebar section + bottom-right banner; mobile users see a top banner
 # VITE_SHOW_APP_DOWNLOADS="true"
+
+# iroh relay for the ACP/MCP bridge transport (build-time; Vite inlines it).
+# Unset = the n0 public relays (default). Set to a self-hosted iroh-relay wss URL
+# to route every bridge dial through it — n0 DNS discovery + crypto are kept, only
+# the relay hop changes. The CLI bridge has its own runtime env: THUNDERBOLT_IROH_RELAY_URL.
+# VITE_IROH_RELAY_URL="wss://relay.example.com"

.github/workflows/ci.yml

@@ -25,6 +25,10 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       rust: ${{ steps.filter.outputs.rust }}
+      agent-core: ${{ steps.filter.outputs.agent-core }}
+      cli: ${{ steps.filter.outputs.cli }}
+      wasm-artifact: ${{ steps.filter.outputs.wasm-artifact }}
+      crate-src: ${{ steps.filter.outputs.crate-src }}
     steps:
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -41,6 +45,23 @@ jobs:
               - 'src-tauri/build.rs'
               - 'src-tauri/rust-toolchain.toml'
               - 'src-tauri/.cargo/**'
+              - 'crates/**'
+            agent-core:
+              - 'shared/agent-core/**'
+            cli:
+              - 'cli/**'
+            wasm-artifact:
+              - 'src/acp/iroh/pkg/**'
+            # Inputs that change the compiled wasm (README.md excluded — it doesn't).
+            # Pairs with the wasm-artifact staleness gate: touching any of these MUST
+            # ship a regenerated src/acp/iroh/pkg in the same PR.
+            crate-src:
+              - 'crates/thunderbolt-acp-client/src/**'
+              - 'crates/thunderbolt-acp-client/Cargo.toml'
+              - 'crates/thunderbolt-acp-client/Cargo.lock'
+              - 'crates/thunderbolt-acp-client/rust-toolchain.toml'
+              - 'crates/thunderbolt-acp-client/.cargo/**'
+              - 'crates/thunderbolt-acp-client/build.sh'
 
   typescript:
     runs-on: ubuntu-latest
@@ -126,6 +147,113 @@ jobs:
           path: .metrics-baseline
           key: pr-metrics-main-${{ github.sha }}
 
+  # shared/agent-core is an isolated module (also consumed by cli/). Its unit tests
+  # are NOT part of the default `bun run test` — they only need to run when the
+  # module itself changes, so gate them on the agent-core path filter. Mirrors the
+  # `rust` job's detect-changes pattern and the `typescript` job's Bun setup.
+  agent-core:
+    needs: detect-changes
+    if: needs.detect-changes.outputs.agent-core == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Setup Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: '20'
+
+      - name: Install Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.3.14
+
+      - name: Cache Bun dependencies
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: |
+            ~/.bun/install/cache
+            node_modules
+          key: bun-${{ hashFiles('bun.lock') }}
+          restore-keys: |
+            bun-
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Run agent-core tests (5x)
+        run: bun run test:agent-core:5x
+
+  # cli/ is a self-contained package (own bun.lock, no imports from src/ or shared/),
+  # so its tests and typecheck aren't reached by the `typescript` job. Gate on the
+  # `cli/**` path filter — same detect-changes mechanism as the `rust` and
+  # `agent-core` jobs — so it runs only when cli/ changes.
+  cli:
+    needs: detect-changes
+    if: needs.detect-changes.outputs.cli == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Install Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.3.14
+
+      - name: Cache Bun dependencies (cli)
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: |
+            ~/.bun/install/cache
+            cli/node_modules
+          key: cli-bun-${{ hashFiles('cli/bun.lock') }}
+          restore-keys: |
+            cli-bun-
+
+      - name: Install cli dependencies
+        run: cd cli && bun install --frozen-lockfile
+
+      - name: Type check cli
+        run: cd cli && bun run typecheck
+
+      - name: Run cli tests (5x)
+        run: cd cli && bun run test:5x
+
+  # The iroh ACP client (P2P/QUIC crypto core) ships as a prebuilt wasm artifact at
+  # src/acp/iroh/pkg so the web app imports it without a wasm toolchain in CI. The
+  # committed binary embeds ~750 absolute ~/.cargo build paths, so it is byte-for-byte
+  # reproducible only on the machine that built it — a Linux/macOS CI rebuild can never
+  # match hash-for-hash (see the crate README's provenance note). CI therefore enforces
+  # provenance two ways, neither needing a wasm toolchain:
+  #   1. Staleness gate — a change to the crate source MUST ship a regenerated pkg/ in
+  #      the same PR, so editing the crate can't silently leave the committed wasm stale
+  #      (the `rust` job host-compiles the crate but never touches the binary).
+  #   2. Tamper-evidence — the committed pkg/ must match its CHECKSUMS.txt manifest.
+  # Reproduce a bit-identical artifact locally on the pinned toolchain with
+  # `crates/thunderbolt-acp-client/build.sh --verify` (see that crate's README).
+  wasm-artifact:
+    needs: detect-changes
+    if: needs.detect-changes.outputs.wasm-artifact == 'true' || needs.detect-changes.outputs.crate-src == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      # Crate source changed but the committed pkg/ didn't — the wasm wasn't rebuilt,
+      # so it's now stale relative to its source. Fail with the fix instruction.
+      - name: Guard against stale wasm artifact
+        if: needs.detect-changes.outputs.crate-src == 'true' && needs.detect-changes.outputs.wasm-artifact != 'true'
+        run: |
+          echo "::error::crates/thunderbolt-acp-client changed but src/acp/iroh/pkg was not regenerated — the committed wasm is stale."
+          echo "Rebuild and commit the artifact in the same change: crates/thunderbolt-acp-client/build.sh (then commit src/acp/iroh/pkg)."
+          exit 1
+
+      - name: Verify committed wasm artifacts match checksums manifest
+        if: needs.detect-changes.outputs.wasm-artifact == 'true'
+        run: cd src/acp/iroh/pkg && shasum -a 256 -c CHECKSUMS.txt
+
   rust:
     needs: detect-changes
     if: needs.detect-changes.outputs.rust == 'true'
@@ -189,6 +317,21 @@ jobs:
           cargo clippy --all-targets -- -D warnings
           cargo test
 
+      # crates/ holds the standalone thunderbolt-acp-client crate (own Cargo.toml
+      # and Cargo.lock, not a src-tauri workspace member), so the src-tauri build
+      # above never compiles it. Its wasm cdylib is the deployed artifact; the rlib
+      # target lets these host-target checks run without a wasm toolchain — the
+      # .cargo/config.toml rustflags are scoped to wasm32, so no --target override.
+      - name: Build and check ACP client crate
+        env:
+          CARGO_INCREMENTAL: 0
+          RUSTC_WRAPPER: ''
+        run: |
+          cd crates/thunderbolt-acp-client
+          cargo build --all-targets
+          cargo clippy --all-targets -- -D warnings
+          cargo test
+
   backend:
     runs-on: ubuntu-latest
     # Healthy run is ~130s; a CPU-starved one was observed at 4920s (~82min). A

.github/workflows/cli-release.yml

@@ -0,0 +1,158 @@
+name: CLI Release
+run-name: CLI release for v${{ inputs.version }}
+
+# Builds the standalone `thunderbolt` CLI binaries and attaches them, plus a
+# SHA256SUMS manifest, to the shared `v{version}` GitHub Release. The desktop
+# app derives download URLs from its own version:
+#
+#   https://github.com/thunderbird/thunderbolt/releases/download/v{APP_VERSION}/thunderbolt-{target}
+#   https://github.com/thunderbird/thunderbolt/releases/download/v{APP_VERSION}/SHA256SUMS
+#
+# where {target} is one of: darwin-arm64 | linux-x64 | linux-arm64.
+#
+# Native-runner matrix (no cross-compile): the CLI depends on @number0/iroh, a
+# NAPI addon that ships a per-platform prebuilt `.node`. `bun build --compile`
+# embeds only the `.node` that is installed on the build machine, so each target
+# MUST build on a runner of its own architecture — `bun install` there pulls the
+# matching optional iroh dependency automatically.
+#
+# darwin-x64 is intentionally absent: iroh 1.0.0 publishes no x86_64-apple-darwin
+# addon (`@number0/iroh-darwin-x64` does not exist on npm), so an Intel-macOS CLI
+# binary cannot load iroh and is not shipped. Intel-Mac desktop users therefore
+# have no one-click CLI install until iroh gains that target upstream.
+#
+# Publishing (flipping the draft release to public) is owned by the desktop
+# release workflow, which shares the `v{version}` tag. This workflow only uploads
+# assets via `gh release upload`, which never mutates the release's draft state —
+# so it cannot race the desktop publish flip back into draft.
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        description: 'Version to release (e.g., 1.2.3 without v prefix)'
+        required: true
+        type: string
+      nightly:
+        description: 'Is this a nightly build?'
+        required: false
+        default: false
+        type: boolean
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version to release (e.g., 1.2.3 without v prefix)'
+        required: true
+        type: string
+      nightly:
+        description: 'Is this a nightly build?'
+        required: false
+        default: false
+        type: boolean
+
+concurrency:
+  group: cli-release-${{ inputs.version }}
+  cancel-in-progress: true
+
+permissions:
+  contents: write
+
+jobs:
+  ensure-release:
+    name: Ensure Draft Release
+    runs-on: ubuntu-24.04
+    steps:
+      # For a regular release the draft already exists (version-bump created it).
+      # For a nightly it is created by the desktop workflow's draft job, which
+      # runs in parallel — create it here if we win the race, confirm it if we
+      # lose. Either way the build matrix can upload afterwards.
+      - name: Ensure the shared draft release exists
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPO: ${{ github.repository }}
+          VERSION: ${{ inputs.version }}
+          NIGHTLY: ${{ inputs.nightly }}
+        run: |
+          if gh release view "v${VERSION}" --repo "$REPO" >/dev/null 2>&1; then
+            exit 0
+          fi
+          FLAGS="--draft"
+          [ "$NIGHTLY" = "true" ] && FLAGS="$FLAGS --prerelease"
+          gh release create "v${VERSION}" --repo "$REPO" $FLAGS \
+            --title "Release v${VERSION}" \
+            --notes "Release assets are uploaded by CI." \
+            || gh release view "v${VERSION}" --repo "$REPO"
+
+  build:
+    name: Build ${{ matrix.target }}
+    needs: ensure-release
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macos-latest
+            target: darwin-arm64
+          - os: ubuntu-24.04
+            target: linux-x64
+          - os: ubuntu-24.04-arm
+            target: linux-arm64
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          ref: v${{ inputs.version }}
+
+      - name: Install Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.3.14
+
+      - name: Cache Bun dependencies (cli)
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: |
+            ~/.bun/install/cache
+            cli/node_modules
+          key: cli-bun-${{ matrix.os }}-${{ hashFiles('cli/bun.lock') }}
+          restore-keys: |
+            cli-bun-${{ matrix.os }}-
+
+      - name: Build CLI binary
+        run: cd cli && bun install --frozen-lockfile && bun run build:${{ matrix.target }}
+
+      # Upload as a workflow artifact rather than straight to the Release, so a
+      # failed leg can never leave a partial set of binaries on the release with
+      # no SHA256SUMS. The publish job below attaches everything atomically once
+      # ALL legs have succeeded.
+      - name: Upload CLI binary artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: thunderbolt-${{ matrix.target }}
+          path: cli/dist/thunderbolt-${{ matrix.target }}
+          if-no-files-found: error
+          retention-days: 1
+
+  publish:
+    name: Publish CLI assets
+    # `needs: build` (default success()) gates this on EVERY leg succeeding, so
+    # publishing is atomic: either all binaries + SHA256SUMS land, or nothing does.
+    needs: build
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Download all CLI binaries
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          path: dist
+          pattern: thunderbolt-*
+          merge-multiple: true
+
+      - name: Generate SHA256SUMS and upload all assets to the release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPO: ${{ github.repository }}
+          VERSION: ${{ inputs.version }}
+        run: |
+          cd dist
+          sha256sum thunderbolt-* > SHA256SUMS
+          gh release upload "v${VERSION}" thunderbolt-* SHA256SUMS --clobber --repo "$REPO"

.github/workflows/release.yml

@@ -79,3 +79,17 @@ jobs:
     with:
       version: ${{ needs.version_bump.outputs.new_version }}
       nightly: ${{ github.event_name == 'schedule' }}
+
+  # The CLI rides the unified `v{version}` release tag: its binaries attach to the
+  # same GitHub Release, and the desktop workflow's publish job flips that shared
+  # tag to public. It therefore builds only for `all` and nightly runs — not for
+  # single-platform (ios/android/desktop) dispatches, which produce RC tags the
+  # CLI would not belong to.
+  cli:
+    name: CLI Release
+    needs: version_bump
+    if: needs.version_bump.result == 'success' && (inputs.platform == 'all' || github.event_name == 'schedule')
+    uses: ./.github/workflows/cli-release.yml
+    with:
+      version: ${{ needs.version_bump.outputs.new_version }}
+      nightly: ${{ github.event_name == 'schedule' }}

.prettierignore

@@ -9,4 +9,7 @@ thunderbird-mcp-bridge
 thunderbird-mcp-native
 package-lock.json
 bun.lock
-*.lock
+*.lock
+# Generated wasm-bindgen glue for the iroh ACP client (build artifact).
+src/acp/iroh/pkg
+crates/*/target

backend/drizzle/0021_overrated_mindworm.sql

@@ -0,0 +1,6 @@
+-- This Source Code Form is subject to the terms of the Mozilla Public
+-- License, v. 2.0. If a copy of the MPL was not distributed with this
+-- file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+ALTER TABLE "powersync"."devices" ADD COLUMN "node_id" text;--> statement-breakpoint
+ALTER TABLE "powersync"."devices" ADD COLUMN "node_id_attested_at" timestamp;