feat: implement end-to-end encryption for relay connections

packages/app/e2e/global-setup.ts

@@ -184,6 +184,7 @@ export default async function globalSetup() {
   process.env.E2E_DAEMON_PORT = String(port);
   process.env.E2E_RELAY_PORT = String(relayPort);
   process.env.E2E_RELAY_SESSION_ID = offer.sessionId;
+  process.env.E2E_RELAY_DAEMON_PUBLIC_KEY = offer.daemonPublicKeyB64;
   process.env.E2E_METRO_PORT = String(metroPort);
   console.log(`[e2e] Test daemon started on port ${port}, Metro on port ${metroPort}, home: ${paseoHome}`);
 

packages/app/e2e/relay-fallback-connect.spec.ts

@@ -3,8 +3,11 @@ import { test, expect } from './fixtures';
 test('connects via relay when direct endpoints fail', async ({ page }) => {
   const relayPort = process.env.E2E_RELAY_PORT;
   const sessionId = process.env.E2E_RELAY_SESSION_ID;
-  if (!relayPort || !sessionId) {
-    throw new Error('E2E_RELAY_PORT or E2E_RELAY_SESSION_ID is not set (expected from globalSetup).');
+  const daemonPublicKeyB64 = process.env.E2E_RELAY_DAEMON_PUBLIC_KEY;
+  if (!relayPort || !sessionId || !daemonPublicKeyB64) {
+    throw new Error(
+      'E2E_RELAY_PORT, E2E_RELAY_SESSION_ID, or E2E_RELAY_DAEMON_PUBLIC_KEY is not set (expected from globalSetup).'
+    );
   }
 
   const nowIso = new Date().toISOString();
@@ -14,6 +17,7 @@ test('connects via relay when direct endpoints fail', async ({ page }) => {
     id: 'relay-only-daemon',
     label: 'relay-daemon',
     endpoints: [relayEndpoint],
+    daemonPublicKeyB64,
     relay: { endpoint: relayEndpoint, sessionId },
     metadata: null,
     createdAt: nowIso,

packages/app/metro.config.js

@@ -5,6 +5,7 @@ const path = require("path");
 
 const projectRoot = __dirname;
 const serverSrcRoot = path.resolve(projectRoot, "../server/src");
+const relaySrcRoot = path.resolve(projectRoot, "../relay/src");
 
 const config = getDefaultConfig(projectRoot);
 const defaultResolveRequest = config.resolver.resolveRequest ?? resolve;
@@ -13,7 +14,7 @@ config.resolver.resolveRequest = (context, moduleName, platform) => {
   const origin = context.originModulePath;
   if (
     origin &&
-    origin.startsWith(serverSrcRoot) &&
+    (origin.startsWith(serverSrcRoot) || origin.startsWith(relaySrcRoot)) &&
     moduleName.endsWith(".js")
   ) {
     const tsModuleName = moduleName.replace(/\.js$/, ".ts");

packages/app/package.json

@@ -41,8 +41,10 @@
     "@react-navigation/bottom-tabs": "^7.4.0",
     "@react-navigation/elements": "^2.6.3",
     "@react-navigation/native": "^7.1.8",
+    "@sphereon/isomorphic-webcrypto": "^2.5.0-rn-crypto.2",
     "@tanstack/react-query": "^5.90.11",
     "@tauri-apps/api": "^2.9.1",
+    "base64-js": "^1.5.1",
     "buffer": "^6.0.3",
     "expo": "^54.0.18",
     "expo-audio": "~1.0.13",
@@ -85,6 +87,7 @@
     "react-native-reanimated": "~4.1.1",
     "react-native-safe-area-context": "~5.6.0",
     "react-native-screens": "~4.16.0",
+    "react-native-securerandom": "^1.0.1",
     "react-native-svg": "^15.14.0",
     "react-native-unistyles": "^3.0.15",
     "react-native-web": "~0.21.0",

packages/app/src/components/multi-daemon-session-host.tsx

@@ -10,6 +10,7 @@ import { useEffect, useMemo, useRef, useState } from "react";
 function buildCandidateUrls(daemon: HostProfile): string[] {
   const endpoints = daemon.endpoints ?? [];
   const sessionId = daemon.relay?.sessionId ?? null;
+  const relayEndpoint = daemon.relay?.endpoint ?? null;
   const lastKnownGood =
     typeof daemon.metadata?.lastKnownGoodEndpoint === "string"
       ? (daemon.metadata.lastKnownGoodEndpoint as string)
@@ -20,21 +21,24 @@ function buildCandidateUrls(daemon: HostProfile): string[] {
     if (!out.includes(url)) out.push(url);
   };
 
-  if (lastKnownGood) {
+  const isLastKnownRelay = !!relayEndpoint && lastKnownGood === relayEndpoint;
+  const directEndpoints = relayEndpoint
+    ? endpoints.filter((endpoint) => endpoint !== relayEndpoint)
+    : endpoints;
+
+  if (lastKnownGood && !isLastKnownRelay) {
     push(buildDaemonWebSocketUrl(lastKnownGood));
   }
 
-  for (const endpoint of endpoints) {
+  for (const endpoint of directEndpoints) {
     push(buildDaemonWebSocketUrl(endpoint));
   }
 
-  if (sessionId) {
-    if (lastKnownGood) {
-      push(buildRelayWebSocketUrl({ endpoint: lastKnownGood, sessionId }));
-    }
-    for (const endpoint of endpoints) {
-      push(buildRelayWebSocketUrl({ endpoint, sessionId }));
+  if (sessionId && relayEndpoint) {
+    if (isLastKnownRelay) {
+      push(buildRelayWebSocketUrl({ endpoint: relayEndpoint, sessionId }));
     }
+    push(buildRelayWebSocketUrl({ endpoint: relayEndpoint, sessionId }));
   }
 
   return out;
@@ -123,7 +127,12 @@ function ManagedDaemonSession({ daemon }: { daemon: HostProfile }) {
   ]);
 
   return (
-    <SessionProvider key={`${daemon.id}:${activeUrl}`} serverUrl={activeUrl} serverId={daemon.id}>
+    <SessionProvider
+      key={`${daemon.id}:${activeUrl}`}
+      serverUrl={activeUrl}
+      serverId={daemon.id}
+      daemonPublicKeyB64={daemon.daemonPublicKeyB64}
+    >
       {null}
     </SessionProvider>
   );

packages/app/src/contexts/session-context.tsx

@@ -326,6 +326,7 @@ interface SessionProviderProps {
   children: ReactNode;
   serverUrl: string;
   serverId: string;
+  daemonPublicKeyB64?: string;
 }
 
 // SessionProvider: Daemon client message handler that updates Zustand store
@@ -333,8 +334,9 @@ export function SessionProvider({
   children,
   serverUrl,
   serverId,
+  daemonPublicKeyB64,
 }: SessionProviderProps) {
-  const client = useDaemonClient(serverUrl);
+  const client = useDaemonClient(serverUrl, { daemonPublicKeyB64 });
   const [connectionSnapshot, setConnectionSnapshot] =
     useState<DaemonConnectionSnapshot>(() =>
       mapConnectionState(client.getConnectionState(), client.lastError)

packages/app/src/hooks/use-daemon-client.ts

@@ -9,19 +9,44 @@ function runDaemonRequest(label: string, promise: Promise<unknown>): void {
   });
 }
 
-export function useDaemonClient(url: string): DaemonClientV2 {
+type DaemonClientOptions = {
+  daemonPublicKeyB64?: string;
+};
+
+function isRelayWebSocketUrl(url: string): boolean {
+  try {
+    const parsed = new URL(url);
+    return parsed.searchParams.get("role") === "client" && parsed.searchParams.has("session");
+  } catch {
+    return false;
+  }
+}
+
+export function useDaemonClient(
+  url: string,
+  options: DaemonClientOptions = {}
+): DaemonClientV2 {
   const client = useMemo(
     () => {
       const tauriTransportFactory = createTauriWebSocketTransportFactory();
+      const relayConnection = isRelayWebSocketUrl(url);
       return new DaemonClientV2({
         url,
         suppressSendErrors: true,
         ...(tauriTransportFactory
           ? { transportFactory: tauriTransportFactory }
           : {}),
+        ...(relayConnection
+          ? {
+              e2ee: {
+                enabled: true,
+                daemonPublicKeyB64: options.daemonPublicKeyB64,
+              },
+            }
+          : {}),
       });
     },
-    [url]
+    [options.daemonPublicKeyB64, url]
   );
 
   useEffect(() => {

packages/app/src/polyfills/crypto.ts

@@ -7,16 +7,44 @@ declare global {
 }
 
 export function polyfillCrypto(): void {
-  if (typeof globalThis.crypto === "undefined") {
-    (globalThis as any).crypto = {};
+  let webcrypto: Crypto | null = null;
+  try {
+    // Prefer the React Native entrypoint to avoid the browser shim.
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    const rnModule = require("@sphereon/isomorphic-webcrypto/src/react-native");
+    webcrypto = (rnModule?.default ?? rnModule) as Crypto;
+  } catch {
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    const fallbackModule = require("@sphereon/isomorphic-webcrypto");
+    webcrypto = (fallbackModule?.default ?? fallbackModule) as Crypto;
   }
 
-  if (typeof globalThis.crypto.randomUUID !== "function") {
+  const existing = (globalThis as any).crypto as Crypto | null | undefined;
+  let target = existing;
+  if (!target || typeof (target as Crypto).subtle === "undefined") {
+    target = (webcrypto && typeof webcrypto === "object" ? (webcrypto as Crypto) : undefined) ?? ({} as Crypto);
+    (globalThis as any).crypto = target;
+  }
+
+  const ensureSecure = (globalThis as any).crypto?.ensureSecure as
+    | (() => Promise<void>)
+    | undefined;
+  if (typeof ensureSecure === "function") {
+    void ensureSecure();
+  }
+
+  if (typeof (globalThis as any).crypto?.randomUUID !== "function") {
+    if (!globalThis.crypto) {
+      (globalThis as any).crypto = {} as Crypto;
+    }
     globalThis.crypto.randomUUID = () =>
       ExpoCrypto.randomUUID() as `${string}-${string}-${string}-${string}-${string}`;
   }
 
-  if (typeof globalThis.crypto.getRandomValues !== "function") {
+  if (typeof (globalThis as any).crypto?.getRandomValues !== "function") {
+    if (!globalThis.crypto) {
+      (globalThis as any).crypto = {} as Crypto;
+    }
     globalThis.crypto.getRandomValues = <T extends ArrayBufferView>(array: T): T => {
       return ExpoCrypto.getRandomValues(array as any) as T;
     };