feat(relay): rendezvous-relay service — 7 packages + plans (contracts/transport/agent/control-plane/e2e/auth/web)

Multi-tenant reverse-tunnel service ("ngrok for Claude Code" with E2E): a
host-agent dials OUT to an operator-run relay; external devices reach the host
THROUGH the relay, routed by per-tenant subdomain, forwarding ciphertext only
(the relay never sees plaintext). Lets a customer reach their own self-hosted
web-terminal from anywhere with zero networking setup.

Packages — all tsc-strict + vitest green (656 tests), cross-package integration verified:
- relay-contracts: frozen shared contracts (mux frame codec, data model,
  capability token, E2E envelope, pairing) — the src/types.ts analog
- term-relay:   native WS mux + stateless data plane (subdomain routing, ciphertext forward)
- agent:        host-agent (pairing, per-host Ed25519 + mTLS dial-out, forwards to 127.0.0.1:3000)
- control-plane: accounts/hosts registry, pairing-code flow, routing table, provisioning
- relay-e2e:    browser<->agent E2E (X25519 ECDH through relay, AEAD, anti-replay, recoverable replay key)
- relay-auth:   Passkey/WebAuthn, capability tokens, per-host certs, deny-by-default tenant isolation
- relay-web:    browser login + Web Crypto E2E + client-side preview rendering

Security invariants INV1-15 enforced; cross-tenant isolation CI tripwire live
(.github/workflows/relay-tripwire.yml). Design + implementation-level plans in
docs/PLAN_RELAY_*.md and docs/EXPLORE_RELAY_SERVICE.md.

NOTE: generated autonomously per the reviewed plans. The security-critical
packages (relay-e2e, relay-auth) REQUIRE expert security audit before any real
deployment — passing tests prove self-consistency, not resistance to attackers.
Base app (src/, public/) unchanged; concurrent desktop work left uncommitted.

relay-web/src/preview-client.ts

@@ -0,0 +1,140 @@
+/**
+ * T9 (v0.10) — client-side preview rendering. Under E2E the relay CANNOT render a screen it cannot
+ * read (server previews die); the authorized, key-holding browser decrypts a CIPHERTEXT replay and
+ * renders a READ-ONLY xterm.
+ *
+ * Ring-buffer replay survives a reload because the agent (P2) sealed each stored frame with
+ * `sealReplayFrame` under the RECOVERABLE content key `K_content` — NOT the ephemeral live
+ * `DirectionalKeys` (which are re-derived per handshake and lost on reload). The browser re-derives
+ * the SAME `K_content` via `deriveContentKey({ hostContentSecret, sessionId, alg })` (§4.4 FIX 3;
+ * `hostContentSecret` obtained via P5 after auth/step-up) and decrypts each payload with
+ * `openReplayCiphertext`. A wrong/ephemeral key throws (AEAD tag) → the card shows "unavailable",
+ * never a torn/garbled screen (cross-host/session isolation, INV1).
+ *
+ * The §4.4 crypto (`deriveContentKey`/`openReplayCiphertext`) is imported from `relay-e2e` and
+ * injected — cited verbatim, never re-implemented. `hostContentSecret`/`K_content` are transient in
+ * memory: NEVER persisted or logged (INV5/INV9). The preview has NO input wiring (read-only).
+ */
+import type { AeadAlg, AeadKey, ReplayKeyParams } from 'relay-contracts'
+
+/** Ciphertext ring-buffer replay for one host/session. */
+export interface ReplaySource {
+  readonly sessionId: string
+  readonly alg: AeadAlg // negotiated aead (matches how P2 sealed the replay)
+  readonly frames: readonly Uint8Array[] // stored DATA payloads, each a sealReplayFrame envelope
+}
+
+/** Read-only terminal surface — NO `onData`/input path exists (structural read-only guarantee). */
+export interface ReadonlyTerminalLike {
+  open(container: HTMLElement): void
+  write(data: string): void
+  dispose(): void
+}
+
+/** Injected §4.4 replay crypto (from relay-e2e) + a read-only terminal factory. */
+export interface PreviewDeps {
+  deriveContentKey(p: ReplayKeyParams): AeadKey
+  openReplayCiphertext(k: AeadKey, dataPayload: Uint8Array): Uint8Array
+  createTerminal?: (dims: { cols: number; rows: number }) => ReadonlyTerminalLike
+}
+
+export interface PreviewClient {
+  render(): Promise<void>
+  dispose(): void
+}
+
+const decoder = new TextDecoder()
+
+async function defaultReadonlyTerminal(dims: {
+  cols: number
+  rows: number
+}): Promise<ReadonlyTerminalLike> {
+  const { Terminal } = await import('@xterm/xterm')
+  // disableStdin: the preview is read-only — it can never become a covert input channel.
+  const term = new Terminal({ cols: dims.cols, rows: dims.rows, disableStdin: true })
+  return {
+    open: (el) => term.open(el),
+    write: (data) => term.write(data),
+    dispose: () => term.dispose(),
+  }
+}
+
+export function mountPreviewClient(
+  card: HTMLElement,
+  replay: ReplaySource,
+  hostContentSecret: Uint8Array,
+  dims: { cols: number; rows: number },
+  deps: PreviewDeps,
+): PreviewClient {
+  let term: ReadonlyTerminalLike | null = null
+  let disposed = false
+
+  function showUnavailable(): void {
+    const msg = document.createElement('p')
+    msg.className = 'preview-unavailable'
+    msg.textContent = 'unavailable'
+    card.replaceChildren(msg)
+  }
+
+  async function render(): Promise<void> {
+    // Derive K_content ONCE, fresh from the host-scoped secret (no in-memory ephemeral key) —
+    // this is why replay survives a reload where the forward-secret live keys cannot.
+    let kContent: AeadKey
+    try {
+      kContent = deps.deriveContentKey({
+        hostContentSecret,
+        sessionId: replay.sessionId,
+        alg: replay.alg,
+      })
+    } catch {
+      showUnavailable()
+      return
+    }
+
+    // Decrypt every stored ciphertext BEFORE mounting a terminal; a wrong/ephemeral key (or a
+    // host-mismatched secret) makes openReplayCiphertext throw → "unavailable", never a torn screen.
+    const chunks: string[] = []
+    for (const frame of replay.frames) {
+      try {
+        chunks.push(decoder.decode(deps.openReplayCiphertext(kContent, frame)))
+      } catch {
+        showUnavailable()
+        return
+      }
+    }
+
+    if (disposed) return
+    const factory =
+      deps.createTerminal ?? ((d) => makeSyncPending(defaultReadonlyTerminal(d)))
+    term = factory(dims)
+    term.open(card)
+    for (const chunk of chunks) term.write(chunk)
+  }
+
+  return {
+    render,
+    dispose(): void {
+      disposed = true
+      if (term) term.dispose()
+    },
+  }
+}
+
+/**
+ * Bridge the async default terminal loader into the synchronous factory shape. The real path
+ * (production) awaits xterm before writing; tests always inject a synchronous mock so this branch
+ * is not exercised there.
+ */
+function makeSyncPending(pending: Promise<ReadonlyTerminalLike>): ReadonlyTerminalLike {
+  let resolved: ReadonlyTerminalLike | null = null
+  const queue: string[] = []
+  void pending.then((t) => {
+    resolved = t
+    for (const c of queue) t.write(c)
+  })
+  return {
+    open: (el) => void pending.then((t) => t.open(el)),
+    write: (data) => (resolved ? resolved.write(data) : void queue.push(data)),
+    dispose: () => void pending.then((t) => t.dispose()),
+  }
+}