feat(web): relay --cert/--key for real TLS on one port by paul-nechifor · Pull Request #3952 · dimensionalOS/dimos

paul-nechifor · 2026-09-05T23:05:17Z

Adds --cert and --key options to run the relay with a supplied TLS certificate. This enables HTTPS access to the cockpit from other machines.
Serves HTTPS and robot data connections on the same port number when a certificate is supplied, simplifying network setup.
Updates browser and robot clients to verify the relay's supplied certificate. Adds --relay-ca so robots can trust certificates issued by a private certificate authority.

greptile-apps · 2026-09-05T23:09:38Z

Greptile Summary

Adds operator-provided TLS certificates to the web relay and updates clients to verify those certificates. The TLS discovery response can advertise a localhost WebTransport address that does not reach the default IPv4-only QUIC listener.

Confidence Score: 4/5

Not safe to merge until TLS relay discovery consistently advertises an address that reaches the configured QUIC listener.

A reproduced relay discovery failure prevents the cockpit from connecting when localhost is selected but resolves to IPv6 before the relay's IPv4-only listener. The earlier listener-cleanup thread was manually resolved by paul-nechifor without explanation.

Files Needing Attention: web/relay/server.ts

T-Rex Logs

What T-Rex did

Produced proofs for two P1 findings and linked them to the relevant review comments.
Executed the contract-validation proof with a localhost run and an IPv4 run; localhost showed HTTP 200 OK with the internal URL redacted, IPv6 direct connection was refused and WebTransport timed out, while the IPv4 run returned HTTP 200 OK and WebTransport ready; no repository files were changed and the only authored file was the reproduced TypeScript script artifact.
Prepared artifacts for the contract-validation proof, including the reproduction script and two log captures.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
web/relay/server.ts	TLS relay discovery returns the request origin, which can advertise an unreachable IPv6 localhost address for the default IPv4-only listener.

Comments Outside Diff (1)

General comment

TLS discovery advertises an IPv6-capable hostname for an IPv4-only default relay
- Bug
  - With startRelay({ port: 0, cert, key }), fetching https://localhost:<port>/api/info returned 200 OK and advertised wtUrl: https://localhost:<port>. This environment resolves localhost to both 127.0.0.1 and ::1, while a direct ::1 connection was refused. A WebTransport connection using the advertised URL failed (timed out); the IPv4 comparison advertised 127.0.0.1 and connected successfully.
- Cause
  - In TLS mode, /api/info returns url.origin, preserving the request hostname (localhost), but the default host remains 127.0.0.1, so neither the TCP nor QUIC listener is bound on ::1.
- Fix
  - Advertise an IPv4-reachable origin for the default IPv4 listener (for example, derive the host from the configured bind host rather than request origin), or bind both TCP and QUIC listeners on IPv6 when advertising localhost.
_{Ran code and verified through T-Rex}

_{Reviews (2): Last reviewed commit: "feat(web): relay --cert/--key for real T..." | Re-trigger Greptile}

codecov · 2026-09-05T23:18:15Z

❌ 8 Tests Failed:

Tests completed	Failed	Passed	Skipped
5640	8	5632	111

View the top 1 failed test(s) by shortest run time

dimos.e2e_tests.test_dimsim_path_replaning::test_path_replanning

Stack Traces | 221s run time

lcm_spy = <dimos.e2e_tests.lcm_spy.LcmSpy object at 0x728c5f572c30>
start_blueprint = <function start_blueprint.<locals>.set_name_and_start at 0x728c5f779da0>
wait_for_system_ready = <function wait_for_system_ready.<locals>.wait at 0x728c5f779d00>
dim_sim = <dimos.e2e_tests.dim_sim_client.DimSimClient object at 0x728c5f6faf30>
direct_cmd_vel_explorer = <dimos.simulation.mujoco.direct_cmd_vel_explorer.DirectCmdVelExplorer object at 0x728c5f6f1a30>
spawn_wall_on_pose = <function spawn_wall_on_pose.<locals>.spawn at 0x728c5f7793a0>

    @pytest.mark.self_hosted_large
    def test_path_replanning(
        lcm_spy,
        start_blueprint,
        wait_for_system_ready,
        dim_sim,
        direct_cmd_vel_explorer,
        spawn_wall_on_pose,
    ) -> None:
        start_blueprint(
            "--dimsim-scene=empty",
            "run",
            "unitree-go2-agentic",
            simulator="dimsim",
        )
        wait_for_system_ready(timeout=1200.0)
    
        # robot spawns at (3, 2)
    
        # side wall
        dim_sim.add_wall(2, -2.5, 12, -2.5)
        # other side wall
        dim_sim.add_wall(2, 3.5, 12, 3.5)
        # back wall (behind robot)
        dim_sim.add_wall(2, -2.5, 2, 3.5)
        # forward wall (far end)
        dim_sim.add_wall(12, -2.5, 12, 3.5)
        # dividing wall at x=7 with doors at y=[-1.5,-0.5] and y=[1.5,2.5]
        dim_sim.add_wall(7, -2.5, 7, -1.5)
        dim_sim.add_wall(7, -0.5, 7, 1.5)
        dim_sim.add_wall(7, 2.5, 7, 3.5)
    
        direct_cmd_vel_explorer.linear_speed = 0.8
        direct_cmd_vel_explorer.follow_points([(10, 2), (2.5, 2), (3, 2)])
    
        # When the robot comes within 1.5 m of the left door's centre, drop a wall
        # in the opening so the planner has to bail out and route through the
        # right door at y=-1 instead.
        spawn_wall_on_pose(
            point=(7, 2),
            threshold=1.5,
            wall=(7, 1.5, 7, 2.5),
        )
    
        dim_sim.publish_goal(10.913, 0.588)
    
>       lcm_spy.wait_until_odom_position(10.913, 0.588, threshold=1, timeout=120)

dim_sim    = <dimos.e2e_tests.dim_sim_client.DimSimClient object at 0x728c5f6faf30>
direct_cmd_vel_explorer = <dimos.simulation.mujoco.direct_cmd_vel_explorer.DirectCmdVelExplorer object at 0x728c5f6f1a30>
lcm_spy    = <dimos.e2e_tests.lcm_spy.LcmSpy object at 0x728c5f572c30>
spawn_wall_on_pose = <function spawn_wall_on_pose.<locals>.spawn at 0x728c5f7793a0>
start_blueprint = <function start_blueprint.<locals>.set_name_and_start at 0x728c5f779da0>
wait_for_system_ready = <function wait_for_system_ready.<locals>.wait at 0x728c5f779d00>

dimos/e2e_tests/test_dimsim_path_replaning.py:64: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
dimos/e2e_tests/lcm_spy.py:190: in wait_until_odom_position
    self.wait_for_message_result(
        predicate  = <function LcmSpy.wait_until_odom_position.<locals>.predicate at 0x728c5f77ae80>
        self       = <dimos.e2e_tests.lcm_spy.LcmSpy object at 0x728c5f572c30>
        threshold  = 1
        timeout    = 120
        x          = 10.913
        y          = 0.588
dimos/e2e_tests/lcm_spy.py:176: in wait_for_message_result
    wait_until(
        event      = <threading.Event at 0x728c64570d70: unset>
        fail_message = 'Failed to get to position x=10.913, y=0.588'
        listener   = <function LcmSpy.wait_for_message_result.<locals>.listener at 0x728c5f77af20>
        predicate  = <function LcmSpy.wait_until_odom_position.<locals>.predicate at 0x728c5f77ae80>
        self       = <dimos.e2e_tests.lcm_spy.LcmSpy object at 0x728c5f572c30>
        timeout    = 120
        topic      = '/odom#geometry_msgs.PoseStamped'
        type       = <class 'dimos.msgs.geometry_msgs.PoseStamped.PoseStamped'>
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

predicate = <bound method Event.is_set of <threading.Event at 0x728c64570d70: unset>>

    def wait_until(
        predicate: Callable[[], bool],
        *,
        timeout: float,
        interval: float = 0.1,
        message: str | None = None,
    ) -> None:
        """Poll ``predicate`` until it returns truthy or ``timeout`` elapses."""
        deadline = time.monotonic() + timeout
        while time.monotonic() < deadline:
            if predicate():
                return
            time.sleep(interval)
>       raise TimeoutError(message or f"Timed out after {timeout}s waiting for condition")
E       TimeoutError: Failed to get to position x=10.913, y=0.588

deadline   = 5573547.834556375
interval   = 0.1
message    = 'Failed to get to position x=10.913, y=0.588'
predicate  = <bound method Event.is_set of <threading.Event at 0x728c64570d70: unset>>
timeout    = 120

.../utils/testing/waiting.py:35: TimeoutError

View the full list of 7 ❄️ flaky test(s)

dimos.experimental.memory.test_rust_recorder_e2e::test_cli_recording_uses_existing_binary_for_both_formats[mcap]