fix(engine): export observerAllowsEvent for out-of-package realtime adapters

[khaliqgant]

Problem

A channel-scoped observer token (filters.channel_names: [...], include_dms: false) receives every workspace event on hosted Relaycast: DMs and other channels included. Reproduced against production with a probe that mints such a token, subscribes, then sends a DM between two unrelated agents:

== production
events seen by channel-scoped token: ["dm.received","message.created"]

The same probe against a self-hosted engine built from this repo:

== local node engine
events seen by channel-scoped token: ["message.created"]

The Node adapter applies observerAllowsEvent per socket (adapters/node/realtime.ts). The Cloudflare workspace stream lives in relaycast-cloud, outside this package. The filter is not exported, so that stream applies none.

Change

Export observerAllowsEvent and the ObserverToken type from the package entry, so both adapters use the one implementation. No behaviour change in this repo.

The consumer is AgentWorkforce/relaycast-cloud fix/observer-dm-leak, which needs a release of this.

Evidence

packages/engine:

• npx vitest run src/__tests__/observerEventExport.test.ts → Tests 2 passed (2). The test imports the filter from ../index.js and pins channel-scoped behaviour: own channel in; other channel, dm.received and group_dm.received out.
• npx tsc --noEmit -p . clean.

🤖 Generated with Claude Code

---

Note

Low Risk
Additive public API export and tests only; existing engine and Node adapter paths are unchanged until an external adapter wires in the filter.

Overview
Exports observerAllowsEvent and the ObserverToken type from @relaycast/engine's public entry so hosted realtime adapters (e.g. the Cloudflare workspace stream in relaycast-cloud) can apply the same per-socket observer filter the Node adapter already uses internally.

Adds a changelog note under Unreleased - Patch and a small Vitest suite that imports the filter from the package entry and pins channel-scoped behaviour (allowed channel in, other channels and DMs out; unscoped principals pass everything). No runtime behaviour change inside this repo — it unblocks consumers to fix channel-scoped tokens seeing workspace-wide events.

^{Reviewed by Cursor Bugbot for commit 617c89e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Warning

Review limit reached

Next included review available in 34 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: c8d26055-e157-4002-a859-e83e7c3a1fea

📥 Commits

Reviewing files that changed from the base of the PR and between 6d6204a and 617c89e.

📒 Files selected for processing (3)

• packages/engine/CHANGELOG.md
• packages/engine/src/__tests__/observerEventExport.test.ts
• packages/engine/src/index.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-24T14:23:15.004903Z	f82ac22	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[cubic-dev-ai]

No issues found across 3 files

_{You’re at about 99% of the monthly reviewed-line limit. You may want to disable incremental reviews to conserve quota. Reviews will continue until that limit is exceeded. If you need help avoiding interruptions, please contact contact@cubic.dev.}

_{Re-trigger cubic}