@agent-relay/cloud 0.1.0

package/dist/api/cli-pty-runner.js

@@ -0,0 +1,193 @@
+/**
+ * CLI PTY Runner
+ *
+ * Shared module for running CLI auth flows via PTY.
+ * Used by both production (onboarding.ts) and tests (ci-test-real-clis.ts).
+ *
+ * Uses the relay-pty Rust binary for PTY emulation.
+ */
+import { spawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { randomUUID } from 'node:crypto';
+// Get the directory where this module is located
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+// Import shared config and utilities
+import { CLI_AUTH_CONFIG, stripAnsiCodes, matchesSuccessPattern, findMatchingPrompt, validateProviderConfig, validateAllProviderConfigs as validateAllConfigs, getSupportedProviders, } from '@agent-relay/config/cli-auth-config';
+// Re-export everything from shared config for backward compatibility
+export { CLI_AUTH_CONFIG, stripAnsiCodes, matchesSuccessPattern, findMatchingPrompt, validateProviderConfig, getSupportedProviders, };
+// Wrapper that throws instead of returning array (backward compatible)
+export function validateAllProviderConfigs() {
+    const errors = validateAllConfigs();
+    if (errors.length > 0) {
+        throw new Error(`Invalid provider configurations:\n${errors.join('\n')}`);
+    }
+}
+/**
+ * Find the relay-pty binary path.
+ * Returns null if not found.
+ */
+function findRelayPtyBinary() {
+    // Get the project root (five levels up from packages/cloud/dist/api/)
+    // packages/cloud/dist/api/ -> packages/cloud/dist -> packages/cloud -> packages -> project root
+    const projectRoot = join(__dirname, '..', '..', '..', '..', '..');
+    const candidates = [
+        // Primary: installed by postinstall from platform-specific binary
+        join(projectRoot, 'bin', 'relay-pty'),
+        // Development: local Rust build
+        join(projectRoot, 'relay-pty', 'target', 'release', 'relay-pty'),
+        join(projectRoot, 'relay-pty', 'target', 'debug', 'relay-pty'),
+        // Local build in cwd (for development)
+        join(process.cwd(), 'relay-pty', 'target', 'release', 'relay-pty'),
+        // Installed globally
+        '/usr/local/bin/relay-pty',
+        // In node_modules (when installed as dependency)
+        join(process.cwd(), 'node_modules', 'agent-relay', 'bin', 'relay-pty'),
+    ];
+    for (const candidate of candidates) {
+        if (existsSync(candidate)) {
+            return candidate;
+        }
+    }
+    return null;
+}
+/**
+ * Run CLI auth flow via PTY using relay-pty binary
+ *
+ * This is the core PTY runner used by both production and tests.
+ * It handles:
+ * - Spawning the CLI with proper TTY emulation via relay-pty
+ * - Auto-responding to interactive prompts
+ * - Extracting auth URLs from output
+ * - Detecting success patterns
+ *
+ * @param config - CLI auth configuration for the provider
+ * @param options - Optional callbacks and overrides
+ * @returns Promise resolving to auth result
+ */
+export async function runCLIAuthViaPTY(config, options = {}) {
+    const result = {
+        authUrl: null,
+        success: false,
+        promptsHandled: [],
+        output: '',
+        exitCode: null,
+    };
+    const respondedPrompts = new Set();
+    // Find relay-pty binary
+    const relayPtyPath = findRelayPtyBinary();
+    if (!relayPtyPath) {
+        result.error = 'relay-pty binary not found. Build with: cd relay-pty && cargo build --release';
+        return result;
+    }
+    return new Promise((resolve) => {
+        try {
+            // Generate unique name for this auth session
+            const sessionName = `auth-${randomUUID().substring(0, 8)}`;
+            // Build relay-pty arguments
+            const relayArgs = [
+                '--name', sessionName,
+                '--rows', '30',
+                '--cols', '120',
+                '--log-level', 'error', // Suppress relay-pty logs
+                '--', config.command,
+                ...config.args,
+            ];
+            const proc = spawn(relayPtyPath, relayArgs, {
+                cwd: options.cwd || process.cwd(),
+                env: {
+                    ...process.env,
+                    NO_COLOR: '1',
+                    TERM: 'xterm-256color',
+                    // Prevent CLIs from trying to open browsers
+                    BROWSER: 'echo',
+                    DISPLAY: '',
+                    ...options.env,
+                },
+                stdio: ['pipe', 'pipe', 'pipe'],
+            });
+            // Timeout handler
+            const timeout = setTimeout(() => {
+                proc.kill();
+                result.error = 'Timeout waiting for auth URL';
+                resolve(result);
+            }, config.waitTimeout + 5000);
+            // Handle stdout (main PTY output)
+            proc.stdout?.on('data', (data) => {
+                const text = data.toString();
+                result.output += text;
+                options.onOutput?.(text);
+                // Check for matching prompts and auto-respond
+                const matchingPrompt = findMatchingPrompt(text, config.prompts, respondedPrompts);
+                if (matchingPrompt) {
+                    respondedPrompts.add(matchingPrompt.description);
+                    result.promptsHandled.push(matchingPrompt.description);
+                    options.onPromptHandled?.(matchingPrompt.description);
+                    const delay = matchingPrompt.delay ?? 100;
+                    setTimeout(() => {
+                        try {
+                            proc.stdin?.write(matchingPrompt.response);
+                        }
+                        catch {
+                            // Process may have exited
+                        }
+                    }, delay);
+                }
+                // Look for auth URL
+                const cleanText = stripAnsiCodes(text);
+                const match = cleanText.match(config.urlPattern);
+                if (match && match[1] && !result.authUrl) {
+                    result.authUrl = match[1];
+                    if (result.authUrl) {
+                        options.onAuthUrl?.(result.authUrl);
+                    }
+                }
+                // Check for success indicators
+                if (matchesSuccessPattern(text, config.successPatterns)) {
+                    result.success = true;
+                }
+            });
+            // Handle stderr (relay-pty logs, usually minimal)
+            proc.stderr?.on('data', (data) => {
+                const text = data.toString();
+                // Also check stderr for output (some CLIs write to stderr)
+                result.output += text;
+                options.onOutput?.(text);
+                // Check stderr for auth URLs too
+                const cleanText = stripAnsiCodes(text);
+                const match = cleanText.match(config.urlPattern);
+                if (match && match[1] && !result.authUrl) {
+                    result.authUrl = match[1];
+                    if (result.authUrl) {
+                        options.onAuthUrl?.(result.authUrl);
+                    }
+                }
+            });
+            proc.on('exit', (code) => {
+                clearTimeout(timeout);
+                result.exitCode = code;
+                // Consider it a success if we got a URL (main goal)
+                // or if exit code was 0 with success pattern
+                if (result.authUrl || (code === 0 && result.success)) {
+                    result.success = true;
+                }
+                if (!result.authUrl && !result.success && !result.error) {
+                    result.error = 'Failed to extract auth URL from CLI output';
+                }
+                resolve(result);
+            });
+            proc.on('error', (err) => {
+                clearTimeout(timeout);
+                result.error = err.message;
+                resolve(result);
+            });
+        }
+        catch (err) {
+            result.error = err instanceof Error ? err.message : 'Unknown error';
+            resolve(result);
+        }
+    });
+}
+//# sourceMappingURL=cli-pty-runner.js.map

package/dist/api/cli-pty-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-pty-runner.js","sourceRoot":"","sources":["../../src/api/cli-pty-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,iDAAiD;AACjD,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAEtC,qCAAqC;AACrC,OAAO,EACL,eAAe,EACf,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,EACtB,0BAA0B,IAAI,kBAAkB,EAChD,qBAAqB,GAGtB,MAAM,qCAAqC,CAAC;AAE7C,qEAAqE;AACrE,OAAO,EACL,eAAe,EACf,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,GAGtB,CAAC;AAEF,uEAAuE;AACvE,MAAM,UAAU,0BAA0B;IACxC,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IACpC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AA8BD;;;GAGG;AACH,SAAS,kBAAkB;IACzB,sEAAsE;IACtE,gGAAgG;IAChG,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAElE,MAAM,UAAU,GAAG;QACjB,kEAAkE;QAClE,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,CAAC;QACrC,gCAAgC;QAChC,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC;QAChE,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAC;QAC9D,uCAAuC;QACvC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC;QAClE,qBAAqB;QACrB,0BAA0B;QAC1B,iDAAiD;QACjD,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,CAAC;KACvE,CAAC;IAEF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAqB,EACrB,UAA0B,EAAE;IAE5B,MAAM,MAAM,GAAkB;QAC5B,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,KAAK;QACd,cAAc,EAAE,EAAE;QAClB,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE,IAAI;KACf,CAAC;IAEF,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE3C,wBAAwB;IACxB,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;IAC1C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,CAAC,KAAK,GAAG,+EAA+E,CAAC;QAC/F,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,CAAC;YACH,6CAA6C;YAC7C,MAAM,WAAW,GAAG,QAAQ,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAE3D,4BAA4B;YAC5B,MAAM,SAAS,GAAG;gBAChB,QAAQ,EAAE,WAAW;gBACrB,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,KAAK;gBACf,aAAa,EAAE,OAAO,EAAE,0BAA0B;gBAClD,IAAI,EAAE,MAAM,CAAC,OAAO;gBACpB,GAAG,MAAM,CAAC,IAAI;aACf,CAAC;YAEF,MAAM,IAAI,GAAiB,KAAK,CAAC,YAAY,EAAE,SAAS,EAAE;gBACxD,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;gBACjC,GAAG,EAAE;oBACH,GAAG,OAAO,CAAC,GAAG;oBACd,QAAQ,EAAE,GAAG;oBACb,IAAI,EAAE,gBAAgB;oBACtB,4CAA4C;oBAC5C,OAAO,EAAE,MAAM;oBACf,OAAO,EAAE,EAAE;oBACX,GAAG,OAAO,CAAC,GAAG;iBACf;gBACD,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;aAChC,CAAC,CAAC;YAEH,kBAAkB;YAClB,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC9B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACZ,MAAM,CAAC,KAAK,GAAG,8BAA8B,CAAC;gBAC9C,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,EAAE,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;YAE9B,kCAAkC;YAClC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACvC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC7B,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC;gBACtB,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC;gBAEzB,8CAA8C;gBAC9C,MAAM,cAAc,GAAG,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;gBAClF,IAAI,cAAc,EAAE,CAAC;oBACnB,gBAAgB,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;oBACjD,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;oBACvD,OAAO,CAAC,eAAe,EAAE,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;oBAEtD,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,IAAI,GAAG,CAAC;oBAC1C,UAAU,CAAC,GAAG,EAAE;wBACd,IAAI,CAAC;4BACH,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;wBAC7C,CAAC;wBAAC,MAAM,CAAC;4BACP,0BAA0B;wBAC5B,CAAC;oBACH,CAAC,EAAE,KAAK,CAAC,CAAC;gBACZ,CAAC;gBAED,oBAAoB;gBACpB,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;gBACvC,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBACjD,IAAI,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACzC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;oBAC1B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;wBACnB,OAAO,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;oBACtC,CAAC;gBACH,CAAC;gBAED,+BAA+B;gBAC/B,IAAI,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;oBACxD,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;gBACxB,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,kDAAkD;YAClD,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACvC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC7B,2DAA2D;gBAC3D,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC;gBACtB,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC;gBAEzB,iCAAiC;gBACjC,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;gBACvC,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBACjD,IAAI,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBACzC,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;oBAC1B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;wBACnB,OAAO,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;oBACtC,CAAC;gBACH,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBACvB,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;gBAEvB,oDAAoD;gBACpD,6CAA6C;gBAC7C,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;oBACrD,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;gBACxB,CAAC;gBAED,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBACxD,MAAM,CAAC,KAAK,GAAG,4CAA4C,CAAC;gBAC9D,CAAC;gBAED,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACvB,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,MAAM,CAAC,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC;gBAC3B,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACpE,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/api/codex-auth-helper.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Codex Auth Helper API
+ *
+ * Provides endpoints for the `npx agent-relay codex-auth` CLI command.
+ * Uses SSH tunneling to forward localhost:1455 to the workspace container,
+ * allowing the Codex CLI's OAuth callback to work in remote/container environments.
+ *
+ * Flow:
+ * 1. CLI gets workspace SSH info via /tunnel-info
+ * 2. CLI establishes SSH tunnel: local:1455 -> container:1455
+ * 3. User completes OAuth, browser redirects to localhost:1455
+ * 4. Tunnel forwards to container's Codex CLI server
+ * 5. Codex CLI exchanges code for tokens internally
+ * 6. CLI polls for auth completion
+ */
+export declare const codexAuthHelperRouter: import("express-serve-static-core").Router;
+/**
+ * Stop the cleanup interval. Call this on server shutdown.
+ */
+export declare function stopCodexAuthCleanup(): void;
+//# sourceMappingURL=codex-auth-helper.d.ts.map

package/dist/api/codex-auth-helper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-auth-helper.d.ts","sourceRoot":"","sources":["../../src/api/codex-auth-helper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAQH,eAAO,MAAM,qBAAqB,4CAAW,CAAC;AA2C9C;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C"}

package/dist/api/codex-auth-helper.js

@@ -0,0 +1,327 @@
+/**
+ * Codex Auth Helper API
+ *
+ * Provides endpoints for the `npx agent-relay codex-auth` CLI command.
+ * Uses SSH tunneling to forward localhost:1455 to the workspace container,
+ * allowing the Codex CLI's OAuth callback to work in remote/container environments.
+ *
+ * Flow:
+ * 1. CLI gets workspace SSH info via /tunnel-info
+ * 2. CLI establishes SSH tunnel: local:1455 -> container:1455
+ * 3. User completes OAuth, browser redirects to localhost:1455
+ * 4. Tunnel forwards to container's Codex CLI server
+ * 5. Codex CLI exchanges code for tokens internally
+ * 6. CLI polls for auth completion
+ */
+import { Router } from 'express';
+import crypto from 'crypto';
+import { requireAuth } from './auth.js';
+import { db } from '../db/index.js';
+import { deriveSshPassword } from '../services/ssh-security.js';
+export const codexAuthHelperRouter = Router();
+const WORKSPACE_SSH_PORT = 3022;
+const pendingAuthSessions = new Map();
+const pendingCliTokens = new Map();
+// Clean up old sessions every minute
+const cleanupInterval = setInterval(() => {
+    const now = Date.now();
+    for (const [id, session] of pendingAuthSessions) {
+        // Remove sessions older than 10 minutes
+        if (now - session.createdAt.getTime() > 10 * 60 * 1000) {
+            pendingAuthSessions.delete(id);
+        }
+    }
+    // Also clean up CLI tokens
+    for (const [id, token] of pendingCliTokens) {
+        // Remove tokens older than 10 minutes
+        if (now - token.createdAt.getTime() > 10 * 60 * 1000) {
+            pendingCliTokens.delete(id);
+        }
+    }
+}, 60000);
+/**
+ * Stop the cleanup interval. Call this on server shutdown.
+ */
+export function stopCodexAuthCleanup() {
+    clearInterval(cleanupInterval);
+}
+/**
+ * POST /api/auth/codex-helper/cli-session
+ * Create a new auth session for the CLI command.
+ * Returns workspace info and CLI command for SSH tunnel approach.
+ */
+codexAuthHelperRouter.post('/cli-session', requireAuth, async (req, res) => {
+    const userId = req.session.userId;
+    const { workspaceId, authUrl, sessionId: onboardingSessionId } = req.body;
+    // If workspace ID provided, return SSH tunnel command
+    if (workspaceId) {
+        try {
+            const workspace = await db.workspaces.findById(workspaceId);
+            if (!workspace || workspace.userId !== userId) {
+                return res.status(404).json({ error: 'Workspace not found' });
+            }
+            // Generate a one-time CLI token for authentication
+            const cliToken = crypto.randomUUID();
+            pendingCliTokens.set(cliToken, {
+                userId,
+                workspaceId,
+                createdAt: new Date(),
+                authUrl, // Store authUrl so CLI can retrieve it
+                sessionId: onboardingSessionId, // Store sessionId for credential storage
+            });
+            console.log(`[codex-helper] Created CLI session for workspace ${workspaceId} with token ${cliToken.slice(0, 8)}...`);
+            const cloudUrl = process.env.PUBLIC_URL || 'https://agent-relay.com';
+            // Generate the CLI command with workspace ID and token
+            res.json({
+                workspaceId: workspace.id,
+                workspaceName: workspace.name,
+                expiresIn: 600, // 10 minutes
+                command: `npx agent-relay codex-auth --workspace=${workspaceId} --token=${cliToken}`,
+                commandWithUrl: `npx agent-relay codex-auth --workspace=${workspaceId} --token=${cliToken} --cloud-url=${cloudUrl}`,
+            });
+            return;
+        }
+        catch (error) {
+            console.error('[codex-helper] Error creating CLI session:', error);
+            return res.status(500).json({ error: 'Failed to create CLI session' });
+        }
+    }
+    // Legacy: token-based session (for backwards compatibility)
+    const authSessionId = crypto.randomUUID();
+    pendingAuthSessions.set(authSessionId, {
+        userId,
+        createdAt: new Date(),
+    });
+    console.log(`[codex-helper] Created legacy CLI session ${authSessionId} for user ${userId}`);
+    res.json({
+        authSessionId,
+        expiresIn: 600, // 10 minutes
+        command: `npx agent-relay codex-auth --token=${authSessionId}`,
+    });
+});
+/**
+ * POST /api/auth/codex-helper/callback
+ * Receives the auth code from the CLI.
+ * No auth required - validated by authSessionId.
+ */
+codexAuthHelperRouter.post('/callback', async (req, res) => {
+    const { authSessionId, code, state, error } = req.body;
+    if (!authSessionId) {
+        return res.status(400).json({ error: 'Missing authSessionId' });
+    }
+    const session = pendingAuthSessions.get(authSessionId);
+    if (!session) {
+        return res.status(404).json({ error: 'Session not found or expired' });
+    }
+    if (error) {
+        console.log(`[codex-helper] Auth error for session ${authSessionId}:`, error);
+        pendingAuthSessions.delete(authSessionId);
+        return res.json({ success: false, error });
+    }
+    if (!code) {
+        return res.status(400).json({ error: 'Missing auth code' });
+    }
+    // Store the code and state so the polling endpoint can retrieve them
+    session.code = code;
+    session.state = state; // Store state for CSRF validation
+    pendingAuthSessions.set(authSessionId, session);
+    console.log(`[codex-helper] Auth code received for session ${authSessionId}`);
+    res.json({ success: true, message: 'Auth code received. You can close this terminal.' });
+});
+/**
+ * GET /api/auth/codex-helper/status/:authSessionId
+ * Check if auth code has been received.
+ * The dashboard polls this to know when the CLI has captured the callback.
+ */
+codexAuthHelperRouter.get('/status/:authSessionId', requireAuth, async (req, res) => {
+    const authSessionId = req.params.authSessionId;
+    const session = pendingAuthSessions.get(authSessionId);
+    if (!session || session.userId !== req.session.userId) {
+        return res.status(404).json({ error: 'Session not found or expired' });
+    }
+    if (session.code) {
+        // Clean up session after successful retrieval (code is single-use)
+        const code = session.code;
+        const state = session.state;
+        pendingAuthSessions.delete(authSessionId);
+        return res.json({
+            ready: true,
+            code,
+            state, // Return state for CSRF validation
+        });
+    }
+    res.json({ ready: false });
+});
+/**
+ * GET /api/auth/codex-helper/tunnel-info/:workspaceId
+ * Get SSH tunnel info for establishing port forwarding to a workspace.
+ * Returns host, port, user, and password for SSH connection.
+ *
+ * Authentication: Requires either session auth OR a valid CLI token.
+ */
+codexAuthHelperRouter.get('/tunnel-info/:workspaceId', async (req, res) => {
+    const workspaceId = req.params.workspaceId;
+    const { token } = req.query;
+    // Authenticate via CLI token or session
+    let userId;
+    if (token && typeof token === 'string') {
+        // CLI token authentication
+        const cliToken = pendingCliTokens.get(token);
+        if (!cliToken) {
+            return res.status(401).json({ error: 'Invalid or expired token' });
+        }
+        if (cliToken.workspaceId !== workspaceId) {
+            return res.status(403).json({ error: 'Token does not match workspace' });
+        }
+        userId = cliToken.userId;
+        // Don't delete token - it's also used for auth-status polling
+        // Cleanup interval will remove it after 10 minutes
+        console.log(`[codex-helper] CLI token used for workspace ${workspaceId}`);
+    }
+    else if (req.session?.userId) {
+        // Session authentication
+        userId = req.session.userId;
+    }
+    else {
+        return res.status(401).json({ error: 'Authentication required. Provide token query parameter or valid session.' });
+    }
+    try {
+        const workspace = await db.workspaces.findById(workspaceId);
+        if (!workspace || workspace.userId !== userId) {
+            return res.status(404).json({ error: 'Workspace not found' });
+        }
+        if (workspace.status !== 'running') {
+            return res.status(400).json({ error: 'Workspace is not running' });
+        }
+        // Parse workspace URL to get host
+        const publicUrl = workspace.publicUrl;
+        if (!publicUrl) {
+            return res.status(400).json({ error: 'Workspace URL not available' });
+        }
+        const url = new URL(publicUrl);
+        const host = url.hostname;
+        const apiPort = parseInt(url.port, 10) || 80;
+        // SSH connection info varies by environment:
+        // - Fly.io: Use public fly.dev hostname with port 3022 (exposed via TCP service)
+        // - Local Docker: Use localhost with derived SSH port (22000 + apiPort - 3000)
+        const isOnFly = !!process.env.FLY_APP_NAME;
+        const isLocalDocker = (host === 'localhost' || host === '127.0.0.1') && apiPort >= 3000;
+        let sshHost;
+        let sshPort;
+        if (isOnFly) {
+            // Fly.io public hostname - SSH is exposed as a public TCP service on port 3022
+            // Users can SSH directly from their machine to {app}.fly.dev:3022
+            const appName = `ar-${workspace.id.substring(0, 8)}`;
+            sshHost = `${appName}.fly.dev`;
+            sshPort = WORKSPACE_SSH_PORT;
+        }
+        else if (isLocalDocker) {
+            // Local Docker: SSH port is derived from API port
+            // API port 3500 -> SSH port 22500 (formula: 22000 + apiPort - 3000)
+            sshHost = 'localhost';
+            sshPort = 22000 + (apiPort - 3000);
+        }
+        else {
+            // Default fallback
+            sshHost = host;
+            sshPort = WORKSPACE_SSH_PORT;
+        }
+        // SSH password is derived per-workspace for security
+        // Each workspace gets a unique password based on its ID + secret salt
+        const sshPassword = deriveSshPassword(workspace.id);
+        // Get authUrl from CLI token if available
+        let authUrl;
+        if (token && typeof token === 'string') {
+            const cliToken = pendingCliTokens.get(token);
+            authUrl = cliToken?.authUrl;
+        }
+        res.json({
+            host: sshHost,
+            port: sshPort,
+            user: 'workspace',
+            password: sshPassword,
+            tunnelPort: 1455, // Codex OAuth callback port
+            workspaceId: workspace.id,
+            workspaceName: workspace.name,
+            authUrl, // OAuth URL if available (set by dashboard)
+        });
+    }
+    catch (error) {
+        console.error('[codex-helper] Error getting tunnel info:', error);
+        res.status(500).json({ error: 'Failed to get tunnel info' });
+    }
+});
+/**
+ * GET /api/auth/codex-helper/auth-status/:workspaceId
+ * Poll for Codex authentication completion in a workspace.
+ * The CLI uses this after establishing the tunnel to know when auth is done.
+ *
+ * Authentication: Requires either session auth OR a valid CLI token.
+ */
+codexAuthHelperRouter.get('/auth-status/:workspaceId', async (req, res) => {
+    const workspaceId = req.params.workspaceId;
+    const { token } = req.query;
+    // Authenticate via CLI token or session
+    let userId;
+    if (token && typeof token === 'string') {
+        // CLI token authentication
+        const cliToken = pendingCliTokens.get(token);
+        if (!cliToken) {
+            return res.status(401).json({ error: 'Invalid or expired token' });
+        }
+        if (cliToken.workspaceId !== workspaceId) {
+            return res.status(403).json({ error: 'Token does not match workspace' });
+        }
+        userId = cliToken.userId;
+    }
+    else if (req.session?.userId) {
+        // Session authentication
+        userId = req.session.userId;
+    }
+    else {
+        return res.status(401).json({ error: 'Authentication required. Provide token query parameter or valid session.' });
+    }
+    try {
+        const workspace = await db.workspaces.findById(workspaceId);
+        if (!workspace || workspace.userId !== userId) {
+            return res.status(404).json({ error: 'Workspace not found' });
+        }
+        if (!workspace.publicUrl) {
+            return res.status(400).json({ error: 'Workspace URL not available' });
+        }
+        // Check with workspace daemon if Codex is authenticated for this specific user
+        // Pass userId to enable per-user credential checking (multiple users can share a workspace)
+        const checkUrl = new URL(`${workspace.publicUrl}/auth/cli/openai/check`);
+        checkUrl.searchParams.set('userId', userId);
+        const response = await fetch(checkUrl.toString(), {
+            method: 'GET',
+            signal: AbortSignal.timeout(5000),
+        });
+        if (response.ok) {
+            const data = await response.json();
+            // When authentication is detected, mark the provider as connected in the database
+            // This ensures the dashboard shows correct per-user connection status
+            if (data.authenticated && userId) {
+                try {
+                    await db.credentials.upsert({
+                        userId,
+                        provider: 'codex', // Codex provider for OpenAI
+                        scopes: [],
+                    });
+                    console.log(`[codex-helper] Marked codex as connected for user ${userId}`);
+                }
+                catch (dbError) {
+                    console.error('[codex-helper] Failed to mark provider as connected:', dbError);
+                    // Don't fail the request if DB update fails
+                }
+            }
+            return res.json({ authenticated: data.authenticated });
+        }
+        res.json({ authenticated: false });
+    }
+    catch (_error) {
+        // Workspace might not be reachable, return false
+        res.json({ authenticated: false });
+    }
+});
+//# sourceMappingURL=codex-auth-helper.js.map

package/dist/api/codex-auth-helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-auth-helper.js","sourceRoot":"","sources":["../../src/api/codex-auth-helper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,MAAM,EAAqB,MAAM,SAAS,CAAC;AACpD,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAEhE,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,EAAE,CAAC;AAE9C,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAUhC,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAA8B,CAAC;AAWlE,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA2B,CAAC;AAE5D,qCAAqC;AACrC,MAAM,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,mBAAmB,EAAE,CAAC;QAChD,wCAAwC;QACxC,IAAI,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YACvD,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IACD,2BAA2B;IAC3B,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,gBAAgB,EAAE,CAAC;QAC3C,sCAAsC;QACtC,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YACrD,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;AACH,CAAC,EAAE,KAAK,CAAC,CAAC;AAEV;;GAEG;AACH,MAAM,UAAU,oBAAoB;IAClC,aAAa,CAAC,eAAe,CAAC,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,qBAAqB,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IAC5F,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAO,CAAC;IACnC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;IAE1E,sDAAsD;IACtD,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAE5D,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9C,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAChE,CAAC;YAED,mDAAmD;YACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YACrC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE;gBAC7B,MAAM;gBACN,WAAW;gBACX,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,OAAO,EAAE,uCAAuC;gBAChD,SAAS,EAAE,mBAAmB,EAAE,yCAAyC;aAC1E,CAAC,CAAC;YAEH,OAAO,CAAC,GAAG,CAAC,oDAAoD,WAAW,eAAe,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAErH,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,yBAAyB,CAAC;YAErE,uDAAuD;YACvD,GAAG,CAAC,IAAI,CAAC;gBACP,WAAW,EAAE,SAAS,CAAC,EAAE;gBACzB,aAAa,EAAE,SAAS,CAAC,IAAI;gBAC7B,SAAS,EAAE,GAAG,EAAE,aAAa;gBAC7B,OAAO,EAAE,0CAA0C,WAAW,YAAY,QAAQ,EAAE;gBACpF,cAAc,EAAE,0CAA0C,WAAW,YAAY,QAAQ,gBAAgB,QAAQ,EAAE;aACpH,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE,KAAK,CAAC,CAAC;YACnE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC1C,mBAAmB,CAAC,GAAG,CAAC,aAAa,EAAE;QACrC,MAAM;QACN,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CAAC,6CAA6C,aAAa,aAAa,MAAM,EAAE,CAAC,CAAC;IAE7F,GAAG,CAAC,IAAI,CAAC;QACP,aAAa;QACb,SAAS,EAAE,GAAG,EAAE,aAAa;QAC7B,OAAO,EAAE,sCAAsC,aAAa,EAAE;KAC/D,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH;;;;GAIG;AACH,qBAAqB,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IAC5E,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;IAEvD,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACvD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,yCAAyC,aAAa,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9E,mBAAmB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAC1C,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,qEAAqE;IACrE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IACpB,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,kCAAkC;IACzD,mBAAmB,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAEhD,OAAO,CAAC,GAAG,CAAC,iDAAiD,aAAa,EAAE,CAAC,CAAC;IAC9E,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC,CAAC;AAC3F,CAAC,CAAC,CAAC;AAEH;;;;GAIG;AACH,qBAAqB,CAAC,GAAG,CAAC,wBAAwB,EAAE,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IACrG,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,aAAuB,CAAC;IACzD,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAEvD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACtD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,mEAAmE;QACnE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,mBAAmB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAE1C,OAAO,GAAG,CAAC,IAAI,CAAC;YACd,KAAK,EAAE,IAAI;YACX,IAAI;YACJ,KAAK,EAAE,mCAAmC;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AAC7B,CAAC,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,qBAAqB,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IAC3F,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,WAAqB,CAAC;IACrD,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;IAE5B,wCAAwC;IACxC,IAAI,MAA0B,CAAC;IAE/B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,2BAA2B;QAC3B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YACzC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QACzB,8DAA8D;QAC9D,mDAAmD;QACnD,OAAO,CAAC,GAAG,CAAC,+CAA+C,WAAW,EAAE,CAAC,CAAC;IAC5E,CAAC;SAAM,IAAI,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAC/B,yBAAyB;QACzB,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAC9B,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0EAA0E,EAAE,CAAC,CAAC;IACrH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE5D,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9C,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,kCAAkC;QAClC,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;QAE7C,6CAA6C;QAC7C,iFAAiF;QACjF,+EAA+E;QAC/E,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAC3C,MAAM,aAAa,GAAG,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,CAAC,IAAI,OAAO,IAAI,IAAI,CAAC;QAExF,IAAI,OAAe,CAAC;QACpB,IAAI,OAAe,CAAC;QAEpB,IAAI,OAAO,EAAE,CAAC;YACZ,+EAA+E;YAC/E,kEAAkE;YAClE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO,GAAG,GAAG,OAAO,UAAU,CAAC;YAC/B,OAAO,GAAG,kBAAkB,CAAC;QAC/B,CAAC;aAAM,IAAI,aAAa,EAAE,CAAC;YACzB,kDAAkD;YAClD,oEAAoE;YACpE,OAAO,GAAG,WAAW,CAAC;YACtB,OAAO,GAAG,KAAK,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,mBAAmB;YACnB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,GAAG,kBAAkB,CAAC;QAC/B,CAAC;QAED,qDAAqD;QACrD,sEAAsE;QACtE,MAAM,WAAW,GAAG,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAEpD,0CAA0C;QAC1C,IAAI,OAA2B,CAAC;QAChC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC7C,OAAO,GAAG,QAAQ,EAAE,OAAO,CAAC;QAC9B,CAAC;QAED,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,WAAW;YACrB,UAAU,EAAE,IAAI,EAAE,4BAA4B;YAC9C,WAAW,EAAE,SAAS,CAAC,EAAE;YACzB,aAAa,EAAE,SAAS,CAAC,IAAI;YAC7B,OAAO,EAAE,4CAA4C;SACtD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAC;QAClE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,qBAAqB,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IAC3F,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,WAAqB,CAAC;IACrD,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;IAE5B,wCAAwC;IACxC,IAAI,MAA0B,CAAC;IAE/B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,2BAA2B;QAC3B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,QAAQ,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;YACzC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC3B,CAAC;SAAM,IAAI,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAC/B,yBAAyB;QACzB,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAC9B,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0EAA0E,EAAE,CAAC,CAAC;IACrH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAE5D,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9C,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;YACzB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,+EAA+E;QAC/E,4FAA4F;QAC5F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,SAAS,CAAC,SAAS,wBAAwB,CAAC,CAAC;QACzE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAE5C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE;YAChD,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAgC,CAAC;YAEjE,kFAAkF;YAClF,sEAAsE;YACtE,IAAI,IAAI,CAAC,aAAa,IAAI,MAAM,EAAE,CAAC;gBACjC,IAAI,CAAC;oBACH,MAAM,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC;wBAC1B,MAAM;wBACN,QAAQ,EAAE,OAAO,EAAE,4BAA4B;wBAC/C,MAAM,EAAE,EAAE;qBACX,CAAC,CAAC;oBACH,OAAO,CAAC,GAAG,CAAC,qDAAqD,MAAM,EAAE,CAAC,CAAC;gBAC7E,CAAC;gBAAC,OAAO,OAAO,EAAE,CAAC;oBACjB,OAAO,CAAC,KAAK,CAAC,sDAAsD,EAAE,OAAO,CAAC,CAAC;oBAC/E,4CAA4C;gBAC9C,CAAC;YACH,CAAC;YAED,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,iDAAiD;QACjD,GAAG,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IACrC,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/api/consensus.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Consensus API Routes (Read-Only)
+ *
+ * Provides API endpoints for observing multi-agent consensus decisions.
+ * The dashboard is read-only - agents handle all consensus activity via relay messages.
+ *
+ * Architecture:
+ * - Agents create proposals and vote via ->relay:_consensus messages
+ * - The daemon processes these and syncs state to cloud via /sync endpoint
+ * - Dashboard reads consensus state for display only
+ */
+export declare const consensusRouter: import("express-serve-static-core").Router;
+//# sourceMappingURL=consensus.d.ts.map

package/dist/api/consensus.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consensus.d.ts","sourceRoot":"","sources":["../../src/api/consensus.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAeH,eAAO,MAAM,eAAe,4CAAW,CAAC"}