@agent-relay/cloud 0.1.0

package/dist/api/generic-webhooks.js

@@ -0,0 +1,129 @@
+/**
+ * Generic Webhooks API Routes
+ *
+ * Provides endpoints for receiving webhooks from any configured source.
+ * Routes: POST /api/webhooks/:source
+ */
+import { Router } from 'express';
+import { processWebhook, getWebhookConfig } from '../webhooks/index.js';
+export const genericWebhooksRouter = Router();
+/**
+ * POST /api/webhooks/:source
+ * Receive a webhook from any configured source
+ */
+genericWebhooksRouter.post('/:source', async (req, res) => {
+    const source = req.params.source;
+    // For Slack URL verification challenge
+    if (source === 'slack' && req.body?.type === 'url_verification') {
+        return res.json({ challenge: req.body.challenge });
+    }
+    try {
+        // Get raw body for signature verification
+        // Note: This requires express.raw() middleware or similar
+        const rawBody = typeof req.body === 'string'
+            ? req.body
+            : JSON.stringify(req.body);
+        const result = await processWebhook(source, rawBody, req.headers);
+        if (!result.success && result.responses[0]?.error === 'Invalid signature') {
+            return res.status(401).json({ error: 'Invalid signature' });
+        }
+        if (!result.success && result.responses[0]?.error?.includes('Unknown webhook source')) {
+            return res.status(404).json({ error: `Unknown webhook source: ${source}` });
+        }
+        console.log(`[webhooks] Processed ${source} webhook: ${result.eventType} (${result.matchedRules.length} rules matched)`);
+        res.json({
+            success: result.success,
+            eventId: result.eventId,
+            eventType: result.eventType,
+            matchedRules: result.matchedRules,
+            actionsExecuted: result.actions.length,
+        });
+    }
+    catch (error) {
+        console.error(`[webhooks] Error processing ${source} webhook:`, error);
+        res.status(500).json({
+            error: error instanceof Error ? error.message : 'Unknown error',
+        });
+    }
+});
+/**
+ * GET /api/webhooks/config
+ * Get the current webhook configuration (for debugging)
+ */
+genericWebhooksRouter.get('/config', (_req, res) => {
+    const config = getWebhookConfig();
+    res.json({
+        sources: Object.entries(config.sources).map(([id, source]) => ({
+            id,
+            name: source.name,
+            enabled: source.enabled,
+            parser: source.parser,
+            responder: source.responder,
+        })),
+        rules: config.rules.map(rule => ({
+            id: rule.id,
+            name: rule.name,
+            enabled: rule.enabled,
+            source: rule.source,
+            eventType: rule.eventType,
+            condition: rule.condition,
+            actionType: rule.action.type,
+            priority: rule.priority,
+        })),
+    });
+});
+/**
+ * GET /api/webhooks/sources
+ * List available webhook sources with their setup instructions
+ */
+genericWebhooksRouter.get('/sources', (_req, res) => {
+    const baseUrl = process.env.PUBLIC_URL || 'https://your-domain.com';
+    res.json({
+        sources: [
+            {
+                id: 'github',
+                name: 'GitHub',
+                webhookUrl: `${baseUrl}/api/webhooks/github`,
+                setupInstructions: [
+                    '1. Go to your repository Settings > Webhooks > Add webhook',
+                    `2. Set Payload URL to: ${baseUrl}/api/webhooks/github`,
+                    '3. Set Content type to: application/json',
+                    '4. Set Secret to your GITHUB_WEBHOOK_SECRET value',
+                    '5. Select events: Check runs, Issues, Issue comments, Pull request review comments',
+                ],
+                requiredEnvVars: ['GITHUB_WEBHOOK_SECRET'],
+                events: ['check_run', 'issues', 'issue_comment', 'pull_request_review_comment'],
+            },
+            {
+                id: 'linear',
+                name: 'Linear',
+                webhookUrl: `${baseUrl}/api/webhooks/linear`,
+                setupInstructions: [
+                    '1. Go to Linear Settings > API > Webhooks',
+                    '2. Create a new webhook',
+                    `3. Set URL to: ${baseUrl}/api/webhooks/linear`,
+                    '4. Copy the signing secret to LINEAR_WEBHOOK_SECRET',
+                    '5. Select events: Issues, Comments',
+                ],
+                requiredEnvVars: ['LINEAR_WEBHOOK_SECRET', 'LINEAR_API_KEY'],
+                events: ['Issue', 'Comment', 'IssueLabel'],
+            },
+            {
+                id: 'slack',
+                name: 'Slack',
+                webhookUrl: `${baseUrl}/api/webhooks/slack`,
+                setupInstructions: [
+                    '1. Create a Slack App at api.slack.com/apps',
+                    '2. Enable Event Subscriptions',
+                    `3. Set Request URL to: ${baseUrl}/api/webhooks/slack`,
+                    '4. Subscribe to bot events: app_mention, message.channels',
+                    '5. Copy Signing Secret to SLACK_SIGNING_SECRET',
+                    '6. Install the app to your workspace',
+                ],
+                requiredEnvVars: ['SLACK_SIGNING_SECRET', 'SLACK_BOT_TOKEN'],
+                events: ['app_mention', 'message', 'reaction_added'],
+            },
+        ],
+    });
+});
+//# sourceMappingURL=generic-webhooks.js.map

package/dist/api/generic-webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generic-webhooks.js","sourceRoot":"","sources":["../../src/api/generic-webhooks.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAqB,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExE,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,EAAE,CAAC;AAE9C;;;GAGG;AACH,qBAAqB,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IAC3E,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAgB,CAAC;IAE3C,uCAAuC;IACvC,IAAI,MAAM,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAChE,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,CAAC;QACH,0CAA0C;QAC1C,0DAA0D;QAC1D,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;YAC1C,CAAC,CAAC,GAAG,CAAC,IAAI;YACV,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAE7B,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,MAAM,EACN,OAAO,EACP,GAAG,CAAC,OAAwD,CAC7D,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,mBAAmB,EAAE,CAAC;YAC1E,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC;YACtF,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,aAAa,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,YAAY,CAAC,MAAM,iBAAiB,CAAC,CAAC;QAEzH,GAAG,CAAC,IAAI,CAAC;YACP,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;SACvC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,+BAA+B,MAAM,WAAW,EAAE,KAAK,CAAC,CAAC;QACvE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SAChE,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,qBAAqB,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;IACpE,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAElC,GAAG,CAAC,IAAI,CAAC;QACP,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7D,EAAE;YACF,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QACH,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/B,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;KACJ,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,qBAAqB,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;IACrE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,yBAAyB,CAAC;IAEpE,GAAG,CAAC,IAAI,CAAC;QACP,OAAO,EAAE;YACP;gBACE,EAAE,EAAE,QAAQ;gBACZ,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,GAAG,OAAO,sBAAsB;gBAC5C,iBAAiB,EAAE;oBACjB,4DAA4D;oBAC5D,0BAA0B,OAAO,sBAAsB;oBACvD,0CAA0C;oBAC1C,mDAAmD;oBACnD,oFAAoF;iBACrF;gBACD,eAAe,EAAE,CAAC,uBAAuB,CAAC;gBAC1C,MAAM,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,eAAe,EAAE,6BAA6B,CAAC;aAChF;YACD;gBACE,EAAE,EAAE,QAAQ;gBACZ,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,GAAG,OAAO,sBAAsB;gBAC5C,iBAAiB,EAAE;oBACjB,2CAA2C;oBAC3C,yBAAyB;oBACzB,kBAAkB,OAAO,sBAAsB;oBAC/C,qDAAqD;oBACrD,oCAAoC;iBACrC;gBACD,eAAe,EAAE,CAAC,uBAAuB,EAAE,gBAAgB,CAAC;gBAC5D,MAAM,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC;aAC3C;YACD;gBACE,EAAE,EAAE,OAAO;gBACX,IAAI,EAAE,OAAO;gBACb,UAAU,EAAE,GAAG,OAAO,qBAAqB;gBAC3C,iBAAiB,EAAE;oBACjB,6CAA6C;oBAC7C,+BAA+B;oBAC/B,0BAA0B,OAAO,qBAAqB;oBACtD,2DAA2D;oBAC3D,gDAAgD;oBAChD,sCAAsC;iBACvC;gBACD,eAAe,EAAE,CAAC,sBAAsB,EAAE,iBAAiB,CAAC;gBAC5D,MAAM,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,gBAAgB,CAAC;aACrD;SACF;KACF,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/api/git.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Git Gateway API Routes
+ *
+ * Provides fresh GitHub tokens to workspace containers for git operations.
+ * This gateway pattern ensures tokens are always valid (Nango handles refresh).
+ */
+export declare const gitRouter: import("express-serve-static-core").Router;
+//# sourceMappingURL=git.d.ts.map

package/dist/api/git.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../../src/api/git.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,eAAO,MAAM,SAAS,4CAAW,CAAC"}

package/dist/api/git.js

@@ -0,0 +1,269 @@
+/**
+ * Git Gateway API Routes
+ *
+ * Provides fresh GitHub tokens to workspace containers for git operations.
+ * This gateway pattern ensures tokens are always valid (Nango handles refresh).
+ */
+import crypto from 'crypto';
+import { Router } from 'express';
+import { db } from '../db/index.js';
+import { nangoService } from '../services/nango.js';
+import { getConfig } from '../config.js';
+export const gitRouter = Router();
+/**
+ * Generate expected workspace token using HMAC
+ */
+function generateExpectedToken(workspaceId) {
+    const config = getConfig();
+    return crypto
+        .createHmac('sha256', config.sessionSecret)
+        .update(`workspace:${workspaceId}`)
+        .digest('hex');
+}
+/**
+ * Verify workspace access token
+ * Workspaces authenticate with a secret passed at provisioning time
+ *
+ * Returns:
+ * - { valid: true } if token matches
+ * - { valid: false, reason: string } if token is invalid or missing
+ */
+function verifyWorkspaceToken(req, workspaceId) {
+    const authHeader = req.get('authorization');
+    if (!authHeader) {
+        return { valid: false, reason: 'No Authorization header. WORKSPACE_TOKEN may not be set in the container.' };
+    }
+    if (!authHeader.startsWith('Bearer ')) {
+        return { valid: false, reason: 'Invalid Authorization header format. Expected: Bearer <token>' };
+    }
+    const providedToken = authHeader.slice(7);
+    if (!providedToken) {
+        return { valid: false, reason: 'Empty bearer token provided.' };
+    }
+    const expectedToken = generateExpectedToken(workspaceId);
+    // Use timing-safe comparison to prevent timing attacks
+    try {
+        const isValid = crypto.timingSafeEqual(Buffer.from(providedToken), Buffer.from(expectedToken));
+        if (!isValid) {
+            return { valid: false, reason: 'Token mismatch. Workspace may need reprovisioning or SESSION_SECRET changed.' };
+        }
+        return { valid: true };
+    }
+    catch {
+        return { valid: false, reason: 'Token comparison failed (length mismatch). Workspace may need reprovisioning.' };
+    }
+}
+/**
+ * GET /api/git/token
+ * Get a fresh GitHub token for git operations
+ *
+ * Query params:
+ *   - workspaceId: The workspace requesting the token
+ *
+ * Returns: { token: string, expiresAt?: string }
+ *
+ * This endpoint is called by the git credential helper in workspace containers.
+ * It fetches a fresh GitHub App installation token via Nango.
+ */
+gitRouter.get('/token', async (req, res) => {
+    const { workspaceId } = req.query;
+    if (!workspaceId || typeof workspaceId !== 'string') {
+        return res.status(400).json({ error: 'workspaceId is required' });
+    }
+    // Verify the request is from a valid workspace
+    const tokenVerification = verifyWorkspaceToken(req, workspaceId);
+    if (!tokenVerification.valid) {
+        console.warn(`[git] Token verification failed for workspace ${workspaceId.substring(0, 8)}: ${tokenVerification.reason}`);
+        return res.status(401).json({
+            error: 'Invalid workspace token',
+            code: 'INVALID_WORKSPACE_TOKEN',
+            hint: tokenVerification.reason,
+        });
+    }
+    try {
+        // Get workspace to find the user
+        const workspace = await db.workspaces.findById(workspaceId);
+        if (!workspace) {
+            console.warn(`[git] Workspace not found: ${workspaceId}`);
+            return res.status(404).json({
+                error: 'Workspace not found',
+                code: 'WORKSPACE_NOT_FOUND',
+                hint: 'The workspace may have been deleted. Try reprovisioning.',
+            });
+        }
+        const userId = workspace.userId;
+        console.log(`[git] Token request for workspace ${workspaceId.substring(0, 8)}, user ${userId.substring(0, 8)}`);
+        // Find a repository with a Nango connection for this user
+        const repos = await db.repositories.findByUserId(userId);
+        const repoWithConnection = repos.find(r => r.nangoConnectionId);
+        if (!repoWithConnection?.nangoConnectionId) {
+            console.warn(`[git] No Nango connection found for user ${userId.substring(0, 8)}. Repos: ${repos.length}, with connections: ${repos.filter(r => r.nangoConnectionId).length}`);
+            return res.status(404).json({
+                error: 'No GitHub App connection found',
+                code: 'NO_GITHUB_APP_CONNECTION',
+                hint: 'Install the GitHub App on your repositories at https://github.com/apps/agent-relay',
+                repoCount: repos.length,
+            });
+        }
+        console.log(`[git] Fetching token from Nango for connection ${repoWithConnection.nangoConnectionId.substring(0, 8)}...`);
+        // Get fresh tokens from Nango (auto-refreshes if needed)
+        // - installationToken: for git operations (clone, push, pull)
+        // - userToken: for gh CLI operations (requires user context)
+        let installationToken;
+        try {
+            installationToken = await nangoService.getGithubAppToken(repoWithConnection.nangoConnectionId);
+        }
+        catch (nangoError) {
+            const errorMessage = nangoError instanceof Error ? nangoError.message : 'Unknown error';
+            console.error(`[git] Nango token fetch failed for connection ${repoWithConnection.nangoConnectionId}:`, errorMessage);
+            // Provide specific hints based on error type
+            if (errorMessage.includes('not found') || errorMessage.includes('404')) {
+                return res.status(500).json({
+                    error: 'GitHub App connection expired or revoked',
+                    code: 'NANGO_CONNECTION_EXPIRED',
+                    hint: 'Reconnect your GitHub App at https://github.com/apps/agent-relay',
+                    details: errorMessage,
+                });
+            }
+            return res.status(500).json({
+                error: 'Failed to fetch GitHub token from Nango',
+                code: 'NANGO_TOKEN_FETCH_FAILED',
+                hint: 'This may be a temporary issue. Try again in a few seconds.',
+                details: errorMessage,
+            });
+        }
+        // Try to get user OAuth token from github-app-oauth connection_config first
+        // Fall back to separate 'github' user connection if available
+        let userToken = null;
+        try {
+            userToken = await nangoService.getGithubUserOAuthToken(repoWithConnection.nangoConnectionId);
+        }
+        catch {
+            // Try the separate github user connection if available
+            const userRepo = repos.find(r => r.nangoConnectionId && r.nangoConnectionId !== repoWithConnection.nangoConnectionId);
+            if (userRepo?.nangoConnectionId) {
+                try {
+                    userToken = await nangoService.getGithubUserToken(userRepo.nangoConnectionId);
+                }
+                catch {
+                    console.log('[git] No github user token available');
+                }
+            }
+        }
+        // GitHub App installation tokens expire after 1 hour
+        const expiresAt = new Date(Date.now() + 55 * 60 * 1000).toISOString(); // 55 min buffer
+        // Prefer userToken for git operations - installation tokens (ghs_*) are API-only
+        // and don't work with git credential helpers. User OAuth tokens work for both
+        // git operations (clone, push, pull) AND gh CLI commands.
+        const primaryToken = userToken || installationToken;
+        const tokenType = userToken ? 'user' : 'installation';
+        console.log(`[git] Token fetched successfully for workspace ${workspaceId.substring(0, 8)} (type: ${tokenType})`);
+        res.json({
+            token: primaryToken, // Primary token for git/gh operations (prefer user token)
+            userToken, // Explicit user token field (may be null)
+            installationToken, // GitHub App installation token for API operations
+            expiresAt,
+            username: 'x-access-token', // Works with both token types
+            tokenType, // 'user' or 'installation' - helps clients know what they got
+        });
+    }
+    catch (error) {
+        const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+        console.error('[git] Unexpected error getting token:', error);
+        res.status(500).json({
+            error: 'Failed to get GitHub token',
+            code: 'UNEXPECTED_ERROR',
+            details: errorMessage,
+        });
+    }
+});
+/**
+ * POST /api/git/token
+ * Same as GET but accepts body params (for compatibility with some git credential helpers)
+ */
+gitRouter.post('/token', async (req, res) => {
+    const workspaceId = req.body.workspaceId || req.query.workspaceId;
+    if (!workspaceId || typeof workspaceId !== 'string') {
+        return res.status(400).json({ error: 'workspaceId is required' });
+    }
+    const tokenVerification = verifyWorkspaceToken(req, workspaceId);
+    if (!tokenVerification.valid) {
+        console.warn(`[git] POST: Token verification failed for workspace ${workspaceId.substring(0, 8)}: ${tokenVerification.reason}`);
+        return res.status(401).json({
+            error: 'Invalid workspace token',
+            code: 'INVALID_WORKSPACE_TOKEN',
+            hint: tokenVerification.reason,
+        });
+    }
+    try {
+        const workspace = await db.workspaces.findById(workspaceId);
+        if (!workspace) {
+            console.warn(`[git] POST: Workspace not found: ${workspaceId}`);
+            return res.status(404).json({
+                error: 'Workspace not found',
+                code: 'WORKSPACE_NOT_FOUND',
+            });
+        }
+        const repos = await db.repositories.findByUserId(workspace.userId);
+        const repoWithConnection = repos.find(r => r.nangoConnectionId);
+        if (!repoWithConnection?.nangoConnectionId) {
+            console.warn(`[git] POST: No Nango connection for user ${workspace.userId.substring(0, 8)}`);
+            return res.status(404).json({
+                error: 'No GitHub App connection found',
+                code: 'NO_GITHUB_APP_CONNECTION',
+            });
+        }
+        let installationToken;
+        try {
+            installationToken = await nangoService.getGithubAppToken(repoWithConnection.nangoConnectionId);
+        }
+        catch (nangoError) {
+            const errorMessage = nangoError instanceof Error ? nangoError.message : 'Unknown error';
+            console.error(`[git] POST: Nango token fetch failed:`, errorMessage);
+            return res.status(500).json({
+                error: 'Failed to fetch GitHub token',
+                code: 'NANGO_TOKEN_FETCH_FAILED',
+                details: errorMessage,
+            });
+        }
+        // Try to get user OAuth token (preferred for git operations)
+        let userToken = null;
+        try {
+            userToken = await nangoService.getGithubUserOAuthToken(repoWithConnection.nangoConnectionId);
+        }
+        catch {
+            // Try the separate github user connection if available
+            const userRepo = repos.find(r => r.nangoConnectionId && r.nangoConnectionId !== repoWithConnection.nangoConnectionId);
+            if (userRepo?.nangoConnectionId) {
+                try {
+                    userToken = await nangoService.getGithubUserToken(userRepo.nangoConnectionId);
+                }
+                catch {
+                    console.log('[git] POST: No github user token available');
+                }
+            }
+        }
+        const expiresAt = new Date(Date.now() + 55 * 60 * 1000).toISOString();
+        // Prefer userToken for git operations
+        const primaryToken = userToken || installationToken;
+        const tokenType = userToken ? 'user' : 'installation';
+        res.json({
+            token: primaryToken,
+            userToken,
+            installationToken,
+            expiresAt,
+            username: 'x-access-token',
+            tokenType,
+        });
+    }
+    catch (error) {
+        const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+        console.error('[git] POST: Unexpected error:', error);
+        res.status(500).json({
+            error: 'Failed to get GitHub token',
+            code: 'UNEXPECTED_ERROR',
+            details: errorMessage,
+        });
+    }
+});
+//# sourceMappingURL=git.js.map

package/dist/api/git.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.js","sourceRoot":"","sources":["../../src/api/git.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAqB,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC;AAElC;;GAEG;AACH,SAAS,qBAAqB,CAAC,WAAmB;IAChD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,OAAO,MAAM;SACV,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,aAAa,CAAC;SAC1C,MAAM,CAAC,aAAa,WAAW,EAAE,CAAC;SAClC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,GAAY,EAAE,WAAmB;IAC7D,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAE5C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,2EAA2E,EAAE,CAAC;IAC/G,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,+DAA+D,EAAE,CAAC;IACnG,CAAC;IAED,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IAClE,CAAC;IAED,MAAM,aAAa,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;IAEzD,uDAAuD;IACvD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,CACpC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,EAC1B,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAC3B,CAAC;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,8EAA8E,EAAE,CAAC;QAClH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,+EAA+E,EAAE,CAAC;IACnH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IAC5D,MAAM,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;IAElC,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,+CAA+C;IAC/C,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACjE,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,iDAAiD,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1H,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC1B,KAAK,EAAE,yBAAyB;YAChC,IAAI,EAAE,yBAAyB;YAC/B,IAAI,EAAE,iBAAiB,CAAC,MAAM;SAC/B,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC;QACH,iCAAiC;QACjC,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC5D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,8BAA8B,WAAW,EAAE,CAAC,CAAC;YAC1D,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,qBAAqB;gBAC5B,IAAI,EAAE,qBAAqB;gBAC3B,IAAI,EAAE,0DAA0D;aACjE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,qCAAqC,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAEhH,0DAA0D;QAC1D,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,kBAAkB,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAEhE,IAAI,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,CAAC;YAC3C,OAAO,CAAC,IAAI,CAAC,4CAA4C,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,YAAY,KAAK,CAAC,MAAM,uBAAuB,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YAC/K,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,gCAAgC;gBACvC,IAAI,EAAE,0BAA0B;gBAChC,IAAI,EAAE,oFAAoF;gBAC1F,SAAS,EAAE,KAAK,CAAC,MAAM;aACxB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,kDAAkD,kBAAkB,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAEzH,yDAAyD;QACzD,8DAA8D;QAC9D,6DAA6D;QAC7D,IAAI,iBAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,iBAAiB,GAAG,MAAM,YAAY,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;QACjG,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,MAAM,YAAY,GAAG,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACxF,OAAO,CAAC,KAAK,CAAC,iDAAiD,kBAAkB,CAAC,iBAAiB,GAAG,EAAE,YAAY,CAAC,CAAC;YAEtH,6CAA6C;YAC7C,IAAI,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC1B,KAAK,EAAE,0CAA0C;oBACjD,IAAI,EAAE,0BAA0B;oBAChC,IAAI,EAAE,kEAAkE;oBACxE,OAAO,EAAE,YAAY;iBACtB,CAAC,CAAC;YACL,CAAC;YAED,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,yCAAyC;gBAChD,IAAI,EAAE,0BAA0B;gBAChC,IAAI,EAAE,4DAA4D;gBAClE,OAAO,EAAE,YAAY;aACtB,CAAC,CAAC;QACL,CAAC;QAED,4EAA4E;QAC5E,8DAA8D;QAC9D,IAAI,SAAS,GAAkB,IAAI,CAAC;QACpC,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,YAAY,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;QAC/F,CAAC;QAAC,MAAM,CAAC;YACP,uDAAuD;YACvD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,iBAAiB,KAAK,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;YACtH,IAAI,QAAQ,EAAE,iBAAiB,EAAE,CAAC;gBAChC,IAAI,CAAC;oBACH,SAAS,GAAG,MAAM,YAAY,CAAC,kBAAkB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;gBAChF,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;gBACtD,CAAC;YACH,CAAC;QACH,CAAC;QAED,qDAAqD;QACrD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,gBAAgB;QAEvF,iFAAiF;QACjF,8EAA8E;QAC9E,0DAA0D;QAC1D,MAAM,YAAY,GAAG,SAAS,IAAI,iBAAiB,CAAC;QACpD,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC;QAEtD,OAAO,CAAC,GAAG,CAAC,kDAAkD,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,SAAS,GAAG,CAAC,CAAC;QAElH,GAAG,CAAC,IAAI,CAAC;YACP,KAAK,EAAE,YAAY,EAAE,0DAA0D;YAC/E,SAAS,EAAE,0CAA0C;YACrD,iBAAiB,EAAE,mDAAmD;YACtE,SAAS;YACT,QAAQ,EAAE,gBAAgB,EAAE,8BAA8B;YAC1D,SAAS,EAAE,8DAA8D;SAC1E,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QAC9E,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,KAAK,CAAC,CAAC;QAC9D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,4BAA4B;YACnC,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,YAAY;SACtB,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IAC7D,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC;IAElE,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACjE,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,uDAAuD,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC,CAAC;QAChI,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC1B,KAAK,EAAE,yBAAyB;YAChC,IAAI,EAAE,yBAAyB;YAC/B,IAAI,EAAE,iBAAiB,CAAC,MAAM;SAC/B,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC5D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,oCAAoC,WAAW,EAAE,CAAC,CAAC;YAChE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,qBAAqB;gBAC5B,IAAI,EAAE,qBAAqB;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACnE,MAAM,kBAAkB,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAEhE,IAAI,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,CAAC;YAC3C,OAAO,CAAC,IAAI,CAAC,4CAA4C,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YAC7F,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,gCAAgC;gBACvC,IAAI,EAAE,0BAA0B;aACjC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,iBAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,iBAAiB,GAAG,MAAM,YAAY,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;QACjG,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,MAAM,YAAY,GAAG,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YACxF,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,YAAY,CAAC,CAAC;YACrE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,8BAA8B;gBACrC,IAAI,EAAE,0BAA0B;gBAChC,OAAO,EAAE,YAAY;aACtB,CAAC,CAAC;QACL,CAAC;QAED,6DAA6D;QAC7D,IAAI,SAAS,GAAkB,IAAI,CAAC;QACpC,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,YAAY,CAAC,uBAAuB,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;QAC/F,CAAC;QAAC,MAAM,CAAC;YACP,uDAAuD;YACvD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,iBAAiB,KAAK,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;YACtH,IAAI,QAAQ,EAAE,iBAAiB,EAAE,CAAC;gBAChC,IAAI,CAAC;oBACH,SAAS,GAAG,MAAM,YAAY,CAAC,kBAAkB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;gBAChF,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;gBAC5D,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAEtE,sCAAsC;QACtC,MAAM,YAAY,GAAG,SAAS,IAAI,iBAAiB,CAAC;QACpD,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC;QAEtD,GAAG,CAAC,IAAI,CAAC;YACP,KAAK,EAAE,YAAY;YACnB,SAAS;YACT,iBAAiB;YACjB,SAAS;YACT,QAAQ,EAAE,gBAAgB;YAC1B,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QAC9E,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;QACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,4BAA4B;YACnC,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,YAAY;SACtB,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/api/github-app.d.ts

@@ -0,0 +1,11 @@
+/**
+ * GitHub App API Routes
+ *
+ * Repo operations via Nango's github-app-oauth connection:
+ * - Get clone token for repositories
+ * - Create issues, PRs, and comments
+ *
+ * Auth flow is handled by nango-auth.ts
+ */
+export declare const githubAppRouter: import("express-serve-static-core").Router;
+//# sourceMappingURL=github-app.d.ts.map

package/dist/api/github-app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-app.d.ts","sourceRoot":"","sources":["../../src/api/github-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH,eAAO,MAAM,eAAe,4CAAW,CAAC"}