agent-relay 1.0.22 → 1.2.0

package/dist/cloud/provisioner/index.js

@@ -0,0 +1,977 @@
+/**
+ * Agent Relay Cloud - Workspace Provisioner
+ *
+ * One-click provisioning for compute resources (Fly.io, Railway, Docker).
+ */
+import * as crypto from 'crypto';
+import { getConfig } from '../config.js';
+import { db } from '../db/index.js';
+import { vault } from '../vault/index.js';
+import { nangoService } from '../services/nango.js';
+const WORKSPACE_PORT = 3888;
+const FETCH_TIMEOUT_MS = 10_000;
+const WORKSPACE_IMAGE = process.env.WORKSPACE_IMAGE || 'ghcr.io/agentworkforce/relay-workspace:latest';
+/**
+ * Get a fresh GitHub App installation token from Nango.
+ * Looks up the user's connected repositories to find a valid Nango connection.
+ */
+async function getGithubAppTokenForUser(userId) {
+    try {
+        // Find any repository with a Nango connection for this user
+        const repos = await db.repositories.findByUserId(userId);
+        const repoWithConnection = repos.find(r => r.nangoConnectionId);
+        if (!repoWithConnection?.nangoConnectionId) {
+            console.warn(`[provisioner] No Nango GitHub App connection found for user ${userId}`);
+            return null;
+        }
+        // Get fresh installation token from Nango (handles refresh automatically)
+        const token = await nangoService.getGithubAppToken(repoWithConnection.nangoConnectionId);
+        return token;
+    }
+    catch (error) {
+        console.error(`[provisioner] Failed to get GitHub App token for user ${userId}:`, error);
+        return null;
+    }
+}
+async function loadCredentialToken(userId, provider) {
+    try {
+        const cred = await vault.getCredential(userId, provider);
+        if (cred?.accessToken) {
+            return cred.accessToken;
+        }
+    }
+    catch (error) {
+        console.warn(`Failed to decrypt ${provider} credential from vault; trying raw storage fallback`, error);
+        const raw = await db.credentials.findByUserAndProvider(userId, provider);
+        return raw?.accessToken ?? null;
+    }
+    return null;
+}
+async function wait(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function fetchWithRetry(url, options = {}) {
+    const retries = options.retries ?? 2;
+    let attempt = 0;
+    while (attempt <= retries) {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+        try {
+            const response = await fetch(url, { ...options, signal: controller.signal });
+            clearTimeout(timer);
+            if (!response.ok && response.status >= 500 && attempt < retries) {
+                attempt += 1;
+                await wait(500 * attempt);
+                continue;
+            }
+            return response;
+        }
+        catch (error) {
+            clearTimeout(timer);
+            if (attempt >= retries) {
+                throw error;
+            }
+            attempt += 1;
+            await wait(500 * attempt);
+        }
+    }
+    throw new Error('fetchWithRetry exhausted retries');
+}
+async function softHealthCheck(url) {
+    try {
+        const res = await fetchWithRetry(`${url.replace(/\/$/, '')}/health`, { method: 'GET', retries: 1 });
+        if (!res.ok) {
+            console.warn(`[health] Non-200 from ${url}/health: ${res.status}`);
+        }
+    }
+    catch (error) {
+        console.warn(`[health] Failed to reach ${url}/health`, error);
+    }
+}
+export const RESOURCE_TIERS = {
+    small: { name: 'small', cpuCores: 1, memoryMb: 512, maxAgents: 5 },
+    medium: { name: 'medium', cpuCores: 2, memoryMb: 1024, maxAgents: 10 },
+    large: { name: 'large', cpuCores: 4, memoryMb: 2048, maxAgents: 20 },
+    xlarge: { name: 'xlarge', cpuCores: 8, memoryMb: 4096, maxAgents: 50 },
+};
+/**
+ * Fly.io provisioner
+ */
+class FlyProvisioner {
+    apiToken;
+    org;
+    region;
+    workspaceDomain;
+    cloudApiUrl;
+    sessionSecret;
+    registryAuth;
+    constructor() {
+        const config = getConfig();
+        if (!config.compute.fly) {
+            throw new Error('Fly.io configuration missing');
+        }
+        this.apiToken = config.compute.fly.apiToken;
+        this.org = config.compute.fly.org;
+        this.region = config.compute.fly.region || 'sjc';
+        this.workspaceDomain = config.compute.fly.workspaceDomain;
+        this.registryAuth = config.compute.fly.registryAuth;
+        this.cloudApiUrl = config.publicUrl;
+        this.sessionSecret = config.sessionSecret;
+    }
+    /**
+     * Generate a workspace token for API authentication
+     * This is a simple HMAC - in production, consider using JWTs
+     */
+    generateWorkspaceToken(workspaceId) {
+        return crypto
+            .createHmac('sha256', this.sessionSecret)
+            .update(`workspace:${workspaceId}`)
+            .digest('hex');
+    }
+    async provision(workspace, credentials) {
+        const appName = `ar-${workspace.id.substring(0, 8)}`;
+        // Create Fly app
+        await fetchWithRetry('https://api.machines.dev/v1/apps', {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${this.apiToken}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+                app_name: appName,
+                org_slug: this.org,
+            }),
+        });
+        // Set secrets (provider credentials)
+        const secrets = {};
+        for (const [provider, token] of credentials) {
+            secrets[`${provider.toUpperCase()}_TOKEN`] = token;
+        }
+        if (Object.keys(secrets).length > 0) {
+            await fetchWithRetry(`https://api.machines.dev/v1/apps/${appName}/secrets`, {
+                method: 'POST',
+                headers: {
+                    Authorization: `Bearer ${this.apiToken}`,
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify(secrets),
+            });
+        }
+        // If custom workspace domain is configured, add certificate
+        const customHostname = this.workspaceDomain
+            ? `${appName}.${this.workspaceDomain}`
+            : null;
+        if (customHostname) {
+            await this.allocateCertificate(appName, customHostname);
+        }
+        // Create machine with auto-stop/start for cost optimization
+        const machineResponse = await fetchWithRetry(`https://api.machines.dev/v1/apps/${appName}/machines`, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${this.apiToken}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+                region: this.region,
+                config: {
+                    image: WORKSPACE_IMAGE,
+                    // Registry auth for private ghcr.io images
+                    ...(this.registryAuth && {
+                        image_registry_auth: {
+                            registry: 'ghcr.io',
+                            username: this.registryAuth.username,
+                            password: this.registryAuth.password,
+                        },
+                    }),
+                    env: {
+                        WORKSPACE_ID: workspace.id,
+                        SUPERVISOR_ENABLED: String(workspace.config.supervisorEnabled ?? false),
+                        MAX_AGENTS: String(workspace.config.maxAgents ?? 10),
+                        REPOSITORIES: (workspace.config.repositories ?? []).join(','),
+                        PROVIDERS: (workspace.config.providers ?? []).join(','),
+                        PORT: String(WORKSPACE_PORT),
+                        AGENT_RELAY_DASHBOARD_PORT: String(WORKSPACE_PORT),
+                        // Git gateway configuration
+                        CLOUD_API_URL: this.cloudApiUrl,
+                        WORKSPACE_TOKEN: this.generateWorkspaceToken(workspace.id),
+                    },
+                    services: [
+                        {
+                            ports: [
+                                { port: 443, handlers: ['tls', 'http'] },
+                                { port: 80, handlers: ['http'] },
+                            ],
+                            protocol: 'tcp',
+                            internal_port: WORKSPACE_PORT,
+                            // Auto-stop after 5 minutes of inactivity
+                            auto_stop_machines: true,
+                            auto_start_machines: true,
+                            min_machines_running: 0,
+                        },
+                    ],
+                    guest: {
+                        cpu_kind: 'shared',
+                        cpus: 1,
+                        memory_mb: 512,
+                    },
+                },
+            }),
+        });
+        if (!machineResponse.ok) {
+            const error = await machineResponse.text();
+            throw new Error(`Failed to create Fly machine: ${error}`);
+        }
+        const machine = (await machineResponse.json());
+        // Return custom domain URL if configured, otherwise default fly.dev
+        const publicUrl = customHostname
+            ? `https://${customHostname}`
+            : `https://${appName}.fly.dev`;
+        await softHealthCheck(publicUrl);
+        return {
+            computeId: machine.id,
+            publicUrl,
+        };
+    }
+    /**
+     * Allocate SSL certificate for custom domain
+     */
+    async allocateCertificate(appName, hostname) {
+        const response = await fetchWithRetry(`https://api.machines.dev/v1/apps/${appName}/certificates`, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${this.apiToken}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({ hostname }),
+        });
+        if (!response.ok) {
+            const error = await response.text();
+            // Don't fail if cert already exists
+            if (!error.includes('already exists')) {
+                throw new Error(`Failed to allocate certificate for ${hostname}: ${error}`);
+            }
+        }
+    }
+    async deprovision(workspace) {
+        const appName = `ar-${workspace.id.substring(0, 8)}`;
+        await fetchWithRetry(`https://api.machines.dev/v1/apps/${appName}`, {
+            method: 'DELETE',
+            headers: {
+                Authorization: `Bearer ${this.apiToken}`,
+            },
+        });
+    }
+    async getStatus(workspace) {
+        if (!workspace.computeId)
+            return 'error';
+        const appName = `ar-${workspace.id.substring(0, 8)}`;
+        const response = await fetchWithRetry(`https://api.machines.dev/v1/apps/${appName}/machines/${workspace.computeId}`, {
+            headers: {
+                Authorization: `Bearer ${this.apiToken}`,
+            },
+        });
+        if (!response.ok)
+            return 'error';
+        const machine = await response.json();
+        switch (machine.state) {
+            case 'started':
+                return 'running';
+            case 'stopped':
+                return 'stopped';
+            case 'created':
+            case 'starting':
+                return 'provisioning';
+            default:
+                return 'error';
+        }
+    }
+    async restart(workspace) {
+        if (!workspace.computeId)
+            return;
+        const appName = `ar-${workspace.id.substring(0, 8)}`;
+        await fetchWithRetry(`https://api.machines.dev/v1/apps/${appName}/machines/${workspace.computeId}/restart`, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${this.apiToken}`,
+            },
+        });
+    }
+    /**
+     * Resize workspace - vertical scaling via Fly Machines API
+     */
+    async resize(workspace, tier) {
+        if (!workspace.computeId)
+            return;
+        const appName = `ar-${workspace.id.substring(0, 8)}`;
+        // Update machine configuration
+        await fetchWithRetry(`https://api.machines.dev/v1/apps/${appName}/machines/${workspace.computeId}`, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${this.apiToken}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+                config: {
+                    guest: {
+                        cpu_kind: tier.cpuCores <= 2 ? 'shared' : 'performance',
+                        cpus: tier.cpuCores,
+                        memory_mb: tier.memoryMb,
+                    },
+                    env: {
+                        MAX_AGENTS: String(tier.maxAgents),
+                    },
+                },
+            }),
+        });
+        console.log(`[fly] Resized workspace ${workspace.id} to ${tier.name} (${tier.cpuCores} CPU, ${tier.memoryMb}MB RAM)`);
+    }
+    /**
+     * Update the max agent limit for a workspace
+     */
+    async updateAgentLimit(workspace, newLimit) {
+        if (!workspace.computeId)
+            return;
+        const appName = `ar-${workspace.id.substring(0, 8)}`;
+        // Update environment variable
+        await fetchWithRetry(`https://api.machines.dev/v1/apps/${appName}/machines/${workspace.computeId}`, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${this.apiToken}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+                config: {
+                    env: {
+                        MAX_AGENTS: String(newLimit),
+                    },
+                },
+            }),
+        });
+        console.log(`[fly] Updated workspace ${workspace.id} agent limit to ${newLimit}`);
+    }
+    /**
+     * Get current resource tier for a workspace
+     */
+    async getCurrentTier(workspace) {
+        if (!workspace.computeId) {
+            return RESOURCE_TIERS.small;
+        }
+        const appName = `ar-${workspace.id.substring(0, 8)}`;
+        const response = await fetchWithRetry(`https://api.machines.dev/v1/apps/${appName}/machines/${workspace.computeId}`, {
+            headers: {
+                Authorization: `Bearer ${this.apiToken}`,
+            },
+        });
+        if (!response.ok) {
+            return RESOURCE_TIERS.small;
+        }
+        const machine = await response.json();
+        const _cpus = machine.config?.guest?.cpus || 1;
+        const memoryMb = machine.config?.guest?.memory_mb || 512;
+        // Map to nearest tier
+        if (memoryMb >= 4096)
+            return RESOURCE_TIERS.xlarge;
+        if (memoryMb >= 2048)
+            return RESOURCE_TIERS.large;
+        if (memoryMb >= 1024)
+            return RESOURCE_TIERS.medium;
+        return RESOURCE_TIERS.small;
+    }
+}
+/**
+ * Railway provisioner
+ */
+class RailwayProvisioner {
+    apiToken;
+    cloudApiUrl;
+    sessionSecret;
+    constructor() {
+        const config = getConfig();
+        if (!config.compute.railway) {
+            throw new Error('Railway configuration missing');
+        }
+        this.apiToken = config.compute.railway.apiToken;
+        this.cloudApiUrl = config.publicUrl;
+        this.sessionSecret = config.sessionSecret;
+    }
+    generateWorkspaceToken(workspaceId) {
+        return crypto
+            .createHmac('sha256', this.sessionSecret)
+            .update(`workspace:${workspaceId}`)
+            .digest('hex');
+    }
+    async provision(workspace, credentials) {
+        // Create project
+        const projectResponse = await fetchWithRetry('https://backboard.railway.app/graphql/v2', {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${this.apiToken}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+                query: `
+          mutation CreateProject($input: ProjectCreateInput!) {
+            projectCreate(input: $input) {
+              id
+              name
+            }
+          }
+        `,
+                variables: {
+                    input: {
+                        name: `agent-relay-${workspace.id.substring(0, 8)}`,
+                    },
+                },
+            }),
+        });
+        const projectData = await projectResponse.json();
+        const projectId = projectData.data.projectCreate.id;
+        // Deploy service
+        const serviceResponse = await fetchWithRetry('https://backboard.railway.app/graphql/v2', {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${this.apiToken}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+                query: `
+          mutation CreateService($input: ServiceCreateInput!) {
+            serviceCreate(input: $input) {
+              id
+            }
+          }
+        `,
+                variables: {
+                    input: {
+                        projectId,
+                        name: 'workspace',
+                        source: {
+                            image: WORKSPACE_IMAGE,
+                        },
+                    },
+                },
+            }),
+        });
+        const serviceData = await serviceResponse.json();
+        const serviceId = serviceData.data.serviceCreate.id;
+        // Set environment variables
+        const envVars = {
+            WORKSPACE_ID: workspace.id,
+            SUPERVISOR_ENABLED: String(workspace.config.supervisorEnabled ?? false),
+            MAX_AGENTS: String(workspace.config.maxAgents ?? 10),
+            REPOSITORIES: (workspace.config.repositories ?? []).join(','),
+            PROVIDERS: (workspace.config.providers ?? []).join(','),
+            PORT: String(WORKSPACE_PORT),
+            AGENT_RELAY_DASHBOARD_PORT: String(WORKSPACE_PORT),
+            CLOUD_API_URL: this.cloudApiUrl,
+            WORKSPACE_TOKEN: this.generateWorkspaceToken(workspace.id),
+        };
+        for (const [provider, token] of credentials) {
+            envVars[`${provider.toUpperCase()}_TOKEN`] = token;
+        }
+        await fetchWithRetry('https://backboard.railway.app/graphql/v2', {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${this.apiToken}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+                query: `
+          mutation SetVariables($input: VariableCollectionUpsertInput!) {
+            variableCollectionUpsert(input: $input)
+          }
+        `,
+                variables: {
+                    input: {
+                        projectId,
+                        serviceId,
+                        variables: envVars,
+                    },
+                },
+            }),
+        });
+        // Generate domain
+        const domainResponse = await fetchWithRetry('https://backboard.railway.app/graphql/v2', {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${this.apiToken}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+                query: `
+          mutation CreateDomain($input: ServiceDomainCreateInput!) {
+            serviceDomainCreate(input: $input) {
+              domain
+            }
+          }
+        `,
+                variables: {
+                    input: {
+                        serviceId,
+                    },
+                },
+            }),
+        });
+        const domainData = await domainResponse.json();
+        const domain = domainData.data.serviceDomainCreate.domain;
+        await softHealthCheck(`https://${domain}`);
+        return {
+            computeId: projectId,
+            publicUrl: `https://${domain}`,
+        };
+    }
+    async deprovision(workspace) {
+        if (!workspace.computeId)
+            return;
+        await fetchWithRetry('https://backboard.railway.app/graphql/v2', {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${this.apiToken}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+                query: `
+          mutation DeleteProject($id: String!) {
+            projectDelete(id: $id)
+          }
+        `,
+                variables: {
+                    id: workspace.computeId,
+                },
+            }),
+        });
+    }
+    async getStatus(workspace) {
+        if (!workspace.computeId)
+            return 'error';
+        const response = await fetchWithRetry('https://backboard.railway.app/graphql/v2', {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${this.apiToken}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+                query: `
+          query GetProject($id: String!) {
+            project(id: $id) {
+              deployments {
+                edges {
+                  node {
+                    status
+                  }
+                }
+              }
+            }
+          }
+        `,
+                variables: {
+                    id: workspace.computeId,
+                },
+            }),
+        });
+        const data = await response.json();
+        const deployments = data.data?.project?.deployments?.edges;
+        if (!deployments || deployments.length === 0)
+            return 'provisioning';
+        const latestStatus = deployments[0].node.status;
+        switch (latestStatus) {
+            case 'SUCCESS':
+                return 'running';
+            case 'BUILDING':
+            case 'DEPLOYING':
+                return 'provisioning';
+            case 'CRASHED':
+            case 'FAILED':
+                return 'error';
+            default:
+                return 'stopped';
+        }
+    }
+    async restart(workspace) {
+        // Railway doesn't have a direct restart - redeploy instead
+        if (!workspace.computeId)
+            return;
+        await fetchWithRetry('https://backboard.railway.app/graphql/v2', {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${this.apiToken}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+                query: `
+          mutation RedeployService($input: DeploymentTriggerInput!) {
+            deploymentTrigger(input: $input)
+          }
+        `,
+                variables: {
+                    input: {
+                        projectId: workspace.computeId,
+                    },
+                },
+            }),
+        });
+    }
+}
+/**
+ * Local Docker provisioner (for development/self-hosted)
+ */
+class DockerProvisioner {
+    cloudApiUrl;
+    cloudApiUrlForContainer;
+    sessionSecret;
+    constructor() {
+        const config = getConfig();
+        this.cloudApiUrl = config.publicUrl;
+        this.sessionSecret = config.sessionSecret;
+        // For Docker containers, localhost won't work - they need to reach the host
+        // Convert localhost URLs to host.docker.internal for container access
+        if (this.cloudApiUrl.includes('localhost') || this.cloudApiUrl.includes('127.0.0.1')) {
+            this.cloudApiUrlForContainer = this.cloudApiUrl
+                .replace('localhost', 'host.docker.internal')
+                .replace('127.0.0.1', 'host.docker.internal');
+            console.log(`[docker] Container API URL: ${this.cloudApiUrlForContainer} (host: ${this.cloudApiUrl})`);
+        }
+        else {
+            this.cloudApiUrlForContainer = this.cloudApiUrl;
+        }
+    }
+    generateWorkspaceToken(workspaceId) {
+        return crypto
+            .createHmac('sha256', this.sessionSecret)
+            .update(`workspace:${workspaceId}`)
+            .digest('hex');
+    }
+    /**
+     * Wait for container to be healthy by polling the health endpoint
+     */
+    async waitForHealthy(publicUrl, timeoutMs = 60_000) {
+        const startTime = Date.now();
+        const pollInterval = 2000;
+        console.log(`[docker] Waiting for container to be healthy at ${publicUrl}...`);
+        while (Date.now() - startTime < timeoutMs) {
+            try {
+                const response = await fetch(`${publicUrl}/health`, {
+                    method: 'GET',
+                    signal: AbortSignal.timeout(5000),
+                });
+                if (response.ok) {
+                    console.log(`[docker] Container healthy after ${Date.now() - startTime}ms`);
+                    return;
+                }
+            }
+            catch {
+                // Container not ready yet, continue polling
+            }
+            await wait(pollInterval);
+        }
+        throw new Error(`Container did not become healthy within ${timeoutMs}ms`);
+    }
+    async provision(workspace, credentials) {
+        const containerName = `ar-${workspace.id.substring(0, 8)}`;
+        // Build environment variables
+        const envArgs = [
+            `-e WORKSPACE_ID=${workspace.id}`,
+            `-e SUPERVISOR_ENABLED=${workspace.config.supervisorEnabled ?? false}`,
+            `-e MAX_AGENTS=${workspace.config.maxAgents ?? 10}`,
+            `-e REPOSITORIES=${(workspace.config.repositories ?? []).join(',')}`,
+            `-e PROVIDERS=${(workspace.config.providers ?? []).join(',')}`,
+            `-e PORT=${WORKSPACE_PORT}`,
+            `-e AGENT_RELAY_DASHBOARD_PORT=${WORKSPACE_PORT}`,
+            `-e CLOUD_API_URL=${this.cloudApiUrlForContainer}`,
+            `-e WORKSPACE_TOKEN=${this.generateWorkspaceToken(workspace.id)}`,
+        ];
+        for (const [provider, token] of credentials) {
+            envArgs.push(`-e ${provider.toUpperCase()}_TOKEN=${token}`);
+        }
+        // Run container
+        const { execSync } = await import('child_process');
+        const hostPort = 3000 + Math.floor(Math.random() * 1000);
+        // When running in Docker, connect to the same network for container-to-container communication
+        const runningInDocker = process.env.RUNNING_IN_DOCKER === 'true';
+        const networkArg = runningInDocker ? '--network agent-relay-dev' : '';
+        // In development, mount local dist and docs folders for faster iteration
+        // Set WORKSPACE_DEV_MOUNT=true to enable
+        const devMount = process.env.WORKSPACE_DEV_MOUNT === 'true';
+        const volumeArgs = devMount
+            ? `-v "${process.cwd()}/dist:/app/dist:ro" -v "${process.cwd()}/docs:/app/docs:ro"`
+            : '';
+        if (devMount) {
+            console.log('[provisioner] Dev mode: mounting local dist/ and docs/ folders into workspace container');
+        }
+        try {
+            execSync(`docker run -d --user root --name ${containerName} ${networkArg} ${volumeArgs} -p ${hostPort}:${WORKSPACE_PORT} ${envArgs.join(' ')} ${WORKSPACE_IMAGE}`, { stdio: 'pipe' });
+            const publicUrl = `http://localhost:${hostPort}`;
+            // Wait for container to be healthy before returning
+            // When running in Docker, use the internal container name for health check
+            const healthCheckUrl = runningInDocker
+                ? `http://${containerName}:${WORKSPACE_PORT}`
+                : publicUrl;
+            await this.waitForHealthy(healthCheckUrl);
+            return {
+                computeId: containerName,
+                publicUrl,
+            };
+        }
+        catch (error) {
+            // Clean up container if it was created but health check failed
+            try {
+                const { execSync: execSyncCleanup } = await import('child_process');
+                execSyncCleanup(`docker rm -f ${containerName}`, { stdio: 'pipe' });
+            }
+            catch {
+                // Ignore cleanup errors
+            }
+            throw new Error(`Failed to start Docker container: ${error}`);
+        }
+    }
+    async deprovision(workspace) {
+        if (!workspace.computeId)
+            return;
+        const { execSync } = await import('child_process');
+        try {
+            execSync(`docker rm -f ${workspace.computeId}`, { stdio: 'pipe' });
+        }
+        catch {
+            // Container may already be removed
+        }
+    }
+    async getStatus(workspace) {
+        if (!workspace.computeId)
+            return 'error';
+        const { execSync } = await import('child_process');
+        try {
+            const result = execSync(`docker inspect -f '{{.State.Status}}' ${workspace.computeId}`, { stdio: 'pipe' }).toString().trim();
+            switch (result) {
+                case 'running':
+                    return 'running';
+                case 'exited':
+                case 'dead':
+                    return 'stopped';
+                case 'created':
+                case 'restarting':
+                    return 'provisioning';
+                default:
+                    return 'error';
+            }
+        }
+        catch {
+            return 'error';
+        }
+    }
+    async restart(workspace) {
+        if (!workspace.computeId)
+            return;
+        const { execSync } = await import('child_process');
+        try {
+            execSync(`docker restart ${workspace.computeId}`, { stdio: 'pipe' });
+        }
+        catch (error) {
+            throw new Error(`Failed to restart container: ${error}`);
+        }
+    }
+}
+/**
+ * Main Workspace Provisioner
+ */
+export class WorkspaceProvisioner {
+    provisioner;
+    constructor() {
+        const config = getConfig();
+        switch (config.compute.provider) {
+            case 'fly':
+                this.provisioner = new FlyProvisioner();
+                break;
+            case 'railway':
+                this.provisioner = new RailwayProvisioner();
+                break;
+            case 'docker':
+            default:
+                this.provisioner = new DockerProvisioner();
+        }
+    }
+    /**
+     * Provision a new workspace (one-click)
+     */
+    async provision(config) {
+        // Create workspace record
+        const workspace = await db.workspaces.create({
+            userId: config.userId,
+            name: config.name,
+            computeProvider: getConfig().compute.provider,
+            config: {
+                providers: config.providers,
+                repositories: config.repositories,
+                supervisorEnabled: config.supervisorEnabled ?? true,
+                maxAgents: config.maxAgents ?? 10,
+            },
+        });
+        // Add creator as owner in workspace_members for team collaboration support
+        await db.workspaceMembers.addMember({
+            workspaceId: workspace.id,
+            userId: config.userId,
+            role: 'owner',
+            invitedBy: config.userId, // Self-invited as creator
+        });
+        // Auto-accept the creator's membership
+        await db.workspaceMembers.acceptInvite(workspace.id, config.userId);
+        // Get credentials
+        const credentials = new Map();
+        for (const provider of config.providers) {
+            const token = await loadCredentialToken(config.userId, provider);
+            if (token) {
+                credentials.set(provider, token);
+            }
+        }
+        // GitHub token is required for cloning repositories
+        // Use direct token if provided (for testing), otherwise get from Nango
+        if (config.repositories.length > 0) {
+            if (config.githubToken) {
+                // Direct token provided (for testing)
+                credentials.set('github', config.githubToken);
+                console.log('[provisioner] Using provided GitHub token');
+            }
+            else {
+                // Get fresh installation token from Nango GitHub App
+                const githubToken = await getGithubAppTokenForUser(config.userId);
+                if (githubToken) {
+                    credentials.set('github', githubToken);
+                }
+                else {
+                    console.warn(`[provisioner] No GitHub App token for user ${config.userId}; repository cloning may fail.`);
+                }
+            }
+        }
+        // Provision compute
+        try {
+            const { computeId, publicUrl } = await this.provisioner.provision(workspace, credentials);
+            await db.workspaces.updateStatus(workspace.id, 'running', {
+                computeId,
+                publicUrl,
+            });
+            return {
+                workspaceId: workspace.id,
+                status: 'running',
+                publicUrl,
+            };
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+            await db.workspaces.updateStatus(workspace.id, 'error', {
+                errorMessage,
+            });
+            return {
+                workspaceId: workspace.id,
+                status: 'error',
+                error: errorMessage,
+            };
+        }
+    }
+    /**
+     * Deprovision a workspace
+     */
+    async deprovision(workspaceId) {
+        const workspace = await db.workspaces.findById(workspaceId);
+        if (!workspace) {
+            throw new Error('Workspace not found');
+        }
+        await this.provisioner.deprovision(workspace);
+        await db.workspaces.delete(workspaceId);
+    }
+    /**
+     * Get workspace status
+     */
+    async getStatus(workspaceId) {
+        const workspace = await db.workspaces.findById(workspaceId);
+        if (!workspace) {
+            throw new Error('Workspace not found');
+        }
+        const status = await this.provisioner.getStatus(workspace);
+        // Update database if status changed
+        if (status !== workspace.status) {
+            await db.workspaces.updateStatus(workspaceId, status);
+        }
+        return status;
+    }
+    /**
+     * Restart a workspace
+     */
+    async restart(workspaceId) {
+        const workspace = await db.workspaces.findById(workspaceId);
+        if (!workspace) {
+            throw new Error('Workspace not found');
+        }
+        await this.provisioner.restart(workspace);
+    }
+    /**
+     * Stop a workspace
+     */
+    async stop(workspaceId) {
+        const workspace = await db.workspaces.findById(workspaceId);
+        if (!workspace) {
+            throw new Error('Workspace not found');
+        }
+        // For now, just deprovision to stop
+        await this.provisioner.deprovision(workspace);
+        await db.workspaces.updateStatus(workspaceId, 'stopped');
+    }
+    /**
+     * Resize a workspace (vertical scaling)
+     */
+    async resize(workspaceId, tier) {
+        const workspace = await db.workspaces.findById(workspaceId);
+        if (!workspace) {
+            throw new Error('Workspace not found');
+        }
+        if (!this.provisioner.resize) {
+            throw new Error('Resize not supported by current compute provider');
+        }
+        await this.provisioner.resize(workspace, tier);
+        // Update workspace config with new limits
+        await db.workspaces.updateConfig(workspaceId, {
+            ...workspace.config,
+            maxAgents: tier.maxAgents,
+            resourceTier: tier.name,
+        });
+    }
+    /**
+     * Update the max agent limit for a workspace
+     */
+    async updateAgentLimit(workspaceId, newLimit) {
+        const workspace = await db.workspaces.findById(workspaceId);
+        if (!workspace) {
+            throw new Error('Workspace not found');
+        }
+        if (this.provisioner.updateAgentLimit) {
+            await this.provisioner.updateAgentLimit(workspace, newLimit);
+        }
+        // Update workspace config
+        await db.workspaces.updateConfig(workspaceId, {
+            ...workspace.config,
+            maxAgents: newLimit,
+        });
+    }
+    /**
+     * Get current resource tier for a workspace
+     */
+    async getCurrentTier(workspaceId) {
+        const workspace = await db.workspaces.findById(workspaceId);
+        if (!workspace) {
+            throw new Error('Workspace not found');
+        }
+        if (this.provisioner.getCurrentTier) {
+            return this.provisioner.getCurrentTier(workspace);
+        }
+        // Fallback: determine from config or default to small
+        const tierName = workspace.config.resourceTier || 'small';
+        return RESOURCE_TIERS[tierName] || RESOURCE_TIERS.small;
+    }
+}
+// Singleton instance
+let _provisioner = null;
+export function getProvisioner() {
+    if (!_provisioner) {
+        _provisioner = new WorkspaceProvisioner();
+    }
+    return _provisioner;
+}
+//# sourceMappingURL=index.js.map