agent-relay 1.0.22 → 1.2.0

package/dist/cloud/api/daemons.js

@@ -0,0 +1,320 @@
+/**
+ * Linked Daemons API Routes
+ *
+ * Allows local agent-relay instances to register and link with cloud.
+ * This enables:
+ * - Credential sync from cloud to local
+ * - Remote monitoring of local agents
+ * - Cross-machine agent discovery
+ * - Centralized dashboard for all instances
+ */
+import { Router } from 'express';
+import { randomBytes, createHash } from 'crypto';
+import { requireAuth } from './auth.js';
+import { db } from '../db/index.js';
+import { vault } from '../vault/index.js';
+export const daemonsRouter = Router();
+/**
+ * Generate a secure API key
+ */
+function generateApiKey() {
+    // Format: ar_live_<32 random bytes as hex>
+    const random = randomBytes(32).toString('hex');
+    return `ar_live_${random}`;
+}
+/**
+ * Hash an API key for storage
+ */
+function hashApiKey(apiKey) {
+    return createHash('sha256').update(apiKey).digest('hex');
+}
+/**
+ * POST /api/daemons/link
+ * Register a local daemon with the cloud (requires browser auth first)
+ *
+ * Flow:
+ * 1. User runs `agent-relay cloud link` in terminal
+ * 2. CLI opens browser to /cloud/link?code=<temp_code>
+ * 3. User authenticates (or is already logged in)
+ * 4. Browser shows confirmation, user clicks "Link"
+ * 5. Server generates API key and returns to CLI via the temp code
+ */
+daemonsRouter.post('/link', requireAuth, async (req, res) => {
+    const userId = req.session.userId;
+    const { name, machineId, metadata } = req.body;
+    if (!machineId || typeof machineId !== 'string') {
+        return res.status(400).json({ error: 'machineId is required' });
+    }
+    try {
+        // Check if this machine is already linked
+        const existing = await db.linkedDaemons.findByMachineId(userId, machineId);
+        if (existing) {
+            // Regenerate API key for existing link
+            const apiKey = generateApiKey();
+            const apiKeyHash = hashApiKey(apiKey);
+            await db.linkedDaemons.update(existing.id, {
+                name: name || existing.name,
+                apiKeyHash,
+                metadata: metadata || existing.metadata,
+                status: 'online',
+                lastSeenAt: new Date(),
+            });
+            return res.json({
+                success: true,
+                daemonId: existing.id,
+                apiKey, // Only returned once!
+                message: 'Daemon re-linked with new API key',
+            });
+        }
+        // Create new linked daemon
+        const apiKey = generateApiKey();
+        const apiKeyHash = hashApiKey(apiKey);
+        const daemon = await db.linkedDaemons.create({
+            userId,
+            name: name || `Daemon on ${machineId.substring(0, 8)}`,
+            machineId,
+            apiKeyHash,
+            status: 'online',
+            metadata: metadata || {},
+        });
+        res.status(201).json({
+            success: true,
+            daemonId: daemon.id,
+            apiKey, // Only returned once - user must save this!
+            message: 'Daemon linked successfully. Save your API key - it cannot be retrieved later.',
+        });
+    }
+    catch (error) {
+        console.error('Error linking daemon:', error);
+        res.status(500).json({ error: 'Failed to link daemon' });
+    }
+});
+/**
+ * GET /api/daemons
+ * List user's linked daemons
+ */
+daemonsRouter.get('/', requireAuth, async (req, res) => {
+    const userId = req.session.userId;
+    try {
+        const daemons = await db.linkedDaemons.findByUserId(userId);
+        res.json({
+            daemons: daemons.map((d) => ({
+                id: d.id,
+                name: d.name,
+                machineId: d.machineId,
+                status: d.status,
+                lastSeenAt: d.lastSeenAt,
+                metadata: d.metadata,
+                createdAt: d.createdAt,
+            })),
+        });
+    }
+    catch (error) {
+        console.error('Error listing daemons:', error);
+        res.status(500).json({ error: 'Failed to list daemons' });
+    }
+});
+/**
+ * DELETE /api/daemons/:id
+ * Unlink a daemon
+ */
+daemonsRouter.delete('/:id', requireAuth, async (req, res) => {
+    const userId = req.session.userId;
+    const { id } = req.params;
+    try {
+        const daemon = await db.linkedDaemons.findById(id);
+        if (!daemon) {
+            return res.status(404).json({ error: 'Daemon not found' });
+        }
+        if (daemon.userId !== userId) {
+            return res.status(403).json({ error: 'Unauthorized' });
+        }
+        await db.linkedDaemons.delete(id);
+        res.json({ success: true, message: 'Daemon unlinked' });
+    }
+    catch (error) {
+        console.error('Error unlinking daemon:', error);
+        res.status(500).json({ error: 'Failed to unlink daemon' });
+    }
+});
+// ============================================================================
+// Daemon API (authenticated with API key, not session)
+// These endpoints are called by local daemons, not browsers
+// ============================================================================
+/**
+ * Middleware to authenticate daemon by API key
+ */
+async function requireDaemonAuth(req, res, next) {
+    const authHeader = req.headers.authorization;
+    if (!authHeader || !authHeader.startsWith('Bearer ar_live_')) {
+        res.status(401).json({ error: 'Invalid API key format' });
+        return;
+    }
+    const apiKey = authHeader.replace('Bearer ', '');
+    const apiKeyHash = hashApiKey(apiKey);
+    try {
+        const daemon = await db.linkedDaemons.findByApiKeyHash(apiKeyHash);
+        if (!daemon) {
+            res.status(401).json({ error: 'Invalid API key' });
+            return;
+        }
+        // Update last seen
+        await db.linkedDaemons.updateLastSeen(daemon.id);
+        // Attach daemon info to request
+        req.daemon = daemon;
+        next();
+    }
+    catch (error) {
+        console.error('Daemon auth error:', error);
+        res.status(500).json({ error: 'Authentication failed' });
+    }
+}
+/**
+ * POST /api/daemons/heartbeat
+ * Daemon heartbeat - reports status and gets any pending commands
+ */
+daemonsRouter.post('/heartbeat', requireDaemonAuth, async (req, res) => {
+    const daemon = req.daemon;
+    const { agents, metrics } = req.body;
+    try {
+        // Update daemon status with agent info
+        await db.linkedDaemons.update(daemon.id, {
+            status: 'online',
+            metadata: {
+                ...daemon.metadata,
+                agents: agents || [],
+                metrics: metrics || {},
+                lastHeartbeat: new Date().toISOString(),
+            },
+        });
+        // Check for any pending commands (credential updates, etc.)
+        const pendingUpdates = await db.linkedDaemons.getPendingUpdates(daemon.id);
+        res.json({
+            success: true,
+            commands: pendingUpdates,
+        });
+    }
+    catch (error) {
+        console.error('Error processing heartbeat:', error);
+        res.status(500).json({ error: 'Failed to process heartbeat' });
+    }
+});
+/**
+ * GET /api/daemons/credentials
+ * Get credentials for the daemon's user (syncs cloud credentials to local)
+ */
+daemonsRouter.get('/credentials', requireDaemonAuth, async (req, res) => {
+    const daemon = req.daemon;
+    try {
+        // Get all decrypted credentials for the user via vault
+        const credentialsMap = await vault.getUserCredentials(daemon.userId);
+        // Convert Map to array format for API response
+        const credentials = Array.from(credentialsMap.entries()).map(([provider, cred]) => ({
+            provider,
+            accessToken: cred.accessToken,
+            tokenType: 'bearer',
+            expiresAt: cred.tokenExpiresAt,
+        }));
+        res.json({ credentials });
+    }
+    catch (error) {
+        console.error('Error fetching credentials:', error);
+        res.status(500).json({ error: 'Failed to fetch credentials' });
+    }
+});
+/**
+ * POST /api/daemons/agents
+ * Report agent list to cloud (for cross-machine discovery)
+ */
+daemonsRouter.post('/agents', requireDaemonAuth, async (req, res) => {
+    const daemon = req.daemon;
+    const { agents } = req.body;
+    if (!agents || !Array.isArray(agents)) {
+        return res.status(400).json({ error: 'agents array is required' });
+    }
+    try {
+        // Store agent list in daemon metadata
+        await db.linkedDaemons.update(daemon.id, {
+            metadata: {
+                ...daemon.metadata,
+                agents,
+                lastAgentSync: new Date().toISOString(),
+            },
+        });
+        // Get agents from all linked daemons for this user (cross-machine discovery)
+        const allDaemons = await db.linkedDaemons.findByUserId(daemon.userId);
+        const allAgents = allDaemons.flatMap((d) => {
+            const metadata = d.metadata;
+            const dAgents = metadata?.agents || [];
+            return dAgents.map((a) => ({
+                ...a,
+                daemonId: d.id,
+                daemonName: d.name,
+                machineId: d.machineId,
+            }));
+        });
+        res.json({
+            success: true,
+            allAgents, // Return all agents across all linked daemons
+        });
+    }
+    catch (error) {
+        console.error('Error syncing agents:', error);
+        res.status(500).json({ error: 'Failed to sync agents' });
+    }
+});
+/**
+ * POST /api/daemons/message
+ * Send message to an agent on another machine (cross-machine relay)
+ */
+daemonsRouter.post('/message', requireDaemonAuth, async (req, res) => {
+    const daemon = req.daemon;
+    const { targetDaemonId, targetAgent, message } = req.body;
+    if (!targetDaemonId || !targetAgent || !message) {
+        return res.status(400).json({ error: 'targetDaemonId, targetAgent, and message are required' });
+    }
+    try {
+        // Verify target daemon belongs to same user
+        const targetDaemon = await db.linkedDaemons.findById(targetDaemonId);
+        if (!targetDaemon || targetDaemon.userId !== daemon.userId) {
+            return res.status(404).json({ error: 'Target daemon not found' });
+        }
+        // Queue message for delivery
+        await db.linkedDaemons.queueMessage(targetDaemonId, {
+            from: {
+                daemonId: daemon.id,
+                daemonName: daemon.name,
+                agent: message.from,
+            },
+            to: targetAgent,
+            content: message.content,
+            metadata: message.metadata,
+            timestamp: new Date().toISOString(),
+        });
+        res.json({ success: true, message: 'Message queued for delivery' });
+    }
+    catch (error) {
+        console.error('Error sending cross-machine message:', error);
+        res.status(500).json({ error: 'Failed to send message' });
+    }
+});
+/**
+ * GET /api/daemons/messages
+ * Get pending messages for this daemon (cross-machine messages)
+ */
+daemonsRouter.get('/messages', requireDaemonAuth, async (req, res) => {
+    const daemon = req.daemon;
+    try {
+        const messages = await db.linkedDaemons.getQueuedMessages(daemon.id);
+        // Clear the queue after fetching
+        if (messages.length > 0) {
+            await db.linkedDaemons.clearMessageQueue(daemon.id);
+        }
+        res.json({ messages });
+    }
+    catch (error) {
+        console.error('Error fetching messages:', error);
+        res.status(500).json({ error: 'Failed to fetch messages' });
+    }
+});
+//# sourceMappingURL=daemons.js.map

package/dist/cloud/api/daemons.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemons.js","sourceRoot":"","sources":["../../../src/cloud/api/daemons.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,MAAM,EAAqB,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAE1C,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC;AAEtC;;GAEG;AACH,SAAS,cAAc;IACrB,2CAA2C;IAC3C,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,WAAW,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;GAUG;AACH,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IAC7E,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAO,CAAC;IACnC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;IAE/C,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,CAAC;QACH,0CAA0C;QAC1C,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAE3E,IAAI,QAAQ,EAAE,CAAC;YACb,uCAAuC;YACvC,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;YAChC,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YAEtC,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE;gBACzC,IAAI,EAAE,IAAI,IAAI,QAAQ,CAAC,IAAI;gBAC3B,UAAU;gBACV,QAAQ,EAAE,QAAQ,IAAI,QAAQ,CAAC,QAAQ;gBACvC,MAAM,EAAE,QAAQ;gBAChB,UAAU,EAAE,IAAI,IAAI,EAAE;aACvB,CAAC,CAAC;YAEH,OAAO,GAAG,CAAC,IAAI,CAAC;gBACd,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,QAAQ,CAAC,EAAE;gBACrB,MAAM,EAAE,sBAAsB;gBAC9B,OAAO,EAAE,mCAAmC;aAC7C,CAAC,CAAC;QACL,CAAC;QAED,2BAA2B;QAC3B,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;QAChC,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAEtC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC;YAC3C,MAAM;YACN,IAAI,EAAE,IAAI,IAAI,aAAa,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;YACtD,SAAS;YACT,UAAU;YACV,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,QAAQ,IAAI,EAAE;SACzB,CAAC,CAAC;QAEH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,MAAM,EAAE,4CAA4C;YACpD,OAAO,EAAE,+EAA+E;SACzF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;QAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IACxE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAO,CAAC;IAEnC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAE5D,GAAG,CAAC,IAAI,CAAC;YACP,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC3B,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,SAAS,EAAE,CAAC,CAAC,SAAS;aACvB,CAAC,CAAC;SACJ,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;QAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IAC9E,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAO,CAAC;IACnC,MAAM,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;IAE1B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAEnD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC7B,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAElC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;QAChD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,+EAA+E;AAC/E,uDAAuD;AACvD,4DAA4D;AAC5D,+EAA+E;AAE/E;;GAEG;AACH,KAAK,UAAU,iBAAiB,CAC9B,GAAY,EACZ,GAAa,EACb,IAAgB;IAEhB,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAE7C,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAEtC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAEnE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,mBAAmB;QACnB,MAAM,EAAE,CAAC,aAAa,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAEjD,gCAAgC;QAC/B,GAAW,CAAC,MAAM,GAAG,MAAM,CAAC;QAC7B,IAAI,EAAE,CAAC;IACT,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;QAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,iBAAwB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IAC/F,MAAM,MAAM,GAAI,GAAW,CAAC,MAAM,CAAC;IACnC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;IAErC,IAAI,CAAC;QACH,uCAAuC;QACvC,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE;YACvC,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE;gBACR,GAAG,MAAM,CAAC,QAAQ;gBAClB,MAAM,EAAE,MAAM,IAAI,EAAE;gBACpB,OAAO,EAAE,OAAO,IAAI,EAAE;gBACtB,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACxC;SACF,CAAC,CAAC;QAEH,4DAA4D;QAC5D,MAAM,cAAc,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAE3E,GAAG,CAAC,IAAI,CAAC;YACP,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,cAAc;SACzB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;QACpD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,aAAa,CAAC,GAAG,CAAC,cAAc,EAAE,iBAAwB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IAChG,MAAM,MAAM,GAAI,GAAW,CAAC,MAAM,CAAC;IAEnC,IAAI,CAAC;QACH,uDAAuD;QACvD,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAErE,+CAA+C;QAC/C,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAClF,QAAQ;YACR,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,QAAQ;YACnB,SAAS,EAAE,IAAI,CAAC,cAAc;SAC/B,CAAC,CAAC,CAAC;QAEJ,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;QACpD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAwB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IAC5F,MAAM,MAAM,GAAI,GAAW,CAAC,MAAM,CAAC;IACnC,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;IAE5B,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,CAAC;QACH,sCAAsC;QACtC,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE;YACvC,QAAQ,EAAE;gBACR,GAAG,MAAM,CAAC,QAAQ;gBAClB,MAAM;gBACN,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACxC;SACF,CAAC,CAAC;QAEH,6EAA6E;QAC7E,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;YACzC,MAAM,QAAQ,GAAG,CAAC,CAAC,QAA0C,CAAC;YAC9D,MAAM,OAAO,GAAI,QAAQ,EAAE,MAAkD,IAAI,EAAE,CAAC;YACpF,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACzB,GAAG,CAAC;gBACJ,QAAQ,EAAE,CAAC,CAAC,EAAE;gBACd,UAAU,EAAE,CAAC,CAAC,IAAI;gBAClB,SAAS,EAAE,CAAC,CAAC,SAAS;aACvB,CAAC,CAAC,CAAC;QACN,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CAAC;YACP,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,8CAA8C;SAC1D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;QAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAwB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IAC7F,MAAM,MAAM,GAAI,GAAW,CAAC,MAAM,CAAC;IACnC,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;IAE1D,IAAI,CAAC,cAAc,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;QAChD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uDAAuD,EAAE,CAAC,CAAC;IAClG,CAAC;IAED,IAAI,CAAC;QACH,4CAA4C;QAC5C,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAErE,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YAC3D,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,6BAA6B;QAC7B,MAAM,EAAE,CAAC,aAAa,CAAC,YAAY,CAAC,cAAc,EAAE;YAClD,IAAI,EAAE;gBACJ,QAAQ,EAAE,MAAM,CAAC,EAAE;gBACnB,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,KAAK,EAAE,OAAO,CAAC,IAAI;aACpB;YACD,EAAE,EAAE,WAAW;YACf,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;QAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,aAAa,CAAC,GAAG,CAAC,WAAW,EAAE,iBAAwB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IAC7F,MAAM,MAAM,GAAI,GAAW,CAAC,MAAM,CAAC;IAEnC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAErE,iCAAiC;QACjC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,EAAE,CAAC,aAAa,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtD,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAC;QACjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/cloud/api/generic-webhooks.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Generic Webhooks API Routes
+ *
+ * Provides endpoints for receiving webhooks from any configured source.
+ * Routes: POST /api/webhooks/:source
+ */
+export declare const genericWebhooksRouter: import("express-serve-static-core").Router;
+//# sourceMappingURL=generic-webhooks.d.ts.map

package/dist/cloud/api/generic-webhooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generic-webhooks.d.ts","sourceRoot":"","sources":["../../../src/cloud/api/generic-webhooks.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,eAAO,MAAM,qBAAqB,4CAAW,CAAC"}

package/dist/cloud/api/generic-webhooks.js

@@ -0,0 +1,129 @@
+/**
+ * Generic Webhooks API Routes
+ *
+ * Provides endpoints for receiving webhooks from any configured source.
+ * Routes: POST /api/webhooks/:source
+ */
+import { Router } from 'express';
+import { processWebhook, getWebhookConfig } from '../webhooks/index.js';
+export const genericWebhooksRouter = Router();
+/**
+ * POST /api/webhooks/:source
+ * Receive a webhook from any configured source
+ */
+genericWebhooksRouter.post('/:source', async (req, res) => {
+    const { source } = req.params;
+    // For Slack URL verification challenge
+    if (source === 'slack' && req.body?.type === 'url_verification') {
+        return res.json({ challenge: req.body.challenge });
+    }
+    try {
+        // Get raw body for signature verification
+        // Note: This requires express.raw() middleware or similar
+        const rawBody = typeof req.body === 'string'
+            ? req.body
+            : JSON.stringify(req.body);
+        const result = await processWebhook(source, rawBody, req.headers);
+        if (!result.success && result.responses[0]?.error === 'Invalid signature') {
+            return res.status(401).json({ error: 'Invalid signature' });
+        }
+        if (!result.success && result.responses[0]?.error?.includes('Unknown webhook source')) {
+            return res.status(404).json({ error: `Unknown webhook source: ${source}` });
+        }
+        console.log(`[webhooks] Processed ${source} webhook: ${result.eventType} (${result.matchedRules.length} rules matched)`);
+        res.json({
+            success: result.success,
+            eventId: result.eventId,
+            eventType: result.eventType,
+            matchedRules: result.matchedRules,
+            actionsExecuted: result.actions.length,
+        });
+    }
+    catch (error) {
+        console.error(`[webhooks] Error processing ${source} webhook:`, error);
+        res.status(500).json({
+            error: error instanceof Error ? error.message : 'Unknown error',
+        });
+    }
+});
+/**
+ * GET /api/webhooks/config
+ * Get the current webhook configuration (for debugging)
+ */
+genericWebhooksRouter.get('/config', (_req, res) => {
+    const config = getWebhookConfig();
+    res.json({
+        sources: Object.entries(config.sources).map(([id, source]) => ({
+            id,
+            name: source.name,
+            enabled: source.enabled,
+            parser: source.parser,
+            responder: source.responder,
+        })),
+        rules: config.rules.map(rule => ({
+            id: rule.id,
+            name: rule.name,
+            enabled: rule.enabled,
+            source: rule.source,
+            eventType: rule.eventType,
+            condition: rule.condition,
+            actionType: rule.action.type,
+            priority: rule.priority,
+        })),
+    });
+});
+/**
+ * GET /api/webhooks/sources
+ * List available webhook sources with their setup instructions
+ */
+genericWebhooksRouter.get('/sources', (_req, res) => {
+    const baseUrl = process.env.PUBLIC_URL || 'https://your-domain.com';
+    res.json({
+        sources: [
+            {
+                id: 'github',
+                name: 'GitHub',
+                webhookUrl: `${baseUrl}/api/webhooks/github`,
+                setupInstructions: [
+                    '1. Go to your repository Settings > Webhooks > Add webhook',
+                    `2. Set Payload URL to: ${baseUrl}/api/webhooks/github`,
+                    '3. Set Content type to: application/json',
+                    '4. Set Secret to your GITHUB_WEBHOOK_SECRET value',
+                    '5. Select events: Check runs, Issues, Issue comments, Pull request review comments',
+                ],
+                requiredEnvVars: ['GITHUB_WEBHOOK_SECRET'],
+                events: ['check_run', 'issues', 'issue_comment', 'pull_request_review_comment'],
+            },
+            {
+                id: 'linear',
+                name: 'Linear',
+                webhookUrl: `${baseUrl}/api/webhooks/linear`,
+                setupInstructions: [
+                    '1. Go to Linear Settings > API > Webhooks',
+                    '2. Create a new webhook',
+                    `3. Set URL to: ${baseUrl}/api/webhooks/linear`,
+                    '4. Copy the signing secret to LINEAR_WEBHOOK_SECRET',
+                    '5. Select events: Issues, Comments',
+                ],
+                requiredEnvVars: ['LINEAR_WEBHOOK_SECRET', 'LINEAR_API_KEY'],
+                events: ['Issue', 'Comment', 'IssueLabel'],
+            },
+            {
+                id: 'slack',
+                name: 'Slack',
+                webhookUrl: `${baseUrl}/api/webhooks/slack`,
+                setupInstructions: [
+                    '1. Create a Slack App at api.slack.com/apps',
+                    '2. Enable Event Subscriptions',
+                    `3. Set Request URL to: ${baseUrl}/api/webhooks/slack`,
+                    '4. Subscribe to bot events: app_mention, message.channels',
+                    '5. Copy Signing Secret to SLACK_SIGNING_SECRET',
+                    '6. Install the app to your workspace',
+                ],
+                requiredEnvVars: ['SLACK_SIGNING_SECRET', 'SLACK_BOT_TOKEN'],
+                events: ['app_mention', 'message', 'reaction_added'],
+            },
+        ],
+    });
+});
+//# sourceMappingURL=generic-webhooks.js.map

package/dist/cloud/api/generic-webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generic-webhooks.js","sourceRoot":"","sources":["../../../src/cloud/api/generic-webhooks.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAqB,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExE,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,EAAE,CAAC;AAE9C;;;GAGG;AACH,qBAAqB,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IAC3E,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;IAE9B,uCAAuC;IACvC,IAAI,MAAM,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAChE,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,CAAC;QACH,0CAA0C;QAC1C,0DAA0D;QAC1D,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;YAC1C,CAAC,CAAC,GAAG,CAAC,IAAI;YACV,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAE7B,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,MAAM,EACN,OAAO,EACP,GAAG,CAAC,OAAwD,CAC7D,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,mBAAmB,EAAE,CAAC;YAC1E,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC;YACtF,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,aAAa,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,YAAY,CAAC,MAAM,iBAAiB,CAAC,CAAC;QAEzH,GAAG,CAAC,IAAI,CAAC;YACP,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;SACvC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,+BAA+B,MAAM,WAAW,EAAE,KAAK,CAAC,CAAC;QACvE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SAChE,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,qBAAqB,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;IACpE,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAElC,GAAG,CAAC,IAAI,CAAC;QACP,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7D,EAAE;YACF,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QACH,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/B,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;KACJ,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,qBAAqB,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;IACrE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,yBAAyB,CAAC;IAEpE,GAAG,CAAC,IAAI,CAAC;QACP,OAAO,EAAE;YACP;gBACE,EAAE,EAAE,QAAQ;gBACZ,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,GAAG,OAAO,sBAAsB;gBAC5C,iBAAiB,EAAE;oBACjB,4DAA4D;oBAC5D,0BAA0B,OAAO,sBAAsB;oBACvD,0CAA0C;oBAC1C,mDAAmD;oBACnD,oFAAoF;iBACrF;gBACD,eAAe,EAAE,CAAC,uBAAuB,CAAC;gBAC1C,MAAM,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,eAAe,EAAE,6BAA6B,CAAC;aAChF;YACD;gBACE,EAAE,EAAE,QAAQ;gBACZ,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,GAAG,OAAO,sBAAsB;gBAC5C,iBAAiB,EAAE;oBACjB,2CAA2C;oBAC3C,yBAAyB;oBACzB,kBAAkB,OAAO,sBAAsB;oBAC/C,qDAAqD;oBACrD,oCAAoC;iBACrC;gBACD,eAAe,EAAE,CAAC,uBAAuB,EAAE,gBAAgB,CAAC;gBAC5D,MAAM,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC;aAC3C;YACD;gBACE,EAAE,EAAE,OAAO;gBACX,IAAI,EAAE,OAAO;gBACb,UAAU,EAAE,GAAG,OAAO,qBAAqB;gBAC3C,iBAAiB,EAAE;oBACjB,6CAA6C;oBAC7C,+BAA+B;oBAC/B,0BAA0B,OAAO,qBAAqB;oBACtD,2DAA2D;oBAC3D,gDAAgD;oBAChD,sCAAsC;iBACvC;gBACD,eAAe,EAAE,CAAC,sBAAsB,EAAE,iBAAiB,CAAC;gBAC5D,MAAM,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,gBAAgB,CAAC;aACrD;SACF;KACF,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/cloud/api/git.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Git Gateway API Routes
+ *
+ * Provides fresh GitHub tokens to workspace containers for git operations.
+ * This gateway pattern ensures tokens are always valid (Nango handles refresh).
+ */
+export declare const gitRouter: import("express-serve-static-core").Router;
+//# sourceMappingURL=git.d.ts.map

package/dist/cloud/api/git.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../../../src/cloud/api/git.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,eAAO,MAAM,SAAS,4CAAW,CAAC"}

package/dist/cloud/api/git.js

@@ -0,0 +1,131 @@
+/**
+ * Git Gateway API Routes
+ *
+ * Provides fresh GitHub tokens to workspace containers for git operations.
+ * This gateway pattern ensures tokens are always valid (Nango handles refresh).
+ */
+import crypto from 'crypto';
+import { Router } from 'express';
+import { db } from '../db/index.js';
+import { nangoService } from '../services/nango.js';
+import { getConfig } from '../config.js';
+export const gitRouter = Router();
+/**
+ * Generate expected workspace token using HMAC
+ */
+function generateExpectedToken(workspaceId) {
+    const config = getConfig();
+    return crypto
+        .createHmac('sha256', config.sessionSecret)
+        .update(`workspace:${workspaceId}`)
+        .digest('hex');
+}
+/**
+ * Verify workspace access token
+ * Workspaces authenticate with a secret passed at provisioning time
+ */
+function verifyWorkspaceToken(req, workspaceId) {
+    const authHeader = req.get('authorization');
+    if (!authHeader?.startsWith('Bearer ')) {
+        return false;
+    }
+    const providedToken = authHeader.slice(7);
+    const expectedToken = generateExpectedToken(workspaceId);
+    // Use timing-safe comparison to prevent timing attacks
+    try {
+        return crypto.timingSafeEqual(Buffer.from(providedToken), Buffer.from(expectedToken));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * GET /api/git/token
+ * Get a fresh GitHub token for git operations
+ *
+ * Query params:
+ *   - workspaceId: The workspace requesting the token
+ *
+ * Returns: { token: string, expiresAt?: string }
+ *
+ * This endpoint is called by the git credential helper in workspace containers.
+ * It fetches a fresh GitHub App installation token via Nango.
+ */
+gitRouter.get('/token', async (req, res) => {
+    const { workspaceId } = req.query;
+    if (!workspaceId || typeof workspaceId !== 'string') {
+        return res.status(400).json({ error: 'workspaceId is required' });
+    }
+    // Verify the request is from a valid workspace
+    if (!verifyWorkspaceToken(req, workspaceId)) {
+        return res.status(401).json({ error: 'Invalid workspace token' });
+    }
+    try {
+        // Get workspace to find the user
+        const workspace = await db.workspaces.findById(workspaceId);
+        if (!workspace) {
+            return res.status(404).json({ error: 'Workspace not found' });
+        }
+        const userId = workspace.userId;
+        // Find a repository with a Nango connection for this user
+        const repos = await db.repositories.findByUserId(userId);
+        const repoWithConnection = repos.find(r => r.nangoConnectionId);
+        if (!repoWithConnection?.nangoConnectionId) {
+            return res.status(404).json({
+                error: 'No GitHub App connection found',
+                hint: 'Connect a repository via the GitHub App to enable git operations',
+            });
+        }
+        // Get fresh token from Nango (auto-refreshes if needed)
+        const token = await nangoService.getGithubAppToken(repoWithConnection.nangoConnectionId);
+        // GitHub App installation tokens expire after 1 hour
+        const expiresAt = new Date(Date.now() + 55 * 60 * 1000).toISOString(); // 55 min buffer
+        res.json({
+            token,
+            expiresAt,
+            username: 'x-access-token', // GitHub App tokens use this as username
+        });
+    }
+    catch (error) {
+        console.error('[git] Error getting token:', error);
+        res.status(500).json({ error: 'Failed to get GitHub token' });
+    }
+});
+/**
+ * POST /api/git/token
+ * Same as GET but accepts body params (for compatibility with some git credential helpers)
+ */
+gitRouter.post('/token', async (req, res) => {
+    const workspaceId = req.body.workspaceId || req.query.workspaceId;
+    if (!workspaceId || typeof workspaceId !== 'string') {
+        return res.status(400).json({ error: 'workspaceId is required' });
+    }
+    if (!verifyWorkspaceToken(req, workspaceId)) {
+        return res.status(401).json({ error: 'Invalid workspace token' });
+    }
+    try {
+        const workspace = await db.workspaces.findById(workspaceId);
+        if (!workspace) {
+            return res.status(404).json({ error: 'Workspace not found' });
+        }
+        const repos = await db.repositories.findByUserId(workspace.userId);
+        const repoWithConnection = repos.find(r => r.nangoConnectionId);
+        if (!repoWithConnection?.nangoConnectionId) {
+            return res.status(404).json({
+                error: 'No GitHub App connection found',
+            });
+        }
+        const token = await nangoService.getGithubAppToken(repoWithConnection.nangoConnectionId);
+        const expiresAt = new Date(Date.now() + 55 * 60 * 1000).toISOString();
+        res.json({
+            token,
+            expiresAt,
+            username: 'x-access-token',
+        });
+    }
+    catch (error) {
+        console.error('[git] Error getting token:', error);
+        res.status(500).json({ error: 'Failed to get GitHub token' });
+    }
+});
+//# sourceMappingURL=git.js.map

package/dist/cloud/api/git.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.js","sourceRoot":"","sources":["../../../src/cloud/api/git.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAqB,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC;AAElC;;GAEG;AACH,SAAS,qBAAqB,CAAC,WAAmB;IAChD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,OAAO,MAAM;SACV,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,aAAa,CAAC;SAC1C,MAAM,CAAC,aAAa,WAAW,EAAE,CAAC;SAClC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAAC,GAAY,EAAE,WAAmB;IAC7D,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC5C,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,aAAa,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;IAEzD,uDAAuD;IACvD,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,eAAe,CAC3B,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,EAC1B,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAC3B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IAC5D,MAAM,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;IAElC,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,+CAA+C;IAC/C,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;QAC5C,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,CAAC;QACH,iCAAiC;QACjC,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC5D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;QAEhC,0DAA0D;QAC1D,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,kBAAkB,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAEhE,IAAI,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,CAAC;YAC3C,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,gCAAgC;gBACvC,IAAI,EAAE,kEAAkE;aACzE,CAAC,CAAC;QACL,CAAC;QAED,wDAAwD;QACxD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;QAEzF,qDAAqD;QACrD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,gBAAgB;QAEvF,GAAG,CAAC,IAAI,CAAC;YACP,KAAK;YACL,SAAS;YACT,QAAQ,EAAE,gBAAgB,EAAE,yCAAyC;SACtE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;QACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;IAChE,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IAC7D,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC;IAElE,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;QAC5C,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC5D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACnE,MAAM,kBAAkB,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAEhE,IAAI,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,CAAC;YAC3C,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,gCAAgC;aACxC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,CAAC;QACzF,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAEtE,GAAG,CAAC,IAAI,CAAC;YACP,KAAK;YACL,SAAS;YACT,QAAQ,EAAE,gBAAgB;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;QACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC,CAAC;IAChE,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/cloud/api/github-app.d.ts

@@ -0,0 +1,11 @@
+/**
+ * GitHub App API Routes
+ *
+ * Repo operations via Nango's github-app-oauth connection:
+ * - Get clone token for repositories
+ * - Create issues, PRs, and comments
+ *
+ * Auth flow is handled by nango-auth.ts
+ */
+export declare const githubAppRouter: import("express-serve-static-core").Router;
+//# sourceMappingURL=github-app.d.ts.map

package/dist/cloud/api/github-app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-app.d.ts","sourceRoot":"","sources":["../../../src/cloud/api/github-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH,eAAO,MAAM,eAAe,4CAAW,CAAC"}