agent-relay 1.1.0 → 1.2.0

package/dist/cloud/api/nango-auth.js

@@ -0,0 +1,377 @@
+/**
+ * Nango Auth API Routes
+ *
+ * Handles GitHub OAuth via Nango with two-connection pattern:
+ * - github: User login (identity)
+ * - github-app-oauth: Repository access
+ */
+import { Router } from 'express';
+import { randomUUID } from 'crypto';
+import { requireAuth } from './auth.js';
+import { db } from '../db/index.js';
+import { nangoService, NANGO_INTEGRATIONS } from '../services/nango.js';
+export const nangoAuthRouter = Router();
+/**
+ * GET /api/auth/nango/status
+ * Check if Nango is configured
+ */
+nangoAuthRouter.get('/status', (req, res) => {
+    try {
+        res.json({
+            configured: true,
+            integrations: NANGO_INTEGRATIONS,
+        });
+    }
+    catch (_error) {
+        res.json({
+            configured: false,
+            message: 'Nango not configured',
+        });
+    }
+});
+/**
+ * GET /api/auth/nango/login-session
+ * Create a Nango connect session for GitHub login
+ */
+nangoAuthRouter.get('/login-session', async (req, res) => {
+    try {
+        const tempUserId = randomUUID();
+        const session = await nangoService.createConnectSession([NANGO_INTEGRATIONS.GITHUB_USER], { id: tempUserId });
+        res.json({ sessionToken: session.token, tempUserId });
+    }
+    catch (error) {
+        console.error('Error creating login session:', error);
+        res.status(500).json({ error: 'Failed to create login session' });
+    }
+});
+/**
+ * GET /api/auth/nango/login-status/:connectionId
+ * Poll for login completion after Nango connect UI
+ */
+nangoAuthRouter.get('/login-status/:connectionId', async (req, res) => {
+    const { connectionId } = req.params;
+    try {
+        // Check if a user exists with this incoming connection
+        const user = await db.users.findByIncomingConnectionId(connectionId);
+        if (!user) {
+            return res.json({ ready: false });
+        }
+        // Issue session
+        req.session.userId = user.id;
+        // Clear incoming connection ID
+        await db.users.clearIncomingConnectionId(user.id);
+        // Check if user has any repos connected
+        const repos = await db.repositories.findByUserId(user.id);
+        const hasRepos = repos.length > 0;
+        res.json({
+            ready: true,
+            hasRepos,
+            user: {
+                id: user.id,
+                githubUsername: user.githubUsername,
+                email: user.email,
+                avatarUrl: user.avatarUrl,
+                plan: user.plan,
+            },
+        });
+    }
+    catch (error) {
+        console.error('Error checking login status:', error);
+        res.status(500).json({ error: 'Failed to check login status' });
+    }
+});
+/**
+ * GET /api/auth/nango/repo-session
+ * Create a Nango connect session for GitHub App OAuth (repo access)
+ * Requires authentication
+ */
+nangoAuthRouter.get('/repo-session', requireAuth, async (req, res) => {
+    const userId = req.session.userId;
+    try {
+        const user = await db.users.findById(userId);
+        if (!user) {
+            return res.status(404).json({ error: 'User not found' });
+        }
+        const session = await nangoService.createConnectSession([NANGO_INTEGRATIONS.GITHUB_APP], { id: user.id, email: user.email || undefined });
+        res.json({ sessionToken: session.token });
+    }
+    catch (error) {
+        console.error('Error creating repo session:', error);
+        res.status(500).json({ error: 'Failed to create repo session' });
+    }
+});
+/**
+ * GET /api/auth/nango/repo-status/:connectionId
+ * Poll for repo sync completion after GitHub App OAuth
+ * Requires authentication
+ */
+nangoAuthRouter.get('/repo-status/:connectionId', requireAuth, async (req, res) => {
+    const userId = req.session.userId;
+    const { connectionId: _connectionId } = req.params;
+    try {
+        const user = await db.users.findById(userId);
+        if (!user) {
+            return res.status(404).json({ error: 'User not found' });
+        }
+        // Check for pending org approval
+        if (user.pendingInstallationRequest) {
+            return res.json({
+                ready: false,
+                pendingApproval: true,
+                message: 'Waiting for organization admin approval',
+            });
+        }
+        // Check if repos have been synced
+        const repos = await db.repositories.findByUserId(userId);
+        const reposFromConnection = repos.filter(r => r.syncStatus === 'synced' && r.nangoConnectionId);
+        if (reposFromConnection.length === 0) {
+            return res.json({ ready: false });
+        }
+        // Check workspace status for frontend visibility
+        const workspaces = await db.workspaces.findByUserId(userId);
+        const primaryWorkspace = workspaces[0];
+        res.json({
+            ready: true,
+            repos: reposFromConnection.map(r => ({
+                id: r.id,
+                fullName: r.githubFullName,
+                isPrivate: r.isPrivate,
+                defaultBranch: r.defaultBranch,
+            })),
+            workspace: primaryWorkspace ? {
+                id: primaryWorkspace.id,
+                name: primaryWorkspace.name,
+                status: primaryWorkspace.status,
+                publicUrl: primaryWorkspace.publicUrl,
+            } : null,
+            workspaceProvisioning: primaryWorkspace?.status === 'provisioning',
+        });
+    }
+    catch (error) {
+        console.error('Error checking repo status:', error);
+        res.status(500).json({ error: 'Failed to check repo status' });
+    }
+});
+// ============================================================================
+// Nango Webhook Handler
+// ============================================================================
+/**
+ * POST /api/auth/nango/webhook
+ * Handle Nango webhooks for auth and sync events
+ */
+nangoAuthRouter.post('/webhook', async (req, res) => {
+    // Use the preserved raw body from express.json verify callback
+    const rawBody = req.rawBody || JSON.stringify(req.body);
+    // Verify signature using the new verifyIncomingWebhookRequest method
+    const hasSignature = req.headers['x-nango-signature'] || req.headers['x-nango-hmac-sha256'];
+    const isDev = process.env.NODE_ENV !== 'production';
+    if (hasSignature) {
+        if (!nangoService.verifyWebhookSignature(rawBody, req.headers)) {
+            console.error('[nango-webhook] Invalid signature');
+            return res.status(401).json({ error: 'Invalid signature' });
+        }
+        console.log('[nango-webhook] Signature verified');
+    }
+    else if (!isDev) {
+        console.error('[nango-webhook] Missing signature in production');
+        return res.status(401).json({ error: 'Missing signature' });
+    }
+    else {
+        console.warn('[nango-webhook] Skipping signature verification in development (no signature)');
+    }
+    const payload = req.body;
+    console.log(`[nango-webhook] Received ${payload.type} event`, JSON.stringify(payload, null, 2));
+    try {
+        switch (payload.type) {
+            case 'auth':
+                await handleAuthWebhook(payload);
+                break;
+            case 'sync':
+                console.log('[nango-webhook] Sync event received');
+                break;
+            case 'forward':
+                // Nango forwards events from providers - typically not needed for our flow
+                console.log('[nango-webhook] Forward event from provider (ignored)');
+                break;
+            default:
+                console.log(`[nango-webhook] Unhandled event type: ${payload.type}`);
+        }
+        res.json({ success: true });
+    }
+    catch (error) {
+        console.error('[nango-webhook] Error processing webhook:', error);
+        res.status(500).json({ error: 'Failed to process webhook' });
+    }
+});
+/**
+ * Handle Nango auth webhook
+ */
+async function handleAuthWebhook(payload) {
+    const { connectionId, providerConfigKey, endUser } = payload;
+    console.log(`[nango-webhook] Auth event for ${providerConfigKey} (${connectionId})`);
+    if (providerConfigKey === NANGO_INTEGRATIONS.GITHUB_USER) {
+        await handleLoginWebhook(connectionId, endUser);
+    }
+    else if (providerConfigKey === NANGO_INTEGRATIONS.GITHUB_APP) {
+        await handleRepoAuthWebhook(connectionId, endUser);
+    }
+}
+/**
+ * Handle GitHub login webhook
+ *
+ * Three scenarios:
+ * 1. New user - Create user record, keep connection as permanent
+ * 2. Returning user with existing connection - Store incoming ID for polling, delete temp connection
+ * 3. Existing user, first connection - Set connection ID as permanent
+ */
+async function handleLoginWebhook(connectionId, _endUser) {
+    // Get GitHub user info via Nango proxy
+    const githubUser = await nangoService.getGithubUser(connectionId);
+    const githubId = String(githubUser.id);
+    // Check if user already exists
+    const existingUser = await db.users.findByGithubId(githubId);
+    // SCENARIO 1: New user
+    if (!existingUser) {
+        const newUser = await db.users.upsert({
+            githubId,
+            githubUsername: githubUser.login,
+            email: githubUser.email || null,
+            avatarUrl: githubUser.avatar_url || null,
+            nangoConnectionId: connectionId,
+            incomingConnectionId: connectionId,
+        });
+        // Update connection with real user ID
+        await nangoService.updateEndUser(connectionId, NANGO_INTEGRATIONS.GITHUB_USER, {
+            id: newUser.id,
+            email: newUser.email || undefined,
+        });
+        console.log(`[nango-webhook] New user created: ${githubUser.login}`);
+        return;
+    }
+    // SCENARIO 2: Returning user with existing connection - delete temp connection
+    if (existingUser.nangoConnectionId && existingUser.nangoConnectionId !== connectionId) {
+        console.log(`[nango-webhook] Returning user: ${githubUser.login}`, {
+            permanentConnectionId: existingUser.nangoConnectionId,
+            incomingConnectionId: connectionId,
+        });
+        // Store incoming connection ID for polling
+        await db.users.update(existingUser.id, {
+            incomingConnectionId: connectionId,
+            githubUsername: githubUser.login,
+            avatarUrl: githubUser.avatar_url || null,
+        });
+        // Delete the temporary connection from Nango to prevent duplicates
+        try {
+            await nangoService.deleteConnection(connectionId, NANGO_INTEGRATIONS.GITHUB_USER);
+            console.log(`[nango-webhook] Deleted temp connection for returning user`);
+        }
+        catch (error) {
+            console.error(`[nango-webhook] Failed to delete temp connection:`, error);
+            // Non-fatal - continue anyway
+        }
+        return;
+    }
+    // SCENARIO 3: Existing user, first connection (or same connection)
+    console.log(`[nango-webhook] First/same connection for existing user: ${githubUser.login}`);
+    await db.users.update(existingUser.id, {
+        nangoConnectionId: connectionId,
+        incomingConnectionId: connectionId,
+        githubUsername: githubUser.login,
+        avatarUrl: githubUser.avatar_url || null,
+    });
+    // Update connection with user ID
+    await nangoService.updateEndUser(connectionId, NANGO_INTEGRATIONS.GITHUB_USER, {
+        id: existingUser.id,
+        email: existingUser.email || undefined,
+    });
+}
+/**
+ * Handle GitHub App OAuth webhook (repo access)
+ */
+async function handleRepoAuthWebhook(connectionId, endUser) {
+    let userId = endUser?.id;
+    // Fallback: If endUser.id not in webhook, fetch connection metadata from Nango
+    if (!userId) {
+        console.log('[nango-webhook] No user ID in webhook payload, fetching from connection metadata...');
+        try {
+            const connection = await nangoService.getConnection(connectionId, NANGO_INTEGRATIONS.GITHUB_APP);
+            userId = connection.end_user?.id;
+            console.log(`[nango-webhook] Got user ID from connection: ${userId || 'not found'}`);
+        }
+        catch (err) {
+            console.error('[nango-webhook] Failed to fetch connection metadata:', err);
+        }
+    }
+    if (!userId) {
+        console.error('[nango-webhook] No user ID found - cannot sync repos');
+        return;
+    }
+    const user = await db.users.findById(userId);
+    if (!user) {
+        console.error(`[nango-webhook] User ${userId} not found`);
+        return;
+    }
+    try {
+        // Get the GitHub App installation ID
+        const githubInstallationId = await nangoService.getGithubAppInstallationId(connectionId);
+        let installationUuid = null;
+        if (githubInstallationId) {
+            // Find or create the github_installations record
+            let installation = await db.githubInstallations.findByInstallationId(String(githubInstallationId));
+            if (!installation) {
+                // Create a new installation record
+                // We need to get more info about the installation - for now use user info
+                installation = await db.githubInstallations.upsert({
+                    installationId: String(githubInstallationId),
+                    accountType: 'user', // Could be 'organization' - we'd need to detect this
+                    accountLogin: user.githubUsername || 'unknown',
+                    accountId: user.githubId || 'unknown',
+                    installedById: user.id,
+                    permissions: {},
+                    events: [],
+                });
+                console.log(`[nango-webhook] Created installation record for ${githubInstallationId}`);
+            }
+            installationUuid = installation.id;
+        }
+        else {
+            console.warn('[nango-webhook] Could not get installation ID from Nango connection');
+        }
+        // Fetch repos the user has access to
+        const { repositories: repos } = await nangoService.listGithubAppRepos(connectionId);
+        // Sync repos to database
+        for (const repo of repos) {
+            await db.repositories.upsert({
+                userId: user.id,
+                githubFullName: repo.full_name,
+                githubId: repo.id,
+                isPrivate: repo.private,
+                defaultBranch: repo.default_branch,
+                nangoConnectionId: connectionId,
+                installationId: installationUuid,
+                syncStatus: 'synced',
+                lastSyncedAt: new Date(),
+            });
+        }
+        // Clear any pending installation request
+        await db.users.clearPendingInstallationRequest(user.id);
+        console.log(`[nango-webhook] Synced ${repos.length} repos for ${user.githubUsername} (installation: ${githubInstallationId || 'unknown'})`);
+        // Note: We intentionally do NOT auto-provision workspaces here.
+        // Users should go through the onboarding flow at /app to:
+        // 1. Name their workspace
+        // 2. Choose which repos to include
+        // 3. Understand what they're creating
+    }
+    catch (error) {
+        const err = error;
+        if (err.message?.includes('403')) {
+            // Org approval pending
+            await db.users.setPendingInstallationRequest(user.id);
+            console.log(`[nango-webhook] Org approval pending for ${user.githubUsername}`);
+        }
+        else {
+            throw error;
+        }
+    }
+}
+//# sourceMappingURL=nango-auth.js.map

package/dist/cloud/api/nango-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nango-auth.js","sourceRoot":"","sources":["../../../src/cloud/api/nango-auth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,EAAqB,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAExE,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,EAAE,CAAC;AAExC;;;GAGG;AACH,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;IAC7D,IAAI,CAAC;QACH,GAAG,CAAC,IAAI,CAAC;YACP,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,kBAAkB;SACjC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,GAAG,CAAC,IAAI,CAAC;YACP,UAAU,EAAE,KAAK;YACjB,OAAO,EAAE,sBAAsB;SAChC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,eAAe,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IAC1E,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,oBAAoB,CACrD,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAChC,EAAE,EAAE,EAAE,UAAU,EAAE,CACnB,CAAC;QAEF,GAAG,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;QACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAC;IACpE,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,eAAe,CAAC,GAAG,CAAC,6BAA6B,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IACvF,MAAM,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;IAEpC,IAAI,CAAC;QACH,uDAAuD;QACvD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,0BAA0B,CAAC,YAAY,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,gBAAgB;QAChB,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;QAE7B,+BAA+B;QAC/B,MAAM,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAElD,wCAAwC;QACxC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAElC,GAAG,CAAC,IAAI,CAAC;YACP,KAAK,EAAE,IAAI;YACX,QAAQ;YACR,IAAI,EAAE;gBACJ,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;QACrD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;IAClE,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;;GAIG;AACH,eAAe,CAAC,GAAG,CAAC,eAAe,EAAE,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IACtF,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAO,CAAC;IAEnC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,oBAAoB,CACrD,CAAC,kBAAkB,CAAC,UAAU,CAAC,EAC/B,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS,EAAE,CAChD,CAAC;QAEF,GAAG,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;QACrD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;;GAIG;AACH,eAAe,CAAC,GAAG,CAAC,4BAA4B,EAAE,WAAW,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IACnG,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAO,CAAC;IACnC,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;IAEnD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,iCAAiC;QACjC,IAAI,IAAI,CAAC,0BAA0B,EAAE,CAAC;YACpC,OAAO,GAAG,CAAC,IAAI,CAAC;gBACd,KAAK,EAAE,KAAK;gBACZ,eAAe,EAAE,IAAI;gBACrB,OAAO,EAAE,yCAAyC;aACnD,CAAC,CAAC;QACL,CAAC;QAED,kCAAkC;QAClC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,mBAAmB,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAEhG,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,iDAAiD;QACjD,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC5D,MAAM,gBAAgB,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAEvC,GAAG,CAAC,IAAI,CAAC;YACP,KAAK,EAAE,IAAI;YACX,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACnC,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,QAAQ,EAAE,CAAC,CAAC,cAAc;gBAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,aAAa,EAAE,CAAC,CAAC,aAAa;aAC/B,CAAC,CAAC;YACH,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC;gBAC5B,EAAE,EAAE,gBAAgB,CAAC,EAAE;gBACvB,IAAI,EAAE,gBAAgB,CAAC,IAAI;gBAC3B,MAAM,EAAE,gBAAgB,CAAC,MAAM;gBAC/B,SAAS,EAAE,gBAAgB,CAAC,SAAS;aACtC,CAAC,CAAC,CAAC,IAAI;YACR,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,KAAK,cAAc;SACnE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC;QACpD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E;;;GAGG;AACH,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IACrE,+DAA+D;IAC/D,MAAM,OAAO,GAAI,GAAsC,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAE5F,qEAAqE;IACrE,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC5F,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;IAEpD,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,OAAO,EAAE,GAAG,CAAC,OAAwD,CAAC,EAAE,CAAC;YAChH,OAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACnD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;IACpD,CAAC;SAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACjE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC9D,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IAChG,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC;IACzB,OAAO,CAAC,GAAG,CAAC,4BAA4B,OAAO,CAAC,IAAI,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAEhG,IAAI,CAAC;QACH,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,MAAM;gBACT,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;gBACjC,MAAM;YAER,KAAK,MAAM;gBACT,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;gBACnD,MAAM;YAER,KAAK,SAAS;gBACZ,2EAA2E;gBAC3E,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;gBACrE,MAAM;YAER;gBACE,OAAO,CAAC,GAAG,CAAC,yCAAyC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAC;QAClE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;GAEG;AACH,KAAK,UAAU,iBAAiB,CAAC,OAKhC;IACC,MAAM,EAAE,YAAY,EAAE,iBAAiB,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAE7D,OAAO,CAAC,GAAG,CAAC,kCAAkC,iBAAiB,KAAK,YAAY,GAAG,CAAC,CAAC;IAErF,IAAI,iBAAiB,KAAK,kBAAkB,CAAC,WAAW,EAAE,CAAC;QACzD,MAAM,kBAAkB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;SAAM,IAAI,iBAAiB,KAAK,kBAAkB,CAAC,UAAU,EAAE,CAAC;QAC/D,MAAM,qBAAqB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,kBAAkB,CAC/B,YAAoB,EACpB,QAA0C;IAE1C,uCAAuC;IACvC,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAEvC,+BAA+B;IAC/B,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAE7D,uBAAuB;IACvB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;YACpC,QAAQ;YACR,cAAc,EAAE,UAAU,CAAC,KAAK;YAChC,KAAK,EAAE,UAAU,CAAC,KAAK,IAAI,IAAI;YAC/B,SAAS,EAAE,UAAU,CAAC,UAAU,IAAI,IAAI;YACxC,iBAAiB,EAAE,YAAY;YAC/B,oBAAoB,EAAE,YAAY;SACnC,CAAC,CAAC;QAEH,sCAAsC;QACtC,MAAM,YAAY,CAAC,aAAa,CAAC,YAAY,EAAE,kBAAkB,CAAC,WAAW,EAAE;YAC7E,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,SAAS;SAClC,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,qCAAqC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IAED,+EAA+E;IAC/E,IAAI,YAAY,CAAC,iBAAiB,IAAI,YAAY,CAAC,iBAAiB,KAAK,YAAY,EAAE,CAAC;QACtF,OAAO,CAAC,GAAG,CAAC,mCAAmC,UAAU,CAAC,KAAK,EAAE,EAAE;YACjE,qBAAqB,EAAE,YAAY,CAAC,iBAAiB;YACrD,oBAAoB,EAAE,YAAY;SACnC,CAAC,CAAC;QAEH,2CAA2C;QAC3C,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE;YACrC,oBAAoB,EAAE,YAAY;YAClC,cAAc,EAAE,UAAU,CAAC,KAAK;YAChC,SAAS,EAAE,UAAU,CAAC,UAAU,IAAI,IAAI;SACzC,CAAC,CAAC;QAEH,mEAAmE;QACnE,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,gBAAgB,CAAC,YAAY,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC;YAClF,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,mDAAmD,EAAE,KAAK,CAAC,CAAC;YAC1E,8BAA8B;QAChC,CAAC;QAED,OAAO;IACT,CAAC;IAED,mEAAmE;IACnE,OAAO,CAAC,GAAG,CAAC,4DAA4D,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5F,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE;QACrC,iBAAiB,EAAE,YAAY;QAC/B,oBAAoB,EAAE,YAAY;QAClC,cAAc,EAAE,UAAU,CAAC,KAAK;QAChC,SAAS,EAAE,UAAU,CAAC,UAAU,IAAI,IAAI;KACzC,CAAC,CAAC;IAEH,iCAAiC;IACjC,MAAM,YAAY,CAAC,aAAa,CAAC,YAAY,EAAE,kBAAkB,CAAC,WAAW,EAAE;QAC7E,EAAE,EAAE,YAAY,CAAC,EAAE;QACnB,KAAK,EAAE,YAAY,CAAC,KAAK,IAAI,SAAS;KACvC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,qBAAqB,CAClC,YAAoB,EACpB,OAAyC;IAEzC,IAAI,MAAM,GAAG,OAAO,EAAE,EAAE,CAAC;IAEzB,+EAA+E;IAC/E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,qFAAqF,CAAC,CAAC;QACnG,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,aAAa,CAAC,YAAY,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC;YACjG,MAAM,GAAG,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,gDAAgD,MAAM,IAAI,WAAW,EAAE,CAAC,CAAC;QACvF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,sDAAsD,EAAE,GAAG,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,KAAK,CAAC,wBAAwB,MAAM,YAAY,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,qCAAqC;QACrC,MAAM,oBAAoB,GAAG,MAAM,YAAY,CAAC,0BAA0B,CAAC,YAAY,CAAC,CAAC;QACzF,IAAI,gBAAgB,GAAkB,IAAI,CAAC;QAE3C,IAAI,oBAAoB,EAAE,CAAC;YACzB,iDAAiD;YACjD,IAAI,YAAY,GAAG,MAAM,EAAE,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC;YAEnG,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,mCAAmC;gBACnC,0EAA0E;gBAC1E,YAAY,GAAG,MAAM,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC;oBACjD,cAAc,EAAE,MAAM,CAAC,oBAAoB,CAAC;oBAC5C,WAAW,EAAE,MAAM,EAAE,qDAAqD;oBAC1E,YAAY,EAAE,IAAI,CAAC,cAAc,IAAI,SAAS;oBAC9C,SAAS,EAAE,IAAI,CAAC,QAAQ,IAAI,SAAS;oBACrC,aAAa,EAAE,IAAI,CAAC,EAAE;oBACtB,WAAW,EAAE,EAAE;oBACf,MAAM,EAAE,EAAE;iBACX,CAAC,CAAC;gBACH,OAAO,CAAC,GAAG,CAAC,mDAAmD,oBAAoB,EAAE,CAAC,CAAC;YACzF,CAAC;YAED,gBAAgB,GAAG,YAAY,CAAC,EAAE,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;QACtF,CAAC;QAED,qCAAqC;QACrC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,YAAY,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAEpF,yBAAyB;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;gBAC3B,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,cAAc,EAAE,IAAI,CAAC,SAAS;gBAC9B,QAAQ,EAAE,IAAI,CAAC,EAAE;gBACjB,SAAS,EAAE,IAAI,CAAC,OAAO;gBACvB,aAAa,EAAE,IAAI,CAAC,cAAc;gBAClC,iBAAiB,EAAE,YAAY;gBAC/B,cAAc,EAAE,gBAAgB;gBAChC,UAAU,EAAE,QAAQ;gBACpB,YAAY,EAAE,IAAI,IAAI,EAAE;aACzB,CAAC,CAAC;QACL,CAAC;QAED,yCAAyC;QACzC,MAAM,EAAE,CAAC,KAAK,CAAC,+BAA+B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAExD,OAAO,CAAC,GAAG,CAAC,0BAA0B,KAAK,CAAC,MAAM,cAAc,IAAI,CAAC,cAAc,mBAAmB,oBAAoB,IAAI,SAAS,GAAG,CAAC,CAAC;QAE5I,gEAAgE;QAChE,0DAA0D;QAC1D,0BAA0B;QAC1B,mCAAmC;QACnC,sCAAsC;IAExC,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,KAA6B,CAAC;QAC1C,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,uBAAuB;YACvB,MAAM,EAAE,CAAC,KAAK,CAAC,6BAA6B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACtD,OAAO,CAAC,GAAG,CAAC,4CAA4C,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QACjF,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/cloud/api/onboarding.d.ts

@@ -2,7 +2,14 @@
  * Onboarding API Routes
  *
  * Handles CLI proxy authentication for Claude Code and other providers.
- * Spawns CLI tools to get auth URLs, captures tokens.
+ * Spawns CLI tools via PTY to get auth URLs, captures tokens.
+ *
+ * We use node-pty instead of child_process.spawn because:
+ * 1. Many CLIs detect if they're in a TTY and behave differently
+ * 2. Interactive OAuth flows often require TTY for proper output
+ * 3. PTY ensures the CLI outputs auth URLs correctly
  */
+import { CLI_AUTH_CONFIG, runCLIAuthViaPTY, stripAnsiCodes, matchesSuccessPattern, findMatchingPrompt, validateProviderConfig, validateAllProviderConfigs, getSupportedProviders, type CLIAuthConfig, type PTYAuthResult, type PTYAuthOptions, type PromptHandler } from './cli-pty-runner.js';
+export { CLI_AUTH_CONFIG, runCLIAuthViaPTY, stripAnsiCodes, matchesSuccessPattern, findMatchingPrompt, validateProviderConfig, validateAllProviderConfigs, getSupportedProviders, type CLIAuthConfig, type PTYAuthResult, type PTYAuthOptions, type PromptHandler, };
 export declare const onboardingRouter: import("express-serve-static-core").Router;
 //# sourceMappingURL=onboarding.d.ts.map

package/dist/cloud/api/onboarding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"onboarding.d.ts","sourceRoot":"","sources":["../../../src/cloud/api/onboarding.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,eAAO,MAAM,gBAAgB,4CAAW,CAAC"}
+{"version":3,"file":"onboarding.d.ts","sourceRoot":"","sources":["../../../src/cloud/api/onboarding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAUH,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,EACtB,0BAA0B,EAC1B,qBAAqB,EACrB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,EACtB,0BAA0B,EAC1B,qBAAqB,EACrB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,CAAC;AAEF,eAAO,MAAM,gBAAgB,4CAAW,CAAC"}