agent-relay 1.1.0 → 1.2.3

package/dist/cloud/api/auth.d.ts

@@ -1,7 +1,9 @@
 /**
  * Auth API Routes
  *
- * Handles GitHub OAuth for user login.
+ * Session management routes.
+ * User login is handled via Nango (see nango-auth.ts).
+ * GitHub repo operations are in github-app.ts.
  */
 import { Request, Response } from 'express';
 export declare const authRouter: import("express-serve-static-core").Router;
@@ -9,7 +11,6 @@ declare module 'express-session' {
     interface SessionData {
         userId?: string;
         githubToken?: string;
-        oauthState?: string;
     }
 }
 /**

package/dist/cloud/api/auth.js

@@ -1,111 +1,20 @@
 /**
  * Auth API Routes
  *
- * Handles GitHub OAuth for user login.
+ * Session management routes.
+ * User login is handled via Nango (see nango-auth.ts).
+ * GitHub repo operations are in github-app.ts.
  */
 import { Router } from 'express';
-import crypto from 'crypto';
-import { getConfig } from '../config.js';
 import { db } from '../db/index.js';
 export const authRouter = Router();
 /**
  * GET /api/auth/github
- * Start GitHub OAuth flow
+ * Redirect to Nango login flow
+ * @deprecated Use /api/auth/nango/login-session instead
  */
-authRouter.get('/github', (req, res) => {
-    const config = getConfig();
-    const state = crypto.randomBytes(16).toString('hex');
-    // Store state in session for CSRF protection
-    req.session.oauthState = state;
-    const params = new URLSearchParams({
-        client_id: config.github.clientId,
-        redirect_uri: `${config.publicUrl}/api/auth/github/callback`,
-        scope: 'read:user user:email repo',
-        state,
-    });
-    res.redirect(`https://github.com/login/oauth/authorize?${params}`);
-});
-/**
- * GET /api/auth/github/callback
- * GitHub OAuth callback
- */
-authRouter.get('/github/callback', async (req, res) => {
-    const config = getConfig();
-    const { code, state } = req.query;
-    // Verify state
-    if (state !== req.session.oauthState) {
-        return res.status(400).json({ error: 'Invalid state parameter' });
-    }
-    try {
-        // Exchange code for token
-        const tokenResponse = await fetch('https://github.com/login/oauth/access_token', {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                Accept: 'application/json',
-            },
-            body: JSON.stringify({
-                client_id: config.github.clientId,
-                client_secret: config.github.clientSecret,
-                code,
-            }),
-        });
-        const tokenData = await tokenResponse.json();
-        if (tokenData.error) {
-            throw new Error(tokenData.error_description || tokenData.error);
-        }
-        const accessToken = tokenData.access_token;
-        // Get user info
-        const userResponse = await fetch('https://api.github.com/user', {
-            headers: {
-                Authorization: `Bearer ${accessToken}`,
-                Accept: 'application/vnd.github.v3+json',
-            },
-        });
-        const userData = await userResponse.json();
-        // Get user email if not public
-        let email = userData.email;
-        if (!email) {
-            const emailsResponse = await fetch('https://api.github.com/user/emails', {
-                headers: {
-                    Authorization: `Bearer ${accessToken}`,
-                    Accept: 'application/vnd.github.v3+json',
-                },
-            });
-            const emails = await emailsResponse.json();
-            const primaryEmail = emails.find((e) => e.primary);
-            email = primaryEmail?.email;
-        }
-        // Create or update user
-        const user = await db.users.upsert({
-            githubId: String(userData.id),
-            githubUsername: userData.login,
-            email,
-            avatarUrl: userData.avatar_url,
-        });
-        // Store GitHub token as a credential
-        await db.credentials.upsert({
-            userId: user.id,
-            provider: 'github',
-            accessToken,
-            scopes: ['read:user', 'user:email', 'repo'],
-            providerAccountId: String(userData.id),
-            providerAccountEmail: email,
-        });
-        // Set session
-        req.session.userId = user.id;
-        req.session.githubToken = accessToken;
-        delete req.session.oauthState;
-        // Redirect to dashboard or onboarding
-        const redirectTo = user.onboardingCompletedAt
-            ? '/dashboard'
-            : '/onboarding/providers';
-        res.redirect(redirectTo);
-    }
-    catch (error) {
-        console.error('GitHub OAuth error:', error);
-        res.redirect('/login?error=oauth_failed');
-    }
+authRouter.get('/github', (_req, res) => {
+    res.redirect('/api/auth/nango/login-session');
 });
 /**
  * POST /api/auth/logout
@@ -141,6 +50,8 @@ authRouter.get('/me', async (req, res) => {
         }));
         // Get pending invites
         const pendingInvites = await db.workspaceMembers.getPendingInvites(user.id);
+        // Check for pending GitHub installation request
+        const pendingGitHubApproval = !!user.pendingInstallationRequest;
         res.json({
             id: user.id,
             githubUsername: user.githubUsername,
@@ -149,6 +60,7 @@ authRouter.get('/me', async (req, res) => {
             plan: user.plan,
             connectedProviders,
             pendingInvites: pendingInvites.length,
+            pendingGitHubApproval,
             onboardingCompleted: !!user.onboardingCompletedAt,
         });
     }

package/dist/cloud/api/billing.js

@@ -6,6 +6,7 @@
 import { Router } from 'express';
 import { getBillingService, getAllPlans, getPlan, comparePlans } from '../billing/index.js';
 import { getConfig } from '../config.js';
+import { db } from '../db/index.js';
 export const billingRouter = Router();
 /**
  * Middleware to require authentication
@@ -315,8 +316,14 @@ billingRouter.post('/webhook',
     }
     const billing = getBillingService();
     try {
-        // Get raw body
-        const rawBody = JSON.stringify(req.body);
+        // Use the preserved raw body from express.json verify callback
+        // This is critical for Stripe signature verification - JSON.stringify(req.body) won't work
+        const rawBody = req.rawBody;
+        if (!rawBody) {
+            console.error('Raw body not available for Stripe webhook verification');
+            res.status(400).json({ error: 'Raw body not available' });
+            return;
+        }
         // Verify and parse event
         const event = billing.verifyWebhookSignature(rawBody, sig);
         // Process the event
@@ -330,16 +337,30 @@ billingRouter.post('/webhook',
         // Handle specific events
         switch (billingEvent.type) {
             case 'subscription.created':
-            case 'subscription.updated':
-                // Update user's subscription in database
-                // This would integrate with your user/database layer
-                console.log('Subscription updated for user:', billingEvent.userId);
+            case 'subscription.updated': {
+                // Extract subscription tier and update user's plan
+                if (billingEvent.userId) {
+                    const subscription = billingEvent.data;
+                    const tier = billing.getTierFromSubscription(subscription);
+                    // Update user's plan in database
+                    await db.users.update(billingEvent.userId, { plan: tier });
+                    console.log(`Updated user ${billingEvent.userId} plan to: ${tier}`);
+                }
+                else {
+                    console.warn('Subscription event received without userId:', billingEvent.id);
+                }
                 break;
-            case 'subscription.canceled':
-                console.log('Subscription canceled for user:', billingEvent.userId);
+            }
+            case 'subscription.canceled': {
+                // Reset user to free plan
+                if (billingEvent.userId) {
+                    await db.users.update(billingEvent.userId, { plan: 'free' });
+                    console.log(`User ${billingEvent.userId} subscription canceled, reset to free plan`);
+                }
                 break;
+            }
             case 'invoice.payment_failed':
-                // Notify user of failed payment
+                // Log payment failure (don't immediately downgrade - Stripe retries)
                 console.log('Payment failed for user:', billingEvent.userId);
                 break;
         }

package/dist/cloud/api/cli-pty-runner.d.ts

@@ -0,0 +1,54 @@
+/**
+ * CLI PTY Runner
+ *
+ * Shared module for running CLI auth flows via PTY.
+ * Used by both production (onboarding.ts) and tests (ci-test-real-clis.ts).
+ *
+ * This module has minimal dependencies (only node-pty) so it can be
+ * used in isolated test containers without the full server stack.
+ */
+import { CLI_AUTH_CONFIG, stripAnsiCodes, matchesSuccessPattern, findMatchingPrompt, validateProviderConfig, getSupportedProviders, type CLIAuthConfig, type PromptHandler } from '../../shared/cli-auth-config.js';
+export { CLI_AUTH_CONFIG, stripAnsiCodes, matchesSuccessPattern, findMatchingPrompt, validateProviderConfig, getSupportedProviders, type CLIAuthConfig, type PromptHandler, };
+export declare function validateAllProviderConfigs(): void;
+/**
+ * Result of running a CLI auth flow via PTY
+ */
+export interface PTYAuthResult {
+    authUrl: string | null;
+    success: boolean;
+    promptsHandled: string[];
+    output: string;
+    exitCode: number | null;
+    error?: string;
+}
+/**
+ * Options for running CLI auth via PTY
+ */
+export interface PTYAuthOptions {
+    /** Callback when auth URL is found */
+    onAuthUrl?: (url: string) => void;
+    /** Callback when a prompt is handled */
+    onPromptHandled?: (description: string) => void;
+    /** Callback for raw PTY output */
+    onOutput?: (data: string) => void;
+    /** Environment variables override */
+    env?: Record<string, string>;
+    /** Working directory */
+    cwd?: string;
+}
+/**
+ * Run CLI auth flow via PTY
+ *
+ * This is the core PTY runner used by both production and tests.
+ * It handles:
+ * - Spawning the CLI with proper TTY emulation
+ * - Auto-responding to interactive prompts
+ * - Extracting auth URLs from output
+ * - Detecting success patterns
+ *
+ * @param config - CLI auth configuration for the provider
+ * @param options - Optional callbacks and overrides
+ * @returns Promise resolving to auth result
+ */
+export declare function runCLIAuthViaPTY(config: CLIAuthConfig, options?: PTYAuthOptions): Promise<PTYAuthResult>;
+//# sourceMappingURL=cli-pty-runner.d.ts.map

package/dist/cloud/api/cli-pty-runner.js

@@ -0,0 +1,119 @@
+/**
+ * CLI PTY Runner
+ *
+ * Shared module for running CLI auth flows via PTY.
+ * Used by both production (onboarding.ts) and tests (ci-test-real-clis.ts).
+ *
+ * This module has minimal dependencies (only node-pty) so it can be
+ * used in isolated test containers without the full server stack.
+ */
+import * as pty from 'node-pty';
+// Import shared config and utilities
+import { CLI_AUTH_CONFIG, stripAnsiCodes, matchesSuccessPattern, findMatchingPrompt, validateProviderConfig, validateAllProviderConfigs as validateAllConfigs, getSupportedProviders, } from '../../shared/cli-auth-config.js';
+// Re-export everything from shared config for backward compatibility
+export { CLI_AUTH_CONFIG, stripAnsiCodes, matchesSuccessPattern, findMatchingPrompt, validateProviderConfig, getSupportedProviders, };
+// Wrapper that throws instead of returning array (backward compatible)
+export function validateAllProviderConfigs() {
+    const errors = validateAllConfigs();
+    if (errors.length > 0) {
+        throw new Error(`Invalid provider configurations:\n${errors.join('\n')}`);
+    }
+}
+/**
+ * Run CLI auth flow via PTY
+ *
+ * This is the core PTY runner used by both production and tests.
+ * It handles:
+ * - Spawning the CLI with proper TTY emulation
+ * - Auto-responding to interactive prompts
+ * - Extracting auth URLs from output
+ * - Detecting success patterns
+ *
+ * @param config - CLI auth configuration for the provider
+ * @param options - Optional callbacks and overrides
+ * @returns Promise resolving to auth result
+ */
+export async function runCLIAuthViaPTY(config, options = {}) {
+    const result = {
+        authUrl: null,
+        success: false,
+        promptsHandled: [],
+        output: '',
+        exitCode: null,
+    };
+    const respondedPrompts = new Set();
+    return new Promise((resolve) => {
+        try {
+            const proc = pty.spawn(config.command, config.args, {
+                name: 'xterm-256color',
+                cols: 120,
+                rows: 30,
+                cwd: options.cwd || process.cwd(),
+                env: {
+                    ...process.env,
+                    NO_COLOR: '1',
+                    TERM: 'xterm-256color',
+                    // Prevent CLIs from trying to open browsers
+                    BROWSER: 'echo',
+                    DISPLAY: '',
+                    ...options.env,
+                },
+            });
+            // Timeout handler
+            const timeout = setTimeout(() => {
+                proc.kill();
+                result.error = 'Timeout waiting for auth URL';
+                resolve(result);
+            }, config.waitTimeout + 5000);
+            proc.onData((data) => {
+                result.output += data;
+                options.onOutput?.(data);
+                // Check for matching prompts and auto-respond
+                const matchingPrompt = findMatchingPrompt(data, config.prompts, respondedPrompts);
+                if (matchingPrompt) {
+                    respondedPrompts.add(matchingPrompt.description);
+                    result.promptsHandled.push(matchingPrompt.description);
+                    options.onPromptHandled?.(matchingPrompt.description);
+                    const delay = matchingPrompt.delay ?? 100;
+                    setTimeout(() => {
+                        try {
+                            proc.write(matchingPrompt.response);
+                        }
+                        catch {
+                            // Process may have exited
+                        }
+                    }, delay);
+                }
+                // Look for auth URL
+                const cleanText = stripAnsiCodes(data);
+                const match = cleanText.match(config.urlPattern);
+                if (match && match[1] && !result.authUrl) {
+                    result.authUrl = match[1];
+                    options.onAuthUrl?.(result.authUrl);
+                }
+                // Check for success indicators
+                if (matchesSuccessPattern(data, config.successPatterns)) {
+                    result.success = true;
+                }
+            });
+            proc.onExit(({ exitCode }) => {
+                clearTimeout(timeout);
+                result.exitCode = exitCode;
+                // Consider it a success if we got a URL (main goal)
+                // or if exit code was 0 with success pattern
+                if (result.authUrl || (exitCode === 0 && result.success)) {
+                    result.success = true;
+                }
+                if (!result.authUrl && !result.success && !result.error) {
+                    result.error = 'Failed to extract auth URL from CLI output';
+                }
+                resolve(result);
+            });
+        }
+        catch (err) {
+            result.error = err instanceof Error ? err.message : 'Unknown error';
+            resolve(result);
+        }
+    });
+}
+//# sourceMappingURL=cli-pty-runner.js.map

package/dist/cloud/api/codex-auth-helper.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Codex Auth Helper API
+ *
+ * Provides endpoints for the `npx agent-relay codex-auth` CLI command
+ * to capture OAuth callbacks locally and send them to the cloud.
+ *
+ * This solves the "This site can't be reached" problem where Codex redirects
+ * to localhost:1455 after auth but nothing is listening.
+ */
+export declare const codexAuthHelperRouter: import("express-serve-static-core").Router;
+/**
+ * Stop the cleanup interval. Call this on server shutdown.
+ */
+export declare function stopCodexAuthCleanup(): void;
+//# sourceMappingURL=codex-auth-helper.d.ts.map

package/dist/cloud/api/codex-auth-helper.js

@@ -0,0 +1,100 @@
+/**
+ * Codex Auth Helper API
+ *
+ * Provides endpoints for the `npx agent-relay codex-auth` CLI command
+ * to capture OAuth callbacks locally and send them to the cloud.
+ *
+ * This solves the "This site can't be reached" problem where Codex redirects
+ * to localhost:1455 after auth but nothing is listening.
+ */
+import { Router } from 'express';
+import crypto from 'crypto';
+import { requireAuth } from './auth.js';
+export const codexAuthHelperRouter = Router();
+const pendingAuthSessions = new Map();
+// Clean up old sessions every minute
+const cleanupInterval = setInterval(() => {
+    const now = Date.now();
+    for (const [id, session] of pendingAuthSessions) {
+        // Remove sessions older than 10 minutes
+        if (now - session.createdAt.getTime() > 10 * 60 * 1000) {
+            pendingAuthSessions.delete(id);
+        }
+    }
+}, 60000);
+/**
+ * Stop the cleanup interval. Call this on server shutdown.
+ */
+export function stopCodexAuthCleanup() {
+    clearInterval(cleanupInterval);
+}
+/**
+ * POST /api/auth/codex-helper/cli-session
+ * Create a new auth session for the CLI command.
+ * Returns an authSessionId that the CLI uses to send the auth code.
+ */
+codexAuthHelperRouter.post('/cli-session', requireAuth, async (req, res) => {
+    const userId = req.session.userId;
+    const authSessionId = crypto.randomUUID();
+    pendingAuthSessions.set(authSessionId, {
+        userId,
+        createdAt: new Date(),
+    });
+    console.log(`[codex-helper] Created CLI session ${authSessionId} for user ${userId}`);
+    res.json({
+        authSessionId,
+        expiresIn: 600, // 10 minutes
+        command: `npx agent-relay codex-auth --token=${authSessionId}`,
+    });
+});
+/**
+ * POST /api/auth/codex-helper/callback
+ * Receives the auth code from the CLI.
+ * No auth required - validated by authSessionId.
+ */
+codexAuthHelperRouter.post('/callback', async (req, res) => {
+    const { authSessionId, code, error } = req.body;
+    if (!authSessionId) {
+        return res.status(400).json({ error: 'Missing authSessionId' });
+    }
+    const session = pendingAuthSessions.get(authSessionId);
+    if (!session) {
+        return res.status(404).json({ error: 'Session not found or expired' });
+    }
+    if (error) {
+        console.log(`[codex-helper] Auth error for session ${authSessionId}:`, error);
+        pendingAuthSessions.delete(authSessionId);
+        return res.json({ success: false, error });
+    }
+    if (!code) {
+        return res.status(400).json({ error: 'Missing auth code' });
+    }
+    // Store the code so the polling endpoint can retrieve it
+    session.code = code;
+    pendingAuthSessions.set(authSessionId, session);
+    console.log(`[codex-helper] Auth code received for session ${authSessionId}`);
+    res.json({ success: true, message: 'Auth code received. You can close this terminal.' });
+});
+/**
+ * GET /api/auth/codex-helper/status/:authSessionId
+ * Check if auth code has been received.
+ * The dashboard polls this to know when the CLI has captured the callback.
+ */
+codexAuthHelperRouter.get('/status/:authSessionId', requireAuth, async (req, res) => {
+    const { authSessionId } = req.params;
+    const session = pendingAuthSessions.get(authSessionId);
+    if (!session || session.userId !== req.session.userId) {
+        return res.status(404).json({ error: 'Session not found or expired' });
+    }
+    if (session.code) {
+        // Clean up session after successful retrieval (code is single-use)
+        const code = session.code;
+        pendingAuthSessions.delete(authSessionId);
+        return res.json({
+            ready: true,
+            code,
+        });
+    }
+    res.json({ ready: false });
+});
+//# sourceMappingURL=codex-auth-helper.js.map

package/dist/cloud/api/generic-webhooks.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Generic Webhooks API Routes
+ *
+ * Provides endpoints for receiving webhooks from any configured source.
+ * Routes: POST /api/webhooks/:source
+ */
+export declare const genericWebhooksRouter: import("express-serve-static-core").Router;
+//# sourceMappingURL=generic-webhooks.d.ts.map

package/dist/cloud/api/generic-webhooks.js

@@ -0,0 +1,129 @@
+/**
+ * Generic Webhooks API Routes
+ *
+ * Provides endpoints for receiving webhooks from any configured source.
+ * Routes: POST /api/webhooks/:source
+ */
+import { Router } from 'express';
+import { processWebhook, getWebhookConfig } from '../webhooks/index.js';
+export const genericWebhooksRouter = Router();
+/**
+ * POST /api/webhooks/:source
+ * Receive a webhook from any configured source
+ */
+genericWebhooksRouter.post('/:source', async (req, res) => {
+    const { source } = req.params;
+    // For Slack URL verification challenge
+    if (source === 'slack' && req.body?.type === 'url_verification') {
+        return res.json({ challenge: req.body.challenge });
+    }
+    try {
+        // Get raw body for signature verification
+        // Note: This requires express.raw() middleware or similar
+        const rawBody = typeof req.body === 'string'
+            ? req.body
+            : JSON.stringify(req.body);
+        const result = await processWebhook(source, rawBody, req.headers);
+        if (!result.success && result.responses[0]?.error === 'Invalid signature') {
+            return res.status(401).json({ error: 'Invalid signature' });
+        }
+        if (!result.success && result.responses[0]?.error?.includes('Unknown webhook source')) {
+            return res.status(404).json({ error: `Unknown webhook source: ${source}` });
+        }
+        console.log(`[webhooks] Processed ${source} webhook: ${result.eventType} (${result.matchedRules.length} rules matched)`);
+        res.json({
+            success: result.success,
+            eventId: result.eventId,
+            eventType: result.eventType,
+            matchedRules: result.matchedRules,
+            actionsExecuted: result.actions.length,
+        });
+    }
+    catch (error) {
+        console.error(`[webhooks] Error processing ${source} webhook:`, error);
+        res.status(500).json({
+            error: error instanceof Error ? error.message : 'Unknown error',
+        });
+    }
+});
+/**
+ * GET /api/webhooks/config
+ * Get the current webhook configuration (for debugging)
+ */
+genericWebhooksRouter.get('/config', (_req, res) => {
+    const config = getWebhookConfig();
+    res.json({
+        sources: Object.entries(config.sources).map(([id, source]) => ({
+            id,
+            name: source.name,
+            enabled: source.enabled,
+            parser: source.parser,
+            responder: source.responder,
+        })),
+        rules: config.rules.map(rule => ({
+            id: rule.id,
+            name: rule.name,
+            enabled: rule.enabled,
+            source: rule.source,
+            eventType: rule.eventType,
+            condition: rule.condition,
+            actionType: rule.action.type,
+            priority: rule.priority,
+        })),
+    });
+});
+/**
+ * GET /api/webhooks/sources
+ * List available webhook sources with their setup instructions
+ */
+genericWebhooksRouter.get('/sources', (_req, res) => {
+    const baseUrl = process.env.PUBLIC_URL || 'https://your-domain.com';
+    res.json({
+        sources: [
+            {
+                id: 'github',
+                name: 'GitHub',
+                webhookUrl: `${baseUrl}/api/webhooks/github`,
+                setupInstructions: [
+                    '1. Go to your repository Settings > Webhooks > Add webhook',
+                    `2. Set Payload URL to: ${baseUrl}/api/webhooks/github`,
+                    '3. Set Content type to: application/json',
+                    '4. Set Secret to your GITHUB_WEBHOOK_SECRET value',
+                    '5. Select events: Check runs, Issues, Issue comments, Pull request review comments',
+                ],
+                requiredEnvVars: ['GITHUB_WEBHOOK_SECRET'],
+                events: ['check_run', 'issues', 'issue_comment', 'pull_request_review_comment'],
+            },
+            {
+                id: 'linear',
+                name: 'Linear',
+                webhookUrl: `${baseUrl}/api/webhooks/linear`,
+                setupInstructions: [
+                    '1. Go to Linear Settings > API > Webhooks',
+                    '2. Create a new webhook',
+                    `3. Set URL to: ${baseUrl}/api/webhooks/linear`,
+                    '4. Copy the signing secret to LINEAR_WEBHOOK_SECRET',
+                    '5. Select events: Issues, Comments',
+                ],
+                requiredEnvVars: ['LINEAR_WEBHOOK_SECRET', 'LINEAR_API_KEY'],
+                events: ['Issue', 'Comment', 'IssueLabel'],
+            },
+            {
+                id: 'slack',
+                name: 'Slack',
+                webhookUrl: `${baseUrl}/api/webhooks/slack`,
+                setupInstructions: [
+                    '1. Create a Slack App at api.slack.com/apps',
+                    '2. Enable Event Subscriptions',
+                    `3. Set Request URL to: ${baseUrl}/api/webhooks/slack`,
+                    '4. Subscribe to bot events: app_mention, message.channels',
+                    '5. Copy Signing Secret to SLACK_SIGNING_SECRET',
+                    '6. Install the app to your workspace',
+                ],
+                requiredEnvVars: ['SLACK_SIGNING_SECRET', 'SLACK_BOT_TOKEN'],
+                events: ['app_mention', 'message', 'reaction_added'],
+            },
+        ],
+    });
+});
+//# sourceMappingURL=generic-webhooks.js.map

package/dist/cloud/api/git.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Git Gateway API Routes
+ *
+ * Provides fresh GitHub tokens to workspace containers for git operations.
+ * This gateway pattern ensures tokens are always valid (Nango handles refresh).
+ */
+export declare const gitRouter: import("express-serve-static-core").Router;
+//# sourceMappingURL=git.d.ts.map