agent-relay 1.1.0 → 1.2.3

package/dist/cloud/api/git.js

@@ -0,0 +1,152 @@
+/**
+ * Git Gateway API Routes
+ *
+ * Provides fresh GitHub tokens to workspace containers for git operations.
+ * This gateway pattern ensures tokens are always valid (Nango handles refresh).
+ */
+import crypto from 'crypto';
+import { Router } from 'express';
+import { db } from '../db/index.js';
+import { nangoService } from '../services/nango.js';
+import { getConfig } from '../config.js';
+export const gitRouter = Router();
+/**
+ * Generate expected workspace token using HMAC
+ */
+function generateExpectedToken(workspaceId) {
+    const config = getConfig();
+    return crypto
+        .createHmac('sha256', config.sessionSecret)
+        .update(`workspace:${workspaceId}`)
+        .digest('hex');
+}
+/**
+ * Verify workspace access token
+ * Workspaces authenticate with a secret passed at provisioning time
+ */
+function verifyWorkspaceToken(req, workspaceId) {
+    const authHeader = req.get('authorization');
+    if (!authHeader?.startsWith('Bearer ')) {
+        return false;
+    }
+    const providedToken = authHeader.slice(7);
+    const expectedToken = generateExpectedToken(workspaceId);
+    // Use timing-safe comparison to prevent timing attacks
+    try {
+        return crypto.timingSafeEqual(Buffer.from(providedToken), Buffer.from(expectedToken));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * GET /api/git/token
+ * Get a fresh GitHub token for git operations
+ *
+ * Query params:
+ *   - workspaceId: The workspace requesting the token
+ *
+ * Returns: { token: string, expiresAt?: string }
+ *
+ * This endpoint is called by the git credential helper in workspace containers.
+ * It fetches a fresh GitHub App installation token via Nango.
+ */
+gitRouter.get('/token', async (req, res) => {
+    const { workspaceId } = req.query;
+    if (!workspaceId || typeof workspaceId !== 'string') {
+        return res.status(400).json({ error: 'workspaceId is required' });
+    }
+    // Verify the request is from a valid workspace
+    if (!verifyWorkspaceToken(req, workspaceId)) {
+        return res.status(401).json({ error: 'Invalid workspace token' });
+    }
+    try {
+        // Get workspace to find the user
+        const workspace = await db.workspaces.findById(workspaceId);
+        if (!workspace) {
+            return res.status(404).json({ error: 'Workspace not found' });
+        }
+        const userId = workspace.userId;
+        // Find a repository with a Nango connection for this user
+        const repos = await db.repositories.findByUserId(userId);
+        const repoWithConnection = repos.find(r => r.nangoConnectionId);
+        if (!repoWithConnection?.nangoConnectionId) {
+            return res.status(404).json({
+                error: 'No GitHub App connection found',
+                hint: 'Connect a repository via the GitHub App to enable git operations',
+            });
+        }
+        // Get fresh tokens from Nango (auto-refreshes if needed)
+        // - installationToken: for git operations (clone, push, pull)
+        // - userToken: for gh CLI operations (requires user context)
+        const installationToken = await nangoService.getGithubAppToken(repoWithConnection.nangoConnectionId);
+        // Try to get user OAuth token from github-app-oauth connection_config first
+        // Fall back to separate 'github' user connection if available
+        let userToken = null;
+        try {
+            userToken = await nangoService.getGithubUserOAuthToken(repoWithConnection.nangoConnectionId);
+        }
+        catch {
+            // Try the separate github user connection if available
+            const userRepo = repos.find(r => r.nangoConnectionId && r.nangoConnectionId !== repoWithConnection.nangoConnectionId);
+            if (userRepo?.nangoConnectionId) {
+                try {
+                    userToken = await nangoService.getGithubUserToken(userRepo.nangoConnectionId);
+                }
+                catch {
+                    console.log('[git] No github user token available');
+                }
+            }
+        }
+        // GitHub App installation tokens expire after 1 hour
+        const expiresAt = new Date(Date.now() + 55 * 60 * 1000).toISOString(); // 55 min buffer
+        res.json({
+            token: installationToken,
+            userToken, // For gh CLI - may be null if not available
+            expiresAt,
+            username: 'x-access-token', // GitHub App tokens use this as username
+        });
+    }
+    catch (error) {
+        console.error('[git] Error getting token:', error);
+        res.status(500).json({ error: 'Failed to get GitHub token' });
+    }
+});
+/**
+ * POST /api/git/token
+ * Same as GET but accepts body params (for compatibility with some git credential helpers)
+ */
+gitRouter.post('/token', async (req, res) => {
+    const workspaceId = req.body.workspaceId || req.query.workspaceId;
+    if (!workspaceId || typeof workspaceId !== 'string') {
+        return res.status(400).json({ error: 'workspaceId is required' });
+    }
+    if (!verifyWorkspaceToken(req, workspaceId)) {
+        return res.status(401).json({ error: 'Invalid workspace token' });
+    }
+    try {
+        const workspace = await db.workspaces.findById(workspaceId);
+        if (!workspace) {
+            return res.status(404).json({ error: 'Workspace not found' });
+        }
+        const repos = await db.repositories.findByUserId(workspace.userId);
+        const repoWithConnection = repos.find(r => r.nangoConnectionId);
+        if (!repoWithConnection?.nangoConnectionId) {
+            return res.status(404).json({
+                error: 'No GitHub App connection found',
+            });
+        }
+        const token = await nangoService.getGithubAppToken(repoWithConnection.nangoConnectionId);
+        const expiresAt = new Date(Date.now() + 55 * 60 * 1000).toISOString();
+        res.json({
+            token,
+            expiresAt,
+            username: 'x-access-token',
+        });
+    }
+    catch (error) {
+        console.error('[git] Error getting token:', error);
+        res.status(500).json({ error: 'Failed to get GitHub token' });
+    }
+});
+//# sourceMappingURL=git.js.map

package/dist/cloud/api/github-app.d.ts

@@ -0,0 +1,11 @@
+/**
+ * GitHub App API Routes
+ *
+ * Repo operations via Nango's github-app-oauth connection:
+ * - Get clone token for repositories
+ * - Create issues, PRs, and comments
+ *
+ * Auth flow is handled by nango-auth.ts
+ */
+export declare const githubAppRouter: import("express-serve-static-core").Router;
+//# sourceMappingURL=github-app.d.ts.map

package/dist/cloud/api/github-app.js

@@ -0,0 +1,189 @@
+/**
+ * GitHub App API Routes
+ *
+ * Repo operations via Nango's github-app-oauth connection:
+ * - Get clone token for repositories
+ * - Create issues, PRs, and comments
+ *
+ * Auth flow is handled by nango-auth.ts
+ */
+import { Router } from 'express';
+import { requireAuth } from './auth.js';
+import { db } from '../db/index.js';
+import { nangoService, NANGO_INTEGRATIONS } from '../services/nango.js';
+export const githubAppRouter = Router();
+// All routes require authentication
+githubAppRouter.use(requireAuth);
+/**
+ * GET /api/github-app/status
+ * Check if Nango GitHub App OAuth is configured
+ */
+githubAppRouter.get('/status', (_req, res) => {
+    res.json({
+        configured: true,
+        integrations: NANGO_INTEGRATIONS,
+        connectUrl: '/connect-repos',
+    });
+});
+/**
+ * GET /api/github-app/repos
+ * List repositories the user has connected via Nango
+ */
+githubAppRouter.get('/repos', async (req, res) => {
+    const userId = req.session.userId;
+    try {
+        const repos = await db.repositories.findByUserId(userId);
+        res.json({
+            repositories: repos.map((r) => ({
+                id: r.id,
+                fullName: r.githubFullName,
+                isPrivate: r.isPrivate,
+                defaultBranch: r.defaultBranch,
+                syncStatus: r.syncStatus,
+                hasNangoConnection: !!r.nangoConnectionId,
+                lastSyncedAt: r.lastSyncedAt,
+            })),
+        });
+    }
+    catch (error) {
+        console.error('Error listing repos:', error);
+        res.status(500).json({ error: 'Failed to list repositories' });
+    }
+});
+/**
+ * GET /api/github-app/clone-token
+ * Get a clone token for a repository
+ * Used by workspace provisioner to clone private repos
+ */
+githubAppRouter.get('/clone-token', async (req, res) => {
+    const userId = req.session.userId;
+    const { repo } = req.query;
+    if (!repo || typeof repo !== 'string') {
+        return res.status(400).json({ error: 'Repository name is required (owner/repo)' });
+    }
+    try {
+        // Find the repository in our database
+        const userRepos = await db.repositories.findByUserId(userId);
+        const repository = userRepos.find((r) => r.githubFullName === repo);
+        if (!repository) {
+            return res.status(404).json({ error: 'Repository not found' });
+        }
+        if (!repository.nangoConnectionId) {
+            return res.status(400).json({
+                error: 'Repository not connected via Nango',
+                hint: 'Connect your GitHub repos through the Nango flow first',
+            });
+        }
+        // Get token from Nango connection
+        const token = await nangoService.getGithubAppToken(repository.nangoConnectionId);
+        const cloneUrl = `https://x-access-token:${token}@github.com/${repo}.git`;
+        res.json({
+            token,
+            cloneUrl,
+            expiresIn: '1 hour',
+        });
+    }
+    catch (error) {
+        console.error('Error getting clone token:', error);
+        res.status(500).json({ error: 'Failed to get clone token' });
+    }
+});
+/**
+ * POST /api/github-app/repos/:id/issues
+ * Create an issue on a repository
+ */
+githubAppRouter.post('/repos/:id/issues', async (req, res) => {
+    const userId = req.session.userId;
+    const { id } = req.params;
+    const { title, body, labels } = req.body;
+    if (!title || typeof title !== 'string') {
+        return res.status(400).json({ error: 'Issue title is required' });
+    }
+    try {
+        // Find the repository
+        const repository = await db.repositories.findById(id);
+        if (!repository || repository.userId !== userId) {
+            return res.status(404).json({ error: 'Repository not found' });
+        }
+        if (!repository.nangoConnectionId) {
+            return res.status(400).json({ error: 'Repository not connected via Nango' });
+        }
+        // Create issue via Nango Proxy (handles token injection automatically)
+        const [owner, repo] = repository.githubFullName.split('/');
+        const issue = await nangoService.createGithubIssue(repository.nangoConnectionId, owner, repo, { title, body: body || '', labels });
+        res.json({
+            number: issue.number,
+            url: issue.html_url,
+        });
+    }
+    catch (error) {
+        console.error('Error creating issue:', error);
+        res.status(500).json({ error: 'Failed to create issue' });
+    }
+});
+/**
+ * POST /api/github-app/repos/:id/pulls
+ * Create a pull request on a repository
+ */
+githubAppRouter.post('/repos/:id/pulls', async (req, res) => {
+    const userId = req.session.userId;
+    const { id } = req.params;
+    const { title, body, head, base } = req.body;
+    if (!title || !head || !base) {
+        return res.status(400).json({ error: 'title, head, and base are required' });
+    }
+    try {
+        // Find the repository
+        const repository = await db.repositories.findById(id);
+        if (!repository || repository.userId !== userId) {
+            return res.status(404).json({ error: 'Repository not found' });
+        }
+        if (!repository.nangoConnectionId) {
+            return res.status(400).json({ error: 'Repository not connected via Nango' });
+        }
+        // Create PR via Nango Proxy (handles token injection automatically)
+        const [owner, repo] = repository.githubFullName.split('/');
+        const pr = await nangoService.createGithubPullRequest(repository.nangoConnectionId, owner, repo, { title, body: body || '', head, base });
+        res.json({
+            number: pr.number,
+            url: pr.html_url,
+        });
+    }
+    catch (error) {
+        console.error('Error creating PR:', error);
+        res.status(500).json({ error: 'Failed to create pull request' });
+    }
+});
+/**
+ * POST /api/github-app/repos/:id/comments
+ * Add a comment to an issue or PR
+ */
+githubAppRouter.post('/repos/:id/comments', async (req, res) => {
+    const userId = req.session.userId;
+    const { id } = req.params;
+    const { issueNumber, body } = req.body;
+    if (!issueNumber || !body) {
+        return res.status(400).json({ error: 'issueNumber and body are required' });
+    }
+    try {
+        const repository = await db.repositories.findById(id);
+        if (!repository || repository.userId !== userId) {
+            return res.status(404).json({ error: 'Repository not found' });
+        }
+        if (!repository.nangoConnectionId) {
+            return res.status(400).json({ error: 'Repository not connected via Nango' });
+        }
+        // Add comment via Nango Proxy (handles token injection automatically)
+        const [owner, repo] = repository.githubFullName.split('/');
+        const comment = await nangoService.addGithubIssueComment(repository.nangoConnectionId, owner, repo, issueNumber, body);
+        res.json({
+            id: comment.id,
+            url: comment.html_url,
+        });
+    }
+    catch (error) {
+        console.error('Error adding comment:', error);
+        res.status(500).json({ error: 'Failed to add comment' });
+    }
+});
+//# sourceMappingURL=github-app.js.map

package/dist/cloud/api/middleware/planLimits.d.ts

@@ -33,4 +33,11 @@ export declare function checkAgentLimit(req: Request, res: Response, next: NextF
  * Coordinators are only available on Pro plan and above.
  */
 export declare function checkCoordinatorAccess(req: Request, res: Response, next: NextFunction): Promise<void>;
+/**
+ * Middleware to check session persistence access
+ *
+ * Use this middleware on endpoints that enable cloud session persistence.
+ * Session persistence is only available on Pro plan and above.
+ */
+export declare function checkSessionPersistenceAccess(req: Request, res: Response, next: NextFunction): Promise<void>;
 //# sourceMappingURL=planLimits.d.ts.map

package/dist/cloud/api/middleware/planLimits.js

@@ -3,7 +3,7 @@
  *
  * Express middleware to enforce plan-based resource limits.
  */
-import { canCreateWorkspace, canAddRepo, canSpawnAgent, canUseCoordinator, } from '../../services/planLimits.js';
+import { canCreateWorkspace, canAddRepo, canSpawnAgent, canUseCoordinator, canUseSessionPersistence, } from '../../services/planLimits.js';
 /**
  * Middleware to check workspace creation limit
  *
@@ -161,4 +161,42 @@ export async function checkCoordinatorAccess(req, res, next) {
         res.status(500).json({ error: 'Failed to check coordinator access' });
     }
 }
+/**
+ * Middleware to check session persistence access
+ *
+ * Use this middleware on endpoints that enable cloud session persistence.
+ * Session persistence is only available on Pro plan and above.
+ */
+export async function checkSessionPersistenceAccess(req, res, next) {
+    const userId = req.session.userId;
+    if (!userId) {
+        res.status(401).json({ error: 'Authentication required' });
+        return;
+    }
+    try {
+        const check = await canUseSessionPersistence(userId);
+        if (!check.allowed) {
+            const response = {
+                error: check.reason || 'Session persistence not available',
+                code: 'FEATURE_NOT_AVAILABLE',
+                details: {
+                    plan: 'current',
+                    resource: 'sessionPersistence',
+                    requiredPlan: check.requiredPlan,
+                },
+                upgrade: {
+                    message: 'Upgrade to Pro to enable cloud session persistence',
+                    url: '/settings/billing',
+                },
+            };
+            res.status(402).json(response);
+            return;
+        }
+        next();
+    }
+    catch (error) {
+        console.error('Error checking session persistence access:', error);
+        res.status(500).json({ error: 'Failed to check session persistence access' });
+    }
+}
 //# sourceMappingURL=planLimits.js.map

package/dist/cloud/api/monitoring.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Agent Monitoring API Routes
+ *
+ * Provides endpoints for:
+ * - Real-time memory metrics collection
+ * - Crash insights and history
+ * - Proactive alerting
+ * - System health dashboard
+ */
+export declare const monitoringRouter: import("express-serve-static-core").Router;
+//# sourceMappingURL=monitoring.d.ts.map