agent-relay 1.1.0 → 1.2.3

package/dist/cloud/api/onboarding.js

@@ -2,59 +2,62 @@
  * Onboarding API Routes
  *
  * Handles CLI proxy authentication for Claude Code and other providers.
- * Spawns CLI tools to get auth URLs, captures tokens.
+ * Spawns CLI tools via PTY to get auth URLs, captures tokens.
+ *
+ * We use node-pty instead of child_process.spawn because:
+ * 1. Many CLIs detect if they're in a TTY and behave differently
+ * 2. Interactive OAuth flows often require TTY for proper output
+ * 3. PTY ensures the CLI outputs auth URLs correctly
  */
 import { Router } from 'express';
-import { spawn } from 'child_process';
-import crypto from 'crypto';
+import * as crypto from 'crypto';
 import { requireAuth } from './auth.js';
 import { db } from '../db/index.js';
 import { vault } from '../vault/index.js';
+// Import for local use
+import { CLI_AUTH_CONFIG, runCLIAuthViaPTY, stripAnsiCodes, matchesSuccessPattern, findMatchingPrompt, validateProviderConfig, validateAllProviderConfigs, getSupportedProviders, } from './cli-pty-runner.js';
+// Re-export from shared module for backward compatibility
+export { CLI_AUTH_CONFIG, runCLIAuthViaPTY, stripAnsiCodes, matchesSuccessPattern, findMatchingPrompt, validateProviderConfig, validateAllProviderConfigs, getSupportedProviders, };
 export const onboardingRouter = Router();
+// Debug: log all requests to this router
+onboardingRouter.use((req, res, next) => {
+    console.log(`[onboarding] ${req.method} ${req.path} - body:`, JSON.stringify(req.body));
+    next();
+});
 // All routes require authentication
 onboardingRouter.use(requireAuth);
 const activeSessions = new Map();
 // Clean up old sessions periodically
 setInterval(() => {
     const now = Date.now();
-    for (const [id, session] of activeSessions) {
+    activeSessions.forEach((session, id) => {
         // Remove sessions older than 10 minutes
         if (now - session.createdAt.getTime() > 10 * 60 * 1000) {
             if (session.process) {
-                session.process.kill();
+                try {
+                    session.process.kill();
+                }
+                catch {
+                    // Process may already be dead
+                }
             }
             activeSessions.delete(id);
         }
-    }
+    });
 }, 60000);
-/**
- * CLI commands and URL patterns for each provider
- */
-const CLI_AUTH_CONFIG = {
-    anthropic: {
-        // Claude Code CLI login
-        command: 'claude',
-        args: ['login', '--no-open'],
-        // Claude outputs: "Please open: https://..."
-        urlPattern: /(?:open|visit|go to)[:\s]+(\S+anthropic\S+)/i,
-        // Token might be in output or in credentials file
-        credentialPath: '~/.claude/credentials.json',
-    },
-    openai: {
-        // Codex CLI auth
-        command: 'codex',
-        args: ['auth', '--no-browser'],
-        urlPattern: /(?:open|visit|go to)[:\s]+(\S+openai\S+)/i,
-        credentialPath: '~/.codex/credentials.json',
-    },
-};
 /**
  * POST /api/onboarding/cli/:provider/start
- * Start CLI-based auth - spawns the CLI and captures auth URL
+ * Start CLI-based auth - forwards to workspace daemon if available
+ *
+ * CLI auth requires a running workspace since CLI tools are installed there.
+ * For onboarding without a workspace, users should use the API key flow.
  */
 onboardingRouter.post('/cli/:provider/start', async (req, res) => {
+    console.log('[onboarding] Route handler entered! provider:', req.params.provider);
     const { provider } = req.params;
     const userId = req.session.userId;
+    const { workspaceId, useDeviceFlow } = req.body; // Optional: specific workspace, device flow option
+    console.log('[onboarding] userId:', userId, 'workspaceId:', workspaceId, 'useDeviceFlow:', useDeviceFlow);
     const config = CLI_AUTH_CONFIG[provider];
     if (!config) {
         return res.status(400).json({
@@ -62,93 +65,108 @@ onboardingRouter.post('/cli/:provider/start', async (req, res) => {
             supportedProviders: Object.keys(CLI_AUTH_CONFIG),
         });
     }
-    // Create session
-    const sessionId = crypto.randomUUID();
-    const session = {
-        userId,
-        provider,
-        status: 'starting',
-        createdAt: new Date(),
-    };
-    activeSessions.set(sessionId, session);
     try {
-        // Spawn CLI process
-        const proc = spawn(config.command, config.args, {
-            env: { ...process.env, NO_COLOR: '1' },
-            stdio: ['pipe', 'pipe', 'pipe'],
-        });
-        session.process = proc;
-        let _output = '';
-        // Capture stdout/stderr for auth URL
-        const handleOutput = (data) => {
-            const text = data.toString();
-            _output += text;
-            // Look for auth URL
-            const match = text.match(config.urlPattern);
-            if (match && match[1]) {
-                session.authUrl = match[1];
-                session.status = 'waiting_auth';
-            }
-            // Look for success indicators
-            if (text.toLowerCase().includes('success') ||
-                text.toLowerCase().includes('authenticated') ||
-                text.toLowerCase().includes('logged in')) {
-                session.status = 'success';
-            }
-        };
-        proc.stdout.on('data', handleOutput);
-        proc.stderr.on('data', handleOutput);
-        proc.on('error', (err) => {
-            session.status = 'error';
-            session.error = `Failed to start CLI: ${err.message}`;
-        });
-        proc.on('exit', async (code) => {
-            if (code === 0 && session.status !== 'error') {
-                session.status = 'success';
-                // Try to read credentials from file
-                await extractCredentials(session, config);
+        // Find a running workspace to use for CLI auth
+        let workspace;
+        if (workspaceId) {
+            workspace = await db.workspaces.findById(workspaceId);
+            if (!workspace) {
+                console.log(`[onboarding] Workspace ${workspaceId} not found in database`);
+                return res.status(404).json({ error: 'Workspace not found' });
             }
-            else if (session.status === 'starting') {
-                session.status = 'error';
-                session.error = `CLI exited with code ${code}`;
+            if (workspace.userId !== userId) {
+                console.log(`[onboarding] Workspace ${workspaceId} belongs to ${workspace.userId}, not ${userId}`);
+                return res.status(404).json({ error: 'Workspace not found' });
             }
-        });
-        // Wait a moment for URL to appear
-        await new Promise(resolve => setTimeout(resolve, 2000));
-        // Return session info
-        if (session.authUrl) {
-            res.json({
-                sessionId,
-                status: 'waiting_auth',
-                authUrl: session.authUrl,
-                message: 'Open the auth URL to complete login',
+        }
+        else {
+            // Find any running workspace for this user
+            const workspaces = await db.workspaces.findByUserId(userId);
+            workspace = workspaces.find(w => w.status === 'running' && w.publicUrl);
+        }
+        if (!workspace || workspace.status !== 'running' || !workspace.publicUrl) {
+            return res.status(400).json({
+                error: 'CLI auth requires a running workspace',
+                code: 'NO_RUNNING_WORKSPACE',
+                message: 'Please start a workspace first, or use the API key input to connect your provider.',
+                hint: 'You can create a workspace without providers and connect them afterward using CLI auth.',
             });
         }
-        else if (session.status === 'error') {
-            activeSessions.delete(sessionId);
-            res.status(500).json({ error: session.error || 'CLI auth failed to start' });
+        // Forward auth request to workspace daemon
+        // When running in Docker, localhost refers to the container, not the host
+        // Use host.docker.internal on Mac/Windows to reach the host machine
+        // When running on Fly.io, use internal networking (.internal) instead of public DNS
+        let workspaceUrl = workspace.publicUrl.replace(/\/$/, '');
+        // Detect Fly.io by checking FLY_APP_NAME env var
+        const isOnFly = !!process.env.FLY_APP_NAME;
+        // Detect Docker by checking for /.dockerenv file or RUNNING_IN_DOCKER env var
+        const isInDocker = process.env.RUNNING_IN_DOCKER === 'true' ||
+            await import('fs').then(fs => fs.existsSync('/.dockerenv')).catch(() => false);
+        console.log('[onboarding] isOnFly:', isOnFly, 'isInDocker:', isInDocker);
+        if (isOnFly && workspaceUrl.includes('.fly.dev')) {
+            // Use Fly.io internal networking for server-to-server communication
+            // ar-583f273b.fly.dev -> http://ar-583f273b.internal:3888
+            // .internal uses IPv6 and works by default for apps in the same org
+            const appName = workspaceUrl.match(/https?:\/\/([^.]+)\.fly\.dev/)?.[1];
+            if (appName) {
+                workspaceUrl = `http://${appName}.internal:3888`;
+                console.log('[onboarding] Using Fly internal network:', workspaceUrl);
+            }
         }
-        else {
-            // Still starting, return session ID to poll
-            res.json({
-                sessionId,
-                status: 'starting',
-                message: 'Auth session starting, poll for status',
+        else if (isInDocker && workspaceUrl.includes('localhost')) {
+            workspaceUrl = workspaceUrl.replace('localhost', 'host.docker.internal');
+            console.log('[onboarding] Translated localhost to host.docker.internal');
+        }
+        const targetUrl = `${workspaceUrl}/auth/cli/${provider}/start`;
+        console.log('[onboarding] Forwarding to workspace daemon:', targetUrl);
+        const authResponse = await fetch(targetUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ useDeviceFlow }),
+        });
+        console.log('[onboarding] Workspace daemon response:', authResponse.status);
+        if (!authResponse.ok) {
+            const errorData = await authResponse.json().catch(() => ({}));
+            console.log('[onboarding] Workspace daemon error:', errorData);
+            return res.status(authResponse.status).json({
+                error: errorData.error || 'Failed to start CLI auth in workspace',
             });
         }
+        const workspaceSession = await authResponse.json();
+        // Create cloud session to track this
+        const sessionId = crypto.randomUUID();
+        const session = {
+            userId,
+            provider,
+            status: workspaceSession.status || 'starting',
+            authUrl: workspaceSession.authUrl,
+            createdAt: new Date(),
+            output: '',
+            // Store workspace info for status polling and auth code forwarding
+            workspaceUrl,
+            workspaceSessionId: workspaceSession.sessionId,
+        };
+        activeSessions.set(sessionId, session);
+        console.log('[onboarding] Session created:', { sessionId, workspaceUrl, workspaceSessionId: workspaceSession.sessionId });
+        res.json({
+            sessionId,
+            status: session.status,
+            authUrl: session.authUrl,
+            workspaceId: workspace.id,
+            message: session.authUrl ? 'Open the auth URL to complete login' : 'Auth session starting, poll for status',
+        });
     }
     catch (error) {
-        activeSessions.delete(sessionId);
         console.error(`Error starting CLI auth for ${provider}:`, error);
         res.status(500).json({ error: 'Failed to start CLI authentication' });
     }
 });
 /**
  * GET /api/onboarding/cli/:provider/status/:sessionId
- * Check status of CLI auth session
+ * Check status of CLI auth session - forwards to workspace daemon
  */
-onboardingRouter.get('/cli/:provider/status/:sessionId', (req, res) => {
-    const { sessionId } = req.params;
+onboardingRouter.get('/cli/:provider/status/:sessionId', async (req, res) => {
+    const { provider, sessionId } = req.params;
     const userId = req.session.userId;
     const session = activeSessions.get(sessionId);
     if (!session) {
@@ -157,6 +175,22 @@ onboardingRouter.get('/cli/:provider/status/:sessionId', (req, res) => {
     if (session.userId !== userId) {
         return res.status(403).json({ error: 'Unauthorized' });
     }
+    // If we have workspace info, poll the workspace for status
+    if (session.workspaceUrl && session.workspaceSessionId) {
+        try {
+            const statusResponse = await fetch(`${session.workspaceUrl}/auth/cli/${provider}/status/${session.workspaceSessionId}`);
+            if (statusResponse.ok) {
+                const workspaceStatus = await statusResponse.json();
+                // Update local session with workspace status
+                session.status = workspaceStatus.status || session.status;
+                session.authUrl = workspaceStatus.authUrl || session.authUrl;
+                session.error = workspaceStatus.error;
+            }
+        }
+        catch (err) {
+            console.error('[onboarding] Failed to poll workspace status:', err);
+        }
+    }
     res.json({
         status: session.status,
         authUrl: session.authUrl,
@@ -166,11 +200,16 @@ onboardingRouter.get('/cli/:provider/status/:sessionId', (req, res) => {
 /**
  * POST /api/onboarding/cli/:provider/complete/:sessionId
  * Mark CLI auth as complete and store credentials
+ *
+ * Handles two modes:
+ * 1. Workspace delegation: Forwards to workspace daemon to complete auth, then fetches credentials
+ * 2. Direct: Uses token from body or session
  */
 onboardingRouter.post('/cli/:provider/complete/:sessionId', async (req, res) => {
     const { provider, sessionId } = req.params;
     const userId = req.session.userId;
-    const { token } = req.body; // Optional: user can paste token directly
+    const { token, authCode } = req.body; // token for direct mode, authCode for Codex redirect
+    console.log(`[onboarding] POST /cli/${provider}/complete/${sessionId} - token: ${token ? 'provided' : 'none'}, authCode: ${authCode ? 'provided' : 'none'}`);
     const session = activeSessions.get(sessionId);
     if (!session) {
         return res.status(404).json({ error: 'Session not found or expired' });
@@ -179,14 +218,49 @@ onboardingRouter.post('/cli/:provider/complete/:sessionId', async (req, res) =>
         return res.status(403).json({ error: 'Unauthorized' });
     }
     try {
-        // If token provided directly, use it
         let accessToken = token || session.token;
-        // If no token yet, try to read from credentials file
-        if (!accessToken) {
-            const config = CLI_AUTH_CONFIG[provider];
-            if (config) {
-                await extractCredentials(session, config);
-                accessToken = session.token;
+        let refreshToken = session.refreshToken;
+        let tokenExpiresAt = session.tokenExpiresAt;
+        // If using workspace delegation, forward complete request first
+        if (session.workspaceUrl && session.workspaceSessionId) {
+            // Forward authCode to workspace if provided (for Codex-style redirects)
+            if (authCode) {
+                const backendProviderId = provider === 'anthropic' ? 'anthropic' : provider;
+                const targetUrl = `${session.workspaceUrl}/auth/cli/${backendProviderId}/complete/${session.workspaceSessionId}`;
+                console.log('[onboarding] Forwarding complete request to workspace:', targetUrl);
+                const completeResponse = await fetch(targetUrl, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify({ authCode }),
+                });
+                if (!completeResponse.ok) {
+                    const errorData = await completeResponse.json().catch(() => ({}));
+                    return res.status(completeResponse.status).json({
+                        error: errorData.error || 'Failed to complete authentication in workspace',
+                    });
+                }
+                session.status = 'success';
+            }
+            // Fetch credentials from workspace
+            if (!accessToken) {
+                try {
+                    const credsResponse = await fetch(`${session.workspaceUrl}/auth/cli/${provider}/creds/${session.workspaceSessionId}`);
+                    if (credsResponse.ok) {
+                        const creds = await credsResponse.json();
+                        accessToken = creds.token;
+                        refreshToken = creds.refreshToken;
+                        if (creds.expiresAt) {
+                            tokenExpiresAt = new Date(creds.expiresAt);
+                        }
+                        console.log('[onboarding] Fetched credentials from workspace:', {
+                            hasToken: !!accessToken,
+                            hasRefreshToken: !!refreshToken,
+                        });
+                    }
+                }
+                catch (err) {
+                    console.error('[onboarding] Failed to get credentials from workspace:', err);
+                }
             }
         }
         if (!accessToken) {
@@ -194,17 +268,16 @@ onboardingRouter.post('/cli/:provider/complete/:sessionId', async (req, res) =>
                 error: 'No token found. Please complete authentication or paste your token.',
             });
         }
-        // Store in vault
+        // Store in vault with refresh token and expiry
         await vault.storeCredential({
             userId,
             provider,
             accessToken,
+            refreshToken,
+            tokenExpiresAt,
             scopes: getProviderScopes(provider),
         });
         // Clean up session
-        if (session.process) {
-            session.process.kill();
-        }
         activeSessions.delete(sessionId);
         res.json({
             success: true,
@@ -216,17 +289,93 @@ onboardingRouter.post('/cli/:provider/complete/:sessionId', async (req, res) =>
         res.status(500).json({ error: 'Failed to complete authentication' });
     }
 });
+/**
+ * POST /api/onboarding/cli/:provider/code/:sessionId
+ * Submit auth code to the CLI PTY session
+ * Used when OAuth returns a code that must be pasted into the CLI
+ */
+onboardingRouter.post('/cli/:provider/code/:sessionId', async (req, res) => {
+    const { provider, sessionId } = req.params;
+    const userId = req.session.userId;
+    const { code } = req.body;
+    console.log('[onboarding] Auth code submission request:', { provider, sessionId, codeLength: code?.length });
+    if (!code || typeof code !== 'string') {
+        return res.status(400).json({ error: 'Auth code is required' });
+    }
+    const session = activeSessions.get(sessionId);
+    if (!session) {
+        console.log('[onboarding] Session not found:', { sessionId, activeSessions: Array.from(activeSessions.keys()) });
+        return res.status(404).json({ error: 'Session not found or expired. Please try connecting again.' });
+    }
+    if (session.userId !== userId) {
+        return res.status(403).json({ error: 'Unauthorized' });
+    }
+    console.log('[onboarding] Session found:', {
+        sessionId,
+        workspaceUrl: session.workspaceUrl,
+        workspaceSessionId: session.workspaceSessionId,
+        status: session.status,
+    });
+    // Forward to workspace daemon
+    if (session.workspaceUrl && session.workspaceSessionId) {
+        try {
+            const targetUrl = `${session.workspaceUrl}/auth/cli/${provider}/code/${session.workspaceSessionId}`;
+            console.log('[onboarding] Forwarding auth code to workspace:', targetUrl);
+            const codeResponse = await fetch(targetUrl, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ code }),
+            });
+            console.log('[onboarding] Workspace response:', { status: codeResponse.status });
+            if (codeResponse.ok) {
+                return res.json({ success: true, message: 'Auth code submitted' });
+            }
+            const errorData = await codeResponse.json().catch(() => ({}));
+            console.log('[onboarding] Workspace error:', errorData);
+            // Provide more helpful error message
+            const needsRestart = errorData.needsRestart;
+            if (codeResponse.status === 404 || codeResponse.status === 400) {
+                return res.status(400).json({
+                    error: errorData.error || 'Auth session expired in workspace. The CLI process may have timed out. Please try connecting again.',
+                    needsRestart: needsRestart ?? true,
+                });
+            }
+            return res.status(codeResponse.status).json({
+                error: errorData.error || 'Failed to submit auth code to workspace',
+                needsRestart,
+            });
+        }
+        catch (err) {
+            console.error('[onboarding] Failed to submit auth code to workspace:', err);
+            return res.status(500).json({
+                error: 'Failed to reach workspace. Please ensure your workspace is running and try again.',
+            });
+        }
+    }
+    console.log('[onboarding] No workspace session info available');
+    return res.status(400).json({
+        error: 'No workspace session available. This can happen if the workspace was restarted. Please try connecting again.',
+    });
+});
+// Note: POST /cli/:provider/complete/:sessionId handler is defined above (lines 269-368)
+// It handles both direct token storage and workspace delegation with authCode forwarding
 /**
  * POST /api/onboarding/cli/:provider/cancel/:sessionId
  * Cancel a CLI auth session
  */
-onboardingRouter.post('/cli/:provider/cancel/:sessionId', (req, res) => {
-    const { sessionId } = req.params;
+onboardingRouter.post('/cli/:provider/cancel/:sessionId', async (req, res) => {
+    const { provider, sessionId } = req.params;
     const userId = req.session.userId;
     const session = activeSessions.get(sessionId);
     if (session?.userId === userId) {
-        if (session.process) {
-            session.process.kill();
+        // Cancel on workspace side if applicable
+        if (session.workspaceUrl && session.workspaceSessionId) {
+            try {
+                await fetch(`${session.workspaceUrl}/auth/cli/${provider}/cancel/${session.workspaceSessionId}`, { method: 'POST' });
+            }
+            catch {
+                // Ignore cancel errors
+            }
         }
         activeSessions.delete(sessionId);
     }
@@ -319,8 +468,9 @@ onboardingRouter.post('/complete', async (req, res) => {
 });
 /**
  * Helper: Extract credentials from CLI credential file
+ * @deprecated Currently unused - kept for potential future use
  */
-async function extractCredentials(session, config) {
+async function _extractCredentials(session, config) {
     if (!config.credentialPath)
         return;
     try {
@@ -331,12 +481,31 @@ async function extractCredentials(session, config) {
         const creds = JSON.parse(content);
         // Extract token based on provider structure
         if (session.provider === 'anthropic') {
-            // Claude stores: { "oauth_token": "...", ... } or { "api_key": "..." }
-            session.token = creds.oauth_token || creds.access_token || creds.api_key;
+            // Claude stores OAuth in: { claudeAiOauth: { accessToken: "...", refreshToken: "...", expiresAt: ... } }
+            if (creds.claudeAiOauth?.accessToken) {
+                session.token = creds.claudeAiOauth.accessToken;
+                session.refreshToken = creds.claudeAiOauth.refreshToken;
+                if (creds.claudeAiOauth.expiresAt) {
+                    session.tokenExpiresAt = new Date(creds.claudeAiOauth.expiresAt);
+                }
+            }
+            else {
+                // Fallback to legacy formats
+                session.token = creds.oauth_token || creds.access_token || creds.api_key;
+            }
         }
         else if (session.provider === 'openai') {
-            // Codex might store: { "token": "..." } or { "api_key": "..." }
-            session.token = creds.token || creds.access_token || creds.api_key;
+            // Codex stores OAuth in: { tokens: { access_token: "...", refresh_token: "...", ... } }
+            if (creds.tokens?.access_token) {
+                session.token = creds.tokens.access_token;
+                session.refreshToken = creds.tokens.refresh_token;
+                // Codex doesn't store expiry in the file, but JWTs have exp claim
+                // We could decode it, but for now just skip
+            }
+            else {
+                // Fallback: API key or legacy formats
+                session.token = creds.OPENAI_API_KEY || creds.token || creds.access_token || creds.api_key;
+            }
         }
     }
     catch (error) {
@@ -358,9 +527,34 @@ function getProviderScopes(provider) {
 }
 /**
  * Helper: Validate a provider token by making a test API call
+ *
+ * Note: OAuth tokens from CLI flows (like `claude` CLI) are different from API keys.
+ * - API keys: sk-ant-api03-... (can be validated via API)
+ * - OAuth tokens: Session tokens from OAuth flow (can't be validated the same way)
+ *
+ * For OAuth tokens, we accept them if they look valid (non-empty, reasonable length).
+ * The CLI already validated the OAuth flow, so we trust those tokens.
  */
 async function validateProviderToken(provider, token) {
+    // Basic sanity check
+    if (!token || token.length < 10) {
+        return false;
+    }
     try {
+        // Check if this looks like an API key vs OAuth token
+        const isAnthropicApiKey = token.startsWith('sk-ant-');
+        const isOpenAIApiKey = token.startsWith('sk-');
+        // For OAuth tokens (not API keys), accept them without API validation
+        // The OAuth flow already authenticated the user
+        if (provider === 'anthropic' && !isAnthropicApiKey) {
+            console.log('[onboarding] Accepting OAuth token for anthropic (not an API key)');
+            return true;
+        }
+        if (provider === 'openai' && !isOpenAIApiKey) {
+            console.log('[onboarding] Accepting OAuth token for openai (not an API key)');
+            return true;
+        }
+        // For API keys, validate via API call
         const endpoints = {
             anthropic: {
                 url: 'https://api.anthropic.com/v1/messages',

package/dist/cloud/api/policy.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Agent Policy API Routes
+ *
+ * Provides endpoints for managing workspace-level agent policies.
+ * These policies serve as fallbacks when repos don't have .claude/policies/ files.
+ */
+export declare const policyRouter: import("express-serve-static-core").Router;
+//# sourceMappingURL=policy.d.ts.map