agent-relay 1.1.0 → 1.2.3

package/dist/cloud/api/policy.js

@@ -0,0 +1,229 @@
+/**
+ * Agent Policy API Routes
+ *
+ * Provides endpoints for managing workspace-level agent policies.
+ * These policies serve as fallbacks when repos don't have .claude/policies/ files.
+ */
+import { Router } from 'express';
+import { db } from '../db/index.js';
+export const policyRouter = Router();
+/**
+ * GET /api/policy/:workspaceId
+ * Get the agent policy for a workspace
+ */
+policyRouter.get('/:workspaceId', async (req, res) => {
+    const { workspaceId } = req.params;
+    const userId = req.userId;
+    if (!userId) {
+        return res.status(401).json({ error: 'Unauthorized' });
+    }
+    try {
+        const workspace = await db.workspaces.findById(workspaceId);
+        if (!workspace) {
+            return res.status(404).json({ error: 'Workspace not found' });
+        }
+        // Check user has access to this workspace
+        if (workspace.userId !== userId) {
+            const members = await db.workspaceMembers.findByWorkspaceId(workspaceId);
+            const member = members.find(m => m.userId === userId);
+            if (!member) {
+                return res.status(403).json({ error: 'Access denied' });
+            }
+        }
+        // Return the policy (or default if not set)
+        const policy = workspace.config?.agentPolicy ?? getDefaultPolicy();
+        res.json({
+            workspaceId,
+            policy,
+            source: workspace.config?.agentPolicy ? 'workspace' : 'default',
+        });
+    }
+    catch (error) {
+        console.error('[policy] Error getting policy:', error);
+        res.status(500).json({ error: 'Failed to get policy' });
+    }
+});
+/**
+ * PUT /api/policy/:workspaceId
+ * Update the agent policy for a workspace
+ */
+policyRouter.put('/:workspaceId', async (req, res) => {
+    const { workspaceId } = req.params;
+    const userId = req.userId;
+    const policy = req.body.policy;
+    if (!userId) {
+        return res.status(401).json({ error: 'Unauthorized' });
+    }
+    if (!policy || typeof policy !== 'object') {
+        return res.status(400).json({ error: 'Policy object is required' });
+    }
+    try {
+        const workspace = await db.workspaces.findById(workspaceId);
+        if (!workspace) {
+            return res.status(404).json({ error: 'Workspace not found' });
+        }
+        // Only owner can update policy
+        if (workspace.userId !== userId) {
+            const members = await db.workspaceMembers.findByWorkspaceId(workspaceId);
+            const member = members.find(m => m.userId === userId);
+            if (!member || !['owner', 'admin'].includes(member.role)) {
+                return res.status(403).json({ error: 'Only owners and admins can update policy' });
+            }
+        }
+        // Validate policy structure
+        const validationError = validatePolicy(policy);
+        if (validationError) {
+            return res.status(400).json({ error: validationError });
+        }
+        // Update workspace config with new policy
+        const newConfig = {
+            ...workspace.config,
+            agentPolicy: policy,
+        };
+        await db.workspaces.updateConfig(workspaceId, newConfig);
+        res.json({
+            success: true,
+            workspaceId,
+            policy,
+        });
+    }
+    catch (error) {
+        console.error('[policy] Error updating policy:', error);
+        res.status(500).json({ error: 'Failed to update policy' });
+    }
+});
+/**
+ * DELETE /api/policy/:workspaceId
+ * Reset workspace policy to defaults
+ */
+policyRouter.delete('/:workspaceId', async (req, res) => {
+    const { workspaceId } = req.params;
+    const userId = req.userId;
+    if (!userId) {
+        return res.status(401).json({ error: 'Unauthorized' });
+    }
+    try {
+        const workspace = await db.workspaces.findById(workspaceId);
+        if (!workspace) {
+            return res.status(404).json({ error: 'Workspace not found' });
+        }
+        // Only owner can reset policy
+        if (workspace.userId !== userId) {
+            const members = await db.workspaceMembers.findByWorkspaceId(workspaceId);
+            const member = members.find(m => m.userId === userId);
+            if (!member || member.role !== 'owner') {
+                return res.status(403).json({ error: 'Only owners can reset policy' });
+            }
+        }
+        // Remove policy from config
+        const { agentPolicy: _agentPolicy, ...restConfig } = workspace.config ?? {};
+        await db.workspaces.updateConfig(workspaceId, restConfig);
+        res.json({
+            success: true,
+            workspaceId,
+            policy: getDefaultPolicy(),
+            source: 'default',
+        });
+    }
+    catch (error) {
+        console.error('[policy] Error resetting policy:', error);
+        res.status(500).json({ error: 'Failed to reset policy' });
+    }
+});
+/**
+ * GET /api/policy/:workspaceId/internal
+ * Internal endpoint for workspace containers to fetch policy
+ * Uses workspace token authentication (not user auth)
+ */
+policyRouter.get('/:workspaceId/internal', async (req, res) => {
+    const { workspaceId } = req.params;
+    // This endpoint should be called with the workspace token
+    // The git.ts file has the token verification logic we can reuse
+    // For now, we'll trust the workspace ID from container requests
+    try {
+        const workspace = await db.workspaces.findById(workspaceId);
+        if (!workspace) {
+            return res.status(404).json({ error: 'Workspace not found' });
+        }
+        const policy = workspace.config?.agentPolicy ?? getDefaultPolicy();
+        res.json({
+            defaultPolicy: policy.defaultPolicy,
+            agents: policy.agents ?? [],
+            settings: policy.settings ?? {
+                requireExplicitAgents: false,
+                auditEnabled: true,
+                maxTotalAgents: 50,
+            },
+        });
+    }
+    catch (error) {
+        console.error('[policy] Error getting internal policy:', error);
+        res.status(500).json({ error: 'Failed to get policy' });
+    }
+});
+/**
+ * Get default policy
+ */
+function getDefaultPolicy() {
+    return {
+        defaultPolicy: {
+            name: '*',
+            allowedTools: undefined, // All tools allowed
+            canSpawn: undefined, // Can spawn any
+            canMessage: undefined, // Can message any
+            maxSpawns: 10,
+            rateLimit: 60,
+            canBeSpawned: true,
+        },
+        agents: [],
+        settings: {
+            requireExplicitAgents: false,
+            auditEnabled: true,
+            maxTotalAgents: 50,
+        },
+    };
+}
+/**
+ * Validate policy structure
+ */
+function validatePolicy(policy) {
+    // Validate defaultPolicy
+    if (policy.defaultPolicy && typeof policy.defaultPolicy !== 'object') {
+        return 'defaultPolicy must be an object';
+    }
+    // Validate agents array
+    if (policy.agents) {
+        if (!Array.isArray(policy.agents)) {
+            return 'agents must be an array';
+        }
+        for (let i = 0; i < policy.agents.length; i++) {
+            const agent = policy.agents[i];
+            if (!agent.name || typeof agent.name !== 'string') {
+                return `agents[${i}].name is required and must be a string`;
+            }
+            // Validate arrays
+            if (agent.allowedTools && !Array.isArray(agent.allowedTools)) {
+                return `agents[${i}].allowedTools must be an array`;
+            }
+            if (agent.canSpawn && !Array.isArray(agent.canSpawn)) {
+                return `agents[${i}].canSpawn must be an array`;
+            }
+            if (agent.canMessage && !Array.isArray(agent.canMessage)) {
+                return `agents[${i}].canMessage must be an array`;
+            }
+            // Validate numbers
+            if (agent.maxSpawns !== undefined && typeof agent.maxSpawns !== 'number') {
+                return `agents[${i}].maxSpawns must be a number`;
+            }
+            if (agent.rateLimit !== undefined && typeof agent.rateLimit !== 'number') {
+                return `agents[${i}].rateLimit must be a number`;
+            }
+        }
+    }
+    // Validate settings
+    if (policy.settings && typeof policy.settings !== 'object') {
+        return 'settings must be an object';
+    }
+    return null;
+}
+//# sourceMappingURL=policy.js.map

package/dist/cloud/api/providers.js

@@ -13,52 +13,47 @@ import { vault } from '../vault/index.js';
 export const providersRouter = Router();
 // All routes require authentication
 providersRouter.use(requireAuth);
-/**
- * Provider registry with OAuth/device flow configuration
- *
- * Auth Strategy:
- * - google: Real OAuth device flow (works today)
- * - anthropic: CLI-based auth (user runs `claude login`, we detect credentials)
- * - openai: CLI-based auth (user runs `codex auth`, we detect credentials)
- *
- * When providers add OAuth support, we can switch to device flow.
- */
 const PROVIDERS = {
     anthropic: {
         name: 'Anthropic',
         displayName: 'Claude',
         description: 'Claude Code - recommended for code tasks',
-        // Auth strategy: CLI-based until Anthropic adds OAuth
         authStrategy: 'cli',
-        cliCommand: 'claude login',
-        credentialPath: '~/.claude/credentials.json', // Where Claude stores tokens
-        // Future OAuth endpoints (hypothetical - for when Anthropic implements)
-        deviceCodeUrl: 'https://api.anthropic.com/oauth/device/code',
-        tokenUrl: 'https://api.anthropic.com/oauth/token',
-        userInfoUrl: 'https://api.anthropic.com/v1/user',
-        scopes: ['claude-code:execute', 'user:read'],
+        cliCommand: 'claude',
+        credentialPath: '~/.claude/credentials.json',
         color: '#D97757',
     },
-    openai: {
+    codex: {
         name: 'OpenAI',
         displayName: 'Codex',
-        description: 'Codex CLI for AI-assisted coding',
-        // Auth strategy: CLI-based until OpenAI adds OAuth
+        description: 'Codex - OpenAI coding assistant',
         authStrategy: 'cli',
-        cliCommand: 'codex auth',
+        cliCommand: 'codex login',
         credentialPath: '~/.codex/credentials.json',
-        // Future OAuth endpoints (hypothetical)
-        deviceCodeUrl: 'https://auth.openai.com/device/code',
-        tokenUrl: 'https://auth.openai.com/oauth/token',
-        userInfoUrl: 'https://api.openai.com/v1/user',
-        scopes: ['openid', 'profile', 'email', 'codex:execute'],
         color: '#10A37F',
     },
+    opencode: {
+        name: 'OpenCode',
+        displayName: 'OpenCode',
+        description: 'OpenCode - AI coding assistant',
+        authStrategy: 'cli',
+        cliCommand: 'opencode',
+        credentialPath: '~/.opencode/credentials.json',
+        color: '#00D4AA',
+    },
+    droid: {
+        name: 'Factory',
+        displayName: 'Droid',
+        description: 'Droid - Factory AI coding agent',
+        authStrategy: 'cli',
+        cliCommand: 'droid',
+        credentialPath: '~/.factory/credentials.json',
+        color: '#6366F1',
+    },
     google: {
         name: 'Google',
         displayName: 'Gemini',
         description: 'Gemini - multi-modal capabilities',
-        // Auth strategy: Real OAuth device flow (works today!)
         authStrategy: 'device_flow',
         deviceCodeUrl: 'https://oauth2.googleapis.com/device/code',
         tokenUrl: 'https://oauth2.googleapis.com/token',
@@ -67,6 +62,10 @@ const PROVIDERS = {
         color: '#4285F4',
     },
 };
+// Type guard for device flow providers
+function isDeviceFlowProvider(provider) {
+    return provider.authStrategy === 'device_flow';
+}
 let redisClient = null;
 async function getRedisClient() {
     if (!redisClient) {
@@ -171,7 +170,12 @@ providersRouter.post('/:provider/connect', async (req, res) => {
         });
     }
     // Device flow auth (Google) - start OAuth device flow
-    const clientConfig = config.providers[provider];
+    // At this point, we know it's a device flow provider (CLI was handled above)
+    if (!isDeviceFlowProvider(providerConfig)) {
+        return res.status(400).json({ error: 'Provider does not support device flow' });
+    }
+    // Only google is configured for device flow in config
+    const clientConfig = provider === 'google' ? config.providers.google : undefined;
     if (!clientConfig) {
         return res.status(400).json({ error: `Provider ${provider} not configured` });
     }
@@ -245,7 +249,7 @@ providersRouter.post('/:provider/verify', async (req, res) => {
             userId,
             provider,
             accessToken: 'cli-authenticated', // Placeholder - real token from CLI
-            scopes: providerConfig.scopes,
+            scopes: [], // CLI auth doesn't use scopes
             providerAccountEmail: req.body.email, // User can optionally provide
         });
         res.json({
@@ -259,6 +263,67 @@ providersRouter.post('/:provider/verify', async (req, res) => {
         res.status(500).json({ error: 'Failed to verify connection' });
     }
 });
+/**
+ * POST /api/providers/:provider/api-key
+ * Connect a provider using an API key (for cloud-hosted workspaces)
+ */
+providersRouter.post('/:provider/api-key', async (req, res) => {
+    const { provider } = req.params;
+    const userId = req.session.userId;
+    const { apiKey } = req.body;
+    if (!apiKey || typeof apiKey !== 'string') {
+        return res.status(400).json({ error: 'API key is required' });
+    }
+    const providerConfig = PROVIDERS[provider];
+    if (!providerConfig) {
+        return res.status(404).json({ error: 'Unknown provider' });
+    }
+    // Validate the API key by making a test request
+    try {
+        let isValid = false;
+        if (provider === 'anthropic') {
+            // Test Anthropic API key
+            const testRes = await fetch('https://api.anthropic.com/v1/messages', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'x-api-key': apiKey,
+                    'anthropic-version': '2023-06-01',
+                },
+                body: JSON.stringify({
+                    model: 'claude-3-haiku-20240307',
+                    max_tokens: 1,
+                    messages: [{ role: 'user', content: 'hi' }],
+                }),
+            });
+            // 200 = valid, 401 = invalid key, 400/other = might still be valid key
+            isValid = testRes.status !== 401;
+        }
+        else {
+            // For other providers, just accept the key
+            isValid = true;
+        }
+        if (!isValid) {
+            return res.status(400).json({ error: 'Invalid API key' });
+        }
+        // Store the API key - use scopes from device flow providers, empty for CLI providers
+        const scopes = isDeviceFlowProvider(providerConfig) ? providerConfig.scopes : [];
+        await vault.storeCredential({
+            userId,
+            provider,
+            accessToken: apiKey,
+            scopes,
+        });
+        res.json({
+            success: true,
+            message: `${providerConfig.displayName} connected`,
+        });
+    }
+    catch (error) {
+        console.error(`Error connecting ${provider} with API key:`, error);
+        res.status(500).json({ error: 'Failed to connect provider' });
+    }
+});
 /**
  * GET /api/providers/:provider/status/:flowId
  * Check status of device flow
@@ -329,6 +394,11 @@ providersRouter.delete('/:provider/flow/:flowId', (req, res) => {
  */
 async function pollForToken(flowId, provider, clientId) {
     const providerConfig = PROVIDERS[provider];
+    // Only device flow providers can poll for tokens
+    if (!isDeviceFlowProvider(providerConfig)) {
+        console.error(`Provider ${provider} does not support device flow polling`);
+        return;
+    }
     const poll = async (intervalMs) => {
         const current = await loadFlow(flowId);
         if (!current || current.status !== 'pending')
@@ -403,20 +473,22 @@ async function pollForToken(flowId, provider, clientId) {
  */
 async function storeProviderTokens(userId, provider, tokens) {
     const providerConfig = PROVIDERS[provider];
-    // Fetch user info from provider
+    // Fetch user info from provider (only device flow providers have userInfoUrl)
     let userInfo = {};
-    try {
-        const response = await fetch(providerConfig.userInfoUrl, {
-            headers: {
-                Authorization: `Bearer ${tokens.accessToken}`,
-            },
-        });
-        if (response.ok) {
-            userInfo = await response.json();
+    if (isDeviceFlowProvider(providerConfig)) {
+        try {
+            const response = await fetch(providerConfig.userInfoUrl, {
+                headers: {
+                    Authorization: `Bearer ${tokens.accessToken}`,
+                },
+            });
+            if (response.ok) {
+                userInfo = await response.json();
+            }
+        }
+        catch (error) {
+            console.error('Error fetching user info:', error);
         }
-    }
-    catch (error) {
-        console.error('Error fetching user info:', error);
     }
     // Encrypt and store
     await vault.storeCredential({

package/dist/cloud/api/repos.d.ts

@@ -2,6 +2,7 @@
  * Repos API Routes
  *
  * GitHub repository management - list, import, sync.
+ * Includes Nango-based GitHub permission checking for dashboard access control.
  */
 export declare const reposRouter: import("express-serve-static-core").Router;
 //# sourceMappingURL=repos.d.ts.map

package/dist/cloud/api/repos.js

@@ -2,10 +2,12 @@
  * Repos API Routes
  *
  * GitHub repository management - list, import, sync.
+ * Includes Nango-based GitHub permission checking for dashboard access control.
  */
 import { Router } from 'express';
 import { requireAuth } from './auth.js';
 import { db } from '../db/index.js';
+import { nangoService } from '../services/nango.js';
 export const reposRouter = Router();
 // All routes require authentication
 reposRouter.use(requireAuth);
@@ -311,4 +313,188 @@ reposRouter.get('/search', async (req, res) => {
         res.status(500).json({ error: 'Failed to search repositories' });
     }
 });
+// ============================================================================
+// Nango-based GitHub Permission APIs (for dashboard access control)
+// ============================================================================
+/**
+ * GET /api/repos/check-access/:owner/:repo
+ * Check if authenticated user has access to a specific GitHub repository.
+ * Uses Nango proxy with user's GitHub OAuth token.
+ *
+ * Response:
+ * - hasAccess: boolean - Whether user can access this repo
+ * - permission: 'admin' | 'write' | 'read' | 'none' - User's permission level
+ * - repository: Repository details if user has access
+ *
+ * Use this for dashboard access control - grant access if hasAccess is true.
+ */
+reposRouter.get('/check-access/:owner/:repo', async (req, res) => {
+    const userId = req.session.userId;
+    const { owner, repo } = req.params;
+    if (!owner || !repo) {
+        return res.status(400).json({ error: 'Owner and repo parameters are required' });
+    }
+    try {
+        // Get user's Nango connection ID
+        const user = await db.users.findById(userId);
+        if (!user) {
+            return res.status(404).json({ error: 'User not found' });
+        }
+        if (!user.nangoConnectionId) {
+            return res.status(400).json({
+                error: 'GitHub not connected via Nango',
+                code: 'NANGO_NOT_CONNECTED',
+                message: 'Please reconnect your GitHub account',
+            });
+        }
+        // Check access via Nango proxy
+        const accessResult = await nangoService.checkUserRepoAccess(user.nangoConnectionId, owner, repo);
+        res.json({
+            hasAccess: accessResult.hasAccess,
+            permission: accessResult.permission,
+            repository: accessResult.repository,
+            // Include user info for dashboard context
+            checkedBy: {
+                userId: user.id,
+                githubUsername: user.githubUsername,
+            },
+        });
+    }
+    catch (error) {
+        console.error('Error checking repo access:', error);
+        res.status(500).json({ error: 'Failed to check repository access' });
+    }
+});
+/**
+ * GET /api/repos/accessible
+ * List all GitHub repositories the authenticated user has access to.
+ * Uses Nango proxy with user's GitHub OAuth token.
+ *
+ * Query params:
+ * - page: Page number (default: 1)
+ * - perPage: Results per page (default: 100, max: 100)
+ * - type: Filter by type (all, owner, public, private, member)
+ * - sort: Sort by (created, updated, pushed, full_name)
+ *
+ * Use this to determine which dashboards/workspaces a user can access.
+ */
+reposRouter.get('/accessible', async (req, res) => {
+    const userId = req.session.userId;
+    const { page, perPage, type, sort } = req.query;
+    try {
+        // Get user's Nango connection ID
+        const user = await db.users.findById(userId);
+        if (!user) {
+            return res.status(404).json({ error: 'User not found' });
+        }
+        if (!user.nangoConnectionId) {
+            return res.status(400).json({
+                error: 'GitHub not connected via Nango',
+                code: 'NANGO_NOT_CONNECTED',
+                message: 'Please reconnect your GitHub account',
+            });
+        }
+        // List accessible repos via Nango proxy
+        const result = await nangoService.listUserAccessibleRepos(user.nangoConnectionId, {
+            page: page ? parseInt(page, 10) : undefined,
+            perPage: perPage ? Math.min(parseInt(perPage, 10), 100) : undefined,
+            type: type,
+            sort: sort,
+        });
+        res.json({
+            repositories: result.repositories,
+            pagination: {
+                page: page ? parseInt(page, 10) : 1,
+                perPage: perPage ? Math.min(parseInt(perPage, 10), 100) : 100,
+                hasMore: result.hasMore,
+            },
+            // Include user info for context
+            checkedBy: {
+                userId: user.id,
+                githubUsername: user.githubUsername,
+            },
+        });
+    }
+    catch (error) {
+        console.error('Error listing accessible repos:', error);
+        res.status(500).json({ error: 'Failed to list accessible repositories' });
+    }
+});
+/**
+ * POST /api/repos/check-access-bulk
+ * Check access to multiple repositories at once.
+ * Useful for determining which workspaces a user can view.
+ *
+ * Body:
+ * - repositories: Array of "owner/repo" strings
+ *
+ * Response:
+ * - results: Array of { fullName, hasAccess, permission }
+ */
+reposRouter.post('/check-access-bulk', async (req, res) => {
+    const userId = req.session.userId;
+    const { repositories } = req.body;
+    if (!repositories || !Array.isArray(repositories)) {
+        return res.status(400).json({ error: 'repositories array is required' });
+    }
+    if (repositories.length > 50) {
+        return res.status(400).json({ error: 'Maximum 50 repositories per request' });
+    }
+    try {
+        // Get user's Nango connection ID
+        const user = await db.users.findById(userId);
+        if (!user) {
+            return res.status(404).json({ error: 'User not found' });
+        }
+        if (!user.nangoConnectionId) {
+            return res.status(400).json({
+                error: 'GitHub not connected via Nango',
+                code: 'NANGO_NOT_CONNECTED',
+                message: 'Please reconnect your GitHub account',
+            });
+        }
+        // Check access for each repo (in parallel with concurrency limit)
+        const results = [];
+        // Process in batches of 10 to avoid rate limiting
+        const batchSize = 10;
+        for (let i = 0; i < repositories.length; i += batchSize) {
+            const batch = repositories.slice(i, i + batchSize);
+            const batchResults = await Promise.all(batch.map(async (fullName) => {
+                try {
+                    const [owner, repo] = fullName.split('/');
+                    if (!owner || !repo) {
+                        return { fullName, hasAccess: false, error: 'Invalid repository format' };
+                    }
+                    const accessResult = await nangoService.checkUserRepoAccess(user.nangoConnectionId, owner, repo);
+                    return {
+                        fullName,
+                        hasAccess: accessResult.hasAccess,
+                        permission: accessResult.permission,
+                    };
+                }
+                catch (_err) {
+                    return { fullName, hasAccess: false, error: 'Check failed' };
+                }
+            }));
+            results.push(...batchResults);
+        }
+        const accessibleCount = results.filter(r => r.hasAccess).length;
+        res.json({
+            results,
+            summary: {
+                total: repositories.length,
+                accessible: accessibleCount,
+                denied: repositories.length - accessibleCount,
+            },
+            checkedBy: {
+                userId: user.id,
+                githubUsername: user.githubUsername,
+            },
+        });
+    }
+    catch (error) {
+        console.error('Error checking bulk repo access:', error);
+        res.status(500).json({ error: 'Failed to check repository access' });
+    }
+});
 //# sourceMappingURL=repos.js.map

package/dist/cloud/api/test-helpers.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Test Helper API Routes
+ *
+ * These endpoints are ONLY available in test/development mode.
+ * They allow integration tests to create users and daemons without OAuth.
+ *
+ * IMPORTANT: These routes are disabled in production (NODE_ENV=production).
+ */
+export declare const testHelpersRouter: import("express-serve-static-core").Router;
+//# sourceMappingURL=test-helpers.d.ts.map