agent-relay 1.1.0 → 1.2.3

package/dist/cloud/api/webhooks.js

@@ -0,0 +1,645 @@
+/**
+ * Webhook API Routes
+ *
+ * Handles GitHub App webhooks for installation events.
+ * Also provides workspace webhook forwarding for external integrations.
+ */
+import { Router } from 'express';
+import crypto from 'crypto';
+import { getConfig } from '../config.js';
+import { db } from '../db/index.js';
+export const webhooksRouter = Router();
+// ============================================================================
+// Workspace Webhook Forwarding
+// ============================================================================
+/**
+ * Convert workspace public URL to internal Fly.io URL
+ */
+function getWorkspaceInternalUrl(publicUrl) {
+    const isOnFly = !!process.env.FLY_APP_NAME;
+    let url = publicUrl.replace(/\/$/, '');
+    if (isOnFly && url.includes('.fly.dev')) {
+        // Use Fly.io internal networking
+        // ar-583f273b.fly.dev -> http://ar-583f273b.internal:3888
+        // .internal uses IPv6 and works by default for apps in the same org
+        const appName = url.match(/https?:\/\/([^.]+)\.fly\.dev/)?.[1];
+        if (appName) {
+            url = `http://${appName}.internal:3888`;
+        }
+    }
+    return url;
+}
+/**
+ * Wake a suspended Fly.io workspace machine
+ */
+async function wakeWorkspaceMachine(workspaceId) {
+    const workspace = await db.workspaces.findById(workspaceId);
+    if (!workspace?.computeId)
+        return false;
+    const appName = `ar-${workspaceId.substring(0, 8)}`;
+    const apiToken = process.env.FLY_API_TOKEN;
+    if (!apiToken) {
+        console.warn('[webhooks] FLY_API_TOKEN not set, cannot wake machine');
+        return false;
+    }
+    try {
+        const response = await fetch(`https://api.machines.dev/v1/apps/${appName}/machines/${workspace.computeId}/start`, {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${apiToken}` },
+        });
+        if (response.ok) {
+            console.log(`[webhooks] Started workspace machine ${workspace.computeId}`);
+            // Wait a bit for machine to start
+            await new Promise(resolve => setTimeout(resolve, 5000));
+            return true;
+        }
+        // 200 OK means already running
+        if (response.status === 200) {
+            return true;
+        }
+        console.warn(`[webhooks] Failed to start machine: ${response.status}`);
+        return false;
+    }
+    catch (error) {
+        console.error('[webhooks] Error waking machine:', error);
+        return false;
+    }
+}
+/**
+ * POST /api/webhooks/workspace/:workspaceId/*
+ * Forward webhooks to a specific workspace
+ *
+ * External services can send webhooks to:
+ *   https://agent-relay.com/api/webhooks/workspace/{workspaceId}/your/path
+ *
+ * This will be forwarded to:
+ *   http://{workspace-internal}/webhooks/your/path
+ */
+// Handler for workspace webhook forwarding - matches any path under /workspace/:workspaceId
+async function handleWorkspaceWebhook(req, res) {
+    // Extract workspaceId from URL path
+    const pathMatch = req.originalUrl.match(/\/workspace\/([^/]+)\/?(.*)$/);
+    if (!pathMatch) {
+        res.status(400).json({ error: 'Invalid workspace webhook URL' });
+        return;
+    }
+    const workspaceId = pathMatch[1];
+    const forwardPath = pathMatch[2] || '';
+    console.log(`[webhooks] Forwarding to workspace ${workspaceId}: ${req.method} /${forwardPath}`);
+    try {
+        // Find the workspace
+        const workspace = await db.workspaces.findById(workspaceId);
+        if (!workspace) {
+            res.status(404).json({ error: 'Workspace not found' });
+            return;
+        }
+        if (!workspace.publicUrl) {
+            res.status(400).json({ error: 'Workspace has no public URL' });
+            return;
+        }
+        // Try to wake the machine if it might be suspended
+        if (workspace.status === 'running' || workspace.status === 'suspended') {
+            await wakeWorkspaceMachine(workspaceId);
+        }
+        // Get internal URL for server-to-server communication
+        const internalUrl = getWorkspaceInternalUrl(workspace.publicUrl);
+        const targetUrl = `${internalUrl}/webhooks/${forwardPath}`;
+        console.log(`[webhooks] Forwarding to: ${targetUrl}`);
+        // Forward the request with original headers and body
+        const forwardHeaders = {};
+        // Copy relevant headers
+        const headersToForward = [
+            'content-type',
+            'x-hub-signature-256',
+            'x-hub-signature',
+            'x-github-event',
+            'x-github-delivery',
+            'x-gitlab-token',
+            'x-gitlab-event',
+            'user-agent',
+        ];
+        for (const header of headersToForward) {
+            const value = req.get(header);
+            if (value) {
+                forwardHeaders[header] = value;
+            }
+        }
+        // Add workspace context header
+        forwardHeaders['x-forwarded-for-workspace'] = workspaceId;
+        forwardHeaders['x-original-host'] = req.get('host') || '';
+        // Get raw body if available, otherwise use JSON stringified body
+        const rawBody = req.rawBody || JSON.stringify(req.body);
+        const response = await fetch(targetUrl, {
+            method: req.method,
+            headers: forwardHeaders,
+            body: ['GET', 'HEAD'].includes(req.method) ? undefined : rawBody,
+        });
+        // Forward response back
+        const responseBody = await response.text();
+        res.status(response.status);
+        // Copy response headers
+        response.headers.forEach((value, key) => {
+            if (!['content-encoding', 'transfer-encoding', 'content-length'].includes(key.toLowerCase())) {
+                res.set(key, value);
+            }
+        });
+        res.send(responseBody);
+    }
+    catch (error) {
+        console.error(`[webhooks] Error forwarding to workspace ${workspaceId}:`, error);
+        res.status(502).json({
+            error: 'Failed to forward webhook to workspace',
+            details: error.message,
+        });
+    }
+}
+// TODO: Re-enable workspace webhook forwarding once route pattern issue is resolved
+// The newer path-to-regexp version doesn't support wildcard patterns like /workspace/*
+// See: https://git.new/pathToRegexpError
+// webhooksRouter.all('/workspace/*', handleWorkspaceWebhook);
+// GitHub webhook signature verification
+function verifyGitHubSignature(payload, signature) {
+    if (!signature)
+        return false;
+    const config = getConfig();
+    const secret = config.github.webhookSecret || config.github.clientSecret;
+    const expectedSignature = `sha256=${crypto
+        .createHmac('sha256', secret)
+        .update(payload)
+        .digest('hex')}`;
+    return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expectedSignature));
+}
+/**
+ * POST /api/webhooks/github
+ * Handle GitHub App webhook events
+ */
+webhooksRouter.post('/github', async (req, res) => {
+    const signature = req.get('x-hub-signature-256');
+    const event = req.get('x-github-event');
+    const deliveryId = req.get('x-github-delivery');
+    // Get raw body for signature verification
+    // Note: This requires raw body middleware to be set up
+    const rawBody = JSON.stringify(req.body);
+    // Verify signature
+    if (!verifyGitHubSignature(rawBody, signature)) {
+        console.error(`[webhook] Invalid signature for delivery ${deliveryId}`);
+        return res.status(401).json({ error: 'Invalid signature' });
+    }
+    console.log(`[webhook] Received ${event} event (delivery: ${deliveryId})`);
+    try {
+        switch (event) {
+            case 'installation':
+                await handleInstallationEvent(req.body);
+                break;
+            case 'installation_repositories':
+                await handleInstallationRepositoriesEvent(req.body);
+                break;
+            case 'push':
+                // Future: trigger sync for push events
+                console.log(`[webhook] Push to ${req.body.repository?.full_name}`);
+                break;
+            case 'pull_request':
+                // Future: handle PR events
+                console.log(`[webhook] PR ${req.body.action} on ${req.body.repository?.full_name}`);
+                break;
+            case 'issues':
+                await handleIssueEvent(req.body);
+                break;
+            case 'issue_comment':
+                await handleIssueCommentEvent(req.body);
+                break;
+            case 'pull_request_review_comment':
+                await handlePRReviewCommentEvent(req.body);
+                break;
+            case 'check_run':
+                await handleCheckRunEvent(req.body);
+                break;
+            case 'workflow_run':
+                await handleWorkflowRunEvent(req.body);
+                break;
+            default:
+                console.log(`[webhook] Unhandled event: ${event}`);
+        }
+        res.json({ received: true });
+    }
+    catch (error) {
+        console.error(`[webhook] Error processing ${event}:`, error);
+        res.status(500).json({ error: 'Failed to process webhook' });
+    }
+});
+/**
+ * Handle installation events (created, deleted, suspended, etc.)
+ */
+async function handleInstallationEvent(payload) {
+    const { action, installation, sender, repositories } = payload;
+    const installationId = String(installation.id);
+    console.log(`[webhook] Installation ${action}: ${installation.account.login} (${installationId})`);
+    switch (action) {
+        case 'created': {
+            // Find the user by their GitHub ID (the sender who installed the app)
+            const user = await db.users.findByGithubId(String(sender.id));
+            // Create/update the installation record
+            await db.githubInstallations.upsert({
+                installationId,
+                accountType: installation.account.type.toLowerCase(),
+                accountLogin: installation.account.login,
+                accountId: String(installation.account.id),
+                installedById: user?.id ?? null,
+                permissions: installation.permissions,
+                events: installation.events,
+            });
+            // If repositories were included, sync them
+            if (repositories && user) {
+                for (const repo of repositories) {
+                    const dbInstallation = await db.githubInstallations.findByInstallationId(installationId);
+                    if (dbInstallation) {
+                        await db.repositories.upsert({
+                            userId: user.id,
+                            githubFullName: repo.full_name,
+                            githubId: repo.id,
+                            isPrivate: repo.private,
+                            installationId: dbInstallation.id,
+                            syncStatus: 'synced',
+                            lastSyncedAt: new Date(),
+                        });
+                    }
+                }
+            }
+            console.log(`[webhook] Created installation for ${installation.account.login}`);
+            break;
+        }
+        case 'deleted': {
+            // Remove the installation
+            await db.githubInstallations.delete(installationId);
+            console.log(`[webhook] Deleted installation for ${installation.account.login}`);
+            break;
+        }
+        case 'suspend': {
+            await db.githubInstallations.suspend(installationId, installation.suspended_by?.login || 'unknown');
+            console.log(`[webhook] Suspended installation for ${installation.account.login}`);
+            break;
+        }
+        case 'unsuspend': {
+            await db.githubInstallations.unsuspend(installationId);
+            console.log(`[webhook] Unsuspended installation for ${installation.account.login}`);
+            break;
+        }
+        case 'new_permissions_accepted': {
+            // Update permissions
+            await db.githubInstallations.updatePermissions(installationId, installation.permissions, installation.events);
+            console.log(`[webhook] Updated permissions for ${installation.account.login}`);
+            break;
+        }
+        default:
+            console.log(`[webhook] Unhandled installation action: ${action}`);
+    }
+}
+/**
+ * Handle installation_repositories events (added/removed repos)
+ */
+async function handleInstallationRepositoriesEvent(payload) {
+    const { action, installation, repositories_added, repositories_removed, sender } = payload;
+    const installationId = String(installation.id);
+    console.log(`[webhook] Repositories ${action} for ${installation.account.login}`);
+    // Find the installation in our database
+    const dbInstallation = await db.githubInstallations.findByInstallationId(installationId);
+    if (!dbInstallation) {
+        console.error(`[webhook] Installation ${installationId} not found in database`);
+        return;
+    }
+    // Get the user who triggered this (should be the installedBy user)
+    const user = await db.users.findByGithubId(String(sender.id));
+    if (!user) {
+        console.error(`[webhook] User ${sender.login} not found in database`);
+        return;
+    }
+    if (action === 'added' && repositories_added) {
+        for (const repo of repositories_added) {
+            await db.repositories.upsert({
+                userId: user.id,
+                githubFullName: repo.full_name,
+                githubId: repo.id,
+                isPrivate: repo.private,
+                installationId: dbInstallation.id,
+                syncStatus: 'synced',
+                lastSyncedAt: new Date(),
+            });
+        }
+        console.log(`[webhook] Added ${repositories_added.length} repositories`);
+    }
+    if (action === 'removed' && repositories_removed) {
+        // We don't delete repos, just remove the installation link
+        // This preserves any user config while showing the repo is no longer accessible
+        for (const repo of repositories_removed) {
+            // Find the repo and clear its installation reference
+            const repos = await db.repositories.findByUserId(user.id);
+            const existingRepo = repos.find(r => r.githubFullName === repo.full_name);
+            if (existingRepo) {
+                // Update sync status to indicate repo access was removed
+                await db.repositories.updateSyncStatus(existingRepo.id, 'access_removed');
+            }
+        }
+        console.log(`[webhook] Removed access to ${repositories_removed.length} repositories`);
+    }
+}
+/**
+ * Handle check_run webhook events
+ *
+ * When a CI check fails on a PR, we:
+ * 1. Record the failure in our database
+ * 2. Check if an agent is already working on the PR
+ * 3. Either message the existing agent or spawn a new one
+ */
+async function handleCheckRunEvent(payload) {
+    const { action, check_run, repository } = payload;
+    // Only handle completed checks
+    if (action !== 'completed') {
+        console.log(`[webhook] Ignoring check_run action: ${action}`);
+        return;
+    }
+    // Only handle failures
+    if (check_run.conclusion !== 'failure') {
+        console.log(`[webhook] Check ${check_run.name} conclusion: ${check_run.conclusion} (not a failure)`);
+        return;
+    }
+    // Only handle checks on PRs
+    if (check_run.pull_requests.length === 0) {
+        console.log(`[webhook] Check ${check_run.name} failed but not on a PR, skipping`);
+        return;
+    }
+    const pr = check_run.pull_requests[0];
+    console.log(`[webhook] CI failure: ${check_run.name} on ${repository.full_name}#${pr.number}`);
+    // Build failure context
+    const failureContext = {
+        repository: repository.full_name,
+        prNumber: pr.number,
+        branch: pr.head.ref,
+        commitSha: pr.head.sha,
+        checkName: check_run.name,
+        checkId: check_run.id,
+        conclusion: check_run.conclusion,
+        failureTitle: check_run.output.title,
+        failureSummary: check_run.output.summary,
+        failureDetails: check_run.output.text,
+        annotations: (check_run.output.annotations || []).map(a => ({
+            path: a.path,
+            startLine: a.start_line,
+            endLine: a.end_line,
+            annotationLevel: a.annotation_level,
+            message: a.message,
+        })),
+    };
+    // Record the failure in the database
+    try {
+        const failureEvent = await db.ciFailureEvents.create({
+            repository: failureContext.repository,
+            prNumber: failureContext.prNumber,
+            branch: failureContext.branch,
+            commitSha: failureContext.commitSha,
+            checkName: failureContext.checkName,
+            checkId: failureContext.checkId,
+            conclusion: failureContext.conclusion,
+            failureTitle: failureContext.failureTitle,
+            failureSummary: failureContext.failureSummary,
+            failureDetails: failureContext.failureDetails,
+            annotations: failureContext.annotations,
+        });
+        console.log(`[webhook] Recorded CI failure event: ${failureEvent.id}`);
+        // Check for existing active fix attempts on this repo
+        const activeAttempts = await db.ciFixAttempts.findActiveByRepository(repository.full_name);
+        if (activeAttempts.length > 0) {
+            console.log(`[webhook] ${activeAttempts.length} active fix attempt(s) already exist, skipping spawn`);
+            await db.ciFailureEvents.markProcessed(failureEvent.id, false);
+            return;
+        }
+        // Import and call the CI agent spawner (lazy import to avoid circular deps)
+        const { spawnCIFixAgent } = await import('../services/ci-agent-spawner.js');
+        await spawnCIFixAgent(failureEvent);
+        // Mark as processed with agent spawned
+        await db.ciFailureEvents.markProcessed(failureEvent.id, true);
+        console.log(`[webhook] Agent spawned for CI failure: ${failureEvent.id}`);
+    }
+    catch (error) {
+        console.error(`[webhook] Failed to handle CI failure:`, error);
+        // Don't re-throw - we still want to return 200 to GitHub
+    }
+}
+/**
+ * Handle workflow_run webhook events
+ *
+ * This handles the entire workflow completion. Useful for:
+ * - Waiting for all checks to complete before acting
+ * - Getting workflow-level context
+ */
+async function handleWorkflowRunEvent(payload) {
+    const { action, workflow_run, repository } = payload;
+    // Only handle completed workflows
+    if (action !== 'completed') {
+        console.log(`[webhook] Ignoring workflow_run action: ${action}`);
+        return;
+    }
+    // Only handle failures
+    if (workflow_run.conclusion !== 'failure') {
+        console.log(`[webhook] Workflow ${workflow_run.name} conclusion: ${workflow_run.conclusion}`);
+        return;
+    }
+    // Log for now - we primarily handle individual check_runs
+    // but workflow_run events can be used for aggregate failure handling
+    console.log(`[webhook] Workflow failed: ${workflow_run.name} on ${repository.full_name} ` +
+        `(branch: ${workflow_run.head_branch}, PRs: ${workflow_run.pull_requests.map(p => p.number).join(', ')})`);
+    // Future: Could use this to trigger workflow-level actions
+    // For now, individual check_run events handle the actual failure processing
+}
+/**
+ * Extract @mentions from comment text
+ * Returns list of mentioned agent names (without @ prefix)
+ */
+function extractMentions(text) {
+    // Match @agent-name patterns (alphanumeric, hyphens, underscores)
+    const mentionPattern = /@([a-zA-Z][a-zA-Z0-9_-]*)/g;
+    const mentions = [];
+    let match;
+    while ((match = mentionPattern.exec(text)) !== null) {
+        mentions.push(match[1].toLowerCase());
+    }
+    return [...new Set(mentions)]; // Remove duplicates
+}
+/**
+ * Get context around a mention (for prompt building)
+ */
+function getMentionContext(text, mention, contextLength = 200) {
+    const mentionIndex = text.toLowerCase().indexOf(`@${mention.toLowerCase()}`);
+    if (mentionIndex === -1)
+        return text.slice(0, contextLength);
+    const start = Math.max(0, mentionIndex - contextLength / 2);
+    const end = Math.min(text.length, mentionIndex + mention.length + 1 + contextLength / 2);
+    let context = text.slice(start, end);
+    if (start > 0)
+        context = '...' + context;
+    if (end < text.length)
+        context = context + '...';
+    return context;
+}
+/**
+ * Handle issues webhook events
+ *
+ * When a new issue is opened or labeled, we can:
+ * 1. Auto-assign an agent based on labels
+ * 2. Record the issue for later assignment
+ */
+async function handleIssueEvent(payload) {
+    const { action, issue, repository } = payload;
+    console.log(`[webhook] Issue ${action}: #${issue.number} on ${repository.full_name}`);
+    // Only handle opened issues for now
+    if (action !== 'opened' && action !== 'labeled') {
+        return;
+    }
+    try {
+        // Check if we already have an assignment for this issue
+        const existing = await db.issueAssignments.findByIssue(repository.full_name, issue.number);
+        if (existing) {
+            console.log(`[webhook] Issue #${issue.number} already has an assignment`);
+            return;
+        }
+        // Determine priority based on labels
+        const labels = issue.labels.map(l => l.name.toLowerCase());
+        let priority;
+        if (labels.includes('critical') || labels.includes('p0'))
+            priority = 'critical';
+        else if (labels.includes('high') || labels.includes('p1'))
+            priority = 'high';
+        else if (labels.includes('medium') || labels.includes('p2'))
+            priority = 'medium';
+        else if (labels.includes('low') || labels.includes('p3'))
+            priority = 'low';
+        // Create issue assignment record
+        const assignment = await db.issueAssignments.create({
+            repository: repository.full_name,
+            issueNumber: issue.number,
+            issueTitle: issue.title,
+            issueBody: issue.body,
+            issueUrl: issue.html_url,
+            status: 'pending',
+            labels: issue.labels.map(l => l.name),
+            priority,
+        });
+        console.log(`[webhook] Created issue assignment: ${assignment.id}`);
+        // Check if we should auto-assign an agent
+        // TODO: Load repo configuration for auto-assign settings
+        // For now, issues remain in 'pending' status for manual assignment
+    }
+    catch (error) {
+        console.error(`[webhook] Failed to handle issue event:`, error);
+    }
+}
+/**
+ * Handle issue_comment webhook events
+ *
+ * When someone @mentions an agent in a comment:
+ * 1. Detect the mention
+ * 2. Record it for agent processing
+ * 3. Route to appropriate agent
+ */
+async function handleIssueCommentEvent(payload) {
+    const { action, issue, comment, repository, sender } = payload;
+    // Only handle new comments
+    if (action !== 'created') {
+        return;
+    }
+    const isPR = !!issue.pull_request;
+    const sourceType = isPR ? 'pr_comment' : 'issue_comment';
+    console.log(`[webhook] ${sourceType} on ${repository.full_name}#${issue.number} by @${sender.login}`);
+    // Extract @mentions from comment
+    const mentions = extractMentions(comment.body);
+    if (mentions.length === 0) {
+        return; // No mentions to process
+    }
+    console.log(`[webhook] Found mentions: ${mentions.join(', ')}`);
+    try {
+        for (const mention of mentions) {
+            // Check if this is a known agent mention
+            // TODO: Load configured agents from repo/workspace settings
+            // For now, we accept any mention that looks like an agent name
+            const context = getMentionContext(comment.body, mention);
+            // Create mention record
+            const mentionRecord = await db.commentMentions.create({
+                repository: repository.full_name,
+                sourceType,
+                sourceId: comment.id,
+                issueOrPrNumber: issue.number,
+                commentBody: comment.body,
+                commentUrl: comment.html_url,
+                authorLogin: sender.login,
+                authorId: sender.id,
+                mentionedAgent: mention,
+                mentionContext: context,
+                status: 'pending',
+            });
+            console.log(`[webhook] Created mention record for @${mention}: ${mentionRecord.id}`);
+            // Import and call the mention handler (lazy import)
+            try {
+                const { handleMention } = await import('../services/mention-handler.js');
+                await handleMention(mentionRecord);
+            }
+            catch (_importError) {
+                // Handler not implemented yet - mentions will be processed later
+                console.log(`[webhook] Mention handler not available, mention queued for later processing`);
+            }
+        }
+    }
+    catch (error) {
+        console.error(`[webhook] Failed to handle comment mentions:`, error);
+    }
+}
+/**
+ * Handle pull_request_review_comment webhook events
+ *
+ * Similar to issue_comment, but for PR review comments (inline code comments)
+ */
+async function handlePRReviewCommentEvent(payload) {
+    const { action, pull_request, comment, repository, sender } = payload;
+    // Only handle new comments
+    if (action !== 'created') {
+        return;
+    }
+    console.log(`[webhook] PR review comment on ${repository.full_name}#${pull_request.number} ` +
+        `(${comment.path}:${comment.line}) by @${sender.login}`);
+    // Extract @mentions from comment
+    const mentions = extractMentions(comment.body);
+    if (mentions.length === 0) {
+        return; // No mentions to process
+    }
+    console.log(`[webhook] Found mentions in review comment: ${mentions.join(', ')}`);
+    try {
+        for (const mention of mentions) {
+            const context = getMentionContext(comment.body, mention);
+            // Create mention record
+            const mentionRecord = await db.commentMentions.create({
+                repository: repository.full_name,
+                sourceType: 'pr_review',
+                sourceId: comment.id,
+                issueOrPrNumber: pull_request.number,
+                commentBody: comment.body,
+                commentUrl: comment.html_url,
+                authorLogin: sender.login,
+                authorId: sender.id,
+                mentionedAgent: mention,
+                mentionContext: `${comment.path}:${comment.line || '?'}\n\n${context}`,
+                status: 'pending',
+            });
+            console.log(`[webhook] Created review mention for @${mention}: ${mentionRecord.id}`);
+            // Try to handle mention immediately
+            try {
+                const { handleMention } = await import('../services/mention-handler.js');
+                await handleMention(mentionRecord);
+            }
+            catch {
+                console.log(`[webhook] Mention handler not available, mention queued for later processing`);
+            }
+        }
+    }
+    catch (error) {
+        console.error(`[webhook] Failed to handle PR review comment mentions:`, error);
+    }
+}
+//# sourceMappingURL=webhooks.js.map