agent-relay 1.1.0 → 1.2.3

package/dist/cloud/provisioner/index.js

@@ -3,11 +3,73 @@
  *
  * One-click provisioning for compute resources (Fly.io, Railway, Docker).
  */
+import * as crypto from 'crypto';
 import { getConfig } from '../config.js';
 import { db } from '../db/index.js';
 import { vault } from '../vault/index.js';
+import { nangoService } from '../services/nango.js';
+import { canAutoScale, canScaleToTier, getResourceTierForPlan, } from '../services/planLimits.js';
 const WORKSPACE_PORT = 3888;
 const FETCH_TIMEOUT_MS = 10_000;
+const WORKSPACE_IMAGE = process.env.WORKSPACE_IMAGE || 'ghcr.io/agentworkforce/relay-workspace:latest';
+// In-memory tracker for provisioning progress (workspace ID -> progress)
+const provisioningProgress = new Map();
+/**
+ * Update the provisioning stage for a workspace
+ */
+function updateProvisioningStage(workspaceId, stage) {
+    const existing = provisioningProgress.get(workspaceId);
+    provisioningProgress.set(workspaceId, {
+        stage,
+        startedAt: existing?.startedAt ?? Date.now(),
+        updatedAt: Date.now(),
+    });
+    console.log(`[provisioner] Workspace ${workspaceId.substring(0, 8)} stage: ${stage}`);
+}
+/**
+ * Get the current provisioning stage for a workspace
+ */
+export function getProvisioningStage(workspaceId) {
+    return provisioningProgress.get(workspaceId) ?? null;
+}
+/**
+ * Clear provisioning progress (call when complete or failed)
+ */
+function clearProvisioningProgress(workspaceId) {
+    provisioningProgress.delete(workspaceId);
+}
+/**
+ * Schedule cleanup of provisioning progress after a delay
+ * This gives the frontend time to poll and see the 'complete' stage
+ */
+function scheduleProgressCleanup(workspaceId, delayMs = 30_000) {
+    setTimeout(() => {
+        clearProvisioningProgress(workspaceId);
+        console.log(`[provisioner] Cleaned up provisioning progress for ${workspaceId.substring(0, 8)}`);
+    }, delayMs);
+}
+/**
+ * Get a fresh GitHub App installation token from Nango.
+ * Looks up the user's connected repositories to find a valid Nango connection.
+ */
+async function getGithubAppTokenForUser(userId) {
+    try {
+        // Find any repository with a Nango connection for this user
+        const repos = await db.repositories.findByUserId(userId);
+        const repoWithConnection = repos.find(r => r.nangoConnectionId);
+        if (!repoWithConnection?.nangoConnectionId) {
+            console.warn(`[provisioner] No Nango GitHub App connection found for user ${userId}`);
+            return null;
+        }
+        // Get fresh installation token from Nango (handles refresh automatically)
+        const token = await nangoService.getGithubAppToken(repoWithConnection.nangoConnectionId);
+        return token;
+    }
+    catch (error) {
+        console.error(`[provisioner] Failed to get GitHub App token for user ${userId}:`, error);
+        return null;
+    }
+}
 async function loadCredentialToken(userId, provider) {
     try {
         const cred = await vault.getCredential(userId, provider);
@@ -63,6 +125,96 @@ async function softHealthCheck(url) {
         console.warn(`[health] Failed to reach ${url}/health`, error);
     }
 }
+/**
+ * Wait for machine to be in "started" state using Fly.io's /wait endpoint
+ * This is more efficient than polling - the API blocks until the state is reached
+ * @see https://fly.io/docs/machines/api/machines-resource/#wait-for-a-machine-to-reach-a-specific-state
+ */
+async function waitForMachineStarted(apiToken, appName, machineId, timeoutSeconds = 120) {
+    console.log(`[provisioner] Waiting for machine ${machineId} to start (timeout: ${timeoutSeconds}s)...`);
+    try {
+        // Use Fly.io's /wait endpoint - blocks until machine reaches target state
+        const res = await fetch(`https://api.machines.dev/v1/apps/${appName}/machines/${machineId}/wait?state=started&timeout=${timeoutSeconds}`, {
+            headers: { Authorization: `Bearer ${apiToken}` },
+        });
+        if (res.ok) {
+            console.log(`[provisioner] Machine ${machineId} is now started`);
+            return;
+        }
+        // 408 = timeout, machine didn't reach state in time
+        if (res.status === 408) {
+            // Get current state for error message
+            const stateRes = await fetch(`https://api.machines.dev/v1/apps/${appName}/machines/${machineId}`, { headers: { Authorization: `Bearer ${apiToken}` } });
+            const machine = stateRes.ok ? (await stateRes.json()) : { state: 'unknown' };
+            throw new Error(`Machine ${machineId} did not start within ${timeoutSeconds}s (last state: ${machine.state})`);
+        }
+        // Other error
+        const errorText = await res.text();
+        throw new Error(`Wait for machine failed: ${res.status} ${errorText}`);
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.includes('did not start')) {
+            throw error;
+        }
+        console.warn(`[provisioner] Error waiting for machine:`, error);
+        throw new Error(`Failed to wait for machine ${machineId}: ${error.message}`);
+    }
+}
+/**
+ * Wait for health check to pass (with DNS propagation time)
+ * Tries internal Fly network first if available, then falls back to public URL
+ */
+async function waitForHealthy(url, appName, maxWaitMs = 90_000) {
+    const startTime = Date.now();
+    // Build list of URLs to try - internal first (faster, more reliable from inside Fly)
+    const urlsToTry = [];
+    // If running on Fly and app name provided, try internal network first
+    const isOnFly = !!process.env.FLY_APP_NAME;
+    if (isOnFly && appName) {
+        urlsToTry.push(`http://${appName}.internal:8080/health`);
+    }
+    // Always add the public URL as fallback
+    urlsToTry.push(`${url.replace(/\/$/, '')}/health`);
+    console.log(`[provisioner] Waiting for workspace to become healthy (trying: ${urlsToTry.join(', ')})...`);
+    while (Date.now() - startTime < maxWaitMs) {
+        // Try each URL in order
+        for (const healthUrl of urlsToTry) {
+            try {
+                const controller = new AbortController();
+                const timer = setTimeout(() => controller.abort(), 5_000);
+                const res = await fetch(healthUrl, {
+                    method: 'GET',
+                    signal: controller.signal,
+                });
+                clearTimeout(timer);
+                if (res.ok) {
+                    console.log(`[provisioner] Health check passed via ${healthUrl}`);
+                    return;
+                }
+                console.log(`[provisioner] Health check to ${healthUrl} returned ${res.status}`);
+            }
+            catch (error) {
+                const elapsed = Math.round((Date.now() - startTime) / 1000);
+                const errMsg = error.message;
+                // Only log detailed error for last URL attempt
+                if (healthUrl === urlsToTry[urlsToTry.length - 1]) {
+                    console.log(`[provisioner] Health check failed (${elapsed}s elapsed): ${errMsg}`);
+                }
+            }
+        }
+        await wait(3000);
+    }
+    // Don't throw - workspace is provisioned, health check is best-effort
+    console.warn(`[provisioner] Health check did not pass within ${maxWaitMs}ms, continuing anyway`);
+}
+// Resource tiers sized for Claude Code agents (~1-2GB RAM per agent)
+// cpuKind: 'shared' = cheaper but can be throttled, 'performance' = dedicated
+export const RESOURCE_TIERS = {
+    small: { name: 'small', cpuCores: 2, memoryMb: 2048, maxAgents: 2, cpuKind: 'shared' },
+    medium: { name: 'medium', cpuCores: 2, memoryMb: 4096, maxAgents: 5, cpuKind: 'shared' },
+    large: { name: 'large', cpuCores: 4, memoryMb: 8192, maxAgents: 10, cpuKind: 'performance' },
+    xlarge: { name: 'xlarge', cpuCores: 8, memoryMb: 16384, maxAgents: 20, cpuKind: 'performance' },
+};
 /**
  * Fly.io provisioner
  */
@@ -71,6 +223,9 @@ class FlyProvisioner {
     org;
     region;
     workspaceDomain;
+    cloudApiUrl;
+    sessionSecret;
+    registryAuth;
     constructor() {
         const config = getConfig();
         if (!config.compute.fly) {
@@ -80,11 +235,26 @@ class FlyProvisioner {
         this.org = config.compute.fly.org;
         this.region = config.compute.fly.region || 'sjc';
         this.workspaceDomain = config.compute.fly.workspaceDomain;
+        this.registryAuth = config.compute.fly.registryAuth;
+        this.cloudApiUrl = config.publicUrl;
+        this.sessionSecret = config.sessionSecret;
+    }
+    /**
+     * Generate a workspace token for API authentication
+     * This is a simple HMAC - in production, consider using JWTs
+     */
+    generateWorkspaceToken(workspaceId) {
+        return crypto
+            .createHmac('sha256', this.sessionSecret)
+            .update(`workspace:${workspaceId}`)
+            .digest('hex');
     }
     async provision(workspace, credentials) {
         const appName = `ar-${workspace.id.substring(0, 8)}`;
+        // Stage: Creating workspace
+        updateProvisioningStage(workspace.id, 'creating');
         // Create Fly app
-        const createResponse = await fetchWithRetry('https://api.machines.dev/v1/apps', {
+        await fetchWithRetry('https://api.machines.dev/v1/apps', {
             method: 'POST',
             headers: {
                 Authorization: `Bearer ${this.apiToken}`,
@@ -95,19 +265,93 @@ class FlyProvisioner {
                 org_slug: this.org,
             }),
         });
-        // Set secrets (credentials)
+        // Stage: Networking
+        updateProvisioningStage(workspace.id, 'networking');
+        // Allocate IPs for the app (required for public DNS)
+        // Must use GraphQL API - Machines REST API doesn't support IP allocation
+        // Shared IPv4 is free, IPv6 is free
+        console.log(`[fly] Allocating IPs for ${appName}...`);
+        const allocateIP = async (type) => {
+            try {
+                // Map our type to Fly GraphQL enum
+                const graphqlType = type === 'shared_v4' ? 'shared_v4' : 'v6';
+                const res = await fetchWithRetry('https://api.fly.io/graphql', {
+                    method: 'POST',
+                    headers: {
+                        Authorization: `Bearer ${this.apiToken}`,
+                        'Content-Type': 'application/json',
+                    },
+                    body: JSON.stringify({
+                        query: `
+              mutation AllocateIPAddress($input: AllocateIPAddressInput!) {
+                allocateIpAddress(input: $input) {
+                  ipAddress {
+                    id
+                    address
+                    type
+                  }
+                }
+              }
+            `,
+                        variables: {
+                            input: {
+                                appId: appName,
+                                type: graphqlType,
+                            },
+                        },
+                    }),
+                });
+                if (!res.ok) {
+                    const errorText = await res.text();
+                    console.warn(`[fly] Failed to allocate ${type}: ${res.status} ${errorText}`);
+                    return false;
+                }
+                const data = await res.json();
+                if (data.errors?.length) {
+                    // Ignore "already allocated" errors
+                    const alreadyAllocated = data.errors.some(e => e.message.includes('already') || e.message.includes('exists'));
+                    if (!alreadyAllocated) {
+                        console.warn(`[fly] GraphQL error allocating ${type}: ${data.errors[0].message}`);
+                        return false;
+                    }
+                    console.log(`[fly] IP ${type} already allocated`);
+                    return true;
+                }
+                const address = data.data?.allocateIpAddress?.ipAddress?.address;
+                console.log(`[fly] Allocated ${type}: ${address}`);
+                return true;
+            }
+            catch (err) {
+                console.warn(`[fly] Failed to allocate ${type}: ${err.message}`);
+                return false;
+            }
+        };
+        const [sharedV4Result, v6Result] = await Promise.all([
+            allocateIP('shared_v4'),
+            allocateIP('v6'),
+        ]);
+        console.log(`[fly] IP allocation results: shared_v4=${sharedV4Result}, v6=${v6Result}`);
+        // Stage: Secrets
+        updateProvisioningStage(workspace.id, 'secrets');
+        // Set secrets (provider credentials)
         const secrets = {};
         for (const [provider, token] of credentials) {
             secrets[`${provider.toUpperCase()}_TOKEN`] = token;
+            // Also set GH_TOKEN for gh CLI compatibility
+            if (provider === 'github') {
+                secrets['GH_TOKEN'] = token;
+            }
+        }
+        if (Object.keys(secrets).length > 0) {
+            await fetchWithRetry(`https://api.machines.dev/v1/apps/${appName}/secrets`, {
+                method: 'POST',
+                headers: {
+                    Authorization: `Bearer ${this.apiToken}`,
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify(secrets),
+            });
         }
-        await fetchWithRetry(`https://api.machines.dev/v1/apps/${appName}/secrets`, {
-            method: 'POST',
-            headers: {
-                Authorization: `Bearer ${this.apiToken}`,
-                'Content-Type': 'application/json',
-            },
-            body: JSON.stringify(secrets),
-        });
         // If custom workspace domain is configured, add certificate
         const customHostname = this.workspaceDomain
             ? `${appName}.${this.workspaceDomain}`
@@ -115,6 +359,8 @@ class FlyProvisioner {
         if (customHostname) {
             await this.allocateCertificate(appName, customHostname);
         }
+        // Stage: Machine
+        updateProvisioningStage(workspace.id, 'machine');
         // Create machine with auto-stop/start for cost optimization
         const machineResponse = await fetchWithRetry(`https://api.machines.dev/v1/apps/${appName}/machines`, {
             method: 'POST',
@@ -125,7 +371,15 @@ class FlyProvisioner {
             body: JSON.stringify({
                 region: this.region,
                 config: {
-                    image: 'ghcr.io/khaliqgant/agent-relay-workspace:latest',
+                    image: WORKSPACE_IMAGE,
+                    // Registry auth for private ghcr.io images
+                    ...(this.registryAuth && {
+                        image_registry_auth: {
+                            registry: 'ghcr.io',
+                            username: this.registryAuth.username,
+                            password: this.registryAuth.password,
+                        },
+                    }),
                     env: {
                         WORKSPACE_ID: workspace.id,
                         SUPERVISOR_ENABLED: String(workspace.config.supervisorEnabled ?? false),
@@ -134,25 +388,56 @@ class FlyProvisioner {
                         PROVIDERS: (workspace.config.providers ?? []).join(','),
                         PORT: String(WORKSPACE_PORT),
                         AGENT_RELAY_DASHBOARD_PORT: String(WORKSPACE_PORT),
+                        // Git gateway configuration
+                        CLOUD_API_URL: this.cloudApiUrl,
+                        WORKSPACE_TOKEN: this.generateWorkspaceToken(workspace.id),
                     },
                     services: [
                         {
                             ports: [
-                                { port: 443, handlers: ['tls', 'http'] },
+                                {
+                                    port: 443,
+                                    handlers: ['tls', 'http'],
+                                    // Force HTTP/1.1 to backend for WebSocket upgrade compatibility
+                                    // HTTP/2 doesn't support traditional WebSocket upgrade mechanism
+                                    http_options: {
+                                        h2_backend: false,
+                                    },
+                                },
                                 { port: 80, handlers: ['http'] },
                             ],
                             protocol: 'tcp',
                             internal_port: WORKSPACE_PORT,
-                            // Auto-stop after 5 minutes of inactivity
-                            auto_stop_machines: true,
+                            // Auto-stop after inactivity to reduce costs
+                            // Fly Proxy automatically wakes machines on incoming requests
+                            auto_stop_machines: 'stop', // stop (not suspend) for faster wake
                             auto_start_machines: true,
                             min_machines_running: 0,
+                            // Idle timeout before auto-stop (in seconds)
+                            // Longer timeout = better UX, shorter = lower costs
+                            concurrency: {
+                                type: 'requests',
+                                soft_limit: 25,
+                                hard_limit: 50,
+                            },
                         },
                     ],
+                    checks: {
+                        health: {
+                            type: 'http',
+                            port: WORKSPACE_PORT,
+                            path: '/health',
+                            interval: '30s',
+                            timeout: '5s',
+                            grace_period: '10s',
+                        },
+                    },
+                    // Start with small tier (shared CPUs) - scales up based on plan
+                    // Free tier uses shared CPUs for cost efficiency
                     guest: {
                         cpu_kind: 'shared',
-                        cpus: 1,
-                        memory_mb: 512,
+                        cpus: 2,
+                        memory_mb: 2048,
                     },
                 },
             }),
@@ -166,7 +451,19 @@ class FlyProvisioner {
         const publicUrl = customHostname
             ? `https://${customHostname}`
             : `https://${appName}.fly.dev`;
-        await softHealthCheck(publicUrl);
+        // Stage: Booting
+        updateProvisioningStage(workspace.id, 'booting');
+        // Wait for machine to be in started state
+        await waitForMachineStarted(this.apiToken, appName, machine.id);
+        // Stage: Health check
+        updateProvisioningStage(workspace.id, 'health');
+        // Wait for health check to pass (includes DNS propagation time)
+        // Pass appName to enable internal Fly network health checks
+        await waitForHealthy(publicUrl, appName);
+        // Stage: Complete
+        updateProvisioningStage(workspace.id, 'complete');
+        // Schedule cleanup of provisioning progress after 30s (gives frontend time to see 'complete')
+        scheduleProgressCleanup(workspace.id);
         return {
             computeId: machine.id,
             publicUrl,
@@ -236,18 +533,110 @@ class FlyProvisioner {
             },
         });
     }
+    /**
+     * Resize workspace - vertical scaling via Fly Machines API
+     */
+    async resize(workspace, tier) {
+        if (!workspace.computeId)
+            return;
+        const appName = `ar-${workspace.id.substring(0, 8)}`;
+        // Update machine configuration
+        await fetchWithRetry(`https://api.machines.dev/v1/apps/${appName}/machines/${workspace.computeId}`, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${this.apiToken}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+                config: {
+                    guest: {
+                        // Use tier-specific CPU type (shared for cost, performance for power)
+                        cpu_kind: tier.cpuKind,
+                        cpus: tier.cpuCores,
+                        memory_mb: tier.memoryMb,
+                    },
+                    env: {
+                        MAX_AGENTS: String(tier.maxAgents),
+                    },
+                },
+            }),
+        });
+        console.log(`[fly] Resized workspace ${workspace.id} to ${tier.name} (${tier.cpuCores} CPU, ${tier.memoryMb}MB RAM)`);
+    }
+    /**
+     * Update the max agent limit for a workspace
+     */
+    async updateAgentLimit(workspace, newLimit) {
+        if (!workspace.computeId)
+            return;
+        const appName = `ar-${workspace.id.substring(0, 8)}`;
+        // Update environment variable
+        await fetchWithRetry(`https://api.machines.dev/v1/apps/${appName}/machines/${workspace.computeId}`, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${this.apiToken}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+                config: {
+                    env: {
+                        MAX_AGENTS: String(newLimit),
+                    },
+                },
+            }),
+        });
+        console.log(`[fly] Updated workspace ${workspace.id} agent limit to ${newLimit}`);
+    }
+    /**
+     * Get current resource tier for a workspace
+     */
+    async getCurrentTier(workspace) {
+        if (!workspace.computeId) {
+            return RESOURCE_TIERS.small;
+        }
+        const appName = `ar-${workspace.id.substring(0, 8)}`;
+        const response = await fetchWithRetry(`https://api.machines.dev/v1/apps/${appName}/machines/${workspace.computeId}`, {
+            headers: {
+                Authorization: `Bearer ${this.apiToken}`,
+            },
+        });
+        if (!response.ok) {
+            return RESOURCE_TIERS.small;
+        }
+        const machine = await response.json();
+        const _cpus = machine.config?.guest?.cpus || 1;
+        const memoryMb = machine.config?.guest?.memory_mb || 512;
+        // Map to nearest tier
+        if (memoryMb >= 4096)
+            return RESOURCE_TIERS.xlarge;
+        if (memoryMb >= 2048)
+            return RESOURCE_TIERS.large;
+        if (memoryMb >= 1024)
+            return RESOURCE_TIERS.medium;
+        return RESOURCE_TIERS.small;
+    }
 }
 /**
  * Railway provisioner
  */
 class RailwayProvisioner {
     apiToken;
+    cloudApiUrl;
+    sessionSecret;
     constructor() {
         const config = getConfig();
         if (!config.compute.railway) {
             throw new Error('Railway configuration missing');
         }
         this.apiToken = config.compute.railway.apiToken;
+        this.cloudApiUrl = config.publicUrl;
+        this.sessionSecret = config.sessionSecret;
+    }
+    generateWorkspaceToken(workspaceId) {
+        return crypto
+            .createHmac('sha256', this.sessionSecret)
+            .update(`workspace:${workspaceId}`)
+            .digest('hex');
     }
     async provision(workspace, credentials) {
         // Create project
@@ -295,7 +684,7 @@ class RailwayProvisioner {
                         projectId,
                         name: 'workspace',
                         source: {
-                            image: 'ghcr.io/khaliqgant/agent-relay-workspace:latest',
+                            image: WORKSPACE_IMAGE,
                         },
                     },
                 },
@@ -312,9 +701,15 @@ class RailwayProvisioner {
             PROVIDERS: (workspace.config.providers ?? []).join(','),
             PORT: String(WORKSPACE_PORT),
             AGENT_RELAY_DASHBOARD_PORT: String(WORKSPACE_PORT),
+            CLOUD_API_URL: this.cloudApiUrl,
+            WORKSPACE_TOKEN: this.generateWorkspaceToken(workspace.id),
         };
         for (const [provider, token] of credentials) {
             envVars[`${provider.toUpperCase()}_TOKEN`] = token;
+            // Also set GH_TOKEN for gh CLI compatibility
+            if (provider === 'github') {
+                envVars['GH_TOKEN'] = token;
+            }
         }
         await fetchWithRetry('https://backboard.railway.app/graphql/v2', {
             method: 'POST',
@@ -463,6 +858,56 @@ class RailwayProvisioner {
  * Local Docker provisioner (for development/self-hosted)
  */
 class DockerProvisioner {
+    cloudApiUrl;
+    cloudApiUrlForContainer;
+    sessionSecret;
+    constructor() {
+        const config = getConfig();
+        this.cloudApiUrl = config.publicUrl;
+        this.sessionSecret = config.sessionSecret;
+        // For Docker containers, localhost won't work - they need to reach the host
+        // Convert localhost URLs to host.docker.internal for container access
+        if (this.cloudApiUrl.includes('localhost') || this.cloudApiUrl.includes('127.0.0.1')) {
+            this.cloudApiUrlForContainer = this.cloudApiUrl
+                .replace('localhost', 'host.docker.internal')
+                .replace('127.0.0.1', 'host.docker.internal');
+            console.log(`[docker] Container API URL: ${this.cloudApiUrlForContainer} (host: ${this.cloudApiUrl})`);
+        }
+        else {
+            this.cloudApiUrlForContainer = this.cloudApiUrl;
+        }
+    }
+    generateWorkspaceToken(workspaceId) {
+        return crypto
+            .createHmac('sha256', this.sessionSecret)
+            .update(`workspace:${workspaceId}`)
+            .digest('hex');
+    }
+    /**
+     * Wait for container to be healthy by polling the health endpoint
+     */
+    async waitForHealthy(publicUrl, timeoutMs = 60_000) {
+        const startTime = Date.now();
+        const pollInterval = 2000;
+        console.log(`[docker] Waiting for container to be healthy at ${publicUrl}...`);
+        while (Date.now() - startTime < timeoutMs) {
+            try {
+                const response = await fetch(`${publicUrl}/health`, {
+                    method: 'GET',
+                    signal: AbortSignal.timeout(5000),
+                });
+                if (response.ok) {
+                    console.log(`[docker] Container healthy after ${Date.now() - startTime}ms`);
+                    return;
+                }
+            }
+            catch {
+                // Container not ready yet, continue polling
+            }
+            await wait(pollInterval);
+        }
+        throw new Error(`Container did not become healthy within ${timeoutMs}ms`);
+    }
     async provision(workspace, credentials) {
         const containerName = `ar-${workspace.id.substring(0, 8)}`;
         // Build environment variables
@@ -474,21 +919,54 @@ class DockerProvisioner {
             `-e PROVIDERS=${(workspace.config.providers ?? []).join(',')}`,
             `-e PORT=${WORKSPACE_PORT}`,
             `-e AGENT_RELAY_DASHBOARD_PORT=${WORKSPACE_PORT}`,
+            `-e CLOUD_API_URL=${this.cloudApiUrlForContainer}`,
+            `-e WORKSPACE_TOKEN=${this.generateWorkspaceToken(workspace.id)}`,
         ];
         for (const [provider, token] of credentials) {
             envArgs.push(`-e ${provider.toUpperCase()}_TOKEN=${token}`);
+            // Also set GH_TOKEN for gh CLI compatibility
+            if (provider === 'github') {
+                envArgs.push(`-e GH_TOKEN=${token}`);
+            }
         }
         // Run container
         const { execSync } = await import('child_process');
         const hostPort = 3000 + Math.floor(Math.random() * 1000);
+        // When running in Docker, connect to the same network for container-to-container communication
+        const runningInDocker = process.env.RUNNING_IN_DOCKER === 'true';
+        const networkArg = runningInDocker ? '--network agent-relay-dev' : '';
+        // In development, mount local dist and docs folders for faster iteration
+        // Set WORKSPACE_DEV_MOUNT=true to enable
+        const devMount = process.env.WORKSPACE_DEV_MOUNT === 'true';
+        const volumeArgs = devMount
+            ? `-v "${process.cwd()}/dist:/app/dist:ro" -v "${process.cwd()}/docs:/app/docs:ro"`
+            : '';
+        if (devMount) {
+            console.log('[provisioner] Dev mode: mounting local dist/ and docs/ folders into workspace container');
+        }
         try {
-            execSync(`docker run -d --name ${containerName} -p ${hostPort}:${WORKSPACE_PORT} ${envArgs.join(' ')} ghcr.io/khaliqgant/agent-relay-workspace:latest`, { stdio: 'pipe' });
+            execSync(`docker run -d --user root --name ${containerName} ${networkArg} ${volumeArgs} -p ${hostPort}:${WORKSPACE_PORT} ${envArgs.join(' ')} ${WORKSPACE_IMAGE}`, { stdio: 'pipe' });
+            const publicUrl = `http://localhost:${hostPort}`;
+            // Wait for container to be healthy before returning
+            // When running in Docker, use the internal container name for health check
+            const healthCheckUrl = runningInDocker
+                ? `http://${containerName}:${WORKSPACE_PORT}`
+                : publicUrl;
+            await this.waitForHealthy(healthCheckUrl);
             return {
                 computeId: containerName,
-                publicUrl: `http://localhost:${hostPort}`,
+                publicUrl,
             };
         }
         catch (error) {
+            // Clean up container if it was created but health check failed
+            try {
+                const { execSync: execSyncCleanup } = await import('child_process');
+                execSyncCleanup(`docker rm -f ${containerName}`, { stdio: 'pipe' });
+            }
+            catch {
+                // Ignore cleanup errors
+            }
             throw new Error(`Failed to start Docker container: ${error}`);
         }
     }
@@ -559,6 +1037,7 @@ export class WorkspaceProvisioner {
     }
     /**
      * Provision a new workspace (one-click)
+     * Returns immediately with 'provisioning' status and runs actual provisioning in background
      */
     async provision(config) {
         // Create workspace record
@@ -573,6 +1052,31 @@ export class WorkspaceProvisioner {
                 maxAgents: config.maxAgents ?? 10,
             },
         });
+        // Add creator as owner in workspace_members for team collaboration support
+        await db.workspaceMembers.addMember({
+            workspaceId: workspace.id,
+            userId: config.userId,
+            role: 'owner',
+            invitedBy: config.userId, // Self-invited as creator
+        });
+        // Auto-accept the creator's membership
+        await db.workspaceMembers.acceptInvite(workspace.id, config.userId);
+        // Initialize stage tracking immediately
+        updateProvisioningStage(workspace.id, 'creating');
+        // Run provisioning in the background so frontend can poll for stages
+        this.runProvisioningAsync(workspace, config).catch((error) => {
+            console.error(`[provisioner] Background provisioning failed for ${workspace.id}:`, error);
+        });
+        // Return immediately with 'provisioning' status
+        return {
+            workspaceId: workspace.id,
+            status: 'provisioning',
+        };
+    }
+    /**
+     * Run the actual provisioning work asynchronously
+     */
+    async runProvisioningAsync(workspace, config) {
         // Get credentials
         const credentials = new Map();
         for (const provider of config.providers) {
@@ -582,13 +1086,22 @@ export class WorkspaceProvisioner {
             }
         }
         // GitHub token is required for cloning repositories
+        // Use direct token if provided (for testing), otherwise get from Nango
         if (config.repositories.length > 0) {
-            const githubToken = await loadCredentialToken(config.userId, 'github');
-            if (githubToken) {
-                credentials.set('github', githubToken);
+            if (config.githubToken) {
+                // Direct token provided (for testing)
+                credentials.set('github', config.githubToken);
+                console.log('[provisioner] Using provided GitHub token');
             }
             else {
-                console.warn(`No GitHub token found for user ${config.userId}; repository cloning may fail.`);
+                // Get fresh installation token from Nango GitHub App
+                const githubToken = await getGithubAppTokenForUser(config.userId);
+                if (githubToken) {
+                    credentials.set('github', githubToken);
+                }
+                else {
+                    console.warn(`[provisioner] No GitHub App token for user ${config.userId}; repository cloning may fail.`);
+                }
             }
         }
         // Provision compute
@@ -598,22 +1111,21 @@ export class WorkspaceProvisioner {
                 computeId,
                 publicUrl,
             });
-            return {
-                workspaceId: workspace.id,
-                status: 'running',
-                publicUrl,
-            };
+            // Schedule cleanup of provisioning progress after 30s (gives frontend time to see 'complete')
+            setTimeout(() => {
+                clearProvisioningProgress(workspace.id);
+                console.log(`[provisioner] Cleaned up provisioning progress for ${workspace.id.substring(0, 8)}`);
+            }, 30_000);
+            console.log(`[provisioner] Workspace ${workspace.id} provisioned successfully at ${publicUrl}`);
         }
         catch (error) {
             const errorMessage = error instanceof Error ? error.message : 'Unknown error';
             await db.workspaces.updateStatus(workspace.id, 'error', {
                 errorMessage,
             });
-            return {
-                workspaceId: workspace.id,
-                status: 'error',
-                error: errorMessage,
-            };
+            // Clear provisioning progress on error
+            clearProvisioningProgress(workspace.id);
+            console.error(`[provisioner] Workspace ${workspace.id} provisioning failed:`, errorMessage);
         }
     }
     /**
@@ -635,6 +1147,11 @@ export class WorkspaceProvisioner {
         if (!workspace) {
             throw new Error('Workspace not found');
         }
+        // During early provisioning, computeId isn't set yet
+        // Return the database status instead of querying the provider
+        if (!workspace.computeId && workspace.status === 'provisioning') {
+            return 'provisioning';
+        }
         const status = await this.provisioner.getStatus(workspace);
         // Update database if status changed
         if (status !== workspace.status) {
@@ -664,6 +1181,131 @@ export class WorkspaceProvisioner {
         await this.provisioner.deprovision(workspace);
         await db.workspaces.updateStatus(workspaceId, 'stopped');
     }
+    /**
+     * Resize a workspace (vertical scaling)
+     */
+    async resize(workspaceId, tier) {
+        const workspace = await db.workspaces.findById(workspaceId);
+        if (!workspace) {
+            throw new Error('Workspace not found');
+        }
+        if (!this.provisioner.resize) {
+            throw new Error('Resize not supported by current compute provider');
+        }
+        await this.provisioner.resize(workspace, tier);
+        // Update workspace config with new limits
+        await db.workspaces.updateConfig(workspaceId, {
+            ...workspace.config,
+            maxAgents: tier.maxAgents,
+            resourceTier: tier.name,
+        });
+    }
+    /**
+     * Update the max agent limit for a workspace
+     */
+    async updateAgentLimit(workspaceId, newLimit) {
+        const workspace = await db.workspaces.findById(workspaceId);
+        if (!workspace) {
+            throw new Error('Workspace not found');
+        }
+        if (this.provisioner.updateAgentLimit) {
+            await this.provisioner.updateAgentLimit(workspace, newLimit);
+        }
+        // Update workspace config
+        await db.workspaces.updateConfig(workspaceId, {
+            ...workspace.config,
+            maxAgents: newLimit,
+        });
+    }
+    /**
+     * Get current resource tier for a workspace
+     */
+    async getCurrentTier(workspaceId) {
+        const workspace = await db.workspaces.findById(workspaceId);
+        if (!workspace) {
+            throw new Error('Workspace not found');
+        }
+        if (this.provisioner.getCurrentTier) {
+            return this.provisioner.getCurrentTier(workspace);
+        }
+        // Fallback: determine from config or default to small
+        const tierName = workspace.config.resourceTier || 'small';
+        return RESOURCE_TIERS[tierName] || RESOURCE_TIERS.small;
+    }
+    /**
+     * Get recommended tier based on agent count
+     * Uses 1.5-2GB per agent as baseline for Claude Code
+     */
+    getRecommendedTier(agentCount) {
+        // Find the smallest tier that supports this agent count
+        const tiers = Object.values(RESOURCE_TIERS).sort((a, b) => a.maxAgents - b.maxAgents);
+        for (const tier of tiers) {
+            if (tier.maxAgents >= agentCount) {
+                return tier;
+            }
+        }
+        // If agent count exceeds all tiers, return the largest
+        return RESOURCE_TIERS.xlarge;
+    }
+    /**
+     * Auto-scale workspace based on current agent count
+     * Respects plan limits - free tier cannot scale, others have max tier limits
+     * Returns { scaled: boolean, reason?: string }
+     */
+    async autoScale(workspaceId, currentAgentCount) {
+        const workspace = await db.workspaces.findById(workspaceId);
+        if (!workspace) {
+            throw new Error('Workspace not found');
+        }
+        // Get user's plan
+        const user = await db.users.findById(workspace.userId);
+        const plan = user?.plan || 'free';
+        // Check if plan allows auto-scaling
+        if (!canAutoScale(plan)) {
+            return {
+                scaled: false,
+                reason: 'Auto-scaling requires Pro plan or higher',
+            };
+        }
+        const currentTier = await this.getCurrentTier(workspaceId);
+        const recommendedTier = this.getRecommendedTier(currentAgentCount);
+        // Only scale UP, never down (to avoid disruption)
+        if (recommendedTier.memoryMb <= currentTier.memoryMb) {
+            return {
+                scaled: false,
+                currentTier: currentTier.name,
+            };
+        }
+        // Check if plan allows scaling to the recommended tier
+        if (!canScaleToTier(plan, recommendedTier.name)) {
+            // Find the max tier allowed for this plan
+            const maxTierName = getResourceTierForPlan(plan);
+            const maxTier = RESOURCE_TIERS[maxTierName];
+            if (maxTier.memoryMb <= currentTier.memoryMb) {
+                return {
+                    scaled: false,
+                    reason: `Already at max tier (${currentTier.name}) for ${plan} plan`,
+                    currentTier: currentTier.name,
+                };
+            }
+            // Scale to max allowed tier instead
+            console.log(`[provisioner] Auto-scaling workspace ${workspaceId.substring(0, 8)} from ${currentTier.name} to ${maxTierName} (max for ${plan} plan)`);
+            await this.resize(workspaceId, maxTier);
+            return {
+                scaled: true,
+                currentTier: currentTier.name,
+                targetTier: maxTierName,
+                reason: `Scaled to max tier for ${plan} plan`,
+            };
+        }
+        console.log(`[provisioner] Auto-scaling workspace ${workspaceId.substring(0, 8)} from ${currentTier.name} to ${recommendedTier.name} (${currentAgentCount} agents)`);
+        await this.resize(workspaceId, recommendedTier);
+        return {
+            scaled: true,
+            currentTier: currentTier.name,
+            targetTier: recommendedTier.name,
+        };
+    }
 }
 // Singleton instance
 let _provisioner = null;