agent-relay 1.1.0 → 1.2.3

package/dist/cloud/services/nango.js

@@ -0,0 +1,344 @@
+import { Nango } from '@nangohq/node';
+import crypto from 'node:crypto';
+import { getConfig } from '../config.js';
+export const NANGO_INTEGRATIONS = {
+    GITHUB_USER: 'github',
+    GITHUB_APP: 'github-app-oauth',
+};
+class NangoService {
+    client;
+    secret;
+    constructor() {
+        const config = getConfig();
+        this.secret = config.nango.secretKey;
+        this.client = new Nango({
+            secretKey: config.nango.secretKey,
+            ...(config.nango.host ? { host: config.nango.host } : {}),
+        });
+    }
+    /**
+     * Create a Nango connect session restricted to specific integrations.
+     */
+    async createConnectSession(allowedIntegrations, endUser) {
+        const { data } = await this.client.createConnectSession({
+            allowed_integrations: allowedIntegrations,
+            end_user: {
+                id: endUser.id,
+                email: endUser.email,
+            },
+        });
+        return data;
+    }
+    /**
+     * Fetch GitHub user profile via Nango proxy.
+     */
+    async getGithubUser(connectionId) {
+        const response = await this.client.get({
+            connectionId,
+            providerConfigKey: NANGO_INTEGRATIONS.GITHUB_USER,
+            endpoint: '/user',
+        });
+        return response.data;
+    }
+    /**
+     * Retrieve an installation access token from a GitHub App connection.
+     * Use this ONLY when you need the raw token (e.g., for git clone URLs).
+     * For API calls, use the proxy methods instead.
+     */
+    async getGithubAppToken(connectionId) {
+        const token = await this.client.getToken(NANGO_INTEGRATIONS.GITHUB_APP, connectionId, false, true);
+        // Handle different return formats from Nango
+        if (typeof token === 'string') {
+            return token;
+        }
+        // Nango may return an object with access_token
+        if (token && typeof token === 'object') {
+            const tokenObj = token;
+            if (tokenObj.access_token) {
+                return tokenObj.access_token;
+            }
+            if (tokenObj.token) {
+                return tokenObj.token;
+            }
+        }
+        console.error('[nango] Unexpected token format:', typeof token, token);
+        throw new Error('Expected GitHub App token to be a string');
+    }
+    /**
+     * Retrieve the user's OAuth access token from a GitHub App OAuth connection.
+     * This is the user-level token (not the installation token).
+     * Use this for operations that require user context (e.g., gh CLI).
+     *
+     * The user token can be found in:
+     * 1. getToken() without installation flag
+     * 2. connection_config.access_token in github-app-oauth
+     * 3. Separate 'github' user connection
+     */
+    async getGithubUserOAuthToken(connectionId) {
+        // First try: Get token from github-app-oauth connection credentials
+        try {
+            const token = await this.client.getToken(NANGO_INTEGRATIONS.GITHUB_APP, connectionId);
+            if (typeof token === 'string' && token.length > 0) {
+                return token;
+            }
+            if (token && typeof token === 'object') {
+                const tokenObj = token;
+                if (tokenObj.access_token) {
+                    return tokenObj.access_token;
+                }
+                if (tokenObj.token) {
+                    return tokenObj.token;
+                }
+            }
+        }
+        catch (err) {
+            console.log('[nango] getToken for user OAuth failed, trying connection_config:', err);
+        }
+        // Second try: Check connection_config for user token
+        try {
+            const connection = await this.client.getConnection(NANGO_INTEGRATIONS.GITHUB_APP, connectionId);
+            const connConfig = connection.connection_config;
+            if (connConfig?.access_token && typeof connConfig.access_token === 'string') {
+                return connConfig.access_token;
+            }
+            // Also check credentials object
+            const credentials = connection.credentials;
+            if (credentials?.access_token) {
+                return credentials.access_token;
+            }
+        }
+        catch (err) {
+            console.log('[nango] connection_config check failed:', err);
+        }
+        throw new Error('Could not retrieve GitHub user OAuth token');
+    }
+    /**
+     * Retrieve the user's OAuth token from a 'github' user connection.
+     * This is for the separate GitHub OAuth login (not the App connection).
+     */
+    async getGithubUserToken(connectionId) {
+        const token = await this.client.getToken(NANGO_INTEGRATIONS.GITHUB_USER, connectionId);
+        if (typeof token === 'string') {
+            return token;
+        }
+        if (token && typeof token === 'object') {
+            const tokenObj = token;
+            if (tokenObj.access_token) {
+                return tokenObj.access_token;
+            }
+            if (tokenObj.token) {
+                return tokenObj.token;
+            }
+        }
+        throw new Error('Could not retrieve GitHub user token');
+    }
+    /**
+     * List repositories available to a GitHub App installation using the Nango Proxy.
+     * The proxy automatically handles token injection and refresh.
+     * @see https://nango.dev/docs/implementation-guides/requests-proxy/implement-requests-proxy
+     */
+    async listGithubAppRepos(connectionId) {
+        const response = await this.client.get({
+            connectionId,
+            providerConfigKey: NANGO_INTEGRATIONS.GITHUB_APP,
+            endpoint: '/installation/repositories',
+            params: { per_page: '100' },
+        });
+        return response.data;
+    }
+    /**
+     * Get the GitHub App installation ID from a connection.
+     * The installation ID is stored in connection_config.installation_id
+     */
+    async getGithubAppInstallationId(connectionId) {
+        try {
+            const connection = await this.client.getConnection(NANGO_INTEGRATIONS.GITHUB_APP, connectionId);
+            // Extract installation_id from connection_config (where Nango stores it for GitHub App OAuth)
+            const connectionConfig = connection.connection_config;
+            if (connectionConfig?.installation_id) {
+                return Number(connectionConfig.installation_id);
+            }
+            console.warn('[nango] No installation_id in connection_config');
+            return null;
+        }
+        catch (err) {
+            console.error('[nango] Failed to get installation ID:', err);
+            return null;
+        }
+    }
+    /**
+     * Create an issue via Nango Proxy.
+     */
+    async createGithubIssue(connectionId, owner, repo, data) {
+        const response = await this.client.post({
+            connectionId,
+            providerConfigKey: NANGO_INTEGRATIONS.GITHUB_APP,
+            endpoint: `/repos/${owner}/${repo}/issues`,
+            data,
+        });
+        return response.data;
+    }
+    /**
+     * Create a pull request via Nango Proxy.
+     */
+    async createGithubPullRequest(connectionId, owner, repo, data) {
+        const response = await this.client.post({
+            connectionId,
+            providerConfigKey: NANGO_INTEGRATIONS.GITHUB_APP,
+            endpoint: `/repos/${owner}/${repo}/pulls`,
+            data,
+        });
+        return response.data;
+    }
+    /**
+     * Add a comment to an issue via Nango Proxy.
+     */
+    async addGithubIssueComment(connectionId, owner, repo, issueNumber, body) {
+        const response = await this.client.post({
+            connectionId,
+            providerConfigKey: NANGO_INTEGRATIONS.GITHUB_APP,
+            endpoint: `/repos/${owner}/${repo}/issues/${issueNumber}/comments`,
+            data: { body },
+        });
+        return response.data;
+    }
+    /**
+     * Update connection end user metadata (e.g., after creating a user record).
+     */
+    async updateEndUser(connectionId, providerConfigKey, endUser) {
+        await this.client.patchConnection({ connectionId, provider_config_key: providerConfigKey }, { end_user: endUser });
+    }
+    /**
+     * Delete a connection from Nango.
+     *
+     * Used to remove temporary session connections for returning users
+     * to prevent duplicate connections in Nango. In the two-connection pattern,
+     * new users get a permanent connection but returning users authenticate
+     * with a temporary one that gets deleted.
+     *
+     * @param connectionId - Nango connection ID to delete
+     * @param providerConfigKey - The integration key (e.g., 'github')
+     */
+    async deleteConnection(connectionId, providerConfigKey) {
+        await this.client.deleteConnection(providerConfigKey, connectionId);
+    }
+    /**
+     * Get connection metadata including end_user info.
+     * Useful when webhook doesn't include end_user data.
+     */
+    async getConnection(connectionId, providerConfigKey) {
+        const connection = await this.client.getConnection(providerConfigKey, connectionId);
+        return connection;
+    }
+    /**
+     * Check if user has access to a specific GitHub repository.
+     * Uses the user's OAuth connection to query GitHub API.
+     * @param connectionId - User's Nango connection ID (github user OAuth)
+     * @param owner - Repository owner
+     * @param repo - Repository name
+     * @returns Access details or null if no access
+     */
+    async checkUserRepoAccess(connectionId, owner, repo) {
+        try {
+            const response = await this.client.get({
+                connectionId,
+                providerConfigKey: NANGO_INTEGRATIONS.GITHUB_USER,
+                endpoint: `/repos/${owner}/${repo}`,
+            });
+            const data = response.data;
+            let permission = 'none';
+            if (data.permissions) {
+                if (data.permissions.admin) {
+                    permission = 'admin';
+                }
+                else if (data.permissions.push) {
+                    permission = 'write';
+                }
+                else if (data.permissions.pull) {
+                    permission = 'read';
+                }
+            }
+            return {
+                hasAccess: true,
+                permission,
+                repository: {
+                    id: data.id,
+                    fullName: data.full_name,
+                    isPrivate: data.private,
+                    defaultBranch: data.default_branch,
+                },
+            };
+        }
+        catch (err) {
+            // 404 = no access or repo doesn't exist
+            const error = err;
+            if (error.response?.status === 404 || error.response?.status === 403) {
+                return { hasAccess: false };
+            }
+            console.error('[nango] checkUserRepoAccess error:', err);
+            throw err;
+        }
+    }
+    /**
+     * List all repositories the user has access to via their OAuth connection.
+     * Uses the user's personal OAuth token (not the GitHub App).
+     * @param connectionId - User's Nango connection ID (github user OAuth)
+     * @param options - Pagination and filter options
+     * @returns List of accessible repositories
+     */
+    async listUserAccessibleRepos(connectionId, options) {
+        const page = options?.page ?? 1;
+        const perPage = options?.perPage ?? 100;
+        const type = options?.type ?? 'all';
+        const sort = options?.sort ?? 'updated';
+        const response = await this.client.get({
+            connectionId,
+            providerConfigKey: NANGO_INTEGRATIONS.GITHUB_USER,
+            endpoint: '/user/repos',
+            params: {
+                page: String(page),
+                per_page: String(perPage),
+                type,
+                sort,
+                direction: 'desc',
+            },
+        });
+        const repos = response.data || [];
+        return {
+            repositories: repos.map(r => ({
+                id: r.id,
+                fullName: r.full_name,
+                isPrivate: r.private,
+                defaultBranch: r.default_branch,
+                permissions: r.permissions || { admin: false, push: false, pull: false },
+            })),
+            hasMore: repos.length === perPage,
+        };
+    }
+    /**
+     * Verify webhook signature sent by Nango.
+     * Uses the new verifyIncomingWebhookRequest method.
+     * @see https://nango.dev/docs/reference/sdks/node#verify-webhook-signature
+     */
+    verifyWebhookSignature(rawBody, headers) {
+        try {
+            // Use the new method: verifyIncomingWebhookRequest(body, headers)
+            return this.client.verifyIncomingWebhookRequest(rawBody, headers);
+        }
+        catch (err) {
+            console.error('[nango] verifyIncomingWebhookRequest error:', err);
+            // Fall back to manual HMAC verification using the secret key
+            const signature = headers['x-nango-signature'];
+            const hmacSha256 = headers['x-nango-hmac-sha256'];
+            if (!signature && !hmacSha256)
+                return false;
+            const expectedSignature = crypto
+                .createHmac('sha256', this.secret)
+                .update(rawBody)
+                .digest('hex');
+            return signature === expectedSignature || hmacSha256 === expectedSignature;
+        }
+    }
+}
+export const nangoService = new NangoService();
+//# sourceMappingURL=nango.js.map

package/dist/cloud/services/persistence.d.ts

@@ -0,0 +1,131 @@
+/**
+ * Cloud Persistence Service
+ *
+ * Handles durable persistence of agent session data for cloud deployments.
+ * Subscribes to PtyWrapper events ('summary', 'session-end') and persists
+ * to PostgreSQL via Drizzle ORM.
+ *
+ * This decouples PtyWrapper from storage concerns - the wrapper emits events,
+ * this service handles persistence. Different storage backends can be swapped
+ * by implementing alternative persistence services.
+ *
+ * @see PtyWrapperEvents in src/wrapper/pty-wrapper.ts for event definitions
+ */
+import type { PtyWrapper } from '../../wrapper/pty-wrapper.js';
+/**
+ * Configuration for CloudPersistenceService
+ */
+export interface CloudPersistenceConfig {
+    /** Workspace ID for scoping sessions */
+    workspaceId: string;
+    /** Optional callback when summary is persisted */
+    onSummaryPersisted?: (agentName: string, summaryId: string) => void;
+    /** Optional callback when session ends */
+    onSessionEnded?: (agentName: string, sessionId: string) => void;
+}
+/**
+ * CloudPersistenceService manages durable storage for agent sessions.
+ *
+ * Usage:
+ * ```typescript
+ * const persistence = new CloudPersistenceService({
+ *   workspaceId: 'workspace-123',
+ * });
+ *
+ * // Bind to a PtyWrapper instance
+ * const pty = new PtyWrapper(config);
+ * const sessionId = await persistence.bindToPtyWrapper(pty);
+ *
+ * // When done, unbind to clean up listeners
+ * persistence.unbindFromPtyWrapper(pty);
+ * ```
+ */
+export declare class CloudPersistenceService {
+    private config;
+    private boundWrappers;
+    constructor(config: CloudPersistenceConfig);
+    /**
+     * Bind to a PtyWrapper instance and start persisting its events.
+     * Creates a new agent session record and returns the session ID.
+     *
+     * @param wrapper The PtyWrapper to bind to
+     * @returns The session ID for this agent session
+     */
+    bindToPtyWrapper(wrapper: PtyWrapper): Promise<string>;
+    /**
+     * Unbind from a PtyWrapper and clean up event listeners.
+     *
+     * @param wrapper The PtyWrapper to unbind from
+     */
+    unbindFromPtyWrapper(wrapper: PtyWrapper): void;
+    /**
+     * Handle a summary event - persist to agent_summaries table.
+     */
+    private handleSummary;
+    /**
+     * Handle a session-end event - update agent_sessions with end marker.
+     */
+    private handleSessionEnd;
+    /**
+     * Get the session ID for a bound wrapper.
+     */
+    getSessionId(wrapper: PtyWrapper): string | undefined;
+    /**
+     * Get all summaries for a session.
+     */
+    getSessionSummaries(sessionId: string): Promise<{
+        id: string;
+        sessionId: string;
+        agentName: string;
+        summary: {
+            currentTask?: string;
+            completedTasks?: string[];
+            decisions?: string[];
+            context?: string;
+            files?: string[];
+        };
+        createdAt: Date;
+    }[]>;
+    /**
+     * Get the latest summary for an agent in THIS workspace.
+     * Joins through agent_sessions to ensure workspace scoping.
+     */
+    getLatestSummary(agentName: string): Promise<{
+        id: string;
+        sessionId: string;
+        agentName: string;
+        summary: {
+            currentTask?: string;
+            completedTasks?: string[];
+            decisions?: string[];
+            context?: string;
+            files?: string[];
+        };
+        createdAt: Date;
+    }>;
+    /**
+     * Get active sessions for a workspace.
+     */
+    getActiveSessions(): Promise<{
+        id: string;
+        workspaceId: string;
+        agentName: string;
+        status: string;
+        startedAt: Date;
+        endedAt: Date | null;
+        endMarker: {
+            summary?: string;
+            completedTasks?: string[];
+        } | null;
+        metadata: unknown;
+    }[]>;
+    /**
+     * Clean up all bindings.
+     */
+    destroy(): void;
+}
+/**
+ * Factory function to create a persistence service for a workspace.
+ */
+export declare function createPersistenceService(workspaceId: string): CloudPersistenceService;
+//# sourceMappingURL=persistence.d.ts.map

package/dist/cloud/services/persistence.js

@@ -0,0 +1,200 @@
+/**
+ * Cloud Persistence Service
+ *
+ * Handles durable persistence of agent session data for cloud deployments.
+ * Subscribes to PtyWrapper events ('summary', 'session-end') and persists
+ * to PostgreSQL via Drizzle ORM.
+ *
+ * This decouples PtyWrapper from storage concerns - the wrapper emits events,
+ * this service handles persistence. Different storage backends can be swapped
+ * by implementing alternative persistence services.
+ *
+ * @see PtyWrapperEvents in src/wrapper/pty-wrapper.ts for event definitions
+ */
+import { eq, and, desc } from 'drizzle-orm';
+import { getDb } from '../db/drizzle.js';
+import { agentSessions, agentSummaries } from '../db/schema.js';
+/**
+ * CloudPersistenceService manages durable storage for agent sessions.
+ *
+ * Usage:
+ * ```typescript
+ * const persistence = new CloudPersistenceService({
+ *   workspaceId: 'workspace-123',
+ * });
+ *
+ * // Bind to a PtyWrapper instance
+ * const pty = new PtyWrapper(config);
+ * const sessionId = await persistence.bindToPtyWrapper(pty);
+ *
+ * // When done, unbind to clean up listeners
+ * persistence.unbindFromPtyWrapper(pty);
+ * ```
+ */
+export class CloudPersistenceService {
+    config;
+    boundWrappers = new Map();
+    constructor(config) {
+        this.config = config;
+    }
+    /**
+     * Bind to a PtyWrapper instance and start persisting its events.
+     * Creates a new agent session record and returns the session ID.
+     *
+     * @param wrapper The PtyWrapper to bind to
+     * @returns The session ID for this agent session
+     */
+    async bindToPtyWrapper(wrapper) {
+        const db = getDb();
+        const agentName = wrapper.name;
+        // Create session record
+        const result = await db.insert(agentSessions).values({
+            workspaceId: this.config.workspaceId,
+            agentName,
+            status: 'active',
+            startedAt: new Date(),
+        }).returning();
+        const session = result[0];
+        if (!session) {
+            throw new Error(`Failed to create session for agent ${agentName}`);
+        }
+        const sessionId = session.id;
+        // Create event handlers
+        const summaryHandler = async (event) => {
+            await this.handleSummary(sessionId, event);
+        };
+        const sessionEndHandler = async (event) => {
+            await this.handleSessionEnd(sessionId, event);
+        };
+        // Bind handlers
+        wrapper.on('summary', summaryHandler);
+        wrapper.on('session-end', sessionEndHandler);
+        // Track binding for cleanup
+        this.boundWrappers.set(wrapper, {
+            sessionId,
+            summaryHandler,
+            sessionEndHandler,
+        });
+        console.log(`[persistence] Bound to ${agentName}, session=${sessionId}`);
+        return sessionId;
+    }
+    /**
+     * Unbind from a PtyWrapper and clean up event listeners.
+     *
+     * @param wrapper The PtyWrapper to unbind from
+     */
+    unbindFromPtyWrapper(wrapper) {
+        const binding = this.boundWrappers.get(wrapper);
+        if (!binding)
+            return;
+        wrapper.off('summary', binding.summaryHandler);
+        wrapper.off('session-end', binding.sessionEndHandler);
+        this.boundWrappers.delete(wrapper);
+        console.log(`[persistence] Unbound from ${wrapper.name}`);
+    }
+    /**
+     * Handle a summary event - persist to agent_summaries table.
+     */
+    async handleSummary(sessionId, event) {
+        try {
+            const db = getDb();
+            const result = await db.insert(agentSummaries).values({
+                sessionId,
+                agentName: event.agentName,
+                summary: event.summary,
+                createdAt: new Date(),
+            }).returning();
+            const summaryRecord = result[0];
+            if (!summaryRecord) {
+                console.error(`[persistence] Insert returned no record for ${event.agentName}`);
+                return;
+            }
+            console.log(`[persistence] Saved summary for ${event.agentName}: ${event.summary.currentTask || 'no task'}`);
+            this.config.onSummaryPersisted?.(event.agentName, summaryRecord.id);
+        }
+        catch (err) {
+            console.error(`[persistence] Failed to save summary for ${event.agentName}:`, err);
+        }
+    }
+    /**
+     * Handle a session-end event - update agent_sessions with end marker.
+     */
+    async handleSessionEnd(sessionId, event) {
+        try {
+            const db = getDb();
+            await db.update(agentSessions)
+                .set({
+                status: 'ended',
+                endedAt: new Date(),
+                endMarker: event.marker,
+            })
+                .where(eq(agentSessions.id, sessionId));
+            console.log(`[persistence] Session ended for ${event.agentName}: ${event.marker.summary || 'no summary'}`);
+            this.config.onSessionEnded?.(event.agentName, sessionId);
+        }
+        catch (err) {
+            console.error(`[persistence] Failed to end session for ${event.agentName}:`, err);
+        }
+    }
+    /**
+     * Get the session ID for a bound wrapper.
+     */
+    getSessionId(wrapper) {
+        return this.boundWrappers.get(wrapper)?.sessionId;
+    }
+    /**
+     * Get all summaries for a session.
+     */
+    async getSessionSummaries(sessionId) {
+        const db = getDb();
+        return db.select()
+            .from(agentSummaries)
+            .where(eq(agentSummaries.sessionId, sessionId))
+            .orderBy(agentSummaries.createdAt);
+    }
+    /**
+     * Get the latest summary for an agent in THIS workspace.
+     * Joins through agent_sessions to ensure workspace scoping.
+     */
+    async getLatestSummary(agentName) {
+        const db = getDb();
+        // Join with sessions to ensure we only get summaries from this workspace
+        const results = await db.select({
+            id: agentSummaries.id,
+            sessionId: agentSummaries.sessionId,
+            agentName: agentSummaries.agentName,
+            summary: agentSummaries.summary,
+            createdAt: agentSummaries.createdAt,
+        })
+            .from(agentSummaries)
+            .innerJoin(agentSessions, eq(agentSummaries.sessionId, agentSessions.id))
+            .where(and(eq(agentSummaries.agentName, agentName), eq(agentSessions.workspaceId, this.config.workspaceId)))
+            .orderBy(desc(agentSummaries.createdAt))
+            .limit(1);
+        return results[0] || null;
+    }
+    /**
+     * Get active sessions for a workspace.
+     */
+    async getActiveSessions() {
+        const db = getDb();
+        return db.select()
+            .from(agentSessions)
+            .where(and(eq(agentSessions.workspaceId, this.config.workspaceId), eq(agentSessions.status, 'active')));
+    }
+    /**
+     * Clean up all bindings.
+     */
+    destroy() {
+        for (const wrapper of this.boundWrappers.keys()) {
+            this.unbindFromPtyWrapper(wrapper);
+        }
+    }
+}
+/**
+ * Factory function to create a persistence service for a workspace.
+ */
+export function createPersistenceService(workspaceId) {
+    return new CloudPersistenceService({ workspaceId });
+}
+//# sourceMappingURL=persistence.js.map