agent-relay 1.1.0 → 1.2.3

package/dist/daemon/api.js

@@ -9,6 +9,7 @@ import { createLogger } from '../resiliency/logger.js';
 import { metrics } from '../resiliency/metrics.js';
 import { getWorkspaceManager } from './workspace-manager.js';
 import { getAgentManager } from './agent-manager.js';
+import { startCLIAuth, getAuthSession, cancelAuthSession, getSupportedProviders, } from './cli-auth.js';
 const logger = createLogger('daemon-api');
 export class DaemonApi extends EventEmitter {
     server;
@@ -18,17 +19,63 @@ export class DaemonApi extends EventEmitter {
     sessions = new Map();
     routes = new Map();
     config;
+    allowedOrigins;
+    allowAllOrigins;
     constructor(config) {
         super();
         this.config = config;
         this.workspaceManager = getWorkspaceManager(config.dataDir);
         this.agentManager = getAgentManager(config.dataDir);
+        const configuredOrigins = this.loadAllowedOrigins(config);
+        this.allowAllOrigins = configuredOrigins.includes('*');
+        this.allowedOrigins = new Set(configuredOrigins
+            .map(origin => origin.trim())
+            .filter(origin => origin && origin !== '*'));
         // Setup routes
         this.setupRoutes();
         // Forward events to WebSocket clients
         this.workspaceManager.on('event', (event) => this.broadcastEvent(event));
         this.agentManager.on('event', (event) => this.broadcastEvent(event));
     }
+    /**
+     * Resolve allowed origins from config/env (comma-separated list).
+     * Empty list means no cross-origin access is permitted.
+     */
+    loadAllowedOrigins(config) {
+        if (config.allowedOrigins?.length) {
+            return config.allowedOrigins;
+        }
+        const envOrigins = process.env.AGENT_RELAY_API_ALLOWED_ORIGINS;
+        if (envOrigins?.trim()) {
+            return envOrigins.split(',').map(origin => origin.trim()).filter(Boolean);
+        }
+        return [];
+    }
+    /**
+     * Return allowed origin for CORS or null if explicitly blocked.
+     * Undefined means no CORS header will be set (same-origin/server-to-server).
+     */
+    resolveAllowedOrigin(originHeader, requestHost) {
+        if (!originHeader)
+            return undefined; // Non-browser or requests without Origin header
+        if (this.allowAllOrigins)
+            return originHeader;
+        if (this.allowedOrigins.has(originHeader))
+            return originHeader;
+        if (requestHost) {
+            try {
+                const originHost = new URL(originHeader).host;
+                // Allow same-origin requests even if not explicitly configured
+                if (originHost === requestHost) {
+                    return originHeader;
+                }
+            }
+            catch {
+                // Malformed origin; treat as blocked below
+            }
+        }
+        return null;
+    }
     /**
      * Start the API server
      */
@@ -208,15 +255,97 @@ export class DaemonApi extends EventEmitter {
             const agents = this.agentManager.getAll();
             return { status: 200, body: { agents } };
         });
+        // === CLI Auth (for cloud server to call) ===
+        // List supported providers
+        this.routes.set('GET /auth/providers', async () => {
+            return { status: 200, body: { providers: getSupportedProviders() } };
+        });
+        // Start CLI auth flow
+        this.routes.set('POST /auth/cli/:provider/start', async (req) => {
+            const { provider } = req.params;
+            try {
+                const session = await startCLIAuth(provider);
+                return {
+                    status: 200,
+                    body: {
+                        sessionId: session.id,
+                        status: session.status,
+                        authUrl: session.authUrl,
+                    },
+                };
+            }
+            catch (err) {
+                return {
+                    status: 400,
+                    body: { error: err instanceof Error ? err.message : 'Failed to start auth' },
+                };
+            }
+        });
+        // Get auth session status
+        this.routes.set('GET /auth/cli/:provider/status/:sessionId', async (req) => {
+            const { sessionId } = req.params;
+            const session = getAuthSession(sessionId);
+            if (!session) {
+                return { status: 404, body: { error: 'Session not found' } };
+            }
+            return {
+                status: 200,
+                body: {
+                    sessionId: session.id,
+                    status: session.status,
+                    authUrl: session.authUrl,
+                    error: session.error,
+                    promptsHandled: session.promptsHandled,
+                },
+            };
+        });
+        // Get credentials from completed auth
+        this.routes.set('GET /auth/cli/:provider/creds/:sessionId', async (req) => {
+            const { sessionId } = req.params;
+            const session = getAuthSession(sessionId);
+            if (!session) {
+                return { status: 404, body: { error: 'Session not found' } };
+            }
+            if (session.status !== 'success') {
+                return { status: 400, body: { error: 'Auth not complete', status: session.status } };
+            }
+            return {
+                status: 200,
+                body: {
+                    token: session.token,
+                    provider: session.provider,
+                },
+            };
+        });
+        // Cancel auth session
+        this.routes.set('POST /auth/cli/:provider/cancel/:sessionId', async (req) => {
+            const { sessionId } = req.params;
+            const cancelled = cancelAuthSession(sessionId);
+            if (!cancelled) {
+                return { status: 404, body: { error: 'Session not found' } };
+            }
+            return { status: 200, body: { success: true } };
+        });
     }
     /**
      * Handle HTTP request
      */
     async handleRequest(req, res) {
-        // CORS headers
-        res.setHeader('Access-Control-Allow-Origin', '*');
+        const originHeader = typeof req.headers.origin === 'string' ? req.headers.origin : undefined;
+        const allowedOrigin = this.resolveAllowedOrigin(originHeader, req.headers.host);
+        // CORS headers (default denies cross-origin unless explicitly allowed)
         res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
         res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
+        res.setHeader('Vary', 'Origin');
+        if (allowedOrigin === null) {
+            logger.warn('CORS origin blocked', { origin: originHeader });
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'CORS origin not allowed' }));
+            return;
+        }
+        if (allowedOrigin) {
+            res.setHeader('Access-Control-Allow-Origin', allowedOrigin);
+        }
         if (req.method === 'OPTIONS') {
             res.writeHead(204);
             res.end();

package/dist/daemon/cli-auth.d.ts

@@ -0,0 +1,67 @@
+/**
+ * CLI Auth Handler for Workspace Daemon
+ *
+ * Handles CLI-based authentication (claude, codex, etc.) via PTY.
+ * Runs inside the workspace container where CLI tools are installed.
+ */
+import * as pty from 'node-pty';
+import { CLI_AUTH_CONFIG, getSupportedProviders, type CLIAuthConfig, type PromptHandler } from '../shared/cli-auth-config.js';
+export { CLI_AUTH_CONFIG, getSupportedProviders };
+export type { CLIAuthConfig, PromptHandler };
+/**
+ * Auth session state
+ */
+interface AuthSession {
+    id: string;
+    provider: string;
+    status: 'starting' | 'waiting_auth' | 'success' | 'error';
+    authUrl?: string;
+    token?: string;
+    refreshToken?: string;
+    tokenExpiresAt?: Date;
+    error?: string;
+    output: string;
+    promptsHandled: string[];
+    createdAt: Date;
+    process?: pty.IPty;
+}
+export interface StartCLIAuthOptions {
+    /** Use device flow instead of standard OAuth (if provider supports it) */
+    useDeviceFlow?: boolean;
+}
+/**
+ * Start CLI auth flow
+ *
+ * This function waits for the auth URL to be captured before returning,
+ * ensuring the caller can immediately open the OAuth popup.
+ */
+export declare function startCLIAuth(provider: string, options?: StartCLIAuthOptions): Promise<AuthSession>;
+/**
+ * Get auth session status
+ */
+export declare function getAuthSession(sessionId: string): AuthSession | null;
+/**
+ * Submit auth code to a waiting session
+ * This writes the code to the PTY process stdin
+ *
+ * @returns Object with success status and optional error message
+ */
+export declare function submitAuthCode(sessionId: string, code: string): Promise<{
+    success: boolean;
+    error?: string;
+    needsRestart?: boolean;
+}>;
+/**
+ * Complete auth session by polling for credentials
+ * Called when user indicates they've completed auth in browser
+ */
+export declare function completeAuthSession(sessionId: string): Promise<{
+    success: boolean;
+    error?: string;
+    token?: string;
+}>;
+/**
+ * Cancel auth session
+ */
+export declare function cancelAuthSession(sessionId: string): boolean;
+//# sourceMappingURL=cli-auth.d.ts.map