agent-relay 1.1.0 → 1.2.3

package/dist/shared/cli-auth-config.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Shared CLI Auth Configuration
+ *
+ * Provider-specific CLI commands and patterns for OAuth authentication.
+ * Used by both the cloud API and workspace daemon.
+ */
+/**
+ * Interactive prompt handler configuration
+ * Defines patterns to detect prompts and responses to send
+ */
+export interface PromptHandler {
+    /** Pattern to detect in CLI output (case-insensitive) */
+    pattern: RegExp;
+    /** Response to send (e.g., '\r' for enter, 'y\r' for yes+enter) */
+    response: string;
+    /** Delay before sending response (ms) */
+    delay?: number;
+    /** Description for logging/debugging */
+    description: string;
+}
+/**
+ * CLI auth configuration for each provider
+ */
+export interface CLIAuthConfig {
+    /** CLI command to run */
+    command: string;
+    /** Arguments to pass */
+    args: string[];
+    /** Alternative args for device flow (if supported) */
+    deviceFlowArgs?: string[];
+    /** Pattern to extract auth URL from output */
+    urlPattern: RegExp;
+    /** Path to credentials file (for reading after auth) */
+    credentialPath?: string;
+    /** Display name for UI */
+    displayName: string;
+    /** Interactive prompts to auto-respond to */
+    prompts: PromptHandler[];
+    /** Success indicators in output */
+    successPatterns: RegExp[];
+    /** How long to wait for URL to appear (ms) */
+    waitTimeout: number;
+    /** Whether this provider supports device flow */
+    supportsDeviceFlow?: boolean;
+}
+/**
+ * CLI commands and URL patterns for each provider
+ *
+ * Each CLI tool outputs an OAuth URL when run without credentials.
+ * We capture stdout/stderr and extract the URL using regex patterns.
+ *
+ * IMPORTANT: These CLIs are interactive - they output the auth URL then wait
+ * for the user to complete OAuth in their browser. We capture the URL and
+ * display it in a popup for the user.
+ */
+export declare const CLI_AUTH_CONFIG: Record<string, CLIAuthConfig>;
+/**
+ * Strip ANSI escape codes from text
+ */
+export declare function stripAnsiCodes(text: string): string;
+/**
+ * Check if text matches any success pattern
+ */
+export declare function matchesSuccessPattern(text: string, patterns: RegExp[]): boolean;
+/**
+ * Find matching prompt handler that hasn't been responded to yet
+ */
+export declare function findMatchingPrompt(text: string, prompts: PromptHandler[], respondedPrompts: Set<string>): PromptHandler | null;
+/**
+ * Get list of supported provider IDs
+ */
+export declare function getSupportedProviderIds(): string[];
+/**
+ * Get list of supported providers with details
+ */
+export declare function getSupportedProviders(): {
+    id: string;
+    displayName: string;
+    command: string;
+}[];
+/**
+ * Validate a provider's CLI auth configuration
+ * Returns null if valid, or an error message if invalid
+ */
+export declare function validateProviderConfig(providerId: string, config: CLIAuthConfig): string | null;
+/**
+ * Validate all provider configurations
+ * Returns array of error messages (empty if all valid)
+ */
+export declare function validateAllProviderConfigs(): string[];
+//# sourceMappingURL=cli-auth-config.d.ts.map

package/dist/shared/cli-auth-config.js

@@ -0,0 +1,264 @@
+/**
+ * Shared CLI Auth Configuration
+ *
+ * Provider-specific CLI commands and patterns for OAuth authentication.
+ * Used by both the cloud API and workspace daemon.
+ */
+/**
+ * CLI commands and URL patterns for each provider
+ *
+ * Each CLI tool outputs an OAuth URL when run without credentials.
+ * We capture stdout/stderr and extract the URL using regex patterns.
+ *
+ * IMPORTANT: These CLIs are interactive - they output the auth URL then wait
+ * for the user to complete OAuth in their browser. We capture the URL and
+ * display it in a popup for the user.
+ */
+export const CLI_AUTH_CONFIG = {
+    anthropic: {
+        command: 'claude',
+        args: [],
+        urlPattern: /(https:\/\/[^\s]+)/,
+        credentialPath: '~/.claude/.credentials.json',
+        displayName: 'Claude',
+        waitTimeout: 30000, // Claude can take a while to show the auth URL
+        prompts: [
+            {
+                // Claude Code version selection - accept default (recommended)
+                pattern: /which\s*version|claude\s*code\s*version|select.*version/i,
+                response: '\r',
+                delay: 100,
+                description: 'Version selection prompt',
+            },
+            {
+                pattern: /dark\s*(mode|theme)/i,
+                response: '\r', // Press enter to accept default
+                delay: 100,
+                description: 'Dark mode prompt',
+            },
+            {
+                // Login method selection - "Select login method:" with Claude account or Console options
+                pattern: /select\s*login\s*method|how\s*would\s*you\s*like\s*to\s*authenticate|choose.*auth.*method|select.*auth|subscription\s*or.*api\s*key/i,
+                response: '\r', // Press enter for first option (Claude account with subscription)
+                delay: 100,
+                description: 'Login method selection',
+            },
+            {
+                // Login success - press enter to continue
+                pattern: /login\s*successful|logged\s*in.*press\s*enter|press\s*enter\s*to\s*continue/i,
+                response: '\r',
+                delay: 200,
+                description: 'Login success prompt',
+            },
+            {
+                // Trust directory - matches various trust prompts including:
+                // "Quick safety check: Is this a project you created or one you trust?"
+                // "Yes, I trust this folder"
+                // "Do you trust the files in this folder?"
+                pattern: /trust\s*(this|the)?\s*(files|directory|folder|workspace)|do\s*you\s*trust|safety\s*check|yes,?\s*i\s*trust/i,
+                response: '\r', // Press enter for first option (Yes, proceed)
+                delay: 300, // Slightly longer delay for menu to render
+                description: 'Trust directory prompt',
+            },
+            {
+                // "Ready to code here?" permission prompt - asks for file access permission
+                // Shows "Yes, continue" / "No, exit" options with "Enter to confirm"
+                // This is different from trust directory - it's about granting file permissions
+                pattern: /ready\s*to\s*code\s*here|permission\s*to\s*work\s*with\s*your\s*files|yes,?\s*continue/i,
+                response: '\r', // Press enter to accept "Yes, continue" (already selected)
+                delay: 300,
+                description: 'Ready to code permission prompt',
+            },
+            {
+                // Fallback: Any "press enter" or "enter to confirm/continue" prompt
+                // Keep this LAST so more specific handlers match first
+                pattern: /press\s*enter|enter\s*to\s*(confirm|continue|proceed)|hit\s*enter/i,
+                response: '\r',
+                delay: 300,
+                description: 'Generic enter prompt',
+            },
+        ],
+        successPatterns: [/success/i, /authenticated/i, /logged\s*in/i, /you.*(?:are|now).*logged/i],
+    },
+    openai: {
+        command: 'codex',
+        args: ['login'], // Standard OAuth flow
+        deviceFlowArgs: ['login', '--device-auth'], // Device auth for headless/container environments
+        supportsDeviceFlow: true,
+        urlPattern: /(https:\/\/[^\s]+)/,
+        credentialPath: '~/.codex/auth.json',
+        displayName: 'Codex',
+        waitTimeout: 30000,
+        prompts: [
+            {
+                pattern: /trust\s*(this|the)\s*(directory|folder|workspace)/i,
+                response: 'y\r',
+                delay: 100,
+                description: 'Trust directory prompt',
+            },
+        ],
+        successPatterns: [/success/i, /authenticated/i, /logged\s*in/i],
+    },
+    google: {
+        command: 'gemini',
+        args: [],
+        urlPattern: /(https:\/\/[^\s]+)/,
+        displayName: 'Gemini',
+        waitTimeout: 30000,
+        prompts: [
+            {
+                pattern: /login\s*with\s*google|google\s*account|choose.*auth/i,
+                response: '\r', // Select first option (Login with Google)
+                delay: 200,
+                description: 'Auth method selection',
+            },
+        ],
+        successPatterns: [/success/i, /authenticated/i, /logged\s*in/i],
+    },
+    opencode: {
+        command: 'opencode',
+        args: ['auth', 'login'],
+        // OpenCode redirects to provider OAuth pages (Anthropic, OpenAI, Google)
+        urlPattern: /(https:\/\/[^\s]+)/,
+        credentialPath: '~/.local/share/opencode/auth.json',
+        displayName: 'OpenCode',
+        waitTimeout: 30000,
+        prompts: [
+            {
+                pattern: /select.*provider|choose.*provider|which.*provider/i,
+                response: '\r', // Select first provider (OpenCode Zen - recommended)
+                delay: 300,
+                description: 'Provider selection',
+            },
+            {
+                pattern: /opencode\s*zen|recommended/i,
+                response: '\r', // Confirm provider selection
+                delay: 200,
+                description: 'Confirm provider',
+            },
+        ],
+        // Success patterns include credential added and existing credentials list
+        successPatterns: [/success/i, /authenticated/i, /logged\s*in/i, /credential\s*added/i, /\d+\s*credentials?/i],
+    },
+    droid: {
+        command: 'droid',
+        args: ['--login'],
+        urlPattern: /(https:\/\/[^\s]+)/,
+        displayName: 'Droid',
+        waitTimeout: 30000,
+        prompts: [
+            {
+                pattern: /sign\s*in|log\s*in|authenticate/i,
+                response: '\r',
+                delay: 200,
+                description: 'Login prompt',
+            },
+        ],
+        successPatterns: [/success/i, /authenticated/i, /logged\s*in/i],
+    },
+};
+/**
+ * Strip ANSI escape codes from text
+ */
+export function stripAnsiCodes(text) {
+    // eslint-disable-next-line no-control-regex
+    return text.replace(/\x1b\[[0-9;]*[a-zA-Z]/g, '');
+}
+/**
+ * Check if text matches any success pattern
+ */
+export function matchesSuccessPattern(text, patterns) {
+    const cleanText = stripAnsiCodes(text).toLowerCase();
+    return patterns.some((p) => p.test(cleanText));
+}
+/**
+ * Find matching prompt handler that hasn't been responded to yet
+ */
+export function findMatchingPrompt(text, prompts, respondedPrompts) {
+    const cleanText = stripAnsiCodes(text);
+    for (const prompt of prompts) {
+        if (respondedPrompts.has(prompt.description))
+            continue;
+        if (prompt.pattern.test(cleanText)) {
+            return prompt;
+        }
+    }
+    return null;
+}
+/**
+ * Get list of supported provider IDs
+ */
+export function getSupportedProviderIds() {
+    return Object.keys(CLI_AUTH_CONFIG);
+}
+/**
+ * Get list of supported providers with details
+ */
+export function getSupportedProviders() {
+    return Object.entries(CLI_AUTH_CONFIG).map(([id, config]) => ({
+        id,
+        displayName: config.displayName,
+        command: config.command,
+    }));
+}
+/**
+ * Validate a provider's CLI auth configuration
+ * Returns null if valid, or an error message if invalid
+ */
+export function validateProviderConfig(providerId, config) {
+    if (!config.command || typeof config.command !== 'string') {
+        return `${providerId}: missing or invalid 'command'`;
+    }
+    if (!Array.isArray(config.args)) {
+        return `${providerId}: 'args' must be an array`;
+    }
+    if (!(config.urlPattern instanceof RegExp)) {
+        return `${providerId}: 'urlPattern' must be a RegExp`;
+    }
+    // Check urlPattern has a capture group
+    const testUrl = 'https://example.com/test';
+    const match = testUrl.match(config.urlPattern);
+    if (!match || !match[1]) {
+        return `${providerId}: 'urlPattern' must have a capture group - got ${config.urlPattern}`;
+    }
+    if (!config.displayName || typeof config.displayName !== 'string') {
+        return `${providerId}: missing or invalid 'displayName'`;
+    }
+    if (typeof config.waitTimeout !== 'number' || config.waitTimeout <= 0) {
+        return `${providerId}: 'waitTimeout' must be a positive number`;
+    }
+    if (!Array.isArray(config.prompts)) {
+        return `${providerId}: 'prompts' must be an array`;
+    }
+    for (let i = 0; i < config.prompts.length; i++) {
+        const prompt = config.prompts[i];
+        if (!(prompt.pattern instanceof RegExp)) {
+            return `${providerId}: prompt[${i}].pattern must be a RegExp`;
+        }
+        if (typeof prompt.response !== 'string') {
+            return `${providerId}: prompt[${i}].response must be a string`;
+        }
+        if (!prompt.description) {
+            return `${providerId}: prompt[${i}].description is required`;
+        }
+    }
+    if (!Array.isArray(config.successPatterns)) {
+        return `${providerId}: 'successPatterns' must be an array`;
+    }
+    return null;
+}
+/**
+ * Validate all provider configurations
+ * Returns array of error messages (empty if all valid)
+ */
+export function validateAllProviderConfigs() {
+    const errors = [];
+    for (const [id, config] of Object.entries(CLI_AUTH_CONFIG)) {
+        const error = validateProviderConfig(id, config);
+        if (error) {
+            errors.push(error);
+        }
+    }
+    return errors;
+}
+//# sourceMappingURL=cli-auth-config.js.map

package/dist/storage/adapter.d.ts

@@ -1,5 +1,5 @@
 import type { PayloadKind, SendMeta } from '../protocol/types.js';
-export type MessageStatus = 'unread' | 'read' | 'acked';
+export type MessageStatus = 'unread' | 'read' | 'acked' | 'failed';
 export interface StoredMessage {
     id: string;
     ts: number;

package/dist/trajectory/config.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Trajectory Configuration
+ *
+ * Handles repo-level opt-in/opt-out for trajectory storage.
+ * When trajectories are opt-out (not in source control), they're stored
+ * in the user's home directory instead of the repo.
+ *
+ * DECISIONS:
+ * 1. Default behavior: trajectories are OPT-OUT (stored outside repo)
+ *    - Reasoning: Most repos won't want trajectory files in source control
+ *    - Users must explicitly opt-in to store in repo
+ *
+ * 2. Setting location: .relay/config.json in repo root
+ *    - Reasoning: Keeps relay config separate from .claude/ which may have other uses
+ *    - Alternative considered: .claude/settings.json - rejected to avoid conflicts
+ *
+ * 3. User-level storage: ~/.config/agent-relay/trajectories/<project-hash>/
+ *    - Reasoning: XDG-compliant, project-isolated, survives repo deletion
+ */
+/**
+ * Relay config structure
+ */
+export interface RelayConfig {
+    /** Trajectory settings */
+    trajectories?: {
+        /**
+         * Whether to store trajectories in the repo (.trajectories/)
+         * Default: false (stored in ~/.config/agent-relay/trajectories/)
+         */
+        storeInRepo?: boolean;
+    };
+}
+/**
+ * Get the relay config file path
+ */
+export declare function getRelayConfigPath(projectRoot?: string): string;
+/**
+ * Read the relay config from the repo
+ */
+export declare function readRelayConfig(projectRoot?: string): RelayConfig;
+/**
+ * Check if trajectories should be stored in the repo
+ */
+export declare function shouldStoreInRepo(projectRoot?: string): boolean;
+/**
+ * Get a hash of the project path for user-level storage isolation
+ */
+export declare function getProjectHash(projectRoot?: string): string;
+/**
+ * Get the user-level trajectories directory
+ */
+export declare function getUserTrajectoriesDir(projectRoot?: string): string;
+/**
+ * Get the repo-level trajectories directory
+ */
+export declare function getRepoTrajectoriesDir(projectRoot?: string): string;
+/**
+ * Get the primary trajectories directory based on config
+ * This is where new trajectories will be written
+ */
+export declare function getPrimaryTrajectoriesDir(projectRoot?: string): string;
+/**
+ * Get all trajectories directories (for reading)
+ * Returns both repo and user-level if they exist
+ */
+export declare function getAllTrajectoriesDirs(projectRoot?: string): string[];
+/**
+ * Ensure the primary trajectories directory exists
+ */
+export declare function ensureTrajectoriesDir(projectRoot?: string): string;
+/**
+ * Get trajectory environment variables for trail CLI
+ * Sets TRAJECTORIES_DATA_DIR to the appropriate location
+ */
+export declare function getTrajectoryEnvVars(projectRoot?: string): Record<string, string>;
+/**
+ * Check if project has opted into repo-level trajectory storage
+ */
+export declare function isTrajectoryOptedIn(projectRoot?: string): boolean;
+/**
+ * Get a human-readable description of where trajectories are stored
+ */
+export declare function getTrajectoriesStorageDescription(projectRoot?: string): string;
+//# sourceMappingURL=config.d.ts.map

package/dist/trajectory/config.js

@@ -0,0 +1,163 @@
+/**
+ * Trajectory Configuration
+ *
+ * Handles repo-level opt-in/opt-out for trajectory storage.
+ * When trajectories are opt-out (not in source control), they're stored
+ * in the user's home directory instead of the repo.
+ *
+ * DECISIONS:
+ * 1. Default behavior: trajectories are OPT-OUT (stored outside repo)
+ *    - Reasoning: Most repos won't want trajectory files in source control
+ *    - Users must explicitly opt-in to store in repo
+ *
+ * 2. Setting location: .relay/config.json in repo root
+ *    - Reasoning: Keeps relay config separate from .claude/ which may have other uses
+ *    - Alternative considered: .claude/settings.json - rejected to avoid conflicts
+ *
+ * 3. User-level storage: ~/.config/agent-relay/trajectories/<project-hash>/
+ *    - Reasoning: XDG-compliant, project-isolated, survives repo deletion
+ */
+import { existsSync, readFileSync, mkdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { createHash } from 'node:crypto';
+import { getProjectPaths } from '../utils/project-namespace.js';
+/**
+ * Cache for config to avoid repeated file reads
+ */
+let configCache = null;
+/**
+ * Get the relay config file path
+ */
+export function getRelayConfigPath(projectRoot) {
+    const root = projectRoot ?? getProjectPaths().projectRoot;
+    return join(root, '.relay', 'config.json');
+}
+/**
+ * Read the relay config from the repo
+ */
+export function readRelayConfig(projectRoot) {
+    const configPath = getRelayConfigPath(projectRoot);
+    // Check cache
+    if (configCache && configCache.path === configPath) {
+        try {
+            const stat = statSync(configPath);
+            if (stat.mtimeMs === configCache.mtime) {
+                return configCache.config;
+            }
+        }
+        catch {
+            // File may not exist or be readable
+        }
+    }
+    try {
+        if (!existsSync(configPath)) {
+            return {};
+        }
+        const content = readFileSync(configPath, 'utf-8');
+        const config = JSON.parse(content);
+        // Update cache
+        try {
+            const stat = statSync(configPath);
+            configCache = { path: configPath, config, mtime: stat.mtimeMs };
+        }
+        catch {
+            // Ignore cache update failures
+        }
+        return config;
+    }
+    catch (err) {
+        console.warn('[trajectory-config] Failed to read config:', err);
+        return {};
+    }
+}
+/**
+ * Check if trajectories should be stored in the repo
+ */
+export function shouldStoreInRepo(projectRoot) {
+    const config = readRelayConfig(projectRoot);
+    // Default to false - trajectories are stored outside repo by default
+    return config.trajectories?.storeInRepo === true;
+}
+/**
+ * Get a hash of the project path for user-level storage isolation
+ */
+export function getProjectHash(projectRoot) {
+    const root = projectRoot ?? getProjectPaths().projectRoot;
+    return createHash('sha256').update(root).digest('hex').slice(0, 16);
+}
+/**
+ * Get the user-level trajectories directory
+ */
+export function getUserTrajectoriesDir(projectRoot) {
+    const projectHash = getProjectHash(projectRoot);
+    const configDir = process.env.XDG_CONFIG_HOME || join(homedir(), '.config');
+    return join(configDir, 'agent-relay', 'trajectories', projectHash);
+}
+/**
+ * Get the repo-level trajectories directory
+ */
+export function getRepoTrajectoriesDir(projectRoot) {
+    const root = projectRoot ?? getProjectPaths().projectRoot;
+    return join(root, '.trajectories');
+}
+/**
+ * Get the primary trajectories directory based on config
+ * This is where new trajectories will be written
+ */
+export function getPrimaryTrajectoriesDir(projectRoot) {
+    if (shouldStoreInRepo(projectRoot)) {
+        return getRepoTrajectoriesDir(projectRoot);
+    }
+    return getUserTrajectoriesDir(projectRoot);
+}
+/**
+ * Get all trajectories directories (for reading)
+ * Returns both repo and user-level if they exist
+ */
+export function getAllTrajectoriesDirs(projectRoot) {
+    const dirs = [];
+    const repoDir = getRepoTrajectoriesDir(projectRoot);
+    if (existsSync(repoDir)) {
+        dirs.push(repoDir);
+    }
+    const userDir = getUserTrajectoriesDir(projectRoot);
+    if (existsSync(userDir)) {
+        dirs.push(userDir);
+    }
+    return dirs;
+}
+/**
+ * Ensure the primary trajectories directory exists
+ */
+export function ensureTrajectoriesDir(projectRoot) {
+    const dir = getPrimaryTrajectoriesDir(projectRoot);
+    mkdirSync(dir, { recursive: true });
+    return dir;
+}
+/**
+ * Get trajectory environment variables for trail CLI
+ * Sets TRAJECTORIES_DATA_DIR to the appropriate location
+ */
+export function getTrajectoryEnvVars(projectRoot) {
+    const dataDir = getPrimaryTrajectoriesDir(projectRoot);
+    return {
+        TRAJECTORIES_DATA_DIR: dataDir,
+    };
+}
+/**
+ * Check if project has opted into repo-level trajectory storage
+ */
+export function isTrajectoryOptedIn(projectRoot) {
+    return shouldStoreInRepo(projectRoot);
+}
+/**
+ * Get a human-readable description of where trajectories are stored
+ */
+export function getTrajectoriesStorageDescription(projectRoot) {
+    if (shouldStoreInRepo(projectRoot)) {
+        return `repo (.trajectories/)`;
+    }
+    return `user (~/.config/agent-relay/trajectories/)`;
+}
+//# sourceMappingURL=config.js.map

package/dist/trajectory/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Trajectory Module
+ *
+ * Integrates agent-relay with the agent-trajectories package
+ * for PDERO paradigm tracking (Plan, Design, Execute, Review, Observe)
+ */
+export * from './integration.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/trajectory/index.js

@@ -0,0 +1,8 @@
+/**
+ * Trajectory Module
+ *
+ * Integrates agent-relay with the agent-trajectories package
+ * for PDERO paradigm tracking (Plan, Design, Execute, Review, Observe)
+ */
+export * from './integration.js';
+//# sourceMappingURL=index.js.map