agent-relay 1.2.0 → 1.2.3

package/dist/cli/index.js

@@ -1688,6 +1688,7 @@ program
     .action(async (args) => {
     const { spawn } = await import('node:child_process');
     const { getProjectPaths } = await import('../utils/project-namespace.js');
+    const { getPrimaryTrajectoriesDir, ensureTrajectoriesDir } = await import('../trajectory/config.js');
     const paths = getProjectPaths();
     // Check if trail is available
     const trailCheck = spawn('which', ['trail'], { stdio: 'pipe' });
@@ -1709,6 +1710,10 @@ program
         console.log('PDERO phases: plan, design, execute, review, observe');
         process.exit(1);
     }
+    // Get trajectory storage path based on config (respects opt-in/opt-out)
+    // Uses TRAJECTORIES_DATA_DIR env var which trail CLI reads
+    const trajectoriesDir = getPrimaryTrajectoriesDir(paths.projectRoot);
+    ensureTrajectoriesDir(paths.projectRoot);
     // Spawn trail with the provided arguments
     const trailProc = spawn('trail', args, {
         cwd: paths.projectRoot,
@@ -1716,7 +1721,7 @@ program
         env: {
             ...process.env,
             TRAJECTORIES_PROJECT: paths.projectId,
-            TRAJECTORIES_DATA_DIR: paths.dataDir,
+            TRAJECTORIES_DATA_DIR: trajectoriesDir,
         },
     });
     trailProc.on('close', (code) => {
@@ -2220,5 +2225,217 @@ program
     await wrapper.start();
     console.log(`Profiling ${agentName}... Press Ctrl+C to stop.`);
 });
+// ============================================================================
+// codex-auth - Local OAuth callback helper for Codex/OpenAI authentication
+// ============================================================================
+program
+    .command('codex-auth')
+    .description('Capture Codex OAuth callback locally (run this when connecting Codex in Agent Relay)')
+    .option('--token <token>', 'Auth session token from Agent Relay dashboard')
+    .option('--cloud-url <url>', 'Cloud API URL', process.env.AGENT_RELAY_CLOUD_URL || 'https://agent-relay.com')
+    .option('--port <port>', 'Callback port (default: 1455)', '1455')
+    .option('--timeout <seconds>', 'Timeout in seconds (default: 300)', '300')
+    .action(async (options) => {
+    const http = await import('node:http');
+    const { URL } = await import('node:url');
+    const CALLBACK_PORT = parseInt(options.port, 10);
+    const TIMEOUT_MS = parseInt(options.timeout, 10) * 1000;
+    const CLOUD_URL = options.cloudUrl.replace(/\/$/, '');
+    // Colors for terminal output
+    const cyan = (s) => `\x1b[36m${s}\x1b[0m`;
+    const green = (s) => `\x1b[32m${s}\x1b[0m`;
+    const yellow = (s) => `\x1b[33m${s}\x1b[0m`;
+    const red = (s) => `\x1b[31m${s}\x1b[0m`;
+    console.log('');
+    console.log(cyan('═══════════════════════════════════════════════════'));
+    console.log(cyan('       Codex Authentication Helper'));
+    console.log(cyan('═══════════════════════════════════════════════════'));
+    console.log('');
+    // Get or create auth session
+    let authSessionId = options.token;
+    if (!authSessionId) {
+        // No token provided - create a session via the API
+        console.log('Creating auth session...');
+        try {
+            const response = await fetch(`${CLOUD_URL}/api/auth/codex-helper/cli-session`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+            });
+            if (!response.ok) {
+                const error = await response.json().catch(() => ({}));
+                console.log('');
+                console.log(red('Failed to create auth session.'));
+                console.log('');
+                if (response.status === 401) {
+                    console.log('To use this command, run it with a token from the Agent Relay dashboard:');
+                    console.log('');
+                    console.log(cyan('  npx agent-relay codex-auth --token=<TOKEN>'));
+                    console.log('');
+                    console.log('Get the token from: Settings → Connect Codex → "Use CLI helper"');
+                }
+                else {
+                    console.log(`Error: ${error.error || response.statusText}`);
+                }
+                process.exit(1);
+            }
+            const data = await response.json();
+            authSessionId = data.authSessionId;
+        }
+        catch (err) {
+            console.log(red('Failed to connect to Agent Relay Cloud.'));
+            console.log(`URL: ${CLOUD_URL}`);
+            console.log(`Error: ${err instanceof Error ? err.message : String(err)}`);
+            process.exit(1);
+        }
+    }
+    console.log(`Session: ${authSessionId?.slice(0, 8)}...`);
+    console.log(`Listening on port: ${cyan(String(CALLBACK_PORT))}`);
+    console.log('');
+    // Success HTML page
+    const successHtml = `<!DOCTYPE html>
+<html>
+<head>
+  <title>Authentication Successful</title>
+  <style>
+    body { font-family: -apple-system, sans-serif; background: #0a0f1a; color: #e2e8f0;
+           display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; }
+    .card { background: #1a1f2e; padding: 2rem; border-radius: 12px; text-align: center;
+            border: 1px solid rgba(0, 212, 255, 0.3); max-width: 400px; }
+    h1 { color: #00d4ff; margin-bottom: 1rem; }
+    p { color: #94a3b8; margin: 0.5rem 0; }
+  </style>
+</head>
+<body>
+  <div class="card">
+    <h1>✓ Authentication Successful!</h1>
+    <p>Your Codex account is now connected.</p>
+    <p style="margin-top: 1rem;">You can close this window.</p>
+  </div>
+</body>
+</html>`;
+    // Create HTTP server to capture callback
+    let authCode = null;
+    let serverClosed = false;
+    const server = http.createServer(async (req, res) => {
+        const url = new URL(req.url || '/', `http://localhost:${CALLBACK_PORT}`);
+        if (url.pathname === '/auth/callback') {
+            const code = url.searchParams.get('code');
+            const error = url.searchParams.get('error');
+            if (error) {
+                res.writeHead(400, { 'Content-Type': 'text/plain' });
+                res.end(`OAuth Error: ${error}`);
+                console.log(red(`OAuth error: ${error}`));
+                return;
+            }
+            if (code) {
+                authCode = code;
+                res.writeHead(200, { 'Content-Type': 'text/html' });
+                res.end(successHtml);
+                console.log('');
+                console.log(green('✓ Received OAuth callback!'));
+            }
+            else {
+                res.writeHead(400, { 'Content-Type': 'text/plain' });
+                res.end('Missing authorization code');
+            }
+        }
+        else if (url.pathname === '/favicon.ico') {
+            res.writeHead(404);
+            res.end();
+        }
+        else {
+            res.writeHead(200, { 'Content-Type': 'text/plain' });
+            res.end('Waiting for OAuth callback on /auth/callback...');
+        }
+    });
+    // Handle server errors
+    server.on('error', (err) => {
+        if (err.code === 'EADDRINUSE') {
+            console.log(red(`Port ${CALLBACK_PORT} is already in use.`));
+            console.log('');
+            console.log('Another process may be using this port.');
+            console.log('Close it and try again, or specify a different port with --port');
+            process.exit(1);
+        }
+        throw err;
+    });
+    // Start listening
+    await new Promise((resolve) => {
+        server.listen(CALLBACK_PORT, () => {
+            resolve();
+        });
+    });
+    console.log(green('Server ready!'));
+    console.log('');
+    console.log(yellow('Next steps:'));
+    console.log('  1. Go to the Agent Relay dashboard');
+    console.log('  2. Click "Open Codex Login Page" to start OAuth');
+    console.log('  3. Sign in with your OpenAI account');
+    console.log('  4. The callback will be captured automatically');
+    console.log('');
+    console.log(cyan(`Waiting for callback... (timeout: ${options.timeout}s)`));
+    // Wait for callback or timeout
+    const startTime = Date.now();
+    while (!authCode && !serverClosed && (Date.now() - startTime) < TIMEOUT_MS) {
+        await new Promise(resolve => setTimeout(resolve, 1000));
+        const elapsed = Math.floor((Date.now() - startTime) / 1000);
+        if (elapsed > 0 && elapsed % 30 === 0) {
+            console.log(`  Still waiting... (${elapsed}s)`);
+        }
+    }
+    // Close server
+    server.close();
+    serverClosed = true;
+    if (!authCode) {
+        console.log('');
+        console.log(red('Timeout waiting for OAuth callback.'));
+        console.log('');
+        console.log('If you completed sign-in, the callback may have failed.');
+        console.log('Try copying the localhost URL from your browser and pasting');
+        console.log('it into the Agent Relay dashboard manually.');
+        process.exit(1);
+    }
+    // Send code to cloud API
+    console.log('Sending auth code to Agent Relay...');
+    try {
+        const response = await fetch(`${CLOUD_URL}/api/auth/codex-helper/callback`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                authSessionId,
+                code: authCode,
+            }),
+        });
+        const data = await response.json();
+        if (response.ok && data.success) {
+            console.log('');
+            console.log(green('═══════════════════════════════════════════════════'));
+            console.log(green('          Authentication Complete!'));
+            console.log(green('═══════════════════════════════════════════════════'));
+            console.log('');
+            console.log('Your Codex account is now connected to Agent Relay.');
+            console.log('You can close this terminal and return to the dashboard.');
+            console.log('');
+        }
+        else {
+            console.log('');
+            console.log(red('Failed to send auth code to Agent Relay.'));
+            console.log(`Error: ${data.error || 'Unknown error'}`);
+            console.log('');
+            console.log('You can try pasting this code manually in the dashboard:');
+            console.log(cyan(authCode));
+            process.exit(1);
+        }
+    }
+    catch (err) {
+        console.log('');
+        console.log(red('Failed to connect to Agent Relay Cloud.'));
+        console.log(`Error: ${err instanceof Error ? err.message : String(err)}`);
+        console.log('');
+        console.log('You can try pasting this code manually in the dashboard:');
+        console.log(cyan(authCode));
+        process.exit(1);
+    }
+});
 program.parse();
 //# sourceMappingURL=index.js.map

package/dist/cloud/api/billing.js

@@ -6,6 +6,7 @@
 import { Router } from 'express';
 import { getBillingService, getAllPlans, getPlan, comparePlans } from '../billing/index.js';
 import { getConfig } from '../config.js';
+import { db } from '../db/index.js';
 export const billingRouter = Router();
 /**
  * Middleware to require authentication
@@ -315,8 +316,14 @@ billingRouter.post('/webhook',
     }
     const billing = getBillingService();
     try {
-        // Get raw body
-        const rawBody = JSON.stringify(req.body);
+        // Use the preserved raw body from express.json verify callback
+        // This is critical for Stripe signature verification - JSON.stringify(req.body) won't work
+        const rawBody = req.rawBody;
+        if (!rawBody) {
+            console.error('Raw body not available for Stripe webhook verification');
+            res.status(400).json({ error: 'Raw body not available' });
+            return;
+        }
         // Verify and parse event
         const event = billing.verifyWebhookSignature(rawBody, sig);
         // Process the event
@@ -330,16 +337,30 @@ billingRouter.post('/webhook',
         // Handle specific events
         switch (billingEvent.type) {
             case 'subscription.created':
-            case 'subscription.updated':
-                // Update user's subscription in database
-                // This would integrate with your user/database layer
-                console.log('Subscription updated for user:', billingEvent.userId);
+            case 'subscription.updated': {
+                // Extract subscription tier and update user's plan
+                if (billingEvent.userId) {
+                    const subscription = billingEvent.data;
+                    const tier = billing.getTierFromSubscription(subscription);
+                    // Update user's plan in database
+                    await db.users.update(billingEvent.userId, { plan: tier });
+                    console.log(`Updated user ${billingEvent.userId} plan to: ${tier}`);
+                }
+                else {
+                    console.warn('Subscription event received without userId:', billingEvent.id);
+                }
                 break;
-            case 'subscription.canceled':
-                console.log('Subscription canceled for user:', billingEvent.userId);
+            }
+            case 'subscription.canceled': {
+                // Reset user to free plan
+                if (billingEvent.userId) {
+                    await db.users.update(billingEvent.userId, { plan: 'free' });
+                    console.log(`User ${billingEvent.userId} subscription canceled, reset to free plan`);
+                }
                 break;
+            }
             case 'invoice.payment_failed':
-                // Notify user of failed payment
+                // Log payment failure (don't immediately downgrade - Stripe retries)
                 console.log('Payment failed for user:', billingEvent.userId);
                 break;
         }

package/dist/cloud/api/codex-auth-helper.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Codex Auth Helper API
+ *
+ * Provides endpoints for the `npx agent-relay codex-auth` CLI command
+ * to capture OAuth callbacks locally and send them to the cloud.
+ *
+ * This solves the "This site can't be reached" problem where Codex redirects
+ * to localhost:1455 after auth but nothing is listening.
+ */
+export declare const codexAuthHelperRouter: import("express-serve-static-core").Router;
+/**
+ * Stop the cleanup interval. Call this on server shutdown.
+ */
+export declare function stopCodexAuthCleanup(): void;
+//# sourceMappingURL=codex-auth-helper.d.ts.map

package/dist/cloud/api/codex-auth-helper.js

@@ -0,0 +1,100 @@
+/**
+ * Codex Auth Helper API
+ *
+ * Provides endpoints for the `npx agent-relay codex-auth` CLI command
+ * to capture OAuth callbacks locally and send them to the cloud.
+ *
+ * This solves the "This site can't be reached" problem where Codex redirects
+ * to localhost:1455 after auth but nothing is listening.
+ */
+import { Router } from 'express';
+import crypto from 'crypto';
+import { requireAuth } from './auth.js';
+export const codexAuthHelperRouter = Router();
+const pendingAuthSessions = new Map();
+// Clean up old sessions every minute
+const cleanupInterval = setInterval(() => {
+    const now = Date.now();
+    for (const [id, session] of pendingAuthSessions) {
+        // Remove sessions older than 10 minutes
+        if (now - session.createdAt.getTime() > 10 * 60 * 1000) {
+            pendingAuthSessions.delete(id);
+        }
+    }
+}, 60000);
+/**
+ * Stop the cleanup interval. Call this on server shutdown.
+ */
+export function stopCodexAuthCleanup() {
+    clearInterval(cleanupInterval);
+}
+/**
+ * POST /api/auth/codex-helper/cli-session
+ * Create a new auth session for the CLI command.
+ * Returns an authSessionId that the CLI uses to send the auth code.
+ */
+codexAuthHelperRouter.post('/cli-session', requireAuth, async (req, res) => {
+    const userId = req.session.userId;
+    const authSessionId = crypto.randomUUID();
+    pendingAuthSessions.set(authSessionId, {
+        userId,
+        createdAt: new Date(),
+    });
+    console.log(`[codex-helper] Created CLI session ${authSessionId} for user ${userId}`);
+    res.json({
+        authSessionId,
+        expiresIn: 600, // 10 minutes
+        command: `npx agent-relay codex-auth --token=${authSessionId}`,
+    });
+});
+/**
+ * POST /api/auth/codex-helper/callback
+ * Receives the auth code from the CLI.
+ * No auth required - validated by authSessionId.
+ */
+codexAuthHelperRouter.post('/callback', async (req, res) => {
+    const { authSessionId, code, error } = req.body;
+    if (!authSessionId) {
+        return res.status(400).json({ error: 'Missing authSessionId' });
+    }
+    const session = pendingAuthSessions.get(authSessionId);
+    if (!session) {
+        return res.status(404).json({ error: 'Session not found or expired' });
+    }
+    if (error) {
+        console.log(`[codex-helper] Auth error for session ${authSessionId}:`, error);
+        pendingAuthSessions.delete(authSessionId);
+        return res.json({ success: false, error });
+    }
+    if (!code) {
+        return res.status(400).json({ error: 'Missing auth code' });
+    }
+    // Store the code so the polling endpoint can retrieve it
+    session.code = code;
+    pendingAuthSessions.set(authSessionId, session);
+    console.log(`[codex-helper] Auth code received for session ${authSessionId}`);
+    res.json({ success: true, message: 'Auth code received. You can close this terminal.' });
+});
+/**
+ * GET /api/auth/codex-helper/status/:authSessionId
+ * Check if auth code has been received.
+ * The dashboard polls this to know when the CLI has captured the callback.
+ */
+codexAuthHelperRouter.get('/status/:authSessionId', requireAuth, async (req, res) => {
+    const { authSessionId } = req.params;
+    const session = pendingAuthSessions.get(authSessionId);
+    if (!session || session.userId !== req.session.userId) {
+        return res.status(404).json({ error: 'Session not found or expired' });
+    }
+    if (session.code) {
+        // Clean up session after successful retrieval (code is single-use)
+        const code = session.code;
+        pendingAuthSessions.delete(authSessionId);
+        return res.json({
+            ready: true,
+            code,
+        });
+    }
+    res.json({ ready: false });
+});
+//# sourceMappingURL=codex-auth-helper.js.map

package/dist/cloud/api/git.js

@@ -76,12 +76,33 @@ gitRouter.get('/token', async (req, res) => {
                 hint: 'Connect a repository via the GitHub App to enable git operations',
             });
         }
-        // Get fresh token from Nango (auto-refreshes if needed)
-        const token = await nangoService.getGithubAppToken(repoWithConnection.nangoConnectionId);
+        // Get fresh tokens from Nango (auto-refreshes if needed)
+        // - installationToken: for git operations (clone, push, pull)
+        // - userToken: for gh CLI operations (requires user context)
+        const installationToken = await nangoService.getGithubAppToken(repoWithConnection.nangoConnectionId);
+        // Try to get user OAuth token from github-app-oauth connection_config first
+        // Fall back to separate 'github' user connection if available
+        let userToken = null;
+        try {
+            userToken = await nangoService.getGithubUserOAuthToken(repoWithConnection.nangoConnectionId);
+        }
+        catch {
+            // Try the separate github user connection if available
+            const userRepo = repos.find(r => r.nangoConnectionId && r.nangoConnectionId !== repoWithConnection.nangoConnectionId);
+            if (userRepo?.nangoConnectionId) {
+                try {
+                    userToken = await nangoService.getGithubUserToken(userRepo.nangoConnectionId);
+                }
+                catch {
+                    console.log('[git] No github user token available');
+                }
+            }
+        }
         // GitHub App installation tokens expire after 1 hour
         const expiresAt = new Date(Date.now() + 55 * 60 * 1000).toISOString(); // 55 min buffer
         res.json({
-            token,
+            token: installationToken,
+            userToken, // For gh CLI - may be null if not available
             expiresAt,
             username: 'x-access-token', // GitHub App tokens use this as username
         });

package/dist/cloud/api/onboarding.js

@@ -95,12 +95,25 @@ onboardingRouter.post('/cli/:provider/start', async (req, res) => {
         // Forward auth request to workspace daemon
         // When running in Docker, localhost refers to the container, not the host
         // Use host.docker.internal on Mac/Windows to reach the host machine
+        // When running on Fly.io, use internal networking (.internal) instead of public DNS
         let workspaceUrl = workspace.publicUrl.replace(/\/$/, '');
+        // Detect Fly.io by checking FLY_APP_NAME env var
+        const isOnFly = !!process.env.FLY_APP_NAME;
         // Detect Docker by checking for /.dockerenv file or RUNNING_IN_DOCKER env var
         const isInDocker = process.env.RUNNING_IN_DOCKER === 'true' ||
             await import('fs').then(fs => fs.existsSync('/.dockerenv')).catch(() => false);
-        console.log('[onboarding] isInDocker:', isInDocker, 'RUNNING_IN_DOCKER:', process.env.RUNNING_IN_DOCKER);
-        if (isInDocker && workspaceUrl.includes('localhost')) {
+        console.log('[onboarding] isOnFly:', isOnFly, 'isInDocker:', isInDocker);
+        if (isOnFly && workspaceUrl.includes('.fly.dev')) {
+            // Use Fly.io internal networking for server-to-server communication
+            // ar-583f273b.fly.dev -> http://ar-583f273b.internal:3888
+            // .internal uses IPv6 and works by default for apps in the same org
+            const appName = workspaceUrl.match(/https?:\/\/([^.]+)\.fly\.dev/)?.[1];
+            if (appName) {
+                workspaceUrl = `http://${appName}.internal:3888`;
+                console.log('[onboarding] Using Fly internal network:', workspaceUrl);
+            }
+        }
+        else if (isInDocker && workspaceUrl.includes('localhost')) {
             workspaceUrl = workspaceUrl.replace('localhost', 'host.docker.internal');
             console.log('[onboarding] Translated localhost to host.docker.internal');
         }

package/dist/cloud/api/repos.d.ts

@@ -2,6 +2,7 @@
  * Repos API Routes
  *
  * GitHub repository management - list, import, sync.
+ * Includes Nango-based GitHub permission checking for dashboard access control.
  */
 export declare const reposRouter: import("express-serve-static-core").Router;
 //# sourceMappingURL=repos.d.ts.map