agent-relay 1.2.0 → 1.2.3

package/dist/cloud/api/repos.js

@@ -2,10 +2,12 @@
  * Repos API Routes
  *
  * GitHub repository management - list, import, sync.
+ * Includes Nango-based GitHub permission checking for dashboard access control.
  */
 import { Router } from 'express';
 import { requireAuth } from './auth.js';
 import { db } from '../db/index.js';
+import { nangoService } from '../services/nango.js';
 export const reposRouter = Router();
 // All routes require authentication
 reposRouter.use(requireAuth);
@@ -311,4 +313,188 @@ reposRouter.get('/search', async (req, res) => {
         res.status(500).json({ error: 'Failed to search repositories' });
     }
 });
+// ============================================================================
+// Nango-based GitHub Permission APIs (for dashboard access control)
+// ============================================================================
+/**
+ * GET /api/repos/check-access/:owner/:repo
+ * Check if authenticated user has access to a specific GitHub repository.
+ * Uses Nango proxy with user's GitHub OAuth token.
+ *
+ * Response:
+ * - hasAccess: boolean - Whether user can access this repo
+ * - permission: 'admin' | 'write' | 'read' | 'none' - User's permission level
+ * - repository: Repository details if user has access
+ *
+ * Use this for dashboard access control - grant access if hasAccess is true.
+ */
+reposRouter.get('/check-access/:owner/:repo', async (req, res) => {
+    const userId = req.session.userId;
+    const { owner, repo } = req.params;
+    if (!owner || !repo) {
+        return res.status(400).json({ error: 'Owner and repo parameters are required' });
+    }
+    try {
+        // Get user's Nango connection ID
+        const user = await db.users.findById(userId);
+        if (!user) {
+            return res.status(404).json({ error: 'User not found' });
+        }
+        if (!user.nangoConnectionId) {
+            return res.status(400).json({
+                error: 'GitHub not connected via Nango',
+                code: 'NANGO_NOT_CONNECTED',
+                message: 'Please reconnect your GitHub account',
+            });
+        }
+        // Check access via Nango proxy
+        const accessResult = await nangoService.checkUserRepoAccess(user.nangoConnectionId, owner, repo);
+        res.json({
+            hasAccess: accessResult.hasAccess,
+            permission: accessResult.permission,
+            repository: accessResult.repository,
+            // Include user info for dashboard context
+            checkedBy: {
+                userId: user.id,
+                githubUsername: user.githubUsername,
+            },
+        });
+    }
+    catch (error) {
+        console.error('Error checking repo access:', error);
+        res.status(500).json({ error: 'Failed to check repository access' });
+    }
+});
+/**
+ * GET /api/repos/accessible
+ * List all GitHub repositories the authenticated user has access to.
+ * Uses Nango proxy with user's GitHub OAuth token.
+ *
+ * Query params:
+ * - page: Page number (default: 1)
+ * - perPage: Results per page (default: 100, max: 100)
+ * - type: Filter by type (all, owner, public, private, member)
+ * - sort: Sort by (created, updated, pushed, full_name)
+ *
+ * Use this to determine which dashboards/workspaces a user can access.
+ */
+reposRouter.get('/accessible', async (req, res) => {
+    const userId = req.session.userId;
+    const { page, perPage, type, sort } = req.query;
+    try {
+        // Get user's Nango connection ID
+        const user = await db.users.findById(userId);
+        if (!user) {
+            return res.status(404).json({ error: 'User not found' });
+        }
+        if (!user.nangoConnectionId) {
+            return res.status(400).json({
+                error: 'GitHub not connected via Nango',
+                code: 'NANGO_NOT_CONNECTED',
+                message: 'Please reconnect your GitHub account',
+            });
+        }
+        // List accessible repos via Nango proxy
+        const result = await nangoService.listUserAccessibleRepos(user.nangoConnectionId, {
+            page: page ? parseInt(page, 10) : undefined,
+            perPage: perPage ? Math.min(parseInt(perPage, 10), 100) : undefined,
+            type: type,
+            sort: sort,
+        });
+        res.json({
+            repositories: result.repositories,
+            pagination: {
+                page: page ? parseInt(page, 10) : 1,
+                perPage: perPage ? Math.min(parseInt(perPage, 10), 100) : 100,
+                hasMore: result.hasMore,
+            },
+            // Include user info for context
+            checkedBy: {
+                userId: user.id,
+                githubUsername: user.githubUsername,
+            },
+        });
+    }
+    catch (error) {
+        console.error('Error listing accessible repos:', error);
+        res.status(500).json({ error: 'Failed to list accessible repositories' });
+    }
+});
+/**
+ * POST /api/repos/check-access-bulk
+ * Check access to multiple repositories at once.
+ * Useful for determining which workspaces a user can view.
+ *
+ * Body:
+ * - repositories: Array of "owner/repo" strings
+ *
+ * Response:
+ * - results: Array of { fullName, hasAccess, permission }
+ */
+reposRouter.post('/check-access-bulk', async (req, res) => {
+    const userId = req.session.userId;
+    const { repositories } = req.body;
+    if (!repositories || !Array.isArray(repositories)) {
+        return res.status(400).json({ error: 'repositories array is required' });
+    }
+    if (repositories.length > 50) {
+        return res.status(400).json({ error: 'Maximum 50 repositories per request' });
+    }
+    try {
+        // Get user's Nango connection ID
+        const user = await db.users.findById(userId);
+        if (!user) {
+            return res.status(404).json({ error: 'User not found' });
+        }
+        if (!user.nangoConnectionId) {
+            return res.status(400).json({
+                error: 'GitHub not connected via Nango',
+                code: 'NANGO_NOT_CONNECTED',
+                message: 'Please reconnect your GitHub account',
+            });
+        }
+        // Check access for each repo (in parallel with concurrency limit)
+        const results = [];
+        // Process in batches of 10 to avoid rate limiting
+        const batchSize = 10;
+        for (let i = 0; i < repositories.length; i += batchSize) {
+            const batch = repositories.slice(i, i + batchSize);
+            const batchResults = await Promise.all(batch.map(async (fullName) => {
+                try {
+                    const [owner, repo] = fullName.split('/');
+                    if (!owner || !repo) {
+                        return { fullName, hasAccess: false, error: 'Invalid repository format' };
+                    }
+                    const accessResult = await nangoService.checkUserRepoAccess(user.nangoConnectionId, owner, repo);
+                    return {
+                        fullName,
+                        hasAccess: accessResult.hasAccess,
+                        permission: accessResult.permission,
+                    };
+                }
+                catch (_err) {
+                    return { fullName, hasAccess: false, error: 'Check failed' };
+                }
+            }));
+            results.push(...batchResults);
+        }
+        const accessibleCount = results.filter(r => r.hasAccess).length;
+        res.json({
+            results,
+            summary: {
+                total: repositories.length,
+                accessible: accessibleCount,
+                denied: repositories.length - accessibleCount,
+            },
+            checkedBy: {
+                userId: user.id,
+                githubUsername: user.githubUsername,
+            },
+        });
+    }
+    catch (error) {
+        console.error('Error checking bulk repo access:', error);
+        res.status(500).json({ error: 'Failed to check repository access' });
+    }
+});
 //# sourceMappingURL=repos.js.map

package/dist/cloud/api/webhooks.d.ts

@@ -2,6 +2,7 @@
  * Webhook API Routes
  *
  * Handles GitHub App webhooks for installation events.
+ * Also provides workspace webhook forwarding for external integrations.
  */
 export declare const webhooksRouter: import("express-serve-static-core").Router;
 //# sourceMappingURL=webhooks.d.ts.map

package/dist/cloud/api/webhooks.js

@@ -2,12 +2,161 @@
  * Webhook API Routes
  *
  * Handles GitHub App webhooks for installation events.
+ * Also provides workspace webhook forwarding for external integrations.
  */
 import { Router } from 'express';
 import crypto from 'crypto';
 import { getConfig } from '../config.js';
 import { db } from '../db/index.js';
 export const webhooksRouter = Router();
+// ============================================================================
+// Workspace Webhook Forwarding
+// ============================================================================
+/**
+ * Convert workspace public URL to internal Fly.io URL
+ */
+function getWorkspaceInternalUrl(publicUrl) {
+    const isOnFly = !!process.env.FLY_APP_NAME;
+    let url = publicUrl.replace(/\/$/, '');
+    if (isOnFly && url.includes('.fly.dev')) {
+        // Use Fly.io internal networking
+        // ar-583f273b.fly.dev -> http://ar-583f273b.internal:3888
+        // .internal uses IPv6 and works by default for apps in the same org
+        const appName = url.match(/https?:\/\/([^.]+)\.fly\.dev/)?.[1];
+        if (appName) {
+            url = `http://${appName}.internal:3888`;
+        }
+    }
+    return url;
+}
+/**
+ * Wake a suspended Fly.io workspace machine
+ */
+async function wakeWorkspaceMachine(workspaceId) {
+    const workspace = await db.workspaces.findById(workspaceId);
+    if (!workspace?.computeId)
+        return false;
+    const appName = `ar-${workspaceId.substring(0, 8)}`;
+    const apiToken = process.env.FLY_API_TOKEN;
+    if (!apiToken) {
+        console.warn('[webhooks] FLY_API_TOKEN not set, cannot wake machine');
+        return false;
+    }
+    try {
+        const response = await fetch(`https://api.machines.dev/v1/apps/${appName}/machines/${workspace.computeId}/start`, {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${apiToken}` },
+        });
+        if (response.ok) {
+            console.log(`[webhooks] Started workspace machine ${workspace.computeId}`);
+            // Wait a bit for machine to start
+            await new Promise(resolve => setTimeout(resolve, 5000));
+            return true;
+        }
+        // 200 OK means already running
+        if (response.status === 200) {
+            return true;
+        }
+        console.warn(`[webhooks] Failed to start machine: ${response.status}`);
+        return false;
+    }
+    catch (error) {
+        console.error('[webhooks] Error waking machine:', error);
+        return false;
+    }
+}
+/**
+ * POST /api/webhooks/workspace/:workspaceId/*
+ * Forward webhooks to a specific workspace
+ *
+ * External services can send webhooks to:
+ *   https://agent-relay.com/api/webhooks/workspace/{workspaceId}/your/path
+ *
+ * This will be forwarded to:
+ *   http://{workspace-internal}/webhooks/your/path
+ */
+// Handler for workspace webhook forwarding - matches any path under /workspace/:workspaceId
+async function handleWorkspaceWebhook(req, res) {
+    // Extract workspaceId from URL path
+    const pathMatch = req.originalUrl.match(/\/workspace\/([^/]+)\/?(.*)$/);
+    if (!pathMatch) {
+        res.status(400).json({ error: 'Invalid workspace webhook URL' });
+        return;
+    }
+    const workspaceId = pathMatch[1];
+    const forwardPath = pathMatch[2] || '';
+    console.log(`[webhooks] Forwarding to workspace ${workspaceId}: ${req.method} /${forwardPath}`);
+    try {
+        // Find the workspace
+        const workspace = await db.workspaces.findById(workspaceId);
+        if (!workspace) {
+            res.status(404).json({ error: 'Workspace not found' });
+            return;
+        }
+        if (!workspace.publicUrl) {
+            res.status(400).json({ error: 'Workspace has no public URL' });
+            return;
+        }
+        // Try to wake the machine if it might be suspended
+        if (workspace.status === 'running' || workspace.status === 'suspended') {
+            await wakeWorkspaceMachine(workspaceId);
+        }
+        // Get internal URL for server-to-server communication
+        const internalUrl = getWorkspaceInternalUrl(workspace.publicUrl);
+        const targetUrl = `${internalUrl}/webhooks/${forwardPath}`;
+        console.log(`[webhooks] Forwarding to: ${targetUrl}`);
+        // Forward the request with original headers and body
+        const forwardHeaders = {};
+        // Copy relevant headers
+        const headersToForward = [
+            'content-type',
+            'x-hub-signature-256',
+            'x-hub-signature',
+            'x-github-event',
+            'x-github-delivery',
+            'x-gitlab-token',
+            'x-gitlab-event',
+            'user-agent',
+        ];
+        for (const header of headersToForward) {
+            const value = req.get(header);
+            if (value) {
+                forwardHeaders[header] = value;
+            }
+        }
+        // Add workspace context header
+        forwardHeaders['x-forwarded-for-workspace'] = workspaceId;
+        forwardHeaders['x-original-host'] = req.get('host') || '';
+        // Get raw body if available, otherwise use JSON stringified body
+        const rawBody = req.rawBody || JSON.stringify(req.body);
+        const response = await fetch(targetUrl, {
+            method: req.method,
+            headers: forwardHeaders,
+            body: ['GET', 'HEAD'].includes(req.method) ? undefined : rawBody,
+        });
+        // Forward response back
+        const responseBody = await response.text();
+        res.status(response.status);
+        // Copy response headers
+        response.headers.forEach((value, key) => {
+            if (!['content-encoding', 'transfer-encoding', 'content-length'].includes(key.toLowerCase())) {
+                res.set(key, value);
+            }
+        });
+        res.send(responseBody);
+    }
+    catch (error) {
+        console.error(`[webhooks] Error forwarding to workspace ${workspaceId}:`, error);
+        res.status(502).json({
+            error: 'Failed to forward webhook to workspace',
+            details: error.message,
+        });
+    }
+}
+// TODO: Re-enable workspace webhook forwarding once route pattern issue is resolved
+// The newer path-to-regexp version doesn't support wildcard patterns like /workspace/*
+// See: https://git.new/pathToRegexpError
+// webhooksRouter.all('/workspace/*', handleWorkspaceWebhook);
 // GitHub webhook signature verification
 function verifyGitHubSignature(payload, signature) {
     if (!signature)

package/dist/cloud/api/workspaces.js

@@ -6,8 +6,9 @@
 import { Router } from 'express';
 import { requireAuth } from './auth.js';
 import { db } from '../db/index.js';
-import { getProvisioner } from '../provisioner/index.js';
+import { getProvisioner, getProvisioningStage } from '../provisioner/index.js';
 import { checkWorkspaceLimit } from './middleware/planLimits.js';
+import { getConfig } from '../config.js';
 export const workspacesRouter = Router();
 // All routes require authentication
 workspacesRouter.use(requireAuth);
@@ -267,7 +268,17 @@ workspacesRouter.get('/:id/status', async (req, res) => {
         }
         const provisioner = getProvisioner();
         const status = await provisioner.getStatus(id);
-        res.json({ status });
+        // Include provisioning progress info if it exists (even after status changes to 'running')
+        // This allows the frontend to see all stages including 'complete'
+        const provisioningProgress = getProvisioningStage(id);
+        res.json({
+            status,
+            provisioning: provisioningProgress ? {
+                stage: provisioningProgress.stage,
+                startedAt: provisioningProgress.startedAt,
+                elapsedMs: Date.now() - provisioningProgress.startedAt,
+            } : null,
+        });
     }
     catch (error) {
         console.error('Error getting workspace status:', error);
@@ -376,6 +387,77 @@ workspacesRouter.post('/:id/repos', async (req, res) => {
         res.status(500).json({ error: 'Failed to add repositories' });
     }
 });
+/**
+ * POST /api/workspaces/:id/autoscale
+ * Trigger auto-scaling based on current agent count
+ * Supports both user session auth and workspace token auth
+ * Called by workspace container when spawning new agents
+ */
+workspacesRouter.post('/:id/autoscale', async (req, res) => {
+    const { id } = req.params;
+    const { agentCount } = req.body;
+    if (typeof agentCount !== 'number' || agentCount < 0) {
+        return res.status(400).json({ error: 'agentCount must be a non-negative number' });
+    }
+    try {
+        const workspace = await db.workspaces.findById(id);
+        if (!workspace) {
+            return res.status(404).json({ error: 'Workspace not found' });
+        }
+        // Verify auth: either user session or workspace token
+        const userId = req.session?.userId;
+        const authHeader = req.get('authorization');
+        if (userId) {
+            // User session auth
+            if (workspace.userId !== userId) {
+                return res.status(403).json({ error: 'Unauthorized' });
+            }
+        }
+        else if (authHeader?.startsWith('Bearer ')) {
+            // Workspace token auth (for calls from within the workspace)
+            const crypto = await import('crypto');
+            const config = getConfig();
+            const providedToken = authHeader.slice(7);
+            const expectedToken = crypto.default
+                .createHmac('sha256', config.sessionSecret)
+                .update(`workspace:${id}`)
+                .digest('hex');
+            const isValid = crypto.default.timingSafeEqual(Buffer.from(providedToken), Buffer.from(expectedToken));
+            if (!isValid) {
+                return res.status(401).json({ error: 'Invalid workspace token' });
+            }
+        }
+        else {
+            return res.status(401).json({ error: 'Authentication required' });
+        }
+        const provisioner = getProvisioner();
+        const currentTier = await provisioner.getCurrentTier(id);
+        const recommendedTier = provisioner.getRecommendedTier(agentCount);
+        // Check if scaling is needed
+        if (recommendedTier.memoryMb <= currentTier.memoryMb) {
+            return res.json({
+                scaled: false,
+                currentTier: currentTier.name,
+                message: 'Current tier is sufficient',
+            });
+        }
+        // Perform the scale-up (respects plan limits)
+        const result = await provisioner.autoScale(id, agentCount);
+        res.json({
+            scaled: result.scaled,
+            previousTier: result.currentTier || currentTier.name,
+            newTier: result.targetTier || currentTier.name,
+            reason: result.reason,
+            message: result.scaled
+                ? `Scaled up to ${result.targetTier} tier`
+                : result.reason || 'Scaling not required',
+        });
+    }
+    catch (error) {
+        console.error('Error auto-scaling workspace:', error);
+        res.status(500).json({ error: 'Failed to auto-scale workspace' });
+    }
+});
 /**
  * POST /api/workspaces/:id/domain
  * Add or update custom domain (Premium feature - Team/Enterprise only)
@@ -424,7 +506,7 @@ workspacesRouter.post('/:id/domain', async (req, res) => {
             instructions: {
                 type: 'CNAME',
                 name: domain,
-                value: workspace.publicUrl?.replace('https://', '') || `${id}.agentrelay.dev`,
+                value: workspace.publicUrl?.replace('https://', '') || `${id}.agent-relay.com`,
                 ttl: 300,
             },
             verifyEndpoint: `/api/workspaces/${id}/domain/verify`,
@@ -458,7 +540,7 @@ workspacesRouter.post('/:id/domain/verify', async (req, res) => {
         const dns = await import('dns').then(m => m.promises);
         try {
             const records = await dns.resolveCname(workspace.customDomain);
-            const expectedTarget = workspace.publicUrl?.replace('https://', '') || `${id}.agentrelay.dev`;
+            const expectedTarget = workspace.publicUrl?.replace('https://', '') || `${id}.agent-relay.com`;
             if (records.some(r => r.includes(expectedTarget) || r.includes('agentrelay'))) {
                 // DNS is configured, now provision SSL cert
                 await db.workspaces.updateCustomDomainStatus(id, 'verifying');
@@ -600,10 +682,19 @@ workspacesRouter.all('/:id/proxy/{*proxyPath}', async (req, res) => {
             return res.status(400).json({ error: 'Workspace is not running' });
         }
         // Determine the internal URL for proxying
-        // When running inside Docker, localhost URLs won't work - use the container name instead
+        // When running inside Docker or Fly.io, use internal networking
         let targetBaseUrl = workspace.publicUrl;
         const runningInDocker = process.env.RUNNING_IN_DOCKER === 'true';
-        if (runningInDocker && workspace.computeId && targetBaseUrl.includes('localhost')) {
+        const runningOnFly = !!process.env.FLY_APP_NAME;
+        if (runningOnFly && targetBaseUrl.includes('.fly.dev')) {
+            // Use Fly.io internal networking (.internal uses IPv6, works by default)
+            // ar-583f273b.fly.dev -> http://ar-583f273b.internal:3888
+            const appName = targetBaseUrl.match(/https?:\/\/([^.]+)\.fly\.dev/)?.[1];
+            if (appName) {
+                targetBaseUrl = `http://${appName}.internal:3888`;
+            }
+        }
+        else if (runningInDocker && workspace.computeId && targetBaseUrl.includes('localhost')) {
             // Replace localhost URL with container name for Docker networking
             // workspace.computeId is the container name (e.g., "ar-abc12345")
             // The workspace port is 3888 inside the container

package/dist/cloud/billing/plans.js

@@ -10,15 +10,15 @@ export const BILLING_PLANS = {
     free: {
         id: 'free',
         name: 'Free',
-        description: 'For individuals exploring AI agent workflows',
+        description: 'Try AI agent workflows with limited access',
         priceMonthly: 0,
         priceYearly: 0,
         limits: {
-            maxWorkspaces: 2,
-            maxAgentsPerWorkspace: 3,
+            maxWorkspaces: 1,
+            maxAgentsPerWorkspace: 2,
             maxTeamMembers: 1,
             maxStorageGB: 1,
-            maxComputeHoursPerMonth: 10,
+            maxComputeHoursPerMonth: 5, // Limited to 5 hours/month
             customDomains: false,
             prioritySupport: false,
             sla: false,
@@ -27,27 +27,27 @@ export const BILLING_PLANS = {
             sessionPersistence: false,
         },
         features: [
-            'Up to 2 workspaces',
-            'Up to 3 agents per workspace',
-            '10 compute hours/month',
-            '1 GB storage',
+            '1 workspace',
+            'Up to 2 agents',
+            '5 compute hours/month',
+            'Shared CPU (may throttle)',
             'Community support',
         ],
     },
     pro: {
         id: 'pro',
         name: 'Pro',
-        description: 'For professional developers and small teams',
-        priceMonthly: 2900, // $29/month
-        priceYearly: 29000, // $290/year (2 months free)
+        description: 'For professional developers building with AI agents',
+        priceMonthly: 4900, // $49/month
+        priceYearly: 47000, // $470/year (2 months free)
         stripePriceIdMonthly: process.env.STRIPE_PRO_MONTHLY_PRICE_ID,
         stripePriceIdYearly: process.env.STRIPE_PRO_YEARLY_PRICE_ID,
         limits: {
-            maxWorkspaces: 10,
-            maxAgentsPerWorkspace: 10,
-            maxTeamMembers: 5,
+            maxWorkspaces: 5,
+            maxAgentsPerWorkspace: 5,
+            maxTeamMembers: 3,
             maxStorageGB: 10,
-            maxComputeHoursPerMonth: 100,
+            maxComputeHoursPerMonth: 50,
             customDomains: true,
             prioritySupport: false,
             sla: false,
@@ -56,11 +56,11 @@ export const BILLING_PLANS = {
             sessionPersistence: true,
         },
         features: [
-            'Up to 10 workspaces',
-            'Up to 10 agents per workspace',
-            '100 compute hours/month',
+            'Up to 5 workspaces',
+            'Up to 5 agents per workspace',
+            '50 compute hours/month',
             '10 GB storage',
-            '5 team members',
+            '3 team members',
             'Custom domains',
             'Session persistence',
             'Email support',

package/dist/cloud/provisioner/index.d.ts

@@ -4,6 +4,16 @@
  * One-click provisioning for compute resources (Fly.io, Railway, Docker).
  */
 import { Workspace } from '../db/index.js';
+export type ProvisioningStage = 'creating' | 'networking' | 'secrets' | 'machine' | 'booting' | 'health' | 'complete';
+interface ProvisioningProgress {
+    stage: ProvisioningStage;
+    startedAt: number;
+    updatedAt: number;
+}
+/**
+ * Get the current provisioning stage for a workspace
+ */
+export declare function getProvisioningStage(workspaceId: string): ProvisioningProgress | null;
 export interface ProvisionConfig {
     userId: string;
     name: string;
@@ -30,6 +40,7 @@ export interface ResourceTier {
     cpuCores: number;
     memoryMb: number;
     maxAgents: number;
+    cpuKind: 'shared' | 'performance';
 }
 export declare const RESOURCE_TIERS: Record<string, ResourceTier>;
 /**
@@ -40,8 +51,13 @@ export declare class WorkspaceProvisioner {
     constructor();
     /**
      * Provision a new workspace (one-click)
+     * Returns immediately with 'provisioning' status and runs actual provisioning in background
      */
     provision(config: ProvisionConfig): Promise<ProvisionResult>;
+    /**
+     * Run the actual provisioning work asynchronously
+     */
+    private runProvisioningAsync;
     /**
      * Deprovision a workspace
      */
@@ -70,6 +86,22 @@ export declare class WorkspaceProvisioner {
      * Get current resource tier for a workspace
      */
     getCurrentTier(workspaceId: string): Promise<ResourceTier>;
+    /**
+     * Get recommended tier based on agent count
+     * Uses 1.5-2GB per agent as baseline for Claude Code
+     */
+    getRecommendedTier(agentCount: number): ResourceTier;
+    /**
+     * Auto-scale workspace based on current agent count
+     * Respects plan limits - free tier cannot scale, others have max tier limits
+     * Returns { scaled: boolean, reason?: string }
+     */
+    autoScale(workspaceId: string, currentAgentCount: number): Promise<{
+        scaled: boolean;
+        reason?: string;
+        currentTier?: string;
+        targetTier?: string;
+    }>;
 }
 export declare function getProvisioner(): WorkspaceProvisioner;
 //# sourceMappingURL=index.d.ts.map