agent-relay 1.2.0 → 1.2.3

package/dist/cloud/provisioner/index.js

@@ -8,9 +8,46 @@ import { getConfig } from '../config.js';
 import { db } from '../db/index.js';
 import { vault } from '../vault/index.js';
 import { nangoService } from '../services/nango.js';
+import { canAutoScale, canScaleToTier, getResourceTierForPlan, } from '../services/planLimits.js';
 const WORKSPACE_PORT = 3888;
 const FETCH_TIMEOUT_MS = 10_000;
 const WORKSPACE_IMAGE = process.env.WORKSPACE_IMAGE || 'ghcr.io/agentworkforce/relay-workspace:latest';
+// In-memory tracker for provisioning progress (workspace ID -> progress)
+const provisioningProgress = new Map();
+/**
+ * Update the provisioning stage for a workspace
+ */
+function updateProvisioningStage(workspaceId, stage) {
+    const existing = provisioningProgress.get(workspaceId);
+    provisioningProgress.set(workspaceId, {
+        stage,
+        startedAt: existing?.startedAt ?? Date.now(),
+        updatedAt: Date.now(),
+    });
+    console.log(`[provisioner] Workspace ${workspaceId.substring(0, 8)} stage: ${stage}`);
+}
+/**
+ * Get the current provisioning stage for a workspace
+ */
+export function getProvisioningStage(workspaceId) {
+    return provisioningProgress.get(workspaceId) ?? null;
+}
+/**
+ * Clear provisioning progress (call when complete or failed)
+ */
+function clearProvisioningProgress(workspaceId) {
+    provisioningProgress.delete(workspaceId);
+}
+/**
+ * Schedule cleanup of provisioning progress after a delay
+ * This gives the frontend time to poll and see the 'complete' stage
+ */
+function scheduleProgressCleanup(workspaceId, delayMs = 30_000) {
+    setTimeout(() => {
+        clearProvisioningProgress(workspaceId);
+        console.log(`[provisioner] Cleaned up provisioning progress for ${workspaceId.substring(0, 8)}`);
+    }, delayMs);
+}
 /**
  * Get a fresh GitHub App installation token from Nango.
  * Looks up the user's connected repositories to find a valid Nango connection.
@@ -88,11 +125,95 @@ async function softHealthCheck(url) {
         console.warn(`[health] Failed to reach ${url}/health`, error);
     }
 }
+/**
+ * Wait for machine to be in "started" state using Fly.io's /wait endpoint
+ * This is more efficient than polling - the API blocks until the state is reached
+ * @see https://fly.io/docs/machines/api/machines-resource/#wait-for-a-machine-to-reach-a-specific-state
+ */
+async function waitForMachineStarted(apiToken, appName, machineId, timeoutSeconds = 120) {
+    console.log(`[provisioner] Waiting for machine ${machineId} to start (timeout: ${timeoutSeconds}s)...`);
+    try {
+        // Use Fly.io's /wait endpoint - blocks until machine reaches target state
+        const res = await fetch(`https://api.machines.dev/v1/apps/${appName}/machines/${machineId}/wait?state=started&timeout=${timeoutSeconds}`, {
+            headers: { Authorization: `Bearer ${apiToken}` },
+        });
+        if (res.ok) {
+            console.log(`[provisioner] Machine ${machineId} is now started`);
+            return;
+        }
+        // 408 = timeout, machine didn't reach state in time
+        if (res.status === 408) {
+            // Get current state for error message
+            const stateRes = await fetch(`https://api.machines.dev/v1/apps/${appName}/machines/${machineId}`, { headers: { Authorization: `Bearer ${apiToken}` } });
+            const machine = stateRes.ok ? (await stateRes.json()) : { state: 'unknown' };
+            throw new Error(`Machine ${machineId} did not start within ${timeoutSeconds}s (last state: ${machine.state})`);
+        }
+        // Other error
+        const errorText = await res.text();
+        throw new Error(`Wait for machine failed: ${res.status} ${errorText}`);
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.includes('did not start')) {
+            throw error;
+        }
+        console.warn(`[provisioner] Error waiting for machine:`, error);
+        throw new Error(`Failed to wait for machine ${machineId}: ${error.message}`);
+    }
+}
+/**
+ * Wait for health check to pass (with DNS propagation time)
+ * Tries internal Fly network first if available, then falls back to public URL
+ */
+async function waitForHealthy(url, appName, maxWaitMs = 90_000) {
+    const startTime = Date.now();
+    // Build list of URLs to try - internal first (faster, more reliable from inside Fly)
+    const urlsToTry = [];
+    // If running on Fly and app name provided, try internal network first
+    const isOnFly = !!process.env.FLY_APP_NAME;
+    if (isOnFly && appName) {
+        urlsToTry.push(`http://${appName}.internal:8080/health`);
+    }
+    // Always add the public URL as fallback
+    urlsToTry.push(`${url.replace(/\/$/, '')}/health`);
+    console.log(`[provisioner] Waiting for workspace to become healthy (trying: ${urlsToTry.join(', ')})...`);
+    while (Date.now() - startTime < maxWaitMs) {
+        // Try each URL in order
+        for (const healthUrl of urlsToTry) {
+            try {
+                const controller = new AbortController();
+                const timer = setTimeout(() => controller.abort(), 5_000);
+                const res = await fetch(healthUrl, {
+                    method: 'GET',
+                    signal: controller.signal,
+                });
+                clearTimeout(timer);
+                if (res.ok) {
+                    console.log(`[provisioner] Health check passed via ${healthUrl}`);
+                    return;
+                }
+                console.log(`[provisioner] Health check to ${healthUrl} returned ${res.status}`);
+            }
+            catch (error) {
+                const elapsed = Math.round((Date.now() - startTime) / 1000);
+                const errMsg = error.message;
+                // Only log detailed error for last URL attempt
+                if (healthUrl === urlsToTry[urlsToTry.length - 1]) {
+                    console.log(`[provisioner] Health check failed (${elapsed}s elapsed): ${errMsg}`);
+                }
+            }
+        }
+        await wait(3000);
+    }
+    // Don't throw - workspace is provisioned, health check is best-effort
+    console.warn(`[provisioner] Health check did not pass within ${maxWaitMs}ms, continuing anyway`);
+}
+// Resource tiers sized for Claude Code agents (~1-2GB RAM per agent)
+// cpuKind: 'shared' = cheaper but can be throttled, 'performance' = dedicated
 export const RESOURCE_TIERS = {
-    small: { name: 'small', cpuCores: 1, memoryMb: 512, maxAgents: 5 },
-    medium: { name: 'medium', cpuCores: 2, memoryMb: 1024, maxAgents: 10 },
-    large: { name: 'large', cpuCores: 4, memoryMb: 2048, maxAgents: 20 },
-    xlarge: { name: 'xlarge', cpuCores: 8, memoryMb: 4096, maxAgents: 50 },
+    small: { name: 'small', cpuCores: 2, memoryMb: 2048, maxAgents: 2, cpuKind: 'shared' },
+    medium: { name: 'medium', cpuCores: 2, memoryMb: 4096, maxAgents: 5, cpuKind: 'shared' },
+    large: { name: 'large', cpuCores: 4, memoryMb: 8192, maxAgents: 10, cpuKind: 'performance' },
+    xlarge: { name: 'xlarge', cpuCores: 8, memoryMb: 16384, maxAgents: 20, cpuKind: 'performance' },
 };
 /**
  * Fly.io provisioner
@@ -130,6 +251,8 @@ class FlyProvisioner {
     }
     async provision(workspace, credentials) {
         const appName = `ar-${workspace.id.substring(0, 8)}`;
+        // Stage: Creating workspace
+        updateProvisioningStage(workspace.id, 'creating');
         // Create Fly app
         await fetchWithRetry('https://api.machines.dev/v1/apps', {
             method: 'POST',
@@ -142,10 +265,82 @@ class FlyProvisioner {
                 org_slug: this.org,
             }),
         });
+        // Stage: Networking
+        updateProvisioningStage(workspace.id, 'networking');
+        // Allocate IPs for the app (required for public DNS)
+        // Must use GraphQL API - Machines REST API doesn't support IP allocation
+        // Shared IPv4 is free, IPv6 is free
+        console.log(`[fly] Allocating IPs for ${appName}...`);
+        const allocateIP = async (type) => {
+            try {
+                // Map our type to Fly GraphQL enum
+                const graphqlType = type === 'shared_v4' ? 'shared_v4' : 'v6';
+                const res = await fetchWithRetry('https://api.fly.io/graphql', {
+                    method: 'POST',
+                    headers: {
+                        Authorization: `Bearer ${this.apiToken}`,
+                        'Content-Type': 'application/json',
+                    },
+                    body: JSON.stringify({
+                        query: `
+              mutation AllocateIPAddress($input: AllocateIPAddressInput!) {
+                allocateIpAddress(input: $input) {
+                  ipAddress {
+                    id
+                    address
+                    type
+                  }
+                }
+              }
+            `,
+                        variables: {
+                            input: {
+                                appId: appName,
+                                type: graphqlType,
+                            },
+                        },
+                    }),
+                });
+                if (!res.ok) {
+                    const errorText = await res.text();
+                    console.warn(`[fly] Failed to allocate ${type}: ${res.status} ${errorText}`);
+                    return false;
+                }
+                const data = await res.json();
+                if (data.errors?.length) {
+                    // Ignore "already allocated" errors
+                    const alreadyAllocated = data.errors.some(e => e.message.includes('already') || e.message.includes('exists'));
+                    if (!alreadyAllocated) {
+                        console.warn(`[fly] GraphQL error allocating ${type}: ${data.errors[0].message}`);
+                        return false;
+                    }
+                    console.log(`[fly] IP ${type} already allocated`);
+                    return true;
+                }
+                const address = data.data?.allocateIpAddress?.ipAddress?.address;
+                console.log(`[fly] Allocated ${type}: ${address}`);
+                return true;
+            }
+            catch (err) {
+                console.warn(`[fly] Failed to allocate ${type}: ${err.message}`);
+                return false;
+            }
+        };
+        const [sharedV4Result, v6Result] = await Promise.all([
+            allocateIP('shared_v4'),
+            allocateIP('v6'),
+        ]);
+        console.log(`[fly] IP allocation results: shared_v4=${sharedV4Result}, v6=${v6Result}`);
+        // Stage: Secrets
+        updateProvisioningStage(workspace.id, 'secrets');
         // Set secrets (provider credentials)
         const secrets = {};
         for (const [provider, token] of credentials) {
             secrets[`${provider.toUpperCase()}_TOKEN`] = token;
+            // Also set GH_TOKEN for gh CLI compatibility
+            if (provider === 'github') {
+                secrets['GH_TOKEN'] = token;
+            }
         }
         if (Object.keys(secrets).length > 0) {
             await fetchWithRetry(`https://api.machines.dev/v1/apps/${appName}/secrets`, {
@@ -164,6 +359,8 @@ class FlyProvisioner {
         if (customHostname) {
             await this.allocateCertificate(appName, customHostname);
         }
+        // Stage: Machine
+        updateProvisioningStage(workspace.id, 'machine');
         // Create machine with auto-stop/start for cost optimization
         const machineResponse = await fetchWithRetry(`https://api.machines.dev/v1/apps/${appName}/machines`, {
             method: 'POST',
@@ -198,21 +395,49 @@ class FlyProvisioner {
                     services: [
                         {
                             ports: [
-                                { port: 443, handlers: ['tls', 'http'] },
+                                {
+                                    port: 443,
+                                    handlers: ['tls', 'http'],
+                                    // Force HTTP/1.1 to backend for WebSocket upgrade compatibility
+                                    // HTTP/2 doesn't support traditional WebSocket upgrade mechanism
+                                    http_options: {
+                                        h2_backend: false,
+                                    },
+                                },
                                 { port: 80, handlers: ['http'] },
                             ],
                             protocol: 'tcp',
                             internal_port: WORKSPACE_PORT,
-                            // Auto-stop after 5 minutes of inactivity
-                            auto_stop_machines: true,
+                            // Auto-stop after inactivity to reduce costs
+                            // Fly Proxy automatically wakes machines on incoming requests
+                            auto_stop_machines: 'stop', // stop (not suspend) for faster wake
                             auto_start_machines: true,
                             min_machines_running: 0,
+                            // Idle timeout before auto-stop (in seconds)
+                            // Longer timeout = better UX, shorter = lower costs
+                            concurrency: {
+                                type: 'requests',
+                                soft_limit: 25,
+                                hard_limit: 50,
+                            },
                         },
                     ],
+                    checks: {
+                        health: {
+                            type: 'http',
+                            port: WORKSPACE_PORT,
+                            path: '/health',
+                            interval: '30s',
+                            timeout: '5s',
+                            grace_period: '10s',
+                        },
+                    },
+                    // Start with small tier (shared CPUs) - scales up based on plan
+                    // Free tier uses shared CPUs for cost efficiency
                     guest: {
                         cpu_kind: 'shared',
-                        cpus: 1,
-                        memory_mb: 512,
+                        cpus: 2,
+                        memory_mb: 2048,
                     },
                 },
             }),
@@ -226,7 +451,19 @@ class FlyProvisioner {
         const publicUrl = customHostname
             ? `https://${customHostname}`
             : `https://${appName}.fly.dev`;
-        await softHealthCheck(publicUrl);
+        // Stage: Booting
+        updateProvisioningStage(workspace.id, 'booting');
+        // Wait for machine to be in started state
+        await waitForMachineStarted(this.apiToken, appName, machine.id);
+        // Stage: Health check
+        updateProvisioningStage(workspace.id, 'health');
+        // Wait for health check to pass (includes DNS propagation time)
+        // Pass appName to enable internal Fly network health checks
+        await waitForHealthy(publicUrl, appName);
+        // Stage: Complete
+        updateProvisioningStage(workspace.id, 'complete');
+        // Schedule cleanup of provisioning progress after 30s (gives frontend time to see 'complete')
+        scheduleProgressCleanup(workspace.id);
         return {
             computeId: machine.id,
             publicUrl,
@@ -313,7 +550,8 @@ class FlyProvisioner {
             body: JSON.stringify({
                 config: {
                     guest: {
-                        cpu_kind: tier.cpuCores <= 2 ? 'shared' : 'performance',
+                        // Use tier-specific CPU type (shared for cost, performance for power)
+                        cpu_kind: tier.cpuKind,
                         cpus: tier.cpuCores,
                         memory_mb: tier.memoryMb,
                     },
@@ -468,6 +706,10 @@ class RailwayProvisioner {
         };
         for (const [provider, token] of credentials) {
             envVars[`${provider.toUpperCase()}_TOKEN`] = token;
+            // Also set GH_TOKEN for gh CLI compatibility
+            if (provider === 'github') {
+                envVars['GH_TOKEN'] = token;
+            }
         }
         await fetchWithRetry('https://backboard.railway.app/graphql/v2', {
             method: 'POST',
@@ -682,6 +924,10 @@ class DockerProvisioner {
         ];
         for (const [provider, token] of credentials) {
             envArgs.push(`-e ${provider.toUpperCase()}_TOKEN=${token}`);
+            // Also set GH_TOKEN for gh CLI compatibility
+            if (provider === 'github') {
+                envArgs.push(`-e GH_TOKEN=${token}`);
+            }
         }
         // Run container
         const { execSync } = await import('child_process');
@@ -791,6 +1037,7 @@ export class WorkspaceProvisioner {
     }
     /**
      * Provision a new workspace (one-click)
+     * Returns immediately with 'provisioning' status and runs actual provisioning in background
      */
     async provision(config) {
         // Create workspace record
@@ -814,6 +1061,22 @@ export class WorkspaceProvisioner {
         });
         // Auto-accept the creator's membership
         await db.workspaceMembers.acceptInvite(workspace.id, config.userId);
+        // Initialize stage tracking immediately
+        updateProvisioningStage(workspace.id, 'creating');
+        // Run provisioning in the background so frontend can poll for stages
+        this.runProvisioningAsync(workspace, config).catch((error) => {
+            console.error(`[provisioner] Background provisioning failed for ${workspace.id}:`, error);
+        });
+        // Return immediately with 'provisioning' status
+        return {
+            workspaceId: workspace.id,
+            status: 'provisioning',
+        };
+    }
+    /**
+     * Run the actual provisioning work asynchronously
+     */
+    async runProvisioningAsync(workspace, config) {
         // Get credentials
         const credentials = new Map();
         for (const provider of config.providers) {
@@ -848,22 +1111,21 @@ export class WorkspaceProvisioner {
                 computeId,
                 publicUrl,
             });
-            return {
-                workspaceId: workspace.id,
-                status: 'running',
-                publicUrl,
-            };
+            // Schedule cleanup of provisioning progress after 30s (gives frontend time to see 'complete')
+            setTimeout(() => {
+                clearProvisioningProgress(workspace.id);
+                console.log(`[provisioner] Cleaned up provisioning progress for ${workspace.id.substring(0, 8)}`);
+            }, 30_000);
+            console.log(`[provisioner] Workspace ${workspace.id} provisioned successfully at ${publicUrl}`);
         }
         catch (error) {
             const errorMessage = error instanceof Error ? error.message : 'Unknown error';
             await db.workspaces.updateStatus(workspace.id, 'error', {
                 errorMessage,
             });
-            return {
-                workspaceId: workspace.id,
-                status: 'error',
-                error: errorMessage,
-            };
+            // Clear provisioning progress on error
+            clearProvisioningProgress(workspace.id);
+            console.error(`[provisioner] Workspace ${workspace.id} provisioning failed:`, errorMessage);
         }
     }
     /**
@@ -885,6 +1147,11 @@ export class WorkspaceProvisioner {
         if (!workspace) {
             throw new Error('Workspace not found');
         }
+        // During early provisioning, computeId isn't set yet
+        // Return the database status instead of querying the provider
+        if (!workspace.computeId && workspace.status === 'provisioning') {
+            return 'provisioning';
+        }
         const status = await this.provisioner.getStatus(workspace);
         // Update database if status changed
         if (status !== workspace.status) {
@@ -965,6 +1232,80 @@ export class WorkspaceProvisioner {
         const tierName = workspace.config.resourceTier || 'small';
         return RESOURCE_TIERS[tierName] || RESOURCE_TIERS.small;
     }
+    /**
+     * Get recommended tier based on agent count
+     * Uses 1.5-2GB per agent as baseline for Claude Code
+     */
+    getRecommendedTier(agentCount) {
+        // Find the smallest tier that supports this agent count
+        const tiers = Object.values(RESOURCE_TIERS).sort((a, b) => a.maxAgents - b.maxAgents);
+        for (const tier of tiers) {
+            if (tier.maxAgents >= agentCount) {
+                return tier;
+            }
+        }
+        // If agent count exceeds all tiers, return the largest
+        return RESOURCE_TIERS.xlarge;
+    }
+    /**
+     * Auto-scale workspace based on current agent count
+     * Respects plan limits - free tier cannot scale, others have max tier limits
+     * Returns { scaled: boolean, reason?: string }
+     */
+    async autoScale(workspaceId, currentAgentCount) {
+        const workspace = await db.workspaces.findById(workspaceId);
+        if (!workspace) {
+            throw new Error('Workspace not found');
+        }
+        // Get user's plan
+        const user = await db.users.findById(workspace.userId);
+        const plan = user?.plan || 'free';
+        // Check if plan allows auto-scaling
+        if (!canAutoScale(plan)) {
+            return {
+                scaled: false,
+                reason: 'Auto-scaling requires Pro plan or higher',
+            };
+        }
+        const currentTier = await this.getCurrentTier(workspaceId);
+        const recommendedTier = this.getRecommendedTier(currentAgentCount);
+        // Only scale UP, never down (to avoid disruption)
+        if (recommendedTier.memoryMb <= currentTier.memoryMb) {
+            return {
+                scaled: false,
+                currentTier: currentTier.name,
+            };
+        }
+        // Check if plan allows scaling to the recommended tier
+        if (!canScaleToTier(plan, recommendedTier.name)) {
+            // Find the max tier allowed for this plan
+            const maxTierName = getResourceTierForPlan(plan);
+            const maxTier = RESOURCE_TIERS[maxTierName];
+            if (maxTier.memoryMb <= currentTier.memoryMb) {
+                return {
+                    scaled: false,
+                    reason: `Already at max tier (${currentTier.name}) for ${plan} plan`,
+                    currentTier: currentTier.name,
+                };
+            }
+            // Scale to max allowed tier instead
+            console.log(`[provisioner] Auto-scaling workspace ${workspaceId.substring(0, 8)} from ${currentTier.name} to ${maxTierName} (max for ${plan} plan)`);
+            await this.resize(workspaceId, maxTier);
+            return {
+                scaled: true,
+                currentTier: currentTier.name,
+                targetTier: maxTierName,
+                reason: `Scaled to max tier for ${plan} plan`,
+            };
+        }
+        console.log(`[provisioner] Auto-scaling workspace ${workspaceId.substring(0, 8)} from ${currentTier.name} to ${recommendedTier.name} (${currentAgentCount} agents)`);
+        await this.resize(workspaceId, recommendedTier);
+        return {
+            scaled: true,
+            currentTier: currentTier.name,
+            targetTier: recommendedTier.name,
+        };
+    }
 }
 // Singleton instance
 let _provisioner = null;

package/dist/cloud/server.js

@@ -34,6 +34,7 @@ import { webhooksRouter } from './api/webhooks.js';
 import { githubAppRouter } from './api/github-app.js';
 import { nangoAuthRouter } from './api/nango-auth.js';
 import { gitRouter } from './api/git.js';
+import { codexAuthHelperRouter } from './api/codex-auth-helper.js';
 import { db } from './db/index.js';
 /**
  * Proxy a request to the user's primary running workspace
@@ -98,7 +99,9 @@ export async function createServer() {
         credentials: true,
     }));
     // Custom JSON parser that preserves raw body for webhook signature verification
+    // Increase limit to 10mb for base64 image uploads (screenshots)
     app.use(express.json({
+        limit: '10mb',
         verify: (req, _res, buf) => {
             // Store raw body for webhook signature verification
             req.rawBody = buf.toString();
@@ -168,10 +171,11 @@ export async function createServer() {
     });
     // Lightweight CSRF protection using session token
     const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
-    // Paths exempt from CSRF (webhooks from external services, workspace proxy)
+    // Paths exempt from CSRF (webhooks from external services, workspace proxy, local auth callbacks)
     const CSRF_EXEMPT_PATHS = [
         '/api/webhooks/',
         '/api/auth/nango/webhook',
+        '/api/auth/codex-helper/callback',
     ];
     // Additional pattern for workspace proxy routes (contains /proxy/)
     const isWorkspaceProxyRoute = (path) => /^\/api\/workspaces\/[^/]+\/proxy\//.test(path);
@@ -236,6 +240,7 @@ export async function createServer() {
     app.use('/api/webhooks', webhooksRouter);
     app.use('/api/github-app', githubAppRouter);
     app.use('/api/auth/nango', nangoAuthRouter);
+    app.use('/api/auth/codex-helper', codexAuthHelperRouter);
     app.use('/api/git', gitRouter);
     // Test helper routes (only available in non-production)
     if (process.env.NODE_ENV !== 'production') {

package/dist/cloud/services/nango.d.ts

@@ -33,6 +33,22 @@ declare class NangoService {
      * For API calls, use the proxy methods instead.
      */
     getGithubAppToken(connectionId: string): Promise<string>;
+    /**
+     * Retrieve the user's OAuth access token from a GitHub App OAuth connection.
+     * This is the user-level token (not the installation token).
+     * Use this for operations that require user context (e.g., gh CLI).
+     *
+     * The user token can be found in:
+     * 1. getToken() without installation flag
+     * 2. connection_config.access_token in github-app-oauth
+     * 3. Separate 'github' user connection
+     */
+    getGithubUserOAuthToken(connectionId: string): Promise<string>;
+    /**
+     * Retrieve the user's OAuth token from a 'github' user connection.
+     * This is for the separate GitHub OAuth login (not the App connection).
+     */
+    getGithubUserToken(connectionId: string): Promise<string>;
     /**
      * List repositories available to a GitHub App installation using the Nango Proxy.
      * The proxy automatically handles token injection and refresh.
@@ -114,6 +130,50 @@ declare class NangoService {
         };
         metadata?: Record<string, unknown>;
     }>;
+    /**
+     * Check if user has access to a specific GitHub repository.
+     * Uses the user's OAuth connection to query GitHub API.
+     * @param connectionId - User's Nango connection ID (github user OAuth)
+     * @param owner - Repository owner
+     * @param repo - Repository name
+     * @returns Access details or null if no access
+     */
+    checkUserRepoAccess(connectionId: string, owner: string, repo: string): Promise<{
+        hasAccess: boolean;
+        permission?: 'admin' | 'write' | 'read' | 'none';
+        repository?: {
+            id: number;
+            fullName: string;
+            isPrivate: boolean;
+            defaultBranch: string;
+        };
+    }>;
+    /**
+     * List all repositories the user has access to via their OAuth connection.
+     * Uses the user's personal OAuth token (not the GitHub App).
+     * @param connectionId - User's Nango connection ID (github user OAuth)
+     * @param options - Pagination and filter options
+     * @returns List of accessible repositories
+     */
+    listUserAccessibleRepos(connectionId: string, options?: {
+        page?: number;
+        perPage?: number;
+        type?: 'all' | 'owner' | 'public' | 'private' | 'member';
+        sort?: 'created' | 'updated' | 'pushed' | 'full_name';
+    }): Promise<{
+        repositories: Array<{
+            id: number;
+            fullName: string;
+            isPrivate: boolean;
+            defaultBranch: string;
+            permissions: {
+                admin: boolean;
+                push: boolean;
+                pull: boolean;
+            };
+        }>;
+        hasMore: boolean;
+    }>;
     /**
      * Verify webhook signature sent by Nango.
      * Uses the new verifyIncomingWebhookRequest method.