agent-relay 1.2.0 → 1.3.0

package/dist/cloud/api/coordinators.js

@@ -20,6 +20,408 @@ const coordinatorWriteRoutes = [
 coordinatorWriteRoutes.forEach(route => {
     coordinatorsRouter.use(route, checkCoordinatorAccess);
 });
+// ============================================================================
+// Project Group CRUD Routes
+// These must come BEFORE the /:groupId/coordinator routes
+// ============================================================================
+/**
+ * GET /api/project-groups
+ * List all project groups for the authenticated user
+ */
+coordinatorsRouter.get('/', async (req, res) => {
+    const userId = req.session.userId;
+    try {
+        const result = await db.projectGroups.findAllWithRepositories(userId);
+        res.json({
+            groups: result.groups.map(group => ({
+                id: group.id,
+                name: group.name,
+                description: group.description,
+                color: group.color,
+                icon: group.icon,
+                coordinatorAgent: group.coordinatorAgent,
+                sortOrder: group.sortOrder,
+                repositoryCount: group.repositories.length,
+                repositories: group.repositories.map(repo => ({
+                    id: repo.id,
+                    githubFullName: repo.githubFullName,
+                    defaultBranch: repo.defaultBranch,
+                    isPrivate: repo.isPrivate,
+                })),
+                createdAt: group.createdAt,
+                updatedAt: group.updatedAt,
+            })),
+            ungroupedRepositories: result.ungroupedRepositories.map(repo => ({
+                id: repo.id,
+                githubFullName: repo.githubFullName,
+                defaultBranch: repo.defaultBranch,
+                isPrivate: repo.isPrivate,
+                workspaceId: repo.workspaceId,
+            })),
+        });
+    }
+    catch (error) {
+        console.error('Error listing project groups:', error);
+        res.status(500).json({ error: 'Failed to list project groups' });
+    }
+});
+/**
+ * POST /api/project-groups
+ * Create a new project group
+ */
+coordinatorsRouter.post('/', async (req, res) => {
+    const userId = req.session.userId;
+    const { name, description, color, icon, repositoryIds } = req.body;
+    if (!name || typeof name !== 'string' || name.trim().length === 0) {
+        return res.status(400).json({ error: 'Name is required' });
+    }
+    if (name.length > 255) {
+        return res.status(400).json({ error: 'Name must be 255 characters or less' });
+    }
+    try {
+        // Check for duplicate name
+        const existing = await db.projectGroups.findByName(userId, name.trim());
+        if (existing) {
+            return res.status(409).json({ error: 'A project group with this name already exists' });
+        }
+        // Create the group
+        const group = await db.projectGroups.create({
+            userId,
+            name: name.trim(),
+            description: description?.trim() || null,
+            color: color || null,
+            icon: icon || null,
+            coordinatorAgent: { enabled: false },
+            sortOrder: 0,
+        });
+        // Assign repositories to the group if provided
+        if (repositoryIds && Array.isArray(repositoryIds) && repositoryIds.length > 0) {
+            // Verify all repositories belong to the user
+            const userRepos = await db.repositories.findByUserId(userId);
+            const userRepoIds = new Set(userRepos.map(r => r.id));
+            for (const repoId of repositoryIds) {
+                if (!userRepoIds.has(repoId)) {
+                    return res.status(400).json({
+                        error: `Repository ${repoId} not found or not owned by user`,
+                    });
+                }
+            }
+            // Assign repositories to the group
+            for (const repoId of repositoryIds) {
+                await db.repositories.assignToGroup(repoId, group.id);
+            }
+        }
+        // Fetch the group with repositories for response
+        const groupWithRepos = await db.projectGroups.findWithRepositories(group.id);
+        res.status(201).json({
+            success: true,
+            group: {
+                id: groupWithRepos.id,
+                name: groupWithRepos.name,
+                description: groupWithRepos.description,
+                color: groupWithRepos.color,
+                icon: groupWithRepos.icon,
+                coordinatorAgent: groupWithRepos.coordinatorAgent,
+                repositories: groupWithRepos.repositories.map(repo => ({
+                    id: repo.id,
+                    githubFullName: repo.githubFullName,
+                    defaultBranch: repo.defaultBranch,
+                    isPrivate: repo.isPrivate,
+                })),
+                createdAt: groupWithRepos.createdAt,
+                updatedAt: groupWithRepos.updatedAt,
+            },
+        });
+    }
+    catch (error) {
+        console.error('Error creating project group:', error);
+        res.status(500).json({ error: 'Failed to create project group' });
+    }
+});
+/**
+ * GET /api/project-groups/:id
+ * Get a specific project group with its repositories
+ */
+coordinatorsRouter.get('/:id', async (req, res) => {
+    const userId = req.session.userId;
+    const { id } = req.params;
+    // Skip if this looks like a coordinator route
+    if (id === 'coordinators') {
+        return res.status(404).json({ error: 'Not found' });
+    }
+    try {
+        const group = await db.projectGroups.findWithRepositories(id);
+        if (!group) {
+            return res.status(404).json({ error: 'Project group not found' });
+        }
+        if (group.userId !== userId) {
+            return res.status(403).json({ error: 'Unauthorized' });
+        }
+        res.json({
+            id: group.id,
+            name: group.name,
+            description: group.description,
+            color: group.color,
+            icon: group.icon,
+            coordinatorAgent: group.coordinatorAgent,
+            sortOrder: group.sortOrder,
+            repositories: group.repositories.map(repo => ({
+                id: repo.id,
+                githubFullName: repo.githubFullName,
+                defaultBranch: repo.defaultBranch,
+                isPrivate: repo.isPrivate,
+                syncStatus: repo.syncStatus,
+                lastSyncedAt: repo.lastSyncedAt,
+                workspaceId: repo.workspaceId,
+            })),
+            createdAt: group.createdAt,
+            updatedAt: group.updatedAt,
+        });
+    }
+    catch (error) {
+        console.error('Error getting project group:', error);
+        res.status(500).json({ error: 'Failed to get project group' });
+    }
+});
+/**
+ * PATCH /api/project-groups/:id
+ * Update a project group's metadata
+ */
+coordinatorsRouter.patch('/:id', async (req, res) => {
+    const userId = req.session.userId;
+    const { id } = req.params;
+    const { name, description, color, icon } = req.body;
+    try {
+        const group = await db.projectGroups.findById(id);
+        if (!group) {
+            return res.status(404).json({ error: 'Project group not found' });
+        }
+        if (group.userId !== userId) {
+            return res.status(403).json({ error: 'Unauthorized' });
+        }
+        // Build update object with only provided fields
+        const updates = {};
+        if (name !== undefined) {
+            if (typeof name !== 'string' || name.trim().length === 0) {
+                return res.status(400).json({ error: 'Name cannot be empty' });
+            }
+            if (name.length > 255) {
+                return res.status(400).json({ error: 'Name must be 255 characters or less' });
+            }
+            // Check for duplicate name (excluding current group)
+            const existing = await db.projectGroups.findByName(userId, name.trim());
+            if (existing && existing.id !== id) {
+                return res.status(409).json({ error: 'A project group with this name already exists' });
+            }
+            updates.name = name.trim();
+        }
+        if (description !== undefined) {
+            updates.description = description?.trim() || null;
+        }
+        if (color !== undefined) {
+            // Validate hex color format if provided
+            if (color && !/^#[0-9A-Fa-f]{6}$/.test(color)) {
+                return res.status(400).json({ error: 'Color must be a valid hex color (e.g., #3B82F6)' });
+            }
+            updates.color = color || null;
+        }
+        if (icon !== undefined) {
+            updates.icon = icon || null;
+        }
+        if (Object.keys(updates).length === 0) {
+            return res.status(400).json({ error: 'No valid fields to update' });
+        }
+        await db.projectGroups.update(id, updates);
+        // Fetch updated group
+        const updatedGroup = await db.projectGroups.findWithRepositories(id);
+        res.json({
+            success: true,
+            group: {
+                id: updatedGroup.id,
+                name: updatedGroup.name,
+                description: updatedGroup.description,
+                color: updatedGroup.color,
+                icon: updatedGroup.icon,
+                coordinatorAgent: updatedGroup.coordinatorAgent,
+                repositories: updatedGroup.repositories.map(repo => ({
+                    id: repo.id,
+                    githubFullName: repo.githubFullName,
+                    defaultBranch: repo.defaultBranch,
+                    isPrivate: repo.isPrivate,
+                })),
+                updatedAt: updatedGroup.updatedAt,
+            },
+        });
+    }
+    catch (error) {
+        console.error('Error updating project group:', error);
+        res.status(500).json({ error: 'Failed to update project group' });
+    }
+});
+/**
+ * DELETE /api/project-groups/:id
+ * Delete a project group (repositories are unassigned, not deleted)
+ */
+coordinatorsRouter.delete('/:id', async (req, res) => {
+    const userId = req.session.userId;
+    const { id } = req.params;
+    try {
+        const group = await db.projectGroups.findById(id);
+        if (!group) {
+            return res.status(404).json({ error: 'Project group not found' });
+        }
+        if (group.userId !== userId) {
+            return res.status(403).json({ error: 'Unauthorized' });
+        }
+        // Stop coordinator if running
+        if (group.coordinatorAgent?.enabled) {
+            try {
+                const coordinatorService = getCoordinatorService();
+                await coordinatorService.stop(id);
+            }
+            catch (err) {
+                console.warn('Error stopping coordinator during group deletion:', err);
+            }
+        }
+        // Delete the group (repositories will have projectGroupId set to null due to ON DELETE SET NULL)
+        await db.projectGroups.delete(id);
+        res.json({
+            success: true,
+            message: 'Project group deleted',
+        });
+    }
+    catch (error) {
+        console.error('Error deleting project group:', error);
+        res.status(500).json({ error: 'Failed to delete project group' });
+    }
+});
+/**
+ * POST /api/project-groups/:id/repositories
+ * Add repositories to a project group
+ */
+coordinatorsRouter.post('/:id/repositories', async (req, res) => {
+    const userId = req.session.userId;
+    const { id } = req.params;
+    const { repositoryIds } = req.body;
+    if (!repositoryIds || !Array.isArray(repositoryIds) || repositoryIds.length === 0) {
+        return res.status(400).json({ error: 'repositoryIds array is required' });
+    }
+    try {
+        const group = await db.projectGroups.findById(id);
+        if (!group) {
+            return res.status(404).json({ error: 'Project group not found' });
+        }
+        if (group.userId !== userId) {
+            return res.status(403).json({ error: 'Unauthorized' });
+        }
+        // Verify all repositories belong to the user
+        const userRepos = await db.repositories.findByUserId(userId);
+        const userRepoIds = new Set(userRepos.map(r => r.id));
+        for (const repoId of repositoryIds) {
+            if (!userRepoIds.has(repoId)) {
+                return res.status(400).json({
+                    error: `Repository ${repoId} not found or not owned by user`,
+                });
+            }
+        }
+        // Assign repositories to the group
+        for (const repoId of repositoryIds) {
+            await db.repositories.assignToGroup(repoId, id);
+        }
+        // Fetch updated group
+        const updatedGroup = await db.projectGroups.findWithRepositories(id);
+        res.json({
+            success: true,
+            group: {
+                id: updatedGroup.id,
+                name: updatedGroup.name,
+                repositories: updatedGroup.repositories.map(repo => ({
+                    id: repo.id,
+                    githubFullName: repo.githubFullName,
+                    defaultBranch: repo.defaultBranch,
+                    isPrivate: repo.isPrivate,
+                })),
+            },
+        });
+    }
+    catch (error) {
+        console.error('Error adding repositories to group:', error);
+        res.status(500).json({ error: 'Failed to add repositories to group' });
+    }
+});
+/**
+ * DELETE /api/project-groups/:id/repositories/:repoId
+ * Remove a repository from a project group
+ */
+coordinatorsRouter.delete('/:id/repositories/:repoId', async (req, res) => {
+    const userId = req.session.userId;
+    const { id, repoId } = req.params;
+    try {
+        const group = await db.projectGroups.findById(id);
+        if (!group) {
+            return res.status(404).json({ error: 'Project group not found' });
+        }
+        if (group.userId !== userId) {
+            return res.status(403).json({ error: 'Unauthorized' });
+        }
+        // Verify repository exists and belongs to this group
+        const repo = await db.repositories.findById(repoId);
+        if (!repo) {
+            return res.status(404).json({ error: 'Repository not found' });
+        }
+        if (repo.userId !== userId) {
+            return res.status(403).json({ error: 'Unauthorized' });
+        }
+        if (repo.projectGroupId !== id) {
+            return res.status(400).json({ error: 'Repository is not in this group' });
+        }
+        // Remove repository from group (set projectGroupId to null)
+        await db.repositories.assignToGroup(repoId, null);
+        res.json({
+            success: true,
+            message: 'Repository removed from group',
+        });
+    }
+    catch (error) {
+        console.error('Error removing repository from group:', error);
+        res.status(500).json({ error: 'Failed to remove repository from group' });
+    }
+});
+/**
+ * PUT /api/project-groups/reorder
+ * Reorder project groups
+ */
+coordinatorsRouter.put('/reorder', async (req, res) => {
+    const userId = req.session.userId;
+    const { orderedIds } = req.body;
+    if (!orderedIds || !Array.isArray(orderedIds)) {
+        return res.status(400).json({ error: 'orderedIds array is required' });
+    }
+    try {
+        // Verify all groups belong to user
+        const userGroups = await db.projectGroups.findByUserId(userId);
+        const userGroupIds = new Set(userGroups.map(g => g.id));
+        for (const groupId of orderedIds) {
+            if (!userGroupIds.has(groupId)) {
+                return res.status(400).json({
+                    error: `Group ${groupId} not found or not owned by user`,
+                });
+            }
+        }
+        await db.projectGroups.reorder(userId, orderedIds);
+        res.json({
+            success: true,
+            message: 'Groups reordered',
+        });
+    }
+    catch (error) {
+        console.error('Error reordering project groups:', error);
+        res.status(500).json({ error: 'Failed to reorder project groups' });
+    }
+});
+// ============================================================================
+// Coordinator Agent Routes
+// ============================================================================
 /**
  * GET /api/project-groups/:groupId/coordinator
  * Get coordinator agent configuration

package/dist/cloud/api/daemons.js

@@ -12,7 +12,6 @@ import { Router } from 'express';
 import { randomBytes, createHash } from 'crypto';
 import { requireAuth } from './auth.js';
 import { db } from '../db/index.js';
-import { vault } from '../vault/index.js';
 export const daemonsRouter = Router();
 /**
  * Generate a secure API key
@@ -201,21 +200,26 @@ daemonsRouter.post('/heartbeat', requireDaemonAuth, async (req, res) => {
 });
 /**
  * GET /api/daemons/credentials
- * Get credentials for the daemon's user (syncs cloud credentials to local)
+ * Get credentials for the daemon's user
+ *
+ * Note: Tokens are no longer stored centrally. CLI tools authenticate directly
+ * on workspace/local instances. This endpoint returns connected provider info only.
  */
 daemonsRouter.get('/credentials', requireDaemonAuth, async (req, res) => {
     const daemon = req.daemon;
     try {
-        // Get all decrypted credentials for the user via vault
-        const credentialsMap = await vault.getUserCredentials(daemon.userId);
-        // Convert Map to array format for API response
-        const credentials = Array.from(credentialsMap.entries()).map(([provider, cred]) => ({
-            provider,
-            accessToken: cred.accessToken,
-            tokenType: 'bearer',
-            expiresAt: cred.tokenExpiresAt,
+        // Get connected providers for this user (no tokens stored centrally)
+        const credentials = await db.credentials.findByUserId(daemon.userId);
+        // Return provider info without tokens
+        const providers = credentials.map((cred) => ({
+            provider: cred.provider,
+            providerAccountEmail: cred.providerAccountEmail,
+            connectedAt: cred.createdAt,
         }));
-        res.json({ credentials });
+        res.json({
+            providers,
+            note: 'Tokens are authenticated locally on workspace instances via CLI.',
+        });
     }
     catch (error) {
         console.error('Error fetching credentials:', error);

package/dist/cloud/api/git.js

@@ -23,20 +23,34 @@ function generateExpectedToken(workspaceId) {
 /**
  * Verify workspace access token
  * Workspaces authenticate with a secret passed at provisioning time
+ *
+ * Returns:
+ * - { valid: true } if token matches
+ * - { valid: false, reason: string } if token is invalid or missing
  */
 function verifyWorkspaceToken(req, workspaceId) {
     const authHeader = req.get('authorization');
-    if (!authHeader?.startsWith('Bearer ')) {
-        return false;
+    if (!authHeader) {
+        return { valid: false, reason: 'No Authorization header. WORKSPACE_TOKEN may not be set in the container.' };
+    }
+    if (!authHeader.startsWith('Bearer ')) {
+        return { valid: false, reason: 'Invalid Authorization header format. Expected: Bearer <token>' };
     }
     const providedToken = authHeader.slice(7);
+    if (!providedToken) {
+        return { valid: false, reason: 'Empty bearer token provided.' };
+    }
     const expectedToken = generateExpectedToken(workspaceId);
     // Use timing-safe comparison to prevent timing attacks
     try {
-        return crypto.timingSafeEqual(Buffer.from(providedToken), Buffer.from(expectedToken));
+        const isValid = crypto.timingSafeEqual(Buffer.from(providedToken), Buffer.from(expectedToken));
+        if (!isValid) {
+            return { valid: false, reason: 'Token mismatch. Workspace may need reprovisioning or SESSION_SECRET changed.' };
+        }
+        return { valid: true };
     }
     catch {
-        return false;
+        return { valid: false, reason: 'Token comparison failed (length mismatch). Workspace may need reprovisioning.' };
     }
 }
 /**
@@ -57,38 +71,103 @@ gitRouter.get('/token', async (req, res) => {
         return res.status(400).json({ error: 'workspaceId is required' });
     }
     // Verify the request is from a valid workspace
-    if (!verifyWorkspaceToken(req, workspaceId)) {
-        return res.status(401).json({ error: 'Invalid workspace token' });
+    const tokenVerification = verifyWorkspaceToken(req, workspaceId);
+    if (!tokenVerification.valid) {
+        console.warn(`[git] Token verification failed for workspace ${workspaceId.substring(0, 8)}: ${tokenVerification.reason}`);
+        return res.status(401).json({
+            error: 'Invalid workspace token',
+            code: 'INVALID_WORKSPACE_TOKEN',
+            hint: tokenVerification.reason,
+        });
     }
     try {
         // Get workspace to find the user
         const workspace = await db.workspaces.findById(workspaceId);
         if (!workspace) {
-            return res.status(404).json({ error: 'Workspace not found' });
+            console.warn(`[git] Workspace not found: ${workspaceId}`);
+            return res.status(404).json({
+                error: 'Workspace not found',
+                code: 'WORKSPACE_NOT_FOUND',
+                hint: 'The workspace may have been deleted. Try reprovisioning.',
+            });
         }
         const userId = workspace.userId;
+        console.log(`[git] Token request for workspace ${workspaceId.substring(0, 8)}, user ${userId.substring(0, 8)}`);
         // Find a repository with a Nango connection for this user
         const repos = await db.repositories.findByUserId(userId);
         const repoWithConnection = repos.find(r => r.nangoConnectionId);
         if (!repoWithConnection?.nangoConnectionId) {
+            console.warn(`[git] No Nango connection found for user ${userId.substring(0, 8)}. Repos: ${repos.length}, with connections: ${repos.filter(r => r.nangoConnectionId).length}`);
             return res.status(404).json({
                 error: 'No GitHub App connection found',
-                hint: 'Connect a repository via the GitHub App to enable git operations',
+                code: 'NO_GITHUB_APP_CONNECTION',
+                hint: 'Install the GitHub App on your repositories at https://github.com/apps/agent-relay',
+                repoCount: repos.length,
             });
         }
-        // Get fresh token from Nango (auto-refreshes if needed)
-        const token = await nangoService.getGithubAppToken(repoWithConnection.nangoConnectionId);
+        console.log(`[git] Fetching token from Nango for connection ${repoWithConnection.nangoConnectionId.substring(0, 8)}...`);
+        // Get fresh tokens from Nango (auto-refreshes if needed)
+        // - installationToken: for git operations (clone, push, pull)
+        // - userToken: for gh CLI operations (requires user context)
+        let installationToken;
+        try {
+            installationToken = await nangoService.getGithubAppToken(repoWithConnection.nangoConnectionId);
+        }
+        catch (nangoError) {
+            const errorMessage = nangoError instanceof Error ? nangoError.message : 'Unknown error';
+            console.error(`[git] Nango token fetch failed for connection ${repoWithConnection.nangoConnectionId}:`, errorMessage);
+            // Provide specific hints based on error type
+            if (errorMessage.includes('not found') || errorMessage.includes('404')) {
+                return res.status(500).json({
+                    error: 'GitHub App connection expired or revoked',
+                    code: 'NANGO_CONNECTION_EXPIRED',
+                    hint: 'Reconnect your GitHub App at https://github.com/apps/agent-relay',
+                    details: errorMessage,
+                });
+            }
+            return res.status(500).json({
+                error: 'Failed to fetch GitHub token from Nango',
+                code: 'NANGO_TOKEN_FETCH_FAILED',
+                hint: 'This may be a temporary issue. Try again in a few seconds.',
+                details: errorMessage,
+            });
+        }
+        // Try to get user OAuth token from github-app-oauth connection_config first
+        // Fall back to separate 'github' user connection if available
+        let userToken = null;
+        try {
+            userToken = await nangoService.getGithubUserOAuthToken(repoWithConnection.nangoConnectionId);
+        }
+        catch {
+            // Try the separate github user connection if available
+            const userRepo = repos.find(r => r.nangoConnectionId && r.nangoConnectionId !== repoWithConnection.nangoConnectionId);
+            if (userRepo?.nangoConnectionId) {
+                try {
+                    userToken = await nangoService.getGithubUserToken(userRepo.nangoConnectionId);
+                }
+                catch {
+                    console.log('[git] No github user token available');
+                }
+            }
+        }
         // GitHub App installation tokens expire after 1 hour
         const expiresAt = new Date(Date.now() + 55 * 60 * 1000).toISOString(); // 55 min buffer
+        console.log(`[git] Token fetched successfully for workspace ${workspaceId.substring(0, 8)}`);
         res.json({
-            token,
+            token: installationToken,
+            userToken, // For gh CLI - may be null if not available
             expiresAt,
             username: 'x-access-token', // GitHub App tokens use this as username
         });
     }
     catch (error) {
-        console.error('[git] Error getting token:', error);
-        res.status(500).json({ error: 'Failed to get GitHub token' });
+        const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+        console.error('[git] Unexpected error getting token:', error);
+        res.status(500).json({
+            error: 'Failed to get GitHub token',
+            code: 'UNEXPECTED_ERROR',
+            details: errorMessage,
+        });
     }
 });
 /**
@@ -100,22 +179,46 @@ gitRouter.post('/token', async (req, res) => {
     if (!workspaceId || typeof workspaceId !== 'string') {
         return res.status(400).json({ error: 'workspaceId is required' });
     }
-    if (!verifyWorkspaceToken(req, workspaceId)) {
-        return res.status(401).json({ error: 'Invalid workspace token' });
+    const tokenVerification = verifyWorkspaceToken(req, workspaceId);
+    if (!tokenVerification.valid) {
+        console.warn(`[git] POST: Token verification failed for workspace ${workspaceId.substring(0, 8)}: ${tokenVerification.reason}`);
+        return res.status(401).json({
+            error: 'Invalid workspace token',
+            code: 'INVALID_WORKSPACE_TOKEN',
+            hint: tokenVerification.reason,
+        });
     }
     try {
         const workspace = await db.workspaces.findById(workspaceId);
         if (!workspace) {
-            return res.status(404).json({ error: 'Workspace not found' });
+            console.warn(`[git] POST: Workspace not found: ${workspaceId}`);
+            return res.status(404).json({
+                error: 'Workspace not found',
+                code: 'WORKSPACE_NOT_FOUND',
+            });
         }
         const repos = await db.repositories.findByUserId(workspace.userId);
         const repoWithConnection = repos.find(r => r.nangoConnectionId);
         if (!repoWithConnection?.nangoConnectionId) {
+            console.warn(`[git] POST: No Nango connection for user ${workspace.userId.substring(0, 8)}`);
             return res.status(404).json({
                 error: 'No GitHub App connection found',
+                code: 'NO_GITHUB_APP_CONNECTION',
+            });
+        }
+        let token;
+        try {
+            token = await nangoService.getGithubAppToken(repoWithConnection.nangoConnectionId);
+        }
+        catch (nangoError) {
+            const errorMessage = nangoError instanceof Error ? nangoError.message : 'Unknown error';
+            console.error(`[git] POST: Nango token fetch failed:`, errorMessage);
+            return res.status(500).json({
+                error: 'Failed to fetch GitHub token',
+                code: 'NANGO_TOKEN_FETCH_FAILED',
+                details: errorMessage,
             });
         }
-        const token = await nangoService.getGithubAppToken(repoWithConnection.nangoConnectionId);
         const expiresAt = new Date(Date.now() + 55 * 60 * 1000).toISOString();
         res.json({
             token,
@@ -124,8 +227,13 @@ gitRouter.post('/token', async (req, res) => {
         });
     }
     catch (error) {
-        console.error('[git] Error getting token:', error);
-        res.status(500).json({ error: 'Failed to get GitHub token' });
+        const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+        console.error('[git] POST: Unexpected error:', error);
+        res.status(500).json({
+            error: 'Failed to get GitHub token',
+            code: 'UNEXPECTED_ERROR',
+            details: errorMessage,
+        });
     }
 });
 //# sourceMappingURL=git.js.map