agent-relay 1.2.0 → 1.3.0

package/dist/cloud/api/onboarding.js

@@ -13,7 +13,6 @@ import { Router } from 'express';
 import * as crypto from 'crypto';
 import { requireAuth } from './auth.js';
 import { db } from '../db/index.js';
-import { vault } from '../vault/index.js';
 // Import for local use
 import { CLI_AUTH_CONFIG, runCLIAuthViaPTY, stripAnsiCodes, matchesSuccessPattern, findMatchingPrompt, validateProviderConfig, validateAllProviderConfigs, getSupportedProviders, } from './cli-pty-runner.js';
 // Re-export from shared module for backward compatibility
@@ -56,9 +55,12 @@ onboardingRouter.post('/cli/:provider/start', async (req, res) => {
     console.log('[onboarding] Route handler entered! provider:', req.params.provider);
     const { provider } = req.params;
     const userId = req.session.userId;
-    const { workspaceId, useDeviceFlow } = req.body; // Optional: specific workspace, device flow option
-    console.log('[onboarding] userId:', userId, 'workspaceId:', workspaceId, 'useDeviceFlow:', useDeviceFlow);
+    const { workspaceId, useDeviceFlow: requestedDeviceFlow } = req.body; // Optional: specific workspace, device flow option
+    // Device flow is only used if explicitly requested by the client
+    // Standard flow: user runs `codex-auth` CLI locally to capture OAuth callback and forward to cloud
     const config = CLI_AUTH_CONFIG[provider];
+    const useDeviceFlow = requestedDeviceFlow ?? false;
+    console.log('[onboarding] userId:', userId, 'workspaceId:', workspaceId, 'useDeviceFlow:', useDeviceFlow);
     if (!config) {
         return res.status(400).json({
             error: 'Provider not supported for CLI auth',
@@ -95,12 +97,25 @@ onboardingRouter.post('/cli/:provider/start', async (req, res) => {
         // Forward auth request to workspace daemon
         // When running in Docker, localhost refers to the container, not the host
         // Use host.docker.internal on Mac/Windows to reach the host machine
+        // When running on Fly.io, use internal networking (.internal) instead of public DNS
         let workspaceUrl = workspace.publicUrl.replace(/\/$/, '');
+        // Detect Fly.io by checking FLY_APP_NAME env var
+        const isOnFly = !!process.env.FLY_APP_NAME;
         // Detect Docker by checking for /.dockerenv file or RUNNING_IN_DOCKER env var
         const isInDocker = process.env.RUNNING_IN_DOCKER === 'true' ||
             await import('fs').then(fs => fs.existsSync('/.dockerenv')).catch(() => false);
-        console.log('[onboarding] isInDocker:', isInDocker, 'RUNNING_IN_DOCKER:', process.env.RUNNING_IN_DOCKER);
-        if (isInDocker && workspaceUrl.includes('localhost')) {
+        console.log('[onboarding] isOnFly:', isOnFly, 'isInDocker:', isInDocker);
+        if (isOnFly && workspaceUrl.includes('.fly.dev')) {
+            // Use Fly.io internal networking for server-to-server communication
+            // ar-583f273b.fly.dev -> http://ar-583f273b.internal:3888
+            // .internal uses IPv6 and works by default for apps in the same org
+            const appName = workspaceUrl.match(/https?:\/\/([^.]+)\.fly\.dev/)?.[1];
+            if (appName) {
+                workspaceUrl = `http://${appName}.internal:3888`;
+                console.log('[onboarding] Using Fly internal network:', workspaceUrl);
+            }
+        }
+        else if (isInDocker && workspaceUrl.includes('localhost')) {
             workspaceUrl = workspaceUrl.replace('localhost', 'host.docker.internal');
             console.log('[onboarding] Translated localhost to host.docker.internal');
         }
@@ -140,6 +155,7 @@ onboardingRouter.post('/cli/:provider/start', async (req, res) => {
             status: session.status,
             authUrl: session.authUrl,
             workspaceId: workspace.id,
+            useDeviceFlow, // Tell dashboard whether device flow is being used (no CLI helper needed)
             message: session.authUrl ? 'Open the auth URL to complete login' : 'Auth session starting, poll for status',
         });
     }
@@ -172,6 +188,8 @@ onboardingRouter.get('/cli/:provider/status/:sessionId', async (req, res) => {
                 session.status = workspaceStatus.status || session.status;
                 session.authUrl = workspaceStatus.authUrl || session.authUrl;
                 session.error = workspaceStatus.error;
+                session.errorHint = workspaceStatus.errorHint;
+                session.recoverable = workspaceStatus.recoverable;
             }
         }
         catch (err) {
@@ -182,6 +200,8 @@ onboardingRouter.get('/cli/:provider/status/:sessionId', async (req, res) => {
         status: session.status,
         authUrl: session.authUrl,
         error: session.error,
+        errorHint: session.errorHint,
+        recoverable: session.recoverable,
     });
 });
 /**
@@ -207,7 +227,7 @@ onboardingRouter.post('/cli/:provider/complete/:sessionId', async (req, res) =>
     try {
         let accessToken = token || session.token;
         let refreshToken = session.refreshToken;
-        let tokenExpiresAt = session.tokenExpiresAt;
+        let _tokenExpiresAt = session.tokenExpiresAt;
         // If using workspace delegation, forward complete request first
         if (session.workspaceUrl && session.workspaceSessionId) {
             // Forward authCode to workspace if provided (for Codex-style redirects)
@@ -228,25 +248,52 @@ onboardingRouter.post('/cli/:provider/complete/:sessionId', async (req, res) =>
                 }
                 session.status = 'success';
             }
-            // Fetch credentials from workspace
+            // Fetch credentials from workspace with retry
+            // Credentials may not be immediately available after OAuth completes
             if (!accessToken) {
-                try {
-                    const credsResponse = await fetch(`${session.workspaceUrl}/auth/cli/${provider}/creds/${session.workspaceSessionId}`);
-                    if (credsResponse.ok) {
-                        const creds = await credsResponse.json();
-                        accessToken = creds.token;
-                        refreshToken = creds.refreshToken;
-                        if (creds.expiresAt) {
-                            tokenExpiresAt = new Date(creds.expiresAt);
+                const MAX_CREDS_RETRIES = 5;
+                const CREDS_RETRY_DELAY = 1000; // 1 second between retries
+                for (let attempt = 1; attempt <= MAX_CREDS_RETRIES; attempt++) {
+                    try {
+                        console.log(`[onboarding] Fetching credentials from workspace (attempt ${attempt}/${MAX_CREDS_RETRIES})`);
+                        const credsResponse = await fetch(`${session.workspaceUrl}/auth/cli/${provider}/creds/${session.workspaceSessionId}`);
+                        if (credsResponse.ok) {
+                            const creds = await credsResponse.json();
+                            accessToken = creds.token;
+                            refreshToken = creds.refreshToken;
+                            if (creds.tokenExpiresAt) {
+                                _tokenExpiresAt = new Date(creds.tokenExpiresAt);
+                            }
+                            console.log('[onboarding] Fetched credentials from workspace:', {
+                                hasToken: !!accessToken,
+                                hasRefreshToken: !!refreshToken,
+                                attempt,
+                            });
+                            break; // Success, exit retry loop
+                        }
+                        // Check if it's an error state (not just "not ready yet")
+                        const errorBody = await credsResponse.json().catch(() => ({}));
+                        if (errorBody.status === 'error') {
+                            // Auth failed, don't retry
+                            console.error('[onboarding] Auth failed in workspace:', errorBody);
+                            return res.status(400).json({
+                                error: errorBody.error || 'Authentication failed',
+                                errorHint: errorBody.errorHint,
+                                recoverable: errorBody.recoverable,
+                            });
+                        }
+                        // If not ready yet and we have more retries, wait and try again
+                        if (attempt < MAX_CREDS_RETRIES) {
+                            console.log(`[onboarding] Credentials not ready yet, retrying in ${CREDS_RETRY_DELAY}ms...`);
+                            await new Promise(resolve => setTimeout(resolve, CREDS_RETRY_DELAY));
+                        }
+                    }
+                    catch (err) {
+                        console.error(`[onboarding] Failed to get credentials from workspace (attempt ${attempt}):`, err);
+                        if (attempt < MAX_CREDS_RETRIES) {
+                            await new Promise(resolve => setTimeout(resolve, CREDS_RETRY_DELAY));
                         }
-                        console.log('[onboarding] Fetched credentials from workspace:', {
-                            hasToken: !!accessToken,
-                            hasRefreshToken: !!refreshToken,
-                        });
                     }
-                }
-                catch (err) {
-                    console.error('[onboarding] Failed to get credentials from workspace:', err);
                 }
             }
         }
@@ -255,13 +302,11 @@ onboardingRouter.post('/cli/:provider/complete/:sessionId', async (req, res) =>
                 error: 'No token found. Please complete authentication or paste your token.',
             });
         }
-        // Store in vault with refresh token and expiry
-        await vault.storeCredential({
+        // Mark provider as connected (tokens are not stored centrally - CLI tools
+        // authenticate directly on workspace instances)
+        await db.credentials.upsert({
             userId,
             provider,
-            accessToken,
-            refreshToken,
-            tokenExpiresAt,
             scopes: getProviderScopes(provider),
         });
         // Clean up session
@@ -284,8 +329,8 @@ onboardingRouter.post('/cli/:provider/complete/:sessionId', async (req, res) =>
 onboardingRouter.post('/cli/:provider/code/:sessionId', async (req, res) => {
     const { provider, sessionId } = req.params;
     const userId = req.session.userId;
-    const { code } = req.body;
-    console.log('[onboarding] Auth code submission request:', { provider, sessionId, codeLength: code?.length });
+    const { code, state } = req.body; // state is optional, used for Codex OAuth
+    console.log('[onboarding] Auth code submission request:', { provider, sessionId, codeLength: code?.length, hasState: !!state });
     if (!code || typeof code !== 'string') {
         return res.status(400).json({ error: 'Auth code is required' });
     }
@@ -311,7 +356,7 @@ onboardingRouter.post('/cli/:provider/code/:sessionId', async (req, res) => {
             const codeResponse = await fetch(targetUrl, {
                 method: 'POST',
                 headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ code }),
+                body: JSON.stringify({ code, state }), // Forward state for Codex CSRF validation
             });
             console.log('[onboarding] Workspace response:', { status: codeResponse.status });
             if (codeResponse.ok) {
@@ -368,6 +413,37 @@ onboardingRouter.post('/cli/:provider/cancel/:sessionId', async (req, res) => {
     }
     res.json({ success: true });
 });
+/**
+ * POST /api/onboarding/mark-connected/:provider
+ * Mark a provider as connected without storing a token.
+ * Used by terminal-based setup where the CLI stores credentials locally.
+ */
+onboardingRouter.post('/mark-connected/:provider', async (req, res) => {
+    const { provider } = req.params;
+    const userId = req.session.userId;
+    // Validate provider
+    const validProviders = ['anthropic', 'openai', 'google', 'github'];
+    if (!validProviders.includes(provider)) {
+        return res.status(400).json({ error: 'Invalid provider' });
+    }
+    try {
+        // Mark provider as connected (tokens are stored by CLI on workspace)
+        await db.credentials.upsert({
+            userId,
+            provider,
+            scopes: getProviderScopes(provider),
+        });
+        console.log(`[onboarding] Marked ${provider} as connected for user ${userId}`);
+        res.json({
+            success: true,
+            message: `${provider} connected successfully`,
+        });
+    }
+    catch (error) {
+        console.error(`Error marking ${provider} as connected:`, error);
+        res.status(500).json({ error: 'Failed to mark provider as connected' });
+    }
+});
 /**
  * POST /api/onboarding/token/:provider
  * Directly store a token (for manual paste flow)
@@ -385,22 +461,23 @@ onboardingRouter.post('/token/:provider', async (req, res) => {
         if (!isValid) {
             return res.status(400).json({ error: 'Invalid token' });
         }
-        // Store in vault
-        await vault.storeCredential({
+        // Mark provider as connected (tokens are not stored centrally - CLI tools
+        // authenticate directly on workspace instances)
+        await db.credentials.upsert({
             userId,
             provider,
-            accessToken: token,
             scopes: getProviderScopes(provider),
             providerAccountEmail: email,
         });
         res.json({
             success: true,
             message: `${provider} connected successfully`,
+            note: 'Token validated. Configure this on your workspace for usage.',
         });
     }
     catch (error) {
-        console.error(`Error storing token for ${provider}:`, error);
-        res.status(500).json({ error: 'Failed to store token' });
+        console.error(`Error storing provider connection for ${provider}:`, error);
+        res.status(500).json({ error: 'Failed to store provider connection' });
     }
 });
 /**

package/dist/cloud/api/providers.js

@@ -9,7 +9,6 @@ import { createClient } from 'redis';
 import { requireAuth } from './auth.js';
 import { getConfig } from '../config.js';
 import { db } from '../db/index.js';
-import { vault } from '../vault/index.js';
 export const providersRouter = Router();
 // All routes require authentication
 providersRouter.use(requireAuth);
@@ -243,19 +242,18 @@ providersRouter.post('/:provider/verify', async (req, res) => {
     // For self-hosted: we trust the user completed the CLI flow
     // In production, we'd verify by making a test API call with the credentials
     try {
-        // For now, mark as connected (in production, verify credentials exist)
-        // This would be called after the user's workspace detects valid credentials
+        // Mark as connected (tokens are not stored centrally - CLI tools
+        // authenticate directly on workspace instances)
         await db.credentials.upsert({
             userId,
             provider,
-            accessToken: 'cli-authenticated', // Placeholder - real token from CLI
             scopes: [], // CLI auth doesn't use scopes
             providerAccountEmail: req.body.email, // User can optionally provide
         });
         res.json({
             success: true,
             message: `${providerConfig.displayName} connected via CLI`,
-            note: 'Credentials will be synced when workspace starts',
+            note: 'CLI credentials remain on your local machine',
         });
     }
     catch (error) {
@@ -306,17 +304,18 @@ providersRouter.post('/:provider/api-key', async (req, res) => {
         if (!isValid) {
             return res.status(400).json({ error: 'Invalid API key' });
         }
-        // Store the API key - use scopes from device flow providers, empty for CLI providers
+        // Mark provider as connected (tokens are not stored centrally - CLI tools
+        // authenticate directly on workspace instances)
         const scopes = isDeviceFlowProvider(providerConfig) ? providerConfig.scopes : [];
-        await vault.storeCredential({
+        await db.credentials.upsert({
             userId,
             provider,
-            accessToken: apiKey,
             scopes,
         });
         res.json({
             success: true,
             message: `${providerConfig.displayName} connected`,
+            note: 'API key validated. Configure this key on your workspace for usage.',
         });
     }
     catch (error) {
@@ -469,7 +468,9 @@ async function pollForToken(flowId, provider, clientId) {
         .catch((err) => console.error('Poll start error:', err));
 }
 /**
- * Store tokens after successful device flow
+ * Mark provider as connected after successful device flow
+ * Note: Tokens are not stored centrally - CLI tools authenticate directly
+ * on workspace instances. We only record the connection status and user info.
  */
 async function storeProviderTokens(userId, provider, tokens) {
     const providerConfig = PROVIDERS[provider];
@@ -490,15 +491,10 @@ async function storeProviderTokens(userId, provider, tokens) {
             console.error('Error fetching user info:', error);
         }
     }
-    // Encrypt and store
-    await vault.storeCredential({
+    // Mark provider as connected (without storing tokens)
+    await db.credentials.upsert({
         userId,
         provider,
-        accessToken: tokens.accessToken,
-        refreshToken: tokens.refreshToken,
-        tokenExpiresAt: tokens.expiresIn
-            ? new Date(Date.now() + tokens.expiresIn * 1000)
-            : undefined,
         scopes: tokens.scope?.split(' '),
         providerAccountId: userInfo.id,
         providerAccountEmail: userInfo.email,

package/dist/cloud/api/repos.d.ts

@@ -2,6 +2,7 @@
  * Repos API Routes
  *
  * GitHub repository management - list, import, sync.
+ * Includes Nango-based GitHub permission checking for dashboard access control.
  */
 export declare const reposRouter: import("express-serve-static-core").Router;
 //# sourceMappingURL=repos.d.ts.map