agent-relay 1.2.0 → 1.3.0

package/dist/cloud/services/intro-expiration.js

@@ -0,0 +1,211 @@
+/**
+ * Intro Expiration Service
+ *
+ * Handles auto-resize of workspaces when the free tier introductory period expires.
+ * Free users get Pro-level resources (2 CPU / 4GB) for the first 14 days,
+ * then get automatically downsized to standard free tier (1 CPU / 2GB).
+ */
+import { db } from '../db/index.js';
+import { getProvisioner } from '../provisioner/index.js';
+export const INTRO_PERIOD_DAYS = 14;
+const DEFAULT_CONFIG = {
+    enabled: true,
+    checkIntervalMs: 60 * 60 * 1000, // 1 hour
+};
+/**
+ * Get intro period status for a user
+ */
+export function getIntroStatus(userCreatedAt, plan) {
+    const introPeriodDays = INTRO_PERIOD_DAYS;
+    // Only free tier users get intro bonus
+    if (plan !== 'free' || !userCreatedAt) {
+        return {
+            isIntroPeriod: false,
+            daysRemaining: 0,
+            introPeriodDays,
+            expiresAt: null,
+        };
+    }
+    const createdAt = typeof userCreatedAt === 'string' ? new Date(userCreatedAt) : userCreatedAt;
+    const daysSinceSignup = (Date.now() - createdAt.getTime()) / (1000 * 60 * 60 * 24);
+    const isIntroPeriod = daysSinceSignup < introPeriodDays;
+    const daysRemaining = Math.max(0, Math.ceil(introPeriodDays - daysSinceSignup));
+    const expiresAt = new Date(createdAt.getTime() + introPeriodDays * 24 * 60 * 60 * 1000);
+    return {
+        isIntroPeriod,
+        daysRemaining,
+        introPeriodDays,
+        expiresAt,
+    };
+}
+export class IntroExpirationService {
+    config;
+    checkTimer = null;
+    isRunning = false;
+    constructor(config = {}) {
+        this.config = { ...DEFAULT_CONFIG, ...config };
+    }
+    /**
+     * Start the expiration service
+     */
+    start() {
+        if (!this.config.enabled) {
+            console.log('[intro-expiration] Service disabled');
+            return;
+        }
+        if (this.isRunning) {
+            console.warn('[intro-expiration] Service already running');
+            return;
+        }
+        this.isRunning = true;
+        console.log(`[intro-expiration] Started (checking every ${this.config.checkIntervalMs / 1000 / 60} minutes)`);
+        // Run immediately on start
+        this.runExpirationCheck().catch((err) => {
+            console.error('[intro-expiration] Initial run failed:', err);
+        });
+        // Then run periodically
+        this.checkTimer = setInterval(() => {
+            this.runExpirationCheck().catch((err) => {
+                console.error('[intro-expiration] Periodic run failed:', err);
+            });
+        }, this.config.checkIntervalMs);
+    }
+    /**
+     * Stop the expiration service
+     */
+    stop() {
+        if (this.checkTimer) {
+            clearInterval(this.checkTimer);
+            this.checkTimer = null;
+        }
+        this.isRunning = false;
+        console.log('[intro-expiration] Stopped');
+    }
+    /**
+     * Run expiration check for all free tier users with expired intro periods
+     */
+    async runExpirationCheck() {
+        const results = [];
+        try {
+            // Get all users on free tier
+            const freeUsers = await db.users.findByPlan('free');
+            // Filter to users whose intro period has expired
+            const expiredUsers = freeUsers.filter((user) => {
+                const status = getIntroStatus(user.createdAt, user.plan || 'free');
+                return !status.isIntroPeriod && status.expiresAt !== null;
+            });
+            if (expiredUsers.length === 0) {
+                return results;
+            }
+            console.log(`[intro-expiration] Checking ${expiredUsers.length} users with expired intro periods`);
+            for (const user of expiredUsers) {
+                try {
+                    const userResults = await this.checkAndResizeUserWorkspaces(user.id);
+                    results.push(...userResults);
+                }
+                catch (err) {
+                    console.error(`[intro-expiration] Error checking user ${user.id}:`, err);
+                }
+            }
+            // Summary
+            const resized = results.filter((r) => r.action === 'resized').length;
+            const skipped = results.filter((r) => r.action === 'skipped').length;
+            const errors = results.filter((r) => r.action === 'error').length;
+            if (resized > 0 || errors > 0) {
+                console.log(`[intro-expiration] Results: ${resized} resized, ${skipped} skipped, ${errors} errors`);
+            }
+            return results;
+        }
+        catch (err) {
+            console.error('[intro-expiration] Run failed:', err);
+            return results;
+        }
+    }
+    /**
+     * Check and resize workspaces for a user whose intro period has expired
+     */
+    async checkAndResizeUserWorkspaces(userId) {
+        const results = [];
+        const provisioner = getProvisioner();
+        // Get user's workspaces
+        const workspaces = await db.workspaces.findByUserId(userId);
+        for (const workspace of workspaces) {
+            try {
+                // Check if workspace has intro-sized resources
+                // We detect this by checking if it has 4GB memory (intro size) vs 2GB (standard)
+                const config = workspace.config;
+                const resourceTier = config?.resourceTier;
+                // Skip if already resized to standard free tier
+                // Intro workspaces would have been provisioned with medium tier (4GB)
+                // Standard free tier is small (2GB)
+                if (resourceTier === 'small') {
+                    results.push({
+                        userId,
+                        workspaceId: workspace.id,
+                        workspaceName: workspace.name,
+                        action: 'skipped',
+                        reason: 'Already at standard free tier size',
+                    });
+                    continue;
+                }
+                // Skip if workspace is not running (resize happens on next start)
+                if (workspace.status !== 'running') {
+                    results.push({
+                        userId,
+                        workspaceId: workspace.id,
+                        workspaceName: workspace.name,
+                        action: 'skipped',
+                        reason: `Workspace status is ${workspace.status}`,
+                    });
+                    continue;
+                }
+                // Resize to standard free tier (small: 1 CPU / 2GB)
+                // Use skipRestart=true to not disrupt running agents
+                // The config is saved and will apply on next restart
+                console.log(`[intro-expiration] Resizing workspace ${workspace.name} to standard free tier`);
+                await provisioner.resize(workspace.id, {
+                    name: 'small',
+                    cpuCores: 1,
+                    cpuKind: 'shared',
+                    memoryMb: 2048,
+                    maxAgents: 2,
+                }, true); // skipRestart = true for graceful resize
+                results.push({
+                    userId,
+                    workspaceId: workspace.id,
+                    workspaceName: workspace.name,
+                    action: 'resized',
+                    reason: 'Intro period expired, downsized to standard free tier (applies on next restart)',
+                });
+            }
+            catch (err) {
+                console.error(`[intro-expiration] Failed to resize workspace ${workspace.id}:`, err);
+                results.push({
+                    userId,
+                    workspaceId: workspace.id,
+                    workspaceName: workspace.name,
+                    action: 'error',
+                    reason: err instanceof Error ? err.message : 'Unknown error',
+                });
+            }
+        }
+        return results;
+    }
+}
+// Singleton instance
+let _service = null;
+export function getIntroExpirationService() {
+    if (!_service) {
+        _service = new IntroExpirationService();
+    }
+    return _service;
+}
+export function startIntroExpirationService() {
+    getIntroExpirationService().start();
+}
+export function stopIntroExpirationService() {
+    if (_service) {
+        _service.stop();
+    }
+}
+//# sourceMappingURL=intro-expiration.js.map

package/dist/cloud/services/nango.d.ts

@@ -33,6 +33,22 @@ declare class NangoService {
      * For API calls, use the proxy methods instead.
      */
     getGithubAppToken(connectionId: string): Promise<string>;
+    /**
+     * Retrieve the user's OAuth access token from a GitHub App OAuth connection.
+     * This is the user-level token (not the installation token).
+     * Use this for operations that require user context (e.g., gh CLI).
+     *
+     * The user token can be found in:
+     * 1. getToken() without installation flag
+     * 2. connection_config.access_token in github-app-oauth
+     * 3. Separate 'github' user connection
+     */
+    getGithubUserOAuthToken(connectionId: string): Promise<string>;
+    /**
+     * Retrieve the user's OAuth token from a 'github' user connection.
+     * This is for the separate GitHub OAuth login (not the App connection).
+     */
+    getGithubUserToken(connectionId: string): Promise<string>;
     /**
      * List repositories available to a GitHub App installation using the Nango Proxy.
      * The proxy automatically handles token injection and refresh.
@@ -114,6 +130,64 @@ declare class NangoService {
         };
         metadata?: Record<string, unknown>;
     }>;
+    /**
+     * Check if user has access to a specific GitHub repository.
+     * Uses the user's OAuth connection to query GitHub API.
+     * @param connectionId - User's Nango connection ID (github user OAuth)
+     * @param owner - Repository owner
+     * @param repo - Repository name
+     * @returns Access details or null if no access
+     */
+    checkUserRepoAccess(connectionId: string, owner: string, repo: string): Promise<{
+        hasAccess: boolean;
+        permission?: 'admin' | 'write' | 'read' | 'none';
+        repository?: {
+            id: number;
+            fullName: string;
+            isPrivate: boolean;
+            defaultBranch: string;
+        };
+    }>;
+    /**
+     * List all repositories the user has access to via their OAuth connection.
+     * Uses the user's personal OAuth token (not the GitHub App).
+     * @param connectionId - User's Nango connection ID (github user OAuth)
+     * @param options - Pagination and filter options
+     * @returns List of accessible repositories
+     */
+    listUserAccessibleRepos(connectionId: string, options?: {
+        page?: number;
+        perPage?: number;
+        type?: 'all' | 'owner' | 'public' | 'private' | 'member';
+        sort?: 'created' | 'updated' | 'pushed' | 'full_name';
+    }): Promise<{
+        repositories: Array<{
+            id: number;
+            fullName: string;
+            isPrivate: boolean;
+            defaultBranch: string;
+            permissions: {
+                admin: boolean;
+                push: boolean;
+                pull: boolean;
+            };
+        }>;
+        hasMore: boolean;
+    }>;
+    /**
+     * List collaborators for a repository via Nango Proxy.
+     * Uses the GitHub App connection to access repository collaborators.
+     * @param connectionId - GitHub App connection ID
+     * @param owner - Repository owner
+     * @param repo - Repository name
+     * @returns List of collaborators with their permissions
+     */
+    listRepoCollaborators(connectionId: string, owner: string, repo: string): Promise<Array<{
+        id: number;
+        login: string;
+        avatarUrl: string;
+        permission: 'admin' | 'write' | 'read' | 'none';
+    }>>;
     /**
      * Verify webhook signature sent by Nango.
      * Uses the new verifyIncomingWebhookRequest method.

package/dist/cloud/services/nango.js

@@ -46,12 +46,93 @@ class NangoService {
      * For API calls, use the proxy methods instead.
      */
     async getGithubAppToken(connectionId) {
-        const token = await this.client.getToken(NANGO_INTEGRATIONS.GITHUB_APP, connectionId, false, true);
-        // Handle different return formats from Nango
+        try {
+            const token = await this.client.getToken(NANGO_INTEGRATIONS.GITHUB_APP, connectionId, false, true);
+            // Handle different return formats from Nango
+            if (typeof token === 'string') {
+                return token;
+            }
+            // Nango may return an object with access_token
+            if (token && typeof token === 'object') {
+                const tokenObj = token;
+                if (tokenObj.access_token) {
+                    return tokenObj.access_token;
+                }
+                if (tokenObj.token) {
+                    return tokenObj.token;
+                }
+            }
+            console.error('[nango] Unexpected token format:', typeof token, token);
+            throw new Error('Expected GitHub App token to be a string');
+        }
+        catch (err) {
+            // Handle 404 (connection not found) gracefully
+            const error = err;
+            const status = error.response?.status || error.status;
+            if (status === 404) {
+                throw new Error(`GitHub App connection not found: ${connectionId} (may have been disconnected)`);
+            }
+            // Re-throw with cleaner message
+            throw new Error(`Failed to get GitHub App token: ${err.message || 'Unknown error'}`);
+        }
+    }
+    /**
+     * Retrieve the user's OAuth access token from a GitHub App OAuth connection.
+     * This is the user-level token (not the installation token).
+     * Use this for operations that require user context (e.g., gh CLI).
+     *
+     * The user token can be found in:
+     * 1. getToken() without installation flag
+     * 2. connection_config.access_token in github-app-oauth
+     * 3. Separate 'github' user connection
+     */
+    async getGithubUserOAuthToken(connectionId) {
+        // First try: Get token from github-app-oauth connection credentials
+        try {
+            const token = await this.client.getToken(NANGO_INTEGRATIONS.GITHUB_APP, connectionId);
+            if (typeof token === 'string' && token.length > 0) {
+                return token;
+            }
+            if (token && typeof token === 'object') {
+                const tokenObj = token;
+                if (tokenObj.access_token) {
+                    return tokenObj.access_token;
+                }
+                if (tokenObj.token) {
+                    return tokenObj.token;
+                }
+            }
+        }
+        catch (err) {
+            console.log('[nango] getToken for user OAuth failed, trying connection_config:', err);
+        }
+        // Second try: Check connection_config for user token
+        try {
+            const connection = await this.client.getConnection(NANGO_INTEGRATIONS.GITHUB_APP, connectionId);
+            const connConfig = connection.connection_config;
+            if (connConfig?.access_token && typeof connConfig.access_token === 'string') {
+                return connConfig.access_token;
+            }
+            // Also check credentials object
+            const credentials = connection.credentials;
+            if (credentials?.access_token) {
+                return credentials.access_token;
+            }
+        }
+        catch (err) {
+            console.log('[nango] connection_config check failed:', err);
+        }
+        throw new Error('Could not retrieve GitHub user OAuth token');
+    }
+    /**
+     * Retrieve the user's OAuth token from a 'github' user connection.
+     * This is for the separate GitHub OAuth login (not the App connection).
+     */
+    async getGithubUserToken(connectionId) {
+        const token = await this.client.getToken(NANGO_INTEGRATIONS.GITHUB_USER, connectionId);
         if (typeof token === 'string') {
             return token;
         }
-        // Nango may return an object with access_token
         if (token && typeof token === 'object') {
             const tokenObj = token;
             if (tokenObj.access_token) {
@@ -61,8 +142,7 @@ class NangoService {
                 return tokenObj.token;
             }
         }
-        console.error('[nango] Unexpected token format:', typeof token, token);
-        throw new Error('Expected GitHub App token to be a string');
+        throw new Error('Could not retrieve GitHub user token');
     }
     /**
      * List repositories available to a GitHub App installation using the Nango Proxy.
@@ -162,6 +242,139 @@ class NangoService {
         const connection = await this.client.getConnection(providerConfigKey, connectionId);
         return connection;
     }
+    /**
+     * Check if user has access to a specific GitHub repository.
+     * Uses the user's OAuth connection to query GitHub API.
+     * @param connectionId - User's Nango connection ID (github user OAuth)
+     * @param owner - Repository owner
+     * @param repo - Repository name
+     * @returns Access details or null if no access
+     */
+    async checkUserRepoAccess(connectionId, owner, repo) {
+        try {
+            const response = await this.client.get({
+                connectionId,
+                providerConfigKey: NANGO_INTEGRATIONS.GITHUB_USER,
+                endpoint: `/repos/${owner}/${repo}`,
+            });
+            const data = response.data;
+            let permission = 'none';
+            if (data.permissions) {
+                if (data.permissions.admin) {
+                    permission = 'admin';
+                }
+                else if (data.permissions.push) {
+                    permission = 'write';
+                }
+                else if (data.permissions.pull) {
+                    permission = 'read';
+                }
+            }
+            return {
+                hasAccess: true,
+                permission,
+                repository: {
+                    id: data.id,
+                    fullName: data.full_name,
+                    isPrivate: data.private,
+                    defaultBranch: data.default_branch,
+                },
+            };
+        }
+        catch (err) {
+            // 404 = no access or repo doesn't exist
+            const error = err;
+            if (error.response?.status === 404 || error.response?.status === 403) {
+                return { hasAccess: false };
+            }
+            console.error('[nango] checkUserRepoAccess error:', err);
+            throw err;
+        }
+    }
+    /**
+     * List all repositories the user has access to via their OAuth connection.
+     * Uses the user's personal OAuth token (not the GitHub App).
+     * @param connectionId - User's Nango connection ID (github user OAuth)
+     * @param options - Pagination and filter options
+     * @returns List of accessible repositories
+     */
+    async listUserAccessibleRepos(connectionId, options) {
+        const page = options?.page ?? 1;
+        const perPage = options?.perPage ?? 100;
+        const type = options?.type ?? 'all';
+        const sort = options?.sort ?? 'updated';
+        const response = await this.client.get({
+            connectionId,
+            providerConfigKey: NANGO_INTEGRATIONS.GITHUB_USER,
+            endpoint: '/user/repos',
+            params: {
+                page: String(page),
+                per_page: String(perPage),
+                type,
+                sort,
+                direction: 'desc',
+            },
+        });
+        const repos = response.data || [];
+        return {
+            repositories: repos.map(r => ({
+                id: r.id,
+                fullName: r.full_name,
+                isPrivate: r.private,
+                defaultBranch: r.default_branch,
+                permissions: r.permissions || { admin: false, push: false, pull: false },
+            })),
+            hasMore: repos.length === perPage,
+        };
+    }
+    /**
+     * List collaborators for a repository via Nango Proxy.
+     * Uses the GitHub App connection to access repository collaborators.
+     * @param connectionId - GitHub App connection ID
+     * @param owner - Repository owner
+     * @param repo - Repository name
+     * @returns List of collaborators with their permissions
+     */
+    async listRepoCollaborators(connectionId, owner, repo) {
+        try {
+            const response = await this.client.get({
+                connectionId,
+                providerConfigKey: NANGO_INTEGRATIONS.GITHUB_APP,
+                endpoint: `/repos/${owner}/${repo}/collaborators`,
+                params: { per_page: '100' },
+            });
+            return (response.data || []).map(collab => {
+                let permission = 'none';
+                if (collab.permissions) {
+                    if (collab.permissions.admin) {
+                        permission = 'admin';
+                    }
+                    else if (collab.permissions.push) {
+                        permission = 'write';
+                    }
+                    else if (collab.permissions.pull) {
+                        permission = 'read';
+                    }
+                }
+                return {
+                    id: collab.id,
+                    login: collab.login,
+                    avatarUrl: collab.avatar_url,
+                    permission,
+                };
+            });
+        }
+        catch (err) {
+            const error = err;
+            // 403 = no permission to view collaborators, 404 = repo not found
+            if (error.response?.status === 403 || error.response?.status === 404) {
+                console.warn(`[nango] Cannot list collaborators for ${owner}/${repo}: status ${error.response.status}`);
+                return [];
+            }
+            console.error('[nango] listRepoCollaborators error:', err);
+            throw err;
+        }
+    }
     /**
      * Verify webhook signature sent by Nango.
      * Uses the new verifyIncomingWebhookRequest method.

package/dist/cloud/services/planLimits.d.ts

@@ -122,4 +122,26 @@ export declare function recordComputeUsage(userId: string, workspaceId: string,
  * Update active agent count for a user
  */
 export declare function updateActiveAgentCount(userId: string, workspaceId: string, count: number): Promise<void>;
+/**
+ * Resource tier name type
+ */
+export type ResourceTierName = 'small' | 'medium' | 'large' | 'xlarge';
+/**
+ * Get the default resource tier for a plan
+ * Maps plans to appropriate compute resources
+ */
+export declare function getResourceTierForPlan(plan: PlanType): ResourceTierName;
+/**
+ * Get the maximum resource tier a plan can scale to
+ * Prevents over-scaling beyond plan entitlements
+ */
+export declare function getMaxResourceTierForPlan(plan: PlanType): ResourceTierName;
+/**
+ * Check if user's plan allows auto-scaling
+ */
+export declare function canAutoScale(plan: PlanType): boolean;
+/**
+ * Check if auto-scale to a specific tier is allowed for a plan
+ */
+export declare function canScaleToTier(plan: PlanType, targetTier: ResourceTierName): boolean;
 //# sourceMappingURL=planLimits.d.ts.map

package/dist/cloud/services/planLimits.js

@@ -18,17 +18,17 @@ import { getDb } from '../db/drizzle.js';
 export const PLAN_LIMITS = {
     free: {
         maxWorkspaces: 1,
-        maxRepos: 3,
+        maxRepos: 2,
         maxConcurrentAgents: 2,
-        maxComputeHoursPerMonth: 10,
+        maxComputeHoursPerMonth: 5, // Limited free tier
         coordinatorsEnabled: false,
         sessionPersistence: false,
     },
     pro: {
         maxWorkspaces: 5,
-        maxRepos: 20,
-        maxConcurrentAgents: 10,
-        maxComputeHoursPerMonth: 100,
+        maxRepos: 10,
+        maxConcurrentAgents: 5,
+        maxComputeHoursPerMonth: 50,
         coordinatorsEnabled: true,
         sessionPersistence: true,
     },
@@ -279,4 +279,57 @@ export async function updateActiveAgentCount(userId, workspaceId, count) {
         recordedAt: new Date(),
     });
 }
+/**
+ * Get the default resource tier for a plan
+ * Maps plans to appropriate compute resources
+ */
+export function getResourceTierForPlan(plan) {
+    switch (plan) {
+        case 'free':
+            return 'small'; // 2GB, 2 CPUs - suitable for 2 agents
+        case 'pro':
+            return 'medium'; // 4GB, 4 CPUs - suitable for 5 agents
+        case 'team':
+            return 'large'; // 8GB, 4 CPUs - suitable for 10 agents
+        case 'enterprise':
+            return 'xlarge'; // 16GB, 8 CPUs - suitable for 20 agents
+        default:
+            return 'small';
+    }
+}
+/**
+ * Get the maximum resource tier a plan can scale to
+ * Prevents over-scaling beyond plan entitlements
+ */
+export function getMaxResourceTierForPlan(plan) {
+    switch (plan) {
+        case 'free':
+            return 'small'; // Free tier cannot scale up
+        case 'pro':
+            return 'medium'; // Pro can scale to medium
+        case 'team':
+            return 'large'; // Team can scale to large
+        case 'enterprise':
+            return 'xlarge'; // Enterprise can use any tier
+        default:
+            return 'small';
+    }
+}
+/**
+ * Check if user's plan allows auto-scaling
+ */
+export function canAutoScale(plan) {
+    // Only Pro and above can auto-scale
+    return plan !== 'free';
+}
+/**
+ * Check if auto-scale to a specific tier is allowed for a plan
+ */
+export function canScaleToTier(plan, targetTier) {
+    const tierOrder = ['small', 'medium', 'large', 'xlarge'];
+    const maxTier = getMaxResourceTierForPlan(plan);
+    const targetIndex = tierOrder.indexOf(targetTier);
+    const maxIndex = tierOrder.indexOf(maxTier);
+    return targetIndex <= maxIndex;
+}
 //# sourceMappingURL=planLimits.js.map

package/dist/cloud/services/ssh-security.d.ts

@@ -0,0 +1,31 @@
+/**
+ * SSH Security Utilities
+ *
+ * Provides secure SSH password derivation for workspace containers.
+ * Uses a deterministic approach based on workspace ID + secret salt,
+ * ensuring each workspace has a unique password without storage.
+ */
+/**
+ * Derive a unique SSH password for a workspace.
+ *
+ * Uses SHA-256 hash of (workspaceId + salt) to generate a deterministic
+ * but unique password for each workspace. This approach:
+ * - Ensures each workspace has a unique password
+ * - Requires no database storage
+ * - Produces consistent results across cloud server and container
+ *
+ * SECURITY: Set SSH_PASSWORD_SALT environment variable in production!
+ * The default salt is insecure and should never be used in production.
+ *
+ * @param workspaceId - The workspace UUID
+ * @returns A 24-character hex password (96 bits of entropy)
+ */
+export declare function deriveSshPassword(workspaceId: string): string;
+/**
+ * Validate that SSH security is properly configured.
+ * Call this at server startup to catch configuration issues early.
+ *
+ * @returns true if properly configured, false otherwise
+ */
+export declare function validateSshSecurityConfig(): boolean;
+//# sourceMappingURL=ssh-security.d.ts.map