agent-relay 1.2.0 → 1.3.0

package/dist/cloud/services/ssh-security.js

@@ -0,0 +1,63 @@
+/**
+ * SSH Security Utilities
+ *
+ * Provides secure SSH password derivation for workspace containers.
+ * Uses a deterministic approach based on workspace ID + secret salt,
+ * ensuring each workspace has a unique password without storage.
+ */
+import * as crypto from 'crypto';
+const DEFAULT_SALT = 'default-salt-change-in-prod';
+/**
+ * Derive a unique SSH password for a workspace.
+ *
+ * Uses SHA-256 hash of (workspaceId + salt) to generate a deterministic
+ * but unique password for each workspace. This approach:
+ * - Ensures each workspace has a unique password
+ * - Requires no database storage
+ * - Produces consistent results across cloud server and container
+ *
+ * SECURITY: Set SSH_PASSWORD_SALT environment variable in production!
+ * The default salt is insecure and should never be used in production.
+ *
+ * @param workspaceId - The workspace UUID
+ * @returns A 24-character hex password (96 bits of entropy)
+ */
+export function deriveSshPassword(workspaceId) {
+    const salt = process.env.SSH_PASSWORD_SALT;
+    // Warn if using default salt in production
+    if (!salt) {
+        const isProduction = process.env.NODE_ENV === 'production' || process.env.FLY_APP_NAME;
+        if (isProduction) {
+            console.warn('[SECURITY WARNING] SSH_PASSWORD_SALT is not set! ' +
+                'Using default salt is INSECURE in production. ' +
+                'Set SSH_PASSWORD_SALT to a random 32+ character secret.');
+        }
+    }
+    const effectiveSalt = salt || DEFAULT_SALT;
+    return crypto
+        .createHash('sha256')
+        .update(`${workspaceId}:${effectiveSalt}`)
+        .digest('hex')
+        .substring(0, 24); // 24 hex chars = 96 bits of entropy
+}
+/**
+ * Validate that SSH security is properly configured.
+ * Call this at server startup to catch configuration issues early.
+ *
+ * @returns true if properly configured, false otherwise
+ */
+export function validateSshSecurityConfig() {
+    const salt = process.env.SSH_PASSWORD_SALT;
+    const isProduction = process.env.NODE_ENV === 'production' || process.env.FLY_APP_NAME;
+    if (isProduction && !salt) {
+        console.error('[SECURITY ERROR] SSH_PASSWORD_SALT must be set in production! ' +
+            'Generate one with: openssl rand -hex 32');
+        return false;
+    }
+    if (salt && salt.length < 16) {
+        console.warn('[SECURITY WARNING] SSH_PASSWORD_SALT should be at least 16 characters. ' +
+            'Current length: ' + salt.length);
+    }
+    return true;
+}
+//# sourceMappingURL=ssh-security.js.map

package/dist/continuity/manager.d.ts

@@ -102,6 +102,11 @@ export declare class ContinuityManager {
      * Filter placeholder values from a handoff (defensive)
      */
     private filterHandoffPlaceholders;
+    /**
+     * Filter placeholder values from ledger updates (for object input to saveLedger).
+     * This ensures placeholder values like "...", "task1", etc. don't get saved.
+     */
+    private filterUpdatesPlaceholders;
     /**
      * Format a ledger for display/injection
      */

package/dist/continuity/manager.js

@@ -91,8 +91,16 @@ export class ContinuityManager {
      */
     async saveLedger(agentName, content, options = {}) {
         await this.initialize();
-        // Parse content if string
-        const updates = typeof content === 'string' ? parseSaveContent(content) : content;
+        // Parse content if string, otherwise filter placeholders from object input
+        // This ensures placeholder values like "...", "task1", etc. never get saved
+        let updates;
+        if (typeof content === 'string') {
+            updates = parseSaveContent(content);
+        }
+        else {
+            // Filter placeholders from object input (e.g., from [[SUMMARY]] blocks)
+            updates = this.filterUpdatesPlaceholders(content);
+        }
         // Get or create existing ledger
         let ledger = await this.ledgerStore.load(agentName);
         if (ledger) {
@@ -329,6 +337,52 @@ export class ContinuityManager {
             learnings: handoff.learnings ? filterPlaceholders(handoff.learnings) : undefined,
         };
     }
+    /**
+     * Filter placeholder values from ledger updates (for object input to saveLedger).
+     * This ensures placeholder values like "...", "task1", etc. don't get saved.
+     */
+    filterUpdatesPlaceholders(updates) {
+        const filtered = { ...updates };
+        // Filter string fields
+        if (filtered.currentTask !== undefined) {
+            filtered.currentTask = isPlaceholderValue(filtered.currentTask) ? undefined : filtered.currentTask;
+            if (filtered.currentTask === undefined)
+                delete filtered.currentTask;
+        }
+        // Filter array fields
+        if (filtered.completed) {
+            filtered.completed = filterPlaceholders(filtered.completed);
+            if (filtered.completed.length === 0)
+                delete filtered.completed;
+        }
+        if (filtered.inProgress) {
+            filtered.inProgress = filterPlaceholders(filtered.inProgress);
+            if (filtered.inProgress.length === 0)
+                delete filtered.inProgress;
+        }
+        if (filtered.blocked) {
+            filtered.blocked = filterPlaceholders(filtered.blocked);
+            if (filtered.blocked.length === 0)
+                delete filtered.blocked;
+        }
+        if (filtered.uncertainItems) {
+            filtered.uncertainItems = filterPlaceholders(filtered.uncertainItems);
+            if (filtered.uncertainItems.length === 0)
+                delete filtered.uncertainItems;
+        }
+        // Filter complex array fields
+        if (filtered.fileContext) {
+            filtered.fileContext = filtered.fileContext.filter(f => !isPlaceholderValue(f.path));
+            if (filtered.fileContext.length === 0)
+                delete filtered.fileContext;
+        }
+        if (filtered.keyDecisions) {
+            filtered.keyDecisions = filtered.keyDecisions.filter(d => !isPlaceholderValue(d.decision));
+            if (filtered.keyDecisions.length === 0)
+                delete filtered.keyDecisions;
+        }
+        return filtered;
+    }
     /**
      * Format a ledger for display/injection
      */

package/dist/daemon/api.d.ts

@@ -14,6 +14,8 @@ export declare class DaemonApi extends EventEmitter {
     private config;
     private allowedOrigins;
     private allowAllOrigins;
+    private clientAlive;
+    private pingInterval?;
     constructor(config: ApiDaemonConfig);
     /**
      * Resolve allowed origins from config/env (comma-separated list).

package/dist/daemon/api.js

@@ -9,7 +9,8 @@ import { createLogger } from '../resiliency/logger.js';
 import { metrics } from '../resiliency/metrics.js';
 import { getWorkspaceManager } from './workspace-manager.js';
 import { getAgentManager } from './agent-manager.js';
-import { startCLIAuth, getAuthSession, cancelAuthSession, getSupportedProviders, } from './cli-auth.js';
+import { startCLIAuth, getAuthSession, submitAuthCode, cancelAuthSession, getSupportedProviders, } from './cli-auth.js';
+import { getRepoManager, initRepoManager } from './repo-manager.js';
 const logger = createLogger('daemon-api');
 export class DaemonApi extends EventEmitter {
     server;
@@ -21,6 +22,9 @@ export class DaemonApi extends EventEmitter {
     config;
     allowedOrigins;
     allowAllOrigins;
+    // Track alive status for ping/pong keepalive
+    clientAlive = new WeakMap();
+    pingInterval;
     constructor(config) {
         super();
         this.config = config;
@@ -80,11 +84,28 @@ export class DaemonApi extends EventEmitter {
      * Start the API server
      */
     async start() {
+        // Initialize repo manager (scans for existing repos, syncs from env)
+        // This runs in background - don't block server startup
+        initRepoManager().catch((err) => {
+            logger.warn('Failed to initialize repo manager', { error: String(err) });
+        });
         return new Promise((resolve) => {
             this.server = http.createServer((req, res) => this.handleRequest(req, res));
-            // Setup WebSocket server
-            this.wss = new WebSocketServer({ server: this.server });
+            // Setup WebSocket server (disable compression for compatibility)
+            this.wss = new WebSocketServer({ server: this.server, perMessageDeflate: false });
             this.wss.on('connection', (ws, req) => this.handleWebSocketConnection(ws, req));
+            // Setup ping/pong keepalive (30 second interval)
+            this.pingInterval = setInterval(() => {
+                this.wss?.clients.forEach((ws) => {
+                    if (this.clientAlive.get(ws) === false) {
+                        logger.info('WebSocket client unresponsive, closing');
+                        ws.terminate();
+                        return;
+                    }
+                    this.clientAlive.set(ws, false);
+                    ws.ping();
+                });
+            }, 30000);
             this.server.listen(this.config.port, this.config.host, () => {
                 logger.info('Daemon API started', { port: this.config.port, host: this.config.host });
                 resolve();
@@ -95,6 +116,11 @@ export class DaemonApi extends EventEmitter {
      * Stop the API server
      */
     async stop() {
+        // Clear ping interval
+        if (this.pingInterval) {
+            clearInterval(this.pingInterval);
+            this.pingInterval = undefined;
+        }
         // Close all WebSocket connections
         if (this.wss) {
             for (const ws of this.wss.clients) {
@@ -295,6 +321,8 @@ export class DaemonApi extends EventEmitter {
                     status: session.status,
                     authUrl: session.authUrl,
                     error: session.error,
+                    errorHint: session.errorHint,
+                    recoverable: session.recoverable,
                     promptsHandled: session.promptsHandled,
                 },
             };
@@ -306,17 +334,109 @@ export class DaemonApi extends EventEmitter {
             if (!session) {
                 return { status: 404, body: { error: 'Session not found' } };
             }
-            if (session.status !== 'success') {
-                return { status: 400, body: { error: 'Auth not complete', status: session.status } };
+            // Check for error state first
+            if (session.status === 'error') {
+                return {
+                    status: 400,
+                    body: {
+                        error: session.error || 'Authentication failed',
+                        errorHint: session.errorHint,
+                        recoverable: session.recoverable,
+                        status: session.status,
+                    },
+                };
+            }
+            // Check if auth is complete AND we have credentials
+            // Status can be 'success' before credentials are extracted (race condition)
+            if (session.status !== 'success' || !session.token) {
+                return {
+                    status: 400,
+                    body: {
+                        error: 'Auth not complete or credentials not yet available',
+                        status: session.status,
+                        hasToken: !!session.token,
+                    },
+                };
             }
             return {
                 status: 200,
                 body: {
                     token: session.token,
+                    refreshToken: session.refreshToken,
+                    tokenExpiresAt: session.tokenExpiresAt,
                     provider: session.provider,
                 },
             };
         });
+        // Submit auth code to PTY session
+        this.routes.set('POST /auth/cli/:provider/code/:sessionId', async (req) => {
+            const { sessionId } = req.params;
+            const { code, state } = req.body;
+            if (!code || typeof code !== 'string') {
+                return { status: 400, body: { error: 'Auth code is required' } };
+            }
+            const result = await submitAuthCode(sessionId, code, state);
+            if (!result.success) {
+                return {
+                    status: 400,
+                    body: {
+                        error: result.error || 'Failed to submit auth code',
+                        needsRestart: result.needsRestart,
+                    },
+                };
+            }
+            return { status: 200, body: { success: true, message: 'Auth code submitted' } };
+        });
+        // Complete auth and wait for credentials
+        this.routes.set('POST /auth/cli/:provider/complete/:sessionId', async (req) => {
+            const { sessionId } = req.params;
+            const { authCode, state } = req.body;
+            // For Codex, we need to forward the authCode to the CLI's callback server
+            // The Codex CLI starts a callback server at localhost:1455
+            if (authCode) {
+                try {
+                    // Forward the OAuth callback to the Codex CLI's callback server
+                    const callbackUrl = `http://localhost:1455/auth/callback?code=${encodeURIComponent(authCode)}${state ? `&state=${encodeURIComponent(state)}` : ''}`;
+                    logger.info('Forwarding OAuth callback to Codex CLI', { callbackUrl: callbackUrl.replace(authCode, '[REDACTED]') });
+                    const callbackResponse = await fetch(callbackUrl, {
+                        signal: AbortSignal.timeout(5000),
+                    });
+                    if (!callbackResponse.ok) {
+                        logger.error('Failed to forward callback to Codex CLI', { status: callbackResponse.status });
+                        return {
+                            status: 400,
+                            body: {
+                                error: 'Failed to deliver OAuth callback to Codex CLI. The CLI may have timed out.',
+                                needsRestart: true,
+                            },
+                        };
+                    }
+                    logger.info('Successfully forwarded OAuth callback to Codex CLI');
+                }
+                catch (err) {
+                    logger.error('Error forwarding callback to Codex CLI', { error: String(err) });
+                    return {
+                        status: 500,
+                        body: {
+                            error: 'Failed to reach Codex CLI callback server. The CLI may not be running.',
+                            needsRestart: true,
+                        },
+                    };
+                }
+            }
+            // Wait for credentials to be available (polls for up to 15 seconds)
+            const { completeAuthSession } = await import('./cli-auth.js');
+            const completeResult = await completeAuthSession(sessionId);
+            if (!completeResult.success) {
+                return {
+                    status: 400,
+                    body: {
+                        error: completeResult.error || 'Authentication failed',
+                    },
+                };
+            }
+            return { status: 200, body: { success: true, token: completeResult.token } };
+        });
         // Cancel auth session
         this.routes.set('POST /auth/cli/:provider/cancel/:sessionId', async (req) => {
             const { sessionId } = req.params;
@@ -326,6 +446,89 @@ export class DaemonApi extends EventEmitter {
             }
             return { status: 200, body: { success: true } };
         });
+        // Check if provider is authenticated (credentials exist)
+        this.routes.set('GET /auth/cli/:provider/check', async (req) => {
+            const { provider } = req.params;
+            const { checkProviderAuth } = await import('./cli-auth.js');
+            const authenticated = await checkProviderAuth(provider);
+            return { status: 200, body: { authenticated } };
+        });
+        // === Repository Management ===
+        // Dynamic repo management without workspace restart
+        // List all repos
+        this.routes.set('GET /repos', async () => {
+            try {
+                const repoManager = getRepoManager();
+                const repos = repoManager.getRepos();
+                return { status: 200, body: { repos } };
+            }
+            catch (err) {
+                logger.error('Failed to list repos', { error: String(err) });
+                return { status: 500, body: { error: 'Failed to list repositories' } };
+            }
+        });
+        // Get a specific repo
+        this.routes.set('GET /repos/:name', async (req) => {
+            try {
+                const repoManager = getRepoManager();
+                // Handle encoded slashes (e.g., "owner%2Frepo" -> "owner/repo")
+                const fullName = decodeURIComponent(req.params.name);
+                const repo = repoManager.getRepo(fullName);
+                if (!repo) {
+                    return { status: 404, body: { error: 'Repository not found' } };
+                }
+                return { status: 200, body: repo };
+            }
+            catch (err) {
+                logger.error('Failed to get repo', { error: String(err) });
+                return { status: 500, body: { error: 'Failed to get repository' } };
+            }
+        });
+        // Sync (clone or update) a repo
+        this.routes.set('POST /repos/sync', async (req) => {
+            const body = req.body;
+            // Support single repo or batch
+            const reposToSync = [];
+            if (body.repo) {
+                reposToSync.push(body.repo);
+            }
+            if (body.repos && Array.isArray(body.repos)) {
+                reposToSync.push(...body.repos);
+            }
+            if (reposToSync.length === 0) {
+                return { status: 400, body: { error: 'repo or repos field is required' } };
+            }
+            try {
+                const repoManager = getRepoManager();
+                const results = await repoManager.syncRepos(reposToSync);
+                const allSuccess = results.every(r => r.success);
+                return {
+                    status: allSuccess ? 200 : 207, // 207 Multi-Status if partial success
+                    body: { results },
+                };
+            }
+            catch (err) {
+                logger.error('Failed to sync repos', { error: String(err) });
+                return { status: 500, body: { error: 'Failed to sync repositories' } };
+            }
+        });
+        // Remove a repo
+        this.routes.set('DELETE /repos/:name', async (req) => {
+            try {
+                const repoManager = getRepoManager();
+                const fullName = decodeURIComponent(req.params.name);
+                const deleteFiles = req.query.deleteFiles === 'true';
+                const removed = await repoManager.removeRepo(fullName, deleteFiles);
+                if (!removed) {
+                    return { status: 404, body: { error: 'Repository not found' } };
+                }
+                return { status: 200, body: { success: true, deleted: deleteFiles } };
+            }
+            catch (err) {
+                logger.error('Failed to remove repo', { error: String(err) });
+                return { status: 500, body: { error: 'Failed to remove repository' } };
+            }
+        });
     }
     /**
      * Handle HTTP request
@@ -461,6 +664,12 @@ export class DaemonApi extends EventEmitter {
      */
     handleWebSocketConnection(ws, req) {
         logger.info('WebSocket client connected', { url: req.url });
+        // Mark client as alive for ping/pong keepalive
+        this.clientAlive.set(ws, true);
+        // Handle pong responses
+        ws.on('pong', () => {
+            this.clientAlive.set(ws, true);
+        });
         // Create session
         const session = {
             userId: 'anonymous', // Would be set from auth

package/dist/daemon/cli-auth.d.ts

@@ -20,6 +20,10 @@ interface AuthSession {
     refreshToken?: string;
     tokenExpiresAt?: Date;
     error?: string;
+    /** User-friendly hint for resolving the error */
+    errorHint?: string;
+    /** Whether the error can be resolved by retrying */
+    recoverable?: boolean;
     output: string;
     promptsHandled: string[];
     createdAt: Date;
@@ -44,9 +48,12 @@ export declare function getAuthSession(sessionId: string): AuthSession | null;
  * Submit auth code to a waiting session
  * This writes the code to the PTY process stdin
  *
+ * @param sessionId - The auth session ID
+ * @param code - The OAuth authorization code
+ * @param state - Optional OAuth state parameter for CSRF validation (used by Codex)
  * @returns Object with success status and optional error message
  */
-export declare function submitAuthCode(sessionId: string, code: string): Promise<{
+export declare function submitAuthCode(sessionId: string, code: string, state?: string): Promise<{
     success: boolean;
     error?: string;
     needsRestart?: boolean;
@@ -64,4 +71,9 @@ export declare function completeAuthSession(sessionId: string): Promise<{
  * Cancel auth session
  */
 export declare function cancelAuthSession(sessionId: string): boolean;
+/**
+ * Check if a provider is authenticated (credentials exist)
+ * Used by the auth check endpoint for SSH tunnel flow
+ */
+export declare function checkProviderAuth(provider: string): Promise<boolean>;
 //# sourceMappingURL=cli-auth.d.ts.map