agent-relay 1.2.0 → 1.3.0

package/dist/daemon/cli-auth.js

@@ -9,7 +9,7 @@ import * as crypto from 'crypto';
 import * as fs from 'fs/promises';
 import * as os from 'os';
 import { createLogger } from '../resiliency/logger.js';
-import { CLI_AUTH_CONFIG, stripAnsiCodes, matchesSuccessPattern, findMatchingPrompt, getSupportedProviders, } from '../shared/cli-auth-config.js';
+import { CLI_AUTH_CONFIG, stripAnsiCodes, matchesSuccessPattern, findMatchingPrompt, findMatchingError, getSupportedProviders, } from '../shared/cli-auth-config.js';
 const logger = createLogger('cli-auth');
 // Re-export for consumers
 export { CLI_AUTH_CONFIG, getSupportedProviders };
@@ -123,46 +123,49 @@ export async function startCLIAuth(provider, options = {}) {
                 session.error = 'Timeout waiting for auth completion (5 minutes). Please try again.';
             }
         }, config.waitTimeout + OAUTH_COMPLETION_TIMEOUT);
-        // Keep-alive: Some CLIs timeout if they don't receive stdin input
-        // Send a space+backspace every 20 seconds to simulate user presence
-        const keepAliveInterval = setInterval(() => {
-            if (session.status === 'waiting_auth' && session.process) {
-                try {
-                    // Send space then backspace - appears as user typing but no net effect
-                    session.process.write(' \b');
-                    logger.debug('Keep-alive ping sent', {
-                        sessionId,
-                        status: session.status,
-                        ageSeconds: Math.round((Date.now() - session.createdAt.getTime()) / 1000),
-                    });
-                }
-                catch {
-                    // Process may have exited
-                }
-            }
-        }, 20000);
+        // Note: Removed keep-alive mechanism that sent ' \b' every 20 seconds
+        // It was interfering with OAuth code paste, causing "invalid code" errors
+        // CLIs like Claude don't actually need stdin keep-alive during auth wait
         proc.onData((data) => {
             session.output += data;
-            // Handle prompts
-            const matchingPrompt = findMatchingPrompt(data, config.prompts, respondedPrompts);
-            if (matchingPrompt) {
-                respondedPrompts.add(matchingPrompt.description);
-                session.promptsHandled.push(matchingPrompt.description);
-                logger.info('Auto-responding to prompt', { description: matchingPrompt.description });
-                const delay = matchingPrompt.delay ?? 100;
-                setTimeout(() => {
-                    try {
-                        proc.write(matchingPrompt.response);
-                    }
-                    catch {
-                        // Process may have exited
-                    }
-                }, delay);
-            }
-            // Extract auth URL
             const cleanText = stripAnsiCodes(data);
+            // Check for error patterns FIRST - if error detected, don't auto-respond to prompts
+            // This prevents us from auto-responding to "Press Enter to retry" in error messages
+            const matchedError = findMatchingError(data, config.errorPatterns);
+            if (matchedError && session.status !== 'error') {
+                logger.warn('Auth error detected', {
+                    provider,
+                    sessionId,
+                    errorMessage: matchedError.message,
+                    recoverable: matchedError.recoverable,
+                });
+                session.status = 'error';
+                session.error = matchedError.message;
+                session.errorHint = matchedError.hint;
+                session.recoverable = matchedError.recoverable;
+            }
+            // Don't auto-respond to prompts if we're in error state
+            // This prevents responding to "Press Enter to retry" after an error
+            if (session.status !== 'error') {
+                const matchingPrompt = findMatchingPrompt(data, config.prompts, respondedPrompts);
+                if (matchingPrompt) {
+                    respondedPrompts.add(matchingPrompt.description);
+                    session.promptsHandled.push(matchingPrompt.description);
+                    logger.info('Auto-responding to prompt', { description: matchingPrompt.description });
+                    const delay = matchingPrompt.delay ?? 100;
+                    setTimeout(() => {
+                        try {
+                            proc.write(matchingPrompt.response);
+                        }
+                        catch {
+                            // Process may have exited
+                        }
+                    }, delay);
+                }
+            }
+            // Extract auth URL (only if not in error state and don't have URL yet)
             const match = cleanText.match(config.urlPattern);
-            if (match && match[1] && !session.authUrl) {
+            if (match && match[1] && !session.authUrl && session.status !== 'error') {
                 session.authUrl = match[1];
                 session.status = 'waiting_auth';
                 logger.info('Auth URL captured', { provider, url: session.authUrl });
@@ -172,7 +175,7 @@ export async function startCLIAuth(provider, options = {}) {
             }
             // Log all output after auth URL is captured (for debugging)
             if (session.authUrl) {
-                const trimmedData = stripAnsiCodes(data).trim();
+                const trimmedData = cleanText.trim();
                 if (trimmedData.length > 0) {
                     logger.info('PTY output after auth URL', {
                         provider,
@@ -182,12 +185,18 @@ export async function startCLIAuth(provider, options = {}) {
                 }
             }
             // Check for success and try to extract credentials
-            if (matchesSuccessPattern(data, config.successPatterns)) {
+            // Don't override error status - if there was an error, keep it
+            if (session.status !== 'error' && matchesSuccessPattern(data, config.successPatterns)) {
                 session.status = 'success';
                 logger.info('Success pattern detected, attempting credential extraction', { provider });
                 // Try to extract credentials immediately (CLI may not exit after success)
                 // Use a small delay to let the CLI finish writing the file
                 setTimeout(async () => {
+                    // Don't extract if status changed to error (e.g., error detected after success pattern)
+                    if (session.status === 'error') {
+                        logger.info('Skipping credential extraction - session is in error state', { provider });
+                        return;
+                    }
                     try {
                         const creds = await extractCredentials(provider, config);
                         if (creds) {
@@ -206,7 +215,6 @@ export async function startCLIAuth(provider, options = {}) {
         proc.onExit(async ({ exitCode }) => {
             clearTimeout(timeout);
             clearTimeout(authUrlTimeout);
-            clearInterval(keepAliveInterval);
             // Clear process reference so submitAuthCode knows PTY is gone
             session.process = undefined;
             // Log full output for debugging PTY exit issues
@@ -221,8 +229,9 @@ export async function startCLIAuth(provider, options = {}) {
                 // Last 500 chars of output for debugging
                 outputTail: cleanOutput.slice(-500),
             });
-            // Try to extract credentials
-            if (session.authUrl || exitCode === 0) {
+            // Try to extract credentials (but don't override error status)
+            // CLI might exit cleanly (code 0) even after an OAuth error
+            if ((session.authUrl || exitCode === 0) && session.status !== 'error') {
                 try {
                     const creds = await extractCredentials(provider, config);
                     if (creds) {
@@ -265,9 +274,12 @@ export function getAuthSession(sessionId) {
  * Submit auth code to a waiting session
  * This writes the code to the PTY process stdin
  *
+ * @param sessionId - The auth session ID
+ * @param code - The OAuth authorization code
+ * @param state - Optional OAuth state parameter for CSRF validation (used by Codex)
  * @returns Object with success status and optional error message
  */
-export async function submitAuthCode(sessionId, code) {
+export async function submitAuthCode(sessionId, code, state) {
     // Log all active sessions for debugging
     const activeSessionIds = Array.from(sessions.keys());
     logger.info('submitAuthCode called', {
@@ -305,11 +317,14 @@ export async function submitAuthCode(sessionId, code) {
             outputTail: session.output ? stripAnsiCodes(session.output).slice(-500) : 'no output',
         });
         // Try to extract credentials as a fallback - maybe auth completed in browser
+        // But don't override error status
         const config = CLI_AUTH_CONFIG[session.provider];
-        if (config) {
+        if (config && session.status !== 'error') {
             try {
                 const creds = await extractCredentials(session.provider, config);
-                if (creds) {
+                // Re-check status after async operation (race condition protection)
+                // Use type assertion because TypeScript narrowing doesn't account for async race conditions
+                if (creds && session.status !== 'error') {
                     session.token = creds.token;
                     session.refreshToken = creds.refreshToken;
                     session.tokenExpiresAt = creds.expiresAt;
@@ -331,8 +346,78 @@ export async function submitAuthCode(sessionId, code) {
         };
     }
     try {
-        // Clean the code - trim whitespace
-        const cleanCode = code.trim();
+        // Clean the code - trim whitespace and strip state parameter if present
+        // Claude OAuth codes come as "CODE#STATE" - we only need the code part
+        let cleanCode = code.trim();
+        if (cleanCode.includes('#')) {
+            const originalCode = cleanCode;
+            cleanCode = cleanCode.split('#')[0];
+            logger.info('Stripped state parameter from auth code', {
+                sessionId,
+                originalLength: originalCode.length,
+                cleanLength: cleanCode.length,
+            });
+        }
+        // For Codex (openai), forward the callback to the CLI's localhost server
+        // instead of writing to PTY stdin. The CLI spawns a localhost server
+        // waiting for the OAuth callback.
+        if (session.provider === 'openai' && session.authUrl) {
+            // Extract the redirect port from the auth URL (usually 1455)
+            const redirectMatch = session.authUrl.match(/redirect_uri=http%3A%2F%2Flocalhost%3A(\d+)/);
+            const port = redirectMatch ? redirectMatch[1] : '1455';
+            logger.info('Forwarding OAuth callback to Codex CLI localhost server', {
+                sessionId,
+                port,
+                codeLength: cleanCode.length,
+                hasState: !!state,
+            });
+            try {
+                // Forward the callback to the CLI's localhost server
+                // Include state parameter for CSRF validation if provided
+                let callbackUrl = `http://localhost:${port}/auth/callback?code=${encodeURIComponent(cleanCode)}`;
+                if (state) {
+                    callbackUrl += `&state=${encodeURIComponent(state)}`;
+                }
+                const response = await fetch(callbackUrl, {
+                    method: 'GET',
+                    signal: AbortSignal.timeout(5000),
+                });
+                if (response.ok) {
+                    logger.info('OAuth callback forwarded successfully to Codex CLI', { sessionId, status: response.status });
+                    // Start polling for credentials
+                    const config = CLI_AUTH_CONFIG[session.provider];
+                    if (config) {
+                        pollForCredentials(session, config);
+                    }
+                    return { success: true };
+                }
+                else {
+                    // Try to get error details from response body
+                    let errorBody = '';
+                    try {
+                        errorBody = await response.text();
+                    }
+                    catch {
+                        // Ignore
+                    }
+                    logger.warn('Codex CLI localhost server returned error', {
+                        sessionId,
+                        status: response.status,
+                        statusText: response.statusText,
+                        errorBody: errorBody.substring(0, 500), // Limit log size
+                        callbackUrl: callbackUrl.replace(/code=[^&]+/, 'code=***'), // Redact code
+                    });
+                    // Fall through to PTY write as fallback
+                }
+            }
+            catch (err) {
+                logger.warn('Failed to forward callback to Codex CLI localhost server', {
+                    sessionId,
+                    error: String(err),
+                });
+                // Fall through to PTY write as fallback
+            }
+        }
         logger.info('Writing auth code to PTY', {
             sessionId,
             originalLength: code.length,
@@ -382,6 +467,14 @@ async function pollForCredentials(session, config) {
         try {
             const creds = await extractCredentials(session.provider, config);
             if (creds) {
+                // Double-check we're not in error state (race condition protection)
+                // Use type assertion because TypeScript narrowing doesn't account for async race conditions
+                if (session.status === 'error') {
+                    logger.info('Credentials found but session is in error state, not overriding', {
+                        provider: session.provider,
+                    });
+                    return;
+                }
                 session.token = creds.token;
                 session.refreshToken = creds.refreshToken;
                 session.tokenExpiresAt = creds.expiresAt;
@@ -424,9 +517,18 @@ export async function completeAuthSession(sessionId) {
     const maxAttempts = 15;
     const pollInterval = 1000;
     for (let i = 0; i < maxAttempts; i++) {
+        // Check if session went into error state
+        if (session.status === 'error') {
+            return { success: false, error: session.error || 'Authentication failed' };
+        }
         try {
             const creds = await extractCredentials(session.provider, config);
             if (creds) {
+                // Double-check we're not in error state (race condition protection)
+                // Use type assertion because TypeScript narrowing doesn't account for async race conditions
+                if (session.status === 'error') {
+                    return { success: false, error: session.error || 'Authentication failed' };
+                }
                 session.token = creds.token;
                 session.refreshToken = creds.refreshToken;
                 session.tokenExpiresAt = creds.expiresAt;
@@ -534,4 +636,21 @@ async function extractCredentials(provider, config) {
         return null;
     }
 }
+/**
+ * Check if a provider is authenticated (credentials exist)
+ * Used by the auth check endpoint for SSH tunnel flow
+ */
+export async function checkProviderAuth(provider) {
+    const config = CLI_AUTH_CONFIG[provider];
+    if (!config) {
+        return false;
+    }
+    try {
+        const creds = await extractCredentials(provider, config);
+        return !!creds?.token;
+    }
+    catch {
+        return false;
+    }
+}
 //# sourceMappingURL=cli-auth.js.map

package/dist/daemon/connection.d.ts

@@ -8,7 +8,7 @@
  *                   ERROR -------> CLOSED
  */
 import net from 'node:net';
-import { type Envelope, type AckPayload } from '../protocol/types.js';
+import { type Envelope, type AckPayload, type EntityType } from '../protocol/types.js';
 export type ConnectionState = 'CONNECTING' | 'HANDSHAKING' | 'ACTIVE' | 'CLOSING' | 'CLOSED' | 'ERROR';
 export interface ConnectionConfig {
     maxFrameBytes: number;
@@ -39,11 +39,14 @@ export declare class Connection {
     private config;
     private _state;
     private _agentName?;
+    private _entityType?;
     private _cli?;
     private _program?;
     private _model?;
     private _task?;
     private _workingDirectory?;
+    private _displayName?;
+    private _avatarUrl?;
     private _sessionId;
     private _resumeToken;
     private _isResumed;
@@ -59,11 +62,14 @@ export declare class Connection {
     constructor(socket: net.Socket, config?: Partial<ConnectionConfig>);
     get state(): ConnectionState;
     get agentName(): string | undefined;
+    get entityType(): EntityType | undefined;
     get cli(): string | undefined;
     get program(): string | undefined;
     get model(): string | undefined;
     get task(): string | undefined;
     get workingDirectory(): string | undefined;
+    get displayName(): string | undefined;
+    get avatarUrl(): string | undefined;
     get sessionId(): string;
     get resumeToken(): string;
     get isResumed(): boolean;

package/dist/daemon/connection.js

@@ -23,11 +23,14 @@ export class Connection {
     config;
     _state = 'CONNECTING';
     _agentName;
+    _entityType;
     _cli;
     _program;
     _model;
     _task;
     _workingDirectory;
+    _displayName;
+    _avatarUrl;
     _sessionId;
     _resumeToken;
     _isResumed = false;
@@ -58,6 +61,9 @@ export class Connection {
     get agentName() {
         return this._agentName;
     }
+    get entityType() {
+        return this._entityType;
+    }
     get cli() {
         return this._cli;
     }
@@ -73,6 +79,12 @@ export class Connection {
     get workingDirectory() {
         return this._workingDirectory;
     }
+    get displayName() {
+        return this._displayName;
+    }
+    get avatarUrl() {
+        return this._avatarUrl;
+    }
     get sessionId() {
         return this._sessionId;
     }
@@ -133,11 +145,14 @@ export class Connection {
             return;
         }
         this._agentName = envelope.payload.agent;
+        this._entityType = envelope.payload.entityType;
         this._cli = envelope.payload.cli;
         this._program = envelope.payload.program;
         this._model = envelope.payload.model;
         this._task = envelope.payload.task;
         this._workingDirectory = envelope.payload.workingDirectory;
+        this._displayName = envelope.payload.displayName;
+        this._avatarUrl = envelope.payload.avatarUrl;
         // Check for session resume
         const resumeToken = envelope.payload.session?.resume_token;
         if (resumeToken) {

package/dist/daemon/orchestrator.d.ts

@@ -26,6 +26,8 @@ export declare class Orchestrator extends EventEmitter {
     private sessions;
     private supervisor;
     private workspacesFile;
+    private clientAlive;
+    private pingInterval?;
     constructor(config?: Partial<OrchestratorConfig>);
     /**
      * Start the orchestrator

package/dist/daemon/orchestrator.js

@@ -39,6 +39,9 @@ export class Orchestrator extends EventEmitter {
         contextPersistence: { enabled: true, autoInjectOnRestart: true },
     });
     workspacesFile;
+    // Track alive status for ping/pong keepalive
+    clientAlive = new WeakMap();
+    pingInterval;
     constructor(config = {}) {
         super();
         this.config = { ...DEFAULT_CONFIG, ...config };
@@ -73,6 +76,18 @@ export class Orchestrator extends EventEmitter {
         // Setup WebSocket
         this.wss = new WebSocketServer({ server: this.server });
         this.wss.on('connection', (ws, req) => this.handleWebSocket(ws, req));
+        // Setup ping/pong keepalive (30 second interval)
+        this.pingInterval = setInterval(() => {
+            this.wss?.clients.forEach((ws) => {
+                if (this.clientAlive.get(ws) === false) {
+                    logger.info('WebSocket client unresponsive, closing');
+                    ws.terminate();
+                    return;
+                }
+                this.clientAlive.set(ws, false);
+                ws.ping();
+            });
+        }, 30000);
         return new Promise((resolve) => {
             this.server.listen(this.config.port, this.config.host, () => {
                 logger.info('Orchestrator started', {
@@ -87,6 +102,11 @@ export class Orchestrator extends EventEmitter {
      */
     async stop() {
         logger.info('Stopping orchestrator');
+        // Clear ping interval
+        if (this.pingInterval) {
+            clearInterval(this.pingInterval);
+            this.pingInterval = undefined;
+        }
         // Stop all workspace daemons
         for (const [id] of this.workspaces) {
             await this.stopWorkspaceDaemon(id);
@@ -501,6 +521,12 @@ export class Orchestrator extends EventEmitter {
      */
     handleWebSocket(ws, _req) {
         logger.info('WebSocket client connected');
+        // Mark client as alive for ping/pong keepalive
+        this.clientAlive.set(ws, true);
+        // Handle pong responses
+        ws.on('pong', () => {
+            this.clientAlive.set(ws, true);
+        });
         const session = {
             userId: 'anonymous',
             githubUsername: 'anonymous',

package/dist/daemon/repo-manager.d.ts

@@ -0,0 +1,116 @@
+/**
+ * Workspace Repository Manager
+ *
+ * Manages repository cloning, updating, and removal for workspace containers.
+ * Uses a file-based tracking system (repos.json) to persist state across restarts.
+ *
+ * This replaces the static REPOSITORIES env var approach, allowing dynamic
+ * repo management without workspace restart.
+ */
+import { EventEmitter } from 'events';
+export interface RepoInfo {
+    /** Full GitHub repo name (e.g., "owner/repo") */
+    fullName: string;
+    /** Local directory name */
+    localName: string;
+    /** Absolute path to the cloned repo */
+    path: string;
+    /** Current status */
+    status: 'cloned' | 'cloning' | 'error' | 'removed';
+    /** Last sync timestamp */
+    lastSynced?: string;
+    /** Default branch */
+    defaultBranch?: string;
+    /** Error message if status is 'error' */
+    error?: string;
+    /** When the repo was added */
+    addedAt: string;
+}
+export interface ReposConfig {
+    version: number;
+    workspaceDir: string;
+    repos: Record<string, RepoInfo>;
+    lastUpdated: string;
+}
+export interface SyncResult {
+    success: boolean;
+    repo: string;
+    action: 'cloned' | 'updated' | 'already_synced' | 'error';
+    path?: string;
+    error?: string;
+}
+export interface RepoManagerConfig {
+    workspaceDir: string;
+    configFile?: string;
+}
+export declare class RepoManager extends EventEmitter {
+    private workspaceDir;
+    private configPath;
+    private config;
+    constructor(options: RepoManagerConfig);
+    /**
+     * Load or initialize the repos config file
+     */
+    private loadConfig;
+    /**
+     * Save the config to disk
+     */
+    private saveConfig;
+    /**
+     * Get all tracked repos
+     */
+    getRepos(): RepoInfo[];
+    /**
+     * Get a specific repo by full name
+     */
+    getRepo(fullName: string): RepoInfo | null;
+    /**
+     * Sync a repository (clone if new, pull if exists)
+     */
+    syncRepo(fullName: string): Promise<SyncResult>;
+    /**
+     * Remove a repository
+     */
+    removeRepo(fullName: string, deleteFiles?: boolean): Promise<boolean>;
+    /**
+     * Sync multiple repos (e.g., from initial REPOSITORIES env var)
+     */
+    syncRepos(fullNames: string[]): Promise<SyncResult[]>;
+    /**
+     * Initialize from REPOSITORIES env var (backward compatibility)
+     */
+    initFromEnv(): Promise<SyncResult[]>;
+    /**
+     * Scan workspace directory for existing repos and register them
+     * This handles repos that were cloned by entrypoint.sh before daemon started
+     */
+    scanExistingRepos(): void;
+    /**
+     * Clone a repository
+     */
+    private gitClone;
+    /**
+     * Pull updates for a repository
+     */
+    private gitPull;
+    /**
+     * Get the default branch of a repo
+     */
+    private getDefaultBranch;
+    /**
+     * Mark directory as safe for git (prevents "dubious ownership" errors)
+     */
+    private markSafeDirectory;
+}
+/**
+ * Get or create the repo manager instance
+ */
+export declare function getRepoManager(workspaceDir?: string): RepoManager;
+/**
+ * Initialize repo manager (call at startup)
+ *
+ * 1. Scans workspace for existing repos (handles entrypoint.sh clones)
+ * 2. Syncs any repos from REPOSITORIES env var that aren't already cloned
+ */
+export declare function initRepoManager(workspaceDir?: string): Promise<RepoManager>;
+//# sourceMappingURL=repo-manager.d.ts.map