agent-relay 1.2.3 → 1.3.0

package/dist/cloud/config.d.ts

@@ -4,6 +4,7 @@
 export interface CloudConfig {
     port: number;
     publicUrl: string;
+    appUrl: string;
     sessionSecret: string;
     databaseUrl: string;
     redisUrl: string;
@@ -38,6 +39,8 @@ export interface CloudConfig {
                 username: string;
                 password: string;
             };
+            snapshotRetentionDays?: number;
+            volumeSizeGb?: number;
         };
         railway?: {
             apiToken: string;
@@ -60,7 +63,12 @@ export interface CloudConfig {
             enterpriseYearly?: string;
         };
     };
+    adminUsers: string[];
 }
 export declare function loadConfig(): CloudConfig;
+/**
+ * Check if a GitHub username is an admin user
+ */
+export declare function isAdminUser(githubUsername: string): boolean;
 export declare function getConfig(): CloudConfig;
 //# sourceMappingURL=config.d.ts.map

package/dist/cloud/config.js

@@ -15,6 +15,7 @@ export function loadConfig() {
     return {
         port: parseInt(process.env.PORT || '4567', 10),
         publicUrl: process.env.PUBLIC_URL || 'http://localhost:4567',
+        appUrl: process.env.APP_URL || process.env.PUBLIC_URL || 'http://localhost:4567',
         sessionSecret: requireEnv('SESSION_SECRET'),
         databaseUrl: requireEnv('DATABASE_URL'),
         redisUrl: process.env.REDIS_URL || 'redis://localhost:6379',
@@ -54,6 +55,8 @@ export function loadConfig() {
                             password: optionalEnv('GHCR_TOKEN'),
                         }
                         : undefined,
+                    snapshotRetentionDays: parseInt(optionalEnv('FLY_SNAPSHOT_RETENTION_DAYS') || '14', 10),
+                    volumeSizeGb: parseInt(optionalEnv('FLY_VOLUME_SIZE_GB') || '10', 10),
                 }
                 : undefined,
             railway: optionalEnv('RAILWAY_API_TOKEN')
@@ -79,8 +82,20 @@ export function loadConfig() {
                 enterpriseYearly: optionalEnv('STRIPE_ENTERPRISE_YEARLY_PRICE_ID'),
             },
         },
+        // Admin users - comma-separated GitHub usernames (e.g., "khaliqgant,admin2")
+        adminUsers: (optionalEnv('ADMIN_USERS') || '')
+            .split(',')
+            .map((u) => u.trim().toLowerCase())
+            .filter(Boolean),
     };
 }
+/**
+ * Check if a GitHub username is an admin user
+ */
+export function isAdminUser(githubUsername) {
+    const config = getConfig();
+    return config.adminUsers.includes(githubUsername.toLowerCase());
+}
 // Singleton config instance
 let _config = null;
 export function getConfig() {

package/dist/cloud/db/drizzle.d.ts

@@ -18,6 +18,7 @@ export interface UserQueries {
     findByEmail(email: string): Promise<schema.User | null>;
     findByNangoConnectionId(connectionId: string): Promise<schema.User | null>;
     findByIncomingConnectionId(connectionId: string): Promise<schema.User | null>;
+    findByPlan(plan: string): Promise<schema.User[]>;
     upsert(data: schema.NewUser): Promise<schema.User>;
     update(id: string, data: Partial<Omit<schema.User, 'id' | 'createdAt'>>): Promise<void>;
     completeOnboarding(userId: string): Promise<void>;
@@ -43,7 +44,6 @@ export interface CredentialQueries {
     findByUserId(userId: string): Promise<schema.Credential[]>;
     findByUserAndProvider(userId: string, provider: string): Promise<schema.Credential | null>;
     upsert(data: schema.NewCredential): Promise<schema.Credential>;
-    updateTokens(userId: string, provider: string, accessToken: string, refreshToken?: string, expiresAt?: Date): Promise<void>;
     delete(userId: string, provider: string): Promise<void>;
 }
 export declare const credentialQueries: CredentialQueries;
@@ -51,7 +51,9 @@ export interface WorkspaceQueries {
     findById(id: string): Promise<schema.Workspace | null>;
     findByUserId(userId: string): Promise<schema.Workspace[]>;
     findByCustomDomain(domain: string): Promise<schema.Workspace | null>;
+    findAll(): Promise<schema.Workspace[]>;
     create(data: schema.NewWorkspace): Promise<schema.Workspace>;
+    update(id: string, data: Partial<Pick<schema.Workspace, 'name' | 'config'>>): Promise<void>;
     updateStatus(id: string, status: string, options?: {
         computeId?: string;
         publicUrl?: string;
@@ -137,11 +139,12 @@ export declare const projectGroupQueries: ProjectGroupQueries;
 export interface RepositoryQueries {
     findById(id: string): Promise<schema.Repository | null>;
     findByFullName(fullName: string): Promise<schema.Repository | null>;
+    findByGithubFullName(fullName: string): Promise<schema.Repository[]>;
     findByUserId(userId: string): Promise<schema.Repository[]>;
     findByWorkspaceId(workspaceId: string): Promise<schema.Repository[]>;
     findByProjectGroupId(projectGroupId: string): Promise<schema.Repository[]>;
     upsert(data: schema.NewRepository): Promise<schema.Repository>;
-    assignToWorkspace(repoId: string, workspaceId: string): Promise<void>;
+    assignToWorkspace(repoId: string, workspaceId: string | null): Promise<void>;
     assignToGroup(repoId: string, projectGroupId: string | null): Promise<void>;
     updateProjectAgent(id: string, config: schema.ProjectAgentConfig): Promise<void>;
     updateSyncStatus(id: string, status: string, lastSyncedAt?: Date): Promise<void>;

package/dist/cloud/db/drizzle.js

@@ -61,6 +61,11 @@ export const userQueries = {
         const result = await db.select().from(schema.users).where(eq(schema.users.incomingConnectionId, connectionId));
         return result[0] ?? null;
     },
+    async findByPlan(plan) {
+        const db = getDb();
+        const result = await db.select().from(schema.users).where(eq(schema.users.plan, plan));
+        return result;
+    },
     async upsert(data) {
         const db = getDb();
         const result = await db
@@ -214,9 +219,6 @@ export const credentialQueries = {
             .onConflictDoUpdate({
             target: [schema.credentials.userId, schema.credentials.provider],
             set: {
-                accessToken: data.accessToken,
-                refreshToken: data.refreshToken ?? sql `credentials.refresh_token`,
-                tokenExpiresAt: data.tokenExpiresAt,
                 scopes: data.scopes,
                 providerAccountId: data.providerAccountId,
                 providerAccountEmail: data.providerAccountEmail,
@@ -226,23 +228,6 @@ export const credentialQueries = {
             .returning();
         return result[0];
     },
-    async updateTokens(userId, provider, accessToken, refreshToken, expiresAt) {
-        const db = getDb();
-        const updates = {
-            accessToken,
-            updatedAt: new Date(),
-        };
-        if (refreshToken !== undefined) {
-            updates.refreshToken = refreshToken;
-        }
-        if (expiresAt !== undefined) {
-            updates.tokenExpiresAt = expiresAt;
-        }
-        await db
-            .update(schema.credentials)
-            .set(updates)
-            .where(and(eq(schema.credentials.userId, userId), eq(schema.credentials.provider, provider)));
-    },
     async delete(userId, provider) {
         const db = getDb();
         await db
@@ -272,11 +257,25 @@ export const workspaceQueries = {
             .where(eq(schema.workspaces.customDomain, domain));
         return result[0] ?? null;
     },
+    async findAll() {
+        const db = getDb();
+        return db
+            .select()
+            .from(schema.workspaces)
+            .orderBy(desc(schema.workspaces.createdAt));
+    },
     async create(data) {
         const db = getDb();
         const result = await db.insert(schema.workspaces).values(data).returning();
         return result[0];
     },
+    async update(id, data) {
+        const db = getDb();
+        await db
+            .update(schema.workspaces)
+            .set({ ...data, updatedAt: new Date() })
+            .where(eq(schema.workspaces.id, id));
+    },
     async updateStatus(id, status, options) {
         const db = getDb();
         await db
@@ -652,6 +651,14 @@ export const repositoryQueries = {
             .where(eq(schema.repositories.githubFullName, fullName));
         return result[0] ?? null;
     },
+    async findByGithubFullName(fullName) {
+        const db = getDb();
+        // Use case-insensitive match since GitHub repo names are case-insensitive
+        return db
+            .select()
+            .from(schema.repositories)
+            .where(sql `LOWER(${schema.repositories.githubFullName}) = LOWER(${fullName})`);
+    },
     async findByUserId(userId) {
         const db = getDb();
         return db

package/dist/cloud/db/schema.d.ts

@@ -121,6 +121,25 @@ export declare const users: import("drizzle-orm/pg-core").PgTableWithColumns<{
         }, {}, {
             length: 50;
         }>;
+        stripeCustomerId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "stripe_customer_id";
+            tableName: "users";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
         nangoConnectionId: import("drizzle-orm/pg-core").PgColumn<{
             name: "nango_connection_id";
             tableName: "users";
@@ -565,57 +584,6 @@ export declare const credentials: import("drizzle-orm/pg-core").PgTableWithColum
         }, {}, {
             length: 50;
         }>;
-        accessToken: import("drizzle-orm/pg-core").PgColumn<{
-            name: "access_token";
-            tableName: "credentials";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        refreshToken: import("drizzle-orm/pg-core").PgColumn<{
-            name: "refresh_token";
-            tableName: "credentials";
-            dataType: "string";
-            columnType: "PgText";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: [string, ...string[]];
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        tokenExpiresAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "token_expires_at";
-            tableName: "credentials";
-            dataType: "date";
-            columnType: "PgTimestamp";
-            data: Date;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
         scopes: import("drizzle-orm/pg-core").PgColumn<{
             name: "scopes";
             tableName: "credentials";

package/dist/cloud/db/schema.js

@@ -17,6 +17,8 @@ export const users = pgTable('users', {
     email: varchar('email', { length: 255 }),
     avatarUrl: varchar('avatar_url', { length: 512 }),
     plan: varchar('plan', { length: 50 }).notNull().default('free'),
+    // Stripe billing
+    stripeCustomerId: varchar('stripe_customer_id', { length: 255 }),
     // Nango OAuth connections
     nangoConnectionId: varchar('nango_connection_id', { length: 255 }), // Permanent login connection
     incomingConnectionId: varchar('incoming_connection_id', { length: 255 }), // Temp polling connection
@@ -68,15 +70,14 @@ export const githubInstallationsRelations = relations(githubInstallations, ({ on
     repositories: many(repositories),
 }));
 // ============================================================================
-// Credentials (provider tokens)
+// Credentials (connected provider registry - no token storage)
+// Note: Tokens are not stored centrally. CLI tools authenticate directly
+// on workspace instances. This table tracks which providers a user has connected.
 // ============================================================================
 export const credentials = pgTable('credentials', {
     id: uuid('id').primaryKey().defaultRandom(),
     userId: uuid('user_id').notNull().references(() => users.id, { onDelete: 'cascade' }),
     provider: varchar('provider', { length: 50 }).notNull(),
-    accessToken: text('access_token').notNull(),
-    refreshToken: text('refresh_token'),
-    tokenExpiresAt: timestamp('token_expires_at'),
     scopes: text('scopes').array(),
     providerAccountId: varchar('provider_account_id', { length: 255 }),
     providerAccountEmail: varchar('provider_account_email', { length: 255 }),

package/dist/cloud/index.d.ts

@@ -5,7 +5,6 @@
  */
 export { createServer } from './server.js';
 export { getConfig, loadConfig, CloudConfig } from './config.js';
-export { CredentialVault } from './vault/index.js';
 export { WorkspaceProvisioner, ProvisionConfig, Workspace, WorkspaceStatus } from './provisioner/index.js';
 export { ScalingPolicyService, ScalingThresholds, ScalingPolicy, ScalingDecision, WorkspaceMetrics, getScalingPolicyService, AutoScaler, ScalingOperation, getAutoScaler, createAutoScaler, CapacityManager, WorkspaceCapacity, PlacementRecommendation, CapacityForecast, getCapacityManager, createCapacityManager, ScalingOrchestrator, ScalingEvent, getScalingOrchestrator, createScalingOrchestrator, } from './services/index.js';
 export * from './billing/index.js';

package/dist/cloud/index.js

@@ -7,7 +7,6 @@ import { fileURLToPath } from 'node:url';
 export { createServer } from './server.js';
 export { getConfig, loadConfig } from './config.js';
 // Services
-export { CredentialVault } from './vault/index.js';
 export { WorkspaceProvisioner } from './provisioner/index.js';
 // Scaling infrastructure
 export { ScalingPolicyService, getScalingPolicyService, AutoScaler, getAutoScaler, createAutoScaler, CapacityManager, getCapacityManager, createCapacityManager, ScalingOrchestrator, getScalingOrchestrator, createScalingOrchestrator, } from './services/index.js';

package/dist/cloud/provisioner/index.d.ts

@@ -76,8 +76,9 @@ export declare class WorkspaceProvisioner {
     stop(workspaceId: string): Promise<void>;
     /**
      * Resize a workspace (vertical scaling)
+     * @param skipRestart - If true, config is saved but machine won't restart (changes apply on next start)
      */
-    resize(workspaceId: string, tier: ResourceTier): Promise<void>;
+    resize(workspaceId: string, tier: ResourceTier, skipRestart?: boolean): Promise<void>;
     /**
      * Update the max agent limit for a workspace
      */
@@ -102,6 +103,97 @@ export declare class WorkspaceProvisioner {
         currentTier?: string;
         targetTier?: string;
     }>;
+    /**
+     * Create an on-demand snapshot of a workspace's volume
+     * Use before risky operations (e.g., major refactors, untrusted code execution)
+     */
+    createSnapshot(workspaceId: string): Promise<{
+        snapshotId: string;
+    } | null>;
+    /**
+     * List available snapshots for a workspace
+     * Includes both automatic daily snapshots and on-demand snapshots
+     */
+    listSnapshots(workspaceId: string): Promise<Array<{
+        id: string;
+        createdAt: string;
+        sizeBytes: number;
+    }>>;
+    /**
+     * Get the volume ID for a workspace (needed for restore operations)
+     */
+    getVolumeId(workspaceId: string): Promise<string | null>;
+    /**
+     * Result of a graceful update attempt
+     */
+    static readonly UpdateResult: {
+        readonly UPDATED: "updated";
+        readonly UPDATED_PENDING_RESTART: "updated_pending_restart";
+        readonly SKIPPED_ACTIVE_AGENTS: "skipped_active_agents";
+        readonly SKIPPED_NOT_RUNNING: "skipped_not_running";
+        readonly NOT_SUPPORTED: "not_supported";
+        readonly ERROR: "error";
+    };
+    /**
+     * Gracefully update a single workspace's image
+     *
+     * Behavior:
+     * - If workspace is stopped: Update config, will use new image on next wake
+     * - If workspace is running with no agents: Update config and restart
+     * - If workspace is running with active agents: Skip (or force if specified)
+     *
+     * @param workspaceId - Workspace to update
+     * @param newImage - New Docker image to use
+     * @param options - Update options
+     * @returns Update result with details
+     */
+    gracefulUpdateImage(workspaceId: string, newImage: string, options?: {
+        force?: boolean;
+        skipRestart?: boolean;
+    }): Promise<{
+        result: string;
+        workspaceId: string;
+        machineState?: string;
+        agentCount?: number;
+        agents?: Array<{
+            name: string;
+            status: string;
+        }>;
+        error?: string;
+    }>;
+    /**
+     * Gracefully update all workspaces to a new image
+     *
+     * Processes workspaces in batches, respecting active agents unless forced.
+     * Returns detailed results for each workspace.
+     *
+     * @param newImage - New Docker image to use
+     * @param options - Update options
+     * @returns Summary and per-workspace results
+     */
+    gracefulUpdateAllImages(newImage: string, options?: {
+        force?: boolean;
+        skipRestart?: boolean;
+        batchSize?: number;
+        userIds?: string[];
+        workspaceIds?: string[];
+    }): Promise<{
+        summary: {
+            total: number;
+            updated: number;
+            pendingRestart: number;
+            skippedActiveAgents: number;
+            skippedNotRunning: number;
+            errors: number;
+        };
+        results: Array<{
+            result: string;
+            workspaceId: string;
+            machineState?: string;
+            agentCount?: number;
+            error?: string;
+        }>;
+    }>;
 }
 export declare function getProvisioner(): WorkspaceProvisioner;
 //# sourceMappingURL=index.d.ts.map