agent-relay 1.3.0 → 1.3.2

package/dist/bridge/spawner.d.ts

@@ -23,6 +23,8 @@ interface WorkerMeta {
     task: string;
     /** Optional team name this agent belongs to */
     team?: string;
+    /** Optional user ID for per-user credential scoping */
+    userId?: string;
     spawnedAt: number;
     pid?: number;
     logFile?: string;

package/dist/bridge/spawner.js

@@ -12,6 +12,7 @@ import { PtyWrapper } from '../wrapper/pty-wrapper.js';
 import { selectShadowCli } from './shadow-cli.js';
 import { AgentPolicyService } from '../policy/agent-policy.js';
 import { buildClaudeArgs } from '../utils/agent-config.js';
+import { getUserDirectoryService } from '../daemon/user-directory.js';
 /**
  * Get a minimal relay reminder.
  * Agents already have full relay docs via CLAUDE.md - this is just a brief reminder.
@@ -150,7 +151,7 @@ export class AgentSpawner {
      * Spawn a new worker agent using node-pty
      */
     async spawn(request) {
-        const { name, cli, task, team, spawnerName } = request;
+        const { name, cli, task, team, spawnerName, userId } = request;
         const debug = process.env.DEBUG_SPAWN === '1';
         // Check if worker already exists
         if (this.activeWorkers.has(name)) {
@@ -219,6 +220,19 @@ export class AgentSpawner {
             const agentCwd = request.cwd || this.projectRoot;
             // Log whether nested spawning will be enabled for this agent
             console.log(`[spawner] Spawning ${name}: dashboardPort=${this.dashboardPort || 'none'} (${this.dashboardPort ? 'nested spawns enabled' : 'nested spawns disabled'})`);
+            let userEnv;
+            if (userId) {
+                try {
+                    const userDirService = getUserDirectoryService();
+                    userEnv = userDirService.getUserEnvironment(userId);
+                }
+                catch (err) {
+                    console.warn('[spawner] Failed to resolve user environment, using default', {
+                        userId,
+                        error: err instanceof Error ? err.message : String(err),
+                    });
+                }
+            }
             const ptyConfig = {
                 name,
                 command,
@@ -227,6 +241,7 @@ export class AgentSpawner {
                 cwd: agentCwd,
                 logsDir: this.logsDir,
                 dashboardPort: this.dashboardPort,
+                env: userEnv,
                 // Interactive mode - disables auto-accept for auth setup flows
                 interactive: request.interactive,
                 // Shadow agent configuration
@@ -242,6 +257,7 @@ export class AgentSpawner {
                         cli: workerCli,
                         task: workerTask,
                         // Nested spawns don't inherit team - they're flat by default
+                        userId,
                     });
                 },
                 onRelease: this.dashboardPort ? undefined : async (workerName) => {
@@ -386,6 +402,7 @@ export class AgentSpawner {
                 cli,
                 task,
                 team,
+                userId,
                 spawnedAt: Date.now(),
                 pid: pty.pid,
                 pty,
@@ -674,6 +691,7 @@ export class AgentSpawner {
                 cli: w.cli,
                 task: w.task,
                 team: w.team,
+                userId: w.userId,
                 spawnedAt: w.spawnedAt,
                 pid: w.pid,
                 logFile: w.logFile,

package/dist/bridge/types.d.ts

@@ -53,6 +53,8 @@ export interface SpawnRequest {
     shadowTriggers?: Array<'SESSION_END' | 'CODE_WRITTEN' | 'REVIEW_REQUEST' | 'EXPLICIT_ASK' | 'ALL_MESSAGES'>;
     /** When the shadow should speak (default: ['EXPLICIT_ASK']) */
     shadowSpeakOn?: Array<'SESSION_END' | 'CODE_WRITTEN' | 'REVIEW_REQUEST' | 'EXPLICIT_ASK' | 'ALL_MESSAGES'>;
+    /** User ID for per-user credential storage in shared workspaces */
+    userId?: string;
 }
 /** Policy decision details */
 export interface PolicyDecision {

package/dist/cli/index.d.ts

@@ -5,7 +5,7 @@
  * Commands:
  *   relay <cmd>         - Wrap agent with real-time messaging (default)
  *   relay -n Name cmd   - Wrap with specific agent name
- *   relay up            - Start daemon + dashboard
+ *   relay up            - Start daemon
  *   relay read <id>     - Read full message by ID
  *   relay agents        - List connected agents
  *   relay who           - Show currently active agents

package/dist/cli/index.js

@@ -5,7 +5,7 @@
  * Commands:
  *   relay <cmd>         - Wrap agent with real-time messaging (default)
  *   relay -n Name cmd   - Wrap with specific agent name
- *   relay up            - Start daemon + dashboard
+ *   relay up            - Start daemon
  *   relay read <id>     - Read full message by ID
  *   relay agents        - List connected agents
  *   relay who           - Show currently active agents
@@ -26,7 +26,6 @@ import { promisify } from 'node:util';
 import { exec } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 dotenvConfig();
-const DEFAULT_DASHBOARD_PORT = process.env.AGENT_RELAY_DASHBOARD_PORT || '3888';
 // Read version from package.json
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -55,7 +54,6 @@ program
     .option('-n, --name <name>', 'Agent name (auto-generated if not set)')
     .option('-q, --quiet', 'Disable debug output', false)
     .option('--prefix <pattern>', 'Relay prefix pattern (default: ->relay:)')
-    .option('--dashboard-port <port>', 'Dashboard port for spawn/release API (auto-detected if not set)')
     .option('--shadow <name>', 'Spawn a shadow agent with this name that monitors the primary')
     .option('--shadow-role <role>', 'Shadow role: reviewer, auditor, or triggers (comma-separated: SESSION_END,CODE_WRITTEN,REVIEW_REQUEST,EXPLICIT_ASK,ALL_MESSAGES)')
     .argument('[command...]', 'Command to wrap (e.g., claude)')
@@ -86,31 +84,8 @@ program
     }
     const { TmuxWrapper } = await import('../wrapper/tmux-wrapper.js');
     const { AgentSpawner } = await import('../bridge/spawner.js');
-    // Determine dashboard port for spawn/release API
-    // Priority: CLI flag > env var > auto-detect default port
-    let dashboardPort;
-    if (options.dashboardPort) {
-        dashboardPort = parseInt(options.dashboardPort, 10);
-    }
-    else {
-        // Try to detect if dashboard is running at default port
-        const defaultPort = parseInt(DEFAULT_DASHBOARD_PORT, 10);
-        try {
-            const response = await fetch(`http://localhost:${defaultPort}/api/status`, {
-                method: 'GET',
-                signal: AbortSignal.timeout(500), // Quick timeout for detection
-            });
-            if (response.ok) {
-                dashboardPort = defaultPort;
-                console.error(`Dashboard detected: http://localhost:${dashboardPort}`);
-            }
-        }
-        catch {
-            // Dashboard not running - spawn/release will use fallback callbacks
-        }
-    }
-    // Create spawner as fallback for direct spawn (if dashboard API not available)
-    const spawner = new AgentSpawner(paths.projectRoot, undefined, dashboardPort);
+    // Create spawner for spawn/release callbacks
+    const spawner = new AgentSpawner(paths.projectRoot);
     const wrapper = new TmuxWrapper({
         name: agentName,
         command: mainCommand,
@@ -120,9 +95,7 @@ program
         relayPrefix: options.prefix,
         useInbox: true,
         inboxDir: paths.dataDir, // Use the project-specific data directory for the inbox
-        // Use dashboard API for spawn/release when available (preferred - works from any context)
-        dashboardPort,
-        // Wire up spawn/release callbacks as fallback (if no dashboardPort)
+        // Wire up spawn/release callbacks
         onSpawn: async (workerName, workerCli, task) => {
             console.error(`[${agentName}] Spawning ${workerName} (${workerCli})...`);
             const result = await spawner.spawn({
@@ -226,12 +199,10 @@ program
         }
     }
 });
-// up - Start daemon + dashboard
+// up - Start daemon
 program
     .command('up')
-    .description('Start daemon + dashboard')
-    .option('--no-dashboard', 'Disable web dashboard')
-    .option('--port <port>', 'Dashboard port', DEFAULT_DASHBOARD_PORT)
+    .description('Start daemon')
     .option('--spawn', 'Force spawn all agents from teams.json')
     .option('--no-spawn', 'Do not auto-spawn agents (just start daemon)')
     .option('--watch', 'Auto-restart daemon on crash (supervisor mode)')
@@ -248,10 +219,6 @@ program
         const startDaemon = () => {
             // Build args without --watch to prevent infinite recursion
             const args = ['up'];
-            if (options.dashboard === false)
-                args.push('--no-dashboard');
-            if (options.port)
-                args.push('--port', options.port);
             if (options.spawn === true)
                 args.push('--spawn');
             if (options.spawn === false)
@@ -363,28 +330,6 @@ program
     try {
         await daemon.start();
         console.log('Daemon started.');
-        let dashboardPort;
-        // Dashboard starts by default (use --no-dashboard to disable)
-        if (options.dashboard !== false) {
-            const port = parseInt(options.port, 10);
-            const { startDashboard } = await import('../dashboard-server/server.js');
-            dashboardPort = await startDashboard({
-                port,
-                dataDir: paths.dataDir,
-                teamDir: paths.teamDir,
-                dbPath,
-                enableSpawner: true,
-                projectRoot: paths.projectRoot,
-            });
-            console.log(`Dashboard: http://localhost:${dashboardPort}`);
-            // Hook daemon log output to dashboard WebSocket
-            daemon.onLogOutput = (agentName, data, _timestamp) => {
-                const broadcast = global.__broadcastLogOutput;
-                if (broadcast) {
-                    broadcast(agentName, data);
-                }
-            };
-        }
         // Determine if we should auto-spawn agents
         // --spawn: force spawn
         // --no-spawn: never spawn
@@ -397,7 +342,7 @@ program
         if (shouldSpawn && teamsConfig && teamsConfig.agents.length > 0) {
             console.log('');
             console.log('Auto-spawning agents from teams.json...');
-            spawner = new AgentSpawner(paths.projectRoot, undefined, dashboardPort);
+            spawner = new AgentSpawner(paths.projectRoot);
             for (const agent of teamsConfig.agents) {
                 console.log(`  Spawning ${agent.name} (${agent.cli})...`);
                 const result = await spawner.spawn({
@@ -1341,14 +1286,113 @@ program
         }
     }
 });
+// spawn - Spawn an agent via API (works from any context, no tmux required)
+program
+    .command('spawn', { hidden: true })
+    .description('Spawn an agent via dashboard API (no tmux required, works in containers)')
+    .argument('<name>', 'Agent name')
+    .argument('<cli>', 'CLI to use (claude, codex, gemini, etc.)')
+    .argument('[task]', 'Task description (can also be piped via stdin)')
+    .option('--port <port>', 'Dashboard port', '3888')
+    .option('--team <team>', 'Team name for the agent')
+    .option('--spawner <name>', 'Name of the agent requesting the spawn (for policy enforcement)')
+    .option('--interactive', 'Disable auto-accept of permission prompts (for auth setup flows)')
+    .option('--cwd <path>', 'Working directory for the agent')
+    .option('--shadow-mode <mode>', 'Shadow execution mode: subagent or process')
+    .option('--shadow-of <name>', 'Primary agent to shadow (if this agent is a shadow)')
+    .option('--shadow-agent <profile>', 'Shadow agent profile to use')
+    .option('--shadow-triggers <triggers>', 'When to trigger shadow (comma-separated: SESSION_END,CODE_WRITTEN,REVIEW_REQUEST,EXPLICIT_ASK,ALL_MESSAGES)')
+    .option('--shadow-speak-on <triggers>', 'When shadow should speak (comma-separated, same values as --shadow-triggers)')
+    .action(async (name, cli, task, options) => {
+    const port = options.port || '3888';
+    // Read task from stdin if not provided as argument
+    let finalTask = task;
+    if (!finalTask && !process.stdin.isTTY) {
+        const chunks = [];
+        for await (const chunk of process.stdin) {
+            chunks.push(chunk);
+        }
+        finalTask = Buffer.concat(chunks).toString('utf-8').trim();
+    }
+    if (!finalTask) {
+        console.error('Error: Task description required (as argument or via stdin)');
+        process.exit(1);
+    }
+    // Validate shadow mode if provided
+    if (options.shadowMode && !['subagent', 'process'].includes(options.shadowMode)) {
+        console.error('Error: --shadow-mode must be "subagent" or "process"');
+        process.exit(1);
+    }
+    // Parse comma-separated trigger lists
+    const parseTriggers = (value) => {
+        if (!value)
+            return undefined;
+        const validTriggers = ['SESSION_END', 'CODE_WRITTEN', 'REVIEW_REQUEST', 'EXPLICIT_ASK', 'ALL_MESSAGES'];
+        const triggers = value.split(',').map(t => t.trim().toUpperCase());
+        const invalid = triggers.filter(t => !validTriggers.includes(t));
+        if (invalid.length > 0) {
+            console.error(`Error: Invalid triggers: ${invalid.join(', ')}`);
+            console.error(`Valid triggers: ${validTriggers.join(', ')}`);
+            process.exit(1);
+        }
+        return triggers;
+    };
+    try {
+        // Build spawn request using the SpawnRequest type for consistency
+        const spawnRequest = {
+            name,
+            cli,
+            task: finalTask,
+            team: options.team,
+            spawnerName: options.spawner,
+            interactive: options.interactive,
+            cwd: options.cwd,
+            shadowMode: options.shadowMode,
+            shadowOf: options.shadowOf,
+            shadowAgent: options.shadowAgent,
+            shadowTriggers: parseTriggers(options.shadowTriggers),
+            shadowSpeakOn: parseTriggers(options.shadowSpeakOn),
+        };
+        const response = await fetch(`http://localhost:${port}/api/spawn`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(spawnRequest),
+        });
+        const result = await response.json();
+        if (result.success) {
+            console.log(`Spawned agent: ${name} (pid: ${result.pid})`);
+            process.exit(0);
+        }
+        else {
+            if (result.policyDecision) {
+                console.error(`Policy denied spawn: ${result.policyDecision.reason}`);
+                console.error(`Policy source: ${result.policyDecision.policySource}`);
+            }
+            else {
+                console.error(`Failed to spawn ${name}: ${result.error || 'Unknown error'}`);
+            }
+            process.exit(1);
+        }
+    }
+    catch (err) {
+        if (err.code === 'ECONNREFUSED') {
+            console.error(`Cannot connect to dashboard at port ${port}. Is the daemon running?`);
+            console.log(`Run 'agent-relay up' to start the daemon.`);
+        }
+        else {
+            console.error(`Failed to spawn ${name}: ${err.message}`);
+        }
+        process.exit(1);
+    }
+});
 // release - Release a spawned agent via API (works from any context, no terminal required)
 program
     .command('release')
     .description('Release a spawned agent via API (no terminal required)')
     .argument('<name>', 'Agent name to release')
-    .option('--port <port>', 'Dashboard port', DEFAULT_DASHBOARD_PORT)
+    .option('--port <port>', 'Dashboard port', '3888')
     .action(async (name, options) => {
-    const port = options.port || DEFAULT_DASHBOARD_PORT;
+    const port = options.port || '3888';
     try {
         const response = await fetch(`http://localhost:${port}/api/spawned/${encodeURIComponent(name)}`, {
             method: 'DELETE',
@@ -1439,7 +1483,7 @@ cloudCommand
     .command('link')
     .description('Link this machine to your Agent Relay Cloud account')
     .option('--name <name>', 'Name for this machine')
-    .option('--cloud-url <url>', 'Cloud API URL', process.env.AGENT_RELAY_CLOUD_URL || 'https://api.agent-relay.com')
+    .option('--cloud-url <url>', 'Cloud API URL', process.env.AGENT_RELAY_CLOUD_URL || 'https://agent-relay.com')
     .action(async (options) => {
     const os = await import('node:os');
     const crypto = await import('node:crypto');
@@ -1720,6 +1764,8 @@ program
         stdio: 'inherit',
         env: {
             ...process.env,
+            // Trajectory env vars override parent shell settings
+            // This ensures config-based TRAJECTORIES_DATA_DIR takes precedence
             TRAJECTORIES_PROJECT: paths.projectId,
             TRAJECTORIES_DATA_DIR: trajectoriesDir,
         },
@@ -1914,12 +1960,12 @@ program
     .command('metrics')
     .description('Show agent memory metrics and resource usage')
     .option('--agent <name>', 'Show metrics for specific agent')
-    .option('--port <port>', 'Dashboard port', DEFAULT_DASHBOARD_PORT)
+    .option('--port <port>', 'Dashboard port', '3888')
     .option('--json', 'Output as JSON')
     .option('--watch', 'Continuously update metrics')
     .option('--interval <ms>', 'Update interval for watch mode', '5000')
     .action(async (options) => {
-    const port = options.port || DEFAULT_DASHBOARD_PORT;
+    const port = options.port || '3888';
     const fetchMetrics = async () => {
         try {
             const response = await fetch(`http://localhost:${port}/api/metrics/agents`);
@@ -2033,12 +2079,12 @@ program
 program
     .command('health')
     .description('Show system health, crash insights, and recommendations')
-    .option('--port <port>', 'Dashboard port', DEFAULT_DASHBOARD_PORT)
+    .option('--port <port>', 'Dashboard port', '3888')
     .option('--json', 'Output as JSON')
     .option('--crashes', 'Show recent crash history')
     .option('--alerts', 'Show unacknowledged alerts')
     .action(async (options) => {
-    const port = options.port || DEFAULT_DASHBOARD_PORT;
+    const port = options.port || '3888';
     try {
         const response = await fetch(`http://localhost:${port}/api/metrics/health`);
         if (!response.ok) {

package/dist/cloud/api/admin.js

@@ -43,7 +43,7 @@ adminRouter.use(requireAdminAuth);
  * - batchSize?: Number of concurrent updates (default: 5)
  *
  * Response:
- * - summary: { total, updated, pendingRestart, skippedActiveAgents, skippedNotRunning, errors }
+ * - summary: { total, updated, pendingRestart, skippedActiveAgents, skippedVerificationFailed, skippedNotRunning, errors }
  * - results: Array of per-workspace results
  */
 adminRouter.post('/workspaces/update-image', async (req, res) => {
@@ -159,7 +159,9 @@ adminRouter.get('/workspaces/:id/agents', async (req, res) => {
             return;
         }
         try {
-            const response = await fetch(`${baseUrl}/api/agents`, {
+            // Use /api/data endpoint which returns { agents: [...], ... }
+            // Note: /api/agents doesn't exist on the workspace dashboard-server
+            const response = await fetch(`${baseUrl}/api/data`, {
                 method: 'GET',
                 headers: { 'Accept': 'application/json' },
                 signal: AbortSignal.timeout(10_000),
@@ -170,7 +172,18 @@ adminRouter.get('/workspaces/:id/agents', async (req, res) => {
             }
             const data = await response.json();
             const agents = data.agents || [];
-            const activeAgents = agents.filter(a => a.status === 'running' || a.activityState === 'active' || a.activityState === 'idle');
+            const activeAgents = agents.filter(a => {
+                const status = (a.status ?? '').toLowerCase();
+                const activityState = (a.activityState ?? '').toLowerCase();
+                const isProcessing = a.isProcessing === true;
+                if (activityState === 'active' || activityState === 'idle')
+                    return true;
+                if (status && status !== 'disconnected' && status !== 'offline')
+                    return true;
+                if (isProcessing)
+                    return true;
+                return false;
+            });
             res.json({
                 hasActiveAgents: activeAgents.length > 0,
                 agentCount: activeAgents.length,

package/dist/cloud/api/codex-auth-helper.js

@@ -19,6 +19,7 @@ import { requireAuth } from './auth.js';
 import { db } from '../db/index.js';
 import { deriveSshPassword } from '../services/ssh-security.js';
 export const codexAuthHelperRouter = Router();
+const WORKSPACE_SSH_PORT = 3022;
 const pendingAuthSessions = new Map();
 const pendingCliTokens = new Map();
 // Clean up old sessions every minute
@@ -201,18 +202,18 @@ codexAuthHelperRouter.get('/tunnel-info/:workspaceId', async (req, res) => {
         const host = url.hostname;
         const apiPort = parseInt(url.port, 10) || 80;
         // SSH connection info varies by environment:
-        // - Fly.io: Use public fly.dev hostname with port 2222 (exposed via TCP service)
+        // - Fly.io: Use public fly.dev hostname with port 3022 (exposed via TCP service)
         // - Local Docker: Use localhost with derived SSH port (22000 + apiPort - 3000)
         const isOnFly = !!process.env.FLY_APP_NAME;
         const isLocalDocker = (host === 'localhost' || host === '127.0.0.1') && apiPort >= 3000;
         let sshHost;
         let sshPort;
         if (isOnFly) {
-            // Fly.io public hostname - SSH is exposed as a public TCP service on port 2222
-            // Users can SSH directly from their machine to {app}.fly.dev:2222
+            // Fly.io public hostname - SSH is exposed as a public TCP service on port 3022
+            // Users can SSH directly from their machine to {app}.fly.dev:3022
             const appName = `ar-${workspace.id.substring(0, 8)}`;
             sshHost = `${appName}.fly.dev`;
-            sshPort = 2222;
+            sshPort = WORKSPACE_SSH_PORT;
         }
         else if (isLocalDocker) {
             // Local Docker: SSH port is derived from API port
@@ -223,7 +224,7 @@ codexAuthHelperRouter.get('/tunnel-info/:workspaceId', async (req, res) => {
         else {
             // Default fallback
             sshHost = host;
-            sshPort = 2222;
+            sshPort = WORKSPACE_SSH_PORT;
         }
         // SSH password is derived per-workspace for security
         // Each workspace gets a unique password based on its ID + secret salt
@@ -288,18 +289,37 @@ codexAuthHelperRouter.get('/auth-status/:workspaceId', async (req, res) => {
         if (!workspace.publicUrl) {
             return res.status(400).json({ error: 'Workspace URL not available' });
         }
-        // Check with workspace daemon if Codex is authenticated
-        const response = await fetch(`${workspace.publicUrl}/auth/cli/openai/check`, {
+        // Check with workspace daemon if Codex is authenticated for this specific user
+        // Pass userId to enable per-user credential checking (multiple users can share a workspace)
+        const checkUrl = new URL(`${workspace.publicUrl}/auth/cli/openai/check`);
+        checkUrl.searchParams.set('userId', userId);
+        const response = await fetch(checkUrl.toString(), {
             method: 'GET',
             signal: AbortSignal.timeout(5000),
         });
         if (response.ok) {
             const data = await response.json();
+            // When authentication is detected, mark the provider as connected in the database
+            // This ensures the dashboard shows correct per-user connection status
+            if (data.authenticated && userId) {
+                try {
+                    await db.credentials.upsert({
+                        userId,
+                        provider: 'codex', // Codex provider for OpenAI
+                        scopes: [],
+                    });
+                    console.log(`[codex-helper] Marked codex as connected for user ${userId}`);
+                }
+                catch (dbError) {
+                    console.error('[codex-helper] Failed to mark provider as connected:', dbError);
+                    // Don't fail the request if DB update fails
+                }
+            }
             return res.json({ authenticated: data.authenticated });
         }
         res.json({ authenticated: false });
     }
-    catch (error) {
+    catch (_error) {
         // Workspace might not be reachable, return false
         res.json({ authenticated: false });
     }

package/dist/cloud/api/consensus.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Consensus API Routes (Read-Only)
+ *
+ * Provides API endpoints for observing multi-agent consensus decisions.
+ * The dashboard is read-only - agents handle all consensus activity via relay messages.
+ *
+ * Architecture:
+ * - Agents create proposals and vote via ->relay:_consensus messages
+ * - The daemon processes these and syncs state to cloud via /sync endpoint
+ * - Dashboard reads consensus state for display only
+ */
+export declare const consensusRouter: import("express-serve-static-core").Router;
+//# sourceMappingURL=consensus.d.ts.map