agent-relay 1.3.2 → 1.5.0

package/dist/cloud/server.js

@@ -43,7 +43,7 @@ import { validateSshSecurityConfig } from './services/ssh-security.js';
 /**
  * Proxy a request to the user's primary running workspace
  */
-async function proxyToUserWorkspace(req, res, path) {
+async function proxyToUserWorkspace(req, res, path, options) {
     const userId = req.session.userId;
     if (!userId) {
         res.status(401).json({ error: 'Unauthorized' });
@@ -59,12 +59,29 @@ async function proxyToUserWorkspace(req, res, path) {
         }
         // Proxy to workspace
         const targetUrl = `${runningWorkspace.publicUrl}${path}`;
-        const proxyRes = await fetch(targetUrl);
+        console.log(`[workspace-proxy] ${options?.method || 'GET'} ${targetUrl}`);
+        const fetchOptions = {
+            method: options?.method || 'GET',
+            headers: { 'Content-Type': 'application/json' },
+        };
+        if (options?.body) {
+            fetchOptions.body = JSON.stringify(options.body);
+        }
+        const proxyRes = await fetch(targetUrl, fetchOptions);
+        const contentType = proxyRes.headers.get('content-type') || '';
+        console.log(`[workspace-proxy] Response: ${proxyRes.status} ${proxyRes.statusText}, content-type: ${contentType}`);
+        // Check if response is JSON
+        if (!contentType.includes('application/json')) {
+            const text = await proxyRes.text();
+            console.error(`[workspace-proxy] Non-JSON response: ${text.substring(0, 200)}`);
+            res.status(502).json({ error: 'Workspace returned non-JSON response', success: false });
+            return;
+        }
         const data = await proxyRes.json();
         res.status(proxyRes.status).json(data);
     }
     catch (error) {
-        console.error('[trajectory-proxy] Error:', error);
+        console.error('[workspace-proxy] Error:', error);
         res.status(500).json({ error: 'Failed to proxy request to workspace', success: false });
     }
 }
@@ -183,6 +200,7 @@ export async function createServer() {
         '/api/auth/nango/webhook',
         '/api/auth/codex-helper/callback',
         '/api/admin/', // Admin API uses X-Admin-Secret header auth
+        '/api/channels/', // Channels API routes to local daemon, not cloud
     ];
     // Additional pattern for workspace proxy routes (contains /proxy/)
     const isWorkspaceProxyRoute = (path) => /^\/api\/workspaces\/[^/]+\/proxy\//.test(path);
@@ -262,17 +280,9 @@ export async function createServer() {
     app.use('/api/usage', usageRouter);
     app.use('/api/project-groups', coordinatorsRouter);
     app.use('/api/github-app', githubAppRouter);
-    // Test helper routes (only available in non-production)
-    // MUST be before teamsRouter to avoid auth interception
-    if (process.env.NODE_ENV !== 'production') {
-        app.use('/api/test', testHelpersRouter);
-        console.log('[cloud] Test helper routes enabled (non-production mode)');
-    }
-    // Teams router - MUST BE LAST among /api routes
-    // Handles /workspaces/:id/members and /invites with requireAuth on all routes
-    app.use('/api', teamsRouter);
     // Trajectory proxy routes - auto-detect user's workspace and forward
     // These are convenience routes so the dashboard doesn't need to know the workspace ID
+    // MUST be before teamsRouter to avoid being caught by its catch-all
     app.get('/api/trajectory', requireAuth, async (req, res) => {
         await proxyToUserWorkspace(req, res, '/api/trajectory');
     });
@@ -285,6 +295,598 @@ export async function createServer() {
     app.get('/api/trajectory/history', requireAuth, async (req, res) => {
         await proxyToUserWorkspace(req, res, '/api/trajectory/history');
     });
+    // Channel proxy routes - forward to local dashboard-server (not workspace)
+    // Channels talk to the local daemon, so they need the local dashboard-server
+    // MUST be before teamsRouter to avoid being caught by its catch-all
+    // Auto-detect local dashboard URL if not configured
+    let localDashboardUrl = config.localDashboardUrl;
+    const defaultPorts = [3889, 3888, 3890]; // 3889 first (common alternate port)
+    async function detectLocalDashboard() {
+        console.log('[channel-proxy] Auto-detecting local dashboard...');
+        for (const port of defaultPorts) {
+            try {
+                const controller = new AbortController();
+                const timeout = setTimeout(() => controller.abort(), 2000);
+                const res = await fetch(`http://localhost:${port}/health`, {
+                    method: 'GET',
+                    signal: controller.signal,
+                });
+                clearTimeout(timeout);
+                if (res.ok) {
+                    console.log(`[channel-proxy] Detected local dashboard at http://localhost:${port}`);
+                    return `http://localhost:${port}`;
+                }
+                console.log(`[channel-proxy] Port ${port}: responded but not OK (${res.status})`);
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                console.log(`[channel-proxy] Port ${port}: ${msg}`);
+            }
+        }
+        console.log('[channel-proxy] No local dashboard detected, using fallback');
+        return null;
+    }
+    // Detect at startup if not configured - use a promise to ensure detection completes before first use
+    let detectionPromise = null;
+    if (localDashboardUrl) {
+        console.log(`[channel-proxy] Using configured dashboard URL: ${localDashboardUrl}`);
+    }
+    else {
+        // Start detection immediately
+        detectionPromise = detectLocalDashboard().then((detected) => {
+            if (detected) {
+                localDashboardUrl = detected;
+            }
+            else {
+                localDashboardUrl = 'http://localhost:3889';
+                console.log(`[channel-proxy] Falling back to ${localDashboardUrl}`);
+            }
+        });
+    }
+    async function getLocalDashboardUrl() {
+        // Wait for detection to complete if it's in progress
+        if (detectionPromise) {
+            await detectionPromise;
+            detectionPromise = null;
+        }
+        // If still not set (shouldn't happen), detect now
+        if (!localDashboardUrl) {
+            const detected = await detectLocalDashboard();
+            localDashboardUrl = detected || 'http://localhost:3889';
+        }
+        return localDashboardUrl;
+    }
+    async function proxyToLocalDashboard(req, res, path, options) {
+        try {
+            const dashboardUrl = await getLocalDashboardUrl();
+            const targetUrl = `${dashboardUrl}${path}`;
+            console.log(`[channel-proxy] ${options?.method || 'GET'} ${targetUrl}`);
+            const fetchOptions = {
+                method: options?.method || 'GET',
+                headers: { 'Content-Type': 'application/json' },
+            };
+            if (options?.body) {
+                fetchOptions.body = JSON.stringify(options.body);
+            }
+            const proxyRes = await fetch(targetUrl, fetchOptions);
+            const contentType = proxyRes.headers.get('content-type') || '';
+            if (!contentType.includes('application/json')) {
+                const text = await proxyRes.text();
+                console.error(`[channel-proxy] Non-JSON response from ${targetUrl}: ${text.substring(0, 100)}`);
+                res.status(502).json({
+                    error: 'Local dashboard not available or returned non-JSON response',
+                    hint: 'Make sure the dashboard-server is running (agent-relay start)',
+                });
+                return;
+            }
+            const data = await proxyRes.json();
+            res.status(proxyRes.status).json(data);
+        }
+        catch (error) {
+            console.error('[channel-proxy] Error:', error);
+            res.status(502).json({
+                error: 'Failed to connect to local dashboard',
+                hint: 'Make sure the dashboard-server is running (agent-relay start)',
+            });
+        }
+    }
+    // =========================================================================
+    // Channel metadata endpoints (stored in cloud PostgreSQL)
+    // =========================================================================
+    /**
+     * GET /api/channels - List channels for a workspace
+     * Channels are workspace-scoped, not user-scoped
+     */
+    app.get('/api/channels', requireAuth, async (req, res) => {
+        try {
+            const workspaceId = req.query.workspaceId;
+            if (!workspaceId) {
+                return res.status(400).json({ error: 'workspaceId query param required' });
+            }
+            // Verify user has access to this workspace
+            const userId = req.session.userId;
+            const workspace = await db.workspaces.findById(workspaceId);
+            if (!workspace) {
+                return res.status(404).json({ error: 'Workspace not found' });
+            }
+            if (workspace.userId !== userId) {
+                const membership = await db.workspaceMembers.findMembership(workspaceId, userId);
+                if (!membership || !membership.acceptedAt) {
+                    return res.status(403).json({ error: 'Access denied' });
+                }
+            }
+            const allChannels = await db.channels.findByWorkspaceId(workspaceId);
+            const activeChannels = allChannels.filter(c => c.status === 'active');
+            const archivedChannels = allChannels.filter(c => c.status === 'archived');
+            // Get member counts for all channels in one query
+            const channelUuids = allChannels.map(c => c.id);
+            const memberCounts = await db.channelMembers.countByChannelIds(channelUuids);
+            // Transform to API response format
+            const mapChannel = (c) => ({
+                id: c.channelId,
+                name: c.name,
+                description: c.description,
+                visibility: c.visibility,
+                status: c.status,
+                createdAt: c.createdAt.toISOString(),
+                createdBy: c.createdBy || '__system__',
+                lastActivityAt: c.lastActivityAt?.toISOString(),
+                memberCount: memberCounts.get(c.id) ?? 0,
+                unreadCount: 0,
+                hasMentions: false,
+                isDm: c.channelId.startsWith('dm:'),
+            });
+            res.json({
+                channels: activeChannels.map(mapChannel),
+                archivedChannels: archivedChannels.map(mapChannel),
+            });
+        }
+        catch (error) {
+            console.error('[channels] Error listing channels:', error);
+            res.status(500).json({ error: 'Failed to list channels' });
+        }
+    });
+    /**
+     * POST /api/channels - Create a new channel
+     */
+    app.post('/api/channels', requireAuth, express.json(), async (req, res) => {
+        try {
+            const { name, description, isPrivate, workspaceId, invites } = req.body;
+            if (!name || !workspaceId) {
+                return res.status(400).json({ error: 'name and workspaceId are required' });
+            }
+            // Verify user has access to this workspace
+            const userId = req.session.userId;
+            const workspace = await db.workspaces.findById(workspaceId);
+            if (!workspace) {
+                return res.status(404).json({ error: 'Workspace not found' });
+            }
+            if (workspace.userId !== userId) {
+                const membership = await db.workspaceMembers.findMembership(workspaceId, userId);
+                if (!membership || !membership.acceptedAt) {
+                    return res.status(403).json({ error: 'Access denied' });
+                }
+            }
+            // Get creator username from session
+            const user = await db.users.findById(userId);
+            const createdBy = user?.githubUsername || 'unknown';
+            // Normalize channel name (remove # prefix if present)
+            const channelId = name.startsWith('#') ? name.slice(1) : name;
+            const displayName = channelId;
+            // Check if channel already exists
+            const existing = await db.channels.findByWorkspaceAndChannelId(workspaceId, channelId);
+            if (existing) {
+                return res.status(409).json({ error: 'Channel already exists' });
+            }
+            // Create the channel
+            console.log('[channels] Creating channel:', { workspaceId, channelId, displayName, createdBy });
+            let channel;
+            try {
+                channel = await db.channels.create({
+                    workspaceId,
+                    channelId,
+                    name: displayName,
+                    description,
+                    visibility: isPrivate ? 'private' : 'public',
+                    status: 'active',
+                    createdBy,
+                });
+                console.log('[channels] Channel created:', channel.id);
+            }
+            catch (createError) {
+                const err = createError;
+                console.error('[channels] Failed to create channel in database:', {
+                    message: err.message,
+                    stack: err.stack,
+                });
+                throw createError;
+            }
+            // Add creator as owner
+            try {
+                await db.channelMembers.addMember({
+                    channelId: channel.id,
+                    memberId: createdBy,
+                    memberType: 'user',
+                    role: 'owner',
+                });
+                console.log('[channels] Added creator as owner:', createdBy);
+            }
+            catch (memberError) {
+                const err = memberError;
+                console.error('[channels] Failed to add channel member:', {
+                    message: err.message,
+                    stack: err.stack,
+                    channelId: channel.id,
+                    memberId: createdBy,
+                });
+                throw memberError;
+            }
+            // Handle invites if provided
+            // Supports: comma-separated string, array of strings, or array of {id, type} objects
+            const addedMembers = [
+                { id: createdBy, type: 'user', role: 'owner' },
+            ];
+            const memberWarnings = [];
+            if (invites) {
+                let inviteList = [];
+                if (typeof invites === 'string') {
+                    // Comma-separated string: "alice,bob" -> all as users
+                    inviteList = invites.split(',')
+                        .map((s) => s.trim())
+                        .filter(Boolean)
+                        .map(id => ({ id, type: 'user' }));
+                }
+                else if (Array.isArray(invites)) {
+                    // Array of strings or objects
+                    inviteList = invites.map((inv) => {
+                        if (typeof inv === 'string') {
+                            return { id: inv, type: 'user' };
+                        }
+                        return {
+                            id: inv.id,
+                            type: (inv.type === 'agent' ? 'agent' : 'user'),
+                        };
+                    });
+                }
+                for (const invitee of inviteList) {
+                    await db.channelMembers.addMember({
+                        channelId: channel.id,
+                        memberId: invitee.id,
+                        memberType: invitee.type,
+                        role: 'member',
+                        invitedBy: createdBy,
+                    });
+                    addedMembers.push({ id: invitee.id, type: invitee.type, role: 'member' });
+                    // For agent members, sync to local daemon's in-memory channel membership
+                    if (invitee.type === 'agent') {
+                        try {
+                            const channelName = channelId.startsWith('#') ? channelId : `#${channelId}`;
+                            // Route to local dashboard where the daemon and channel routing lives
+                            const dashboardUrl = await getLocalDashboardUrl();
+                            const joinResponse = await fetch(`${dashboardUrl}/api/channels/admin-join`, {
+                                method: 'POST',
+                                headers: { 'Content-Type': 'application/json' },
+                                body: JSON.stringify({ channel: channelName, member: invitee.id, workspaceId }),
+                            });
+                            const joinResult = await joinResponse.json();
+                            console.log(`[channels] Synced agent ${invitee.id} to channel ${channelName} via local dashboard`);
+                            // Check for warning about unconnected agent
+                            if (joinResult.warning) {
+                                memberWarnings.push({ member: invitee.id, warning: joinResult.warning });
+                                console.log(`[channels] Warning for ${invitee.id}: ${joinResult.warning}`);
+                            }
+                        }
+                        catch (err) {
+                            // Non-fatal - daemon sync is best-effort
+                            console.warn(`[channels] Failed to sync agent ${invitee.id} to daemon:`, err);
+                        }
+                    }
+                }
+            }
+            res.status(201).json({
+                success: true,
+                channel: {
+                    id: channel.channelId,
+                    name: channel.name,
+                    description: channel.description,
+                    visibility: channel.visibility,
+                    status: channel.status,
+                    createdAt: channel.createdAt.toISOString(),
+                    createdBy: channel.createdBy,
+                    members: addedMembers,
+                },
+                warnings: memberWarnings.length > 0 ? memberWarnings : undefined,
+            });
+        }
+        catch (error) {
+            const err = error;
+            console.error('[channels] Error creating channel:', {
+                message: err.message,
+                stack: err.stack,
+                name: err.name,
+                workspaceId: req.body.workspaceId,
+                channelName: req.body.name,
+            });
+            // Include error message for debugging (safe since this is authenticated)
+            res.status(500).json({
+                error: 'Failed to create channel',
+                message: err.message,
+            });
+        }
+    });
+    /**
+     * POST /api/channels/join - Join a channel
+     */
+    app.post('/api/channels/join', requireAuth, express.json(), async (req, res) => {
+        try {
+            const { channel: rawChannelId, workspaceId, username } = req.body;
+            if (!rawChannelId || !workspaceId) {
+                return res.status(400).json({ error: 'channel and workspaceId are required' });
+            }
+            // Normalize channel ID (remove # prefix if present)
+            const channelId = rawChannelId.startsWith('#') ? rawChannelId.slice(1) : rawChannelId;
+            const userId = req.session.userId;
+            const user = await db.users.findById(userId);
+            const memberId = username || user?.githubUsername || 'unknown';
+            // Find the channel
+            const channel = await db.channels.findByWorkspaceAndChannelId(workspaceId, channelId);
+            if (!channel) {
+                return res.status(404).json({ error: 'Channel not found' });
+            }
+            // Check if already a member
+            const existing = await db.channelMembers.findMembership(channel.id, memberId);
+            if (!existing) {
+                await db.channelMembers.addMember({
+                    channelId: channel.id,
+                    memberId,
+                    memberType: 'user',
+                    role: 'member',
+                });
+            }
+            // Also subscribe the user on the daemon side for real-time messages
+            try {
+                const dashboardUrl = await getLocalDashboardUrl();
+                const channelWithHash = rawChannelId.startsWith('#') ? rawChannelId : `#${rawChannelId}`;
+                await fetch(`${dashboardUrl}/api/channels/subscribe`, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify({
+                        username: memberId,
+                        channels: [channelWithHash],
+                        workspaceId,
+                    }),
+                });
+                console.log(`[cloud] Subscribed ${memberId} to ${channelWithHash} on local daemon`);
+            }
+            catch (err) {
+                // Non-fatal - daemon sync is best-effort
+                console.warn(`[cloud] Failed to sync join to daemon:`, err);
+            }
+            res.json({ success: true, channel: channelId });
+        }
+        catch (error) {
+            console.error('[channels] Error joining channel:', error);
+            res.status(500).json({ error: 'Failed to join channel' });
+        }
+    });
+    /**
+     * POST /api/channels/leave - Leave a channel
+     */
+    app.post('/api/channels/leave', requireAuth, express.json(), async (req, res) => {
+        try {
+            const { channel: rawChannelId, workspaceId, username } = req.body;
+            if (!rawChannelId || !workspaceId) {
+                return res.status(400).json({ error: 'channel and workspaceId are required' });
+            }
+            // Normalize channel ID (remove # prefix if present)
+            const channelId = rawChannelId.startsWith('#') ? rawChannelId.slice(1) : rawChannelId;
+            const userId = req.session.userId;
+            const user = await db.users.findById(userId);
+            const memberId = username || user?.githubUsername || 'unknown';
+            const channel = await db.channels.findByWorkspaceAndChannelId(workspaceId, channelId);
+            if (!channel) {
+                return res.status(404).json({ error: 'Channel not found' });
+            }
+            await db.channelMembers.removeMember(channel.id, memberId);
+            res.json({ success: true, channel: channelId });
+        }
+        catch (error) {
+            console.error('[channels] Error leaving channel:', error);
+            res.status(500).json({ error: 'Failed to leave channel' });
+        }
+    });
+    /**
+     * POST /api/channels/invite - Invite users to a channel
+     */
+    app.post('/api/channels/invite', requireAuth, express.json(), async (req, res) => {
+        try {
+            const { channel: rawChannelId, workspaceId, invites, invitedBy } = req.body;
+            if (!rawChannelId || !workspaceId || !invites) {
+                return res.status(400).json({ error: 'channel, workspaceId, and invites are required' });
+            }
+            // Normalize channel ID (remove # prefix if present)
+            const channelId = rawChannelId.startsWith('#') ? rawChannelId.slice(1) : rawChannelId;
+            const channel = await db.channels.findByWorkspaceAndChannelId(workspaceId, channelId);
+            if (!channel) {
+                return res.status(404).json({ error: 'Channel not found' });
+            }
+            const inviteList = typeof invites === 'string'
+                ? invites.split(',').map((s) => s.trim()).filter(Boolean)
+                : invites;
+            const results = [];
+            for (const invitee of inviteList) {
+                const existing = await db.channelMembers.findMembership(channel.id, invitee);
+                if (!existing) {
+                    await db.channelMembers.addMember({
+                        channelId: channel.id,
+                        memberId: invitee,
+                        memberType: 'user',
+                        role: 'member',
+                        invitedBy,
+                    });
+                    results.push({ username: invitee, success: true });
+                }
+                else {
+                    results.push({ username: invitee, success: true, reason: 'already_member' });
+                }
+            }
+            res.json({ channel: channelId, invited: results });
+        }
+        catch (error) {
+            console.error('[channels] Error inviting to channel:', error);
+            res.status(500).json({ error: 'Failed to invite to channel' });
+        }
+    });
+    /**
+     * POST /api/channels/archive - Archive a channel
+     */
+    app.post('/api/channels/archive', requireAuth, express.json(), async (req, res) => {
+        try {
+            const { channel: rawChannelId, workspaceId } = req.body;
+            if (!rawChannelId || !workspaceId) {
+                return res.status(400).json({ error: 'channel and workspaceId are required' });
+            }
+            // Normalize channel ID (remove # prefix if present)
+            const channelId = rawChannelId.startsWith('#') ? rawChannelId.slice(1) : rawChannelId;
+            const channel = await db.channels.findByWorkspaceAndChannelId(workspaceId, channelId);
+            if (!channel) {
+                return res.status(404).json({ error: 'Channel not found' });
+            }
+            await db.channels.archive(channel.id);
+            res.json({ success: true, channel: channelId, status: 'archived' });
+        }
+        catch (error) {
+            console.error('[channels] Error archiving channel:', error);
+            res.status(500).json({ error: 'Failed to archive channel' });
+        }
+    });
+    /**
+     * POST /api/channels/unarchive - Unarchive a channel
+     */
+    app.post('/api/channels/unarchive', requireAuth, express.json(), async (req, res) => {
+        try {
+            const { channel: rawChannelId, workspaceId } = req.body;
+            if (!rawChannelId || !workspaceId) {
+                return res.status(400).json({ error: 'channel and workspaceId are required' });
+            }
+            // Normalize channel ID (remove # prefix if present)
+            const channelId = rawChannelId.startsWith('#') ? rawChannelId.slice(1) : rawChannelId;
+            const channel = await db.channels.findByWorkspaceAndChannelId(workspaceId, channelId);
+            if (!channel) {
+                return res.status(404).json({ error: 'Channel not found' });
+            }
+            await db.channels.unarchive(channel.id);
+            res.json({ success: true, channel: channelId, status: 'active' });
+        }
+        catch (error) {
+            console.error('[channels] Error unarchiving channel:', error);
+            res.status(500).json({ error: 'Failed to unarchive channel' });
+        }
+    });
+    // =========================================================================
+    // Channel message endpoints (proxied to workspace container)
+    // Messages are stored in the daemon's SQLite for real-time performance
+    // =========================================================================
+    app.post('/api/channels/message', requireAuth, express.json(), async (req, res) => {
+        // Route to local dashboard where relay daemon and channel routing lives
+        await proxyToLocalDashboard(req, res, '/api/channels/message', { method: 'POST', body: req.body });
+    });
+    app.get('/api/channels/:channel/messages', requireAuth, async (req, res) => {
+        const channel = encodeURIComponent(req.params.channel);
+        const params = new URLSearchParams();
+        if (req.query.limit)
+            params.set('limit', req.query.limit);
+        if (req.query.before)
+            params.set('before', req.query.before);
+        const queryString = params.toString() ? `?${params.toString()}` : '';
+        await proxyToLocalDashboard(req, res, `/api/channels/${channel}/messages${queryString}`);
+    });
+    /**
+     * GET /api/channels/:channel/members - Get members of a channel
+     */
+    app.get('/api/channels/:channel/members', requireAuth, async (req, res) => {
+        const channel = encodeURIComponent(req.params.channel);
+        await proxyToLocalDashboard(req, res, `/api/channels/${channel}/members`);
+    });
+    /**
+     * GET /api/channels/available-members - Get available members for channel invites
+     * Returns workspace members (humans) and agents from linked daemons
+     */
+    app.get('/api/channels/available-members', requireAuth, async (req, res) => {
+        try {
+            const userId = req.session.userId;
+            const workspaceId = req.query.workspaceId;
+            // Get workspace ID - either from query param or user's default workspace
+            let targetWorkspaceId = workspaceId;
+            if (!targetWorkspaceId) {
+                // Find user's default or first workspace
+                const memberships = await db.workspaceMembers.findByUserId(userId);
+                if (memberships.length > 0) {
+                    targetWorkspaceId = memberships[0].workspaceId;
+                }
+            }
+            if (!targetWorkspaceId) {
+                return res.json({ members: [], agents: [] });
+            }
+            // Verify user has access to this workspace
+            const canView = await db.workspaceMembers.canView(targetWorkspaceId, userId);
+            if (!canView) {
+                const workspace = await db.workspaces.findById(targetWorkspaceId);
+                if (!workspace || workspace.userId !== userId) {
+                    return res.status(403).json({ error: 'Access denied' });
+                }
+            }
+            // Get workspace members (humans)
+            const workspaceMembers = await db.workspaceMembers.findByWorkspaceId(targetWorkspaceId);
+            const members = await Promise.all(workspaceMembers.map(async (m) => {
+                const user = await db.users.findById(m.userId);
+                return {
+                    id: user?.githubUsername || m.userId,
+                    displayName: user?.githubUsername || 'Unknown',
+                    type: 'user',
+                    avatarUrl: user?.avatarUrl ?? undefined,
+                };
+            }));
+            // Get agents from linked daemons for this workspace
+            const daemons = await db.linkedDaemons.findByWorkspaceId(targetWorkspaceId);
+            const agents = [];
+            for (const daemon of daemons) {
+                const metadata = daemon.metadata;
+                const daemonAgents = metadata?.agents || [];
+                for (const agent of daemonAgents) {
+                    // Skip human users from daemon agent list (they're in workspace members)
+                    if (agent.isHuman)
+                        continue;
+                    // Avoid duplicates
+                    if (!agents.some((a) => a.id === agent.name)) {
+                        agents.push({
+                            id: agent.name,
+                            displayName: agent.name,
+                            type: 'agent',
+                            status: agent.status,
+                        });
+                    }
+                }
+            }
+            res.json({ members, agents });
+        }
+        catch (error) {
+            console.error('[channels] Error getting available members:', error);
+            res.status(500).json({ error: 'Failed to get available members' });
+        }
+    });
+    app.get('/api/channels/users', requireAuth, async (req, res) => {
+        await proxyToLocalDashboard(req, res, '/api/channels/users');
+    });
+    // Test helper routes (only available in non-production)
+    // MUST be before teamsRouter to avoid auth interception
+    if (process.env.NODE_ENV !== 'production') {
+        app.use('/api/test', testHelpersRouter);
+        console.log('[cloud] Test helper routes enabled (non-production mode)');
+    }
+    // Teams router - MUST BE LAST among /api routes
+    // Handles /workspaces/:id/members and /invites with requireAuth on all routes
+    app.use('/api', teamsRouter);
     // Serve static dashboard files (Next.js static export)
     // Path: dist/cloud/server.js -> ../../src/dashboard/out
     const dashboardPath = path.join(__dirname, '../../src/dashboard/out');
@@ -360,21 +962,25 @@ export async function createServer() {
     };
     // WebSocket server for agent logs (proxied to workspace daemon)
     const wssLogs = new WebSocketServer({ noServer: true, perMessageDeflate: false });
+    // WebSocket server for channel messages (proxied to workspace daemon)
+    const wssChannels = new WebSocketServer({ noServer: true, perMessageDeflate: false });
     // Handle agent logs WebSocket connections
     wssLogs.on('connection', async (clientWs, workspaceId, agentName) => {
         console.log(`[ws/logs] Client connected for workspace=${workspaceId} agent=${agentName}`);
         let daemonWs = null;
         try {
-            // Find the workspace
+            // Find the workspace (needed to verify it exists and get its URL)
             const workspace = await db.workspaces.findById(workspaceId);
-            if (!workspace || !workspace.publicUrl) {
-                clientWs.send(JSON.stringify({ type: 'error', message: 'Workspace not found or not running' }));
+            if (!workspace) {
+                clientWs.send(JSON.stringify({ type: 'error', message: 'Workspace not found' }));
                 clientWs.close();
                 return;
             }
-            // Connect to workspace daemon WebSocket
-            // The workspace runs the dashboard server which expects /ws/logs path
-            const baseUrl = workspace.publicUrl.replace(/^http/, 'ws').replace(/\/$/, '');
+            // Connect to the workspace's dashboard where the agent was spawned
+            // IMPORTANT: Must use workspace.publicUrl (not getLocalDashboardUrl) because
+            // agents are spawned on the workspace server, so logs must connect there too
+            const dashboardUrl = workspace.publicUrl || await getLocalDashboardUrl();
+            const baseUrl = dashboardUrl.replace(/^http/, 'ws').replace(/\/$/, '');
             const daemonWsUrl = `${baseUrl}/ws/logs/${encodeURIComponent(agentName)}`;
             console.log(`[ws/logs] Connecting to daemon: ${daemonWsUrl}`);
             daemonWs = new WebSocket(daemonWsUrl, { perMessageDeflate: false });
@@ -429,6 +1035,101 @@ export async function createServer() {
             }
         }
     });
+    // Handle channel WebSocket connections (proxied to workspace daemon)
+    // This allows cloud users to receive real-time channel messages
+    wssChannels.on('connection', async (clientWs, workspaceId, username) => {
+        console.log(`[ws/channels] Client connected for workspace=${workspaceId} user=${username}`);
+        let daemonWs = null;
+        try {
+            // Find the workspace (needed to verify it exists)
+            const workspace = await db.workspaces.findById(workspaceId);
+            if (!workspace) {
+                clientWs.send(JSON.stringify({ type: 'error', message: 'Workspace not found' }));
+                clientWs.close();
+                return;
+            }
+            // Connect to local dashboard where the daemon actually runs
+            const dashboardUrl = await getLocalDashboardUrl();
+            const baseUrl = dashboardUrl.replace(/^http/, 'ws').replace(/\/$/, '');
+            const daemonWsUrl = `${baseUrl}/ws/presence`;
+            console.log(`[ws/channels] Connecting to daemon: ${daemonWsUrl}`);
+            daemonWs = new WebSocket(daemonWsUrl, { perMessageDeflate: false });
+            daemonWs.on('open', () => {
+                console.log(`[ws/channels] Connected to daemon for ${username}`);
+                // Register with the daemon's presence system
+                daemonWs.send(JSON.stringify({
+                    type: 'presence',
+                    action: 'join',
+                    user: { username },
+                }));
+            });
+            daemonWs.on('message', (data) => {
+                // Forward daemon messages to client
+                // Only forward channel_message type messages for this user
+                try {
+                    const msg = JSON.parse(data.toString());
+                    if (msg.type === 'channel_message') {
+                        // Only forward if this message is for this user
+                        if (msg.targetUser === username) {
+                            console.log(`[ws/channels] Forwarding channel message to ${username}: ${msg.from} -> ${msg.channel}`);
+                            clientWs.send(data.toString());
+                        }
+                    }
+                    // Also forward presence updates so client stays in sync
+                    if (msg.type === 'presence_join' || msg.type === 'presence_leave' || msg.type === 'presence_list') {
+                        clientWs.send(data.toString());
+                    }
+                }
+                catch {
+                    // Non-JSON message, skip
+                }
+            });
+            daemonWs.on('close', () => {
+                console.log(`[ws/channels] Daemon connection closed for ${username}`);
+                if (clientWs.readyState === WebSocket.OPEN) {
+                    clientWs.close();
+                }
+            });
+            daemonWs.on('error', (err) => {
+                console.error(`[ws/channels] Daemon WebSocket error:`, err);
+                if (clientWs.readyState === WebSocket.OPEN) {
+                    clientWs.send(JSON.stringify({ type: 'error', message: 'Daemon connection error' }));
+                    clientWs.close();
+                }
+            });
+            // Forward client messages to daemon (for sending channel messages)
+            clientWs.on('message', (data) => {
+                if (daemonWs && daemonWs.readyState === WebSocket.OPEN) {
+                    daemonWs.send(data.toString());
+                }
+            });
+            clientWs.on('close', () => {
+                console.log(`[ws/channels] Client disconnected for ${username}`);
+                // Send leave message to daemon
+                if (daemonWs && daemonWs.readyState === WebSocket.OPEN) {
+                    daemonWs.send(JSON.stringify({
+                        type: 'presence',
+                        action: 'leave',
+                        username,
+                    }));
+                    daemonWs.close();
+                }
+            });
+            clientWs.on('error', (err) => {
+                console.error(`[ws/channels] Client WebSocket error:`, err);
+                if (daemonWs && daemonWs.readyState === WebSocket.OPEN) {
+                    daemonWs.close();
+                }
+            });
+        }
+        catch (err) {
+            console.error(`[ws/channels] Setup error:`, err);
+            if (clientWs.readyState === WebSocket.OPEN) {
+                clientWs.send(JSON.stringify({ type: 'error', message: 'Failed to connect to workspace' }));
+                clientWs.close();
+            }
+        }
+    });
     // Handle HTTP upgrade for WebSocket
     httpServer.on('upgrade', (request, socket, head) => {
         const pathname = new URL(request.url || '', `http://${request.headers.host}`).pathname;
@@ -451,6 +1152,20 @@ export async function createServer() {
                 socket.destroy();
             }
         }
+        else if (pathname.startsWith('/ws/channels/')) {
+            // Parse /ws/channels/:workspaceId/:username
+            const parts = pathname.split('/').filter(Boolean);
+            if (parts.length >= 4) {
+                const workspaceId = decodeURIComponent(parts[2]);
+                const username = decodeURIComponent(parts[3]);
+                wssChannels.handleUpgrade(request, socket, head, (ws) => {
+                    wssChannels.emit('connection', ws, workspaceId, username);
+                });
+            }
+            else {
+                socket.destroy();
+            }
+        }
         else {
             // Unknown WebSocket path - destroy socket
             socket.destroy();
@@ -499,6 +1214,96 @@ export async function createServer() {
     wssPresence.on('close', () => {
         clearInterval(presenceHeartbeat);
     });
+    // Track daemon proxy connections for channel message forwarding
+    const daemonProxies = new Map(); // clientWs -> workspaceId -> daemonWs
+    // Set up daemon proxy for channel messages
+    async function setupDaemonChannelProxy(clientWs, workspaceId, username) {
+        // Check if already have a proxy for this workspace
+        const clientProxies = daemonProxies.get(clientWs) || new Map();
+        if (clientProxies.has(workspaceId)) {
+            return; // Already connected
+        }
+        try {
+            const workspace = await db.workspaces.findById(workspaceId);
+            if (!workspace) {
+                console.log(`[cloud] Workspace ${workspaceId} not found`);
+                return;
+            }
+            // Use local dashboard URL where the daemon actually runs
+            const dashboardUrl = await getLocalDashboardUrl();
+            const daemonWsUrl = dashboardUrl.replace(/^http/, 'ws').replace(/\/$/, '') + '/ws/presence';
+            console.log(`[cloud] Connecting channel proxy to daemon: ${daemonWsUrl} for ${username}`);
+            // First, register the user for channel messages on the daemon side
+            // This creates a relay client for them so they receive channel messages
+            try {
+                const subscribeRes = await fetch(`${dashboardUrl}/api/channels/subscribe`, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify({
+                        username,
+                        channels: ['#general'], // Start with general, others can be joined later
+                        workspaceId,
+                    }),
+                });
+                if (subscribeRes.ok) {
+                    const result = (await subscribeRes.json());
+                    console.log(`[cloud] Subscribed ${username} to channels: ${result.channels?.join(', ')}`);
+                }
+                else {
+                    console.warn(`[cloud] Failed to subscribe ${username} to channels: ${subscribeRes.status}`);
+                }
+            }
+            catch (err) {
+                console.warn(`[cloud] Error subscribing ${username} to channels:`, err);
+                // Continue anyway - we can still set up the proxy
+            }
+            const daemonWs = new WebSocket(daemonWsUrl, { perMessageDeflate: false });
+            daemonWs.on('open', () => {
+                console.log(`[cloud] Channel proxy connected for ${username} in workspace ${workspaceId}`);
+            });
+            daemonWs.on('message', (data) => {
+                try {
+                    const msg = JSON.parse(data.toString());
+                    // Forward channel messages targeted at this user
+                    if (msg.type === 'channel_message' && msg.targetUser === username) {
+                        console.log(`[cloud] Forwarding channel message to ${username}: ${msg.from} -> ${msg.channel}`);
+                        if (clientWs.readyState === WebSocket.OPEN) {
+                            clientWs.send(data.toString());
+                        }
+                    }
+                }
+                catch {
+                    // Non-JSON, ignore
+                }
+            });
+            daemonWs.on('close', () => {
+                console.log(`[cloud] Channel proxy closed for ${username} in workspace ${workspaceId}`);
+                clientProxies.delete(workspaceId);
+            });
+            daemonWs.on('error', (err) => {
+                console.error(`[cloud] Channel proxy error for ${username}:`, err);
+                clientProxies.delete(workspaceId);
+            });
+            clientProxies.set(workspaceId, daemonWs);
+            daemonProxies.set(clientWs, clientProxies);
+        }
+        catch (err) {
+            console.error(`[cloud] Failed to setup channel proxy for ${username}:`, err);
+        }
+    }
+    // Clean up daemon proxies for a client
+    function cleanupDaemonProxies(clientWs) {
+        const clientProxies = daemonProxies.get(clientWs);
+        if (clientProxies) {
+            for (const [workspaceId, daemonWs] of clientProxies) {
+                console.log(`[cloud] Cleaning up channel proxy for workspace ${workspaceId}`);
+                if (daemonWs.readyState === WebSocket.OPEN) {
+                    daemonWs.close();
+                }
+            }
+            daemonProxies.delete(clientWs);
+        }
+    }
     // Handle presence connections
     wssPresence.on('connection', (ws) => {
         // Initialize health tracking (no log - too noisy)
@@ -582,12 +1387,43 @@ export async function createServer() {
                         isTyping: msg.isTyping,
                     }, ws);
                 }
+                else if (msg.type === 'subscribe_channels') {
+                    // Subscribe to channel messages for a specific workspace
+                    if (!clientUsername) {
+                        console.warn(`[cloud] subscribe_channels from unauthenticated client`);
+                        return;
+                    }
+                    if (!msg.workspaceId || typeof msg.workspaceId !== 'string') {
+                        console.warn(`[cloud] subscribe_channels missing workspaceId`);
+                        return;
+                    }
+                    console.log(`[cloud] User ${clientUsername} subscribing to channels in workspace ${msg.workspaceId}`);
+                    setupDaemonChannelProxy(ws, msg.workspaceId, clientUsername).catch((err) => {
+                        console.error(`[cloud] Failed to setup channel subscription:`, err);
+                    });
+                }
+                else if (msg.type === 'channel_message') {
+                    // Proxy channel message to daemon via HTTP API
+                    if (!clientUsername) {
+                        console.warn(`[cloud] channel_message from unauthenticated client`);
+                        return;
+                    }
+                    if (!msg.channel || !msg.body) {
+                        console.warn(`[cloud] channel_message missing channel or body`);
+                        return;
+                    }
+                    // Note: This should be handled by the HTTP API, but support WebSocket too
+                    console.log(`[cloud] Channel message via WebSocket from ${clientUsername} to ${msg.channel}`);
+                    // The HTTP proxy will handle actual sending - just log for now
+                }
             }
             catch (err) {
                 console.error('[cloud] Invalid presence message:', err);
             }
         });
         ws.on('close', () => {
+            // Clean up daemon proxies
+            cleanupDaemonProxies(ws);
             if (clientUsername) {
                 const userState = onlineUsers.get(clientUsername);
                 if (userState) {