agent-relay 2.0.11 → 2.0.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-relay",
-  "version": "2.0.11",
+  "version": "2.0.12",
   "description": "Real-time agent-to-agent communication system",
   "type": "module",
   "main": "dist/src/index.js",
@@ -107,20 +107,20 @@
   },
   "homepage": "https://github.com/AgentWorkforce/relay#readme",
   "dependencies": {
-    "@agent-relay/bridge": "2.0.11",
-    "@agent-relay/config": "2.0.11",
-    "@agent-relay/continuity": "2.0.11",
-    "@agent-relay/daemon": "2.0.11",
-    "@agent-relay/hooks": "2.0.11",
-    "@agent-relay/protocol": "2.0.11",
-    "@agent-relay/resiliency": "2.0.11",
-    "@agent-relay/sdk": "2.0.11",
-    "@agent-relay/storage": "2.0.11",
-    "@agent-relay/telemetry": "2.0.11",
-    "@agent-relay/trajectory": "2.0.11",
-    "@agent-relay/user-directory": "2.0.11",
-    "@agent-relay/utils": "2.0.11",
-    "@agent-relay/wrapper": "2.0.11",
+    "@agent-relay/bridge": "2.0.12",
+    "@agent-relay/config": "2.0.12",
+    "@agent-relay/continuity": "2.0.12",
+    "@agent-relay/daemon": "2.0.12",
+    "@agent-relay/hooks": "2.0.12",
+    "@agent-relay/protocol": "2.0.12",
+    "@agent-relay/resiliency": "2.0.12",
+    "@agent-relay/sdk": "2.0.12",
+    "@agent-relay/storage": "2.0.12",
+    "@agent-relay/telemetry": "2.0.12",
+    "@agent-relay/trajectory": "2.0.12",
+    "@agent-relay/user-directory": "2.0.12",
+    "@agent-relay/utils": "2.0.12",
+    "@agent-relay/wrapper": "2.0.12",
     "@nangohq/node": "^0.69.20",
     "@types/jsonwebtoken": "^9.0.10",
     "agent-trajectories": "^0.2.3",

package/packages/api-types/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-relay/api-types",
-  "version": "2.0.11",
+  "version": "2.0.12",
   "description": "Shared API types and Zod schemas for Agent Relay",
   "type": "module",
   "main": "dist/index.js",

package/packages/bridge/dist/spawner.js

@@ -13,6 +13,7 @@ import { resolveCommand } from '@agent-relay/utils/command-resolver';
 import { createTraceableError } from '@agent-relay/utils/error-tracking';
 import { createLogger } from '@agent-relay/utils/logger';
 import { mapModelToCli } from '@agent-relay/utils/model-mapping';
+import { findRelayPtyBinary as findRelayPtyBinaryUtil } from '@agent-relay/utils/relay-pty-path';
 import { RelayPtyOrchestrator } from '@agent-relay/wrapper';
 import { selectShadowCli } from './shadow-cli.js';
 // Get the directory where this module is located (for binary path resolution)
@@ -182,78 +183,10 @@ function getRelayInstructions(agentName, options = {}) {
 /**
  * Check if the relay-pty binary is available.
  * Returns the path to the binary if found, null otherwise.
- *
- * Search order:
- * 1. bin/relay-pty in package root (installed by postinstall)
- * 2. relay-pty/target/release/relay-pty (local Rust build)
- * 3. /usr/local/bin/relay-pty (global install)
- * 4. In node_modules when installed as dependency
- * 5. Global npm installs (nvm) - both scoped and root packages
+ * Uses shared utility from @agent-relay/utils.
  */
 function findRelayPtyBinary() {
-    // Determine the agent-relay package root
-    // This code runs from either:
-    // - packages/bridge/dist/ (development/workspace)
-    // - node_modules/@agent-relay/bridge/dist/ (npm install)
-    //
-    // We need to find the agent-relay package root where bin/relay-pty lives
-    let packageRoot;
-    // Check if we're inside node_modules/@agent-relay/bridge/
-    if (__dirname.includes('node_modules/@agent-relay/bridge')) {
-        // Go from node_modules/@agent-relay/bridge/dist/ to agent-relay/
-        // dist/ -> bridge/ -> @agent-relay/ -> node_modules/ -> agent-relay/
-        packageRoot = path.join(__dirname, '..', '..', '..', '..');
-    }
-    else if (__dirname.includes('node_modules/agent-relay')) {
-        // Direct dependency: node_modules/agent-relay/packages/bridge/dist/
-        // dist/ -> bridge/ -> packages/ -> agent-relay/
-        packageRoot = path.join(__dirname, '..', '..', '..');
-    }
-    else {
-        // Development: packages/bridge/dist/ -> packages/ -> project root
-        packageRoot = path.join(__dirname, '..', '..', '..');
-    }
-    // Find the node_modules root for global installs
-    // When running from node_modules/@agent-relay/dashboard/node_modules/@agent-relay/bridge/dist/
-    // we need to look for agent-relay at node_modules/agent-relay
-    let nodeModulesRoot = null;
-    const nodeModulesMatch = __dirname.match(/^(.+?\/node_modules)\/@agent-relay\//);
-    if (nodeModulesMatch) {
-        nodeModulesRoot = nodeModulesMatch[1];
-    }
-    const candidates = [
-        // Primary: installed by postinstall from platform-specific binary
-        path.join(packageRoot, 'bin', 'relay-pty'),
-        // Development: local Rust build
-        path.join(packageRoot, 'relay-pty', 'target', 'release', 'relay-pty'),
-        path.join(packageRoot, 'relay-pty', 'target', 'debug', 'relay-pty'),
-        // Local build in cwd (for development)
-        path.join(process.cwd(), 'relay-pty', 'target', 'release', 'relay-pty'),
-        // Installed globally
-        '/usr/local/bin/relay-pty',
-        // In node_modules (when installed as local dependency)
-        path.join(process.cwd(), 'node_modules', 'agent-relay', 'bin', 'relay-pty'),
-        // Global npm install (nvm) - root package
-        path.join(process.env.HOME || '', '.nvm', 'versions', 'node', process.version, 'lib', 'node_modules', 'agent-relay', 'bin', 'relay-pty'),
-    ];
-    // Add candidate for root agent-relay package when running from scoped @agent-relay/* packages
-    if (nodeModulesRoot) {
-        candidates.push(path.join(nodeModulesRoot, 'agent-relay', 'bin', 'relay-pty'));
-    }
-    // Try common global npm paths
-    if (process.env.HOME) {
-        // Homebrew npm (macOS)
-        candidates.push(path.join('/usr/local/lib/node_modules', 'agent-relay', 'bin', 'relay-pty'));
-        candidates.push(path.join('/opt/homebrew/lib/node_modules', 'agent-relay', 'bin', 'relay-pty'));
-        // pnpm global
-        candidates.push(path.join(process.env.HOME, '.local', 'share', 'pnpm', 'global', 'node_modules', 'agent-relay', 'bin', 'relay-pty'));
-    }
-    for (const candidate of candidates) {
-        if (fs.existsSync(candidate)) {
-            return candidate;
-        }
-    }
-    return null;
+    return findRelayPtyBinaryUtil(__dirname);
 }
 /** Cached result of relay-pty binary check */
 let relayPtyBinaryPath;

package/packages/bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-relay/bridge",
-  "version": "2.0.11",
+  "version": "2.0.12",
   "description": "Multi-project bridge client utilities for Relay",
   "type": "module",
   "main": "dist/index.js",
@@ -22,12 +22,12 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@agent-relay/protocol": "2.0.11",
-    "@agent-relay/config": "2.0.11",
-    "@agent-relay/utils": "2.0.11",
-    "@agent-relay/policy": "2.0.11",
-    "@agent-relay/user-directory": "2.0.11",
-    "@agent-relay/wrapper": "2.0.11"
+    "@agent-relay/protocol": "2.0.12",
+    "@agent-relay/config": "2.0.12",
+    "@agent-relay/utils": "2.0.12",
+    "@agent-relay/policy": "2.0.12",
+    "@agent-relay/user-directory": "2.0.12",
+    "@agent-relay/wrapper": "2.0.12"
   },
   "devDependencies": {
     "@types/node": "^22.19.3",

package/packages/cloud/dist/api/cli-pty-runner.js

@@ -7,8 +7,7 @@
  * Uses the relay-pty Rust binary for PTY emulation.
  */
 import { spawn } from 'node:child_process';
-import { existsSync } from 'node:fs';
-import { join, dirname } from 'node:path';
+import { dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { randomUUID } from 'node:crypto';
 // Get the directory where this module is located
@@ -16,6 +15,7 @@ const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 // Import shared config and utilities
 import { CLI_AUTH_CONFIG, stripAnsiCodes, matchesSuccessPattern, findMatchingPrompt, validateProviderConfig, validateAllProviderConfigs as validateAllConfigs, getSupportedProviders, } from '@agent-relay/config/cli-auth-config';
+import { findRelayPtyBinary as findRelayPtyBinaryUtil } from '@agent-relay/utils/relay-pty-path';
 // Re-export everything from shared config for backward compatibility
 export { CLI_AUTH_CONFIG, stripAnsiCodes, matchesSuccessPattern, findMatchingPrompt, validateProviderConfig, getSupportedProviders, };
 // Wrapper that throws instead of returning array (backward compatible)
@@ -27,31 +27,10 @@ export function validateAllProviderConfigs() {
 }
 /**
  * Find the relay-pty binary path.
- * Returns null if not found.
+ * Uses shared utility from @agent-relay/utils.
  */
 function findRelayPtyBinary() {
-    // Get the project root (five levels up from packages/cloud/dist/api/)
-    // packages/cloud/dist/api/ -> packages/cloud/dist -> packages/cloud -> packages -> project root
-    const projectRoot = join(__dirname, '..', '..', '..', '..', '..');
-    const candidates = [
-        // Primary: installed by postinstall from platform-specific binary
-        join(projectRoot, 'bin', 'relay-pty'),
-        // Development: local Rust build
-        join(projectRoot, 'relay-pty', 'target', 'release', 'relay-pty'),
-        join(projectRoot, 'relay-pty', 'target', 'debug', 'relay-pty'),
-        // Local build in cwd (for development)
-        join(process.cwd(), 'relay-pty', 'target', 'release', 'relay-pty'),
-        // Installed globally
-        '/usr/local/bin/relay-pty',
-        // In node_modules (when installed as dependency)
-        join(process.cwd(), 'node_modules', 'agent-relay', 'bin', 'relay-pty'),
-    ];
-    for (const candidate of candidates) {
-        if (existsSync(candidate)) {
-            return candidate;
-        }
-    }
-    return null;
+    return findRelayPtyBinaryUtil(__dirname);
 }
 /**
  * Run CLI auth flow via PTY using relay-pty binary

package/packages/cloud/dist/api/provider-env.d.ts

@@ -11,4 +11,16 @@ export declare function setProviderApiKeyEnv(userId: string, provider: string, a
     updated: number;
     skipped: number;
 }>;
+/**
+ * Clear provider credentials from workspace(s).
+ * Deletes credential files and unsets environment variables.
+ *
+ * @param userId - User ID
+ * @param provider - Provider name (e.g., 'google', 'anthropic', 'codex')
+ * @param workspaceId - Workspace to clear credentials from
+ */
+export declare function clearProviderCredentials(userId: string, provider: string, workspaceId: string): Promise<{
+    cleared: boolean;
+    error?: string;
+}>;
 //# sourceMappingURL=provider-env.d.ts.map

package/packages/cloud/dist/api/provider-env.js

@@ -4,6 +4,18 @@ const PROVIDER_ENV_VARS = {
     google: 'GEMINI_API_KEY',
     gemini: 'GEMINI_API_KEY',
 };
+/**
+ * All providers that may have credential files on the workspace.
+ * This includes CLI-based providers that store auth locally.
+ */
+const ALL_CREDENTIAL_PROVIDERS = [
+    'anthropic', 'claude',
+    'codex', 'openai',
+    'google', 'gemini',
+    'opencode',
+    'droid', 'factory',
+    'cursor',
+];
 /**
  * Providers that need credential files written to the workspace filesystem.
  * These providers have CLIs that read from files rather than just env vars.
@@ -72,4 +84,58 @@ export async function setProviderApiKeyEnv(userId, provider, apiKey, workspaceId
     const updated = results.filter((result) => result === 'updated').length;
     return { updated, skipped: results.length - updated };
 }
+/**
+ * Clear provider credentials from workspace(s).
+ * Deletes credential files and unsets environment variables.
+ *
+ * @param userId - User ID
+ * @param provider - Provider name (e.g., 'google', 'anthropic', 'codex')
+ * @param workspaceId - Workspace to clear credentials from
+ */
+export async function clearProviderCredentials(userId, provider, workspaceId) {
+    const envVarName = PROVIDER_ENV_VARS[provider];
+    const needsCredentialFileClear = ALL_CREDENTIAL_PROVIDERS.includes(provider);
+    // Get the workspace
+    const workspace = await db.workspaces.findById(workspaceId);
+    if (!workspace) {
+        return { cleared: false, error: 'Workspace not found' };
+    }
+    if (!workspace.publicUrl) {
+        // Workspace not running, credentials will be gone when it restarts anyway
+        return { cleared: true };
+    }
+    // Clear environment variable if applicable
+    if (envVarName && workspace.computeId) {
+        const provisioner = getProvisioner();
+        try {
+            // Set to empty string to clear
+            await provisioner.setWorkspaceEnvVars(workspace, { [envVarName]: '' });
+        }
+        catch (err) {
+            console.warn(`[provider-env] Failed to clear env var ${envVarName} on workspace ${workspace.id}:`, err);
+        }
+    }
+    // Delete credential files from workspace
+    if (needsCredentialFileClear) {
+        try {
+            const response = await fetch(`${workspace.publicUrl}/api/credentials/apikey`, {
+                method: 'DELETE',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ userId, provider }),
+            });
+            if (!response.ok) {
+                const data = await response.json().catch(() => ({}));
+                console.warn(`[provider-env] Failed to delete credential files for ${provider} on workspace ${workspace.id}: ${response.status}`, data);
+                return { cleared: false, error: 'Failed to delete credential files on workspace' };
+            }
+            const data = await response.json();
+            console.log(`[provider-env] Deleted ${provider} credentials for user ${userId} on workspace ${workspace.id}:`, data.deletedPaths);
+        }
+        catch (err) {
+            console.warn(`[provider-env] Error deleting credential files for ${provider} on workspace ${workspace.id}:`, err);
+            return { cleared: false, error: 'Error connecting to workspace' };
+        }
+    }
+    return { cleared: true };
+}
 //# sourceMappingURL=provider-env.js.map

package/packages/cloud/dist/api/providers.js

@@ -9,7 +9,7 @@ import { createClient } from 'redis';
 import { requireAuth } from './auth.js';
 import { getConfig } from '../config.js';
 import { db } from '../db/index.js';
-import { setProviderApiKeyEnv } from './provider-env.js';
+import { setProviderApiKeyEnv, clearProviderCredentials } from './provider-env.js';
 export const providersRouter = Router();
 // All routes require authentication
 providersRouter.use(requireAuth);
@@ -402,6 +402,7 @@ providersRouter.get('/:provider/status/:flowId', (req, res) => {
 /**
  * DELETE /api/providers/:provider
  * Disconnect a provider from a specific workspace
+ * Also clears credential files from the workspace filesystem
  *
  * Query: ?workspaceId=xxx
  */
@@ -420,12 +421,21 @@ providersRouter.delete('/:provider', async (req, res) => {
     }
     const workspaceId = workspaceIdParam;
     const provider = providerParam;
+    // Sanitize for logging (prevent log injection)
+    const safeProvider = String(provider).replace(/[\r\n]/g, '').substring(0, 20);
     try {
+        // Delete from database
         await db.credentials.deleteForWorkspace(userId, workspaceId, provider);
+        // Clear credentials from workspace filesystem
+        const clearResult = await clearProviderCredentials(userId, provider, workspaceId);
+        if (!clearResult.cleared) {
+            console.warn('[providers] Failed to clear workspace credentials', { provider: safeProvider, error: clearResult.error });
+            // Don't fail the request, just warn - database entry was already deleted
+        }
         res.json({ success: true });
     }
     catch (error) {
-        console.error(`Error disconnecting ${provider}:`, error);
+        console.error('[providers] Error disconnecting', { provider: safeProvider, error: error instanceof Error ? error.message : String(error) });
         res.status(500).json({ error: 'Failed to disconnect provider' });
     }
 });

package/packages/cloud/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-relay/cloud",
-  "version": "2.0.11",
+  "version": "2.0.12",
   "description": "Cloud API server and services for Agent Relay",
   "type": "module",
   "main": "dist/index.js",
@@ -38,11 +38,11 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@agent-relay/wrapper": "2.0.11",
-    "@agent-relay/config": "2.0.11",
-    "@agent-relay/resiliency": "2.0.11",
-    "@agent-relay/storage": "2.0.11",
-    "@agent-relay/protocol": "2.0.11"
+    "@agent-relay/wrapper": "2.0.12",
+    "@agent-relay/config": "2.0.12",
+    "@agent-relay/resiliency": "2.0.12",
+    "@agent-relay/storage": "2.0.12",
+    "@agent-relay/protocol": "2.0.12"
   },
   "devDependencies": {
     "@types/node": "^22.19.3",

package/packages/config/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-relay/config",
-  "version": "2.0.11",
+  "version": "2.0.12",
   "description": "Shared configuration schemas and loaders for Agent Relay",
   "type": "module",
   "main": "dist/index.js",
@@ -83,7 +83,7 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@agent-relay/protocol": "2.0.11",
+    "@agent-relay/protocol": "2.0.12",
     "zod": "^3.23.8",
     "zod-to-json-schema": "^3.23.1"
   },

package/packages/continuity/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-relay/continuity",
-  "version": "2.0.11",
+  "version": "2.0.12",
   "description": "Session continuity manager for Relay (ledgers, handoffs, resume)",
   "type": "module",
   "main": "dist/index.js",

package/packages/daemon/dist/cli-auth.js

@@ -8,15 +8,15 @@
  * version compatibility by avoiding native module compilation.
  */
 import { spawn } from 'node:child_process';
-import { existsSync } from 'node:fs';
 import * as fs from 'fs/promises';
 import * as os from 'os';
-import { join, dirname } from 'node:path';
+import { dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import * as crypto from 'crypto';
 import { createLogger } from '@agent-relay/resiliency';
 import { CLI_AUTH_CONFIG, stripAnsiCodes, matchesSuccessPattern, findMatchingPrompt, findMatchingError, getSupportedProviders, } from '@agent-relay/config/cli-auth-config';
 import { getUserDirectoryService } from '@agent-relay/user-directory';
+import { findRelayPtyBinary as findRelayPtyBinaryUtil } from '@agent-relay/utils/relay-pty-path';
 // Get the directory where this module is located
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -25,31 +25,10 @@ const logger = createLogger('cli-auth');
 export { CLI_AUTH_CONFIG, getSupportedProviders };
 /**
  * Find the relay-pty binary path.
- * Returns null if not found.
+ * Uses shared utility from @agent-relay/utils.
  */
 function findRelayPtyBinary() {
-    // Get the project root (four levels up from packages/daemon/dist/)
-    // packages/daemon/dist/ -> packages/daemon -> packages -> project root
-    const projectRoot = join(__dirname, '..', '..', '..', '..');
-    const candidates = [
-        // Primary: installed by postinstall from platform-specific binary
-        join(projectRoot, 'bin', 'relay-pty'),
-        // Development: local Rust build
-        join(projectRoot, 'relay-pty', 'target', 'release', 'relay-pty'),
-        join(projectRoot, 'relay-pty', 'target', 'debug', 'relay-pty'),
-        // Local build in cwd (for development)
-        join(process.cwd(), 'relay-pty', 'target', 'release', 'relay-pty'),
-        // Installed globally
-        '/usr/local/bin/relay-pty',
-        // In node_modules (when installed as dependency)
-        join(process.cwd(), 'node_modules', 'agent-relay', 'bin', 'relay-pty'),
-    ];
-    for (const candidate of candidates) {
-        if (existsSync(candidate)) {
-            return candidate;
-        }
-    }
-    return null;
+    return findRelayPtyBinaryUtil(__dirname);
 }
 // Active sessions
 const sessions = new Map();

package/packages/daemon/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-relay/daemon",
-  "version": "2.0.11",
+  "version": "2.0.12",
   "description": "Relay daemon server - agent coordination and message routing",
   "type": "module",
   "main": "dist/index.js",
@@ -22,17 +22,17 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@agent-relay/protocol": "2.0.11",
-    "@agent-relay/config": "2.0.11",
-    "@agent-relay/storage": "2.0.11",
-    "@agent-relay/bridge": "2.0.11",
-    "@agent-relay/utils": "2.0.11",
-    "@agent-relay/policy": "2.0.11",
-    "@agent-relay/memory": "2.0.11",
-    "@agent-relay/resiliency": "2.0.11",
-    "@agent-relay/user-directory": "2.0.11",
-    "@agent-relay/wrapper": "2.0.11",
-    "@agent-relay/telemetry": "2.0.11",
+    "@agent-relay/protocol": "2.0.12",
+    "@agent-relay/config": "2.0.12",
+    "@agent-relay/storage": "2.0.12",
+    "@agent-relay/bridge": "2.0.12",
+    "@agent-relay/utils": "2.0.12",
+    "@agent-relay/policy": "2.0.12",
+    "@agent-relay/memory": "2.0.12",
+    "@agent-relay/resiliency": "2.0.12",
+    "@agent-relay/user-directory": "2.0.12",
+    "@agent-relay/wrapper": "2.0.12",
+    "@agent-relay/telemetry": "2.0.12",
     "ws": "^8.18.3",
     "better-sqlite3": "^12.6.2",
     "pg": "^8.16.3",

package/packages/dashboard/dist/server.js

@@ -3422,6 +3422,38 @@ export async function startDashboard(portOrOptions, dataDirArg, teamDirArg, dbPa
             res.status(500).json({ error: 'Failed to write credential file' });
         }
     });
+    /**
+     * DELETE /api/credentials/apikey - Delete API key credential from user's home directory
+     * Used by cloud API to clear provider credentials when disconnecting
+     */
+    app.delete('/api/credentials/apikey', express.json(), async (req, res) => {
+        const { userId, provider } = req.body;
+        if (!userId || typeof userId !== 'string') {
+            return res.status(400).json({ error: 'userId is required' });
+        }
+        if (!provider || typeof provider !== 'string') {
+            return res.status(400).json({ error: 'provider is required' });
+        }
+        // Sanitize for logging (prevent log injection)
+        const safeProvider = String(provider).replace(/[\r\n]/g, '').substring(0, 20);
+        const safeUserId = String(userId).replace(/[\r\n]/g, '').substring(0, 50);
+        try {
+            // Dynamically import to avoid loading user-directory in all cases
+            const { getUserDirectoryService } = await import('@agent-relay/user-directory');
+            const userDirService = getUserDirectoryService();
+            const deletedPaths = userDirService.deleteProviderCredentials(userId, provider);
+            console.log('[credentials] Deleted credentials', { provider: safeProvider, userId: safeUserId, count: deletedPaths.length });
+            res.json({
+                success: true,
+                message: 'credentials deleted',
+                deletedPaths,
+            });
+        }
+        catch (err) {
+            console.error('[credentials] Failed to delete credentials', { provider: safeProvider, userId: safeUserId, error: err instanceof Error ? err.message : String(err) });
+            res.status(500).json({ error: 'Failed to delete credential files' });
+        }
+    });
     // ===== Metrics API =====
     /**
      * GET /api/metrics - JSON format metrics for dashboard

package/packages/dashboard/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-relay/dashboard",
-  "version": "2.0.11",
+  "version": "2.0.12",
   "description": "Web dashboard for Agent Relay - optional package for visual agent coordination",
   "type": "module",
   "main": "dist/index.js",
@@ -25,17 +25,17 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@agent-relay/protocol": "2.0.11",
-    "@agent-relay/config": "2.0.11",
-    "@agent-relay/storage": "2.0.11",
-    "@agent-relay/bridge": "2.0.11",
-    "@agent-relay/utils": "2.0.11",
-    "@agent-relay/resiliency": "2.0.11",
-    "@agent-relay/trajectory": "2.0.11",
-    "@agent-relay/cloud": "2.0.11",
-    "@agent-relay/daemon": "2.0.11",
-    "@agent-relay/user-directory": "2.0.11",
-    "@agent-relay/wrapper": "2.0.11",
+    "@agent-relay/protocol": "2.0.12",
+    "@agent-relay/config": "2.0.12",
+    "@agent-relay/storage": "2.0.12",
+    "@agent-relay/bridge": "2.0.12",
+    "@agent-relay/utils": "2.0.12",
+    "@agent-relay/resiliency": "2.0.12",
+    "@agent-relay/trajectory": "2.0.12",
+    "@agent-relay/cloud": "2.0.12",
+    "@agent-relay/daemon": "2.0.12",
+    "@agent-relay/user-directory": "2.0.12",
+    "@agent-relay/wrapper": "2.0.12",
     "express": "^5.2.1",
     "ws": "^8.18.3"
   },

package/packages/dashboard/ui/react-components/settings/WorkspaceSettingsPanel.tsx

@@ -158,6 +158,9 @@ export function WorkspaceSettingsPanel({
     google: true,    // Default to terminal for Gemini - allows choosing OAuth or API key
   });
 
+  // Provider disconnection state
+  const [disconnectingProvider, setDisconnectingProvider] = useState<string | null>(null);
+
   // Repo sync state
   const [syncingRepoId, setSyncingRepoId] = useState<string | null>(null);
 
@@ -231,6 +234,34 @@ export function WorkspaceSettingsPanel({
     // ProviderAuthFlow will handle the rest when it mounts
   };
 
+  // Disconnect a provider
+  const handleDisconnectProvider = useCallback(async (provider: AIProvider) => {
+    const confirmed = window.confirm(
+      `Are you sure you want to disconnect ${provider.displayName}? This will remove the authentication and delete credential files from the workspace.`
+    );
+    if (!confirmed) return;
+
+    setDisconnectingProvider(provider.id);
+    setProviderError(null);
+
+    try {
+      const result = await cloudApi.disconnectProvider(provider.id, workspaceId);
+      if (result.success) {
+        setProviderStatus(prev => {
+          const updated = { ...prev };
+          delete updated[provider.id];
+          return updated;
+        });
+      } else {
+        setProviderError(result.error);
+      }
+    } catch (err) {
+      setProviderError(err instanceof Error ? err.message : 'Failed to disconnect provider');
+    } finally {
+      setDisconnectingProvider(null);
+    }
+  }, [workspaceId]);
+
   const submitApiKey = async (provider: AIProvider) => {
     if (!apiKeyInput.trim()) {
       setProviderError('Please enter an API key');
@@ -605,9 +636,19 @@ export function WorkspaceSettingsPanel({
                     </div>
 
                     {providerStatus[provider.id] ? (
-                      <div className="flex items-center gap-2 px-4 py-2 bg-success/15 rounded-full border border-success/30">
-                        <div className="w-2 h-2 rounded-full bg-success animate-pulse" />
-                        <span className="text-sm font-medium text-success">Connected</span>
+                      <div className="flex items-center gap-3">
+                        <div className="flex items-center gap-2 px-4 py-2 bg-success/15 rounded-full border border-success/30">
+                          <div className="w-2 h-2 rounded-full bg-success animate-pulse" />
+                          <span className="text-sm font-medium text-success">Connected</span>
+                        </div>
+                        <button
+                          onClick={() => handleDisconnectProvider(provider)}
+                          disabled={disconnectingProvider === provider.id}
+                          className="px-3 py-2 text-xs font-medium text-error/80 hover:text-error hover:bg-error/10 rounded-lg border border-transparent hover:border-error/30 transition-all disabled:opacity-50 disabled:cursor-not-allowed"
+                          title={`Disconnect ${provider.displayName}`}
+                        >
+                          {disconnectingProvider === provider.id ? 'Disconnecting...' : 'Disconnect'}
+                        </button>
                       </div>
                     ) : null}
                   </div>