agent-relay 2.0.21 → 2.0.23

package/deploy/workspace/entrypoint.sh

@@ -1,612 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-log() {
-  echo "[workspace] $*"
-}
-
-# Debug logging function
-debug() {
-  if [[ "${GH_CREDENTIAL_DEBUG:-}" == "1" ]]; then
-    echo "[workspace:debug] $*" >&2
-  fi
-}
-
-# Fix volume permissions and drop to workspace user if running as root
-if [[ "$(id -u)" == "0" ]]; then
-  # Fix /data and /workspace permissions before dropping privileges
-  # Fresh Fly.io volumes are root-owned, need to chown for workspace user
-  log "Fixing volume permissions..."
-  chown -R workspace:workspace /data /workspace 2>/dev/null || true
-
-  # ============================================================================
-  # SSH Server Setup (for CLI tunneling - Codex OAuth callback forwarding)
-  # When ENABLE_SSH=true, start SSH server on port 3022 for secure tunneling
-  # ============================================================================
-  if [[ "${ENABLE_SSH:-false}" == "true" ]]; then
-    SSH_PORT="${SSH_PORT:-3022}"
-    log "Starting SSH server on port ${SSH_PORT}..."
-
-    # Set SSH password for workspace user
-    SSH_PASS="${SSH_PASSWORD:-devpassword}"
-    echo "workspace:${SSH_PASS}" | chpasswd
-
-    # Configure SSH server for tunneling
-    # - Allow password auth (for CLI simplicity)
-    # - Listen on port 3022 (non-privileged)
-    # - Allow TCP forwarding (for port tunneling)
-    mkdir -p /etc/ssh/sshd_config.d
-    cat > /etc/ssh/sshd_config.d/workspace.conf <<SSHEOF
-Port ${SSH_PORT}
-PasswordAuthentication yes
-PermitRootLogin no
-AllowUsers workspace
-AllowTcpForwarding yes
-GatewayPorts no
-X11Forwarding no
-SSHEOF
-
-    # Start SSH server in background
-    /usr/sbin/sshd -e -p "${SSH_PORT}"
-    log "SSH server started (port ${SSH_PORT}, user: workspace)"
-  fi
-
-  # ============================================================================
-  # Persist workspace environment for SSH sessions (must be done as root)
-  # SSH sessions don't inherit the container's runtime environment, so we write
-  # critical variables to /etc/profile.d/ which gets sourced by login shells
-  # ============================================================================
-  if [[ -n "${CLOUD_API_URL:-}" || -n "${WORKSPACE_ID:-}" ]]; then
-    log "Persisting workspace environment for SSH sessions"
-    # Compute HOME path for the env file
-    _DATA_DIR="${AGENT_RELAY_DATA_DIR:-/data}"
-    if [[ -n "${WORKSPACE_OWNER_USER_ID:-}" ]]; then
-      _USER_HOME="${_DATA_DIR}/users/${WORKSPACE_OWNER_USER_ID}"
-    else
-      _USER_HOME="/home/workspace"
-    fi
-    cat > /etc/profile.d/workspace-env.sh <<ENVEOF
-# Workspace environment variables (auto-generated by entrypoint.sh)
-export WORKSPACE_ID="${WORKSPACE_ID:-}"
-export WORKSPACE_OWNER_USER_ID="${WORKSPACE_OWNER_USER_ID:-}"
-export CLOUD_API_URL="${CLOUD_API_URL:-}"
-export WORKSPACE_TOKEN="${WORKSPACE_TOKEN:-}"
-export WORKSPACE_DIR="${WORKSPACE_DIR:-/workspace}"
-export HOME="${_USER_HOME}"
-export AGENT_RELAY_USER_ID="${WORKSPACE_OWNER_USER_ID:-}"
-export AGENT_RELAY_DATA_DIR="${_DATA_DIR}"
-export AGENT_RELAY_API_KEY="${AGENT_RELAY_API_KEY:-}"
-
-# Source GH_TOKEN from user-writable file if available (written after startup)
-# This enables SSH sessions to use the token fetched during container init
-if [[ -f "${_USER_HOME}/.gh_token" ]]; then
-  source "${_USER_HOME}/.gh_token"
-fi
-ENVEOF
-    chmod 644 /etc/profile.d/workspace-env.sh
-  fi
-
-  log "Dropping privileges to workspace user..."
-  exec gosu workspace "$0" "$@"
-fi
-
-PORT="${AGENT_RELAY_DASHBOARD_PORT:-${PORT:-3888}}"
-export AGENT_RELAY_DASHBOARD_PORT="${PORT}"
-export PORT="${PORT}"
-
-# Disable auto-updates for AI CLIs in container environments
-# Prevents permission errors when CLIs try to self-update with npm/pip
-export DISABLE_AUTOUPDATER=1
-# Belt-and-suspenders flags to block Codex/OpenAI update checks
-export CODEX_CHECK_FOR_UPDATES=false
-export CODEX_DISABLE_AUTOUPDATE=1
-export OPENAI_CLI_NO_UPDATE=1
-export NO_UPDATE_NOTIFIER=1
-export NPM_CONFIG_UPDATE_NOTIFIER=false
-log "Auto-updates disabled for AI CLIs (container environment)"
-
-# ============================================================================
-# Git credential helper configuration
-# Clean up conflicting credential helpers that gh CLI or other tools may set
-# git-credential-relay requires no host-specific overrides to work properly
-# ============================================================================
-git config --global --unset-all 'credential.https://github.com.helper' 2>/dev/null || true
-git config --global --unset-all 'credential.https://gist.github.com.helper' 2>/dev/null || true
-log "Git credential helper configured (removed conflicting gh auth overrides)"
-
-# ============================================================================
-# Per-user credential storage setup
-# Create user-specific HOME on persistent volume (/data)
-# This enables multi-user workspaces where each user has their own credentials
-# ============================================================================
-DATA_DIR="${AGENT_RELAY_DATA_DIR:-/data}"
-if [[ -n "${WORKSPACE_OWNER_USER_ID:-}" ]]; then
-  USER_HOME="${DATA_DIR}/users/${WORKSPACE_OWNER_USER_ID}"
-  log "Setting up per-user HOME at ${USER_HOME}"
-  mkdir -p "${USER_HOME}"
-  mkdir -p "${USER_HOME}/.claude"
-  mkdir -p "${USER_HOME}/.codex"
-  mkdir -p "${USER_HOME}/.config/gcloud"
-  mkdir -p "${USER_HOME}/.config/gh"
-  export HOME="${USER_HOME}"
-  # Ensure user-local bin is on PATH for per-user shims/wrappers
-  export PATH="${HOME}/.local/bin:${PATH}"
-  export XDG_CONFIG_HOME="${USER_HOME}/.config"
-  export AGENT_RELAY_USER_ID="${WORKSPACE_OWNER_USER_ID}"
-  log "HOME set to ${HOME} (user: ${WORKSPACE_OWNER_USER_ID})"
-else
-  log "No WORKSPACE_OWNER_USER_ID set, using default HOME: ${HOME}"
-fi
-
-WORKSPACE_DIR="${WORKSPACE_DIR:-/workspace}"
-REPO_LIST="${REPOSITORIES:-}"
-
-mkdir -p "${WORKSPACE_DIR}"
-cd "${WORKSPACE_DIR}"
-
-# Configure Git credentials via the gateway (tokens auto-refresh via Nango)
-# The credential helper fetches fresh tokens from the cloud API on each git operation
-if [[ -n "${CLOUD_API_URL:-}" && -n "${WORKSPACE_ID:-}" && -n "${WORKSPACE_TOKEN:-}" ]]; then
-  log "Configuring git credential helper (gateway mode)"
-  git config --global credential.helper "/usr/local/bin/git-credential-relay"
-  git config --global credential.useHttpPath true
-  export GIT_TERMINAL_PROMPT=0
-
-  # ============================================================================
-  # PRE-FETCH GitHub token at startup and export to environment
-  # This ensures GH_TOKEN is available for git operations and spawned agents
-  # even if cloud API becomes unreachable later. The credential helper's
-  # fallback chain will use this token (env > hosts.yml > gh CLI > cloud API).
-  # ============================================================================
-  if [[ -z "${GH_TOKEN:-}" ]]; then
-    log "Fetching GitHub token from cloud API (with retry)..."
-    
-    GH_TOKEN_MAX_RETRIES=3
-    GH_TOKEN_RETRY_DELAY=2
-    GH_TOKEN_FETCHED=""
-    
-    for attempt in $(seq 1 $GH_TOKEN_MAX_RETRIES); do
-      log "Attempt $attempt/$GH_TOKEN_MAX_RETRIES to fetch token..."
-      
-      # Remove -f flag to capture error responses, use -w to get HTTP status
-      GH_TOKEN_HTTP_CODE=0
-      GH_TOKEN_RESPONSE=$(curl -s -w "\n%{http_code}" --max-time 10 \
-        -H "Authorization: Bearer ${WORKSPACE_TOKEN}" \
-        "${CLOUD_API_URL}/api/git/token?workspaceId=${WORKSPACE_ID}" 2>&1) || true
-      
-      # Split response and status code
-      GH_TOKEN_HTTP_CODE=$(echo "$GH_TOKEN_RESPONSE" | tail -1)
-      GH_TOKEN_RESPONSE=$(echo "$GH_TOKEN_RESPONSE" | head -n -1)
-      
-      debug "HTTP Status: $GH_TOKEN_HTTP_CODE"
-      debug "Response: ${GH_TOKEN_RESPONSE:0:200}"
-      
-      # Handle different failure modes
-      case "$GH_TOKEN_HTTP_CODE" in
-        200)
-          # Success - parse token
-          FETCHED_TOKEN=$(echo "$GH_TOKEN_RESPONSE" | jq -r '.userToken // .token // empty' 2>/dev/null)
-          if [[ -n "${FETCHED_TOKEN}" && "${FETCHED_TOKEN}" != "null" ]]; then
-            export GH_TOKEN="${FETCHED_TOKEN}"
-            export GITHUB_TOKEN="${FETCHED_TOKEN}"
-            echo "export GH_TOKEN=\"${FETCHED_TOKEN}\"" > "${HOME}/.gh_token"
-            echo "export GITHUB_TOKEN=\"${FETCHED_TOKEN}\"" >> "${HOME}/.gh_token"
-            chmod 600 "${HOME}/.gh_token"
-            log "✓ GH_TOKEN fetched successfully (attempt $attempt)"
-            GH_TOKEN_FETCHED="yes"
-            break
-          else
-            log "WARN: Response 200 but no token in JSON response"
-            GH_TOKEN_FETCHED="empty-response"
-          fi
-          ;;
-        401|403)
-          # Auth error - don't retry
-          log "ERROR: Authentication failed (HTTP $GH_TOKEN_HTTP_CODE)"
-          log "      Check WORKSPACE_TOKEN and CLOUD_API_URL credentials"
-          GH_TOKEN_FETCHED="auth-error"
-          break
-          ;;
-        000|28)
-          # Network timeout (000=curl error, 28=timeout)
-          log "WARN: Network timeout on attempt $attempt"
-          [[ $attempt -lt $GH_TOKEN_MAX_RETRIES ]] && sleep $((GH_TOKEN_RETRY_DELAY * (2 ** (attempt - 1))))
-          ;;
-        *)
-          # Other HTTP errors - could be transient, retry
-          log "WARN: HTTP $GH_TOKEN_HTTP_CODE on attempt $attempt"
-          [[ $attempt -lt $GH_TOKEN_MAX_RETRIES ]] && sleep $((GH_TOKEN_RETRY_DELAY * (2 ** (attempt - 1))))
-          ;;
-      esac
-    done
-    
-    # Final status
-    if [[ -z "$GH_TOKEN_FETCHED" ]]; then
-      log "WARN: Could not fetch GitHub token after $GH_TOKEN_MAX_RETRIES attempts"
-      log "      Git operations will use credential helper fallback chain"
-    fi
-  else
-    log "GH_TOKEN already set in environment"
-  fi
-
-  # Configure git identity for commits
-  # Use env vars if set, otherwise default to "Agent Relay" / "agent@agent-relay.com"
-  DEFAULT_GIT_EMAIL="${AGENT_NAME:-agent}@agent-relay.com"
-  git config --global user.name "${GIT_USER_NAME:-Agent Relay}"
-  git config --global user.email "${GIT_USER_EMAIL:-${DEFAULT_GIT_EMAIL}}"
-  log "Git identity configured: ${GIT_USER_NAME:-Agent Relay} <${GIT_USER_EMAIL:-${DEFAULT_GIT_EMAIL}}>"
-
-  # Configure gh CLI
-  # NOTE: Do NOT create hosts.yml with placeholder - it causes migration errors
-  # when combined with GH_TOKEN. The gh-relay wrapper in /usr/local/bin/gh
-  # handles token refresh automatically with caching.
-  # Install and configure gh-credential-relay credential helper
-  # This allows gh CLI to fetch fresh tokens from cloud API on-demand
-  if [[ -f "/app/deploy/workspace/gh-credential-relay" ]]; then
-    sudo install -m 755 /app/deploy/workspace/gh-credential-relay /usr/local/bin/gh-credential-relay
-    gh config set -h github.com credential-helper gh-credential-relay 2>/dev/null || true
-    log "Configured gh CLI to use cloud API credential helper"
-  fi
-
-  mkdir -p "${HOME}/.config/gh"
-  # Remove any stale hosts.yml that might cause migration errors
-  rm -f "${HOME}/.config/gh/hosts.yml"
-
-  # The gh-relay wrapper is installed at /usr/local/bin/gh during Docker build.
-  # It fetches fresh tokens from /api/git/token and caches them for 55 minutes.
-  # This handles the case where GH_TOKEN expires after ~1 hour.
-  if [[ -x "/usr/local/bin/gh" ]]; then
-    log "GitHub CLI wrapper installed at /usr/local/bin/gh (auto-refreshing tokens)"
-  fi
-
-# Fallback: Use static GITHUB_TOKEN if provided (legacy mode)
-elif [[ -n "${GITHUB_TOKEN:-}" ]]; then
-  log "Configuring git credentials (legacy static token mode)"
-  GIT_ASKPASS_SCRIPT="/tmp/git-askpass.sh"
-  cat > "${GIT_ASKPASS_SCRIPT}" <<'EOF'
-#!/usr/bin/env bash
-prompt="${1:-}"
-if [[ "${prompt}" == *"Username"* ]]; then
-  echo "x-access-token"
-else
-  echo "${GITHUB_TOKEN}"
-fi
-EOF
-  chmod +x "${GIT_ASKPASS_SCRIPT}"
-  export GIT_ASKPASS="${GIT_ASKPASS_SCRIPT}"
-  export GIT_TERMINAL_PROMPT=0
-  export GH_TOKEN="${GITHUB_TOKEN}"
-
-  # Configure git identity for commits
-  DEFAULT_GIT_EMAIL="${AGENT_NAME:-agent}@agent-relay.com"
-  git config --global user.name "${GIT_USER_NAME:-Agent Relay}"
-  git config --global user.email "${GIT_USER_EMAIL:-${DEFAULT_GIT_EMAIL}}"
-  log "Git identity configured: ${GIT_USER_NAME:-Agent Relay} <${GIT_USER_EMAIL:-${DEFAULT_GIT_EMAIL}}>"
-fi
-
-clone_or_update_repo() {
-  local repo="$1"
-  repo="${repo// /}"
-  if [[ -z "${repo}" ]]; then
-    return
-  fi
-
-  local repo_name
-  repo_name="$(basename "${repo}")"
-  local target="${WORKSPACE_DIR}/${repo_name}"
-  local url="https://github.com/${repo}.git"
-
-  if [[ -d "${target}/.git" ]]; then
-    log "Updating ${repo}..."
-    git -C "${target}" remote set-url origin "${url}" >/dev/null 2>&1 || true
-    git -C "${target}" fetch --all --prune >/dev/null 2>&1 || true
-    git -C "${target}" pull --ff-only >/dev/null 2>&1 || true
-  else
-    log "Cloning ${repo}..."
-    # Use shallow clone for faster initial setup (full history not needed for most agent work)
-    # SHALLOW_CLONE env var can be set to "false" to disable this optimization
-    if [[ "${SHALLOW_CLONE:-true}" == "true" ]]; then
-      git clone --depth=1 "${url}" "${target}" >/dev/null 2>&1 || {
-        log "WARN: Failed to clone ${repo}"
-      }
-    else
-      git clone "${url}" "${target}" >/dev/null 2>&1 || {
-        log "WARN: Failed to clone ${repo}"
-      }
-    fi
-  fi
-  # Note: safe.directory config is done after all clones complete (batched)
-}
-
-if [[ -n "${REPO_LIST}" ]]; then
-  # Check if we have credentials configured (gateway mode or static token)
-  if [[ -z "${GITHUB_TOKEN:-}" && -z "${CLOUD_API_URL:-}" ]]; then
-    log "WARN: REPOSITORIES set but no credentials configured; clones may fail."
-  fi
-
-  IFS=',' read -ra repos <<< "${REPO_LIST}"
-
-  # Clone repositories in PARALLEL for faster startup
-  # Each clone runs in background, then we wait for all to complete
-  log "Cloning ${#repos[@]} repositories in parallel..."
-  for repo in "${repos[@]}"; do
-    clone_or_update_repo "${repo}" &
-  done
-
-  # Wait for all background clone jobs to complete
-  wait
-  log "All repository clones complete"
-
-  # Batch configure safe.directory for all cloned repos (runs once, not per-repo)
-  # This prevents "dubious ownership" errors when git runs as different user
-  for repo in "${repos[@]}"; do
-    repo="${repo// /}"
-    if [[ -n "${repo}" ]]; then
-      repo_name="$(basename "${repo}")"
-      target="${WORKSPACE_DIR}/${repo_name}"
-      if [[ -d "${target}/.git" ]]; then
-        git config --global --add safe.directory "${target}" 2>/dev/null || true
-      fi
-    fi
-  done
-fi
-
-# ============================================================================
-# Configure agent policy enforcement for cloud workspaces
-# Policy is fetched from cloud API and enforced at runtime
-# ============================================================================
-
-if [[ -n "${CLOUD_API_URL:-}" && -n "${WORKSPACE_ID:-}" ]]; then
-  log "Enabling agent policy enforcement"
-  export AGENT_POLICY_ENFORCEMENT=1
-  # Policy is fetched from ${CLOUD_API_URL}/api/policy/${WORKSPACE_ID}/internal
-fi
-
-# ============================================================================
-# Configure AI provider credentials
-# Create credential files that CLIs expect from ENV vars passed by provisioner
-# ============================================================================
-
-# Claude CLI expects ~/.claude/.credentials.json (note the dot prefix on filename)
-# Format: { claudeAiOauth: { accessToken: "...", refreshToken: "...", expiresAt: ... } }
-if [[ -n "${ANTHROPIC_TOKEN:-}" ]]; then
-  log "Configuring Claude credentials..."
-  mkdir -p "${HOME}/.claude"
-  cat > "${HOME}/.claude/.credentials.json" <<EOF
-{
-  "claudeAiOauth": {
-    "accessToken": "${ANTHROPIC_TOKEN}",
-    "refreshToken": "${ANTHROPIC_REFRESH_TOKEN:-}",
-    "expiresAt": ${ANTHROPIC_TOKEN_EXPIRES_AT:-null}
-  }
-}
-EOF
-  chmod 600 "${HOME}/.claude/.credentials.json"
-fi
-
-# Configure Claude Code for cloud workspaces
-# Create both settings and instructions files
-log "Configuring Claude Code for cloud workspace..."
-mkdir -p "${HOME}/.claude"
-
-# Create settings.json with MCP server config and auto-accept permissions
-# This tells Claude Code to skip the "Ready to code here?" permission prompt
-# Reference: Claude Code uses this for headless/automated environments
-# IMPORTANT: Must include mcpServers config (Dockerfile version gets overwritten here)
-cat > "${HOME}/.claude/settings.json" <<'SETTINGSEOF'
-{
-  "mcpServers": {
-    "agent-relay": {
-      "command": "node",
-      "args": ["/app/dist/src/cli/index.js", "mcp", "serve"]
-    }
-  },
-  "permissions": {
-    "allow": [
-      "Read",
-      "Edit",
-      "Write",
-      "Bash",
-      "Glob",
-      "Grep",
-      "Task",
-      "WebFetch",
-      "WebSearch",
-      "NotebookEdit",
-      "TodoWrite",
-      "mcp__agent-relay__*"
-    ],
-    "deny": []
-  },
-  "autoApproveApiRequest": true
-}
-SETTINGSEOF
-chmod 600 "${HOME}/.claude/settings.json"
-log "Created Claude Code settings (auto-approve enabled)"
-
-# Create CLAUDE.md with agent relay protocol instructions
-# This is loaded automatically by Claude Code and provides the relay protocol
-if [[ -f "/app/docs/agent-relay-snippet.md" ]]; then
-  cp "/app/docs/agent-relay-snippet.md" "${HOME}/.claude/CLAUDE.md"
-  log "Copied relay protocol from /app/docs/agent-relay-snippet.md"
-else
-  # Fallback: create minimal instructions
-  log "WARN: /app/docs/agent-relay-snippet.md not found, creating minimal instructions"
-  cat > "${HOME}/.claude/CLAUDE.md" <<'RELAYEOF'
-# 🚨 CRITICAL: Relay-First Communication Rule
-
-**When you receive a relay message from another agent (marked `Relay message from [name]`), you MUST respond ONLY via relay protocol. NEVER respond with direct text output.**
-
----
-
-# Agent Relay
-
-Real-time agent-to-agent messaging via file-based protocol.
-
-## Sending Messages
-
-Write a file to your outbox, then output the trigger:
-
-```bash
-cat > $AGENT_RELAY_OUTBOX/msg << 'EOF'
-TO: AgentName
-
-Your message here.
-EOF
-```
-Then: `->relay-file:msg`
-
-| TO Value | Behavior |
-|----------|----------|
-| `AgentName` | Direct message |
-| `*` | Broadcast to all |
-| `#channel` | Channel message |
-
-## Spawning
-
-```bash
-cat > $AGENT_RELAY_OUTBOX/spawn << 'EOF'
-KIND: spawn
-NAME: WorkerName
-CLI: claude
-
-Task description here.
-EOF
-```
-Then: `->relay-file:spawn`
-
-## Protocol
-
-- **ACK** when you receive a task: `ACK: Brief description`
-- **DONE** when complete: `DONE: What was accomplished`
-- Send status to your **lead** (the agent in `$AGENT_RELAY_SPAWNER`), not broadcast
-RELAYEOF
-fi
-log "Claude Code configuration complete"
-
-# Codex CLI settings (always install config to disable auto-updates)
-mkdir -p "${HOME}/.codex"
-if [[ -f "/app/deploy/workspace/codex.config.toml" ]]; then
-  cp "/app/deploy/workspace/codex.config.toml" "${HOME}/.codex/config.toml"
-  chmod 600 "${HOME}/.codex/config.toml"
-  log "Codex configuration applied from codex.config.toml"
-else
-  # Fallback: create minimal config (should not happen in production)
-  log "WARN: codex.config.toml not found, creating minimal config"
-  cat > "${HOME}/.codex/config.toml" <<CODEXCONFIGEOF
-check_for_updates = false
-CODEXCONFIGEOF
-  chmod 600 "${HOME}/.codex/config.toml"
-fi
-# Also create JSON config for Codex (some versions read config.json instead of config.toml)
-cat > "${HOME}/.codex/config.json" <<'CODEXJSON'
-{
-  "check_for_updates": false
-}
-CODEXJSON
-chmod 600 "${HOME}/.codex/config.json"
-
-# NPM wrapper to block Codex self-updates (no-op when Codex tries npm install -g @openai/codex)
-mkdir -p "${HOME}/.local/bin"
-cat > "${HOME}/.local/bin/npm" <<'NPMWRAPPER'
-#!/usr/bin/env bash
-if [[ "$1" == "install" && "$2" == "-g" && "$3" == @openai/codex* ]]; then
-  echo "npm wrapper: skipping Codex self-update (auto-update disabled)" >&2
-  exit 0
-fi
-exec /usr/local/bin/npm "$@"
-NPMWRAPPER
-chmod +x "${HOME}/.local/bin/npm"
-
-# Codex CLI expects ~/.codex/auth.json for credentials
-# Format: { tokens: { access_token: "...", refresh_token: "...", ... } }
-if [[ -n "${OPENAI_TOKEN:-}" ]]; then
-  log "Configuring Codex credentials..."
-  cat > "${HOME}/.codex/auth.json" <<EOF
-{
-  "tokens": {
-    "access_token": "${OPENAI_TOKEN}",
-    "refresh_token": "${OPENAI_REFRESH_TOKEN:-}"
-  }
-}
-EOF
-  chmod 600 "${HOME}/.codex/auth.json"
-fi
-
-# Google/Gemini - uses application default credentials
-if [[ -n "${GOOGLE_TOKEN:-}" ]]; then
-  log "Configuring Google credentials..."
-  mkdir -p "${HOME}/.config/gcloud"
-  cat > "${HOME}/.config/gcloud/application_default_credentials.json" <<EOF
-{
-  "type": "authorized_user",
-  "access_token": "${GOOGLE_TOKEN}"
-}
-EOF
-  chmod 600 "${HOME}/.config/gcloud/application_default_credentials.json"
-fi
-
-# ============================================================================
-# Detect workspace path and start daemon
-# The daemon must start from the same directory that spawned agents will use
-# to ensure consistent socket paths
-# ============================================================================
-
-# Function to detect the actual workspace path (same logic as project-namespace.ts)
-detect_workspace_path() {
-  local base_dir="${1}"
-
-  # 1. Explicit override via env var
-  if [[ -n "${WORKSPACE_CWD:-}" ]]; then
-    echo "${WORKSPACE_CWD}"
-    return
-  fi
-
-  # 2. Check if base_dir itself is a git repo
-  if [[ -d "${base_dir}/.git" ]]; then
-    echo "${base_dir}"
-    return
-  fi
-
-  # 3. Scan for cloned repos (directories with .git)
-  local first_repo=""
-  for dir in "${base_dir}"/*/; do
-    if [[ -d "${dir}.git" ]]; then
-      # Use first repo found (alphabetically sorted by bash glob)
-      first_repo="${dir%/}"
-      break
-    fi
-  done
-
-  if [[ -n "${first_repo}" ]]; then
-    echo "${first_repo}"
-    return
-  fi
-
-  # 4. Fall back to base_dir
-  echo "${base_dir}"
-}
-
-# Detect the actual workspace path
-ACTUAL_WORKSPACE=$(detect_workspace_path "${WORKSPACE_DIR}")
-log "Detected workspace path: ${ACTUAL_WORKSPACE}"
-
-# Change to the detected workspace before starting daemon
-cd "${ACTUAL_WORKSPACE}"
-
-# Set RELAY_PROJECT from WORKSPACE_ID at runtime (MCP socket discovery uses this)
-export RELAY_PROJECT="${WORKSPACE_ID:-${RELAY_PROJECT:-default}}"
-
-# Ensure node can resolve modules from /app when running from workspace directory
-# Without this, @agent-relay/dashboard won't be found since it's in /app/node_modules
-export NODE_PATH="/app/node_modules"
-
-log "Starting agent-relay daemon on port ${PORT} from ${ACTUAL_WORKSPACE}"
-args=(/app/dist/src/cli/index.js up --dashboard --port "${PORT}")
-
-if [[ "${SUPERVISOR_ENABLED:-true}" == "true" ]]; then
-  args+=("--watch")
-fi
-
-exec node "${args[@]}"

package/deploy/workspace/gh-credential-relay

@@ -1,90 +0,0 @@
-#!/usr/bin/env bash
-#
-# GitHub CLI Credential Helper for Agent Relay Workspaces
-#
-# This credential helper provides GitHub authentication tokens to the gh CLI
-# by fetching from the cloud API. It works in non-interactive container
-# environments without requiring manual gh auth login.
-#
-# Installation:
-#   gh config set -h github.com credential-helper gh-credential-relay
-#
-# Environment variables (auto-set by workspace entrypoint):
-#   CLOUD_API_URL    - Cloud API base URL
-#   WORKSPACE_ID     - Workspace identifier
-#   WORKSPACE_TOKEN  - Bearer token for cloud API auth
-
-set -euo pipefail
-
-# Debug logging (enable with GH_CREDENTIAL_DEBUG=1)
-debug() {
-  if [[ "${GH_CREDENTIAL_DEBUG:-}" == "1" ]]; then
-    echo "gh-credential-relay: $*" >&2
-  fi
-}
-
-debug "Called with args: $*"
-
-# Only handle 'get' operation for storing credentials
-if [[ "${1:-}" != "get" ]]; then
-  debug "Ignoring non-get operation: ${1:-}"
-  exit 0
-fi
-
-# Read input from gh CLI (host, protocol, etc)
-declare -A input
-while IFS='=' read -r key value; do
-  [[ -z "$key" ]] && break
-  input["$key"]="$value"
-done
-
-host="${input[host]:-}"
-debug "Host: $host"
-
-# Only provide credentials for github.com
-if [[ "$host" != "github.com" ]]; then
-  debug "Not github.com, skipping"
-  exit 0
-fi
-
-# Check required environment variables
-if [[ -z "${CLOUD_API_URL:-}" ]]; then
-  echo "gh-credential-relay: CLOUD_API_URL not set" >&2
-  exit 1
-fi
-
-if [[ -z "${WORKSPACE_ID:-}" ]]; then
-  echo "gh-credential-relay: WORKSPACE_ID not set" >&2
-  exit 1
-fi
-
-if [[ -z "${WORKSPACE_TOKEN:-}" ]]; then
-  echo "gh-credential-relay: WORKSPACE_TOKEN not set" >&2
-  exit 1
-fi
-
-debug "Fetching token from ${CLOUD_API_URL}/api/git/token?workspaceId=${WORKSPACE_ID}"
-
-# Fetch fresh token from cloud API (5 second timeout)
-response=$(curl -s --max-time 5 \
-  -H "Authorization: Bearer ${WORKSPACE_TOKEN}" \
-  "${CLOUD_API_URL}/api/git/token?workspaceId=${WORKSPACE_ID}" 2>/dev/null) || true
-
-if [[ -z "$response" ]]; then
-  debug "No response from cloud API"
-  exit 1
-fi
-
-# Parse JSON response
-token=$(echo "$response" | jq -r '.userToken // .token // empty' 2>/dev/null)
-
-if [[ -z "$token" ]]; then
-  debug "No token in response"
-  exit 1
-fi
-
-# Output in git credential format (same as git-credential-relay)
-echo "protocol=https"
-echo "host=github.com"
-echo "username=x-access-token"
-echo "password=${token}"