agent-relay 2.0.22 → 2.0.24

package/packages/cloud/dist/api/cli-pty-runner.js

@@ -1,175 +0,0 @@
-/**
- * CLI PTY Runner
- *
- * Shared module for running CLI auth flows via PTY.
- * Used by both production (onboarding.ts) and tests (ci-test-real-clis.ts).
- *
- * Uses the relay-pty Rust binary for PTY emulation.
- */
-import { spawn } from 'node:child_process';
-import { dirname } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { randomUUID } from 'node:crypto';
-// Get the directory where this module is located
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-// Import shared config and utilities
-import { CLI_AUTH_CONFIG, stripAnsiCodes, matchesSuccessPattern, findMatchingPrompt, validateProviderConfig, validateAllProviderConfigs as validateAllConfigs, getSupportedProviders, } from '@agent-relay/config/cli-auth-config';
-import { findRelayPtyBinary as findRelayPtyBinaryUtil } from '@agent-relay/utils/relay-pty-path';
-// Re-export everything from shared config for backward compatibility
-export { CLI_AUTH_CONFIG, stripAnsiCodes, matchesSuccessPattern, findMatchingPrompt, validateProviderConfig, getSupportedProviders, };
-// Wrapper that throws instead of returning array (backward compatible)
-export function validateAllProviderConfigs() {
-    const errors = validateAllConfigs();
-    if (errors.length > 0) {
-        throw new Error(`Invalid provider configurations:\n${errors.join('\n')}`);
-    }
-}
-/**
- * Find the relay-pty binary path.
- * Uses shared utility from @agent-relay/utils.
- */
-function findRelayPtyBinary() {
-    return findRelayPtyBinaryUtil(__dirname);
-}
-/**
- * Run CLI auth flow via PTY using relay-pty binary
- *
- * This is the core PTY runner used by both production and tests.
- * It handles:
- * - Spawning the CLI with proper TTY emulation via relay-pty
- * - Auto-responding to interactive prompts
- * - Extracting auth URLs from output
- * - Detecting success patterns
- *
- * @param config - CLI auth configuration for the provider
- * @param options - Optional callbacks and overrides
- * @returns Promise resolving to auth result
- */
-export async function runCLIAuthViaPTY(config, options = {}) {
-    const result = {
-        authUrl: null,
-        success: false,
-        promptsHandled: [],
-        output: '',
-        exitCode: null,
-    };
-    const respondedPrompts = new Set();
-    // Find relay-pty binary
-    const relayPtyPath = findRelayPtyBinary();
-    if (!relayPtyPath) {
-        result.error = 'relay-pty binary not found. Build with: cd relay-pty && cargo build --release';
-        return result;
-    }
-    return new Promise((resolve) => {
-        try {
-            // Generate unique name for this auth session
-            const sessionName = `auth-${randomUUID().substring(0, 8)}`;
-            // Build relay-pty arguments
-            const relayArgs = [
-                '--name', sessionName,
-                '--rows', '30',
-                '--cols', '120',
-                '--log-level', 'error', // Suppress relay-pty logs
-                '--', config.command,
-                ...config.args,
-            ];
-            const proc = spawn(relayPtyPath, relayArgs, {
-                cwd: options.cwd || process.cwd(),
-                env: {
-                    ...process.env,
-                    NO_COLOR: '1',
-                    TERM: 'xterm-256color',
-                    // Prevent CLIs from trying to open browsers
-                    BROWSER: 'echo',
-                    DISPLAY: '',
-                    ...options.env,
-                },
-                stdio: ['pipe', 'pipe', 'pipe'],
-            });
-            // Timeout handler
-            const timeout = setTimeout(() => {
-                proc.kill();
-                result.error = 'Timeout waiting for auth URL';
-                resolve(result);
-            }, config.waitTimeout + 5000);
-            // Handle stdout (main PTY output)
-            proc.stdout?.on('data', (data) => {
-                const text = data.toString();
-                result.output += text;
-                options.onOutput?.(text);
-                // Check for matching prompts and auto-respond
-                const matchingPrompt = findMatchingPrompt(text, config.prompts, respondedPrompts);
-                if (matchingPrompt) {
-                    respondedPrompts.add(matchingPrompt.description);
-                    result.promptsHandled.push(matchingPrompt.description);
-                    options.onPromptHandled?.(matchingPrompt.description);
-                    const delay = matchingPrompt.delay ?? 100;
-                    setTimeout(() => {
-                        try {
-                            proc.stdin?.write(matchingPrompt.response);
-                        }
-                        catch {
-                            // Process may have exited
-                        }
-                    }, delay);
-                }
-                // Look for auth URL in accumulated output
-                // Join lines that look like URL continuations (handles wrapped URLs)
-                const cleanAccumulated = stripAnsiCodes(result.output)
-                    .replace(/\n(?=[a-zA-Z0-9\-_.~:/?#\[\]@!$&'()*+,;=%])/g, '');
-                const match = cleanAccumulated.match(config.urlPattern);
-                if (match && match[1] && !result.authUrl) {
-                    result.authUrl = match[1];
-                    if (result.authUrl) {
-                        options.onAuthUrl?.(result.authUrl);
-                    }
-                }
-                // Check for success indicators
-                if (matchesSuccessPattern(text, config.successPatterns)) {
-                    result.success = true;
-                }
-            });
-            // Handle stderr (relay-pty logs, usually minimal)
-            proc.stderr?.on('data', (data) => {
-                const text = data.toString();
-                // Also check stderr for output (some CLIs write to stderr)
-                result.output += text;
-                options.onOutput?.(text);
-                // Check stderr for auth URLs too (using accumulated output)
-                const cleanAccumulated = stripAnsiCodes(result.output)
-                    .replace(/\n(?=[a-zA-Z0-9\-_.~:/?#\[\]@!$&'()*+,;=%])/g, '');
-                const match = cleanAccumulated.match(config.urlPattern);
-                if (match && match[1] && !result.authUrl) {
-                    result.authUrl = match[1];
-                    if (result.authUrl) {
-                        options.onAuthUrl?.(result.authUrl);
-                    }
-                }
-            });
-            proc.on('exit', (code) => {
-                clearTimeout(timeout);
-                result.exitCode = code;
-                // Consider it a success if we got a URL (main goal)
-                // or if exit code was 0 with success pattern
-                if (result.authUrl || (code === 0 && result.success)) {
-                    result.success = true;
-                }
-                if (!result.authUrl && !result.success && !result.error) {
-                    result.error = 'Failed to extract auth URL from CLI output';
-                }
-                resolve(result);
-            });
-            proc.on('error', (err) => {
-                clearTimeout(timeout);
-                result.error = err.message;
-                resolve(result);
-            });
-        }
-        catch (err) {
-            result.error = err instanceof Error ? err.message : 'Unknown error';
-            resolve(result);
-        }
-    });
-}
-//# sourceMappingURL=cli-pty-runner.js.map

package/packages/cloud/dist/api/codex-auth-helper.d.ts

@@ -1,21 +0,0 @@
-/**
- * Codex Auth Helper API
- *
- * Provides endpoints for the `npx agent-relay codex-auth` CLI command.
- * Uses SSH tunneling to forward localhost:1455 to the workspace container,
- * allowing the Codex CLI's OAuth callback to work in remote/container environments.
- *
- * Flow:
- * 1. CLI gets workspace SSH info via /tunnel-info
- * 2. CLI establishes SSH tunnel: local:1455 -> container:1455
- * 3. User completes OAuth, browser redirects to localhost:1455
- * 4. Tunnel forwards to container's Codex CLI server
- * 5. Codex CLI exchanges code for tokens internally
- * 6. CLI polls for auth completion
- */
-export declare const codexAuthHelperRouter: import("express-serve-static-core").Router;
-/**
- * Stop the cleanup interval. Call this on server shutdown.
- */
-export declare function stopCodexAuthCleanup(): void;
-//# sourceMappingURL=codex-auth-helper.d.ts.map

package/packages/cloud/dist/api/codex-auth-helper.js

@@ -1,327 +0,0 @@
-/**
- * Codex Auth Helper API
- *
- * Provides endpoints for the `npx agent-relay codex-auth` CLI command.
- * Uses SSH tunneling to forward localhost:1455 to the workspace container,
- * allowing the Codex CLI's OAuth callback to work in remote/container environments.
- *
- * Flow:
- * 1. CLI gets workspace SSH info via /tunnel-info
- * 2. CLI establishes SSH tunnel: local:1455 -> container:1455
- * 3. User completes OAuth, browser redirects to localhost:1455
- * 4. Tunnel forwards to container's Codex CLI server
- * 5. Codex CLI exchanges code for tokens internally
- * 6. CLI polls for auth completion
- */
-import { Router } from 'express';
-import crypto from 'crypto';
-import { requireAuth } from './auth.js';
-import { db } from '../db/index.js';
-import { deriveSshPassword } from '../services/ssh-security.js';
-export const codexAuthHelperRouter = Router();
-const WORKSPACE_SSH_PORT = 3022;
-const pendingAuthSessions = new Map();
-const pendingCliTokens = new Map();
-// Clean up old sessions every minute
-const cleanupInterval = setInterval(() => {
-    const now = Date.now();
-    for (const [id, session] of pendingAuthSessions) {
-        // Remove sessions older than 10 minutes
-        if (now - session.createdAt.getTime() > 10 * 60 * 1000) {
-            pendingAuthSessions.delete(id);
-        }
-    }
-    // Also clean up CLI tokens
-    for (const [id, token] of pendingCliTokens) {
-        // Remove tokens older than 10 minutes
-        if (now - token.createdAt.getTime() > 10 * 60 * 1000) {
-            pendingCliTokens.delete(id);
-        }
-    }
-}, 60000);
-/**
- * Stop the cleanup interval. Call this on server shutdown.
- */
-export function stopCodexAuthCleanup() {
-    clearInterval(cleanupInterval);
-}
-/**
- * POST /api/auth/codex-helper/cli-session
- * Create a new auth session for the CLI command.
- * Returns workspace info and CLI command for SSH tunnel approach.
- */
-codexAuthHelperRouter.post('/cli-session', requireAuth, async (req, res) => {
-    const userId = req.session.userId;
-    const { workspaceId, authUrl, sessionId: onboardingSessionId } = req.body;
-    // If workspace ID provided, return SSH tunnel command
-    if (workspaceId) {
-        try {
-            const workspace = await db.workspaces.findById(workspaceId);
-            if (!workspace || workspace.userId !== userId) {
-                return res.status(404).json({ error: 'Workspace not found' });
-            }
-            // Generate a one-time CLI token for authentication
-            const cliToken = crypto.randomUUID();
-            pendingCliTokens.set(cliToken, {
-                userId,
-                workspaceId,
-                createdAt: new Date(),
-                authUrl, // Store authUrl so CLI can retrieve it
-                sessionId: onboardingSessionId, // Store sessionId for credential storage
-            });
-            console.log(`[codex-helper] Created CLI session for workspace ${workspaceId} with token ${cliToken.slice(0, 8)}...`);
-            const cloudUrl = process.env.PUBLIC_URL || 'https://agent-relay.com';
-            // Generate the CLI command with workspace ID and token
-            res.json({
-                workspaceId: workspace.id,
-                workspaceName: workspace.name,
-                expiresIn: 600, // 10 minutes
-                command: `npx agent-relay codex-auth --workspace=${workspaceId} --token=${cliToken}`,
-                commandWithUrl: `npx agent-relay codex-auth --workspace=${workspaceId} --token=${cliToken} --cloud-url=${cloudUrl}`,
-            });
-            return;
-        }
-        catch (error) {
-            console.error('[codex-helper] Error creating CLI session:', error);
-            return res.status(500).json({ error: 'Failed to create CLI session' });
-        }
-    }
-    // Legacy: token-based session (for backwards compatibility)
-    const authSessionId = crypto.randomUUID();
-    pendingAuthSessions.set(authSessionId, {
-        userId,
-        createdAt: new Date(),
-    });
-    console.log(`[codex-helper] Created legacy CLI session ${authSessionId} for user ${userId}`);
-    res.json({
-        authSessionId,
-        expiresIn: 600, // 10 minutes
-        command: `npx agent-relay codex-auth --token=${authSessionId}`,
-    });
-});
-/**
- * POST /api/auth/codex-helper/callback
- * Receives the auth code from the CLI.
- * No auth required - validated by authSessionId.
- */
-codexAuthHelperRouter.post('/callback', async (req, res) => {
-    const { authSessionId, code, state, error } = req.body;
-    if (!authSessionId) {
-        return res.status(400).json({ error: 'Missing authSessionId' });
-    }
-    const session = pendingAuthSessions.get(authSessionId);
-    if (!session) {
-        return res.status(404).json({ error: 'Session not found or expired' });
-    }
-    if (error) {
-        console.log(`[codex-helper] Auth error for session ${authSessionId}:`, error);
-        pendingAuthSessions.delete(authSessionId);
-        return res.json({ success: false, error });
-    }
-    if (!code) {
-        return res.status(400).json({ error: 'Missing auth code' });
-    }
-    // Store the code and state so the polling endpoint can retrieve them
-    session.code = code;
-    session.state = state; // Store state for CSRF validation
-    pendingAuthSessions.set(authSessionId, session);
-    console.log(`[codex-helper] Auth code received for session ${authSessionId}`);
-    res.json({ success: true, message: 'Auth code received. You can close this terminal.' });
-});
-/**
- * GET /api/auth/codex-helper/status/:authSessionId
- * Check if auth code has been received.
- * The dashboard polls this to know when the CLI has captured the callback.
- */
-codexAuthHelperRouter.get('/status/:authSessionId', requireAuth, async (req, res) => {
-    const authSessionId = req.params.authSessionId;
-    const session = pendingAuthSessions.get(authSessionId);
-    if (!session || session.userId !== req.session.userId) {
-        return res.status(404).json({ error: 'Session not found or expired' });
-    }
-    if (session.code) {
-        // Clean up session after successful retrieval (code is single-use)
-        const code = session.code;
-        const state = session.state;
-        pendingAuthSessions.delete(authSessionId);
-        return res.json({
-            ready: true,
-            code,
-            state, // Return state for CSRF validation
-        });
-    }
-    res.json({ ready: false });
-});
-/**
- * GET /api/auth/codex-helper/tunnel-info/:workspaceId
- * Get SSH tunnel info for establishing port forwarding to a workspace.
- * Returns host, port, user, and password for SSH connection.
- *
- * Authentication: Requires either session auth OR a valid CLI token.
- */
-codexAuthHelperRouter.get('/tunnel-info/:workspaceId', async (req, res) => {
-    const workspaceId = req.params.workspaceId;
-    const { token } = req.query;
-    // Authenticate via CLI token or session
-    let userId;
-    if (token && typeof token === 'string') {
-        // CLI token authentication
-        const cliToken = pendingCliTokens.get(token);
-        if (!cliToken) {
-            return res.status(401).json({ error: 'Invalid or expired token' });
-        }
-        if (cliToken.workspaceId !== workspaceId) {
-            return res.status(403).json({ error: 'Token does not match workspace' });
-        }
-        userId = cliToken.userId;
-        // Don't delete token - it's also used for auth-status polling
-        // Cleanup interval will remove it after 10 minutes
-        console.log(`[codex-helper] CLI token used for workspace ${workspaceId}`);
-    }
-    else if (req.session?.userId) {
-        // Session authentication
-        userId = req.session.userId;
-    }
-    else {
-        return res.status(401).json({ error: 'Authentication required. Provide token query parameter or valid session.' });
-    }
-    try {
-        const workspace = await db.workspaces.findById(workspaceId);
-        if (!workspace || workspace.userId !== userId) {
-            return res.status(404).json({ error: 'Workspace not found' });
-        }
-        if (workspace.status !== 'running') {
-            return res.status(400).json({ error: 'Workspace is not running' });
-        }
-        // Parse workspace URL to get host
-        const publicUrl = workspace.publicUrl;
-        if (!publicUrl) {
-            return res.status(400).json({ error: 'Workspace URL not available' });
-        }
-        const url = new URL(publicUrl);
-        const host = url.hostname;
-        const apiPort = parseInt(url.port, 10) || 80;
-        // SSH connection info varies by environment:
-        // - Fly.io: Use public fly.dev hostname with port 3022 (exposed via TCP service)
-        // - Local Docker: Use localhost with derived SSH port (22000 + apiPort - 3000)
-        const isOnFly = !!process.env.FLY_APP_NAME;
-        const isLocalDocker = (host === 'localhost' || host === '127.0.0.1') && apiPort >= 3000;
-        let sshHost;
-        let sshPort;
-        if (isOnFly) {
-            // Fly.io public hostname - SSH is exposed as a public TCP service on port 3022
-            // Users can SSH directly from their machine to {app}.fly.dev:3022
-            const appName = `ar-${workspace.id.substring(0, 8)}`;
-            sshHost = `${appName}.fly.dev`;
-            sshPort = WORKSPACE_SSH_PORT;
-        }
-        else if (isLocalDocker) {
-            // Local Docker: SSH port is derived from API port
-            // API port 3500 -> SSH port 22500 (formula: 22000 + apiPort - 3000)
-            sshHost = 'localhost';
-            sshPort = 22000 + (apiPort - 3000);
-        }
-        else {
-            // Default fallback
-            sshHost = host;
-            sshPort = WORKSPACE_SSH_PORT;
-        }
-        // SSH password is derived per-workspace for security
-        // Each workspace gets a unique password based on its ID + secret salt
-        const sshPassword = deriveSshPassword(workspace.id);
-        // Get authUrl from CLI token if available
-        let authUrl;
-        if (token && typeof token === 'string') {
-            const cliToken = pendingCliTokens.get(token);
-            authUrl = cliToken?.authUrl;
-        }
-        res.json({
-            host: sshHost,
-            port: sshPort,
-            user: 'workspace',
-            password: sshPassword,
-            tunnelPort: 1455, // Codex OAuth callback port
-            workspaceId: workspace.id,
-            workspaceName: workspace.name,
-            authUrl, // OAuth URL if available (set by dashboard)
-        });
-    }
-    catch (error) {
-        console.error('[codex-helper] Error getting tunnel info:', error);
-        res.status(500).json({ error: 'Failed to get tunnel info' });
-    }
-});
-/**
- * GET /api/auth/codex-helper/auth-status/:workspaceId
- * Poll for Codex authentication completion in a workspace.
- * The CLI uses this after establishing the tunnel to know when auth is done.
- *
- * Authentication: Requires either session auth OR a valid CLI token.
- */
-codexAuthHelperRouter.get('/auth-status/:workspaceId', async (req, res) => {
-    const workspaceId = req.params.workspaceId;
-    const { token } = req.query;
-    // Authenticate via CLI token or session
-    let userId;
-    if (token && typeof token === 'string') {
-        // CLI token authentication
-        const cliToken = pendingCliTokens.get(token);
-        if (!cliToken) {
-            return res.status(401).json({ error: 'Invalid or expired token' });
-        }
-        if (cliToken.workspaceId !== workspaceId) {
-            return res.status(403).json({ error: 'Token does not match workspace' });
-        }
-        userId = cliToken.userId;
-    }
-    else if (req.session?.userId) {
-        // Session authentication
-        userId = req.session.userId;
-    }
-    else {
-        return res.status(401).json({ error: 'Authentication required. Provide token query parameter or valid session.' });
-    }
-    try {
-        const workspace = await db.workspaces.findById(workspaceId);
-        if (!workspace || workspace.userId !== userId) {
-            return res.status(404).json({ error: 'Workspace not found' });
-        }
-        if (!workspace.publicUrl) {
-            return res.status(400).json({ error: 'Workspace URL not available' });
-        }
-        // Check with workspace daemon if Codex is authenticated for this specific user
-        // Pass userId to enable per-user credential checking (multiple users can share a workspace)
-        const checkUrl = new URL(`${workspace.publicUrl}/auth/cli/openai/check`);
-        checkUrl.searchParams.set('userId', userId);
-        const response = await fetch(checkUrl.toString(), {
-            method: 'GET',
-            signal: AbortSignal.timeout(5000),
-        });
-        if (response.ok) {
-            const data = await response.json();
-            // When authentication is detected, mark the provider as connected in the database
-            // This ensures the dashboard shows correct per-user connection status
-            if (data.authenticated && userId) {
-                try {
-                    await db.credentials.upsert({
-                        userId,
-                        provider: 'codex', // Codex provider for OpenAI
-                        scopes: [],
-                    });
-                    console.log(`[codex-helper] Marked codex as connected for user ${userId}`);
-                }
-                catch (dbError) {
-                    console.error('[codex-helper] Failed to mark provider as connected:', dbError);
-                    // Don't fail the request if DB update fails
-                }
-            }
-            return res.json({ authenticated: data.authenticated });
-        }
-        res.json({ authenticated: false });
-    }
-    catch (_error) {
-        // Workspace might not be reachable, return false
-        res.json({ authenticated: false });
-    }
-});
-//# sourceMappingURL=codex-auth-helper.js.map

package/packages/cloud/dist/api/consensus.d.ts

@@ -1,13 +0,0 @@
-/**
- * Consensus API Routes (Read-Only)
- *
- * Provides API endpoints for observing multi-agent consensus decisions.
- * The dashboard is read-only - agents handle all consensus activity via relay messages.
- *
- * Architecture:
- * - Agents create proposals and vote via ->relay:_consensus messages
- * - The daemon processes these and syncs state to cloud via /sync endpoint
- * - Dashboard reads consensus state for display only
- */
-export declare const consensusRouter: import("express-serve-static-core").Router;
-//# sourceMappingURL=consensus.d.ts.map