agent-relay 2.0.22 → 2.0.24

package/packages/cloud/dist/api/sessions.js

@@ -1,302 +0,0 @@
-/**
- * Agent Session Persistence API Routes
- *
- * Provides endpoints for workspace containers to persist agent session data.
- * Workspaces call these endpoints instead of accessing the database directly,
- * which provides better security isolation (workspaces can only write their own data).
- *
- * Authentication: Workspace token (same as git gateway)
- */
-import crypto from 'crypto';
-import { Router } from 'express';
-import { eq } from 'drizzle-orm';
-import { getDb } from '../db/drizzle.js';
-import { agentSessions, agentSummaries } from '../db/schema.js';
-import { getConfig } from '../config.js';
-export const sessionsRouter = Router();
-// Validation patterns
-const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-const AGENT_NAME_REGEX = /^[a-zA-Z0-9_-]+$/;
-const MAX_AGENT_NAME_LENGTH = 255;
-/**
- * Generate expected workspace token using HMAC
- */
-function generateExpectedToken(workspaceId) {
-    const config = getConfig();
-    return crypto
-        .createHmac('sha256', config.sessionSecret)
-        .update(`workspace:${workspaceId}`)
-        .digest('hex');
-}
-/**
- * Verify workspace access token
- */
-function verifyWorkspaceToken(req, workspaceId) {
-    const authHeader = req.get('authorization');
-    if (!authHeader) {
-        return { valid: false, reason: 'No Authorization header. WORKSPACE_TOKEN may not be set in the container.' };
-    }
-    if (!authHeader.startsWith('Bearer ')) {
-        return { valid: false, reason: 'Invalid Authorization header format. Expected: Bearer <token>' };
-    }
-    const providedToken = authHeader.slice(7);
-    if (!providedToken) {
-        return { valid: false, reason: 'Empty bearer token provided.' };
-    }
-    const expectedToken = generateExpectedToken(workspaceId);
-    try {
-        const isValid = crypto.timingSafeEqual(Buffer.from(providedToken), Buffer.from(expectedToken));
-        if (!isValid) {
-            return { valid: false, reason: 'Token mismatch. Workspace may need reprovisioning or SESSION_SECRET changed.' };
-        }
-        return { valid: true };
-    }
-    catch {
-        return { valid: false, reason: 'Token comparison failed (length mismatch). Workspace may need reprovisioning.' };
-    }
-}
-/**
- * Validate UUID format
- */
-function isValidUUID(value) {
-    return UUID_REGEX.test(value);
-}
-/**
- * Validate agent name format
- */
-function isValidAgentName(name) {
-    if (name.length > MAX_AGENT_NAME_LENGTH) {
-        return { valid: false, reason: `agentName exceeds maximum length of ${MAX_AGENT_NAME_LENGTH} characters` };
-    }
-    if (!AGENT_NAME_REGEX.test(name)) {
-        return { valid: false, reason: 'agentName contains invalid characters (only alphanumeric, underscore, and hyphen allowed)' };
-    }
-    return { valid: true };
-}
-/**
- * Validate summary object structure
- */
-function validateSummary(summary) {
-    if (typeof summary !== 'object' || summary === null || Array.isArray(summary)) {
-        return { valid: false, reason: 'summary must be an object' };
-    }
-    const s = summary;
-    const allowedKeys = ['currentTask', 'completedTasks', 'decisions', 'context', 'files'];
-    for (const key of Object.keys(s)) {
-        if (!allowedKeys.includes(key)) {
-            // Allow extra keys but log warning (don't reject - for forward compatibility)
-            continue;
-        }
-    }
-    // Validate types of known fields
-    if (s.currentTask !== undefined && typeof s.currentTask !== 'string') {
-        return { valid: false, reason: 'summary.currentTask must be a string' };
-    }
-    if (s.completedTasks !== undefined && !Array.isArray(s.completedTasks)) {
-        return { valid: false, reason: 'summary.completedTasks must be an array' };
-    }
-    if (s.decisions !== undefined && !Array.isArray(s.decisions)) {
-        return { valid: false, reason: 'summary.decisions must be an array' };
-    }
-    if (s.context !== undefined && typeof s.context !== 'string') {
-        return { valid: false, reason: 'summary.context must be a string' };
-    }
-    if (s.files !== undefined && !Array.isArray(s.files)) {
-        return { valid: false, reason: 'summary.files must be an array' };
-    }
-    return { valid: true };
-}
-/**
- * POST /api/sessions/create
- * Create a new agent session
- *
- * Body: { workspaceId: string, agentName: string }
- * Returns: { sessionId: string }
- */
-sessionsRouter.post('/create', async (req, res) => {
-    const { workspaceId, agentName } = req.body;
-    if (!workspaceId || typeof workspaceId !== 'string') {
-        return res.status(400).json({ error: 'workspaceId is required', code: 'MISSING_WORKSPACE_ID' });
-    }
-    if (!isValidUUID(workspaceId)) {
-        return res.status(400).json({ error: 'workspaceId must be a valid UUID', code: 'INVALID_WORKSPACE_ID' });
-    }
-    if (!agentName || typeof agentName !== 'string') {
-        return res.status(400).json({ error: 'agentName is required', code: 'MISSING_AGENT_NAME' });
-    }
-    const agentNameValidation = isValidAgentName(agentName);
-    if (!agentNameValidation.valid) {
-        return res.status(400).json({ error: agentNameValidation.reason, code: 'INVALID_AGENT_NAME' });
-    }
-    const tokenVerification = verifyWorkspaceToken(req, workspaceId);
-    if (!tokenVerification.valid) {
-        console.warn(`[sessions] Token verification failed for workspace ${workspaceId.substring(0, 8)}: ${tokenVerification.reason}`);
-        return res.status(401).json({
-            error: 'Invalid workspace token',
-            code: 'INVALID_WORKSPACE_TOKEN',
-            hint: tokenVerification.reason,
-        });
-    }
-    try {
-        const db = getDb();
-        const result = await db.insert(agentSessions).values({
-            workspaceId,
-            agentName,
-            status: 'active',
-            startedAt: new Date(),
-        }).returning();
-        const session = result[0];
-        if (!session) {
-            return res.status(500).json({ error: 'Failed to create session', code: 'CREATE_FAILED' });
-        }
-        console.log(`[sessions] Created session ${session.id.substring(0, 8)} for ${agentName} in workspace ${workspaceId.substring(0, 8)}`);
-        return res.json({ sessionId: session.id });
-    }
-    catch (err) {
-        console.error(`[sessions] Failed to create session:`, err);
-        return res.status(500).json({ error: 'Internal server error', code: 'INTERNAL_ERROR' });
-    }
-});
-/**
- * POST /api/sessions/summary
- * Add a summary to an existing session
- *
- * Body: {
- *   workspaceId: string,
- *   sessionId: string,
- *   agentName: string,
- *   summary: { currentTask?: string, completedTasks?: string[], ... }
- * }
- * Returns: { summaryId: string }
- */
-sessionsRouter.post('/summary', async (req, res) => {
-    const { workspaceId, sessionId, agentName, summary } = req.body;
-    if (!workspaceId || typeof workspaceId !== 'string') {
-        return res.status(400).json({ error: 'workspaceId is required', code: 'MISSING_WORKSPACE_ID' });
-    }
-    if (!isValidUUID(workspaceId)) {
-        return res.status(400).json({ error: 'workspaceId must be a valid UUID', code: 'INVALID_WORKSPACE_ID' });
-    }
-    if (!sessionId || typeof sessionId !== 'string') {
-        return res.status(400).json({ error: 'sessionId is required', code: 'MISSING_SESSION_ID' });
-    }
-    if (!isValidUUID(sessionId)) {
-        return res.status(400).json({ error: 'sessionId must be a valid UUID', code: 'INVALID_SESSION_ID' });
-    }
-    if (!agentName || typeof agentName !== 'string') {
-        return res.status(400).json({ error: 'agentName is required', code: 'MISSING_AGENT_NAME' });
-    }
-    const agentNameValidation = isValidAgentName(agentName);
-    if (!agentNameValidation.valid) {
-        return res.status(400).json({ error: agentNameValidation.reason, code: 'INVALID_AGENT_NAME' });
-    }
-    if (!summary) {
-        return res.status(400).json({ error: 'summary is required', code: 'MISSING_SUMMARY' });
-    }
-    const summaryValidation = validateSummary(summary);
-    if (!summaryValidation.valid) {
-        return res.status(400).json({ error: summaryValidation.reason, code: 'INVALID_SUMMARY' });
-    }
-    const tokenVerification = verifyWorkspaceToken(req, workspaceId);
-    if (!tokenVerification.valid) {
-        console.warn(`[sessions] Summary: Token verification failed for workspace ${workspaceId.substring(0, 8)}`);
-        return res.status(401).json({
-            error: 'Invalid workspace token',
-            code: 'INVALID_WORKSPACE_TOKEN',
-            hint: tokenVerification.reason,
-        });
-    }
-    try {
-        const db = getDb();
-        // Verify the session exists and belongs to this workspace
-        const existingSession = await db.select()
-            .from(agentSessions)
-            .where(eq(agentSessions.id, sessionId))
-            .limit(1);
-        if (!existingSession[0]) {
-            return res.status(404).json({ error: 'Session not found', code: 'SESSION_NOT_FOUND' });
-        }
-        if (existingSession[0].workspaceId !== workspaceId) {
-            return res.status(403).json({ error: 'Session does not belong to this workspace', code: 'SESSION_FORBIDDEN' });
-        }
-        const result = await db.insert(agentSummaries).values({
-            sessionId,
-            agentName,
-            summary,
-            createdAt: new Date(),
-        }).returning();
-        const summaryRecord = result[0];
-        if (!summaryRecord) {
-            return res.status(500).json({ error: 'Failed to create summary', code: 'CREATE_FAILED' });
-        }
-        console.log(`[sessions] Saved summary for ${agentName}: ${summary.currentTask || 'no task'}`);
-        return res.json({ summaryId: summaryRecord.id });
-    }
-    catch (err) {
-        console.error(`[sessions] Failed to save summary:`, err);
-        return res.status(500).json({ error: 'Internal server error', code: 'INTERNAL_ERROR' });
-    }
-});
-/**
- * POST /api/sessions/end
- * Mark a session as ended
- *
- * Body: {
- *   workspaceId: string,
- *   sessionId: string,
- *   endMarker: { summary?: string, completedTasks?: string[] }
- * }
- * Returns: { success: true }
- */
-sessionsRouter.post('/end', async (req, res) => {
-    const { workspaceId, sessionId, endMarker } = req.body;
-    if (!workspaceId || typeof workspaceId !== 'string') {
-        return res.status(400).json({ error: 'workspaceId is required', code: 'MISSING_WORKSPACE_ID' });
-    }
-    if (!isValidUUID(workspaceId)) {
-        return res.status(400).json({ error: 'workspaceId must be a valid UUID', code: 'INVALID_WORKSPACE_ID' });
-    }
-    if (!sessionId || typeof sessionId !== 'string') {
-        return res.status(400).json({ error: 'sessionId is required', code: 'MISSING_SESSION_ID' });
-    }
-    if (!isValidUUID(sessionId)) {
-        return res.status(400).json({ error: 'sessionId must be a valid UUID', code: 'INVALID_SESSION_ID' });
-    }
-    const tokenVerification = verifyWorkspaceToken(req, workspaceId);
-    if (!tokenVerification.valid) {
-        console.warn(`[sessions] End: Token verification failed for workspace ${workspaceId.substring(0, 8)}`);
-        return res.status(401).json({
-            error: 'Invalid workspace token',
-            code: 'INVALID_WORKSPACE_TOKEN',
-            hint: tokenVerification.reason,
-        });
-    }
-    try {
-        const db = getDb();
-        // Verify the session exists and belongs to this workspace
-        const existingSession = await db.select()
-            .from(agentSessions)
-            .where(eq(agentSessions.id, sessionId))
-            .limit(1);
-        if (!existingSession[0]) {
-            return res.status(404).json({ error: 'Session not found', code: 'SESSION_NOT_FOUND' });
-        }
-        if (existingSession[0].workspaceId !== workspaceId) {
-            return res.status(403).json({ error: 'Session does not belong to this workspace', code: 'SESSION_FORBIDDEN' });
-        }
-        await db.update(agentSessions)
-            .set({
-            status: 'ended',
-            endedAt: new Date(),
-            endMarker: endMarker || {},
-        })
-            .where(eq(agentSessions.id, sessionId));
-        console.log(`[sessions] Session ended for workspace ${workspaceId.substring(0, 8)}: ${endMarker?.summary || 'no summary'}`);
-        return res.json({ success: true });
-    }
-    catch (err) {
-        console.error(`[sessions] Failed to end session:`, err);
-        return res.status(500).json({ error: 'Internal server error', code: 'INTERNAL_ERROR' });
-    }
-});
-//# sourceMappingURL=sessions.js.map

package/packages/cloud/dist/api/teams.d.ts

@@ -1,7 +0,0 @@
-/**
- * Teams API Routes
- *
- * Manage workspace members, invitations, and roles.
- */
-export declare const teamsRouter: import("express-serve-static-core").Router;
-//# sourceMappingURL=teams.d.ts.map

package/packages/cloud/dist/api/teams.js

@@ -1,281 +0,0 @@
-/**
- * Teams API Routes
- *
- * Manage workspace members, invitations, and roles.
- */
-import { Router } from 'express';
-import { requireAuth } from './auth.js';
-import { db } from '../db/index.js';
-export const teamsRouter = Router();
-// All routes require authentication
-teamsRouter.use(requireAuth);
-/**
- * GET /api/workspaces/:workspaceId/members
- * List workspace members
- */
-teamsRouter.get('/workspaces/:workspaceId/members', async (req, res) => {
-    const userId = req.session.userId;
-    const workspaceId = req.params.workspaceId;
-    try {
-        // Check user has access to workspace
-        const canView = await db.workspaceMembers.canView(workspaceId, userId);
-        if (!canView) {
-            // Also check if user is the workspace owner (legacy single-user workspaces)
-            const workspace = await db.workspaces.findById(workspaceId);
-            if (!workspace || workspace.userId !== userId) {
-                return res.status(403).json({ error: 'Access denied' });
-            }
-        }
-        const members = await db.workspaceMembers.findByWorkspaceId(workspaceId);
-        // Fetch user info for each member
-        const membersWithUsers = await Promise.all(members.map(async (m) => {
-            const user = await db.users.findById(m.userId);
-            return {
-                id: m.id,
-                userId: m.userId,
-                role: m.role,
-                invitedAt: m.invitedAt,
-                acceptedAt: m.acceptedAt,
-                isPending: !m.acceptedAt,
-                user: user
-                    ? {
-                        githubUsername: user.githubUsername,
-                        email: user.email ?? undefined,
-                        avatarUrl: user.avatarUrl ?? undefined,
-                    }
-                    : undefined,
-            };
-        }));
-        res.json({ members: membersWithUsers });
-    }
-    catch (error) {
-        console.error('Error listing members:', error);
-        res.status(500).json({ error: 'Failed to list members' });
-    }
-});
-/**
- * POST /api/workspaces/:workspaceId/members
- * Invite a user to workspace
- */
-teamsRouter.post('/workspaces/:workspaceId/members', async (req, res) => {
-    const userId = req.session.userId;
-    const workspaceId = req.params.workspaceId;
-    const { githubUsername, role = 'member' } = req.body;
-    if (!githubUsername) {
-        return res.status(400).json({ error: 'GitHub username is required' });
-    }
-    const validRoles = ['admin', 'member', 'viewer'];
-    if (!validRoles.includes(role)) {
-        return res.status(400).json({ error: 'Invalid role. Must be admin, member, or viewer' });
-    }
-    try {
-        // Check user is owner or admin
-        const isOwner = await db.workspaceMembers.isOwner(workspaceId, userId);
-        const workspace = await db.workspaces.findById(workspaceId);
-        if (!isOwner && workspace?.userId !== userId) {
-            const membership = await db.workspaceMembers.findMembership(workspaceId, userId);
-            if (!membership || membership.role !== 'admin') {
-                return res.status(403).json({ error: 'Only owners and admins can invite members' });
-            }
-        }
-        // Check plan allows team members
-        const owner = await db.users.findById(workspace.userId);
-        if (owner?.plan !== 'team' && owner?.plan !== 'enterprise') {
-            return res.status(402).json({
-                error: 'Team members require Team or Enterprise plan',
-                upgrade: '/settings/billing',
-            });
-        }
-        // Find user by GitHub username
-        const invitee = await db.users.findByGithubUsername(githubUsername);
-        if (!invitee) {
-            return res.status(404).json({
-                error: 'User not found. They must sign up first.',
-                inviteLink: `https://agent-relay.com/invite?workspace=${workspaceId}`,
-            });
-        }
-        // Check if already a member
-        const existing = await db.workspaceMembers.findMembership(workspaceId, invitee.id);
-        if (existing) {
-            return res.status(409).json({ error: 'User is already a member' });
-        }
-        // Add member (pending acceptance)
-        const member = await db.workspaceMembers.addMember({
-            workspaceId,
-            userId: invitee.id,
-            role,
-            invitedBy: userId,
-        });
-        // TODO: Send email notification to invitee
-        res.status(201).json({
-            success: true,
-            member: {
-                id: member.id,
-                userId: member.userId,
-                role: member.role,
-                isPending: true,
-                user: {
-                    githubUsername: invitee.githubUsername,
-                    email: invitee.email,
-                    avatarUrl: invitee.avatarUrl,
-                },
-            },
-        });
-    }
-    catch (error) {
-        console.error('Error inviting member:', error);
-        res.status(500).json({ error: 'Failed to invite member' });
-    }
-});
-/**
- * PATCH /api/workspaces/:workspaceId/members/:memberId
- * Update member role
- */
-teamsRouter.patch('/workspaces/:workspaceId/members/:memberId', async (req, res) => {
-    const userId = req.session.userId;
-    const workspaceId = req.params.workspaceId;
-    const memberId = req.params.memberId;
-    const { role } = req.body;
-    const validRoles = ['admin', 'member', 'viewer'];
-    if (!validRoles.includes(role)) {
-        return res.status(400).json({ error: 'Invalid role' });
-    }
-    try {
-        // Check user is owner or admin
-        const isOwner = await db.workspaceMembers.isOwner(workspaceId, userId);
-        const workspace = await db.workspaces.findById(workspaceId);
-        if (!isOwner && workspace?.userId !== userId) {
-            return res.status(403).json({ error: 'Only owners can change roles' });
-        }
-        // Get the member to update
-        const members = await db.workspaceMembers.findByWorkspaceId(workspaceId);
-        const member = members.find((m) => m.id === memberId);
-        if (!member) {
-            return res.status(404).json({ error: 'Member not found' });
-        }
-        // Can't change owner role
-        if (member.role === 'owner') {
-            return res.status(400).json({ error: 'Cannot change owner role' });
-        }
-        await db.workspaceMembers.updateRole(workspaceId, member.userId, role);
-        res.json({ success: true, role });
-    }
-    catch (error) {
-        console.error('Error updating role:', error);
-        res.status(500).json({ error: 'Failed to update role' });
-    }
-});
-/**
- * DELETE /api/workspaces/:workspaceId/members/:memberId
- * Remove member from workspace
- */
-teamsRouter.delete('/workspaces/:workspaceId/members/:memberId', async (req, res) => {
-    const userId = req.session.userId;
-    const workspaceId = req.params.workspaceId;
-    const memberId = req.params.memberId;
-    try {
-        const members = await db.workspaceMembers.findByWorkspaceId(workspaceId);
-        const member = members.find((m) => m.id === memberId);
-        if (!member) {
-            return res.status(404).json({ error: 'Member not found' });
-        }
-        // Users can remove themselves
-        if (member.userId === userId) {
-            if (member.role === 'owner') {
-                return res.status(400).json({ error: 'Owner cannot leave. Transfer ownership first.' });
-            }
-            await db.workspaceMembers.removeMember(workspaceId, userId);
-            return res.json({ success: true });
-        }
-        // Otherwise, must be owner or admin
-        const isOwner = await db.workspaceMembers.isOwner(workspaceId, userId);
-        const workspace = await db.workspaces.findById(workspaceId);
-        if (!isOwner && workspace?.userId !== userId) {
-            const myMembership = await db.workspaceMembers.findMembership(workspaceId, userId);
-            if (!myMembership || myMembership.role !== 'admin') {
-                return res.status(403).json({ error: 'Permission denied' });
-            }
-        }
-        // Can't remove owner
-        if (member.role === 'owner') {
-            return res.status(400).json({ error: 'Cannot remove owner' });
-        }
-        await db.workspaceMembers.removeMember(workspaceId, member.userId);
-        res.json({ success: true });
-    }
-    catch (error) {
-        console.error('Error removing member:', error);
-        res.status(500).json({ error: 'Failed to remove member' });
-    }
-});
-/**
- * GET /api/invites
- * Get pending invites for current user
- */
-teamsRouter.get('/invites', async (req, res) => {
-    const userId = req.session.userId;
-    try {
-        const invites = await db.workspaceMembers.getPendingInvites(userId);
-        res.json({
-            invites: invites.map((inv) => ({
-                id: inv.id,
-                workspaceId: inv.workspaceId,
-                workspaceName: inv.workspace_name,
-                role: inv.role,
-                invitedAt: inv.invitedAt,
-                invitedBy: inv.inviter_username,
-            })),
-        });
-    }
-    catch (error) {
-        console.error('Error getting invites:', error);
-        res.status(500).json({ error: 'Failed to get invites' });
-    }
-});
-/**
- * POST /api/invites/:inviteId/accept
- * Accept workspace invitation
- */
-teamsRouter.post('/invites/:inviteId/accept', async (req, res) => {
-    const userId = req.session.userId;
-    const inviteId = req.params.inviteId;
-    try {
-        const invites = await db.workspaceMembers.getPendingInvites(userId);
-        const invite = invites.find((i) => i.id === inviteId);
-        if (!invite) {
-            return res.status(404).json({ error: 'Invite not found' });
-        }
-        await db.workspaceMembers.acceptInvite(invite.workspaceId, userId);
-        res.json({
-            success: true,
-            workspaceId: invite.workspaceId,
-            message: 'Invitation accepted',
-        });
-    }
-    catch (error) {
-        console.error('Error accepting invite:', error);
-        res.status(500).json({ error: 'Failed to accept invite' });
-    }
-});
-/**
- * POST /api/invites/:inviteId/decline
- * Decline workspace invitation
- */
-teamsRouter.post('/invites/:inviteId/decline', async (req, res) => {
-    const userId = req.session.userId;
-    const inviteId = req.params.inviteId;
-    try {
-        const invites = await db.workspaceMembers.getPendingInvites(userId);
-        const invite = invites.find((i) => i.id === inviteId);
-        if (!invite) {
-            return res.status(404).json({ error: 'Invite not found' });
-        }
-        await db.workspaceMembers.removeMember(invite.workspaceId, userId);
-        res.json({ success: true, message: 'Invitation declined' });
-    }
-    catch (error) {
-        console.error('Error declining invite:', error);
-        res.status(500).json({ error: 'Failed to decline invite' });
-    }
-});
-//# sourceMappingURL=teams.js.map

package/packages/cloud/dist/api/test-helpers.d.ts

@@ -1,10 +0,0 @@
-/**
- * Test Helper API Routes
- *
- * These endpoints are ONLY available in test/development mode.
- * They allow integration tests to create users and daemons without OAuth.
- *
- * IMPORTANT: These routes are disabled in production (NODE_ENV=production).
- */
-export declare const testHelpersRouter: import("express-serve-static-core").Router;
-//# sourceMappingURL=test-helpers.d.ts.map