agent-relay 2.0.29 → 2.0.32

package/packages/config/src/cloud-config.ts

@@ -0,0 +1,208 @@
+/**
+ * Agent Relay Cloud - Configuration
+ */
+
+export interface CloudConfig {
+  // Server
+  port: number;
+  publicUrl: string;
+  appUrl: string; // Dashboard app URL (e.g., app.agent-relay.com)
+  sessionSecret: string;
+
+  // Local dashboard URL for channel API proxying (optional)
+  // When set, channel requests are proxied to this URL instead of the workspace
+  localDashboardUrl?: string;
+
+  // Database
+  databaseUrl: string;
+  redisUrl: string;
+
+  // GitHub OAuth (user login)
+  github: {
+    clientId: string;
+    clientSecret: string;
+    webhookSecret?: string; // Optional: for verifying GitHub webhooks
+  };
+
+  // Provider OAuth (for device flow)
+  // Note: Only Google has public OAuth today. Claude/Codex use CLI-based auth.
+  providers: {
+    // Anthropic: Future OAuth support (hypothetical - requires Anthropic to implement)
+    anthropic?: { clientId: string };
+    // OpenAI: Future OAuth support (hypothetical - requires OpenAI to implement)
+    openai?: { clientId: string };
+    // Google: Has real OAuth device flow support
+    google?: { clientId: string; clientSecret: string };
+  };
+
+  // Credential vault
+  vault: {
+    masterKey: string; // 32 bytes, base64 encoded
+  };
+
+  // Compute provisioner
+  compute: {
+    provider: 'fly' | 'railway' | 'docker';
+    fly?: {
+      apiToken: string;
+      org: string;
+      region?: string;
+      workspaceDomain?: string; // e.g., ws.agent-relay.com
+      registryAuth?: {
+        username: string;
+        password: string;
+      };
+      // Volume snapshot settings
+      snapshotRetentionDays?: number; // 1-60, default 14
+      volumeSizeGb?: number; // default 10
+    };
+    railway?: {
+      apiToken: string;
+    };
+  };
+
+  // Nango OAuth management
+  nango: {
+    secretKey: string;
+    host?: string;
+  };
+
+  // Stripe billing
+  stripe: {
+    secretKey: string;
+    publishableKey: string;
+    webhookSecret: string;
+    priceIds: {
+      proMonthly?: string;
+      proYearly?: string;
+      teamMonthly?: string;
+      teamYearly?: string;
+      enterpriseMonthly?: string;
+      enterpriseYearly?: string;
+    };
+  };
+
+  // Admin users (exempt from billing, get enterprise features)
+  adminUsers: string[];
+}
+
+function requireEnv(name: string): string {
+  const value = process.env[name];
+  if (!value) {
+    throw new Error(`Missing required environment variable: ${name}`);
+  }
+  return value;
+}
+
+function optionalEnv(name: string): string | undefined {
+  return process.env[name];
+}
+
+export function loadConfig(): CloudConfig {
+  return {
+    port: parseInt(process.env.PORT || '4567', 10),
+    publicUrl: process.env.PUBLIC_URL || 'http://localhost:4567',
+    appUrl: process.env.APP_URL || process.env.PUBLIC_URL || 'http://localhost:4567',
+    sessionSecret: requireEnv('SESSION_SECRET'),
+
+    // Local dashboard for channel API (auto-detected if not set)
+    localDashboardUrl: optionalEnv('LOCAL_DASHBOARD_URL'),
+
+    databaseUrl: requireEnv('DATABASE_URL'),
+    redisUrl: process.env.REDIS_URL || 'redis://localhost:6379',
+
+    github: {
+      clientId: requireEnv('GITHUB_CLIENT_ID'),
+      clientSecret: requireEnv('GITHUB_CLIENT_SECRET'),
+      webhookSecret: optionalEnv('GITHUB_WEBHOOK_SECRET'),
+    },
+
+    providers: {
+      anthropic: optionalEnv('ANTHROPIC_CLIENT_ID')
+        ? { clientId: optionalEnv('ANTHROPIC_CLIENT_ID')! }
+        : undefined,
+      openai: optionalEnv('OPENAI_CLIENT_ID')
+        ? { clientId: optionalEnv('OPENAI_CLIENT_ID')! }
+        : undefined,
+      google:
+        optionalEnv('GOOGLE_CLIENT_ID') && optionalEnv('GOOGLE_CLIENT_SECRET')
+          ? {
+              clientId: optionalEnv('GOOGLE_CLIENT_ID')!,
+              clientSecret: optionalEnv('GOOGLE_CLIENT_SECRET')!,
+            }
+          : undefined,
+    },
+
+    vault: {
+      masterKey: requireEnv('VAULT_MASTER_KEY'),
+    },
+
+    compute: {
+      provider: (process.env.COMPUTE_PROVIDER as 'fly' | 'railway' | 'docker') || 'docker',
+      fly: optionalEnv('FLY_API_TOKEN')
+        ? {
+            apiToken: optionalEnv('FLY_API_TOKEN')!,
+            org: optionalEnv('FLY_ORG') || 'personal',
+            region: optionalEnv('FLY_REGION') || 'sjc',
+            workspaceDomain: optionalEnv('FLY_WORKSPACE_DOMAIN'),
+            registryAuth: optionalEnv('GHCR_USERNAME') && optionalEnv('GHCR_TOKEN')
+              ? {
+                  username: optionalEnv('GHCR_USERNAME')!,
+                  password: optionalEnv('GHCR_TOKEN')!,
+                }
+              : undefined,
+            snapshotRetentionDays: parseInt(optionalEnv('FLY_SNAPSHOT_RETENTION_DAYS') || '14', 10),
+            volumeSizeGb: parseInt(optionalEnv('FLY_VOLUME_SIZE_GB') || '10', 10),
+          }
+        : undefined,
+      railway: optionalEnv('RAILWAY_API_TOKEN')
+        ? {
+            apiToken: optionalEnv('RAILWAY_API_TOKEN')!,
+          }
+        : undefined,
+    },
+
+    nango: {
+      secretKey: requireEnv('NANGO_SECRET_KEY'),
+      host: optionalEnv('NANGO_HOST'),
+    },
+
+    stripe: {
+      secretKey: requireEnv('STRIPE_SECRET_KEY'),
+      publishableKey: requireEnv('STRIPE_PUBLISHABLE_KEY'),
+      webhookSecret: requireEnv('STRIPE_WEBHOOK_SECRET'),
+      priceIds: {
+        proMonthly: optionalEnv('STRIPE_PRO_MONTHLY_PRICE_ID'),
+        proYearly: optionalEnv('STRIPE_PRO_YEARLY_PRICE_ID'),
+        teamMonthly: optionalEnv('STRIPE_TEAM_MONTHLY_PRICE_ID'),
+        teamYearly: optionalEnv('STRIPE_TEAM_YEARLY_PRICE_ID'),
+        enterpriseMonthly: optionalEnv('STRIPE_ENTERPRISE_MONTHLY_PRICE_ID'),
+        enterpriseYearly: optionalEnv('STRIPE_ENTERPRISE_YEARLY_PRICE_ID'),
+      },
+    },
+
+    // Admin users - comma-separated GitHub usernames (e.g., "khaliqgant,admin2")
+    adminUsers: (optionalEnv('ADMIN_USERS') || '')
+      .split(',')
+      .map((u) => u.trim().toLowerCase())
+      .filter(Boolean),
+  };
+}
+
+/**
+ * Check if a GitHub username is an admin user
+ */
+export function isAdminUser(githubUsername: string): boolean {
+  const config = getConfig();
+  return config.adminUsers.includes(githubUsername.toLowerCase());
+}
+
+// Singleton config instance
+let _config: CloudConfig | null = null;
+
+export function getConfig(): CloudConfig {
+  if (!_config) {
+    _config = loadConfig();
+  }
+  return _config;
+}

package/packages/config/src/index.ts

@@ -0,0 +1,12 @@
+export * from './relay-config.js';
+export * from './bridge-config.js';
+export * from './bridge-utils.js';
+export * from './teams-config.js';
+export * from './shadow-config.js';
+export * from './trajectory-config.js';
+export * from './agent-config.js';
+export * from './cli-auth-config.js';
+export * from './cloud-config.js';
+export * from './project-namespace.js';
+export * from './schemas.js';
+export * from './relay-file-writer.js';

package/packages/config/src/project-namespace.ts

@@ -0,0 +1,344 @@
+/**
+ * Project Namespace Utility
+ *
+ * Generates project-specific paths for agent-relay data storage.
+ * Data is stored in .agent-relay/ within the project root directory.
+ * This allows multiple projects to use agent-relay simultaneously
+ * without conflicts, and keeps data with the project.
+ */
+
+import crypto from 'node:crypto';
+import path from 'node:path';
+import fs from 'node:fs';
+import os from 'node:os';
+
+/**
+ * Get the global base directory for agent-relay data (used for cross-project data).
+ * Priority:
+ * 1. AGENT_RELAY_DATA_DIR environment variable
+ * 2. XDG_DATA_HOME/agent-relay (Linux/macOS standard)
+ * 3. ~/.agent-relay (fallback)
+ */
+function getGlobalBaseDir(): string {
+  // Explicit override
+  if (process.env.AGENT_RELAY_DATA_DIR) {
+    return process.env.AGENT_RELAY_DATA_DIR;
+  }
+
+  // XDG Base Directory Specification
+  const xdgDataHome = process.env.XDG_DATA_HOME;
+  if (xdgDataHome) {
+    return path.join(xdgDataHome, 'agent-relay');
+  }
+
+  // Default: ~/.agent-relay
+  return path.join(os.homedir(), '.agent-relay');
+}
+
+const GLOBAL_BASE_DIR = getGlobalBaseDir();
+
+/** Directory name within project root */
+const PROJECT_DATA_DIR = '.agent-relay';
+
+/**
+ * Generate a short hash of a path for namespacing
+ */
+function hashPath(projectPath: string): string {
+  const normalized = path.resolve(projectPath);
+  const hash = crypto.createHash('sha256').update(normalized).digest('hex');
+  return hash.substring(0, 12); // First 12 chars is enough
+}
+
+/**
+ * Get the project root by looking for common markers
+ *
+ * Priority:
+ * 1. AGENT_RELAY_PROJECT environment variable (for worktrees/subprojects)
+ * 2. Find project root by looking for markers (.git, package.json, etc.)
+ */
+export function findProjectRoot(startDir: string = process.cwd()): string {
+  // Allow explicit override for worktrees and subprojects
+  if (process.env.AGENT_RELAY_PROJECT) {
+    return path.resolve(process.env.AGENT_RELAY_PROJECT);
+  }
+
+  let current = path.resolve(startDir);
+  const root = path.parse(current).root;
+
+  const markers = ['.git', 'package.json', 'Cargo.toml', 'go.mod', 'pyproject.toml', '.agent-relay'];
+
+  while (current !== root) {
+    for (const marker of markers) {
+      if (fs.existsSync(path.join(current, marker))) {
+        return current;
+      }
+    }
+    current = path.dirname(current);
+  }
+
+  // Fallback to start directory
+  return path.resolve(startDir);
+}
+
+/**
+ * Get namespaced paths for a project
+ */
+export interface ProjectPaths {
+  /** Root directory for all agent-relay data for this project */
+  dataDir: string;
+  /** Team data directory */
+  teamDir: string;
+  /** SQLite database path */
+  dbPath: string;
+  /** Unix socket path */
+  socketPath: string;
+  /** The project root that was used */
+  projectRoot: string;
+  /** Short identifier for the project */
+  projectId: string;
+}
+
+export function getProjectPaths(projectRoot?: string): ProjectPaths {
+  const root = projectRoot ?? findProjectRoot();
+  const projectId = hashPath(root);
+  // Store data in project-local .agent-relay/ directory
+  const dataDir = path.join(root, PROJECT_DATA_DIR);
+
+  return {
+    dataDir,
+    teamDir: path.join(dataDir, 'team'),
+    dbPath: path.join(dataDir, 'messages.sqlite'),
+    socketPath: path.join(dataDir, 'relay.sock'),
+    projectRoot: root,
+    projectId,
+  };
+}
+
+/**
+ * Get the default paths (for backwards compatibility or explicit global usage)
+ */
+export function getGlobalPaths(): ProjectPaths {
+  return {
+    dataDir: GLOBAL_BASE_DIR,
+    teamDir: path.join(GLOBAL_BASE_DIR, 'team'),
+    dbPath: path.join(GLOBAL_BASE_DIR, 'messages.sqlite'),
+    socketPath: path.join(GLOBAL_BASE_DIR, 'relay.sock'),
+    projectRoot: process.cwd(),
+    projectId: 'global',
+  };
+}
+
+/**
+ * Add .agent-relay/ to .git/info/exclude (local per-repo gitignore).
+ *
+ * This file is:
+ * - Per-repository (not shared across clones)
+ * - Not committed (local to each developer)
+ * - Standard git feature with no permission issues
+ * - No branch/merge complications
+ *
+ * Returns true if the exclude file was modified
+ */
+function ensureGitExclude(projectRoot: string): { modified: boolean } {
+  // Find the .git directory (could be in projectRoot or a parent for worktrees)
+  const gitDir = path.join(projectRoot, '.git');
+  const excludePath = path.join(gitDir, 'info', 'exclude');
+
+  try {
+    // Check if this is a git repository
+    if (!fs.existsSync(gitDir)) {
+      return { modified: false };
+    }
+
+    // Ensure .git/info directory exists
+    const infoDir = path.join(gitDir, 'info');
+    if (!fs.existsSync(infoDir)) {
+      fs.mkdirSync(infoDir, { recursive: true });
+    }
+
+    let content = '';
+    if (fs.existsSync(excludePath)) {
+      content = fs.readFileSync(excludePath, 'utf-8');
+      // Check if .agent-relay is already in exclude
+      const lines = content.split('\n');
+      const hasEntry = lines.some(line => {
+        const trimmed = line.trim();
+        return trimmed === '.agent-relay' || trimmed === '.agent-relay/' || trimmed === '/.agent-relay' || trimmed === '/.agent-relay/';
+      });
+      if (hasEntry) {
+        return { modified: false }; // Already present
+      }
+    }
+
+    // Add .agent-relay/ to exclude
+    const newEntry = '.agent-relay/';
+    const newContent = content.endsWith('\n') || content === ''
+      ? `${content}${newEntry}\n`
+      : `${content}\n${newEntry}\n`;
+
+    fs.writeFileSync(excludePath, newContent, 'utf-8');
+    return { modified: true };
+  } catch {
+    // Silently ignore errors (not a git repo, no write permission, etc.)
+    return { modified: false };
+  }
+}
+
+/**
+ * Ensure the project data directory exists
+ */
+export function ensureProjectDir(projectRoot?: string): ProjectPaths {
+  const paths = getProjectPaths(projectRoot);
+
+  // Auto-add to .gitignore on first creation
+  const isFirstCreation = !fs.existsSync(paths.dataDir);
+
+  if (isFirstCreation) {
+    fs.mkdirSync(paths.dataDir, { recursive: true });
+
+    // Add to .git/info/exclude (local per-repo gitignore, not committed)
+    const excludeResult = ensureGitExclude(paths.projectRoot);
+    if (excludeResult.modified) {
+      console.log('[agent-relay] Added .agent-relay/ to .git/info/exclude');
+    }
+  }
+  if (!fs.existsSync(paths.teamDir)) {
+    fs.mkdirSync(paths.teamDir, { recursive: true });
+  }
+
+  // Write a marker file with project info
+  const markerPath = path.join(paths.dataDir, '.project');
+  fs.writeFileSync(markerPath, JSON.stringify({
+    projectRoot: paths.projectRoot,
+    projectId: paths.projectId,
+    createdAt: new Date().toISOString(),
+  }, null, 2));
+
+  return paths;
+}
+
+/**
+ * List all known projects (scans global base dir for legacy data)
+ * Note: With project-local storage, this only finds projects that
+ * used the old global storage location.
+ */
+export function listProjects(): Array<{ projectId: string; projectRoot: string; dataDir: string }> {
+  if (!fs.existsSync(GLOBAL_BASE_DIR)) {
+    return [];
+  }
+
+  const projects: Array<{ projectId: string; projectRoot: string; dataDir: string }> = [];
+
+  for (const entry of fs.readdirSync(GLOBAL_BASE_DIR)) {
+    const dataDir = path.join(GLOBAL_BASE_DIR, entry);
+    const markerPath = path.join(dataDir, '.project');
+
+    if (fs.existsSync(markerPath)) {
+      try {
+        const info = JSON.parse(fs.readFileSync(markerPath, 'utf-8'));
+        projects.push({
+          projectId: entry,
+          projectRoot: info.projectRoot,
+          dataDir,
+        });
+      } catch {
+        // Invalid marker, skip
+      }
+    }
+  }
+
+  return projects;
+}
+
+/**
+ * Detect the actual workspace directory for cloud deployments.
+ *
+ * In cloud workspaces, repos are cloned to /workspace/{repo-name}.
+ * This function finds the correct working directory:
+ *
+ * Priority:
+ * 1. WORKSPACE_CWD env var (explicit override)
+ * 2. If baseDir itself is a git repo, use it
+ * 3. Scan baseDir for cloned repos - use the first one found (alphabetically)
+ * 4. Fall back to baseDir
+ *
+ * @param baseDir - The base workspace directory (e.g., /workspace)
+ * @returns The actual workspace path to use
+ */
+export function detectWorkspacePath(baseDir: string): string {
+  // 1. Explicit override
+  if (process.env.WORKSPACE_CWD) {
+    return process.env.WORKSPACE_CWD;
+  }
+
+  // 2. Check if baseDir itself is a git repo
+  if (fs.existsSync(path.join(baseDir, '.git'))) {
+    return baseDir;
+  }
+
+  // 3. Scan for cloned repos (directories with .git)
+  try {
+    const entries = fs.readdirSync(baseDir, { withFileTypes: true });
+    const repos: string[] = [];
+
+    for (const entry of entries) {
+      if (entry.isDirectory()) {
+        const repoPath = path.join(baseDir, entry.name);
+        const gitPath = path.join(repoPath, '.git');
+        if (fs.existsSync(gitPath)) {
+          repos.push(repoPath);
+        }
+      }
+    }
+
+    // Sort alphabetically for consistent behavior
+    repos.sort();
+
+    // Use the first repo found
+    if (repos.length > 0) {
+      if (repos.length > 1) {
+        console.log(`[workspace] Multiple repos found, using first: ${repos[0]} (others: ${repos.slice(1).join(', ')})`);
+      } else {
+        console.log(`[workspace] Detected repo: ${repos[0]}`);
+      }
+      return repos[0];
+    }
+  } catch (err) {
+    // Failed to scan, fall back
+    console.warn(`[workspace] Failed to scan ${baseDir}:`, err);
+  }
+
+  // 4. Fall back to baseDir
+  return baseDir;
+}
+
+/**
+ * List all git repos in a workspace directory.
+ * Useful for allowing users to select which repo to work in.
+ *
+ * @param baseDir - The base workspace directory
+ * @returns Array of repo paths
+ */
+export function listWorkspaceRepos(baseDir: string): string[] {
+  const repos: string[] = [];
+
+  try {
+    const entries = fs.readdirSync(baseDir, { withFileTypes: true });
+
+    for (const entry of entries) {
+      if (entry.isDirectory()) {
+        const repoPath = path.join(baseDir, entry.name);
+        const gitPath = path.join(repoPath, '.git');
+        if (fs.existsSync(gitPath)) {
+          repos.push(repoPath);
+        }
+      }
+    }
+
+    repos.sort();
+  } catch {
+    // Failed to scan
+  }
+
+  return repos;
+}

package/packages/config/src/relay-config.test.ts

@@ -0,0 +1,51 @@
+import { describe, it, expect } from 'vitest';
+import {
+  DEFAULT_CONNECTION_CONFIG,
+  DEFAULT_TMUX_WRAPPER_CONFIG,
+  DEFAULT_IDLE_BEFORE_INJECT_MS,
+  DEFAULT_IDLE_CONFIDENCE_THRESHOLD,
+  LOW_LATENCY_CONFIG,
+} from './relay-config.js';
+
+describe('relay-config defaults', () => {
+  it('exposes connection defaults', () => {
+    expect(DEFAULT_CONNECTION_CONFIG).toEqual({
+      maxFrameBytes: 1024 * 1024,
+      heartbeatMs: 5000,
+      heartbeatTimeoutMultiplier: 6,
+      maxWriteQueueSize: 2000,
+      writeQueueHighWaterMark: 1500,
+      writeQueueLowWaterMark: 500,
+    });
+  });
+
+  it('exposes tmux wrapper defaults with reduced latency', () => {
+    expect(DEFAULT_TMUX_WRAPPER_CONFIG).toEqual({
+      pollInterval: 150,
+      idleBeforeInjectMs: 800,
+      injectRetryMs: 300,
+      debug: false,
+      debugLogIntervalMs: 0,
+      mouseMode: true,
+      activityIdleThresholdMs: 30_000,
+      outputStabilityTimeoutMs: 800,
+      outputStabilityPollMs: 150,
+      streamLogs: true,
+    });
+  });
+
+  it('exposes idle detection defaults', () => {
+    expect(DEFAULT_IDLE_BEFORE_INJECT_MS).toBe(800);
+    expect(DEFAULT_IDLE_CONFIDENCE_THRESHOLD).toBe(0.7);
+  });
+
+  it('exposes low-latency config for time-critical messaging', () => {
+    expect(LOW_LATENCY_CONFIG).toEqual({
+      pollInterval: 100,
+      idleBeforeInjectMs: 300,
+      injectRetryMs: 200,
+      outputStabilityTimeoutMs: 300,
+      outputStabilityPollMs: 100,
+    });
+  });
+});

package/packages/config/src/relay-config.ts

@@ -0,0 +1,36 @@
+export const DEFAULT_CONNECTION_CONFIG = {
+  maxFrameBytes: 1024 * 1024,
+  heartbeatMs: 5000,
+  heartbeatTimeoutMultiplier: 6,
+  maxWriteQueueSize: 2000,
+  writeQueueHighWaterMark: 1500,
+  writeQueueLowWaterMark: 500,
+} as const;
+
+export const DEFAULT_TMUX_WRAPPER_CONFIG = {
+  pollInterval: 150,
+  idleBeforeInjectMs: 800,
+  injectRetryMs: 300,
+  debug: false,
+  debugLogIntervalMs: 0,
+  mouseMode: true,
+  activityIdleThresholdMs: 30_000,
+  outputStabilityTimeoutMs: 800,
+  outputStabilityPollMs: 150,
+  streamLogs: true,
+} as const;
+
+export const DEFAULT_IDLE_BEFORE_INJECT_MS = 800;
+export const DEFAULT_IDLE_CONFIDENCE_THRESHOLD = 0.7;
+
+/** Low-latency mode constants for time-critical messaging */
+export const LOW_LATENCY_CONFIG = {
+  pollInterval: 100,
+  idleBeforeInjectMs: 300,
+  injectRetryMs: 200,
+  outputStabilityTimeoutMs: 300,
+  outputStabilityPollMs: 100,
+} as const;
+
+/** Default Unix socket path for daemon communication */
+export const DEFAULT_SOCKET_PATH = '/tmp/agent-relay.sock';